@bongos/core 1.19.975 → 1.19.977

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.975",
-  "core_contract": "1.19.975",
-  "source_commit": "4073475edb22dae11e825a4191c1467101ca8b78",
+  "core_version": "1.19.977",
+  "core_contract": "1.19.977",
+  "source_commit": "97ba854401629212275dafc294e6632004516781",
   "source_ref": "HEAD",
-  "built_at": "2026-09-23T14:01:28.147Z",
+  "built_at": "2026-09-23T15:21:57.063Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 516,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2378,
+    "functional_verbatim": 2386,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2920,
-  "tree_sha256": "2ff13cad510adfd6dc7430579c417a6c8216d515d0fadb546fec92844fee0186",
+  "file_count": 2928,
+  "tree_sha256": "bc6990ad901c42ffd73df27e947932152a51800591640250f55acda99925c20f",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -142,12 +142,12 @@
     {
       "path": ".claude/skills/goal-create/SKILL.md",
       "mode": "0000644",
-      "sha256": "b6ee07ebb27de1b8b4d3406617f0f577e07f72e38df9df0f65381b03eae00b39"
+      "sha256": "fef368de4b2a0b42aad43f505b053d7b84aac34bf8f1da7525053970e8e27f42"
     },
     {
       "path": ".claude/skills/goal-review/SKILL.md",
       "mode": "0000644",
-      "sha256": "606df145f399fb1aa483d608258eda0f2a88906142d5e675d7aacf272d235e0a"
+      "sha256": "39016b0c0bf7c42e0b0ee1dc9bff23b90401a1ad29c34f7a475406660855be79"
     },
     {
       "path": ".claude/skills/grade-audit/SKILL.md",
@@ -1362,7 +1362,7 @@
     {
       "path": "docs/adr/0176-private-repo-deploy-keys.md",
       "mode": "0000644",
-      "sha256": "80c1b9d283892454f45504fe3f20f3a215967de7cca66a5b3ef30970bb8eed47"
+      "sha256": "c10a9b3039835676e84c1cedac77b3897fc03f5db689ecc34b8b658c51210d5f"
     },
     {
       "path": "docs/adr/0177-goal-membership-kind.md",
@@ -2702,7 +2702,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7daf42cf3ac4f8acccb5543777095d0cbd57c6cf44769c12eb9ad3c0f45caa29"
+      "sha256": "5df4d92085d7624d9c5acbf8f99af5a02d10731359071102d4cbe8b8eb73820c"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5797,7 +5797,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "ba8a41a33d3612f41509d50c65533f169b4008bbc8a01df783dbd03fe872afa4"
+      "sha256": "d0844d8f53c003e6026918ad2c132262a358b8c64951aa7927eace1e37fcd41f"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -5814,6 +5814,11 @@
       "mode": "0000644",
       "sha256": "4738131a48e85dd7bf0644ddd3686c85d0d1d0da55ee623b1834d048c614b91c"
     },
+    {
+      "path": "modules/lifecycle/dependency-advisory.js",
+      "mode": "0000644",
+      "sha256": "b2d93f29010a27f50d5da5712e485b7fac0ef6582f3e531052699b321c693d5e"
+    },
     {
       "path": "modules/lifecycle/done-when.js",
       "mode": "0000644",
@@ -5964,6 +5969,11 @@
       "mode": "0000644",
       "sha256": "85f7c058dcd6bc3f3d7e4d46ee1c58047347c9bff833148ec715f2a29fe7d7a7"
     },
+    {
