@bongos/core 1.20.37 → 1.20.38

package/clients/bongos-client/index.cjs

@@ -176,6 +176,8 @@ function createClient(opts = {}) {
       postAutonomyFenceGoals: (args) => request("POST", "/autonomy/fence/goals", { hasBody: true }, args),
       // DELETE /autonomy/fence/goals/{goalId} — rank: archon — DELETE /autonomy/fence/goals/:goalId
       deleteAutonomyFenceGoalsGoalId: (args) => request("DELETE", "/autonomy/fence/goals/{goalId}", { hasBody: false }, args),
+      // POST /autonomy/fence/priority — rank: archon — POST /autonomy/fence/priority
+      postAutonomyFencePriority: (args) => request("POST", "/autonomy/fence/priority", { hasBody: true }, args),
       // POST /autonomy/heartbeat — rank: any-builder — POST /autonomy/heartbeat
       postAutonomyHeartbeat: (args) => request("POST", "/autonomy/heartbeat", { hasBody: true }, args),
       // GET /autonomy/precheck — rank: metic+archon — GET /autonomy/precheck
@@ -367,6 +369,10 @@ function createClient(opts = {}) {
       // GET /done-when/pending-review — rank: metic+archon — GET /done-when/pending-review
       getDoneWhenPendingReview: (args) => request("GET", "/done-when/pending-review", { hasBody: false }, args),
     },
+    "feedback": {
+      // POST /feedback — rank: any-builder — POST /feedback
+      postFeedback: (args) => request("POST", "/feedback", { hasBody: true }, args),
+    },
     "gateApprovals": {
       // GET /gate-approvals — rank: metic+archon — GET /gate-approvals
       getGateApprovals: (args) => request("GET", "/gate-approvals", { hasBody: false }, args),
@@ -1018,6 +1024,8 @@ function createClient(opts = {}) {
       postSsoDevicePoll: (args) => request("POST", "/sso/device/poll", { hasBody: true }, args),
       // POST /sso/device/start — rank: public — POST /sso/device/start
       postSsoDeviceStart: (args) => request("POST", "/sso/device/start", { hasBody: true }, args),
+      // POST /sso/feedback — rank: public — POST /sso/feedback
+      postSsoFeedback: (args) => request("POST", "/sso/feedback", { hasBody: true }, args),
       // POST /sso/invites/clear — rank: public — POST /sso/invites/clear
       postSsoInvitesClear: (args) => request("POST", "/sso/invites/clear", { hasBody: true }, args),
       // POST /sso/invites/notify — rank: public — POST /sso/invites/notify

