@bongos/core 1.20.26 → 1.20.27

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.26",
-  "core_contract": "1.20.26",
-  "source_commit": "7bf58c3913461c4383f40d27a2c2abe4b357ee85",
+  "core_version": "1.20.27",
+  "core_contract": "1.20.27",
+  "source_commit": "1fc525416e379b30ced8b97b9999a269eb272392",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T19:12:54.558Z",
+  "built_at": "2026-09-30T19:45:22.316Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 560,
+    "docs_redacted": 561,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2647,
+    "functional_verbatim": 2655,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3233,
-  "tree_sha256": "6cc2f111dd67610b01e2286ded5cfef7db118cdbb5afe9d134262e29262f7ade",
+  "file_count": 3242,
+  "tree_sha256": "c65b104e5fd942b276adceaae176a3d833b2fa53daebe3292ac36d278f890c2e",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -327,12 +327,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "6142e330ccbf058cfe2d266b80d1dab1419cdd9194f39933da2f410d6e20abb1"
+      "sha256": "8dde50025e6ac0a8e9742455d62495b72c1803b87044455c48b13b95209f59a2"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "094ba492c058258352e891a1d418fbff5777d40176e21292a6c92c0ad4c55902"
+      "sha256": "77f3e9375343c45fd538d179928628a7422858ddea7540cc60cfbdfba95a8545"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -342,17 +342,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "4b57358e758f2959d9564bd59dab8c8d4ecfddebba4ee972884dd19522eb0f6c"
+      "sha256": "2eea3743862e9ec173c63517b6f79073b25e71aa3cb2d0a2a19ecce95ef78ca0"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "c8fab17a151038309beceb2ca3e07a4dfbaa8d79f82b2b314cb3f1440882c3b6"
+      "sha256": "065abbfa7d625aa5811ae9e6c27101ca5b9c824422a6a74bba22d92e3f5d53ae"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "007c35d80ca1e647157a3330d4791871119659228b4ad2fc8091d9f6b00b6e3b"
+      "sha256": "e2714285309adfdb0644e82319363fdcc6fc19ad9f5a2cf0e71e203da8c5e188"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2237,27 +2237,32 @@
     {
       "path": "docs/adr/0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md",
       "mode": "0000644",
-      "sha256": "4445d9c306a22fb3b7e72467bedad262f4653c092bf4866f8a39410248da2724"
+      "sha256": "5c93de4ab1813f7641ec3b33ad620a609a77fbe6fb3cbaffd99b7e6e5f8282fa"
     },
     {
       "path": "docs/adr/0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md",
       "mode": "0000644",
       "sha256": "962d868c0887244c53b53c58754f7232715a20df6feec694f30cbda707f9e17e"
     },
+    {
+      "path": "docs/adr/0355-a-soft-limit-is-a-rule-with-a-reason-and-nobody-enforces-it.md",
+      "mode": "0000644",
+      "sha256": "6ad8ab3bd8bcb4f55575232af651f108e3879a5965f5daaac42ab693d00a1f0a"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "850168519d3ef7eaf6d9658b9e2b19a80402147e9f3e8fc5318c53b7647fa9b0"
+      "sha256": "8258f16b11aaed9731afca21379b1ae976dc67040d6d35139987e29fd4acd360"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "0d81859e19436003332c5ee22b94c7e0a23636a61ac2a52118c15caae71fb31c"
+      "sha256": "db03fd5370b7b592769a806607b9cd0880a56b53c64d8909ca24364feeff818e"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "ce15358f33baf4ba95f59b2e2de9bfc4a5a4a0dddde5bfc91a0bfab09e4447f9"
+      "sha256": "545342fb2849e012cd5caca28d21659fe076a5158c0a0a4c2ca4a2b34abd34da"
     },
     {
       "path": "docs/architecture.md",
@@ -2282,12 +2287,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "cc3d3c2334fabc860be82ea509588681ca03cdd34da374011e2b0d5a646b8c9a"
+      "sha256": "3e6cb5cc724958b42912c60fa5cfe65cd6bd7baa7697c3b501534506053a5cb6"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "efedc6e640a54a117e108ae85654fec0385580a108918c62a8ec96fc3b927daa"
+      "sha256": "5eb31ba434dd1afbfe397ed33ae62ea76c51b71eaafca9b693bebfbe800e3b14"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2792,7 +2797,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7ceae0d7b1f9b1305c7dbec25e411f80c7700a128bbcf140ae65da98d73323c9"
