@bongos/core 1.19.417 → 1.19.419

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.417",
-  "core_contract": "1.19.417",
-  "source_commit": "2ea84040287b365331cb8eb9278615dc4a0e5642",
+  "core_version": "1.19.419",
+  "core_contract": "1.19.419",
+  "source_commit": "d433ea7793766e404ce4b09ee9f652d5c09df897",
   "source_ref": "HEAD",
-  "built_at": "2026-08-29T16:38:30.577Z",
+  "built_at": "2026-08-29T17:21:12.343Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 356,
+    "docs_redacted": 358,
     "agent_docs_stubbed": 23,
-    "functional_verbatim": 1701,
+    "functional_verbatim": 1710,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2080,
-  "tree_sha256": "4d8a309a1363b0a74ea89df369c37d35b0af343cd3ed08d4361f8951165933b3",
+  "file_count": 2091,
+  "tree_sha256": "95da3db8c2006aa8998116a9f4679ee33c902f365d0aa3904d7af6d3412ac78d",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -352,12 +352,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "80d3bb0a3dc011b0c2b16558b20c1ea2adc3e5345418a8d08f13a7cd2ac5eb9a"
+      "sha256": "d80581bbcb2577fe16cba30d6e0e1ff4ede4ca49dd08c306d1a3bcbfdf1d2cdc"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "833fecb6824cb535eb990a8f3a516528c6d560eee856323f5d824afe5bcf7932"
+      "sha256": "64cccfdbd4d3d86798bdb60dbcf336e474aeb6af3854225c0a87f9d466c86acd"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -367,17 +367,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "bf528220a1990c760111ef291e6d6d6543b62440ab62c3962a8772e897218c69"
+      "sha256": "b11537927f1268e2e14d8307589fe2eb58ef01e245556decd0251efc17f707d3"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "84fce1d4d0fba5b586f1a965a7b4b6818ad7d27e7bbce68818e9def0db85724b"
+      "sha256": "227105130a432d4e7a294b4359455e022beaaac87bcd4014855d9d34e2faeaf4"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "b07a09551c9af7e526aaf2416e5340b112f7b8b8ffc28c49afe252092a215f9c"
+      "sha256": "aaa84ab1bc5fd8054a85d36d6c70dd4667c8103c21e1c5a027de0b3806096029"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1529,25 +1529,35 @@
       "mode": "0000644",
       "sha256": "dedf9285b041a0d4c54982a8372aca573e57eb3d89a5abf9381a922a8784ff7f"
     },
+    {
+      "path": "docs/adr/0206-own-scoped-session-revocation-no-absolute-ceiling.md",
+      "mode": "0000644",
+      "sha256": "634404f2eb0d29386460e0ea008a826069d80bfbd42721aa7b2cd4d74cb4fa86"
+    },
+    {
+      "path": "docs/adr/0207-connections-implementation-departures-and-honest-limits.md",
+      "mode": "0000644",
+      "sha256": "72c859bdfc70fd4fc0d104439985a43eaf60cce281bbaae8b8faaffb40546973"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "3d9a57147d8a7e8db350df79ecc457cf57bdadd77d08b41749dfa658c733c07c"
+      "sha256": "0f92a7a74afdf213a1aba92da88ea5348878ba0df67c3fc9e33d06b8f7ebade9"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "dc283ca75e6aa5b2dcede50879f7c7f7beb151ae953282c917621b4dd6d6b2e1"
+      "sha256": "e58b3d540eeaa8f38e028c72e64f4a2373c16c4c185edabc2d2538d247da9a29"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "b0f8cab2aa5931ef9090bbee552ff00f3da37a86ce327225b11712f16cd25090"
+      "sha256": "091c9eecdbec83a540fc5d92017525dfdfdf192604b39d8cf60ec2cfb3466819"
     },
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "68d30a764a36e963d40e4271010c56b61a824b9e2fad61599fdc62ee1bc2fddf"
+      "sha256": "d24b71683aab15bb19ffd110c3d214dade7f2be4c5cc81740153c92ea8ccc252"
     },
     {
       "path": "docs/branding-contract.md",
@@ -1567,12 +1577,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "c462f7be788726d0bbe0186dcaa7288fa81b23550057ce9f579bc5b3d6096f44"
+      "sha256": "3e70beb03c93a71f5068c407467deeeca3c69d5271372de04399a9094fa32dd9"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "429fbb99f080c8bb80c8b8fc9539eb632dab1a4f6bb0534170667c76e055001d"
+      "sha256": "ae4ffbc86e556ea5463b8289754b70e9465a581e93a40f8713204c34d433e00a"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -1907,7 +1917,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "76febc87dd3d8b6641673093df2efa7c699a33428e6a53bc1cf595e0f3daf558"
+      "sha256": "2464bcb60656e263ef00002c928a2e6f0d4b812b7a7b8183c634535f1192e58d"
