@bongos/core 1.19.714 → 1.19.724

package/docs/adr/0111-instance-hosting-provisioning-module.md

@@ -7,8 +7,8 @@
 - **Deciders:** Lars (Archon), Claude
 - **Consolidates:** idea [#345](https://example.com/builders#/idea/345) (owner — *"offer hosting + domain services directly as a module when people start a Cloud Bongos project… configured with the API"*) + idea [#303](https://example.com/builders#/idea/303) (owner, deferred from the 2026-06-17 planning — *optional managed-hosting layer: operate branded instances for owners, push updates centrally, same self-host artifact*).
 - **Decides:** (1) that "hosting + domains" ships as a **new `provisioning` module** (NOT the ADR 0092 `hosting` key — see disambiguation below), and its boundary; (2) how the web tier provisions real infra **without holding cloud credentials**; (3) what "provision an instance" composes; (4) domain + TLS handling; (5) the **self-host vs managed split** — both run the identical artifact, and what actually differs; (6) the cost posture; (7) sequencing.
-- **Builds on:** [ADR 0062](<redacted>.md) (core↔host instance model), [ADR 0108](<redacted>.md) (the core as a versioned npm dependency — "the same self-host artifact"), [ADR 0065](<redacted>.md) §2 (managed hosting is a service *on top of* the same AGPL artifact), [ADR 0031](<redacted>.md) (the dev-box lifecycle — the reusable provisioning substrate + trust-boundary pattern), [ADR 0083](<redacted>.md) (the module system this ships as), [ADR 0016](<redacted>.md) (server-enforced trust boundary the module must never weaken), [ADR 0100](<redacted>.md) §3 (per-repo GDS — locked; a managed fleet sits *above* it).
-- **Relationship to [ADR 0092](<redacted>.md) (name-collision, resolved):** ADR 0092's `hosting` module answers *"where do compute/storage **workloads** run"* (LLM inference, imagegen, embeddings, training, blob storage — brokered to a target such as the warehouse GPU box). **This ADR is a different layer:** *"stand up + operate a whole Cloud Bongos **instance's own infrastructure** — server, database, domain, DNS, TLS."* Same English word "hosting", two concerns. To avoid the "contribution seam" naming-collision lesson ([ADR 0107](<redacted>.md) §Context), this module takes the distinct key **`provisioning`**; ADR 0092 keeps `hosting`. This ADR does **not** re-open or supersede 0092.
+- **Builds on:** [ADR 0062](0062-medusa-instance-model-decoupling.md) (core↔host instance model), [ADR 0108](0108-instance-composition-configurable-root.md) (the core as a versioned npm dependency — "the same self-host artifact"), [ADR 0065](0065-agpl-nonprofit-ai-first-governance.md) §2 (managed hosting is a service *on top of* the same AGPL artifact), [ADR 0031](0031-cloud-dev-environments-for-builders.md) (the dev-box lifecycle — the reusable provisioning substrate + trust-boundary pattern), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the module system this ships as), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced trust boundary the module must never weaken), [ADR 0100](0100-two-repo-instance-model.md) §3 (per-repo GDS — locked; a managed fleet sits *above* it).
+- **Relationship to [ADR 0092](0092-hosting-module-and-on-prem-target.md) (name-collision, resolved):** ADR 0092's `hosting` module answers *"where do compute/storage **workloads** run"* (LLM inference, imagegen, embeddings, training, blob storage — brokered to a target such as the warehouse GPU box). **This ADR is a different layer:** *"stand up + operate a whole Cloud Bongos **instance's own infrastructure** — server, database, domain, DNS, TLS."* Same English word "hosting", two concerns. To avoid the "contribution seam" naming-collision lesson ([ADR 0107](0107-module-upstreaming-contribution-to-core-catalog.md) §Context), this module takes the distinct key **`provisioning`**; ADR 0092 keeps `hosting`. This ADR does **not** re-open or supersede 0092.
 
 ---
 
@@ -18,16 +18,16 @@
 
 **What already exists (the reusable substrate).**
 
-- **The instance model is real and proven.** cloudbongos.com is a live second instance (shipped 2026-06-21): its own database, its own process/port, neutral branding, zero game code, **$0/mo extra** because it co-tenants the existing $14/mo droplet ([`docs/recipes/cloudbongos-standup.md`](../recipes/cloudbongos-standup.md)). An instance = a branding pack + enabled modules + owner/repo/OAuth binding + its own DB ([ADR 0062](<redacted>.md) §2).
-- **"The same self-host artifact" is defined.** [ADR 0108](<redacted>.md): the core is packaged as `@cloudbongos/core` (`scripts/gds/package-core.js`, `core_version 1.14.0`, pinned by `tree_sha256`) and consumed as a versioned npm dependency via `resolveCoreRoot()`/`resolveInstanceRoot()` in `src/instance-config.js`. Central updates = `bongos upgrade` (a version-pin bump → `npm ci` → migrate → restart) — **O(1) per instance, not an O(instances × drift) merge**. (`bongos upgrade` is a stub until R86; the channel is specified, not yet exercised.)
+- **The instance model is real and proven.** cloudbongos.com is a live second instance (shipped 2026-06-21): its own database, its own process/port, neutral branding, zero game code, **$0/mo extra** because it co-tenants the existing $14/mo droplet ([`docs/recipes/cloudbongos-standup.md`](../recipes/cloudbongos-standup.md)). An instance = a branding pack + enabled modules + owner/repo/OAuth binding + its own DB ([ADR 0062](0062-medusa-instance-model-decoupling.md) §2).
+- **"The same self-host artifact" is defined.** [ADR 0108](0108-instance-composition-configurable-root.md): the core is packaged as `@cloudbongos/core` (`scripts/gds/package-core.js`, `core_version 1.14.0`, pinned by `tree_sha256`) and consumed as a versioned npm dependency via `resolveCoreRoot()`/`resolveInstanceRoot()` in `src/instance-config.js`. Central updates = `bongos upgrade` (a version-pin bump → `npm ci` → migrate → restart) — **O(1) per instance, not an O(instances × drift) merge**. (`bongos upgrade` is a stub until R86; the channel is specified, not yet exercised.)
 - **`bongos init` scaffolds a project** (`scripts/gds/init.js`): an interview writes lean `config/branding.json` / `config/modules.json` / `config/hierarchy.json` overrides, materialises `.claude/`, seeds a first version + goal, and — critically — files the **irreducibly-manual owner steps as tracked kickoff tasks** rather than pretending launch is one command: register a GitHub OAuth app, first owner sign-in (seats the founding Archon), confirm the repo binding, and "production topology: TLS, real origins, managed Postgres." **That kickoff list is precisely the surface this module automates.**
-- **Programmatic infra provisioning already works — for dev boxes.** The dev-box lifecycle ([ADR 0031](<redacted>.md)) creates/parks/wakes/destroys DigitalOcean droplets (`modules/dev-box/do-api.js`, DO API v2, dry-run by default), manages Cloudflare DNS records (`infra/box-dns-cloudflare.sh` — UPSERT + a blackhole-on-retire that avoids NXDOMAIN caching), boots servers unattended via cloud-init, and prices resources from a `SIZE_CATALOG` cost ledger. **This is the exact machinery a hosting module needs**, one layer up (a whole instance instead of a builder's box).
-- **The trust-boundary + intent-queue pattern is established and non-negotiable.** Real-money / infra mutations **never** touch the internet-facing web process. The web route only **enqueues an intent** (`box_intents`); a separate **control-plane runner** (`scripts/gds/box.js`, driven by a systemd timer) is the *sole holder* of the cloud provider tokens, which live in a chmod-600 `/etc/<inst>/box.env` loaded via `EnvironmentFile=` — structurally out of reach of the web tier ([ADR 0016](<redacted>.md), [ADR 0031](<redacted>.md) §9.4).
-- **The module contract is settled** ([`docs/modules-contract.md`](../modules-contract.md), [ADR 0083](<redacted>.md)): `module.json` manifest, `default:false` optional modules, one-way import boundary (a module reaches core only through `src/module-api.js`; never another module), rank-gated write routes (fitness-enforced), and module-owned namespaced migrations.
+- **Programmatic infra provisioning already works — for dev boxes.** The dev-box lifecycle ([ADR 0031](0031-cloud-dev-environments-for-builders.md)) creates/parks/wakes/destroys DigitalOcean droplets (`modules/dev-box/do-api.js`, DO API v2, dry-run by default), manages Cloudflare DNS records (`infra/box-dns-cloudflare.sh` — UPSERT + a blackhole-on-retire that avoids NXDOMAIN caching), boots servers unattended via cloud-init, and prices resources from a `SIZE_CATALOG` cost ledger. **This is the exact machinery a hosting module needs**, one layer up (a whole instance instead of a builder's box).
+- **The trust-boundary + intent-queue pattern is established and non-negotiable.** Real-money / infra mutations **never** touch the internet-facing web process. The web route only **enqueues an intent** (`box_intents`); a separate **control-plane runner** (`scripts/gds/box.js`, driven by a systemd timer) is the *sole holder* of the cloud provider tokens, which live in a chmod-600 `/etc/<inst>/box.env` loaded via `EnvironmentFile=` — structurally out of reach of the web tier ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md), [ADR 0031](0031-cloud-dev-environments-for-builders.md) §9.4).
+- **The module contract is settled** ([`docs/modules-contract.md`](../modules-contract.md), [ADR 0083](0083-modular-architecture-strangler-build-plan.md)): `module.json` manifest, `default:false` optional modules, one-way import boundary (a module reaches core only through `src/module-api.js`; never another module), rank-gated write routes (fitness-enforced), and module-owned namespaced migrations.
 
