@bongos/core 1.19.369 → 1.19.371

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.369",
-  "core_contract": "1.19.369",
-  "source_commit": "486cdf89329ccbf01188586ff918d22390620cba",
+  "core_version": "1.19.371",
+  "core_contract": "1.19.371",
+  "source_commit": "587eb4ed0b68da54bf63fb01b69fab937450bd66",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T21:52:45.667Z",
+  "built_at": "2026-08-25T22:08:11.031Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 333,
+    "docs_redacted": 334,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1543,
+    "functional_verbatim": 1544,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1898,
-  "tree_sha256": "e4c29c0518ebcdb414195829f5e8efd9f175df0feb556f1eb8114b2f921e2336",
+  "file_count": 1900,
+  "tree_sha256": "55cb6adeadbe8a337b32bba8352f2dbc38d655ec2cdd807c550d527b9f49822d",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1459,10 +1459,15 @@
       "mode": "0000644",
       "sha256": "caf369cc73f2a997df7dd12b074a5e7c815b8f717cb864ce49ce533d74008d75"
     },
+    {
+      "path": "docs/adr/0193-pause-task-scoped-box-slices.md",
+      "mode": "0000644",
+      "sha256": "38af373e191ebf9d9788884315f90d439ec5a719f08afc596039d722153c8396"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "632a5dd2b047437eca5201d0e572378a2a70d0b5d3ff10e97285ee00eec49618"
+      "sha256": "cf4a81346983c4247f711855d8eae3939b3cbeb37b12ad7cf2449d2e896b3ade"
     },
     {
       "path": "docs/api-reference.md",
@@ -1857,7 +1862,7 @@
     {
       "path": "docs/recipes/work-on-a-task-from-your-dev-box.md",
       "mode": "0000644",
-      "sha256": "15a8fa87b11a3d3ab86551f9bc54adaf84c2a7a2b8fb7fc6915c0d16e5f5199d"
+      "sha256": "be4d67926e39c9f9c146f5f709d30595057058f5c4444c1e87ed92e37b3f3190"
     },
     {
       "path": "docs/research/cursor-competitive-analysis.md",
@@ -2942,7 +2947,7 @@
     {
       "path": "modules/dev-box/routes/box.js",
       "mode": "0000644",
-      "sha256": "4310c28d74085f2544f92e2191e7cbc4d646bbc4e304fec83099298e5f8d9c93"
+      "sha256": "bbe6ed7344f7e5dd1d4dba79e636f4bc02806d25193edb0609f41c850ffbad4c"
     },
     {
       "path": "modules/discord/CLAUDE.md",
@@ -4897,12 +4902,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7ecd5aa9734efaab265e867498834dae2a5a58e4c0d1616cddcb0cfcea5b17e3"
+      "sha256": "9013a462765ac09e02093fd322534183ef67983cba7fb17b01ffd9e514c904ba"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4463e81c49fd1c7476e9351255bb9d37516106d9d5e2dc88ad0baaabf521de5e"
+      "sha256": "02ba6d7d5c371b3b07671bb84216d7a38a23b9ab97f3ab491d218fb31f9afa46"
     },
     {
       "path": "public-docs/index.html",
@@ -6787,7 +6792,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8f018f2f5c96b98e7e08bfedb50161b4b9ffb639afe2ab9f108541e951c3fc6e"
+      "sha256": "acc072cf951d0eb479345626f462425a47d7f8a0247db473375fa614f64e7589"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7174,6 +7179,11 @@
       "mode": "0000644",
       "sha256": "22a2dc8bdccb9900b642371b85e8cc1785ecfacaf8f7579b042951425d95d794"
     },
+    {
+      "path": "tests/box_task_scope_pause.mjs",
+      "mode": "0000644",
+      "sha256": "3a5083e6249c70d3142f2b9c7e0c0bc031b09ccd01425c45f52e91e362b64d0b"
+    },
     {
       "path": "tests/box_terminal_ssrf.mjs",
       "mode": "0000644",