package/clients/bongos-client/index.d.ts

@@ -251,8 +251,9 @@ export interface PostAuthRevokeRequest { session_id?: StringifiableId }
 export interface PostAuthRevokeResponse { ok: boolean; revoked: unknown }
 export interface PostAutonomyFenceGoalsRequest { goal_id: StringifiableId; note?: string }
 export interface PostAutonomyFenceGoalsResponse { goal: unknown }
+export interface PostAutonomyFencePriorityRequest { goal_id?: StringifiableId }
 export interface PostAutonomyFenceRequest { enabled: boolean; reason?: string }
-export interface PostAutonomyHeartbeatRequest { host: string; pid?: number; started_at?: string; mode?: string; consecutive_failures?: number; last_event?: string; working_task_id?: number }
+export interface PostAutonomyHeartbeatRequest { host: string; pid?: number; started_at?: string; mode?: string; consecutive_failures?: number; last_event?: string; working_task_id?: number; working_goal_id?: number }
 export interface PostAutonomyHeartbeatResponse { ok: boolean; heartbeat: unknown }
 export interface PostBackupTriggerResponse { ok: boolean; message: unknown; started_at: unknown }
 export interface PostBlockersIdLinkRequest { task_id: StringifiableId }
@@ -293,6 +294,7 @@ export interface PostDoneWhenCriterionIdUatRecordingResponse { ok: boolean; reco
 export interface PostDoneWhenCriterionIdUatRequest { kind: string; recording?: string; live_attested?: boolean; note?: string }
 export interface PostDoneWhenCriterionIdUatResponse { ok: boolean; signoff: unknown; criterion_closed: unknown; achieved_goals: unknown; closed_versions: unknown }
 export interface PostDoneWhenCriterionIdUnsatisfyResponse { criterion: unknown }
+export interface PostFeedbackRequest { message: string; kind?: "bug" | "idea"; context?: unknown }
 export interface PostGateApprovalsPrApproveResponse { ok: boolean; pr: unknown; already_clear?: boolean; message: unknown; head_sha?: unknown; status_set?: boolean; recheck?: unknown; held_for_artist?: unknown }
 export interface PostGithubRepoVisibilityRequest { repo: string; visibility: "public" | "private" }
 export interface PostGithubRepoVisibilityResponse { ok: boolean; repo: unknown; private_deployable: boolean }
@@ -445,6 +447,7 @@ export interface PostSsoApplicantProfileRequest { client_id: string; client_secr
 export interface PostSsoApplicantProfileResponse { profile: unknown }
 export interface PostSsoDevicePollRequest { device_code: string }
 export interface PostSsoDeviceStartRequest { origin: string }
+export interface PostSsoFeedbackRequest { client_id: string; client_secret: string; github_id: StringifiableId; message: string; kind?: string; context?: unknown }
 export interface PostSsoInvitesClearRequest { client_id: string; client_secret: string; github_login: string }
 export interface PostSsoInvitesNotifyRequest { client_id: string; client_secret: string; github_login: string }
 export interface PostSsoMembershipCheckInRequest { client_id: string; client_secret: string; github_id: StringifiableId; github_login: string; display_name?: string; avatar_url?: string; membership_kind?: string }
@@ -608,6 +611,8 @@ export interface BongosClient {
     postAutonomyFenceGoals(args: RequestArgs & { body: PostAutonomyFenceGoalsRequest }): Promise<PostAutonomyFenceGoalsResponse>;
     /** DELETE /autonomy/fence/goals/{goalId} — rank: archon */
     deleteAutonomyFenceGoalsGoalId(args?: RequestArgs): Promise<ApiResponse>;
+    /** POST /autonomy/fence/priority — rank: archon */
+    postAutonomyFencePriority(args?: RequestArgs & { body?: PostAutonomyFencePriorityRequest }): Promise<ApiResponse>;
     /** POST /autonomy/heartbeat — rank: any-builder */
     postAutonomyHeartbeat(args: RequestArgs & { body: PostAutonomyHeartbeatRequest }): Promise<PostAutonomyHeartbeatResponse>;
     /** GET /autonomy/precheck — rank: metic+archon */
@@ -799,6 +804,10 @@ export interface BongosClient {
     /** GET /done-when/pending-review — rank: metic+archon */
     getDoneWhenPendingReview(args?: RequestArgs): Promise<GetDoneWhenPendingReviewResponse>;
   };
+  "feedback": {
+    /** POST /feedback — rank: any-builder */
+    postFeedback(args: RequestArgs & { body: PostFeedbackRequest }): Promise<ApiResponse>;
+  };
   "gateApprovals": {
     /** GET /gate-approvals — rank: metic+archon */
     getGateApprovals(args?: RequestArgs): Promise<ApiResponse>;
@@ -1450,6 +1459,8 @@ export interface BongosClient {
     postSsoDevicePoll(args: RequestArgs & { body: PostSsoDevicePollRequest }): Promise<ApiResponse>;
     /** POST /sso/device/start — rank: public */
     postSsoDeviceStart(args: RequestArgs & { body: PostSsoDeviceStartRequest }): Promise<ApiResponse>;
+    /** POST /sso/feedback — rank: public */
+    postSsoFeedback(args: RequestArgs & { body: PostSsoFeedbackRequest }): Promise<ApiResponse>;
     /** POST /sso/invites/clear — rank: public */
     postSsoInvitesClear(args: RequestArgs & { body: PostSsoInvitesClearRequest }): Promise<ApiResponse>;
     /** POST /sso/invites/notify — rank: public */

package/clients/bongos-client/index.mjs

@@ -173,6 +173,8 @@ export function createClient(opts = {}) {
       postAutonomyFenceGoals: (args) => request("POST", "/autonomy/fence/goals", { hasBody: true }, args),
       // DELETE /autonomy/fence/goals/{goalId} — rank: archon — DELETE /autonomy/fence/goals/:goalId
       deleteAutonomyFenceGoalsGoalId: (args) => request("DELETE", "/autonomy/fence/goals/{goalId}", { hasBody: false }, args),
+      // POST /autonomy/fence/priority — rank: archon — POST /autonomy/fence/priority
+      postAutonomyFencePriority: (args) => request("POST", "/autonomy/fence/priority", { hasBody: true }, args),
       // POST /autonomy/heartbeat — rank: any-builder — POST /autonomy/heartbeat
       postAutonomyHeartbeat: (args) => request("POST", "/autonomy/heartbeat", { hasBody: true }, args),
       // GET /autonomy/precheck — rank: metic+archon — GET /autonomy/precheck
@@ -364,6 +366,10 @@ export function createClient(opts = {}) {
       // GET /done-when/pending-review — rank: metic+archon — GET /done-when/pending-review
       getDoneWhenPendingReview: (args) => request("GET", "/done-when/pending-review", { hasBody: false }, args),
     },
+    "feedback": {
+      // POST /feedback — rank: any-builder — POST /feedback
+      postFeedback: (args) => request("POST", "/feedback", { hasBody: true }, args),
+    },
     "gateApprovals": {
       // GET /gate-approvals — rank: metic+archon — GET /gate-approvals
       getGateApprovals: (args) => request("GET", "/gate-approvals", { hasBody: false }, args),
@@ -1015,6 +1021,8 @@ export function createClient(opts = {}) {
       postSsoDevicePoll: (args) => request("POST", "/sso/device/poll", { hasBody: true }, args),
       // POST /sso/device/start — rank: public — POST /sso/device/start
       postSsoDeviceStart: (args) => request("POST", "/sso/device/start", { hasBody: true }, args),
+      // POST /sso/feedback — rank: public — POST /sso/feedback
+      postSsoFeedback: (args) => request("POST", "/sso/feedback", { hasBody: true }, args),
       // POST /sso/invites/clear — rank: public — POST /sso/invites/clear
       postSsoInvitesClear: (args) => request("POST", "/sso/invites/clear", { hasBody: true }, args),
       // POST /sso/invites/notify — rank: public — POST /sso/invites/notify

