@bongos/core 1.19.1081 → 1.20.1

package/.claude/skills/planning-session/SKILL.md

@@ -33,7 +33,7 @@ This mirrors GDS-V3 criterion C2 (`three-ranks-gate-everything`) and matches the
 
 **Enforce the gate at the very top of the session, before reading anything else:**
 
-1. Call `GET /api/bongos/me` and read `builder.rank`. Compare case-insensitively (lowercase it before testing).
+1. Call `GET /api/bongos/me` and read `builder.rank`. Compare case-insensitively (lowercase it before testing). **If it answers `401`, or the CLI says the Bongos CLI session is no longer valid**, stop before anything else and tell the builder to run `/builder-reauth` (the fast Settings re-issue), then re-run this skill — there is nothing to lose yet. (A session that is valid here can still expire before Phase 5, which is why Phase 4 spools and Phase 5 probes again; task 1002865.)
 2. **If `rank` is present and lowercases to `xenos`** → stop immediately. Tell the builder: *"Planning sessions set the scope-truth of a version — they're a Metic+ operation. You're currently Xenos. You can still **file** a criterion proposal or task idea via `POST /api/bongos/inbox` (which lands in idea_inbox for a Metic+ builder to ratify at the next planning session); ask an Archon for promotion if you need to run sessions directly."* Do not pull state, do not present criteria, do not propose tasks.
 3. **If `rank` lowercases to `metic`** → proceed in **Metic-mode**: run the five-phase structure below conversationally, but in Phase 5 write proposals to `idea_inbox` (kind=`criterion-proposal` for criteria, kind=`feature` for tasks) tagged with the target version — filed with `node scripts/gds/capture.js "…" --via planning` (or `filed_via: 'planning'` on `POST /inbox`), so the sky records the door they came through (task 1004233; every other filing's door is read off the session). Any Metic+ builder ratifies them (`idea.ratify`, metic-floored since ADR 0157) — typically at the next planning session. Since [ADR 0090](../../../docs/adr/0090-metic-task-authoring.md) a Metic MAY `POST /tasks` directly, and since [ADR 0154](../../../docs/adr/0154-goal-owner-criterion-authoring.md) a Metic MAY write a `done_when_criteria` row for a goal they own or manage. What needs an Archon is a VERSION-level criterion (no `goal_id`), one in a goal you don't hold, and — since [ADR 0250](../../../docs/adr/0250-strict-versioning-the-version-boundary-is-the-scope-gate.md) §6 (task 1003608) — **creating a version at all**: `version.create` returned to the Archon floor, because once the version boundary carries the scope gate, cutting a version is the way around it rather than authoring. ADR 0157 had briefly delegated it to Metic; it no longer is. The spec-draft (Phase 3) and the in-depth interview (Phase 4) run identically in Metic-mode — the only difference is the Phase-5 write (you file proposals, you don't seed tasks directly).
 
@@ -195,6 +195,8 @@ Tell the user the spec is written and where, then move straight to the interview
 
 **This is the heart of the new flow — it replaces asking for task-by-task approval.** Read the spec you just wrote, then interview the owner with the **AskUserQuestion tool** to resolve every non-obvious decision before a single task is seeded.
 
+**Spool every answer to the spec file as it lands (task 1002865).** After each AskUserQuestion round, write the decisions into the spec file's *Design decisions & assumptions* and strike them from *Open questions* before you ask the next round — never hold the interview only in the conversation. The spec on disk is what Phase 5 reads; if the Bongos login expires mid-session, a re-auth then costs a minute, not the interview.
+
 **Run it as a loop, not a one-shot:**
 
 1. From the spec's *Open questions* (plus anything the task outline leaves genuinely undecided), assemble a round of up to **4 questions** and ask them with AskUserQuestion. Put a recommended option first when you have a view; always leave room for "Other."
@@ -263,7 +265,9 @@ This is what the V3.R02 (task 309) dependency system encodes; Phase 5 writes bot
 
 ### Phase 5 — Land it
 
-Once the spec is finalized (Phase 4), **read `docs/specs/<ver>-<goal-slug>.md` as the source of truth** and do the writes in this exact order. (If the goal and its criteria already exist — e.g. this session planned tasks for a pre-existing goal — skip the goal/criteria creation in step 2 and seed the tasks under the existing goal, linking them via `criterion_ids` + `goal_id`.)
+Once the spec is finalized (Phase 4), **read `docs/specs/<ver>-<goal-slug>.md` as the source of truth** and do the writes in this exact order.
+
+**Probe the session right before the first write, and recover on a 401 (task 1002865).** Call `GET /api/bongos/me` again here: a session that passed the gate at Phase 1 can expire during a long interview (the retro that filed this: 200 at the gate, 401 by Phase 5). If the probe — or ANY write below — answers `401` / "session is no longer valid", **do not abandon the session**: tell the builder to run `/builder-reauth`, wait for it, then **resume** from the write that failed. Everything the session decided is already in the spec file (Phase 4 spooled it), and the writes are idempotent — the meta task and every seeded task on `source_ref`, criteria on `criterion_id` (a 409 means already seeded), dependencies on `(task_id, depends_on_task_id)` — so re-running the seed script after a re-auth creates nothing twice. (If the goal and its criteria already exist — e.g. this session planned tasks for a pre-existing goal — skip the goal/criteria creation in step 2 and seed the tasks under the existing goal, linking them via `criterion_ids` + `goal_id`.)
 
 1. **Create a meta planning-session task** (`source_ref='<ver>-planning-N'`) that backs all the writes — version='<ver>', kind='decision', status='ready', priority=5, the full session described in its body. Claim it. (For a long session — a big spec + a multi-round interview — create and claim this meta task **early, at Phase 1**, so the spec-write and interview are themselves covered by a claim. A rebase-gated builder can't claim new work; as Archon, proceed and record the session in the meta task even if the claim is blocked, noting it.)
 

