@bongos/core 1.19.714 → 1.19.724

package/docs/adr/0154-goal-owner-criterion-authoring.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-07-29
 - **Deciders:** Lars (owner / Archon), Claude
 
-**Builds on / amends:** [ADR 0086](<redacted>.md) (the goal tier — this ADR extends its owner/manager authority to the goal's criteria), [ADR 0090](<redacted>.md) (Metic task authoring), [ADR 0106](<redacted>.md) (owner vs manager), [ADR 0105](<redacted>.md) (why this route exists at all), [ADR 0016](<redacted>.md) (server-enforced rank boundary — unchanged), [ADR 0151](<redacted>.md) (permissions-as-atom — and see §5, which corrects one of its rows).
+**Builds on / amends:** [ADR 0086](0086-goal-scoped-work-hierarchy.md) (the goal tier — this ADR extends its owner/manager authority to the goal's criteria), [ADR 0090](0090-metic-task-authoring.md) (Metic task authoring), [ADR 0106](0106-goal-owner-manager-authority.md) (owner vs manager), [ADR 0105](0105-instance-seed-migrations-out-of-core.md) (why this route exists at all), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced rank boundary — unchanged), [ADR 0151](0151-governance-permissions-as-atom-ranks-as-roles.md) (permissions-as-atom — and see §5, which corrects one of its rows).
 
 **Track:** `internal` (GDS / methodology). Task [1002538](https://cloudbongos.com/builders#/task/1002538), under the **Builder experience** goal [1000025](https://cloudbongos.com/builders#/goal/1000025).
 
@@ -12,7 +12,7 @@
 
 ## Context
 
-The Metic planning loop is complete except in one place. A Metic may create a goal ([ADR 0086](<redacted>.md): `POST /goals` is `requireRank('metic','archon')`), author the tasks under it ([ADR 0090](<redacted>.md)), wire their dependencies and criterion links, and **confirm** a criterion when the work lands ([ADR 0086](<redacted>.md) §6 re-ranked `POST /done-when/:criterionId/satisfy` to Metic+ "so the planner — not only the Archon — closes the criterion/goal loop").
+The Metic planning loop is complete except in one place. A Metic may create a goal ([ADR 0086](0086-goal-scoped-work-hierarchy.md): `POST /goals` is `requireRank('metic','archon')`), author the tasks under it ([ADR 0090](0090-metic-task-authoring.md)), wire their dependencies and criterion links, and **confirm** a criterion when the work lands ([ADR 0086](0086-goal-scoped-work-hierarchy.md) §6 re-ranked `POST /done-when/:criterionId/satisfy` to Metic+ "so the planner — not only the Archon — closes the criterion/goal loop").
 
 But they could not **create** the criteria those tasks are measured against: `POST /versions/:id/done-when` was `requireRank('archon')`. So a Metic could stand up a goal, fill it with work, and close its criteria out — but had to ask an Archon to write them in the first place. That is the one Archon-shaped hole in an otherwise Metic-complete loop, and it is what blocked `/goal-create` ([1002540](https://cloudbongos.com/builders#/task/1002540)) from being a skill a Metic can actually run end to end.
 
@@ -27,7 +27,7 @@ The tempting move is symmetry: a Metic may confirm a criterion, so let them crea
 
 That is operationally the same effect as `POST /done-when/:criterionId/unsatisfy` — which is Archon-only, and which `docs/governance/<redacted>.md` lists in the same Archon "Lifecycle disposition" line as this route. And there is **no DELETE route for a criterion**: descoping is direct SQL under a claim. A mistake is not correctable through the API by anyone.
 
-**The create path also had no ownership check whatsoever.** Its entire authorization surface was `requireBuilder` → `requireRank` → version exists → (if `goal_id` given) the goal belongs to that version. That last one is referential integrity, not authority. Every *other* goal-touching write in the module runs `authorizeGoalManagement` (owner | manager | Archon) or `authorizeGoalTaskCreate` (membership + scope wall). A flat re-rank would therefore have let any Metic attach a permanent, un-deletable criterion to **any goal on any version**, including goals they had never joined and private goals ([ADR 0112](<redacted>.md)) — published to the anonymous status feed.
+**The create path also had no ownership check whatsoever.** Its entire authorization surface was `requireBuilder` → `requireRank` → version exists → (if `goal_id` given) the goal belongs to that version. That last one is referential integrity, not authority. Every *other* goal-touching write in the module runs `authorizeGoalManagement` (owner | manager | Archon) or `authorizeGoalTaskCreate` (membership + scope wall). A flat re-rank would therefore have let any Metic attach a permanent, un-deletable criterion to **any goal on any version**, including goals they had never joined and private goals ([ADR 0112](0112-private-goals-invitations-join-requests.md)) — published to the anonymous status feed.
 
 `docs/canonical-permissions.md` named "set version scope (`done-when`)" as Archon-exclusive. A flat re-rank contradicts that flatly; the decision below narrows it instead.
 
@@ -52,7 +52,7 @@ The authority predicate is `isGoalOwnerOrManager` — the **same** owner-or-mana
 
 Ordering matters here in a way it does not for the sibling goal routes. Those are reached by callers who already know the goal exists (they are looking at it); this one takes an arbitrary integer `goal_id` from any Metic.
 
-If the refusals were distinguishable — `400 bad_goal_id` (no such goal) vs `403 not_owner_or_manager` (exists, not yours) vs `409 goal_not_open` (exists, settled) — the route would be an **existence oracle**: a Metic could enumerate `goal_id`s and learn which exist on a version, including **private goals** ([ADR 0112](<redacted>.md)). That surface did not exist while the route was Archon-only, because an Archon can already read every goal. Re-ranking it creates the surface, so the re-rank has to close it.
+If the refusals were distinguishable — `400 bad_goal_id` (no such goal) vs `403 not_owner_or_manager` (exists, not yours) vs `409 goal_not_open` (exists, settled) — the route would be an **existence oracle**: a Metic could enumerate `goal_id`s and learn which exist on a version, including **private goals** ([ADR 0112](0112-private-goals-invitations-join-requests.md)). That surface did not exist while the route was Archon-only, because an Archon can already read every goal. Re-ranking it creates the surface, so the re-rank has to close it.
 
 So the ownership test runs **ahead of** both state checks, and a caller who fails it gets byte-identical `400 bad_goal_id` to one naming a goal that does not exist — same code, same message, same envelope, rendered by the same `badGoalId()` helper the genuine-absence branch uses. Only someone who already holds the goal learns anything further about it. This mirrors the O1 no-leak ordering the goal abuse matrix already pins (`not_a_member` is returned before any scope hint).
 
@@ -71,7 +71,7 @@ Creating a criterion inside a goal you own is not scope-*truth* authorship in th
 
 ## §5 — A correction to ADR 0151's catalog
 
-[ADR 0151](<redacted>.md)'s "floor `metic` today" table bundles three routes into one row:
+[ADR 0151](0151-governance-permissions-as-atom-ranks-as-roles.md)'s "floor `metic` today" table bundles three routes into one row:
 
 > `criterion.satisfy` / `criterion.review` | `POST /done-when/:id/satisfy`, `GET /done-when/pending-review`, `POST /versions/:id/done-when`
 
@@ -81,6 +81,6 @@ This ADR makes the row's *outcome* correct but for a different reason, so the ro
 
 ## Alternatives considered
 
-- **Leave it Archon; use the proposal queue.** Rejected: it keeps the Archon in the loop for a Metic describing a goal they own, which is the janitorial-delegation problem [ADR 0152](<redacted>.md) already named. The queue survives for the cases that genuinely need adjudication.
+- **Leave it Archon; use the proposal queue.** Rejected: it keeps the Archon in the loop for a Metic describing a goal they own, which is the janitorial-delegation problem [ADR 0152](0152-metic-task-abandonment.md) already named. The queue survives for the cases that genuinely need adjudication.
 - **Flat re-rank to Metic+.** Rejected — §Context.
-- **Add a DELETE for criteria so the ratchet has an undo** (the [ADR 0152](<redacted>.md) "pair the grant with its inverse" pattern). Deferred, not rejected: it is the honest completion of "manage," and it would neutralise the no-undo objection directly. It is a new capability nobody has today — including Archons — and deleting a criterion with linked `task_criteria` rows needs its own cascade decision. Worth its own task.
+- **Add a DELETE for criteria so the ratchet has an undo** (the [ADR 0152](0152-metic-task-abandonment.md) "pair the grant with its inverse" pattern). Deferred, not rejected: it is the honest completion of "manage," and it would neutralise the no-undo objection directly. It is a new capability nobody has today — including Archons — and deleting a criterion with linked `task_criteria` rows needs its own cascade decision. Worth its own task.

package/docs/adr/0155-adopt-private-repo-widen-oauth-scope.md

@@ -3,8 +3,8 @@
 - **Status:** Accepted — built in task [#1002561](https://example.com/builders#/task/1002561).
 - **Date:** 2026-08-04
 - **Deciders:** the owner chose the credential approach after being shown the trade-off; Claude diagnosed + built.
-- **Amends:** [ADR 0143](<redacted>.md) §1 (its Decision 1 — scope choice). 0143 otherwise stands unchanged: opt-in per sign-in, lazy consent, encrypted short-TTL token store, personal repos only, 503-degrade. Per 0143's own append-only rule, this is a new ADR, not an edit.
-- **Related:** [ADR 0121](<redacted>.md) (greenfield vs brownfield onboarding).
+- **Amends:** [ADR 0143](0143-onboarding-repo-picker-oauth-scope.md) §1 (its Decision 1 — scope choice). 0143 otherwise stands unchanged: opt-in per sign-in, lazy consent, encrypted short-TTL token store, personal repos only, 503-degrade. Per 0143's own append-only rule, this is a new ADR, not an edit.
+- **Related:** [ADR 0121](0121-greenfield-vs-brownfield-onboarding-adopt-existing-repo.md) (greenfield vs brownfield onboarding).
 