package/docs/adr/0193-pause-task-scoped-box-slices.md

@@ -0,0 +1,60 @@
+# 0193 — Pause task-scoped box slices: a box serves its rank scope (the full repo for Metic+)
+
+- **Status:** Accepted
+- **Date:** 2026-08-25
+- **Tasks:** [#1003285](https://cloudbongos.com/builders#/task/1003285) (the pause), from the owner's 2026-08-25 dev-box efficiency review; the review's other findings are [#1003286](https://cloudbongos.com/builders#/task/1003286)–[#1003291](https://cloudbongos.com/builders#/task/1003291) and shipped [#1003253](https://cloudbongos.com/builders#/task/1003253).
+- **Pauses, does not repeal:** [ADR 0148](<redacted>.md) / goal 1000051 — the claim-driven slice. The machinery stays; the default flips.
+
+## 1. The decision
+
+The owner reviewed the live dev-box experience and decided: **pause the serving
+of a task-scoped slice and serve the entire repo instead.** A box now gets its
+**rank scope** — the full repo for Metic+, the starter sparse surface below —
+regardless of what the builder has claimed.
+
+Implementation is a pause, not a deletion: `routes/box.js` skips the
+lifecycle-port `scopeKeys` resolution unless `BOX_TASK_SCOPE=on` is set in the
+web process env. With `scopeKeys` absent, `decideSourceAccess` takes its
+documented pre-ADR-0148 rank fallback — a path that has existed, unit-tested,
+since the feature shipped. `GET /box/scope` reports `task_scoping_paused` so the
+hall and the desktop app can say why `task_scope` is false.
+
+## 2. Why
+
+The slice was defense-in-depth, never a hard wall — ADR 0031 §6 records the
+honest limit: any read credential for the repo can read all of it, and
+sparse-checkout is client-side. What the 2026-08-25 review found is that the
+narrowing's *costs* were real while that benefit was notional:
+
+- **Sessions on a box misdiagnose.** A Claude session that cannot see a module
+  (or its nested CLAUDE.md) concludes the code is missing or itself stuck, and
+  burns the session repairing context instead of doing the task.
+- **The scope machinery multiplied the moving parts** that already failed in the
+  field: the base-slice collapse (task 1002729, 247 of 248 grants), the empty
+  `modules/` cone, and per-claim re-sync churn on every claim change.
+- **Every live box user is Metic+ anyway** — the rank fallback grants them full;
+  the slice was narrowing trusted builders while newcomers were already gated by
+  rank.
+
+## 3. What does NOT change
+
+- **Allow/deny is untouched.** The live-rank + status check per request (ADR
+  0016), the provision floor, and the clawback on demotion all stand.
+- **The credential posture is untouched.** The box still holds no permanent
+  credential; the per-request credential is read-only and `git push` still 403s
+  (ADR 0055; re-verified on hardware 2026-08-25, task 1003253).
+- **Sub-Metic boxes still get the starter surface.** The rank scope IS the
+  boundary that carries the trust posture; it was never the claim slice.
+
+## 4. Revert
+
+Set `BOX_TASK_SCOPE=on` in the web env and restart — the ADR 0148 behavior
+returns exactly as shipped. If the pause becomes permanent, delete the
+lifecycle-port resolution in `routes/box.js` and retire this flag with a
+follow-up ADR.
+
+## 5. Known staleness while paused
+
+The desktop app's task-picker copy ("your box is now scoped to `<modules>` —
+and nothing else", BV1.R100) overstates while paused; it can read
+`task_scoping_paused` from `GET /box/scope`. Cosmetic, not gating.