-**The gaps (net-new work).** No single command turns the [`cloudbongos-standup.md`](../recipes/cloudbongos-standup.md) runbook into an automated provision. No **domain purchase/registration** capability exists (only DNS-*record* management on existing zones). Per-apex **TLS** is a manual Cloudflare Origin-Cert console step (the least-automated leg). There is no per-instance managed-DB provisioning at scale, no **billing/metering** (only a box *cost ledger*), and no **central fleet control plane** — per-repo GDS is locked ([ADR 0100](<redacted>.md) §3), so "instances Cloud Bongos operates" would be a new operator layer *above* the individual GDS DBs.
+**The gaps (net-new work).** No single command turns the [`cloudbongos-standup.md`](../recipes/cloudbongos-standup.md) runbook into an automated provision. No **domain purchase/registration** capability exists (only DNS-*record* management on existing zones). Per-apex **TLS** is a manual Cloudflare Origin-Cert console step (the least-automated leg). There is no per-instance managed-DB provisioning at scale, no **billing/metering** (only a box *cost ledger*), and no **central fleet control plane** — per-repo GDS is locked ([ADR 0100](0100-two-repo-instance-model.md) §3), so "instances Cloud Bongos operates" would be a new operator layer *above* the individual GDS DBs.
 
-**The budget DNA that constrains this.** $5K total for build + first year; cheapest-viable-by-default; any high fixed monthly cost needs an ADR + a cheaper fallback ([CLAUDE.md §4](../../CLAUDE.md)). The project has twice rejected always-on control planes on cost grounds — Coder and a container pool were both declined in [ADR 0031](<redacted>.md) in favour of snapshot-and-park with fixed cost ≈ $0. A hosting module inherits that DNA: **near-zero fixed cost when idle.**
+**The budget DNA that constrains this.** $5K total for build + first year; cheapest-viable-by-default; any high fixed monthly cost needs an ADR + a cheaper fallback ([CLAUDE.md §4](../../CLAUDE.md)). The project has twice rejected always-on control planes on cost grounds — Coder and a container pool were both declined in [ADR 0031](0031-cloud-dev-environments-for-builders.md) in favour of snapshot-and-park with fixed cost ≈ $0. A hosting module inherits that DNA: **near-zero fixed cost when idle.**
 
 ---
 
@@ -48,7 +48,7 @@ A new, portable, **`default:false`** module `modules/provisioning/` (`coreVersio
 - Optionally a hall **`uiSection`** (an "Instances" panel — own-scoped for owners, fleet view for Archon), reusing the dev-box UI pattern.
 - A **port it provides**, e.g. `provisioning.instanceState`, so other code can read instance status via `seams.resolveOptional` without importing this module.
 
-**It does NOT own** (hard boundary — the trust-boundary rule, §2): the cloud provider tokens, the code that calls DigitalOcean/Cloudflare/a registrar, or any privileged shell/SSH. Those live only on the control plane. It also does not own the *game*, *branding*, or *the instance's own GDS data* — an instance provisioned by this module is a normal Cloud Bongos instance with its own DB ([ADR 0100](<redacted>.md) §3).
+**It does NOT own** (hard boundary — the trust-boundary rule, §2): the cloud provider tokens, the code that calls DigitalOcean/Cloudflare/a registrar, or any privileged shell/SSH. Those live only on the control plane. It also does not own the *game*, *branding*, or *the instance's own GDS data* — an instance provisioned by this module is a normal Cloud Bongos instance with its own DB ([ADR 0100](0100-two-repo-instance-model.md) §3).
 
 ### 2. The web tier enqueues intents; a control-plane runner holds the tokens
 
@@ -63,7 +63,7 @@ The runner automates the [`cloudbongos-standup.md`](../recipes/cloudbongos-stand
 | Step | Automatable? | How |
 |---|---|---|
 | Server (co-tenant process **or** a dedicated droplet) | **Yes** | Co-tenant: allocate a port + DB on an existing box (the cloudbongos.com shape, $0 extra). Dedicated: `do-api.js` `createDroplet` + cloud-init (the box precedent). |
-| Database | **Yes** | `createdb <inst>` + GDS-only `migrate.sh` (`MEDUSA_GDS_ONLY=1`, instance seeds off — [ADR 0105](<redacted>.md)). |
+| Database | **Yes** | `createdb <inst>` + GDS-only `migrate.sh` (`MEDUSA_GDS_ONLY=1`, instance seeds off — [ADR 0105](0105-instance-seed-migrations-out-of-core.md)). |
 | App config + secrets | **Yes** | Write `config/branding.json`/`modules.json`/`hierarchy.json` (from the init spec) + a per-instance `/etc/<inst>/web.env` (chmod 600). |
 | Process/service | **Yes** | Install + enable a per-instance systemd unit (the `cloudbongos.service` template). |
 | DNS | **Yes** | Cloudflare A-record UPSERT via the shared client (§2/§4). |
@@ -80,13 +80,13 @@ The runner automates the [`cloudbongos-standup.md`](../recipes/cloudbongos-stand
 
 ### 5. The self-host vs managed split
 
-**Both run the identical `@cloudbongos/core` artifact ([ADR 0108](<redacted>.md)).** Managed is not a fork, not open-core, not a proprietary layer — it is self-host + (a) the provisioning module pointed at Cloud Bongos's own infra, and (b) a central operator driving the *existing* `bongos upgrade` channel. This is exactly the posture [ADR 0065](<redacted>.md) §2 already recorded ("*a service offered on top of the same AGPL artifact — it does not change the artifact's license or the non-profit posture*").
+**Both run the identical `@cloudbongos/core` artifact ([ADR 0108](0108-instance-composition-configurable-root.md)).** Managed is not a fork, not open-core, not a proprietary layer — it is self-host + (a) the provisioning module pointed at Cloud Bongos's own infra, and (b) a central operator driving the *existing* `bongos upgrade` channel. This is exactly the posture [ADR 0065](0065-agpl-nonprofit-ai-first-governance.md) §2 already recorded ("*a service offered on top of the same AGPL artifact — it does not change the artifact's license or the non-profit posture*").
 
 | Dimension | **Self-host** | **Managed** (idea 303) |
 |---|---|---|
 | Artifact | identical `@cloudbongos/core` (pinned npm dep) | identical |
 | Whose cloud account/tokens | the **owner's** (their DO/Cloudflare/registrar tokens, held on **their** control plane) | **Cloud Bongos's** tokens on Cloud Bongos infra |
-| Control plane | the owner's own (their box runs `provision.js`) | a **central fleet control plane** — greenfield; sits *above* per-instance GDS DBs ([ADR 0100](<redacted>.md) §3) |
+| Control plane | the owner's own (their box runs `provision.js`) | a **central fleet control plane** — greenfield; sits *above* per-instance GDS DBs ([ADR 0100](0100-two-repo-instance-model.md) §3) |
 | The `provisioning` module | same module, enabled, configured with the owner's target | same module, target = Cloud Bongos infra |
 | Updates | owner runs `bongos upgrade` | operator drives `bongos upgrade` across the fleet (same channel) |
 | Billing | owner pays their own cloud bill directly | Cloud Bongos meters → invoices → collects (**deferred**, §6) |
@@ -108,9 +108,9 @@ Inherit the budget DNA. **Default to the cheapest shape** — a co-tenant proces
 