package/docs/adr/0136-update-channel-subscription-policy.md

@@ -1,7 +1,7 @@
 # ADR 0136 — Update-channel subscription policy (patch-only, health-gated, opt-in, autonomy-gated)
 
 **Date:** 2026-07-10
-**Status:** Accepted.
+**Status:** Accepted. Amended by [ADR 0357](0357-the-update-rule-set-on-deploy-is-the-one-the-sweep-follows.md) (2026-09-30): a project's channel is now its `provisioning_instances.update_channel`, set on /deploy; the roster's `channel` is only the fallback.
 **Context:** [task 2150](https://example.com/builders#/task/2150) (BONGOS-V1, goal 26). The last piece of the update-consumption workstream: [ADR 0100](0100-two-repo-instance-model.md) §2 / [task 1690](https://example.com/builders#/task/1690) gave a consumer the manual `bongos upgrade` channel; [ADR 0134](0134-private-first-npm-distribution.md) / [task 2090](https://example.com/builders#/task/2090) added the private-registry source; [task 2149](https://example.com/builders#/task/2149) added auto-rollback; [task 2157](https://example.com/builders#/task/2157) proved rollback live on the demo instance. What was missing is the **subscription** — how a consumer instance takes new releases *on a cadence, unattended*, rather than a human running `bongos upgrade` each time. Builds on the scheduled-routines portability contract ([ADR 0115](0115-scheduled-routines-portability.md)).
 
 ## Problem

package/docs/adr/0357-the-update-rule-set-on-deploy-is-the-one-the-sweep-follows.md

@@ -0,0 +1,41 @@
+# ADR 0357 — The update rule set on /deploy is the one the sweep follows
+
+- **Status:** accepted
+- **Date:** 2026-09-30
+- **Task:** [task 1004468](https://cloudbongos.com/builders#/task/1004468) (goal 1000090, BONGOS-V2)
+- **Amends:** [ADR 0136](0136-update-channel-subscription-policy.md), "Alternatives considered" (a `provisioning_instances` column for the channel) and its Consequences line naming `config/update-subscriptions.json` as the one place a channel is set
+- **Builds on:** [task 1004445](https://cloudbongos.com/builders#/task/1004445) (migration provisioning_029, `POST /provisioning/instances/:id/update-channel`), [ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md) (the deploy door)
+- **Decided with:** the owner, 2026-09-30. Asked "which one decides how far a project auto-updates, the site setting or the server file?", they chose the site setting.
+
+## Context
+
+ADR 0136 put each subscribed instance's update channel (`pinned` / `patch` / `minor`) in the roster file `config/update-subscriptions.json`, and it rejected a `provisioning_instances` column because the fleet registry was not yet designed. By the time of [ADR 0325](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md), `provisioning_instances` *was* the registry. Task 1004445 then added `update_channel` to it, so the owner could set the rule on /deploy, and the deploy door's runner obeys it.
+
+That left two rules for one project. On 2026-09-30 cloudbongos.com was set to `minor` on /deploy and still `patch` in the box roster. The button followed the first and the unattended sweep the second, so a step-up release (1.20 → 1.21) would never land unattended even though /deploy said it would. Task 1004451's proof was graded down for exactly this.
+
+## Decision
+
+**D1. The project row is the rule.** For a roster entry whose `slug` matches a `provisioning_instances` row, the sweep uses that row's `update_channel`. The match is by slug, the only stable key the table carries (it records no directory).
+
+**D2. The roster's `channel` is a fallback, not a second vote.** It applies only when no row matches (an instance the control plane never provisioned) or when the sweep cannot read the database. The roster keeps everything else it holds — `dir`, service, health URL, topology, `env`, pin mode — because the registry doesn't record those.
+
+**D3. Every fallback says so.** The sweep prints each entry's channel and where it came from ("set on /deploy", or "from the roster — <reason>"). When the row overrides a different roster value, the log names the ignored value too. A silent fallback is how two rules drifted apart in the first place.
+
+**D4. It reads the control plane's database, over psql, from the sweep's own environment** — `DATABASE_URL`, else `PGDATABASE` (socket + peer auth). These are the two variables `upgrade.js` `recordLedger` reads. Unlike recordLedger, it hands a `DATABASE_URL` to `psql -d` rather than the pg driver, because the sweep is synchronous. An entry's `env` is never used, because it names *that instance's* database. A core too old to carry the reader keeps the roster behaviour unchanged. A failure is logged as a fixed class (unreachable, login refused, table missing…), never psql's own text, which can name a user or host.
+
+**D1a. Why not slug *or* directory.** The task brief suggested matching by slug or dir. `provisioning_instances` stores no directory, so there is nothing to match a dir against, and a roster slug that differs from its row's slug falls back to the roster, visibly (D3).
+
+**D5. Nothing is migrated or copied.** Every row already has a channel (the column defaults to `patch`, the old behaviour). So once this is live, an entry the roster listed as `minor` but whose row was never changed on /deploy is swept as `patch`. That is the ruling applied, not a regression, and D3 makes it visible in the log.
+
+## Consequences
+
+- One place to change how far a project auto-updates, on the site, with no SSH.
+- ADR 0136's policy is otherwise unchanged: majors and prereleases are never automatic, every move is health-gated with auto-rollback, and the routine stays opt-in and autonomy-gated. Enrollment itself (which instances the sweep touches, and where they live) is still the roster.
+- **Delivery depends on the sweep running current code.** On cloudbongos.com the sweep runs from a checkout frozen at 2026-08-25 ([task 1004307](https://cloudbongos.com/builders#/task/1004307)). Until that is fixed, or the checkout is updated, a release carrying this change does not reach the sweep.
+- The rule is now testable in isolation: `tests/update_channel_db.mjs`.
+
+## Alternatives considered
+
+- **Keep the roster in charge (ADR 0136 as written).** Rejected by the owner: changing the unattended behaviour would stay an SSH edit, and /deploy would keep showing a setting the sweep ignores.
+- **Take the stricter of the two.** Rejected: safe, but setting `minor` on the site would do nothing until someone also edited the file, which is the same confusion in a new form.
+- **Copy the roster's channels into the rows first.** Rejected: the rows already hold the owner's deliberate choices (cloudbongos = `minor`), and a copy would overwrite a newer decision with an older file.

