@bongos/core 1.19.936 → 1.19.938

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.936",
-  "core_contract": "1.19.936",
-  "source_commit": "c584621a2bdc28b094881d2a51384398c3062cfb",
+  "core_version": "1.19.938",
+  "core_contract": "1.19.938",
+  "source_commit": "8dd584dae92b44faa1bbed125048a59789ad8535",
   "source_ref": "HEAD",
-  "built_at": "2026-09-21T04:31:32.976Z",
+  "built_at": "2026-09-21T18:26:08.361Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 511,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2329,
+    "functional_verbatim": 2334,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2866,
-  "tree_sha256": "04c64a49cb815692ebbc6ee7382d47e4a296616b707d8e566e0894bf52364655",
+  "file_count": 2871,
+  "tree_sha256": "fbde3b87a4c049acf1a6d2075d3bf614fd92e74ffdf94d5cb9f96ac8d80439f5",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "56d3e08ff4e4893d4d6b30c9292f2c1b0730deb2bff99ea64d7d5df7971995c1"
+      "sha256": "ce2ce4bd71f9ea04c46e8c1f4e7173a941458162be0e3b32759aa0c5f9d97297"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "7cfab2d88dc9d36fc57334db3b43c0c31b3656e2bff7ebff11d0c18b12a61850"
+      "sha256": "47d36e3b0c228706df44c4a91d5b22bd6005a345c95d8ddda2650bf9b8170242"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "8a5ed1946540c3adb30ff986f1845bdc65b5a6e441698723f8c31eb8e1374ef2"
+      "sha256": "5368fb77dc06a2ea22ab2db87ec3ac89a9857388bc12117c31dc327e598f63a1"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "61b51506067b743fef5b475bf3b61914054d18474c0f8368d0bc4520a591ab6d"
+      "sha256": "5d076131337103c34e8b0e46cd613ae898dfa9edeffa6104617f046eb4f651b0"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "7676427e266c9528793e47c3c9431c329b67f0b29edff522724f430b4c29a37f"
+      "sha256": "2e7178e059cb520cf0509a46151624bb00160cc2cd263582015980576b98482d"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1897,7 +1897,7 @@
     {
       "path": "docs/adr/0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md",
       "mode": "0000644",
-      "sha256": "2697c7cdca6d518d7ca7d84cf354ca92f264bf641e0b178bfa038f83878d5963"
+      "sha256": "d36d2333c07107c09d7431b4f49ceaafe51231dd4646dbb13bb081d0b2b63a33"
     },
     {
       "path": "docs/adr/0282-a-module-that-spends-for-its-callers-declares-a-payer-and-the-core-refuses-it-without-one.md",
@@ -2112,12 +2112,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "eb6f7b98ac6b54bdfb35adf224c47de318d5c07aa064276d98bb023633a79ded"
+      "sha256": "d72a950df3fa37b7834a167d60e621434a0d0806f1a3f298b079d0538254be50"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "257966d20d4076a5b3e96e95f1966971a7df6a3218212ee57e980b9adc89a83f"
+      "sha256": "f89f852f211ffee8ccc13f4331fc867837eae6b6ac2a0a24292abc4537aa9591"
     },
     {
       "path": "docs/architecture.md",
@@ -2677,7 +2677,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "cce34badfbc776279489f414db3459706aeb2433726a0d4b1e9d7dd84c5f4731"
+      "sha256": "91500af9d7c272807c97d945b549ae8cbd0c6f30904e9c90b55c1a4c990451c3"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2897,7 +2897,7 @@
     {
       "path": "docs/recipes/self-host.md",
       "mode": "0000644",
-      "sha256": "a5c98b8ee01461669a5f4ee5fa361e85e11915eb8326e060c4cf20841c35c07e"
+      "sha256": "48dbce2966702987cbb9de6639ceb1e63ab3c7166e759bf93df06bd9f5875a88"
     },
     {
       "path": "docs/recipes/server-bring-up.md",
@@ -4317,7 +4317,7 @@
     {
       "path": "modules/government/board.js",
       "mode": "0000644",
-      "sha256": "22b5c7a2f2b41faa222281e1ad9acb1aebed074b065de892c7550f628900d6c2"
