@bongos/core 1.19.550 → 1.19.551

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.550",
-  "core_contract": "1.19.550",
-  "source_commit": "c1759a04d89ed06abdc8dfe92880259633704aeb",
+  "core_version": "1.19.551",
+  "core_contract": "1.19.551",
+  "source_commit": "de0b6c99753fd502f2356bcfb6bf338227445cc7",
   "source_ref": "HEAD",
-  "built_at": "2026-09-04T18:42:59.133Z",
+  "built_at": "2026-09-04T20:39:18.276Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 441,
+    "docs_redacted": 442,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2013,
+    "functional_verbatim": 2018,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2478,
-  "tree_sha256": "d36204b8544ce3a80ec2ac8a90bd182e3157116d8944fddb8b72468558c0244b",
+  "file_count": 2484,
+  "tree_sha256": "38fea0008aa898d10d6e7388c30a7d422be81dcde8d201172848e551d72d361b",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -29,6 +29,11 @@
       "mode": "0000644",
       "sha256": "90de8b32fb4dac69d6e5c781d78489c36c40f00c4b07f062c0650cff08052203"
     },
+    {
+      "path": ".claude/skills/bug-triage/SKILL.md",
+      "mode": "0000644",
+      "sha256": "85481aea23304149520f1adcb7e2e8ab05b655c269dd2e38a6c04922013e9202"
+    },
     {
       "path": ".claude/skills/builder-backup/SKILL.md",
       "mode": "0000644",
@@ -367,12 +372,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "b1abf8c13f89ba8fe2ebca540d1a8b22fac0ad293595e51f464e189dfaf1a1ad"
+      "sha256": "262491824b5d7b6005c69d8190d50f450320f02dc1333dc7ae029616aff9f018"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "1178634ee16c7b1a83defe0c6ece5754a92901370ce18f114a84d3922f7065ca"
+      "sha256": "fd5d716ec3ba7fbdb9fdaee076ef89048424248139ef7d4ea51c3983866dea90"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -382,17 +387,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "be9e267735c41c695157c01fb82efb9219c2f6769febfa46495395d6dcc887ec"
+      "sha256": "17753bb744e592f7d7871d33399536d9938b1b7d6c6249959bcbb4355688b557"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "73e1e22f18262eb0cb73edfe58aef773f802bae33b68b9ca2e4430403d03d7c9"
+      "sha256": "1b28c414b039d21ab8105d1687cf6d75cde078238ac84b920885772cd5e9bdbf"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "f9c26f336f8b7808ed1c07e844191abd0de7bc39657dda5d0363f5d472b6c2c4"
+      "sha256": "779dc3d8970036513a0f8da8e4846bd6c0d2d4714de38390b14ede249e75a3f6"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1767,12 +1772,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "aef38c3ecd8942f0a38c56cbb390fd3590e785634d24e95660900a5140636b5f"
+      "sha256": "5ec1ca7cb551994a31d644eeebd77795955bac39e6389feaf6e6a5ec0217c911"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "923202b89890cc048769c8b05087181fa06ff126aa80aeaa4d9f669f4d96c27e"
+      "sha256": "40d863b7b46cc3691298f9e48c254cda3b7f4ab23bb008712a55e75764a69dd1"
     },
     {
       "path": "docs/architecture.md",
@@ -2637,7 +2642,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "6085fdda80f0c961067a044b890358fa148415638854029e63f764e262594aeb"
+      "sha256": "e7c193b1cca2fc3f59742e95f921fc65096a32fbbcfba16e4a3950448293a7ba"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2647,7 +2652,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d3af686f65da15d8a3c4e8e291b7c4e2a9c025e2cc78305d509165978412329f"
+      "sha256": "1389ff20919a19aef2fbff28102f596f0ca168c34bc4c4114cf557bbf52627a5"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3644,6 +3649,11 @@
       "mode": "0000644",
       "sha256": "8ae32be783a4ca41637f56626bd83375aa4ae0755e701a0c0170eada8d8303b8"
     },
+    {
+      "path": "migrations/core_232_task_merge_provenance.sql",
+      "mode": "0000644",
+      "sha256": "5ed2ff8117e6650de621a1576062b27f2d6e84faf8860f9cb2aed45323a85aa6"
+    },
     {
       "path": "modules/agents/lib/validate.js",
       "mode": "0000644",
@@ -4042,7 +4052,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "be9e267735c41c695157c01fb82efb9219c2f6769febfa46495395d6dcc887ec"