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 440 operations across 67 resource groups
+- 454 operations across 69 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -372,6 +372,12 @@ function createClient(opts = {}) {
       // POST /github/repos — rank: any-builder — POST /github/repos
       postGithubRepos: (args) => request("POST", "/github/repos", { hasBody: true }, args),
     },
+    "goalTaskRelevance": {
+      // POST /goal-task-relevance/{id}/decide — rank: metic+archon — POST /goal-task-relevance/:id/decide
+      postGoalTaskRelevanceIdDecide: (args) => request("POST", "/goal-task-relevance/{id}/decide", { hasBody: true }, args),
+      // GET /goal-task-relevance/pending — rank: metic+archon — GET /goal-task-relevance/pending
+      getGoalTaskRelevancePending: (args) => request("GET", "/goal-task-relevance/pending", { hasBody: false }, args),
+    },
     "goals": {
       // GET /goals — rank: any-builder — GET /goals
       getGoals: (args) => request("GET", "/goals", { hasBody: false }, args),
@@ -717,6 +723,16 @@ function createClient(opts = {}) {
       postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
     },
     "npmRelease": {
+      // DELETE /npm-release/preview — rank: any-builder — DELETE /npm-release/preview
+      deleteNpmReleasePreview: (args) => request("DELETE", "/npm-release/preview", { hasBody: false }, args),
+      // GET /npm-release/preview — rank: any-builder — GET /npm-release/preview
+      getNpmReleasePreview: (args) => request("GET", "/npm-release/preview", { hasBody: false }, args),
+      // POST /npm-release/preview — rank: any-builder — POST /npm-release/preview
+      postNpmReleasePreview: (args) => request("POST", "/npm-release/preview", { hasBody: true }, args),
+      // GET /npm-release/preview/enter — rank: any-builder — GET /npm-release/preview/enter
+      getNpmReleasePreviewEnter: (args) => request("GET", "/npm-release/preview/enter", { hasBody: false }, args),
+      // GET /npm-release/preview/exit — rank: any-builder — GET /npm-release/preview/exit
+      getNpmReleasePreviewExit: (args) => request("GET", "/npm-release/preview/exit", { hasBody: false }, args),
       // GET /npm-release/task/{id} — rank: any-builder — GET /npm-release/task/:id
       getNpmReleaseTaskId: (args) => request("GET", "/npm-release/task/{id}", { hasBody: false }, args),
       // GET /npm-release/work — rank: archon — GET /npm-release/work
@@ -797,6 +813,8 @@ function createClient(opts = {}) {
       postProvisioningInstancesIdGithubApp: (args) => request("POST", "/provisioning/instances/{id}/github-app", { hasBody: true }, args),
       // GET /provisioning/instances/{id}/invite-suggestions — rank: any-builder — GET /provisioning/instances/:id/invite-suggestions
       getProvisioningInstancesIdInviteSuggestions: (args) => request("GET", "/provisioning/instances/{id}/invite-suggestions", { hasBody: false }, args),
+      // GET /provisioning/instances/{id}/render — rank: any-builder — GET /provisioning/instances/:id/render
+      getProvisioningInstancesIdRender: (args) => request("GET", "/provisioning/instances/{id}/render", { hasBody: false }, args),
       // POST /provisioning/instances/{id}/render — rank: any-builder — POST /provisioning/instances/:id/render
       postProvisioningInstancesIdRender: (args) => request("POST", "/provisioning/instances/{id}/render", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/repo-private — rank: any-builder — POST /provisioning/instances/:id/repo-private
@@ -813,6 +831,8 @@ function createClient(opts = {}) {
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations
       getProvisioningRecommendations: (args) => request("GET", "/provisioning/recommendations", { hasBody: false }, args),
+      // POST /provisioning/render/lookup — rank: any-builder — POST /provisioning/render/lookup
+      postProvisioningRenderLookup: (args) => request("POST", "/provisioning/render/lookup", { hasBody: true }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
       // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles
@@ -864,6 +884,16 @@ function createClient(opts = {}) {
       // POST /removal-proposals/{id}/decide — rank: metic+archon — POST /removal-proposals/:id/decide
       postRemovalProposalsIdDecide: (args) => request("POST", "/removal-proposals/{id}/decide", { hasBody: true }, args),
     },
+    "renderDeploy": {
+      // POST /render-deploy/act — rank: archon — POST /render-deploy/act
+      postRenderDeployAct: (args) => request("POST", "/render-deploy/act", { hasBody: true }, args),
+      // GET /render-deploy/app — rank: archon — GET /render-deploy/app
+      getRenderDeployApp: (args) => request("GET", "/render-deploy/app", { hasBody: false }, args),
+      // PUT /render-deploy/app — rank: archon — PUT /render-deploy/app
+      putRenderDeployApp: (args) => request("PUT", "/render-deploy/app", { hasBody: true }, args),
+      // GET /render-deploy/history — rank: archon — GET /render-deploy/history
+      getRenderDeployHistory: (args) => request("GET", "/render-deploy/history", { hasBody: false }, args),
+    },
     "scouting": {
       // GET /scouting — rank: metic+archon — GET /scouting
       getScouting: (args) => request("GET", "/scouting", { hasBody: false }, args),
@@ -949,6 +979,8 @@ function createClient(opts = {}) {
       deleteSpecialitiesIdDocumentsDocId: (args) => request("DELETE", "/specialities/{id}/documents/{docId}", { hasBody: false }, args),
       // POST /specialities/{id}/offer — rank: metic+archon — POST /specialities/:id/offer
       postSpecialitiesIdOffer: (args) => request("POST", "/specialities/{id}/offer", { hasBody: true }, args),
+      // PUT /specialities/{id}/skills — rank: any-builder — PUT /specialities/:id/skills
+      putSpecialitiesIdSkills: (args) => request("PUT", "/specialities/{id}/skills", { hasBody: true }, args),
       // POST /specialities/{id}/unoffer — rank: metic+archon — POST /specialities/:id/unoffer
       postSpecialitiesIdUnoffer: (args) => request("POST", "/specialities/{id}/unoffer", { hasBody: true }, args),
       // GET /specialities/offered — rank: any-builder — GET /specialities/offered

