@bongos/core 1.19.335 → 1.19.336

package/scripts/gds/seed-v3-tasks.js

@@ -1,1981 +0,0 @@
-#!/usr/bin/env node
-// Seed the 80 net-new GDS-V3 tasks defined in V3 Planning Session #1
-// (CLAUDE.md session log 2026-05-12 GDS-V3 planning).
-//
-// Idempotent: skips tasks whose source_ref already exists.
-//
-// Companion migration 018_pms_v3_planning_seed.sql handles:
-//   - 9 done_when_criteria seed rows
-//   - versions.GDS-V3.done_when text update
-//   - 9 existing-task priority + V3.R## title-prefix updates
-//
-// This script handles the 80 net-new task creates + the 10 idea-promotion
-// PATCH calls that mark the source ideas as 'promoted' with their new
-// promoted_to_task_id.
-//
-// Ranking convention: priority is 1-5 (CHECK constraint). Fine-grained
-// 89-deep ordering lives in the V3.R## title prefix (zero-padded for sort).
-// Tier mapping: T1=P5, T2=P5, T3=P4, T4=P4, T5=P3, T6=P2, T7=P1.
-//
-// Usage:  node scripts/gds/seed-v3-tasks.js [--dry-run]
-
-const { cliClient, requireSession } = require('./cli-lib');
-
-const DRY = process.argv.includes('--dry-run');
-
-// ---------------------------------------------------------------------------
-// The 80 net-new tasks
-// ---------------------------------------------------------------------------
-//
-// Each entry: { ref, title, description, kind, discipline, priority,
-//               est_minutes, manual_degree, credits_reward, touches,
-//               promoted_idea_id? }
-//
-// `ref` doubles as source_ref ("gds-v3-r##") and as the V3.R## title prefix.
-
-const TASKS = [
-  // =========================================================================
-  // TIER 1 — Bedrock (P5). Must ship before Builder #2 arrives.
-  // =========================================================================
-
-  {
-    ref: 'R01',
-    title: 'Rename GDS → GDS (backend folders, routes, env vars; "credits→drachmae" frontend-only)',
-    description: `**Criterion:** cross-cutting (identity).
-
-**Why:** GDS-V3 opens the system to multiple builders; the "Project Management System" name is internal and feels off when the thing is actually the Game Development System for an entire civilization. Rename now while there's only one builder; deferring multiplies the cost across N builders.
-
-**Scope (V3):**
-- Backend folder: \`src/pms/\` → \`src/bongos/\` (incl. routes/, db.js, auth.js, etc.)
-- Scripts: \`scripts/pms/\` → \`scripts/gds/\`
-- API path: \`/api/pms/*\` → \`/api/gds/*\` (keep \`/api/pms/*\` as 301 redirect for one version)
-- Env vars: \`PMS_*\` → \`GDS_*\`
-- Frontend label: "credits" displayed as "drachmae" everywhere on \`/builders\` + \`/status\` (no schema rename of \`credits_reward\` / \`credit_log\` — that's a separate task)
-- All skill files updated to call new paths
-- CLAUDE.md / README / docs updated
-
-**Done when:**
-- \`/api/gds/me\` returns 200 with current builder
-- \`/api/pms/me\` returns 301 to the new path
-- All 14 GDS slash commands work after the rename
-- "drachmae" label visible on \`/builders\` and \`/status\` profile/leaderboard rows
-
-**Cross-refs:** Promotes idea_inbox #11. All subsequent V3 tasks reference the new \`src/bongos/\` paths.`,
-    kind: 'refactor',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 480,
-    manual_degree: 2,
-    credits_reward: 80,
-    touches: ['src/pms/', 'scripts/pms/', 'server.js', 'public-status/', 'public-builders/', '.claude/skills/', 'CLAUDE.md', 'README.md'],
-    promoted_idea_id: 11,
-  },
-
-  {
-    ref: 'R02',
-    title: 'Architecture spike — server-enforced trust boundary (output ADR + sub-tasks)',
-    description: `**Criterion:** C7 — server-enforced permissions.
-
-**Why:** Before we build rank-check middleware, route auditors, and a periodic auditor cron, we need an explicit design for the trust boundary: where does authority live, how is it checked, what is the exact failure mode when a builder edits their local files. This spike outputs an ADR and generates the actual implementation tasks for C7.
-
-**Done when:**
-- ADR \`docs/adr/0015-trust-boundary-server-enforced-permissions.md\` describes: where rank lives (DB), how it's checked (every privileged request hits the DB, no token caching), how skills/hooks/settings.json are bounded, what files describe vs what files enforce
-- Implementation sub-tasks created for C7 with parent_task_id pointing at this spike: covers route middleware, audit pass, periodic auditor, CLAUDE.md disclaimer, token issuance design
-- Trust-model diagram included in the ADR
-
-**Cross-refs:** Gates V3.R05, V3.R06, V3.R44, V3.R45 (the C7 implementation tasks). Output reshapes them if needed.`,
-    kind: 'spike',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 180,
-    manual_degree: 3,
-    credits_reward: 40,
-    touches: ['docs/adr/'],
-  },
-
-  {
-    ref: 'R03',
-    title: 'Architecture spike — cloneability + local-first memory with server sync',
-    description: `**Criterion:** C8 — cloneable repo, local-first memory, server-canonical on ship.
-
-**Why:** Same pattern as R02. Before we build memory sync infrastructure, we need a design: what's the schema for server-side memory, how do we resolve conflicts between local and server, how does pull-on-session-start interact with worktree creation, what happens when a builder's machine dies.
-
-**Done when:**
-- ADR \`docs/adr/0016-cloneable-repo-local-first-memory.md\` describes: server schema (Postgres BYTEA vs object storage), sync trigger (ship-time push, session-start pull), conflict policy (last-write-wins per file, or merge), isolation (per-builder, no cross-reads), backup cadence
-- Implementation sub-tasks created for C8 with parent_task_id pointing here
-- Portability test plan included: fresh clone → setup → ready to ship
-
-**Cross-refs:** Gates V3.R55–V3.R63 (the C8 implementation tasks). Output reshapes the memory schema + sync mechanics.`,
-    kind: 'spike',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 180,
-    manual_degree: 3,
-    credits_reward: 40,
-    touches: ['docs/adr/'],
-  },
-
-  {
-    ref: 'R05',
-    title: 'Server-side requireRank() middleware on every privileged GDS API route',
-    description: `**Criterion:** C2, C7 — three ranks gate everything; server-side enforcement.
-
-**Why:** With \`builders.rank\` enum added by R04 (#106), every privileged endpoint needs to check rank against the DB. No token-side caching — checked on every request so rank changes propagate immediately.
-
-**Done when:**
-- \`src/bongos/auth.js\` exposes \`requireRank(minRank)\` middleware that returns 403 \`{error: 'rank_too_low', required, actual}\` on failure
-- Applied to every route flagged Metic+ or Archon+ in R02's ADR (routes file by file)
-- Unit-test smoke: Xenos session calling a Metic+ route → 403; Archon session calling everything → 200
-- Output of R02 (the spike) drives the exact route list
-
-**Cross-refs:** Depends on R02 (spike) + R04 (rank enum). Blocks R06.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 240,
-    manual_degree: 2,
-    credits_reward: 40,
-    touches: ['src/bongos/auth.js', 'src/bongos/routes/'],
-  },
-
-  {
-    ref: 'R06',
-    title: 'PATCH /api/gds/builders/:id/rank — Archon-only promotion AND demotion endpoint',
-    description: `**Criterion:** C2 — three ranks gate everything.
-
-**Why:** Archon needs a way to promote Xenos → Metic and demote in reverse. Endpoint is the single chokepoint for rank changes; everything logs to audit_log (R36 dependency).
-
-**Done when:**
-- \`PATCH /api/gds/builders/:id/rank { rank: 'Metic' | 'Xenos' | 'Archon' }\` works
-- requireRank('Archon') guards it
-- Cannot demote yourself (no last-Archon footgun)
-- Writes to audit_log (when R36 is shipped; until then, writes to credit_log with reason='rank_change' + the actor)
-- Returns updated builder row
-- Smoke test: Archon promotes a Xenos → 200, rank flips; same Xenos tries to demote Archon → 403
-
-**Cross-refs:** Depends on R04 (rank column) + R05 (middleware). Cross-link to R29 (promotion ceremony).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 120,
-    manual_degree: 2,
-    credits_reward: 20,
-    touches: ['src/bongos/routes/builders.js', 'src/bongos/db.js'],
-  },
-
-  {
-    ref: 'R07',
-    title: '/builder-setup audit — strip every Archon-only assumption (paths, hostnames, ssh, deploy keys)',
-    description: `**Criterion:** C1 — onboarding ≤ 2h.
-
-**Why:** \`scripts/pms/setup.js\` and the surrounding \`/builder-setup\` skill currently assume Lars's machine (paths like \`~/.config/otb/\`, expects \`~/.claude/credentials.json\` shape from one Anthropic account, hardcoded \`lars589\` references in test code, deploy-key paths). A second builder runs it and hits cryptic failures. Audit + fix every assumption.
-
-**Done when:**
-- A clean-checkout builder on a different machine completes \`/builder-setup\` end-to-end without manual edits
-- No string \`lars\`, \`lars589\`, \`lars@\`, or \`Lars\` in any setup-path code
-- Setup writes to \`~/.config/otb/pms-session.json\` regardless of OS/user
-- \`/builder-setup --dry-run\` mode prints what it would do, for newcomer reassurance
-- Smoke test runs in a fresh worktree as a fresh "user" (env var override of homedir)
-
-**Cross-refs:** Cross-link to R08 (bootstrap script) + R11 (authorship audit).`,
-    kind: 'cleanup',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 180,
-    manual_degree: 2,
-    credits_reward: 30,
-    touches: ['scripts/gds/setup.js', '.claude/skills/otb-builder-setup/', 'scripts/gds/cli-lib.js'],
-  },
-
-  {
-    ref: 'R08',
-    title: 'scripts/setup-builder.sh — one-command bootstrap (Node/Python checks, npm ci, .env.local, /builder-setup)',
-    description: `**Criterion:** C1 — onboarding ≤ 2h.
-
-**Why:** Today onboarding requires the builder to know what to install in what order. We want \`./scripts/setup-builder.sh\` to be the one thing they run.