+      "sha256": "17753bb744e592f7d7871d33399536d9938b1b7d6c6249959bcbb4355688b557"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4282,7 +4292,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "913b7ab33c6785903376b0bf7804d7d8d2db620112b983ae4c0368f33a6b8c0f"
+      "sha256": "57b29298fa5707d3a1d59e78612d2b039b1559d26b8a9116812d5c76e9c3af87"
     },
     {
       "path": "modules/government/config.js",
@@ -4384,6 +4394,11 @@
       "mode": "0000644",
       "sha256": "2b729acbc94c933ff2558d59e3cb811e7725450f0d646f9d9bc89209c1340d0f"
     },
+    {
+      "path": "modules/government/migrations/government_011_task_merge_metic.sql",
+      "mode": "0000644",
+      "sha256": "ccd2cd14103bae00957227d037d41f76adaaddc639bd09808f244b0bc514e702"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -5437,7 +5452,7 @@
     {
       "path": "modules/lifecycle/db-ship.js",
       "mode": "0000644",
-      "sha256": "d300392b7bf802d00ae79c55ad3b0d9413dc9bb56e7e1105f49656b39abb874a"
+      "sha256": "e48d877a5951f02153c7384217421b2b04a3a1fed215b61ac41fc5b0b8355ded"
     },
     {
       "path": "modules/lifecycle/db-tasks.js",
@@ -5452,7 +5467,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "09d40dd2eaae47c4620993ad3db6a6db2d880cc499724d31ceff29604960fd64"
+      "sha256": "df5de732d9484e1bcf801c657c78b618d1a0353a912cdb1ee4fdd2c9f121749c"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -5682,7 +5697,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "0ba020342e32eb552532a3a34a57b19aa4bbe87f0cb89ace0c45f4c301d7a015"
+      "sha256": "366cb9c60952539ab8a946f8cf757754163b6cd6764a6430777b4529c86c6a75"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -7452,12 +7467,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a0768e258949174041e701e168aeab239b06a4e1ccc58298a0438c241a34cc58"
+      "sha256": "c71d59c13b87d9ffbd6c792eb56b26eb434704e855aed3afdfc58914dba02e29"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "24085dcaa56b6f1085b7f75682d68d4f124c7ff51a8eef763a9e2296dfee9e10"
+      "sha256": "6a2c55e98a36d257177254a100569a14bec9b3720931caf9ef265971b81ba319"
     },
     {
       "path": "public-docs/index.html",
@@ -7644,6 +7659,11 @@
       "mode": "0000644",
       "sha256": "afcebfb8e8e8f7041ee9cbfce1e9b8a46a299feb5e6e89ce4e00273135b268db"
     },
+    {
+      "path": "scripts/gds/bug-triage.js",
+      "mode": "0000644",
+      "sha256": "70b8f34cd401395e828bcd7d2b1c3bf508d2f1e0918f998df034efb15b6783b8"
+    },
     {
       "path": "scripts/gds/build-bongos.js",
       "mode": "0000644",
@@ -8702,7 +8722,7 @@
     {
       "path": "scripts/gds/triage.js",
       "mode": "0000644",
-      "sha256": "39cbb3b02f4dd8fab80ad53d39b95c3d94666c65b3eed5fbb38995551d170617"
+      "sha256": "dc494030979bf60de1d1423c68a07e36667e816d7e2a1652960cfbd17be4bfcc"
     },
     {
       "path": "scripts/gds/turn-end-sound.js",
@@ -9147,7 +9167,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9ac49d0373037ef2fa93837e2483adb5bda5c40514a2c8458489092c03f4d9fc"
+      "sha256": "95e7b476152291d84e955bfd585e62c48c48d85dcab0ca8d73c4519af2997e8b"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9197,7 +9217,7 @@
     {
       "path": "tests/abandon_task.mjs",
       "mode": "0000644",
-      "sha256": "031b75aeb83322055c4d69ab5481b220a7a41ccbe950129b84f8bc80d7c75a40"
+      "sha256": "ccfb5d3e85fd6bd34acc78d510edf20d037d344eca58706f3e3130fa6dce611c"
     },
     {
       "path": "tests/access_requests_invite.mjs",
@@ -9599,6 +9619,11 @@
       "mode": "0000644",
       "sha256": "b9303554061efaea510ef42d774ab9017ac7258cc0bc08f684abca7408b3fa86"
     },
+    {
+      "path": "tests/bug_triage.mjs",
+      "mode": "0000644",
+      "sha256": "2bc6312ff72fffc04478d40adc60e57e031b52ed208adf1d88f78986e536623f"
+    },
     {
       "path": "tests/build_info.mjs",
       "mode": "0000644",
@@ -12214,6 +12239,11 @@
       "mode": "0000644",
       "sha256": "bc89502f571659477178d68047098cf6098030491ac5c5a82b46802474a48387"
     },
+    {
+      "path": "tests/task_merge.mjs",
+      "mode": "0000644",
+      "sha256": "2a16f120729c641de65cccf79f1583e2d2e68b72bf10277310991c1787dde2bf"
+    },
     {
       "path": "tests/task_ownership_gate.mjs",
       "mode": "0000644",