 ## Alternatives considered
 
-- **Reuse the `hosting` key / fold into [ADR 0092](<redacted>.md).** Rejected — 0092 is compute/storage *workload* brokering; conflating "where my inference runs" with "where my instance runs" would muddy both boundaries (the [ADR 0107](<redacted>.md) naming-collision lesson). Distinct `provisioning` key.
-- **Provision directly from the web tier (let it hold DO/CF tokens).** Rejected — violates the [ADR 0016](<redacted>.md)/[ADR 0031](<redacted>.md) trust boundary. The intent-queue + control-plane runner is mandatory, not stylistic.
-- **A full standing control plane per the Coder model.** Rejected on cost — the exact trade [ADR 0031](<redacted>.md) already declined. Systemd-timer-drained intents keep idle fixed cost ≈ $0.
+- **Reuse the `hosting` key / fold into [ADR 0092](0092-hosting-module-and-on-prem-target.md).** Rejected — 0092 is compute/storage *workload* brokering; conflating "where my inference runs" with "where my instance runs" would muddy both boundaries (the [ADR 0107](0107-module-upstreaming-contribution-to-core-catalog.md) naming-collision lesson). Distinct `provisioning` key.
+- **Provision directly from the web tier (let it hold DO/CF tokens).** Rejected — violates the [ADR 0016](0016-trust-boundary-server-enforced-permissions.md)/[ADR 0031](0031-cloud-dev-environments-for-builders.md) trust boundary. The intent-queue + control-plane runner is mandatory, not stylistic.
+- **A full standing control plane per the Coder model.** Rejected on cost — the exact trade [ADR 0031](0031-cloud-dev-environments-for-builders.md) already declined. Systemd-timer-drained intents keep idle fixed cost ≈ $0.
 - **Per-apex Cloudflare Origin Certs (automate the console step).** Rejected in favour of Caddy on-demand ACME — less bespoke, no Cloudflare-console dependency, and it removes the manual leg outright. Existing apexes keep their Origin Certs.
 - **Domain purchase in V1.** Deferred — bring-your-own-domain covers the common case; registrar-API integration is additive and shouldn't gate the module.
 - **Build managed first.** Rejected — it depends on unshipped Mercury + the upgrade channel, and idea 303 was always the optional later layer.
@@ -123,8 +123,8 @@ Inherit the budget DNA. **Default to the cheapest shape** — a co-tenant proces
 - **The trust boundary is preserved** — the internet-facing process gains a provisioning surface but still holds no cloud credentials; all real infra mutation stays on the control plane.
 - **`bongos init` gains an infra arm** — its infra answers flow into a provisioning request instead of only filing manual kickoff tasks.
 - **Deferred / risks:** the **managed fleet control plane** is genuinely greenfield and sits above the locked per-repo GDS model — it needs its own spec once Mercury lands. **Billing/metering** is greenfield (no capability today). **Domain registration** is deferred. On-demand TLS must be hostname-allow-listed to what was actually provisioned. `bongos upgrade` is still a stub (R86).
-- **Licensing unchanged** — managed is a service on the same AGPL artifact ([ADR 0065](<redacted>.md) §2); no open-core, no relicensing.
-- **A provisioned instance loads its OWN branding pack** ([task 1003740](https://cloudbongos.com/builders#/task/1003740)). Provisioning originally pinned every instance's pack to the shared, committed neutral starter, because the co-tenant model of the day ran ONE checkout for all instances and differentiated them purely by env. Under [ADR 0108](<redacted>.md) that is no longer true — each instance has its own checkout, its own `config/branding.json` written at init, and runs `node_modules/@bongos/core`. The pin outlived its premise, and because `src/branding.js`'s env overrides carry domains, `auth.idp` and landing but **never `identity.productName`**, every hosted instance served the platform's name as its own: `GET /api/gds/instance` on hermeslines-marketing, mercury and demo all answered "Cloud Bongos" while their own packs on disk said otherwise. `bongos login <instance>` therefore greeted a newcomer with the wrong project at the moment they were deciding whether to trust it, and nothing looked — a healthy instance passes `/healthz` while lying about who it is. Provisioning now writes no branding-file pin at all, so `src/branding.js`'s default (`<instanceRoot>/config/branding.json`, falling back to neutral when absent) applies; standup gained an identity probe beside the healthz one, which **warns** rather than fails, since an owner may legitimately name a project after the platform.
+- **Licensing unchanged** — managed is a service on the same AGPL artifact ([ADR 0065](0065-agpl-nonprofit-ai-first-governance.md) §2); no open-core, no relicensing.
+- **A provisioned instance loads its OWN branding pack** ([task 1003740](https://cloudbongos.com/builders#/task/1003740)). Provisioning originally pinned every instance's pack to the shared, committed neutral starter, because the co-tenant model of the day ran ONE checkout for all instances and differentiated them purely by env. Under [ADR 0108](0108-instance-composition-configurable-root.md) that is no longer true — each instance has its own checkout, its own `config/branding.json` written at init, and runs `node_modules/@bongos/core`. The pin outlived its premise, and because `src/branding.js`'s env overrides carry domains, `auth.idp` and landing but **never `identity.productName`**, every hosted instance served the platform's name as its own: `GET /api/gds/instance` on hermeslines-marketing, mercury and demo all answered "Cloud Bongos" while their own packs on disk said otherwise. `bongos login <instance>` therefore greeted a newcomer with the wrong project at the moment they were deciding whether to trust it, and nothing looked — a healthy instance passes `/healthz` while lying about who it is. Provisioning now writes no branding-file pin at all, so `src/branding.js`'s default (`<instanceRoot>/config/branding.json`, falling back to neutral when absent) applies; standup gained an identity probe beside the healthz one, which **warns** rather than fails, since an owner may legitimately name a project after the platform.
 - **Follow-up tasks seeded** under BONGOS-V1 / goal 26 (idempotent seeder `scripts/gds/seed-provisioning-tasks.js`, `source_ref = <redacted>*`):
   1. **Scaffold the `provisioning` module** — manifest + `provisioning_*` tables + the web-tier intent/state routes (own + Archon), no token handling. *(buildable now)*
   2. **Extract the shared DO + Cloudflare control-plane clients** so `box.js` and `provision.js` reuse them without a module→module import (dev-box byte-identical). *(buildable now; enables 3)*

package/docs/adr/0112-private-goals-invitations-join-requests.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-07-03
 - **Deciders:** jaxri (Metic, owner request), Claude
 
-**Builds on / amends:** [ADR 0086](<redacted>.md) (goal-scoped work hierarchy — this ADR adds a privacy dimension + the self-service membership queue its §3 deferred), [ADR 0106](<redacted>.md) (goal owner/manager authority — the exact authority this ADR reuses for who may invite/approve), [ADR 0016](<redacted>.md) (server-enforced rank boundary — unchanged). Reuses the approval-queue shape of `access_requests` ([`modules/onboarding/routes/access-requests.js`](../../modules/onboarding/routes/access-requests.js)).
+**Builds on / amends:** [ADR 0086](0086-goal-scoped-work-hierarchy.md) (goal-scoped work hierarchy — this ADR adds a privacy dimension + the self-service membership queue its §3 deferred), [ADR 0106](0106-goal-owner-manager-authority.md) (goal owner/manager authority — the exact authority this ADR reuses for who may invite/approve), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced rank boundary — unchanged). Reuses the approval-queue shape of `access_requests` ([`modules/onboarding/routes/access-requests.js`](../../modules/onboarding/routes/access-requests.js)).
 
 **Track:** `internal` (GDS / methodology — a Cloud Bongos platform capability).
 
@@ -12,7 +12,7 @@
 
 ## Context
 
-Goals are shared, module-scoped workspaces ([ADR 0086](<redacted>.md)). Today a *normal* (non-protected-scope) goal is **open-join**: `POST /goals/:id/join` adds anyone who asks. Protected-scope goals are already Archon-mediated. There was no middle ground — no way for a goal's own owner/manager ([ADR 0106](<redacted>.md)) to say "this is a curated group; ask to join, or wait to be invited." ADR 0086 §3 explicitly deferred the self-service "request → approve" queue ("it co-evolves with that ADR"); this is that ADR for the normal-goal case.
+Goals are shared, module-scoped workspaces ([ADR 0086](0086-goal-scoped-work-hierarchy.md)). Today a *normal* (non-protected-scope) goal is **open-join**: `POST /goals/:id/join` adds anyone who asks. Protected-scope goals are already Archon-mediated. There was no middle ground — no way for a goal's own owner/manager ([ADR 0106](0106-goal-owner-manager-authority.md)) to say "this is a curated group; ask to join, or wait to be invited." ADR 0086 §3 explicitly deferred the self-service "request → approve" queue ("it co-evolves with that ADR"); this is that ADR for the normal-goal case.
 
 The owner request (2026-07-03): let a goal manager **make a goal private and invite builders**, let any builder **request to join**, gate approval to the goal's **owner/manager (or an Archon)**, and surface both sides in a **home-page inbox**.
 
@@ -24,8 +24,8 @@ One product decision was made explicitly with the requester: **private means joi
 
 ### 1. Visibility (task 1951)
 
-- `goals.visibility text NOT NULL DEFAULT 'public' CHECK (visibility IN ('public','private'))` — a purely additive column (core migration `core_188_…`, because `goals` is a **core-owned** table; [ADR 0083](<redacted>.md) §Decision 5). Every existing goal defaults to `public` = today's behaviour, so nothing changes until a manager flips it.
-- `PATCH /goals/:id/visibility { visibility }` — the owner, a manager, or an Archon (the `authorizeGoalManagement` gate, [ADR 0106](<redacted>.md)). (task 1952)
+- `goals.visibility text NOT NULL DEFAULT 'public' CHECK (visibility IN ('public','private'))` — a purely additive column (core migration `core_188_…`, because `goals` is a **core-owned** table; [ADR 0083](0083-modular-architecture-strangler-build-plan.md) §Decision 5). Every existing goal defaults to `public` = today's behaviour, so nothing changes until a manager flips it.
+- `PATCH /goals/:id/visibility { visibility }` — the owner, a manager, or an Archon (the `authorizeGoalManagement` gate, [ADR 0106](0106-goal-owner-manager-authority.md)). (task 1952)
 
 ### 2. The membership-request queue (task 1951)
 
@@ -42,7 +42,7 @@ One table, both directions, distinguished by `kind`:
 
 ### 3. Routes (task 1952) — every wall in-handler, pinned `any-builder`
 
-Following the [ADR 0106](<redacted>.md) precedent (the wall is the in-handler pure ordered gate, not a rank middleware; each route pinned in `route-rank-check` so an accidental `requireRank` re-gate or a gate removal is a red build):
+Following the [ADR 0106](0106-goal-owner-manager-authority.md) precedent (the wall is the in-handler pure ordered gate, not a rank middleware; each route pinned in `route-rank-check` so an accidental `requireRank` re-gate or a gate removal is a red build):
 
 - `POST /goals/:id/join` — **changed**: on a `private` goal, a non-member who isn't owner/manager/Archon is refused `409 goal_private` ("request to join or wait for an invite") instead of being added. Public + protected-scope behaviour unchanged.
 - `POST /goals/:id/requests { note? }` — a builder asks to join (refused on a public non-protected goal — just join — and if already a member).
@@ -60,8 +60,8 @@ The membership add on accept/approve is atomic with the resolve: `resolveMembers
 ## Consequences
 
 - **Additive + reversible.** Default `public` means zero behaviour change on every existing goal; the whole feature is dark until a manager flips a goal private. Each of the four build phases (schema, API, goals-page UI, home inbox) ships independently.
-- **Reuses the existing authority model wholesale** — no new notion of "who runs a goal"; invitations/approvals gate on the same owner/manager/Archon as role changes and conflict resolution ([ADR 0106](<redacted>.md)).
-- **Protected-scope goals are unchanged** — their stronger Archon-mediation ([ADR 0086](<redacted>.md) §3) still governs; `visibility` is orthogonal and additive on top.
+- **Reuses the existing authority model wholesale** — no new notion of "who runs a goal"; invitations/approvals gate on the same owner/manager/Archon as role changes and conflict resolution ([ADR 0106](0106-goal-owner-manager-authority.md)).
+- **Protected-scope goals are unchanged** — their stronger Archon-mediation ([ADR 0086](0086-goal-scoped-work-hierarchy.md) §3) still governs; `visibility` is orthogonal and additive on top.
 - **Private = join-gated, not hidden.** A non-member can still see a private goal's title + progress. If true concealment is ever wanted it needs its own ADR (a membership filter across list/detail/roadmap/board/tasks) — deliberately **not** built now.
 