+      "path": "modules/lifecycle/missing-dep-classify.js",
+      "mode": "0000644",
+      "sha256": "d89f4659debd15dfac18258ba1e900f58c757e02937444d42391acec727afef0"
+    },
     {
       "path": "modules/lifecycle/module.json",
       "mode": "0000644",
@@ -6107,7 +6117,7 @@
     {
       "path": "modules/lifecycle/routes/task-write-routes.js",
       "mode": "0000644",
-      "sha256": "bb172485d8d5f84d96cdb611b0d57cd5f69ee768bdceddeb1eea42dc3f5676c1"
+      "sha256": "7f9419719070ec7048a2c81149427cbdaf3bf0e4a33993c1c79453161bdc06cc"
     },
     {
       "path": "modules/lifecycle/routes/tasks.js",
@@ -6719,6 +6729,11 @@
       "mode": "0000644",
       "sha256": "1287440b0088a6451dd4df234e578e06fc6f3e892915e64cd6c6e1f09dadd9d5"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_025_repo_private.sql",
+      "mode": "0000644",
+      "sha256": "949130ba321fc382c30fd7bfb76572e8415492b8641f644719cef3658a415cb9"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -6757,7 +6772,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "82bb265d63bb882468bbb609faa60a783ccf7dfeec5cd4595550586c37131bda"
+      "sha256": "a6c7b6cdaca50106bd59b86e0272a2e24fe269a43e4a7f6e3a63504e73fa74d5"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -6769,6 +6784,11 @@
       "mode": "0000644",
       "sha256": "4c933aad1307378496d47960e24c9d797a1f122f28aefa27b769f336e4cf2e75"
     },
+    {
+      "path": "modules/provisioning/repo-private.js",
+      "mode": "0000644",
+      "sha256": "0adee6537b5f127ea3fa5589bc92acc5b6accf6f100f395fe802640ff74b018f"
+    },
     {
       "path": "modules/provisioning/routes/body-validators.js",
       "mode": "0000644",
@@ -8122,12 +8142,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0f89059003740deb1ccd605358c8f983a2d0e1ea880bf5a584150d8f8549fef6"
+      "sha256": "94174c5cd82588020aca94cba69a1e64e311efc037ab4768df616028056268d3"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d12f17578bc304bdef802b5e15a9a705437a947795a255a70b5e7d76c8a3f2e7"
+      "sha256": "97a39697bb451c4ace97d3d753dc66b8e6d77aa0c832fdc91f8d9dd60c10fea9"
     },
     {
       "path": "public-docs/index.html",
@@ -8262,7 +8282,7 @@
     {
       "path": "scripts/gds/audit-deps.js",
       "mode": "0000644",
-      "sha256": "ff7ccdf15ae2c215d3330e957d6a36adc7d48f5d9bd5042b5d61bb228b878073"
+      "sha256": "529829a6ba6de16a0166ac3bf4108366c2831d6ac76eac1b448b9fe3b397d775"
     },
     {
       "path": "scripts/gds/audit-exports.js",
@@ -9104,6 +9124,11 @@
       "mode": "0000644",
       "sha256": "a113cdae4d6dcb3f8d968d41c2f1ce67b34d77229fe0a19d6bc5023f7ed469b5"
     },
+    {
+      "path": "scripts/gds/provision-repo-private.js",
+      "mode": "0000644",
+      "sha256": "f2c31eaf1808ee19aaf7266a82509a05ae39d7f638ffaf3aeffcc33e304262aa"
+    },
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
@@ -9122,7 +9147,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "1d92b6cbbfb544328a8bacd29cb492445508617298c251872d846bb7ab5a180a"
