@bongos/core 1.19.646 → 1.19.648

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.646",
-  "core_contract": "1.19.646",
-  "source_commit": "9648a16f755cae6136582c0d0ca4930a566a11af",
+  "core_version": "1.19.648",
+  "core_contract": "1.19.648",
+  "source_commit": "0606a231569b44bdc2521fcee567031ea8ea6f08",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T18:10:26.956Z",
+  "built_at": "2026-09-10T19:06:50.891Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 470,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2106,
+    "functional_verbatim": 2109,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2600,
-  "tree_sha256": "69d3719087a6b6e7fb7c1a0d4889c6bf272f0258a7d7cc72458179525775f6df",
+  "file_count": 2603,
+  "tree_sha256": "3260c3c3da2ae8a6b6630824444ada3145268a70b9194585231bb3391392db80",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -362,12 +362,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "65fb7649709e966a90f431d57b8855bd39951684a754320c4a797da9e3ccac13"
+      "sha256": "03379a98721207feab9a9b4c03862051ee6d52a29a0bc467ed73ae1d36bf49cd"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "ea404e8d932d396796888692651965072cb8d828b3d6e9ebb93bc205fb00f7b9"
+      "sha256": "ec75333abb0ee49b89320a86e73b56f2f3872c13c596b1e67f36e705b8ba1210"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -377,17 +377,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "a6fb1af25ba5d2ef74cee69f2e126811d535b193422d44ee6f2f4efb787d7584"
+      "sha256": "bce3dcdbe37505e0fa526e02b7b379ca9ab378f6c34b41345621d55170d9f19d"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "c109144665c545407dc0a56a8d08e77b277d7a1636ab3740d0e81e43c563f616"
+      "sha256": "5ef1befd1a1b30e8ef9e8b8ca08f768361d2422f6ddba2160a5395d46a84d443"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "0b96a51d69f2aeb6485eea84d80254ee1a4f90a8292c6b33e9bb89075f8cc187"
+      "sha256": "3fbcb50de89350e95b86180e828a16b897be32a1f8b4cdf78cc060e1c5afff86"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1892,12 +1892,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "72bfc066767c1c7301516d4f747c8a29725c2d623b5be1d916e6baa11e20a988"
+      "sha256": "6c5f26c9c00387ecc84ed80726a4d62eca0f017f1d75c304d758961749fe616f"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "ac3c10aa8cc2cdad0d6878a7b2c51bb668b5207a2cd9649ee87da871e190494e"
+      "sha256": "d63a4ab6e92a24d339a632360fb92246512e09eabbc5bff632881bda6d4abf50"
     },
     {
       "path": "docs/architecture.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f4ceea78bdb8f6ba5fec64415aed58610a8ab011d3a8b550e517515904c8cfce"
+      "sha256": "f646af7c4521017e44e5dfef0b160c18907bfa0f07b5986603593485a34f2742"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3814,6 +3814,11 @@
       "mode": "0000644",
       "sha256": "06b53d66e710dfbf602011459ec8d69adce8e281632927daea0735f8078b2f86"
     },
+    {
+      "path": "migrations/core_237_box_widen_paths.sql",
+      "mode": "0000644",
+      "sha256": "2cda282b43ea71dd82ddf4e5ece90f11ad4013cbee0820f0a33391f202feff9c"
+    },
     {
       "path": "modules/agents/lib/validate.js",
       "mode": "0000644",
@@ -4212,7 +4217,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "a6fb1af25ba5d2ef74cee69f2e126811d535b193422d44ee6f2f4efb787d7584"
