@bongos/core 1.19.1075 → 1.19.1076

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1075",
-  "core_contract": "1.19.1075",
-  "source_commit": "529814b824836e4a2c41c6d7289d386e9e8f28e1",
+  "core_version": "1.19.1076",
+  "core_contract": "1.19.1076",
+  "source_commit": "4135e4def362d39393077ddfeb1d1dc1a9051388",
   "source_ref": "HEAD",
-  "built_at": "2026-09-29T02:22:00.773Z",
+  "built_at": "2026-09-29T04:46:26.745Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 549,
+    "docs_redacted": 550,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2533,
+    "functional_verbatim": 2529,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3108,
-  "tree_sha256": "c162c3bb6796c8f809371fcb1d81bb2c724fdd8c4954d3a6f3357e18eee133d4",
+  "file_count": 3105,
+  "tree_sha256": "9e3b295c6b90f3d06b78b0ba7c1ba67b736ff026e40d259c30ac405836f3df3e",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -37,7 +37,7 @@
     {
       "path": ".claude/skills/blocker-solve/SKILL.md",
       "mode": "0000644",
-      "sha256": "48a6a81b4009c5c217a30362c7d732f4ad044ea06e36f0ddd6f9ce0da1300a79"
+      "sha256": "cec66fc2958b538c94d7bc7d7811cf849f005ed8bbfd3b3c6040082f6524e1e0"
     },
     {
       "path": ".claude/skills/bug-triage/SKILL.md",
@@ -312,7 +312,7 @@
     {
       "path": "README.md",
       "mode": "0000644",
-      "sha256": "9d0a14555c9c5c3da120c84ecaa7f09489d8e6d329db50b0d2adab8097dd7061"
+      "sha256": "74e177ab9a2b3a6c2e2de5fdac803944053c249d9e5ad794a838e2cbc497d848"
     },
     {
       "path": "bin/bongos.js",
@@ -557,7 +557,7 @@
     {
       "path": "docs/adr/0031-cloud-dev-environments-for-builders.md",
       "mode": "0000644",
-      "sha256": "a1cfb17aab585d47d920ade899ef293e69b7d45f6c171d983b425a721a87a4bf"
+      "sha256": "f48cf9b651d31a4866417400288c302f12811524b0001c31c70740b71639d31c"
     },
     {
       "path": "docs/adr/0032-discord-mirror-of-gds.md",
@@ -577,7 +577,7 @@
     {
       "path": "docs/adr/0035-builder-onboarding-three-paths.md",
       "mode": "0000644",
-      "sha256": "eefc4f6a5d9090c853bcb45d03e1b5fb410910a003b08331dbf16a3d50836e80"
+      "sha256": "e527a73f9f8092d1751a5d6d5afdab447f70c372eedde4b9f3d5ac6195dfe924"
     },
     {
       "path": "docs/adr/0036-builders-subdomain-and-ui-reorg.md",
@@ -627,17 +627,17 @@
     {
       "path": "docs/adr/0044-per-box-live-game-preview.md",
       "mode": "0000644",
-      "sha256": "c970de07c04d74a41d8af8f33bbd61e0c53fd8fcbe3cbb781080974dbee8ef4e"
+      "sha256": "4c67db1d5ebcedfcf75ab55d0485f1fea11b7ab8ff2495d17792defc577128e6"
     },
     {
       "path": "docs/adr/0045-devbox-desktop-app.md",
       "mode": "0000644",
-      "sha256": "9d4d14b7b505bafee6fec97f2d55fd6000915d97c1b6a0a0a75535aa5c65d3ef"
+      "sha256": "b3d2258d366be28ad385170a273c5ea8e720bbe3451872c854acc750fa23e1ba"
     },
     {
       "path": "docs/adr/0046-sandbox-first-review-gate.md",
       "mode": "0000644",
-      "sha256": "4c08d726f39b58ae91af6828b1732e9dd1de931d21cfe4c46f79936ac2de70be"
+      "sha256": "a69a9eb920aa7143123aab538d1d3e7cd574335fbcb9434af5a53cbead28343b"
     },
     {
       "path": "docs/adr/0047-discord-bugs-intake-anti-abuse.md",
@@ -667,12 +667,12 @@
     {
       "path": "docs/adr/0052-sandbox-for-everyone-game-only-preview.md",
       "mode": "0000644",
-      "sha256": "517d6e267898a38ab4e602c37c58fadfb5ee9b36cb25b4d7ce12f7f01a75e82f"
+      "sha256": "02cb445ce8d8a1ac73584bfd1032541ff8066e54293ed157c7a05f52ab1349ce"
     },
     {
       "path": "docs/adr/0053-scoped-dev-box-session.md",
       "mode": "0000644",
-      "sha256": "4957a33dc145dfa7af8dd212de0aaea1fd14319f1557e137fbbf5c9b38ae5251"
+      "sha256": "7e43300c05a6a66daf5b2555fb36badbe1a21a10678cdabde71e9af342920fc8"
     },
     {
       "path": "docs/adr/0054-session-token-reward-cost-plus.md",
@@ -682,7 +682,7 @@