+      "sha256": "7747b46f241bddb4257a56461703f82603dd58e18d22bd2c547fd7137749d0e6"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9892,7 +9917,7 @@
     {
       "path": "src/bongos/github-repos.js",
       "mode": "0000644",
-      "sha256": "e69373026518a4e67ceca38e596354fa471fe11b7b00a718af62a1d3aabc0c4a"
+      "sha256": "3e0087226edf1d877e56cf647b2af805430ececabf9b51ecf56df280f959b418"
     },
     {
       "path": "src/bongos/goal-scope-check.js",
@@ -10147,7 +10172,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e0a617d0a28a74ab5e8a1af5b6ddeb79de9ec5b8c94640e6f548dac35416c085"
+      "sha256": "a666eed999520506fa357a4b21c5f304f7237bad0b4ca25953505485a8eb14bc"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11194,6 +11219,11 @@
       "mode": "0000644",
       "sha256": "9d16748bfadb1b13969613bd7a43bed42ea3e1bdcc7254ab26fba14ea8b4c036"
     },
+    {
+      "path": "tests/dependency_advisory.mjs",
+      "mode": "0000644",
+      "sha256": "9141b1e9544eceeaf94d5156a4c150236db7011f769dafec9a70f5fd5f51bc25"
+    },
     {
       "path": "tests/deploy_audit_gate.mjs",
       "mode": "0000644",
@@ -11532,7 +11562,7 @@
     {
       "path": "tests/github_repos_helpers.mjs",
       "mode": "0000644",
-      "sha256": "0bde5e75593b43a307c3bab748f02b1f77afc2e3a98decf88f2bff419c843b7d"
+      "sha256": "66fd3d349445aa00e55fa77589958d6c98980e99f3cdaf4746ff55494202333a"
     },
     {
       "path": "tests/github_token_store.mjs",
@@ -12759,6 +12789,11 @@
       "mode": "0000644",
       "sha256": "1da3144c843ebcacc914f8ccc6e4e0578b2efc40bd3d2feb99d3665989923512"
     },
+    {
+      "path": "tests/missing_dep_classify.mjs",
+      "mode": "0000644",
+      "sha256": "0bd80e5c2a08bf90509563a878cceea2485d7755022f7818f036c37fe60a32e6"
+    },
     {
       "path": "tests/model_alloc_prefs.mjs",
       "mode": "0000644",
@@ -13274,6 +13309,11 @@
       "mode": "0000644",
       "sha256": "755e93592b581593c463af59bad68b7e5b753c8305b80ff759501d878a31b209"
     },
+    {
+      "path": "tests/provision_repo_private.mjs",
+      "mode": "0000644",
+      "sha256": "9140b670c8ab76069c76238cf47bfdd539141198a40ef23f443813543947c4aa"
+    },
     {
       "path": "tests/provision_restart.mjs",
       "mode": "0000644",
@@ -13382,7 +13422,7 @@
     {
       "path": "tests/provisioning_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "642d29f2e29e38a0b3a7229309b03a9e1cb28969e7f6d942bd06dd092147b835"
+      "sha256": "ab01149d73158276a73464bc0feca3474ee2f054db03af378c9b43874a2056fb"
     },
     {
       "path": "tests/provisioning_settings_env.mjs",
@@ -13402,7 +13442,7 @@
     {
       "path": "tests/provisioning_teardown_intent.mjs",
       "mode": "0000644",
-      "sha256": "6155e1e7c18417537636e6e0ca1d63f4b87264c350d736fb787dfdafb7950280"
+      "sha256": "b23049faa369d75b867a9c31237fe073424e694588627217a1105a5522c16fc6"
     },
     {
       "path": "tests/provisioning_teardown_states.mjs",

