@bongos/core 1.19.813 → 1.19.814

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.813",
-  "core_contract": "1.19.813",
-  "source_commit": "62a2b5a5f9bb96162fdb7d1be299d9fd50b6f7e3",
+  "core_version": "1.19.814",
+  "core_contract": "1.19.814",
+  "source_commit": "1f01e14964d5ea0ba6bc679b6545e33b7858829c",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T07:11:52.940Z",
+  "built_at": "2026-09-17T07:24:36.013Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 488,
+    "docs_redacted": 489,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2209,
+    "functional_verbatim": 2214,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2723,
-  "tree_sha256": "911e2248028f57d2233c75dde64c923ba2cb3642f6aa99b8607b405bd8ca9b03",
+  "file_count": 2729,
+  "tree_sha256": "7a2511fd82d8a030199059a73c74669bc0c447fb5860e4eca010231226cd32a1",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -352,7 +352,7 @@
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "979dfc61bb05eba94d1b8caa6c5719c8b0eb083aa3a0f08b948cf4664f3f4450"
+      "sha256": "5753830b87cce7612cb6c6799ea3807fa5c2e9eaf1b1e5f137af21fb3692a3c4"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "fe53f128f95908a58ebe749496d0dde631c4be5295c776cafd26a0d7b37e3102"
+      "sha256": "233ade028d8fb2334e0cd2e17d10d695a5c873a8ebe5589407cccac6dd023bd5"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "5b6c3210bb423ef975ea9ad8e45bd0b24f93b368b4160f22f153f1b23da5c4ae"
+      "sha256": "e713625480afabdcda10f665beabb91cccaa3bce0268371a6ee780daea626b6d"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "38011ff56e228ded3d526bcb50b2c0c2b8b8ab7a742dffb16f377983c37ea676"
+      "sha256": "e8592cf9783404ce849e1c234a06c716993ef9c9f4d5b066a456eeeec002b0c0"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1969,20 +1969,25 @@
       "mode": "0000644",
       "sha256": "440116d384964c06055b1c7c07c30a962b164f519c9bbf3ce910570d186f1308"
     },
+    {
+      "path": "docs/adr/0297-a-tasks-creator-may-retire-it.md",
+      "mode": "0000644",
+      "sha256": "4e6d5268c58e905c86acc1bbd4c66778e3695ecd37cbc1c9e0f1448cd67f26a9"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "b59f2fe025d6f96790faabe77a417fe08a42eaa29f38e176aa90ca9950d3a4a8"
+      "sha256": "9e305c448d390efbfd7f4b5521284a8dc452d43a106d4686a0176433e2d1a3a7"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "e7dfc7ab1f840c9a5e2ab84690f35d17c7ddcc12bca9aa974a55a39105a73df1"
+      "sha256": "16b812b3d5df71ecd9c8908fcd724345cee9ebe36bdf445fedd623e8d3572498"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "ccd869f8386340558cce007a74ba818d6808ac4037be0005fd81cf665b769f65"
+      "sha256": "d062ab3925ae7919f1f0e32a2da4974cae41ee409d914ea6fb49bfd3591b91d2"
     },
     {
       "path": "docs/architecture.md",
@@ -2002,17 +2007,17 @@
     {
       "path": "docs/canonical-permissions.md",
       "mode": "0000644",
-      "sha256": "37d1a7cbbdaf86e4814ebb8c878b7d1e99021a81a147513c5cbd7807d6d7216a"
+      "sha256": "bbc4878ab6e3a0cedf5fad1b197d427b44d89ea2d32fd8dce9babfe73da09ee1"
     },
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "d7d32a0abf958fc99e21516e1708f37015376c456e0ffc125ab22a53d9a07994"
+      "sha256": "b0fb481aa86ab8ad8b2bf37bfdf09e6aba00f611156d92002632384cddc40cb2"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "5a7576210021053f21acc7d7cc6fe90d71b603bbb2fcc118a09ef64e40bbc750"
+      "sha256": "a21e7da139c5593f452509692e3f17b945f99eb5013f9a0e7ec4ceedc8c8b50e"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2537,7 +2542,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d3749c214cb091b1df2679417ab828c6f9989c62592fe213d06c2d0365ec781b"
+      "sha256": "2e01c98f75c74643cc843b80f507635d1d674749fed9185414cfce51eeac3cf8"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4072,7 +4077,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "fe53f128f95908a58ebe749496d0dde631c4be5295c776cafd26a0d7b37e3102"
+      "sha256": "233ade028d8fb2334e0cd2e17d10d695a5c873a8ebe5589407cccac6dd023bd5"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4322,7 +4327,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "25f086b8b845c35a3d9fbefbf1dcc30f0c4856b08bafc4f2c0c4952e6f57a7ab"
+      "sha256": "409e2309bdfcf4b3bb60cfde69e8854af9cd280a205cca2f7640103e08a56c84"
     },
     {
       "path": "modules/government/config.js",
@@ -4444,6 +4449,11 @@
       "mode": "0000644",
       "sha256": "0ddff91ec6d4c1f4344c6fdc2bd2f158e34a9b14662a100cf73796924b7c98de"
