@bongos/core 1.19.714 → 1.19.724

package/docs/adr/0097-one-active-claim-per-session-and-worktree-binding.md

@@ -4,7 +4,7 @@
 **Status:** Accepted
 **Track:** `internal` (development system / lifecycle)
 **Task:** [#1642](https://example.com/builders#/task/1642) (GDS-V4)
-**Amends:** [ADR 0049](<redacted>.md) (the parallel-safety contract). 0049 fixed *cross-claim* parallel safety (two claims colliding); this adds the missing *within-session* invariant.
+**Amends:** [ADR 0049](0049-split-parallel-safety-contract.md) (the parallel-safety contract). 0049 fixed *cross-claim* parallel safety (two claims colliding); this adds the missing *within-session* invariant.
 
 ## Context — the commingled-ship hole
 
@@ -38,7 +38,7 @@ The default claim flow (`.claude/skills/builder-claim/SKILL.md`) ensures the tas
 - **Predicate divergence from the task spec, on purpose.** The spec cited `WHERE status='active'`, but `claims` has **no `status` column** — "active" is the table's `released_at IS NULL` convention (the row's lifecycle status lives on `tasks`). The index uses the real column.
 - **Migration safety.** A unique index *fails to create* if existing rows already violate it, which would block deploy. The migration first heals any current violation (keep the earliest active bound claim per session, close the rest — the same shape as migration 174), so the `CREATE` always succeeds; it is idempotent. The **app-layer guard is authoritative**; the index is belt-and-braces and must not break deploy.
 
-> **Amended 2026-08-06 (task 1002570 / `core_204`).** The index as shipped was *stricter* than the worktree-scoped guard above: keyed on `creator_session_id` alone, it refused at the DB layer the second-worktree parallel claim the guard deliberately allows — breaking the many-sessions-per-builder norm this ADR set out to preserve. `migrations/<redacted>.sql` re-keys it to `(creator_session_id, COALESCE(worktree_name, ''))` under the name `uniq_active_claim_per_session_worktree`, same partial predicate, so the backstop now enforces exactly the guard's boundary. The `COALESCE` fold (rather than PG15's `NULLS NOT DISTINCT`) is load-bearing: a plain composite index treats NULLs as distinct, so two worktree-less claims off one shared clone would both insert and re-open the commingling hole. A `23505` from either index generation surfaces as `session_already_has_bound_claim` (task 1002589), never the false `ALREADY_CLAIMED`.
+> **Amended 2026-08-06 (task 1002570 / `core_204`).** The index as shipped was *stricter* than the worktree-scoped guard above: keyed on `creator_session_id` alone, it refused at the DB layer the second-worktree parallel claim the guard deliberately allows — breaking the many-sessions-per-builder norm this ADR set out to preserve. `migrations/core_204_rekey_active_claim_per_session_worktree.sql` re-keys it to `(creator_session_id, COALESCE(worktree_name, ''))` under the name `uniq_active_claim_per_session_worktree`, same partial predicate, so the backstop now enforces exactly the guard's boundary. The `COALESCE` fold (rather than PG15's `NULLS NOT DISTINCT`) is load-bearing: a plain composite index treats NULLs as distinct, so two worktree-less claims off one shared clone would both insert and re-open the commingling hole. A `23505` from either index generation surfaces as `session_already_has_bound_claim` (task 1002589), never the false `ALREADY_CLAIMED`.
 
 > **Amended 2026-08-11 (task 1002522) — the guard and the index now fold tree identity identically.** `core_204`'s key folds `NULL` and `''` together (`COALESCE(worktree_name, '')`); the guard compared raw values, where `'' !== null`. So a claim sent with `worktree_name: ""` (the route caps the length but never required non-empty) was waved through beside a worktree-less claim and *then* refused by the index — a `23505` on a task nobody had taken. `db.foldWorktreeName` is now the single normalization: it folds empty/whitespace-only to `NULL` and trims, and it is applied at **every ingest point** (`claimTask`, `claimTasksBatch`'s prefix, and `shouldRefuseSessionClaim`), so stored names are always trimmed-or-`NULL` and the guard's comparison of stored rows is exact by construction. Pinned DB-free in `tests/one_active_claim_per_session.mjs`.
 >

package/docs/adr/0097-retroactive-reward-backfill.md

@@ -4,7 +4,7 @@
 - **Status:** Accepted
 - **Track:** `internal` (GDS / economy)
 - **Task:** [#1672](https://example.com/builders#/task/1672)
-- **Relates to:** [ADR 0023](<redacted>.md) (per-task kind multipliers), [ADR 0054](<redacted>.md) (cost-plus session reward)
+- **Relates to:** [ADR 0023](0023-kind-multipliers-and-idea-bonus.md) (per-task kind multipliers), [ADR 0054](0054-session-token-reward-cost-plus.md) (cost-plus session reward)
 
 ## Context — the gap
 
@@ -19,10 +19,10 @@ per-task stream.
 There are **two reward streams** a builder accrues to `builders.total_credits`:
 
 1. **Per-task** — `reason='task.confirmed'`, the kind-multiplied `credits_reward`
-   ([ADR 0023](<redacted>.md)). This is the stream
+   ([ADR 0023](0023-kind-multipliers-and-idea-bonus.md)). This is the stream
    that paid 0 for the affected tasks.
 2. **Cost-plus session** — `reason='session.token_reward'`,
-   `round(true_cost_usd × 1.20)` per shipped session ([ADR 0054](<redacted>.md)).
+   `round(true_cost_usd × 1.20)` per shipped session ([ADR 0054](0054-session-token-reward-cost-plus.md)).
    This was supposed to backstop the per-task gap, but it pays **~0 for dev-box /
    CI agent ships**: those sessions upload no priced model usage, so
    `priceModelUsage` returns ~$0 and the reward rounds to 0. So for exactly the
@@ -85,7 +85,7 @@ self-describing convention of the other credit_log writers (migration 031).
   safe to ship inert.
 - **`--apply` requires ALL of:** the explicit `--apply` flag; an **Archon rank**
   verified server-side via `GET /api/gds/me` (the script refuses for any other
-  rank — markdown/local edits cannot grant authority, [ADR 0016](<redacted>.md));
+  rank — markdown/local edits cannot grant authority, [ADR 0016](0016-trust-boundary-server-enforced-permissions.md));
   and an **interactive y/N confirmation** at the terminal.
 - **Never acts on import/require.** All work is inside `main()`, gated on
   `require.main === module`. Importing the file (the unit test does) touches no DB

package/docs/adr/0098-public-mirror-publish-manifest.md

@@ -4,13 +4,13 @@
 - **Date:** 2026-06-30
 - **Track:** internal
 - **Task:** [#1210](https://example.com/builders#/task/1210) (V4.R71) — the publishable-subtree carve-out + the public mirror repo.
-- **Builds on:** [ADR 0065](<redacted>.md) §4 (the AGPL decision + the prose publish boundary this task makes executable), [ADR 0062](<redacted>.md) §1 (the portable-core / host-instance / feature-module cut-line), [ADR 0043](<redacted>.md) (`PROTECTED_GLOBS`), [ADR 0058](<redacted>.md) (the gate-review "no allow-by-omission" doctrine this borrows).
+- **Builds on:** [ADR 0065](0065-agpl-nonprofit-ai-first-governance.md) §4 (the AGPL decision + the prose publish boundary this task makes executable), [ADR 0062](0062-medusa-instance-model-decoupling.md) §1 (the portable-core / host-instance / feature-module cut-line), [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (`PROTECTED_GLOBS`), [ADR 0058](0058-automatic-gate-surface-gatekeeper.md) (the gate-review "no allow-by-omission" doctrine this borrows).
 - **Gates:** [#1211](https://example.com/builders#/task/1211) (R72 — the delayed export pipeline, which *consumes* this manifest) and [#1212](https://example.com/builders#/task/1212) (R73 — the lineage + no-leak proof, which *asserts against* it).
-- **Referenced by:** [ADR 0108](<redacted>.md) §2 — `isPublishable()` stays the single definition of "the core," now read as "the core npm package's contents," not just the mirror/package-core tarball subtree.
+- **Referenced by:** [ADR 0108](0108-instance-composition-configurable-root.md) §2 — `isPublishable()` stays the single definition of "the core," now read as "the core npm package's contents," not just the mirror/package-core tarball subtree.
 