+      "sha256": "cce76edcf96a8ece8bb3321f5edb505e0e93acae96babe7169da607fd1888f3b"
     },
     {
       "path": "modules/government/catalog.js",
@@ -4332,7 +4332,7 @@
     {
       "path": "modules/government/db.js",
       "mode": "0000644",
-      "sha256": "10363058d52e097ac4e0f8cdb3957062d446840f42c2ca65ef95b541b6e27aad"
+      "sha256": "dc56a5747bb5275ba372dc297cce585219c649984778a924ce22bab7249889a8"
     },
     {
       "path": "modules/government/membership-predicate.js",
@@ -4459,6 +4459,11 @@
       "mode": "0000644",
       "sha256": "7603087ac279d05eb2c69527557035c72c3bbb1510c16fdb2230b2e377f0df74"
     },
+    {
+      "path": "modules/government/migrations/government_018_passed_items_index.sql",
+      "mode": "0000644",
+      "sha256": "c85b1615c66ae68b630c727faa6ab56358a35dea37a0c2da507d11d3909176fd"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -4492,7 +4497,7 @@
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "6c38766b7b2a76a5fc035ad4eefce41fe45739730e70fb26b40546bded7b66b9"
+      "sha256": "40c2cd95481690b88a065afad62636ae732845a5dc81f082ebd623f7fb060de4"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
@@ -4802,7 +4807,7 @@
     {
       "path": "modules/hall-ui/public/deploy.js",
       "mode": "0000644",
-      "sha256": "e5a689447524c8c3460a2a649bea3673c958c6ec8607ad41144c575d29d142d0"
+      "sha256": "de280baf7432be56c67a65681a6e5d5af7146464271dec547d5bd6d45be2f37a"
     },
     {
       "path": "modules/hall-ui/public/diagram-viewer.css",
@@ -5462,7 +5467,7 @@
     {
       "path": "modules/ideas/inbox.js",
       "mode": "0000644",
-      "sha256": "b56a305c8c3b269e6a273b8f1c56da745bc91a57b1028f5c1d2ee33735e3c68d"
+      "sha256": "da8ac68f553980fef162b7d9fbc85481fd60cd885954cf316894a132f845ef6c"
     },
     {
       "path": "modules/ideas/landing-preview.js",
@@ -5514,10 +5519,15 @@
       "mode": "0000644",
       "sha256": "53c66f25e685931e73334d6b904f7d3c0f3838a15f160bd5387864ef27836aa7"
     },
+    {
+      "path": "modules/ideas/migrations/ideas_010_goal_ratification.sql",
+      "mode": "0000644",
+      "sha256": "7ba109e2f5415daec8b0767ecfabb110fc02d8944f4e6cc0664ca2d205e05480"
+    },
     {
       "path": "modules/ideas/module.json",
       "mode": "0000644",
-      "sha256": "c23099e7c3a4768dc68778292c42988ee21234ed81d1832347e9fd272f6137d9"
+      "sha256": "a869f9dec25e003006a495b3fbee45ac99c80b306cec7f16808693d70133e717"
     },
     {
       "path": "modules/ideas/pollers/descent-writer.js",
@@ -5532,7 +5542,7 @@
     {
       "path": "modules/ideas/ratify.js",
       "mode": "0000644",
-      "sha256": "2988a93940cd1eba73fb0c9e04f8326108466ba81901f86b3768b29115f17237"
+      "sha256": "05789550a8e6345f27ac78ccef3ac93a7837e99a6b067871189b1e983b4d374f"
     },
     {
       "path": "modules/ideas/reads.js",
@@ -5549,6 +5559,11 @@
       "mode": "0000644",
       "sha256": "da91fe0641109b3b8adc0cca44480337f15cbd481b590f42d022e9eaa78654b7"
     },
+    {
+      "path": "modules/ideas/routes/ratify-goal.js",
+      "mode": "0000644",
+      "sha256": "92c10dbffef40038dac64ea646372e3fcd1c70c5d2bda1d731ddbdcd508d9181"
+    },
     {
       "path": "modules/ideas/routing.js",
       "mode": "0000644",
@@ -5562,7 +5577,7 @@
     {
       "path": "modules/ideas/templates.js",
       "mode": "0000644",
-      "sha256": "deef66d514a2ea090274acc05e85ffefdfd6c0bf0279b64f7bee16af7b2e1471"
+      "sha256": "345cbf4d87be780ee98c33042d2ec914b40bceeab6122a67a00a3852580b681b"
     },
     {
       "path": "modules/ideas/trail-descent.js",
@@ -5769,6 +5784,11 @@
       "mode": "0000644",
       "sha256": "c22a0782ddf7a93deb40f700a2afab15a313925647bbdf424db777da5aa29aa1"
