@bongos/core 1.19.804 → 1.19.805

package/.claude/skills/priority-session/SKILL.md

@@ -14,7 +14,7 @@ This is the live-flight complement to `/planning-session`: planning sessions set
 
 **Enforce the gate at the very top of the session, before reading anything else:**
 
-1. Call `GET /api/gds/me` and read `builder.rank`. Compare case-insensitively (lowercase it before testing) — the `builders.rank` enum casing is defined by V3.R04; until it ships, normalize defensively.
+1. Call `GET /api/bongos/me` and read `builder.rank`. Compare case-insensitively (lowercase it before testing) — the `builders.rank` enum casing is defined by V3.R04; until it ships, normalize defensively.
 2. **If `rank` is present and lowercases to `xenos`** → stop immediately. Tell the builder: *"Priority sessions are a Metic+ operation — they reweight the whole team's idea queue. You're currently Xenos. Ask an Archon to promote you, then run this again."* Do not read the inbox, do not propose a ranking.
 3. **If `rank` lowercases to `metic` or `archon`** → proceed.
 4. **If `rank` is absent** (the server-enforced rank system — V3.R04 / criterion C7 — has not shipped yet, so `/me` returns no `rank` field): treat the session as available, exactly as `/planning-session` does today ("available to all builders for now; rank-gates to Metic+ at end of V3"). Note in the session-log entry that the gate ran in pre-rank passthrough mode. The moment `builders.rank` lands, this skill enforces it for real with no edit — the check above already reads the field.
@@ -40,10 +40,10 @@ This is the live-flight complement to `/planning-session`: planning sessions set
 
 Read everything the reweighting depends on. Do this before asking the builder anything, so their answers land against real data, not guesses.
 
-1. `GET /api/gds/me` — rank gate (above) **and** the builder's `active_claims` (don't suggest claiming something they already hold) and `total_credits`.
-2. `GET /api/gds/inbox` — the open ideas. This is the set you will rank. Capture each idea's `id`, `title`, `body_md`, `kind`, `suggested_version`, `suggested_priority`, `captured_at`, `captured_by`.
-3. `GET /api/gds/tasks/claimable` — what's *actually claimable right now* (deps shipped, parallel-safe). The "what should I claim next?" answer must come from this list, never from an idea that hasn't been promoted to a task yet.
-4. `GET /api/gds/blockers` (read-public, no auth) — open blockers. An idea that would resolve or route around a current blocker scores higher on the "unblock the most builders" axis.
+1. `GET /api/bongos/me` — rank gate (above) **and** the builder's `active_claims` (don't suggest claiming something they already hold) and `total_credits`.
+2. `GET /api/bongos/inbox` — the open ideas. This is the set you will rank. Capture each idea's `id`, `title`, `body_md`, `kind`, `suggested_version`, `suggested_priority`, `captured_at`, `captured_by`.
+3. `GET /api/bongos/tasks/claimable` — what's *actually claimable right now* (deps shipped, parallel-safe). The "what should I claim next?" answer must come from this list, never from an idea that hasn't been promoted to a task yet.
+4. `GET /api/bongos/blockers` (read-public, no auth) — open blockers. An idea that would resolve or route around a current blocker scores higher on the "unblock the most builders" axis.
 
 If `open_count` is 0, print *"inbox empty — nothing to reprioritize. Running `/builder-start` instead to surface claimable tasks."* and stop the priority flow.
 
@@ -90,7 +90,7 @@ Leverage is weighted highest because unblocking the team is the strongest team-l
 
 ### Phase 4 — "What should I claim next?" + land the log
 
-**Make the claim suggestion.** This is the single most useful output. Cross the ranking against `GET /api/gds/tasks/claimable` and the builder's Q7 (time/energy):
+**Make the claim suggestion.** This is the single most useful output. Cross the ranking against `GET /api/bongos/tasks/claimable` and the builder's Q7 (time/energy):
 
 - The top-ranked idea is only a valid claim suggestion **if it's already a claimable task**. An open idea is *not* claimable — it's an idea. If the top idea hasn't been promoted to a task yet, say so and offer: *"This isn't a task yet — want me to promote it via `/idea-triage`, or claim the highest-ranked thing that's already a task?"*
 - Filter claimable tasks by the ranking's themes and by Q7: if the builder said "quick win," prefer low `est_minutes`; if "deep block," prefer the high-leverage foundational work even if it's bigger.
@@ -114,15 +114,15 @@ Prepend a one-line link to the CLAUDE.md §13 Session Log index (newest at top),
 # legacy fallback pms-session.json) and signs every request. Prefer driving the
 # API through it rather than re-deriving the token inline.
 node -e "const {apiCall}=require('./scripts/gds/cli-lib.js'); \
-  apiCall('GET','/api/gds/me').then(r=>console.log(JSON.stringify(r.data,null,2)))"
+  apiCall('GET','/api/bongos/me').then(r=>console.log(JSON.stringify(r.data,null,2)))"
 
 # Phase 1 — pull state
 node -e "const {apiCall}=require('./scripts/gds/cli-lib.js'); \
-  apiCall('GET','/api/gds/inbox').then(r=>console.log(JSON.stringify(r.data,null,2)))"
+  apiCall('GET','/api/bongos/inbox').then(r=>console.log(JSON.stringify(r.data,null,2)))"
 node -e "const {apiCall}=require('./scripts/gds/cli-lib.js'); \
-  apiCall('GET','/api/gds/tasks/claimable').then(r=>console.log(JSON.stringify(r.data,null,2)))"
+  apiCall('GET','/api/bongos/tasks/claimable').then(r=>console.log(JSON.stringify(r.data,null,2)))"
 node -e "const {apiCall}=require('./scripts/gds/cli-lib.js'); \
-  apiCall('GET','/api/gds/blockers').then(r=>console.log(JSON.stringify(r.data,null,2)))"   # read-public
+  apiCall('GET','/api/bongos/blockers').then(r=>console.log(JSON.stringify(r.data,null,2)))"   # read-public
 
 # Phase 4 — the suggestion resolves to a real claim command
 node scripts/gds/claim.js <task_id> --worktree <worktree-name>

package/.claude/skills/recall/SKILL.md

@@ -49,5 +49,5 @@ Each summary result shows the hit id (`#NNN`, the handle for `--expand`), the ti
 
