@bongos/core 1.19.788 → 1.19.790

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.788",
-  "core_contract": "1.19.788",
-  "source_commit": "92849625024c376906ce07c3c0c0ca7a3d680548",
+  "core_version": "1.19.790",
+  "core_contract": "1.19.790",
+  "source_commit": "65b7661a78960a298c7598f0937a5c76abc55063",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T22:46:46.860Z",
+  "built_at": "2026-09-16T23:41:22.245Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 484,
+    "docs_redacted": 485,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2160,
+    "functional_verbatim": 2173,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2669,
-  "tree_sha256": "de7ca524df98188a2d7081d557c66df028de4810b9e2fccd1e052d3db4cc787a",
+  "file_count": 2683,
+  "tree_sha256": "8ca493db048f77e39d94464f095bd5e926050f7ae855ec90c7902c5283faa81f",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "3960e4e1720e6f6613d2fe4fb1527b42b84a61b06b0daf480598e04362a86c2a"
+      "sha256": "ed619e165f5ab41b2003d5721bee90b77d0bb80614358e7f0c9aaecd54d52120"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "9ee5a9c9f0fb8faac162bce68a06800ba74d2ccf1dd8ede4452b754b99d376db"
+      "sha256": "7b572e442e8f142fa23e0b45e32b04d18638b7cee2121c17b8e28c8b48435384"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "898a51f9a3f1f28f94fb978ae0954f8a85771fb158708bddbc4d6d766f854b34"
+      "sha256": "0921f40ea40f6e562c1d4ddbb549748372d7b6ec661c1f902bd65f6be1b387ec"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "b82c307a8a951980762cd4baa86088b37cfa1852c3265c1f4a709de8c8479b7e"
+      "sha256": "cace11e622ee6d515f96800e288cbd854efbea2269b1b211bf89f56d53b13325"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "47f940af83ee05d23d80b02f908ca76c3c8aefe5d5653f19b773017530b47245"
+      "sha256": "b6645d78fe6a9cfb047809753383ff49a74217f378d47d264416d825167b9370"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1949,20 +1949,25 @@
       "mode": "0000644",
       "sha256": "6a5afb0821a42af204fe97ec68040ea7781344651e599bce135bf8f15d8c86dc"
     },
+    {
+      "path": "docs/adr/0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md",
+      "mode": "0000644",
+      "sha256": "fb72a972f472cfea4c214dc73c7c5e811670d4eb2bbbc8d397495c8756daa625"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "7eb54577c118f262fa9bd5bd8b00aa194d88cff85646f57b78bd616813472723"
+      "sha256": "4b61b76ac117cd1f3086db73d9badb4046285ecf7cd1d1dd6e5c4d389d3c68af"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "4faa312df356d31b6e4bcc5d048d24a63ec380dff9605d42855e1a1033cc33fb"
+      "sha256": "9ede5654985d0d667740c2c55090f9a5e7fbfc44c1c0c30743eb6ad3112c5e35"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "d2c3c4cf4d078d2f5cd9a5a7948ce10379a30c87c972f4c43d6c0e2e1a49afe9"
+      "sha256": "00f6e4757e5337e7f7cf3ae1d0afeccfcabe9ef1896304004b855931f8b9c423"
     },
     {
       "path": "docs/architecture.md",
@@ -1987,12 +1992,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "d4ab1fa4354fa8ac218f1a29d46fb2a0e67a559d01aa118ce9e8182531193579"
+      "sha256": "795dee2bad79df8e5937f3d4288832e01480afc23c505dbe5b8a41d1d02f876b"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "30f052c83992946d4c264ad30fb157c629b50fa5cc37cb985c5a8346e2fa153b"
+      "sha256": "619669f9cc00836df3872c00b0279047d6a5f65da20c76eb765835c1ae201840"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2517,7 +2522,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "67cecf319da71f951791242844391a055cbf58a76b1490b8fd0818258e0937ae"
+      "sha256": "4b4fca2cca1876f6e56253a16eaf7709406a386e5dd240edbadc7497f7866e71"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2637,7 +2642,7 @@