 ## Context
 
-[ADR 0065](<redacted>.md) §4 defined the public-mirror boundary in **prose**: publish the portable methodology core + the platform + the neutral (customer-0) branding + sanitized docs; never publish secrets, instance identity literals, prod infra, or the customer-1 (Example) game/art content. That prose is the policy. But R72 (the generated, redacted, 6-month-delayed export) and R73 (the no-leak proof) need the boundary as an **executable, drift-proof artifact** — not a paragraph a future builder has to re-interpret per file.
+[ADR 0065](0065-agpl-nonprofit-ai-first-governance.md) §4 defined the public-mirror boundary in **prose**: publish the portable methodology core + the platform + the neutral (customer-0) branding + sanitized docs; never publish secrets, instance identity literals, prod infra, or the customer-1 (Example) game/art content. That prose is the policy. But R72 (the generated, redacted, 6-month-delayed export) and R73 (the no-leak proof) need the boundary as an **executable, drift-proof artifact** — not a paragraph a future builder has to re-interpret per file.
 
 The task instructs reusing the existing `PROTECTED_GLOBS` / `SENSITIVE_DOC_GLOBS` inventories. The catch: **those inventories are necessary but not sufficient, and `PROTECTED_GLOBS` is emphatically not a denylist.**
 

package/docs/adr/0099-delayed-redacted-mirror-export.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-06-30
 - **Track:** internal
 - **Task:** [#1211](https://example.com/builders#/task/1211) (V4.R72) — the delayed export pipeline + source-level redaction. The XL long-pole of GDS-V4 criterion **C9** (Cloud Bongos is open, free, and protected from capture).
-- **Builds on:** [ADR 0098](<redacted>.md) (the publishable-subtree manifest this pipeline *consumes*), [ADR 0065](<redacted>.md) §4 (the publish boundary + the "redact instance literals" mandate), [ADR 0022](0022-secrets-policy.md) (the secret scrubber this reuses), [ADR 0029](<redacted>.md) / [#741](https://example.com/builders#/task/741) (the scoped-deploy-key mirror-push precedent).
+- **Builds on:** [ADR 0098](0098-public-mirror-publish-manifest.md) (the publishable-subtree manifest this pipeline *consumes*), [ADR 0065](0065-agpl-nonprofit-ai-first-governance.md) §4 (the publish boundary + the "redact instance literals" mandate), [ADR 0022](0022-secrets-policy.md) (the secret scrubber this reuses), [ADR 0029](0029-status-page-outage-resilience.md) / [#741](https://example.com/builders#/task/741) (the scoped-deploy-key mirror-push precedent).
 - **Gates:** [#1212](https://example.com/builders#/task/1212) (R73 — the lineage + no-leak proof) reuses this pipeline's `findLeaks` + `.mirror-provenance.json`.
 
 ## Context

package/docs/adr/0100-two-repo-instance-model.md

@@ -1,14 +1,14 @@
 # ADR 0100 — Two-repo instance model: a project consumes Cloud Bongos as a versioned platform
 
-- **Status:** Accepted — **§§1–2 superseded by [ADR 0103](<redacted>.md)** (2026-07-02 owner review: core-first extraction, and Example *does* split rather than staying coupled). §3 (per-repo GDS) and §4 (conditional mirror) remain in force.
+- **Status:** Accepted — **§§1–2 superseded by [ADR 0103](0103-core-first-extraction-cloud-bongos-trunk.md)** (2026-07-02 owner review: core-first extraction, and Example *does* split rather than staying coupled). §3 (per-repo GDS) and §4 (conditional mirror) remain in force.
 - **Date:** 2026-07-01
 - **Track:** internal
 - **Task:** [#1607](https://example.com/builders#/task/1607) (BV1.R77) — the decision gate this ADR resolves.
-- **Decides:** the physical-repo topology that [ADR 0062](<redacted>.md) §10 left open and [ADR 0065](<redacted>.md) §4 answered for the *open-source* surface only.
-- **Builds on:** [ADR 0062](<redacted>.md) §1 (portable-core / host-instance / feature-module cut-line), [ADR 0064](<redacted>.md) (the Cloud Bongos rename), [ADR 0083](<redacted>.md) + [ADR 0093](<redacted>.md) (the module boundary + completed core-carve that make the split mechanical), [ADR 0098](<redacted>.md) (`isPublishable()` — the executable definition of "what is the core"), [ADR 0099](<redacted>.md) (the delayed mirror), [ADR 0015](<redacted>.md) (dependencies).
+- **Decides:** the physical-repo topology that [ADR 0062](0062-medusa-instance-model-decoupling.md) §10 left open and [ADR 0065](0065-agpl-nonprofit-ai-first-governance.md) §4 answered for the *open-source* surface only.
+- **Builds on:** [ADR 0062](0062-medusa-instance-model-decoupling.md) §1 (portable-core / host-instance / feature-module cut-line), [ADR 0064](0064-rename-medusa-to-cloud-bongos.md) (the Cloud Bongos rename), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) + [ADR 0093](0093-tranche-2-core-carve-sequence.md) (the module boundary + completed core-carve that make the split mechanical), [ADR 0098](0098-public-mirror-publish-manifest.md) (`isPublishable()` — the executable definition of "what is the core"), [ADR 0099](0099-delayed-redacted-mirror-export.md) (the delayed mirror), [ADR 0015](0015-task-dependencies-and-auto-promotion.md) (dependencies).
 - **Amends:** ADR 0062 §10 (chooses a physical topology it left open); ADR 0065 §4 (puts the generated mirror on a *conditional* retirement path — §4 below).
 - **Seeds:** GDS-V4 R84 → R85 → R86 (package the core → stand Mercury up on a pinned core → make `bongos upgrade` a real update channel).
-- **Amended by:** [ADR 0108](<redacted>.md) — resolves §1's mechanism-neutral "installs a pinned core + layers its own content on top" into configurable-root (the core as a `node_modules` dependency + an injected instance-root), not clone-and-layer.
+- **Amended by:** [ADR 0108](0108-instance-composition-configurable-root.md) — resolves §1's mechanism-neutral "installs a pinned core + layers its own content on top" into configurable-root (the core as a `node_modules` dependency + an injected instance-root), not clone-and-layer.
 
 ## Context
 
@@ -37,7 +37,7 @@ We build the smallest slice that stands **Mercury up as customer 2** in its own
 
 ### 3. GDS topology: per-repo.
 
-Each project runs its **own** GDS — its own database, tasks, builders, versions, and credits. Mercury's builders never see Cloud Bongos platform tasks and vice versa; that separation of work is the point. A single shared GDS across repos is **rejected**: it re-couples exactly what the split exists to separate, and widens the trust/identity surface (ADR 0062 §5, [ADR 0016](<redacted>.md)). The cost — more than one GDS database to operate — is accepted as the price of clean separation.
+Each project runs its **own** GDS — its own database, tasks, builders, versions, and credits. Mercury's builders never see Cloud Bongos platform tasks and vice versa; that separation of work is the point. A single shared GDS across repos is **rejected**: it re-couples exactly what the split exists to separate, and widens the trust/identity surface (ADR 0062 §5, [ADR 0016](0016-trust-boundary-server-enforced-permissions.md)). The cost — more than one GDS database to operate — is accepted as the price of clean separation.
 