package/clients/bongos-client/index.cjs

@@ -371,6 +371,12 @@ function createClient(opts = {}) {
       // POST /github/repos — rank: any-builder — POST /github/repos
       postGithubRepos: (args) => request("POST", "/github/repos", { hasBody: true }, args),
     },
+    "goalTaskRelevance": {
+      // POST /goal-task-relevance/{id}/decide — rank: metic+archon — POST /goal-task-relevance/:id/decide
+      postGoalTaskRelevanceIdDecide: (args) => request("POST", "/goal-task-relevance/{id}/decide", { hasBody: true }, args),
+      // GET /goal-task-relevance/pending — rank: metic+archon — GET /goal-task-relevance/pending
+      getGoalTaskRelevancePending: (args) => request("GET", "/goal-task-relevance/pending", { hasBody: false }, args),
+    },
     "goals": {
       // GET /goals — rank: any-builder — GET /goals
       getGoals: (args) => request("GET", "/goals", { hasBody: false }, args),
@@ -716,6 +722,16 @@ function createClient(opts = {}) {
       postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
     },
     "npmRelease": {
+      // DELETE /npm-release/preview — rank: any-builder — DELETE /npm-release/preview
+      deleteNpmReleasePreview: (args) => request("DELETE", "/npm-release/preview", { hasBody: false }, args),
+      // GET /npm-release/preview — rank: any-builder — GET /npm-release/preview
+      getNpmReleasePreview: (args) => request("GET", "/npm-release/preview", { hasBody: false }, args),
+      // POST /npm-release/preview — rank: any-builder — POST /npm-release/preview
+      postNpmReleasePreview: (args) => request("POST", "/npm-release/preview", { hasBody: true }, args),
+      // GET /npm-release/preview/enter — rank: any-builder — GET /npm-release/preview/enter
+      getNpmReleasePreviewEnter: (args) => request("GET", "/npm-release/preview/enter", { hasBody: false }, args),
+      // GET /npm-release/preview/exit — rank: any-builder — GET /npm-release/preview/exit
+      getNpmReleasePreviewExit: (args) => request("GET", "/npm-release/preview/exit", { hasBody: false }, args),
       // GET /npm-release/task/{id} — rank: any-builder — GET /npm-release/task/:id
       getNpmReleaseTaskId: (args) => request("GET", "/npm-release/task/{id}", { hasBody: false }, args),
       // GET /npm-release/work — rank: archon — GET /npm-release/work
@@ -796,6 +812,8 @@ function createClient(opts = {}) {
       postProvisioningInstancesIdGithubApp: (args) => request("POST", "/provisioning/instances/{id}/github-app", { hasBody: true }, args),
       // GET /provisioning/instances/{id}/invite-suggestions — rank: any-builder — GET /provisioning/instances/:id/invite-suggestions
       getProvisioningInstancesIdInviteSuggestions: (args) => request("GET", "/provisioning/instances/{id}/invite-suggestions", { hasBody: false }, args),
+      // GET /provisioning/instances/{id}/render — rank: any-builder — GET /provisioning/instances/:id/render
+      getProvisioningInstancesIdRender: (args) => request("GET", "/provisioning/instances/{id}/render", { hasBody: false }, args),
       // POST /provisioning/instances/{id}/render — rank: any-builder — POST /provisioning/instances/:id/render
       postProvisioningInstancesIdRender: (args) => request("POST", "/provisioning/instances/{id}/render", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/repo-private — rank: any-builder — POST /provisioning/instances/:id/repo-private
@@ -812,6 +830,8 @@ function createClient(opts = {}) {
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations
       getProvisioningRecommendations: (args) => request("GET", "/provisioning/recommendations", { hasBody: false }, args),
+      // POST /provisioning/render/lookup — rank: any-builder — POST /provisioning/render/lookup
+      postProvisioningRenderLookup: (args) => request("POST", "/provisioning/render/lookup", { hasBody: true }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
       // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles
@@ -863,6 +883,16 @@ function createClient(opts = {}) {
       // POST /removal-proposals/{id}/decide — rank: metic+archon — POST /removal-proposals/:id/decide
       postRemovalProposalsIdDecide: (args) => request("POST", "/removal-proposals/{id}/decide", { hasBody: true }, args),
     },
+    "renderDeploy": {
+      // POST /render-deploy/act — rank: archon — POST /render-deploy/act
+      postRenderDeployAct: (args) => request("POST", "/render-deploy/act", { hasBody: true }, args),
+      // GET /render-deploy/app — rank: archon — GET /render-deploy/app
+      getRenderDeployApp: (args) => request("GET", "/render-deploy/app", { hasBody: false }, args),
+      // PUT /render-deploy/app — rank: archon — PUT /render-deploy/app
+      putRenderDeployApp: (args) => request("PUT", "/render-deploy/app", { hasBody: true }, args),
+      // GET /render-deploy/history — rank: archon — GET /render-deploy/history
+      getRenderDeployHistory: (args) => request("GET", "/render-deploy/history", { hasBody: false }, args),
+    },
     "scouting": {
       // GET /scouting — rank: metic+archon — GET /scouting
       getScouting: (args) => request("GET", "/scouting", { hasBody: false }, args),
@@ -948,6 +978,8 @@ function createClient(opts = {}) {
       deleteSpecialitiesIdDocumentsDocId: (args) => request("DELETE", "/specialities/{id}/documents/{docId}", { hasBody: false }, args),
       // POST /specialities/{id}/offer — rank: metic+archon — POST /specialities/:id/offer
       postSpecialitiesIdOffer: (args) => request("POST", "/specialities/{id}/offer", { hasBody: true }, args),
+      // PUT /specialities/{id}/skills — rank: any-builder — PUT /specialities/:id/skills
+      putSpecialitiesIdSkills: (args) => request("PUT", "/specialities/{id}/skills", { hasBody: true }, args),
       // POST /specialities/{id}/unoffer — rank: metic+archon — POST /specialities/:id/unoffer
       postSpecialitiesIdUnoffer: (args) => request("POST", "/specialities/{id}/unoffer", { hasBody: true }, args),
       // GET /specialities/offered — rank: any-builder — GET /specialities/offered