package/docs/adr/README.md

@@ -475,3 +475,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0354 | [**A builder hosts one project for free, and more takes the fleet permission** ([task 1004412](https://cloudbongos.com/builders#/task/1004412), goal 1000106 — working area 1, the owner's ruling of 2026-09-30). The create wizard always asks for `cloud-host`, which task 1003370 had gated behind `provisioning.fleet.manage`, so every new (Xenos) user was refused at "Create my project" — against ADR 0345 decision 1. **D1:** a builder's first live `cloud-host` project needs no permission; a further one needs the fleet permission (a retry of your own slug is the same project; only `torn_down` frees the place; an unreadable count refuses). **D2:** one first-free request per builder at a time (409 `create_in_progress`), held as a Postgres advisory lock so it holds across processes. **D3:** the wizard states `permission_forbidden` and `box_full` in plain words. Nothing yet caps a hosted project's memory.](0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md) | provisioning / security / project creation |
 | 0355 | [**A soft limit is a rule with a reason, and nobody enforces it** ([task 1004416](https://cloudbongos.com/builders#/task/1004416), goal 1000121 — BV2.PS02). The startup flow's seven planet-physics answers and what they rule out. **D1:** the answers are more provisioning `detail` keys under `team_shape`'s contract (no defaults, refused loudly, `null` un-answers), with two new kinds — a list (`many`) and a whole number (`count`); the country is a closed ISO list. **D2:** answers must agree only within one request, so a merge patch's edit order never matters. **D3:** one declarative soft-limit table (`soft-limits.js`) — data conditions, `hide`/`grey`/`note`, a reason on every rule — and every resolution says `enforced: false`. **D4:** screening is a seam (`screening.js`) with a deliberately small rule set; a stop is 422 `screened_out` before anything exists. **D5:** the edit route screens a new description too.](0355-a-soft-limit-is-a-rule-with-a-reason-and-nobody-enforces-it.md) | provisioning / project startup |
 | 0356 | [**A recruit invite expires 30 days after it is sent, decided at read time** ([task 1002969](https://cloudbongos.com/builders#/task/1002969), goal 1000110 — privacy spec D4, owner-signed). **D1:** one definition, `src/bongos/invite-expiry.js` (`INVITE_EXPIRY_DAYS` + the SQL), read by the sign-in gate, the waiting-page probe, the onboarding routes and, through the doorway's `inviteExpiry`, the hub. Nothing is stored and nothing sweeps. **D2:** only `kind='invite'` rows expire; approved applications and goal invites do not. **D3:** amends ADR 0335 D2.5: the gate reads `kind` only inside the expiry unit, which can close a door and never open one. **D4:** an expired invite is refused, marked `expired` + `expires_at` in the queues, reported `expired` by the status probe (the CLI stops), and replaced by a re-invite's fresh row. **D5:** the hub hides a `pending` notice past 30 days and a re-invite restamps it. Split out: `seen_at` (task 1004443), the decline relay (task 1004444).](0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md) | platform identity / admission / invites |
+| 0357 | [**The update rule set on /deploy is the one the sweep follows** ([task 1004468](https://cloudbongos.com/builders#/task/1004468), goal 1000090 — BONGOS-V2, owner's ruling 2026-09-30). Amends [ADR 0136](0136-update-channel-subscription-policy.md)'s rejected DB-column alternative. **D1:** for a roster entry whose slug matches a `provisioning_instances` row, the unattended sweep uses that row's `update_channel` (set on /deploy, task 1004445). **D2:** the roster's `channel` is only the fallback — no matching row, or the database unreadable; enrollment and topology stay in the roster. **D3:** the sweep logs each entry's channel and its source, naming an overridden roster value. **D4:** read over psql from the sweep's own `DATABASE_URL`/`PGDATABASE`, never an entry's `env`. **D5:** nothing is copied; a row never changed is `patch`. Delivery to cloudbongos.com waits on the frozen sweep checkout (task 1004307). Rejected: roster stays in charge; stricter-of-the-two; copying roster values into rows.](0357-the-update-rule-set-on-deploy-is-the-one-the-sweep-follows.md) | distribution / updates |