     {
       "path": "docs/recipes/core-release-pipeline.md",
       "mode": "0000644",
-      "sha256": "0c9c375cf33259b8824e24113997a098e497f15c998ce8ec516e64e59d65c120"
+      "sha256": "169425fb8bbdd3e54ab3eefb8ac772c3789dfe19f3f16e39b4e83bba5e831e76"
     },
     {
       "path": "docs/recipes/devbox-app-release.md",
@@ -2777,7 +2782,7 @@
     {
       "path": "docs/recipes/upgrading-the-core.md",
       "mode": "0000644",
-      "sha256": "408b4792ffb869f2fa13201485c1ab5b8306b93996bb75f01b4117de3fd39303"
+      "sha256": "041955ed109343181ea563e47e905c59e3bbd052e4dc3988b5ea34fbe5029f16"
     },
     {
       "path": "docs/recipes/windows-builders.md",
@@ -3589,6 +3594,16 @@
       "mode": "0000644",
       "sha256": "e8faead6772089c8e47f3f81433c65038bfbb60bb509dff6c2a7b5572124316d"
     },
+    {
+      "path": "migrations/core_241_core_upgrades_actor.sql",
+      "mode": "0000644",
+      "sha256": "7cc5e9681fd62486d445a80f8ac4f0a8cc7fbe4a8ffacba7d7ffcfd262e8440c"
+    },
+    {
+      "path": "migrations/core_242_core_version_snapshot.sql",
+      "mode": "0000644",
+      "sha256": "e52821124b99bd844c8323f2de0221db3fafd92c0c6e2227838cadf7d987676a"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -4027,7 +4042,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "898a51f9a3f1f28f94fb978ae0954f8a85771fb158708bddbc4d6d766f854b34"
+      "sha256": "0921f40ea40f6e562c1d4ddbb549748372d7b6ec661c1f902bd65f6be1b387ec"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4277,7 +4292,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "e4729cd6482c08f28bbb0f2de2a1b84c7df38747590af9a287d6c58f2d1cc672"
+      "sha256": "25f086b8b845c35a3d9fbefbf1dcc30f0c4856b08bafc4f2c0c4952e6f57a7ab"
     },
     {
       "path": "modules/government/config.js",
@@ -4394,6 +4409,11 @@
       "mode": "0000644",
       "sha256": "f1e5ae5cef3f2e9d4196ea6c3f1c436bb4411d5492ca6c42c9b876f8575f754e"
     },
+    {
+      "path": "modules/government/migrations/government_014_core_pin_move.sql",
+      "mode": "0000644",
+      "sha256": "0ddff91ec6d4c1f4344c6fdc2bd2f158e34a9b14662a100cf73796924b7c98de"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -4709,6 +4729,16 @@
       "mode": "0000644",
       "sha256": "85748768107d0d0ff93e2e4a2d4ec388f4a0b433d54d6603d2d5b2d192a0b062"
     },
+    {
+      "path": "modules/hall-ui/public/deploy.html",
+      "mode": "0000644",
+      "sha256": "23e54a15a796a7f7176cea0fcfcc72f92e5a008c851de25e443b74a2af8951ed"
+    },
+    {
+      "path": "modules/hall-ui/public/deploy.js",
+      "mode": "0000644",
+      "sha256": "a44f3c64894c8f51b50e28ad42c9e8e52d60eb1a1d6098cdaf514f16492ba0b2"
+    },
     {
       "path": "modules/hall-ui/public/diagram-viewer.css",
       "mode": "0000644",
@@ -5202,7 +5232,7 @@
     {
       "path": "modules/hall-ui/public/shell.js",
       "mode": "0000644",
-      "sha256": "96fe28b7a05898c43830cf9f088f64869c3161ce659e84e4776c50313b563bf7"
+      "sha256": "24cca58dbbaa29ad5eb9ae6673c1b70b843ff1e96afe323ac559d016345f9abc"
     },
     {
       "path": "modules/hall-ui/public/ship.wav",
@@ -6209,6 +6239,16 @@
       "mode": "0000644",
       "sha256": "6978ddde30cb0b378a2decbe18c2824817d8d57a941a8de6230483453e99acd7"
     },
+    {
+      "path": "modules/provisioning/control-plane-guard.js",
+      "mode": "0000644",
+      "sha256": "b70ad687c7699a3023e8be973b67ceeb7ff67afb38ff47665c7089614901c200"
+    },
+    {
+      "path": "modules/provisioning/core-upgrade.js",
+      "mode": "0000644",
+      "sha256": "dbe57cec7dd94613e9f2d23f396838ba77411c8fe3f9dca858cfd2af956ae43f"
+    },
     {
       "path": "modules/provisioning/credential-preflight.js",