 ## Context
 

package/docs/adr/0156-user-set-display-name-wins.md

@@ -56,7 +56,7 @@ The chosen fix costs one boolean-shaped column and keeps both behaviours correct
 
 ## Consequences
 
-- **New core column.** `builders.display_name_source`. Core, not `modules/builder-settings/migrations/`: the column sits on the core `builders` table and the guard that reads it lives in core `db-kernel.js` on the auth path. A module migration may only touch its own namespaced objects ([ADR 0083](<redacted>.md) §Decision #5), and core schema must not depend on whether a module is enabled. Same placement as the other `builders`-table preference columns (037, 075, 119, 164).
+- **New core column.** `builders.display_name_source`. Core, not `modules/builder-settings/migrations/`: the column sits on the core `builders` table and the guard that reads it lives in core `db-kernel.js` on the auth path. A module migration may only touch its own namespaced objects ([ADR 0083](0083-modular-architecture-strangler-build-plan.md) §Decision #5), and core schema must not depend on whether a module is enabled. Same placement as the other `builders`-table preference columns (037, 075, 119, 164).
 - **Not surfaced in the API.** `GET /me/display-name` and `docs/api/openapi.json` are unchanged. The flag is internal persistence state; no UI copy branches on whether a name is GitHub-derived, so exposing it would be surface with no consumer.
 - **The federated hub needs no matching guard.** `modules/platform-identity/platform-identity.js`'s `upsertAccount` does the same unconditional re-sync on `platform_identity_accounts`, and its `display_name` reaches an instance through `completeIdpFlow`. It does not need changing: the `CASE` above runs regardless of what `EXCLUDED` carries, so an instance's `builders.display_name` is protected no matter which login path supplied the value. And `platform_identity_accounts` is identity-only with no self-service editor — there is no user-set value there to protect.
 - **Regression-tested where it broke.** `tests/display_name.mjs` previously covered only the pure validator, which is exactly why this shipped: the half that was correct was the half under test. It now also reads the real SQL both halves emit and asserts the conflict branch's behaviour — a renamed builder keeps their name against a different incoming GitHub name, and a never-renamed builder still picks up a GitHub rename.

package/docs/adr/0157-archon-is-rank-and-identity-only.md

@@ -4,19 +4,19 @@
 - **Date:** 2026-08-05
 - **Deciders:** Lars (Archon), Claude
 
-**Builds on / amends:** [ADR 0016](<redacted>.md) (server-enforced trust boundary — **unchanged**, this ADR moves floors inside it, never the enforcement point), [ADR 0151](<redacted>.md) (permissions-as-atom — this ADR is only possible because the floor is declared once, in `catalog.js`), [ADR 0090](<redacted>.md) / [ADR 0152](<redacted>.md) (the two earlier one-power delegations this generalises), [ADR 0154](<redacted>.md) (**amends** — its "unsatisfy stays Archon" carve-out is superseded), [ADR 0086](<redacted>.md) (protected-scope goals — **unchanged**, `goal.scope.manage` stays Archon).
+**Builds on / amends:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced trust boundary — **unchanged**, this ADR moves floors inside it, never the enforcement point), [ADR 0151](0151-governance-permissions-as-atom-ranks-as-roles.md) (permissions-as-atom — this ADR is only possible because the floor is declared once, in `catalog.js`), [ADR 0090](0090-metic-task-authoring.md) / [ADR 0152](0152-metic-task-abandonment.md) (the two earlier one-power delegations this generalises), [ADR 0154](0154-goal-owner-criterion-authoring.md) (**amends** — its "unsatisfy stays Archon" carve-out is superseded), [ADR 0086](0086-goal-scoped-work-hierarchy.md) (protected-scope goals — **unchanged**, `goal.scope.manage` stays Archon).
 
 **Track:** `internal` (GDS / methodology). Task [1002584](https://cloudbongos.com/builders#/task/1002584).
 
-> **Amended by [ADR 0250](<redacted>.md) §6 for exactly one key** (2026-09-07, task [1003608](https://cloudbongos.com/builders#/task/1003608)): **`version.create` returns to the Archon floor.** The argument below — *authoring delegates, disposition does not* — was right about what a version **was**. ADR 0250 D1 makes the version boundary the scope gate, and once it does, cutting a new version is no longer authoring: it is the way **around** the gate, because a builder refused a goal on a building version need only cut a fresh version to put it somewhere. Create therefore joins `version.close` as a disposition over scope. **Every other key in this ADR stands.**
+> **Amended by [ADR 0250](0250-strict-versioning-the-version-boundary-is-the-scope-gate.md) §6 for exactly one key** (2026-09-07, task [1003608](https://cloudbongos.com/builders#/task/1003608)): **`version.create` returns to the Archon floor.** The argument below — *authoring delegates, disposition does not* — was right about what a version **was**. ADR 0250 D1 makes the version boundary the scope gate, and once it does, cutting a new version is no longer authoring: it is the way **around** the gate, because a builder refused a goal on a building version need only cut a fresh version to put it somewhere. Create therefore joins `version.close` as a disposition over scope. **Every other key in this ADR stands.**
 
 ---
 
 ## Context
 
-The Archon rank had accumulated 50 route gates. Almost none of them were about *authority*; they were about **administration** — reading the roster, listing dev boxes, viewing the audit log, adjudicating a vulnerability report, tearing down an idle droplet, reordering a queue, ratifying an idea. Each arrived Archon-gated for the same defensible reason: [ADR 0016](<redacted>.md) sets the default posture for any new privileged route to `requireRank('archon')` until a lower rank is explicitly granted — fail closed. Nothing ever came back to lower them, so "fail closed" quietly became "the owner is the only operator."
+The Archon rank had accumulated 50 route gates. Almost none of them were about *authority*; they were about **administration** — reading the roster, listing dev boxes, viewing the audit log, adjudicating a vulnerability report, tearing down an idle droplet, reordering a queue, ratifying an idea. Each arrived Archon-gated for the same defensible reason: [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) sets the default posture for any new privileged route to `requireRank('archon')` until a lower rank is explicitly granted — fail closed. Nothing ever came back to lower them, so "fail closed" quietly became "the owner is the only operator."
 
-Two earlier ADRs had already delegated one power each on the same reasoning — [ADR 0090](<redacted>.md) (a rank trusted to *triage* ideas is trusted to *seed* the work they become) and [ADR 0152](<redacted>.md) (a rank trusted to author work is trusted to retire it). This ADR generalises that argument instead of relitigating it one route at a time.
+Two earlier ADRs had already delegated one power each on the same reasoning — [ADR 0090](0090-metic-task-authoring.md) (a rank trusted to *triage* ideas is trusted to *seed* the work they become) and [ADR 0152](0152-metic-task-abandonment.md) (a rank trusted to author work is trusted to retire it). This ADR generalises that argument instead of relitigating it one route at a time.
 