+      "sha256": "bce3dcdbe37505e0fa526e02b7b379ca9ab378f6c34b41345621d55170d9f19d"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4222,7 +4227,7 @@
     {
       "path": "modules/dev-box/box-access.js",
       "mode": "0000644",
-      "sha256": "a51e16aba67547c0692d9422587f83d8ce40f0e45830463b80bfd188401eb6c0"
+      "sha256": "7bc7c746f2518cb465773a205c8e9fe7efc30852c857001255be92ad8e340bca"
     },
     {
       "path": "modules/dev-box/box-credential.js",
@@ -4237,7 +4242,7 @@
     {
       "path": "modules/dev-box/boxes.js",
       "mode": "0000644",
-      "sha256": "a56b75218b3ac3fed0bb495b9c7f41b2794dafa5f3e6ec28cbb21a97e9b25b7b"
+      "sha256": "667993d81db36e1ddd1307013044f3d40b6baca3c6f5271b77332d10fa290063"
     },
     {
       "path": "modules/dev-box/db.js",
@@ -4252,7 +4257,7 @@
     {
       "path": "modules/dev-box/routes/box.js",
       "mode": "0000644",
-      "sha256": "bbe6ed7344f7e5dd1d4dba79e636f4bc02806d25193edb0609f41c850ffbad4c"
+      "sha256": "b61996de3fa3dbdc9b8fb639fd53aba5c1c2567350dc602b39ebbbd3a93164ac"
     },
     {
       "path": "modules/discord/CLAUDE.md",
@@ -5657,7 +5662,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "d8cce5b44106009987d3d32b711a114e4505b4e504bbc6fdfc84f161024ee0cd"
+      "sha256": "fb6503bdaf013a13752968844693cbf957484f033b9df27a66f93eacb91c2cfa"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -5667,7 +5672,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "95ff6bc6e9f4ad652dc2aa6bc2c7c520409a2115c714cb4ba867fc80413691e8"
+      "sha256": "a568b425560d8d8f4523995442454233b69016a31934810c5d4b7d83baab0b09"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -5897,7 +5902,7 @@
     {
       "path": "modules/lifecycle/routes/task-write-routes.js",
       "mode": "0000644",
-      "sha256": "cc86b3c05885c733cc28ba6e41f1b08cb8f0fe652e3181c1c88be4caabf18d61"
+      "sha256": "25bfb492572d553dbd19595addc0c337706ac2c83df71fb04d7fa199b07b715b"
     },
     {
       "path": "modules/lifecycle/routes/tasks.js",
@@ -7722,12 +7727,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8def408bd91446b93b180b2696465b9bedaf1f8ebe15c671cd4f66a41f6b03da"
+      "sha256": "83135ce62c34647b4bc57872526cb9f550a9fef2148c585839d57c600763961b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "62ee3c0059ddc570ef2fef4f2288b7714d9eb95f64d390f67720eb7d07c92cd5"
+      "sha256": "a9a2455f79599041389b23a18607666ce74eba9be0199d21fbc62553824463f6"
     },
     {
       "path": "public-docs/index.html",
@@ -7917,7 +7922,7 @@
     {
       "path": "scripts/gds/box-sync.js",
       "mode": "0000644",
-      "sha256": "981544bfd56d486c2017edd744c86089659771a74399b4780455821c45e3b3a9"
+      "sha256": "33a79ddd2049419fe7df09cd7b5fe3da9163728a36bc8fe1351d89dcf2463a11"
     },
     {
       "path": "scripts/gds/box.js",
@@ -8862,7 +8867,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "9853e719e4a695cc52ec9089298d05163210ed3b51ca9eceb7553bc0ed9c65bd"
+      "sha256": "8bf28a3d4d15e83a1e94416ec2519d39bc2a3faa71303a4f2d22d429b6afaa95"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -9482,7 +9487,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "bb3a06612cea7d25b04efabda8659ed8a71b66859bab279f9b4e8a1e5dbadff3"
+      "sha256": "dadc321fdd8e6a6f856bb9260c555284b9859361c556d47b14b25df45db900b0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9862,7 +9867,7 @@
     {
       "path": "tests/box_access.mjs",
