@bongos/core 1.20.37 → 1.20.39

package/.claude/skills/bongos-feedback/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: bongos-feedback
+description: >-
+  File a Bongos problem with its maintainers — unasked, whenever a builder vents that Bongos itself is broken, stuck or confusing. Triggers: "/bongos-feedback", "Bongos is broken", "this keeps failing", "why does claim hang", "report this Bongos bug".
+plain: >-
+  Sends a short note about a problem with Bongos, or an idea for it, to the people who build Bongos. It also does this by itself when you complain that Bongos is not working.
+reach-for: >-
+  When Bongos itself got in your way — a command that failed or confused you, or something you wish it did. You do not have to ask; complaining is enough.
+cost: >-
+  Free. It files one note with the Bongos maintainers and changes nothing in your project.
+---
+
+**Script skill (authoritative).** The core action is `bongos feedback "<message>"` (or `--idea "<message>"`, or `--message-file <path>`). Run it and print its output verbatim.
+
+This is **not** `/feedback`, which loads a walkthrough you recorded into this session. This one **sends** a note about Bongos — the tool — upstream to its maintainers on Cloud Bongos, where a bug becomes a task waiting for a maintainer's approval (tasks 1004462, 1004467).
+
+## Two ways in
+
+- **Asked** — the builder says "report this", "tell the Bongos team", or runs `/bongos-feedback`. Draft it, show them, send on their go.
+- **Proactive** — the builder is venting that Bongos is not working: frustration, swearing, "this is broken again", "why does X keep failing", "Bongos is useless today". **File it without being asked**, then tell them in one line (below). The owner's standing rule (2026-09-30): every rant about Bongos not working becomes something to fix. Do not ask permission first, and do not argue them out of it.
+
+## Is it about Bongos? (proactive mode files only when yes)
+
+File when the complaint is about **Bongos itself**: a `bongos`/`/builder-*` command, a claim, ship, grade, merge or deploy step, the hall, Settings, sign-in, credits, the upgrade, or a Bongos message that confused them.
+
+Do **not** file when it is about their **own project's** code, tests or design, about Claude itself, their laptop, GitHub or another service — or when the "problem" is a rule working as designed (an `[otb-plain]` card saying `By design: Yes`). If it is genuinely unclear, fix the thing in front of you first and file only if it turns out to be Bongos.
+
+**One filing per distinct problem per session.** A second rant about the same failure adds nothing; say it is already filed (with the number) instead.
+
+## Writing the report
+
+Write it yourself from what you saw. **Never paste the rant.** The maintainers need the facts, not the mood:
+
+1. A plain first line naming what went wrong — it becomes the title. (`bongos claim hung for two minutes, then failed with fetch failed`)
+2. What the builder was doing, what they expected, what happened instead, and the exact error line if there was one.
+3. Whether it happened more than once, and any workaround you found.
+
+**Leave out:** code, file contents, secrets, tokens, customer or personal data, and anything about their project the maintainers do not need. Only the text you send travels (plus the Bongos and CLI versions, added automatically). As a backstop the command runs every report through Bongos's secret scrubber and refuses to send if it can't, but it is a backstop, not permission to be careless.
+
+A report that is really a wish ("I'd like Bongos to…") goes with `--idea`.
+
+## Sending
+
+From the project checkout. For anything longer than one line, write the report to a file with the Write tool first — the shell eats backticks inside a quoted argument:
+
+```bash
+bongos feedback --message-file <path>
+```
+
+## Telling the builder
+
+**Proactive:** one line, after sending, then carry on with what they were doing. For example: *"I've reported this to the Bongos team as task 1004500 — it's waiting for a maintainer to approve it."* No more than that, unless they ask what was sent — then show them the report.
+
+**Asked:** report the CLI's output verbatim.
+
+## If it refuses
+
+The CLI prints one plain line for each refusal. In proactive mode, a refusal is one line to the builder and nothing more — never retry in a loop.
+
+- **"not connected to Cloud Bongos"** — a self-hosted project has no link to the hub. Point the builder at the Bongos core repository's issue tracker.
+- **"does not yet know you as a member"** — the hub only accepts reports from someone it has seen sign in to this project. Signing in to the project once through Cloud Bongos in a browser fixes it.
+- **"Too much feedback"** — the hourly cap. Don't retry; mention it once.
+
+## Files this skill touches
+
+- Runs: `bongos feedback` → `scripts/gds/feedback-send.js` → `POST /api/bongos/feedback` on this project (`src/bongos/routes/feedback.js`) → the hub's `POST /api/bongos/sso/feedback` (`modules/platform-identity/instance-feedback.js`).