package/docs/api/openapi.json

@@ -121,6 +121,10 @@
       "name": "done-when",
       "description": "Endpoints under `/api/bongos/done-when`."
     },
+    {
+      "name": "feedback",
+      "description": "Endpoints under `/api/bongos/feedback`."
+    },
     {
       "name": "gate-approvals",
       "description": "Endpoints under `/api/bongos/gate-approvals`."
@@ -1890,6 +1894,51 @@
         ]
       }
     },
+    "/autonomy/fence/priority": {
+      "post": {
+        "operationId": "post_autonomy_fence_priority",
+        "tags": [
+          "autonomy"
+        ],
+        "summary": "POST /autonomy/fence/priority",
+        "description": "The priority goal (task 1004453): which allowlisted goal the runner works first. Same gate as the allowlist — choosing what an unattended machine does first is part of choosing what it may do. The goal must already be on the allowlist (409 otherwise), so a priority can order the list and never widen it. `goal_id: null` clears it.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `autonomy.fence.manage` (all required).",
+        "x-rank": "archon",
+        "x-source": "modules/autonomy/routes/autonomy.js",
+        "x-permissions": [
+          "autonomy.fence.manage"
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostAutonomyFencePriorityRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/autonomy/heartbeat": {
       "post": {
         "operationId": "post_autonomy_heartbeat",
@@ -5637,6 +5686,48 @@
         ]
       }
     },
+    "/feedback": {
+      "post": {
+        "operationId": "post_feedback",
+        "tags": [
+          "feedback"
+        ],
+        "summary": "POST /feedback",
+        "description": "signed-in builder — reporting a problem with Bongos grants nothing here, and the hub files every report at 'backlog' behind a Metic+ nod.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/feedback.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostFeedbackRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/gate-approvals": {
       "get": {
         "operationId": "get_gate_approvals",
@@ -18773,6 +18864,38 @@
         "security": []
       }
     },
+    "/sso/feedback": {
+      "post": {
+        "operationId": "post_sso_feedback",
+        "tags": [
+          "sso"
+        ],
+        "summary": "POST /sso/feedback",
+        "description": "POST /sso/feedback — a federated project relays one builder's feedback about Bongos itself (task 1004462). A bug becomes a 'backlog' task in the building version's maintenance goal; an idea becomes an inbox row. Why always backlog, and why the sender must be a witnessed member: ../instance-feedback.js. rank: public — authenticated by client_id + client_secret, not a builder rank. The per-project and per-sender caps run after the client check, so an unauthenticated caller cannot spend a real project's allowance.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/sso.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostSsoFeedbackRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          }
+        },
+        "security": []
+      }
+    },
     "/sso/invites/clear": {
       "post": {
         "operationId": "post_sso_invites_clear",
@@ -25188,6 +25311,15 @@
           "goal"
         ]
       },
+      "PostAutonomyFencePriorityRequest": {
+        "type": "object",
+        "properties": {
+          "goal_id": {
+            "$ref": "#/components/schemas/StringifiableId"
+          }
+        },
+        "additionalProperties": false
+      },
       "PostAutonomyFenceRequest": {
         "type": "object",
         "properties": {
@@ -25232,6 +25364,9 @@
           },
           "working_task_id": {
             "type": "number"
+          },
+          "working_goal_id": {
+            "type": "number"
           }
         },
         "required": [
@@ -25977,6 +26112,27 @@
           "criterion"
         ]
       },
+      "PostFeedbackRequest": {
+        "type": "object",
+        "properties": {
+          "message": {
+            "type": "string",
+            "maxLength": 4000
+          },
+          "kind": {
+            "type": "string",
+            "enum": [
+              "bug",
+              "idea"
+            ]
+          },
+          "context": {}
+        },
+        "required": [
+          "message"
+        ],
+        "additionalProperties": false
+      },
       "PostGateApprovalsPrApproveResponse": {
         "type": "object",
         "properties": {
@@ -28652,6 +28808,36 @@
         ],
         "additionalProperties": false
       },
+      "PostSsoFeedbackRequest": {
+        "type": "object",
+        "properties": {
+          "client_id": {
+            "type": "string",
+            "maxLength": 200
+          },
+          "client_secret": {
+            "type": "string",
+            "maxLength": 512
+          },
+          "github_id": {
+            "$ref": "#/components/schemas/StringifiableId"
+          },
+          "message": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "context": {}
+        },
+        "required": [
+          "client_id",
+          "client_secret",
+          "github_id",
+          "message"
+        ],
+        "additionalProperties": false
+      },
       "PostSsoInvitesClearRequest": {
         "type": "object",
         "properties": {
@@ -29812,8 +29998,8 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 466,
-  "x-schema-count": 498,
+  "x-endpoint-count": 469,
+  "x-schema-count": 501,
   "x-undocumented-bodies": 12,
   "x-response-schemas": 337,
   "x-generated-by": "scripts/gds/gen-api-docs.js"