     },
+    {
+      "path": "modules/lifecycle/goal-from-idea.js",
+      "mode": "0000644",
+      "sha256": "21d091ef596bc67f08a4f0785d17eaddf47d2da702219ccd5af6164413944428"
+    },
     {
       "path": "modules/lifecycle/goal-rollup.js",
       "mode": "0000644",
@@ -5802,7 +5822,7 @@
     {
       "path": "modules/lifecycle/lifecycle.js",
       "mode": "0000644",
-      "sha256": "41ef55efff7f334ee8b19490f03944ca25f22454c718dfb81445539bc6a77aa4"
+      "sha256": "74e09c7d1a978da826f99cff9e863b1051ab19a6437ae398a1e83ec8293e794f"
     },
     {
       "path": "modules/lifecycle/merge-lock.js",
@@ -6477,7 +6497,7 @@
     {
       "path": "modules/provisioning/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "291a3765197f9429c70dd240fe5cdfa72a245ad3698c822032e71bb88999d533"
+      "sha256": "f5556a75b34977d0c46d4c9cf95383e4f57088c137e1c29c5b87211a5f159451"
     },
     {
       "path": "modules/provisioning/credential-preflight.js",
@@ -6647,7 +6667,7 @@
     {
       "path": "modules/provisioning/routes/core-upgrade.js",
       "mode": "0000644",
-      "sha256": "7447a5eb37dc120e14fa6b5fb81c574ec951b9a46ed126d5c954c63b03bc6b6d"
+      "sha256": "8ceb0707b3bfe16e308cdf3034b034bcea8b5e266bcfa1d0e47bd53a61392990"
     },
     {
       "path": "modules/provisioning/routes/disconnect.js",
@@ -7982,12 +8002,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "50c742fdaa94ee84b79406b7654fc544f6c355c71e5664e6431785c8fbe882b3"
+      "sha256": "5deecad0d887fedac8dedc460fe2ad83990dbd7955fde8cc46e5a88f550f45ba"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "62828bf612cefb41d1c28f7d331d711d2cc2ed5575f6ce506b410c007e47bccb"
+      "sha256": "59e6e64dcbb6313c3d7db30d0a5466958207792de738adc0c47151a3f5eed45b"
     },
     {
       "path": "public-docs/index.html",
@@ -8117,7 +8137,7 @@
     {
       "path": "scripts/gds/audit-authorship.sh",
       "mode": "0000644",
-      "sha256": "27b436b82d129f956ddb956efdca9226f31602a8f22b4099b9e6b0ffeb49313e"
+      "sha256": "f3aab6f76580d418c7920ef54a37c9577c057f220f43720a8f151487e3ef2841"
     },
     {
       "path": "scripts/gds/audit-deps.js",
@@ -8407,7 +8427,7 @@
     {
       "path": "scripts/gds/db-backup-nightly.sh",
       "mode": "0000644",
-      "sha256": "5e8b7ebfe0b82a426e229a256daf231cb597d8e1df2b908c528a0ed0a67066a5"
+      "sha256": "f021271073004e3c80a89e82626dde9f2b38ce9760b7bbadb51190f97a648f5d"
     },
     {
       "path": "scripts/gds/db-backup-offsite.sh",
@@ -8722,7 +8742,7 @@
     {
       "path": "scripts/gds/instance-apex.js",
       "mode": "0000644",
-      "sha256": "fcb59a4eda007d98179dfe54956fcce4ff07c11ca941ed6dea41b38c0daca421"
+      "sha256": "7b2402543c3b1eadbafc14907e6dc6689b434ac65fb9c709115dd81a92eb13eb"
     },
     {
       "path": "scripts/gds/key-card.js",
@@ -8927,12 +8947,12 @@
     {
       "path": "scripts/gds/provision-config.js",
       "mode": "0000644",
-      "sha256": "68882e5e600881c0e3a96d4b84a9ad38dd77c3216a09a7886a263cfe40044f1e"
+      "sha256": "6905238b164d1fbd47abbc1f495e6f1bf2de58ed26545853f8aa92f199dc78e5"
     },
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "8ad61c85e0cf3f515fbd970fedcd6c33871d70e4dd42c36cb275ae907e31b655"
+      "sha256": "4a84f48518a6427e95bf23e273865b6b2753489b40737b9256191fd2a65562e1"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -8947,7 +8967,7 @@
     {
       "path": "scripts/gds/provision-process.js",
       "mode": "0000644",
-      "sha256": "210d5135b157363499dc34bb8ac34eb7f661a61d8ba3d23e6a64953e5893559e"
+      "sha256": "34f24f674b7be4607f598d6f968e3e3c1f15cb9175361956b0808a1df1ac723c"