+      "sha256": "7360408e833d4775efb81a46a20c2b357495e93532e08468fe59766cede1b0ad"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2882,7 +2887,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "e9b2c838868e4b23789112734c976ecae722ee3dcc4bea948482666e7a17863a"
+      "sha256": "bed8eb280c3798e7def41bfff4d21ac22e8f16ded6174de18487d54e071af768"
     },
     {
       "path": "docs/project-context.template.md",
@@ -4527,13 +4532,18 @@
     {
       "path": "modules/government/board.js",
       "mode": "0000644",
-      "sha256": "f620a9c3cfe606955aa4b6b7dd0d194c1160bab99ee6ffc81a801edf6b3db4a6"
+      "sha256": "afb73887cf5fa3f2c3b1d963e3fd501b5d2251fe1cbe0b28ca1baacb2690410d"
     },
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
       "sha256": "0559d78f54b4b8a89ac4e6924d6dad4e2693a7e54f943532e83e4ac966868b76"
     },
+    {
+      "path": "modules/government/charter.js",
+      "mode": "0000644",
+      "sha256": "5b0707da0b679b6b34bcca6f28354de1f4f1b31bc5255bcbca2b74eec5eaf67c"
+    },
     {
       "path": "modules/government/config.js",
       "mode": "0000644",
@@ -4717,7 +4727,7 @@
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "58415db3a65d68f1e30f626cab20882fc324c2575226b8d6f0a82b8f018694c4"
+      "sha256": "9e98696154986f67d20a6563d71da353359b1acd8af7d29fe98d60973c5856e4"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
@@ -5237,7 +5247,7 @@
     {
       "path": "modules/hall-ui/public/government.js",
       "mode": "0000644",
-      "sha256": "4e527b94cf239b219b309d1fe7d8a7d907f42f1f610b0ef3d7edb6d4b23ab6c6"
+      "sha256": "0d584e177a095a53449611feffee2eb9a2a35751154f329e985c8102f7b4fa02"
     },
     {
       "path": "modules/hall-ui/public/government.states.json",
@@ -7064,6 +7074,11 @@
       "mode": "0000644",
       "sha256": "9b263f91ce6df19640ef8ae413f3eb40cc17589924fdf21256da7647b55631c1"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_028_purge_pre_notice_invites.sql",
+      "mode": "0000644",
+      "sha256": "7af1d5f5deeae675247ace4a796482ce5a606c871d611f90e2dade905b70a5c1"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
@@ -7444,6 +7459,11 @@
       "mode": "0000644",
       "sha256": "aad8d8e8a641ebcbff9aeeed765e6c1657fa5896dc9cc3e84aa32f6d327b7db2"
     },
+    {
+      "path": "modules/provisioning/planet-physics.js",
+      "mode": "0000644",
+      "sha256": "e3b0539fff5af52fc24ea171fb6a7ee537c2952608ab59b59dc20596cfbee045"
+    },
     {
       "path": "modules/provisioning/pollers/app-liveness.js",
       "mode": "0000644",
@@ -7472,7 +7492,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "92e9a12c0d07d87a16f0d036369967a60c2dfaca3fb1bce78fab97ad54dac0bf"
+      "sha256": "f2dd673e30cf17abbfbadd3c0142616a1c40b3b680c865b57db8330933816405"
     },
     {
       "path": "modules/provisioning/public-refusal.js",
@@ -7507,7 +7527,7 @@
     {
       "path": "modules/provisioning/routes/body-validators.js",
       "mode": "0000644",
-      "sha256": "c59c59f842a0bab6bc45370a902d6db4a1b0e39a902eb115a12abaa59fc48dc9"
+      "sha256": "fdb68a0cf1717b861aabfb9d9b843e9cf3cc28dc4c60a58242597c821c4f8fba"
     },
     {
       "path": "modules/provisioning/routes/callback-page.js",
@@ -7532,7 +7552,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "d0a1e16b8ba6cb03bfadf95c7a3b688007309d173812e34b4e69d6e4dc33d21f"
+      "sha256": "6269c57fd10238a0660beae9df2ab686ea62a8e777eee04bc64d15e03ca503b0"
     },
     {
       "path": "modules/provisioning/routes/render-standup.js",
@@ -7544,11 +7564,21 @@
       "mode": "0000644",
       "sha256": "6189883417ca5703c67be2a66c687d8cdf45053ed28d72ac3775f2d3770d1106"
     },
+    {
+      "path": "modules/provisioning/screening.js",
+      "mode": "0000644",
+      "sha256": "7c707281978f54483029743268f2280b77f3ebcd12a083dce51f81a1d9cfb963"
+    },
     {
       "path": "modules/provisioning/seams.js",
       "mode": "0000644",
       "sha256": "68ba324773bbd9a347ef682c5b1f105b447c6760f24595b8850590ed6d64d78e"