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 466 endpoints across 83 route files.
+> **Generated from the live route files** — the route file is authoritative. 469 endpoints across 84 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -81,7 +81,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/auth/web/handoff` | `public` | — | GET /auth/web/handoff?code=&return= — the far side of the one-time session handoff (task 1004357). |
 | GET | `/api/bongos/auth/web/start` | `public` | — | /auth/web — browser flow (used by the /builders page). |
 
-## `autonomy` (8)
+## `autonomy` (9)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -89,7 +89,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/autonomy/fence` | `archon` | `enabled`, `reason` | The kill switch. |
 | POST | `/api/bongos/autonomy/fence/goals` | `archon` | `goal_id`, `note` | Add a goal to the allowlist. |
 | DELETE | `/api/bongos/autonomy/fence/goals/:goalId` | `archon` | — | Revoke one. |
-| POST | `/api/bongos/autonomy/heartbeat` | `any-builder` | `host`, `pid`, `started_at`, `mode`, `consecutive_failures`, `last_event`, `working_task_id` | The runner's check-in, once per loop. |
+| POST | `/api/bongos/autonomy/fence/priority` | `archon` | `goal_id` | The priority goal (task 1004453): which allowlisted goal the runner works first. |
+| POST | `/api/bongos/autonomy/heartbeat` | `any-builder` | `host`, `pid`, `started_at`, `mode`, `consecutive_failures`, `last_event`, `working_task_id`, `working_goal_id` | The runner's check-in, once per loop. |
 | GET | `/api/bongos/autonomy/precheck` | `metic+archon` | — |  |
 | GET | `/api/bongos/autonomy/runners` | `any-builder` | — | What the hall renders: the CALLER'S OWN runners, with the pure verdict attached so the page and any future alert cannot disagree about wh… |
 | GET | `/api/bongos/autonomy/runs` | `metic+archon` | — | The gate's past decisions — did a routine fire, and what did it decide, and why (task 1002669). |
@@ -249,6 +250,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/done-when/:criterionId/unsatisfy` | `metic+archon` | — | Auth: flip a criterion back to unsatisfied (rare; for corrections). |
 | GET | `/api/bongos/done-when/pending-review` | `metic+archon` | — | Auth (Metic+): the criterion review queue — every criterion auto-flagged "met — pending review" (≥1 linked task, all shipped, not yet con… |
 
+## `feedback` (1)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| POST | `/api/bongos/feedback` | `any-builder` | `message`, `kind`, `context` | signed-in builder — reporting a problem with Bongos grants nothing here, and the hub files every report at 'backlog' behind a Metic+ nod. |
+
 ## `gate-approvals` (2)
 
 | Method | Path | Rank | Body | Description |
@@ -721,7 +728,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/specialities/installed-skills` | `any-builder` | — | GET /specialities/installed-skills — every skill THIS instance has, each explained the way the adoption walkthrough explains it, so a spe… |
 | GET | `/api/bongos/specialities/offered` | `any-builder` | — | GET /specialities/offered — the suggestions for THIS builder. |
 