package/.claude/skills/collab-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: collab-review
 description: >-
-  Walk what other builders have asked of YOU — help requests and task recommendations addressed to you — verifying each against the live record before acting, and bringing back one decision at a time. The answering half of /ask-for-help. Triggers: "/collab-review", "what have people asked me", "answer my asks", "work my collab queue", or a pasted "Copy for Session Start" prompt.
+  Walk the help requests and task recommendations addressed to YOU, verifying each against the live record, one decision at a time. The answering half of /ask-for-help. Triggers: "/collab-review", "what have people asked me", "answer my asks", "work my collab queue", or a pasted "Copy for Session Start" prompt.
 plain: >-
   Goes through the requests other people have sent you, such as asks for help or suggested tasks, and brings you one decision at a time.
 reach-for: >-

package/.claude/skills/priority-session/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: priority-session
 description: >-
-  A trusted builder answers a few plain questions; the answers reweight the idea_inbox and suggest what to claim next. Metic+ only. Triggers: "/priority-session", "run a priority session", "what should I work on next", "reprioritize the inbox", "what feels most important right now", "help me decide what to claim".
+  A trusted builder answers a few plain questions; the answers reweight the idea_inbox and suggest what to claim next. Metic+ only. Triggers: "/priority-session", "run a priority session", "what should I work on next", "reprioritize the inbox".
 plain: >-
   Asks you a few simple questions about what matters most, then re-ranks the ideas and suggests what to work on next.
 reach-for: >-

package/.claude/skills/session-handoff/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: session-handoff
 description: >-
-  Emit a paste-ready next-steps prompt so a FRESH session starts with curated context. Read-only. Triggers: "/session-handoff", "hand off to a fresh session", "give me a handoff prompt", "wrap up context for next time", "write the next-steps prompt", "I want to continue this in a new session", "context is getting heavy, prep a fresh start".
+  Emit a paste-ready next-steps prompt so a FRESH session starts with curated context. Read-only. Triggers: "/session-handoff", "hand off to a fresh session", "give me a handoff prompt", "wrap up context for next time", "continue this in a new session".
 plain: >-
   Writes a ready-to-paste note so a fresh conversation can pick up exactly where this one left off.
 reach-for: >-

package/.claude/skills/status/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: status
 description: >-
-  Roll up a version or criterion in one call — its gating tasks, their live statuses, and what is blocking. Read-only. Answers "what's the status of X" and "what's left for criterion Cn". Triggers: "/status", "what's left for C8", "status of GDS-V3", "how far along is the memory criterion", "what tasks remain to complete X".
+  Roll up a version or criterion in one call — its gating tasks, their live statuses, and what is blocking. Read-only. Triggers: "/status", "what's left for C8", "status of GDS-V3", "what tasks remain to complete X".
 plain: >-
   Shows how far along a version or goal is: what is finished, what is left, and what is holding it up.
 reach-for: >-

package/bin/bongos.js

@@ -93,6 +93,7 @@ const VERBS = {
   // name, the way claim/ship/release already are (ADR 0104).
   'paste-token': { script: 'paste-token.js', group: 'account', summary: 'Finish re-auth: store the token copied from Settings  (bongos paste-token <token>)' },
   doctor:  { script: 'doctor.js', group: 'account', summary: 'Check your local toolchain + session' },
+  feedback: { script: 'feedback-send.js', group: 'account', summary: 'Send feedback about Bongos itself to its maintainers  (bongos feedback "…" | --idea "…")', selfHelp: true },
 
   init:    { script: 'init.js', group: 'instance', summary: 'Scaffold a new instance (config + first version + kickoff tasks)' },
   dev:     { script: 'dev.js', group: 'instance', summary: 'Run THIS instance locally in one command (Postgres + migrate + server + sign-in)', selfHelp: true },