     },
+    {
+      "path": "modules/government/migrations/government_015_task_abandon_own.sql",
+      "mode": "0000644",
+      "sha256": "d376d2532b942c77a8ad71f6bdbeea389db3276ee86a6e57a58eed41439b6bdd"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -5327,7 +5337,7 @@
     {
       "path": "modules/hall-ui/public/task.js",
       "mode": "0000644",
-      "sha256": "394cc4c35e789cf25825c945dd7d0aa335b9d3949a64e33d607048b4861b246c"
+      "sha256": "49cd43aa6da51f6b30efac92e27912b44589c22cf879ef62b4201ed8e8552996"
     },
     {
       "path": "modules/hall-ui/public/task.states.json",
@@ -5469,6 +5479,11 @@
       "mode": "0000644",
       "sha256": "7cb9dac9cb87b679e1ae50e4112b3a7928a38ebb9902c8947a74d17bec4d9009"
     },
+    {
+      "path": "modules/lifecycle/abandon-authz.js",
+      "mode": "0000644",
+      "sha256": "4aad5d4d75fb329ae721b06840248d03c47159c632f14e22c2566ded36c158f8"
+    },
     {
       "path": "modules/lifecycle/abandon-leftovers.js",
       "mode": "0000644",
@@ -5567,7 +5582,7 @@
     {
       "path": "modules/lifecycle/db-ship.js",
       "mode": "0000644",
-      "sha256": "5b4e370fcaf6a5d23f2835833d4cd77eab67b9d509f78c24dd2650efa8e97fac"
+      "sha256": "19e70254936af3f51fa12d3b9aa9d25dbc0a84761aee84b5143ebfe6a8654b30"
     },
     {
       "path": "modules/lifecycle/db-tasks.js",
@@ -5739,6 +5754,11 @@
       "mode": "0000644",
       "sha256": "74ca9df69cd8d119c59cccf5976a3ab99c8cc1e85414488ad432c445ddd821e2"
     },
+    {
+      "path": "modules/lifecycle/routes/abandon-handler.js",
+      "mode": "0000644",
+      "sha256": "64e1baa060af63f7242d7164c7e9711aa1230ef003d1aa3f51c91f392e840725"
+    },
     {
       "path": "modules/lifecycle/routes/analytics.js",
       "mode": "0000644",
@@ -5832,7 +5852,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "0497ab99a5c13399617b43f70d775e77773f1eed259548433f19c20c708ebab9"
+      "sha256": "06948b8df847145848dec75dcb3c525cecd24948064eae19ae524e0498576b2c"
     },
     {
       "path": "modules/lifecycle/routes/version-route-authz.js",
@@ -7772,12 +7792,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e5b6e6ec23435368ffb25a25943670922f08c4a9f9a7a12e8a12d62e9bc48691"
+      "sha256": "bc7f846af00793ffc9d682071391f110593648a25297cd15050385b9c3a8828f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "beca5540ada5fdee92caf4c003fdd683ba0ac71218eb54fc9520db7b1e23a74e"
+      "sha256": "db09d4c1609d9b4b0547b052326785367cfe19a5838cd3f9d458dac40ef70685"
     },
     {
       "path": "public-docs/index.html",
@@ -9532,7 +9552,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "f57293c2d157949ccb5a74511f167902adf096037b4830b0bf667a38baf6ab58"
+      "sha256": "909c8ea1b1f73ece215ada3cc41488590a0558879af7b3850e55cbf2729b719c"
     },
     {
       "path": "src/bongos/routes.js",
@@ -9667,7 +9687,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c2878962ff1e2c457ea2eee7e6d1d0a6310a103d64ac1c4a1617e4081bc08ac5"
+      "sha256": "2b104850c999f4a9c71f7f205c640b9525a9a812031c1bad6d13cdcd06c05706"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9719,15 +9739,25 @@
       "mode": "0000644",
       "sha256": "2e46d071e5c61d302f34507215dd0a5f20a0887841ae0f7b033be865c2cb8af5"
     },
+    {
+      "path": "tests/abandon_creator_authz.mjs",
+      "mode": "0000644",
+      "sha256": "fb0611fe900cb213344b52c50c5f28543b5f5986b4a227cf4fcb380512a3a167"
+    },
     {
       "path": "tests/abandon_leftovers.mjs",
       "mode": "0000644",
       "sha256": "fe9562bd27fc127f5113de4316d1abe784874aa198d87be79caa302d526ecf17"
     },
+    {
+      "path": "tests/abandon_route.mjs",
+      "mode": "0000644",
+      "sha256": "523fe88b9582153d56c0867dc2973fb89a6b9dbc010066e57ca8dba2265a0b6d"
+    },
     {
       "path": "tests/abandon_task.mjs",
       "mode": "0000644",
-      "sha256": "ccfb5d3e85fd6bd34acc78d510edf20d037d344eca58706f3e3130fa6dce611c"
+      "sha256": "bcf19d27a76fd9fbafc3791f6a46d9636453427dc1c50940069673781eb817bc"
     },
     {
       "path": "tests/access_requests_invite.mjs",
@@ -11227,7 +11257,7 @@
     {
       "path": "tests/government_ownership_scope.mjs",
       "mode": "0000644",
-      "sha256": "76b81db7769290d5ef5c26ece86ce0610c5aef6c8984ffdd54a6340db66db3bc"
+      "sha256": "a05a1aaec7b6924bc1653307f921b16ec9517191bf51956c968c4d53eec0e988"
     },
     {
       "path": "tests/government_page_gates.mjs",