       "mode": "0000644",
-      "sha256": "fcad6c578c2d8698d6ad93fe04f500734d589013590f006910f1bc33fc908642"
+      "sha256": "911a764f72976298daa17855acb836d0ada3215b480961ae8607e1fc3634f882"
     },
     {
       "path": "tests/box_auth_check.mjs",
@@ -9932,7 +9937,7 @@
     {
       "path": "tests/box_sync_scope_report.mjs",
       "mode": "0000644",
-      "sha256": "010525c500aa1d5133f85a1a2ea7c23e9a680b08493a6f3b78c69a5108501468"
+      "sha256": "4b1df674e2e53ce9d521bab3c43c2b3959dee7daa51b97dfa9b23c20e2a41f94"
     },
     {
       "path": "tests/box_task_scope.mjs",
@@ -11142,7 +11147,7 @@
     {
       "path": "tests/home_bounded_reads.mjs",
       "mode": "0000644",
-      "sha256": "186a8ebd04cd4dc8021b3a36699468e9c0bcf78ca61ce9f7be7c3e25c632fb3e"
+      "sha256": "6853241b64b5f71dfb782956a4fab468a05aa2a9ee41d5159a4cbea5f0424f38"
     },
     {
       "path": "tests/hook_core_resolve.mjs",
@@ -11429,6 +11434,11 @@
       "mode": "0000644",
       "sha256": "7fa36152b6dbb17b2855d261ddbea96af63d26f97001273cd131104235ea431d"
     },
+    {
+      "path": "tests/lifecycle_facade_surface.mjs",
+      "mode": "0000644",
+      "sha256": "cc14604bf130022ce2533247d29187da6260a791f850f73051bd522252d1b115"
+    },
     {
       "path": "tests/linkify_check.mjs",
       "mode": "0000644",
@@ -11547,7 +11557,7 @@
     {
       "path": "tests/migration_allocation.mjs",
       "mode": "0000644",
-      "sha256": "0d1bc299555d98aa2ad8571e0a5a185776ca727f95577c3308a7e4b36efbfd97"
+      "sha256": "e9271b1a67d201cfd075ce272b1a5a4f3b66c80dcfa5798ca3ea0d3f5048be43"
     },
     {
       "path": "tests/migration_namespace.mjs",
@@ -11787,7 +11797,12 @@
     {
       "path": "tests/patch_gate_ordering.mjs",
       "mode": "0000644",
-      "sha256": "27a3b5023b6857f3f53734966bc7685757383f2b8dadfa3c0bf1aca2e7db5517"
+      "sha256": "db5e934ef61ddc8dc5804f25a9c84c04f30570db708fd6c77a157e101c69b4d4"
+    },
+    {
+      "path": "tests/patch_value_summary_e2e.mjs",
+      "mode": "0000644",
+      "sha256": "86f60e682284c5f36fa23c6df0ec8b137f40cc548562d6c4496d11d200edb9bf"
     },
     {
       "path": "tests/path_match.mjs",
@@ -12517,7 +12532,7 @@
     {
       "path": "tests/ship_cannot_lie.mjs",
       "mode": "0000644",
-      "sha256": "d8d99b6cd465b04eaf13790b0bdfe9a76ce36d77660407d3a2c6a17ac7852e8c"
+      "sha256": "18a3bb613fff3dcc0dfbffb2283a866726af4347c161fc28853b36b5bdd75512"
     },
     {
       "path": "tests/ship_card.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 360 operations across 55 resource groups
+- 362 operations across 55 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -205,6 +205,10 @@ function createClient(opts = {}) {
       postBoxTerminal: (args) => request("POST", "/box/terminal", { hasBody: true }, args),
       // POST /box/version — rank: any-builder — POST /box/version
       postBoxVersion: (args) => request("POST", "/box/version", { hasBody: true }, args),
+      // GET /box/widen — rank: any-builder — GET /box/widen
+      getBoxWiden: (args) => request("GET", "/box/widen", { hasBody: false }, args),
+      // POST /box/widen — rank: any-builder — POST /box/widen
+      postBoxWiden: (args) => request("POST", "/box/widen", { hasBody: true }, args),
     },
     "boxes": {
       // GET /boxes — rank: metic+archon — GET /boxes