     },
     {
       "path": "scripts/gds/provision-repo-auth.js",
@@ -8957,7 +8977,7 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "ef448bfb12437b2a3b83d7d726daff6a38b2a5a2db52096cc0150171d73547ce"
+      "sha256": "ab6b240d93920bb81bf096aff9553c478a2c3e8c0c4926b81c468e99aee89d67"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
@@ -8967,12 +8987,12 @@
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "4228fa562e8832f545558c15caf94fdc3e5d96d7928e6ecb8a6bf23dd6511f04"
+      "sha256": "f8c642838cbae5dc096f35870bda10f3da342e1cd93b0713e4528bfefe1819a8"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "e384ffc0ecfcdb05d275d1245a6bc1214f2737c0fa67ae21eb8228ce1a398abf"
+      "sha256": "e879686d5fcadfd32eb1dfc4e1640fc229cc4f0afc78615681964484e8457c1f"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9987,7 +10007,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ab8bbe4ee49dbf220c6a5550d22c38ef22ea41988b50d8774933e297fc93f496"
+      "sha256": "211ea75dbda9c058e7945f56db78eafcfeb5e0d9ffece439fcd0ca3a6adc51d2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10902,7 +10922,7 @@
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
-      "sha256": "6077bfd9eca120db9dcfebec30fa355d0ae281df6cf9fbd6489203640051fcc1"
+      "sha256": "f8bc5b5329c4de27b41a9172e6b5023c4854d864f532aac3ed062e0d35633f00"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",
@@ -11687,7 +11707,7 @@
     {
       "path": "tests/government_seed.mjs",
       "mode": "0000644",
-      "sha256": "e31b024ce9a64a13737a32720ba7bef3d92f2644f56581143965afb1bb65f1fd"
+      "sha256": "e165fe5c67ee4e80c58f489514ac77ba34e51984dabd2329ecdd70052b81a9cc"
     },
     {
       "path": "tests/government_session_scope.mjs",
@@ -12064,6 +12084,11 @@
       "mode": "0000644",
       "sha256": "63afe2afd59ff64e290234a0cc8d33a0f77b784d8c10c2d7147fe2ab3c114cd1"
     },
+    {
+      "path": "tests/idea_goal_ratification.mjs",
+      "mode": "0000644",
+      "sha256": "3c624db8e11ae02f503d19c6b2556b286d3ca59229daacd6ea2319782530c84f"
+    },
     {
       "path": "tests/idea_governance_pass_credit.mjs",
       "mode": "0000644",
@@ -13012,12 +13037,12 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "4e1d463693cb7d5e363964360b72085d2307578bd430f2fee1129698d907a567"
+      "sha256": "b6558cb094a2d38c837d3e5028573c14e5c55c832555b382c1d1135a55b5c6b5"
     },
     {
       "path": "tests/provision_account_identity.mjs",
       "mode": "0000644",
-      "sha256": "d56cf2553c0b5efa6a17df3d578b7b5766ff62504af6c226688f73ac417df3c6"
+      "sha256": "9f62eea1b43a478334a83df52d0e81a3b3b67f4c4eea54680d2d8db3b25ee513"
     },
     {
       "path": "tests/provision_caddy_wiring.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 403 operations across 61 resource groups
+- 404 operations across 61 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -511,6 +511,8 @@ function createClient(opts = {}) {
       postInboxIdDevelop: (args) => request("POST", "/inbox/{id}/develop", { hasBody: true }, args),
       // POST /inbox/{id}/ratify — rank: metic+archon — POST /inbox/:id/ratify
       postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
+      // POST /inbox/{id}/ratify-goal — rank: metic+archon — POST /inbox/:id/ratify-goal
+      postInboxIdRatifyGoal: (args) => request("POST", "/inbox/{id}/ratify-goal", { hasBody: true }, args),
       // POST /inbox/{id}/resubmit — rank: any-builder — POST /inbox/:id/resubmit
       postInboxIdResubmit: (args) => request("POST", "/inbox/{id}/resubmit", { hasBody: true }, args),
       // DELETE /inbox/{id}/spark — rank: any-builder — DELETE /inbox/:id/spark