     },
     {
       "path": "docs/handoff-template.md",
@@ -1917,7 +1927,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "402fcd99a486b88a9c7e0acccd85d95effbbe263dec1f917f7bfc1e07349f46c"
+      "sha256": "793b13d001dfdb2742b623d7f43d1c5850c67df8a8b12ffb469c675f15a109e2"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3227,7 +3237,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "bf528220a1990c760111ef291e6d6d6543b62440ab62c3962a8772e897218c69"
+      "sha256": "b11537927f1268e2e14d8307589fe2eb58ef01e245556decd0251efc17f707d3"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4144,15 +4154,20 @@
       "mode": "0000644",
       "sha256": "e99046a2c0e2cb6ce9f05711ddbe6ed9d2e7536086dca16496ef0e5e8cb9a041"
     },
+    {
+      "path": "modules/hall-ui/public/settings-sessions.js",
+      "mode": "0000644",
+      "sha256": "c0c207769631f027ca35d219105e2189e2d259e7b45bfeaa1245fd749d7e91e5"
+    },
     {
       "path": "modules/hall-ui/public/settings.css",
       "mode": "0000644",
-      "sha256": "4ff2a298547ad65d92b2511b0ea98c4adfe8f173833585eb34197f29255086b7"
+      "sha256": "d50ac6727dde53e91aef8daa5ce759edcc69924e43b786103800892d9b87fe4d"
     },
     {
       "path": "modules/hall-ui/public/settings.html",
       "mode": "0000644",
-      "sha256": "852ce177610c5bc49145333b157700d8c3566565d106dcf26c476d32b7105609"
+      "sha256": "88886109031ceb77f4a4efbe133af5a2ac8e26ec5dd55e2e71a0bbe5152887bc"
     },
     {
       "path": "modules/hall-ui/public/settings.js",
@@ -4754,6 +4769,16 @@
       "mode": "0000644",
       "sha256": "7cb9dac9cb87b679e1ae50e4112b3a7928a38ebb9902c8947a74d17bec4d9009"
     },
+    {
+      "path": "modules/platform-identity/account-visibility.js",
+      "mode": "0000644",
+      "sha256": "744a7293bbdf4e2340baf0dc7f789df03a63ba7970741b8aef5922c02cb8910e"
+    },
+    {
+      "path": "modules/platform-identity/connections.js",
+      "mode": "0000644",
+      "sha256": "3bdd5edf87ff2095035e8945afb7d3a0779cbb9f691e6e634f12a6500edeb21b"
+    },
     {
       "path": "modules/platform-identity/hub-device.js",
       "mode": "0000644",
@@ -4844,10 +4869,15 @@
       "mode": "0000644",
       "sha256": "cf29832de04b2b31e1d36b5d595489bbbb09d14b12c86da7c5ac7557917475bf"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_015_connections.sql",
+      "mode": "0000644",
+      "sha256": "edaced87ae340bb4c0a8c73d5dc40f8578bf7be0bd4064a02d6c4fcf0cf94be3"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "c4c02577f7318e994301bbe700e20dfb24519e411fee04539755f7374a73590b"
+      "sha256": "d7c74b8b41b3c0f6d0d072632f4a8d04f11b06c39203c6f759dcaf4e324fd9b0"
     },
     {
       "path": "modules/platform-identity/platform-identity.js",
@@ -4864,6 +4894,11 @@
       "mode": "0000644",
       "sha256": "2e898799632a2b5c2ead9cb44fa0b8029fcb6d217f7d5f26c8a39b34c75bbea7"
     },
+    {
+      "path": "modules/platform-identity/routes/connections.js",
+      "mode": "0000644",
+      "sha256": "d4b7ddb7ec100899e95e73428fba8dc5e3f41005e021fcf887ea80ba8ae0e1b6"
+    },
     {
       "path": "modules/platform-identity/routes/my-projects.js",
       "mode": "0000644",
@@ -5432,12 +5467,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "64e99f4a6c987054fa4827a376eace859767c9f5edc34676a60b5e0e19cb1581"
+      "sha256": "9bcfa46cd421336fba313885ceb399c9f025a85f5c07759abdb9d653bbd34105"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "29aa7a9418a4755ab9c7e20a439d84f12ea48407851c6634ff9669c809940332"
+      "sha256": "cff6d489fea88ab0fe13b221de09f4bfa4b7d95ce5d8a1386de53ce94236b44e"
     },
     {
       "path": "public-docs/index.html",
@@ -7317,7 +7352,7 @@
     {
       "path": "src/bongos/db.js",
       "mode": "0000644",
-      "sha256": "3c34327680f89ae6a442bf6d75c1ac3ba570e0a08df2efa063d55b84727ba9ea"
+      "sha256": "feff54089b6bae5845558d262c07ec30d9532419d42c04f1f113bc2fc95d9173"
     },
     {
       "path": "src/bongos/github-repos.js",
@@ -7417,12 +7452,12 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "ebdf0cb4cb521fbf5aa7809c39e89ad4f776e77b194c734042fae72226511674"