package/docs/adr/README.md

@@ -270,5 +270,6 @@ This keeps the decision history honest and traceable.
 | 0191 | [**Majority, and an author who may vote but never decide alone** ([task 1003273](https://cloudbongos.com/builders#/task/1003273); diagnosis and companion in [task 1003271](https://cloudbongos.com/builders#/task/1003271)). Supersedes ADR 0175 §3's pass-rule set and §§7/11's flat anti-self rule. The owner reported voting as broken; nothing was broken. Nine items sat open under `first_ratifier` with four archons active — any one of three non-authors could have ratified any of them in a click — but every item was authored by the one person looking at them, and ADR 0175's anti-self rule was enforced by rendering NO BALLOT, so from the owner's seat the feature did not exist. The lesson: a rule enforced by removing the control is indistinguishable from a broken feature. Two decisions. (1) `majority` joins PASS_RULES: strictly more than half of the resolved MEMBERSHIP must vote yes — of the membership, not of the votes cast, so low turnout cannot quietly pass things; a tie is not a majority. The three rules are NOT a ladder of strictness, they differ on WHAT SILENCE MEANS — `first_ratifier` and `consent` pass an unvoted item, `majority` returns it — which is the axis that matters and now the comment in config.js. (2) An author MAY vote and may NEVER DECIDE ALONE: the rule moved from refusing the cast to the two places something is actually decided — `shouldCloseAfterVote` needs a non-author vote under every rule, and the majority tally needs a non-author YES. Their yes still counts toward the numerator; their `no` is excluded from the objection test (else silence would be an author's safest act); a self-cast earns no karma. The ADR 0175 §7 amendment carve-out survives as the author rule's SCOPE, not an exception: `authorRuleApplies` is full_idea-only, so a sole Archon still ratifies their own amendment. Also records why the CLOCK is a consequence of majority and not an independent fix — `tallyOutcome` passes on ZERO votes, so adding a deadline under `first_ratifier` would have closed all nine items as ratified-unread, paying karma and credits on ideas nobody read; `BOARD_DEFAULTS.window_minutes` therefore stays `null` in the neutral core. States the cost plainly: three affirmative votes are needed on a four-member board, and a solo instance still cannot ratify its own ideas. Discord stays outbound-only (ADR 0175 §8 re-affirmed).](<redacted>.md) | government / board room |
 | 0192 | [**A gated project refuses strangers at the app's front door, and the hub reads what the project runs from the project itself** ([task 1003043](https://cloudbongos.com/builders#/task/1003043), goal 1000058). Task 1003040 gave every project a `platform_visibility` setting and 1003139/1003140 carried it into the instance's `branding().project.platformVisibility` — resolved, enforced by nothing. Decision: ONE app-level middleware (`src/bongos/platform-visibility-gate.js`), mounted beside the pre-launch gate ahead of every human and public-read surface — the landing, the hub pages, the status host, the hall shell, `/public/*` and every module's `rank: public` route — rather than per-surface wiring, which misses the next surface nobody told it about. "Member" is a live, non-deactivated session on this instance, the same `resolveSession` lookup `requireBuilder` uses, per request, no cache; a lookup that throws fails CLOSED. The exempt list is the door, the manifest and the probes and nothing wider: `/api/*/auth/*` (a door that cannot be opened locks the members out too), `/api/*/instance` (what a stranger reads to learn how to sign in AND what the runner reads after a settings restart to learn whether the value was consumed — including the push that turns this gate on), `/healthz`, `/version`, `/metrics`; the pre-launch gate's blanket `/api/` exemption is deliberately not copied. A refused page gets a self-contained 401 door (no stylesheet, no branding bundle, no script) with one control — Sign in, returning (relatively) to the page knocked on; a refused API call gets `res.fail('unauthenticated', 401)`, exactly requireBuilder's envelope, which is why it mounts after `attachFail`. A member's answer leaves marked `private, no-store` whatever the route said — the public read API sends `public, max-age`, and a CDN edge would otherwise serve a member's copy to the next stranger. The exempt list covers every API prefix (the versioned contract too), `/downloads/*` and Caddy's TLS ask; a request's session is resolved once (`resolveSession` memoizes per request). The hub's manage page shows the CHOICE from the platform's row and what the project RUNS from the project's own public manifest (`brand.project`), and never confuses the two: `push.message` is rendered verbatim, `saved` moves only the radio, the "runs" line is written only from the manifest and says "doesn't report this setting yet" for a core that predates the channel. Rejected: per-surface wiring; a 302 into OAuth for a refused page (sends assets and crawlers to GitHub); copying the `/api/` exemption; painting the radio from the manifest or the runs line from `saved`; reusing the pre-launch gate.](<redacted>.md) | instance / project visibility |