package/clients/bongos-client/index.d.ts

@@ -62,6 +62,7 @@ export interface GetDiscordChannelsSnapshotResponse { ok: boolean; guild_id: unk
 export interface GetDoneWhenPendingReviewResponse { criteria: unknown; count: unknown }
 export interface GetGithubRepoResponse { ok: boolean; repo: unknown; private_deployable: boolean }
 export interface GetGithubReposResponse { repos: unknown }
+export interface GetGoalTaskRelevancePendingResponse { flags: unknown; count: unknown }
 export interface GetGoalsIdConflictsResponse { ok: boolean; goal_id: unknown; conflicts: unknown; cross_goals_considered: unknown }
 export interface GetGoalsIdRequestsResponse { requests: unknown }
 export interface GetGoalsIdResponse { goal: unknown; members: unknown; criteria: unknown; dependencies: unknown; criterionless_task_count: unknown; admitted: unknown; open_tasks: unknown }
@@ -121,6 +122,7 @@ export interface GetProvisioningGithubAppStatusResponse { ok: boolean; status: u
 export interface GetProvisioningHealthResponse { module: unknown; ok: boolean; coreVersion: unknown }
 export interface GetProvisioningInstancesIdEnvManifestResponse { instance: unknown; env_vars: unknown; environments: unknown; values_held: boolean; note: unknown }
 export interface GetProvisioningInstancesIdInviteSuggestionsResponse { suggested: unknown; seeking: unknown; reason: unknown; unavailable?: unknown }
+export interface GetProvisioningInstancesIdRenderResponse { ok: boolean; app: unknown; env_vars: unknown; values_held: boolean }
 export interface GetProvisioningInstancesIdResponse { instance: unknown; open_intent: unknown; github_app: unknown }
 export interface GetProvisioningInstancesIdSettingsResponse { ok: boolean; settings: unknown; planet: unknown; options: unknown }
 export interface GetProvisioningInstancesResponse { instances: unknown }
@@ -142,6 +144,7 @@ export interface GetPublicTasksIdResponse { task: unknown }
 export interface GetPublicUptimeResponse { services: unknown }
 export interface GetPublicVersionsResponse { versions: unknown; page: PageInfo }
 export interface GetRemovalProposalsResponse { pending: unknown; count: unknown }
+export interface GetRenderDeployAppResponse { app: unknown }
 export interface GetScoutingHandleResponse { sliver: unknown }
 export interface GetScoutingResponse { builders: unknown; name_only: unknown }
 export interface GetSecurityDocsResponse { docs: unknown }
@@ -217,7 +220,7 @@ export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; descr
 export interface PatchProvisioningInstancesIdEnvManifestVarIdRequest { name?: string; description?: string; environments?: unknown[]; required?: boolean }
 export interface PatchProvisioningInstancesIdEnvManifestVarIdResponse { ok: boolean; env_var: unknown; values_held: boolean }
 export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; planet: unknown; push: unknown }
-export interface PatchSpecialitiesIdRequest { name?: string; summary?: string; contract_md?: string; visibility?: string; sellable?: boolean }
+export interface PatchSpecialitiesIdRequest { name?: string; summary?: string; contract_md?: string; visibility?: string; sellable?: boolean; skills?: string[] }
 export interface PatchSpecialitiesIdResponse { speciality: unknown }
 export interface PatchTaskRecommendationsIdRequest { status: "declined" | "withdrawn" }
 export interface PatchTaskRecommendationsIdResponse { ok: boolean; recommendation: unknown }
@@ -289,6 +292,8 @@ export interface PostGithubRepoVisibilityRequest { repo: string; visibility: "pu
 export interface PostGithubRepoVisibilityResponse { ok: boolean; repo: unknown; private_deployable: boolean }
 export interface PostGithubReposRequest { name: string }
 export interface PostGithubReposResponse { repo: unknown }
+export interface PostGoalTaskRelevanceIdDecideRequest { decision: "confirmed_gaming" | "false_positive"; note?: string }
+export interface PostGoalTaskRelevanceIdDecideResponse { ok: boolean; flag: unknown }
 export interface PostGoalsIdArchiveRequest { reason?: string; dispositions?: Record<string, unknown> }
 export interface PostGoalsIdArchiveResponse { ok: boolean; goal: unknown; applied: unknown }
 export interface PostGoalsIdConflictsResolveRequest { action: string; note?: string; touches?: string[]; first_task_id?: StringifiableId; then_task_id?: StringifiableId; task_id?: StringifiableId }
@@ -340,7 +345,7 @@ export interface PostHelpRequestsIdRepliesResponse { ok: boolean; reply: unknown
 export interface PostHelpRequestsRequest { needs_craft?: string; needs_builder_id?: number; what_is_stuck: string; task_id?: number; goal_id?: number }
 export interface PostHelpRequestsResponse { ok: boolean; help_request: unknown }
 export interface PostInboxIdDevelopRequest { field_values: Record<string, unknown>; template_key?: string; recommendation?: string }
-export interface PostInboxIdRatifyGoalRequest { target_version: string; scope_modules?: string[]; admit_reason?: string; notes_md?: string }
+export interface PostInboxIdRatifyGoalRequest { target_version: string; scope_modules?: string[]; admit_reason?: string; notes_md?: string; success_criterion?: string }
 export interface PostInboxIdRatifyRequest { notes_md?: string }
 export interface PostInboxIdResubmitRequest { field_values: Record<string, unknown>; template_key?: string; recommendation?: string }
 export interface PostInboxIdSparkResponse { idea: unknown; sparked: boolean; unchanged: boolean }
@@ -375,9 +380,10 @@ export interface PostMyProjectsInvitesClientIdAcceptResponse { ok: boolean; acce
 export interface PostMyProjectsInvitesClientIdDeclineResponse { ok: boolean; accepted: boolean }
 export interface PostMyProjectsJoinRequest { origin: string; note?: string }
 export interface PostMyProjectsJoinResponse { ok: boolean; status: unknown; project: unknown; message: unknown }
+export interface PostNpmReleasePreviewRequest { version: string }
 export interface PostOverrideRequestsIdDecideRequest { decision: string; note?: string }
 export interface PostProjectsInviteRequest { client_id: string; github_login: string }
-export interface PostProjectsProjectIdSpecialitiesRequest { name: string; discipline: string; summary?: string; contract_md?: string; visibility?: string; sellable?: boolean }
+export interface PostProjectsProjectIdSpecialitiesRequest { name: string; discipline: string; summary?: string; contract_md?: string; visibility?: string; sellable?: boolean; skills?: string[] }
 export interface PostProjectsProjectIdSpecialitiesResponse { speciality: unknown }
 export interface PostProjectsRequest { origin: string; name: string; tagline?: string; description?: string; art_url?: string; type?: string; template?: string }
 export interface PostProjectsResponse { project: unknown }
@@ -389,13 +395,16 @@ export interface PostProvisioningInstancesIdEnvManifestRequest { name: string; d
 export interface PostProvisioningInstancesIdForceTeardownResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; superseded: unknown; message: unknown }
 export interface PostProvisioningInstancesIdGithubAppRequest { account?: string }
 export interface PostProvisioningInstancesIdGithubAppResponse { state: unknown; account: unknown; post_url: unknown; personal_url: unknown; org_url: unknown; org_login: unknown; manifest: unknown; redirect_url: unknown; expires_at: unknown }
-export interface PostProvisioningInstancesIdRenderRequest { key: string; owner_id: string; mode: string; service_id?: string; web_plan?: string; db_plan?: string; region?: string }
-export interface PostProvisioningInstancesIdRenderResponse { ok: boolean; queued: boolean; action: unknown; mode: unknown; message: unknown }