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 466 operations across 70 resource groups
+- 469 operations across 71 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -177,6 +177,8 @@ function createClient(opts = {}) {
       postAutonomyFenceGoals: (args) => request("POST", "/autonomy/fence/goals", { hasBody: true }, args),
       // DELETE /autonomy/fence/goals/{goalId} — rank: archon — DELETE /autonomy/fence/goals/:goalId
       deleteAutonomyFenceGoalsGoalId: (args) => request("DELETE", "/autonomy/fence/goals/{goalId}", { hasBody: false }, args),
+      // POST /autonomy/fence/priority — rank: archon — POST /autonomy/fence/priority
+      postAutonomyFencePriority: (args) => request("POST", "/autonomy/fence/priority", { hasBody: true }, args),
       // POST /autonomy/heartbeat — rank: any-builder — POST /autonomy/heartbeat
       postAutonomyHeartbeat: (args) => request("POST", "/autonomy/heartbeat", { hasBody: true }, args),
       // GET /autonomy/precheck — rank: metic+archon — GET /autonomy/precheck
@@ -368,6 +370,10 @@ function createClient(opts = {}) {
       // GET /done-when/pending-review — rank: metic+archon — GET /done-when/pending-review
       getDoneWhenPendingReview: (args) => request("GET", "/done-when/pending-review", { hasBody: false }, args),
     },
+    "feedback": {
+      // POST /feedback — rank: any-builder — POST /feedback
+      postFeedback: (args) => request("POST", "/feedback", { hasBody: true }, args),
+    },
     "gateApprovals": {
       // GET /gate-approvals — rank: metic+archon — GET /gate-approvals
       getGateApprovals: (args) => request("GET", "/gate-approvals", { hasBody: false }, args),
@@ -1019,6 +1025,8 @@ function createClient(opts = {}) {
       postSsoDevicePoll: (args) => request("POST", "/sso/device/poll", { hasBody: true }, args),
       // POST /sso/device/start — rank: public — POST /sso/device/start
       postSsoDeviceStart: (args) => request("POST", "/sso/device/start", { hasBody: true }, args),
+      // POST /sso/feedback — rank: public — POST /sso/feedback
+      postSsoFeedback: (args) => request("POST", "/sso/feedback", { hasBody: true }, args),
       // POST /sso/invites/clear — rank: public — POST /sso/invites/clear
       postSsoInvitesClear: (args) => request("POST", "/sso/invites/clear", { hasBody: true }, args),
       // POST /sso/invites/notify — rank: public — POST /sso/invites/notify

package/clients/bongos-client/index.cjs

@@ -176,6 +176,8 @@ function createClient(opts = {}) {
       postAutonomyFenceGoals: (args) => request("POST", "/autonomy/fence/goals", { hasBody: true }, args),
       // DELETE /autonomy/fence/goals/{goalId} — rank: archon — DELETE /autonomy/fence/goals/:goalId
       deleteAutonomyFenceGoalsGoalId: (args) => request("DELETE", "/autonomy/fence/goals/{goalId}", { hasBody: false }, args),
+      // POST /autonomy/fence/priority — rank: archon — POST /autonomy/fence/priority
+      postAutonomyFencePriority: (args) => request("POST", "/autonomy/fence/priority", { hasBody: true }, args),
       // POST /autonomy/heartbeat — rank: any-builder — POST /autonomy/heartbeat
       postAutonomyHeartbeat: (args) => request("POST", "/autonomy/heartbeat", { hasBody: true }, args),
       // GET /autonomy/precheck — rank: metic+archon — GET /autonomy/precheck
@@ -367,6 +369,10 @@ function createClient(opts = {}) {
       // GET /done-when/pending-review — rank: metic+archon — GET /done-when/pending-review
       getDoneWhenPendingReview: (args) => request("GET", "/done-when/pending-review", { hasBody: false }, args),
     },
+    "feedback": {
+      // POST /feedback — rank: any-builder — POST /feedback
+      postFeedback: (args) => request("POST", "/feedback", { hasBody: true }, args),
+    },
     "gateApprovals": {
       // GET /gate-approvals — rank: metic+archon — GET /gate-approvals
       getGateApprovals: (args) => request("GET", "/gate-approvals", { hasBody: false }, args),
@@ -1018,6 +1024,8 @@ function createClient(opts = {}) {
       postSsoDevicePoll: (args) => request("POST", "/sso/device/poll", { hasBody: true }, args),
       // POST /sso/device/start — rank: public — POST /sso/device/start
       postSsoDeviceStart: (args) => request("POST", "/sso/device/start", { hasBody: true }, args),
+      // POST /sso/feedback — rank: public — POST /sso/feedback
+      postSsoFeedback: (args) => request("POST", "/sso/feedback", { hasBody: true }, args),
       // POST /sso/invites/clear — rank: public — POST /sso/invites/clear
       postSsoInvitesClear: (args) => request("POST", "/sso/invites/clear", { hasBody: true }, args),
       // POST /sso/invites/notify — rank: public — POST /sso/invites/notify