 | 0192 | [**A work category orients a human and authorises nothing** ([task 1003275](https://cloudbongos.com/builders#/task/1003275), goal 1000072, criterion `legibility-categories`). A goal gains a human CATEGORY from an owner-named set of eight (Builders Hall, Context Management, Government (Decision Making), Modules, Security, Economics, Legal, User/ABI Experience) so a person scanning the board can tell at a glance which goals are about money, which about the walls, which about the hall — today each goal's own words say so, but only if you read all thirty-eight. The DECISION is the constraint, not the feature: the owner said twice that this organisation has no hierarchical purpose and no effect on the agentic management of the work, and the system ALREADY has a load-bearing hierarchy (ADR 0086 — the scope_modules wall, rank floors, goal membership). The goal's own prose predicts the failure: a second thing that looks like a hierarchy gets mistaken for one within a release, and the mistake arrives as ONE plausible line in a gate ('skip Legal goals in the feed'), after which work is refused because of a label nobody meant as a permission. So: no authority, claim-eligibility, feed or dependency surface may read a category — enforced by the `scripts/gds/category-advisory-guard.js` fitness check, which scans every decision surface with comments stripped (a gate may CITE the rule, never branch on it) AND asserts the feature still exists, so a renamed-away subject fails loudly instead of passing vacuously (the ADR 0022 assurance-of-assurance finding). Uncategorised is LEGAL — nullable, no default, required by no write — because the criterion is explicit that Claude failing to place a goal is a designed prompt, not an error. A task stores no category and INHERITS its goal's through `tasks.goal_id`; a stored copy would be a second answer to one question. The set is a table, not an enum (runtime-extensible without a migration per addition) and retiring is `active = false`, never a DELETE, so a goal keeps rendering a label someone tidied away. The three route-rank pins are a tripwire: if one ever needs a WIDER gate than its neighbours, the label has grown into a permission. Deliberately NOT built: a per-category page or filtered navigation view — a chip is a label, a drill-down destination is a tier. Making a category gate anything is an owner decision and needs its own ADR first.](<redacted>.md) | GDS / goals |
+| 0193 | [**Pause task-scoped box slices: a box serves its rank scope (the full repo for Metic+)** ([task 1003285](https://cloudbongos.com/builders#/task/1003285), owner decision from the 2026-08-25 dev-box efficiency review). Pauses, does not repeal, ADR 0148 / goal 1000051: `routes/box.js` skips the lifecycle-port `scopeKeys` resolution unless `BOX_TASK_SCOPE=on`, so `decideSourceAccess` takes its documented rank fallback — full repo for Metic+, starter surface below. WHY: the slice was defense-in-depth git cannot hard-enforce (ADR 0031 §6's honest limit) while its costs were real on the live fleet — sessions on a box that cannot see a module (or its nested CLAUDE.md) misdiagnose themselves as stuck, the scope machinery kept failing in the field (task 1002729's base-slice collapse), and every live box user is Metic+ anyway, so the slice narrowed trusted builders while newcomers were already gated by rank. UNCHANGED: live-rank allow/deny per request (ADR 0016), the provision floor and demotion clawback, the read-only per-request credential (ADR 0055 — push still 403s, re-verified on hardware in task 1003253), and sub-Metic starter boxes. `GET /box/scope` now reports `task_scoping_paused` so the hall/app can say why `task_scope` is false; the app task-picker's "scoped to `<modules>` and nothing else" copy overstates while paused (cosmetic). Revert = set the env flag; make-permanent = delete the resolution + a follow-up ADR.](<redacted>.md) | dev-box |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/docs/recipes/work-on-a-task-from-your-dev-box.md