+      "sha256": "96b884a69b7b709a256d220c97a972f9827d74a36a864c216a7b37db3fdf66be"
     },
     {
       "path": "src/bongos/routes.js",
       "mode": "0000644",
-      "sha256": "ede634ea623ec035a5ebab896f1f97e67e142c882cade5afaeb3e3c253fc28f8"
+      "sha256": "074cded727667d864b1849d8d5505736895a69a6bdf7132375fd358d66c2e6fd"
     },
     {
       "path": "src/bongos/routes/CLAUDE.md",
@@ -7489,6 +7524,11 @@
       "mode": "0000644",
       "sha256": "54a42c37d4afd403a13aa5e9fda6a7d95cb0fca70dfe3cb4daef318c099a5f00"
     },
+    {
+      "path": "src/bongos/routes/my-sessions.js",
+      "mode": "0000644",
+      "sha256": "0e002104e2fedea2bb322826560aadf18b9885f21e214592c63b304b3ba9fd1e"
+    },
     {
       "path": "src/bongos/routes/optimizer.js",
       "mode": "0000644",
@@ -7552,7 +7592,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0dce01d81ecb3f709416d11f10605ac834dbdb5ed9faea3f9459ddfceaa8389d"
+      "sha256": "d70b98299c5a454682784d75bed90dc711525c826fb861bf11c8e5126ea0e155"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8114,6 +8154,16 @@
       "mode": "0000644",
       "sha256": "69f4e40c66e49e4d2c58f1f41ec1c515b2cb44891e40b6192ed898484d10671d"
     },
+    {
+      "path": "tests/connections_api.mjs",
+      "mode": "0000644",
+      "sha256": "fe844d310fbe79e38f199dc623a96e0facd751967a9a247be5cbe9c15f80f13a"
+    },
+    {
+      "path": "tests/connections_ownership.mjs",
+      "mode": "0000644",
+      "sha256": "1d716fc81ebdb81daedade019f5adcdda2161c06df40711c8fb78f3ec5d605b0"
+    },
     {
       "path": "tests/consumer_layout_boot.mjs",
       "mode": "0000644",
@@ -9462,7 +9512,12 @@
     {
       "path": "tests/own_scope_guard.mjs",
       "mode": "0000644",
-      "sha256": "694002ebe39755fd01bdba57bf70e7077201b81a6938df92fff09b44027a29cc"
+      "sha256": "074346fee8dbc4de221600d21a4066852125f4f3d0b4f792093e9546ba2cd900"
+    },
+    {
+      "path": "tests/own_session_revoke.mjs",
+      "mode": "0000644",
+      "sha256": "756920320b74c9094d1be12108efb8ddbb39341b8d122afd9454ffd084a2efe5"
     },
     {
       "path": "tests/package_core.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 327 operations across 52 resource groups
+- 337 operations across 53 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -264,6 +264,22 @@ function createClient(opts = {}) {
       // GET /closeness/with/{builderId} — rank: any-builder — GET /closeness/with/:builderId
       getClosenessWithBuilderId: (args) => request("GET", "/closeness/with/{builderId}", { hasBody: false }, args),
     },
+    "connections": {
+      // GET /connections — rank: any-builder — GET /connections
+      getConnections: (args) => request("GET", "/connections", { hasBody: false }, args),
+      // POST /connections — rank: any-builder — POST /connections
+      postConnections: (args) => request("POST", "/connections", { hasBody: true }, args),
+      // DELETE /connections/{id} — rank: any-builder — DELETE /connections/:id
+      deleteConnectionsId: (args) => request("DELETE", "/connections/{id}", { hasBody: false }, args),
+      // POST /connections/{id}/accept — rank: any-builder — POST /connections/:id/accept
+      postConnectionsIdAccept: (args) => request("POST", "/connections/{id}/accept", { hasBody: true }, args),
+      // POST /connections/{id}/decline — rank: any-builder — POST /connections/:id/decline
+      postConnectionsIdDecline: (args) => request("POST", "/connections/{id}/decline", { hasBody: true }, args),
+      // GET /connections/degree/{handle} — rank: any-builder — GET /connections/degree/:handle
+      getConnectionsDegreeHandle: (args) => request("GET", "/connections/degree/{handle}", { hasBody: false }, args),
+      // GET /connections/requests — rank: any-builder — GET /connections/requests
+      getConnectionsRequests: (args) => request("GET", "/connections/requests", { hasBody: false }, args),
+    },
     "copyDesk": {
       // POST /copy-desk/flags — rank: any-builder — POST /copy-desk/flags
       postCopyDeskFlags: (args) => request("POST", "/copy-desk/flags", { hasBody: true }, args),
@@ -523,6 +539,12 @@ function createClient(opts = {}) {
