@bongos/core 1.19.1075 → 1.19.1077

package/docs/branding-contract.md

@@ -29,7 +29,7 @@ env override   →   instance config (config/branding.json)   →   neutral star
 | `domains.cookieDomain` | Session cookie domain (`""` = host-only — the safe default; never widen to a parent domain by accident). |
 | `domains.oauthOrigin` | Canonical sign-in origin. |
 | `domains.provisioningOrigin` | **Optional.** Control-plane front-door origin the [provisioning module](../modules/provisioning/CLAUDE.md) uses to build a new customer's GitHub-App `redirect_url`. Set it when the control plane co-hosts a game whose `publicOrigin` is the game's own domain (OTB = customer 0) so the customer's App carries the PLATFORM brand (e.g. `https://get.cloudbongos.com`), not the game's. **Falls back to `publicOrigin` when unset** — an instance whose `publicOrigin` is already the platform needs no override. Env-overridable: `<PREFIX>_PROVISIONING_ORIGIN`. ([#2101](https://example.com/builders#/task/2101)) |
-| `domains.instanceBase` | Apex zone new projects get their **auto-assigned** address under (`<slug>.<instanceBase>`, task 1002704 — every project's hall reachable day one; `no_address: true` on the create call opts out). Same one-label-under-apex/edge-TLS constraint as `devBoxBase`. Deliberately NOT derived from `publicOrigin` (on a co-hosting control plane that is the game's domain). Empty ⇒ no auto-assign — creates are domainless unless the caller brings a domain. |
+| `domains.instanceBase` | Apex zone new projects get their **auto-assigned** address under (`<slug>.<instanceBase>`, task 1002704 — every project's hall reachable day one; `no_address: true` on the create call opts out). One label under the apex only, so the edge wildcard certificate covers it. Deliberately NOT derived from `publicOrigin` (on a co-hosting control plane that is the game's domain). Empty ⇒ no auto-assign — creates are domainless unless the caller brings a domain. |
 | `repo` | `{ owner, name }` GitHub binding. |
 | `db.database` | DB name Bongos pool connects to when neither `DATABASE_URL` nor `PGHOST`/`PGDATABASE` is set (`src/bongos/pool.js`, ADR 0062 §5). `null` in the neutral starter = **fail loud** rather than silently target a host DB. |
 | `currency` | `{ label, symbol }` — the reward unit label (e.g. "example"). Display only. |
@@ -41,7 +41,7 @@ env override   →   instance config (config/branding.json)   →   neutral star
 | `landing.postLogin` | Where a successful web sign-in lands when it carried no explicit `?return=` / same-apex `Referer` (`src/bongos/routes/auth.js` `postLoginLanding`). **Portable default `/builders`** — the hall always exists. A platform-home instance points this at its OWN front door so a visitor who signs in from there returns there instead of being auto-redirected into the hall (cloudbongos.com → `/gate/`, the orbs). Validated through the same open-redirect allowlist as `?return=` (a misconfigured value falls back to `/builders`). Env-overridable: `<PREFIX>_POST_LOGIN_LANDING`. (task [#1002240](https://cloudbongos.com/builders#/task/1002240)) |
 | `envPrefix` | Env-var namespace for overrides (`BONGOS` for vanilla, `OTB`, …). Legacy `CLOUDBONGOS_`, `OTB_`, `GDS_` and `PMS_` spellings still resolve, with one deprecation warning per name, until core 1.21 (task 1003703). |
 
-**Not here:** feature-module on/off flags (game, art, discord, dev-box) are a sibling config owned by R54 (task [#1193](https://example.com/builders#/task/1193)).
+**Not here:** feature-module on/off flags (game, art, discord) are a sibling config owned by R54 (task [#1193](https://example.com/builders#/task/1193)).
 
 ## Using it
 

package/docs/canonical-permissions.md

@@ -222,12 +222,11 @@ or missing ranks fail closed.
   of its grants (ADR 0034); `archon` and the divine tiers above it do.
 
   **[ADR 0157](adr/0157-archon-is-rank-and-identity-only.md) added the whole operational block here** —
-  20 permissions that had been Archon-gated only by ADR 0016's fail-closed default, never by a decision:
-  the government/monitoring **pages** (`/watch`, `/harbor`, `/gate` — `page.view.government`) and
+  20 permissions (19 today: the dev-box fleet one went with the box, [ADR 0346](adr/0346-dev-boxes-are-retired.md)) that had been Archon-gated only by ADR 0016's fail-closed default, never by a decision:
+  the government/monitoring **pages** (`/watch`, `/gate` — `page.view.government`) and
   `GET /api/bongos/sessions/search` (whose own `/sessions` page had no server gate at all until
   task 1002710 put it behind `page.view.government` alongside its three group-mates); the
-  **dev-box + provisioning fleets** (`GET /boxes[/cost-ledger]`,
-  `POST /boxes/:b/close`, `PATCH .../block`, `GET /provisioning/fleet[/cost-ledger]`,
+  **provisioning fleet** (`GET /provisioning/fleet[/cost-ledger]`,
   `POST .../force-teardown`); **security adjudication** (`GET /security/reports`,
   `POST /security/reports/:id/{confirm,dispute,fix,link-fix}`, `/security/docs` CRUD);
   `GET /api/bongos/audit-log`; the **roster reads** (`GET /builders/roster`, `/grades/by-builder`,
@@ -276,22 +275,15 @@ nothing set it, so every task sat at the `'xenos'` default and the claim gate ab
   still at the `'xenos'` default to `metic` where sensitive (raise-only, idempotent).
 - The builders-hall card shows a rank pill when a task's floor is above `xenos`.
 