 ## Alternatives considered

package/docs/adr/0113-sandbox-studio-descope-superseded-by-0044-0052.md

@@ -1,7 +1,7 @@
 # ADR 0113 — Per-builder art sandbox (task 885): descope to the Studio only, superseded by ADR 0044/0052
 
 **Date:** 2026-07-03
-**Context:** [task 885](https://example.com/builders#/task/885) ("Per-builder art sandbox + sprite studio"), goal 25 (builder experience). Companion to [ADR 0044](<redacted>.md) (per-box live game preview), [ADR 0052](<redacted>.md) (game-only preview entry, every rank), and [ADR 0083](<redacted>.md) (the game's carve into `modules/game/`).
+**Context:** [task 885](https://example.com/builders#/task/885) ("Per-builder art sandbox + sprite studio"), goal 25 (builder experience). Companion to [ADR 0044](0044-per-box-live-game-preview.md) (per-box live game preview), [ADR 0052](0052-sandbox-for-everyone-game-only-preview.md) (game-only preview entry, every rank), and [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the game's carve into `modules/game/`).
 **Status:** Accepted.
 **Track:** `internal` (builder experience / dev box).
 

package/docs/adr/0114-instance-docs-discovery-contract.md

@@ -2,14 +2,14 @@
 
 **Date:** 2026-07-04
 **Status:** Accepted.
-**Context:** [task 2005](https://builders.example.com#/task/2005) (BONGOS-V1, from the 2026-07-04 CLAUDE.md review, bullet 6). Companion to [ADR 0062](<redacted>.md) (core↔host split), [ADR 0109](<redacted>.md) (self-describing OpenAPI + hosted `/docs`), and [ADR 0029](<redacted>.md) (off-box status page).
+**Context:** [task 2005](https://builders.example.com#/task/2005) (BONGOS-V1, from the 2026-07-04 CLAUDE.md review, bullet 6). Companion to [ADR 0062](0062-medusa-instance-model-decoupling.md) (core↔host split), [ADR 0109](0109-self-describing-openapi-and-hosted-docs.md) (self-describing OpenAPI + hosted `/docs`), and [ADR 0029](0029-status-page-outage-resilience.md) (off-box status page).
 
 ## Problem
 
 CLAUDE.md tells an agent to "read docs on your instance's builders' hall (`domains.buildersOrigin`)," but nothing *pins* how a fresh, self-hosted instance's agent reliably locates its doc surfaces. The pointer was one line of prose citing one config key — hand-waving, not a contract. A second instance standing up on its own domain needs to resolve "where are my hall, my rendered docs, my status page?" **from config alone, with no hard-coded `example` anywhere.** Today the pieces exist but were never named together as the discovery contract:
 
 - `config/branding.json` `domains.{publicOrigin,buildersOrigin,statusOrigin}` — the config source of truth.
-- `/docs` + `/docs/openapi.json` — the rendered API reference + machine spec ([ADR 0109](<redacted>.md)), served on the instance's own origin.
+- `/docs` + `/docs/openapi.json` — the rendered API reference + machine spec ([ADR 0109](0109-self-describing-openapi-and-hosted-docs.md)), served on the instance's own origin.
 - `GET <publicOrigin>/api/bongos` (and the permanent `/api/gds` alias) — the machine-discovery index (task 1918), CORS-open + unauthenticated, which answered with `docs`/`openapi` pointers but **not** the hall or status origins.
 
 ## Decision
@@ -19,7 +19,7 @@ Pin a three-layer docs-discovery contract. Every layer is derivable from config
 1. **Config is the source of truth.** `config/branding.json` `domains` carries the surfaces:
    - `domains.buildersOrigin` — the **builders' hall**: the canonical doc-reading surface (task/idea/blocker refs render as working links; the primer + generated diagrams + repo docs render there).
    - `domains.publicOrigin` — the **instance origin**: `/docs` renders the API reference and `/docs/openapi.json` is the machine-readable OpenAPI 3.1 spec.
-   - `domains.statusOrigin` — the **status page**: the off-box fallback for project state when the hall is down ([ADR 0029](<redacted>.md)), though it does not render full docs.
+   - `domains.statusOrigin` — the **status page**: the off-box fallback for project state when the hall is down ([ADR 0029](0029-status-page-outage-resilience.md)), though it does not render full docs.
 2. **The machine-discovery index is the zero-config entry point.** `GET <publicOrigin>/api/bongos` (and the permanent `/api/gds` alias) returns a small JSON map that now advertises the doc surfaces themselves — `hall`, `status`, and `public` origins alongside `docs`/`openapi`. An agent or client that knows only *one* origin (or reaches the API root by accident) can bootstrap every other doc surface from that single response, with no config file and no hard-coded host.
 3. **Resolution order for an agent.** (a) Read `config/branding.json` `domains` when the checkout is present; (b) otherwise `GET <origin>/api/bongos` and read `hall`/`status`/`docs`; (c) the hall is the canonical doc surface, the status page the outage fallback, `/docs` the API reference. `github.com` is the code host only — never the doc-reading surface (a bare `#NNN` mis-autolinks there).
 
@@ -29,4 +29,4 @@ Pin a three-layer docs-discovery contract. Every layer is derivable from config
 - **`docs/branding-contract.md`** documents the docs-discovery contract so a fresh instance knows these `domains.*` fields are load-bearing, not decorative.
 - **CLAUDE.md's preamble references this ADR** instead of hand-waving a single config key.
 - **No new required config field** — the contract formalizes the existing `domains.{publicOrigin,buildersOrigin,statusOrigin}` keys. `buildersOrigin`/`statusOrigin` stay optional in the contract (an instance may ship without a hall/status surface); when absent the index returns `null` for that pointer and the agent falls back to `/docs` on `publicOrigin`.
-- **Portability, not behavior.** No endpoint semantics change; the index adds fields (back-compatible). The [ADR 0016](<redacted>.md) trust boundary is untouched — the index names only public locations and remains unauthenticated.
+- **Portability, not behavior.** No endpoint semantics change; the index adds fields (back-compatible). The [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) trust boundary is untouched — the index names only public locations and remains unauthenticated.

package/docs/adr/0115-scheduled-routines-portability.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-07-04
 **Status:** Accepted (contract; spike deliverable).
-**Context:** [task 2014](https://builders.example.com#/task/2014) (BONGOS-V1, from the 2026-07-04 CLAUDE.md review, bullet 241). The ~17 autonomous cron routines under [`.claude/scheduled-tasks/`](../../.claude/scheduled-tasks/) (`overnight-builder`, `idea-triage-nightly`, `overnight-code-review`, `bfg`, `security-review-weekly`, box lifecycle, audits, newcomer restock, …) were written for *this* instance. A self-hosted, multi-builder instance needs a defined model for which run instance-wide vs per-builder, how a fresh instance inherits/configures them, and what a builder gets by default. Companion to [ADR 0062](<redacted>.md) (core↔host split) and [ADR 0024](<redacted>.md) (the MAS the routines belong to).
+**Context:** [task 2014](https://builders.example.com#/task/2014) (BONGOS-V1, from the 2026-07-04 CLAUDE.md review, bullet 241). The ~17 autonomous cron routines under [`.claude/scheduled-tasks/`](../../.claude/scheduled-tasks/) (`overnight-builder`, `idea-triage-nightly`, `overnight-code-review`, `bfg`, `security-review-weekly`, box lifecycle, audits, newcomer restock, …) were written for *this* instance. A self-hosted, multi-builder instance needs a defined model for which run instance-wide vs per-builder, how a fresh instance inherits/configures them, and what a builder gets by default. Companion to [ADR 0062](0062-medusa-instance-model-decoupling.md) (core↔host split) and [ADR 0024](0024-multi-agent-system-architecture.md) (the MAS the routines belong to).
 
 ## Problem
 

package/docs/adr/0117-api-versioning-and-deprecation-policy.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-07-04
 **Status:** Accepted (policy; R05 of goal 36).
-**Context:** [task 1992](https://builders.example.com#/task/1992) (BONGOS-V1, goal 36 "Robust, versioned, easy-to-call public API", criterion `api-versioning`). This is the **policy**; the mount + aliasing that implements it is R06 ([task 1993](https://builders.example.com#/task/1993)). Builds on the API-prefix chokepoint ([`src/gds/api-prefix.js`](../../src/gds/api-prefix.js), task 1918/1919), the self-describing OpenAPI + hosted `/docs` ([ADR 0109](<redacted>.md)), and the docs-discovery contract ([ADR 0114](<redacted>.md)).
+**Context:** [task 1992](https://builders.example.com#/task/1992) (BONGOS-V1, goal 36 "Robust, versioned, easy-to-call public API", criterion `api-versioning`). This is the **policy**; the mount + aliasing that implements it is R06 ([task 1993](https://builders.example.com#/task/1993)). Builds on the API-prefix chokepoint ([`src/gds/api-prefix.js`](../../src/gds/api-prefix.js), task 1918/1919), the self-describing OpenAPI + hosted `/docs` ([ADR 0109](0109-self-describing-openapi-and-hosted-docs.md)), and the docs-discovery contract ([ADR 0114](0114-instance-docs-discovery-contract.md)).
 
 ## Problem
 

package/docs/adr/0118-api-contract-source-of-truth-code-first.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-07-04
 **Status:** Accepted (spike; R07 of goal 36).
-**Context:** [task 1994](https://builders.example.com#/task/1994) (BONGOS-V1, goal 36, criteria `api-client-sdk` + `api-validation`). The spike that shapes the SDK (R08–R10) and validation (R11–R12): does the OpenAPI spec become the **source** (schema-first — author schemas, generate routes + validation + client), or stay **generated from code** (code-first) with codegen layered on? Builds on the self-describing OpenAPI generator ([ADR 0109](<redacted>.md), `scripts/gds/gen-api-docs.js`) and the error envelope ([ADR 0116](<redacted>.md)).
+**Context:** [task 1994](https://builders.example.com#/task/1994) (BONGOS-V1, goal 36, criteria `api-client-sdk` + `api-validation`). The spike that shapes the SDK (R08–R10) and validation (R11–R12): does the OpenAPI spec become the **source** (schema-first — author schemas, generate routes + validation + client), or stay **generated from code** (code-first) with codegen layered on? Builds on the self-describing OpenAPI generator ([ADR 0109](0109-self-describing-openapi-and-hosted-docs.md), `scripts/gds/gen-api-docs.js`) and the error envelope ([ADR 0116](0116-api-error-envelope-and-code-taxonomy.md)).
 