       getMeRender: (args) => request("GET", "/me/render", { hasBody: false }, args),
       // PATCH /me/render — rank: any-builder — PATCH /me/render
       patchMeRender: (args) => request("PATCH", "/me/render", { hasBody: true }, args),
+      // GET /me/sessions — rank: any-builder — GET /me/sessions
+      getMeSessions: (args) => request("GET", "/me/sessions", { hasBody: false }, args),
+      // POST /me/sessions/revoke — rank: any-builder — POST /me/sessions/revoke
+      postMeSessionsRevoke: (args) => request("POST", "/me/sessions/revoke", { hasBody: true }, args),
+      // POST /me/sessions/revoke-all — rank: any-builder — POST /me/sessions/revoke-all
+      postMeSessionsRevokeAll: (args) => request("POST", "/me/sessions/revoke-all", { hasBody: true }, args),
       // GET /me/skill-prefs — rank: any-builder — GET /me/skill-prefs
       getMeSkillPrefs: (args) => request("GET", "/me/skill-prefs", { hasBody: false }, args),
       // PATCH /me/skill-prefs — rank: any-builder — PATCH /me/skill-prefs

package/clients/bongos-client/index.cjs

@@ -263,6 +263,22 @@ function createClient(opts = {}) {
       // GET /closeness/with/{builderId} — rank: any-builder — GET /closeness/with/:builderId
       getClosenessWithBuilderId: (args) => request("GET", "/closeness/with/{builderId}", { hasBody: false }, args),
     },
+    "connections": {
+      // GET /connections — rank: any-builder — GET /connections
+      getConnections: (args) => request("GET", "/connections", { hasBody: false }, args),
+      // POST /connections — rank: any-builder — POST /connections
+      postConnections: (args) => request("POST", "/connections", { hasBody: true }, args),
+      // DELETE /connections/{id} — rank: any-builder — DELETE /connections/:id
+      deleteConnectionsId: (args) => request("DELETE", "/connections/{id}", { hasBody: false }, args),
+      // POST /connections/{id}/accept — rank: any-builder — POST /connections/:id/accept
+      postConnectionsIdAccept: (args) => request("POST", "/connections/{id}/accept", { hasBody: true }, args),
+      // POST /connections/{id}/decline — rank: any-builder — POST /connections/:id/decline
+      postConnectionsIdDecline: (args) => request("POST", "/connections/{id}/decline", { hasBody: true }, args),
+      // GET /connections/degree/{handle} — rank: any-builder — GET /connections/degree/:handle
+      getConnectionsDegreeHandle: (args) => request("GET", "/connections/degree/{handle}", { hasBody: false }, args),
+      // GET /connections/requests — rank: any-builder — GET /connections/requests
+      getConnectionsRequests: (args) => request("GET", "/connections/requests", { hasBody: false }, args),
+    },
     "copyDesk": {
       // POST /copy-desk/flags — rank: any-builder — POST /copy-desk/flags
       postCopyDeskFlags: (args) => request("POST", "/copy-desk/flags", { hasBody: true }, args),
@@ -522,6 +538,12 @@ function createClient(opts = {}) {
       getMeRender: (args) => request("GET", "/me/render", { hasBody: false }, args),
       // PATCH /me/render — rank: any-builder — PATCH /me/render
       patchMeRender: (args) => request("PATCH", "/me/render", { hasBody: true }, args),
+      // GET /me/sessions — rank: any-builder — GET /me/sessions
+      getMeSessions: (args) => request("GET", "/me/sessions", { hasBody: false }, args),
+      // POST /me/sessions/revoke — rank: any-builder — POST /me/sessions/revoke
+      postMeSessionsRevoke: (args) => request("POST", "/me/sessions/revoke", { hasBody: true }, args),
+      // POST /me/sessions/revoke-all — rank: any-builder — POST /me/sessions/revoke-all
+      postMeSessionsRevokeAll: (args) => request("POST", "/me/sessions/revoke-all", { hasBody: true }, args),
       // GET /me/skill-prefs — rank: any-builder — GET /me/skill-prefs
       getMeSkillPrefs: (args) => request("GET", "/me/skill-prefs", { hasBody: false }, args),
       // PATCH /me/skill-prefs — rank: any-builder — PATCH /me/skill-prefs

package/clients/bongos-client/index.d.ts

@@ -6,6 +6,7 @@ export declare const DEFAULT_BASE_URL: string;
 // Request-body + shared types, generated from the OpenAPI components.schemas.