-### Source access is rank-gated too (ADR 0031 §9.2, ADR 0035 §1)
+### Source access (ADR 0035 §1)
 
-Authority over *the code itself* rides the same ladder, enforced server-side from the live DB rank
-(never from anything the builder's machine can write):
+Reading the code is not rank-gated today; what a builder can LAND is (next section):
 
-- **Local clone onto your own disk = Metic and up.** Below Metic (`xenos`, `thetes`), there is **no
-  permanent local copy** — the collaborator-invite path is a Metic+ affordance. New builders work
-  inside the org-controlled cloud box, where access is revocable and audited.
-- **Box source is scoped by rank** (`boxScopeForRank`, decided live inside `GET /api/bongos/box/source-access`):
-  `xenos`/`thetes` get a sparse `starter` surface; `metic`/`archon` get `full`. A demotion cuts a box
-  off on its very next fetch (instant credential-layer revocation; the droplet teardown is the slower
-  control-plane half via `box.js reconcile`).
-
-> **Rollout note (ADR 0035 §4):** until the box lane is verified end-to-end on real hardware, the
-> collaborator-invite/local-clone path stays open to all admitted ranks as the interim on-ramp — the
-> Metic+ tightening lands once the box gives newcomers a working alternative. Never leave zero working paths.
+- **A local clone onto your own disk is how every builder works**, and the collaborator-invite /
+  local-clone path is open to every admitted rank. `source.clone.local` still names the Metic+ floor
+  ADR 0035 planned, but that tightening was to land once a cloud box gave newcomers another way in;
+  the box is retired ([ADR 0346](adr/0346-dev-boxes-are-retired.md)), so it does not land as designed.
+  What bounds a checkout is what it can land, as the next section describes.
 
 ### Git and SSH are OUTSIDE the HTTP boundary — covered by a separate rank floor (ADR 0043, SEC [#863](https://example.com/builders#/task/863))
 

package/docs/copy-inventory.md

@@ -589,7 +589,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9f9424a5100b` | certain | Join our Discord | `modules/hall-ui/public/hall-render.js:804` |
 | `7ee76a958445` | certain | Join requests | `modules/hall-ui/public/goals-render.js:1411` |
 | `b7ab5922126b` | certain | Join-requests to approve | `modules/hall-ui/public/goal-inbox.js:154` |
-| `d305f0df6f25` | certain | Jump to | `modules/hall-ui/public/palette.js:216` |
+| `d305f0df6f25` | certain | Jump to | `modules/hall-ui/public/palette.js:351` |
 | `01176c156112` | certain | Jump to a goal or a thought | `modules/hall-ui/public/goal-map.html:75` |
 | `01176c156112` | certain | Jump to a goal or a thought | `modules/hall-ui/public/thinking.html:92` |
 | `2bfc5a50ce88` | certain | Jump to a page or record | `modules/hall-ui/public/shell.js:485` |
@@ -696,7 +696,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `abc64639b134` | certain | No goals seeded yet. | `modules/hall-ui/public/roadmap.js:205` |
 | `139ec3636c22` | certain | No introductions right now. One appears here when a pairing round runs. | `modules/hall-ui/public/collab.html:99` |
 | `3b9823dd4579` | certain | No maintenance declared — nobody is on the hook for this module as the core advances. | `modules/hall-ui/public/modules.js:92` |
-| `64a4281934d1` | certain | No match. Try a page name, or an id like | `modules/hall-ui/public/palette.js:172` |
+| `64a4281934d1` | certain | No match. Try a page name, or an id like | `modules/hall-ui/public/palette.js:307` |
 | `f52552a6afcd` | certain | No notes were packed for this version. | `modules/hall-ui/public/settings-software-update.js:102` |
 | `4f89817b92e5` | certain | No onboarding steps recorded yet. | `modules/hall-ui/public/hall-render.js:880` |
 | `421ae031594e` | certain | No open goals in this version | `modules/hall-ui/public/task.js:589` |
@@ -1443,7 +1443,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `af3a8e0fe6a8` | certain | open your goals | `modules/hall-ui/public/goal-inbox.js:158` |
 | `9a803563c948` | certain | open {…} | `modules/hall-ui/public/approval-queue.js:156` |
 | `4f279d68175f` | certain | open, on the Security tab | `modules/hall-ui/public/watch.html:47` |
-| `7b85e6494596` | certain | opens a new tab | `modules/hall-ui/public/palette.js:180` |
+| `7b85e6494596` | certain | opens a new tab | `modules/hall-ui/public/palette.js:315` |
 | `c38db02adb61` | certain | or above | `modules/hall-ui/public/government.js:564` |
 | `271de72308a4` | certain | pages tweaked | `modules/hall-ui/public/studio.html:83` |
 | `884948925fcb` | certain | paste command | `modules/hall-ui/public/settings.js:914` |

package/docs/copy-registry.json

@@ -6727,7 +6727,7 @@
       "surface": "builders-hall",
       "text": "Jump to",
       "file": "modules/hall-ui/public/palette.js",
-      "line": 216,
+      "line": 351,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7690,7 +7690,7 @@
       "surface": "builders-hall",
       "text": "No match. Try a page name, or an id like",
       "file": "modules/hall-ui/public/palette.js",
-      "line": 172,
+      "line": 307,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14413,7 +14413,7 @@
       "surface": "builders-hall",
       "text": "opens a new tab",
       "file": "modules/hall-ui/public/palette.js",
-      "line": 180,
+      "line": 315,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/design/gate-navigation-direction.md

@@ -62,7 +62,7 @@ the apex redirects straight past it into the walled gate.
 `src/platform-server.js:115-121`, conditional only on `isApexHost(req)` and the gate file existing,
 with no session check and no query bypass.
 