 ## Files this skill touches
 
-- Calls: `POST /api/gds/search` via `scripts/gds/recall.js` — twice over the same route: `{ q }` for the summary layer (step 1) and `{ expand: <id> }` for one hit's full content (step 2).
+- Calls: `POST /api/bongos/search` via `scripts/gds/recall.js` — twice over the same route: `{ q }` for the summary layer (step 1) and `{ expand: <id> }` for one hit's full content (step 2).
 - Reads: `~/.config/otb/gds-session.json` (the session token, like every `/builder-*` CLI).

package/.claude/skills/scan-before-install/SKILL.md

@@ -95,11 +95,11 @@ Step by step:
 
 1. **Validate the target** (targets section above). Refuse early and plainly.
 2. **Quarantine + fetch.** `createQuarantine({ forbiddenRoots })` — list every workspace root; the pen refuses the repo, sync folders (OneDrive etc.), and workspace roots so an artifact's own `CLAUDE.md` can never auto-load. `fetchArtifact` hard-fails with a recordable abort code on timeout/caps/private hosts; record aborted scans too (step 7) — a scan that died must be visible as "died, here is why".
-3. **Prior-scan lookup.** `node scripts/gds/api.js GET "/api/gds/security/scans?content_hash=<manifest.contentHash>"` — if these exact bytes were scanned before, surface that verdict before spending panel budget (any rank can read).
+3. **Prior-scan lookup.** `node scripts/gds/api.js GET "/api/bongos/security/scans?content_hash=<manifest.contentHash>"` — if these exact bytes were scanned before, surface that verdict before spending panel budget (any rank can read).
 4. **Mirror, then floor.** `buildMirror` writes the scrubbed fenced reading room; `runFloor` persists `floor-report.json` inside the pen — pass `extraFindings: fetched.findings` so fetch-stage evidence is IN the arithmetic, not just in prose. Hard rule 4 applies between this step and the next.
 5. **Panel + verify per tier.** Spawn the lenses at the MIRROR. Collect the lens JSONs; run the verify pass; drop only cleanly-refuted panel findings.
 6. **Reduce + report.** `reduceVerdict({ floorReport, lenses, tier })`, then `assembleReport({ target: { url, sha, contentHash }, tier, reduced, floorReport, lenses, engineVersion })` with `engineVersion` = `sbi/1.0.0 floor/<floor_version>`. Write the markdown to `~/.config/otb/scan-reports/<UTC-stamp>-<host>-<sha7>.md`. (Fetch findings are already in `floorReport` from step 4 — do not re-add them here.)
-7. **Record the scan row.** POST `/api/gds/security/scans` via `scripts/gds/api.js` with `--body-file` (never a shell heredoc). **Required on every row:** `target_url`, `artifact_kind` (`repo` | `plugin` | `marketplace`), `tier`, `completion`, `engine_version`. **`verdict` is required exactly when `completion` is `complete`, and must be absent otherwise** — the route enforces that coupling, so an aborted scan carries `completion: 'aborted'` + `abort_code` and NO verdict. Optional: `resolved_sha`, `content_hash`, `file_count`, `total_bytes`, the four `findings_<severity>` counts, `findings_summary` (one-line scrubbed claims only), `action_taken`. A successful scan therefore looks like:
+7. **Record the scan row.** POST `/api/bongos/security/scans` via `scripts/gds/api.js` with `--body-file` (never a shell heredoc). **Required on every row:** `target_url`, `artifact_kind` (`repo` | `plugin` | `marketplace`), `tier`, `completion`, `engine_version`. **`verdict` is required exactly when `completion` is `complete`, and must be absent otherwise** — the route enforces that coupling, so an aborted scan carries `completion: 'aborted'` + `abort_code` and NO verdict. Optional: `resolved_sha`, `content_hash`, `file_count`, `total_bytes`, the four `findings_<severity>` counts, `findings_summary` (one-line scrubbed claims only), `action_taken`. A successful scan therefore looks like:
 
    ```json
    { "target_url": "https://github.com/owner/repo", "artifact_kind": "repo",
@@ -150,7 +150,7 @@ For a dangerous verdict, failed sanitize gates, or a user who just wants the fun
 1. `selectDocFiles(entries)` — the ONLY files a model may read for this landing, via the mirror. Documentation only, never code: the spec describes WHAT to build, derived from the artifact's own docs.
 2. Spawn one doc-reader subagent at those mirror files → it returns one-line functional requirements (JSON array of strings).
 3. `assembleRebuildSpec({ target, docPaths, requirements })` — script-owned framing, every line scrubbed. Write `REBUILD-SPEC.md` next to the scan report in `~/.config/otb/scan-reports/`.
-4. Offer to file it as a Bongos task: `POST /api/gds/tasks` (status `backlog`, body = the spec markdown; Metic+) or `node scripts/gds/capture.js` into the idea inbox otherwise. Record `rebuild_spec`.
+4. Offer to file it as a Bongos task: `POST /api/bongos/tasks` (status `backlog`, body = the spec markdown; Metic+) or `node scripts/gds/capture.js` into the idea inbox otherwise. Record `rebuild_spec`.
 
 ## What this skill does NOT do
 

package/.claude/skills/status/SKILL.md

@@ -8,7 +8,7 @@ You are answering a project-status question. Before this skill existed, doing so
 
 ## What this skill does
 
-Rolls up a version's done-when criteria → gating tasks → live statuses → what's left, in one call to the public `GET /api/gds/versions/:id/progress`. Read-only and unauthenticated, so it works even before `/builder-setup`. As of task 1288 it produces a **deterministic card** (same shape every time) — your job is to render it, not to re-summarize it.
+Rolls up a version's done-when criteria → gating tasks → live statuses → what's left, in one call to the public `GET /api/bongos/versions/:id/progress`. Read-only and unauthenticated, so it works even before `/builder-setup`. As of task 1288 it produces a **deterministic card** (same shape every time) — your job is to render it, not to re-summarize it.
 