     },
+    {
+      "path": "modules/provisioning/soft-limits.js",
+      "mode": "0000644",
+      "sha256": "03991cd9683c3fc2b4a9fda9e359dcd40a1e782800884b33b49b1d6e1fd9637d"
+    },
     {
       "path": "modules/provisioning/starter-bundles.js",
       "mode": "0000644",
@@ -8932,12 +8962,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "60d6f4672fc29b5851546d35e5a6f14c6323d7e5946908d1c2bbe301bb3a0dfa"
+      "sha256": "b4b4420fef73f720a6180d45b5559b38b857fe80181e148715187c5f2c5ec498"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9bb1f16462f06299a105da0895a24faac4f1c5bb689c5c9045deeb4bb97fb5bc"
+      "sha256": "9c84d9545af388a0db6fed5fe78bf1c71469ffa1e69ea37386281f0c273cd656"
     },
     {
       "path": "public-docs/index.html",
@@ -8957,7 +8987,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "1e79c9b3c2692c720aac6166d50e881f8069d94be738e57e6eef882ea2ec9d4a"
+      "sha256": "f6b10e5e103f5007ef31e7d2f53c95e146a93562f5a5465ea4e85da2baeb3c52"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10117,7 +10147,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "8a7b0e6b5d899bc2706d952d2383ee5b45758810b7f7d5bd5b7ebc2fc547e43e"
+      "sha256": "d891a37574626191f7abc01c50a64178a128e4f8b53ceb17ad6ed6d7439bc56e"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -10927,7 +10957,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "0a4448143b5673781ab21a3ec982a3a183c410caeb7e3afd3ba5d69586de06b2"
+      "sha256": "c7809ca26bf270ff260b79bf83f9c7dec27616c375ff8e9db78867a2a26a63eb"
     },
     {
       "path": "src/bongos/routes.js",
@@ -11072,7 +11102,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3e5ca31fb6e6c2fc7f351aa64ef4946c206050c6c34df748946a794011cd6f66"
+      "sha256": "b2361eff082828662c898922d47f4968192f852af7fbf5b03365c7624ffbfc55"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12874,6 +12904,11 @@
       "mode": "0000644",
       "sha256": "ba1c95ca55d8d8e256ba03f2543e44cee4272b9652742343617e35cebefe3ab9"
     },
+    {
+      "path": "tests/government_charter_forms.mjs",
+      "mode": "0000644",
+      "sha256": "0e6e006ad15a39e34b22793be7c6987a8602690f48b65998da04358fd8be3449"
+    },
     {
       "path": "tests/government_charter_library.mjs",
       "mode": "0000644",
@@ -14349,6 +14384,11 @@
       "mode": "0000644",
       "sha256": "6c623a5abe9aadf4821ad8ca291fb5d7805a7a5bc874bfc3cd7e51e83de289d2"
     },
+    {
+      "path": "tests/pending_invite_purge_db.mjs",
+      "mode": "0000644",
+      "sha256": "afc10a1fa260b41133399037cc7c6b1acdde91f9ffac5d62fa7d84f680138b8b"
+    },
     {
       "path": "tests/permission_path.mjs",
       "mode": "0000644",
@@ -14754,6 +14794,11 @@
       "mode": "0000644",
       "sha256": "c9fa4aa59e6e47c139277e3c57298ca441180c4d4752ca6994c72678219df8c8"
     },
+    {
+      "path": "tests/provisioning_planet_physics.mjs",
+      "mode": "0000644",
+      "sha256": "febbdbf82e7521ef80fb00d48a0a5fa9edf063ec20efbb39ddf59051c5cad4b2"
+    },
     {
       "path": "tests/provisioning_public_refusal.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 464 operations across 70 resource groups
+- 465 operations across 70 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -465,6 +465,8 @@ function createClient(opts = {}) {
       postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
       // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
       deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // POST /government/board/charter — rank: metic+archon — POST /government/board/charter
+      postGovernmentBoardCharter: (args) => request("POST", "/government/board/charter", { hasBody: true }, args),
       // GET /government/board/genesis-stages — rank: any-builder — GET /government/board/genesis-stages
       getGovernmentBoardGenesisStages: (args) => request("GET", "/government/board/genesis-stages", { hasBody: false }, args),
       // GET /government/board/items — rank: any-builder — GET /government/board/items