-**The live Caddyfile is not mirrored in this repo** (`infra/` holds only `box-*.sh`); ADR 0152 gives
+**The live Caddyfile is not mirrored in this repo** (`infra/` held only `box-*.sh` and has since been removed with the dev box); ADR 0152 gives
 the intended shape as prose and marks the lock *"optional pre-launch"*, and several references to
 `infra/Caddyfile` elsewhere in the tree are dead. Treat the host config as the source of truth.
 

package/docs/design/hall-direction-v2.md

@@ -28,7 +28,7 @@ Five pages carry the whole hall, and every other page inherits from one of them:
 | **board** (`index.html` + `work.html`) | the home view and the work board: the densest surface in the hall |
 | **task** (`task.html`) | one record read end to end; `idea` and `ideas` inherit |
 | **reading** (`primer.html`) | long markdown with a table of contents; Ranks, Economy, Diagrams, Repo Atlas and Modules inherit |
-| **goals** (`goals.html`) | the governance lists; Government, Modules, Watch, Harbor, Gate, Sessions, People and the rest inherit |
+| **goals** (`goals.html`) | the governance lists; Government, Modules, Watch, Gate, Sessions, People and the rest inherit |
 | **settings** (`settings.html` + `profile.html`) | every form, switch, secret field and status line in the hall |
 
 ---
@@ -125,11 +125,11 @@ Five things were reconciled **between** the archetypes, since the builders ran i
 
 **A fixture rule the round had to learn, flagged by the grader's security worker.** The settings mocks compose the
 CLI re-issue flow, which means they have to show a token in a `<pre>`, and they were seeded with a realistic
-64-character hex string beside the real paste command, plus the live dev box's actual `ssh <account>@<ip>` line.
+64-character hex string beside the real paste command, plus a hosted machine's actual `ssh <account>@<ip>` line.
 Neither belonged in a committed artifact: the hex was invented (verified against this machine's real session files,
 so nothing needed rotating) but a credential-shaped literal is treated as a secret regardless of intent and would
 trip every future scanner, and the SSH host and account are real internal topology that no public API justifies.
-Both are now unmistakable placeholders. **The rule for any mock that composes a secret or a connection string: the
+Both were made unmistakable placeholders (the SSH line has since left the mocks with the retired dev-box settings group). **The rule for any mock that composes a secret or a connection string: the
 fixture must be self-evidently fake at a glance while keeping the real string's LENGTH and SHAPE**, because the
 length is the composition problem being solved. "Real data, invent nothing" governs ledger figures; it does not
 extend to credentials or infrastructure.

package/docs/design/modular-architecture/00-research-report.md

@@ -77,7 +77,7 @@ The "boundary rots back together" problem is universal; the cure is **architectu
 - 📄 **Dependency-graph-scoped context** (`nx affected` / `turbo --filter`; [Nx AI agent skills](https://nx.dev/blog/nx-ai-agent-skills) exposes the project graph to agents).
 - 📄 **Ticket↔component mapping is established**: Jira/Linear "Components", conventional-commit scopes, CODEOWNERS, `nx affected --files`.
 
-🔧 **The synthesis:** `touches[]` is a file-path list (the lowest-altitude form). The industry moves the unit of affinity *up* from files to components/packages. Once modules are first-class, a task should declare **module affinity**; the agent loads only that module + the core API (small context, higher quality), parallel-safety becomes module-disjointness (cleaner than path overlap), and drift detection becomes semantic ("you said dev-box, you touched game"). *(Refined later: see [02](02-module-map.md)/[04](04-module-lifecycle.md) — in a fully modular world the file-path `touches[]` retires entirely in favor of the module label.)*
+🔧 **The synthesis:** `touches[]` is a file-path list (the lowest-altitude form). The industry moves the unit of affinity *up* from files to components/packages. Once modules are first-class, a task should declare **module affinity**; the agent loads only that module + the core API (small context, higher quality), parallel-safety becomes module-disjointness (cleaner than path overlap), and drift detection becomes semantic ("you said discord, you touched game"). *(Refined later: see [02](02-module-map.md)/[04](04-module-lifecycle.md) — in a fully modular world the file-path `touches[]` retires entirely in favor of the module label.)*
 
 ## 7. Thread 6 — How companies manage AI-assisted dev at scale
 

package/docs/design/modular-architecture/01-architecture.md

@@ -38,7 +38,7 @@ The whole product becomes **core + modules**. A module is a **vertical slice** (
 graph TD
     subgraph Modules["Modules (each a vertical slice: routes · db · ui · skills · manifest)"]
         G[game]
-        D[dev-box]
+        D[provisioning]
         DC[discord]
         Y["your module<br/>(no fork!)"]
     end
@@ -94,7 +94,7 @@ graph LR
         R1["long dark window — nothing ships —<br/>re-deriving the SAME core (auth, tasks, grading, ~111 migrations)"] --> R2["risky big-bang cutover ⚠"]
     end
     subgraph ST["Strangler migration (recommended)"]
-        S1[loader] --> S2[dev-box→module] --> S3["discord · art"] --> S4[game] --> S5["carve core + task→module"] --> S6[theming]
+        S1[loader] --> S2[first module→module] --> S3["discord · art"] --> S4[game] --> S5["carve core + task→module"] --> S6[theming]
     end
 ```
 
@@ -110,7 +110,7 @@ Each phase ships independently, guarded by the fitness functions; easiest/most-i
 |---|---|---|
 | 0 | Draw the doorway | define `core/module-api.js` + teach `fitness.js` the one-way rule (mostly exists) |
 | 1 | Build the loader | discover `modules/*/module.json`, validate, compose routes behind auth, apply module migrations, start/stop pollers |
-| 2 | Move dev-box first | most self-contained + half flag-gated; the template every other move copies; prove OTB behaves identically |
+| 2 | Move the most self-contained module first | the template every other move copies; prove OTB behaves identically (the original pick, dev-box, has since been retired, ADR 0346) |
 | 3 | Move discord, then art-pipeline | same recipe |
 | 4 | Move game (the hard one) | Colyseus rooms + world tables + `public/`; "realtime capability" seam |
 | 5 | Carve the core + rewire the task model | split `db.js` per-module; add `task.module`; **retire `touches[]`**; extend fitness to verify diff-in-module |

package/docs/design/modular-architecture/02-module-map.md

@@ -95,7 +95,6 @@ graph TD
     GA[game] --> K
     AR[art-pipeline] --> K
     DC[discord] --> K
-    DB[dev-box] --> K
 ```
 
 | Module | Owns |
@@ -111,6 +110,6 @@ graph TD
 | autonomy/MAS | conductor dispatch · architect audits · autonomy-gate · scheduled routines |
 | security | red-team reports · bounty (rank-gated Metic+) |
 | hall-UI · status-UI | the two web surfaces |
-| game · art-pipeline · discord · dev-box | feature modules |
+| game · art-pipeline · discord | feature modules |
 