package/clients/bongos-client/index.cjs

@@ -510,6 +510,8 @@ function createClient(opts = {}) {
       postInboxIdDevelop: (args) => request("POST", "/inbox/{id}/develop", { hasBody: true }, args),
       // POST /inbox/{id}/ratify — rank: metic+archon — POST /inbox/:id/ratify
       postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
+      // POST /inbox/{id}/ratify-goal — rank: metic+archon — POST /inbox/:id/ratify-goal
+      postInboxIdRatifyGoal: (args) => request("POST", "/inbox/{id}/ratify-goal", { hasBody: true }, args),
       // POST /inbox/{id}/resubmit — rank: any-builder — POST /inbox/:id/resubmit
       postInboxIdResubmit: (args) => request("POST", "/inbox/{id}/resubmit", { hasBody: true }, args),
       // DELETE /inbox/{id}/spark — rank: any-builder — DELETE /inbox/:id/spark

package/clients/bongos-client/index.d.ts

@@ -323,6 +323,7 @@ export interface PostGovernmentRanksResponse { rank: unknown }
 export interface PostHelpRequestsRequest { needs_craft?: string; needs_builder_id?: number; what_is_stuck: string; task_id?: number; goal_id?: number }
 export interface PostHelpRequestsResponse { ok: boolean; help_request: unknown }
 export interface PostInboxIdDevelopRequest { field_values: Record<string, unknown>; template_key?: string; recommendation?: string }
+export interface PostInboxIdRatifyGoalRequest { target_version: string; scope_modules?: string[]; admit_reason?: string; notes_md?: string }
 export interface PostInboxIdRatifyRequest { notes_md?: string }
 export interface PostInboxIdResubmitRequest { field_values: Record<string, unknown>; template_key?: string; recommendation?: string }
 export interface PostInboxIdSparkResponse { idea: unknown; sparked: boolean; unchanged: boolean }
@@ -886,6 +887,8 @@ export interface BongosClient {
     postInboxIdDevelop(args: RequestArgs & { body: PostInboxIdDevelopRequest }): Promise<ApiResponse>;
     /** POST /inbox/{id}/ratify — rank: metic+archon */
     postInboxIdRatify(args?: RequestArgs & { body?: PostInboxIdRatifyRequest }): Promise<ApiResponse>;
+    /** POST /inbox/{id}/ratify-goal — rank: metic+archon */
+    postInboxIdRatifyGoal(args: RequestArgs & { body: PostInboxIdRatifyGoalRequest }): Promise<ApiResponse>;
     /** POST /inbox/{id}/resubmit — rank: any-builder */
     postInboxIdResubmit(args: RequestArgs & { body: PostInboxIdResubmitRequest }): Promise<ApiResponse>;
     /** DELETE /inbox/{id}/spark — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -507,6 +507,8 @@ export function createClient(opts = {}) {
       postInboxIdDevelop: (args) => request("POST", "/inbox/{id}/develop", { hasBody: true }, args),
       // POST /inbox/{id}/ratify — rank: metic+archon — POST /inbox/:id/ratify
       postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
+      // POST /inbox/{id}/ratify-goal — rank: metic+archon — POST /inbox/:id/ratify-goal
+      postInboxIdRatifyGoal: (args) => request("POST", "/inbox/{id}/ratify-goal", { hasBody: true }, args),
       // POST /inbox/{id}/resubmit — rank: any-builder — POST /inbox/:id/resubmit
       postInboxIdResubmit: (args) => request("POST", "/inbox/{id}/resubmit", { hasBody: true }, args),
       // DELETE /inbox/{id}/spark — rank: any-builder — DELETE /inbox/:id/spark

package/docs/adr/0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md

@@ -46,6 +46,8 @@ ADR 0128 anticipated the DB half in its own alternatives: *"Do createdb/migrate
 - **`provision.js` sits two lines under the 1,500-line ratchet.** The generators and their full rationale live in `provision-repo.js`; the runner carries the wiring and a pointer. The next change there will have to move something out.
 - **The non-privileged path is unchanged in kind.** The DDL escalates through the same `asPostgres()` helper ADR 0128 introduced, so a runner without `PROVISION_SUDO` renders the same commands without `sudo` — as broken, and no more broken, than it already was for `createdb`.
 