     {
       "path": "docs/adr/0055-server-mediated-branch-publish.md",
       "mode": "0000644",
-      "sha256": "09b32b0cf2f01db37797c6f99262b37dd5be51a47a57cb5005c49e9058c06c81"
+      "sha256": "72e805997246e7cae9a839ef589e45bc4a60b4c7fbe996111e2a15cf9a94ac83"
     },
     {
       "path": "docs/adr/0056-prod-deploy-script-mirror-and-healthcheck-retry.md",
@@ -692,7 +692,7 @@
     {
       "path": "docs/adr/0057-container-cost-ledger.md",
       "mode": "0000644",
-      "sha256": "e6b2c47e565db9a11a90a9cc66689881d69dd55859f0ee45a927c56d861abf97"
+      "sha256": "278fd92b6cc34477e65658d8233955505200df7d693bf84839b507e72564502b"
     },
     {
       "path": "docs/adr/0057-discord-archon-approval-channels.md",
@@ -707,7 +707,7 @@
     {
       "path": "docs/adr/0059-single-approval-remove-devbox-approval-gate.md",
       "mode": "0000644",
-      "sha256": "6b425c8416bf8695c5a85b93d0f24e3db9d1a43ee9fa3032aa38a9178fbb740a"
+      "sha256": "7e38f60ff840961c22f7247287f90d0cb357436b36e37b06812485f7b3c40825"
     },
     {
       "path": "docs/adr/0060-gds-retrieval-layer.md",
@@ -767,17 +767,17 @@
     {
       "path": "docs/adr/0071-box-confirm-before-destroyed-and-drift-reconcile.md",
       "mode": "0000644",
-      "sha256": "0decb105e0f033ce13d61e9d3c387850447bbe44815602e5b7af78c70b38da93"
+      "sha256": "779f2293aba13d2f6218e8478a0f64b58bc4363eb855a2f639f1d8c0d0250d57"
     },
     {
       "path": "docs/adr/0072-bongos-app-mac-signed-first-windows-deferred.md",
       "mode": "0000644",
-      "sha256": "accc2b71b301ad3168ac189214567746d296b92e18a2714b9ce0f7ace14e4242"
+      "sha256": "c76d09fc004319031410940e2e0a740d9fe8fac5db146c691c5a77d4102576bd"
     },
     {
       "path": "docs/adr/0072-dev-box-code-staleness-visibility.md",
       "mode": "0000644",
-      "sha256": "ada2cb056b1bab044ffccd1261a24a6c96346597bfc8826693487ca2c291f44e"
+      "sha256": "7cfdfb73b12840ebca7a2cce675fea3568eeedcac11eeba76c8949e567186567"
     },
     {
       "path": "docs/adr/0073-builder-needs-signal-and-byok-gemini-key.md",
@@ -967,7 +967,7 @@
     {
       "path": "docs/adr/0104-trust-gds-api-channel-in-auto-mode.md",
       "mode": "0000644",
-      "sha256": "a3bae28f5af3d64fc3fb87da7ab743b226cdb429bbe21eeb72bd10ac6ec48531"
+      "sha256": "351fd07caac51e6f96fd470a65adb296a859c76b0b79c941697711b9ea5ee7de"
     },
     {
       "path": "docs/adr/0105-instance-seed-migrations-out-of-core.md",
@@ -1062,7 +1062,7 @@
     {
       "path": "docs/adr/0123-box-idle-sweep-autosave-before-destroy.md",
       "mode": "0000644",
-      "sha256": "fa930bf2a63aca9b8dd8113a8352530aa6c194d2e7b39f4fff1e192d44f11b12"
+      "sha256": "b5cfc790a2d3990a96d7260268397ab767034afb070958789148117e48af060f"
     },
     {
       "path": "docs/adr/0124-typed-api-response-bodies.md",
@@ -1152,7 +1152,7 @@
     {
       "path": "docs/adr/0144-devbox-rehome-onto-cloudbongos-plane.md",
       "mode": "0000644",
-      "sha256": "b49aa16e0531eb4d8c08fbdbead27ed44cc181ef0ad08be2643648f021e28369"
+      "sha256": "63dd16c48615c5dc59c7e52fbaa272b3e5eeb814a708815c21814c4632c75952"
     },
     {
       "path": "docs/adr/0144-federated-single-logout-backchannel.md",
@@ -1162,7 +1162,7 @@
     {
       "path": "docs/adr/0145-devbox-app-branding-driven-module.md",
       "mode": "0000644",
-      "sha256": "ba25a2248d38fee0350b6fac645c22ca38bd204ff9ad7bb6f6976f51a326fab3"
+      "sha256": "dde740e8a8ac122c7c2ddcadb11fd59d2f346e092352d7cc2f10d79a3f496bc2"
     },
     {
       "path": "docs/adr/0145-free-hosted-project-tier-isolation-and-domain-separation.md",
@@ -1182,7 +1182,7 @@
     {
       "path": "docs/adr/0148-task-scoped-box-source-access.md",
       "mode": "0000644",
-      "sha256": "9ca2d7597c035b2cbb6257478e5e329a192b4efa6a15ef8c8c16107117706822"