package/.claude/skills/bug-triage/SKILL.md

@@ -0,0 +1,191 @@
+---
+name: bug-triage
+description: >-
+  Daily walk through open kind=bug tasks, which land with no triage gate and
+  accumulate near-duplicates. Groups likely dups for one batch verdict, then
+  walks what's left: merge into a canonical task or won't-fix. Mirrors
+  /idea-triage. Triggers on "/bug-triage", "triage bugs", "walk the bug
+  queue", "dedupe bugs". Metic+ rank only (not Xenos/Thetes).
+---
+
+You are running the bug-triage session for Example. Open `kind=bug` tasks get
+walked and verdicted, so near-duplicate reports don't sit forever as separate
+claimable rows.
+
+## Why this exists (task 1001478, idea 244)
+
+Since task 1003071, a `#bugs` report routes straight to a `kind=bug` task at
+filing time — no inbox stop, no gate. That is correct for getting a report
+into the queue fast, but it means nothing ever folds two reports of the same
+underlying bug together the way `/idea-triage` folds duplicate ideas. This
+skill is that missing step, built on a **task-merge primitive** (`tasks`
+gained `merged_into_task_id` + `triage_note` in `core_232`, mirroring
+`idea_inbox`'s `merged_into_idea_id` from `core_195`) that did not exist
+before this task.
+
+**A merge is `abandoned` + a target, not a new status.** `tasks.status` has no
+`'merged'` value — adding one would touch every place that already enumerates
+task statuses (the claimable feed, dependency satisfaction, the diagrams
+state machine) to answer a question `abandoned` already answers: this task is
+retired, and by owner ruling its dependents are stranded, not waiting (see
+`modules/lifecycle/CLAUDE.md`). `merged_into_task_id` carries the one thing
+bare abandon can't: which task absorbed it. Read `modules/lifecycle/db-ship.js`
+`mergeTask`'s header comment for the full guard list before touching this
+surface.
+
+## Rank gate — Metic+ only
+
+**Gated to Metic+ (Metic, Archon); not Xenos or Thetes.** Merging or
+won't-fixing a bug task reshapes the team's backlog the same way idea triage
+does — `task.merge` and `task.abandon` are both floor-`metic` permissions
+(`modules/government/catalog.js`). A sub-Metic can still **file** a bug (via
+Discord `#bugs`, or `POST /tasks` if `task.create` allows it); they can't
+verdict the queue.
+
+**Enforce the gate at the very top of the session, before reading anything else:**
+
+1. Call `GET /api/gds/me` and read `builder.rank`. Compare case-insensitively.
+2. **If `rank` lowercases to `xenos` or `thetes`** → stop immediately. Tell the
+   builder: *"Bug triage is a Metic+ operation — merging or dismissing a bug
+   report reshapes the team's backlog. File new bugs via Discord `#bugs`;
+   ask an Archon to promote you if you need to triage them."* Do not list
+   open bugs, do not propose verdicts.
+3. **If `rank` lowercases to `metic` or `archon`** → proceed below.
+4. **If `rank` is absent** (pre-rank deployment) → treat the session as
+   available, the same pre-rank passthrough `/idea-triage` uses.
+
+> Belt-and-braces: the server already rejects `POST /tasks/:id/merge` and
+> `POST /tasks/:id/abandon` with `403 permission_forbidden` for a sub-Metic
+> caller — this check just stops one early instead of after a wall of 403s.
+
+## What this skill does
+
+1. Lists open `kind=bug` tasks via `GET /api/gds/tasks?kind=bug&limit=1000`,
+   filtered to the still-open statuses (`backlog`, `ready`, `active`,
+   `blocked`, `completed`, `confirmed` — never `shipped` or `abandoned`,
+   the latter of which already includes merged-away duplicates).
+2. **Batches near-duplicate bug tasks** into one verdict per cluster
+   (`node scripts/gds/bug-triage.js`'s reuse of `triage.js`'s `clusterRecords`
+   — the same union-find/Jaccard core `/idea-triage`'s `clusterIdeas` uses,
+   generalized in task 1001478 so the algorithm is written once). Partitioned
+   by `goal_id`, not `kind` — every row here is already `kind='bug'`, so a
+   kind gate would be a no-op; two bug reports in unrelated goals describing
+   similar-sounding symptoms are not the same triage decision.
+3. For each remaining bug, prompts the user with: **merge** (this is the same
+   report as task N) or **won't-fix** (not a bug / already fixed / can't
+   reproduce — closes the report itself, folds into nothing).
+4. Applies each verdict via `POST /api/gds/tasks/:id/merge` or
+   `POST /api/gds/tasks/:id/abandon`.
+
+**No "promote" step, unlike `/idea-triage`.** A bug report is already a task —