 ### 4. The generated mirror (ADR 0065 §4) is retained now, retired conditionally.
 
@@ -55,6 +55,6 @@ The delayed redacted mirror (ADR 0099) stays the public open-source surface **un
 - **P4 and P5 become buildable.** The R84 → R85 → R86 spine delivers Mercury (P5) and the update channel (P4). R84 auto-promotes to `ready` when this gate ([#1607](https://example.com/builders#/task/1607)) ships (ADR 0015).
 - **A permanent per-project upgrade step** replaces free updates — the recurring cost the single-repo model avoided, now explicit and owned per project.
 - **A larger operational footprint** (more repos, CI, at least one more GDS database) — weighed against the $5k budget and mitigated by building incrementally, driven by Mercury, not ahead of it.
-- **The module boundary is now load-bearing across a repo gap.** A two-repo consumer amplifies any core↔host leak into a cross-repo break, so the ADR 0062 Path-C fitness functions ([ADR 0061](<redacted>.md)) matter more, not less.
+- **The module boundary is now load-bearing across a repo gap.** A two-repo consumer amplifies any core↔host leak into a cross-repo break, so the ADR 0062 Path-C fitness functions ([ADR 0061](0061-context-layer-decomposition.md)) matter more, not less.
 - **Example is unaffected today** — single-checkout reference instance, free core updates, until a separate future decision.
 - **No new criterion is minted by this ADR.** The seeded tasks are a distinct "done-when" from GDS-V4 C8 (single-checkout configurable instance); whether to track them under a new criterion is left to the owner (see the shipping task's notes).

package/docs/adr/0101-goal-hierarchy-phase-5-judge-membership-reward.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-07-01
 - **Deciders:** Lars (Archon), Claude
 
-**Builds on:** [ADR 0086](<redacted>.md) (the goal hierarchy — this is its deferred Phase 5), [ADR 0043](<redacted>.md) (the protected-path hard floor this amends), [ADR 0016](<redacted>.md) (server-enforced permissions), [ADR 0084](<redacted>.md) (auto-derived rank floor), [ADR 0024](<redacted>.md) (the grader subagent harness the judge reuses), [ADR 0058](<redacted>.md) (gate-review + owner approval), [ADR 0054](<redacted>.md) (per-task cost-plus reward), [ADR 0023](<redacted>.md) (credit multipliers), [ADR 0027](<redacted>.md) (BFG contribution signals).
+**Builds on:** [ADR 0086](0086-goal-scoped-work-hierarchy.md) (the goal hierarchy — this is its deferred Phase 5), [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (the protected-path hard floor this amends), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced permissions), [ADR 0084](0084-auto-derived-per-task-rank-floor.md) (auto-derived rank floor), [ADR 0024](0024-multi-agent-system-architecture.md) (the grader subagent harness the judge reuses), [ADR 0058](0058-automatic-gate-surface-gatekeeper.md) (gate-review + owner approval), [ADR 0054](0054-session-token-reward-cost-plus.md) (per-task cost-plus reward), [ADR 0023](0023-kind-multipliers-and-idea-bonus.md) (credit multipliers), [ADR 0027](0027-bfg-session-inefficiency-evaluator.md) (BFG contribution signals).
 
 **Track:** `internal` (GDS / methodology — a Cloud Bongos platform capability).
 
@@ -12,14 +12,14 @@
 
 ## Context
 
-[ADR 0086](<redacted>.md) shipped the goal-scoped work hierarchy — Phases 1–4 (BV1.R54–R64): the module-scope map, the configurable hierarchy preset, the `goals` tier, the bounded task-authoring gate (`POST /goals/:id/tasks`), the polymorphic dependency edge, and the criterion-auto-flag → `/goal-review` → goal-auto-achieve lifecycle. Those phases are **live and defended**: a member's authoring is bounded by the deterministic scope-subset wall, the protected-path block (the single [ADR 0043](<redacted>.md) roster), and the auto-derived rank floor ([ADR 0084](<redacted>.md)), with the ship-time gates authoritative on the real diff (BV1.R61 pins + abuse matrix).
+[ADR 0086](0086-goal-scoped-work-hierarchy.md) shipped the goal-scoped work hierarchy — Phases 1–4 (BV1.R54–R64): the module-scope map, the configurable hierarchy preset, the `goals` tier, the bounded task-authoring gate (`POST /goals/:id/tasks`), the polymorphic dependency edge, and the criterion-auto-flag → `/goal-review` → goal-auto-achieve lifecycle. Those phases are **live and defended**: a member's authoring is bounded by the deterministic scope-subset wall, the protected-path block (the single [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) roster), and the auto-derived rank floor ([ADR 0084](0084-auto-derived-per-task-rank-floor.md)), with the ship-time gates authoritative on the real diff (BV1.R61 pins + abuse matrix).
 
 ADR 0086 **explicitly deferred three non-decisions** to "its own security-reviewed ADR," because each is a matter of *judgment* or a *widening of the trust boundary* rather than the deterministic wall that shipped first. This is that ADR. It records the design and the security review; the build is a future cluster (filed below). It changes **no enforcement code**.
 
 The three deferred items:
 
 1. **An AI relevance / anti-hack judge** at goal-task create/claim time — advisory-first, never hard-blocking a newcomer.
-2. **Sub-Metic membership inside protected-scope goals** — which amends the [ADR 0043](<redacted>.md) hard floor and requires the ship-time gates to become goal-aware.
+2. **Sub-Metic membership inside protected-scope goals** — which amends the [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) hard floor and requires the ship-time gates to become goal-aware.
 3. **The goal-reward model** — does *achieving a goal* earn anything beyond the per-task cost-plus already paid, and how does any reward split among a goal's members.
 
 ---
@@ -32,7 +32,7 @@ We adopt a three-part design. Each part is an independent, revertible build task
 
 **What.** At goal-task **create** (`POST /goals/:id/tasks`) and, optionally, at **claim**, an AI judge assesses: *is this task genuinely in service of the goal, or is it scope-gaming / a hack attempt that slipped the deterministic gate?* (e.g. a task whose declared `touches[]` sit inside scope but whose title/description reveal an intent to weaken the very wall that admitted it).
 
-**How.** Reuse the existing grader subagent harness ([ADR 0024](<redacted>.md) — the adversarial worker panel + `cascade-dispatch`), NOT a new harness. Cheapest model first (the cascade ceiling), escalate only on ambiguity; budget-aware (the $5k constraint).
+**How.** Reuse the existing grader subagent harness ([ADR 0024](0024-multi-agent-system-architecture.md) — the adversarial worker panel + `cascade-dispatch`), NOT a new harness. Cheapest model first (the cascade ceiling), escalate only on ambiguity; budget-aware (the $5k constraint).
 
 **Advisory-first — the load-bearing rule.** The judge **flags for a Metic to review**; it **never hard-blocks a newcomer at create time**. The deterministic scope-subset + protected-path + auto-rank-floor gates remain the **only hard walls**. The judge is a soft, human-escalated signal that surfaces in a review queue mirroring the `/goal-review` / `/idea-triage` cadence. High-confidence or repeat gaming may *raise friction* (e.g. require a Metic co-sign before the authored task becomes claimable) but never a silent, opaque AI "no."
 
@@ -40,25 +40,25 @@ We adopt a three-part design. Each part is an independent, revertible build task
 
 ### Part 2 — Sub-Metic membership in protected-scope goals (amends ADR 0043)
 
-**Today (the conservative default that stays until this ships).** A protected-scope goal requires a **Metic+** holder ([ADR 0086](<redacted>.md) Deferred); a sub-Metic cannot author/claim/ship work touching the protected core even inside a goal — the [ADR 0043](<redacted>.md) hard floor blocks it at the pre-push hook, the grader `permissionPathPrePass`, the `gate-review` ESCALATE floor, and the post-push `main-audit`.
+**Today (the conservative default that stays until this ships).** A protected-scope goal requires a **Metic+** holder ([ADR 0086](0086-goal-scoped-work-hierarchy.md) Deferred); a sub-Metic cannot author/claim/ship work touching the protected core even inside a goal — the [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) hard floor blocks it at the pre-push hook, the grader `permissionPathPrePass`, the `gate-review` ESCALATE floor, and the post-push `main-audit`.
 
 **The amendment.** An **Archon** may admit a sub-Metic to a protected-scope goal under a **tightly-scoped, Archon-granted membership**, letting them author + claim + ship work touching a **narrow, explicitly-enumerated** protected surface — but **only with the ship-time gates made goal-aware**.
 