package/clients/bongos-client/index.cjs

@@ -464,6 +464,8 @@ function createClient(opts = {}) {
       postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
       // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
       deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // POST /government/board/charter — rank: metic+archon — POST /government/board/charter
+      postGovernmentBoardCharter: (args) => request("POST", "/government/board/charter", { hasBody: true }, args),
       // GET /government/board/genesis-stages — rank: any-builder — GET /government/board/genesis-stages
       getGovernmentBoardGenesisStages: (args) => request("GET", "/government/board/genesis-stages", { hasBody: false }, args),
       // GET /government/board/items — rank: any-builder — GET /government/board/items

package/clients/bongos-client/index.d.ts

@@ -219,7 +219,7 @@ export interface PatchProjectsIdFeaturedResponse { project: unknown }
 export interface PatchProjectsIdStatusRequest { status: string }
 export interface PatchProjectsIdStatusResponse { project: unknown }
 export interface PatchProvisioningInstancesIdDetailRequest { description?: string; detail?: Record<string, unknown>; modules?: string[]; type?: string }
-export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; description: unknown; detail: unknown; options: unknown; publish: unknown; modules: unknown; type: unknown }
+export interface PatchProvisioningInstancesIdDetailResponse { ok: boolean; description: unknown; detail: unknown; options: unknown; soft_limits: unknown; publish: unknown; modules: unknown; type: unknown }
 export interface PatchProvisioningInstancesIdEnvManifestVarIdRequest { name?: string; description?: string; environments?: unknown[]; required?: boolean }
 export interface PatchProvisioningInstancesIdEnvManifestVarIdResponse { ok: boolean; env_var: unknown; values_held: boolean }
 export interface PatchProvisioningInstancesIdSettingsResponse { ok: boolean; saved: unknown; planet: unknown; push: unknown }
@@ -330,6 +330,8 @@ export interface PostGoalsReorderResponse { ok: boolean; goals: unknown }
 export interface PostGoalsRequest { version_id: string; title: string; subtitle?: string; description?: string; scope_modules?: string[]; succeeds_goal_id?: number; category_id?: number; admit_reason?: string }
 export interface PostGoalsResponse { ok: boolean; goal: unknown; succeeds_goal_id: unknown; category_advisory: unknown; admitted: unknown }
 export interface PostGovernmentAssignmentsRequest { builder_id: number; rank_key: string }
+export interface PostGovernmentBoardCharterRequest { form?: string; franchise?: string; council_rank?: string; pass_rule?: string; rationale_md?: string; acknowledge_self_removal?: boolean }
+export interface PostGovernmentBoardCharterResponse { ok: boolean; amendment: unknown; item: unknown; reads_as: unknown }
 export interface PostGovernmentBoardItemsItemIdVotesRequest { direction: string; reason_md?: string; section_key?: string }
 export interface PostGovernmentBoardItemsRequest { subject_type: string; proposal: Record<string, unknown>; rationale_md?: string; acknowledge_self_removal?: boolean }
 export interface PostGovernmentBoardItemsResponse { ok: boolean; amendment: unknown; item: unknown }
@@ -894,6 +896,8 @@ export interface BongosClient {
     postGovernmentAssignments(args: RequestArgs & { body: PostGovernmentAssignmentsRequest }): Promise<ApiResponse>;
     /** DELETE /government/assignments/{builderId}/{rankKey} — rank: archon */
     deleteGovernmentAssignmentsBuilderIdRankKey(args?: RequestArgs): Promise<DeleteGovernmentAssignmentsBuilderIdRankKeyResponse>;
+    /** POST /government/board/charter — rank: metic+archon */
+    postGovernmentBoardCharter(args?: RequestArgs & { body?: PostGovernmentBoardCharterRequest }): Promise<PostGovernmentBoardCharterResponse>;
     /** GET /government/board/genesis-stages — rank: any-builder */
     getGovernmentBoardGenesisStages(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /government/board/items — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -461,6 +461,8 @@ export function createClient(opts = {}) {
       postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
       // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
       deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // POST /government/board/charter — rank: metic+archon — POST /government/board/charter
+      postGovernmentBoardCharter: (args) => request("POST", "/government/board/charter", { hasBody: true }, args),
       // GET /government/board/genesis-stages — rank: any-builder — GET /government/board/genesis-stages
       getGovernmentBoardGenesisStages: (args) => request("GET", "/government/board/genesis-stages", { hasBody: false }, args),
       // GET /government/board/items — rank: any-builder — GET /government/board/items