+there is no shape question (goal vs criterion vs task) to work out, because
+`task-classifier.js`'s auto-routing already decided `kind=bug` at capture
+time. The only two questions triage adds are "is this the same as an existing
+report" and "should this report be closed at all".
+
+## How to use
+
+**Step 1 — fetch open bug tasks.**
+
+```
+node scripts/gds/api.js GET "/api/gds/tasks?kind=bug&limit=1000"
+```
+
+Filter client-side to the open statuses above. If nothing remains, print "bug
+queue empty — nothing to triage today" and stop.
+
+For a human at a terminal, `node scripts/gds/bug-triage.js` runs the whole
+walk interactively instead — batching, per-task prompts, and the summary all
+in one command, same shape as `node scripts/gds/triage.js`.
+
+**Step 1.5 — batch near-duplicate bug reports BEFORE walking individually.**
+
+Run `clusterRecords` (`scripts/gds/triage.js`, pure, no I/O) with
+`textOf: t => t.title + ' ' + t.description`, `kindOf: t => t.goal_id`,
+`timeOf: t => new Date(t.created_at)`. For each cluster it returns, offer the
+user ONE decision covering the whole group:
+
+> Cluster of 3 likely duplicates: #501 "Login button does nothing on
+> Safari", #517 "Safari: login unresponsive", #530 "Login broken in Safari".
+> **Keep #501 and merge the rest, dismiss all as won't-fix, walk them
+> individually, or skip?**
+
+- **Keep #N** → merge every other member into #N (`POST /tasks/:id/merge
+  {"into_task_id": N}`), leaving #N itself open — it still gets the normal
+  Step 2 walk below, since "which report is the real one" and "should it stay
+  open" are different decisions.
+- **Won't-fix all** → every member abandoned with one shared reason.
+- **Individually** → ignore the grouping for this cluster; each member
+  returns to the normal walk.
+- **Skip** → leave the whole cluster open; it clusters again next triage.
+
+`node scripts/gds/bug-triage.js` already runs this pass automatically before
+its interactive walk — a human running the deterministic walker gets it for
+free with no flag.
+
+**Step 2 — walk the list, task by task.**
+
+Present each remaining bug with:
+- id, status, title
+- description (full)
+- goal_id, created_at
+
+Then ask the user (concise prompt — the owner may not be a software engineer,
+CLAUDE.md §2's portable default; frame in product/outcome terms, not
+implementation):
+
+> Bug #N: "{title}". {one-sentence summary of the report}. **Is this a
+> duplicate of an existing bug, should it be closed as won't-fix, or should
+> it stay open?**
+
+**Step 3 — apply the verdict.**
+
+**Merge** → ask which existing task N is the canonical one, then fold this
+report into it:
+
+```
+node scripts/gds/api.js POST /api/gds/tasks/<id>/merge --body '{"into_task_id":<N>,"reason":"same report as #N"}'
+```
+
+The server refuses a self-merge (`merge_self`), a shipped source
+(`cannot_merge_shipped`), a task with an active claim
+(`task_has_active_claim`), a target that doesn't exist
+(`merge_target_not_found`), and a target that is itself merged elsewhere
+(`merge_target_merged` — it names where the chain ends; retarget there
+instead of re-merging).
+
+**Won't-fix** → dismiss with a reason (not a bug / already fixed / cannot
+reproduce):
+
+```
+node scripts/gds/api.js POST /api/gds/tasks/<id>/abandon --body '{"reason":"cannot reproduce on current build"}'
+```
+
+**Keep open** is implicit — leave the task un-patched by not calling either
+route. It will surface again next triage.
+
+**Step 4 — surface a summary.**
+
+Report to the user:
+- Total walked
+- Merged (count + which task each folded into)
+- Won't-fixed (count + ids)
+- Skipped / left open (count — these surface again next session)
+- Remaining open bug count
+
+## Why we run this
+
+The same reason `/idea-triage` runs daily: a queue nobody walks quietly fills
+with near-duplicates that each cost a separate builder's attention to
+discover independently. A fast pass with mostly "skip" verdicts beats
+skipping the session entirely — the cadence is the discipline.
+
+## Tone for the user
+
+The owner is the prompter (CLAUDE.md §2's portable default). Frame merge/
+won't-fix decisions in terms of what's actually broken for the end user, not
+implementation: "these
+are the same login failure reported twice" not "these share 71% word
+overlap." Decide the mechanical merge target yourself; ask the human only
+when two reports are genuinely ambiguous (different symptoms that might
+share one root cause, say) rather than obviously the same.