       "mode": "0000644",
@@ -6304,10 +6344,15 @@
       "mode": "0000644",
       "sha256": "69fa8f9cdc3c9ec272c318226558254267ae63ef2ffa68ab93a89a3ab5d782a2"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_018_core_upgrade_intent.sql",
+      "mode": "0000644",
+      "sha256": "0fec45fe6188b76d625127ed60dabeda90dc02389709b3d2274c4477b33bb33d"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
-      "sha256": "fb9255453b2878c7453e2d02aa1e389966921cd58481f780414b6328d8f93ce1"
+      "sha256": "5ddd201b98f799f4f3cf6d889dea8d4e0196732e3bab67cf752e95e045724ede"
     },
     {
       "path": "modules/provisioning/onboard-plan.js",
@@ -6332,7 +6377,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "b469cf0d9c6fb1d31fb160ceffee7ceeeaa0923871dd9d9cc33d9d5aa3e726f8"
+      "sha256": "b70d138fb6ed6f0fe4f04d2a37a7a195364250ca10b46a933c5aad0057061c10"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -6354,6 +6399,11 @@
       "mode": "0000644",
       "sha256": "6b43ebf71a778277b94de1b9400f690fac9f51b48010e50a159af57195f99f02"
     },
+    {
+      "path": "modules/provisioning/routes/core-upgrade.js",
+      "mode": "0000644",
+      "sha256": "7447a5eb37dc120e14fa6b5fb81c574ec951b9a46ed126d5c954c63b03bc6b6d"
+    },
     {
       "path": "modules/provisioning/routes/disconnect.js",
       "mode": "0000644",
@@ -7627,12 +7677,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "49f7824295dab411ce5b50f1d5f37837439ee56ca2f66b90b16c93dd0d4dae58"
+      "sha256": "3d7def55a4d9907d5a5cedb1da52cfaf05e4541cd60fad5f0eb1263c1e26e422"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a9dd34b4fde96d0c2486b92cf898b95b6b6570784d1d3f7019cdd4e8acfe3776"
+      "sha256": "a4346e6a913ede8aa9d9bc9d0b91133c746e29ecaf1a1b541e95fdd447cc80d7"
     },
     {
       "path": "public-docs/index.html",
@@ -8074,6 +8124,11 @@
       "mode": "0000644",
       "sha256": "2fcc3f97558ed6a653638df96d585dc7a1ef7dd884657a63d3a9545dbdb03e92"
     },
+    {
+      "path": "scripts/gds/enroll-control-plane.js",
+      "mode": "0000644",
+      "sha256": "2710d4063c78a055c1af024ab4efce18992c8a7949833c87e2a516fcd873bd55"
+    },
     {
       "path": "scripts/gds/exec-path-guard.js",
       "mode": "0000644",
@@ -8489,6 +8544,11 @@
       "mode": "0000644",
       "sha256": "1f60ee3d585ad3ab8c84c6b0abac99573ed218183b8e8403f2ddf3e951ff6b3d"
     },
+    {
+      "path": "scripts/gds/provision-core-upgrade.js",
+      "mode": "0000644",
+      "sha256": "48f41b0d45f26f188585245ef918bd626f2242fdb641f3a11a0a27a83b34d3ca"
+    },
     {
       "path": "scripts/gds/provision-disconnect.js",
       "mode": "0000644",
@@ -8522,7 +8582,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "9744a8493b15537c1789f7270cf5d9679b5ecf40d685f5857e27b21f34ae8690"
+      "sha256": "b81947c37dccac487771865a699ab0a581b75b1991e0e76b07ce2a1877db414c"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9057,7 +9117,7 @@
     {
       "path": "scripts/gds/upgrade.js",
       "mode": "0000644",
-      "sha256": "3146778317a4dfd01673553e94966ea40d27add12a7ca6c52ec8581eded085ac"
+      "sha256": "eba999956e81e6637af527334825d2c1b5ad9b4af165320eb011e28718c5df99"
     },
     {
       "path": "scripts/gds/validate-design.js",
@@ -9227,7 +9287,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "f42e9845e7b2dd78821885a94e2a687c6424c0a13214174b32c982560134f51a"
+      "sha256": "1b6cfa9855919baea11de11636e7cfe9655c3e0eddee7eabf451de55e13bdfe5"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -9467,7 +9527,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "405b8069c27ea596981cd4a2fd6a57b7e3637022cf63962d46a19b452fa675fc"