 **Security review (the crux).** The amendment is a genuine **widening of the trust boundary**, so it is purely *additive* permission, fail-closed, gated on an explicit grant:
 
 - **Goal-aware ship-time gates.** A sub-Metic diff touching a protected path is allowed **only if** all hold, checked server-side against the **real committed diff** (not the advisory create-time `touches[]`): (a) the author is a **member** of a protected-scope goal, (b) the membership was **Archon-granted** and audit-logged, and (c) every protected path the diff touches is **within that goal's enumerated protected scope**. Any protected-path hit **outside** a live matching grant → the ADR-0043 floor bites unchanged.
-- **Never self-granted.** Protected scope is Archon-set at goal creation ([ADR 0086](<redacted>.md) §4); membership admission to a protected-scope goal is the Archon-only `POST /goals/:id/members`. The sub-Metic can *ask*, never grant.
+- **Never self-granted.** Protected scope is Archon-set at goal creation ([ADR 0086](0086-goal-scoped-work-hierarchy.md) §4); membership admission to a protected-scope goal is the Archon-only `POST /goals/:id/members`. The sub-Metic can *ask*, never grant.
 - **Blast-radius containment.** The member can touch only the goal's enumerated protected paths; the grader, `gate-review`, and `main-audit` still run on the real diff; the Archon can revoke membership; the Part-1 relevance judge watches for gaming; the `main-audit` flags any sub-Metic protected-path commit **not** covered by a live goal grant.
-- **Ships last, gated.** This is the highest-risk change. Its build task carries an explicit **owner Gate approval** ([ADR 0058](<redacted>.md)) and a **red-team pass** before merge.
+- **Ships last, gated.** This is the highest-risk change. Its build task carries an explicit **owner Gate approval** ([ADR 0058](0058-automatic-gate-surface-gatekeeper.md)) and a **red-team pass** before merge.
 
 ### Part 3 — The goal-reward model
 
-**Question.** Does *achieving* a goal earn anything beyond the per-task cost-plus already paid ([ADR 0054](<redacted>.md)), and how does any reward split among members?
+**Question.** Does *achieving* a goal earn anything beyond the per-task cost-plus already paid ([ADR 0054](0054-session-token-reward-cost-plus.md)), and how does any reward split among members?
 
 **Leaning (recorded; the money is owner-gated).**
 
 - **Karma by default, not example.** Example are real money (1 = $1) against a tight $5k budget, and a goal is a *coordination construct*, not a unit of billable work — the per-task cost-plus already pays for the actual shipping. A goal-achievement **karma** bonus recognizes the collaboration with **no new monetary spend**.
-- **Contribution-weighted, not membership-flat.** The bonus tracks **who actually shipped tasks under the goal** (reuse the shipped-task/credit attribution + the BFG contribution signals, [ADR 0027](<redacted>.md)), never mere membership — a flat per-member reward would incentivize goal-squatting. A `lead` may take a small coordination share.
+- **Contribution-weighted, not membership-flat.** The bonus tracks **who actually shipped tasks under the goal** (reuse the shipped-task/credit attribution + the BFG contribution signals, [ADR 0027](0027-bfg-session-inefficiency-evaluator.md)), never mere membership — a flat per-member reward would incentivize goal-squatting. A `lead` may take a small coordination share.
 - **On achievement, not creation.** The reward attaches when a goal is **achieved** (all criteria satisfied + confirmed via `/goal-review`), never on creation or joining — which, with contribution-weighting and the Metic confirmation, closes the free-rider and squatting surfaces.
 
 **Owner-gated.** Whether *any* monetary (example) component attaches, and the exact karma amount/curve, is **Lars's call at build time** — money is owner authority. This ADR records the budget-safe default (karma-only, contribution-weighted); the build task (P5.3) surfaces the money decision explicitly rather than presuming it.

package/docs/adr/0102-finish-bounding-the-kernel.md

@@ -1,6 +1,6 @@
 # ADR 0102 — Finish bounding the kernel: LLM-cost as kernel-adjacent infra, identity/auth carve, flip Check 12 to ENFORCING
 
-**Status:** Accepted (2026-07-02) · **Supersedes the WARN-mode deferral in** [ADR 0091](<redacted>.md) §1,§3 / [ADR 0093](<redacted>.md)
+**Status:** Accepted (2026-07-02) · **Supersedes the WARN-mode deferral in** [ADR 0091](0091-bounding-the-kernel-and-db-carve.md) §1,§3 / [ADR 0093](0093-tranche-2-core-carve-sequence.md)
 
 ## Context
 

package/docs/adr/0103-core-first-extraction-cloud-bongos-trunk.md

@@ -4,14 +4,14 @@
 - **Date:** 2026-07-02
 - **Track:** internal
 - **Task:** [#1726](https://example.com/builders#/task/1726) (BV1.R87) — the owner-review decision this ADR records.
-- **Supersedes:** [ADR 0100](<redacted>.md) §§1–2 (the Mercury-first sequence and the "Example stays coupled until a later decision" plank). **Retains ADR 0100 §3** (per-repo GDS) **and §4** (the generated mirror, retired conditionally).
-- **Builds on:** [ADR 0062](<redacted>.md) §1 (portable-core / host-instance cut-line), [ADR 0098](<redacted>.md) (`isPublishable()` — the executable definition of "the core"), [ADR 0100](<redacted>.md) §§3–4 + its R84 (`bongos package-core`, shipped), [ADR 0065](<redacted>.md) (AGPL / non-profit / AI-first).
+- **Supersedes:** [ADR 0100](0100-two-repo-instance-model.md) §§1–2 (the Mercury-first sequence and the "Example stays coupled until a later decision" plank). **Retains ADR 0100 §3** (per-repo GDS) **and §4** (the generated mirror, retired conditionally).
+- **Builds on:** [ADR 0062](0062-medusa-instance-model-decoupling.md) §1 (portable-core / host-instance cut-line), [ADR 0098](0098-public-mirror-publish-manifest.md) (`isPublishable()` — the executable definition of "the core"), [ADR 0100](0100-two-repo-instance-model.md) §§3–4 + its R84 (`bongos package-core`, shipped), [ADR 0065](0065-agpl-nonprofit-ai-first-governance.md) (AGPL / non-profit / AI-first).
 - **Reshapes:** the R84 → R86 spine — inserts a core-extraction step before Mercury (R85) and adds a committed Example-split step (see §4).
-- **Amended by:** [ADR 0108](<redacted>.md) — resolves §2's mechanism-neutral consumer-repo shape ("installs a pinned core version and layers its own content on top") into configurable-root.
+- **Amended by:** [ADR 0108](0108-instance-composition-configurable-root.md) — resolves §2's mechanism-neutral consumer-repo shape ("installs a pinned core version and layers its own content on top") into configurable-root.
 
 ## Context
 
-[ADR 0100](<redacted>.md) was accepted 2026-07-01. It chose two repos, but sequenced **Mercury** (a greenfield Example instance) as the *first* two-repo consumer and deliberately left **Example coupled** as the single-checkout reference instance "until a later, separate decision" — on the reasoning that moving a live product before the update channel is proven buys risk for no gain.
+[ADR 0100](0100-two-repo-instance-model.md) was accepted 2026-07-01. It chose two repos, but sequenced **Mercury** (a greenfield Example instance) as the *first* two-repo consumer and deliberately left **Example coupled** as the single-checkout reference instance "until a later, separate decision" — on the reasoning that moving a live product before the update channel is proven buys risk for no gain.
 
 A next-day owner review (2026-07-02, task [#1726](https://example.com/builders#/task/1726)) reopened planks 1 and 2. The owner's position, stated directly:
 
@@ -26,7 +26,7 @@ A next-day owner review (2026-07-02, task [#1726](https://example.com/builders#/
 
 ### 1. Core-first extraction — the core gets its own repo, first.
 
-The Cloud Bongos **core** — the `isPublishable()` subtree ([ADR 0098](<redacted>.md)): portable methodology + platform + GDS engine + neutral branding — is extracted into its **own standalone repository** with **fresh history**, AGPL/public-ready. That repo **is** Cloud Bongos, the product. This is the *first* physical move, ahead of standing up any consumer. R84's `bongos package-core` is reused, not discarded: the subtree it already packages is exactly what gets extracted.
+The Cloud Bongos **core** — the `isPublishable()` subtree ([ADR 0098](0098-public-mirror-publish-manifest.md)): portable methodology + platform + GDS engine + neutral branding — is extracted into its **own standalone repository** with **fresh history**, AGPL/public-ready. That repo **is** Cloud Bongos, the product. This is the *first* physical move, ahead of standing up any consumer. R84's `bongos package-core` is reused, not discarded: the subtree it already packages is exactly what gets extracted.
 