 > **~16 is the target ceiling, not a day-one requirement.** Start coarser; split as the coupling scan + fitness demand. Every one is a real cohesive cluster (the scan proved it), but a small team should be "as modular as the evidence supports, no finer." Merging two modules is cheap; the fitness ratchet makes splitting them safe — you're never locked into the first cut.

package/docs/design/modular-architecture/03-builder-flows.md

@@ -4,26 +4,26 @@ How a person works once the code is in modules. **Nothing you do is blocked —
 
 ## The one idea: two kinds of "access"
 
-- **Platform capabilities** — claim, start, ship, file an idea, recall, see your box. These are **kernel endpoints over HTTP, gated only by your rank.** The module structure never touches them. Available everywhere, always.
-- **Code-write scope** — which files a *single claimed task* may change. The **only** thing the structure bounds; it lives at the **worktree** level (not you, not your box); escaped by seeding a new task (itself a kernel capability).
+- **Platform capabilities** — claim, start, ship, file an idea, recall. These are **kernel endpoints over HTTP, gated only by your rank.** The module structure never touches them. Available everywhere, always.
+- **Code-write scope** — which files a *single claimed task* may change. The **only** thing the structure bounds; it lives at the **worktree** level (not you, not your checkout); escaped by seeding a new task (itself a kernel capability).
 
-**The wall is around each task's worktree — not around you, and not around your dev box.**
+**The wall is around each task's worktree — not around you, and not around your checkout.**
 
-## 1. What the dev box has access to
+## 1. What your checkout has access to
 
-The dev box is your machine — a persistent environment, **not** module-scoped. Scoping happens one level down, per claim.
+Your checkout is your own copy of the project repo on your own machine — a persistent environment, **not** module-scoped. Scoping happens one level down, per claim.
 
 | Layer | Scope | Governed by |
 |---|---|---|
-| Dev box (your environment) | full repo, all modules readable, whole CLI, the API, the preview | nothing — it's yours |
+| Your checkout (your machine) | full repo, all modules readable, whole CLI, the API, the preview | nothing — it's yours |
 | Kernel capabilities (claim/ship/capture/…) | everything the platform can do | **your rank** (server-enforced) — never a module |
 | A claim's worktree | write = its one module; read = that module + the kernel doorway | the task's **module label** + the ship-time diff check |
 
-## 2. Flow: open a dev box → ship a task
+## 2. Flow: open your checkout → ship a task
 
 ```mermaid
 graph LR
-    A["Open dev box<br/>(box)"] --> B["/builder-start<br/>lists ALL modules<br/>(kernel)"]
+    A["Open your checkout<br/>(local)"] --> B["/builder-start<br/>lists ALL modules<br/>(kernel)"]
     B --> C["/builder-claim N<br/>a game task<br/>(kernel)"]
     C --> D["worktree spun:<br/>modules/game + RO kernel<br/>(module-scoped)"]
     D --> E["agent edits game only<br/>(module-scoped)"]
@@ -31,7 +31,7 @@ graph LR
     F --> G["live ✓<br/>worktree reaped"]
 ```
 
-Five of seven steps are kernel/box capabilities; only the worktree + the edits are module-scoped. The only *new* thing is a silent check inside `/builder-ship` (diff ⊆ declared module) that in-scope work never notices.
+Five of seven steps are kernel/local capabilities; only the worktree + the edits are module-scoped. The only *new* thing is a silent check inside `/builder-ship` (diff ⊆ declared module) that in-scope work never notices.
 
 ## 3. Flow: claim a task in a different module
 
@@ -39,14 +39,14 @@ You're never "in" a module — each *claim* is. A second claim just makes a seco
 
 ## 4. Flow: see an idea — and seed a cross-module task
 
-Browsing ideas, filing an idea, and **seeding a task for another module** are all kernel operations — they need no access to the other module's code, so they work from anywhere. An agent in a game worktree can't *write* dev-box code, but it can always *file the task* for it (one command), then continue or hand off; a dependency link orders them if needed.
+Browsing ideas, filing an idea, and **seeding a task for another module** are all kernel operations — they need no access to the other module's code, so they work from anywhere. An agent in a game worktree can't *write* discord code, but it can always *file the task* for it (one command), then continue or hand off; a dependency link orders them if needed.
 
 ## 5. "Could this block me?" — every worry
 
 | Worry | Why it isn't a block |
 |---|---|
 | Claim a task in a module I'm not "in"? | You're never "in" a module. Claiming is kernel; each claim makes its own scoped worktree. |
-| Does my box only have one module's code? | No — the box has the full repo. Only each per-claim worktree is scoped. |
+| Does my checkout only have one module's code? | No — the checkout has the full repo. Only each per-claim worktree is scoped. |
 | Agent needs another module mid-task — stuck? | No — it seeds a task for it (kernel op, needs no access to that code); a dep orders them. |
 | Filing an idea about module X needs X access? | No — capture/inbox is kernel; file from anywhere. |
 | Is shipping gated by my module? | No — ship is kernel; the only module check is "diff ⊆ module," which passes for normal work. |
@@ -60,7 +60,7 @@ A Claude Code session is **not** welded to one worktree. The session is a **cond
 graph TD
     S["long autonomous SESSION = <redacted> repo · full mobility · no module binding"]
     S --> A["task A (game) → worktree A → its own PR → ship"]
-    S --> B["task B (dev-box) → worktree B → its own PR → ship"]
+    S --> B["task B (discord) → worktree B → its own PR → ship"]
     S --> C["task C (memory) → worktree C → its own PR → ship"]
 ```
 
@@ -69,34 +69,36 @@ graph TD
 
 The session has full mobility across modules; only each *task's worker* is module-isolated. This is the orchestrator-worker pattern (ADR 0024), and Bongos already assigns a per-claim worktree.
 
-## 7. Limiting what the box holds — the jailbreak blast radius
+## 7. Limiting what a sandbox holds — the jailbreak blast radius
 
-The split lets the box hold **far less**: only the claimed module (read/write) + the kernel's **safe contract** (signatures, read-only) + client plumbing + a scoped token. The kernel **implementation** (auth, rank, ship, grade) never leaves the server.
+*This section was written for the dev box, which has since been retired ([ADR 0346](../../adr/0346-dev-boxes-are-retired.md)). The reasoning holds for any sandboxed environment a session might run in, such as a future cloud session. Today's path, a local checkout, holds the full repo by design (§1).*
+
+The split lets a sandbox hold **far less**: only the claimed module (read/write) + the kernel's **safe contract** (signatures, read-only) + client plumbing + a scoped token. The kernel **implementation** (auth, rank, ship, grade) never leaves the server.
 