+      "sha256": "851db86e07022a303e0bf93dc60080c0c0776b7b01114fef617cad729611fc8b"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -9497,7 +9557,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9ba56c6268099a478b0af08849ee7cecce87b2650bd1d82757614bd688651900"
+      "sha256": "bd42bd20fe31864a0c0a5fc9e692c07d3207b92bf9f49030a206f92e76ab4f92"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9822,7 +9882,7 @@
     {
       "path": "tests/auth_resolve_failure.mjs",
       "mode": "0000644",
-      "sha256": "2a0eed68ecf44c376ec7cddc84a7bf7b66191aa23226b300559daca7e2756c60"
+      "sha256": "acbce017f7111b67c556db645de7b88fb5f39829755fa6c9378f300c8fc62a15"
     },
     {
       "path": "tests/auth_session_ttl.mjs",
@@ -10279,6 +10339,16 @@
       "mode": "0000644",
       "sha256": "716aa03c5e93b71aec0c7e6fe646e5abd702b8b6ffda0ef6235a804d2c17a0ca"
     },
+    {
+      "path": "tests/core_upgrade_door.mjs",
+      "mode": "0000644",
+      "sha256": "9b6fb0b2279102a6b9224c1e598adb8cb3d8dd039a7d63116f56862852c64ec8"
+    },
+    {
+      "path": "tests/core_upgrade_runner.mjs",
+      "mode": "0000644",
+      "sha256": "c6d600c92654d54897d457162bf6aad3a8ba46d7d1fe4e94673900025a867fa6"
+    },
     {
       "path": "tests/cosmos_token_contrast.mjs",
       "mode": "0000644",
@@ -11192,7 +11262,7 @@
     {
       "path": "tests/hall_nav.mjs",
       "mode": "0000644",
-      "sha256": "63ded71e9a99244d47831a7389d45c84acd147f5cf4f1274f6ba3d41fa7af473"
+      "sha256": "e3aec810d2b893066d262e74e9779cefee981bad516df4eda7e619b61ba86b24"
     },
     {
       "path": "tests/hall_oversight_world.mjs",
@@ -11202,7 +11272,7 @@
     {
       "path": "tests/hall_page_gate_map.mjs",
       "mode": "0000644",
-      "sha256": "10d8376f94e415d20b112a61e8d1f7f8f0f539eba5f685bdac4509624a69c13e"
+      "sha256": "e8c7bdaaddc80195da94b41cc40695933e2da6f5a8b54c9f0f04899a20b48114"
     },
     {
       "path": "tests/hall_palette.mjs",
@@ -12242,7 +12312,7 @@
     {
       "path": "tests/provisioning_disconnect.mjs",
       "mode": "0000644",
-      "sha256": "63bbb9c60c21c23f4c5b83dd201f73ad56683a63d32e48e008cb9d16402b1f3f"
+      "sha256": "d33debfe7c72dda888c6039d1b78eae51c70e127ac44bba1f70b278fa465f7be"
     },
     {
       "path": "tests/provisioning_domain_attach.mjs",
@@ -12277,7 +12347,7 @@
     {
       "path": "tests/provisioning_paid_shape_gate.mjs",
       "mode": "0000644",
-      "sha256": "a2c8a1761cf44bd0434766cb9e42c34dbc61d7133218440f046d82da802d8217"
+      "sha256": "1cf30338eb8dafc77f2fea1e2b5ec417fe64a6576ececcca18936fe4e871c763"
     },
     {
       "path": "tests/provisioning_recommendations.mjs",
@@ -12287,7 +12357,7 @@
     {
       "path": "tests/provisioning_restart.mjs",
       "mode": "0000644",
-      "sha256": "cc9e251adffa14afdfb6db4eff20bec56e939c5d2692f307fbcf98ecb97cced2"
+      "sha256": "f31a8fc12866f7d639b7472578422e29129db85bbd9ddecb663e753393d74e2a"
     },
     {
       "path": "tests/provisioning_settings.mjs",
@@ -12297,7 +12367,7 @@
     {
       "path": "tests/provisioning_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "d40e0a6bbeccc54943149281597727a7fa61b737894e08959449cc7c76ccf7fb"
+      "sha256": "642d29f2e29e38a0b3a7229309b03a9e1cb28969e7f6d942bd06dd092147b835"
     },
     {
       "path": "tests/provisioning_settings_env.mjs",
@@ -12317,7 +12387,7 @@
     {
       "path": "tests/provisioning_teardown_intent.mjs",
       "mode": "0000644",
-      "sha256": "4a732a0e5f89b9251926f87b5fc37a07e0421487813b9e97b124fc670821fa78"
+      "sha256": "6155e1e7c18417537636e6e0ca1d63f4b87264c350d736fb787dfdafb7950280"
     },
     {
       "path": "tests/provisioning_teardown_states.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 375 operations across 58 resource groups