package/docs/adr/0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md

@@ -55,7 +55,7 @@ The two notice routes are **new**. An older hub answers 404, the sender swallows
 ## Consequences
 
 - **The done-when holds for every invite created from now on.** A hub notice exists only because the project wrote an `invited` row, and a rescind that closes the door removes the notice. The hub's own invite creates no row at all.
-- **Rows written before this change are untouched.** Pending rows the old hub invite wrote still render as **Open project →**, and on a door other than `open` they still lead to the project's gate. The invitee can decline them, and the project can clear one by inviting and then rescinding. Deleting them at deploy would need a data migration, and it would also delete notices that do work (on `open` doors). That is left to the owner (see the task's handoff), not done silently here.
+- **Rows written before this change are untouched.** Pending rows the old hub invite wrote still render as **Open project →**, and on a door other than `open` they still lead to the project's gate. The invitee can decline them, and the project can clear one by inviting and then rescinding. Deleting them at deploy would need a data migration, and it would also delete notices that do work (on `open` doors). That is left to the owner (see the task's handoff), not done silently here. **Amended (task 1004408):** the owner chose to delete them. Migration `<redacted>` deletes every `pending` row older than the hub's first upgrade to core 1.20.22 (the first release carrying this ADR), read from the `core_upgrades` ledger, or every `pending` row if there is no such upgrade. Old rows on `open` doors go too; those invitees can still sign in to the project, and the inviter can re-invite from the project's hall. Proof: `tests/pending_invite_purge_db.mjs`.
 - **The hub's invite now reaches people with no platform account.** The project's own invite takes any GitHub login, so the old `account_not_found` refusal is gone. Such an invitee sees no hub notice, because there is no account to show it to, but they are admitted when they sign in.
 - **Three things still bypass the notice**, all by scope: the reviewer queue's approve (`PATCH` pending → invited), the Discord approval reaction, and R3's future recruiter rescind route. The first two are approvals of an application the applicant already knows about. R3 (task 1002815) must call the same port when it adds its rescind.
 - **The 30-day invite expiry** (task 1002969) is read-time on the instance. An expired invite's hub notice stays until the invitee declines it or the project re-invites and rescinds. Task 1002969 owns closing that.

package/docs/adr/0355-a-soft-limit-is-a-rule-with-a-reason-and-nobody-enforces-it.md