+> **Amended by task 1002719 — the app user is resolved, not named.** The account whose group every instance joins (and which owns the backup dir and runs the backup timers) was the founder's own account as a literal, so a standup on any other host died `invalid user` at the backup step. `appUser()` in `provision-repo.js` now answers it: `PROVISION_APP_USER`, else the account the runner runs as — which on a plane *is* the app user, so the founder box resolves exactly what the literal said. **root is refused, not resolved**: instance accounts join this account's group, and group root is not a read grant to hand a tenant. The name is validated before it reaches a shell command or a unit file, and the refusal is a preflight: it fires before the status flip, never midway through a standup. Its **group** is the account's primary group looked up on the box (`$(id -gn …)`; the backup unit carries no `Group=`), never the account name spelled twice — an admin-made service account need not have a group of its own name. `audit-authorship.sh` now flags the founder's unix account in account position (`-o`/`-u`, `User=`, `*user = '…'`) in runtime code, because the GitHub-login grep never could.
+
 ## Alternatives considered
 
 - **A `DATABASE_URL` in `web.env` instead of discrete `PG*` vars.** `pool.js` already prefers it, so it would have needed no pool change at all. Rejected: the socket path has to ride as `?host=…` or a percent-encoded authority, and the exact parse is `pg-connection-string`'s business rather than something the test could pin — trading a stated, assertable identity for a URL whose behavior we would be trusting.

package/docs/api/openapi.json

@@ -8979,6 +8979,65 @@
         ]
       }
     },
+    "/inbox/{id}/ratify-goal": {
+      "post": {
+        "operationId": "post_inbox_id_ratify_goal",
+        "tags": [
+          "inbox"
+        ],
+        "summary": "POST /inbox/:id/ratify-goal",
+        "description": "BV2.R17 (task 1004096, spec R23, goal 1000095) — ratify a FULL IDEA into a GOAL, atomically: - INSERT goals (title from the idea, description = its five answers) - INSERT done_when_criteria on that goal from the \"what does a successful implementation look like\" answer - UPDATE idea_inbox SET status='promoted', reviewed_at=now() - INSERT ideas_goal_ratifications — who ratified, under which board decision, with the author's own recommendation recorded beside it All of it in one transaction; a partial failure rolls back to an open idea. A SEPARATE ROUTE FROM /ratify, not a mode of it. The two take different subjects (a `criterion-proposal` idea whose body_md is JSON vs. a graded Full Idea whose answers are prose), produce different rows, and differ on whether the board has a say. One route with a discriminator would have to document which half of its own body applies, and a caller who got the discriminator wrong would be told about a field rather than about the act. THE SCOPE AND THE VERSION COME FROM THE REQUEST because nothing else can supply them: no prose answer says which version a goal belongs to or which modules it may touch. THE GATES DO NOT come from the request — the handler passes the caller's LIVE rank through to the lifecycle port, which applies every check POST /goals applies (unknown module key, protected scope → Archon, a building version's goal set closed without a named Archon admission). `idea.ratify`'s floor is Metic, so those gates are load-bearing here rather than ceremonial. Statuses: 400 a bad body / an unratifiable idea / an unmappable template · 403 a rank gate · 404 no such idea · 409 the idea is not open, the board has not passed it, the version will not take a goal, or it is already ratified.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `idea.ratify` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/ideas/routes/ratify-goal.js",
+        "x-permissions": [
+          "idea.ratify"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostInboxIdRatifyGoalRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/inbox/{id}/resubmit": {
       "post": {
         "operationId": "post_inbox_id_resubmit",
@@ -23241,6 +23300,36 @@
         ],
         "additionalProperties": false
       },
+      "PostInboxIdRatifyGoalRequest": {
+        "type": "object",
+        "properties": {
+          "target_version": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64
+          },
+          "scope_modules": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "maxItems": 64
+          },
+          "admit_reason": {
+            "type": "string",
+            "minLength": 8,
+            "maxLength": 500
+          },
+          "notes_md": {
+            "type": "string",
+            "maxLength": 10000
+          }
+        },
+        "required": [
+          "target_version"
+        ],
+        "additionalProperties": false
+      },
       "PostInboxIdRatifyRequest": {
         "type": "object",
         "properties": {
@@ -25564,8 +25653,8 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 403,
-  "x-schema-count": 442,
+  "x-endpoint-count": 404,
+  "x-schema-count": 443,
   "x-undocumented-bodies": 9,
   "x-response-schemas": 301,
   "x-generated-by": "scripts/gds/gen-api-docs.js"