 ### 2. Example splits — it is not the permanently-coupled reference instance.
 
@@ -34,7 +34,7 @@ Example becomes a **consumer repo** that installs a pinned core version and laye
 
 ### 3. Retained from ADR 0100: per-repo GDS (§3) and the conditional mirror (§4).
 
-Each repo runs its own GDS (own DB, tasks, builders, credits) — a shared GDS is still rejected. The delayed redacted mirror ([ADR 0099](<redacted>.md)) stays the public surface **until** the core is physically extracted — under this ADR that trigger now fires *first*, so the mirror's retirement/repointing is re-evaluated at extraction time rather than after a Mercury detour.
+Each repo runs its own GDS (own DB, tasks, builders, credits) — a shared GDS is still rejected. The delayed redacted mirror ([ADR 0099](0099-delayed-redacted-mirror-export.md)) stays the public surface **until** the core is physically extracted — under this ADR that trigger now fires *first*, so the mirror's retirement/repointing is re-evaluated at extraction time rather than after a Mercury detour.
 
 ### 4. Reshaped spine.
 

package/docs/adr/0103-gdsv4-bongos-consolidation.md

@@ -4,13 +4,13 @@
 - **Date:** 2026-07-02
 - **Deciders:** Lars (owner) · Claude (Opus 4.8)
 - **Track:** `internal` (Cloud Bongos)
-- **Relates to:** [ADR 0064](<redacted>.md) (Medusa → Cloud Bongos), [ADR 0062](<redacted>.md) (core ↔ host / instance model), [ADR 0087](<redacted>.md) (the Bongos desktop app absorbs Dev Box), [ADR 0095](<redacted>.md) (grep-over-embeddings — retires the C1 recall arm). Executed by migration `<redacted>.sql` under task [#1709](https://example.com/builders#/task/1709).
+- **Relates to:** [ADR 0064](0064-rename-medusa-to-cloud-bongos.md) (Medusa → Cloud Bongos), [ADR 0062](0062-medusa-instance-model-decoupling.md) (core ↔ host / instance model), [ADR 0087](0087-bongos-app-architecture-and-handoff-contract.md) (the Bongos desktop app absorbs Dev Box), [ADR 0095](0095-cross-agent-context-management.md) (grep-over-embeddings — retires the C1 recall arm). Executed by migration `<redacted>.sql` under task [#1709](https://example.com/builders#/task/1709).
 
 ## Context
 
-The internal track carried **two live versions at once** — `GDS-V4` (534 tasks, ~114 open) and `BONGOS-V1` (130 tasks, ~14 open) — with no clean divide between them. Both were, in practice, Cloud Bongos platform work. Worse, `BONGOS-V1` was *titled* "Bongos App — V1" but its goals were platform concerns (core modularization, the animation module), while the actual **Bongos desktop app** (`bongos-app/` — the feedback-capture tool that also absorbs the Dev Box switch, [ADR 0087](<redacted>.md)) had its tasks scattered across *both* versions. Two parallel internal versions + an app/platform naming inversion made "what's the live internal version?" and "is this app work or platform work?" both unanswerable from the ledger.
+The internal track carried **two live versions at once** — `GDS-V4` (534 tasks, ~114 open) and `BONGOS-V1` (130 tasks, ~14 open) — with no clean divide between them. Both were, in practice, Cloud Bongos platform work. Worse, `BONGOS-V1` was *titled* "Bongos App — V1" but its goals were platform concerns (core modularization, the animation module), while the actual **Bongos desktop app** (`bongos-app/` — the feedback-capture tool that also absorbs the Dev Box switch, [ADR 0087](0087-bongos-app-architecture-and-handoff-contract.md)) had its tasks scattered across *both* versions. Two parallel internal versions + an app/platform naming inversion made "what's the live internal version?" and "is this app work or platform work?" both unanswerable from the ledger.
 
-A task-by-task triage of GDS-V4's 114 open tasks (with the owner, 2026-07-02) also found dead work: the C1 semantic-search/embeddings arm (superseded by [ADR 0095](<redacted>.md)'s decision that agents navigate by grep, not embeddings), old V3-era grader tasks (superseded by the shipped 4-worker grader panel + [ADR 0089](<redacted>.md)), and the T-NNN task-ref migration (the hall-link convention already works and is enforced).
+A task-by-task triage of GDS-V4's 114 open tasks (with the owner, 2026-07-02) also found dead work: the C1 semantic-search/embeddings arm (superseded by [ADR 0095](0095-cross-agent-context-management.md)'s decision that agents navigate by grep, not embeddings), old V3-era grader tasks (superseded by the shipped 4-worker grader panel + [ADR 0089](0089-modular-multi-model-adversarial-grader.md)), and the T-NNN task-ref migration (the hall-link convention already works and is enforced).
 
 ## Decision
 

package/docs/adr/0104-trust-gds-api-channel-in-auto-mode.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-07-02
 - **Deciders:** Lars (owner) · Claude (Opus 4.8)
 - **Track:** `internal` (Cloud Bongos)
-- **Relates to:** [ADR 0016](<redacted>.md) (server-enforced permissions / trust boundary — the load-bearing rationale). Completes task [#1051](https://example.com/builders#/task/1051) (the narrow named-script allow-list, from the task-[#1027](https://example.com/builders#/task/1027) nightmare) and complements task [#1251](https://example.com/builders#/task/1251) (default dev boxes to `bypassPermissions`). Executed under task [#1716](https://example.com/builders#/task/1716).
+- **Relates to:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced permissions / trust boundary — the load-bearing rationale). Completes task [#1051](https://example.com/builders#/task/1051) (the narrow named-script allow-list, from the task-[#1027](https://example.com/builders#/task/1027) nightmare) and complements task [#1251](https://example.com/builders#/task/1251) (default dev boxes to `bypassPermissions`). Executed under task [#1716](https://example.com/builders#/task/1716).
 
 ## Context
 
@@ -27,13 +27,13 @@ The owner chose **"trust the whole channel"** over a narrower "reads + a few spe
 
 ## Why this is safe (the crux)
 
-The auto-mode classifier was **never the security gate here** — the **GDS server is**, and it is stricter. `builders.rank` is checked on every request, per-request, with no caching ([ADR 0016](<redacted>.md)). Therefore:
+The auto-mode classifier was **never the security gate here** — the **GDS server is**, and it is stricter. `builders.rank` is checked on every request, per-request, with no caching ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)). Therefore:
 
 - Allow-listing `api.js` grants an autonomous builder **nothing beyond what its rank already permits**. It only removes a redundant, weaker, and — as observed — **wrong** harness prompt that mistook a sanctioned idea-triage session for scope creep.
 - `api.js` can only reach `/api/gds/*` on the configured API base (via `cli-lib.apiCall`); it is **not** a general HTTP or shell escape hatch. Blast radius = "the caller's rank-permitted GDS operations, without a per-call prompt" — which is exactly the design intent of an autonomous builder.
 - **Scope-discipline** ("don't wander off the claim") is owned by the methodology's per-builder **`wandering`** knob ([`modules/builder-settings/wandering-prefs.js`](../../modules/builder-settings/wandering-prefs.js)), which is the correct layer — a harness classifier can't tell whether promoting an idea *is* the task.
 
-Editing this allow-list grants no authority; sub-Metic authorship limits, protected-path gates, and rank checks all remain server-enforced ([ADR 0016](<redacted>.md)).
+Editing this allow-list grants no authority; sub-Metic authorship limits, protected-path gates, and rank checks all remain server-enforced ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)).
 
 ## Consequences
 

package/docs/adr/0105-instance-seed-migrations-out-of-core.md

@@ -4,8 +4,8 @@
 - **Date:** 2026-07-02
 - **Deciders:** Lars (owner) · Claude (Opus 4.8)
 - **Track:** `internal` (Cloud Bongos)
-- **Relates to:** [ADR 0062](<redacted>.md) (core ↔ host / instance model), [ADR 0083](<redacted>.md) (module-owned migrations — the enabled-gated precedent this generalizes). Executed under task [#1704](https://example.com/builders#/task/1704); the tactical predecessor was task [#1264](https://example.com/builders#/task/1264) (the 172/173 guards).
-- **Amended by:** [ADR 0108](<redacted>.md) §5 — under configurable-root, `migrations/instance/` becomes a genuinely SEPARATE repo's directory (not a subtree of the same checkout), and two independently-versioned repos both adding `NNN_*.sql` will collide on the shared `schema_migrations` stem key. §5 commits to a namespacing/lineage discipline before that ships (task 1885, W5); this ADR's basename-merge-sort ordering and stem-key idempotency in `migrate.sh` are the mechanism §5 extends, not replaces.
+- **Relates to:** [ADR 0062](0062-medusa-instance-model-decoupling.md) (core ↔ host / instance model), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (module-owned migrations — the enabled-gated precedent this generalizes). Executed under task [#1704](https://example.com/builders#/task/1704); the tactical predecessor was task [#1264](https://example.com/builders#/task/1264) (the 172/173 guards).
+- **Amended by:** [ADR 0108](0108-instance-composition-configurable-root.md) §5 — under configurable-root, `migrations/instance/` becomes a genuinely SEPARATE repo's directory (not a subtree of the same checkout), and two independently-versioned repos both adding `NNN_*.sql` will collide on the shared `schema_migrations` stem key. §5 commits to a namespacing/lineage discipline before that ships (task 1885, W5); this ADR's basename-merge-sort ordering and stem-key idempotency in `migrate.sh` are the mechanism §5 extends, not replaces.
 