+      "sha256": "ee22948235919cf6dae9544a7f39f9862c40d8c08f94491344f561589f3323d9"
     },
     {
       "path": "docs/adr/0149-bongos-dev-local-launcher.md",
@@ -1197,7 +1197,7 @@
     {
       "path": "docs/adr/0151-governance-permissions-as-atom-ranks-as-roles.md",
       "mode": "0000644",
-      "sha256": "0ad167bf535aab268bfedece8339cfcf315d85d264028d403ca2c889b6044fe2"
+      "sha256": "a510ee32e9d2a64e99ebb13b7ceb24da8ee0d7ffcb6aebc8682d10897abcdf8f"
     },
     {
       "path": "docs/adr/0152-landing-gate-served-by-the-core-app.md",
@@ -1437,7 +1437,7 @@
     {
       "path": "docs/adr/0193-pause-task-scoped-box-slices.md",
       "mode": "0000644",
-      "sha256": "0fe8e1294c82ac0f8ee40403a663acb18bbe02c872945d7e6ffeef0236c7af24"
+      "sha256": "83907ce796aafdf0f85a51e06fab9810bf2b802bf460918538fa65f1e837062b"
     },
     {
       "path": "docs/adr/0194-joinability-one-door-decision.md",
@@ -1852,7 +1852,7 @@
     {
       "path": "docs/adr/0277-a-box-is-in-use-only-while-a-human-is-attached.md",
       "mode": "0000644",
-      "sha256": "b9558d903c3b96efe190fd242b90f455fa56515cbc92a49de3d8b14045eea820"
+      "sha256": "f777095affed9f45fdcc98fb229c868b8aee54dd28ac9f8b4bcd184574d6636a"
     },
     {
       "path": "docs/adr/0278-a-gated-project-still-takes-applications.md",
@@ -2194,10 +2194,15 @@
       "mode": "0000644",
       "sha256": "e67487d2007991b333c833abab23ae848caee1733a0445964b23787587a607f7"
     },
+    {
+      "path": "docs/adr/0346-dev-boxes-are-retired.md",
+      "mode": "0000644",
+      "sha256": "2ac7140de42599e7ab20785a3fc9265be60fbcd2c4438b2bdc65238c25657c17"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "972d07bc363aec1dd4b35590f138b968456eef298cf478dc5ad0dfbcffceb619"
+      "sha256": "835128e78686d49a23125ab8cc09ca90714c6706beb171114ebb34de4aaf548a"
     },
     {
       "path": "docs/api-reference.md",
@@ -2212,12 +2217,12 @@
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "fbe4e93152ec022d6633dabf7b5a15a888f3e60a2bbae18a84bbab807a2f8d2b"
+      "sha256": "c7e6113f1819b535619c163c097253314cefaf24b665e727f1e16c65aff9c19e"
     },
     {
       "path": "docs/branding-contract.md",
       "mode": "0000644",
-      "sha256": "810aa448e1031d9910768fd5c1917ea7a3ee8014f7b51337eb7fafafcd56e03d"
+      "sha256": "1efa0de30a20f355b25be812de1fd397d5bfda45c83457693a70110e2a89542c"
     },
     {
       "path": "docs/branding-fill-prompt.md",
@@ -2227,17 +2232,17 @@
     {
       "path": "docs/canonical-permissions.md",
       "mode": "0000644",
-      "sha256": "5fa1acf6dfcbaaa07cde5c0b593f834c9f8beed27a82e173298daa1cabe63dca"
+      "sha256": "58b05e37108c25afa2d1d61a22c6fa0419ec2e242dacc3c1f8b7f7c70bd46ae2"
     },
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "6b54c6f484de7a130e72e5052ef3a33c6d44d8dd0c3036a5ab5b7da14f00c293"
+      "sha256": "ae583d687423948c227f8a7ff091e8c812ce80b3adba49ac0c8f395f28492bb2"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "cbeed2728565504d1ccbc80f8d5a6c04bf033d79b44e3fc69df6b46e4b6858a4"
+      "sha256": "c74d0283b397d9462787c64e141640de211c82388d9f98fe344c241f129baca0"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2257,12 +2262,12 @@
     {
       "path": "docs/design/gate-navigation-direction.md",
       "mode": "0000644",
-      "sha256": "90bed9a9f3859f7cfc6dd8a0e23e70adeda5854be0b10f8208d60a96c83403b3"
+      "sha256": "6247d4018abe68913639e0d7012cf0856e73c876b59356b72ed07126e86628a3"
     },
     {
       "path": "docs/design/hall-direction-v2.md",
       "mode": "0000644",
-      "sha256": "67391accbb08e35e37df89e225476bae1b2a8957534a92ba63f49f3f53fcfdeb"
+      "sha256": "85df22358956bd01d94edb98268dd9e3a859c6feead44e22c02c3362a9b2b5c3"
     },
     {
       "path": "docs/design/ideator-surface-direction.md",
@@ -2282,32 +2287,32 @@
     {
       "path": "docs/design/modular-architecture/00-research-report.md",