 Lars's directive (2026-08-05): **"Move all of these to metic, and make archon just responsible for rank and identity."**
 
@@ -40,7 +40,7 @@ Once every gate reads `requirePermission('<atom>')`, the rank floor is declared
 | `gate_approval.decide` | escalation key (below) |
 | `goal.scope.manage` | escalation key (below) |
 | `governance.manage` | escalation key (below) |
-| `deploy.push_main`, `path.protected.modify`, `infra.ssh` | substrate-enforced (pre-push hook, `main-audit.js`), outside the HTTP boundary — [ADR 0043](<redacted>.md). Not reachable to delegate here. |
+| `deploy.push_main`, `path.protected.modify`, `infra.ssh` | substrate-enforced (pre-push hook, `main-audit.js`), outside the HTTP boundary — [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md). Not reachable to delegate here. |
 | `version.close` | see §3 |
 
 ### 2. The four escalation keys, and why a literal reading of the directive was refused
@@ -48,7 +48,7 @@ Once every gate reads `requirePermission('<atom>')`, the rank floor is declared
 `builder.rank.set` staying Archon is **not sufficient** to keep "only the Archon sets rank" true. Four other atoms form a chain that ends in self-promotion, and every link was Archon-gated, which is why the chain was closed:
 
 1. Create a goal scoped to a **protected** module — the permission core itself (`goal.scope.manage`).
-2. Claim a task in it. **Already allowed**: `PROTECTED_GLOBS` floors at *metic*, by [ADR 0043](<redacted>.md)'s design.
+2. Claim a task in it. **Already allowed**: `PROTECTED_GLOBS` floors at *metic*, by [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)'s design.
 3. Write code deleting the rank check, then confirm past the failed grade (`task.confirm.grade_bypass`).
 4. Approve your own red CI deploy gate (`gate_approval.decide`) → it lands on `main`.
 
@@ -82,14 +82,14 @@ Left alone, a Metic would open `/gate` and get a page rendering nothing but a 40
 **Two consequences worth a second look** (both flagged to the owner, neither blocking):
 
 1. **The exploit cookbook widened.** `security.report.adjudicate` guards `/security/docs` — the engagement-report store holding attacker-usable exploit detail — so that is now Metic-readable. Every other delegated atom widens who may *act*; this one widens who may *read*. If unwanted, the fix mirrors §4: split a `security.docs.read` at archon and let adjudication delegate. Recorded in `tests/security_docs.mjs` at the assertion that used to guard it.
-2. **The backward ratchet delegated.** [ADR 0154](<redacted>.md) made "unsatisfy stays Archon" the explicit safety argument for delegating criterion *create* — the forward ratchet moved, the backward one did not. `criterion.unsatisfy` is neither rank/identity nor an escalation key, so under this directive it moved, superseding that carve-out. What still holds is the part that never depended on rank: satisfy and unsatisfy remain **separate atoms**, so confirming a criterion never confers the power to un-confirm one.
+2. **The backward ratchet delegated.** [ADR 0154](0154-goal-owner-criterion-authoring.md) made "unsatisfy stays Archon" the explicit safety argument for delegating criterion *create* — the forward ratchet moved, the backward one did not. `criterion.unsatisfy` is neither rank/identity nor an escalation key, so under this directive it moved, superseding that carve-out. What still holds is the part that never depended on rank: satisfy and unsatisfy remain **separate atoms**, so confirming a criterion never confers the power to un-confirm one.
 
-**A floor change needs a migration.** `governance_002`'s compat seed is run-once, so an edited `floor:` never reaches an already-migrated database. [`<redacted>.sql`](../../modules/government/migrations/<redacted>.sql) grants the 20 to `metic` (+ `gate_approval.read` to both, since it is new). Lowering a floor is additive, so `tests/governance_seed.mjs`'s union model handles it and revokes nothing.
+**A floor change needs a migration.** `governance_002`'s compat seed is run-once, so an edited `floor:` never reaches an already-migrated database. [`governance_007_delegate_archon_ops_to_metic.sql`](../../modules/government/migrations/governance_007_delegate_archon_ops_to_metic.sql) grants the 20 to `metic` (+ `gate_approval.read` to both, since it is new). Lowering a floor is additive, so `tests/governance_seed.mjs`'s union model handles it and revokes nothing.
 
 **`requireArchonPage` is now a misnomer** — it resolves `page.view.governance`, floor metic. Renaming it touches serve-internal, auth, and several test files; left deliberately to keep this diff small in authz code, and filed separately. The hall nav group was relabelled **Archon → Governance**, because a header reading "Archon" over items a Metic can open misdescribes the ladder to exactly the builders still learning it.
 
-> **Resolved (2026-08-05, [#1002588](https://cloudbongos.com/builders#/task/1002588)).** That follow-up landed: the gate is now `requireGovernancePage`. It is a pure rename — same `page.view.governance` permission, same `deniedTo`, same audience. References to `requireArchonPage` in this ADR and in ADRs [0036](<redacted>.md) / [0058](<redacted>.md) / [0151](<redacted>.md) are left as written, since they describe what was true at the time; `src/bongos/auth.js` carries a comment naming the old spelling so a grep from any of them lands on the trail.
+> **Resolved (2026-08-05, [#1002588](https://cloudbongos.com/builders#/task/1002588)).** That follow-up landed: the gate is now `requireGovernancePage`. It is a pure rename — same `page.view.governance` permission, same `deniedTo`, same audience. References to `requireArchonPage` in this ADR and in ADRs [0036](0036-builders-subdomain-and-ui-reorg.md) / [0058](0058-automatic-gate-surface-gatekeeper.md) / [0151](0151-governance-permissions-as-atom-ranks-as-roles.md) are left as written, since they describe what was true at the time; `src/bongos/auth.js` carries a comment naming the old spelling so a grep from any of them lands on the trail.
 
-**What did not change.** [ADR 0016](<redacted>.md) end to end: authority is still resolved server-side, per request, uncached, from `builders.rank` via the seeded rank-roles. A builder editing their checkout still cannot grant themselves anything. This ADR moves floors *inside* that boundary; it does not touch the boundary.
+**What did not change.** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) end to end: authority is still resolved server-side, per request, uncached, from `builders.rank` via the seeded rank-roles. A builder editing their checkout still cannot grant themselves anything. This ADR moves floors *inside* that boundary; it does not touch the boundary.
 
 **The ADR 0016 default posture still stands** for *new* routes: start at `requireRank('archon')` / an archon-floored atom and delegate deliberately. This ADR is that deliberate step taken in bulk for the accumulated backlog — not a licence to skip it.

package/docs/adr/0158-choke-point-verdict-taxonomy.md

@@ -6,7 +6,7 @@
 - **Track:** `internal` (GDS / methodology)
 - **Task:** [1002598](https://cloudbongos.com/builders#/task/1002598), under goal [1000024](https://cloudbongos.com/builders#/goal/1000024) (Build-pipeline integrity)
 
-**Builds on:** [ADR 0016](<redacted>.md) (the server-enforced trust boundary — **unchanged**), [ADR 0043](<redacted>.md) (the out-of-band substrate), [ADR 0151](<redacted>.md) (permissions as atoms), [ADR 0157](<redacted>.md) (the delegation this taxonomy generalises the *reasoning* of).
+**Builds on:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (the server-enforced trust boundary — **unchanged**), [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (the out-of-band substrate), [ADR 0151](0151-governance-permissions-as-atom-ranks-as-roles.md) (permissions as atoms), [ADR 0157](0157-archon-is-rank-and-identity-only.md) (the delegation this taxonomy generalises the *reasoning* of).
 
 **Produces:** [`docs/governance/<redacted>.md`](../governance/<redacted>.md).
 

package/docs/adr/0159-merge-gate-reconciliation.md

@@ -6,7 +6,7 @@
 - **Track:** `internal` (build pipeline / governance)
 - **Task:** [1002611](https://cloudbongos.com/builders#/task/1002611), under goal [1000024](https://cloudbongos.com/builders#/goal/1000024) (Build-pipeline integrity)
 
-**Builds on:** [ADR 0042](<redacted>.md) (CI auto-merge; described Code-Owner review as a live control), [ADR 0058](<redacted>.md) (the gate-review phase plan — **unchanged**; its workflows remain planned), [ADR 0158](<redacted>.md) (the verdict taxonomy; findings D-12 and G-5 in the [choke-point map](../governance/<redacted>.md)).
+**Builds on:** [ADR 0042](0042-builder-self-deploy-ci-auto-merge.md) (CI auto-merge; described Code-Owner review as a live control), [ADR 0058](0058-automatic-gate-surface-gatekeeper.md) (the gate-review phase plan — **unchanged**; its workflows remain planned), [ADR 0158](0158-choke-point-verdict-taxonomy.md) (the verdict taxonomy; findings D-12 and G-5 in the [choke-point map](../governance/<redacted>.md)).
 
 ---
 

package/docs/adr/0160-main-audit-repo-verifiable-caller.md

@@ -6,7 +6,7 @@
 - **Track:** `internal` (build pipeline / governance)
 - **Task:** [1002612](https://cloudbongos.com/builders#/task/1002612), under goal [1000024](https://cloudbongos.com/builders#/goal/1000024) (Build-pipeline integrity)
 
-**Builds on:** [ADR 0043](<redacted>.md) (designates the post-push audit the authoritative layer — **unchanged**), [ADR 0159](<redacted>.md) (the merge-gate reconciliation this is the detective-lane companion to), [ADR 0158](<redacted>.md) (findings G-3, G-8, S-1).
+**Builds on:** [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (designates the post-push audit the authoritative layer — **unchanged**), [ADR 0159](0159-merge-gate-reconciliation.md) (the merge-gate reconciliation this is the detective-lane companion to), [ADR 0158](0158-choke-point-verdict-taxonomy.md) (findings G-3, G-8, S-1).
 