@@ -1,12 +1,13 @@
 # Work on a task from your dev box
 
-> Your dev box is **task-scoped**: claim a task and the box pulls **only the code
-> that task needs** — the module(s) its work touches, on top of a small base
-> instance — never the whole repo. Your GitHub token never leaves the server; the
-> box fetches its slice through the control plane. See
-> [ADR 0148](../adr/<redacted>.md) (the scope model) and
-> [ADR 0150](../adr/<redacted>.md) (how the box
-> comes up).
+> Your dev box serves your **rank scope**: Metic+ boxes carry the **whole repo**;
+> newcomer (starter) boxes carry the safe starter surface. Task-scoped slices are
+> **paused** per [ADR 0193](../adr/<redacted>.md) (the
+> machinery from [ADR 0148](../adr/<redacted>.md) remains;
+> `BOX_TASK_SCOPE=on` re-enables it). Your GitHub token never leaves the server —
+> see "How git works on a box" below, and
+> [ADR 0150](../adr/<redacted>.md) for how the
+> box comes up.
 
 ## TL;DR
 
@@ -15,32 +16,48 @@ In your dev box's terminal:
 ```bash
 /builder-start          # see what you can claim
 /builder-claim <N>      # claim task N (locks it to your session)
-/builder-sync           # pull task N's code onto the box now (re-scopes in place)
+/builder-sync           # pull the latest main onto the box right now
 # …work in /workspace…
 /builder-ship           # smoke + review, then land + deploy — awards credits
 ```
 
-That's the whole loop. `/builder-sync` is the new step: it materializes the claimed
-task's code within seconds instead of waiting for the box's ~10-minute refresh.
+That's the whole loop. `/builder-sync` pulls fresh code within seconds instead of
+waiting for the box's ~10-minute refresh.
+
+## How git works on a box — read this BEFORE diagnosing "stuck"
+
+The box holds **no stored git credential, ever** — and that is the design, not a
+fault ([ADR 0055](../adr/<redacted>.md)):
+
+- **Reads are server-mediated, per request.** Every remote git operation goes
+  through `/usr/local/bin/otb-git-credential`, which asks the control plane
+  (`GET /box/source-access`) for a **short-lived, read-only** credential. The
+  server checks your **live** rank + status on every single request — demotion or
+  deactivation cuts off the next fetch instantly.
+- **`git push` always fails with 403 here — by design.** The read credential
+  cannot write. Landing code is the server's job: `/builder-ship` uploads your
+  work, opens the PR, and lands it. Never try to fix the 403 by embedding a
+  token or editing git config.
+- **Source refreshes from `main` every ~10 minutes** (the `box-source-fetch`
+  cron; log at `/tmp/box-source-fetch.log`). `/builder-sync` runs the same fetch
+  on demand.
+- **If a remote git op says `could not read Username`, or the sync log shows
+  401:** the box's GDS session expired. Run `/builder-reauth`, then
+  `/builder-sync`. That is the whole fix.
+
+The box writes these same facts to `/workspace/CLAUDE.local.md` on every sync, so
+a Claude session on the box loads them automatically (the file is gitignored and
+box-written — don't edit it).
 
 ## The model — what's on your box
 
-A task-scoped box carries two layers:
-
-1. **The base instance** — always present, whatever you've claimed: the methodology
-   (`CLAUDE.md`, `.claude/`), the build tooling (`scripts/`, `src/bongos/`),
-   `docs/`, `infra/`, and the **test suite** (`tests/`). Enough for Claude to hold
-   context and run the `/builder-*` CLI, and to run your module's tests.
-2. **Your claimed task's code** — the module directories the task's goal scopes
-   (`goals.scope_modules` → globs, [ADR 0086](../adr/<redacted>.md)). Claim a `dev-box` task → you get
-   `modules/dev-box/`; claim a `game` task → you get the game world too. Nothing
-   else.
-
-What you do **not** get: other builders' modules, the product/game runtime (unless
-your task is game-scoped), and — the point — **no GitHub credential on the box**.
-The box asks the control plane (`GET /box/source-access`) for its slice on each
-fetch; the server holds the token and returns a scoped, cone-mode sparse-checkout
-spec. Lose the claim or a rank, and the next fetch is cut off at the server.
+- **Metic and above:** the full repo in `/workspace` — same tree as a laptop
+  clone, refreshed from `main` by the sync cron.
+- **Below Metic (starter):** the starter surface — methodology (`CLAUDE.md`,
+  `.claude/`), build tooling (`scripts/`, `src/bongos/`), `docs/`, `infra/`,
+  `tests/`, and the sandbox-runnable product code. Rank, checked live by the
+  server, is what bounds a box — not the task you claimed
+  ([ADR 0193](../adr/<redacted>.md)).
 