       "mode": "0000644",
-      "sha256": "f1e5c3322b21b7a750b21a75ea30758641d2af1c4746dc38a112473f891b65af"
+      "sha256": "1bb8b054155e7c60dd206ba6abbfa35bc293149039508f49734d824d801f5551"
     },
     {
       "path": "docs/design/modular-architecture/01-architecture.md",
       "mode": "0000644",
-      "sha256": "b881d84a6004d91fd1779a1fbc519c0cd71080d8d4e5ee82e5cc27832c8b7a9c"
+      "sha256": "849a17b3dcc09ce7bdb42bcb15e90f83c9a6a22e6df1fcb2e53e74ee21bd41b2"
     },
     {
       "path": "docs/design/modular-architecture/02-module-map.md",
       "mode": "0000644",
-      "sha256": "881c5f78fbb8f5b4a6821d2a5614898a8f2fcaf6642cb944e52acb1176bd1536"
+      "sha256": "bf19bcc49f379679b767c4a3585713ccb0475ab53fe54479e25c968b48f03d76"
     },
     {
       "path": "docs/design/modular-architecture/03-builder-flows.md",
       "mode": "0000644",
-      "sha256": "d8b4cd5a63168a586b9ba182b3db7ef479a07eb491d6c28c25d2308d2474aa90"
+      "sha256": "e08d6abcd282133297058f76a123cb896a79a9a13436a3f6e6b128aa7a497cef"
     },
     {
       "path": "docs/design/modular-architecture/04-module-lifecycle.md",
       "mode": "0000644",
-      "sha256": "5ea44d0e5e8a094fb02e51e4bdbd0d46cf1c32002e8cdcae633c0755b50383bf"
+      "sha256": "f759ea475fc43b521fd70f67f7bfc71d6142e6b5694391d93a958044b8b64a20"
     },
     {
       "path": "docs/design/modular-architecture/README.md",
       "mode": "0000644",
-      "sha256": "8a8430af4bbf082d3bab28d5b82b353a6921782014c2852a87eb1056ba101722"
+      "sha256": "dfa1ea2c45eddd5a9528487f3a0fe80398ba9018c5f73706629015ff6c2108e0"
     },
     {
       "path": "docs/design/projects-hub-direction-v2.md",
@@ -2357,7 +2362,7 @@
     {
       "path": "docs/design/reviews/hall-v2/README.md",
       "mode": "0000644",
-      "sha256": "aee27e741a12bbd1c31a6cd6a327e15544c9a3c42ab7c8c2d9b250374e5050b2"
+      "sha256": "667d908bd44ac9b833e5b206858558a500a5bd1c270834fc4f2a31a8093bca43"
     },
     {
       "path": "docs/design/reviews/hall-v2/atlas--archon.webp",
@@ -2479,21 +2484,6 @@
       "mode": "0000644",
       "sha256": "211f8e74fbd6c5ab0c7fd58835361d9f660b71cd4478ac76cc47b1a8c5f801dd"
     },
-    {
-      "path": "docs/design/reviews/hall-v2/harbor--archon.webp",
-      "mode": "0000644",
-      "sha256": "be3edfac9a658eb72b6483dd5d82bcd0f3310e80334bc246e036c9e2da49d0b2"
-    },
-    {
-      "path": "docs/design/reviews/hall-v2/harbor--metic.webp",
-      "mode": "0000644",
-      "sha256": "ccb1948ef12eb643532f210029dae866a92545de7f6e7d8e81a7ce6d20181f4e"
-    },
-    {
-      "path": "docs/design/reviews/hall-v2/harbor--xenos.webp",
-      "mode": "0000644",
-      "sha256": "ce8e78514ae3fffd7990e29d4422e7b4f7c234be27e125d37896831d5bf95a86"
-    },
     {
       "path": "docs/design/reviews/hall-v2/idea--archon.webp",
       "mode": "0000644",
@@ -2569,21 +2559,6 @@
       "mode": "0000644",
       "sha256": "ea62a387241dfaea1d2cd358a22e5b00d35331433a06ffd4bda8bdd6241fd494"
     },
-    {
-      "path": "docs/design/reviews/hall-v2/pair--archon.webp",
-      "mode": "0000644",
-      "sha256": "71a1b7d97a7215cda890740db6bc705d9c171b13f8e26374da235c888840485b"
-    },
-    {
-      "path": "docs/design/reviews/hall-v2/pair--metic.webp",
-      "mode": "0000644",
-      "sha256": "d4588d5a66bd1f33f1f9581d8a215344edb706b69b1301124b4811736352e99d"
-    },
-    {
-      "path": "docs/design/reviews/hall-v2/pair--xenos.webp",
-      "mode": "0000644",
-      "sha256": "1d86d81622c5be2f32b484bd3e3a4c0dd3c6c65d38d2e9abba35619711670a77"
-    },
     {
       "path": "docs/design/reviews/hall-v2/people--archon.webp",
       "mode": "0000644",
@@ -2752,27 +2727,27 @@
     {
       "path": "docs/design/vanilla-hall-ui-redesign-scope.md",
       "mode": "0000644",
-      "sha256": "1c8d6c3d7ed30281edafe76965c0e4ddd3e4c273d32c2b2f091eea961a7eb8d3"