package/clients/bongos-client/index.cjs

@@ -204,6 +204,10 @@ function createClient(opts = {}) {
       postBoxTerminal: (args) => request("POST", "/box/terminal", { hasBody: true }, args),
       // POST /box/version — rank: any-builder — POST /box/version
       postBoxVersion: (args) => request("POST", "/box/version", { hasBody: true }, args),
+      // GET /box/widen — rank: any-builder — GET /box/widen
+      getBoxWiden: (args) => request("GET", "/box/widen", { hasBody: false }, args),
+      // POST /box/widen — rank: any-builder — POST /box/widen
+      postBoxWiden: (args) => request("POST", "/box/widen", { hasBody: true }, args),
     },
     "boxes": {
       // GET /boxes — rank: metic+archon — GET /boxes

package/clients/bongos-client/index.d.ts

@@ -29,6 +29,7 @@ export interface GetBoxMeResponse { box: unknown; open_intent: unknown; cost: un
 export interface GetBoxSourceAccessResponse { scope: unknown; mode: unknown; sparse_paths: unknown; repo_url: unknown; credential: unknown; configured: unknown; separate_starter_repo: unknown; expires_at: unknown; ttl_seconds: unknown; guidance: unknown }
 export interface GetBoxSshKeyResponse { keys: unknown }
 export interface GetBoxTerminalResponse { state: unknown; url: unknown; credential: unknown; hint: unknown; warming_up?: boolean; terminal_at?: unknown }
+export interface GetBoxWidenResponse { widen_paths: unknown; admitted: unknown; ignored: unknown; max: unknown }
 export interface GetBoxesResponse { boxes: unknown }
 export interface GetBuildersDirectoryResponse { builders: unknown }
 export interface GetBuildersIdActiveClaimsResponse { builder_id: unknown; claims: unknown; stale_hours: unknown; stale_hours_source: unknown }
@@ -182,7 +183,7 @@ export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; descr
 export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; planet: unknown; push: unknown }
 export interface PatchTaskRecommendationsIdRequest { status: "declined" | "withdrawn" }
 export interface PatchTaskRecommendationsIdResponse { ok: boolean; recommendation: unknown }
-export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; description?: string; title?: string; priority?: unknown; status?: unknown }
+export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; description?: string; title?: string; priority?: unknown; value_summary?: string; status?: unknown }
 export interface PostAccessRequestsInviteRequest { github_login: string }
 export interface PostAccessRequestsInviteResponse { ok: boolean; already_invited?: boolean; github_login?: unknown; request?: unknown }
 export interface PostAccessRequestsRequest { github_login: string; display_name?: string; note?: string }
@@ -222,6 +223,8 @@ export interface PostBoxTerminalRequest { url: string; credential?: string }
 export interface PostBoxTerminalResponse { ok: boolean; state: unknown }
 export interface PostBoxVersionRequest { sha: string; committed_at?: string }
 export interface PostBoxVersionResponse { ok: boolean; state: unknown }
+export interface PostBoxWidenRequest { add?: unknown[]; remove?: unknown[]; clear?: boolean }
+export interface PostBoxWidenResponse { ok: boolean; widen_paths: unknown; admitted: unknown; ignored: unknown; max: unknown }
 export interface PostBoxesBuilderIdCloseResponse { ok: boolean; queued: unknown; action: unknown; state: unknown; message: unknown }
 export interface PostClaimsBatchReleaseRequest { claim_ids: unknown[]; force?: boolean }
 export interface PostClaimsBatchReleaseResponse { released: unknown; failures: unknown }
@@ -536,6 +539,10 @@ export interface BongosClient {
     postBoxTerminal(args: RequestArgs & { body: PostBoxTerminalRequest }): Promise<PostBoxTerminalResponse>;
     /** POST /box/version — rank: any-builder */
     postBoxVersion(args: RequestArgs & { body: PostBoxVersionRequest }): Promise<PostBoxVersionResponse>;
+    /** GET /box/widen — rank: any-builder */
+    getBoxWiden(args?: RequestArgs): Promise<GetBoxWidenResponse>;
+    /** POST /box/widen — rank: any-builder */
+    postBoxWiden(args?: RequestArgs & { body?: PostBoxWidenRequest }): Promise<PostBoxWidenResponse>;
   };
   "boxes": {
     /** GET /boxes — rank: metic+archon */