package/clients/bongos-client/bongos-client.global.js

@@ -899,7 +899,7 @@ function createClient(opts = {}) {
       getTasksId: (args) => request("GET", "/tasks/{id}", { hasBody: false }, args),
       // PATCH /tasks/{id} — rank: metic+archon — PATCH /tasks/:id
       patchTasksId: (args) => request("PATCH", "/tasks/{id}", { hasBody: true }, args),
-      // POST /tasks/{id}/abandon — rank: metic+archon — POST /tasks/:id/abandon
+      // POST /tasks/{id}/abandon — rank: any-builder — POST /tasks/:id/abandon
       postTasksIdAbandon: (args) => request("POST", "/tasks/{id}/abandon", { hasBody: true }, args),
       // POST /tasks/{id}/attest-gate — rank: any-builder — POST /tasks/:id/attest-gate
       postTasksIdAttestGate: (args) => request("POST", "/tasks/{id}/attest-gate", { hasBody: true }, args),

package/clients/bongos-client/index.cjs

@@ -898,7 +898,7 @@ function createClient(opts = {}) {
       getTasksId: (args) => request("GET", "/tasks/{id}", { hasBody: false }, args),
       // PATCH /tasks/{id} — rank: metic+archon — PATCH /tasks/:id
       patchTasksId: (args) => request("PATCH", "/tasks/{id}", { hasBody: true }, args),
-      // POST /tasks/{id}/abandon — rank: metic+archon — POST /tasks/:id/abandon
+      // POST /tasks/{id}/abandon — rank: any-builder — POST /tasks/:id/abandon
       postTasksIdAbandon: (args) => request("POST", "/tasks/{id}/abandon", { hasBody: true }, args),
       // POST /tasks/{id}/attest-gate — rank: any-builder — POST /tasks/:id/attest-gate
       postTasksIdAttestGate: (args) => request("POST", "/tasks/{id}/attest-gate", { hasBody: true }, args),

package/clients/bongos-client/index.d.ts

@@ -399,7 +399,6 @@ export interface PostSsoTokenRequest { client_id: string; client_secret: string;
 export interface PostSsoTokenResponse { github_id: unknown; github_login: unknown; display_name: unknown; avatar_url: unknown }
 export interface PostTaskRecommendationsRequest { task_id: number; recommended_to: number; reason: string }
 export interface PostTaskRecommendationsResponse { ok: boolean; recommendation: unknown }
-export interface PostTasksIdAbandonRequest { reason?: string }
 export interface PostTasksIdAttestGateRequest { head_sha: string }
 export interface PostTasksIdAttestGateResponse { ok: boolean; attested: unknown; reason: unknown }
 export interface PostTasksIdConfirmRequest { verified?: unknown }
@@ -1262,8 +1261,8 @@ export interface BongosClient {
     getTasksId(args?: RequestArgs): Promise<ApiResponse>;
     /** PATCH /tasks/{id} — rank: metic+archon */
     patchTasksId(args?: RequestArgs & { body?: PatchTasksIdRequest }): Promise<ApiResponse>;
-    /** POST /tasks/{id}/abandon — rank: metic+archon */
-    postTasksIdAbandon(args?: RequestArgs & { body?: PostTasksIdAbandonRequest }): Promise<ApiResponse>;
+    /** POST /tasks/{id}/abandon — rank: any-builder */
+    postTasksIdAbandon(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /tasks/{id}/attest-gate — rank: any-builder */
     postTasksIdAttestGate(args: RequestArgs & { body: PostTasksIdAttestGateRequest }): Promise<PostTasksIdAttestGateResponse>;
     /** POST /tasks/{id}/confirm — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -895,7 +895,7 @@ export function createClient(opts = {}) {
       getTasksId: (args) => request("GET", "/tasks/{id}", { hasBody: false }, args),
       // PATCH /tasks/{id} — rank: metic+archon — PATCH /tasks/:id
       patchTasksId: (args) => request("PATCH", "/tasks/{id}", { hasBody: true }, args),
-      // POST /tasks/{id}/abandon — rank: metic+archon — POST /tasks/:id/abandon
+      // POST /tasks/{id}/abandon — rank: any-builder — POST /tasks/:id/abandon
       postTasksIdAbandon: (args) => request("POST", "/tasks/{id}/abandon", { hasBody: true }, args),
       // POST /tasks/{id}/attest-gate — rank: any-builder — POST /tasks/:id/attest-gate
       postTasksIdAttestGate: (args) => request("POST", "/tasks/{id}/attest-gate", { hasBody: true }, args),