+      "sha256": "c3d58057645d6f828fd80e83e8398e38cccb377b84368c390d150e35468f59ff"
     },
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "6fa5de289972a7a68047f4bf3dc7155f7b614f803d1f1598d40668aac60418cd"
+      "sha256": "a71df813af4211bae27520be661c6f9cb6cac574552a322793799ffdc0304029"
     },
     {
       "path": "docs/handoff-template.md",
       "mode": "0000644",
-      "sha256": "8792668e8f0c09ec14951e4a7d11902a5890198723442f7c21932adcc1b941be"
+      "sha256": "b28c941a6eba6fe2d5cea8a1d5890582d56d02266834f2e9b2c2ae4a65a38488"
     },
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "cb091147c269d6203c743d2bb2565bf7b93ec737394d4e1532966cb9912536e4"
+      "sha256": "bbf793bc4666f224874a7c6ae58cb2c6ef1532d6a5d34b32c87f3f6bb129a27a"
     },
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "b936068e9d5bdbbdddc8ccc545dc4cce318e7a36bd91a04127efbdbec7004646"
+      "sha256": "7cd6e586e2763199194c3b5752c618ed2eaa728499800c5383d78b0c21869370"
     },
     {
       "path": "docs/onboarding/diagrams/01-task-lifecycle.mmd",
@@ -2857,7 +2832,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "e325c68b244a30823565a7e9e6cd38b9ab0e0d445384714222578822b76c617e"
+      "sha256": "0c9eb27225db3b07ae71b10e84533c605e5d8f59c33627ae0b676eefaf8f0084"
     },
     {
       "path": "docs/project-context.template.md",
@@ -2882,7 +2857,7 @@
     {
       "path": "docs/recipes/bongos-cli-release.md",
       "mode": "0000644",
-      "sha256": "c8e3322e6399678c343bc45456fba2c17d9d0410af225ed7be9f9466414d3d80"
+      "sha256": "93239a95a0a11e3824c4c09aa789da58fd147ca57fb06926c26b001a0ca189b7"
     },
     {
       "path": "docs/recipes/claude-design-loop.md",
@@ -2942,12 +2917,12 @@
     {
       "path": "docs/recipes/multi-builder-merge.md",
       "mode": "0000644",
-      "sha256": "368b0acc045087c8aff34b3a551ced958e6e87987afcf6c3210eff093c8a9eea"
+      "sha256": "eff85eb7338322fcfb5b94d4e926ed09a9bd4d4c3e8fbd7087a7bd8f9f5d2440"
     },
     {
       "path": "docs/recipes/ops-gotchas.md",
       "mode": "0000644",
-      "sha256": "b94f63ecf7d8a061265c2ba33997a1032940f6ddf11de7083ad877d6bcb17ff4"
+      "sha256": "a6793835c193851959274cd2b5014eb9ec86209c8677eab05d3b9315fad61e16"
     },
     {
       "path": "docs/recipes/overnight-builder.md",
@@ -2992,7 +2967,7 @@
     {
       "path": "docs/recipes/self-host.md",
       "mode": "0000644",
-      "sha256": "48dbce2966702987cbb9de6639ceb1e63ab3c7166e759bf93df06bd9f5875a88"
+      "sha256": "c04381acb230dbce0704dff95fc3069256617f4ff1de9d270090afb9695305ac"
     },
     {
       "path": "docs/recipes/server-bring-up.md",
@@ -3027,7 +3002,7 @@
     {
       "path": "docs/recipes/windows-builders.md",
       "mode": "0000644",
-      "sha256": "6119a42cdfef5147e23b4fc39b8baa4aa93dd7cc4d613bf856705b8437bc5f49"
+      "sha256": "07d50e4dfbcc7c274a193c87ddf173b17cf263125d128c6aedeb46d12ec524ac"
     },
     {
       "path": "docs/research/cursor-competitive-analysis.md",
@@ -3912,7 +3887,7 @@
     {
       "path": "migrations/core_258_drop_dev_box_tables.sql",
       "mode": "0000644",
-      "sha256": "a4fb761057ffe82b2986e198cff16206a9ae79b1ec9ffe47391238a56b87b6d4"
+      "sha256": "6591b63dc385fd1d3a69b2729ef16141bdd6017bf3442cac1642403332edc601"
     },
     {
       "path": "modules/agents/CLAUDE.md",
@@ -5287,7 +5262,7 @@
     {
       "path": "modules/hall-ui/public/palette.js",
       "mode": "0000644",
-      "sha256": "bcb271d9021bc9c80e93dc022082b346147441606a67b1c0748ca2e4d0a7cfa9"
+      "sha256": "e001e533fff5f8829c8ab5360e0f7376db08675cb6862a5a7065c4acf3813ec0"
     },
     {
       "path": "modules/hall-ui/public/panel.css",
@@ -8622,12 +8597,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e818d09bf4173c99416c29653de6ba1aa9eb0308f46c2a4654847b8e1a30eab0"