package/clients/bongos-client/index.mjs

@@ -201,6 +201,10 @@ export function createClient(opts = {}) {
       postBoxTerminal: (args) => request("POST", "/box/terminal", { hasBody: true }, args),
       // POST /box/version — rank: any-builder — POST /box/version
       postBoxVersion: (args) => request("POST", "/box/version", { hasBody: true }, args),
+      // GET /box/widen — rank: any-builder — GET /box/widen
+      getBoxWiden: (args) => request("GET", "/box/widen", { hasBody: false }, args),
+      // POST /box/widen — rank: any-builder — POST /box/widen
+      postBoxWiden: (args) => request("POST", "/box/widen", { hasBody: true }, args),
     },
     "boxes": {
       // GET /boxes — rank: metic+archon — GET /boxes

package/docs/api/openapi.json

@@ -2275,6 +2275,91 @@
         ]
       }
     },
+    "/box/widen": {
+      "get": {
+        "operationId": "get_box_widen",
+        "tags": [
+          "box"
+        ],
+        "summary": "GET /box/widen",
+        "description": "GET /box/widen — the caller's own recorded widen set (task 1003087). rank: any authenticated builder, own resource. Reports what is STORED plus what is currently ADMITTED, because those differ whenever a request sits outside the builder's rank scope — showing only the stored list would let a Xenos believe a widen took effect that the fetch quietly drops.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/dev-box/routes/box.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetBoxWidenResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "post": {
+        "operationId": "post_box_widen",
+        "tags": [
+          "box"
+        ],
+        "summary": "POST /box/widen",
+        "description": "POST /box/widen — record extra sparse-checkout directories that must SURVIVE the */10 source-fetch (task 1003087, idea 1000793). rank: any authenticated builder, OWN box (builder_id-scoped in SQL, so no id from the body can point this at someone else's box). Deliberately NOT allowBoxScope. The on-box crons read source-access with a box-scoped session (ADR 0053); this is a WRITE that changes what the box pulls forever after, so it takes the builder's own session — the same posture that keeps a stolen box token from re-scoping the checkout it was stolen from. add/remove are applied to the stored set and the result is re-normalized, so the endpoint is idempotent: widening twice is not an error, and neither is removing something that was never there. A path outside the caller's rank scope is ACCEPTED into storage but reported in `ignored` rather than refused. That is the honest shape: rank can change, and a builder promoted to Metic should find the widen they asked for as a Xenos simply start working, instead of having been silently discarded months earlier. What it can never do is take effect early — admissibleWidenPaths is re-evaluated against the LIVE rank on every single fetch.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/dev-box/routes/box.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostBoxWidenRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostBoxWidenResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/boxes": {
       "get": {
         "operationId": "get_boxes",
@@ -16801,6 +16886,21 @@
           "hint"
         ]
       },
+      "GetBoxWidenResponse": {
+        "type": "object",
+        "properties": {
+          "widen_paths": {},
+          "admitted": {},
+          "ignored": {},
+          "max": {}
+        },
+        "required": [
+          "widen_paths",
+          "admitted",
+          "ignored",
+          "max"
+        ]
+      },
       "GetBoxesResponse": {
         "type": "object",
         "properties": {
@@ -18881,6 +18981,11 @@
             "maxLength": 200
           },
           "priority": {},
+          "value_summary": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 1000
+          },
           "status": {}
         },
         "additionalProperties": false
@@ -19429,6 +19534,40 @@
           "state"
         ]
       },
+      "PostBoxWidenRequest": {
+        "type": "object",
+        "properties": {
+          "add": {
+            "type": "array"
+          },
+          "remove": {
+            "type": "array"
+          },
+          "clear": {
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": false
+      },
+      "PostBoxWidenResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "widen_paths": {},
+          "admitted": {},
+          "ignored": {},
+          "max": {}
+        },
+        "required": [
+          "ok",
+          "widen_paths",
+          "admitted",
+          "ignored",
+          "max"
+        ]
+      },
       "PostBoxesBuilderIdCloseResponse": {
         "type": "object",
         "properties": {
@@ -22806,9 +22945,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 360,
-  "x-schema-count": 398,
+  "x-endpoint-count": 362,
+  "x-schema-count": 401,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 268,
+  "x-response-schemas": 270,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 360 endpoints across 58 route files.
+> **Generated from the live route files** — the route file is authoritative. 362 endpoints across 58 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -81,7 +81,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/blockers/:id/link` | `metic+archon` | `task_id` | Link an existing blocker to a task. |
 | POST | `/api/bongos/blockers/:id/resolve` | `metic+archon` | `resolution_note` | Resolve. |
 