package/docs/adr/0297-a-tasks-creator-may-retire-it.md

@@ -0,0 +1,128 @@
+# ADR 0297 — A task's creator may retire it, and that is the ownership axis's first route
+
+**Status:** accepted · **Date:** 2026-09-16 · **Task:** [task 1002443](https://cloudbongos.com/builders#/task/1002443) (goal 1000095)
+
+## Context
+
+The owner, 2026-07-25: *"Each task should have a creator, the creator of that task
+should be able to abandon that task directly inside of the UI."*
+
+The first half shipped elsewhere and earlier. `migrations/core_227_task_created_by.sql`
+([task 1003278](https://cloudbongos.com/builders#/task/1003278), goal 1000072) added
+`tasks.created_by` — nullable, no backfill, indexed, with the two `SELECT t.*` views
+rebuilt so the column actually reaches the claimable feed — and `createTask` has
+threaded the caller through ever since. This ADR is only about the second half, which
+had not moved: **retiring a task was a rank power and nothing else.**
+
+`POST /tasks/:id/abandon` gated on `task.abandon`, floor `metic`
+([ADR 0152](0152-metic-task-abandonment.md), archon before that under
+[ADR 0090](0090-metic-task-authoring.md)). So a builder below Metic could file a
+task and then could not withdraw it. They had to ask someone with triage authority to
+retire a proposal that was theirs in the first place — the same shape as the goal
+membership problem [ADR 0106](0106-goal-owner-manager-authority.md) fixed, and
+for the same reason: **the rule is about whose row it is, and a rank cannot say that.**
+
+The permission model had already grown the vocabulary for this and had never used it.
+[ADR 0151](0151-governance-permissions-as-atom-ranks-as-roles.md) §3 defines an **ownership axis** —
+a key declared `scope: 'own'` is *parameterized by a concrete row*, so holding it
+authorizes nothing until a handler that has loaded that row supplies its owner. R100
+made `requirePermission` refuse an own-scoped key outright, precisely so `.own` could
+never degrade into `.any`, and recorded that **zero call sites passed one**. The
+resolver shipped `authorizeOwned` / `authorizeOwnedOrAny`; six keys were declared
+own-scoped; not one route decided anything with them. This is that axis's first real
+consumer.
+
+## Decision
+
+**Two authorities reach the abandon transition, and only one of them is rank-shaped.**
+
+| key | floor | reaches |
+|---|---|---|
+| `task.abandon` | `metic` | any task, any creator — triage authority, unchanged from ADR 0152 |
+| `task.abandon.own` | `xenos` | a task you created, while it is still `backlog` / `ready` / `blocked` |
+
+The route is therefore `requireBuilder` plus an in-handler decision — the shape
+`POST /goals/:id/members`, `PATCH /goals/:id/members/:builderId` and
+`PATCH /inbox/:id/body` already use, and the shape `requirePermission` structurally
+cannot express. Its rank pin moves `metic+archon` → `any-builder`, whose job becomes
+catching an accidental **tightening** back to a rank floor as loudly as it catches a
+gate removal.
+
+**The two facts are resolved in two different places, on purpose.** Authority here is a
+conjunction drawn from two sources, and folding them together loses one:
+
+- the **rank fact** — does this builder hold the key — is request-scoped, so it resolves
+  in the route before the transaction opens: once, uncached, per
+  [ADR 0016](0016-trust-boundary-server-enforced-permissions.md);
+- the **owner fact** — is this row theirs — is a column that can change under us, so it
+  is evaluated *inside* `abandonTask`'s existing `FOR UPDATE` transaction, through a new
+  optional `authorize` callback. `created_by` joins the locked `SELECT`, so the predicate
+  and the `UPDATE` read the same row version.
+
+Reading `created_by` in the route would be a TOCTOU window — the task can be
+re-attributed, claimed or shipped between the check and the write. Resolving permissions
+inside the transaction would hold a row lock across a second pool acquire, which under a
+saturated pool is a deadlock. Splitting them is what makes the decision both **fresh**
+and **race-free**, and it is why the callback is documented as pure and DB-free rather
+than merely happening to be.
+
+**The decision itself is a pure module**, `modules/lifecycle/abandon-authz.js`, following
+`goal-route-authz.js` and `shouldRefuseSessionClaim`. Every branch is pinned by a
+DB-free unit test instead of only through a live route, and the hall's display hint and
+the server's verdict are demonstrably reading one rule.
+
+**A creator's window is narrower than a Metic's, and stops at the grader.**
+`backlog` / `ready` / `blocked` only. Past that a retire is a correction to the ledger
+rather than an author changing their mind, so `completed` and `confirmed` stay with the
+cross-owner authority. `active` is excluded here and again by the active-claim guard.
+Nothing is subtracted from `task.abandon`: a Metic keeps every status they could reach
+before, and a test pins that the new window never becomes a ceiling on the old power.
+
+**`counterpart: ['task.abandon']` is declared, not derived.** Same `act` verb, same
+`task` resource, so the cross-owner key genuinely subsumes retiring your own and
+`authorizeOwnedOrAny` may admit on it without consulting the owner. The verb is `act`
+rather than `manage` deliberately: `manage` is the full-control verb and would silently
+dominate every future narrower `task.*.own` key — the verb-blind escalation
+[task 1003195](https://cloudbongos.com/builders#/task/1003195) closed, where a
+`memory.read.any` grant satisfied a `memory.manage.own` write.
+
+## Consequences
+
+**A null creator belongs to nobody, and that is load-bearing.** Every task filed before
+`core_227` (~1,357 of them) plus the seed, restock and Discord-bug vectors carry
+`created_by IS NULL`. The owner comparison is the government resolver's own — injected,
+never re-implemented, because a duplicated ownership comparison is exactly how one
+quietly widens — and it matches `null`, `''`, objects and `NaN` against nothing. Were
+that to slip, one xenos-floor grant would open every historical task at once. It is the
+single widest failure mode here and has its own test.
+
+**The hall shows the control to a creator, and pre-answers the refusals in words.** A
+task's creator sees "Retire this task…" on their own record; outside the window they are
+told why rather than shown a button that would 403. The list of statuses is restated in
+the browser file because it cannot `require` the server's, and is marked as a display
+mirror the server re-decides under a lock.
+
+**Fail-closed at every new branch.** A missing `government` port denies (its absence
+means authority cannot be *established*, and admitting there would make disabling a
+module a privilege escalation — the inversion ADR 0016 exists to prevent); a throwing
+resolver denies; anything that is not an explicit `{ ok: true }` denies; `authorize`
+runs *before* the already-abandoned idempotent return and before the shipped and
+active-claim guards, so an unauthorized caller cannot probe a row's state through a
+200 or distinguish the 409s.
+
+**No guard was removed.** Shipped stays immutable, an active claim still has to be
+released first, the re-abandon is still idempotent, `/promote` still restores, and the
+audit_log entry is unchanged on both paths.
+
+**What this does not do.** It does not give creators any other power over their own
+tasks — editing, promoting and dependency management keep their Metic floor, and
+widening those is a separate decision. It does not touch `task.merge`, which reuses
+`abandonTask` under the hood but is a triage judgement about duplicates rather than
+authorship. And it does not backfill attribution: the control simply does not appear on
+tasks that predate `core_227`, which is the honest outcome of that migration's own
+refusal to guess.
+
+**Revisit if** a second `task.*.own` key appears (the `act` verb choice is what keeps
+that safe, and a wider relation would need a `VERB_DOMINANCE` entry stating why), or if
+goal leadership should confer shaping authority — deliberately left conferring nothing
+here, as [task 1002858](https://cloudbongos.com/builders#/task/1002858) also left it.