 ## What exists today
 

package/docs/adr/0120-pay-on-land-and-builder-owned-rebase-gate.md

@@ -33,7 +33,7 @@ Re-couple reward and queue-access to **landed code**, in four parts.
 1. **Pay on land, not on confirm.** Move BOTH reward writes from the `confirmed`
    transition to the `shipped` (merged-to-`main`) transition:
    - the per-task credit (`insertMultipliedConfirmCredit` + the idea-promotion bonus), and
-   - the cost-plus session-token reward ([ADR 0054](<redacted>.md)).
+   - the cost-plus session-token reward ([ADR 0054](0054-session-token-reward-cost-plus.md)).
 
    The award becomes idempotent on ship (`credit_log.reason = 'task.shipped'`, guarded by a
    uniqueness check per task, mirroring today's confirm-time guard). **The happy path barely
@@ -43,7 +43,7 @@ Re-couple reward and queue-access to **landed code**, in four parts.
 2. **A stalled land becomes the builder's own chore (`needs_rebase`).** The
    `publish-reconciler` already detects why a confirmed task won't land — `merge_conflict`,
    a failing required check against current `main`, or no pushed branch. After the normal
-   auto-land grace (the reconciler's existing retries + the [ADR 0082](<redacted>.md)
+   auto-land grace (the reconciler's existing retries + the [ADR 0082](0082-server-side-merge-conflict-auto-resolution.md)
    generated-file self-heal) is exhausted, it flags the task `needs_rebase = true`, attributed
    to the **claim holder** (the builder who did the work — the same attribution rule as
    `confirmTask`, task 661). This is a signal, not a status change: the task stays `confirmed`

package/docs/adr/0121-greenfield-vs-brownfield-onboarding-adopt-existing-repo.md

@@ -5,7 +5,7 @@
 - **Track:** internal (a portable Cloud Bongos platform capability)
 - **Task:** [#1986](https://example.com/builders#/task/1986) (BONGOS-V1, goal 35 — *Project creation flow*, the `adopt-existing-repo` criterion) — "SCOPE what an adopt mode must do; deliver an ADR + a task breakdown. Do NOT build adopt-mode here."
 - **Deciders:** Lars (Archon), Claude
-- **Builds on:** [ADR 0108](<redacted>.md) (configurable-root / core-as-npm-dep — the "layer, don't clone" substrate), [ADR 0111](<redacted>.md) (the `provisioning` module + the greenfield `bongos init` → provisioning-request wiring), [ADR 0062](<redacted>.md) (core↔host instance model), [ADR 0100](<redacted>.md) (two-repo instance model), [ADR 0105](<redacted>.md) (instance seeds out of core migrations), [ADR 0016](<redacted>.md) (server-enforced trust boundary), [ADR 0083](<redacted>.md) + [ADR 0108](<redacted>.md) §5 (module system + cross-repo migration namespacing).
+- **Builds on:** [ADR 0108](0108-instance-composition-configurable-root.md) (configurable-root / core-as-npm-dep — the "layer, don't clone" substrate), [ADR 0111](0111-instance-hosting-provisioning-module.md) (the `provisioning` module + the greenfield `bongos init` → provisioning-request wiring), [ADR 0062](0062-medusa-instance-model-decoupling.md) (core↔host instance model), [ADR 0100](0100-two-repo-instance-model.md) (two-repo instance model), [ADR 0105](0105-instance-seed-migrations-out-of-core.md) (instance seeds out of core migrations), [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) (server-enforced trust boundary), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) + [ADR 0108](0108-instance-composition-configurable-root.md) §5 (module system + cross-repo migration namespacing).
 - **Raised while** abandoning task 1689 (2026-07-04): the standalone two-repo model is already proven by Emersonian Circles (task 1917), so the missing piece is not *"can core run standalone"* but *"how does an owner who **already has a repo** adopt it."*
 
 ---

package/docs/adr/0122-onboarding-diagram-renders-deploy-rendered-off-git.md

@@ -3,8 +3,8 @@
 - **Status:** Accepted
 - **Date:** 2026-07-05
 - **Track:** internal
-- **Completes:** [ADR 0110](<redacted>.md) — the diagram half it explicitly **deferred** ("the diagrams need verified headless-Chromium handling"). This ADR records that verified handling and lands the untrack.
-- **Builds on:** [ADR 0094](<redacted>.md) (gitignored artifact rebuilt at deploy), [ADR 0063](<redacted>.md) / [ADR 0062](<redacted>.md) §8 (the nav-doc generators ADR 0110 already migrated)
+- **Completes:** [ADR 0110](0110-untrack-whole-file-generated-nav-docs.md) — the diagram half it explicitly **deferred** ("the diagrams need verified headless-Chromium handling"). This ADR records that verified handling and lands the untrack.
+- **Builds on:** [ADR 0094](0094-repo-atlas-self-drawing-codebase-map.md) (gitignored artifact rebuilt at deploy), [ADR 0063](0063-generated-repo-map-symbol-skeleton.md) / [ADR 0062](0062-medusa-instance-model-decoupling.md) §8 (the nav-doc generators ADR 0110 already migrated)
 - **Task:** [#2027](https://example.com/builders#/task/2027) (consolidated the duplicate [#1928](https://example.com/builders#/task/1928))
 
 ## Context
@@ -33,7 +33,7 @@ Apply the ADR 0110 model to the diagram **renders**, with a host-provisioned bro
 
 - The diagram-render branch-collision class is eliminated at the source; render-capable ships drop a bookkeeping commit.
 - **Accepted staleness:** the served images are fresh only *after deploy* (or a box-fetch tick), not at merge — tolerant by nature for a human onboarding page; the LOUD `::ERROR::` is the alarm if a deploy render breaks, and the nightly drift cron is the belt-and-braces.
-- **Operational coupling:** the prod droplet must keep Google Chrome installed. `deploy-prod.sh` is the hand-maintained `~/deploy.sh` mirror ([ADR 0042](<redacted>.md)/[0043](<redacted>.md)), so landing this requires an operator to (a) install Chrome (done) and (b) reinstall the updated `deploy.sh`. If Chrome is ever removed, the render step fails LOUD and the drift cron flags staleness — the page keeps its last-deployed images (no `git reset` wipes an untracked file that was just re-rendered) until the next successful deploy.
+- **Operational coupling:** the prod droplet must keep Google Chrome installed. `deploy-prod.sh` is the hand-maintained `~/deploy.sh` mirror ([ADR 0042](0042-builder-self-deploy-ci-auto-merge.md)/[0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)), so landing this requires an operator to (a) install Chrome (done) and (b) reinstall the updated `deploy.sh`. If Chrome is ever removed, the render step fails LOUD and the drift cron flags staleness — the page keeps its last-deployed images (no `git reset` wipes an untracked file that was just re-rendered) until the next successful deploy.
 - **Fresh pristine checkout / core package:** a bare `git clone` that never deploys lacks the images (same accepted trade-off ADR 0110 notes for the nav docs). `docs/onboarding/diagrams/` is not in the core publish allowlist, so nothing changes for packaged core.
 
 ## Alternatives considered

package/docs/adr/0123-box-idle-sweep-autosave-before-destroy.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-07-05
 - **Track:** internal (dev-box lifecycle)
 - **Task:** [#837](https://example.com/builders#/task/837) — "SPIKE: don't lose uncommitted work when a dev box is reclaimed (idle sweep deprovisions, no snapshot)."
-- **Builds on:** [ADR 0031](<redacted>.md) (cloud dev environments), [ADR 0071](<redacted>.md) (confirm-before-destroyed + drift reconcile — the closest prior art; hardens droplet *truthfulness*, not data preservation), [ADR 0043](<redacted>.md) (git/SSH trust boundary — relevant because the fix widens a box credential's scope).
+- **Builds on:** [ADR 0031](0031-cloud-dev-environments-for-builders.md) (cloud dev environments), [ADR 0071](0071-box-confirm-before-destroyed-and-drift-reconcile.md) (confirm-before-destroyed + drift reconcile — the closest prior art; hardens droplet *truthfulness*, not data preservation), [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) (git/SSH trust boundary — relevant because the fix widens a box credential's scope).
 
 ## Problem
 

package/docs/adr/0124-typed-api-response-bodies.md

@@ -1,8 +1,8 @@
 # ADR 0124 — Typed API response bodies (infer the success shape from `res.json`)
 
 **Date:** 2026-07-05
-**Status:** Accepted (follow-up to [ADR 0118](<redacted>.md); goal 36 `api-client-sdk`).
-**Context:** [task 2061](https://builders.example.com#/task/2061) (BONGOS-V1), promoted from idea 519. [ADR 0118](<redacted>.md) / task 2050 typed every **request** body field-level from each route's `validate()` schema. Success **responses** stayed the `ApiResponse` (`= any`) alias: routes declare no response schema, so the generator had nothing to type them from — a caller got zero autocomplete or safety on what a call returns.
+**Status:** Accepted (follow-up to [ADR 0118](0118-api-contract-source-of-truth-code-first.md); goal 36 `api-client-sdk`).
+**Context:** [task 2061](https://builders.example.com#/task/2061) (BONGOS-V1), promoted from idea 519. [ADR 0118](0118-api-contract-source-of-truth-code-first.md) / task 2050 typed every **request** body field-level from each route's `validate()` schema. Success **responses** stayed the `ApiResponse` (`= any`) alias: routes declare no response schema, so the generator had nothing to type them from — a caller got zero autocomplete or safety on what a call returns.
 
 ## Problem
 

package/docs/adr/0125-control-plane-scaffolds-standalone-instance-repo.md

@@ -1,7 +1,7 @@
 # ADR 0125 — The control plane scaffolds + pushes a standalone instance's repo
 
 **Date:** 2026-07-05
-**Status:** Accepted (implements goal 35's `project-creation-flow` criterion; builds on [ADR 0108](<redacted>.md) + [ADR 0111](<redacted>.md)).
+**Status:** Accepted (implements goal 35's `project-creation-flow` criterion; builds on [ADR 0108](0108-instance-composition-configurable-root.md) + [ADR 0111](0111-instance-hosting-provisioning-module.md)).
 **Context:** [task 2055](https://builders.example.com#/task/2055) (BONGOS-V1) — greenfield onboarding gap 3/4, found in the 2026-07-05 end-to-end standup attempt (task 2052).
 