 ---
 

package/docs/adr/0161-publish-on-merge.md

@@ -4,8 +4,8 @@
 - **Date:** 2026-08-08
 - **Deciders:** the owner (Archon), Claude. The owner chose this directly after reviewing the pipeline end-to-end: "any merge can publish, we can add in more complexity later."
 - **Task:** task 1002620 (BONGOS-V1, goal 1000024 — build-pipeline integrity)
-- **Supersedes:** [ADR 0137](<redacted>.md) (manual owner-gated publish)
-- **Builds on:** [ADR 0134](<redacted>.md) (private-first npm), [ADR 0136](<redacted>.md) (channel policy), [ADR 0159](<redacted>.md) (the required `unit` check)
+- **Supersedes:** [ADR 0137](0137-upstream-publish-policy-manual-owner-gated.md) (manual owner-gated publish)
+- **Builds on:** [ADR 0134](0134-private-first-npm-distribution.md) (private-first npm), [ADR 0136](0136-update-channel-subscription-policy.md) (channel policy), [ADR 0159](0159-merge-gate-reconciliation.md) (the required `unit` check)
 
 ## Context
 

package/docs/adr/0163-legacy-display-name-resolution.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-08-11
 - **Deciders:** Claude (jaxri session), under the bug-wave mandate
 
-**Track:** `internal` (GDS / builder experience). Task [1002643](https://cloudbongos.com/builders#/task/1002643), from idea 1000659. Extends [ADR 0156](<redacted>.md).
+**Track:** `internal` (GDS / builder experience). Task [1002643](https://cloudbongos.com/builders#/task/1002643), from idea 1000659. Extends [ADR 0156](0156-user-set-display-name-wins.md).
 
 ---
 

package/docs/adr/0165-instances-hookless-by-default.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-08-11
 - **Deciders:** Claude (jaxri session), under the bug-wave mandate — flagged owner-adjacent; the ADR is the revisit point
 
-**Track:** `internal` (provisioning / trust boundary). Task [1002641](https://cloudbongos.com/builders#/task/1002641), from idea 1000655. Relates to [ADR 0043](<redacted>.md) (Layer 1), [ADR 0055](<redacted>.md) (server-mediated publish), [ADR 0162](<redacted>.md) (CI-only gates).
+**Track:** `internal` (provisioning / trust boundary). Task [1002641](https://cloudbongos.com/builders#/task/1002641), from idea 1000655. Relates to [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (Layer 1), [ADR 0055](0055-server-mediated-branch-publish.md) (server-mediated publish), [ADR 0162](0162-review-gates-retired-rank-consistent-ci-only.md) (CI-only gates).
 
 ---
 

package/docs/adr/0166-module-maintenance-and-deprecation-policy.md

@@ -4,8 +4,8 @@
 - **Date:** 2026-08-11
 - **Track:** internal
 - **Task:** [#1001773](https://cloudbongos.com/builders#/task/1001773) (BONGOS-V1) — "Module upstreaming: maintenance & deprecation policy for accepted modules".
-- **Implements:** [ADR 0107](<redacted>.md) §7, which named the problem and deferred the mechanics to a follow-up. This is that follow-up.
-- **Builds on:** [ADR 0083](<redacted>.md) (the manifest + loader + `coreVersion` check), [ADR 0107](<redacted>.md) §§1/4/6 (submit → review → accept, the AGPL pre-check, default-off acceptance), [ADR 0135](<redacted>.md) (where submissions queue).
+- **Implements:** [ADR 0107](0107-module-upstreaming-contribution-to-core-catalog.md) §7, which named the problem and deferred the mechanics to a follow-up. This is that follow-up.
+- **Builds on:** [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the manifest + loader + `coreVersion` check), [ADR 0107](0107-module-upstreaming-contribution-to-core-catalog.md) §§1/4/6 (submit → review → accept, the AGPL pre-check, default-off acceptance), [ADR 0135](0135-module-upstream-submission-interim-queue.md) (where submissions queue).
 
 ## Context
 
@@ -88,4 +88,4 @@ The 17 modules that ship inside `@bongos/core` are core-maintained by definition
 - **`bongos upgrade` gets noisier, on purpose.** An instance carrying rotted disabled modules now sees a line per module per bump. That is the intended pressure: the cure is to fix, deprecate, or delete the module, and each of those makes the line go away honestly.
 - **Submitting a module upstream now requires one more field.** `bongos module new` scaffolds `{"status": "maintained"}` (the author is the maintainer — the honest default), so the friction lands only on modules scaffolded before this ADR.
 - **`orphaned` is now sayable, which means it will be said.** Expect the catalog to acquire visibly-unowned entries. That is the policy working: a labelled orphan is a candidate for adoption or deletion, an unlabelled one is a trap.
-- **`removeAfter` is declarative, not enforced.** Nothing deletes a module automatically — `expired` only reports that the core has advanced past the declared date. Automatic removal would need the review/accept flow to own module deletion, which is [ADR 0107](<redacted>.md) §1 territory and a separate decision.
+- **`removeAfter` is declarative, not enforced.** Nothing deletes a module automatically — `expired` only reports that the core has advanced past the declared date. Automatic removal would need the review/accept flow to own module deletion, which is [ADR 0107](0107-module-upstreaming-contribution-to-core-catalog.md) §1 territory and a separate decision.

package/docs/adr/0167-gate-trust-link-agpl-default.md

@@ -9,11 +9,11 @@
 
 The /create gate's "open source" trust link pointed at `github.com/example-owner/Claude-OTB` — a 404 even authenticated (the real core repo is private). Task 1002705's brief said to "default to the npm link so the 404 dies now," on the premise that `@cloudbongos/core` is public on the registry.
 
-That premise is false, verified 2026-08-12 against `registry.npmjs.org`: **both `@cloudbongos/core` and `@bongos/core` 404 anonymously** — they are private scoped packages (ADR 0134 publishes the core privately; npm shows private packages as 404 to signed-out visitors). The [ADR 0099](<redacted>.md) public mirror is deliberately dormant until history clears the 180-day redaction window (~2026-11). So today there is **no browsable public code artifact at all** — following the brief literally would swap one dead link for another.
+That premise is false, verified 2026-08-12 against `registry.npmjs.org`: **both `@cloudbongos/core` and `@bongos/core` 404 anonymously** — they are private scoped packages (ADR 0134 publishes the core privately; npm shows private packages as 404 to signed-out visitors). The [ADR 0099](0099-delayed-redacted-mirror-export.md) public mirror is deliberately dormant until history clears the 180-day redaction window (~2026-11). So today there is **no browsable public code artifact at all** — following the brief literally would swap one dead link for another.
 
 ## Decision
 
-Point the gate's "open source" link at the **AGPL-3.0 license text** (`https://www.gnu.org/licenses/agpl-3.0.html`) and tighten the copy to "open source (AGPL-3.0)". The license is the one live, instance-neutral artifact behind the claim today ([ADR 0065](<redacted>.md) — AGPL is the governance keystone), and the link carries no instance identity into the portable core.
+Point the gate's "open source" link at the **AGPL-3.0 license text** (`https://www.gnu.org/licenses/agpl-3.0.html`) and tighten the copy to "open source (AGPL-3.0)". The license is the one live, instance-neutral artifact behind the claim today ([ADR 0065](0065-agpl-nonprofit-ai-first-governance.md) — AGPL is the governance keystone), and the link carries no instance identity into the portable core.
 
 The upgrade to a *browsable-code* link is the owner's call, filed as **idea 1000700** with three options: flip the repo public now (forfeits the redaction window — weigh ADR 0065 §4), publish a public npm package, or wait for the ADR 0099 mirror (~2026-11, zero extra work). When one lands, repoint the `finePrint` link in `public-landing/create.html`; the pin is `tests/onboard.mjs` "the /create gate trust link points at a live artifact".
 

package/docs/adr/0167-module-catalog-source-vs-provenance.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-08-12
 - **Track:** internal
 - **Task:** [#1001772](https://cloudbongos.com/builders#/task/1001772) (BONGOS-V1, goal 1000029) — the browsable module catalog with author + origin credit.
-- **Builds on:** [ADR 0107](<redacted>.md) §2/§3/§6/§9 (upstreaming, attribution-as-portable-record, credit-now-money-later, default-off, the hall Modules tab), [ADR 0108](<redacted>.md) §1 (the loader discovers across BOTH the core package's `modules/` and the instance's own), [ADR 0083](<redacted>.md) (the manifest + loader), [ADR 0166](<redacted>.md) (the `maintenance` block the catalog surfaces).
+- **Builds on:** [ADR 0107](0107-module-upstreaming-contribution-to-core-catalog.md) §2/§3/§6/§9 (upstreaming, attribution-as-portable-record, credit-now-money-later, default-off, the hall Modules tab), [ADR 0108](0108-instance-composition-configurable-root.md) §1 (the loader discovers across BOTH the core package's `modules/` and the instance's own), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the manifest + loader), [ADR 0166](0166-module-maintenance-and-deprecation-policy.md) (the `maintenance` block the catalog surfaces).
 
