@bongos/core 1.19.1072 → 1.19.1074

package/docs/api/openapi.json

@@ -65,14 +65,6 @@
       "name": "blockers",
       "description": "Endpoints under `/api/bongos/blockers`."
     },
-    {
-      "name": "box",
-      "description": "Endpoints under `/api/bongos/box`."
-    },
-    {
-      "name": "boxes",
-      "description": "Endpoints under `/api/bongos/boxes`."
-    },
     {
       "name": "bug-attachments",
       "description": "Endpoints under `/api/bongos/bug-attachments`."
@@ -273,6 +265,10 @@
       "name": "sso",
       "description": "Endpoints under `/api/bongos/sso`."
     },
+    {
+      "name": "store",
+      "description": "Endpoints under `/api/bongos/store`."
+    },
     {
       "name": "task-recommendations",
       "description": "Endpoints under `/api/bongos/task-recommendations`."
@@ -1206,164 +1202,6 @@
         ]
       }
     },
-    "/auth/app-pair/approve": {
-      "post": {
-        "operationId": "post_auth_app_pair_approve",
-        "tags": [
-          "auth"
-        ],
-        "summary": "POST /auth/app-pair/approve",
-        "description": "(own identity only) — approving signs the app in AS THE APPROVER. Cookie-gated exactly like /auth/cli-token/issue above: a leaked CLI bearer must not be able to approve pairings and mint itself siblings; only the httpOnly browser cookie — the click in the hall — can.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "src/bongos/routes/auth.js",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PostAuthAppPairApproveRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostAuthAppPairApproveResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/ValidationFailed"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/auth/app-pair/info": {
-      "get": {
-        "operationId": "get_auth_app_pair_info",
-        "tags": [
-          "auth"
-        ],
-        "summary": "GET /auth/app-pair/info",
-        "description": "read-only: what the approve page shows BEFORE the click (device name/platform for the given code). Unknown and expired are indistinguishable (404) so the code space can't be probed for liveness.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "src/bongos/routes/auth.js",
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetAuthAppPairInfoResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/auth/app-pair/poll": {
-      "post": {
-        "operationId": "post_auth_app_pair_poll",
-        "tags": [
-          "auth"
-        ],
-        "summary": "POST /auth/app-pair/poll",
-        "description": "poll with the secret poll_token; the token IS the bearer (mirrors /auth/device/poll, where the device_code is the bearer). Kept LAST in this router so route-rank-check's look-ahead window stays clear of any neighboring gated declaration (see the block comment above).\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "src/bongos/routes/auth.js",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PostAuthAppPairPollRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/ValidationFailed"
-          }
-        },
-        "security": []
-      }
-    },
-    "/auth/app-pair/start": {
-      "post": {
-        "operationId": "post_auth_app_pair_start",
-        "tags": [
-          "auth"
-        ],
-        "summary": "POST /auth/app-pair/start",
-        "description": "starts a pairing; returns opaque codes only, no identity.\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "src/bongos/routes/auth.js",
-        "requestBody": {
-          "required": false,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PostAuthAppPairStartRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostAuthAppPairStartResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/ValidationFailed"
-          }
-        },
-        "security": []
-      }
-    },
     "/auth/backchannel-logout": {
       "post": {
         "operationId": "post_auth_backchannel_logout",
@@ -2412,1001 +2250,41 @@
               "type": "string"
             },
             "description": "Path parameter `id`."
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PostBlockersIdLinkRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostBlockersIdLinkResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/ValidationFailed"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          },
-          "404": {
-            "$ref": "#/components/responses/NotFound"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/blockers/{id}/link/{taskId}": {
-      "delete": {
-        "operationId": "delete_blockers_id_link_taskId",
-        "tags": [
-          "blockers"
-        ],
-        "summary": "DELETE /blockers/:id/link/:taskId",
-        "description": "Unlink a blocker from a task — the inverse of /link (task 1003518). Both ids sit in the PATH, matching DELETE /tasks/:id/dependencies/:depId, the closest existing shape: an edge between two rows, removed by naming both. Post-core_223 a task is released only when its LAST open blocker resolves, so a wrong link is permanent: the only way out was to resolve a blocker that was never real, putting a falsehood in the blocker ledger to clear a bookkeeping artifact. This is the honest way out. Promotion is the TRIGGER's job here exactly as it is on /resolve: core_256 fires AFTER DELETE on task_blockers and re-uses core_223's predicate, so \"nothing open is left against this task\" has one definition, not two. blockers.unlinkBlockerFromTask only deletes and reads back what happened. `released` says whether the task actually moved, never a bare {ok:true} (task 1002559 — a write that reports success without saying what changed is how a dead loop hides). Metic+ (task 360 / ADR 0018) — same blocker-review grant as link and resolve. rank: metic+archon — unlink a blocker from a task; same blocker-review grant as link.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `blocker.review` (all required).",
-        "x-rank": "metic+archon",
-        "x-source": "modules/ideas/routes/blockers.js",
-        "x-permissions": [
-          "blocker.review"
-        ],
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string"
-            },
-            "description": "Path parameter `id`."
-          },
-          {
-            "name": "taskId",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string"
-            },
-            "description": "Path parameter `taskId`."
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/DeleteBlockersIdLinkTaskIdResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          },
-          "404": {
-            "$ref": "#/components/responses/NotFound"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/blockers/{id}/resolve": {
-      "post": {
-        "operationId": "post_blockers_id_resolve",
-        "tags": [
-          "blockers"
-        ],
-        "summary": "POST /blockers/:id/resolve",
-        "description": "Resolve. Auto-promotes any blocked tasks linked via task_blockers. Metic+ (task 360 / ADR 0018): blocker review is one of the operations C2 assigns to Metic, so this widened from archon-only to metic+archon when the three-rank model went live. Any builder can still FILE a blocker (POST /blockers above); a Xenos cannot resolve or link them. rank: metic+archon — blocker review (auto-promotes linked blocked tasks); criterion C2 / task 360 / ADR 0018.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `blocker.review` (all required).",
-        "x-rank": "metic+archon",
-        "x-source": "modules/ideas/routes/blockers.js",
-        "x-permissions": [
-          "blocker.review"
-        ],
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string"
-            },
-            "description": "Path parameter `id`."