-
-**Done when:**
-- Script verifies Node ≥22 and Python ≥3.10, prints actionable error if missing
-- Runs \`npm ci\`
-- Copies \`.env.local.example\` to \`.env.local\` (prompts for Gemini key, or accepts \`--skip-keys\`)
-- Runs \`node scripts/gds/setup.js\` (the Device Flow auth)
-- Prints "you're ready — run \`/builder-start\` next"
-- Idempotent: re-run on an already-set-up checkout doesn't blow anything up
-- README updated to point new builders at this script
-
-**Cross-refs:** Depends on R07 (audited \`/builder-setup\`). Verified by R17 (V3 hello-world smoke).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 90,
-    manual_degree: 2,
-    credits_reward: 15,
-    touches: ['scripts/setup-builder.sh', 'README.md', '.env.local.example'],
-  },
-
-  {
-    ref: 'R09',
-    title: 'Anthropic account linking via Claude Code self-verification during /builder-setup',
-    description: `**Criterion:** C3 — per-builder credentials with authorship.
-
-**Why:** We need to know which Anthropic account is making GDS API calls so cost + authorship attribution works across N builders. Per-OAuth from Anthropic doesn't exist yet, but Claude Code itself is the trusted agent on the builder's machine — it can read its own credentials and refuse to proceed if the typed email doesn't match.
-
-**Approach:**
-- During \`/builder-setup\`, prompt builder for their Anthropic email
-- Read local Claude Code credentials (\`~/.claude/credentials.json\` or equivalent in current Claude Code version)
-- Compare; abort with clear error if mismatch
-- On success, store \`anthropic_email\` + \`anthropic_user_id\` on \`builders\`
-- Every GDS API call from a Claude Code session includes \`X-Anthropic-User\` header; server cross-checks against stored value
-
-**Done when:**
-- Setup refuses to proceed on email mismatch
-- builders.anthropic_email + anthropic_user_id columns exist (migration)
-- API middleware verifies header on every authenticated route
-- Smoke: forge the header → 403 \`{error: 'identity_mismatch'}\`
-- V4 follow-up task filed: "Replace attestation with Anthropic OAuth when available"
-
-**Cross-refs:** C3. Touches setup.js, db.js, auth.js. File V4 task as a child idea.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 240,
-    manual_degree: 3,
-    credits_reward: 45,
-    touches: ['scripts/gds/setup.js', 'src/bongos/auth.js', 'src/bongos/db.js', 'migrations/'],
-  },
-
-  {
-    ref: 'R11',
-    title: 'Authorship attribution audit — exhaustive sweep for hardcoded "lars", "lars589", "lars@", paths, ids',
-    description: `**Criterion:** C3 — per-builder authorship; C7 — server-enforced (not file-baked).
-
-**Why:** A second builder shipping code that says "by lars" in commits or "lars's machine" in error messages destroys the audit trail. Every hardcoded reference to the original Archon must be replaced by a lookup against the current builder's identity.
-
-**Done when:**
-- Grep sweep over the entire repo for: \`lars\`, \`lars589\`, \`lars@\`, \`larskristensen\`, \`/Users/lars\`, hardcoded \`builder_id=1\`, \`shipped_by=1\`
-- Every hit categorized: (a) replace with dynamic lookup, (b) keep as historical reference (e.g., session-log archives), (c) replace with placeholder
-- A \`scripts/gds/audit-authorship.sh\` script that re-runs the sweep and fails CI if new hardcodes show up
-- Documentation in CLAUDE.md says "no hardcoded Archon identity in implementation code; use \`req.builder\` / current-builder lookup"
-
-**Cross-refs:** Companion to R07. Runs after R01 (GDS rename) so paths reflect new layout.`,
-    kind: 'cleanup',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 240,
-    manual_degree: 2,
-    credits_reward: 35,
-    touches: ['scripts/', 'src/', 'public/', 'public-builders/', 'public-status/', '.claude/'],
-  },
-
-  {
-    ref: 'R12',
-    title: 'Builder primer doc — system basics so builders can prompt Claude productively',
-    description: `**Criterion:** C1 — onboarding ≤ 2h.
-
-**Why:** A new Metic shouldn't read CLAUDE.md cold (it's the index for AI agents, not a humans-first onboarding doc). The primer is the doc they read alongside Claude on day one, designed to give Claude enough seed context to answer questions.
-
-**Done when:**
-- File at \`docs/onboarding/primer.md\` covers (concise, ~2000 words):
-  - What Off the Boats is (the game) — one paragraph
-  - What the GDS is (the dev system) — one paragraph
-  - The two tracks (product / internal)
-  - The claim → ship lifecycle (with diagram)
-  - The rank ladder (Xenos / Metic / Archon) + what each unlocks
-  - Drachmae + karma (what they are, how they're earned)
-  - "How to ask Claude about anything" — sample prompts
-  - "Where to find more depth" — pointers to CLAUDE.md, ADRs, docs/recipes/
-- Newcomer skill or message points here on first session
-- Pairs with R76 (visual diagrams) for the picture-shaped version
-
-**Cross-refs:** C1. Read alongside R76 (diagrams) and the auto-completing checklist (R75).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 180,
-    manual_degree: 3,
-    credits_reward: 30,
-    touches: ['docs/onboarding/'],
-  },
-
-  {
-    ref: 'R13',
-    title: 'Onboarding observability + Archon-only builder management view in /builders hall',
-    description: `**Criterion:** C1, C2 — onboarding visible to Archon; ranks managed from the hall.
-
-**Why:** Archon needs to see who's onboarding, where they are in the funnel, and act (promote, demote, release a stale claim) without dropping into psql.
-
-**Done when:**
-- builders table gets \`onboarded_at\` + \`first_ship_at\` columns (migration)
-- \`/builders\` hall renders an Archon-only management panel:
-  - Roster of builders with current rank, drachmae, karma, onboarded_at, first_ship_at, time-to-first-ship
-  - Per-builder actions: promote, demote, release-active-claim
-  - Surface for stale claims (no pulse > 24h)
-- Calls into PATCH /builders/:id/rank (R06) and a new endpoint for release-claim-on-behalf
-
-**Cross-refs:** Depends on R05+R06. Pairs with R16 (rank visible on profile/roster). Used by Archon to graduate Xenos → Metic during V3.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 360,
-    manual_degree: 2,
-    credits_reward: 60,
-    touches: ['public-builders/', 'src/bongos/routes/builders.js', 'src/bongos/db.js', 'migrations/'],
-  },
-
-  {
-    ref: 'R14',
-    title: 'tasks.newcomer_friendly column + view filter + Xenos claim policy',
-    description: `**Criterion:** C1 — newcomers always have something to claim. C2 — Xenos rank gates them down.
-
-**Why:** Xenos shouldn't be able to claim arbitrary tasks (they could break things they don't understand). Newcomer-friendly tasks are explicitly marked safe-for-newcomers, low-stakes, well-scoped.
-
-**Done when:**
-- \`tasks.newcomer_friendly bool DEFAULT false\` (migration)
-- \`claimable_tasks\` view: Xenos sees only \`newcomer_friendly = true\`; Metic+ sees all
-- POST /tasks accepts \`newcomer_friendly\` boolean
-- Server-side enforcement on POST /claims: reject Xenos claim of non-newcomer-friendly task with 403 \`{error: 'rank_too_low_for_task'}\`
-- Tag at least 3 currently-open backlog tasks as newcomer-friendly so the queue isn't empty when Xenos arrives
-
-**Cross-refs:** Depends on R04. Feeds R78 (auto-generator for newcomer tasks).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 120,
-    manual_degree: 2,
-    credits_reward: 20,
-    touches: ['migrations/', 'src/bongos/db.js', 'src/bongos/routes/tasks.js', 'src/bongos/routes/claims.js'],
-  },
-
-  {
-    ref: 'R16',
-    title: '/builders hall — rank visible on profile + roster + leaderboard',
-    description: `**Criterion:** C2 — three ranks visible.
-
-**Why:** Rank needs to be readable at a glance throughout the hall, not buried in JSON.
-
-**Done when:**
-- Profile page shows current rank with a styled badge (Xenos = bronze, Metic = silver, Archon = gold; pick something Mediterranean-ish)
-- Roster lists rank next to each builder
-- Leaderboard sortable by rank
-- Mobile-friendly truncation
-
-**Cross-refs:** Depends on R04. Cheap UI task; can ship in parallel with R13.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 60,
-    manual_degree: 2,
-    credits_reward: 10,
-    touches: ['public-builders/'],
-  },
-
-  {
-    ref: 'R17',
-    title: 'V3 hello-world smoke — one real Metic onboards → claims → ships independently',
-    description: `**Criterion:** the proof Tier 1 is done.
-
-**Why:** Tier 1 is "Builder #2 can ship without Archon's help." This task is the live exercise that proves it. Failure → file follow-up tasks. Success → graduate Builder #2 from Xenos to Metic for real.
-
-**Done when:**
-- A real human (Builder #2, identified by Archon at session time) clones the repo on a fresh machine, runs \`./scripts/setup-builder.sh\`, runs \`/builder-setup\`, hits \`/builder-start\`, claims a newcomer-friendly task, ships it
-- Total elapsed time from "Archon promoted you" to "your task is shipped on main" ≤ 2 hours
-- Friction points captured as GDS tasks for V3 (do not punt to V4)
-- Session log written: \`docs/session-logs/2026-MM-DD-v3-hello-world-with-<builder>.md\`
-
-**Cross-refs:** This is the C1 proof. Block on R07, R08, R12, R13, R14, R16 being live in prod.`,
-    kind: 'spike',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 120,
-    manual_degree: 4,
-    credits_reward: 30,
-    touches: ['docs/session-logs/'],
-  },
-
-  // =========================================================================
-  // TIER 2 — Quality + voice (P5). So Builder #2's first ship is judged and
-  // they can speak up.
-  // =========================================================================
-
-  {
-    ref: 'R22',
-    title: 'Failed-confirmation feedback flow — write rejection reasons into learnings table',
-    description: `**Criterion:** C4 — quality bar holds with N builders.
-
-**Why:** When the Opus grader rejects a confirmation, the builder needs structured feedback ("here's what failed, here's how to retry"), and the SYSTEM needs to learn from the rejection — not just the builder. Writing every rejection to the \`learnings\` table means future grader runs can see prior failures.
-
-**Done when:**
-- On every grader rejection, a row inserts into \`learnings\` with source=\`grader_rejection\`, source_ref=task_id, body containing the rubric scores + the specific failure
-- Builder gets a clean rendered message via \`/builder-ship\` response: "Confirmation failed — see learnings/<id> for details"
-- Tags include the failed criterion (e.g. \`tags: ['grader_rejection', 'value_summary_too_short']\`)
-- Cap rejections-per-task to prevent learning-spam if a task fails 10x
-
-**Cross-refs:** Depends on R18 (grader replacement). Feeds the calibration loop in R20 + R74.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 180,
-    manual_degree: 2,
-    credits_reward: 30,
-    touches: ['src/bongos/grader.js', 'src/bongos/learnings.js', 'src/bongos/routes/claims.js'],
-  },
-
-  {
-    ref: 'R23',
-    title: 'version_lifecycle_breakdown view double-counts parent tasks — fix',
-    description: `**Criterion:** C4 — quality bar holds; correctness.
-
-**Why:** The view rolls up parent + child status independently, so a parent with 3 shipped children shows up as both "1 parent shipped" and "3 children shipped" — distorting the leaderboard and version-progress numbers as soon as parent/child tasks appear in V3.
-
-**Done when:**
-- Migration adds a new view that counts only leaf tasks, identical to how \`version_progress\` already does it
-- Old view either dropped or replaced
-- Status-page numbers for V3 match \`SELECT COUNT(*) FROM tasks WHERE version_id='GDS-V3' AND parent_task_id IS NULL\`
-- Regression test added that creates a parent + 2 children, ships both children, and asserts the rollup is correct
-
-**Cross-refs:** Promotes idea_inbox #15. Source: overnight-code-review run 2026-05-11.`,
-    kind: 'bug',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 90,
-    manual_degree: 2,
-    credits_reward: 15,
-    touches: ['migrations/'],
-    promoted_idea_id: 15,
-  },
-
-  {
-    ref: 'R24',
-    title: 'builders.karma + karma_log table — internal good-citizenship reputation track',
-    description: `**Criterion:** C2 — three ranks + karma alongside drachmae.
-
-**Why:** Drachmae rewards work shipped (objective). Karma rewards good citizenship (subjective): voting fairly, surfacing useful ideas, helping newcomers, getting proposals ratified. Separate track so builders can see "I'm a productive shipper" vs "I'm a great teammate" as distinct signals.
-
-**Done when:**
-- Migration adds \`builders.karma integer NOT NULL DEFAULT 0\`
-- New table \`karma_log (id, builder_id, delta, reason text, recorded_at, granted_by builder_id NULL)\` — mirrors credit_log shape
-- Trigger or AFTER INSERT bumps builders.karma on every karma_log row
-- \`/api/gds/me\` returns karma
-- Initial reasons: \`peer_upvote\`, \`peer_downvote\`, \`proposal_ratified\`, \`archon_grant\` (V4 will add \`claude_interaction_signal\`, \`player_upvote\`)
-
-**Cross-refs:** Foundation for R25 (voting UI), R28 (boost on ratification). V4 idea filed for tone/intent reads + player voting.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 120,
-    manual_degree: 2,
-    credits_reward: 20,
-    touches: ['migrations/', 'src/bongos/db.js', 'src/bongos/routes/me.js'],
-  },
-
-  {
-    ref: 'R25',
-    title: 'Builder-on-builder upvote/downvote on confirmed work — UI + endpoint + anti-self-vote',
-    description: `**Criterion:** C2 — karma signal sourcing.
-
-**Why:** Karma needs a continuous input from peers. Every confirmed task can be voted on by other Metics+; +1 = good work, -1 = concerns. Vote totals translate to karma changes for the shipping builder (e.g., +1 karma per net upvote at week-close).
-
-**Done when:**
-- New table \`peer_votes (id, voter_builder_id, target_task_id, vote int CHECK (-1, 1), recorded_at, UNIQUE(voter, target))\`
-- POST /api/gds/tasks/:id/vote { vote: 1 | -1 | 0 } — 0 to clear
-- Anti-self-vote: 403 if voter_id == task.shipped_by
-- /builders hall: every confirmed task in the feed gets a vote widget
-- Weekly cron tallies votes → karma_log entries; visible audit trail
-- Display: net votes on the task; karma updates lag by 7 days to discourage retaliation cycles
-
-**Cross-refs:** Depends on R24. Feeds R26 (surface on profile).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 300,
-    manual_degree: 2,
-    credits_reward: 50,
-    touches: ['migrations/', 'src/bongos/routes/tasks.js', 'public-builders/'],
-  },
-
-  {
-    ref: 'R26',
-    title: 'Karma surfaced on builder profile + sortable on leaderboard',
-    description: `**Criterion:** C2.
-
-**Why:** Once R24+R25 are live, karma must be visible alongside drachmae. Builders should see their own karma trend + sort the leaderboard by karma instead of drachmae.
-
-**Done when:**
-- Profile page shows current karma + 30-day delta + recent karma_log entries
-- Leaderboard has a "sort by karma" toggle
-- Mobile-friendly
-- Tooltip on the karma badge explains the difference (drachmae = work shipped, karma = good citizenship)
-
-**Cross-refs:** Depends on R24.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 90,
-    manual_degree: 2,
-    credits_reward: 15,
-    touches: ['public-builders/'],
-  },
-
-  {
-    ref: 'R27',
-    title: 'Kind multipliers + staged idea-bonus (drachmae weighting per task kind)',
-    description: `**Criterion:** C5 — builder voice; reward shape.
-
-**Why:** All credits_reward values today are treated equally regardless of task kind. GDS-V3 should over-reward the kinds we want more of: ideas that get promoted, learnings captured, bugs found in code review, blocker-resolutions. Under-reward routine maintenance.
-
-**Done when:**
-- Multiplier table (configurable): feature=1.0, bug=1.2, learning-capture=1.5, blocker-resolution=1.5, decision=1.3, infra=1.0, refactor=0.9, cleanup=0.8, spike=1.1
-- On ship, credits_reward is multiplied by the kind multiplier; credit_log row shows raw × multiplier in description
-- Staged idea-bonus: when an idea is promoted to a task and that task ships, the idea's original author gets a slice (e.g., 25% of credits_reward)
-- ADR documents the multiplier rationale
-
-**Cross-refs:** Promotes idea_inbox #6. Pairs with R32 (criterion-proposal workflow) — proposing builders earn karma + a slice when promoted.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 240,
-    manual_degree: 2,
-    credits_reward: 40,
-    touches: ['src/bongos/db.js', 'src/bongos/ship.js', 'migrations/', 'docs/adr/'],
-    promoted_idea_id: 6,
-  },
-
-  {
-    ref: 'R28',
-    title: 'Karma boost on proposal ratification (cross-link C5 → C2)',
-    description: `**Criterion:** C5, C2.
-
-**Why:** When Archon ratifies a Metic's proposal into a real criterion or task, the Metic gets karma (good citizenship signal). Pure mechanism — fires inside the ratification flow.
-
-**Done when:**
-- The ratification endpoint (from R32) writes a karma_log row for the proposing builder on success
-- Reason: \`proposal_ratified\`
-- Delta: +3 (tunable)
-- Visible in the proposer's karma feed
-
-**Cross-refs:** Depends on R24, R32.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 30,
-    manual_degree: 1,
-    credits_reward: 5,
-    touches: ['src/bongos/inbox.js', 'src/bongos/db.js'],
-  },
-
-  {
-    ref: 'R29',
-    title: 'Promotion/demotion ceremony — credit_log + chat broadcast + Claude SessionStart welcome',
-    description: `**Criterion:** C2 — three ranks are real, not just a column flip.
-
-**Why:** Rank changes should feel like ceremony, not bureaucracy. Three signals fire on every promotion or demotion: ledger (credit_log row, +5c for promotion, 0 for demotion with note), team chat (broadcast in tone-appropriate Mediterranean prose), Claude (SessionStart hook detects rank-change-since-last-session and the agent's first reply honors them).
-
-**Done when:**
-- Rank-change endpoint writes a credit_log row \`reason='rank_change'\` with bonus on promotion, audit-only on demotion
-- Chat broadcast (post.js wrapper) named role: "Citizens of Amazonprimea — <name> has been raised to the rank of <rank>."
-- SessionStart hook (\`scripts/chat/poll.js\` equivalent) checks for unread rank changes on the current builder; if present, writes a one-liner to a transient file that Claude reads on session start
-- Tone is celebratory for promotions, dignified for demotions (no shaming)
-
-**Cross-refs:** Depends on R06. Cross-link to R28 (karma on ratification — same ceremony pattern).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 180,
-    manual_degree: 2,
-    credits_reward: 25,
-    touches: ['src/bongos/routes/builders.js', 'scripts/chat/', '.claude/hooks/'],
-  },
-
-  {
-    ref: 'R30',
-    title: 'Rank-gate /idea-triage skill to Metic+',
-    description: `**Criterion:** C5 — builder voice (Metic+ runs triage, not just Archon).
-
-**Why:** Triage shouldn't be Archon-only. Trusted builders should be able to triage the idea_inbox (promote / discard / merge / defer).
-
-**Done when:**
-- \`.claude/skills/idea-triage/SKILL.md\` opening check calls \`/api/gds/me\` and refuses if rank < Metic with a clear message
-- Server-side: PATCH /inbox/:id enforces requireRank('Metic')
-- Smoke: Xenos opens /idea-triage → "this skill requires Metic+; please ask Archon for promotion"; Metic opens → works
-
-**Cross-refs:** Depends on R05.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 60,
-    manual_degree: 2,
-    credits_reward: 10,
-    touches: ['.claude/skills/idea-triage/', 'src/bongos/routes/inbox.js'],
-  },
-
-  {
-    ref: 'R31',
-    title: 'Rank-gate /blocker-review skill to Metic+',
-    description: `**Criterion:** C5.
-
-**Why:** Same pattern as R30 — Metics should be able to walk open blockers and resolve / escalate.
-
-**Done when:**
-- \`.claude/skills/blocker-review/SKILL.md\` enforces Metic+
-- Server-side: PATCH /blockers/:id enforces requireRank('Metic')
-- Smoke test
-
-**Cross-refs:** Depends on R05.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 45,
-    manual_degree: 2,
-    credits_reward: 8,
-    touches: ['.claude/skills/blocker-review/', 'src/bongos/routes/blockers.js'],
-  },
-
-  {
-    ref: 'R32',
-    title: 'idea_inbox.kind=\'criterion-proposal\' workflow + ratification audit log',
-    description: `**Criterion:** C5 — Metics propose, Archon ratifies.
-
-**Why:** Metics need a place to drop proposed criteria and tasks for the next version that's separate from random ideas. Add a new \`kind\` value and a ratification flow that promotes a criterion-proposal into a real done_when_criteria row.
-
-**Done when:**
-- \`idea_inbox.kind\` now accepts \`'criterion-proposal'\`
-- Planning-session skill (Metic mode) writes proposals here with structure: \`{ target_version, criterion_md, sort_order_hint }\` in body_md
-- New endpoint POST /api/gds/inbox/:id/ratify (Archon-only) — atomically inserts a done_when_criteria row + marks idea promoted + writes karma_log for proposer
-- Audit log row captures: who proposed, who ratified, when, what idea_id, what criterion_id
-
-**Cross-refs:** Depends on R02 (or already-shipped R32 via planning-session skill from V3.R00). Cross-link to R28 (karma boost).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 5,
-    est_minutes: 240,
-    manual_degree: 2,
-    credits_reward: 40,
-    touches: ['src/bongos/inbox.js', 'src/bongos/done-when.js', 'src/bongos/routes/inbox.js', 'migrations/'],
-  },
-
-  // =========================================================================
-  // TIER 3 — Security foundations + observability (P4). Parallelizable.
-  // =========================================================================
-
-  {
-    ref: 'R33',
-    title: 'docs/security-baseline.md — checklist that must be green before any non-Archon ships',
-    description: `**Criterion:** C9 — security baseline.
-
-**Why:** Before Builder #2 ships, a checklist exists that says "these basics are in place." It's not a moat — it's a floor.
-
-**Done when:**
-- File at \`docs/security-baseline.md\` enumerates: input validation per write route, auth-token hygiene, rate limits, audit logging, dep-scan in CI, no secrets in repo, observability dashboards
-- Each item links to the implementing task (R34–R44)
-- A meta-check script \`scripts/gds/security-baseline-check.sh\` re-verifies each item programmatically (curl the endpoints, grep CI for the scan step, etc.)
-- /merge-mode refuses to ship a non-Archon claim if the check script is not green
-
-**Cross-refs:** Umbrella for Tier 3. Block on R34-R44 to be fully green.`,
-    kind: 'infra',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 120,
-    manual_degree: 2,
-    credits_reward: 20,
-    touches: ['docs/security-baseline.md', 'scripts/gds/security-baseline-check.sh'],
-  },
-
-  {
-    ref: 'R34',
-    title: 'Input validation pass on every GDS write endpoint',
-    description: `**Criterion:** C9.
-
-**Why:** Today validation is uneven across routes. With multiple builders hitting the API, every write needs defensive input checks: type, range, length, allowed-values.
-
-**Done when:**
-- Each route file in \`src/bongos/routes/\` has explicit validation up front; bad input → 400 with structured error
-- Length caps on user-supplied text (title ≤ 200, description ≤ 50000, notes ≤ 10000)
-- Enum fields verified against in-code sets
-- Smoke test: every POST/PATCH/DELETE route hit with bad inputs; expect 400, not 500
-
-**Cross-refs:** Foundation for R35 (rate limits) + R65 (red-team target).`,
-    kind: 'cleanup',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 240,
-    manual_degree: 2,
-    credits_reward: 35,
-    touches: ['src/bongos/routes/'],
-  },
-
-  {
-    ref: 'R35',
-    title: 'Rate limits on write paths — Caddy + Express middleware',
-    description: `**Criterion:** C9.
-
-**Why:** A malicious or buggy builder script could hammer /api/gds/tasks at 1000/sec and crash the droplet. Rate-limit per session + per IP.
-
-**Done when:**
-- Caddy global rate-limit on /api/gds/* write methods (POST/PATCH/DELETE): 30/minute per IP
-- Express middleware (\`express-rate-limit\` or hand-rolled): 60/minute per authenticated session
-- 429 response with Retry-After header
-- Read paths uncapped
-- Smoke test hits the limit and verifies 429
-
-**Cross-refs:** Pairs with R36 (audit log of throttled attempts).`,
-    kind: 'infra',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 120,
-    manual_degree: 2,
-    credits_reward: 20,
-    touches: ['infra/Caddyfile', 'src/bongos/middleware/', 'server.js'],
-  },
-
-  {
-    ref: 'R36',
-    title: 'audit_log table — every privileged write captured',
-    description: `**Criterion:** C9 — security baseline; C7 — server-enforced (forensics).
-
-**Why:** Today most state changes are recoverable from individual tables (credit_log, task updates) but there's no single audit stream. With N builders, we need an append-only log of "who did what when" for security review + post-incident forensics.
-
-**Done when:**
-- Migration adds \`audit_log (id, builder_id, route, method, request_body_redacted jsonb, response_status int, ip, user_agent, recorded_at)\`
-- Middleware logs every authenticated write
-- Redaction: any field named \`token\`, \`password\`, \`key\`, \`secret\` is replaced with \`<redacted>\`
-- Read-only via API for Archon (R67 — Archon security view)
-- Retention: indefinite for V3; archive policy is V4
-
-**Cross-refs:** Feeds R67 (security view), R70 (weekly review).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 240,
-    manual_degree: 2,
-    credits_reward: 40,
-    touches: ['migrations/', 'src/bongos/middleware/audit.js', 'src/bongos/db.js'],
-  },
-
-  {
-    ref: 'R37',
-    title: 'Pre-commit secrets check + CI step',
-    description: `**Criterion:** C9, C8 — no secrets in repo.
-
-**Why:** A builder commits an .env file by accident → secrets leak the moment they push. Catch it at commit-time (pre-commit hook) and at PR-time (CI check).
-
-**Done when:**
-- \`.husky/pre-commit\` (or equivalent) runs \`trufflehog\` or \`git-secrets\` against staged changes; aborts commit on hit
-- CI job runs full-history scan on PRs
-- Allowlist file for known false positives
-- README updated with "if pre-commit blocks your commit, here's how to investigate"
-
-**Cross-refs:** Pairs with R38 (dependency scan).`,
-    kind: 'infra',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 90,
-    manual_degree: 2,
-    credits_reward: 15,
-    touches: ['.husky/', '.github/workflows/', 'README.md'],
-  },
-
-  {
-    ref: 'R38',
-    title: 'Dependency-scan in CI (npm audit + pip-audit) + nightly cron + alert on high-severity',
-    description: `**Criterion:** C9.
-
-**Done when:**
-- CI job runs \`npm audit --audit-level=high\` + \`pip-audit\` against the Python art pipeline; PRs fail on high+
-- Nightly scheduled task on droplet runs the same; results posted to chat-inbox + Archon security view (R67) on hits
-- Cleanup of any currently-flagged high-severity deps as part of this task
-
-**Cross-refs:** Cross-link to R44 (rank-check audit cron pattern).`,
-    kind: 'infra',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 120,
-    manual_degree: 2,
-    credits_reward: 20,
-    touches: ['.github/workflows/', 'scripts/security/', 'package.json', 'art/requirements.txt'],
-  },
-
-  {
-    ref: 'R39',
-    title: 'Auth token hygiene — short-lived sessions, refresh-on-use, revocation endpoint',
-    description: `**Criterion:** C9, C7 — rank changes must propagate fast.
-
-**Why:** Today tokens are long-lived. For rank-change-near-instant (C7), tokens need a short TTL with refresh-on-use, and Archon needs a way to revoke any session.
-
-**Done when:**
-- Sessions TTL drops from existing value to 1 hour
-- Every authenticated request refreshes \`builder_sessions.last_used_at\`; expiry recomputed
-- POST /api/gds/auth/revoke (Archon-only) — kill a session by id
-- POST /api/gds/auth/revoke-all (Archon-only) — kill every session for a builder (use on demotion)
-- Demotion endpoint (R06) calls revoke-all on the demoted builder
-- Smoke test: revoke a session → next API call → 401
-
-**Cross-refs:** Foundation of "near-instant rank change" — pairs with R44/R45 (rank check on every request).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 180,
-    manual_degree: 2,
-    credits_reward: 30,
-    touches: ['src/bongos/auth.js', 'src/bongos/db.js', 'migrations/'],
-  },
-
-  {
-    ref: 'R40',
-    title: 'Staging environment — provision staging.amazonprimea.com (separate subdomain, DB, Origin Cert SAN)',
-    description: `**Criterion:** C9 — staging mirrors prod; red-team target.
-
-**Why:** Production cannot be the red-team target. Staging is the controlled mirror where builders can try to break things.
-
-**Done when:**
-- DNS A record for staging.amazonprimea.com (Cloudflare-proxied)
-- Cloudflare Origin Cert reissued with \`*.amazonprimea.com\` SAN (already covers it; verify)
-- Caddy site block for staging.amazonprimea.com → 127.0.0.1:3001
-- New systemd unit \`amazonprimea-staging.service\` running the staging branch on port 3001
-- Separate Postgres database \`amazonprimea_staging\`
-- Separate env file with staging-specific keys
-- HTTPS smoke: curl https://staging.amazonprimea.com/healthz → 200
-
-**Cross-refs:** Heaviest single piece in V3. Block on R41 (deploy automation) + R42 (data seed) for the staging environment to be useful.`,
-    kind: 'infra',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 480,
-    manual_degree: 4,
-    credits_reward: 80,
-    touches: ['infra/', 'scripts/deploy/'],
-  },
-
-  {
-    ref: 'R41',
-    title: 'Staging deploy automation — ~/deploy-staging.sh + branch convention',
-    description: `**Criterion:** C9.
-
-**Why:** Builders should be able to push to staging without touching prod.
-
-**Done when:**
-- Convention: branch \`staging\` is auto-deployed to staging.amazonprimea.com on push
-- ~/deploy-staging.sh script on droplet mirrors ~/deploy.sh structure (git pull, npm ci, migrate against staging DB, restart staging service, smoke)
-- GitHub workflow on push-to-staging triggers SSH deploy
-- Smoke: push commit to staging branch → staging.amazonprimea.com reflects it within 2 minutes
-
-**Cross-refs:** Depends on R40.`,
-    kind: 'infra',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 240,
-    manual_degree: 3,
-    credits_reward: 40,
-    touches: ['scripts/deploy/', '.github/workflows/'],
-  },
-
-  {
-    ref: 'R42',
-    title: 'Staging data seeding — anonymized prod snapshot or fixture seed',
-    description: `**Criterion:** C9.
-
-**Done when:**
-- Script \`scripts/gds/seed-staging.sh\` pulls a fresh anonymized snapshot of prod into staging (or seeds from a fixture file if anonymization is too costly)
-- Anonymization: replace builder GitHub logins with \`builder-N\`; nuke real chat-inbox content; preserve task/cost/credit row structure
-- Reseeded weekly via cron OR on demand by Archon
-- Documentation: "what's real, what's faked, on staging"
-
-**Cross-refs:** Depends on R40 + R41.`,
-    kind: 'infra',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 180,
-    manual_degree: 3,
-    credits_reward: 30,
-    touches: ['scripts/gds/seed-staging.sh', 'docs/'],
-  },
-
-  {
-    ref: 'R43',
-    title: 'Observability dashboard — Grafana provisioned-as-code (dashboards JSON in repo)',
-    description: `**Criterion:** C9 — pulled forward from V4 because the public launch needs eyes.
-
-**Why:** When 5 builders are hitting prod and the public is watching, you need a single screen that shows: error rate per route, auth-failure spikes, system load, per-builder activity, claim/ship rates.
-
-**Done when:**
-- Prometheus exporter on the Node process (\`/metrics\` endpoint with default metrics + custom counters for ship rate, claim rate, auth fails, 4xx/5xx per route)
-- Grafana self-hosted on droplet (~150 MB RAM), reverse-proxied at metrics.amazonprimea.com (Archon-only, Cloudflare Access or basic auth)
-- All dashboards stored as JSON in \`infra/grafana/dashboards/\` — provisioned via Grafana's file-based config, NOT drag-and-drop. Editable in VS Code, version-controlled
-- Initial dashboards: System Overview, Error Watch, Builder Activity, Auth + Security
-
-**Cross-refs:** Cross-link to R36 (audit_log feeds the security dashboard).`,
-    kind: 'infra',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 480,
-    manual_degree: 3,
-    credits_reward: 80,
-    touches: ['infra/grafana/', 'infra/prometheus/', 'src/bongos/metrics.js', 'server.js'],
-  },
-
-  {
-    ref: 'R44',
-    title: 'Rank-check audit pass on every route in src/bongos/routes/',
-    description: `**Criterion:** C7 — server-enforced.
-
-**Why:** The output of R02 (the spike) defines what level of rank each route requires. This task is the implementation: go route by route, attach the right \`requireRank\` call, document why.
-
-**Done when:**
-- Every route in src/bongos/routes/ is annotated with a \`// rank: <level>\` comment + the actual middleware call
-- Routes that don't need auth at all (public/) are annotated \`// rank: public\`
-- A \`docs/routes-permissions.md\` is auto-generated from the annotations
-- Smoke test: hit every Metic+ route as Xenos → 403
-- Cross-reference with R45 (periodic auditor) so drift is caught
-
-**Cross-refs:** Depends on R02 + R05.`,
-    kind: 'cleanup',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 240,
-    manual_degree: 2,
-    credits_reward: 35,
-    touches: ['src/bongos/routes/', 'docs/routes-permissions.md'],
-  },
-
-  {
-    ref: 'R45',
-    title: 'Periodic rank-check auditor — nightly scheduled task, files an idea on drift',
-    description: `**Criterion:** C7 — drift detection.
-
-**Why:** Manual audits drift. A nightly job re-greps every route and compares against the canonical list (from R44); any mismatch files an idea_inbox row tagged \`drift_rank_check\`.
-
-**Done when:**
-- Scheduled task in \`.claude/scheduled-tasks/rank-check-audit/\`
-- Cron: nightly at 03:00 America/New_York
-- On mismatch: files idea_inbox row with details + diff
-- On clean run: silent (no inbox noise)
-- Wired into the scheduled-tasks MCP
-
-**Cross-refs:** Depends on R44.`,
-    kind: 'infra',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 120,
-    manual_degree: 2,
-    credits_reward: 20,
-    touches: ['.claude/scheduled-tasks/rank-check-audit/'],
-  },
-
-  // =========================================================================
-  // TIER 4 — Parallel safety + memory infra (P4).
-  // =========================================================================
-
-  {
-    ref: 'R48',
-    title: 'Touches[] verification at PR merge time (not just at ship)',
-    description: `**Criterion:** C6 — parallel safety.
-
-**Why:** Today the touches[] scanner runs at \`/builder-ship\`, but with multiple builders merging PRs, drift could land on main before scanner sees it. Run it again at PR merge.
-
-**Done when:**
-- GitHub Action on PR merge: clones the branch, runs \`scripts/gds/touches-scan.js\` against the PR's claim's touches[], blocks the merge on drift
-- Builder gets a structured comment explaining what drifted
-- /merge-mode skill aware of this — won't re-attempt blocked merges
-
-**Cross-refs:** Promotes idea_inbox #2.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 180,
-    manual_degree: 2,
-    credits_reward: 30,
-    touches: ['.github/workflows/', 'scripts/gds/touches-scan.js'],
-    promoted_idea_id: 2,
-  },
-
-  {
-    ref: 'R49',
-    title: 'Auto-detect migrations/ sentinel from task title or description',
-    description: `**Criterion:** C6, C1 — fewer builder mistakes.
-
-**Why:** Today builders must remember to add \`migrations/\` to touches[] when their task involves a schema change. Forgetting it = scanner doesn't reserve a migration number. Auto-detect from "migration" / "schema" / "alter table" / "create table" keywords in title/description and append automatically.
-
-**Done when:**
-- POST /api/gds/tasks server-side: if title or description matches the keyword set AND \`migrations/\` not in touches, append it (with a flag on the response: \`migrations_auto_added: true\`)
-- Same logic in capture.js for parity
-- Builders can opt out by passing \`{auto_detect_touches: false}\`
-
-**Cross-refs:** Promotes idea_inbox #3.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 60,
-    manual_degree: 2,
-    credits_reward: 10,
-    touches: ['src/bongos/routes/tasks.js', 'scripts/gds/capture.js'],
-    promoted_idea_id: 3,
-  },
-
-  {
-    ref: 'R50',
-    title: 'Stale-claim auto-release via session_pulses heartbeat',
-    description: `**Criterion:** C6.
-
-**Why:** A builder claims a task, their machine dies, the claim sits forever. \`session_pulses\` exists (PMS-V2); add the auto-release logic.
-
-**Done when:**
-- Scheduled task every 15 minutes: any claim with no pulse in 6 hours → released with outcome='abandoned-stale', no credits, log entry
-- Builder gets a chat-broadcast ping if their claim was auto-released
-- Configurable threshold (env var or admin endpoint)
-
-**Cross-refs:** Pairs with R45.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 120,
-    manual_degree: 2,
-    credits_reward: 20,
-    touches: ['scripts/gds/pulse.js', '.claude/scheduled-tasks/'],
-  },
-
-  {
-    ref: 'R51',
-    title: 'Merge serialization audit — find "I am the only builder" assumptions in ship.js + /merge-mode',
-    description: `**Criterion:** C6.
-
-**Why:** Existing flows likely assume single-builder ops (e.g., one worktree, one git fetch racing nobody). Audit + add concurrency guards.
-
-**Done when:**
-- Audit doc: \`docs/recipes/multi-builder-merge.md\` lists every shared-state surface, every place where ship.js or /merge-mode assumes serialized access, every git operation that could race
-- Critical issues filed as new tasks
-- Optimistic concurrency control (or a lightweight mutex) added where needed
-
-**Cross-refs:** Cross-link to R54 (parallel-load smoke).`,
-    kind: 'spike',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 180,
-    manual_degree: 3,
-    credits_reward: 30,
-    touches: ['scripts/gds/ship.js', '.claude/skills/merge-mode/', 'docs/recipes/'],
-  },
-
-  {
-    ref: 'R52',
-    title: 'Per-builder worktree-name collision check + auto-disambiguation',
-    description: `**Criterion:** C6.
-
-**Why:** \`.claude/worktrees/<random>\` should never collide across 5 builders, but verify + add a server-side uniqueness check on POST /api/gds/claims.
-
-**Done when:**
-- POST /api/gds/claims includes worktree_name in the uniqueness key (server-side check)
-- Two claims with the same worktree_name → second one auto-disambiguated with a suffix
-- Test: simulate parallel claim with same worktree_name → both succeed with distinct names
-
-**Cross-refs:** Cheap; pairs with R54.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 60,
-    manual_degree: 2,
-    credits_reward: 10,
-    touches: ['src/bongos/routes/claims.js', 'src/bongos/db.js'],
-  },
-
-  {
-    ref: 'R53',
-    title: 'Audit-trail completeness check — forensic reconstructability per builder',
-    description: `**Criterion:** C6, C9.
-
-**Why:** Can we, given a builder_id and a date range, reconstruct everything they did? If not, the audit trail is incomplete.
-
-**Done when:**
-- Script \`scripts/gds/audit-replay.sh <builder_id> <start> <end>\` outputs a chronological log of: every claim, every ship, every cost entry, every karma change, every audit_log row
-- Gaps identified → filed as tasks
-- Doc: \`docs/recipes/audit-replay.md\` describes how to use it
-
-**Cross-refs:** Depends on R36 (audit_log).`,
-    kind: 'infra',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 180,
-    manual_degree: 3,
-    credits_reward: 30,
-    touches: ['scripts/gds/', 'docs/recipes/'],
-  },
-
-  {
-    ref: 'R54',
-    title: 'Parallel-load smoke test — simulate 5 builders claiming/shipping/merging on staging',
-    description: `**Criterion:** C6 — validates Tier 4.
-
-**Why:** All the parallel-safety hardening above means nothing if not exercised. Run a real load test against staging with 5 simulated builders.
-
-**Done when:**
-- Test harness in \`tests/parallel-load.mjs\` spawns 5 concurrent "builder" sessions
-- Each session: claim a task, simulate 5-min work, ship, claim another
-- Run for 30 minutes against staging
-- All claims either succeed or 409 (collision) cleanly; no 500s, no race conditions
-- Output: per-second throughput, claim collision rate, any anomalies
-
-**Cross-refs:** Depends on R40-R42 (staging exists). Validates R48-R53.`,
-    kind: 'spike',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 240,
-    manual_degree: 3,
-    credits_reward: 40,
-    touches: ['tests/'],
-  },
-
-  {
-    ref: 'R55',
-    title: 'builder_memory server-side store schema (output of R03 spike)',
-    description: `**Criterion:** C8.
-
-**Why:** Server-canonical per-builder memory; schema designed by R03.
-
-**Done when:**
-- Migration adds the schema R03 recommended (Postgres BYTEA per-file vs object storage TBD)
-- Helper functions: \`storeMemoryFile(builder_id, path, content)\`, \`fetchMemoryFile(builder_id, path)\`, \`listMemoryFiles(builder_id)\`
-- Per-builder isolation enforced at the helper layer
-
-**Cross-refs:** Depends on R03 (spike).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 180,
-    manual_degree: 2,
-    credits_reward: 30,
-    touches: ['migrations/', 'src/bongos/memory.js', 'src/bongos/db.js'],
-  },
-
-  {
-    ref: 'R56',
-    title: 'Memory sync-on-ship — /builder-ship pushes builder\'s local memory dir',
-    description: `**Criterion:** C8.
-
-**Done when:**
-- \`/builder-ship\` reads \`~/.claude/projects/.../memory/\` (or whatever Claude Code's current memory dir is on the builder's machine)
-- Calls POST /api/gds/memory/sync with each file
-- Server stores via R55's helpers
-- Progress visible to the builder ("syncing 3 memory files…")
-
-**Cross-refs:** Depends on R55. Pairs with R57.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 180,
-    manual_degree: 2,
-    credits_reward: 30,
-    touches: ['scripts/gds/ship.js', 'src/bongos/routes/memory.js'],
-  },
-
-  {
-    ref: 'R57',
-    title: 'Memory pull-on-session-start — fresh worktree pulls server-side memory if newer',
-    description: `**Criterion:** C8.
-
-**Done when:**
-- SessionStart hook (or \`/builder-start\`) checks server-side memory mtime
-- Pulls any file newer than local
-- Last-write-wins per the R03 policy
-- Smoke: ship on machine A, pull on machine B → memory matches
-
-**Cross-refs:** Depends on R55, R56.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 120,
-    manual_degree: 2,
-    credits_reward: 20,
-    touches: ['.claude/hooks/', 'scripts/gds/start.js'],
-  },
-
-  {
-    ref: 'R58',
-    title: 'Per-builder memory isolation — server enforces no cross-builder reads',
-    description: `**Criterion:** C8, C9.
-
-**Done when:**
-- Every memory endpoint asserts \`req.builder.id === path_owner_id\`
-- Smoke: builder A's session reading builder B's memory → 403
-- Archon override exists for forensics but is audit-logged
-
-**Cross-refs:** Depends on R55.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 60,
-    manual_degree: 2,
-    credits_reward: 10,
-    touches: ['src/bongos/routes/memory.js'],
-  },
-
-  {
-    ref: 'R59',
-    title: 'Memory conflict resolution policy doc',
-    description: `**Criterion:** C8.
-
-**Done when:**
-- Doc at \`docs/recipes/memory-sync-conflicts.md\` describes the policy R03 chose (likely last-write-wins per file)
-- Edge cases: builder edits same file in two parallel sessions, server has newer version than local
-- Operator guidance: how to recover a clobbered file from backup (R63)
-
-**Cross-refs:** Depends on R03.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 60,
-    manual_degree: 3,
-    credits_reward: 10,
-    touches: ['docs/recipes/'],
-  },
-
-  {
-    ref: 'R60',
-    title: '.env.local propagation fix for git worktrees (known gotcha)',
-    description: `**Criterion:** C8 — onboarding shouldn't trip over this.
-
-**Why:** CLAUDE.md flags this: ".env.local does not propagate to git worktrees. Copy it from a sibling worktree before running anything that hits the Google API." This is a footgun for new builders.
-
-**Done when:**
-- Post-worktree-create hook (or wrapper script) auto-copies .env.local from the main checkout into the new worktree
-- If .env.local doesn't exist in main, prompts to run /builder-setup
-- Documented as solved in CLAUDE.md (remove the warning)
-
-**Cross-refs:** Pairs with R08 (bootstrap script).`,
-    kind: 'cleanup',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 45,
-    manual_degree: 2,
-    credits_reward: 8,
-    touches: ['scripts/', '.claude/hooks/', 'CLAUDE.md'],
-  },
-
-  {
-    ref: 'R61',
-    title: 'Secrets-in-repo scan + pre-commit hook (separate from R37 — broader policy)',
-    description: `**Criterion:** C8 — verified, not assumed.
-
-**Done when:**
-- One-time historical scan with trufflehog over the entire repo history
-- Any hits → rotated keys + filtered from history (BFG repo-cleaner or git filter-repo)
-- Pre-commit hook from R37 catches future ones
-- ADR \`docs/adr/0017-secrets-policy.md\` documents: what's a secret, where they live (\`/etc/amazonprimea/secret\` on droplet only), how rotation works
-
-**Cross-refs:** Depends on R37 (the hook). This task is the historical sweep + the policy.`,
-    kind: 'cleanup',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 180,
-    manual_degree: 3,
-    credits_reward: 30,
-    touches: ['docs/adr/', '.husky/'],
-  },
-
-  {
-    ref: 'R62',
-    title: 'Memory + art-pipeline portability smoke tests',
-    description: `**Criterion:** C8.
-
-**Done when:**
-- Two smoke scripts:
-  - \`scripts/gds/portability-smoke-memory.sh\` — fresh clone + Metic creds → /builder-setup → /builder-start → ship a tiny task → verify memory synced
-  - \`scripts/gds/portability-smoke-art.sh\` — fresh clone + own Gemini key → run \`art/pipeline/orchestrator.py\` on a single tile → succeeds
-- Both wired into nightly CI on staging
-- Failures file idea_inbox row for follow-up
-
-**Cross-refs:** Validates C8 end-to-end.`,
-    kind: 'spike',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 240,
-    manual_degree: 3,
-    credits_reward: 40,
-    touches: ['scripts/gds/', '.github/workflows/'],
-  },
-
-  {
-    ref: 'R63',
-    title: 'Memory backup — server-side regular backups + restore drill',
-    description: `**Criterion:** C8.
-
-**Done when:**
-- Nightly backup of builder_memory table to a Spaces bucket (or droplet local + offsite)
-- 30-day retention; weekly archive
-- Restore drill: pick a builder, restore their memory from yesterday's backup into a sandbox, verify content matches
-- Documented in \`docs/recipes/memory-backup.md\`
-
-**Cross-refs:** Depends on R55. Cost: ~$1/month for Spaces if used.`,
-    kind: 'infra',
-    discipline: 'engineering',
-    priority: 4,
-    est_minutes: 180,
-    manual_degree: 3,
-    credits_reward: 30,
-    touches: ['scripts/gds/backup-memory.sh', 'docs/recipes/'],
-  },
-
-  // =========================================================================
-  // TIER 5 — Red-team economy + advanced voice (P3).
-  // =========================================================================
-
-  {
-    ref: 'R64',
-    title: 'vulnerability_reports table + schema',
-    description: `**Criterion:** C9.
-
-**Done when:**
-- Migration: \`vulnerability_reports (id, reporter_builder_id, target text, severity text CHECK IN (low/med/high/critical), title, description, repro_steps_md, status text CHECK IN (open/repro_attempted/confirmed/disputed/fixed/wontfix), confirmed_at, fixed_at, fix_task_id, drachmae_awarded numeric, reported_at)\`
-- Helper module \`src/bongos/security.js\`
-- Per-builder read access (own reports + status); Archon reads all (via R67)
-
-**Cross-refs:** Foundation for R65, R67, R68.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 3,
-    est_minutes: 120,
-    manual_degree: 2,
-    credits_reward: 20,
-    touches: ['migrations/', 'src/bongos/security.js', 'src/bongos/db.js'],
-  },
-
-  {
-    ref: 'R65',
-    title: '/builder-redteam <severity> <title> skill — capture finding, draft security task, surface in Archon view',
-    description: `**Criterion:** C9.
-
-**Done when:**
-- New skill at \`.claude/skills/builder-redteam/SKILL.md\` — Metic+ gated
-- Walks the builder through: title, severity, target (route / file / endpoint), repro steps, expected vs actual
-- POSTs to /api/gds/security/report; row inserted into vulnerability_reports
-- Auto-drafts a security-kind task with kind='infra', parent='security-finding'
-- Doesn't ping Archon directly; surfaces in R67's security view
-- Returns a confirmation with the report id + "an automated subagent will attempt to reproduce within the hour"
-
-**Cross-refs:** Depends on R64. Pairs with R68 (auto-confirmation).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 3,
-    est_minutes: 180,
-    manual_degree: 2,
-    credits_reward: 30,
-    touches: ['.claude/skills/builder-redteam/', 'src/bongos/routes/security.js'],
-  },
-
-  {
-    ref: 'R66',
-    title: 'Drachmae payout table for vulnerability severity',
-    description: `**Criterion:** C9 — incentive structure.
-
-**Done when:**
-- Config table or env var: low=10c, medium=50c, high=200c, critical=1000c (tunable; Archon can adjust via env)
-- ADR documents the rationale
-- Display visible on /builders hall under "Red-team rewards"
-
-**Cross-refs:** Used by R68 (auto-confirmation awards drachmae from this table).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 3,
-    est_minutes: 60,
-    manual_degree: 1,
-    credits_reward: 10,
-    touches: ['src/bongos/security.js', 'docs/adr/', 'public-builders/'],
-  },
-
-  {
-    ref: 'R67',
-    title: 'Archon-only security view in /builders dashboard',
-    description: `**Criterion:** C9.
-
-**Done when:**
-- New tab/section in /builders hall (Archon-only) shows:
-  - Open vulnerability_reports with severity, reporter, repro
-  - audit_log filterable by builder/route/severity-of-route
-  - Dependency-scan alerts (R38)
-  - Recent auth-failure spikes (from R43 Grafana data)
-- Each report has actions: confirm, dispute, mark fixed, link-to-fix-task
-
-**Cross-refs:** Depends on R64, R36, R38.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 3,
-    est_minutes: 240,
-    manual_degree: 3,
-    credits_reward: 40,
-    touches: ['public-builders/', 'src/bongos/routes/security.js'],
-  },
-
-  {
-    ref: 'R68',
-    title: 'Auto-confirmation flow — Opus subagent reproduces vuln on staging; awards drachmae automatically',
-    description: `**Criterion:** C9.
-
-**Why:** Replaces manual Archon confirmation. The grader pattern (already proven in R18-R22) applied to vulnerability reports.
-
-**Done when:**
-- Scheduled task (every hour) picks up reports with status=open
-- Spawns Opus subagent: "given these repro steps, attempt to reproduce on staging.amazonprimea.com. Report success/failure with evidence."
-- On success: status → confirmed, drachmae auto-awarded (per R66), security task auto-created
-- On failure: status → repro_attempted with subagent's reasoning; bounced back to reporter for clarification
-- Archon can manually override either direction via R67
-
-**Cross-refs:** Depends on R40-R42, R64, R66, R67.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 3,
-    est_minutes: 360,
-    manual_degree: 3,
-    credits_reward: 60,
-    touches: ['src/bongos/security.js', '.claude/scheduled-tasks/'],
-  },
-
-  {
-    ref: 'R69',
-    title: 'Security ADR — server-side only, top-rank access only',
-    description: `**Criterion:** C9.
-
-**Why:** The threat model + mitigation details should not be in the public repo. Committed in heavily-redacted form (or only as a stub pointing to the server-side full version).
-
-**Done when:**
-- Stub ADR in repo at \`docs/adr/0018-security-model-public-stub.md\` — public-safe overview, no specific defenses, no specific known weaknesses
-- Full ADR lives in a server-side store (or a separate private repo) accessible only to Archon and Metic+ via a server endpoint
-- The endpoint requires Metic+ (so Xenos doesn't see it)
-
-**Cross-refs:** Companion to R61 (secrets policy).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 3,
-    est_minutes: 180,
-    manual_degree: 3,
-    credits_reward: 30,
-    touches: ['docs/adr/', 'src/bongos/routes/security.js'],
-  },
-
-  {
-    ref: 'R70',
-    title: 'Weekly security review scheduled task',
-    description: `**Criterion:** C9.
-
-**Done when:**
-- Scheduled task: every Sunday 09:00 ET, surfaces:
-  - Vulnerability reports older than 7 days still in open/repro_attempted state
-  - Security tasks older than 14 days
-  - Recent high-severity dep alerts
-- Output posted as a single chat broadcast to Archon's private channel + a row in /builders security view
-- Silent if nothing to surface
-
-**Cross-refs:** Depends on R64, R67.`,
-    kind: 'infra',
-    discipline: 'engineering',
-    priority: 3,
-    est_minutes: 120,
-    manual_degree: 2,
-    credits_reward: 20,
-    touches: ['.claude/scheduled-tasks/'],
-  },
-
-  {
-    ref: 'R71',
-    title: 'Nightly skill-usage feedback loop scheduled task (Metic+ visibility only)',
-    description: `**Criterion:** C5 — builders steer system evolution.
-
-**Done when:**
-- Scheduled task at \`.claude/scheduled-tasks/skill-usage-review/\` aggregates last 24h of skill invocations
-- Identifies friction patterns: same skill invoked > N times in a session, skill exit codes non-zero, builder visibly retried steps
-- Files idea_inbox rows (kind='skill-friction') summarizing the pattern
-- Metic+ only — Xenos don't see skill-friction ideas in their inbox view
-
-**Cross-refs:** Promotes idea_inbox #22.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 3,
-    est_minutes: 240,
-    manual_degree: 3,
-    credits_reward: 40,
-    touches: ['.claude/scheduled-tasks/', 'src/bongos/inbox.js'],
-    promoted_idea_id: 22,
-  },
-
-  {
-    ref: 'R72',
-    title: 'Priority sessions skill — plain-speech questions weight idea_inbox',
-    description: `**Criterion:** C5.
-
-**Why:** Planning sessions set criteria; priority sessions weight what's in flight right now. The trusted builder answers a small set of plain-speech questions ("what feels stuck?", "what would unblock the most builders?", "what excites you?"), and the answers reweight idea_inbox priorities + suggest task promotions.
-
-**Done when:**
-- Skill at \`.claude/skills/priority-session/SKILL.md\` — Metic+ gated
-- Conversation walks 5-7 plain questions
-- Output: weighted ranking of open ideas + a "what should I claim next?" suggestion
-- Writes a session-log entry
-
-**Cross-refs:** Promotes idea_inbox #18.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 3,
-    est_minutes: 240,
-    manual_degree: 3,
-    credits_reward: 40,
-    touches: ['.claude/skills/priority-session/'],
-    promoted_idea_id: 18,
-  },
-
-  {
-    ref: 'R73',
-    title: 'Builder analytics — historical "AI dev curve" per builder',
-    description: `**Criterion:** C5.
-
-**Done when:**
-- /builders profile page gets an analytics panel: ship rate over time, cost-per-task trend, confirmation rate, average task duration trend, top kinds shipped
-- Sparkline charts (no heavy chart library — Chart.js if needed)
-- Archon's view aggregates across all builders
-- Public-facing summary on /status hides individuals but shows ecosystem trends
-
-**Cross-refs:** Promotes idea_inbox #35.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 3,
-    est_minutes: 360,
-    manual_degree: 3,
-    credits_reward: 60,
-    touches: ['public-builders/', 'src/bongos/routes/analytics.js'],
-    promoted_idea_id: 35,
-  },
-
-  {
-    ref: 'R74',
-    title: 'Calibration dashboard (Archon view) — grader signal per builder × kind × time',
-    description: `**Criterion:** C4.
-
-**Done when:**
-- Archon-only page (or Grafana panel) shows grader scores over time, broken down by builder + task kind
-- Trends visible: is Builder X drifting? Is the bar tightening?
-- Alerts on anomalies (single builder's confirmation rate falls > 30% week-over-week)
-
-**Cross-refs:** Depends on R20, R22, R43.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 3,
-    est_minutes: 180,
-    manual_degree: 3,
-    credits_reward: 30,
-    touches: ['public-builders/', 'infra/grafana/dashboards/'],
-  },
-
-  {
-    ref: 'R75',
-    title: 'Manual-override request flow (rare path)',
-    description: `**Criterion:** C4.
-
-**Done when:**
-- If the grader rejects and the builder thinks the grader is wrong, they can POST /api/gds/tasks/:id/override-request with a rationale
-- Surfaces in Archon's queue (R67)
-- Archon decides yes/no; on yes, task flips to confirmed manually
-- Audit-logged
-
-**Cross-refs:** Depends on R67. Should be rare — < 5% of ships.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 3,
-    est_minutes: 90,
-    manual_degree: 2,
-    credits_reward: 15,
-    touches: ['src/bongos/routes/tasks.js', 'public-builders/'],
-  },
-
-  // =========================================================================
-  // TIER 6 — Onboarding polish + remaining (P2).
-  // =========================================================================
-
-  {
-    ref: 'R76',
-    title: 'Auto-completing onboarding checklist — state machine fires on builder events',
-    description: `**Criterion:** C1.
-
-**Why:** New builders shouldn't have to track where they are in onboarding. A state machine on the server fires events as they go (Device Flow complete, first /builder-start, first claim, first ship, first karma vote received) and ticks off a checklist visible in /builders hall.
-
-**Done when:**
-- Migration: \`builder_onboarding_state (builder_id PK, current_stage text, completed_stages text[], started_at, completed_at)\`
-- Stages: \`auth_complete\`, \`primer_read\`, \`first_start\`, \`first_claim\`, \`first_ship\`, \`first_vote_received\`, \`graduated\`
-- Server-side hooks fire on each event
-- /builders hall renders the checklist for the current builder (read-only for others)
-- On completion: chat broadcast "<name> has completed onboarding"
-
-**Cross-refs:** Depends on R04, R13. Pairs with R77 (diagrams).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 2,
-    est_minutes: 300,
-    manual_degree: 2,
-    credits_reward: 50,
-    touches: ['migrations/', 'src/bongos/onboarding.js', 'public-builders/'],
-  },
-
-  {
-    ref: 'R77',
-    title: 'Visual diagrams of how GDS works — Mermaid + PNG flowcharts',
-    description: `**Criterion:** C1.
-
-**Done when:**
-- 5 diagrams in \`docs/onboarding/diagrams/\`:
-  1. Claim → ship lifecycle (states + transitions)
-  2. Rank ladder (Xenos / Metic / Archon + permissions)
-  3. Drachmae / karma sourcing (where each comes from, where each is spent)
-  4. Server ↔ repo ↔ memory layered model
-  5. Two-track versioning (product / internal) and how planning sessions feed it
-- Mermaid source committed; PNGs rendered for embed in primer doc
-- Linked from R12 (primer)
-
-**Cross-refs:** Pairs with R12.`,
-    kind: 'feature',
-    discipline: 'creative',
-    priority: 2,
-    est_minutes: 240,
-    manual_degree: 3,
-    credits_reward: 40,
-    touches: ['docs/onboarding/diagrams/'],
-  },
-
-  {
-    ref: 'R78',
-    title: '/builders hall first-visit welcome panel',
-    description: `**Criterion:** C1.
-
-**Done when:**
-- On first /builders visit by a new builder, render a welcome panel: their rank, what's unlocked, next checklist step (from R76), link to primer (R12), link to /builder-start
-- Dismissable; reappears if onboarding_state stage regresses (rare)
-
-**Cross-refs:** Depends on R13, R76.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 2,
-    est_minutes: 90,
-    manual_degree: 2,
-    credits_reward: 15,
-    touches: ['public-builders/'],
-  },
-
-  {
-    ref: 'R79',
-    title: 'Auto-generator for low-drachmae newcomer tasks — from code-review findings + design prompts',
-    description: `**Criterion:** C1 — newcomer queue always populated.
-
-**Why:** R14 added the newcomer_friendly flag; this task ensures there's always supply. Two sources:
-- Engineering newcomers: overnight code-review findings tagged low-severity and well-scoped get auto-promoted into tasks tagged newcomer_friendly with low drachmae rewards
-- Creative newcomers: a small prompt library generates "design a new NPC sketch" / "write a vendor flavor line" / "name a building" tasks
-
-**Done when:**
-- Scheduled task: if open newcomer_friendly task count < 3, generate one from each pool
-- Engineering pool sources from \`.claude/scheduled-tasks/overnight-code-review/\` findings
-- Creative pool draws from a curated prompt list in \`art/template/newcomer-prompts.json\`
-- Auto-generated tasks tagged \`source='auto-newcomer-generator'\`
-
-**Cross-refs:** Depends on R14. Cross-link to R81 (discipline gating).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 2,
-    est_minutes: 240,
-    manual_degree: 3,
-    credits_reward: 40,
-    touches: ['.claude/scheduled-tasks/newcomer-generator/', 'art/template/'],
-  },
-
-  {
-    ref: 'R80',
-    title: 'Onboarding session logs auto-publish to server + passive analysis pipeline',
-    description: `**Criterion:** C1 — feedback without asking.
-
-**Why:** Instead of asking new builders "what was confusing?" we read their actual session logs and analyze patterns. Logs auto-publish during onboarding (with explicit consent at /builder-setup); a passive analysis pipeline extracts friction.
-
-**Done when:**
-- /builder-setup asks: "May we read your onboarding session logs to improve the system? [Y/n]"
-- On consent: a SessionStart/SessionEnd hook ships the session transcript (compressed) to server during the onboarding window
-- Passive analysis (Opus subagent) reads each transcript, flags moments of confusion (long Claude responses that didn't resolve, repeated similar prompts, error recovery attempts)
-- Files idea_inbox row per flagged session (kind='onboarding-friction')
-
-**Cross-refs:** Pairs with R71.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 2,
-    est_minutes: 360,
-    manual_degree: 3,
-    credits_reward: 60,
-    touches: ['scripts/gds/', '.claude/hooks/', 'src/bongos/onboarding.js'],
-  },
-
-  {
-    ref: 'R81',
-    title: 'Discipline-gated builder experience + cross-discipline recommendations',
-    description: `**Criterion:** C1, C5.
-
-**Why:** A creative builder shouldn't be shown only engineering tasks at /builder-start. Routing by discipline gives a better experience; cross-discipline recommendations expose options.
-
-**Done when:**
-- /builder-start filters claimable_tasks by builder.preferred_disciplines (R82) by default
-- A "show all disciplines" toggle exists
-- A "you might enjoy" section shows 2-3 tasks outside the builder's discipline, ranked by relevance
-
-**Cross-refs:** Promotes idea_inbox #36. Depends on R82.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 2,
-    est_minutes: 180,
-    manual_degree: 2,
-    credits_reward: 30,
-    touches: ['scripts/gds/start.js', 'src/bongos/db.js'],
-    promoted_idea_id: 36,
-  },
-
-  {
-    ref: 'R82',
-    title: 'builders.preferred_disciplines text[] column',
-    description: `**Criterion:** C1.
-
-**Done when:**
-- Migration adds the column (default \`{}\`)
-- /builder-setup asks the new builder which disciplines they're interested in (creative, engineering, both)
-- /builders profile lets them edit later
-- Validated against tasks.discipline enum
-
-**Cross-refs:** Pairs with R81.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 2,
-    est_minutes: 60,
-    manual_degree: 2,
-    credits_reward: 10,
-    touches: ['migrations/', 'scripts/gds/setup.js', 'public-builders/'],
-  },
-
-  {
-    ref: 'R83',
-    title: 'Task-level requires_rank column',
-    description: `**Criterion:** C2.
-
-**Why:** R14 added newcomer_friendly (Xenos-claimable). The inverse: some tasks are Metic-only because they touch sensitive infra. Add an explicit \`requires_rank\` column.
-
-**Done when:**
-- Migration: \`tasks.requires_rank text DEFAULT 'Xenos'\` (Xenos = anyone; Metic = trusted only; Archon = me)
-- claimable_tasks view filters by current builder rank
-- Server-side enforcement on POST /claims
-
-**Cross-refs:** Depends on R04, R14. Sub-case of the rank-gating pattern.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 2,
-    est_minutes: 90,
-    manual_degree: 2,
-    credits_reward: 15,
-    touches: ['migrations/', 'src/bongos/db.js', 'src/bongos/routes/claims.js'],
-  },
-
-  {
-    ref: 'R84',
-    title: '/api/gds/me MTD spend + soft-cap 80% warning + hard-cap 100% refusal',
-    description: `**Criterion:** C3.
-
-**Done when:**
-- /api/gds/me returns: \`{ spend_mtd_usd, budget_mtd_usd, pct_used }\`
-- At 80%: chat ping to that builder + visible warning on /builders profile
-- At 100%: write paths that incur cost (ship, art-pipeline runs) refuse with structured error
-- Budget per-builder configurable by Archon
-
-**Cross-refs:** Depends on R85.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 2,
-    est_minutes: 180,
-    manual_degree: 2,
-    credits_reward: 30,
-    touches: ['src/bongos/routes/me.js', 'src/bongos/cost.js', 'public-builders/'],
-  },
-
-  {
-    ref: 'R85',
-    title: 'cost_log.builder_id attribution audit + /status spend transparency',
-    description: `**Criterion:** C3.
-
-**Done when:**
-- Audit every code path that writes to cost_log; verify builder_id is populated correctly (never NULL, never lars-as-proxy)
-- Backfill any historical rows that need correction
-- /status page gains a "per-builder spend" row (anonymized or named, your call) so the community sees system cost honestly
-
-**Cross-refs:** Depends on R11. Foundation for R84.`,
-    kind: 'cleanup',
-    discipline: 'engineering',
-    priority: 2,
-    est_minutes: 120,
-    manual_degree: 2,
-    credits_reward: 20,
-    touches: ['src/bongos/cost.js', 'scripts/gds/backfill-cost.js', 'public-status/'],
-  },
-
-  {
-    ref: 'R86',
-    title: 'Skill efficiency pass + builder-toggleable per-skill model selector on /builders page',
-    description: `**Criterion:** cross-cutting — cost discipline.
-
-**Why:** Every slash command burns LLM credits on mechanism (parsing JSON, checking rank, formatting output) and judgment (deciding what to claim, writing a task description). The mechanism work should run on cheap models or no LLM (direct script); judgment stays on Opus. Plus: builders should be able to pick their model preferences per skill.
-
-**Done when:**
-- Audit every \`.claude/skills/*/SKILL.md\` — categorize each step as mechanism or judgment
-- Refactor mechanism into pure scripts (no LLM)
-- Skill files updated to delegate accordingly
-- /builders profile gains a model-selector matrix: skill-kind × model (Opus, Sonnet, Haiku) — defaults to Opus for judgment, scripts for mechanism
-- Per-builder preferences read at skill-execution time
-- Cost-per-skill-invocation measured before + after, documented in ADR
-
-**Cross-refs:** Promotes idea_inbox #21. Pulls forward a minimal slice of GDS-V4 idea #30.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 2,
-    est_minutes: 480,
-    manual_degree: 3,
-    credits_reward: 80,
-    touches: ['.claude/skills/', 'scripts/gds/', 'src/bongos/db.js', 'public-builders/', 'docs/adr/'],
-    promoted_idea_id: 21,
-  },
-
-  // =========================================================================
-  // TIER 7 — End-of-V3 lockdown (P1).
-  // =========================================================================
-
-  {
-    ref: 'R87',
-    title: 'CLAUDE.md audit — categorize each claim as descriptive vs canonical; relocate canonical items to DB',
-    description: `**Criterion:** C7.
-
-**Why:** CLAUDE.md is the index for AI agents but also contains de facto state ("here's our rank ladder", "here's the trust boundary"). Some of that is canonical and should live server-side (DB or server-only doc); some is descriptive and stays in the file. Audit + relocate.
-
-**Done when:**
-- Each section of CLAUDE.md tagged (in a temporary review doc) as descriptive or canonical
-- Canonical sections relocated server-side (e.g., rank ladder definitions to a \`docs/canonical-permissions.md\` that's read-only, or to the DB)
-- CLAUDE.md gains a top-of-file disclaimer: "This file is descriptive. The source of truth for permissions, scope, and state is the GDS database accessed via /api/gds/*."
-- Long-form sections that grew too big get split into smaller files
-
-**Cross-refs:** Heaviest at end of V3 so it reflects all V3 changes. Depends on R02 (trust-boundary ADR).`,
-    kind: 'cleanup',
-    discipline: 'engineering',
-    priority: 1,
-    est_minutes: 360,
-    manual_degree: 3,
-    credits_reward: 60,
-    touches: ['CLAUDE.md', 'docs/'],
-  },
-
-  {
-    ref: 'R88',
-    title: 'Rank-gate /planning-session skill to Metic+ (end-of-V3 lockdown)',
-    description: `**Criterion:** C2, C7 — your explicit end-of-V3 ask.
-
-**Why:** The planning-session skill is shipped by V3.R00 with no rank gate so V3 itself can use it. Once V3 ships, only Metics + Archon should be able to open planning sessions.
-
-**Done when:**
-- \`.claude/skills/planning-session/SKILL.md\` opening check enforces Metic+
-- Server-side: any endpoint the skill calls enforces requireRank('Metic')
-- Smoke: Xenos opens /planning-session → "this skill requires Metic+; ask Archon for promotion"
-- Documented as part of V3's "lockdown" tasks
-
-**Cross-refs:** Depends on R05, R30 (same rank-gate pattern as idea-triage).`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 1,
-    est_minutes: 60,
-    manual_degree: 2,
-    credits_reward: 10,
-    touches: ['.claude/skills/planning-session/', 'src/bongos/routes/inbox.js', 'src/bongos/routes/done-when.js'],
-  },
-
-  {
-    ref: 'R89',
-    title: 'Graceful builder exit — transfer claims, archive memory, preserve credit/karma history',
-    description: `**Criterion:** robustness — what happens when a builder quits.
-
-**Done when:**
-- New skill or endpoint: \`/builder-exit\` or PATCH /builders/:id/status='inactive' (Archon-only, or self-service with Archon approval)
-- On exit: active claims released cleanly; outstanding session_logs sealed; memory archived to a long-term store (not deleted); rank → Xenos; can't claim new tasks
-- Drachmae + karma history preserved indefinitely
-- Builder can be re-activated by Archon if they return
-
-**Cross-refs:** Should be available before exits actually happen — file but don't necessarily ship until needed. Could be deprioritized further.`,
-    kind: 'feature',
-    discipline: 'engineering',
-    priority: 1,
-    est_minutes: 240,
-    manual_degree: 3,
-    credits_reward: 40,
-    touches: ['src/bongos/routes/builders.js', '.claude/skills/'],
-  },
-];
-
-// ---------------------------------------------------------------------------
-// Main: post each task; PATCH idea_inbox for promotions
-// ---------------------------------------------------------------------------
-
-async function main() {
-  await requireSession();
-  const api = await cliClient();
-
-  // Pull current GDS-V3 tasks for idempotency by source_ref
-  const list = await api.tasks.getTasks({ query: { version: 'GDS-V3' } });
-  const bySourceRef = {};
-  for (const t of list.data?.tasks || []) {
-    if (t.source_ref) bySourceRef[t.source_ref] = t;
-  }
-
-  let created = 0, skipped = 0, errors = 0, promoted = 0;
-  for (const def of TASKS) {
-    const source_ref = `gds-v3-${def.ref.toLowerCase()}`;
-    if (bySourceRef[source_ref]) {
-      console.log(`SKIP  ${def.ref} (already exists: id=${bySourceRef[source_ref].id})`);
-      skipped++;
-      continue;
-    }
-    const body = {
-      version_id: 'GDS-V3',
-      title: `V3.${def.ref} — ${def.title}`,
-      description: def.description,
-      kind: def.kind,
-      discipline: def.discipline,
-      status: 'backlog',
-      priority: def.priority,
-      est_minutes: def.est_minutes,
-      manual_degree: def.manual_degree,
-      credits_reward: def.credits_reward,
-      touches: def.touches || [],
-      source: 'planning-session',
-      source_ref,
-    };
-    if (DRY) {
-      console.log(`DRY   ${def.ref}  P${def.priority}  ${def.kind}  ${def.est_minutes}m  ${def.credits_reward}c  ${def.title.slice(0, 60)}`);
-      continue;
-    }
-    const res = await api.tasks.postTasks({ body });
-    if (res.status !== 201) {
-      console.error(`FAIL  ${def.ref}: status=${res.status} ${JSON.stringify(res.data).slice(0, 200)}`);
-      errors++;
-      continue;
-    }
-    const newId = res.data.task.id;
-    console.log(`OK    ${def.ref} → task id=${newId}`);
-    created++;
-
-    if (def.promoted_idea_id) {
-      const patch = await api.inbox.patchInboxId({ id: def.promoted_idea_id, body: {
-        status: 'promoted',
-        promoted_to_task_id: Number(newId),
-      } });
-      if (patch.status === 200) {
-        console.log(`      promoted idea_inbox #${def.promoted_idea_id} → task ${newId}`);
-        promoted++;
-      } else {
-        console.error(`      FAIL promote idea #${def.promoted_idea_id}: ${patch.status} ${JSON.stringify(patch.data).slice(0, 200)}`);
-      }
-    }
-  }
-
-  console.log(`\nDONE  created=${created} skipped=${skipped} errors=${errors} ideas_promoted=${promoted}  (total in manifest: ${TASKS.length})`);
-  process.exit(errors === 0 ? 0 : 1);
-}
-
-main().catch((err) => {
-  console.error('FATAL', err);
-  process.exit(1);
-});