 ```mermaid
 graph LR
-    subgraph Box["DEV BOX · one claim (= jailbreak blast radius)"]
+    subgraph Sbx["SANDBOX · one claim (= jailbreak blast radius)"]
         M["modules/&lt;key&gt;/ — read/write"]
         KC["kernel CONTRACT — signatures + docs only (RO)"]
         CLI["CLI plumbing (cli-lib)"]
         TOK["scoped, claim-scoped token (not full-repo)"]
     end
     subgraph Server["SERVER · the trusted side"]
-        KI["KERNEL IMPL — auth · rank · ship · grade<br/>(never on the box)"]
+        KI["KERNEL IMPL — auth · rank · ship · grade<br/>(never in the sandbox)"]
         OM[every other module's source]
         FR[full repo + history]
         EN["ENFORCES the rank ladder, live per request (ADR 0016)"]
     end
-    Box -->|"privileged ops = HTTP call<br/>(box can't push main)"| Server
+    Sbx -->|"privileged ops = HTTP call<br/>(sandbox can't push main)"| Server
 ```
 
-**The trap to avoid:** reducing what's *on disk* is not reducing *access* — a box holding a full-repo credential re-fetches. The real lever is **scoping the box's credential + fetch to the claimed module** (and module access can be **rank-gated** too, since the server mediates every fetch). The primary boundary always remains the **server-enforced rank ladder**; on-disk minimization is defense-in-depth on top.
+**The trap to avoid:** reducing what's *on disk* is not reducing *access* — a sandbox holding a full-repo credential re-fetches. The real lever is **scoping the sandbox's credential + fetch to the claimed module** (and module access can be **rank-gated** too, since the server mediates every fetch). The primary boundary always remains the **server-enforced rank ladder**; on-disk minimization is defense-in-depth on top.
 
 | Approach | Efficiency | Real confidentiality boundary? |
 |---|---|---|
 | Sparse-checkout only | ✓ smaller tree | ✗ — `.git` still has everything |
-| Partial clone + sparse | ✓✓ | ~ — box can lazily re-fetch with its token |
-| **Server-mediated, claim-scoped fetch** | ✓✓ | **✓ — box never holds a full-repo remote or kernel source** |
+| Partial clone + sparse | ✓✓ | ~ — sandbox can lazily re-fetch with its token |
+| **Server-mediated, claim-scoped fetch** | ✓✓ | **✓ — sandbox never holds a full-repo remote or kernel source** |
 | Per-module repos | ✓✓ | ✓✓ strongest — but contradicts single-repo (ADR 0080 rejected package-modules for v1) |
 
 ## 8. Two boundaries that compose (no new friction)

package/docs/design/modular-architecture/04-module-lifecycle.md

@@ -8,7 +8,7 @@ The one-way rule forbids a module importing another. But the **lifecycle** (whic
 
 - **Ports** (a *required, single-provider* capability): the economy module registers a `reward` provider; at ship, the lifecycle asks the kernel to resolve `reward` and calls it. **Economy owns the formula *and* the ledger**; the lifecycle only supplies the session and delivers the result.
 - **Events** (an *optional* reaction): the lifecycle emits `task.shipped`; the discord module reacts if it cares.
-- **Contributions** (an *accumulating extension point*): zero-or-more modules each add a piece to a named point and the kernel hands the whole set to a core consumer — how a module adds its own slice to a shared core surface without core hardcoding it. The `profile.fields` point lets dev-box/discord/art add their slice to the `GET /me` payload (and its browser twin, `window.OTB.contributeSettingsPanel`, adds a Settings panel) instead of those being baked into `routes/me.js` + `settings.js` (BV1.R42 / task 1411 — the strangler prerequisite for those three moves; game has no such coupling). Add-only: a contribution may introduce keys, never overwrite a core one.
+- **Contributions** (an *accumulating extension point*): zero-or-more modules each add a piece to a named point and the kernel hands the whole set to a core consumer — how a module adds its own slice to a shared core surface without core hardcoding it. The `profile.fields` point lets discord/art add their slice to the `GET /me` payload (and its browser twin, `window.OTB.contributeSettingsPanel`, adds a Settings panel) instead of those being baked into `routes/me.js` + `settings.js` (BV1.R42 / task 1411 — the strangler prerequisite for those moves; game has no such coupling). Add-only: a contribution may introduce keys, never overwrite a core one.
 
 ```mermaid
 graph LR

package/docs/design/modular-architecture/README.md

@@ -4,17 +4,19 @@ Five reports from the **2026-06-21 modular-architecture design session**, filed
 
 > **Status: pre-red-team draft.** These are research/design reports, not a decision record. A formal numbered ADR follows once they've been red-teamed. Filed under `docs/design/` (not `docs/adr/`) on purpose — the ADR numbering is in flux (0079→0081 collisions), so the number is assigned later on an up-to-date worktree.
 