 ## Step by step
 
@@ -51,11 +68,10 @@ If you haven't yet, run **`/builder-connect`** (or follow the
 box, then **`/builder-setup`** once on the box to sign the Bongos CLI in. The browser
 terminal drops you into `/workspace` — the one working folder.
 
-> **`bongos shell` / `bongos code` re-scope on connect (BV1.R101).** Connecting with
-> either verb runs the sync for you first, so you land in `/workspace` already scoped
-> to your active claim — no manual `/builder-sync` needed just to arrive. (The browser
-> terminal drops you straight into `/workspace`; run `/builder-sync` there if you
-> claimed or switched since your last sync.)
+> **`bongos shell` / `bongos code` sync on connect (BV1.R101).** Connecting with
+> either verb runs the source fetch for you first, so you land in `/workspace`
+> already fresh. (The browser terminal drops you straight into `/workspace`; run
+> `/builder-sync` there if you want the latest immediately.)
 
 ### 2. See what you can claim — `/builder-start`
 
@@ -64,21 +80,18 @@ claims. Pick one.
 
 ### 3. Claim it — `/builder-claim <N>`
 
-Locks task N to your session. **This is what drives your box's scope:** source
-access is computed from your **active claim** — its task → goal → `scope_modules`.
+Locks task N to your session so no parallel session collides with your work.
 
-### 4. Pull the code now — `/builder-sync`
+### 4. Freshen the code — `/builder-sync`
 
-Re-runs the box's source-fetch immediately, so `/workspace` re-scopes to task N's
-modules within seconds. (A ~10-minute cron does this on its own as a backstop — you
-just don't want to wait for it.) Off a box there's nothing to sync — your source is
-your local checkout — and the command tells you so.
+Re-runs the box's source fetch immediately so `/workspace` is on the current
+`main` before you branch. (The ~10-minute cron does this on its own as a
+backstop.) Off a box there's nothing to sync — your source is your local
+checkout — and the command tells you so.
 
 ### 5. Work — in `/workspace`
 
-`/workspace` now holds the base instance **plus** task N's module code. One folder:
-when you switch tasks it **re-scopes in place**, so there are no per-task folders to
-manage.
+One folder, always. When you switch tasks, keep working in place.
 
 ### 6. Ship — `/builder-ship`
 
@@ -90,19 +103,20 @@ One box, one working folder, one active claim at a time (the server enforces
 one-claim-per-session). To move to a different task:
 
 1. `/builder-ship` (or `/builder-release`) the current claim.
-2. `/builder-claim <M>` the new one.
-3. `/builder-sync` — the box re-scopes to task M in place.
+2. `/builder-claim <M>` the new one — and keep working in `/workspace`.
 
 ## Notes + gotchas
 
-- **`tests/` is always in the base** — so a module's tests run on the box (they
-  live in the top-level `tests/`, not inside `modules/<key>/`).
-- **Idle boxes rest.** A box with no activity is reclaimed after ~10–15 min; the
-  next connect re-provisions a fresh one and re-fetches your scope. **Uncommitted
-  work on a reaped box is lost** — ship or commit before you step away.
+- **`tests/` is on every box** — a starter box can run the suite for the code it
+  holds (tests live in the top-level `tests/`, not inside `modules/<key>/`).
+- **Idle boxes park, they don't die.** After ~2 hours of no activity the box is
+  **parked**: a snapshot is kept and the droplet is destroyed, so compute billing
+  stops and a wake restores your filesystem. Only weeks of staying parked lead to
+  reclaim (with a warning first). Still: **ship or commit before you step away** —
+  a snapshot is a safety net, not a workflow.
 - **`/builder-sync` is idempotent** — safe to re-run; it just does, on demand, what
   the cron does on its schedule.
-- **A fresh box comes up with the base already cloned.** If a box ever comes up
+- **A fresh box comes up with the code already cloned.** If a box ever comes up
   *bare* (no code, no terminal), that's the packaging bug
   [ADR 0150](../adr/<redacted>.md) fixed on the
   control plane — flag it rather than working around it.