-          }
-        ],
-        "requestBody": {
-          "required": false,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PostBlockersIdResolveRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/ValidationFailed"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          },
-          "404": {
-            "$ref": "#/components/responses/NotFound"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/box/authorized-keys": {
-      "get": {
-        "operationId": "get_box_authorized_keys",
-        "tags": [
-          "box"
-        ],
-        "summary": "GET /box/authorized-keys",
-        "description": "GET /box/authorized-keys — the box pulls its builder's authorized_keys. rank: any authenticated builder (own resource) — but the ALLOW/DENY is decided INSIDE from the caller's LIVE rank+status (boxAccess.decideSourceAccess), NOT a static requireRank, mirroring /box/source-access: a demoted/deactivated builder is 403'd and the box-side fetch empties the managed authorized_keys block on the very next cron — instant SSH-login revocation (ADR 0016 extended to login). The body is text/plain: the managed key LINES (no markers — the box wraps them). An allowed builder with no registered keys gets an empty 200 (a valid empty block). task 919: allowBoxScope — box-authorized-keys-fetch.sh (cron */10) runs box-scoped.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/box/close": {
-      "post": {
-        "operationId": "post_box_close",
-        "tags": [
-          "box"
-        ],
-        "summary": "POST /box/close",
-        "description": "POST /box/close — the builder manually requests their box be deprovisioned. rank: any authenticated builder (own resource). Enqueues a 'deprovision' intent; the control-plane runner executes it so the web tier never holds DO_API_TOKEN (trust boundary holds, same as /box/ensure). Only valid for an active box — a box that isn't running has nothing to close.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostBoxCloseResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/box/connect": {
-      "get": {
-        "operationId": "get_box_connect",
-        "tags": [
-          "box"
-        ],
-        "summary": "GET /box/connect",
-        "description": "GET /box/connect — the human/Claude-readable connect walkthrough. rank: public — no auth on purpose: a brand-new builder fetches this from a bare laptop (no token yet) to learn the one command that onboards them. It contains no secrets, only instructions + the public bootstrap URLs.\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "modules/dev-box/routes/box.js",
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          }
-        },
-        "security": []
-      }
-    },
-    "/box/connect.ps1": {
-      "get": {
-        "operationId": "get_box_connect_ps1",
-        "tags": [
-          "box"
-        ],
-        "summary": "GET /box/connect.ps1",
-        "description": "GET /box/connect.ps1 — the Windows (PowerShell) bootstrap script. rank: public — same posture as connect.sh (non-secret installer; self-auths).\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "modules/dev-box/routes/box.js",
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          }
-        },
-        "security": []
-      }
-    },
-    "/box/connect.sh": {
-      "get": {
-        "operationId": "get_box_connect_sh",
-        "tags": [
-          "box"
-        ],
-        "summary": "GET /box/connect.sh",
-        "description": "GET /box/connect.sh — the macOS/Linux bootstrap script. rank: public — non-secret installer (the rustup/nvm pattern). It does its OWN GitHub device-flow auth before it touches anything; serving it needs no auth.\n\n**Rank:** `public` — No authentication — any caller.",
-        "x-rank": "public",
-        "x-source": "modules/dev-box/routes/box.js",
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          }
-        },
-        "security": []
-      }
-    },
-    "/box/ensure": {
-      "post": {
-        "operationId": "post_box_ensure",
-        "tags": [
-          "box"
-        ],
-        "summary": "POST /box/ensure",
-        "description": "POST /box/ensure — \"make my box ready\". rank: any authenticated builder (own resource) — the ALLOW/DENY + the chosen ACTION are decided INSIDE from the caller's LIVE rank+status (boxes.decideEnsureAction), NOT a static requireRank, mirroring /box/source-access. This single call covers BOTH halves of task 701's gap: a builder with no box gets a provision queued (auto-provision), a builder whose box is parked gets a wake queued (wake-on-connect). It enqueues at most one open intent per builder; the actual DO work happens on the control plane.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostBoxEnsureResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/box/heartbeat": {
-      "post": {
-        "operationId": "post_box_heartbeat",
-        "tags": [
-          "box"
-        ],
-        "summary": "POST /box/heartbeat",
-        "description": "POST /box/heartbeat — the box reports it is alive, resetting the idle clock. rank: any authenticated builder (own resource write). Optional body: { claude_active: bool, attached: bool }. `claude_active` records whether a `claude` process is running; the idle sweep honours it as a veto, but since task 1003507 only for BOX_UNATTENDED_MAX_HOURS (a running process is not a person, and an unbounded veto pinned boxes active forever). `attached` is the human signal — a login session, an inbound SSH connection, an open browser terminal, or an attached tmux client — and stamps last_attached_at, the clock that cap is measured against. A heartbeat that omits `attached` (any box still running the pre-1003507 script) leaves the column NULL, which the sweep reads as \"no data\" and not as \"unattended\". Heartbeats without a body behave as before (last_activity_at bumped only). task 919: allowBoxScope — box-heartbeat.sh (cron */5) runs with the box-scoped session.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "requestBody": {
-          "required": false,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PostBoxHeartbeatRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostBoxHeartbeatResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/ValidationFailed"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/box/host-keys": {
-      "post": {
-        "operationId": "post_box_host_keys",
-        "tags": [
-          "box"