package/.claude/skills/goal-create/SKILL.md

@@ -153,6 +153,14 @@ Run the phases above **with the orphan task as the seed** — its title, descrip
 
 **A goal-less task is not an error and was never blocked.** `goal_advisory` is advice on a request that already succeeded. Never fail a build, refuse work, or badger the builder over it — if they say "later", file the idea and move on.
 
+## The sibling advisory: `dependency_advisory` (task 1002827)
+
+The same `POST /tasks` response can also carry a non-null **`dependency_advisory`** — a *different* check, unrelated to which goal the task landed in: it names OPEN tasks in the same version whose `touches[]` overlap this one's, with no declared dependency between them (`scripts/gds/audit-deps.js`'s detector, run live for the first time).
+
+- `dependency_advisory.candidates` is sorted by confidence (`high`/`medium`/`low`) — read each candidate's title before acting; most overlap is parallel work on a shared file, not a real build-order dependency.
+- Only backfill a **high**-confidence candidate, and only after reading both task descriptions. Add the edge with `POST /tasks/<id>/dependencies --body '{"depends_on_task_id":<dep_id>}'`.
+- **Same non-blocking contract as `goal_advisory`** — it is advice on a request that already succeeded, never a reason to redo the create, and a wrong edge GATES the dependent (`POST /claims` → 409 `DEPS_NOT_SHIPPED`) until the named blocker ships, so silence (skip it) beats a guessed edge.
+
 ## Why we run this
 
 Nothing in the system creates a goal on its own, and nothing errors when a task has none. `db.createTask` falls back to the version's `"<version> — general"` catch-all, and those rows were created **only** by migration 160, for the versions that existed at that moment — `db.createVersion` makes no such goal and there is no trigger. So on any newer version, every task quietly gets `goal_id = NULL`: no scope wall, no criteria gating it, no workspace where anyone reviews it. This skill is how a real goal comes to exist before that happens.

package/.claude/skills/goal-review/SKILL.md

@@ -96,6 +96,14 @@ Report to the user:
 - Deferred (count + ids — these surface again next session)
 - New queue `count`
 