-## `sso` (10)
+## `sso` (11)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -730,6 +737,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sso/authorize` | `public` | — | GET /sso/authorize?client_id=&redirect_uri=&state= — the browser authorize leg. |
 | POST | `/api/bongos/sso/device/poll` | `public` | `device_code` | POST /sso/device/poll — poll the hub device flow. |
 | POST | `/api/bongos/sso/device/start` | `public` | `origin` | POST /sso/device/start — begin CLI federation. |
+| POST | `/api/bongos/sso/feedback` | `public` | `client_id`, `client_secret`, `github_id`, `message`, `kind`, `context` | POST /sso/feedback — a federated project relays one builder's feedback about Bongos itself (task 1004462). |
 | POST | `/api/bongos/sso/invites/clear` | `public` | `client_id`, `client_secret`, `github_login` | authenticated by client_id + client_secret, not a builder rank. |
 | POST | `/api/bongos/sso/invites/notify` | `public` | `client_id`, `client_secret`, `github_login` | authenticated by client_id + client_secret, not a builder rank. |
 | POST | `/api/bongos/sso/membership/check-in` | `public` | `client_id`, `client_secret`, `github_id`, `github_login`, `display_name`, `avatar_url`, `membership_kind` | POST /sso/membership/check-in — a federated instance reports, on every sign-in, that a builder builds on its project (ADR 0141 §3). |

package/docs/copy-inventory.md

@@ -164,10 +164,10 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `bea7817e57a4` | certain | All surfaces | `modules/hall-ui/public/copy-desk.js:301` |
 | `627c683a5e5d` | certain | All time | `modules/hall-ui/public/hall-widgets.js:130` |
 | `b38c01691857` | certain | All your work → | `modules/hall-ui/public/hall-widgets.js:110` |
-| `efa803555625` | certain | Allow goal | `modules/hall-ui/public/gate.js:288` |
+| `efa803555625` | certain | Allow goal | `modules/hall-ui/public/gate.js:303` |
 | `375b0e67bc30` | certain | Allow new releases and move to {…} | `modules/hall-ui/public/deploy.js:249` |
 | `375b0e67bc30` | certain | Allow new releases and move to {…} | `modules/hall-ui/public/deploy.js:677` |
-| `86ea8d57d34e` | certain | Allowlisted goals | `modules/hall-ui/public/gate.js:286` |
+| `86ea8d57d34e` | certain | Allowlisted goals | `modules/hall-ui/public/gate.js:300` |
 | `e99cc5d37404` | certain | Already a member? | `modules/hall-ui/public/hall-render.js:367` |
 | `da5368d10f85` | certain | Amendment {…} passed{…}, and the constitution below is not the one it decided: | `modules/hall-ui/public/government.js:633` |
 | `2ca420e19dbb` | certain | An earlier attempt did not land. | `modules/hall-ui/public/deploy.js:366` |
@@ -249,7 +249,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `906c2947dfc1` | certain | Changes save at once and take effect the next time you start a session on this machine. | `modules/hall-ui/public/settings.html:346` |
 | `52384bdc035c` | certain | Changes save at once. Your new choice plays the next time that event fires. | `modules/hall-ui/public/settings.html:359` |
 | `cab7a9526ca1` | certain | Changes save the moment you pick. “Default” clears your override and falls back to the system's choice. | `modules/hall-ui/public/settings.html:329` |
-| `4b714191b423` | certain | Changes touching protected build surfaces, held for your approval. | `modules/hall-ui/public/gate.js:403` |
+| `4b714191b423` | certain | Changes touching protected build surfaces, held for your approval. | `modules/hall-ui/public/gate.js:432` |
 | `864503935eca` | certain | Changing the rule… | `modules/hall-ui/public/deploy.js:671` |
 | `55ad21bd03eb` | certain | Chart the routes | `modules/hall-ui/public/goal-map.html:91` |
 | `55ad21bd03eb` | certain | Chart the routes | `modules/hall-ui/public/thinking.html:108` |
@@ -430,7 +430,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8d2b4f119ee3` | certain | End session | `modules/hall-ui/public/settings-sessions.js:46` |
 | `8e82771e5b63` | certain | Ending a session takes effect immediately; the token stops working on its very next request. | `modules/hall-ui/public/settings.html:163` |
 | `58d381535285` | certain | Engagement reports | `modules/hall-ui/public/watch.html:130` |
-| `690609c8e9a9` | certain | Enter a goal number. | `modules/hall-ui/public/gate.js:300` |
+| `690609c8e9a9` | certain | Enter a goal number. | `modules/hall-ui/public/gate.js:315` |
 | `1825c9c467d8` | certain | Enter the id of the task this one should wait for. | `modules/hall-ui/public/task.js:928` |
 | `bd7a40639a1c` | certain | Estimate (min) | `modules/hall-ui/public/task-detail.js:460` |
 | `c15d1f0ddfb6` | certain | Estimation accuracy | `modules/hall-ui/public/watch.html:148` |
@@ -506,9 +506,9 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9e70797b7e97` | certain | Goal id | `modules/hall-ui/public/goals-render.js:832` |
 | `529460e82058` | certain | Goal invitations to you | `modules/hall-ui/public/goal-inbox.js:150` |
 | `e2a9e33abe60` | certain | Goal tasks | `modules/hall-ui/public/goals.html:151` |
-| `ec88b946ad16` | certain | Goal {…} | `modules/hall-ui/public/gate.js:280` |
-| `7b02827535c2` | certain | Goal {…} allowlisted. | `modules/hall-ui/public/gate.js:303` |
-| `8a421ae268e6` | certain | Goal {…} removed. | `modules/hall-ui/public/gate.js:313` |
+| `ec88b946ad16` | certain | Goal {…} | `modules/hall-ui/public/gate.js:288` |
+| `7b02827535c2` | certain | Goal {…} allowlisted. | `modules/hall-ui/public/gate.js:318` |
+| `8a421ae268e6` | certain | Goal {…} removed. | `modules/hall-ui/public/gate.js:341` |
 | `e0bc28d10785` | certain | Goals could not be loaded. Refresh to try again. | `modules/hall-ui/public/goals-page.js:893` |
 | `4517f2253d0f` | certain | Goals couldn’t be loaded just now. Refresh to try again. | `modules/hall-ui/public/goals.js:121` |
 | `6a85997bda21` | certain | Goals created | `modules/hall-ui/public/profile.html:145` |
@@ -1438,7 +1438,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `6b530a7007bc` | certain | jump to a goal or a thought | `modules/hall-ui/public/goal-map.html:75` |
 | `6b530a7007bc` | certain | jump to a goal or a thought | `modules/hall-ui/public/thinking.html:92` |
 | `9328033a890a` | certain | land every shuttle | `modules/hall-ui/public/sky-interaction.js:45` |
-| `966b32c8af7e` | certain | last check-in {…} ago | `modules/hall-ui/public/gate.js:360` |
+| `966b32c8af7e` | certain | last check-in {…} ago | `modules/hall-ui/public/gate.js:391` |
 | `9018bf6e99eb` | certain | last used {…} · signed in {…} | `modules/hall-ui/public/settings-sessions.js:46` |
 | `2ce7738b1eb0` | certain | loading goals… | `modules/hall-ui/public/task-detail.js:482` |
 | `754bdec368ed` | certain | lowest credits | `modules/hall-ui/public/hall-widgets.js:136` |
@@ -1594,7 +1594,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `81f05d9b2bbf` | certain | what's wrong, or what you'd like to see | `modules/hall-ui/public/ideas.html:65` |
 | `c3959ea9d43b` | certain | where my thoughts are | `modules/hall-ui/public/sky-layout.js:50` |
 | `1651cb1876f5` | certain | who sits on the board | `modules/hall-ui/public/government.html:55` |
-| `57f45f7812ba` | certain | why (optional) | `modules/hall-ui/public/gate.js:288` |
+| `57f45f7812ba` | certain | why (optional) | `modules/hall-ui/public/gate.js:303` |
 | `143f77e2b782` | certain | why these are the same | `modules/hall-ui/public/task-detail.js:565` |
 | `ec7c228cb4ce` | certain | why this isn’t worth doing | `modules/hall-ui/public/task-detail.js:616` |
 | `c612ab426c2f` | certain | your sky | `modules/hall-ui/public/thinking.html:72` |