-        ],
-        "summary": "POST /box/host-keys",
-        "description": "POST /box/host-keys — the box publishes its own PUBLIC SSH host keys (task 1187 / idea 235). rank: any authenticated builder (own resource) — the BOX calls this as its builder via the GDS token on the box; allowBoxScope so the box-scoped baked session (ADR 0053) can reach it, exactly like box-report-terminal.sh / the heartbeat reporter. Stored ONLY for an active box (setBoxHostKeys gates on it). Served back to the owner via GET /box/me; the connect path writes them to known_hosts authoritatively (no TOFU, no keyscan race), killing the post-re-provision \"Host denied\". host_keys are PUBLIC — never a secret — but the write is validated hard (anti-injection, >=1 ed25519).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PostBoxHostKeysRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostBoxHostKeysResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/ValidationFailed"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/box/managed-settings": {
-      "get": {
-        "operationId": "get_box_managed_settings",
-        "tags": [
-          "box"
-        ],
-        "summary": "GET /box/managed-settings",
-        "description": "GET /box/managed-settings — the caller's Claude Desktop managed-settings.json. rank: any authenticated builder (own resource; non-secret — just their box hostname + the SSH identity path). Issued regardless of box state: the builder needs it on disk BEFORE the operator provisions, then connects once the box is up.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/box/me": {
-      "get": {
-        "operationId": "get_box_me",
-        "tags": [
-          "box"
-        ],
-        "summary": "GET /box/me",
-        "description": "GET /box/me — the caller's own box. rank: any authenticated builder (own resource read). Returns { box: { state:'none' } } when they have no box yet.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetBoxMeResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/box/scope": {
-      "get": {
-        "operationId": "get_box_scope",
-        "tags": [
-          "box"
-        ],
-        "summary": "GET /box/scope",
-        "description": "GET /box/scope — the credential-FREE companion to /box/source-access (BV1.R100 / goal 1000051). Answers \"what code does my box hold RIGHT NOW?\" — the resolved sparse set + the module keys of the builder's active claims — WITHOUT issuing the pull credential. The laptop app reads it to confirm \"your box now has <module> for task N\" after a pick+claim; R104's proof reads it to VERIFY the scope is minimal (excludes other modules). Same live rank+ status + lifecycle-port scope logic as source-access, so the answer can't drift from the actual checkout — it just omits the secret. Deliberately NOT gated on a live box (boxCanHoldSource): the SCOPE is metadata, so a builder can ask \"what WOULD my box hold for my current claims\" the instant they claim, before the box has even synced. The ALLOW/DENY still comes from the live rank+status (a demoted/inactive builder gets the same 403 as source-access). allowBoxScope so it works both from the laptop app (full session) and on the box (box-scoped session) — safe here precisely because no credential is returned.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/box/source-access": {
-      "get": {
-        "operationId": "get_box_source_access",
-        "tags": [
-          "box"
-        ],
-        "summary": "GET /box/source-access",
-        "description": "GET /box/source-access — the box fetches its rank-scoped clone spec + the credential to pull it (ADR 0031 §6, task 600). rank: any authenticated builder (own resource) — the ALLOW/DENY and the SCOPE are decided INSIDE from the caller's LIVE rank+status, NOT by a static requireRank: a Xenos must still get their 'starter' credential, a Metic+ gets 'full', and a below-floor / inactive builder is denied (403). This is ADR 0016 server-enforcement extended from \"writes are gated\" to \"source is gated\": the box presents the BUILDER's session, the GDS reads the live DB rank (unforgeable from the box), so a demoted/deactivated builder is cut off on their VERY NEXT fetch — the instant, credential-layer half of the offboarding clawback (the droplet teardown is the slower control-plane half via `box.js reconcile`). The credential is returned ONLY here, from the prod env (never the repo — ADR 0022), and is NEVER logged or exposed by publicBox()/the roster. task 919: allowBoxScope — one of the 4 endpoints the on-box crons call, so a box-scoped session (source='box') is permitted here. box-source-fetch.sh (cron */10).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetBoxSourceAccessResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/box/ssh-key": {
-      "get": {
-        "operationId": "get_box_ssh_key",
-        "tags": [
-          "box"
-        ],
-        "summary": "GET /box/ssh-key",
-        "description": "GET /box/ssh-key — list the caller's registered keys. rank: any builder (own).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetBoxSshKeyResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      },
-      "post": {
-        "operationId": "post_box_ssh_key",
-        "tags": [
-          "box"
-        ],
-        "summary": "POST /box/ssh-key",
-        "description": "POST /box/ssh-key — register the caller's own public SSH key. rank: any authenticated builder (own resource write). The key is validated + normalized (box-onboard.validateSshPublicKey) so nothing attacker-shaped can reach the box's authorized_keys; the audit_log middleware records the write.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PostBoxSshKeyRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostBoxSshKeyResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/ValidationFailed"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/box/ssh-key/{id}": {
-      "delete": {
-        "operationId": "delete_box_ssh_key_id",
-        "tags": [
-          "box"
-        ],
-        "summary": "DELETE /box/ssh-key/:id",
-        "description": "DELETE /box/ssh-key/:id — remove one of the caller's keys. rank: any builder (own resource; the delete is builder_id-scoped in SQL so an id from another builder cannot be removed). 404 when the id isn't the caller's.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string"
-            },
-            "description": "Path parameter `id`."