 export interface ApiErrorObject { code: string; message: string; details?: unknown }
 export interface DeleteBoxSshKeyIdResponse { ok: boolean; deleted: unknown }
+export interface DeleteConnectionsIdResponse { outcome: unknown }
 export interface DeleteDependenciesResponse { ok: boolean }
 export interface DeleteGovernmentAssignmentsBuilderIdRankKeyResponse { ok: boolean; builder_id: unknown; rank_key: unknown; removed: unknown }
 export interface DeleteGovernmentRanksRankKeyPermissionsPermissionKeyResponse { ok: boolean; rank_key: unknown; permission_key: unknown; removed: unknown }
@@ -39,6 +40,9 @@ export interface GetBuildersRosterResponse { builders: unknown; stale_hours: unk
 export interface GetClosenessForMeResponse { closeness: unknown; count: unknown }
 export interface GetClosenessWeightsResponse { weights: unknown; window_days: unknown; note: unknown }
 export interface GetClosenessWithBuilderIdResponse { closeness: unknown; why: unknown }
+export interface GetConnectionsDegreeHandleResponse { handle: unknown; degree: unknown; mutuals: unknown; mutual_count: unknown; truncated: unknown }
+export interface GetConnectionsRequestsResponse { incoming: unknown; outgoing: unknown; incoming_count: unknown; outgoing_count: unknown }
+export interface GetConnectionsResponse { connections: unknown; count: unknown }
 export interface GetDiscordChannelsPlanResponse { ok: boolean; guild_id: unknown; op_count: unknown; ops: unknown; warnings: unknown }
 export interface GetDoneWhenPendingReviewResponse { criteria: unknown; count: unknown }
 export interface GetGithubRepoResponse { ok: boolean; repo: unknown; private_deployable: boolean }
@@ -68,6 +72,7 @@ export interface GetMeCrossProjectResponse { hide_stats: boolean; profile_state:
 export interface GetMeDisplayNameResponse { display_name: unknown; max_length: unknown }
 export interface GetMeEventSoundPrefsResponse { prefs: unknown; effective: unknown; effective_wav: unknown; events: unknown }
 export interface GetMeRecentShipsResponse { ships: unknown }
+export interface GetMeSessionsResponse { sessions: unknown }
 export interface GetMeSkillPrefsResponse { prefs: unknown; effective: unknown; defaults: unknown; known_skills: unknown; allowed_models: unknown }
 export interface GetMeSoundPrefsResponse { prefs: unknown; effective: unknown; effective_map: unknown; volume: unknown; defaults: unknown; known_sounds: unknown }
 export interface GetMemoryBfgBuildersBuilderIdFileResponse { builder_id: unknown; bfg_read: boolean; path: unknown; content: unknown; sha256: unknown; byte_len: unknown; mtime: unknown; updated_at: unknown; created_at: unknown }
@@ -215,6 +220,9 @@ export interface PostClaimsIdReleaseOnBehalfRequest { reason: string }
 export interface PostClaimsIdResolveRequest { outcome: "shipped" | "abandoned" | "partial"; notes_md?: string; value_summary?: string; verification?: Record<string, unknown>; force?: boolean; committed_files?: string[]; sandbox_review?: Record<string, unknown> }
 export interface PostClaimsRequest { task_id: StringifiableId; worktree_name?: string; head_sha?: string; bind_session?: boolean; enforce_touches?: boolean }
 export interface PostClaimsResponse { claim: unknown; task: unknown; just_unlocked: unknown; overlap_warning: unknown; reward: unknown }
+export interface PostConnectionsIdAcceptResponse { status: unknown }
+export interface PostConnectionsRequest { handle: string; note?: string }
+export interface PostConnectionsResponse { status: unknown }
 export interface PostCopyDeskFlagsIdCloseRequest { status: string; resolution_note: string; resolved_task_id?: number }
 export interface PostCopyDeskFlagsIdCloseResponse { ok: boolean; flag: unknown }
 export interface PostCopyDeskFlagsRequest { scope?: string; surface: string; string_id?: string; reason: string; kind?: string }
@@ -283,6 +291,9 @@ export interface PostLlmCacheStoreRequest { spec?: unknown; result_stdout?: unkn
 export interface PostLlmCacheStoreResponse { stored: boolean; result_cost_usd?: unknown }
 export interface PostMeAnthropicLinkRequest { anthropic_email: string; anthropic_user_id: string }