 ## Context
 
@@ -34,11 +34,11 @@ A second, smaller problem: a catalog whose author/origin columns are blank for m
 - **Stamp `author`/`origin` into all ~15 core manifests.** Rejected: a repetitive diff that states the same fact fifteen times, and nothing keeps module sixteen from omitting it. The fallback derives it once, for every module, forever. (A module that *wants* a specific credit still declares one and wins — the fallback only fills a hole.)
 - **Overload `origin` to also mean "core-shipped".** Rejected — it is the attribution record ADR 0107 §2 deliberately defined as portable metadata, and `tests/modules_route.mjs` correctly pins provenance to the declared value. Writing a derived value into it would silently reclassify every core module as *core-loaded* and destroy the credit axis to fix the catalog one.
 - **Decide `source` from `default: true`** (core modules mostly ship default-on). Rejected as a coincidence, not a rule: ADR 0107 §6 requires *accepted* catalog modules to ship `default: false`, so the newest and most interesting catalog entries are exactly the ones this heuristic gets wrong.
-- **A `catalog` table in the DB.** Rejected as premature — the on-disk manifests already are the catalog, and a table would need writing at deploy time and could disagree with what actually mounted. Revisit if/when accepted submissions land from a real cross-repo channel ([ADR 0135](<redacted>.md)'s open question).
+- **A `catalog` table in the DB.** Rejected as premature — the on-disk manifests already are the catalog, and a table would need writing at deploy time and could disagree with what actually mounted. Revisit if/when accepted submissions land from a real cross-repo channel ([ADR 0135](0135-module-upstream-submission-interim-queue.md)'s open question).
 
 ## Consequences
 
 - **The hall's Modules tab sections by `source`, not `provenance`** — "Module catalog" (what the core ships, opt-in) and "Built by this project". The credit axis moved to the per-card chips where it belongs, and the "Submit for review" list is now drawn from `source: 'instance'`: a module that already ships with the core is by definition already in the catalog and cannot be submitted into it.
 - **The catalog is browsable from both surfaces with the same filter rule** — `searchCatalog()` over key/title/description/credit/licence, mirrored in the page's `matchesQuery()`. The hall filters client-side (the whole payload is already there); the CLI takes `--search`.
 - **`GET /modules` grew a `catalog` roll-up** and each row grew `source` + `credit`. Every pre-existing field is byte-identical, so an un-redeployed hall keeps working — `modules.js` falls back to the credit axis when `source` is absent.
-- **The credit fallback names the platform, not the host instance.** That string is the core's own name (like `CORE_PKG`), not host identity, so it does not cross the [ADR 0062](<redacted>.md) §7 core/host line and the BV1.R76 hardcoded-identity fitness check stays green.
+- **The credit fallback names the platform, not the host instance.** That string is the core's own name (like `CORE_PKG`), not host identity, so it does not cross the [ADR 0062](0062-medusa-instance-model-decoupling.md) §7 core/host line and the BV1.R76 hardcoded-identity fitness check stays green.

package/docs/adr/0169-bongos-serve-server-bring-up.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-08-13
 - **Task:** [#1002398](https://cloudbongos.com/builders#/task/1002398) (goal 1000052 — first-run onboarding), depends on [#1002397](https://cloudbongos.com/builders#/task/1002397).
-- **Extends:** [ADR 0149](<redacted>.md) (`bongos dev`, the local launcher). Sibling of [ADR 0108 §4](<redacted>.md) / [`instance-deploy.md`](../recipes/instance-deploy.md) (the *pinned-core consumer* deploy) and `provision.js` (the *control-plane* cloud path).
+- **Extends:** [ADR 0149](0149-bongos-dev-local-launcher.md) (`bongos dev`, the local launcher). Sibling of [ADR 0108 §4](0108-instance-composition-configurable-root.md) / [`instance-deploy.md`](../recipes/instance-deploy.md) (the *pinned-core consumer* deploy) and `provision.js` (the *control-plane* cloud path).
 
 ## Context
 

package/docs/adr/0171-profile-rollup-join-and-consent.md

@@ -25,7 +25,7 @@ Five facts found during this spike shape the decisions:
 
 **2. One safe read path, enforced next to the data.** The port exposes `getPublicProfileExtras(githubId)`: `null` unless the account exists, is publicly addressable (Decision 3), and `hide_stats` is false — otherwise `{ totals: { projects, credits, works_shipped, karma }, disciplines, last_active, projects: [{ name, origin, rank_held }...], more_projects }`, whitelist-shaped **inside the module** (`client_id` and raw rows never cross the port; non-numeric `github_id` values like the `system:*` principals return `null` instead of hitting a bigint cast error). Every surface that shows cross-project numbers reads through the module's filtered functions at render time, never from a stored copy — and that includes the two that already exist: **`listScoutingRollup` itself gains the `profile_state = 'active' AND NOT hide_stats` predicate and a whitelisted projection**, so `/people` and `/scouting` (live today at Metic floor) honor hide by construction, not by memory. The hub hall profile, the `/u/<handle>` page, recruiting (R14/R15) and applications (R09) all sit on the same functions, which is what makes C2's "honored live everywhere, including pending applications" structural. Two deliberate side doors, both narrow: `getOwnProfileExtras(githubId)` serves the builder their own numbers regardless of flags (Settings), and spike 1002785's recruiter flow is expected to add a second **authorization-scoped** read for its opt-in discoverability sliver — `hide_stats` is the invariant every reader honors; public addressability is not.
 
-**3. Consent is a fail-closed `profile_state` on `platform_identity_accounts`, with one discriminator.** Migration `<redacted>.sql` (lands with R02) adds `profile_state text NOT NULL DEFAULT 'provisional' CHECK (profile_state IN ('provisional','active'))` and `hide_stats boolean NOT NULL DEFAULT false`. The single rule: **an account is `active` iff it was touched by a hub-session `/sso/authorize`** — the one path where a human is demonstrably at the hub (and where T&C acceptance can later be captured, task 1002913). Device-poll and check-in create `provisional`; the rollup endpoint creates nothing (orphan activity rows are never publicly addressable). Backfill: **all existing accounts start `provisional`** and lazily upgrade on their next hub-session authorize — no join to core `builders` (that join is type-unsafe against `system:*` text ids and would put a core-table read inside a module migration; the price is that existing hub builders' profiles publish on their next sign-in rather than immediately). Public surfaces read only `active` accounts. **R02 ships this fail-closed default without waiting on P03**, because the asymmetry only runs one way: P03 can then only ever *widen* exposure, never claw back something already published. This deliberately narrows the Phase-4 interview's "no extra consent gate" to the accounts whose consent premise actually holds; P03 is the owner either ratifying that boundary (recommended) or reverting to the interview decision verbatim — and the revert branch has a named precondition: check-in/device-created identities have **no self-serve hide path** (no hub builder session exists for them; hub admission is invite-gated), so rejecting P03 first requires an assertion-authenticated hide path or open hub enrollment. Task 1002799 carries this full decision payload.
+**3. Consent is a fail-closed `profile_state` on `platform_identity_accounts`, with one discriminator.** Migration `platform_identity_007_profile_consent.sql` (lands with R02) adds `profile_state text NOT NULL DEFAULT 'provisional' CHECK (profile_state IN ('provisional','active'))` and `hide_stats boolean NOT NULL DEFAULT false`. The single rule: **an account is `active` iff it was touched by a hub-session `/sso/authorize`** — the one path where a human is demonstrably at the hub (and where T&C acceptance can later be captured, task 1002913). Device-poll and check-in create `provisional`; the rollup endpoint creates nothing (orphan activity rows are never publicly addressable). Backfill: **all existing accounts start `provisional`** and lazily upgrade on their next hub-session authorize — no join to core `builders` (that join is type-unsafe against `system:*` text ids and would put a core-table read inside a module migration; the price is that existing hub builders' profiles publish on their next sign-in rather than immediately). Public surfaces read only `active` accounts. **R02 ships this fail-closed default without waiting on P03**, because the asymmetry only runs one way: P03 can then only ever *widen* exposure, never claw back something already published. This deliberately narrows the Phase-4 interview's "no extra consent gate" to the accounts whose consent premise actually holds; P03 is the owner either ratifying that boundary (recommended) or reverting to the interview decision verbatim — and the revert branch has a named precondition: check-in/device-created identities have **no self-serve hide path** (no hub builder session exists for them; hub admission is invite-gated), so rejecting P03 first requires an assertion-authenticated hide path or open hub enrollment. Task 1002799 carries this full decision payload.
 