+- 378 operations across 58 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -689,6 +689,8 @@ function createClient(opts = {}) {
       postProjectsInvite: (args) => request("POST", "/projects/invite", { hasBody: true }, args),
     },
     "provisioning": {
+      // GET /provisioning/control-plane — rank: archon — GET /provisioning/control-plane
+      getProvisioningControlPlane: (args) => request("GET", "/provisioning/control-plane", { hasBody: false }, args),
       // GET /provisioning/fleet — rank: metic+archon — GET /provisioning/fleet
       getProvisioningFleet: (args) => request("GET", "/provisioning/fleet", { hasBody: false }, args),
       // GET /provisioning/fleet/cost-ledger — rank: metic+archon — GET /provisioning/fleet/cost-ledger
@@ -705,6 +707,10 @@ function createClient(opts = {}) {
       postProvisioningInstances: (args) => request("POST", "/provisioning/instances", { hasBody: true }, args),
       // GET /provisioning/instances/{id} — rank: any-builder — GET /provisioning/instances/:id
       getProvisioningInstancesId: (args) => request("GET", "/provisioning/instances/{id}", { hasBody: false }, args),
+      // GET /provisioning/instances/{id}/core-upgrade — rank: archon — GET /provisioning/instances/:id/core-upgrade
+      getProvisioningInstancesIdCoreUpgrade: (args) => request("GET", "/provisioning/instances/{id}/core-upgrade", { hasBody: false }, args),
+      // POST /provisioning/instances/{id}/core-upgrade — rank: archon — POST /provisioning/instances/:id/core-upgrade
+      postProvisioningInstancesIdCoreUpgrade: (args) => request("POST", "/provisioning/instances/{id}/core-upgrade", { hasBody: true }, args),
       // PATCH /provisioning/instances/{id}/detail — rank: any-builder — PATCH /provisioning/instances/:id/detail
       patchProvisioningInstancesIdDetail: (args) => request("PATCH", "/provisioning/instances/{id}/detail", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/disconnect — rank: any-builder — POST /provisioning/instances/:id/disconnect

package/clients/bongos-client/index.cjs

@@ -688,6 +688,8 @@ function createClient(opts = {}) {
       postProjectsInvite: (args) => request("POST", "/projects/invite", { hasBody: true }, args),
     },
     "provisioning": {
+      // GET /provisioning/control-plane — rank: archon — GET /provisioning/control-plane
+      getProvisioningControlPlane: (args) => request("GET", "/provisioning/control-plane", { hasBody: false }, args),
       // GET /provisioning/fleet — rank: metic+archon — GET /provisioning/fleet
       getProvisioningFleet: (args) => request("GET", "/provisioning/fleet", { hasBody: false }, args),
       // GET /provisioning/fleet/cost-ledger — rank: metic+archon — GET /provisioning/fleet/cost-ledger
@@ -704,6 +706,10 @@ function createClient(opts = {}) {
       postProvisioningInstances: (args) => request("POST", "/provisioning/instances", { hasBody: true }, args),
       // GET /provisioning/instances/{id} — rank: any-builder — GET /provisioning/instances/:id
       getProvisioningInstancesId: (args) => request("GET", "/provisioning/instances/{id}", { hasBody: false }, args),
+      // GET /provisioning/instances/{id}/core-upgrade — rank: archon — GET /provisioning/instances/:id/core-upgrade
+      getProvisioningInstancesIdCoreUpgrade: (args) => request("GET", "/provisioning/instances/{id}/core-upgrade", { hasBody: false }, args),
+      // POST /provisioning/instances/{id}/core-upgrade — rank: archon — POST /provisioning/instances/:id/core-upgrade
+      postProvisioningInstancesIdCoreUpgrade: (args) => request("POST", "/provisioning/instances/{id}/core-upgrade", { hasBody: true }, args),