 ## How to render it
 
@@ -29,6 +29,6 @@ Delivery is deterministic (task 1288, same methodology as `/builder-start`). The
 
 ## Files this skill touches
 
-- Calls: `GET /api/gds/versions/:id/progress` (public)
+- Calls: `GET /api/bongos/versions/:id/progress` (public)
 - Runs: `scripts/gds/status.js` (`--hook` / `--widget` render the card; default text + `--json` unchanged)
 - Delivered by: `.claude/hooks/session-cards.js` (the card-delivery hook, task 1288)

package/.claude/skills/strand-fix/SKILL.md

@@ -33,11 +33,11 @@ node scripts/gds/skill-preflight.js strand-fix   # exits 1 naming what is MISSIN
    gh pr list --search "N" --state all --json number,state,mergeable,url
    ```
 2. **Pick the ONE matching case.**
-   - **A. A main commit carries `(task N` and the post-merge `unit` + `main-audit` on main are green** (`gh run list --branch main --limit 4`): the land happened; only the proof failed. The proof is the claim's recorded tip (`claims.published_head_sha`, task 1547) being an ancestor of main — and a `no_branch_no_tip` claim has none (the work rode in on another branch, e.g. a cloud-agent batch, or a `--here` claim). **Record the tip first**: the owner (Archon) sets that column on the task's latest claim to the full 40-char SHA of the main commit — a direct DB write on the box as the DB owner, so it runs under this task's own ledger with the SQL in the ship note (`UPDATE claims SET published_head_sha = '<sha>' WHERE id = (SELECT id FROM claims WHERE task_id = N ORDER BY claimed_at DESC, id DESC LIMIT 1)`). Then the reconciler proves it within ≤5 min, or flip it yourself: `node scripts/gds/api.js POST /api/gds/tasks/N/ship --body '{}'`. Never `no_artifact: true` here — the artifact exists, and the ledger would record a falsehood. Credits land on the flip (ADR 0120). (Before task 1003434 the manual POST refused even with a tip when the claim had no branch; the reconciler path always worked.)
+   - **A. A main commit carries `(task N` and the post-merge `unit` + `main-audit` on main are green** (`gh run list --branch main --limit 4`): the land happened; only the proof failed. The proof is the claim's recorded tip (`claims.published_head_sha`, task 1547) being an ancestor of main — and a `no_branch_no_tip` claim has none (the work rode in on another branch, e.g. a cloud-agent batch, or a `--here` claim). **Record the tip first**: the owner (Archon) sets that column on the task's latest claim to the full 40-char SHA of the main commit — a direct DB write on the box as the DB owner, so it runs under this task's own ledger with the SQL in the ship note (`UPDATE claims SET published_head_sha = '<sha>' WHERE id = (SELECT id FROM claims WHERE task_id = N ORDER BY claimed_at DESC, id DESC LIMIT 1)`). Then the reconciler proves it within ≤5 min, or flip it yourself: `node scripts/gds/api.js POST /api/bongos/tasks/N/ship --body '{}'`. Never `no_artifact: true` here — the artifact exists, and the ledger would record a falsehood. Credits land on the flip (ADR 0120). (Before task 1003434 the manual POST refused even with a tip when the claim had no branch; the reconciler path always worked.)
    - **B. A local branch exists with commits ahead of `origin/main` and no PR**: the ship never pushed. From that worktree: `git push -u origin <branch>` then `gh pr create --base main --head <branch> --fill`. Green `unit` → server auto-merge → the reconciler flips it within ~5 min. If it merges but does not flip, do **A**.
    - **C. A PR exists but is `CONFLICTING`**: the branch owner brings it up to date — `git merge origin/main`, resolve, push — not this skill, and never `--force`. **Merge, never rebase** (task 1002788): the branch is already published and the server's publish is append-only, so rewriting its history makes every later push non-fast-forward and the task un-landable while the claim gate keeps the owner's queue shut. Report the PR URL and stop.
    - **D. Nothing anywhere** — no branch, no PR, no commit: a codeless confirm. Ask what the task delivered. Work done outside this repo (on the box's instance checkout, a DB-only change captured in the ship note) is legitimately artifact-free → **A** with the reason in the ship body: `--body '{"note":"codeless: <where the work lives>"}'`. If the work was never done, release it instead so it returns to `ready`: `node scripts/gds/release.js N --reason "stranded codeless confirm; nothing delivered"`.
-3. **Verify**: `node scripts/gds/api.js GET /api/gds/tasks/N` → `"status": "shipped"` (or `ready` after a release). Re-run `strand-watch.js --line` — the task must be gone from it. If the claim gate was the symptom, `claim.js` now succeeds.
+3. **Verify**: `node scripts/gds/api.js GET /api/bongos/tasks/N` → `"status": "shipped"` (or `ready` after a release). Re-run `strand-watch.js --line` — the task must be gone from it. If the claim gate was the symptom, `claim.js` now succeeds.
 
 ## Rules
 

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 378 operations across 58 resource groups
+- 379 operations across 58 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -831,6 +831,8 @@ function createClient(opts = {}) {
       getSessionsMine: (args) => request("GET", "/sessions/mine", { hasBody: false }, args),
       // GET /sessions/search — rank: metic+archon — GET /sessions/search
       getSessionsSearch: (args) => request("GET", "/sessions/search", { hasBody: false }, args),
+      // GET /sessions/upload-health — rank: metic+archon — GET /sessions/upload-health
+      getSessionsUploadHealth: (args) => request("GET", "/sessions/upload-health", { hasBody: false }, args),
     },
     "sso": {
       // POST /sso/activity/rollup — rank: public — POST /sso/activity/rollup

package/clients/bongos-client/index.cjs

@@ -830,6 +830,8 @@ function createClient(opts = {}) {
       getSessionsMine: (args) => request("GET", "/sessions/mine", { hasBody: false }, args),
       // GET /sessions/search — rank: metic+archon — GET /sessions/search
       getSessionsSearch: (args) => request("GET", "/sessions/search", { hasBody: false }, args),
+      // GET /sessions/upload-health — rank: metic+archon — GET /sessions/upload-health
+      getSessionsUploadHealth: (args) => request("GET", "/sessions/upload-health", { hasBody: false }, args),
     },
     "sso": {
       // POST /sso/activity/rollup — rank: public — POST /sso/activity/rollup