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/DeleteBoxSshKeyIdResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          },
-          "404": {
-            "$ref": "#/components/responses/NotFound"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/box/terminal": {
-      "get": {
-        "operationId": "get_box_terminal",
-        "tags": [
-          "box"
-        ],
-        "summary": "GET /box/terminal",
-        "description": "GET /box/terminal — the caller reads their box's web-terminal URL + credential (the Chromebook on-ramp, ADR 0038: ttyd behind a Cloudflare Tunnel). rank: any authenticated builder (own resource). Read-only by design: it does NOT wake a parked box (that mutation belongs to POST /box/ensure). The Chromebook flow is: POST /box/ensure → poll this until state='active' and a url appears → open the url, enter the basic-auth credential, run `claude` in the terminal. The url AND credential are returned ONLY to the box's own builder, and are null until the box's terminal reporter (box-report-terminal.sh) has published them.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetBoxTerminalResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      },
-      "post": {
-        "operationId": "post_box_terminal",
-        "tags": [
-          "box"
-        ],
-        "summary": "POST /box/terminal",
-        "description": "POST /box/terminal — the box publishes its current web-terminal URL + the per-box basic-auth credential. rank: any authenticated builder (own resource) — the BOX calls this as its builder, using the GDS token already on the box. Both are stored ONLY when the box is active (boxes.setTerminalAccess enforces this), so a stale URL/credential can never be served after a park. The URL is validated to a bounded https URL; the credential is a bounded opaque string (a secret), only ever returned to its own builder (GET /box/terminal). task 919: allowBoxScope — box-report-terminal.sh (credsync) runs box-scoped. The GET above is the builder reading from the hall, so it stays full-auth (not box-scoped).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PostBoxTerminalRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostBoxTerminalResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/ValidationFailed"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/box/version": {
-      "post": {
-        "operationId": "post_box_version",
-        "tags": [
-          "box"
-        ],
-        "summary": "POST /box/version",
-        "description": "POST /box/version — the box reports its /workspace HEAD commit so the server can flag a stale box (idea 332 / task 1316, ADR 0072). Body: { sha: \"<40-hex>\", committed_at: \"<ISO date>\" } rank: any-builder — own resource (the box reports its OWN code). task 919 pattern: allowBoxScope so the on-box cron (box-report-version.sh, box-scoped session) can call it, exactly like /box/host-keys + /box/heartbeat. Non-secret.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PostBoxVersionRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostBoxVersionResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/ValidationFailed"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/box/widen": {
-      "get": {
-        "operationId": "get_box_widen",
-        "tags": [
-          "box"
-        ],
-        "summary": "GET /box/widen",
-        "description": "GET /box/widen — the caller's own recorded widen set (task 1003087). rank: any authenticated builder, own resource. Reports what is STORED plus what is currently ADMITTED, because those differ whenever a request sits outside the builder's rank scope — showing only the stored list would let a Xenos believe a widen took effect that the fetch quietly drops.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetBoxWidenResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      },
-      "post": {
-        "operationId": "post_box_widen",
-        "tags": [
-          "box"
-        ],
-        "summary": "POST /box/widen",
-        "description": "POST /box/widen — record extra sparse-checkout directories that must SURVIVE the */10 source-fetch (task 1003087, idea 1000793). rank: any authenticated builder, OWN box (builder_id-scoped in SQL, so no id from the body can point this at someone else's box). Deliberately NOT allowBoxScope. The on-box crons read source-access with a box-scoped session (ADR 0053); this is a WRITE that changes what the box pulls forever after, so it takes the builder's own session — the same posture that keeps a stolen box token from re-scoping the checkout it was stolen from. add/remove are applied to the stored set and the result is re-normalized, so the endpoint is idempotent: widening twice is not an error, and neither is removing something that was never there. A path outside the caller's rank scope is ACCEPTED into storage but reported in `ignored` rather than refused. That is the honest shape: rank can change, and a builder promoted to Metic should find the widen they asked for as a Xenos simply start working, instead of having been silently discarded months earlier. What it can never do is take effect early — admissibleWidenPaths is re-evaluated against the LIVE rank on every single fetch.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
-        "x-rank": "any-builder",
-        "x-source": "modules/dev-box/routes/box.js",
-        "requestBody": {
-          "required": false,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PostBoxWidenRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostBoxWidenResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/ValidationFailed"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/boxes": {
-      "get": {
-        "operationId": "get_boxes",
-        "tags": [
-          "boxes"
-        ],
-        "summary": "GET /boxes",
-        "description": "GET /boxes — full roster across all builders. rank: archon (exposes every builder's box + IP + cost; same gate as the rest of roster management).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `box.fleet.manage` (all required).",
-        "x-rank": "metic+archon",
-        "x-source": "modules/dev-box/routes/box.js",
-        "x-permissions": [
-          "box.fleet.manage"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/GetBoxesResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/boxes/cost-ledger": {
-      "get": {
-        "operationId": "get_boxes_cost_ledger",
-        "tags": [
-          "boxes"
-        ],
-        "summary": "GET /boxes/cost-ledger",
-        "description": "GET /boxes/cost-ledger — the full per-builder container-cost ledger + totals (task 602). rank: archon — cost oversight across every builder without a DB query. Declared among the archon routes (archon-first) so the route-rank auditor's 20-line lookahead classifies it correctly.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `box.fleet.manage` (all required).",
-        "x-rank": "metic+archon",
-        "x-source": "modules/dev-box/routes/box.js",
-        "x-permissions": [
-          "box.fleet.manage"
+          }
         ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostBlockersIdLinkRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
         "responses": {
           "200": {
-            "description": "Success."