-## `box` (18)
+## `box` (20)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -103,6 +103,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/box/terminal` | `any-builder` | — | GET /box/terminal — the caller reads their box's web-terminal URL + credential (the Chromebook on-ramp, ADR 0038: ttyd behind a Cloudflar… |
 | POST | `/api/bongos/box/terminal` | `any-builder` | `url`, `credential` | POST /box/terminal — the box publishes its current web-terminal URL + the per-box basic-auth credential. |
 | POST | `/api/bongos/box/version` | `any-builder` | `sha`, `committed_at` | POST /box/version — the box reports its /workspace HEAD commit so the server can flag a stale box (idea 332 / task 1316, ADR 0072). |
+| GET | `/api/bongos/box/widen` | `any-builder` | — | GET /box/widen — the caller's own recorded widen set (task 1003087). |
+| POST | `/api/bongos/box/widen` | `any-builder` | `add`, `remove`, `clear` | POST /box/widen — record extra sparse-checkout directories that must SURVIVE the */10 source-fetch (task 1003087, idea 1000793). |
 
 ## `boxes` (4)
 
@@ -591,7 +593,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/tasks` | `any-builder` | — |  |
 | POST | `/api/bongos/tasks` | `metic+archon` | `version_id`, `title`, `description`, `status`, `touches`, `est_minutes`, `est_cost_usd`, `manual_degree`, `priority`, `automation_tag`, `credits_reward`, `source`, `source_ref`, `value_summary`, `kind`, `discipline`, `parallel_safe`, `newcomer_friendly`, `security_sensitive`, `requires_rank`, `auto_detect_touches`, `criterion_ids`, `module_key`, `goal_id` | Task create/promote/edit (plan/scope mutation) is Metic+ as of ADR 0090 (owner decision 2026-06-26): a Metic who can run idea-triage may … |
 | GET | `/api/bongos/tasks/:id` | `any-builder` | — | single-task read; preserved per CRITICAL §4 (supervisor hot path). |
-| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `needs_migration`, `description`, `title`, `priority`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
+| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `needs_migration`, `description`, `title`, `priority`, `value_summary`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
 | POST | `/api/bongos/tasks/:id/abandon` | `metic+archon` | `reason` | POST /tasks/:id/abandon — terminal "retire this task" transition (task 987). |
 | POST | `/api/bongos/tasks/:id/attest-gate` | `any-builder` | `head_sha` | POST /tasks/:id/attest-gate — body: { head_sha }. |
 | POST | `/api/bongos/tasks/:id/confirm` | `any-builder` | `verified` |  |

package/docs/module-api-changelog.md

@@ -1741,5 +1741,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.644 with no explicit bump. run 34511775606. (task 1002620)
   1.19.646 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.645 with no explicit bump. run 34512629504. (task 1002620)
+  1.19.647 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.646 with no explicit bump. run 34515733973. (task 1002620)
+  1.19.648 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.647 with no explicit bump. run 34518387614. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_237_box_widen_paths.sql