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 403 endpoints across 65 route files.
+> **Generated from the live route files** — the route file is authoritative. 404 endpoints across 66 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -337,7 +337,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/help-requests/for-me` | `any-builder` | — | The addressed read — C01's answer to "and fires a notification". |
 | GET | `/api/bongos/help-requests/mine` | `any-builder` | — | your own asks, so you can settle them. |
 
-## `inbox` (17)
+## `inbox` (18)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -348,6 +348,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | PATCH | `/api/bongos/inbox/:id/body` | `any-builder` | `body_md` | Metic+ (task 360 / ADR 0018): idea triage (promote/discard/merge) shapes the backlog. |
 | POST | `/api/bongos/inbox/:id/develop` | `any-builder` | `field_values`, `template_key`, `recommendation` | POST /inbox/:id/develop — DEVELOP A SPARK INTO A FULL IDEA (task 1002922 / BV1.R146, goal 1000062). |
 | POST | `/api/bongos/inbox/:id/ratify` | `metic+archon` | `notes_md` | V3.R31 (task 252) — Archon ratifies a criterion-proposal idea, atomically: - INSERT done_when_criteria row on the target version - UPDATE… |
+| POST | `/api/bongos/inbox/:id/ratify-goal` | `metic+archon` | `target_version`, `scope_modules`, `admit_reason`, `notes_md` | BV2.R17 (task 1004096, spec R23, goal 1000095) — ratify a FULL IDEA into a GOAL, atomically: - INSERT goals (title from the idea, descrip… |
 | POST | `/api/bongos/inbox/:id/resubmit` | `any-builder` | `field_values`, `template_key`, `recommendation` | RESUBMIT a Full Idea after a rejection (R13 of goal 1000069, criterion C2: an idea never dies and never stalls). |
 | POST | `/api/bongos/inbox/:id/spark` | `any-builder` | — | Mark a Quick Idea as a Big Idea Spark — "I have the spark but not the full picture, someone develop this". |
 | DELETE | `/api/bongos/inbox/:id/spark` | `any-builder` | — | Withdraw the Big Idea Spark mark — the reversibility half of R144. |

package/docs/module-api-changelog.md

@@ -2346,5 +2346,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.934 with no explicit bump. run 35558269194. (task 1002620)
   1.19.936 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.935 with no explicit bump. run 35561285958. (task 1002620)
+  1.19.937 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.936 with no explicit bump. run 35566446478. (task 1002620)
+  1.19.938 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.937 with no explicit bump. run 35638291152. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/self-host.md

@@ -39,7 +39,7 @@ Author `config/branding.json` from the neutral starter — see [the branding con
 
 **Or scaffold it with `bongos init`** ([task #1204](https://example.com/builders#/task/1204)): a short interview (or `bongos init --from spec.json` for a hands-free / CI run) that writes both config files, **seeds your first version + its done-when goal**, and **files the human-only kickoff steps** (register a GitHub OAuth app, first owner sign-in, repo binding, admission) as real tracked tasks — so a fresh instance has a claimable queue on day one instead of an empty hall. It never invents your branding (it points you at the fill prompt for that). Preview the whole plan with `bongos init --dry-run`.
 