package/modules/dev-box/routes/box.js

@@ -55,6 +55,17 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..', '..');
 const PUBLIC_ORIGIN = process.env.GDS_PUBLIC_ORIGIN
   || (() => { try { return api.branding().domains.publicOrigin; } catch { return 'http://localhost:3000'; } })();
 
+// Task-scoping PAUSE (task 1003285 / ADR 0193 — owner decision, 2026-08-25).
+// While paused, the claim-derived slice is never resolved: scopeKeys stays
+// undefined and decideSourceAccess takes its documented rank fallback — full
+// repo for Metic+, the starter surface below. Rank floor, ADR 0016 live-rank
+// checks, and the ADR 0055 read-only credential are all unchanged; only the
+// module BREADTH stops narrowing. Paused by default; set BOX_TASK_SCOPE=on
+// to re-enable the ADR 0148 claim-driven slice.
+function taskScopingPaused() {
+  return String(process.env.BOX_TASK_SCOPE || '').trim().toLowerCase() !== 'on';
+}
+
 // The instance's world name + dev-box apex + SSH zone come from the branding pack
 // (ADR 0062 §3), never a hardcoded host brand — a non-OTB instance uses its own
 // configured identity/domains. Passed into the PURE box-onboard renderers.
@@ -444,10 +455,12 @@ module.exports = function buildBoxRouter() {
       //   - undefined     → decideSourceAccess falls back to the RANK scope (the
       //                     pre-ADR-0148 behavior, so a port-less instance is unchanged).
       // NEVER fail the source fetch on a scope-read hiccup — degrade to rank scope.
+      // While task-scoping is paused (taskScopingPaused above), skip the claim
+      // resolution entirely: undefined scopeKeys IS the rank-fallback signal.
       const lifecycle = api.resolveOptional('lifecycle');
       let scopeKeys;
       let hasActiveClaims;
-      if (lifecycle && typeof lifecycle.moduleScopeForActiveClaims === 'function') {
+      if (!taskScopingPaused() && lifecycle && typeof lifecycle.moduleScopeForActiveClaims === 'function') {
         try {
           scopeKeys = await lifecycle.moduleScopeForActiveClaims(req.builder.id);
         } catch (scopeErr) {
@@ -560,11 +573,13 @@ module.exports = function buildBoxRouter() {
       const status = builder ? builder.status : 'inactive';
 
       // Resolve the claim-driven module scope exactly as source-access does
-      // (optional lifecycle port; degrade to rank scope on any hiccup).
+      // (optional lifecycle port; degrade to rank scope on any hiccup; skipped
+      // entirely while task-scoping is paused, so this read-only companion can
+      // never report a slice the real fetch would no longer grant).
       const lifecycle = api.resolveOptional('lifecycle');
       let scopeKeys;
       let hasActiveClaims;
-      if (lifecycle && typeof lifecycle.moduleScopeForActiveClaims === 'function') {
+      if (!taskScopingPaused() && lifecycle && typeof lifecycle.moduleScopeForActiveClaims === 'function') {
         try {
           scopeKeys = await lifecycle.moduleScopeForActiveClaims(req.builder.id);
         } catch (scopeErr) {
@@ -593,8 +608,9 @@ module.exports = function buildBoxRouter() {
       }
       const meta = boxAccess.scopeMetadata({ decision, scopeKeys });
       // task_scope true only when a claim actually drove the breadth (scopeKeys is
-      // an array). false → the rank fallback (no active claim / no lifecycle port).
-      return res.json({ ...meta, task_scope: Array.isArray(scopeKeys) });
+      // an array). false → the rank fallback (no active claim / no lifecycle port /
+      // task-scoping paused — the paused flag says which, so the app can explain).
+      return res.json({ ...meta, task_scope: Array.isArray(scopeKeys), task_scoping_paused: taskScopingPaused() });
     } catch (err) {
       log.error('[gds] GET /box/scope', err);
       res.fail('box_scope_failed', { status: 500, message: 'internal error' });
@@ -1088,3 +1104,4 @@ module.exports = function buildBoxRouter() {
 // (tests/box_terminal_ssrf.mjs) without a server, DB, or network.
 module.exports.isSafeTerminalUrl = isSafeTerminalUrl;
 module.exports.isTunnelReadyStatus = isTunnelReadyStatus;
+module.exports.taskScopingPaused = taskScopingPaused;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.369",
+  "version": "1.19.371",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.369",
+      "version": "1.19.371",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.369",
+  "version": "1.19.371",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -1168,8 +1168,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.367 with no explicit bump. run 32902864988. (task 1002620)
 //   1.19.369 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.368 with no explicit bump. run 32903289072. (task 1002620)
+//   1.19.370 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.369 with no explicit bump. run 32904231221. (task 1002620)
+//   1.19.371 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.370 with no explicit bump. run 32904582252. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.369'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.371'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_task_scope_pause.mjs