+export interface PostProvisioningInstancesIdRenderRequest { key: string; owner_id: string; mode: string; service_id?: string; web_plan?: string; db_plan?: string; region?: string; runtime?: string; build_command?: string; start_command?: string; database?: boolean }
+export interface PostProvisioningInstancesIdRenderResponse { ok: boolean; queued: boolean; action: unknown; mode: unknown; with_setup: boolean; message: unknown }
 export interface PostProvisioningInstancesIdRepoPrivateResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; message: unknown }
 export interface PostProvisioningInstancesIdRestartResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; message: unknown }
 export interface PostProvisioningInstancesIdTeardownResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; superseded: unknown; message: unknown }
 export interface PostProvisioningInstancesRequest { slug: string; target_ref?: string; hosting_shape?: string; domain?: string; no_address?: boolean; tier?: string; onboard_mode?: string; type?: string; description?: string; detail?: Record<string, unknown>; modules?: string[] }
+export interface PostProvisioningRenderLookupRequest { key: string; owner_id?: string }
 export interface PostRemovalProposalsIdDecideRequest { verdict: string; note?: string }
+export interface PostRenderDeployActRequest { action?: string; deployId?: string; confirm?: unknown; expectLiveDeployId?: unknown }
+export interface PostRenderDeployActResponse { ok: boolean; action: unknown; started: unknown; render: unknown }
 export interface PostSearchMarkRequest { chunk_id?: StringifiableId; useful?: unknown }
 export interface PostSearchRequest { expand?: unknown; q?: string; source_kind?: string; limit?: unknown }
 export interface PostSearchResponse { expand?: unknown; chunk?: unknown; query?: unknown; count?: unknown; total_full_tokens?: unknown; results?: unknown; corpus?: unknown }
@@ -420,7 +429,7 @@ export interface PostSpecialitiesIdDocumentsRequest { title: string; body_md: st
 export interface PostSpecialitiesIdDocumentsResponse { skipped?: boolean; reason?: unknown; document?: unknown }
 export interface PostSpecialitiesIdOfferResponse { speciality: unknown }
 export interface PostSpecialitiesIdUnofferResponse { speciality: unknown }
-export interface PostSpecialitiesRequest { name: string; discipline: string; summary?: string; contract_md?: string; visibility?: string; sellable?: boolean }
+export interface PostSpecialitiesRequest { name: string; discipline: string; summary?: string; contract_md?: string; visibility?: string; sellable?: boolean; skills?: string[] }
 export interface PostSpecialitiesResponse { speciality: unknown }
 export interface PostSsoActivityRollupRequest { client_id: string; client_secret: string; github_id: StringifiableId; credits?: number; tasks_shipped?: number; karma?: number; rank?: string; disciplines?: unknown; recent_ships?: unknown }
 export interface PostSsoActivityRollupResponse { ok: boolean }
@@ -474,6 +483,10 @@ export interface PutGovernmentRanksRankKeyPermissionsPermissionKeyResponse { ok:
 export interface PutMingleOptInRequest { opted_in: boolean }
 export interface PutMingleOptInResponse { opted_in: unknown; updated_at: unknown }
 export interface PutMingleProjectRequest { enabled: boolean }
+export interface PutRenderDeployAppRequest { ownerId?: string; serviceId?: string }
+export interface PutRenderDeployAppResponse { app: unknown }
+export interface PutSpecialitiesIdSkillsRequest { enabled_skills: string[] }
+export interface PutSpecialitiesIdSkillsResponse { adoption: unknown }
 export interface PutTasksIdDependenciesRequest { depends_on_task_ids: unknown[] }
 export interface PutTasksIdDependenciesResponse { ok: boolean; written: unknown; dependencies: unknown }
 export type StringifiableId = number | string;
@@ -778,6 +791,12 @@ export interface BongosClient {
     /** POST /github/repos — rank: any-builder */
     postGithubRepos(args: RequestArgs & { body: PostGithubReposRequest }): Promise<PostGithubReposResponse>;
   };
+  "goalTaskRelevance": {
+    /** POST /goal-task-relevance/{id}/decide — rank: metic+archon */
+    postGoalTaskRelevanceIdDecide(args: RequestArgs & { body: PostGoalTaskRelevanceIdDecideRequest }): Promise<PostGoalTaskRelevanceIdDecideResponse>;
+    /** GET /goal-task-relevance/pending — rank: metic+archon */
+    getGoalTaskRelevancePending(args?: RequestArgs): Promise<GetGoalTaskRelevancePendingResponse>;
+  };
   "goals": {
     /** GET /goals — rank: any-builder */
     getGoals(args?: RequestArgs): Promise<GetGoalsResponse>;
@@ -1123,6 +1142,16 @@ export interface BongosClient {
     postMyProjectsJoin(args: RequestArgs & { body: PostMyProjectsJoinRequest }): Promise<PostMyProjectsJoinResponse>;
   };
   "npmRelease": {
+    /** DELETE /npm-release/preview — rank: any-builder */
+    deleteNpmReleasePreview(args?: RequestArgs): Promise<ApiResponse>;
+    /** GET /npm-release/preview — rank: any-builder */
+    getNpmReleasePreview(args?: RequestArgs): Promise<ApiResponse>;
+    /** POST /npm-release/preview — rank: any-builder */
+    postNpmReleasePreview(args: RequestArgs & { body: PostNpmReleasePreviewRequest }): Promise<ApiResponse>;
+    /** GET /npm-release/preview/enter — rank: any-builder */
+    getNpmReleasePreviewEnter(args?: RequestArgs): Promise<ApiResponse>;
+    /** GET /npm-release/preview/exit — rank: any-builder */
+    getNpmReleasePreviewExit(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /npm-release/task/{id} — rank: any-builder */
     getNpmReleaseTaskId(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /npm-release/work — rank: archon */
@@ -1203,6 +1232,8 @@ export interface BongosClient {
     postProvisioningInstancesIdGithubApp(args?: RequestArgs & { body?: PostProvisioningInstancesIdGithubAppRequest }): Promise<PostProvisioningInstancesIdGithubAppResponse>;
     /** GET /provisioning/instances/{id}/invite-suggestions — rank: any-builder */
     getProvisioningInstancesIdInviteSuggestions(args?: RequestArgs): Promise<GetProvisioningInstancesIdInviteSuggestionsResponse>;
+    /** GET /provisioning/instances/{id}/render — rank: any-builder */
+    getProvisioningInstancesIdRender(args?: RequestArgs): Promise<GetProvisioningInstancesIdRenderResponse>;
     /** POST /provisioning/instances/{id}/render — rank: any-builder */
     postProvisioningInstancesIdRender(args: RequestArgs & { body: PostProvisioningInstancesIdRenderRequest }): Promise<PostProvisioningInstancesIdRenderResponse>;
     /** POST /provisioning/instances/{id}/repo-private — rank: any-builder */
@@ -1219,6 +1250,8 @@ export interface BongosClient {
     getProvisioningOnboardPlan(args?: RequestArgs): Promise<GetProvisioningOnboardPlanResponse>;
     /** GET /provisioning/recommendations — rank: public */
     getProvisioningRecommendations(args?: RequestArgs): Promise<GetProvisioningRecommendationsResponse>;
+    /** POST /provisioning/render/lookup — rank: any-builder */
+    postProvisioningRenderLookup(args: RequestArgs & { body: PostProvisioningRenderLookupRequest }): Promise<ApiResponse>;
     /** GET /provisioning/slug-available — rank: any-builder */
     getProvisioningSlugAvailable(args?: RequestArgs): Promise<GetProvisioningSlugAvailableResponse>;
     /** GET /provisioning/starter-bundles — rank: public */
@@ -1270,6 +1303,16 @@ export interface BongosClient {
     /** POST /removal-proposals/{id}/decide — rank: metic+archon */
     postRemovalProposalsIdDecide(args: RequestArgs & { body: PostRemovalProposalsIdDecideRequest }): Promise<ApiResponse>;
   };
+  "renderDeploy": {
+    /** POST /render-deploy/act — rank: archon */
+    postRenderDeployAct(args?: RequestArgs & { body?: PostRenderDeployActRequest }): Promise<PostRenderDeployActResponse>;