-**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. **A queued request does nothing until a runner drains it:** on the control plane that is a systemd timer running `node scripts/gds/provision.js run-intents --apply`. This Docker image now carries the tools the scaffold needs — git, and a core it can package out of its own `.git`-less checkout (task 1003995) — and supervision is no longer systemd-only: the runner picks a process manager, falling back to supervisord where systemd is not running (task 1003997, [ADR 0306](../adr/0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md)). Three standup legs still assume a systemd box, so on a compose self-host a new project cannot stand up: the container has no reverse proxy for a child instance's front door, cannot create the per-instance unix account that isolates one instance from another, and installs its backup dir as a hardcoded founder user (task 1002719). **Two of the three now refuse instead of failing opaquely, each for its own reason** — so fixing one cannot silently re-open the other. **The ingress leg now refuses instead of failing opaquely** (task 1004017, [ADR 0315](../adr/0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md)): provisioning probes the plane with `caddy version` and returns `Ingress preflight failed: …` naming the missing proxy, before it writes a Caddy snippet or reloads anything. Previously a domained child was told to edit an `/etc/caddy/Caddyfile` the container does not have, and a domainless one crashed on the snippet write. Giving the container a real front door is still unbuilt — the refusal closes the failure mode, not the capability. **The identity leg refuses too** (task 1004018, [ADR 0317](../adr/0317-a-plane-that-cannot-give-an-instance-its-own-account-is-refused.md)): provisioning probes whether the runner can reach root on this plane and returns `Account preflight failed: …` before any mutation, because `useradd` cannot run under `USER node` and every child there would otherwise share one uid — the sibling-secret vector [ADR 0281](../adr/0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md) exists to close. It is a capability question, not a knob: there is no setting that accepts a shared uid. Note supervisord has no timer concept either, so a container-hosted instance gets no automatic DB backup — the standup log prints the `crontab` line to add instead. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
+**Production hosting, optional (the `provisioning` module — [ADR 0111](../adr/0111-instance-hosting-provisioning-module.md) §3).** If you enable the `provisioning` module and answer the interview's hosting questions (shape — co-tenant `$0` or a dedicated droplet — bring-your-own domain, credential ref, tier), init turns those answers into a real **provisioning request** (a queued `provision` intent the control-plane runner drains) instead of only filing a manual "production topology" task. **A queued request does nothing until a runner drains it:** on the control plane that is a systemd timer running `node scripts/gds/provision.js run-intents --apply`. This Docker image now carries the tools the scaffold needs — git, and a core it can package out of its own `.git`-less checkout (task 1003995) — and supervision is no longer systemd-only: the runner picks a process manager, falling back to supervisord where systemd is not running (task 1003997, [ADR 0306](../adr/0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md)). Three standup legs assumed a systemd box, and on a compose self-host a new project still cannot stand up: the container has no reverse proxy for a child instance's front door, cannot create the per-instance unix account that isolates one instance from another, and installed its backup dir as a hardcoded founder user. **That third leg is fixed** (task 1002719): the backup dir's owner is `PROVISION_APP_USER`, else the account the runner runs as (root is refused), so the standup no longer dies `invalid user` on a host without the founder's account. **The other two now refuse instead of failing opaquely, each for its own reason** — so fixing one cannot silently re-open the other. **The ingress leg now refuses instead of failing opaquely** (task 1004017, [ADR 0315](../adr/0315-a-plane-with-no-proxy-is-refused-not-given-a-no-op-ingress.md)): provisioning probes the plane with `caddy version` and returns `Ingress preflight failed: …` naming the missing proxy, before it writes a Caddy snippet or reloads anything. Previously a domained child was told to edit an `/etc/caddy/Caddyfile` the container does not have, and a domainless one crashed on the snippet write. Giving the container a real front door is still unbuilt — the refusal closes the failure mode, not the capability. **The identity leg refuses too** (task 1004018, [ADR 0317](../adr/0317-a-plane-that-cannot-give-an-instance-its-own-account-is-refused.md)): provisioning probes whether the runner can reach root on this plane and returns `Account preflight failed: …` before any mutation, because `useradd` cannot run under `USER node` and every child there would otherwise share one uid — the sibling-secret vector [ADR 0281](../adr/0281-an-instance-identity-is-its-own-unix-account-and-pg-role.md) exists to close. It is a capability question, not a knob: there is no setting that accepts a shared uid. Note supervisord has no timer concept either, so a container-hosted instance gets no automatic DB backup — the standup log prints the `crontab` line to add instead. The two irreducibly-human legs — the GitHub OAuth app and the first owner sign-in — stay guided/manual. If the module isn't enabled on the target instance, init falls back to the manual production-topology task, so nothing is silently skipped.
 
 ## Configuration surface