@@ -0,0 +1,30 @@
+# ADR 0355 — A soft limit is a rule with a reason, and nobody enforces it
+
+- **Status:** accepted
+- **Date:** 2026-09-30
+- **Task:** [task 1004416](https://cloudbongos.com/builders#/task/1004416) (BV2.PS02, goal 1000121)
+- **Interacts with:** [ADR 0239](0239-a-recommendation-is-a-table-that-carries-its-own-reason.md) (a recommendation is a table that carries its own reason), the spec [`docs/specs/<redacted>.md`](../specs/<redacted>.md) decision D6
+
+## Context
+
+The new startup flow asks seven "planet physics" questions before any technical setup: state, geography, ages, entity, builders, rewards and framing. The answers carry legal weight. An individual has no shares to give, cash payouts to EU builders are not available yet, and 13 to 15 year olds join non-monetary tracks only. Spec decision D6 says the flow should grey or hide options that clearly do not apply, each with a line saying why. It also says nothing enforces these limits yet, and no screen may claim otherwise.
+
+The flow also needs a stop screen: a project whose description is something Cloud Bongos will not help build is stopped before anything is created. The real classifier is out of scope.
+
+## Decision
+
+**D1: The answers are more `detail` keys.** They ride the provisioning `detail` jsonb under the same contract as `team_shape`: no defaults, an unknown value refused loudly at the route, and `null` to un-answer. Two new kinds of question join the closed single answer. A `many` question takes a list of members, stored de-duplicated in the vocabulary's order. A `count` question takes a whole number in a range. `PROJECT_DETAIL_QUESTIONS` is the whole contract. `PROJECT_DETAIL_VOCAB` stays the closed answer lists, so every existing reader and the `options` reply keep their shape. The country is a closed ISO 3166-1 list rather than a two-letter pattern, so a typo like `ZZ` is refused instead of stored.
+
+**D2: Answers must agree only within one request.** The main kind of work must be one of the existing kinds, and the region must be inside the country, when both arrive in the same body. A merge patch may change one half now and the other later, and refusing a write because it disagrees with a stored answer would make the order of edits matter.
+
+**D3: The soft limits are one declarative table, and every resolution says `enforced: false`.** Each rule has a `when` (data, never a function), the options it names, an effect (`hide`, `grey` or `note`) and an owner-facing reason. Because conditions are data, a test can check every rule against the vocabulary, and a browser could evaluate the same table. An unanswered key never matches, so no rule fires on an answer nobody gave. `note` exists because some options apply only in part: cash is still available to builders outside the EU, so greying it would be wrong. The resolution rides every owner read of a project and the `PATCH …/detail` reply. A test fails any reason worded as if the limit were enforced.
+
+**D4: Screening is a seam with a deliberately small rule set.** `screenProject(texts, rules)` takes the project's own words and returns `{ stop }`. The real classifier replaces the rules or the function body, and no caller changes. A keyword rule that stops an honest project is worse than one that misses a bad one, so each rule names something no legitimate project is built to be. An `unless` lets a defensive project through (a ransomware detector, a phishing-awareness course). A stop is a 422 `screened_out` with the canvas's own sentence. Nothing in the reply names the rule, because a gate that says which rule it tripped teaches a caller how to reword around it. Whoever answers "contact us" reads the description itself.
+
+**D5: The screen runs on the edit route too.** The stop happens on create before any row or intent exists. `PATCH …/detail` screens a new description as well. Otherwise a project could be created with no description and given the stopped one straight afterwards.
+
+## Consequences
+
+- No migration: `detail` is a dumb jsonb store, so new questions cost none.
+- The age tiers and payout geography are stored facts, not policy. Server-side enforcement is a later goal, and it will read these keys.
+- The screen's false positives are the risk to watch. Until the classifier exists, a rule should be added only when it cannot plausibly describe an honest project.