@@ -0,0 +1,40 @@
+-- core_237_box_widen_paths.sql — let a builder's own sparse-checkout widening
+-- survive the */10 source-fetch tick (task 1003087, goal 1000095, idea 1000793).
+--
+-- THE BUG THIS EXISTS FOR. The box's source-fetch cron re-applies the
+-- SERVER-COMPUTED sparse set every ~10 minutes. A builder who runs
+-- `git sparse-checkout add <path>` to see code their task scope did not pull gets
+-- it deleted out from under them on the next tick — including WHILE A COMMAND IS
+-- RUNNING. A live test suite died mid-run with MODULE_NOT_FOUND that read exactly
+-- like a code bug. It also breaks gen-repo-map, whose output is TREE-DEPENDENT:
+-- a sparse tree regenerates different nested CLAUDE.md symbol blocks than CI's
+-- full tree, so a box-committed regen reds CI's freshness gate (learning 1000192;
+-- it stranded PR #254 until the tree was widened).
+--
+-- WHY THE FIX LIVES IN THE DATABASE AND NOT IN THE FETCH SCRIPT. The obvious fix
+-- is "make box-source-fetch.sh union the builder's additions". It cannot be done
+-- there from this repo: the fetch script is INSTANCE-owned, not shipped by the
+-- neutral core (ADR 0150). More importantly it would not work — the cron asks the
+-- SERVER for the set on every tick, so anything the script remembers locally is
+-- one `git sparse-checkout set` away from being overwritten anyway. Recording the
+-- widening server-side is what makes it tick-surviving: the union is computed in
+-- GET /box/source-access, so EVERY fetch — cron included — already returns it,
+-- and no instance-owned file has to change.
+--
+-- ONE COLUMN, NOT A TABLE. A widen set is small (capped in box-access.js), has no
+-- attributes of its own, and is meaningless apart from its box — the same shape
+-- as the existing array-ish per-box state on this table. A join table would buy
+-- nothing and cost a query on the hot source-fetch path.
+--
+-- NOT AN AUTHORITY GRANT. This column widens what is MATERIALIZED on the box, not
+-- what the builder may author. The wall stays where ADR 0148 put it — goal-scope
+-- -check against the module globs, not what happens to be on disk — and
+-- box-access.js admits a widen path only when the builder's RANK scope already
+-- reaches it, so a Xenos cannot widen past the starter surface. Empty default, so
+-- every existing box is unchanged until its owner asks for something.
+
+ALTER TABLE builder_boxes
+  ADD COLUMN IF NOT EXISTS widen_paths text[] NOT NULL DEFAULT '{}';
+
+COMMENT ON COLUMN builder_boxes.widen_paths IS
+  'Builder-requested extra sparse-checkout directories, unioned into the server-computed set on every source fetch so they survive the */10 cron (task 1003087). Admitted only within the builder''s rank scope — see modules/dev-box/box-access.js admissibleWidenPaths.';

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -204,6 +204,10 @@ function createClient(opts = {}) {
       postBoxTerminal: (args) => request("POST", "/box/terminal", { hasBody: true }, args),
       // POST /box/version — rank: any-builder — POST /box/version
       postBoxVersion: (args) => request("POST", "/box/version", { hasBody: true }, args),
+      // GET /box/widen — rank: any-builder — GET /box/widen
+      getBoxWiden: (args) => request("GET", "/box/widen", { hasBody: false }, args),
+      // POST /box/widen — rank: any-builder — POST /box/widen
+      postBoxWiden: (args) => request("POST", "/box/widen", { hasBody: true }, args),
     },
     "boxes": {
       // GET /boxes — rank: metic+archon — GET /boxes