 export interface PostMeAnthropicLinkResponse { linked: unknown }
+export interface PostMeSessionsRevokeAllResponse { ok: boolean; revoked: unknown }
+export interface PostMeSessionsRevokeRequest { session_id?: StringifiableId }
+export interface PostMeSessionsRevokeResponse { ok: boolean; revoked: unknown }
 export interface PostMemoryBuildersBuilderIdBfgWriteRequest { kind?: string; slug?: string; title?: string; body_md?: string; rationale?: string; karma_delta?: unknown }
 export interface PostMemoryBuildersBuilderIdBfgWriteResponse { ok: boolean; builder_id: unknown; path: unknown; kind: unknown; author: unknown; audit_id: unknown; karma_id: unknown; sha256: unknown; byte_len: unknown; updated_at: unknown }
 export interface PostMemorySyncRequest { files?: unknown[] }
@@ -558,6 +569,22 @@ export interface BongosClient {
     /** GET /closeness/with/{builderId} — rank: any-builder */
     getClosenessWithBuilderId(args?: RequestArgs): Promise<GetClosenessWithBuilderIdResponse>;
   };
+  "connections": {
+    /** GET /connections — rank: any-builder */
+    getConnections(args?: RequestArgs): Promise<GetConnectionsResponse>;
+    /** POST /connections — rank: any-builder */
+    postConnections(args: RequestArgs & { body: PostConnectionsRequest }): Promise<PostConnectionsResponse>;
+    /** DELETE /connections/{id} — rank: any-builder */
+    deleteConnectionsId(args?: RequestArgs): Promise<DeleteConnectionsIdResponse>;
+    /** POST /connections/{id}/accept — rank: any-builder */
+    postConnectionsIdAccept(args?: RequestArgs): Promise<PostConnectionsIdAcceptResponse>;
+    /** POST /connections/{id}/decline — rank: any-builder */
+    postConnectionsIdDecline(args?: RequestArgs): Promise<ApiResponse>;
+    /** GET /connections/degree/{handle} — rank: any-builder */
+    getConnectionsDegreeHandle(args?: RequestArgs): Promise<GetConnectionsDegreeHandleResponse>;
+    /** GET /connections/requests — rank: any-builder */
+    getConnectionsRequests(args?: RequestArgs): Promise<GetConnectionsRequestsResponse>;
+  };
   "copyDesk": {
     /** POST /copy-desk/flags — rank: any-builder */
     postCopyDeskFlags(args: RequestArgs & { body: PostCopyDeskFlagsRequest }): Promise<PostCopyDeskFlagsResponse>;
@@ -817,6 +844,12 @@ export interface BongosClient {
     getMeRender(args?: RequestArgs): Promise<ApiResponse>;
     /** PATCH /me/render — rank: any-builder */
     patchMeRender(args?: RequestArgs): Promise<ApiResponse>;
+    /** GET /me/sessions — rank: any-builder */
+    getMeSessions(args?: RequestArgs): Promise<GetMeSessionsResponse>;
+    /** POST /me/sessions/revoke — rank: any-builder */
+    postMeSessionsRevoke(args?: RequestArgs & { body?: PostMeSessionsRevokeRequest }): Promise<PostMeSessionsRevokeResponse>;
+    /** POST /me/sessions/revoke-all — rank: any-builder */
+    postMeSessionsRevokeAll(args?: RequestArgs): Promise<PostMeSessionsRevokeAllResponse>;
     /** GET /me/skill-prefs — rank: any-builder */
     getMeSkillPrefs(args?: RequestArgs): Promise<GetMeSkillPrefsResponse>;
     /** PATCH /me/skill-prefs — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -260,6 +260,22 @@ export function createClient(opts = {}) {
       // GET /closeness/with/{builderId} — rank: any-builder — GET /closeness/with/:builderId
       getClosenessWithBuilderId: (args) => request("GET", "/closeness/with/{builderId}", { hasBody: false }, args),
     },
+    "connections": {
+      // GET /connections — rank: any-builder — GET /connections
+      getConnections: (args) => request("GET", "/connections", { hasBody: false }, args),
+      // POST /connections — rank: any-builder — POST /connections
+      postConnections: (args) => request("POST", "/connections", { hasBody: true }, args),
+      // DELETE /connections/{id} — rank: any-builder — DELETE /connections/:id
+      deleteConnectionsId: (args) => request("DELETE", "/connections/{id}", { hasBody: false }, args),
+      // POST /connections/{id}/accept — rank: any-builder — POST /connections/:id/accept
+      postConnectionsIdAccept: (args) => request("POST", "/connections/{id}/accept", { hasBody: true }, args),