package/docs/adr/README.md

@@ -388,3 +388,4 @@ This keeps the decision history honest and traceable.
 | 0294 | [**CLI sessions do not expire; revocation is the whole remedy** ([task 1003956](https://cloudbongos.com/builders#/task/1003956), goal 1000110 — owner request 2026-09-16, after a three-week gap signed him out). A `bongos` sign-in died after 24h idle: `createSession` defaulted a null `expiresAt` to `now()+SESSION_TTL_MS` and `lookupSession` rewrote `expires_at = now()+24h` on every request. **This is the third argument about the number and the first about the mechanism** — V3.R38 ([task #259](https://cloudbongos.com/builders#/task/259), migration 035) set 1h, V3.R90 ([task 1000400](https://cloudbongos.com/builders#/task/1000400)) widened it to 24h because 1h "kicked builders out over lunch", and each round shortened the nuisance while leaving the mechanism alone. The hygiene case for keeping it (criterion C9 — bound a leaked token in the mode-0600 plaintext session file) **does not survive contact with refresh-on-use**: a leaked token is by definition one somebody is using, and every use rolled the expiry forward another day, so the timer could only ever fire on a session gone quiet — the legitimate holder stepping away. The control was aimed at attackers and landed exclusively on users. [ADR 0206](0206-own-scoped-session-revocation-no-absolute-ceiling.md) had already written half of this down ("a CLI bearer in daily use is, in practice, immortal") without drawing the conclusion. Decision: **CLI sessions carry no expiry and last until revoked.** `createSession` records `expires_at = NULL` when the caller names none — every such call site is `source: 'cli'` (device flow, federated sign-in, hall re-issue, dev-box pair) — and `lookupSession` still bumps `last_used_at` but rolls `expires_at` forward only via `CASE WHEN expires_at IS NULL THEN NULL ELSE …`; **without that CASE the first request after sign-in re-mints the very timeout this removes.** Migration `core_243` clears `expires_at` on live unrevoked `source='cli'` rows, so the change reaches existing sessions instead of charging every builder one last forced re-auth on deploy day — migration 035's grace inverted, for the reason 035 gave. **Browser sessions are untouched** (they pass an explicit 30 days, so the new default never reaches them, and the migration's `source='cli'` filter is its whole safety property — `lookupSession` only rolls an expiry it can already see, so a web row cleared by mistake stays cleared forever). `SESSION_TTL_MS` survives as the roll-forward window for rows that have an expiry, no longer as a default. The accepted cost, stated plainly: **a leaked CLI token is valid until revoked** — smaller in practice than it sounds, since under refresh-on-use an actively-used leak was already immortal, so what changes is the *abandoned* copy on a dead laptop. The remedy is ADR 0206's own-scoped revoke, immediate where a TTL is next-day, and that ADR's visibility half (`created_at` beside `last_used_at`) is now the primary control rather than a nice-to-have. Nothing about rank moves: `setBuilderRank` still sweeps on demotion and `requireBuilder` still refuses a deactivated builder on the hot path, neither consulting `expires_at`. Rejected: widening the TTL a fourth time; keeping it and making re-auth cheaper (already built — [task 1000401](https://cloudbongos.com/builders#/task/1000401), [task 1000504](https://cloudbongos.com/builders#/task/1000504) — the friction shrank, the interruption stayed); an absolute `created_at` ceiling (ADR 0206's reasoning holds unchanged); dropping the column (load-bearing for web); a blanket `UPDATE … SET expires_at = NULL`. Revisit for machine principals nobody will notice a leak on, a compliance maximum, or long-dead sessions accumulating faster than people prune them.](0294-cli-sessions-do-not-expire.md) | auth / account security / CLI |
 | 0295 | [**The registry is the witness the publish lane cannot be** ([task 1003916](https://cloudbongos.com/builders#/task/1003916), goal 1000090). On 2026-09-13 eight publish runs failed over three hours and NOTHING reported it; it was found by a person idly reading the npm version list. Task 1003914 fixed the lossiness and left the silence, which is structural: a failed run is one red row nobody watches, `main` self-heals on the next merge and **erases the evidence**, and the lane's own verdict step writes to a job summary no one reads. Same shape as the nightly upgrade sweep that died reporting `failed=0`. **Decision: a separate reader compares what the lane ANNOUNCED (release commits) against what the registry HOLDS**; the difference is a phantom. The publisher infers from git because OIDC trusted publishing carries no read credential — **that never bound a reader**, and since task 1003872 the package is public, so an anonymous read needs none. Keeping witness and publisher separate IS the point. Daily not hourly (billable minutes, against a failure measured in hours), cadence pinned to the cron by `routine-schedule.js`; deliberately NOT on the session-start path (a third-party call behind a hook timeout). Healthy days are SILENT in Discord — findings to stdout, the all-clear to stderr — because a channel of reassurances stops being read. Two false-alarm sources, each guarded: a closed incident is permanent history (a 3-day window, by TIME not commit count, which a release burst would outrun), and **npm acknowledges a publish before its listing shows it** — found by RUNNING the check, which flagged 1.19.794 fifteen minutes after a publish whose log ended `published @bongos/core@1.19.794` and whose per-version endpoint answered 200; hence a 30-minute grace period plus per-version confirmation, with the listing only ever nominating suspects. A failed read throws rather than reading as "nothing missing". Proven by replaying the REAL outage from git + the live registry, not a synthetic failure. Does NOT detect a lane that stopped being triggered.](0295-the-registry-is-the-witness-the-lane-cannot-be.md) | release / observability |