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 355 operations across 55 resource groups
+- 356 operations across 55 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -849,6 +849,8 @@ function createClient(opts = {}) {
       deleteTasksIdDependenciesDepId: (args) => request("DELETE", "/tasks/{id}/dependencies/{depId}", { hasBody: false }, args),
       // POST /tasks/{id}/grade — rank: any-builder — POST /tasks/:id/grade
       postTasksIdGrade: (args) => request("POST", "/tasks/{id}/grade", { hasBody: true }, args),
+      // POST /tasks/{id}/merge — rank: metic+archon — POST /tasks/:id/merge
+      postTasksIdMerge: (args) => request("POST", "/tasks/{id}/merge", { hasBody: true }, args),
       // POST /tasks/{id}/override-request — rank: any-builder — POST /tasks/:id/override-request
       postTasksIdOverrideRequest: (args) => request("POST", "/tasks/{id}/override-request", { hasBody: true }, args),
       // POST /tasks/{id}/promote — rank: metic+archon — POST /tasks/:id/promote

package/clients/bongos-client/index.cjs

@@ -848,6 +848,8 @@ function createClient(opts = {}) {
       deleteTasksIdDependenciesDepId: (args) => request("DELETE", "/tasks/{id}/dependencies/{depId}", { hasBody: false }, args),
       // POST /tasks/{id}/grade — rank: any-builder — POST /tasks/:id/grade
       postTasksIdGrade: (args) => request("POST", "/tasks/{id}/grade", { hasBody: true }, args),
+      // POST /tasks/{id}/merge — rank: metic+archon — POST /tasks/:id/merge
+      postTasksIdMerge: (args) => request("POST", "/tasks/{id}/merge", { hasBody: true }, args),
       // POST /tasks/{id}/override-request — rank: any-builder — POST /tasks/:id/override-request
       postTasksIdOverrideRequest: (args) => request("POST", "/tasks/{id}/override-request", { hasBody: true }, args),
       // POST /tasks/{id}/promote — rank: metic+archon — POST /tasks/:id/promote