+      // POST /connections/{id}/decline — rank: any-builder — POST /connections/:id/decline
+      postConnectionsIdDecline: (args) => request("POST", "/connections/{id}/decline", { hasBody: true }, args),
+      // GET /connections/degree/{handle} — rank: any-builder — GET /connections/degree/:handle
+      getConnectionsDegreeHandle: (args) => request("GET", "/connections/degree/{handle}", { hasBody: false }, args),
+      // GET /connections/requests — rank: any-builder — GET /connections/requests
+      getConnectionsRequests: (args) => request("GET", "/connections/requests", { hasBody: false }, args),
+    },
     "copyDesk": {
       // POST /copy-desk/flags — rank: any-builder — POST /copy-desk/flags
       postCopyDeskFlags: (args) => request("POST", "/copy-desk/flags", { hasBody: true }, args),
@@ -519,6 +535,12 @@ export function createClient(opts = {}) {
       getMeRender: (args) => request("GET", "/me/render", { hasBody: false }, args),
       // PATCH /me/render — rank: any-builder — PATCH /me/render
       patchMeRender: (args) => request("PATCH", "/me/render", { hasBody: true }, args),
+      // GET /me/sessions — rank: any-builder — GET /me/sessions
+      getMeSessions: (args) => request("GET", "/me/sessions", { hasBody: false }, args),
+      // POST /me/sessions/revoke — rank: any-builder — POST /me/sessions/revoke
+      postMeSessionsRevoke: (args) => request("POST", "/me/sessions/revoke", { hasBody: true }, args),
+      // POST /me/sessions/revoke-all — rank: any-builder — POST /me/sessions/revoke-all
+      postMeSessionsRevokeAll: (args) => request("POST", "/me/sessions/revoke-all", { hasBody: true }, args),
       // GET /me/skill-prefs — rank: any-builder — GET /me/skill-prefs
       getMeSkillPrefs: (args) => request("GET", "/me/skill-prefs", { hasBody: false }, args),
       // PATCH /me/skill-prefs — rank: any-builder — PATCH /me/skill-prefs

package/docs/adr/0206-own-scoped-session-revocation-no-absolute-ceiling.md

@@ -0,0 +1,59 @@
+# 0206 — A leaked bearer's remedy is the account holder's own revoke, not an absolute session ceiling
+
+- **Status:** Accepted
+- **Date:** 2026-08-29
+- **Deciders:** Claude, building the own-scoped half of the session self-service. The ceiling question is the one the task named as "worth a decision either way".
+- **Task:** task 1003341 (goal 1000045 — public builder profiles + account security, criterion `i-control-my-own-access-and-exposure`)
+- **Interacts with:** [ADR 0016](<redacted>.md) (the DB enforces; a session is checked fresh per request, never cached), [ADR 0053](0053-scoped-dev-box-session.md) / [ADR 0151](<redacted>.md) §3 (the session-scope registry — scope is capability on the token, orthogonal to rank), migration `<redacted>.sql` (the 24h TTL + refresh-on-use it introduced, and the deliberate backfill grace that came with it).
+
+## Context
+
+`db-kernel.js lookupSession` rewrites `expires_at = now() + 24h` on every authenticated request. That is refresh-on-use, and for a session in daily use it means the TTL never arrives: a CLI bearer sitting in `~/.config/otb/gds-session.json` is, in practice, immortal. If it leaks — committed to a repo, left on a shared dev box, copied off a stolen laptop — the holder keeps it alive simply by using it.
+
+Until this task the account holder had no remedy of their own. `POST /auth/logout` revokes only the token presented on that same request, which is useless when the token you want dead is the one you no longer hold. The two endpoints that can kill somebody else's session — `POST /auth/revoke` and `POST /auth/revoke-all` — are gated on the admin `auth.session.revoke` atom, so the victim had to find an Archon and ask. On a self-hosted single-owner instance there may be no second Archon at all, which makes the remedy not merely slow but absent.
+
+Two different fixes were on the table, and it matters that they are not the same fix:
+
+1. **Give the holder the remedy.** List your own live sessions, kill one, or sign out everywhere — no rank, no permission, no intermediary.