 > **P03 outcome — RATIFIED (owner, 2026-08-16, task 1002799).** The fail-closed boundary stands: check-in/device-created accounts stay `provisional` (not publicly listed, not at `/u/<handle>`, not in the sitemap or hub search) until their human signs in at the hub at least once. The owner's rationale: in the intended product flow a builder passes through cloudbongos.com at least once anyway — to find or create the projects they join — so the activation gate is satisfied naturally and costs nothing; the cloudbongos builders hall predating the hub flow is a one-time bootstrap exception, and those accounts lazily activate on their next hub sign-in exactly as the backfill rule above already provides (no backfill activation). Tasks 1002913 (T&C artifact) and 1002914 (criterion text amendments) unblock on this ship.
 

package/docs/adr/0172-editable-rank-roles-substrate-axis.md

@@ -7,7 +7,7 @@
 - **Related:** ADR 0016 (trust boundary — server-enforced, uncached, per request), 0043 (git/ssh trust boundary + the rank floor on protected paths), 0157 (the archon→metic delegation of nineteen operational keys)
 
 
-> **⚠ VOCABULARY AMENDED by [ADR 0174](<redacted>.md) (owner directive, 2026-08-16) — the DECISIONS below are unchanged.**
+> **⚠ VOCABULARY AMENDED by [ADR 0174](0174-government-terminology-ranks-not-roles.md) (owner directive, 2026-08-16) — the DECISIONS below are unchanged.**
 > What this ADR calls *governance* is now the **government**; what it calls *seeded roles* / *rank-roles* are now simply **ranks**. The word *role* is reserved for the three Cloud Bongos crafts — Artist, Ideator, Builder — and appears nowhere on the government side.
 > Concretely: `governance_roles` → `government_ranks`, `governance_builder_roles` → `government_builder_ranks`, `governance_role_permissions` → `government_rank_permissions`, `role_key` → `rank_key`, `governance.manage` → `government.manage`, `page.view.governance` → `page.view.government`, `/governance/roles/*` → `/government/ranks/*`, and `modules/governance/` → `modules/government/`.
 > **The body below is deliberately left in the old vocabulary.** An ADR records what was decided and why at a point in time; rewriting it to match today's words would erase the evidence that the words changed — which is the one thing a reader who hits "rank-role" in an old session log actually needs. Every decision it makes still holds; only the nouns moved. A `fitness.js` check now enforces the new vocabulary, and excludes this file by construction.
@@ -19,7 +19,7 @@ The governance tab (BV1.R110/R111) let an Archon build custom roles and toggle t
 
 Three facts made this cheaper and narrower than the read-only rendering suggested:
 
-1. **The rank roles' grants were already ordinary rows.** `<redacted>.sql` writes them into `governance_role_permissions` exactly like a custom role's. The immutability was a route-level refusal (`loadMutableRole` → `seeded_role_immutable`) plus a disabled toggle — policy, not structure. Nothing had to be remodelled to make them editable.
+1. **The rank roles' grants were already ordinary rows.** `governance_002_seed_and_backfill.sql` writes them into `governance_role_permissions` exactly like a custom role's. The immutability was a route-level refusal (`loadMutableRole` → `seeded_role_immutable`) plus a disabled toggle — policy, not structure. Nothing had to be remodelled to make them editable.
 2. **The `system` flag was carrying two different meanings.** ADR 0151 used one boolean for "trust-boundary power," but the twelve `system:true` keys split cleanly in two. Seven are **in-app**: a real route reads them through `requirePermission`, so a grant row genuinely confers them (`builder.rank.set`, `version.close`, `task.confirm.grade_bypass`, `dependency.cross_tier.manage`, `goal.scope.manage`, `governance.manage`, `gate_approval.decide`). Three are **substrate**: `deploy.push_main`, `path.protected.modify`, `infra.ssh` are enforced entirely outside the app by the pre-push hook, `main-audit.js`, the grader pre-pass and credential placement (ADR 0043) — `tests/government_abuse_matrix.mjs` V10 asserts *no route consumes them* at all. Two are **principal** keys, held by an exact `builders.system_role` identity and by no role ever.
 3. **A grant row for a substrate key is inert.** It resolves honestly and admits nothing (abuse matrix V8/V10/V11). So the interesting question was never "is it dangerous to allow" but "would allowing it be *true*" — and it would not be.
 

package/docs/adr/0172-per-craft-compensation-ideator-credit-lane.md

@@ -5,7 +5,7 @@
 - **Deciders:** Lars (owner / Archon), Claude (Opus 5)
 - **Track:** `internal` (Cloud Bongos — economy)
 - **Task:** BV1.R171 ([#1002995](https://cloudbongos.com/builders#/task/1002995)) — the foundation of the **Ideator compensation** goal ([#1000067](https://cloudbongos.com/builders#/goal/1000067)).
-- **Builds on:** [ADR 0054](<redacted>.md) (cost-plus session reward), [ADR 0146](<redacted><redacted>.md) (`rewardPolicy` + the `cost-plus-only` mode), [ADR 0023](<redacted>.md) (kind multipliers + the 25% idea-promotion slice), [ADR 0120](<redacted>.md) (pay-on-land).
+- **Builds on:** [ADR 0054](0054-session-token-reward-cost-plus.md) (cost-plus session reward), [ADR 0146](<redacted><redacted>.md) (`rewardPolicy` + the `cost-plus-only` mode), [ADR 0023](0023-kind-multipliers-and-idea-bonus.md) (kind multipliers + the 25% idea-promotion slice), [ADR 0120](0120-pay-on-land-and-builder-owned-rebase-gate.md) (pay-on-land).
 - **Relates to:** goal 1000062 (three grades of idea — R141/R142/R143 shipped), idea 1000738 (the Board Room).
 - **Gates:** IC2 ([#1002996](https://cloudbongos.com/builders#/task/1002996)) · IC3 ([#1002997](https://cloudbongos.com/builders#/task/1002997)) · IC4 ([#1002998](https://cloudbongos.com/builders#/task/1002998)) · IC5 ([#1002999](https://cloudbongos.com/builders#/task/1002999)) · IC6 ([#1003000](https://cloudbongos.com/builders#/task/1003000)).
 
@@ -14,9 +14,9 @@
 ## Context
 
 Cloud Bongos pays **one kind of worker one way**. The equity stream is the
-cost-plus session reward ([ADR 0054](<redacted>.md)):
+cost-plus session reward ([ADR 0054](0054-session-token-reward-cost-plus.md)):
 `round(true_cost_usd × (1 + margin))`, booked when a shipped session lands. On
-top of that, [ADR 0023](<redacted>.md) pays the
+top of that, [ADR 0023](0023-kind-multipliers-and-idea-bonus.md) pays the
 capturer of a promoted idea a **25% slice** of the resulting task's estimate
 when it ships, and [ADR 0146](<redacted><redacted>.md)
 lets an instance switch to `cost-plus-only`, which **withholds every per-task
@@ -50,7 +50,7 @@ lane, because that lane is a different craft's pay.
 
 The reward model gains a **named lane per craft**, not a single tunable payout:
 
-- **Builder (engineer)** — the cost-plus session reward ([ADR 0054](<redacted>.md)) plus, where `mode !== 'cost-plus-only'`, the per-task estimate ([ADR 0146](<redacted><redacted>.md)). Unchanged.
+- **Builder (engineer)** — the cost-plus session reward ([ADR 0054](0054-session-token-reward-cost-plus.md)) plus, where `mode !== 'cost-plus-only'`, the per-task estimate ([ADR 0146](<redacted><redacted>.md)). Unchanged.
 - **Ideator** — the **idea credit lane** defined here (three streams, §3). Governed by its **own** policy flag, **never** by `perTaskCredit`.
 - **Artist** — a lane of its own, **deliberately left unspecified here** (the artist craft — grading, copy, voice — is scoped in later ABI work). This ADR reserves the *shape* (a named lane) so the artist lane slots in the same way; it does not define the artist's pay.
 

package/docs/adr/0173-legacy-multi-ship-shortfall-not-backfilled.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-08-16
 - **Task:** [#1002520](https://cloudbongos.com/builders#/task/1002520) (goal 1000037 — pay-on-land incentive alignment)
-- **Related:** ADR 0054 (cost-plus reward — `round(true_cost_usd × 1.20)`), ADR 0120 (pay-on-land), ADR 0146 (cost-plus-only), core migration `<redacted>.sql` (the `reward_basis` watermark)
+- **Related:** ADR 0054 (cost-plus reward — `round(true_cost_usd × 1.20)`), ADR 0120 (pay-on-land), ADR 0146 (cost-plus-only), core migration `core_196_session_reward_topup.sql` (the `reward_basis` watermark)
 
 ## Context
 

package/docs/adr/0174-government-terminology-ranks-not-roles.md

@@ -46,7 +46,7 @@ This was the closest call in the directive, and it was decided against the alter
 
 **The database rename and the constant rename must land in the same deploy.** `government_rank_permissions.permission_key` stores `governance.manage` as text, and `catalog.js` holds the same string as a code constant. If the rows change while the old code is still serving, every `governance.manage` check fails closed — and because that key is what gates the Government tab, the failure mode is the Owner locked out of the surface they would use to investigate. R03 and R05 are sequenced accordingly, and R03 takes a backup first.
 