 ## Context
 

package/docs/adr/0106-goal-owner-manager-authority.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-07-03
 - **Deciders:** jaxri (Metic, owner request), Claude
 
-**Builds on / amends:** [ADR 0086](<redacted>.md) (goal-scoped work hierarchy — this ADR refines its membership-role semantics), [ADR 0016](<redacted>.md) (server-enforced rank boundary — unchanged), [ADR 0090](<redacted>.md) (Metic authoring powers — the rank floor this ADR reuses for ownership).
+**Builds on / amends:** [ADR 0086](0086-goal-scoped-work-hierarchy.md) (goal-scoped work hierarchy — this ADR refines its membership-role semantics), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced rank boundary — unchanged), [ADR 0090](0090-metic-task-authoring.md) (Metic authoring powers — the rank floor this ADR reuses for ownership).
 
 **Track:** `internal` (GDS / methodology — a Cloud Bongos platform capability).
 
@@ -59,7 +59,7 @@ Two authority layers, deliberately different *kinds*:
   goal over. The old owner keeps their `lead` row (drops to manager, not out);
   the new owner's membership upserts to `lead` in the same statement that moves
   `created_by`. **The new owner must be Metic+**: goal creation is Metic+
-  ([ADR 0086](<redacted>.md) / R57), ownership is
+  ([ADR 0086](0086-goal-scoped-work-hierarchy.md) / R57), ownership is
   creator-equivalent authority, and this also keeps the protected-scope
   membership wall intact (a protected-scope goal requires Metic+ members).
 - **Creation rank gate: unchanged.** `POST /goals` was already

package/docs/adr/0107-module-upstreaming-contribution-to-core-catalog.md

@@ -4,8 +4,8 @@
 - **Date:** 2026-07-03
 - **Track:** internal
 - **Task:** [#1766](https://example.com/builders#/task/1766) (BV1) — the owner-review decision this ADR records + the initiative it seeds.
-- **Builds on:** [ADR 0062](<redacted>.md) §1 (portable-core / host-instance / gated feature-module cut-line), [ADR 0083](<redacted>.md) (the module system — loader, manifest, seams, module-owned migrations), [ADR 0098](<redacted>.md) (`isPublishable()` — what a module may contain to enter an AGPL core), [ADR 0065](<redacted>.md) (AGPL-3.0, non-profit, AI-first — and its explicit rejection of CLA-relicensing as "capture").
-- **Complements:** [ADR 0100](<redacted>.md) / [ADR 0103](<redacted>.md) — those define the **distribution** arrow (core → instance, a pinned versioned dependency). This ADR defines the **reverse** arrow (instance → core): an instance's module flows *upstream* into the shared catalog. The two arrows together make the module boundary a two-way membrane.
+- **Builds on:** [ADR 0062](0062-medusa-instance-model-decoupling.md) §1 (portable-core / host-instance / gated feature-module cut-line), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the module system — loader, manifest, seams, module-owned migrations), [ADR 0098](0098-public-mirror-publish-manifest.md) (`isPublishable()` — what a module may contain to enter an AGPL core), [ADR 0065](0065-agpl-nonprofit-ai-first-governance.md) (AGPL-3.0, non-profit, AI-first — and its explicit rejection of CLA-relicensing as "capture").
+- **Complements:** [ADR 0100](0100-two-repo-instance-model.md) / [ADR 0103](0103-core-first-extraction-cloud-bongos-trunk.md) — those define the **distribution** arrow (core → instance, a pinned versioned dependency). This ADR defines the **reverse** arrow (instance → core): an instance's module flows *upstream* into the shared catalog. The two arrows together make the module boundary a two-way membrane.
 
 ## Context
 
@@ -15,7 +15,7 @@ The owner's direction (2026-07-03): an instance also builds feature modules of i
 
 A read-only audit of the current codebase (task [#1766](https://example.com/builders#/task/1766)) established ground truth:
 
-- **The prerequisites are solid.** A validated `module.json` manifest ([`src/module-loader/manifest-schema.js`](../../src/module-loader/manifest-schema.js)), a discover→mount loader with a **one-way import boundary** hard-enforced in CI ([`scripts/gds/fitness.js`](../../scripts/gds/fitness.js) Check 12, [ADR 0102](<redacted>.md)), opt-in **default-off** enablement (`config/modules.json` / `config/modules.neutral.json`), module-owned migrations, and the `isPublishable()` publish boundary that already decides which module *shapes* may enter an AGPL core.
+- **The prerequisites are solid.** A validated `module.json` manifest ([`src/module-loader/manifest-schema.js`](../../src/module-loader/manifest-schema.js)), a discover→mount loader with a **one-way import boundary** hard-enforced in CI ([`scripts/gds/fitness.js`](../../scripts/gds/fitness.js) Check 12, [ADR 0102](0102-finish-bounding-the-kernel.md)), opt-in **default-off** enablement (`config/modules.json` / `config/modules.neutral.json`), module-owned migrations, and the `isPublishable()` publish boundary that already decides which module *shapes* may enter an AGPL core.
 - **The capability is absent.** There is no submission/approval/merge-upstream flow, no catalog/registry (a "marketplace" is an explicitly-deferred future fork in [`docs/design/modular-architecture/01-architecture.md`](../../docs/design/modular-architecture/01-architecture.md)), and the manifest has **no** `author` / `origin` / `license` / `maintainer` fields — adding them fails manifest validation until the schema is extended.
 - **The name "contribution seam" is already taken** — it is the in-process UI/profile extension hook (`contribute`/`contributions`, `CORE_VERSION` 1.1.0). This capability must use a distinct name to avoid confusion: **module upstreaming** / **the module catalog**.
 - **A CI gap:** contributed-module tests only run in core CI if placed at repo-root `tests/`; the runner does not discover `modules/<key>/tests/`.
@@ -28,7 +28,7 @@ An instance builds a module in its own repo. To land it in core, a **platform-na
 
 ### 2. Attribution is portable metadata, not a cross-database link.
 
-Each repo runs its own GDS with its own builder identities ([ADR 0100](<redacted>.md) §3) — there is no shared identity key. So credit **travels with the module**: `module.json` gains `author`, `origin` (origin instance/project), `license`, and `maintainer` fields, captured at submit time. The catalog shows author + origin credit. This is a *record*, not a foreign key.
+Each repo runs its own GDS with its own builder identities ([ADR 0100](0100-two-repo-instance-model.md) §3) — there is no shared identity key. So credit **travels with the module**: `module.json` gains `author`, `origin` (origin instance/project), `license`, and `maintainer` fields, captured at submit time. The catalog shows author + origin credit. This is a *record*, not a foreign key.
 
 ### 3. Reward: credit now, money later.
 
@@ -36,7 +36,7 @@ Accepted contributions earn **visible credit** (author + origin in the catalog)
 
 ### 4. Licensing: AGPL-in, sign-off, no CLA.
 
-Core is AGPL-3.0 and [ADR 0065](<redacted>.md) rejected CLA-relicensing as capture. So **inbound = outbound**: a contributed module is accepted under AGPL-3.0 with a lightweight **DCO-style sign-off** (the contributor affirms it is their own work, licensed AGPL) — never a copyright-assignment CLA. The `isPublishable()` pre-check runs at **submit time** and rejects anything that cannot be AGPL'd (game content, pixel art, copyrighted reference material).
+Core is AGPL-3.0 and [ADR 0065](0065-agpl-nonprofit-ai-first-governance.md) rejected CLA-relicensing as capture. So **inbound = outbound**: a contributed module is accepted under AGPL-3.0 with a lightweight **DCO-style sign-off** (the contributor affirms it is their own work, licensed AGPL) — never a copyright-assignment CLA. The `isPublishable()` pre-check runs at **submit time** and rejects anything that cannot be AGPL'd (game content, pixel art, copyrighted reference material).
 