+    /** GET /render-deploy/app — rank: archon */
+    getRenderDeployApp(args?: RequestArgs): Promise<GetRenderDeployAppResponse>;
+    /** PUT /render-deploy/app — rank: archon */
+    putRenderDeployApp(args?: RequestArgs & { body?: PutRenderDeployAppRequest }): Promise<PutRenderDeployAppResponse>;
+    /** GET /render-deploy/history — rank: archon */
+    getRenderDeployHistory(args?: RequestArgs): Promise<ApiResponse>;
+  };
   "scouting": {
     /** GET /scouting — rank: metic+archon */
     getScouting(args?: RequestArgs): Promise<GetScoutingResponse>;
@@ -1355,6 +1398,8 @@ export interface BongosClient {
     deleteSpecialitiesIdDocumentsDocId(args?: RequestArgs): Promise<DeleteSpecialitiesIdDocumentsDocIdResponse>;
     /** POST /specialities/{id}/offer — rank: metic+archon */
     postSpecialitiesIdOffer(args?: RequestArgs): Promise<PostSpecialitiesIdOfferResponse>;
+    /** PUT /specialities/{id}/skills — rank: any-builder */
+    putSpecialitiesIdSkills(args: RequestArgs & { body: PutSpecialitiesIdSkillsRequest }): Promise<PutSpecialitiesIdSkillsResponse>;
     /** POST /specialities/{id}/unoffer — rank: metic+archon */
     postSpecialitiesIdUnoffer(args?: RequestArgs): Promise<PostSpecialitiesIdUnofferResponse>;
     /** GET /specialities/offered — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -368,6 +368,12 @@ export function createClient(opts = {}) {
       // POST /github/repos — rank: any-builder — POST /github/repos
       postGithubRepos: (args) => request("POST", "/github/repos", { hasBody: true }, args),
     },
+    "goalTaskRelevance": {
+      // POST /goal-task-relevance/{id}/decide — rank: metic+archon — POST /goal-task-relevance/:id/decide
+      postGoalTaskRelevanceIdDecide: (args) => request("POST", "/goal-task-relevance/{id}/decide", { hasBody: true }, args),
+      // GET /goal-task-relevance/pending — rank: metic+archon — GET /goal-task-relevance/pending
+      getGoalTaskRelevancePending: (args) => request("GET", "/goal-task-relevance/pending", { hasBody: false }, args),
+    },
     "goals": {
       // GET /goals — rank: any-builder — GET /goals
       getGoals: (args) => request("GET", "/goals", { hasBody: false }, args),
@@ -713,6 +719,16 @@ export function createClient(opts = {}) {
       postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
     },
     "npmRelease": {
+      // DELETE /npm-release/preview — rank: any-builder — DELETE /npm-release/preview
+      deleteNpmReleasePreview: (args) => request("DELETE", "/npm-release/preview", { hasBody: false }, args),
+      // GET /npm-release/preview — rank: any-builder — GET /npm-release/preview
+      getNpmReleasePreview: (args) => request("GET", "/npm-release/preview", { hasBody: false }, args),
+      // POST /npm-release/preview — rank: any-builder — POST /npm-release/preview
+      postNpmReleasePreview: (args) => request("POST", "/npm-release/preview", { hasBody: true }, args),
+      // GET /npm-release/preview/enter — rank: any-builder — GET /npm-release/preview/enter
+      getNpmReleasePreviewEnter: (args) => request("GET", "/npm-release/preview/enter", { hasBody: false }, args),
+      // GET /npm-release/preview/exit — rank: any-builder — GET /npm-release/preview/exit
+      getNpmReleasePreviewExit: (args) => request("GET", "/npm-release/preview/exit", { hasBody: false }, args),
       // GET /npm-release/task/{id} — rank: any-builder — GET /npm-release/task/:id
       getNpmReleaseTaskId: (args) => request("GET", "/npm-release/task/{id}", { hasBody: false }, args),
       // GET /npm-release/work — rank: archon — GET /npm-release/work
@@ -793,6 +809,8 @@ export function createClient(opts = {}) {
       postProvisioningInstancesIdGithubApp: (args) => request("POST", "/provisioning/instances/{id}/github-app", { hasBody: true }, args),
       // GET /provisioning/instances/{id}/invite-suggestions — rank: any-builder — GET /provisioning/instances/:id/invite-suggestions
       getProvisioningInstancesIdInviteSuggestions: (args) => request("GET", "/provisioning/instances/{id}/invite-suggestions", { hasBody: false }, args),
+      // GET /provisioning/instances/{id}/render — rank: any-builder — GET /provisioning/instances/:id/render
+      getProvisioningInstancesIdRender: (args) => request("GET", "/provisioning/instances/{id}/render", { hasBody: false }, args),
       // POST /provisioning/instances/{id}/render — rank: any-builder — POST /provisioning/instances/:id/render
       postProvisioningInstancesIdRender: (args) => request("POST", "/provisioning/instances/{id}/render", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/repo-private — rank: any-builder — POST /provisioning/instances/:id/repo-private
@@ -809,6 +827,8 @@ export function createClient(opts = {}) {
       getProvisioningOnboardPlan: (args) => request("GET", "/provisioning/onboard-plan", { hasBody: false }, args),
       // GET /provisioning/recommendations — rank: public — GET /provisioning/recommendations
       getProvisioningRecommendations: (args) => request("GET", "/provisioning/recommendations", { hasBody: false }, args),
+      // POST /provisioning/render/lookup — rank: any-builder — POST /provisioning/render/lookup
+      postProvisioningRenderLookup: (args) => request("POST", "/provisioning/render/lookup", { hasBody: true }, args),
       // GET /provisioning/slug-available — rank: any-builder — GET /provisioning/slug-available
       getProvisioningSlugAvailable: (args) => request("GET", "/provisioning/slug-available", { hasBody: false }, args),
       // GET /provisioning/starter-bundles — rank: public — GET /provisioning/starter-bundles
@@ -860,6 +880,16 @@ export function createClient(opts = {}) {
       // POST /removal-proposals/{id}/decide — rank: metic+archon — POST /removal-proposals/:id/decide
       postRemovalProposalsIdDecide: (args) => request("POST", "/removal-proposals/{id}/decide", { hasBody: true }, args),
     },
+    "renderDeploy": {
+      // POST /render-deploy/act — rank: archon — POST /render-deploy/act
+      postRenderDeployAct: (args) => request("POST", "/render-deploy/act", { hasBody: true }, args),
+      // GET /render-deploy/app — rank: archon — GET /render-deploy/app
+      getRenderDeployApp: (args) => request("GET", "/render-deploy/app", { hasBody: false }, args),
+      // PUT /render-deploy/app — rank: archon — PUT /render-deploy/app
+      putRenderDeployApp: (args) => request("PUT", "/render-deploy/app", { hasBody: true }, args),
+      // GET /render-deploy/history — rank: archon — GET /render-deploy/history
+      getRenderDeployHistory: (args) => request("GET", "/render-deploy/history", { hasBody: false }, args),
+    },
     "scouting": {
       // GET /scouting — rank: metic+archon — GET /scouting
       getScouting: (args) => request("GET", "/scouting", { hasBody: false }, args),
@@ -945,6 +975,8 @@ export function createClient(opts = {}) {
       deleteSpecialitiesIdDocumentsDocId: (args) => request("DELETE", "/specialities/{id}/documents/{docId}", { hasBody: false }, args),
       // POST /specialities/{id}/offer — rank: metic+archon — POST /specialities/:id/offer
       postSpecialitiesIdOffer: (args) => request("POST", "/specialities/{id}/offer", { hasBody: true }, args),
+      // PUT /specialities/{id}/skills — rank: any-builder — PUT /specialities/:id/skills
+      putSpecialitiesIdSkills: (args) => request("PUT", "/specialities/{id}/skills", { hasBody: true }, args),
       // POST /specialities/{id}/unoffer — rank: metic+archon — POST /specialities/:id/unoffer
       postSpecialitiesIdUnoffer: (args) => request("POST", "/specialities/{id}/unoffer", { hasBody: true }, args),
       // GET /specialities/offered — rank: any-builder — GET /specialities/offered