-**Two ADRs currently claim the number 0172**, so "ADR 0172" no longer identifies a decision on its own. This ADR amends `<redacted>.md`; the other is `<redacted>.md`. Filed as idea 1000753 with a proposed guard (fail CI on a duplicate ADR number); deliberately not fixed here, because renumbering an ADR mid-rename would put two independent reference churns in the same diff.
+**Two ADRs currently claim the number 0172**, so "ADR 0172" no longer identifies a decision on its own. This ADR amends `0172-editable-rank-roles-substrate-axis.md`; the other is `0172-per-craft-compensation-ideator-credit-lane.md`. Filed as idea 1000753 with a proposed guard (fail CI on a duplicate ADR number); deliberately not fixed here, because renumbering an ADR mid-rename would put two independent reference churns in the same diff.
 
 **ADR 0151 and ADR 0172 get amendment notes, not rewrites.** Their bodies stay in the old vocabulary. An ADR records what was decided and why at a point in time; editing the prose to match today's words would quietly erase the evidence that the words changed — which is the one thing a reader hitting "rank-role" in an old session log will need.
 

package/docs/adr/0177-goal-membership-kind.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-08-18
 - **Tasks:** [#1003013](https://cloudbongos.com/builders#/task/1003013) (goal 1000068 — government terminology; unlinked from the goal's criteria on 2026-08-18 because it is a live-column migration, not a naming pass)
-- **Extends:** [ADR 0174](<redacted>.md) — the reserved-word rule, applied to the fourth use it did not cover
+- **Extends:** [ADR 0174](0174-government-terminology-ranks-not-roles.md) — the reserved-word rule, applied to the fourth use it did not cover
 - **Related:** ADR 0016 (authority resolved server-side, per request, uncached), 0086 (goals + scope walls), 0154 (goal owner/manager authors criteria), 0137/0161 (land → release → deploy are three gates)
 
 ## Context
@@ -51,7 +51,7 @@ previous release querying a column that no longer exists — every goal-membersh
 authz path. `tests/migrations_forward_safe.mjs` exists to catch precisely this, and it would have caught
 it here. So:
 
-- **Step 1 (`<redacted>.sql`, this task)** — ADD `membership_kind`, backfill
+- **Step 1 (`core_220_goal_members_membership_kind.sql`, this task)** — ADD `membership_kind`, backfill
   it from `role`, copy the `CHECK`, and keep the two columns in lockstep with a **BEFORE INSERT OR
   UPDATE trigger** whose direction is decided by which side changed. Both names therefore work for one
   release: new code writes `membership_kind`; the historical `lifecycle_001` seed and any older release
@@ -131,7 +131,7 @@ one is still written (NULL then means exactly "not written"), and `DEFAULT` + `N
 arrive together in step 2. `core_220` shipped with the defective form and was corrected
 the same day under task [#1003093](https://cloudbongos.com/builders#/task/1003093) — there
 the same statement demoted a goal's first lead to `member` on a fresh install
-(`<redacted>.sql` runs after the core migrations), and no production
+(`lifecycle_001_goal_first_leads.sql` runs after the core migrations), and no production
 row was ever affected because the pin still served 1.19.218; the invariant is
 pinned statically by `tests/membership_kind_lockstep.mjs`, since the trigger only
 misbehaves against a live Postgres and CI has none.

package/docs/adr/0178-the-copy-desk-flag-and-queue.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-08-19
 - **Tasks:** [#1003113](https://cloudbongos.com/builders#/task/1003113) (R02 of goal 1000074, the artist's loop) — builds on [#1003112](https://cloudbongos.com/builders#/task/1003112) (R01, the copy registry)
-- **Extends:** [ADR 0081](<redacted>.md) — the repo is the source of truth for design, with swappable tool adapters. This is the same claim for TEXT.
+- **Extends:** [ADR 0081](0081-tool-agnostic-design-layer.md) — the repo is the source of truth for design, with swappable tool adapters. This is the same claim for TEXT.
 - **Related:** ADR 0083 (module system, module-owned migrations), 0086 (goals + scope walls), 0016 (authority resolved server-side), 0162 (grader verdicts are advisory, never self-executing), 0175 (an objection requires a reason)
 
 ## Context

package/docs/adr/0179-board-membership-predicate-grammar.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-08-19
 - **Tasks:** [#1003094](https://cloudbongos.com/builders#/task/1003094) (goal 1000069, the Board Room). Blocks R25's sign-off ([#1003038](https://cloudbongos.com/builders#/task/1003038)); unblocks the charter-library fix ([#1003095](https://cloudbongos.com/builders#/task/1003095))
-- **Amends:** [ADR 0175](<redacted>.md) §7 — the constitution's `board.membership` predicate
+- **Amends:** [ADR 0175](0175-the-board-room-full-idea-ratification.md) §7 — the constitution's `board.membership` predicate
 - **Related:** ADR 0016 (authority server-side, per request, uncached), 0034 (rank inheritance), 0174 (ranks are ranks), 0083 (a module may not import a sibling)
 
 ## Context

package/docs/adr/0181-teardown-state-gate-and-address-retention.md

@@ -5,7 +5,7 @@
 - **Task:** [task 1003042](https://cloudbongos.com/builders#/task/1003042) (BONGOS-V1, goal 1000058 — *Non-cloudbongos project lifecycle*)
 - **Deciders:** jaxri (Archon), Claude
 - **Supersedes nothing. Bounds:** [task 1002897](https://cloudbongos.com/builders#/task/1002897) (address reclaim) owns the half this ADR deliberately does not do.
-- **Related:** [ADR 0111](<redacted>.md) (the provisioning module + intent/runner split), [ADR 0157](<redacted>.md) (permission floors)
+- **Related:** [ADR 0111](0111-instance-hosting-provisioning-module.md) (the provisioning module + intent/runner split), [ADR 0157](0157-archon-is-rank-and-identity-only.md) (permission floors)
 
 ---
 

package/docs/adr/0182-project-visibility-two-axes.md

@@ -6,7 +6,7 @@
 - **Deciders:** IAMMASTERQUA (Archon), Claude
 - **Confirms R04–R18** — the full accounting is in *Scope* below, including the two that this ADR deliberately does **not** govern.
 - **Bounds — deliberately NOT decided here:** the self-hosted→hub *reporting and trust* mechanics ([task 1002321](https://cloudbongos.com/builders#/task/1002321), R02) · the applications/invite *model* (`docs/specs/<redacted>.md` D2, already decided) · project *authority* (same spec, D1)
-- **Related:** [ADR 0141](<redacted>.md) (hub = identity + relay, authority stays local) · [ADR 0112](<redacted>.md) (`goals.visibility`, the precedent this copies) · [ADR 0108](<redacted>.md) (the instance IS the project) · [ADR 0174](<redacted>.md) (one word, one meaning)
+- **Related:** [ADR 0141](<redacted>.md) (hub = identity + relay, authority stays local) · [ADR 0112](0112-private-goals-invitations-join-requests.md) (`goals.visibility`, the precedent this copies) · [ADR 0108](0108-instance-composition-configurable-root.md) (the instance IS the project) · [ADR 0174](0174-government-terminology-ranks-not-roles.md) (one word, one meaning)
 
 ---
 

package/docs/adr/0183-criteria-close-themselves.md

@@ -3,7 +3,7 @@
 - **Status:** accepted
 - **Date:** 2026-08-21
 - **Task:** 1002069 (owner request 2026-07-05, scope owner-confirmed)
-- **Supersedes part of:** [ADR 0086](<redacted>.md) §6 / BV1.R63 — the criterion auto-flag stays, but confirming it is no longer the only way a criterion closes.
+- **Supersedes part of:** [ADR 0086](0086-goal-scoped-work-hierarchy.md) §6 / BV1.R63 — the criterion auto-flag stays, but confirming it is no longer the only way a criterion closes.
 