+**Step 6 — dependency check (task 1002827, idea 1000276).** A cheap housekeeping pass over the same corpus this session already has open: run the likely-missing-dependency detector and surface any `high`-confidence candidate for a human to triage.
+
+```
+node scripts/gds/audit-deps.js --min high
+```
+
+Each line names an open task and an unshipped task whose files it overlaps with no declared dependency between them. **Read both task descriptions before backfilling an edge** — most overlap is parallel work on a shared file, not a build order; a wrong edge gates the dependent (`POST /claims` → 409 `DEPS_NOT_SHIPPED`) until the named blocker ships. Report the count in the same summary as Step 5; zero is the common case and needs no further comment. This is advisory only — it never blocks the review, and skipping it on a rushed pass is fine (it resurfaces next session, same as a deferred criterion).
+
 ## Why we run this
 
 Without a closing cadence, criteria pile up "done but unconfirmed" and goals never flip to achieved — the version looks perpetually in-progress even when the work has shipped. A fast pass keeps the rollup honest. As with `/idea-triage`, the cadence is the discipline; a quick walk with mostly defers beats skipping it.

package/docs/adr/0176-private-repo-deploy-keys.md

@@ -51,6 +51,10 @@ best-effort revokes the key by title. Pushes keep preferring the owner-token HTT
 - The flip-to-private refusal on the manage page (task 1003045) stays until existing
   already-provisioned instances get the same wiring on flip — a follow-up task, since their
   origin still rides the shared alias.
+  **Progress (2026-09-23):** the runner half has landed — task 1004167 let the wiring run
+  before a flip (`intendedPrivate`), and task 1004193 added the `repo-private` intent whose
+  runner leg wires the key and only then flips. The refusal stays until task 1003078 adds the
+  route and the manage-page control that enqueue it.
 - Builder **dev boxes** of a private-repo project were parked here as out of scope.
   **Answered on hardware 2026-08-25 (task 1003247): a box CAN read the private repo, and the
   auth design needed no change.** The GDS-backed credential helper (`otb-git-credential`,

package/docs/module-api-changelog.md

@@ -2424,5 +2424,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.973 with no explicit bump. run 35816317024. (task 1002620)
   1.19.975 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.974 with no explicit bump. run 35871083707. (task 1002620)
+  1.19.976 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.975 with no explicit bump. run 35878415178. (task 1002620)
+  1.19.977 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.976 with no explicit bump. run 35880930697. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-tasks.js

@@ -765,6 +765,48 @@ async function listTasks({ versionId, status, kind, discipline, goalId, createdB
   return rows;
 }
 
+// task 1002827 — the candidate pool for the dependency advisory (POST /tasks'
+// `dependency_advisory` + the periodic sweep): OPEN tasks in this version that
+// carry touches[], the same OPEN set scripts/gds/audit-deps.js already treats
+// as "auditable" (ready, backlog, active, blocked). Bounded and cheap —
+// measured 2026-09-22, BONGOS-V2 carries ~51 such rows, since most tasks
+// declare no touches[] at all (ADR 0049 demoted the field to advisory, so
+// most authors skip it). `dependencies` is not selected: it lives in a join
+// table, not this one (see addTaskDependency), and this advisory only needs
+// the NEW task's own declared deps, supplied by its caller.
+//
+// VISIBILITY (ADR 0112's leak rule — the goal-graph.js precedent). A task's
+// title and touched paths are exactly the "prose" that rule protects: a task
+// under a PRIVATE goal the caller neither manages nor is a member of is
+// EXCLUDED here, not merely redacted — unlike the graph, this advisory has
+// no structural need to keep an invisible node in the picture (omitting a
+// candidate says nothing false; it just offers no advice about it). A
+// goal-less task carries no visibility concern (`t.goal_id IS NULL`).
+// `LIMIT` bounds the candidate count so a growing corpus cannot turn
+// classify()'s O(|a|×|b|) pairwise scan (dependency-advisory.js) into an
+// unbounded synchronous cost on this write path.
+const DEPENDENCY_ADVISORY_CANDIDATE_LIMIT = 200;
+async function listOpenTasksWithTouches(versionId, excludeId, { viewerId = null, viewerIsArchon = false } = {}) {
+  const { rows } = await pool.query(
+    `SELECT t.id, t.title, t.status, t.touches
+       FROM tasks t
+       LEFT JOIN goals g ON g.id = t.goal_id
+       LEFT JOIN goal_members gm ON gm.goal_id = g.id AND gm.builder_id = $4::bigint
+      WHERE t.version_id = $1
+        AND t.status = ANY($2::text[])
+        AND t.touches <> '{}'
+        AND ($3::bigint IS NULL OR t.id <> $3)
+        AND (t.goal_id IS NULL
+             OR g.visibility IS DISTINCT FROM 'private'
+             OR $5::boolean
+             OR gm.builder_id IS NOT NULL)
+      ORDER BY t.id
+      LIMIT ${DEPENDENCY_ADVISORY_CANDIDATE_LIMIT}`,
+    [versionId, ['ready', 'backlog', 'active', 'blocked'], excludeId, viewerId, viewerIsArchon]
+  );
+  return rows;
+}
+
 // Tasks that are ready, unblocked, and have no touches[] overlap
 // with currently active claims. Excludes tasks already claimed by this
 // builder (so the same builder doesn't see their own active claim listed
@@ -1269,6 +1311,7 @@ module.exports = {
   listActiveClaims,
   listClaimableTasks,
   listOpenArtistReviews,
+  listOpenTasksWithTouches,
   listTasks,
   promoteUnblockedBacklogTasks,
   rankCrossDisciplineRecommendations,