 ## Problem
@@ -25,7 +25,7 @@ It is **idempotent** (skips once the repo carries a `package.json`) and **dry-ru
 
 ## Consequences
 
-- **`deploy-instance.sh` already existed** at `scripts/deploy/deploy-instance.sh` (added by [ADR 0108](<redacted>.md) §4 / task 1884 — the task-2055 description predated it). It is the *ongoing* consumer deploy (git pull → `npm ci` → three-root migrate → restart), installed as an instance's own `~/deploy.sh`; the provisioner does the *first-time* standup inline. No duplicate at `infra/` was created.
+- **`deploy-instance.sh` already existed** at `scripts/deploy/deploy-instance.sh` (added by [ADR 0108](0108-instance-composition-configurable-root.md) §4 / task 1884 — the task-2055 description predated it). It is the *ongoing* consumer deploy (git pull → `npm ci` → three-root migrate → restart), installed as an instance's own `~/deploy.sh`; the provisioner does the *first-time* standup inline. No duplicate at `infra/` was created.
 - A fresh empty GitHub repo now goes from "requested" to "installable + bootable" with **no manual clone/scaffold** — closing the init→provision dead-end.
 - The control plane gains a new responsibility (pushing to owner repos). Bounded by the per-repo deploy-key grant above.
 

package/docs/adr/0126-dedicated-cloudbongos-control-plane-droplet.md

@@ -4,9 +4,9 @@
 
 ## Context
 
-cloudbongos.com (Customer 0, the vanilla dogfood instance — [ADR 0062](<redacted>.md) §2, [`docs/recipes/cloudbongos-standup.md`](../recipes/cloudbongos-standup.md)) ran as a **co-tenant on the OTB game droplet** (`REDACTED_IP`): same checkout, port 3002, its own `cloudbongos` DB. The token-holding **control plane** lived on that same box — `/etc/example/box.env` holds the account's DigitalOcean token **and** the Cloudflare token, drained by `scripts/gds/provision.js` (the instance provisioner, [ADR 0111](<redacted>.md)) and `scripts/gds/box.js` (dev boxes).
+cloudbongos.com (Customer 0, the vanilla dogfood instance — [ADR 0062](0062-medusa-instance-model-decoupling.md) §2, [`docs/recipes/cloudbongos-standup.md`](../recipes/cloudbongos-standup.md)) ran as a **co-tenant on the OTB game droplet** (`REDACTED_IP`): same checkout, port 3002, its own `cloudbongos` DB. The token-holding **control plane** lived on that same box — `/etc/example/box.env` holds the account's DigitalOcean token **and** the Cloudflare token, drained by `scripts/gds/provision.js` (the instance provisioner, [ADR 0111](0111-instance-hosting-provisioning-module.md)) and `scripts/gds/box.js` (dev boxes).
 
-That co-location is the weak point in the trust posture: the powerful, account-wide cloud tokens sat on the **same machine** as the game and any co-hosted third-party instance (`emersonian-circles.`, `staging.`). A compromise of any co-hosted workload could reach <redacted> and droplet creation. The existing plan ([ADR 0100](<redacted>.md)/[0108](<redacted>.md), spine R84→R89) only separated cloudbongos.com as a *side effect* of the deferred "Example split" (R89, [#1728](https://example.com/builders#/task/1728)), keeping it co-tenant "for cost" until then.
+That co-location is the weak point in the trust posture: the powerful, account-wide cloud tokens sat on the **same machine** as the game and any co-hosted third-party instance (`emersonian-circles.`, `staging.`). A compromise of any co-hosted workload could reach <redacted> and droplet creation. The existing plan ([ADR 0100](0100-two-repo-instance-model.md)/[0108](0108-instance-composition-configurable-root.md), spine R84→R89) only separated cloudbongos.com as a *side effect* of the deferred "Example split" (R89, [#1728](https://example.com/builders#/task/1728)), keeping it co-tenant "for cost" until then.
 
 The owner elected to pull the **infrastructure** separation forward, explicitly accepting a second droplet's cost, for the security division.
 
@@ -17,7 +17,7 @@ Run cloudbongos.com on its **own dedicated droplet** that is also the **sole tok
 - **New droplet** `cloudbongos` — DigitalOcean `REDACTED_IP`, nyc3, `s-1vcpu-2gb` ($12/mo), Ubuntu 24.04, tagged `cloudbongos-control` (deliberately **not** `PROVISION_TAG`, so the provisioning reconciler never treats the control plane as a disposable instance).
 - **Structural SSH separation** — reached only via a dedicated `cloudbongos_ed25519` key, distinct from the example box's key.
 - **Own stack** — Node 22 / PostgreSQL 16 / Caddy, IPv6 egress disabled (so the IPv4-locked Cloudflare token can never be spuriously rejected — `checkDnsTokenScope` uses plain `fetch` with no `-4`, unlike `infra/box-dns-cloudflare.sh`).
-- **Holds the tokens** — `/etc/cloudbongos/box.env` (mode 600) carries a **new account-wide Cloudflare token** (Edit-zone-DNS, all zones, IP-locked to `REDACTED_IP`) + the DigitalOcean token. This is the box that provisions instance subdomains for the hosting/provisioning module ([ADR 0111](<redacted>.md) §2 — tokens on the control plane, never the web tier; mirrors [ADR 0031](<redacted>.md) §6).
+- **Holds the tokens** — `/etc/cloudbongos/box.env` (mode 600) carries a **new account-wide Cloudflare token** (Edit-zone-DNS, all zones, IP-locked to `REDACTED_IP`) + the DigitalOcean token. This is the box that provisions instance subdomains for the hosting/provisioning module ([ADR 0111](0111-instance-hosting-provisioning-module.md) §2 — tokens on the control plane, never the web tier; mirrors [ADR 0031](0031-cloud-dev-environments-for-builders.md) §6).
 - **The co-hosting box** (the former OTB droplet, `REDACTED_IP`) stays as-is for the game + co-hosted project instances; the cloudbongos co-tenant unit was removed.
 
 The checkout is still a clone of `example-owner/example` running `src/platform-server.js` with `GDS_BRANDING_FILE=config/branding.cloudbongos.json` (a **lift-and-shift**, not the ADR 0108 pinned-`@cloudbongos/core` standalone model — that remains the longer-term shape).

package/docs/adr/0127-cross-box-fleet-observability.md

@@ -11,7 +11,7 @@ platform API**, not any single game — so the dashboards are *platform* observa
 and belong on the **cloudbongos** domain, watching **every** instance, not a
 project-specific one.
 
-Then [ADR 0126](<redacted>.md) moved
+Then [ADR 0126](0126-dedicated-cloudbongos-control-plane-droplet.md) moved
 cloudbongos.com onto a dedicated **control-plane droplet** (REDACTED_IP) that
 holds the account-wide Cloudflare token and serves `*.cloudbongos.com`. That split
 the fleet across two droplets:

package/docs/adr/0128-provisioning-runner-privilege-and-db-auth-model.md

@@ -4,7 +4,7 @@
 
 ## Context
 
-[ADR 0111](<redacted>.md) built `scripts/gds/provision.js` — the control-plane runner that drains `provisioning_intents` and composes the [cloudbongos-standup](../recipes/cloudbongos-standup.md) runbook (createdb → GDS-only migrate → per-instance `/etc/<slug>/web.env` → systemd unit → per-instance Caddy snippet → `/healthz`). It was written injectable + dry-run-default and unit-tested, **but never run end-to-end** — every existing co-located instance (`emersonian-circles`, the vanity doors) was hand-wired by an operator. The 2026-07-05 first real greenfield standup attempt ([#2053](https://example.com/builders#/task/2053)–[#2056](https://example.com/builders#/task/2056)) surfaced three ops gaps. Two were resolved on-box (Cloudflare token scope → [ADR 0126](<redacted>.md); the Caddy on-demand-TLS global that the live `/etc/caddy/Caddyfile` lacked). This ADR is the third, load-bearing one.
+[ADR 0111](0111-instance-hosting-provisioning-module.md) built `scripts/gds/provision.js` — the control-plane runner that drains `provisioning_intents` and composes the [cloudbongos-standup](../recipes/cloudbongos-standup.md) runbook (createdb → GDS-only migrate → per-instance `/etc/<slug>/web.env` → systemd unit → per-instance Caddy snippet → `/healthz`). It was written injectable + dry-run-default and unit-tested, **but never run end-to-end** — every existing co-located instance (`emersonian-circles`, the vanity doors) was hand-wired by an operator. The 2026-07-05 first real greenfield standup attempt ([#2053](https://example.com/builders#/task/2053)–[#2056](https://example.com/builders#/task/2056)) surfaced three ops gaps. Two were resolved on-box (Cloudflare token scope → [ADR 0126](0126-dedicated-cloudbongos-control-plane-droplet.md); the Caddy on-demand-TLS global that the live `/etc/caddy/Caddyfile` lacked). This ADR is the third, load-bearing one.
 
 `provision-intent-runner.service` runs as **`User=lars`** (a non-root user). But every mutating step assumed a privilege the runner does not have when driven headlessly:
 
@@ -14,7 +14,7 @@
 
 Two things additionally made a naive "just add `sudo`" fix silently fail: the unit set **`NoNewPrivileges=true`** (which sets `PR_SET_NO_NEW_PRIVS` and *blocks the setuid `sudo` binary from escalating at all*), and `sudo` resets the environment (so a bare `sudo -u postgres PGDATABASE=x ./migrate.sh` would have `sudo` parse `PGDATABASE=x` as a command).
 