+      "sha256": "f7f09866a7769adcd0ae7c8b98b95d524c8952bc7303fb1c0a7d91ab0f84b702"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "31394e30f2f183bb5138016939b1d88709e06b507e9697d548a1ebc96b1b6c81"
+      "sha256": "fbe7987f4279fa8c73b674d136aa26ef24617bac7a7cc1514c2ed2d5c36d056d"
     },
     {
       "path": "public-docs/index.html",
@@ -8647,7 +8622,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "008225fa7abbf9f218e8308ce500f6b80f4c6a8eca530bb6c7d9b0debb40493e"
+      "sha256": "265af57b3e6a412024b2c35b30940a80ad4e11250aa9a187faab6ef7407b9281"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9064,6 +9039,11 @@
       "mode": "0000644",
       "sha256": "06901aa9fa0fcf89e0710f8f35274bc589f4711024e88350a981a453d5937f96"
     },
+    {
+      "path": "scripts/gds/dev-box-guard.js",
+      "mode": "0000644",
+      "sha256": "7d131f16d11d927b4edc2073398a8b7e2ab942ff4518b009dd2ad400b6293183"
+    },
     {
       "path": "scripts/gds/dev-lib.js",
       "mode": "0000644",
@@ -9187,7 +9167,7 @@
     {
       "path": "scripts/gds/fitness-lib.js",
       "mode": "0000644",
-      "sha256": "765b21df77a1e9c31281e0321778da0cd204913d0485918f6a8f6ab291637dc0"
+      "sha256": "cf4a3cfb002a72b2a42466b9ebadb5463b29f22110dc4670097ffc8a3d737481"
     },
     {
       "path": "scripts/gds/fitness-migration-contraction.js",
@@ -9202,7 +9182,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "ddfa1d57484caf2030fdc5edf28be7acd9cf07c6bdf483cd14acb20c5f22a6de"
+      "sha256": "a90d2d0154ae900e8f0c6ebde75dafd9ca9ea304f6534ab570b6ad47c068dbca"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -9772,7 +9752,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "187eb3b822f20942335ae7ede175b5538b603d33f53719463a7f2fc81b6c925b"
+      "sha256": "7df49ca20c26a0d317627443083c918d749def6dcdcaba24373e14da219c6d77"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -10502,7 +10482,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "4736626fa9c8022be484886dd3538d87403976f691cdea87a4cd1c3911cbf6ea"
+      "sha256": "7db902c39399a77cbc3b4e5065434aa0b4b39f404b27d651a1f62f9aec3fda5c"
     },
     {
       "path": "src/bongos/module-store.js",
@@ -10712,7 +10692,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "070293f3734632a601f4a951b1660bfde29a2353b7544f79f43d3affaab52287"
+      "sha256": "7529243c4bf7f88a907a8e6afeb27a34fff45a4b113c27b2da60005e4fb3303e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11604,6 +11584,11 @@
       "mode": "0000644",
       "sha256": "8af3844c60dad9f561c297398f7d7b72b8a5fd318213b165f72030e923cee93b"
     },
+    {
+      "path": "tests/core_258_box_session_claims_db.mjs",
+      "mode": "0000644",
+      "sha256": "1aa14eb444f6d15dc5b61ba565bf966a6f0cd98acc3424206a1164d18ff9df9e"
+    },
     {
       "path": "tests/core_update_banner.mjs",
       "mode": "0000644",
@@ -12032,7 +12017,7 @@
     {
       "path": "tests/fitness.mjs",
       "mode": "0000644",
-      "sha256": "1f5584bab0287df5fd925d20fa1422ed53e32a29f2d8ecd359522368b6388cf3"
+      "sha256": "e19021a6f2aeba77ce67183a9d5a7c6637cb41029e893e93afdc52001d484027"
     },
     {
       "path": "tests/fitness_gds_ratchet.mjs",
@@ -12757,7 +12742,7 @@
     {
       "path": "tests/hall_palette.mjs",
       "mode": "0000644",
-      "sha256": "15ad1d10ff1c22a5dba63fa71d9b823373b23e021faae8c82c683d11b0fbd02b"
+      "sha256": "14e0bfda70dac75dc29bd784739ade11fe2cb986214bd0a1e8859f398b52dafb"
     },
     {
       "path": "tests/hall_preview_identity.mjs",
@@ -14192,7 +14177,7 @@
     {
       "path": "tests/provisioning_recommendations.mjs",
       "mode": "0000644",
-      "sha256": "4b9f688b95a5a0d63c58ffa0d8a92d291e8732e9e74dfdb59f6efb3da1dcb78c"
+      "sha256": "641d4ba5fd4de4034e7059b835e98e5a386917d76935555e43c3eb436cbaeb20"
     },
     {
       "path": "tests/provisioning_repo_private_route.mjs",