package/modules/lifecycle/dependency-advisory.js

@@ -0,0 +1,99 @@
+'use strict';
+
+// modules/lifecycle/dependency-advisory.js — the MISSING-DEPENDENCY advisory
+// (task 1002827, goal 1000089).
+//
+// THE HOLE. scripts/gds/audit-deps.js has shipped a working
+// likely-missing-dependency detector since task 1000349 (unit-tested,
+// tests/audit_deps.mjs, tests/missing_dep_classify.mjs) — and nothing ever
+// called it. A task can be created touching the exact same files an
+// unshipped task already claims, with no declared dependency between them,
+// and nothing says so until a human happens to run the CLI by hand.
+//
+// This module wires that SAME detector's predicate —
+// modules/lifecycle/missing-dep-classify.js's `candidateEdge`/`classify`,
+// not a second copy of either — into two surfaces, mirroring
+// goal-advisory.js's own two-surface shape (task 1002539):
+//   1. POST /tasks attaches `dependency_advisory` to its 201 body (this
+//      file's `buildDependencyAdvisory`), read by the /goal-create skill's
+//      "sibling advisory" section (.claude/skills/goal-create/SKILL.md).
+//   2. The periodic sweep: `/goal-review`'s daily walk runs
+//      `node scripts/gds/audit-deps.js --min high` as one more housekeeping
+//      step (idea 1000276's half — see .claude/skills/goal-review/SKILL.md).
+//
+// HARD CONSTRAINT, same as goal-advisory.js and ADR 0162: advisory only. This
+// must never refuse a POST, and `buildDependencyAdvisory` swallows its own
+// failures for the same reason goal-advisory.js's does — the task row is
+// ALREADY COMMITTED by the time this runs, so a throw here would turn a
+// successful create into a 500 the caller then retries.
+//
+// VISIBILITY (ADR 0112's leak rule, the goal-graph.js precedent) — enforced
+// in the query, not here: `db.listOpenTasksWithTouches` excludes a candidate
+// under a PRIVATE goal the caller neither manages nor belongs to, so this
+// file never even sees a task it should not name in a 201 body.
+//
+// PURE core (`adviseDependencies`) + a DB-read wrapper, the criterion-suggest /
+// goal-advisory precedent, so every branch is pinned by a DB-free unit test.
+
+const { candidateEdge } = require('./missing-dep-classify.js');
+
+// How many candidates the advisory offers. Small on purpose (the
+// goal-advisory.js CANDIDATE_LIMIT precedent) — this is a hint for the author
+// to triage, not a browsable report; the full corpus scan already exists as
+// `node scripts/gds/audit-deps.js` for that. Separate from (and much smaller
+// than) db.listOpenTasksWithTouches's own query-side LIMIT, which bounds cost
+// rather than display.
+const CANDIDATE_LIMIT = 5;
+
+// adviseDependencies — PURE. `task` is the just-created (or just-fetched) row,
+// `candidates` is the OPEN-with-touches, visibility-filtered pool a caller
+// already fetched. Returns null when there is nothing worth naming (fail-open
+// on ambiguity, same posture as adviseGoal): no touches[] on the task at all,
+// or no candidate clears the shared classify() confidence bar.
+function adviseDependencies({ task, candidates = [] } = {}) {
+  if (!task || !Array.isArray(task.touches) || !task.touches.length) return null;
+  const declared = new Set((task.dependencies || []).map(String));
+  const edges = [];
+  for (const o of candidates) {
+    const e = candidateEdge(task, o, { declared });
+    if (e) edges.push({ dep_id: e.dep_id, dep_title: (o && o.title) || null, dep_status: e.dep_status, confidence: e.confidence, paths: e.paths });
+  }
+  if (!edges.length) return null;
+  const order = { high: 3, medium: 2, low: 1 };
+  edges.sort((a, b) => order[b.confidence] - order[a.confidence]);
+  return {
+    reason: 'possible_missing_dependency',
+    message: `${edges.length} open task(s) touch the same files as this one and are not declared `
+      + 'dependencies — most touches[] overlap is parallel work on a shared surface, not a build-order '
+      + 'dependency, so read each candidate before adding an edge (a wrong one gates the claim).',
+    candidates: edges.slice(0, CANDIDATE_LIMIT),
+  };
+}
+
+// buildDependencyAdvisory — the whole advisory, DB read included, so POST
+// /tasks calls one line (the buildGoalAdvisory precedent). Fails open: any
+// throw degrades to null rather than failing an otherwise-successful create.
+// `viewerId`/`viewerIsArchon` ride straight into the query's own visibility
+// filter — this file never post-filters what the query already excluded.
+async function buildDependencyAdvisory({ db, versionId, task, viewerId = null, viewerIsArchon = false }) {
+  try {
+    if (!Array.isArray(task.touches) || !task.touches.length) return null;
+    const candidates = await db.listOpenTasksWithTouches(versionId, task.id, { viewerId, viewerIsArchon });
+    const verdict = adviseDependencies({ task, candidates });
+    if (!verdict) return null;
+    return {
+      ...verdict,
+      next_step: 'Review each candidate; if it is a real build-order dependency, add it via '
+        + `POST /tasks/${task.id}/dependencies.`,
+    };
+  } catch (e) {
+    // Through the published logger seam (api.logger), not a raw console call
+    // — the est-advisory.js precedent. Lazy-required so the DB-free unit test
+    // that exercises this branch stays hermetic.
+    require('../../src/module-api').logger('lifecycle')
+      .error('dependency-advisory (non-blocking)', e && e.message);
+    return null;
+  }
+}
+
+module.exports = { adviseDependencies, buildDependencyAdvisory, CANDIDATE_LIMIT };