+2. **Cap the sliding window.** Stop `expires_at` at some absolute distance from `created_at`, so every session dies eventually whether anybody notices or not.
+
+## Decision
+
+**Ship (1). Do not ship (2) — for now, and for stated reasons rather than by omission.**
+
+The own-scoped routes land as `GET /me/sessions`, `POST /me/sessions/revoke` and `POST /me/sessions/revoke-all`, in their own file (`src/bongos/routes/my-sessions.js`), gated on `requireBuilder` alone. Every statement they issue carries `builder_id = <the caller's own id>`, taken from the session the caller presented and never from the query string, the body or the path. `revoke-all` deliberately includes the session making the request: this is the button somebody presses when they believe a token has leaked, and a sweep that spared one session would leave them wondering which. The token value is never selected, never logged and never returned.
+
+**Why no absolute ceiling.** A ceiling and a revoke are aimed at different things, and only one of them was the gap:
+
+- A ceiling is **unconditional**: it signs out every builder, every dev box, every long-running autonomous session on a timer, whether or not anything has gone wrong. Migration 035 already met this problem once, in the small — it backfilled a 24h grace *specifically* so the migration would not kill the session running it — and a ceiling reintroduces that class of breakage permanently rather than once.
+- A ceiling is **slow where it matters**: any cap loose enough not to be a daily nuisance (30 days, 90 days) leaves a leaked token live for weeks. The victim who knows their token leaked does not want it to expire eventually; they want it dead now. That is exactly what (1) gives them, in one request.
+- A ceiling has **no owner-visible upside** once (1) exists. Its remaining value is against a leak nobody ever notices — real, but strictly weaker than the visibility this task also ships: the list surfaces `created_at` beside `last_used_at`, so a session that has been alive for three months is now something a person can *see* and act on, which is the compounding half of the fix.
+- Rank changes already do the sweeping a ceiling would do. `setBuilderRank` calls `revokeAllSessionsForBuilder` on any demotion, and `requireBuilder` denies a deactivated builder on the hot path regardless of a live token, so the authority-drift case a ceiling is often justified by is already closed by other means.
+
+The ceiling stays deliberately unbuilt, not forgotten. What would change the answer is stated below.
+
+### Rejected
+
+- **An absolute `created_at + N` cap now.** Breaks every long-lived box and autonomous session on a timer for a threat the revoke answers faster; and any N large enough to be tolerable is too large to be a remedy.
+- **A shorter TTL.** Same objection, worse: it punishes ordinary use continuously and still does nothing the moment a token is in someone else's hands.
+- **Three more routes inside `routes/auth.js`.** That file is the largest in `src/bongos/routes/` and its admin pair legitimately reads a caller-named target from the request body. Keeping the own-scoped half separate is what lets `tests/own_session_revoke.mjs` assert the no-caller-named-owner rule over a whole file, with no carve-out for a neighbour to hide behind.
+- **A `keep_current` flag on revoke-all.** Configurability nobody asked for: somebody who wants to keep one session revokes the others individually — the list marks which one is current.
+- **404 on a session id that is not yours.** It would confirm which ids exist. A miss answers `revoked: 0`, identically to an id that never existed.
+- **Lowering the `auth.session.revoke` floor instead.** That widens an admin atom to reach *other people's* sessions, which is the opposite of what a self-serve remedy needs.
+
+## Consequences
+
+- A builder at any rank — `xenos` included — can see and kill their own sessions without an Archon. The cross-builder admin pair is untouched and still permission-gated; this is an addition, not a replacement.
+- A session in continuous use still never expires on its own. That is now a *visible* property (the list shows how old each session is) with a one-click remedy, rather than an invisible one with no remedy.
+- The three routes are pinned to `any-builder` in `EXPECTED_RANKS`, so both a later rank gate *and* a later widening to public fail the route-rank auditor loudly.
+- The hall's Settings page grows an "Active sessions" panel with a per-session revoke and a "Sign out everywhere" button. Signing out everywhere from the browser ends that browser session too, so the page sends the builder back to sign-in.
+
+## When to revisit
+
+Add the ceiling if any of these become true:
+
+- Instances start issuing sessions to principals that cannot be asked to notice a leak (machine identities, embedded devices) — those want a cap, because nobody is watching the list.
+- A compliance or hosting requirement names a maximum session age.
+- The session list shows, in practice, that long-lived sessions accumulate faster than people prune them — i.e. the visibility half of this decision turns out not to work.
+
+If it is added, it belongs on `created_at` (a true ceiling), not on the TTL, and it needs the same grace treatment migration 035 gave the 24h TTL, or it will sign out the session that deploys it.