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostBlockersIdLinkResponse"
+                }
+              }
+            }
           },
           "400": {
-            "$ref": "#/components/responses/BadRequest"
+            "$ref": "#/components/responses/ValidationFailed"
           },
           "401": {
             "$ref": "#/components/responses/Unauthorized"
           },
           "403": {
             "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
           }
         },
         "security": [
@@ -3416,54 +2294,52 @@
         ]
       }
     },
-    "/boxes/{builderId}/block": {
-      "patch": {
-        "operationId": "patch_boxes_builderId_block",
+    "/blockers/{id}/link/{taskId}": {
+      "delete": {
+        "operationId": "delete_blockers_id_link_taskId",
         "tags": [
-          "boxes"
+          "blockers"
         ],
-        "summary": "PATCH /boxes/:builderId/block",
-        "description": "PATCH /boxes/:builderId/block — Archon bars (or un-bars) a builder from OPENING dev boxes (idea 257 / task 1163; migration 104). Body: { blocked: bool (required), reason?: string, // recorded on block; shown back to the builder close_current?: bool } // on block, ALSO deprovision a running box Block alone is \"no new opens\" (decideEnsureAction → BOX_PROVISION_BLOCKED); it does NOT touch a box that is already active. close_current adds the explicit teardown the owner asked be optional (\"options for both\"). rank: archon. Archon-first ordering (see above).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `box.fleet.manage` (all required).",
+        "summary": "DELETE /blockers/:id/link/:taskId",
+        "description": "Unlink a blocker from a task — the inverse of /link (task 1003518). Both ids sit in the PATH, matching DELETE /tasks/:id/dependencies/:depId, the closest existing shape: an edge between two rows, removed by naming both. Post-core_223 a task is released only when its LAST open blocker resolves, so a wrong link is permanent: the only way out was to resolve a blocker that was never real, putting a falsehood in the blocker ledger to clear a bookkeeping artifact. This is the honest way out. Promotion is the TRIGGER's job here exactly as it is on /resolve: core_256 fires AFTER DELETE on task_blockers and re-uses core_223's predicate, so \"nothing open is left against this task\" has one definition, not two. blockers.unlinkBlockerFromTask only deletes and reads back what happened. `released` says whether the task actually moved, never a bare {ok:true} (task 1002559 — a write that reports success without saying what changed is how a dead loop hides). Metic+ (task 360 / ADR 0018) — same blocker-review grant as link and resolve. rank: metic+archon — unlink a blocker from a task; same blocker-review grant as link.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `blocker.review` (all required).",
         "x-rank": "metic+archon",
-        "x-source": "modules/dev-box/routes/box.js",
+        "x-source": "modules/ideas/routes/blockers.js",
         "x-permissions": [
-          "box.fleet.manage"
+          "blocker.review"
         ],
         "parameters": [
           {
-            "name": "builderId",
+            "name": "id",
             "in": "path",
             "required": true,
             "schema": {
               "type": "string"
             },
-            "description": "Path parameter `builderId`."
+            "description": "Path parameter `id`."
+          },
+          {
+            "name": "taskId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `taskId`."
           }
         ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PatchBoxesBuilderIdBlockRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
         "responses": {
           "200": {
             "description": "Success.",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/PatchBoxesBuilderIdBlockResponse"
+                  "$ref": "#/components/schemas/DeleteBlockersIdLinkTaskIdResponse"
                 }
               }
             }
           },
           "400": {
-            "$ref": "#/components/responses/ValidationFailed"
+            "$ref": "#/components/responses/BadRequest"
           },
           "401": {
             "$ref": "#/components/responses/Unauthorized"
@@ -3482,43 +2358,47 @@
         ]
       }
     },
-    "/boxes/{builderId}/close": {
+    "/blockers/{id}/resolve": {
       "post": {
-        "operationId": "post_boxes_builderId_close",
+        "operationId": "post_blockers_id_resolve",
         "tags": [
-          "boxes"
+          "blockers"
         ],
-        "summary": "POST /boxes/:builderId/close",
-        "description": "POST /boxes/:builderId/close — Archon force-closes ANY builder's box (idea 257 / task 1163). Trust-safe by the same mechanism as the builder's own POST /box/close: it ENQUEUES a 'deprovision' intent and the control-plane runner executes it, so the web tier never holds DO_API_TOKEN (ADR 0031 §9.4). rank: archon (acts on another builder's paid infrastructure). Declared among the archon routes (archon-first) so the route-rank auditor's 20-line lookahead classifies it correctly.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `box.fleet.manage` (all required).",
+        "summary": "POST /blockers/:id/resolve",
+        "description": "Resolve. Auto-promotes any blocked tasks linked via task_blockers. Metic+ (task 360 / ADR 0018): blocker review is one of the operations C2 assigns to Metic, so this widened from archon-only to metic+archon when the three-rank model went live. Any builder can still FILE a blocker (POST /blockers above); a Xenos cannot resolve or link them. rank: metic+archon — blocker review (auto-promotes linked blocked tasks); criterion C2 / task 360 / ADR 0018.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `blocker.review` (all required).",
         "x-rank": "metic+archon",
-        "x-source": "modules/dev-box/routes/box.js",
+        "x-source": "modules/ideas/routes/blockers.js",
         "x-permissions": [
-          "box.fleet.manage"
+          "blocker.review"
         ],
         "parameters": [
           {
-            "name": "builderId",
+            "name": "id",
             "in": "path",
             "required": true,
             "schema": {
               "type": "string"
             },
-            "description": "Path parameter `builderId`."
+            "description": "Path parameter `id`."