 ### 5. Security review is a hard accept-gate.
 
@@ -69,7 +69,7 @@ The enable/disable and provenance views are buildable against the existing modul
 ## Alternatives considered (rejected)
 
 - **Fork-and-PR only.** Standard OSS, but loses attribution/sign-off capture and doesn't fit the GDS review/approval methodology. Kept as a fallback, not the canonical path.
-- **A CLA granting relicensing rights.** Rejected by [ADR 0065](<redacted>.md) as capture; incompatible with the non-profit posture.
+- **A CLA granting relicensing rights.** Rejected by [ADR 0065](0065-agpl-nonprofit-ai-first-governance.md) as capture; incompatible with the non-profit posture.
 - **Auto-accept / CI-only gate (no security review).** Rejected — a module runs in every enabling instance with no sandbox; unreviewed inbound code is a supply-chain compromise across all instances.
 - **Accepted modules default-on.** Rejected — every instance would inherit every contributed feature; breaks the "fail-to-vanilla" default-off contract.
 - **A package marketplace now.** Rejected as premature (the design docs defer it); the in-repo catalog is the smaller first step.

package/docs/adr/0108-instance-composition-configurable-root.md

@@ -4,14 +4,14 @@
 - **Date:** 2026-07-03
 - **Track:** internal
 - **Task:** [#1870](https://example.com/builders#/task/1870) (BV1.R115) — the decision this ADR records.
-- **Decides:** *how* a consumer instance physically composes with the extracted Cloud Bongos core — the composition **mechanism** that [ADR 0062](<redacted>.md) §10, [ADR 0100](<redacted>.md) §1, and [ADR 0103](<redacted>.md) §2 each left open. Those ADRs decided the repo *count* (two), the *order* (core-first), and per-repo GDS; they are deliberately mechanism-neutral ("installs a pinned core + layers its own content on top"), and [ADR 0103](<redacted>.md)'s R88 execution record explicitly deferred "the topology/instance paths the scaffold populates on `init`." This ADR resolves that deferral.
+- **Decides:** *how* a consumer instance physically composes with the extracted Cloud Bongos core — the composition **mechanism** that [ADR 0062](0062-medusa-instance-model-decoupling.md) §10, [ADR 0100](0100-two-repo-instance-model.md) §1, and [ADR 0103](0103-core-first-extraction-cloud-bongos-trunk.md) §2 each left open. Those ADRs decided the repo *count* (two), the *order* (core-first), and per-repo GDS; they are deliberately mechanism-neutral ("installs a pinned core + layers its own content on top"), and [ADR 0103](0103-core-first-extraction-cloud-bongos-trunk.md)'s R88 execution record explicitly deferred "the topology/instance paths the scaffold populates on `init`." This ADR resolves that deferral.
 - **Replaces:** the never-shipped clone-and-layer draft of this same ADR number. A 2026-07-03 owner review rejected clone-and-layer in favour of the scalable model below — optimising for upgrade economics + a real product boundary over near-term least-resistance. (No supersession machinery: the draft never merged.)
-- **Builds on:** [ADR 0062](<redacted>.md) §1 (core/host cut-line), [ADR 0098](<redacted>.md) (`isPublishable()` — now "the core *package* contents"), [ADR 0100](<redacted>.md) §§3–4 (per-repo GDS + conditional mirror, both retained), [ADR 0103](<redacted>.md) (core-first extraction; R88 shipped → `cloud-bongos`), [ADR 0105](<redacted>.md) (the `migrations/instance/` split), [ADR 0083](<redacted>.md)/[ADR 0061](<redacted>.md) (the module boundary + fitness functions), [ADR 0082](<redacted>.md).
+- **Builds on:** [ADR 0062](0062-medusa-instance-model-decoupling.md) §1 (core/host cut-line), [ADR 0098](0098-public-mirror-publish-manifest.md) (`isPublishable()` — now "the core *package* contents"), [ADR 0100](0100-two-repo-instance-model.md) §§3–4 (per-repo GDS + conditional mirror, both retained), [ADR 0103](0103-core-first-extraction-cloud-bongos-trunk.md) (core-first extraction; R88 shipped → `cloud-bongos`), [ADR 0105](0105-instance-seed-migrations-out-of-core.md) (the `migrations/instance/` split), [ADR 0083](0083-modular-architecture-strangler-build-plan.md)/[ADR 0061](0061-context-layer-decomposition.md) (the module boundary + fitness functions), [ADR 0082](0082-server-side-merge-conflict-auto-resolution.md).
 - **Informs:** [#1689](https://example.com/builders#/task/1689) (R85 — Mercury, the first real consumer + the contract's validator), [#1690](https://example.com/builders#/task/1690) (R86 — the `bongos upgrade` channel), [#1728](https://example.com/builders#/task/1728) (R89 — the Example split), plus the net-new workstreams enumerated in §Consequences.
 
 ## Context
 
-[ADR 0103](<redacted>.md) extracted the Cloud Bongos core into its own repo (R88, [#1727](https://example.com/builders#/task/1727), shipped 2026-07-03) and committed Mercury (R85) and Example (R89) to becoming *consumer repos on a pinned core*. It left the composition **mechanism** open. Two shapes were possible:
+[ADR 0103](0103-core-first-extraction-cloud-bongos-trunk.md) extracted the Cloud Bongos core into its own repo (R88, [#1727](https://example.com/builders#/task/1727), shipped 2026-07-03) and committed Mercury (R85) and Example (R89) to becoming *consumer repos on a pinned core*. It left the composition **mechanism** open. Two shapes were possible:
 
 - **Clone-and-layer** — the consumer repo *is* the pinned core tree materialised at its **root**, host content layered on top; the core keeps sitting at repo-root, so its pervasive repo-root path assumptions keep working unchanged.
 - **Configurable-root** — the core is installed as a **versioned dependency** (`@cloudbongos/core` in `node_modules/`) and resolves host content through an **injected instance-root**, so it no longer assumes it lives at the repo root.
@@ -69,7 +69,7 @@ Upgrading = bump the pin in `package.json`/lockfile → `npm ci` → migrate →
 
 - **Clone-and-layer (the prior draft of this ADR).** Cheapest now, proven by the two proofs (cloudbongos.com reskin + the `package-core` tree snapshot), zero core-path changes. **Rejected as the destination:** merge-based upgrades don't scale across many instances × core versions; the boundary is convention + CI and rots under scale; there is no forcing function for a clean core API; and it dead-ends any multi-instance/hosted future — needing this exact refactor later regardless, under worse conditions. **Retained** only as the cheap single-checkout reskin shape (cloudbongos.com).
 - **Git submodule for the core.** Rejected — still lands the core at a subpath (so it still needs configurable-root; it doesn't avoid the refactor) and adds the submodule UX tax on an AI-agent-first builder base.
-- **One monorepo with an internal `core/` + `instances/` cut.** Already rejected in [ADR 0103](<redacted>.md) — the core never becomes a separately shippable product.
+- **One monorepo with an internal `core/` + `instances/` cut.** Already rejected in [ADR 0103](0103-core-first-extraction-cloud-bongos-trunk.md) — the core never becomes a separately shippable product.
 