 ## Context
 

package/docs/adr/0184-ship-requires-an-assurance.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-08-19
 - **Tasks:** [#1002483](https://cloudbongos.com/builders#/task/1002483) (goal 1000024, build-pipeline integrity). Carried forward from blocker 1000047
-- **Extends:** [ADR 0120](<redacted>.md) — pay on land. This makes "land" checkable at the write.
+- **Extends:** [ADR 0120](0120-pay-on-land-and-builder-owned-rebase-gate.md) — pay on land. This makes "land" checkable at the write.
 - **Related:** ADR 0055 (server-mediated publish), 0137 (land → release → deploy are three gates), 0082 (generated-file conflict resolver); tasks 1313 / 1547 / 1002615 / 1002724 (the per-task land proof), [#1002478](https://cloudbongos.com/builders#/task/1002478) (the no-artifact dead end)
 
 ## Context

package/docs/adr/0185-spark-handoff-credit-split.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-08-22
 - **Tasks:** [#1002923](https://cloudbongos.com/builders#/task/1002923) (BV1.R147, goal 1000062 — three grades of idea). Completes the spark chain: [#1002920](https://cloudbongos.com/builders#/task/1002920) (the mark), [#1002921](https://cloudbongos.com/builders#/task/1002921) (the queue), [#1002922](https://cloudbongos.com/builders#/task/1002922) (the pickup)
-- **Extends:** [ADR 0172](<redacted>.md) — the ideator credit lane. That ADR built the streams and paid `captured_by`; this one decides what happens when `captured_by` is not the only person who made the idea.
+- **Extends:** [ADR 0172](0172-per-craft-compensation-ideator-credit-lane.md) — the ideator credit lane. That ADR built the streams and paid `captured_by`; this one decides what happens when `captured_by` is not the only person who made the idea.
 - **Related:** ADR 0023 (the original idea-promotion slice), 0146 (reward-mode machinery), 0054 (cost-plus)
 
 ## Context

package/docs/adr/0186-per-project-idea-templates.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted (spike outcome — decisions below; no implementation in this task)
 - **Date:** 2026-08-23
 - **Tasks:** [#1002932](https://cloudbongos.com/builders#/task/1002932) (BV1.R156, goal 1000062 — three grades of idea). Spike output: this ADR plus the downstream task list in §7. Gates criterion `abi-full-idea-base-template`.
-- **Builds on:** [ADR 0172](<redacted>.md) (the ideator credit lane), [ADR 0185](<redacted>.md) (the 70/30 split), [ADR 0083](<redacted>.md) (module boundary + module-owned migrations)
+- **Builds on:** [ADR 0172](0172-per-craft-compensation-ideator-credit-lane.md) (the ideator credit lane), [ADR 0185](0185-spark-handoff-credit-split.md) (the 70/30 split), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (module boundary + module-owned migrations)
 - **Related:** R141 (`modules/ideas/templates.js` — the template declaration), R142 (`modules/ideas/completeness.js` — the deterministic scorer)
 
 ## 1. Context

package/docs/adr/0187-collab-four-decisions.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-08-24
 - **Tasks:** [#1003170](https://cloudbongos.com/builders#/task/1003170) (goal 1000075 — collaboration and the social hall). Settles the questions criteria `collab-pass-a-task`, `collab-closeness-consented` and `collab-mingle-two-switches` were each carrying.
-- **Related:** [ADR 0171](<redacted>.md) (fail-closed consent in the READ path), ADR 0032 / 0033 (Discord as a one-way mirror, outside the trust boundary), [ADR 0120](<redacted>.md) (pay on land)
+- **Related:** [ADR 0171](0171-profile-rollup-join-and-consent.md) (fail-closed consent in the READ path), ADR 0032 / 0033 (Discord as a one-way mirror, outside the trust boundary), [ADR 0120](0120-pay-on-land-and-builder-owned-rebase-gate.md) (pay on land)
 
 ## 1. Why this ADR exists at all
 

package/docs/adr/0187-oauth-handshake-cookie-lifetime.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-08-24
 - **Tasks:** [#1003234](https://cloudbongos.com/builders#/task/1003234) (goal 1000058 — the non-cloudbongos project lifecycle; a walk finding from the 2026-08-24 stranger's-walk review, task 1003232)
-- **Builds on:** [ADR 0143](<redacted>.md) (the `gds_oauth_repos` opt-in cookie), #726/#734 (the `gds_return` return cookie and the apex-scoped state)
+- **Builds on:** [ADR 0143](0143-onboarding-repo-picker-oauth-scope.md) (the `gds_oauth_repos` opt-in cookie), #726/#734 (the `gds_return` return cookie and the apex-scoped state)
 - **Related:** [ADR 0141](<redacted>.md) (the federated leg shares the same state cookie)
 
 ## 1. Context

package/docs/adr/0188-patrol-runs-on-ci-not-the-server.md

@@ -3,8 +3,8 @@
 - **Status:** Accepted
 - **Date:** 2026-08-24
 - **Tasks:** [#1003209](https://cloudbongos.com/builders#/task/1003209) (goal 1000079 — pay down the frozen debt and make enforcement durable; criterion C4 `reduction-durable`)
-- **Builds on:** [ADR 0078](<redacted>.md) (deterministic-first routines + the `run-routine.js` dispatcher), [ADR 0180](<redacted>.md) §3 (the patrol's dependency checks), [ADR 0022](0022-secrets-policy.md) (the prevent → gate → patrol layering)
-- **Related:** [ADR 0162](<redacted>.md) (patrol findings are advisory — verdicts never self-execute), [ADR 0093](<redacted>.md) §1 (where `routine-timers.js` landed — the in-process poller seam this deliberately does *not* use)
+- **Builds on:** [ADR 0078](0078-deterministic-first-cron.md) (deterministic-first routines + the `run-routine.js` dispatcher), [ADR 0180](0180-dependency-intake-and-drift-policy.md) §3 (the patrol's dependency checks), [ADR 0022](0022-secrets-policy.md) (the prevent → gate → patrol layering)
+- **Related:** [ADR 0162](0162-review-gates-retired-rank-consistent-ci-only.md) (patrol findings are advisory — verdicts never self-execute), [ADR 0093](0093-tranche-2-core-carve-sequence.md) §1 (where `routine-timers.js` landed — the in-process poller seam this deliberately does *not* use)
 
 ## 1. Context
 

package/docs/adr/0189-baseline-floors-and-the-freeze-detector.md

@@ -3,8 +3,8 @@
 - **Status:** Accepted
 - **Date:** 2026-08-24
 - **Tasks:** [#1003210](https://cloudbongos.com/builders#/task/1003210) (goal 1000079 — criterion C4 `reduction-durable`)
-- **Builds on:** [ADR 0180](<redacted>.md) (shrink-only baselines), [ADR 0188](<redacted>.md) (the weekly patrol that now files this)
-- **Related:** [ADR 0091](<redacted>.md) §2 (the boundary-forced duplication that gets the first declared floor), [ADR 0162](<redacted>.md) (findings are advisory)
+- **Builds on:** [ADR 0180](0180-dependency-intake-and-drift-policy.md) (shrink-only baselines), [ADR 0188](0188-patrol-runs-on-ci-not-the-server.md) (the weekly patrol that now files this)
+- **Related:** [ADR 0091](0091-bounding-the-kernel-and-db-carve.md) §2 (the boundary-forced duplication that gets the first declared floor), [ADR 0162](0162-review-gates-retired-rank-consistent-ci-only.md) (findings are advisory)
 
 ## 1. Context
 

package/docs/adr/0191-majority-and-the-author-who-may-not-decide-alone.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-08-25
 - **Tasks:** [#1003273](https://cloudbongos.com/builders#/task/1003273). Diagnosis and companion fix: [#1003271](https://cloudbongos.com/builders#/task/1003271) (the summons), [#1003269](https://cloudbongos.com/builders#/task/1003269) (the Government tab order).
-- **Supersedes, in part:** [ADR 0175](<redacted>.md) — §3's pass-rule set (`first_ratifier | consent`) and §§7/11's flat anti-self-vote rule. Everything else in 0175 stands, including §8 (Discord is outbound-only, never a ballot), which this decision explicitly re-affirms.
+- **Supersedes, in part:** [ADR 0175](0175-the-board-room-full-idea-ratification.md) — §3's pass-rule set (`first_ratifier | consent`) and §§7/11's flat anti-self-vote rule. Everything else in 0175 stands, including §8 (Discord is outbound-only, never a ballot), which this decision explicitly re-affirms.
 
 ## 1. The report, and why the obvious diagnosis was wrong