package/clients/bongos-client/index.d.ts

@@ -371,6 +371,7 @@ export interface PostTasksIdDemoteResponse { ok: boolean }
 export interface PostTasksIdDependenciesRequest { depends_on_task_ids?: unknown[]; depends_on_task_id?: StringifiableId }
 export interface PostTasksIdDependenciesResponse { ok: boolean; added: unknown; dependencies: unknown }
 export interface PostTasksIdGradeRequest { subagent_output?: unknown; signals?: Record<string, unknown>; committed_files?: string[]; diff_hash?: string }
+export interface PostTasksIdMergeRequest { into_task_id: number; reason?: string }
 export interface PostTasksIdOverrideRequestRequest { rationale: string }
 export interface PostTasksIdOverrideRequestResponse { ok: boolean; request: unknown }
 export interface PostTasksIdPublishBranchRequest { branch: string; head_sha: string; bundle_b64: string; value_summary?: string }
@@ -1172,6 +1173,8 @@ export interface BongosClient {
     deleteTasksIdDependenciesDepId(args?: RequestArgs): Promise<DeleteTasksIdDependenciesDepIdResponse>;
     /** POST /tasks/{id}/grade — rank: any-builder */
     postTasksIdGrade(args?: RequestArgs & { body?: PostTasksIdGradeRequest }): Promise<ApiResponse>;
+    /** POST /tasks/{id}/merge — rank: metic+archon */
+    postTasksIdMerge(args: RequestArgs & { body: PostTasksIdMergeRequest }): Promise<ApiResponse>;
     /** POST /tasks/{id}/override-request — rank: any-builder */
     postTasksIdOverrideRequest(args: RequestArgs & { body: PostTasksIdOverrideRequestRequest }): Promise<PostTasksIdOverrideRequestResponse>;
     /** POST /tasks/{id}/promote — rank: metic+archon */

package/clients/bongos-client/index.mjs

@@ -845,6 +845,8 @@ export function createClient(opts = {}) {
       deleteTasksIdDependenciesDepId: (args) => request("DELETE", "/tasks/{id}/dependencies/{depId}", { hasBody: false }, args),
       // POST /tasks/{id}/grade — rank: any-builder — POST /tasks/:id/grade
       postTasksIdGrade: (args) => request("POST", "/tasks/{id}/grade", { hasBody: true }, args),
+      // POST /tasks/{id}/merge — rank: metic+archon — POST /tasks/:id/merge
+      postTasksIdMerge: (args) => request("POST", "/tasks/{id}/merge", { hasBody: true }, args),
       // POST /tasks/{id}/override-request — rank: any-builder — POST /tasks/:id/override-request
       postTasksIdOverrideRequest: (args) => request("POST", "/tasks/{id}/override-request", { hasBody: true }, args),
       // POST /tasks/{id}/promote — rank: metic+archon — POST /tasks/:id/promote