package/docs/adr/0099-delayed-redacted-mirror-export.md

@@ -15,7 +15,7 @@ The redaction surface is real, not theoretical: at build time **23** published f
 
 ## Decision
 
-`scripts/public-mirror-export.js` (orchestration) + `scripts/gds/mirror-redact.js` (redaction library) + `.github/workflows/sync-public-mirror.yml` (schedule/transport). Seven decisions carry the weight:
+`scripts/public-mirror-export.js` (orchestration) + `scripts/gds/mirror-redact.js` (redaction library) + `.github/workflows/sync-public-mirror.yml` (schedule/transport; **never built, see the 2026-09-29 correction at the end**). Seven decisions carry the weight:
 
 ### 1. Snapshot, not history replay
 Each run picks the **newest commit whose committer date is ≥ 180 days old** (`pickSnapshotCommit`) and exports that single tree. The mirror accumulates one lagged snapshot commit per run — always ~6 months behind. Rejected replaying/redacting full history: far more code + risk (rewrite every commit) for no gain the "done-when" asks for. Matches the status-mirror precedent (sync current state as commits).
@@ -53,3 +53,7 @@ Transport reuses the ADR-0029/[#741](https://example.com/builders#/task/741) pat
 - **Share one regex set for redact + detect.** The blind-spot bug above: the gate can't catch what its own bounded rule missed. Rejected — the detector is a separate, stricter substring scan.
 - **TruffleHog as the only secret check.** Strong but network-dependent and verify-only (no transform); can't run in the exporter's own deterministic self-check or the unit tests. Kept the reusable in-process scrubber as the authoritative gate; TruffleHog may layer on later.
 - **Write then scan the mirror on disk.** A failed run would leave a dirty (unpushed) tree and risk a partial state. In-memory-then-write makes abort atomic. Rejected.
+
+## Correction (2026-09-29, task 1003405)
+
+The workflow named above, `sync-public-mirror.yml`, was never added to the repo, so the weekly schedule described in the transport decision never existed. Publishing the redacted public mirror is a **manual** step: `node scripts/public-mirror-export.js --repo-dir <mirror-checkout> --push`. Automating it would open a new public release channel and needs the owner's approval first; it is captured as idea 1001159 rather than built. The design above is left as originally written.

package/docs/adr/0111-instance-hosting-provisioning-module.md

@@ -1,6 +1,7 @@
 # ADR 0111 — Instance hosting + domains as a Cloud Bongos module: the `provisioning` module boundary + the self-host / managed split
 
 - **Status:** Accepted, **superseded in part by [ADR 0323](0323-hosting-is-three-shapes-and-we-are-not-the-landlord.md)** (2026-09-21) — the module boundary and the enqueue-only trust boundary STAND; the DigitalOcean droplet and `co-tenant` shapes it provisions do not. Customer projects move to a managed platform; DigitalOcean hosts hubs only.
+- **Amended by [ADR 0348](0348-the-web-tier-may-look-read-only-at-what-an-owners-render-key-can-see.md)** (2026-09-29): §2 has one read-only exception — the web tier may ask Render what an owner's own key can see (workspaces, and the web services in one of them), holding the key for that request only. Every write to a cloud account still happens in the runner.
 - **Status:** §2 STANDS and is now kernel-enforced as of [task 1004176](https://cloudbongos.com/builders#/task/1004176) (2026-09-23). It was, until then, enforced by the code alone — the web tier does only enqueue intents, but both tiers run as the same unix user and the token file was readable by it, so the boundary was a convention ([ADR 0327](0327-a-cloud-host-runs-on-the-owners-account-and-the-key-is-borrowed.md) §5). A systemd drop-in (`InaccessiblePaths=/etc/cloudbongos/box.env`, tracked at `scripts/gds/cloudbongos-token-isolation.conf`) now puts an empty mode-000 node over that file in the web tier's own mount namespace. The two tiers still run as the same unix user; the isolation is namespace-based, not ownership-based, and the reasoning for that narrower remedy is in [ADR 0327](0327-a-cloud-host-runs-on-the-owners-account-and-the-key-is-borrowed.md) §5.
 - **Status (original):** Accepted (boundary + split decided with the owner; build is task-pending — see §Consequences for the seeded tasks)
 - **Date:** 2026-07-03

package/docs/adr/0120-pay-on-land-and-builder-owned-rebase-gate.md

@@ -106,3 +106,20 @@ Seeded as tasks under this ADR (dependencies noted): pay-on-land (economy + life
 `needs_rebase` state + reconciler flag (lifecycle + migration) → claim gate (lifecycle/claims)
 → clawback migration (depends on pay-on-land being live) → hall + `/builder-start` surfacing →
 tests. See the [#2035](https://example.com/builders#/task/2035) dependency graph.
+
+## Amendment — the CI-unblock exemption (task 1004370, 2026-09-30)
+
+The gate assumed an owed rebase is always the builder's to clear. It is not when main's own CI
+is red for a reason outside every branch (2026-09-29: an npm advisory against `undici` tripped
+the audit gate). Then no confirmed task can land, so every builder holding one is refused new
+claims, including the claim on the fix that would let their task land, and release is no exit
+either because a confirmed task has no open claim to release.
+
+So the gate now lets exactly one shape of task through: **P1 and `kind=infra`**, the shape a
+CI-unblock is filed in (`isRebaseGateExempt` in `modules/lifecycle/db-claims.js`). Filing one
+needs `task.create`, which is Metic-floored, so the door is no wider than the people who could
+already file the fix. The owed rebases are still reported everywhere, and the gate still
+refuses every other claim. The two other options the task named were not taken: skipping the
+gate while main's last CI run is red would make the claim path depend on reading GitHub check
+state, which is unreadable from this app in places (`checks_unreadable`); and a release-to-ready
+path for confirmed tasks would make the builder throw away graded work to get unstuck.