           }
         ],
-        "responses": {
-          "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostBoxesBuilderIdCloseResponse"
-                }
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostBlockersIdResolveRequest"
               }
             }
           },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
           "400": {
-            "$ref": "#/components/responses/BadRequest"
+            "$ref": "#/components/responses/ValidationFailed"
           },
           "401": {
             "$ref": "#/components/responses/Unauthorized"
@@ -3969,7 +2849,7 @@
           "builders"
         ],
         "summary": "GET /builders/:id/profile",
-        "description": "GET /builders/:id/profile — the viewable builder profile page's read (task 1467, goal 25 \"bx-identity\"). Returns ONE builder's public portfolio: identity + rank + economy counters + shipped-work count + recent ships + unlocked achievements. Backs the shareable /builders/profile page. rank: public — every field returned here is ALREADY world-readable: the leaderboard (GET /public/leaderboard, no auth) exposes rank, total_credits, karma, and the top achievement ids; GET /builders/:id/onboarding is likewise an unauthenticated roster-visible read. This route is a per-builder re- presentation of the SAME already-public data, so a portfolio link is shareable without a sign-in wall (that IS the feature). It deliberately WHITELISTS the public column subset off the full builder row — the private columns getBuilderById also returns (anthropic_email / anthropic_user_id / monthly_budget_usd / system_role / box_blocked*) are NEVER spread into the JSON. A leak-prevention unit test (tests/profile_route.mjs) asserts their absence + the 404-on-unknown-id behaviour. THROTTLED since task 1002804. The global limiter meters WRITES only (rateLimitMiddleware returns early for GET) and the public read limiter is mounted under /public/*, which this is not — so this route answered at line rate. That was tolerable while it re-presented leaderboard data; it is not now that it also carries `handle`, because an id walk then yields the builder → canonical-profile-handle map in one call per builder. modules/platform-identity/routes/public-profile.js caps /profiles/:handle for exactly that mapping, so the two routes that publish it get the same ceiling. The EXISTING shared /public/* budget (120/60s per IP), not a new one — ADR 0209's rule that routes answering one question spend one budget.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "GET /builders/:id/profile — the viewable builder profile page's read (task 1467, goal 25 \"bx-identity\"). Returns ONE builder's public portfolio: identity + rank + economy counters + shipped-work count + recent ships + unlocked achievements. Backs the shareable /builders/profile page. rank: public — every field returned here is ALREADY world-readable: the leaderboard (GET /public/leaderboard, no auth) exposes rank, total_credits, karma, and the top achievement ids; GET /builders/:id/onboarding is likewise an unauthenticated roster-visible read. This route is a per-builder re- presentation of the SAME already-public data, so a portfolio link is shareable without a sign-in wall (that IS the feature). It deliberately WHITELISTS the public column subset off the full builder row — the private columns getBuilderById also returns (anthropic_email / anthropic_user_id / monthly_budget_usd / system_role) are NEVER spread into the JSON. A leak-prevention unit test (tests/profile_route.mjs) asserts their absence + the 404-on-unknown-id behaviour. THROTTLED since task 1002804. The global limiter meters WRITES only (rateLimitMiddleware returns early for GET) and the public read limiter is mounted under /public/*, which this is not — so this route answered at line rate. That was tolerable while it re-presented leaderboard data; it is not now that it also carries `handle`, because an id walk then yields the builder → canonical-profile-handle map in one call per builder. modules/platform-identity/routes/public-profile.js caps /profiles/:handle for exactly that mapping, so the two routes that publish it get the same ceiling. The EXISTING shared /public/* budget (120/60s per IP), not a new one — ADR 0209's rule that routes answering one question spend one budget.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/builders.js",
         "parameters": [
@@ -18811,6 +17691,74 @@
         "security": []
       }
     },
+    "/store/modules/{key}/versions": {
+      "post": {
+        "operationId": "post_store_modules_key_versions",
+        "tags": [
+          "store"
+        ],
+        "summary": "POST /store/modules/:key/versions",
+        "description": "POST /api/bongos/store/modules/:key/versions — publish one module version to the store (task 1004271, ADR 0338 D1). Body: the gzip tarball `bongos module publish` builds (scripts/gds/module-artifact.js), sent as application/gzip. The route trusts nothing but the bytes: it recomputes every hash, re-runs the publish denylist and validates module.json itself (verifyModuleArtifact), then keeps the tarball on the control plane's disk and INSERTs the version row in one transaction (module-store.js). A key's first publish makes the caller its author; after that only the author may publish, a delisted key takes nothing new, and a version is published once and never changed. rank: metic+archon — it puts code in a shared store other instances install from. Gate: requirePermission('module.submit') — the atom that already guards filing a module into a shared queue; a dedicated `module.publish` atom is a follow-up once who-may-sell is decided.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.submit` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "src/bongos/routes/modules.js",
+        "x-permissions": [
+          "module.submit"
+        ],
+        "parameters": [
+          {
+            "name": "key",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `key`."
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "additionalProperties": true
+              }
+            }
+          },
+          "x-validated": false,
+          "x-body-undocumented": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostStoreModulesKeyVersionsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/task-recommendations": {
       "post": {
         "operationId": "post_task_recommendations",
@@ -19465,7 +18413,7 @@
           "tasks"
         ],
         "summary": "POST /tasks/:id/attest-gate",