@@ -0,0 +1,66 @@
+// tests/box_task_scope_pause.mjs
+//
+// Regression guard for task 1003285 / ADR 0193 — the task-scoping PAUSE.
+// The owner decision: a box serves its RANK scope (full repo for Metic+),
+// not the claim-derived slice, unless BOX_TASK_SCOPE=on re-enables ADR 0148.
+//
+// Two layers, per the goal-1000077 lesson (a guard must assert the wiring,
+// not just the helper): (1) taskScopingPaused()'s env semantics — paused by
+// DEFAULT, only an explicit "on" re-enables; (2) the route source keeps BOTH
+// lifecycle scope-resolution sites (source-access + /box/scope) behind the
+// helper, and /box/scope keeps reporting task_scoping_paused — so deleting a
+// gate or the report fails here instead of silently reviving the slice.
+//
+// Run:  node --test tests/box_task_scope_pause.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { taskScopingPaused } = require('../modules/dev-box/routes/box.js');
+
+const withEnv = (value, fn) => {
+  const prev = process.env.BOX_TASK_SCOPE;
+  if (value === undefined) delete process.env.BOX_TASK_SCOPE;
+  else process.env.BOX_TASK_SCOPE = value;
+  try { return fn(); }
+  finally {
+    if (prev === undefined) delete process.env.BOX_TASK_SCOPE;
+    else process.env.BOX_TASK_SCOPE = prev;
+  }
+};
+
+test('paused by DEFAULT — an instance that sets nothing serves the rank scope', () => {
+  withEnv(undefined, () => assert.equal(taskScopingPaused(), true));
+  withEnv('', () => assert.equal(taskScopingPaused(), true));
+});
+
+test('only an explicit "on" re-enables the ADR 0148 slice (trim + case-insensitive)', () => {
+  withEnv('on', () => assert.equal(taskScopingPaused(), false));
+  withEnv(' ON ', () => assert.equal(taskScopingPaused(), false));
+});
+
+test('anything that is not "on" stays paused — no accidental re-enable', () => {
+  for (const v of ['off', 'true', '1', 'yes', 'paused', 'On!']) {
+    withEnv(v, () => assert.equal(taskScopingPaused(), true, `value ${JSON.stringify(v)} must stay paused`));
+  }
+});
+
+test('both lifecycle scope-resolution sites stay behind the pause gate', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules', 'dev-box', 'routes', 'box.js'), 'utf8');
+  const gated = src.match(/!taskScopingPaused\(\) && lifecycle && typeof lifecycle\.moduleScopeForActiveClaims === 'function'/g) || [];
+  const resolutionSites = src.match(/typeof lifecycle\.moduleScopeForActiveClaims === 'function'/g) || [];
+  assert.equal(resolutionSites.length, 2, 'expected exactly the two known resolution sites (source-access + /box/scope); a new one must take the gate too');
+  assert.equal(gated.length, 2, 'every moduleScopeForActiveClaims resolution must be gated by !taskScopingPaused()');
+});
+
+test('/box/scope keeps telling the truth about the pause', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules', 'dev-box', 'routes', 'box.js'), 'utf8');
+  assert.ok(src.includes('task_scoping_paused: taskScopingPaused()'),
+    '/box/scope must report task_scoping_paused so the hall/app can explain a false task_scope');
+});