 | 0296 | [**A role speciality is data over three existing surfaces, not a fourth mechanism** ([task 1003855](https://cloudbongos.com/builders#/task/1003855), goal 1000095). A craft says HOW you work; nothing said what you work ON. A speciality is a named bundle of knowledge, skills and an interaction contract sitting under a craft — an ideator with an Economics speciality. **Decision: it is DATA, not an ADR 0083 code module** — a subject-matter expert authors one, and requiring them to ship a package puts the mechanism out of reach of exactly the person it exists for. It layers over three surfaces that already exist (discipline-modes.json, the `behavior_prefs.interaction` contract path, the manifest contribution seam); only the knowledge bundle is new. The contract **rides the existing GET /me -> Conductor injection path rather than adding a second one**, and is CRAFT-SCOPED: the hook injects only the contract matching the claim in hand (which needed `t.discipline` on the active-claims read), and with no claim there is no craft and **nothing is injected** — silence beats guessing which expertise applies. Training is two-fold per the owner's 2026-09-17 ruling: documents they supplied, plus learnings captured from sessions worked in it (pointing at existing `learnings` rows, never a second corpus). The corpus is **inventoried, never inlined** — a document may run to 100k chars — so `speciality_documents` joins the recall ingester, because otherwise the contract's "search it with /recall" is a lie whose failure is silent. **`sellable` is recorded with no storefront behind it**: ADR 0107 defers the marketplace and explicitly rejected building one, so the flag captures the owner's decision when they make it and grants nothing — a deliberate partial implementation, recorded rather than silently made. Index scoping errs toward UNDER-sharing: only a public speciality's documents are corpus-wide, because `project` names a set the index cannot express.](0296-a-role-speciality-is-data-over-three-existing-surfaces.md) | roles / modules |
+| 0297 | [**A task’s creator may retire it, and that is the ownership axis’s first route** ([task 1002443](https://cloudbongos.com/builders#/task/1002443), goal 1000095 — owner request 2026-07-25: *"the creator of that task should be able to abandon that task directly inside of the UI"*). Attribution itself shipped earlier and elsewhere (`core_227`, [task 1003278](https://cloudbongos.com/builders#/task/1003278)); what had not moved is that **retiring a task was a rank power and nothing else** — `task.abandon` floors at `metic` (ADR 0152), so a sub-Metic builder could file a task and then could not withdraw their own proposal. The model already had the vocabulary and had never used it: ADR 0151 §3 defines an **ownership axis** where a `scope:'own'` key authorizes nothing until a handler supplies the row's owner, R100 made `requirePermission` refuse such a key outright so `.own` can never degrade into `.any`, and it recorded that **zero call sites passed one**. This is that axis’s first real consumer. **Decision: two authorities, only one rank-shaped** — `task.abandon` (metic, any task) OR new `task.abandon.own` (xenos, a task you created, while it is still backlog/ready/blocked). Route becomes `requireBuilder` + an in-handler decision (the `POST /goals/:id/members` shape), pin `metic+archon`→`any-builder` so it now catches an accidental **tightening** as loudly as a gate removal. **The two facts resolve in two places on purpose:** the RANK fact is request-scoped and resolves before the transaction (uncached, ADR 0016); the OWNER fact is a column that can change under us, so `created_by` joins `abandonTask`’s existing `FOR UPDATE` SELECT and a new optional `authorize` callback decides under that lock. Reading `created_by` in the route would be a TOCTOU window; resolving permissions inside the transaction would hold a row lock across a second pool acquire. The decision is a PURE module (`abandon-authz.js`, the `goal-route-authz.js` precedent) so every branch is pinned DB-free and the hall hint and server verdict provably read one rule. **A creator’s window stops at the grader** — completed/confirmed stay cross-owner, because past the grader a retire is a ledger correction, not an author changing their mind; nothing is subtracted from `task.abandon`, pinned by a test. `counterpart: ['task.abandon']` is declared not derived, verb `act` not `manage` — `manage` would silently dominate every future narrower `task.*.own` key (the verb-blind escalation task 1003195 closed). **A null creator belongs to nobody and that is load-bearing:** ~1,357 pre-`core_227` tasks plus seed/restock/discord vectors are unattributed, so the owner comparison is the government resolver’s own — injected, never re-implemented, since a duplicated ownership comparison is how one quietly widens — and one slip would open every historical task to a xenos grant at once. Fail-closed throughout: a missing `government` port, a throwing resolver, and anything but an explicit `{ok:true}` all deny, and `authorize` runs BEFORE the idempotent already-abandoned return and the shipped/active-claim guards so an unauthorized caller cannot probe a row through a 200. No guard removed. Does NOT widen edit/promote/dependency (still Metic), does not touch `task.merge`, and does not backfill attribution — the control simply does not appear on tasks predating `core_227`.](0297-a-tasks-creator-may-retire-it.md) | authority / lifecycle / ownership |