-        "description": "POST /tasks/:id/attest-gate — body: { head_sha }. The LAPTOP ci-land analogue of the publish-branch attestation (task 1169). ship.js's local push path (pushVia 'local') pushes the branch + opens the PR with its OWN gh credential but CANNOT forge the trustless gate-author-trust commit status — only the server can (it holds req.builder's server-resolved rank). Without this, an ENFORCING ADR-0058 gate-review BLOCKS a Metic+ author's gate-surface PR shipped from a laptop and they can't self-approve their own PR (hit live on task 1162 / PR task 131). AUTH mirrors publish-branch EXACTLY: requireBuilder + gateTaskOwnership, and deliberately NOT allowBoxScope (a box-scoped session 403s — it must reauth). The attestation power is bounded: gate-author-trust clears a NEEDS_TRUST surface for a Metic+ author only and NEVER the hard floor (which always needs an owner review), so a Metic+ vouching for their own task's head stays within their tier.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /tasks/:id/attest-gate — body: { head_sha }. The LAPTOP ci-land analogue of the publish-branch attestation (task 1169). ship.js's local push path (pushVia 'local') pushes the branch + opens the PR with its OWN gh credential but CANNOT forge the trustless gate-author-trust commit status — only the server can (it holds req.builder's server-resolved rank). Without this, an ENFORCING ADR-0058 gate-review BLOCKS a Metic+ author's gate-surface PR shipped from a laptop and they can't self-approve their own PR (hit live on task 1162 / PR task 131). AUTH mirrors publish-branch EXACTLY: requireBuilder + gateTaskOwnership. The attestation power is bounded: gate-author-trust clears a NEEDS_TRUST surface for a Metic+ author only and NEVER the hard floor (which always needs an owner review), so a Metic+ vouching for their own task's head stays within their tier.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/lifecycle/routes/tasks.js",
         "parameters": [
@@ -21420,19 +20368,6 @@
           "released"
         ]
       },
-      "DeleteBoxSshKeyIdResponse": {
-        "type": "object",
-        "properties": {
-          "ok": {
-            "type": "boolean"
-          },
-          "deleted": {}
-        },
-        "required": [
-          "ok",
-          "deleted"
-        ]
-      },
       "DeleteConnectionsIdResponse": {
         "type": "object",
         "properties": {
@@ -21768,21 +20703,6 @@
           "page"
         ]
       },
-      "GetAuthAppPairInfoResponse": {
-        "type": "object",
-        "properties": {
-          "pair_code": {},
-          "device_name": {},
-          "platform": {},
-          "status": {}
-        },
-        "required": [
-          "pair_code",
-          "device_name",
-          "platform",
-          "status"
-        ]
-      },
       "GetAuthWebAdmissionStatusResponse": {
         "type": "object",
         "properties": {
@@ -21857,98 +20777,6 @@
           "page"
         ]
       },
-      "GetBoxMeResponse": {
-        "type": "object",
-        "properties": {
-          "box": {},
-          "open_intent": {},
-          "cost": {}
-        },
-        "required": [
-          "box",
-          "open_intent",
-          "cost"
-        ]
-      },
-      "GetBoxSourceAccessResponse": {
-        "type": "object",
-        "properties": {
-          "scope": {},
-          "mode": {},
-          "sparse_paths": {},
-          "repo_url": {},
-          "credential": {},
-          "configured": {},
-          "separate_starter_repo": {},
-          "expires_at": {},
-          "ttl_seconds": {},
-          "guidance": {}
-        },
-        "required": [
-          "scope",
-          "mode",
-          "sparse_paths",
-          "repo_url",
-          "credential",
-          "configured",
-          "separate_starter_repo",
-          "expires_at",
-          "ttl_seconds",
-          "guidance"
-        ]
-      },
-      "GetBoxSshKeyResponse": {
-        "type": "object",
-        "properties": {
-          "keys": {}
-        },
-        "required": [
-          "keys"
-        ]
-      },
-      "GetBoxTerminalResponse": {
-        "type": "object",
-        "properties": {
-          "state": {},
-          "url": {},
-          "credential": {},
-          "hint": {},
-          "warming_up": {
-            "type": "boolean"
-          },
-          "terminal_at": {}
-        },
-        "required": [
-          "state",
-          "url",
-          "credential",
-          "hint"
-        ]
-      },
-      "GetBoxWidenResponse": {
-        "type": "object",
-        "properties": {
-          "widen_paths": {},
-          "admitted": {},
-          "ignored": {},
-          "max": {}
-        },
-        "required": [
-          "widen_paths",
-          "admitted",
-          "ignored",
-          "max"
-        ]
-      },
-      "GetBoxesResponse": {
-        "type": "object",
-        "properties": {
-          "boxes": {}
-        },
-        "required": [
-          "boxes"
-        ]
-      },
       "GetBuildersDirectoryResponse": {
         "type": "object",
         "properties": {
@@ -23676,69 +22504,35 @@
         "required": [
           "status"
         ],
-        "additionalProperties": false
-      },
-      "PatchAccessRequestsIdResponse": {
-        "type": "object",
-        "properties": {
-          "ok": {
-            "type": "boolean"
-          },
-          "request": {},
-          "unchanged": {
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "ok",
-          "request"
-        ]
-      },
-      "PatchAgentsNameResponse": {
-        "type": "object",
-        "properties": {
-          "ok": {
-            "type": "boolean"
-          },
-          "agent": {}
-        },
-        "required": [
-          "ok",
-          "agent"
-        ]
+        "additionalProperties": false
       },
-      "PatchBoxesBuilderIdBlockRequest": {
+      "PatchAccessRequestsIdResponse": {
         "type": "object",
         "properties": {
-          "blocked": {
+          "ok": {
             "type": "boolean"
           },
-          "reason": {
-            "type": "string",
-            "maxLength": 500
-          },
-          "close_current": {
+          "request": {},
+          "unchanged": {
             "type": "boolean"
           }
         },
         "required": [
-          "blocked"
-        ],
-        "additionalProperties": false
+          "ok",
+          "request"
+        ]
       },
-      "PatchBoxesBuilderIdBlockResponse": {
+      "PatchAgentsNameResponse": {
         "type": "object",
         "properties": {
           "ok": {
             "type": "boolean"
           },
-          "blocked": {},
-          "close_queued": {}
+          "agent": {}
         },
         "required": [
           "ok",
-          "blocked",
-          "close_queued"
+          "agent"
         ]
       },
       "PatchBuildersIdBudgetRequest": {
@@ -24604,76 +23398,6 @@
           "agent"
         ]
       },
-      "PostAuthAppPairApproveRequest": {
-        "type": "object",
-        "properties": {
-          "pair_code": {
-            "type": "string",
-            "maxLength": 32
-          }
-        },
-        "required": [
-          "pair_code"
-        ],
-        "additionalProperties": false
-      },
-      "PostAuthAppPairApproveResponse": {
-        "type": "object",
-        "properties": {
-          "ok": {
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "ok"
-        ]
-      },
-      "PostAuthAppPairPollRequest": {
-        "type": "object",
-        "properties": {