package/docs/copy-registry.json

@@ -2976,7 +2976,7 @@
       "surface": "builders-hall",
       "text": "Allow goal",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 288,
+      "line": 303,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3003,7 +3003,7 @@
       "surface": "builders-hall",
       "text": "Allowlisted goals",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 286,
+      "line": 300,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3741,7 +3741,7 @@
       "surface": "builders-hall",
       "text": "Changes touching protected build surfaces, held for your approval.",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 403,
+      "line": 432,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5370,7 +5370,7 @@
       "surface": "builders-hall",
       "text": "Enter a goal number.",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 300,
+      "line": 315,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6054,7 +6054,7 @@
       "surface": "builders-hall",
       "text": "Goal {…}",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 280,
+      "line": 288,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6063,7 +6063,7 @@
       "surface": "builders-hall",
       "text": "Goal {…} allowlisted.",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 303,
+      "line": 318,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6072,7 +6072,7 @@
       "surface": "builders-hall",
       "text": "Goal {…} removed.",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 313,
+      "line": 341,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -14442,7 +14442,7 @@
       "surface": "builders-hall",
       "text": "last check-in {…} ago",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 360,
+      "line": 391,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15846,7 +15846,7 @@
       "surface": "builders-hall",
       "text": "why (optional)",
       "file": "modules/hall-ui/public/gate.js",
-      "line": 288,
+      "line": 303,
       "origin": "js-markup",
       "confidence": "certain"
     },