package/.claude/skills/blocker-solve/SKILL.md

@@ -92,6 +92,6 @@ Lars is the prompter (CLAUDE.md §2). Frame around the outcome, not the plumbing
 
 This skill is the **reusable core** of the blocker-solve idea. Future entry points call into this same flow rather than reinventing it:
 - a hall **"Solve this"** button on the Archon blocker card (records an intent), and
-- a **cloud / autonomous runner** that spins the session up server-side (mirroring the `box_intents` control-plane pattern, [ADR 0031](../../../docs/adr/0031-cloud-dev-environments-for-builders.md)), pinging the owner only for the **[needs you]** steps.
+- a **cloud / autonomous runner** that spins the session up server-side (mirroring the `provisioning_intents` control-plane request queue), pinging the owner only for the **[needs you]** steps.
 
 Both reuse the gather → do/guide → verify → auto-resolve loop above. (Filed under GDS-V4; see the task that shipped this skill.)

package/README.md

@@ -11,7 +11,7 @@ The durable framing for AI agents — methodology, working rules, session protoc
 ## What's in here
 
 - **The GDS** (`src/`, `modules/`, `scripts/gds/`) — the build state machine: tasks, claims, versions, goals, dependencies, the claim→ship→grade→credit lifecycle, and the `/builder-*` CLI.
-- **Platform modules** (`modules/`) — lifecycle, grading, economy, memory, onboarding, ideas, sessions, autonomy, security, the builders' hall + status dashboard, dev-box, and Discord integration. Each is configurable (and most are toggleable) per instance.
+- **Platform modules** (`modules/`) — lifecycle, grading, economy, memory, onboarding, ideas, sessions, autonomy, security, the builders' hall + status dashboard, and Discord integration. Each is configurable (and most are toggleable) per instance.
 - **Neutral branding template** (`config/*.neutral.json`, `docs/project-context.template.md`) — the identity scaffold a new instance fills in ([`docs/branding-contract.md`](./docs/branding-contract.md)). The vanilla pack in `config/branding.neutral.json` is the identity Cloud Bongos itself runs on.
 - **Methodology + decisions** (`CLAUDE.md`, `docs/adr/`, `docs/recipes/`, `.claude/skills/`).
 

package/docs/adr/0031-cloud-dev-environments-for-builders.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-06-04
 **Context:** GDS-V3, task [#595](https://example.com/builders#/task/595) (claim `#477`). Feeds done-when criteria **C1** (`onboarding ≤ 2h`) and **C8** (`cloneable repo / local-first memory, server-canonical on ship`). Companion to [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (trust boundary — same server-enforced posture), [ADR 0018](0018-three-rank-model-goes-live.md) (Xenos → Metic → Archon), [ADR 0022](0022-secrets-policy.md) (no secrets in repo — precondition for a cloneable box), [ADR 0024](0024-cloneable-repo-local-first-memory.md) (memory follows the builder — unchanged by where the box runs), and [ADR 0002](0002-digitalocean-over-hetzner.md) (we already run on DigitalOcean).
-**Status:** Accepted. *Decision recorded this session; implementation tasks to be seeded separately (see the Implementation sub-tasks at the end).*
+**Status:** Superseded by [ADR 0346](0346-dev-boxes-are-retired.md) — the dev box was removed (goal 1000120). Was: Accepted. *Decision recorded this session; implementation tasks to be seeded separately (see the Implementation sub-tasks at the end).*
 **Track:** `internal` (dev-system architecture).
 