package/clients/bongos-client/index.d.ts

@@ -1179,6 +1179,8 @@ export interface BongosClient {
     getSessionsMine(args?: RequestArgs): Promise<GetSessionsMineResponse>;
     /** GET /sessions/search — rank: metic+archon */
     getSessionsSearch(args?: RequestArgs): Promise<GetSessionsSearchResponse>;
+    /** GET /sessions/upload-health — rank: metic+archon */
+    getSessionsUploadHealth(args?: RequestArgs): Promise<ApiResponse>;
   };
   "sso": {
     /** POST /sso/activity/rollup — rank: public */

package/clients/bongos-client/index.mjs

@@ -827,6 +827,8 @@ export function createClient(opts = {}) {
       getSessionsMine: (args) => request("GET", "/sessions/mine", { hasBody: false }, args),
       // GET /sessions/search — rank: metic+archon — GET /sessions/search
       getSessionsSearch: (args) => request("GET", "/sessions/search", { hasBody: false }, args),
+      // GET /sessions/upload-health — rank: metic+archon — GET /sessions/upload-health
+      getSessionsUploadHealth: (args) => request("GET", "/sessions/upload-health", { hasBody: false }, args),
     },
     "sso": {
       // POST /sso/activity/rollup — rank: public — POST /sso/activity/rollup