+> **Since filing:** the dev box module that these reports use as their first example was retired on 2026-09-28 ([ADR 0346](../../adr/0346-dev-boxes-are-retired.md)). Where a report still names it (the code-size table, the import-graph findings, the migration plan), that is the tree as it stood at filing.
+
 | # | Doc | What it answers |
 |---|-----|-----------------|
 | 00 | [Research report](00-research-report.md) | Industry best practice on packaging, plugins, theming, and AI-agent scoping (cited) |
 | 01 | [Architecture](01-architecture.md) | The concrete core+modules design; why not a rewrite; the migration path |
 | 02 | [Module map](02-module-map.md) | Where the ~95k LOC live; how finely to cut the core; the decided roster |
-| 03 | [Builder flows](03-builder-flows.md) | What the dev box can access; why the structure never blocks a builder |
+| 03 | [Builder flows](03-builder-flows.md) | What a builder's checkout can access; why the structure never blocks a builder |
 | 04 | [Module lifecycle & maintenance](04-module-lifecycle.md) | How modules interact (seams) and stay healthy as code grows |
 
 ## The decided model (one paragraph)
 
-A small **kernel** (auth, rank, db-pool, the loader, the seam registry, trust primitives, config/identity, analytics, the trusted publish path) plus **~16 modules** (lifecycle, economy, grading, memory, onboarding, ideas, builder-settings, sessions/BFG, autonomy/MAS, security, hall-UI, status-UI + game/art-pipeline/discord/dev-box). Modules **never import each other** — they interact through **kernel-mediated seams** (ports + events). Boundaries are held by **CI fitness functions** so the structure can't rot as it grows. It stays **single-package, single-process, no-bundler** — modularity is a separate axis from packaging/runtime/build. It is built via an incremental **strangler migration**, not a ground-up rewrite.
+A small **kernel** (auth, rank, db-pool, the loader, the seam registry, trust primitives, config/identity, analytics, the trusted publish path) plus **~16 modules** (lifecycle, economy, grading, memory, onboarding, ideas, builder-settings, sessions/BFG, autonomy/MAS, security, hall-UI, status-UI + game/art-pipeline/discord). Modules **never import each other** — they interact through **kernel-mediated seams** (ports + events). Boundaries are held by **CI fitness functions** so the structure can't rot as it grows. It stays **single-package, single-process, no-bundler** — modularity is a separate axis from packaging/runtime/build. It is built via an incremental **strangler migration**, not a ground-up rewrite.
 
 ## How the boundaries were drawn
 

package/docs/design/reviews/hall-v2/README.md

@@ -19,6 +19,8 @@ The 26 pages that carry a `*.states.json` (`modules/hall-ui/public/`), each rend
 
 Sheets: `<page>--<rank>.webp`, one per page-lane — dark rows above light, 1440 → 390 → 320 left to right, one tile per state. (The atlas sheets are from the second run, with `atlas.json` generated.)
 
+The `harbor` and `pair` sheets were deleted when those two pages were removed with the dev box ([ADR 0346](../../../adr/0346-dev-boxes-are-retired.md)). The counts and lists below are as walked on 2026-09-02, with both pages in them.
+
 ## Page × rank
 
 | page | xenos | metic | archon |
@@ -31,13 +33,11 @@ Sheets: `<page>--<rank>.webp`, one per page-lane — dark rows above light, 1440
 | gate | 12 · refused (metic+) | 12 · clean | 18 · clean |
 | goals | 20 · clean | 20 · clean | 30 · clean |
 | government | 20 · refused (permissions view is archon) | 20 · refused (same) | 30 · clean |
-| harbor | 12 · refused (metic+) | 12 · clean | 18 · clean |
 | idea | 8 · clean | 8 · clean | 12 · clean |
 | ideas | 8 · clean | 8 · clean | 12 · clean |
 | index | 16 · clean | 16 · clean | 24 · clean |
 | modules | 20 · clean | 20 · clean | 30 · clean |
 | not-ready | 8 · clean | 8 · clean | 12 · clean |
-| pair | 8 · clean | 8 · clean | 12 · clean |
 | people | 12 · clean | 12 · clean | 18 · clean |
 | primer | 12 · harness (sign-in redirect) | 12 · harness | 18 · harness |
 | profile | 20 · **defect 1003497** (signed-out links) | 20 · **defect 1003497** | 30 · **defect 1003497** |

package/docs/design/vanilla-hall-ui-redesign-scope.md

@@ -38,7 +38,7 @@ The current hall is **one long single-column page** (`index.html`, `<main>` capp
 
 The eleven core widgets (from `hall-widgets.js`, by mount order): **Welcome, Path (onboarding), Standing (profile), Honours (8 laurels), Karma, Acclaim, Works (ships), Marks (grades), Curve (analytics), Bounty (red-team rewards), Roll (leaderboard)** — plus a **Goals** widget (`goals.js`).
 
-Separate full pages behind header links: **Work Board, Primer, Diagrams, Repo Atlas, Ranks, Settings, Pair**, plus Archon-only **Watch, Harbor, Gate**.
+Separate full pages behind header links: **Work Board, Primer, Diagrams, Repo Atlas, Ranks, Settings**, plus Archon-only **Watch, Gate**.
 
 The data and the registry seam stay. The redesign changes the **frame** the widgets live in.
 
@@ -99,7 +99,7 @@ Seven primary destinations plus a gated Admin group. Today's eleven scrolls coll
 | **Leaderboard** | Roll of the Foremost | Table view | signed-in |
 | **Docs** | Primer, Diagrams/maps, Repo Atlas | Doc pages + TOC | signed-in |
 | **Settings** | Settings (all panels) | Sub-nav + panels | signed-in |
-| **Admin ▾** | Watch, Harbor, Gate | Grouped, collapsed | **Archon only** |
+| **Admin ▾** | Watch, Gate | Grouped, collapsed | **Archon only** |
 
 > Rank/permission gating is **unchanged** — Xenos still don't see Work until graduation; Admin only unhides at `rank=archon`. The redesign moves *where* those links render (into the sidebar), not *whether* they gate.
 