package/docs/api/openapi.json

@@ -15213,6 +15213,65 @@
         ]
       }
     },
+    "/tasks/{id}/merge": {
+      "post": {
+        "operationId": "post_tasks_id_merge",
+        "tags": [
+          "tasks"
+        ],
+        "summary": "POST /tasks/:id/merge",
+        "description": "POST /tasks/:id/merge — mark a duplicate task merged into its canonical one (task 1001478 — the /bug-triage counterpart to idea_inbox's merge verdict). Implemented as `abandonTask` plus a target (db.mergeTask, db-ship.js) rather than a new `tasks.status` value — see that function's header for why. Refuses a self-merge, a shipped task, a task with an active claim, a target that doesn't exist, and a target that is itself merged elsewhere (no chains); idempotent when re-merging into the SAME target already recorded. rank: metic+archon — same floor as task.abandon, which this reuses under the hood; a Metic who may retire a task may also say which task it duplicates.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `task.merge` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/lifecycle/routes/tasks.js",
+        "x-permissions": [
+          "task.merge"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostTasksIdMergeRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/tasks/{id}/override-request": {
       "post": {
         "operationId": "post_tasks_id_override_request",
@@ -21790,6 +21849,22 @@
         },
         "additionalProperties": false
       },
+      "PostTasksIdMergeRequest": {
+        "type": "object",
+        "properties": {
+          "into_task_id": {
+            "type": "integer",
+            "minimum": 1
+          },
+          "reason": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "into_task_id"
+        ],
+        "additionalProperties": false
+      },
       "PostTasksIdOverrideRequestRequest": {
         "type": "object",
         "properties": {
@@ -22384,8 +22459,8 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 355,
-  "x-schema-count": 390,
+  "x-endpoint-count": 356,
+  "x-schema-count": 391,
   "x-undocumented-bodies": 9,
   "x-response-schemas": 265,
   "x-generated-by": "scripts/gds/gen-api-docs.js"

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 355 endpoints across 58 route files.
+> **Generated from the live route files** — the route file is authoritative. 356 endpoints across 58 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -581,7 +581,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | GET | `/api/bongos/task-visuals/:name` | `public` | — | the WIDEST path this route can take, declared honestly. |
 
-## `tasks` (31)
+## `tasks` (32)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -601,6 +601,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | PUT | `/api/bongos/tasks/:id/dependencies` | `metic+archon` | `depends_on_task_ids` | PUT /tasks/:id/dependencies — replace the full dep set. |
 | DELETE | `/api/bongos/tasks/:id/dependencies/:depId` | `metic+archon` | — | DELETE /tasks/:id/dependencies/:depId — removes the edge. |
 | POST | `/api/bongos/tasks/:id/grade` | `any-builder` | `subagent_output`, `signals`, `committed_files`, `diff_hash` | GDS-V3 task V3.R18 (task 209). |
+| POST | `/api/bongos/tasks/:id/merge` | `metic+archon` | `into_task_id`, `reason` | POST /tasks/:id/merge — mark a duplicate task merged into its canonical one (task 1001478 — the /bug-triage counterpart to idea_inbox's m… |
 | POST | `/api/bongos/tasks/:id/override-request` | `any-builder` | `rationale` | POST /tasks/:id/override-request — V3.R74 (task 293). |
 | POST | `/api/bongos/tasks/:id/promote` | `metic+archon` | — | backlog→ready promotion; scope mutation; ADR 0090 (was archon). |
 | POST | `/api/bongos/tasks/:id/publish-branch` | `any-builder` | `branch`, `head_sha`, `bundle_b64`, `value_summary` |  |

package/docs/file-map.md

@@ -375,6 +375,7 @@ tests/
 .claude/skills/
 ├── blocker-review/SKILL.md        ← /blocker-review — daily review of open GDS blockers (resolve / escalate / note); Metic+
 ├── blocker-solve/SKILL.md         ← /blocker-solve N — drive ONE blocker to done: do the doable parts, hand back owner-only steps, verify, auto-resolve (auto-promotes waiters); Metic+
+├── bug-triage/SKILL.md            ← /bug-triage — daily walk through open kind=bug tasks (batch-cluster near-dups, merge / won't-fix); the idea-triage counterpart built on the new tasks.merge primitive (task 1001478); Metic+
 ├── builder-backup/SKILL.md        ← /builder-backup — check DB backup status or trigger a fresh local dump before risky changes (migrations, destructive SQL); no SSH required
 ├── builder-box/SKILL.md           ← /builder-box — show the builder their own dev box (state, IP/host, cost, SSH keys) and help them (re)connect
 ├── builder-claim/SKILL.md         ← /builder-claim N — atomic claim; prints the claim-time context pack + discipline playbook routing

package/docs/module-api-changelog.md

@@ -1549,5 +1549,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.548 with no explicit bump. run 33906859934. (task 1002620)
   1.19.550 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.549 with no explicit bump. run 33907331050. (task 1002620)
+  1.19.551 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.550 with no explicit bump. run 33917261720. (task 1002620)
 ---------------------------------------------------------------------------
 ```