package/docs/api/openapi.json

@@ -16170,12 +16170,9 @@
           "tasks"
         ],
         "summary": "POST /tasks/:id/abandon",
-        "description": "POST /tasks/:id/abandon — terminal \"retire this task\" transition (task 987). The lifecycle had promote/ship/confirm/resolve but no first-class way to KILL a task that is no longer relevant: the only paths to status='abandoned' were offboarding a builder or a raw SQL UPDATE, so stale/moot tasks lingered in 'ready' as claimable noise. Refuses on a shipped task (immutable history) and on a task with an active claim (release it first); idempotent on an already- abandoned task. The abandon + its `reason` land in audit_log via the writing middleware, so the ledger keeps a record of who retired what. rank: metic+archon — scope removal; the inverse of /promote, and re-ranked to match it (ADR 0152, was archon under ADR 0090). A Metic who may author, shape, and promote work may also retire it: leaving the kill switch an Archon rung higher than the create switch only forced the owner to clean up after the triage they already delegated. Not one-way any more — /promote restores an abandoned task to backlog at the same rank — and the guards below (shipped refused, active claim refused) plus the audit_log entry are unchanged.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `task.abandon` (all required).",
-        "x-rank": "metic+archon",
+        "description": "POST /tasks/:id/abandon — terminal \"retire this task\" transition (task 987). The lifecycle had promote/ship/confirm/resolve but no first-class way to KILL a task that is no longer relevant: the only paths to status='abandoned' were offboarding a builder or a raw SQL UPDATE, so stale/moot tasks lingered in 'ready' as claimable noise. Refuses on a shipped task (immutable history) and on a task with an active claim (release it first); idempotent on an already- abandoned task. The abandon + its `reason` land in audit_log via the writing middleware, so the ledger keeps a record of who retired what. rank: any-builder — DELIBERATELY, and the middleware list is not the whole gate (ADR 0297). Two authorities reach this transition: `task.abandon` (floor metic) retires ANY task, and `task.abandon.own` (floor xenos) retires one you CREATED while it is still backlog/ready/blocked. The second is a predicate over tasks.created_by, which no rank floor can express — the ADR 0151 ownership axis, and this is its first route. requirePermission structurally cannot carry it: an own-scoped key has no unconditional answer and that gate refuses one outright (auth.js, R100), so `.own` can never collapse into `.any`. The two facts are resolved in two places ON PURPOSE. The RANK fact is request-scoped and resolves here, once, uncached (ADR 0016); the OWNER fact is a column that can change under us, so it is evaluated inside abandonTask's FOR UPDATE transaction. Reading created_by here would be a TOCTOU window; resolving permissions in there would hold a row lock across a second pool acquire. Existing guards (shipped refused, active claim refused, idempotent re-abandon) and the audit_log entry are unchanged on both paths.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
         "x-source": "modules/lifecycle/routes/tasks.js",
-        "x-permissions": [
-          "task.abandon"
-        ],
         "parameters": [
           {
             "name": "id",
@@ -16187,23 +16184,12 @@
             "description": "Path parameter `id`."
           }
         ],
-        "requestBody": {
-          "required": false,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PostTasksIdAbandonRequest"
-              }
-            }
-          },
-          "x-validated": true
-        },
         "responses": {
           "200": {
             "description": "Success."
           },
           "400": {
-            "$ref": "#/components/responses/ValidationFailed"
+            "$ref": "#/components/responses/BadRequest"
           },
           "401": {
             "$ref": "#/components/responses/Unauthorized"
@@ -16883,7 +16869,7 @@
           "tasks"
         ],
         "summary": "POST /tasks/:id/merge",
-        "description": "POST /tasks/:id/merge — mark a duplicate task merged into its canonical one (task 1001478 — the /bug-triage counterpart to idea_inbox's merge verdict). Implemented as `abandonTask` plus a target (db.mergeTask, db-ship.js) rather than a new `tasks.status` value — see that function's header for why. Refuses a self-merge, a shipped task, a task with an active claim, a target that doesn't exist, and a target that is itself merged elsewhere (no chains); idempotent when re-merging into the SAME target already recorded. rank: metic+archon — same floor as task.abandon, which this reuses under the hood; a Metic who may retire a task may also say which task it duplicates.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `task.merge` (all required).",
+        "description": "**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `task.merge` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/lifecycle/routes/tasks.js",
         "x-permissions": [
@@ -24021,15 +24007,6 @@
           "recommendation"
         ]
       },
-      "PostTasksIdAbandonRequest": {
-        "type": "object",
-        "properties": {
-          "reason": {
-            "type": "string"
-          }
-        },
-        "additionalProperties": false
-      },
       "PostTasksIdAttestGateRequest": {
         "type": "object",
         "properties": {
@@ -24783,7 +24760,7 @@
     }
   },
   "x-endpoint-count": 390,
-  "x-schema-count": 430,
+  "x-schema-count": 429,
   "x-undocumented-bodies": 9,
   "x-response-schemas": 293,
   "x-generated-by": "scripts/gds/gen-api-docs.js"

package/docs/api-reference.md

@@ -642,7 +642,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/tasks` | `metic+archon` | `version_id`, `title`, `description`, `status`, `touches`, `est_minutes`, `est_cost_usd`, `manual_degree`, `priority`, `automation_tag`, `credits_reward`, `source`, `source_ref`, `value_summary`, `kind`, `discipline`, `parallel_safe`, `newcomer_friendly`, `security_sensitive`, `requires_rank`, `auto_detect_touches`, `criterion_ids`, `module_key`, `goal_id` | Task create/promote/edit (plan/scope mutation) is Metic+ as of ADR 0090 (owner decision 2026-06-26): a Metic who can run idea-triage may … |
 | GET | `/api/bongos/tasks/:id` | `any-builder` | — | single-task read; preserved per CRITICAL §4 (supervisor hot path). |
 | PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `needs_migration`, `description`, `title`, `priority`, `value_summary`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
-| POST | `/api/bongos/tasks/:id/abandon` | `metic+archon` | `reason` | POST /tasks/:id/abandon — terminal "retire this task" transition (task 987). |
+| POST | `/api/bongos/tasks/:id/abandon` | `any-builder` | — | POST /tasks/:id/abandon — terminal "retire this task" transition (task 987). |
 | POST | `/api/bongos/tasks/:id/attest-gate` | `any-builder` | `head_sha` | POST /tasks/:id/attest-gate — body: { head_sha }. |
 | POST | `/api/bongos/tasks/:id/confirm` | `any-builder` | `verified` |  |
 | GET | `/api/bongos/tasks/:id/criteria` | `any-builder` | — | GET /tasks/:id/criteria — the criteria this task gates (with live "Cn" + source). |
@@ -654,7 +654,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | PUT | `/api/bongos/tasks/:id/dependencies` | `metic+archon` | `depends_on_task_ids` | PUT /tasks/:id/dependencies — replace the full dep set. |
 | DELETE | `/api/bongos/tasks/:id/dependencies/:depId` | `metic+archon` | — | DELETE /tasks/:id/dependencies/:depId — removes the edge. |
 | POST | `/api/bongos/tasks/:id/grade` | `any-builder` | `subagent_output`, `signals`, `committed_files`, `diff_hash` | GDS-V3 task V3.R18 (task 209). |
-| POST | `/api/bongos/tasks/:id/merge` | `metic+archon` | `into_task_id`, `reason` | POST /tasks/:id/merge — mark a duplicate task merged into its canonical one (task 1001478 — the /bug-triage counterpart to idea_inbox's m… |
+| POST | `/api/bongos/tasks/:id/merge` | `metic+archon` | `into_task_id`, `reason` |  |
 | POST | `/api/bongos/tasks/:id/override-request` | `any-builder` | `rationale` | POST /tasks/:id/override-request — V3.R74 (task 293). |
 | POST | `/api/bongos/tasks/:id/promote` | `metic+archon` | — | backlog→ready promotion; scope mutation; ADR 0090 (was archon). |
 | POST | `/api/bongos/tasks/:id/publish-branch` | `any-builder` | `branch`, `head_sha`, `bundle_b64`, `value_summary` |  |