       // PATCH /provisioning/instances/{id}/detail — rank: any-builder — PATCH /provisioning/instances/:id/detail
       patchProvisioningInstancesIdDetail: (args) => request("PATCH", "/provisioning/instances/{id}/detail", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/disconnect — rank: any-builder — POST /provisioning/instances/:id/disconnect

package/clients/bongos-client/index.d.ts

@@ -1037,6 +1037,8 @@ export interface BongosClient {
     postProjectsInvite(args: RequestArgs & { body: PostProjectsInviteRequest }): Promise<ApiResponse>;
   };
   "provisioning": {
+    /** GET /provisioning/control-plane — rank: archon */
+    getProvisioningControlPlane(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /provisioning/fleet — rank: metic+archon */
     getProvisioningFleet(args?: RequestArgs): Promise<GetProvisioningFleetResponse>;
     /** GET /provisioning/fleet/cost-ledger — rank: metic+archon */
@@ -1053,6 +1055,10 @@ export interface BongosClient {
     postProvisioningInstances(args: RequestArgs & { body: PostProvisioningInstancesRequest }): Promise<ApiResponse>;
     /** GET /provisioning/instances/{id} — rank: any-builder */
     getProvisioningInstancesId(args?: RequestArgs): Promise<GetProvisioningInstancesIdResponse>;
+    /** GET /provisioning/instances/{id}/core-upgrade — rank: archon */
+    getProvisioningInstancesIdCoreUpgrade(args?: RequestArgs): Promise<ApiResponse>;
+    /** POST /provisioning/instances/{id}/core-upgrade — rank: archon */
+    postProvisioningInstancesIdCoreUpgrade(args?: RequestArgs): Promise<ApiResponse>;
     /** PATCH /provisioning/instances/{id}/detail — rank: any-builder */
     patchProvisioningInstancesIdDetail(args?: RequestArgs & { body?: PatchProvisioningInstancesIdDetailRequest }): Promise<PatchProvisioningInstancesIdDetailResponse>;
     /** POST /provisioning/instances/{id}/disconnect — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -685,6 +685,8 @@ export function createClient(opts = {}) {
       postProjectsInvite: (args) => request("POST", "/projects/invite", { hasBody: true }, args),
     },
     "provisioning": {
+      // GET /provisioning/control-plane — rank: archon — GET /provisioning/control-plane
+      getProvisioningControlPlane: (args) => request("GET", "/provisioning/control-plane", { hasBody: false }, args),
       // GET /provisioning/fleet — rank: metic+archon — GET /provisioning/fleet
       getProvisioningFleet: (args) => request("GET", "/provisioning/fleet", { hasBody: false }, args),
       // GET /provisioning/fleet/cost-ledger — rank: metic+archon — GET /provisioning/fleet/cost-ledger
@@ -701,6 +703,10 @@ export function createClient(opts = {}) {
       postProvisioningInstances: (args) => request("POST", "/provisioning/instances", { hasBody: true }, args),
       // GET /provisioning/instances/{id} — rank: any-builder — GET /provisioning/instances/:id
       getProvisioningInstancesId: (args) => request("GET", "/provisioning/instances/{id}", { hasBody: false }, args),
+      // GET /provisioning/instances/{id}/core-upgrade — rank: archon — GET /provisioning/instances/:id/core-upgrade
+      getProvisioningInstancesIdCoreUpgrade: (args) => request("GET", "/provisioning/instances/{id}/core-upgrade", { hasBody: false }, args),
+      // POST /provisioning/instances/{id}/core-upgrade — rank: archon — POST /provisioning/instances/:id/core-upgrade
+      postProvisioningInstancesIdCoreUpgrade: (args) => request("POST", "/provisioning/instances/{id}/core-upgrade", { hasBody: true }, args),
       // PATCH /provisioning/instances/{id}/detail — rank: any-builder — PATCH /provisioning/instances/:id/detail