package/docs/api/openapi.json

@@ -1091,7 +1091,7 @@
           "audit-log"
         ],
         "summary": "GET /audit-log",
-        "description": "GET /api/gds/audit-log?limit=&offset=&builder_id=&method= Paginated, newest-first. Clamps: limit → 1..500, default 100 offset → >= 0, default 0 rank: archon — forensics surface; only the Archon should see who did what. Gate: requirePermission('audit_log.read') — BV1.R104; the seeded rank-role makes the permission and the old rank floor identical (ADR 0151).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `audit_log.read` (all required).",
+        "description": "GET /api/bongos/audit-log?limit=&offset=&builder_id=&method= Paginated, newest-first. Clamps: limit → 1..500, default 100 offset → >= 0, default 0 rank: archon — forensics surface; only the Archon should see who did what. Gate: requirePermission('audit_log.read') — BV1.R104; the seeded rank-role makes the permission and the old rank floor identical (ADR 0151).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `audit_log.read` (all required).",
         "x-rank": "metic+archon",
         "x-source": "src/bongos/routes/audit-log.js",
         "x-permissions": [
@@ -3480,7 +3480,7 @@
           "builders"
         ],
         "summary": "GET /builders/:id/onboarding",
-        "description": "GET /builders/:id/onboarding — V3.R75 (task 294) onboarding checklist read. Returns the builder's onboarding state machine row, shaped for the /builders hall checklist UI: { builder_id, current_stage, completed_stages, started_at, completed_at, progress: { cleared, total }, stages: [{ id, label, hint, cleared, is_current }, ...], graduated: boolean } Public read (no auth). Spec says the hall renders other builders' checklists read-only — a builder's onboarding progress is roster-visible signal, same posture as rank or drachmae shown on the leaderboard. The builder's own row is also surfaced inside /api/gds/me; this endpoint is what the hall hits for the CURRENT viewer AND for any other builder whose card is rendered. rank: public — onboarding progress is a roster-visible signal.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "GET /builders/:id/onboarding — V3.R75 (task 294) onboarding checklist read. Returns the builder's onboarding state machine row, shaped for the /builders hall checklist UI: { builder_id, current_stage, completed_stages, started_at, completed_at, progress: { cleared, total }, stages: [{ id, label, hint, cleared, is_current }, ...], graduated: boolean } Public read (no auth). Spec says the hall renders other builders' checklists read-only — a builder's onboarding progress is roster-visible signal, same posture as rank or drachmae shown on the leaderboard. The builder's own row is also surfaced inside /api/bongos/me; this endpoint is what the hall hits for the CURRENT viewer AND for any other builder whose card is rendered. rank: public — onboarding progress is a roster-visible signal.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/builders.js",
         "parameters": [
@@ -8922,7 +8922,7 @@
           "live"
         ],
         "summary": "GET /live",
-        "description": "GET /api/gds/live — SSE stream of Bongos state-change nudges for the hall. rank: any-builder — requireBuilder gates anonymous/abuse traffic (defense in depth; the payload leaks nothing). Mirrors the room's task 983 signed-in gate. EventSource carries the gds_session cookie on this same-origin GET, so a signed-in viewer authenticates transparently. NOT module-gated: the hall's live refresh is core to every instance (the done-when is \"live on a game-less boot\"), so it mounts unconditionally in the GDS router.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "GET /api/bongos/live — SSE stream of Bongos state-change nudges for the hall. rank: any-builder — requireBuilder gates anonymous/abuse traffic (defense in depth; the payload leaks nothing). Mirrors the room's task 983 signed-in gate. EventSource carries the gds_session cookie on this same-origin GET, so a signed-in viewer authenticates transparently. NOT module-gated: the hall's live refresh is core to every instance (the done-when is \"live on a game-less boot\"), so it mounts unconditionally in the GDS router.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "src/bongos/routes/live.js",
         "responses": {
@@ -9057,7 +9057,7 @@
           "me"
         ],
         "summary": "GET /me",
-        "description": "PMS-V2 task 188: response now also carries `unlocked` (server-joined achievement metadata) + `locked_with_progress` (server-computed human-readable progress hint per locked achievement) so the /builders UI can render achievements without a follow-up API call. Additive only — existing keys preserved for back-compat with scripts/gds/me.js and the /builders web client. V3.R24 (task 244): the `builder` payload now carries `karma` (migration 040 added the column + karma_log table). The field is surfaced by db.getBuilderById() — no shape change here, just documenting that the /api/gds/me response is the canonical place clients read karma from. rank: any-builder — own identity + own contributions; preserved per CRITICAL §4.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "PMS-V2 task 188: response now also carries `unlocked` (server-joined achievement metadata) + `locked_with_progress` (server-computed human-readable progress hint per locked achievement) so the /builders UI can render achievements without a follow-up API call. Additive only — existing keys preserved for back-compat with scripts/gds/me.js and the /builders web client. V3.R24 (task 244): the `builder` payload now carries `karma` (migration 040 added the column + karma_log table). The field is surfaced by db.getBuilderById() — no shape change here, just documenting that the /api/bongos/me response is the canonical place clients read karma from. rank: any-builder — own identity + own contributions; preserved per CRITICAL §4.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "src/bongos/routes/me.js",
         "responses": {
@@ -11054,7 +11054,7 @@
           "modules"
         ],
         "summary": "GET /modules/submissions",
-        "description": "GET /api/gds/modules/submissions?status=&module_key= — the upstreaming review queue (task 1771 reads this). Metadata only — no file contents (a future GET .../:id can add a with-files fetch if the review UI needs it). rank: metic+archon — the review queue, same rank as filing into it. Gate: requirePermission('module.submit') — BV1.R104.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.submit` (all required).",
+        "description": "GET /api/bongos/modules/submissions?status=&module_key= — the upstreaming review queue (task 1771 reads this). Metadata only — no file contents (a future GET .../:id can add a with-files fetch if the review UI needs it). rank: metic+archon — the review queue, same rank as filing into it. Gate: requirePermission('module.submit') — BV1.R104.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.submit` (all required).",
         "x-rank": "metic+archon",
         "x-source": "src/bongos/routes/modules.js",
         "x-permissions": [
@@ -11161,7 +11161,7 @@
           "modules"
         ],
         "summary": "POST /modules/:key/submit",
-        "description": "POST /api/gds/modules/:key/submit — ADR 0107 §1 upstreaming submission. task 1770. Body: { signed_by?: \"Name <email>\" }. Re-runs the §4 AGPL/publish pre-check + requires a DCO-style sign-off against THIS box's OWN on-disk copy of modules/:key (the authoritative check — a local `bongos module check` pass on a builder's box is a courtesy, not proof, if the module's changes aren't committed + shipped + deployed here yet). signed_by records a NEW sign-off only if none is on file; an existing .upstream-signoff.json is reused as-is (not overwritten). rank: metic+archon — files into a shared review queue, not just a toggle for the caller. Gate: requirePermission('module.submit') — BV1.R104.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.submit` (all required).",
+        "description": "POST /api/bongos/modules/:key/submit — ADR 0107 §1 upstreaming submission. task 1770. Body: { signed_by?: \"Name <email>\" }. Re-runs the §4 AGPL/publish pre-check + requires a DCO-style sign-off against THIS box's OWN on-disk copy of modules/:key (the authoritative check — a local `bongos module check` pass on a builder's box is a courtesy, not proof, if the module's changes aren't committed + shipped + deployed here yet). signed_by records a NEW sign-off only if none is on file; an existing .upstream-signoff.json is reused as-is (not overwritten). rank: metic+archon — files into a shared review queue, not just a toggle for the caller. Gate: requirePermission('module.submit') — BV1.R104.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.submit` (all required).",
         "x-rank": "metic+archon",
         "x-source": "src/bongos/routes/modules.js",
         "x-permissions": [
@@ -13864,7 +13864,7 @@
           "security"
         ],
         "summary": "GET /security/adr",
-        "description": "GET /api/gds/security/adr Metic+ only. Returns the full security ADR as { adr_md, source, fetched_at } when the file is provisioned; otherwise 404 with a structured hint. The rank gate runs BEFORE the file-existence check so a Xenos sees 403 regardless of whether the document is provisioned — we don't want existence-or-not to leak below the rank line. rank: metic+archon — trust-tier access to the threat model + defenses inventory (ADR 0020). Gate: requirePermission('security.report.file') — BV1.R104; the seeded rank-role makes the permission and the old rank floor identical (ADR 0151). NB the 403 code on this route is `permission_forbidden`, not `rank_forbidden` (ADR 0020 §\"A Xenos hitting the endpoint\" updated to match).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `security.report.file` (all required).",
+        "description": "GET /api/bongos/security/adr Metic+ only. Returns the full security ADR as { adr_md, source, fetched_at } when the file is provisioned; otherwise 404 with a structured hint. The rank gate runs BEFORE the file-existence check so a Xenos sees 403 regardless of whether the document is provisioned — we don't want existence-or-not to leak below the rank line. rank: metic+archon — trust-tier access to the threat model + defenses inventory (ADR 0020). Gate: requirePermission('security.report.file') — BV1.R104; the seeded rank-role makes the permission and the old rank floor identical (ADR 0151). NB the 403 code on this route is `permission_forbidden`, not `rank_forbidden` (ADR 0020 §\"A Xenos hitting the endpoint\" updated to match).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `security.report.file` (all required).",
         "x-rank": "metic+archon",
         "x-source": "src/bongos/routes/security.js",
         "x-permissions": [
@@ -13898,7 +13898,7 @@
           "security"
         ],
         "summary": "GET /security/docs",
-        "description": "GET /api/gds/security/docs — list doc METADATA (no content). rank: archon — index of exploit-detail engagement reports. Gate: requirePermission('security.report.adjudicate') — BV1.R104.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `security.report.adjudicate` (all required).",
+        "description": "GET /api/bongos/security/docs — list doc METADATA (no content). rank: archon — index of exploit-detail engagement reports. Gate: requirePermission('security.report.adjudicate') — BV1.R104.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `security.report.adjudicate` (all required).",
         "x-rank": "metic+archon",
         "x-source": "src/bongos/routes/security.js",
         "x-permissions": [
@@ -13937,7 +13937,7 @@
           "security"
         ],
         "summary": "POST /security/docs",
-        "description": "POST /api/gds/security/docs — upsert a doc by slug. The director uploads each dated engagement report here after deploy. Body: { slug, title, content_md }. content_md uses a large explicit cap (full reports), NOT the small LIMITS.DESCRIPTION. Returns 201 + the row. rank: archon — writes exploit-detail report bodies. Gate: requirePermission('security.report.adjudicate') — BV1.R104.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `security.report.adjudicate` (all required).",
+        "description": "POST /api/bongos/security/docs — upsert a doc by slug. The director uploads each dated engagement report here after deploy. Body: { slug, title, content_md }. content_md uses a large explicit cap (full reports), NOT the small LIMITS.DESCRIPTION. Returns 201 + the row. rank: archon — writes exploit-detail report bodies. Gate: requirePermission('security.report.adjudicate') — BV1.R104.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `security.report.adjudicate` (all required).",
         "x-rank": "metic+archon",
         "x-source": "src/bongos/routes/security.js",
         "x-permissions": [
@@ -13989,7 +13989,7 @@
           "security"
         ],
         "summary": "GET /security/docs/:slug",
-        "description": "GET /api/gds/security/docs/:slug — one doc WITH content, or 404. rank: archon — reads the full exploit-detail report body. Gate: requirePermission('security.report.adjudicate') — BV1.R104.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `security.report.adjudicate` (all required).",
+        "description": "GET /api/bongos/security/docs/:slug — one doc WITH content, or 404. rank: archon — reads the full exploit-detail report body. Gate: requirePermission('security.report.adjudicate') — BV1.R104.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `security.report.adjudicate` (all required).",
         "x-rank": "metic+archon",
         "x-source": "src/bongos/routes/security.js",
         "x-permissions": [
@@ -14625,6 +14625,40 @@
         ]
       }
     },
+    "/sessions/upload-health": {
+      "get": {
+        "operationId": "get_sessions_upload_health",
+        "tags": [
+          "sessions"
+        ],
+        "summary": "GET /sessions/upload-health",
+        "description": "GET /sessions/upload-health — the answer to \"has anyone's session upload silently stopped?\", which before task 1003865 existed ONLY as a jsonl file on the builder's own laptop. A skipped upload means no session_records row, which means the ADR 0146 cost-plus reward never books — a builder earning nothing for work that shipped, invisible from here. Read-only and side-effect-free, so it is DELIBERATELY not a new permission: it reads the same corpus /sessions/search reads, for the same cross-builder audience, so it rides the same `session.search` gate and writes the same fail-closed audit row. A new permission would be a new thing to grant before anyone could look at a number that already exists.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `session.search` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/sessions/routes/sessions.js",
+        "x-permissions": [
+          "session.search"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/sessions/{id}": {
       "get": {
         "operationId": "get_sessions_id",
@@ -23954,7 +23988,7 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 378,
+  "x-endpoint-count": 379,
   "x-schema-count": 415,
   "x-undocumented-bodies": 9,
   "x-response-schemas": 282,