-The whole point is that this runner must NOT bake operator identity into behavior ([ADR 0016](<redacted>.md)), tests must stay hermetic (no shell/DB/network), and the same code drives co-tenant, standalone, and (via cloud-init) dedicated shapes.
+The whole point is that this runner must NOT bake operator identity into behavior ([ADR 0016](0016-trust-boundary-server-enforced-permissions.md)), tests must stay hermetic (no shell/DB/network), and the same code drives co-tenant, standalone, and (via cloud-init) dedicated shapes.
 
 ## Decision
 
@@ -39,7 +39,7 @@ Add a single config knob, **`PROVISION_SUDO=1`** (alias `PROVISION_PRIVILEGED=1`
 - **The dedicated-droplet cloud-init path is deliberately unchanged** (`dedicatedUserData`). It runs as root on a fresh droplet — a different privilege + file-perms model — and is out of the co-tenant/standalone scope this task exercised; escalating it is a separate change.
 - **Follow-ups noted from the standup:** the live `/etc/caddy/Caddyfile` drifts from `infra/Caddyfile` with no auto-sync (a deploy-time reconcile is worth considering); the migrate-as-postgres readable-checkout precondition should be asserted by the box provisioning, not just documented.
 
-> **Followed up 2026-09-12 by [ADR 0281](<redacted>.md)** (task [1003369](https://cloudbongos.com/builders#/task/1003369)), which takes the last alternative below from the other end: the *instance* now holds per-instance DB credentials (its own password-authed role) rather than the runner holding app creds. **This ADR is unchanged** — the runner still escalates via `sudo -u postgres` for `createdb`/`migrate`, and `PROVISION_SUDO` still means exactly what it means here.
+> **Followed up 2026-09-12 by [ADR 0281](0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md)** (task [1003369](https://cloudbongos.com/builders#/task/1003369)), which takes the last alternative below from the other end: the *instance* now holds per-instance DB credentials (its own password-authed role) rather than the runner holding app creds. **This ADR is unchanged** — the runner still escalates via `sudo -u postgres` for `createdb`/`migrate`, and `PROVISION_SUDO` still means exactly what it means here.
 
 ## Alternatives considered
 

package/docs/adr/0129-cloudbongos-control-plane-pull-deploy.md

@@ -1,10 +1,10 @@
 # ADR 0129 — cloudbongos.com control-plane box deploys by a pull timer, not the CI push
 
-**Status:** Accepted — implemented 2026-07-05 (task [#2064](https://example.com/builders#/task/2064)). Follows [ADR 0126](<redacted>.md).
+**Status:** Accepted — implemented 2026-07-05 (task [#2064](https://example.com/builders#/task/2064)). Follows [ADR 0126](0126-dedicated-cloudbongos-control-plane-droplet.md).
 
 ## Context
 
-The 2026-07-05 dedicated-droplet migration ([ADR 0126](<redacted>.md), task [#2063](https://example.com/builders#/task/2063)) moved cloudbongos.com onto its own box (`REDACTED_IP`, checkout `/home/lars/cloudbongos`, `cloudbongos.service`, port 3002). The co-hosting box (`REDACTED_IP`) still auto-deploys **example.com** via [`.github/workflows/deploy-prod.yml`](../../.github/workflows/deploy-prod.yml) (SSH → `~/deploy.sh` on merge to `main`, [ADR 0042](<redacted>.md)). That path only touches the co-hosting box. **Nothing pulled `main` onto the new box**, so cloudbongos.com served its boot-time code and drifted — ADR 0126 §Consequences flagged this as task 2064.
+The 2026-07-05 dedicated-droplet migration ([ADR 0126](0126-dedicated-cloudbongos-control-plane-droplet.md), task [#2063](https://example.com/builders#/task/2063)) moved cloudbongos.com onto its own box (`REDACTED_IP`, checkout `/home/lars/cloudbongos`, `cloudbongos.service`, port 3002). The co-hosting box (`REDACTED_IP`) still auto-deploys **example.com** via [`.github/workflows/deploy-prod.yml`](../../.github/workflows/deploy-prod.yml) (SSH → `~/deploy.sh` on merge to `main`, [ADR 0042](0042-builder-self-deploy-ci-auto-merge.md)). That path only touches the co-hosting box. **Nothing pulled `main` onto the new box**, so cloudbongos.com served its boot-time code and drifted — ADR 0126 §Consequences flagged this as task 2064.
 
 The task allowed either extending the CI push workflow to also target the new box, **or** a pull-based timer on the box.
 
@@ -18,7 +18,7 @@ Deploy the control-plane box with a **pull-based systemd timer**, not by extendi
 ### Why pull, not CI push
 
 1. **Blast radius.** The dedicated box exists to shrink the cloud-token / prod-SSH-key exposure (ADR 0126). Extending CI would require storing **this box's** prod SSH key as a GitHub Actions secret — more secret sprawl, against the migration's whole grain. A pull uses the box's **existing** GitHub deploy key (`git@github-deploy:…`), so no new secret leaves the box and the shared `deploy-prod.yml` is untouched.
-2. **Convention.** It matches the self-healing `*-runner.timer` units already in `infra/` (e.g. `provision-intent-runner.timer`), and the deploy self-installs its own unit changes on the next run (the [ADR 0110](<redacted>.md) self-heal pattern) — no manual re-install.
+2. **Convention.** It matches the self-healing `*-runner.timer` units already in `infra/` (e.g. `provision-intent-runner.timer`), and the deploy self-installs its own unit changes on the next run (the [ADR 0110](0110-untrack-whole-file-generated-nav-docs.md) self-heal pattern) — no manual re-install.
 3. **Cost of staleness is low.** Worst case is one tick (~2 min) behind `main` for a Customer-0 dogfood instance. The idle-tick cost is a single `git fetch` + SHA compare (the no-op fast path).
 
 ### Two deliberate divergences from `deploy-prod.sh`
@@ -30,5 +30,5 @@ Deploy the control-plane box with a **pull-based systemd timer**, not by extendi
 
 - cloudbongos.com now tracks `main` within ~2 min of a merge, with no new GitHub secret and no change to the shared prod deploy.
 - **One-time bootstrap is unavoidable** (the box can't install its own first deploy automation): an operator installs `/home/lars/deploy.sh` + the two units over SSH once — see [`docs/recipes/cloudbongos-standup.md`](../recipes/cloudbongos-standup.md) §"Deploy automation". After that it self-heals.
-- When cloudbongos.com moves to the pinned-`@cloudbongos/core` standalone model ([ADR 0108](<redacted>.md)), this script is the seam that converts `git reset --hard` → `git pull` + `npm ci` (the [`deploy-instance.sh`](../../scripts/deploy/deploy-instance.sh) shape) — a one-file change, not a new pipeline.
+- When cloudbongos.com moves to the pinned-`@cloudbongos/core` standalone model ([ADR 0108](0108-instance-composition-configurable-root.md)), this script is the seam that converts `git reset --hard` → `git pull` + `npm ci` (the [`deploy-instance.sh`](../../scripts/deploy/deploy-instance.sh) shape) — a one-file change, not a new pipeline.
 - Does not affect task [#2065](https://example.com/builders#/task/2065) (stripping cloud tokens off the co-hosting box); that is orthogonal.

package/docs/adr/0130-provision-remote-exec-over-ssh.md

@@ -1,12 +1,12 @@
 # ADR 0130 — provision.js remote-exec over SSH: the control plane orchestrates co-tenant workloads on the co-hosting box
 
-**Status:** Accepted — code implemented 2026-07-05 (task [#2065](https://example.com/builders#/task/2065)); **activation (SSH trust + token rotation) is a sequenced owner-op**, see §Activation. Follows [ADR 0126](<redacted>.md).
+**Status:** Accepted — code implemented 2026-07-05 (task [#2065](https://example.com/builders#/task/2065)); **activation (SSH trust + token rotation) is a sequenced owner-op**, see §Activation. Follows [ADR 0126](0126-dedicated-cloudbongos-control-plane-droplet.md).
 
-> **Superseded in part by [ADR 0132](<redacted>.md)** (task 2071). The remote-exec *mechanism* here stands, but activation found the co-hosting box runs **five** token-consuming runners (not one), each reading its queue from a **localhost-only** Postgres. So the migration also needs an SSH DB tunnel + control-plane variants of all five runners, and the runner unit named below (`provision-intent-runner-cloudbongos.*`) is replaced by `cohost-provision-intent-runner.*`. **Follow ADR 0132's §Activation, not the §Config + runner move step here.**
+> **Superseded in part by [ADR 0132](0132-cohost-fleet-control-plane-migration.md)** (task 2071). The remote-exec *mechanism* here stands, but activation found the co-hosting box runs **five** token-consuming runners (not one), each reading its queue from a **localhost-only** Postgres. So the migration also needs an SSH DB tunnel + control-plane variants of all five runners, and the runner unit named below (`provision-intent-runner-cloudbongos.*`) is replaced by `cohost-provision-intent-runner.*`. **Follow ADR 0132's §Activation, not the §Config + runner move step here.**
 
 ## Context
 
-[ADR 0126](<redacted>.md) moved cloudbongos.com onto its own dedicated droplet that is also the **sole token-holding control plane** (`/etc/cloudbongos/box.env` holds the account-wide DigitalOcean + Cloudflare tokens). But it left the **co-hosting box** (`REDACTED_IP`) still holding its own DO token + a narrow Cloudflare token, used by two control-plane duties that still run *there*:
+[ADR 0126](0126-dedicated-cloudbongos-control-plane-droplet.md) moved cloudbongos.com onto its own dedicated droplet that is also the **sole token-holding control plane** (`/etc/cloudbongos/box.env` holds the account-wide DigitalOcean + Cloudflare tokens). But it left the **co-hosting box** (`REDACTED_IP`) still holding its own DO token + a narrow Cloudflare token, used by two control-plane duties that still run *there*:
 
 - `box.js` — dev-box lifecycle (create/destroy droplets, DNS).
 - `provision.js` + `provision-intent-runner` — instance provisioning for co-tenant instances (`emersonian-circles.`, `staging.`) that **run on the co-hosting box**.
@@ -26,7 +26,7 @@ Add a **remote-exec-over-SSH path** to `provision.js` (`scripts/gds/provision.js
   - the **Cloudflare DNS hook** (`BOX_DNS_HOOK`) — the whole point is that the co-hosting box has no token;
   - the **standalone repo scaffold** (`git clone` / `package-core` / `bongos init` / `git push`).
 