@@ -152,7 +152,7 @@ Kept close to today's three-section structure (in-progress, claimable, history),
 
 ## 7. Surface · Settings — grouped panels
 
-Settings has the most sections today (~15: connections, dev box, box app, craft, display name, wandering, render, art key, CLI, voices, sounds, event sounds…). It gets its own left sub-nav so each group is a focused panel.
+Settings has the most sections today (~13: connections, craft, display name, wandering, render, art key, CLI, voices, sounds, event sounds…). It gets its own left sub-nav so each group is a focused panel.
 
 | Component | Type | Placement | Size |
 |---|---|---|---|
@@ -251,7 +251,7 @@ Not layout, but it rides along. Most of this already flows through the brand pac
 - Neutral default voice
 
 **Deferred**
-- Archon pages — Watch, Harbor, Gate (inherit shell only; internal layout unchanged)
+- Archon pages — Watch, Gate (inherit shell only; internal layout unchanged)
 - Rank-name copy decision
 - Public apex landing page (separate surface)
 

package/docs/file-map.md

@@ -94,7 +94,7 @@
 │   ├── <redacted>.sql ← /builder-exit: deactivated builders drop to 'xenos'
 │   ├── <redacted>.sql ← builders.preferred_disciplines column (enum renamed by mig 086)
 │   ├── 029_rank_three_live.sql  ← #360/ADR 0018: rank default thetes→xenos + tasks.xenos_claimable (three-rank model live)
-│   ├── 067_builder_boxes.sql    ← #598/ADR 0031: builder_boxes (per-builder dev box lifecycle state) + box_events ledger
+│   ├── 067_builder_boxes.sql    ← #598/ADR 0031: the per-builder dev box lifecycle tables; dropped by core_258 (ADR 0346)
 │   └── <redacted>.sql ← task 615: rename disciplines engineering→engineer, creative→artist|ideator; swaps both CHECK constraints + backfills tasks.discipline & builders.preferred_disciplines
 ├── modules/                    ← self-contained optional feature modules (ADR 0083 / docs/modules-contract.md). Each `modules/<key>/` is a full vertical slice — routes, migrations, skills, seam registrations — reached only through src/module-api.js. The loader discovers them at boot; no core file changes to add one.
 │   ├── game/                   ← the playable Example world — Phaser client, Colyseus rooms (WorldRoom/QueueRoom), world/terrain model, game DB tables, static assets. Moved BV1.R49 (task 1418). CLAUDE.md, module.json, routes/game.js, rooms/, world/, public/, migrations/.
@@ -149,7 +149,7 @@
 │       ├── gen-file-map.js      ← ADR 0066 ([#1276](https://example.com/builders#/task/1276)): generates the `.claude/skills/` + `.claude/scheduled-tasks/` sections of docs/file-map.md from disk; per-entry notes come from docs/file-map.notes.json; `--check` fails on drift OR a skill/routine with no note (CI gate via fitness.js); regenerated on deploy by ship.js regenerateFileMap()
 │       ├── spike-task-map.js    ← (task 1003282, goal 1000072) the task-network-map spike harness: builds a ~1,357-task graph across a swept dependency density, lays it out for real (<redacted> + Barnes-Hut), counts what decides readability (isolated nodes, components, distinguishable marks / overplot, crossings, ink budget, payload) and renders PNGs with a hand-rolled encoder. Zero deps, no DB. `--from <tasks.json>` measures the REAL corpus instead of the model. Verdict: docs/research/task-network-map-readability.md
 │       ├── fitness.js           ← Path C (ADR 0062 §9, [#1225](https://example.com/builders#/task/1225)): architecture fitness functions — core↔host import boundary (zero grandfathered exceptions as of R52/#1191), CLAUDE.md budget + nested-doc presence (ADR 0061), no route bypasses rank checks (reuses route-rank-check), repo-map freshness. Enforced in CI via tests/fitness.mjs (the `unit` gate). `node scripts/gds/fitness.js`
-│       ├── ship.js              ← resolve claim as shipped, award credits (`/builder-ship`); also uploads a secret-scrubbed session digest to the corpus (6D.1, ADR 0027); on a dev box runs the sandbox-first review gate before resolving (#927, ADR 0046)
+│       ├── ship.js              ← resolve claim as shipped, award credits (`/builder-ship`); also uploads a secret-scrubbed session digest to the corpus (6D.1, ADR 0027); runs the sandbox-first review gate before resolving when the checkout has a local game preview (#927, ADR 0046)
 │       ├── ship-visual.js       ← the OPTIONAL `--visual <image> [--visual-alt "…"]` leg of a ship (task 1003109): screens the file BEFORE the claim resolves (bad input costs no claim), uploads it AFTER (a failed picture never fails a ship)
 │       ├── package-core.js      ← package the core as a versioned, installable artifact + pin manifest (`bongos package-core`; R84, ADR 0100 §1, [#1688](https://example.com/builders#/task/1688)): isPublishable() selection + mirror redaction + fail-closed no-leak gate → dist/bongos-core-<version>.{tgz,manifest.json}; version = src/module-api CORE_VERSION. Recipe: docs/recipes/packaging-the-core.md
 │       ├── release-notes.js     ← what each core release brought in (task 1004218): generated at pack time from the ref's HISTORY into the package's release-notes.json (exact per-release ranges, 1 MiB bound; package-core redacts its prose like a doc), read back by the upgrade runner for a from→to range; home of the one merge-summary parser
@@ -208,7 +208,7 @@
 │   │   ├── catalog.js          ← the browsable module catalog model (ADR 0167 / ADR 0107 §2/§3): `source` (which TREE ships it — core package vs instance, read off the loader's discovery root) + resolved author/origin `credit` with an `inferred` flag. The ONE builder behind both `GET /api/bongos/modules` and `bongos module list --catalog`, so the hall + CLI can't drift.
 │   │   └── semver.js           ← minimal semver `satisfies(version, range)` used by the loader (no npm dep).
 │   ├── platform-server.js       ← BONGOS-ONLY entrypoint (ADR 0062 R51, task 1190): boots Express + the shared internal surface (API + hall + status) with NO game in the process; the inverse of preview-server.js. `node src/platform-server.js`
-│   ├── preview-server.js        ← GAME-ONLY entrypoint for the per-box sandbox (ADR 0052): Phaser/Colyseus + tiles, NO /api/bongos
+│   ├── preview-server.js        ← GAME-ONLY entrypoint for the local preview that `/builder-stage` runs (ADR 0052): Phaser/Colyseus + tiles, NO /api/bongos
 │   ├── seats.js                 ← in-process seat counter + EventEmitter
 │   ├── rooms/
 │   │   ├── WorldRoom.js         ← singleton room: move + interact + identity
@@ -221,8 +221,8 @@
 │   │   ├── routes.js            ← thin mounter — imports each routes/* sub-router + every enabled module's routes and stitches them behind kernel-composed auth
 │   │   ├── api-prefix.js        ← API_PREFIX ('/api/bongos') + LEGACY_API_PREFIXES ('/api/gds' permanent alias) + API_VERSION
 │   │   ├── api-path-404.js      ← recognize Bongos-API-shaped paths that missed the mount → JSON 404 + corrective hint (server.js catch-all; V4.R14, [#952](https://example.com/builders#/task/952))
-│   │   ├── serve-internal.js    ← (ADR 0062 R51, task 1190) the SHARED internal web surface: mountInternalSurfaces(app) wires /healthz + /version + /api/bongos + the Dev Box downloads + the status & builders hosts; called by BOTH server.js (game boot) and platform-server.js (Bongos-only) so the two never drift. Also injects clientBranding() as window.__BRANDING__ into the served hall/status HTML
-│   │   ├── routes/              ← one file per KERNEL feature so parallel branches stop colliding on routes.js — the domain routes (tasks/claims/versions/cost/leaderboard/memory/learnings/box/inbox/blockers/search/gate-approvals/discord/…) graduated with their domains into `modules/<key>/routes/`, reached only through the loader
+│   │   ├── serve-internal.js    ← (ADR 0062 R51, task 1190) the SHARED internal web surface: mountInternalSurfaces(app) wires /healthz + /version + /api/bongos + the `bongos` CLI downloads + the status & builders hosts; called by BOTH server.js (game boot) and platform-server.js (Bongos-only) so the two never drift. Also injects clientBranding() as window.__BRANDING__ into the served hall/status HTML
+│   │   ├── routes/              ← one file per KERNEL feature so parallel branches stop colliding on routes.js — the domain routes (tasks/claims/versions/cost/leaderboard/memory/learnings/inbox/blockers/search/gate-approvals/discord/…) graduated with their domains into `modules/<key>/routes/`, reached only through the loader
 │   │   │   ├── _helpers.js      ← validateOrRespond, parseId, LIMITS, asyncHandler, publicOrigin, corsPublicGet, parseCookie
 │   │   │   ├── healthz.js, auth.js, me.js, builders.js, instance.js
 │   │   │   ├── my-sessions.js   ← GET /me/sessions + POST /me/sessions/revoke{,-all} — the OWN-scoped session self-service (task 1003341, ADR 0206): see and kill your own sessions without an Archon. Kept apart from auth.js's admin-gated cross-builder pair so the no-caller-named-owner rule holds over a WHOLE file (tests/own_session_revoke.mjs)