package/docs/canonical-permissions.md

@@ -76,7 +76,9 @@ forming the ordered claim-gate tier **`xenos` (1) < `thetes` (2) < `metic` (3) <
   links (`/tasks/:id/dependencies`, `/tasks/:id/criteria`) — the reasoning being that a rank trusted to
   *triage* ideas is trusted to *seed* the work they become. **As of [ADR 0152](adr/0152-metic-task-abandonment.md)
   (owner decision 2026-07-27) a Metic may also retire work** — `POST /tasks/:id/abandon` — and undo a
-  mis-retire, since `POST /tasks/:id/promote` now also restores `abandoned → backlog`. **Still cannot**
+  mis-retire, since `POST /tasks/:id/promote` now also restores `abandoned → backlog`. That rank power
+  is unchanged by [ADR 0297](adr/0297-a-tasks-creator-may-retire-it.md), which adds a SECOND way to
+  reach the same route rather than narrowing this one (see the ownership-axis note below). **Still cannot**
   set rank, close versions, grader-bypass confirm, or author cross-tier `POST /dependencies` / goal-scope edges
   ([ADR 0086](adr/0086-goal-scoped-work-hierarchy.md)) — those stay Archon. A builder reaches Metic
   only by deliberate Archon promotion (`PATCH /builders/:id/rank`).
@@ -169,6 +171,33 @@ or missing ranks fail closed.
   `tasks/:id/{dependencies,criteria}` CRUD — moved to Metic+ in [ADR 0090](adr/0090-metic-task-authoring.md),
   and **task retirement** — `POST /api/gds/tasks/:id/abandon`, plus the `abandoned → backlog` restore on
   `/promote` — in [ADR 0152](adr/0152-metic-task-abandonment.md) (see the Metic+Archon bullet).
+
+  > **The ownership axis: a rule about WHOSE row, which no rank can express** ([ADR 0297](adr/0297-a-tasks-creator-may-retire-it.md),
+  > owner request 2026-07-25). `POST /api/gds/tasks/:id/abandon` is the first route decided on the
+  > [ADR 0151](adr/0151-governance-permissions-as-atom-ranks-as-roles.md) §3 ownership axis, and so the first whose
+  > middleware list is deliberately **not** the whole gate. Two authorities reach it:
+  >
+  > | permission | floor | reaches |
+  > |---|---|---|
+  > | `task.abandon` | `metic` | any task, any creator — the ADR 0152 triage power, unchanged |
+  > | `task.abandon.own` | `xenos` | a task **you created** (`tasks.created_by`), while it is still `backlog`/`ready`/`blocked` |
+  >
+  > The route is `requireBuilder` + an in-handler decision, the same shape as
+  > `POST /goals/:id/members` and `PATCH /inbox/:id/body`. `requirePermission` **cannot** carry an
+  > own-scoped key: it has no unconditional answer, so that gate refuses one outright (R100) precisely so
+  > `.own` can never collapse into `.any`. Its `route-rank-check.js` pin is therefore `any-builder`, whose
+  > job is to catch an accidental **tightening** back to a rank floor as loudly as a gate removal.
+  >
+  > **The DB still enforces, and now under a row lock.** The rank half resolves per request, uncached
+  > (ADR 0016, unchanged); the owner half is read inside `abandonTask`'s `FOR UPDATE` transaction, so the
+  > predicate and the write see one row version. The decision itself is pure and unit-tested in
+  > `modules/lifecycle/abandon-authz.js` — the hall only *displays* the control, and is never the wall.
+  >
+  > **A creator's window stops at the grader.** `completed`/`confirmed` stay cross-owner-only: past the
+  > grader a retire is a correction to the ledger, not an author changing their mind. The existing guards
+  > are untouched for both paths — never a shipped task, never one with an active claim. And a task with
+  > `created_by IS NULL` (everything filed before `core_227`, plus the seed/restock/Discord vectors)
+  > belongs to **nobody**: the control never appears on it, and no ownership grant can reach it.
   `POST /api/gds/done-when/:id/unsatisfy` **was** Archon-only and moved to Metic in ADR 0157, superseding
   [ADR 0154](adr/0154-goal-owner-criterion-authoring.md)'s "the backward ratchet stays Archon" carve-out;
   satisfy and unsatisfy remain separate permissions, so confirming a criterion still never confers