       patchProvisioningInstancesIdDetail: (args) => request("PATCH", "/provisioning/instances/{id}/detail", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/disconnect — rank: any-builder — POST /provisioning/instances/:id/disconnect

package/docs/adr/0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md

@@ -0,0 +1,124 @@
+# 0293 — The owner's deploy door is an INTENT the control plane drains, not a web tier with a shell
+
+- **Status:** Accepted
+- **Date:** 2026-09-16
+- **Tasks:** [#1003159](https://cloudbongos.com/builders#/task/1003159) (goal 1000090) — *"The owner has no path to deploy"*
+- **Related:** 0016 (authority is resolved server-side, never from a local file), 0043 (the control plane is a separate privilege domain), 0128 (how the runner escalates), 0130 (the runner drives remote boxes over ssh), 0136 (channel policy), 0137 / 0161 (the three publish gates), 0111 (the provisioning intent queue this reuses)
+- **Supersedes in practice:** the manual leg of [#1003156](https://cloudbongos.com/builders#/task/1003156) — that bump stays valid, it just stops being the *only* way
+
+## Context
+
+The owner, 2026-08-22, verbatim: **"I don't think I can make anything live."** The same sentence arrived again on 2026-09-16, phrased *"this is above my paygrade."*
+
+Moving an instance's core pin is gate 3 of the release pipeline and the **only** act that makes shipped work visible to users. Today it is reachable from exactly one place: a shell on the control-plane box, holding an ssh key, running
+
+```
+bongos upgrade --registry --to <ver> --service <unit> --health-url <url> --commit-pin
+```
+
+There is no route and no hall control. So a release reaching users depends on one person being at one machine. And an agent cannot close the loop either — the permission classifier blocks an agent from a mutating `sudo -u lars` over ssh, by design.
+
+That is a structural mismatch with the platform's own premise. Cloud Bongos is AI-first: agents write the code, the human owner holds the hard gates. **Deploy is the owner's gate, and it is the one gate with no instrument.**
+
+The concrete cost, measured the day this was written: `cloudbongos.com` served core 1.19.754 while 1.19.757 — carrying a shipped fix to the claimable-task feed — sat published and unreachable. Four releases of shipped work that nobody could see, and no one present could act.
+
+## Decision
+
+### D1 — The door is an INTENT. The web tier never gets a shell.
+
+The hall writes a row to `provisioning_intents`; the control-plane timer
+(`provision-intent-runner.timer` → `provision.js run-intents --apply`) drains it and does
+the privileged work. The web process gains no sudo, no ssh key, and no new capability
+whatsoever — it gains the ability to *ask*.
+
+This is not a new mechanism. It is the seam ADR 0111 already built and that `provision`,
+`teardown`, `domain-attach`, `settings-apply` and `restart` already ride. `enqueueIntent`
+already carries `requested_by`, so the actor requirement is satisfied by the existing
+shape rather than bolted on.
+
+**Rejected: giving the web tier sudo.** ADR 0043 makes the control plane a separate
+privilege domain on purpose. An HTTP-reachable process that can restart services is the
+single highest-value target in the system; the whole point of the split is that
+compromising the web tier must not hand over the box. The intent queue crosses that
+boundary through one narrow, auditable, append-only row.
+
+**Rejected: a new bespoke queue for upgrades.** A second queue is a second set of
+claim/settle/retry semantics to get right, and the failure modes of this one are already
+understood in production.