 ## Consequences
 
@@ -78,10 +78,10 @@ Upgrading = bump the pin in `package.json`/lockfile → `npm ci` → migrate →
 1. **`.claude/` materialisation + invocation rewrite** (§3). `bongos init`/`upgrade` must copy `.claude/` into the instance and rewrite ~30 skills + the `settings.json` hooks to the `bongos` bin. This is what makes an installed instance actually usable by AI agents; it does not exist today.
 2. **Deploy conversion** (§4). `git reset --hard` → `npm ci`-of-the-pinned-core; `ship.js` (~151 KB, a monorepo-coupled deploy tool) needs rework; and the **shared-checkout dual-instance deploy** (example + cloudbongos.com on one tree — already the reason cloudbongos.com runs stale) must be cut *in tandem* with standing up the npm-install flow, or cloudbongos.com breaks.
 3. **Cross-repo migration numbering** (§5) — the deepest design risk; needs the namespacing + lineage discipline before two repos version independently.
-4. **The guardrails become two-root-aware.** `fitness.js`, `gen-repo-map.js`, and `gen-file-map.js` each hardcode `REPO_ROOT = __dirname/../..` and walk one tree; once the core is in `node_modules`, the core↔host boundary check, the CLAUDE.md-budget check, the nested-doc-presence check, and the two generators would inspect the wrong tree. They must learn the core-root/instance-root split — this is the mechanism [ADR 0062](<redacted>.md) §9 / [ADR 0061](<redacted>.md) rely on to keep the boundary from rotting, so it matters *more* under a real repo gap, not less.
+4. **The guardrails become two-root-aware.** `fitness.js`, `gen-repo-map.js`, and `gen-file-map.js` each hardcode `REPO_ROOT = __dirname/../..` and walk one tree; once the core is in `node_modules`, the core↔host boundary check, the CLAUDE.md-budget check, the nested-doc-presence check, and the two generators would inspect the wrong tree. They must learn the core-root/instance-root split — this is the mechanism [ADR 0062](0062-medusa-instance-model-decoupling.md) §9 / [ADR 0061](0061-context-layer-decomposition.md) rely on to keep the boundary from rotting, so it matters *more* under a real repo gap, not less.
 
 **But the runtime-library half is small and de-risked:** ~8–11 readers through the resolvers, and the entrypoint seam, the two-roots loader, the single-sourced `isPublishable()` partition, and the Docker/vanilla-boot substrate all already exist. Step 1 is byte-identical for prod, which lets the risky part land reversibly and early.
 
-**Docs to amend** (none *superseded* — this ADR resolves the mechanism they deferred, so they get cross-refs, not reversals): `docs/file-map.md` (present the tree as two — core-package vs instance), `docs/architecture.md` (repo + deploy), `docs/recipes/packaging-the-core.md` + `docs/recipes/self-host.md` (npm consumption + mount targets), [ADR 0105](<redacted>.md) (three-root migrations), `docs/modules-contract.md` (two-root discovery); cross-refs in [ADR 0062](<redacted>.md)/[0100](<redacted>.md)/[0103](<redacted>.md)/[0098](<redacted>.md), `docs/branding-contract.md`, and `CLAUDE.md` (whose nested-doc discovery model assumes core dirs sit at the instance root — they will live in the package). Keep within the CLAUDE.md 300-line / 42 KB fitness ceiling — relocate detail here, don't expand CLAUDE.md.
+**Docs to amend** (none *superseded* — this ADR resolves the mechanism they deferred, so they get cross-refs, not reversals): `docs/file-map.md` (present the tree as two — core-package vs instance), `docs/architecture.md` (repo + deploy), `docs/recipes/packaging-the-core.md` + `docs/recipes/self-host.md` (npm consumption + mount targets), [ADR 0105](0105-instance-seed-migrations-out-of-core.md) (three-root migrations), `docs/modules-contract.md` (two-root discovery); cross-refs in [ADR 0062](0062-medusa-instance-model-decoupling.md)/[0100](0100-two-repo-instance-model.md)/[0103](0103-core-first-extraction-cloud-bongos-trunk.md)/[0098](0098-public-mirror-publish-manifest.md), `docs/branding-contract.md`, and `CLAUDE.md` (whose nested-doc discovery model assumes core dirs sit at the instance root — they will live in the package). Keep within the CLAUDE.md 300-line / 42 KB fitness ceiling — relocate detail here, don't expand CLAUDE.md.
 
 **Commitments:** R85 is built as `npm install`-of-the-core + configurable-root (and becomes the contract's validator); R86 is a version-bump channel; R89 keeps the risky path/guardrail/trust-boundary changes behind a security review. **No migration, no new criterion** minted by this ADR; recorded against goal 26 (Cloud Bongos productization and self-host).

package/docs/adr/0109-self-describing-openapi-and-hosted-docs.md

@@ -5,7 +5,7 @@
 - **Track:** internal
 - **Task:** [#1918](https://example.com/builders#/task/1918) (BONGOS-V1) — Part A of the API-docs + `/api/gds`→`/api/bongos` rename plan.
 - **Decides:** how the GDS API is documented so an AI agent (or any tool) can read it, and where that documentation is hosted.
-- **Builds on:** [ADR 0016](<redacted>.md) (server-enforced ranks — the gate each endpoint carries), [ADR 0063](<redacted>.md) (the "generate, don't hand-maintain, enforce with `--check`" pattern this copies), [ADR 0062](<redacted>.md) §3 (branding-injected served HTML), [ADR 0108](<redacted>.md) (two-root generator conventions).
+- **Builds on:** [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced ranks — the gate each endpoint carries), [ADR 0063](0063-generated-repo-map-symbol-skeleton.md) (the "generate, don't hand-maintain, enforce with `--check`" pattern this copies), [ADR 0062](0062-medusa-instance-model-decoupling.md) §3 (branding-injected served HTML), [ADR 0108](0108-instance-composition-configurable-root.md) (two-root generator conventions).
 - **Informs:** the `/api/gds` → `/api/bongos` URL + naming rename (Part B), which flips the single `src/bongos/api-prefix.js` constant this ADR introduces.
 
 ## Context
@@ -14,8 +14,8 @@ The GDS API had **no machine-readable contract**. The only endpoint doc was `doc
 
 Two things were already true and shaped the answer:
 
-1. **A route-introspection engine already exists and is CI-enforced.** `src/bongos/route-rank-check.js` (`discoverRouteFiles` + `classifyText` + `classifyRank`) already enumerates every endpoint — method, path, rank gate, source file — across core + every module, because the ship-time rank gate ([ADR 0016](<redacted>.md)) depends on it. It is the natural, non-drifting backbone for docs.
-2. **A generator pattern is established** ([ADR 0063](<redacted>.md)): a deterministic file-reader with a `--check` mode wired into `fitness.js` and auto-regenerated at ship. Docs generated the same way cannot rot.
+1. **A route-introspection engine already exists and is CI-enforced.** `src/bongos/route-rank-check.js` (`discoverRouteFiles` + `classifyText` + `classifyRank`) already enumerates every endpoint — method, path, rank gate, source file — across core + every module, because the ship-time rank gate ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)) depends on it. It is the natural, non-drifting backbone for docs.
+2. **A generator pattern is established** ([ADR 0063](0063-generated-repo-map-symbol-skeleton.md)): a deterministic file-reader with a `--check` mode wired into `fitness.js` and auto-regenerated at ship. Docs generated the same way cannot rot.
 
 ## Decision
 

package/docs/adr/0110-untrack-whole-file-generated-nav-docs.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-07-03
 - **Track:** internal
-- **Builds on:** [ADR 0094](<redacted>.md) (the `gen-atlas.js` precedent — a gitignored artifact rebuilt on every deploy), [ADR 0063](<redacted>.md) (`gen-repo-map.js`), [ADR 0062](<redacted>.md) §8 (`gen-session-index.js`), [ADR 0082](<redacted>.md) (the reactive `otb-regen` heal — kept, not replaced), [ADR 0055](<redacted>.md) (server-mediated publish — untouched)
+- **Builds on:** [ADR 0094](0094-repo-atlas-self-drawing-codebase-map.md) (the `gen-atlas.js` precedent — a gitignored artifact rebuilt on every deploy), [ADR 0063](0063-generated-repo-map-symbol-skeleton.md) (`gen-repo-map.js`), [ADR 0062](0062-medusa-instance-model-decoupling.md) §8 (`gen-session-index.js`), [ADR 0082](0082-server-side-merge-conflict-auto-resolution.md) (the reactive `otb-regen` heal — kept, not replaced), [ADR 0055](0055-server-mediated-branch-publish.md) (server-mediated publish — untouched)
 - **Task:** [#1926](https://example.com/builders#/task/1926)
 - **Supersedes (in part):** the "regenerated + committed at ship" contract for `docs/repo-map.md` and `docs/session-log-index.md` (ADR 0063 / ADR 0062 §8). The nested-block half of that contract stands.