 > This is a decision record, not an implementation. Nothing here is built yet. The point is to lock the shape so a future session can build it without relitigating the design.

package/docs/adr/0035-builder-onboarding-three-paths.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-06-06
 **Context:** GDS-V3, task [#715](https://example.com/builders#/task/715). Feeds done-when criterion **C1** (`a Metic onboards in ≤ 2h`). This ADR is the *onboarding-as-experience* companion to [ADR 0031](0031-cloud-dev-environments-for-builders.md), which locked the **substrate** (the containerized DO box, auto-suspend, rank-gated source access) but never consolidated how a person actually *arrives*. Builds on [ADR 0034](0034-thetes-graduated-newcomer-rank.md) (the `xenos < thetes < metic < archon` ladder), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced permissions), [ADR 0022](0022-secrets-policy.md) (no secrets in repo), and the box onboarding middleware shipped in [#701](https://example.com/builders#/task/701) (§9.4 of ADR 0031).
-**Status:** Accepted — §2 (the first-box Archon approval gate) superseded by [ADR 0059](0059-single-approval-remove-devbox-approval-gate.md). *Decision record — locks the onboarding shape and three new policy decisions. The box-lane machinery already exists (ADR 0031 + [#701](https://example.com/builders#/task/701)); the deltas this ADR introduces (the Metic+ local gate, the first-box approval gate, the single hosted guide surface, the primer rewrite) are implementation sub-tasks listed at the end and are NOT yet built.*
+**Status:** Superseded in part by [ADR 0346](0346-dev-boxes-are-retired.md) (the DO-box setup path). Was: Accepted — §2 (the first-box Archon approval gate) superseded by [ADR 0059](0059-single-approval-remove-devbox-approval-gate.md). *Decision record — locks the onboarding shape and three new policy decisions. The box-lane machinery already exists (ADR 0031 + [#701](https://example.com/builders#/task/701)); the deltas this ADR introduces (the Metic+ local gate, the first-box approval gate, the single hosted guide surface, the primer rewrite) are implementation sub-tasks listed at the end and are NOT yet built.*
 **Track:** `internal` (dev-system / builder onboarding).
 
 > **⚠️ Superseded in part by [ADR 0059](0059-single-approval-remove-devbox-approval-gate.md) (task [#1141](https://example.com/builders#/task/1141)).** Decision **§2 — "A newcomer's FIRST box requires Archon approval"** is **removed**: with admission now invite-gated ([ADR 0050](0050-device-flow-admission-invite-gated-by-default.md)), member-join is the sole human gate, and an admitted builder's first box now provisions hands-off. §1 (Metic+ local clone) and §3 (the single hosted guide) stand unchanged. Read §2 below as historical.

package/docs/adr/0044-per-box-live-game-preview.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-06-10
 **Context:** GDS-V3, task [#897](https://example.com/builders#/task/897) (this ADR + the tunnel mechanism), wired into provisioning under [#898](https://example.com/builders#/task/898), hardware-verified under [#899](https://example.com/builders#/task/899). Companion to [ADR 0031](0031-cloud-dev-environments-for-builders.md) (per-builder DigitalOcean box substrate), [ADR 0038](0038-chromebook-ttyd-cloudflare-tunnel.md) (the box's ttyd terminal over a Cloudflare Tunnel — the mechanism this extends), and [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the web tier only *asks*; the control plane holds infra power).
-**Status:** Accepted. Mechanism implemented under [#897](https://example.com/builders#/task/897).
+**Status:** Superseded by [ADR 0346](0346-dev-boxes-are-retired.md) — the dev box was removed (goal 1000120). Was: Accepted. Mechanism implemented under [#897](https://example.com/builders#/task/897).
 **Track:** `internal` (dev-system / builder experience).
 
 ## Problem

package/docs/adr/0045-devbox-desktop-app.md

@@ -1,6 +1,6 @@
 # ADR 0045 — The Dev Box desktop app: a native switch, app-pairing auth, and off-repo distribution
 
-- **Status:** accepted
+- **Status:** Superseded by [ADR 0346](0346-dev-boxes-are-retired.md) — the dev box was removed (goal 1000120). Was: accepted
 - **Date:** 2026-06-10
 - **Task:** [#904](https://example.com/builders#/task/904)
 - **Track:** internal