+
+### D2 — The control plane is enrolled as a self-row, and that row is NOT teardownable
+
+`provisioning_intents.instance_id` is `NOT NULL REFERENCES provisioning_instances(id)`.
+To ride the queue at all, the control plane needs a row. It does not have one today — the
+table holds only tenant projects.
+
+So the control plane is enrolled, with `hosting_shape='control-plane'`: a shape that
+exists to be **excluded**, not to be operated on. The non-negotiable that comes with it:
+
+> **Every destructive intent action MUST refuse a `control-plane` row.** `teardown` on the
+> self-row would destroy the platform from inside the platform's own UI.
+
+This is the load-bearing risk of D2 and the reason the shape is a distinct value rather
+than reusing `standalone`. A test asserts the refusal for every action in `INTENT_ACTIONS`
+except the ones explicitly allowed on the self-row (`core-upgrade`, `restart`).
+
+**Rejected: a nullable `instance_id` meaning "the control plane".** A null that means
+something is the kind of implicit encoding that reads as a bug at every later call site,
+and it would silently widen every existing query that assumes the FK holds.
+
+### D3 — The target version comes from the registry, never from the request
+
+The request names a version; the runner refuses any version that is not **published** and
+not permitted by the channel policy (`update-channel.js`). Free text never reaches
+`bongos upgrade`.
+
+This is not theoretical tidiness. The release lane mints a git tag **before** the npm
+publish completes — measured at 8–13 minutes on 2026-09-16, against ~100 seconds recorded
+earlier (learnings 1000263, 1000266). A door that accepted "whatever main says" would
+routinely queue a version that does not exist yet and fail with `npm error notarget`. The
+registry is the only honest source of "can this actually be taken".
+
+### D4 — Two-step: preview, then confirm. The owner's choice, 2026-09-16.
+
+The control shows what a bump would move — live version → target, and what sits between
+them — and fires only on an explicit second act.
+
+Auto-rollback (task 2149) already guards the *bad release* case. This guards the different
+one: the **wrong button**. A single click that restarts the live service is recoverable but
+not free, and the owner asked for the confirmation. Rejected: typing the version to arm it
+(strongest, but friction on an action that should be routine once trusted).
+
+### D5 — Archon-gated server-side, ledgered with an actor
+
+`requireRank`-equivalent on the route, resolved server-side per request with no caching
+(ADR 0016). Nothing about this is reachable by editing a local file.
+
+`core_upgrades` gains an actor column. The ledger records **who asked**, not merely what
+moved — a privileged action with an unattributed row is not acceptable, and today the table
+carries only a free-text `note`.
+
+### D6 — The truth read back is the BOX's, not the tool's
+
+Success is `curl http://127.0.0.1:<port>/version` **on the box**, matching the requested
+version — the DONE-WHEN task 1003156 already established. The apex sits behind pre-launch
+basic_auth and its HTML rides a CDN, so an apex read can report a stale or gated answer
+with total confidence. The health gate and auto-rollback inside `bongos upgrade` are
+reused unchanged; this decision is only about what the *control* believes and displays.
+
+## Consequences
+
+- The owner can move the pin from the hall, and read back the version the box actually
+  serves, without a shell or an ssh key. That is the whole point.
+- **Tenant instances are NOT in this change.** The queue supports them and the follow-up is
+  small, but the control plane is where the pain is and mixing the two doubles the surface
+  of a first cut on the most privileged action in the system. Filed separately.
+- The runner upgrades the box it runs on. This is safe for a reason worth stating rather
+  than assuming: the runner and the web service are **different systemd units**, so
+  restarting the web service does not kill the run in progress. The running process also
+  keeps the code it already loaded, so an upgrade that rewrites the runner's own files
+  takes effect on the *next* tick, never mid-run.
+- Re-running a settled-but-unconfirmed intent is safe: `bongos upgrade`'s same-version
+  guard makes the leg a no-op when the box already serves the target.
+- **What this does not do:** it does not make deploys automatic. ADR 0137's three gates
+  stand — land, release, deploy — and this only gives the third gate a handle. An owner who
+  never presses it ships nothing, exactly as today.