package/modules/lifecycle/missing-dep-classify.js

@@ -0,0 +1,95 @@
+'use strict';
+
+// modules/lifecycle/missing-dep-classify.js — the PURE core of the
+// likely-missing-dependency detector (task 349, moved here from
+// scripts/gds/audit-deps.js by task 1002827 so a live route can reuse it
+// without pulling in that script's CLI-only machinery — cliClient(),
+// resolveDefaultVersion() — into the server process. The `dead-deps.js`
+// precedent beside this file: a pure lifecycle module, consumed both by the
+// audit-deps.js CLI (its --stranded arm) and now by dependency-advisory.js's
+// live POST /tasks path.
+//
+// THIS IS ADVISORY. Most touches[] overlaps are PARALLEL work on a shared
+// surface (src/bongos/db.js, migrations/, CLAUDE.md, …), NOT a build-order
+// dependency. Backfilling a wrong edge GATES the dependent (POST /claims →
+// 409 DEPS_NOT_SHIPPED) until the named blocker ships. So: act only on
+// `high` confidence, by hand, after reading both task descriptions. Reuses
+// the ONE canonical overlap matcher (src/bongos/path-match.touchesOverlap,
+// reached via the module-api doorway) so it can't drift from the claim
+// gate's notion of "overlap".
+
+const api = require('../../src/module-api');
+const { touchesOverlap } = api.pathMatch;
+
+// Lifecycle statuses that count as "open" (auditable) vs "an unshipped blocker".
+const OPEN = new Set(['ready', 'backlog', 'active', 'blocked']);
+const isUnshippedBlocker = (s) => s !== 'shipped' && s !== 'abandoned';
+
+// Shared collaboration surfaces: an overlap here is a parallel-safety (touches[])
+// signal, not a dependency. A candidate whose ONLY overlap is one of these (or a
+// bare directory) is demoted to `low`. Deliberately broad; tune as the repo moves.
+const HOTSPOTS = [
+  'src/bongos/db.js', 'src/bongos/routes.js', 'server.js', 'migrations/', 'CLAUDE.md',
+  'modules/hall-ui/', 'tests/', 'scripts/gds/', 'src/bongos/', 'src/bongos/routes/',
+  'scripts/gds/ship.js', 'scripts/gds/api.js', 'scripts/gds/cli-lib.js',
+  'modules/grading/grader.js', 'docs/', 'docs/adr/', 'docs/adr/README.md', 'docs/recipes/',
+  'docs/architecture.md', 'docs/file-map.md', '.claude/skills/', '.claude/hooks/',
+  'infra/', 'public/assets/tiles/',
+];
+const isHotspot = (p) => HOTSPOTS.includes(p);
+
+// Confidence heuristic (advisory; a human decides):
+//   high   — an exact SAME non-hotspot, non-bare-dir FILE both tasks name.
+//   medium — a narrow (non-hotspot, non-bare-dir) overlap exists.
+//   low    — overlap only on a shared hotspot / bare directory.
+function classify(tTouches, oTouches) {
+  const pairs = [];
+  for (const a of tTouches) for (const b of oTouches) {
+    if (touchesOverlap([a], [b])) pairs.push({ a, b, exact: a === b });
+  }
+  if (!pairs.length) return null;
+  const narrow = pairs.filter((p) => !isHotspot(p.a) && !isHotspot(p.b) && !p.a.endsWith('/') && !p.b.endsWith('/'));
+  const confidence = narrow.some((p) => p.exact) ? 'high' : narrow.length ? 'medium' : 'low';
+  const paths = [...new Set(pairs.map((p) => (p.exact ? p.a : `${p.a} ~ ${p.b}`)))];
+  return { confidence, paths };
+}
+
+// candidateEdge — THE ONE predicate for "does `o` qualify as a missing-dependency
+// candidate for `t`", pulled out (task 1002827 grade round 1) so findMissingDeps
+// and dependency-advisory.js's live adviseDependencies call the SAME check
+// instead of two hand-typed copies that can drift on the next rule change.
+// `declared` is precomputed and passed in by findMissingDeps (one Set per `t`,
+// not per pair); a caller checking a single `t` against many candidates may
+// omit it and pay one Set build instead. Runs `classify` exactly ONCE — it
+// already returns null on no overlap, so a separate touchesOverlap pre-check
+// was dead work computing the same answer twice.
+function candidateEdge(t, o, { isBlocker = isUnshippedBlocker, declared } = {}) {
+  if (!o || String(o.id) === String(t.id)) return null;
+  if (!isBlocker(o.status)) return null;
+  if (!Array.isArray(o.touches) || !o.touches.length) return null;
+  const declaredSet = declared || new Set(((t && t.dependencies) || []).map(String));
+  if (declaredSet.has(String(o.id))) return null;
+  if (!Array.isArray(t.touches) || !t.touches.length) return null;
+  const c = classify(t.touches, o.touches);
+  if (!c) return null;
+  return { task_id: t.id, dep_id: o.id, dep_status: o.status, ...c };
+}
+
+// Pure core — unit-tested with fixtures (no API). `tasks` is an array of
+// { id, status, touches:[], dependencies:[ids] }. Returns candidate edges
+// { task_id, dep_id, dep_status, confidence, paths }.
+function findMissingDeps(tasks, { open = OPEN, isBlocker = isUnshippedBlocker } = {}) {
+  const out = [];
+  for (const t of tasks) {
+    if (!open.has(t.status)) continue;
+    if (!Array.isArray(t.touches) || !t.touches.length) continue;
+    const declared = new Set((t.dependencies || []).map(String));
+    for (const o of tasks) {
+      const e = candidateEdge(t, o, { isBlocker, declared });
+      if (e) out.push(e);
+    }
+  }
+  return out;
+}
+
+module.exports = { OPEN, isUnshippedBlocker, HOTSPOTS, isHotspot, classify, candidateEdge, findMissingDeps };