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 378 endpoints across 62 route files.
+> **Generated from the live route files** — the route file is authoritative. 379 endpoints across 62 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -58,7 +58,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/audit-log` | `metic+archon` | — | GET /api/gds/audit-log?limit=&offset=&builder_id=&method= Paginated, newest-first. |
+| GET | `/api/bongos/audit-log` | `metic+archon` | — | GET /api/bongos/audit-log?limit=&offset=&builder_id=&method= Paginated, newest-first. |
 
 ## `auth` (18)
 
@@ -369,7 +369,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/live` | `any-builder` | — | GET /api/gds/live — SSE stream of Bongos state-change nudges for the hall. |
+| GET | `/api/bongos/live` | `any-builder` | — | GET /api/bongos/live — SSE stream of Bongos state-change nudges for the hall. |
 
 ## `llm-cache` (2)
 
@@ -444,8 +444,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 |---|---|---|---|---|
 | GET | `/api/bongos/modules` | `any-builder` | — | list every on-disk module with attribution + provenance (same read gate as the atlas/primer pages). |
 | POST | `/api/bongos/modules/:key/enable` | `metic+archon` | `enabled` | toggling a module changes running behavior for the whole instance, not just the caller. |
-| POST | `/api/bongos/modules/:key/submit` | `metic+archon` | `signed_by` | POST /api/gds/modules/:key/submit — ADR 0107 §1 upstreaming submission. |
-| GET | `/api/bongos/modules/submissions` | `metic+archon` | — | GET /api/gds/modules/submissions?status=&module_key= — the upstreaming review queue (task 1771 reads this). |
+| POST | `/api/bongos/modules/:key/submit` | `metic+archon` | `signed_by` | POST /api/bongos/modules/:key/submit — ADR 0107 §1 upstreaming submission. |
+| GET | `/api/bongos/modules/submissions` | `metic+archon` | — | GET /api/bongos/modules/submissions?status=&module_key= — the upstreaming review queue (task 1771 reads this). |
 
 ## `my-projects` (6)
 
@@ -561,10 +561,10 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| GET | `/api/bongos/security/adr` | `metic+archon` | — | GET /api/gds/security/adr Metic+ only. |
-| GET | `/api/bongos/security/docs` | `metic+archon` | — | GET /api/gds/security/docs — list doc METADATA (no content). |
-| POST | `/api/bongos/security/docs` | `metic+archon` | `slug`, `title`, `content_md` | POST /api/gds/security/docs — upsert a doc by slug. |
-| GET | `/api/bongos/security/docs/:slug` | `metic+archon` | — | GET /api/gds/security/docs/:slug — one doc WITH content, or 404. |
+| GET | `/api/bongos/security/adr` | `metic+archon` | — | GET /api/bongos/security/adr Metic+ only. |
+| GET | `/api/bongos/security/docs` | `metic+archon` | — | GET /api/bongos/security/docs — list doc METADATA (no content). |
+| POST | `/api/bongos/security/docs` | `metic+archon` | `slug`, `title`, `content_md` | POST /api/bongos/security/docs — upsert a doc by slug. |
+| GET | `/api/bongos/security/docs/:slug` | `metic+archon` | — | GET /api/bongos/security/docs/:slug — one doc WITH content, or 404. |
 | GET | `/api/bongos/security/reports` | `metic+archon` | — | GET /api/bongos/security/reports?status=<status> Archon-only, newest-first. |
 | POST | `/api/bongos/security/reports` | `metic+archon` | `target`, `severity`, `title`, `description`, `repro_steps_md` | POST /api/bongos/security/reports — file a new vulnerability report. |
 | POST | `/api/bongos/security/reports/:id/confirm` | `metic+archon` | `drachmae_awarded` | POST /api/bongos/security/reports/:id/confirm Body: { drachmae_awarded?: integer } — defaults to the severity tier bounty if omitted. |
@@ -580,7 +580,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 |---|---|---|---|---|
 | POST | `/api/bongos/session/optimize` | `any-builder` | `mode`, `time_budget_min`, `max_parallel` | pick own next work; the optimizer reads/recommends only. |
 