-`sudo` (from `PROVISION_SUDO`, [ADR 0128](<redacted>.md)) composes cleanly: for a remote step the `sudo` runs on the co-hosting box (as its passwordless-sudo user). Co-tenant A records point at `PROVISION_PUBLIC_IP` = the **co-hosting box's** IP (where the co-tenant actually runs), which is the "point `PROVISION_PUBLIC_IP` appropriately" clause of the task.
+`sudo` (from `PROVISION_SUDO`, [ADR 0128](0128-provisioning-runner-privilege-and-db-auth-model.md)) composes cleanly: for a remote step the `sudo` runs on the co-hosting box (as its passwordless-sudo user). Co-tenant A records point at `PROVISION_PUBLIC_IP` = the **co-hosting box's** IP (where the co-tenant actually runs), which is the "point `PROVISION_PUBLIC_IP` appropriately" clause of the task.
 
 ### `box.js` needs no code change
 

package/docs/adr/0131-rank-scoped-skill-visibility.md

@@ -9,7 +9,7 @@
 
 Task 1650 asks that a builder's Claude session list **only** the skills their live rank can use. Today every session lists every skill, so a lower-rank builder can invoke a gated skill (e.g. `/planning-session`, `/blocker-review`) and only gets stopped partway through — a confusing dead-end.
 
-**This is UX decluttering, not a permission boundary.** Authority is already enforced two ways that stay exactly as-is: the server's `requireRank` (→ 403, [ADR 0016](<redacted>.md)) and each gated skill's own early rank self-check. Hiding a skill from the menu removes a dead-end; it grants and removes nothing. The task's assumed mechanism was **a `SessionStart` hook that filters the skill list by the rank we fetch at session start** (we already run such a hook, `.claude/hooks/session-start.js`).
+**This is UX decluttering, not a permission boundary.** Authority is already enforced two ways that stay exactly as-is: the server's `requireRank` (→ 403, [ADR 0016](0016-trust-boundary-server-enforced-permissions.md)) and each gated skill's own early rank self-check. Hiding a skill from the menu removes a dead-end; it grants and removes nothing. The task's assumed mechanism was **a `SessionStart` hook that filters the skill list by the rank we fetch at session start** (we already run such a hook, `.claude/hooks/session-start.js`).
 
 ## Finding (the spike result)
 
@@ -44,4 +44,4 @@ Either way, the **server rank gate and the per-skill self-checks stay** — cons
 
 - Claude Code docs: *Extend Claude with skills* (skill listing, `skillOverrides`, `Skill(...)` permissions), *Hooks* (`SessionStart` `additionalContext`/`reloadSkills`; no runtime settings mutation), *Configure permissions* (`Skill(name)` deny rules).
 - Local: `.claude/hooks/session-start.js` (where rank is fetched today), `.claude/settings.json` (hooks/permissions wiring).
-- [ADR 0016](<redacted>.md) — server-enforced permissions (the real gate this UX never replaces).
+- [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) — server-enforced permissions (the real gate this UX never replaces).

package/docs/adr/0132-cohost-fleet-control-plane-migration.md

@@ -1,10 +1,10 @@
 # ADR 0132 — Migrating the co-hosting fleet to the control plane over an SSH DB tunnel
 
-**Status:** Accepted — repo half implemented 2026-07-05 (task [#2071](https://example.com/builders#/task/2071)); **units ship additive + not-enabled — activation is a sequenced operator-op** (see §Activation). Extends [ADR 0130](<redacted>.md); completes the "zero cloud tokens on the co-hosting box" goal of [ADR 0126](<redacted>.md) (task 2065 / blocker 64).
+**Status:** Accepted — repo half implemented 2026-07-05 (task [#2071](https://example.com/builders#/task/2071)); **units ship additive + not-enabled — activation is a sequenced operator-op** (see §Activation). Extends [ADR 0130](0130-provision-remote-exec-over-ssh.md); completes the "zero cloud tokens on the co-hosting box" goal of [ADR 0126](0126-dedicated-cloudbongos-control-plane-droplet.md) (task 2065 / blocker 64).
 
 ## Context
 
-[ADR 0130](<redacted>.md) shipped the *code* to run `provision.js` from the control plane and remote-exec box steps over SSH. But when we went to actually strip the tokens (blocker 64), the endgame proved **not a switch-flip**. Three findings:
+[ADR 0130](0130-provision-remote-exec-over-ssh.md) shipped the *code* to run `provision.js` from the control plane and remote-exec box steps over SSH. But when we went to actually strip the tokens (blocker 64), the endgame proved **not a switch-flip**. Three findings:
 
 1. **The co-hosting box (`REDACTED_IP`) runs FIVE token-consuming timers, not one.** ADR 0130 addressed only `provision-intent-runner`. The other four are the whole `box.js` **dev-box lifecycle**: `box-intent-runner` (provision/wake, 1-min), `box-idle-suspend` (15-min), `box-drift-reconcile` (hourly), `box-dormant-reclaim` (daily). Each needs the DO token; none were migrated.
 2. **Every runner reads its work-queue from the *local* `example` Postgres, which is firewalled to localhost** (`pg_hba`: `host … 127.0.0.1/32 scram-sha-256`; `:5432` is closed to the network — the correct posture). A runner moved to the control plane cannot reach the `box_intents` / `provisioning_intents` queues remotely. This is the real obstacle ADR 0130 did not solve: it moved *box-step execution*, not *queue reading*.

package/docs/adr/0133-github-app-manifest-onboarding-signin.md

@@ -13,7 +13,7 @@ The last human friction in greenfield onboarding was wiring GitHub sign-in. The
 
 Use GitHub's **App Manifest flow** — the only real automation path GitHub offers. Instead of a hand-built OAuth App, the owner registers a GitHub **App** from a **pre-filled manifest**: one click, approve on GitHub, and GitHub hands *us* the credentials. Sign-in works unchanged because a GitHub App's user-to-server token hits the same `GET /user` the OAuth-app flow used; GitHub simply ignores the extra `scope` param for Apps, and we only use the token once at sign-in to identify the user before minting our own `builder_session` (so the App token's expiry is irrelevant).
 
-**The flow spans the trust boundary ([ADR 0111](<redacted>.md) §2 / [ADR 0016](<redacted>.md)) — deliberately:**
+**The flow spans the trust boundary ([ADR 0111](0111-instance-hosting-provisioning-module.md) §2 / [ADR 0016](0016-trust-boundary-server-enforced-permissions.md)) — deliberately:**
 
 1. **Web tier** (the mothership hall, where the signed-in owner requested the instance) — `POST /api/bongos/provisioning/instances/:id/github-app` (own-scoped) mints a one-time `state` token, stores a `provisioning_oauth_manifests` row (status `pending`, TTL 30 min), and returns the pre-filled manifest + the GitHub form-POST target. The browser POSTs the manifest to GitHub.
 2. **GitHub** creates the App and redirects the owner's browser to the **mothership** callback `GET /api/bongos/provisioning/github-app/callback?code=&state=` (public — a browser redirect with no session; the unguessable single-use `state` is the authorization, exactly as GitHub's own conversion `code` is "the code IS the auth"). The callback stores the `code`, flips the row to `code_received`, and shows a "finishing setup" page.

package/docs/adr/0134-private-first-npm-distribution.md

@@ -4,7 +4,7 @@
 - **Date:** 2026-07-07
 - **Deciders:** example-owner (owner/Archon), Claude. Owner asked to have the npm/CLI onboarding commands ready but kept private pre-launch, choosing paid private npm over the free GitHub Packages option.
 - **Task:** [#2089](https://example.com/builders#/task/2089) (publish path + private config) · [#2092](https://example.com/builders#/task/2092) (the `@cloudbongos` → `@bongos` scope rename + first real publish) · **Goal:** 35 (project-creation flow), criterion 165.
-- **Refines:** [#2025](https://example.com/builders#/task/2025) (the 2026-07-04 *public* unscoped `cloudbongos` decision — now the launch-time go-public step, not superseded) · **Builds on:** [ADR 0108](<redacted>.md) (core-as-npm-dep), [#2053](https://example.com/builders#/task/2053) (vendored-tarball install).
+- **Refines:** [#2025](https://example.com/builders#/task/2025) (the 2026-07-04 *public* unscoped `cloudbongos` decision — now the launch-time go-public step, not superseded) · **Builds on:** [ADR 0108](0108-instance-composition-configurable-root.md) (core-as-npm-dep), [#2053](https://example.com/builders#/task/2053) (vendored-tarball install).
 
 ## Context
 
@@ -27,12 +27,12 @@ Publish **`@bongos/core`** and **`@bongos/client`** as **scoped, private** npm p
 > mercury, charter, demo) found no dependency on it; the only matches were its own manifest. Everyone
 > who needs the generated client **vendors a copy** — `modules/dev-box/app/src/vendor/bongos-client.cjs`,
 > and `build-cli-package.js` into `@cloudbongos/cli`, which as a *public* package could not have
-> depended on a private one anyway ([ADR 0258](<redacted>.md)).
+> depended on a private one anyway ([ADR 0258](0258-the-public-cli-is-a-generated-client-package-not-the-published-core.md)).
 > A stale generated client that nobody installs is worse than none: the only thing it could do is
 > mislead someone into pinning a client 500 versions behind the routes.
 >
 > The owner removed it from the registry. The **generated artifact stays** and still regenerates
-> ([ADR 0118](<redacted>.md)) — `clients/bongos-client/` and
+> ([ADR 0118](0118-api-contract-source-of-truth-code-first.md)) — `clients/bongos-client/` and
 > `gen-api-client.js` earn their place. What is retired is only the claim that it is a package: the
 > generator no longer emits a `publishConfig`, and its README now documents vendoring instead of
 > `npm install`. **This ADR's core half is unaffected.**