package/docs/adr/0176-private-repo-deploy-keys.md

@@ -2,6 +2,8 @@
 
 Date: 2026-08-17 · Status: accepted · Task: 1002735 (walk finding N4, idea 1000708)
 
+> **Amended by [ADR 0350](0350-the-hub-holds-a-per-project-write-deploy-key-so-a-hosted-upgrade-reaches-github.md):** the hub now also holds a second, WRITABLE per-project key (`cloudbongos-pin-<slug>`), kept outside the checkout, so an upgraded pin reaches the repo without the owner's one-hour token. The pull key described here is unchanged.
+
 ## Context
 
 A standalone instance's repo is cloned/pushed **once** with the owner's `repo`-scoped OAuth

package/docs/adr/0310-a-speciality-offers-skills-and-the-adopter-chooses-them.md

@@ -74,7 +74,7 @@ Already shipped in `specialities_catalog`: `owner_kind` (`builder` | `project`),
 
 Deliberately separate tasks, because the middle one is where the ruling lives and it should not be a sub-bullet of a schema change:
 
-1. **Schema + validation** — the offered set on the catalog, the enabled set on the adoption, `validateDraft`, the routes. Refuses a skill the instance does not have.
+1. **Schema + validation** — the offered set on the catalog, the enabled set on the adoption, `validateDraft`, the routes. Refuses a skill the instance does not have. *Built in task 1004072 (`skills` / `enabled_skills`, specialities_003, `modules/specialities/skills.js`).*
 2. **The walkthrough** — the adoption flow that presents each skill and takes a decision. The ruling's real deliverable.
 3. **Injection** — the enabled set reaches the session through the contract the Conductor already injects; a line naming the skills this builder leans on, per [ADR 0296](0296-a-role-speciality-is-data-over-three-existing-surfaces.md)'s pattern of using surfaces that exist.
 

package/docs/adr/0348-the-web-tier-may-look-read-only-at-what-an-owners-render-key-can-see.md

@@ -0,0 +1,53 @@
+# ADR 0348 — The web tier may look, read-only, at what an owner's Render key can see
+
+- **Status:** accepted
+- **Date:** 2026-09-29
+- **Task:** [task 1004352](https://cloudbongos.com/builders#/task/1004352) (goal 1000106 — working area 1, Project creation)
+- **Deciders:** Lars (Archon) chose both decisions in chat on 2026-09-29, from options Claude laid out. Claude wrote the record.
+- **Amends:** [ADR 0111](0111-instance-hosting-provisioning-module.md) §2 ("the internet-facing web process never calls a cloud API") — one narrow, read-only exception
+- **Keeps:** [ADR 0327](0327-a-cloud-host-runs-on-the-owners-account-and-the-key-is-borrowed.md) §2 (the key is borrowed, never stored) and §3 (we never destroy an owner's infrastructure) · [ADR 0345](0345-we-host-every-projects-hall-and-its-app-deploys-where-the-owner-chooses.md) (we host the hall; the app goes where the owner chooses)
+
+## Context
+
+The setup wizard's app step lets an owner put their app on their own Render account ([task 1004351](https://cloudbongos.com/builders#/task/1004351), [task 1004352](https://cloudbongos.com/builders#/task/1004352)). Two things the owner must see before Create can only come from Render itself:
+
+- **Whether the key works.** A refused key discovered after Create is a project with a broken promise on its done screen.
+- **Which workspaces the key reaches.** A Render key belongs to a *user*, and reaches every workspace that user is in — measured on 2026-09-22 at three, one of them another builder's (ADR 0327). The owner has to choose one. Picking the first would be exactly the mistake ADR 0327 exists to prevent.
+
+ADR 0111 §2 says the web process never calls a cloud API; the runner does, from the intent queue. The runner can't answer an owner who is still on the page, and keeping the key between a check and a Create would break ADR 0327 §2.
+
+There was a second, related problem. Create queues the project's own `provision` run, and a project has one open-intent slot, so a separate `render-standup` request made a moment later collides with it.
+
+## Decision
+
+### 1. One read-only look, on the owner's own key
+
+`POST /provisioning/render/lookup` (`modules/provisioning/render-lookup.js`) may call Render from the web tier, and nothing else may. Its limits are the whole exception:
+
+- **GET only, two calls:** the workspace list, and the web services in one named workspace. Nothing in it can create, change or delete anything.
+- **The key is the owner's own, held for that one request.** It travels in a POST body, never a URL; it is never stored, logged or sent back. Nothing encrypts it, because nothing keeps it.
+- **Every service in the answer is checked to carry the workspace asked about.** One that doesn't voids the whole answer. This is the runner client's guard (`scripts/gds/render-api.js`), carried here as two GETs because a module may not require that file (ADR 0083).
+- **It is capped per builder** (20 a minute): a wizard needs a handful.
+
+What this does *not* change: every write to an owner's Render account still happens in the runner, from the queue, on a key borrowed for one run.
+
+### 2. The key rides the project's own setup run
+
+When the wizard sends the key right after Create, and the project's `provision` run holds the open slot, the key is attached to **that** run (`attachToProvision`). It goes in one statement, only onto a run that holds no key yet, and the table's CHECK still refuses a key on a resolved run. After the project is up, the runner sets the app up on Render in the same drain (`afterProvision`) and clears the key whatever happens:
+
+- **Project up, app set up:** done.
+- **Project up, app failed:** the run is still a success, since the project is live. The app's failure is recorded on `app_host` and in the run's note.
+- **Project failed:** Render is never called. The key is cleared at once, so a provision retry never carries it into a later run, and the owner connects Render again once the project is live.
+
+## Consequences
+
+- The web tier now makes outbound calls to one third party, on user-supplied credentials. That is a new egress path, and the reason decision 1 is drawn so narrowly: read-only, one host, capped, key never kept.
+- A compromised web tier could read keys from lookup requests. It could already read them from the setup request (ADR 0327 §2 says so plainly), so this adds no new exposure of the key.
+- The key waits on the provision run for as long as the project takes to stand up: minutes, and at most the leg's 30-minute limit, after which it is refused and cleared.
+- A resumed wizard draft asks for the key again, because the key never enters the draft.
+
+## Alternatives considered
+
+- **Keep the rule strict: no check before Create.** The owner types a workspace id, and a refused key surfaces after Create. The owner rejected this: it fails the task's done-when and leaves the workspace choice to guesswork.
+- **Let the browser call Render directly.** It depends on Render allowing cross-origin calls from our page, which we can't rely on. It would also move the workspace guard somewhere we can't test on the server.
+- **Ask for the key on the project page once the project is live.** Simpler, but not one wizard pass. It stays available as the fallback when an app fails to set up ([task 1004184](https://cloudbongos.com/builders#/task/1004184)).