-## `sessions` (4)
+## `sessions` (5)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -588,6 +588,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sessions/:id` | `any-builder` | — | own session full detail (deep-dive); cross-builder fetch requires Archon + a fail-closed audit row (BFG-principal posture until 6C.1). |
 | GET | `/api/bongos/sessions/mine` | `any-builder` | — | your OWN sessions (self-serve; no audit needed). |
 | GET | `/api/bongos/sessions/search` | `metic+archon` | — | cross-builder corpus search (BFG-principal posture until 6C.1). |
+| GET | `/api/bongos/sessions/upload-health` | `metic+archon` | — | GET /sessions/upload-health — the answer to "has anyone's session upload silently stopped?", which before task 1003865 existed ONLY as a … |
 
 ## `sso` (8)
 

package/docs/module-api-changelog.md

@@ -2082,5 +2082,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.802 with no explicit bump. run 35175617185. (task 1002620)
   1.19.804 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.803 with no explicit bump. run 35178689663. (task 1002620)
+  1.19.805 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.804 with no explicit bump. run 35180781365. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/builder-settings/profile-nudge-prefs.js

@@ -20,7 +20,7 @@
 // a scalar boolean; a missing key means "not dismissed", which keeps the column
 // sparse. applyPatch leaves sibling keys alone.
 //
-// This module is the single source of truth: GET/PATCH /api/gds/me/profile-nudge
+// This module is the single source of truth: GET/PATCH /api/bongos/me/profile-nudge
 // read and write it, and the hall's attention-card slice reads the resolved
 // boolean to decide whether to render the line at all.
 

package/modules/builder-settings/render-prefs.js

@@ -59,7 +59,7 @@
 // so the column stays sparse and a builder who never touches this gets a card
 // pitched at the profile they did set.
 //
-// This module is the single source of truth: GET/PATCH /api/gds/me/render + the
+// This module is the single source of truth: GET/PATCH /api/bongos/me/render + the
 // /me payload surface it, the /settings UI reads it, and the start/claim/ship
 // CLIs read the resolved level to decide what to emit.
 

package/modules/dev-box/app/README.md

@@ -9,7 +9,7 @@ What it does beyond the switch — each fixing a failure observed in the
 2026-06-10 onboarding sessions that killed the old `curl | bash` flow:
 
 - **Pairing sign-in** — opens the builders' hall, one Approve click, token
-  delivered over the app's own secret channel (`/api/gds/auth/app-pair/*`).
+  delivered over the app's own secret channel (`/api/bongos/auth/app-pair/*`).
   The session is written to `~/.config/otb/gds-session.json`, the same file
   the `/builder-*` CLI uses — pairing the app signs in the CLI too.
 - **SSH key done right** — generates `~/.ssh/otb_builder` (ed25519) with real

package/modules/dev-box/app/src/gds-client.js

@@ -8,8 +8,10 @@
 // only thing that changed is the transport: the endpoint paths are now the
 // spec-derived generated methods, which can never drift from the routes.
 //
-// Endpoints stay on the PERMANENT unversioned /api/gds alias (ADR 0117) so shipped
-// binaries keep working; the generated methods are relative to that base.
+// Endpoints use the canonical unversioned /api/bongos base (ADR 0117); the generated
+// methods are relative to it. The permanent /api/gds alias is what ALREADY-SHIPPED
+// binaries call — editing this source cannot reach them, and the server mounts both,
+// so a future build asking for the canonical path costs nobody anything (task 1003707).
 
 const createGeneratedClient = require('./vendor/bongos-client.cjs');
 const { apiBase } = require('./config');
@@ -28,7 +30,7 @@ class GdsError extends Error {
 // fetchImpl is a seam for tests; it defaults to the platform fetch.
 function createClient({ getToken, getApiBase, fetchImpl } = {}) {
   // Build a generated client bound to the current origin + token. `root` is the
-  // base path under the origin ('/api/gds' for the API, '' for same-origin static
+  // base path under the origin ('/api/bongos' for the API, '' for same-origin static
   // assets like the release manifest). throwOnError:false → result-mode, which we
   // translate back into the GdsError contract callers expect.
   function gen(root) {
@@ -39,7 +41,7 @@ function createClient({ getToken, getApiBase, fetchImpl } = {}) {
       fetch: fetchImpl || undefined,
     });
   }
-  const gds = () => gen('/api/gds');
+  const gds = () => gen('/api/bongos');
 
   // Unwrap a result-mode { status, ok, data } into the legacy contract: return the
   // parsed body on 2xx, throw GdsError(status, body) otherwise — byte-identical to
@@ -52,7 +54,7 @@ function createClient({ getToken, getApiBase, fetchImpl } = {}) {
 
   return {
     // Generic escape hatch, kept for parity with the old surface. `path` is the full
-    // path under the origin (e.g. '/api/gds/box/me'), so it routes through baseUrl:''.
+    // path under the origin (e.g. '/api/bongos/box/me'), so it routes through baseUrl:''.
     call: (method, path, body) => unwrap(gen('').request(method, path, body !== undefined ? { body } : {})),
     // identity
     logout: () => unwrap(gds().auth.postAuthLogout()),
@@ -79,10 +81,10 @@ function createClient({ getToken, getApiBase, fetchImpl } = {}) {
     // request() escape hatch (like latestRelease) rather than a named generated
     // method, so the shipped binary keeps working regardless of whether the
     // vendored client has been regenerated for the new /box/scope route yet.
-    claimableTasks: () => unwrap(gen('').request('GET', '/api/gds/tasks/claimable')),
-    claimTask: (taskId) => unwrap(gen('').request('POST', '/api/gds/claims', { body: { task_id: taskId } })),
-    boxScope: () => unwrap(gen('').request('GET', '/api/gds/box/scope')),
-    // update check (public route at the origin root, not under /api/gds).
+    claimableTasks: () => unwrap(gen('').request('GET', '/api/bongos/tasks/claimable')),
+    claimTask: (taskId) => unwrap(gen('').request('POST', '/api/bongos/claims', { body: { task_id: taskId } })),
+    boxScope: () => unwrap(gen('').request('GET', '/api/bongos/box/scope')),
+    // update check (public route at the origin root, not under /api/bongos).
     // task 1002649: polls the EXTENSIONLESS /version twin, NOT latest.json — a
     // front proxy with a file-matcher can eat *.json paths before Node (the
     // live instance's pre-ADR-0152 vhost 404'd latest.json empty while this