package/modules/lifecycle/routes/task-write-routes.js

@@ -22,6 +22,7 @@ const db = require('../db');
 const hierarchy = require('../hierarchy');
 const { suggestCriteria } = require('../criterion-suggest');
 const { buildGoalAdvisory } = require('../goal-advisory');
+const { buildDependencyAdvisory } = require('../dependency-advisory');
 const { classifyTaskKind, VALID_KINDS, WRITABLE_DISCIPLINES, resolveWriteDiscipline, VOTABLE_TASK_STATUSES, TASK_FIELD_BOUNDS } = require('../task-classifier');
 const { isModuleKey, moduleKeys } = api.moduleScopeMap;
 const { validateOrRespond, LIMITS, parseId } = api;
@@ -282,13 +283,21 @@ module.exports = function registerTaskWriteRoutes(router) {
       const goal_advisory = await buildGoalAdvisory({
         db, versionId: body.version_id, task, hasCriterionLink: criteria.length > 0,
       });
+      // task 1002827 — the missing-dependency advisory (scripts/gds/audit-deps.js's
+      // detector, wired live for the first time): OPEN tasks in this version that
+      // touch the same files as this one and are not declared dependencies.
+      // Non-blocking by construction — see dependency-advisory.js.
+      const dependency_advisory = await buildDependencyAdvisory({
+        db, versionId: body.version_id, task,
+        viewerId: req.builder.id, viewerIsArchon: req.builder.rank === 'archon',
+      });
       res.status(201).json({
         task,
         credits_reward: task.credits_reward,
         needs_migration: needsMigration,
         criteria,
         suggested_criteria,
-        goal_advisory, est_advisory: await require('../est-advisory').buildEstAdvisory({ db, task }), // task 1003148
+        goal_advisory, dependency_advisory, est_advisory: await require('../est-advisory').buildEstAdvisory({ db, task }), // task 1003148
       });
     } catch (err) {
       log.error('[gds] POST /tasks', err);

package/modules/provisioning/migrations/provisioning_025_repo_private.sql

@@ -0,0 +1,34 @@
+-- provisioning_025_repo_private.sql — take an existing project's repository private
+-- (task 1004193, split (b) of task 1003078; ADR 0176).
+--
+-- WHY THIS EXISTS. A project stood up while its repository was public deploys through the
+-- platform's shared key, which cannot read a private repository. Flipping such a repository
+-- private from GitHub breaks the project's next deploy pull (walk finding N4), so the manage
+-- page has refused the flip since task 1003045. Standups after ADR 0176 give a private
+-- repository its own read-only deploy key; this action gives an EXISTING project the same
+-- wiring and only then flips it.
+--
+-- WHY AN INTENT. The wiring runs ssh-keygen and git config inside the project's checkout on
+-- the control-plane box, with the owner's stored GitHub credential. The web tier holds
+-- neither, so it may only ask; the runner (scripts/gds/provision-repo-private.js) does it —
+-- deploy key FIRST, flip SECOND, so there is never a moment the repository is private and
+-- the checkout still reads with the shared key.
+--
+-- WHY NO PAYLOAD. The action name IS the direction: it only ever means "make it private".
+-- Going public needs no wiring and stays a direct call on the core route. So nothing new
+-- is carried, and the target_version CHECK from provisioning_020 already holds for this
+-- action as written (repo-private is not an upgrade action, and carries no target).
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+-- INTENT_ACTIONS in modules/provisioning/provisioning.js is the other spelling of this list;
+-- tests/provisioning_restart.mjs and tests/core_upgrade_door.mjs fail if the two disagree.
+ALTER TABLE provisioning_intents DROP CONSTRAINT IF EXISTS provisioning_intents_action_check;
+ALTER TABLE provisioning_intents ADD CONSTRAINT provisioning_intents_action_check
+  CHECK (action IN ('provision', 'teardown', 'oauth-manifest', 'domain-attach',
+                    'settings-apply', 'restart', 'disconnect', 'core-upgrade',
+                    'core-upgrade-preflight', 'repo-private'));
+
+COMMIT;