-          "poll_token": {
-            "type": "string",
-            "maxLength": 128
-          }
-        },
-        "required": [
-          "poll_token"
-        ],
-        "additionalProperties": false
-      },
-      "PostAuthAppPairStartRequest": {
-        "type": "object",
-        "properties": {
-          "device_name": {
-            "type": "string",
-            "maxLength": 80
-          },
-          "platform": {
-            "type": "string",
-            "maxLength": 20
-          }
-        },
-        "additionalProperties": false
-      },
-      "PostAuthAppPairStartResponse": {
-        "type": "object",
-        "properties": {
-          "pair_code": {},
-          "poll_token": {},
-          "verify_path": {},
-          "verify_url": {},
-          "expires_in": {},
-          "interval": {}
-        },
-        "required": [
-          "pair_code",
-          "poll_token",
-          "verify_path",
-          "verify_url",
-          "expires_in",
-          "interval"
-        ]
-      },
       "PostAuthBackchannelLogoutRequest": {
         "type": "object",
         "properties": {
@@ -24999,235 +23723,6 @@
           "blocker": {}
         }
       },
-      "PostBoxCloseResponse": {
-        "type": "object",
-        "properties": {
-          "ok": {
-            "type": "boolean"
-          },
-          "queued": {},
-          "action": {},
-          "message": {}
-        },
-        "required": [
-          "ok",
-          "queued",
-          "action",
-          "message"
-        ]
-      },
-      "PostBoxEnsureResponse": {
-        "type": "object",
-        "properties": {
-          "state": {},
-          "action": {},
-          "queued": {
-            "type": "boolean"
-          },
-          "intent": {}
-        },
-        "required": [
-          "state",
-          "action",
-          "queued"
-        ]
-      },
-      "PostBoxHeartbeatRequest": {
-        "type": "object",
-        "properties": {
-          "claude_active": {
-            "type": "boolean"
-          },
-          "attached": {
-            "type": "boolean"
-          }
-        },
-        "additionalProperties": true
-      },
-      "PostBoxHeartbeatResponse": {
-        "type": "object",
-        "properties": {
-          "ok": {
-            "type": "boolean"
-          },
-          "state": {}
-        },
-        "required": [
-          "ok",
-          "state"
-        ]
-      },
-      "PostBoxHostKeysRequest": {
-        "type": "object",
-        "properties": {
-          "host_keys": {
-            "type": "string",
-            "maxLength": 4096
-          }
-        },
-        "required": [
-          "host_keys"
-        ],
-        "additionalProperties": false
-      },
-      "PostBoxHostKeysResponse": {
-        "type": "object",
-        "properties": {
-          "ok": {
-            "type": "boolean"
-          },
-          "state": {},
-          "count": {}
-        },
-        "required": [
-          "ok",
-          "state",
-          "count"
-        ]
-      },
-      "PostBoxSshKeyRequest": {
-        "type": "object",
-        "properties": {
-          "public_key": {
-            "type": "string",
-            "maxLength": 20000
-          },
-          "label": {
-            "type": "string",
-            "maxLength": 64
-          }
-        },
-        "required": [
-          "public_key"
-        ],
-        "additionalProperties": false
-      },
-      "PostBoxSshKeyResponse": {
-        "type": "object",
-        "properties": {
-          "ok": {
-            "type": "boolean"
-          },
-          "key": {}
-        },
-        "required": [
-          "ok",
-          "key"
-        ]
-      },
-      "PostBoxTerminalRequest": {
-        "type": "object",
-        "properties": {
-          "url": {
-            "type": "string",
-            "maxLength": 2048
-          },
-          "credential": {
-            "type": "string",
-            "maxLength": 512
-          }
-        },
-        "required": [
-          "url"
-        ],
-        "additionalProperties": false
-      },
-      "PostBoxTerminalResponse": {
-        "type": "object",
-        "properties": {
-          "ok": {
-            "type": "boolean"
-          },
-          "state": {}
-        },
-        "required": [
-          "ok",
-          "state"
-        ]
-      },
-      "PostBoxVersionRequest": {
-        "type": "object",
-        "properties": {
-          "sha": {
-            "type": "string",
-            "maxLength": 64
-          },
-          "committed_at": {
-            "type": "string",
-            "maxLength": 64
-          }
-        },
-        "required": [
-          "sha"
-        ],
-        "additionalProperties": false
-      },
-      "PostBoxVersionResponse": {
-        "type": "object",
-        "properties": {
-          "ok": {
-            "type": "boolean"
-          },
-          "state": {}
-        },
-        "required": [
-          "ok",
-          "state"
-        ]
-      },
-      "PostBoxWidenRequest": {
-        "type": "object",
-        "properties": {
-          "add": {
-            "type": "array"
-          },
-          "remove": {
-            "type": "array"
-          },
-          "clear": {
-            "type": "boolean"
-          }
-        },
-        "additionalProperties": false
-      },
-      "PostBoxWidenResponse": {
-        "type": "object",
-        "properties": {
-          "ok": {
-            "type": "boolean"
-          },
-          "widen_paths": {},
-          "admitted": {},
-          "ignored": {},
-          "max": {}
-        },
-        "required": [
-          "ok",
-          "widen_paths",
-          "admitted",
-          "ignored",
-          "max"
-        ]
-      },
-      "PostBoxesBuilderIdCloseResponse": {
-        "type": "object",
-        "properties": {
-          "ok": {
-            "type": "boolean"
-          },
-          "queued": {},
-          "action": {},
-          "state": {},
-          "message": {}
-        },
-        "required": [
-          "ok",
-          "queued",
-          "action",
-          "state",
-          "message"
-        ]
-      },
       "PostClaimsBatchReleaseRequest": {
         "type": "object",
         "properties": {
@@ -28339,6 +26834,21 @@
           "avatar_url"
         ]
       },
+      "PostStoreModulesKeyVersionsResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "created_module": {},
+          "version": {}
+        },
+        "required": [
+          "ok",
+          "created_module",
+          "version"
+        ]
+      },
       "PostTaskRecommendationsRequest": {
         "type": "object",
         "properties": {
@@ -29206,9 +27716,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 460,
-  "x-schema-count": 495,
-  "x-undocumented-bodies": 10,
-  "x-response-schemas": 338,
+  "x-endpoint-count": 433,
+  "x-schema-count": 466,
+  "x-undocumented-bodies": 11,
+  "x-response-schemas": 319,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }