@bongos/core 1.19.366 → 1.19.368

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.366",
-  "core_contract": "1.19.366",
-  "source_commit": "25f9ddadfd356311a69eb302d7b6c065046fb74d",
+  "core_version": "1.19.368",
+  "core_contract": "1.19.368",
+  "source_commit": "17b78f620a5cdc6f01af878404e8b11ebd9b2f77",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T20:30:49.191Z",
+  "built_at": "2026-08-25T21:47:56.330Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 331,
+    "docs_redacted": 332,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1536,
+    "functional_verbatim": 1541,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1889,
-  "tree_sha256": "69e72536ccdae1d15797d10aad857a6d82a62b87f7699c1f62273750b1618a34",
+  "file_count": 1895,
+  "tree_sha256": "f3b82bb092f3f91eea0a51d84cc52e1b31042d4e9ae32a5a54972a00e9816c39",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "b94bec08062d2f3374043a6ce93bca31b27073e51da47f9477e67e2602565701"
+      "sha256": "fc26e581e9ba06ec9fd798e982539f0bd8dc4c27a5f6c248b395f62214daaf78"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "827ffa492b7035169b0734807208d45dc898d86b7d52570b55f7050d83e0aba3"
+      "sha256": "e50696e5b7b9c1abab280665dd57ab6f8f8883d3bfd0f2701a45ee7d9a6fb728"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "7f601b37bb8acad773f55b5e5200cf1efeb40cdcc2694570b58c336cdcf9b3ad"
+      "sha256": "b13e62181adbc47a9ba6d3349a4abcb63fca123f3b0202414a1f7a2ba5e7d088"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "3834aed054469417cecbd8c1786cbc5400ec1a0e7871ac3bc41c8044f2f97aae"
+      "sha256": "f918564f73e753583651a8d963824c981cd82dc02d1e0d809d245e541219513e"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "d3f455fe0a335606c10ec92fc151f4767bf37d9c40c423f7635c642dd5b1e298"
+      "sha256": "d4f2e6c3b376c35679416efcd30bbe54bae396cbaa8ee1e4078c56b6175da3d4"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1449,20 +1449,25 @@
       "mode": "0000644",
       "sha256": "0ae7f6a69d9006c54210cea4f6a846445a6181f148bcb4de979011b46cca5188"
     },
+    {
+      "path": "docs/adr/0192-a-category-orients-and-authorises-nothing.md",
+      "mode": "0000644",
+      "sha256": "4cb1023731d70965f544bfcde1a9bfa3165e2bc96e0825c7e2c3b5a02c464a63"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "cba01a64b2f86f9e10e6a7306bf23d3fbebe16b2e5d7ddd04f68a1113a3ae525"
+      "sha256": "804999c67653b53c81b68d97fe8be11137c6f19fb3048899d847844095467b11"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "d076deeab4cc5690b2fd8081b3ea885d2e6c414267ff4cacb43d71e9b3d92d8c"
+      "sha256": "544b25f700d89d7f51dd84cb4faa740bc1c9bb4bf52853470e7d645040215033"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "88484f046d52c6ff605fbecd5c32d14542279f487586b8c371de3ce6de50e812"
+      "sha256": "ada26795f34a9ce26711b788abc87bf277c475aa14ee7bb1f92e9376f1e50cc8"
     },
     {
       "path": "docs/architecture.md",
@@ -2509,6 +2514,11 @@
       "mode": "0000644",
       "sha256": "1913405bdb9de48ac3ca7ad6705cf44244d20c77d3a6f73700f88e717fb84043"
     },
+    {
+      "path": "migrations/core_226_work_categories.sql",
+      "mode": "0000644",
+      "sha256": "322578d3d22b87eb07c4b9b4b521c66b0c986a937c3657d0b90123f73867461d"
+    },
     {
       "path": "modules/agents/migrations/agents_001_definitions.sql",
       "mode": "0000644",
@@ -2887,7 +2897,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "7f601b37bb8acad773f55b5e5200cf1efeb40cdcc2694570b58c336cdcf9b3ad"
+      "sha256": "b13e62181adbc47a9ba6d3349a4abcb63fca123f3b0202414a1f7a2ba5e7d088"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4007,7 +4017,7 @@
     {
       "path": "modules/lifecycle/db-goals.js",
       "mode": "0000644",
-      "sha256": "b9d1768f8e271ad5c3595728f2433c27f44c841ab1c6be7d24086d1f6c8c7691"
+      "sha256": "85a87c86496a9f022983a61e7f3642c8f0029c0b07467e27109095a6b98fce61"
     },
     {
       "path": "modules/lifecycle/db-grade.js",
@@ -4079,6 +4089,11 @@
       "mode": "0000644",
       "sha256": "3eb9d818e0e0d45a896a5c0a515842b5f5a01e102d02f8a9a605c271088c8e5d"
     },
+    {
+      "path": "modules/lifecycle/goal-category.js",
+      "mode": "0000644",
+      "sha256": "6bc1bc0152900b49d79a6c09560020dc96ff5fae6c78d7dbb84d72dfed1953d2"
+    },
     {
       "path": "modules/lifecycle/goal-conflicts.js",
       "mode": "0000644",
@@ -4187,7 +4202,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "bfc87f9887cfe03abfdec0a9a3139917099922fc37d56fb0fcb4ec47980fb53b"
+      "sha256": "5e01d0da935758aa24c8f13d2f4e97d9f561c2b1044b326fb4184c5dbc4bf6fb"
     },
     {
       "path": "modules/lifecycle/routes/help-requests.js",
@@ -4877,12 +4892,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "91de7354c10b9722a1189018f827cae48448db443384510dbed0c271c67b6d32"
+      "sha256": "a58b49638d9cbd5aa528a08b7435d6be48d636cb2574e7ed9b84b11850b296dd"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b690c96c25a37783d84ce670859cdcf52ff3d15629254c379bc52d4c825e7538"
+      "sha256": "225e8f6b5b696a25599e723f18cfb3d8da8382a8be2a85be2429b090445ce178"
     },
     {
       "path": "public-docs/index.html",
@@ -5349,6 +5364,11 @@
       "mode": "0000644",
       "sha256": "946fa97d020eb481b7da559f0b5c99bfa16dc24b680a01e0ff3d3faeaf5bd701"
     },
+    {
+      "path": "scripts/gds/category-advisory-guard.js",
+      "mode": "0000644",
+      "sha256": "008fc7268a1e58b7e87b5454d0ca698e25cba3229172031587e934fe73fc33da"
+    },
     {
       "path": "scripts/gds/cf-tunnel.js",
       "mode": "0000644",
@@ -5572,7 +5592,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "e38069a6eee1072438d745634cdae405c57c20b8261f133d4afa0440b1d3d545"
+      "sha256": "95f116e70ba6d6e890705ff862a5c5011002c42a58ba60553c50ec2d656dcf3b"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5952,7 +5972,7 @@
     {
       "path": "scripts/gds/redteam-patrol.js",
       "mode": "0000644",
-      "sha256": "b47919e09dae54b94a9f90c81bf535c00918dbd916f0d51c4bc29517dec9f7e9"
+      "sha256": "34e2a56646ad7b8f72c63ee3f8c6319ce523c3ee390d89740bf44d27190d2005"
     },
     {
       "path": "scripts/gds/regen-instance-docs.js",
@@ -6622,7 +6642,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "f2d893e0de84433cc99411e59aba98c1ca392fa8d5bd24449e1e9200f06d9ff8"
+      "sha256": "b387d8af3a47e209139f40437c5cd855f58d4e37871869efb23069d575ddd041"
     },
     {
       "path": "src/bongos/routes.js",
@@ -6757,7 +6777,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "482e6347bf3fa30bc7f55897307f64ee6be8bf14c5186fa4f882cb53cdb92990"
+      "sha256": "c66c224c5bf1755a79ce4bcb6da90bfb72079ae5195b0b8758be067602329ab7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7194,6 +7214,11 @@
       "mode": "0000644",
       "sha256": "de9d8f8c1daab1e48122febd16699ac519890b6e1296edb7966d835434851786"
     },
+    {
+      "path": "tests/category_advisory_guard.mjs",
+      "mode": "0000644",
+      "sha256": "8fd7b066c264ddaeccaa2dfa9a3c1fe6204a943933a1161c6a235f45b40ab121"
+    },
     {
       "path": "tests/cf_ruleset_preflight.mjs",
       "mode": "0000644",
@@ -7719,6 +7744,11 @@
       "mode": "0000644",
       "sha256": "7488d41a0d962f681f9482e4c06f518f38be824e8fa936b5bd7b1c1b70838c3d"
     },
+    {
+      "path": "tests/goal_category.mjs",
+      "mode": "0000644",
+      "sha256": "19e6987712231ac54e58c4b6658d12bb7df3d6681344bf358c38c1655243f058"
+    },
     {
       "path": "tests/goal_cli.mjs",
       "mode": "0000644",
@@ -7777,7 +7807,7 @@
     {
       "path": "tests/goal_tier.mjs",
       "mode": "0000644",
-      "sha256": "e6a3114339989123d20f42f120f9fed52690fbc0230b10a99fa1fd0453acbfd2"
+      "sha256": "7d8c1b8300c99be22b42ff25e8ce25e25b5af28cd29c314f9aee7ddee11fc0d5"
     },
     {
       "path": "tests/goal_wall_proof.mjs",
@@ -8832,7 +8862,7 @@
     {
       "path": "tests/redteam_patrol.mjs",
       "mode": "0000644",
-      "sha256": "2dbaca4570cdac06c9ebdf2447b9955edeb1afdd763f24d98faec2103001a9e9"
+      "sha256": "6dac9970bfdc8e5fd3940dc956b94963bc8ecdc345820de831078af614cf875f"
     },
     {
       "path": "tests/regrade_eligibility.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 315 operations across 51 resource groups
+- 318 operations across 52 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -323,6 +323,8 @@ function createClient(opts = {}) {
       patchGoalsId: (args) => request("PATCH", "/goals/{id}", { hasBody: true }, args),
       // POST /goals/{id}/archive — rank: metic+archon — POST /goals/:id/archive
       postGoalsIdArchive: (args) => request("POST", "/goals/{id}/archive", { hasBody: true }, args),
+      // PATCH /goals/{id}/category — rank: any-builder — PATCH /goals/:id/category
+      patchGoalsIdCategory: (args) => request("PATCH", "/goals/{id}/category", { hasBody: true }, args),
       // GET /goals/{id}/conflicts — rank: any-builder — GET /goals/:id/conflicts
       getGoalsIdConflicts: (args) => request("GET", "/goals/{id}/conflicts", { hasBody: false }, args),
       // POST /goals/{id}/conflicts/resolve — rank: any-builder — POST /goals/:id/conflicts/resolve
@@ -816,6 +818,12 @@ function createClient(opts = {}) {
       // GET /versions/progress — rank: public — GET /versions/progress
       getVersionsProgress: (args) => request("GET", "/versions/progress", { hasBody: false }, args),
     },
+    "workCategories": {
+      // GET /work-categories — rank: any-builder — GET /work-categories
+      getWorkCategories: (args) => request("GET", "/work-categories", { hasBody: false }, args),
+      // POST /work-categories — rank: metic+archon — POST /work-categories
+      postWorkCategories: (args) => request("POST", "/work-categories", { hasBody: true }, args),
+    },
   };
 }
 

package/clients/bongos-client/index.cjs

@@ -322,6 +322,8 @@ function createClient(opts = {}) {
       patchGoalsId: (args) => request("PATCH", "/goals/{id}", { hasBody: true }, args),
       // POST /goals/{id}/archive — rank: metic+archon — POST /goals/:id/archive
       postGoalsIdArchive: (args) => request("POST", "/goals/{id}/archive", { hasBody: true }, args),
+      // PATCH /goals/{id}/category — rank: any-builder — PATCH /goals/:id/category
+      patchGoalsIdCategory: (args) => request("PATCH", "/goals/{id}/category", { hasBody: true }, args),
       // GET /goals/{id}/conflicts — rank: any-builder — GET /goals/:id/conflicts
       getGoalsIdConflicts: (args) => request("GET", "/goals/{id}/conflicts", { hasBody: false }, args),
       // POST /goals/{id}/conflicts/resolve — rank: any-builder — POST /goals/:id/conflicts/resolve
@@ -815,6 +817,12 @@ function createClient(opts = {}) {
       // GET /versions/progress — rank: public — GET /versions/progress
       getVersionsProgress: (args) => request("GET", "/versions/progress", { hasBody: false }, args),
     },
+    "workCategories": {
+      // GET /work-categories — rank: any-builder — GET /work-categories
+      getWorkCategories: (args) => request("GET", "/work-categories", { hasBody: false }, args),
+      // POST /work-categories — rank: metic+archon — POST /work-categories
+      postWorkCategories: (args) => request("POST", "/work-categories", { hasBody: true }, args),
+    },
   };
 }
 

package/clients/bongos-client/index.d.ts

@@ -251,7 +251,7 @@ export interface PostGoalsIdTransferRequest { builder_id?: StringifiableId }
 export interface PostGoalsIdTransferResponse { ok: boolean; goal: unknown; changed: boolean }
 export interface PostGoalsReorderRequest { version_id: string; ordered_ids: number[] }
 export interface PostGoalsReorderResponse { ok: boolean; goals: unknown }
-export interface PostGoalsRequest { version_id: string; title: string; subtitle?: string; description?: string; scope_modules?: string[]; succeeds_goal_id?: number }
+export interface PostGoalsRequest { version_id: string; title: string; subtitle?: string; description?: string; scope_modules?: string[]; succeeds_goal_id?: number; category_id?: number }
 export interface PostGoalsResponse { ok: boolean; goal: unknown; succeeds_goal_id: unknown }
 export interface PostGovernmentAssignmentsRequest { builder_id: number; rank_key: string }
 export interface PostGovernmentBoardItemsItemIdVotesRequest { direction: string; reason_md?: string; section_key?: string }
@@ -609,6 +609,8 @@ export interface BongosClient {
     patchGoalsId(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /goals/{id}/archive — rank: metic+archon */
     postGoalsIdArchive(args?: RequestArgs): Promise<PostGoalsIdArchiveResponse>;
+    /** PATCH /goals/{id}/category — rank: any-builder */
+    patchGoalsIdCategory(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /goals/{id}/conflicts — rank: any-builder */
     getGoalsIdConflicts(args?: RequestArgs): Promise<GetGoalsIdConflictsResponse>;
     /** POST /goals/{id}/conflicts/resolve — rank: any-builder */
@@ -1102,6 +1104,12 @@ export interface BongosClient {
     /** GET /versions/progress — rank: public */
     getVersionsProgress(args?: RequestArgs): Promise<GetVersionsProgressResponse>;
   };
+  "workCategories": {
+    /** GET /work-categories — rank: any-builder */
+    getWorkCategories(args?: RequestArgs): Promise<ApiResponse>;
+    /** POST /work-categories — rank: metic+archon */
+    postWorkCategories(args?: RequestArgs): Promise<ApiResponse>;
+  };
 }
 export declare function createClient(opts?: ClientOptions): BongosClient;
 export default createClient;

package/clients/bongos-client/index.mjs

@@ -319,6 +319,8 @@ export function createClient(opts = {}) {
       patchGoalsId: (args) => request("PATCH", "/goals/{id}", { hasBody: true }, args),
       // POST /goals/{id}/archive — rank: metic+archon — POST /goals/:id/archive
       postGoalsIdArchive: (args) => request("POST", "/goals/{id}/archive", { hasBody: true }, args),
+      // PATCH /goals/{id}/category — rank: any-builder — PATCH /goals/:id/category
+      patchGoalsIdCategory: (args) => request("PATCH", "/goals/{id}/category", { hasBody: true }, args),
       // GET /goals/{id}/conflicts — rank: any-builder — GET /goals/:id/conflicts
       getGoalsIdConflicts: (args) => request("GET", "/goals/{id}/conflicts", { hasBody: false }, args),
       // POST /goals/{id}/conflicts/resolve — rank: any-builder — POST /goals/:id/conflicts/resolve
@@ -812,6 +814,12 @@ export function createClient(opts = {}) {
       // GET /versions/progress — rank: public — GET /versions/progress
       getVersionsProgress: (args) => request("GET", "/versions/progress", { hasBody: false }, args),
     },
+    "workCategories": {
+      // GET /work-categories — rank: any-builder — GET /work-categories
+      getWorkCategories: (args) => request("GET", "/work-categories", { hasBody: false }, args),
+      // POST /work-categories — rank: metic+archon — POST /work-categories
+      postWorkCategories: (args) => request("POST", "/work-categories", { hasBody: true }, args),
+    },
   };
 }
 

package/docs/adr/0192-a-category-orients-and-authorises-nothing.md

@@ -0,0 +1,97 @@
+# 0192 — A work category orients a human and authorises nothing
+
+- **Status:** Accepted
+- **Date:** 2026-08-25
+- **Tasks:** [#1003275](https://cloudbongos.com/builders#/task/1003275) (this decision + the storage/API), with the hall surfaces in [#1003276](https://cloudbongos.com/builders#/task/1003276) and the assignment path in [#1003277](https://cloudbongos.com/builders#/task/1003277).
+- **Goal:** [#1000072](https://cloudbongos.com/builders#/goal/1000072) — Human legibility, criterion `legibility-categories`.
+- **Constrains, does not amend:** [ADR 0086](<redacted>.md) — the real work hierarchy. This decision adds a label *beside* that hierarchy and forbids it from behaving like part of it.
+
+## 1. The problem
+
+A person scanning the goal board cannot tell at a glance which goals are about
+money, which are about the walls, and which are about the hall. Each goal's own
+words say so — but only if you read all thirty-eight of them. The owner asked for
+one word per goal that answers it, and named the set: Builders Hall, Context
+Management, Government (Decision Making), Modules, Security, Economics, Legal,
+User/ABI Experience.
+
+That is the easy half. The hard half is the constraint the owner attached to it,
+twice: this organisation "has no hierarchical purpose", and these categories have
+"no effect on the creation and agentic management of these elements".
+
+## 2. Why the constraint needs a decision record and not a comment
+
+The system **already has** a hierarchy — Project → Version → Goal → Criteria →
+Task ([ADR 0086](<redacted>.md)) — and that one is
+load-bearing: the `scope_modules` wall, per-task rank floors, and goal membership
+all refuse real work. Goal 1000072's own prose predicts what happens next: *"A
+second thing that LOOKS like a hierarchy will be mistaken for one within a
+release."*
+
+The mistake does not arrive as a decision anybody announces. It arrives as one
+plausible line inside a gate — *skip Legal goals in the claimable feed*, *require
+Archon for Security ones* — and from that moment work is refused because of a
+label nobody meant as a permission. Nothing in a comment can refuse that line.
+
+## 3. Decision
+
+**A category is advisory. It orients a human and steers Claude; it authorises
+nothing.**
+
+Concretely:
+
+1. **No decision surface reads it.** Not authority, not claim eligibility, not the
+   claimable feed, not dependency satisfaction. Enforced by a fitness check,
+   `scripts/gds/category-advisory-guard.js`, which scans every such file with
+   comments stripped — so a gate may *cite* this rule but may never branch on it.
+2. **The guard cannot pass vacuously.** It also asserts the category surface still
+   exists (migration, module, route). A guard whose subject was renamed away
+   passes silently and reads as proof — the assurance-of-assurance finding from
+   the [ADR 0022](0022-secrets-policy.md) audit that produced
+   `control-manifest.js`.
+3. **Uncategorised is a legal state.** `goals.category_id` is nullable with no
+   default, and no write requires it. The criterion is explicit that Claude
+   failing to place a goal is *"a designed prompt, not an error"*: the human is
+   asked to name a new category, and asking is not refusing.
+4. **A task stores no category.** It inherits its goal's through `tasks.goal_id`.
+   The criterion's own wording is "every goal (and task, **by inheritance**)", and
+   a stored copy would be a second answer to one question with no way to know
+   which is right.
+5. **The set is data, not an enum.** A runtime-extensible set cannot be a `CHECK`
+   constraint or a pg enum without a migration per addition — and it must not be a
+   free-text column, or two spellings of "Security" stop it being a set at all.
+   Retiring is `active = false`, never a `DELETE`, so a goal already carrying a
+   category keeps rendering its label.
+6. **The rank pins are a tripwire.** `GET /work-categories` is any-builder (a
+   vocabulary a client cannot read is a vocabulary a client hard-codes),
+   `POST /work-categories` sits at the same permission as authoring a goal
+   (extending the project's words is a planning act), and
+   `PATCH /goals/:id/category` rides the same owner|manager|Archon in-handler gate
+   as the prose edit. If one of these ever needs a *wider* gate than its
+   neighbours, that is the signal the label has grown into a permission.
+
+## 4. What was deliberately not built
+
+- **No per-category page or filtered navigation view.** A chip is a label; a
+  drill-down destination is a tier. Building the destination is how an advisory
+  label becomes the second hierarchy in practice regardless of what the code
+  gates on.
+- **No category on a task, no category-scoped permissions, no category-ordered
+  work feed.**
+
+## 5. If this ever needs to change
+
+Making a category gate something is an **owner decision** and needs its own ADR
+before the guard is relaxed. The guard's failure message says so, because the
+person who trips it is the person who needs to read it.
+
+## 6. Consequences
+
+- A human can scan the goal board by kind, which is the whole point of goal
+  1000072.
+- One more fitness check to maintain, and a `GATE_FILES` list that must grow when
+  a new decision surface lands. That maintenance *is* the mechanism — a new gate
+  either gets added to the list or is not a gate.
+- The false-positive posture is deliberate: the scanner errs toward keeping text
+  when comment-stripping is ambiguous, because a guard that fails loudly is safer
+  than one that fails quietly.

package/docs/adr/README.md

@@ -268,5 +268,6 @@ This keeps the decision history honest and traceable.
 | 0190 | [**A changed project setting reaches a running instance by an in-place env patch and a restart — never a template re-write** ([task 1003140](https://cloudbongos.com/builders#/task/1003140), goal 1000058). Task 1003139 made a NEW instance read `platform_visibility` / `joinability` from the web.env the runner writes; a RUNNING instance loads its branding pack once, memoized and deep-frozen for the process lifetime, so a changed value could not reach it at all — the settings were write-only state on the platform. Decision: `PATCH /provisioning/instances/:id/settings` writes the platform row first, then for an ACTIVE instance on a shape the runner can reach enqueues a `settings-apply` intent (migration provisioning_010); the control-plane runner reads the instance's web.env as it stands, upserts ONLY the two settings lines (`upsertEnvVars`), and RESTARTS the service. The in-place patch is the load-bearing choice: the natural move — re-running `webEnvBody` as domain-attach does — regenerates the file from the row, and the row does not know the OAuth client secret or the App private key that `placeManifestCreds` placed later, so a template re-write silently blanks sign-in on the very instance the owner just touched. `SETTINGS_APPLY_FROM = {active}` because a pre-active instance gets the same values at standup and a torn-down one has nothing to restart (the provision intent cannot stand in — it excludes `active`, task 1002691); `SETTINGS_APPLY_SHAPES = {co-tenant, standalone}` because a dedicated droplet has no post-hoc exec path, and a push that cannot land is refused at the route AND the runner rather than reported. The response is a receipt, not a claim: it says the restart is coming and that the instance keeps its current setting until then, and the read-back lives on the instance's own public `GET /instance` manifest, whose `brand.project` now carries the resolved policy (`clientBranding` allow-list widened deliberately). Rejected: the template re-write; re-provisioning as the push; skipping the restart (impossible while the pack is memoized); claiming the new state on PATCH return.](<redacted>.md) | provisioning / settings channel |
 
 | 0191 | [**Majority, and an author who may vote but never decide alone** ([task 1003273](https://cloudbongos.com/builders#/task/1003273); diagnosis and companion in [task 1003271](https://cloudbongos.com/builders#/task/1003271)). Supersedes ADR 0175 §3's pass-rule set and §§7/11's flat anti-self rule. The owner reported voting as broken; nothing was broken. Nine items sat open under `first_ratifier` with four archons active — any one of three non-authors could have ratified any of them in a click — but every item was authored by the one person looking at them, and ADR 0175's anti-self rule was enforced by rendering NO BALLOT, so from the owner's seat the feature did not exist. The lesson: a rule enforced by removing the control is indistinguishable from a broken feature. Two decisions. (1) `majority` joins PASS_RULES: strictly more than half of the resolved MEMBERSHIP must vote yes — of the membership, not of the votes cast, so low turnout cannot quietly pass things; a tie is not a majority. The three rules are NOT a ladder of strictness, they differ on WHAT SILENCE MEANS — `first_ratifier` and `consent` pass an unvoted item, `majority` returns it — which is the axis that matters and now the comment in config.js. (2) An author MAY vote and may NEVER DECIDE ALONE: the rule moved from refusing the cast to the two places something is actually decided — `shouldCloseAfterVote` needs a non-author vote under every rule, and the majority tally needs a non-author YES. Their yes still counts toward the numerator; their `no` is excluded from the objection test (else silence would be an author's safest act); a self-cast earns no karma. The ADR 0175 §7 amendment carve-out survives as the author rule's SCOPE, not an exception: `authorRuleApplies` is full_idea-only, so a sole Archon still ratifies their own amendment. Also records why the CLOCK is a consequence of majority and not an independent fix — `tallyOutcome` passes on ZERO votes, so adding a deadline under `first_ratifier` would have closed all nine items as ratified-unread, paying karma and credits on ideas nobody read; `BOARD_DEFAULTS.window_minutes` therefore stays `null` in the neutral core. States the cost plainly: three affirmative votes are needed on a four-member board, and a solo instance still cannot ratify its own ideas. Discord stays outbound-only (ADR 0175 §8 re-affirmed).](<redacted>.md) | government / board room |
+| 0192 | [**A work category orients a human and authorises nothing** ([task 1003275](https://cloudbongos.com/builders#/task/1003275), goal 1000072, criterion `legibility-categories`). A goal gains a human CATEGORY from an owner-named set of eight (Builders Hall, Context Management, Government (Decision Making), Modules, Security, Economics, Legal, User/ABI Experience) so a person scanning the board can tell at a glance which goals are about money, which about the walls, which about the hall — today each goal's own words say so, but only if you read all thirty-eight. The DECISION is the constraint, not the feature: the owner said twice that this organisation has no hierarchical purpose and no effect on the agentic management of the work, and the system ALREADY has a load-bearing hierarchy (ADR 0086 — the scope_modules wall, rank floors, goal membership). The goal's own prose predicts the failure: a second thing that looks like a hierarchy gets mistaken for one within a release, and the mistake arrives as ONE plausible line in a gate ('skip Legal goals in the feed'), after which work is refused because of a label nobody meant as a permission. So: no authority, claim-eligibility, feed or dependency surface may read a category — enforced by the `scripts/gds/category-advisory-guard.js` fitness check, which scans every decision surface with comments stripped (a gate may CITE the rule, never branch on it) AND asserts the feature still exists, so a renamed-away subject fails loudly instead of passing vacuously (the ADR 0022 assurance-of-assurance finding). Uncategorised is LEGAL — nullable, no default, required by no write — because the criterion is explicit that Claude failing to place a goal is a designed prompt, not an error. A task stores no category and INHERITS its goal's through `tasks.goal_id`; a stored copy would be a second answer to one question. The set is a table, not an enum (runtime-extensible without a migration per addition) and retiring is `active = false`, never a DELETE, so a goal keeps rendering a label someone tidied away. The three route-rank pins are a tripwire: if one ever needs a WIDER gate than its neighbours, the label has grown into a permission. Deliberately NOT built: a per-category page or filtered navigation view — a chip is a label, a drill-down destination is a tier. Making a category gate anything is an owner decision and needs its own ADR first.](<redacted>.md) | GDS / goals |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/docs/api/openapi.json

@@ -224,6 +224,10 @@
     {
       "name": "versions",
       "description": "Endpoints under `/api/bongos/versions`."
+    },
+    {
+      "name": "work-categories",
+      "description": "Endpoints under `/api/bongos/work-categories`."
     }
   ],
   "paths": {
@@ -4553,6 +4557,51 @@
         ]
       }
     },
+    "/goals/{id}/category": {
+      "patch": {
+        "operationId": "patch_goals_id_category",
+        "tags": [
+          "goals"
+        ],
+        "summary": "PATCH /goals/:id/category",
+        "description": "PATCH /goals/:id/category — body { category_id } (null clears it). Separate from PATCH /goals/:id because that route is the PROSE edit with its write-once posture and before/after audit delta; a label is neither. rank: any-builder (requireBuilder) + the in-handler owner|manager|Archon gate.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/lifecycle/routes/goals.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/goals/{id}/conflicts": {
       "get": {
         "operationId": "get_goals_id_conflicts",
@@ -14324,6 +14373,69 @@
         },
         "security": []
       }
+    },
+    "/work-categories": {
+      "get": {
+        "operationId": "get_work_categories",
+        "tags": [
+          "work-categories"
+        ],
+        "summary": "GET /work-categories",
+        "description": "---- the ADVISORY human category (task 1003275, criterion legibility-categories) ---- A category ORIENTS a person and steers Claude; it authorises nothing. Nothing in this file, in claim eligibility, or in the claimable feed may branch on it — scripts/gds/category-advisory-guard.js fails the build if that changes (ADR 0192). GET /work-categories — the project's set. rank: any-builder; it is a vocabulary, and a client that cannot read it hard-codes the labels instead.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/lifecycle/routes/goals.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "post": {
+        "operationId": "post_work_categories",
+        "tags": [
+          "work-categories"
+        ],
+        "summary": "POST /work-categories",
+        "description": "POST /work-categories — the endpoint the \"Claude could not place this goal\" prompt writes into. Same permission as authoring a goal: extending the project's vocabulary is a planning act. A duplicate slug returns the existing row (200), so two people prompted at once converge instead of one being stranded.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `goal.create` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/lifecycle/routes/goals.js",
+        "x-permissions": [
+          "goal.create"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
     }
   },
   "components": {
@@ -17888,6 +18000,10 @@
           "succeeds_goal_id": {
             "type": "integer",
             "minimum": 1
+          },
+          "category_id": {
+            "type": "integer",
+            "minimum": 1
           }
         },
         "required": [
@@ -19961,7 +20077,7 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 315,
+  "x-endpoint-count": 318,
   "x-schema-count": 353,
   "x-undocumented-bodies": 8,
   "x-response-schemas": 237,