package/docs/adr/README.md

@@ -473,3 +473,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0352 | [**A rollup report carries its "as of" in a header, and the hub keeps the newest** ([task 1004268](https://cloudbongos.com/builders#/task/1004268), goal 1000110). `POST /sso/activity/rollup` was last-writer-wins with no report timestamp, so a sign-in push read earlier and a ship push read later could land the older totals last. **D1:** the instance's read time rides a `Bongos-Report-As-Of` HEADER, not a body field, because the hub validates the body strictly and hub and instances upgrade independently: a body field from a newer instance would 400 on an older hub and lose the report, while an unknown header is ignored. **D2:** missing or unparseable = unstamped = last-writer-wins, never a 400. **D3:** the guard is a WHERE on the upsert's conflict branch (migration 026, `reported_as_of`, no backfill); a skipped update keeps the row lock, so the task 1004244 snapshot stays in step. **D4:** the stamp is compared only with the same client's, and clamped to the hub's `now()`.](0352-a-rollup-report-carries-its-as-of-in-a-header.md) | platform identity / federation |
 | 0353 | [**A hub invite is a notice of the project's own invite, and signing in accepts it** ([task 1002818](https://cloudbongos.com/builders#/task/1002818), goal 1000110 — R6 of the admin console wave). The hub's own invite wrote a `pending` membership that no project reads, so an "accepted" invite met a locked door (new projects default to `apply`). **D1:** that row is now a NOTICE the PROJECT writes: its invite route calls `POST /sso/invites/notify` and a dismissal that leaves no invited row calls `/sso/invites/clear` (client credentials, pending rows only, always `{ ok: true }` so no account oracle); core's `notifyHubOfInvite` is fire-and-forget. **D2:** the hub-side accept route is deleted; signing in to the project accepts, and the hub's own sign-in witness turns the row into a membership. **D3 (owner):** `POST /projects/invite` writes nothing and answers `{ invited: false, invite_url }`, the project's hall invite link (`/builders/watch?invite=<login>`, which only pre-fills); the signed-assertion relay is deferred. **D4:** new routes, so an older hub 404s and only the notice is lost (ADR 0352).](0353-a-hub-invite-is-a-notice-of-the-projects-own-invite.md) | platform identity / federation |
 | 0354 | [**A builder hosts one project for free, and more takes the fleet permission** ([task 1004412](https://cloudbongos.com/builders#/task/1004412), goal 1000106 — working area 1, the owner's ruling of 2026-09-30). The create wizard always asks for `cloud-host`, which task 1003370 had gated behind `provisioning.fleet.manage`, so every new (Xenos) user was refused at "Create my project" — against ADR 0345 decision 1. **D1:** a builder's first live `cloud-host` project needs no permission; a further one needs the fleet permission (a retry of your own slug is the same project; only `torn_down` frees the place; an unreadable count refuses). **D2:** one first-free request per builder at a time (409 `create_in_progress`), held as a Postgres advisory lock so it holds across processes. **D3:** the wizard states `permission_forbidden` and `box_full` in plain words. Nothing yet caps a hosted project's memory.](0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md) | provisioning / security / project creation |
+| 0355 | [**A soft limit is a rule with a reason, and nobody enforces it** ([task 1004416](https://cloudbongos.com/builders#/task/1004416), goal 1000121 — BV2.PS02). The startup flow's seven planet-physics answers and what they rule out. **D1:** the answers are more provisioning `detail` keys under `team_shape`'s contract (no defaults, refused loudly, `null` un-answers), with two new kinds — a list (`many`) and a whole number (`count`); the country is a closed ISO list. **D2:** answers must agree only within one request, so a merge patch's edit order never matters. **D3:** one declarative soft-limit table (`soft-limits.js`) — data conditions, `hide`/`grey`/`note`, a reason on every rule — and every resolution says `enforced: false`. **D4:** screening is a seam (`screening.js`) with a deliberately small rule set; a stop is 422 `screened_out` before anything exists. **D5:** the edit route screens a new description too.](0355-a-soft-limit-is-a-rule-with-a-reason-and-nobody-enforces-it.md) | provisioning / project startup |