package/docs/handoff-template.md

@@ -65,7 +65,7 @@ If even one of these is false, the claim is `[verified-smoke]` or `[implemented-
 
 ### Diagram backstop (task [#357](https://example.com/builders#/task/357); conceptual diagrams auto-generated [#436](https://example.com/builders#/task/436))
 
-If your change touched anything the onboarding diagrams describe — the **rank enum or which ranks are wired** (`requireRank`, `builders.rank` default, exit/assign paths), the **task-status set**, the **versions** (id/track/status), or the **complete-architecture** (the ADR 0024 memory chain + the dev-box → production ship flow) **/ example-karma** models (which now flip per the **shipped** status of their backing tasks) — then before shipping:
+If your change touched anything the onboarding diagrams describe — the **rank enum or which ranks are wired** (`requireRank`, `builders.rank` default, exit/assign paths), the **task-status set**, the **versions** (id/track/status), or the **complete-architecture** (the ADR 0024 memory chain + the machine → production ship flow) **/ example-karma** models (which now flip per the **shipped** status of their backing tasks) — then before shipping:
 
 - **All five diagrams are auto-generated** by `scripts/gds/gen-diagrams.js` — run it (`node scripts/gds/gen-diagrams.js`) and confirm the result looks right; **do not hand-edit any `.mmd`**. The mechanical three (`01-task-lifecycle`, `02-rank-ladder`, `05-versioning`) regenerate from migrations + the public version API. The conceptual two (`03-example-karma`, `04-architecture`) regenerate from the **authenticated** `/tasks/:id` status of their backing tasks (and 03's seeded-achievement count); if no session is present the generator skips them cleanly. Rendering produces both `.svg` (the pannable viewer asset) and `.png` (fallback).
 - To change a diagram's **layout or wording**, edit the matching template function in `gen-diagrams.js` — not the `.mmd`. `assertions.json` is rebuilt by the generator in lockstep, so you don't hand-maintain it.

package/docs/module-api-changelog.md

@@ -2637,5 +2637,13 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1073 with no explicit bump. run 36510198162. (task 1002620)
   1.19.1075 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1074 with no explicit bump. run 36512197709. (task 1002620)
+  (note, no bump) — auth.allowBoxScope is now a deprecated no-op (task 1003894).
+        The narrowing session scope it opted a route into, and the three box.*
+        permissions, were removed with the dev box (ADR 0346). The export is kept so
+        the doorway loses nothing inside 1.x; it goes at the next MAJOR.
+  1.19.1076 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1075 with no explicit bump. run 36523068301. (task 1002620)
+  1.19.1077 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1076 with no explicit bump. run 36558431394. (task 1002620)
 ---------------------------------------------------------------------------
 ```