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -830,6 +830,8 @@ function createClient(opts = {}) {
       getSessionsMine: (args) => request("GET", "/sessions/mine", { hasBody: false }, args),
       // GET /sessions/search — rank: metic+archon — GET /sessions/search
       getSessionsSearch: (args) => request("GET", "/sessions/search", { hasBody: false }, args),
+      // GET /sessions/upload-health — rank: metic+archon — GET /sessions/upload-health
+      getSessionsUploadHealth: (args) => request("GET", "/sessions/upload-health", { hasBody: false }, args),
     },
     "sso": {
       // POST /sso/activity/rollup — rank: public — POST /sso/activity/rollup

package/modules/dev-box/app/test/unit.mjs

@@ -434,19 +434,19 @@ function recordingClient(response = { ok: true, status: 200, text: async () => '
 }
 
 const ENDPOINTS = [
-  ['logout', [], 'POST', '/api/gds/auth/logout', undefined],
-  ['pairStart', ['Lars-Mac', 'darwin'], 'POST', '/api/gds/auth/app-pair/start', { device_name: 'Lars-Mac', platform: 'darwin' }],
-  ['pairPoll', ['pt'], 'POST', '/api/gds/auth/app-pair/poll', { poll_token: 'pt' }],
-  ['boxMe', [], 'GET', '/api/gds/box/me', undefined],
-  ['boxEnsure', [], 'POST', '/api/gds/box/ensure', undefined],
-  ['boxClose', [], 'POST', '/api/gds/box/close', undefined],
-  ['boxHeartbeat', [], 'POST', '/api/gds/box/heartbeat', undefined],
-  ['boxTerminal', [], 'GET', '/api/gds/box/terminal', undefined],
-  ['registerSshKey', ['ssh-ed25519 AAA', 'lars'], 'POST', '/api/gds/box/ssh-key', { public_key: 'ssh-ed25519 AAA', label: 'lars' }],
-  ['managedSettings', [], 'GET', '/api/gds/box/managed-settings', undefined],
-  ['claimableTasks', [], 'GET', '/api/gds/tasks/claimable', undefined],
-  ['claimTask', ['1002388'], 'POST', '/api/gds/claims', { task_id: '1002388' }],
-  ['boxScope', [], 'GET', '/api/gds/box/scope', undefined],
+  ['logout', [], 'POST', '/api/bongos/auth/logout', undefined],
+  ['pairStart', ['Lars-Mac', 'darwin'], 'POST', '/api/bongos/auth/app-pair/start', { device_name: 'Lars-Mac', platform: 'darwin' }],
+  ['pairPoll', ['pt'], 'POST', '/api/bongos/auth/app-pair/poll', { poll_token: 'pt' }],
+  ['boxMe', [], 'GET', '/api/bongos/box/me', undefined],
+  ['boxEnsure', [], 'POST', '/api/bongos/box/ensure', undefined],
+  ['boxClose', [], 'POST', '/api/bongos/box/close', undefined],
+  ['boxHeartbeat', [], 'POST', '/api/bongos/box/heartbeat', undefined],
+  ['boxTerminal', [], 'GET', '/api/bongos/box/terminal', undefined],
+  ['registerSshKey', ['ssh-ed25519 AAA', 'lars'], 'POST', '/api/bongos/box/ssh-key', { public_key: 'ssh-ed25519 AAA', label: 'lars' }],
+  ['managedSettings', [], 'GET', '/api/bongos/box/managed-settings', undefined],
+  ['claimableTasks', [], 'GET', '/api/bongos/tasks/claimable', undefined],
+  ['claimTask', ['1002388'], 'POST', '/api/bongos/claims', { task_id: '1002388' }],
+  ['boxScope', [], 'GET', '/api/bongos/box/scope', undefined],
   ['latestRelease', [], 'GET', '/downloads/devbox/version', undefined],
 ];
 

package/modules/dev-box/box-access.js

@@ -13,7 +13,7 @@
 // THE MODEL (ADR 0016 extended from "writes are gated" to "source is gated")
 // --------------------------------------------------------------------------
 // A box holds NO permanent baked credential. At boot — and on a refresh cron —
-// the box calls GET /api/gds/box/source-access authenticated as the builder. The
+// the box calls GET /api/bongos/box/source-access authenticated as the builder. The
 // GDS reads the builder's LIVE rank+status (their machine cannot forge it) and
 // either DENIES (403 → the box scrubs its credential + clone) or returns a
 // scope-appropriate clone spec plus a short-lived, operator-supplied credential
@@ -60,7 +60,7 @@ const {
 // `public/` game client — so EVERY box (not just Metic+ full-clone boxes) can run
 // the live sandbox (sandbox-<login>.example.com, ADR 0044). The box serves
 // the game from a GAME-ONLY entry (src/preview-server.js) that never mounts
-// /api/gds, so the privacy boundary that matters for a PUBLIC sandbox URL is the
+// /api/bongos, so the privacy boundary that matters for a PUBLIC sandbox URL is the
 // RUNTIME (what the box process exposes), NOT source exclusion. That is consistent
 // with the rest of this list: newcomers already hold the build-tooling source
 // (scripts, .claude, src/bongos — no secrets), so adding the game source changes no
@@ -86,7 +86,7 @@ const STARTER_SPARSE_PATHS = [
   // The product/game runtime so the box can serve the live sandbox (ADR 0052).
   // The game-only entry (src/preview-server.js) registers WorldRoom + QueueRoom
   // from src/rooms and renders src/world + the public/ client; none of it mounts
-  // /api/gds. `public/` is the game client (NOT modules/hall-ui/public/, the hall
+  // /api/bongos. `public/` is the game client (NOT modules/hall-ui/public/, the hall
   // surface carved in BV1.R85, which stays out of a starter box).
   'src/world', 'src/rooms', 'public',
   // infra/ carries the box's own bring-up scripts (box-heartbeat.sh,