package/docs/api/openapi.json

@@ -7898,6 +7898,58 @@
         ]
       }
     },
+    "/government/board/charter": {
+      "post": {
+        "operationId": "post_government_board_charter",
+        "tags": [
+          "government"
+        ],
+        "summary": "POST /government/board/charter",
+        "description": "board.item.open — the genesis charter + legislation choice (task 1004427, spec D10): a form of government and/or its two live settings (franchise, pass rule), built into a whole constitution on top of the live one and filed through the SAME amendment path as the route above — the same atom, the same strict validation, the same self-removal guard. Nothing here changes the constitution; the sitting it opens is what decides.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `board.item.open` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/government/routes/government.js",
+        "x-permissions": [
+          "board.item.open"
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostGovernmentBoardCharterRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostGovernmentBoardCharterResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/government/board/genesis-stages": {
       "get": {
         "operationId": "get_government_board_genesis_stages",
@@ -24576,6 +24628,7 @@
           "description": {},
           "detail": {},
           "options": {},
+          "soft_limits": {},
           "publish": {},
           "modules": {},
           "type": {}
@@ -24585,6 +24638,7 @@
           "description",
           "detail",
           "options",
+          "soft_limits",
           "publish",
           "modules",
           "type"
@@ -26511,6 +26565,52 @@
         ],
         "additionalProperties": false
       },
+      "PostGovernmentBoardCharterRequest": {
+        "type": "object",
+        "properties": {
+          "form": {
+            "type": "string",
+            "maxLength": 64
+          },
+          "franchise": {
+            "type": "string",
+            "maxLength": 32
+          },
+          "council_rank": {
+            "type": "string",
+            "maxLength": 64
+          },
+          "pass_rule": {
+            "type": "string",
+            "maxLength": 32
+          },
+          "rationale_md": {
+            "type": "string",
+            "maxLength": 5000
+          },
+          "acknowledge_self_removal": {
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": false
+      },
+      "PostGovernmentBoardCharterResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "amendment": {},
+          "item": {},
+          "reads_as": {}
+        },
+        "required": [
+          "ok",
+          "amendment",
+          "item",
+          "reads_as"
+        ]
+      },
       "PostGovernmentBoardItemsItemIdVotesRequest": {
         "type": "object",
         "properties": {
@@ -29663,9 +29763,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 464,
-  "x-schema-count": 496,
+  "x-endpoint-count": 465,
+  "x-schema-count": 498,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 336,
+  "x-response-schemas": 337,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 464 endpoints across 83 route files.
+> **Generated from the live route files** — the route file is authoritative. 465 endpoints across 83 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -310,13 +310,14 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/goals/rollups` | `any-builder` | — | GET /goals/rollups?version= — one small row per goal: readiness counters, the last-activity timestamp, the craft set, and the next claima… |
 | GET | `/api/bongos/goals/suggestions` | `any-builder` | — | GET /goals/suggestions — "which goal should this draft live in?", answered before anything is created (task 1003062 / R07). |
 
-## `government` (14)
+## `government` (15)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/government/assignments` | `archon` | — | government.manage — every builder↔rank assignment row. |
 | POST | `/api/bongos/government/assignments` | `archon` | `builder_id`, `rank_key` | government.manage — assign a CUSTOM rank to a builder. |
 | DELETE | `/api/bongos/government/assignments/:builderId/:rankKey` | `archon` | — | government.manage — remove a custom-rank assignment. |
+| POST | `/api/bongos/government/board/charter` | `metic+archon` | `form`, `franchise`, `council_rank`, `pass_rule`, `rationale_md`, `acknowledge_self_removal` | board.item.open — the genesis charter + legislation choice (task 1004427, spec D10): a form of government and/or its two live settings (f… |
 | GET | `/api/bongos/government/board/genesis-stages` | `any-builder` | — | board.vote.cast — the founding band's read (task 1004429): each genesis stage's latest sitting, and who it is still waiting on under the … |
 | GET | `/api/bongos/government/board/items` | `any-builder` | — | board.vote.cast — the Board Room view: open items with their clock, the OPEN BALLOT, the closed history (R16 of goal 1000069). |
 | POST | `/api/bongos/government/board/items` | `metic+archon` | `subject_type`, `proposal`, `rationale_md`, `acknowledge_self_removal` | board.item.open — put an AMENDMENT to the board (R14 of goal 1000069, ADR 0175 §7). |