package/clients/bongos-client/index.d.ts

@@ -251,8 +251,9 @@ export interface PostAuthRevokeRequest { session_id?: StringifiableId }
 export interface PostAuthRevokeResponse { ok: boolean; revoked: unknown }
 export interface PostAutonomyFenceGoalsRequest { goal_id: StringifiableId; note?: string }
 export interface PostAutonomyFenceGoalsResponse { goal: unknown }
+export interface PostAutonomyFencePriorityRequest { goal_id?: StringifiableId }
 export interface PostAutonomyFenceRequest { enabled: boolean; reason?: string }
-export interface PostAutonomyHeartbeatRequest { host: string; pid?: number; started_at?: string; mode?: string; consecutive_failures?: number; last_event?: string; working_task_id?: number }
+export interface PostAutonomyHeartbeatRequest { host: string; pid?: number; started_at?: string; mode?: string; consecutive_failures?: number; last_event?: string; working_task_id?: number; working_goal_id?: number }
 export interface PostAutonomyHeartbeatResponse { ok: boolean; heartbeat: unknown }
 export interface PostBackupTriggerResponse { ok: boolean; message: unknown; started_at: unknown }
 export interface PostBlockersIdLinkRequest { task_id: StringifiableId }
@@ -293,6 +294,7 @@ export interface PostDoneWhenCriterionIdUatRecordingResponse { ok: boolean; reco
 export interface PostDoneWhenCriterionIdUatRequest { kind: string; recording?: string; live_attested?: boolean; note?: string }
 export interface PostDoneWhenCriterionIdUatResponse { ok: boolean; signoff: unknown; criterion_closed: unknown; achieved_goals: unknown; closed_versions: unknown }
 export interface PostDoneWhenCriterionIdUnsatisfyResponse { criterion: unknown }
+export interface PostFeedbackRequest { message: string; kind?: "bug" | "idea"; context?: unknown }
 export interface PostGateApprovalsPrApproveResponse { ok: boolean; pr: unknown; already_clear?: boolean; message: unknown; head_sha?: unknown; status_set?: boolean; recheck?: unknown; held_for_artist?: unknown }
 export interface PostGithubRepoVisibilityRequest { repo: string; visibility: "public" | "private" }
 export interface PostGithubRepoVisibilityResponse { ok: boolean; repo: unknown; private_deployable: boolean }
@@ -445,6 +447,7 @@ export interface PostSsoApplicantProfileRequest { client_id: string; client_secr
 export interface PostSsoApplicantProfileResponse { profile: unknown }
 export interface PostSsoDevicePollRequest { device_code: string }
 export interface PostSsoDeviceStartRequest { origin: string }
+export interface PostSsoFeedbackRequest { client_id: string; client_secret: string; github_id: StringifiableId; message: string; kind?: string; context?: unknown }
 export interface PostSsoInvitesClearRequest { client_id: string; client_secret: string; github_login: string }
 export interface PostSsoInvitesNotifyRequest { client_id: string; client_secret: string; github_login: string }
 export interface PostSsoMembershipCheckInRequest { client_id: string; client_secret: string; github_id: StringifiableId; github_login: string; display_name?: string; avatar_url?: string; membership_kind?: string }
@@ -608,6 +611,8 @@ export interface BongosClient {
     postAutonomyFenceGoals(args: RequestArgs & { body: PostAutonomyFenceGoalsRequest }): Promise<PostAutonomyFenceGoalsResponse>;
     /** DELETE /autonomy/fence/goals/{goalId} — rank: archon */
     deleteAutonomyFenceGoalsGoalId(args?: RequestArgs): Promise<ApiResponse>;
+    /** POST /autonomy/fence/priority — rank: archon */
+    postAutonomyFencePriority(args?: RequestArgs & { body?: PostAutonomyFencePriorityRequest }): Promise<ApiResponse>;
     /** POST /autonomy/heartbeat — rank: any-builder */
     postAutonomyHeartbeat(args: RequestArgs & { body: PostAutonomyHeartbeatRequest }): Promise<PostAutonomyHeartbeatResponse>;
     /** GET /autonomy/precheck — rank: metic+archon */
@@ -799,6 +804,10 @@ export interface BongosClient {
     /** GET /done-when/pending-review — rank: metic+archon */
     getDoneWhenPendingReview(args?: RequestArgs): Promise<GetDoneWhenPendingReviewResponse>;
   };
+  "feedback": {
+    /** POST /feedback — rank: any-builder */
+    postFeedback(args: RequestArgs & { body: PostFeedbackRequest }): Promise<ApiResponse>;
+  };
   "gateApprovals": {
     /** GET /gate-approvals — rank: metic+archon */
     getGateApprovals(args?: RequestArgs): Promise<ApiResponse>;
@@ -1450,6 +1459,8 @@ export interface BongosClient {
     postSsoDevicePoll(args: RequestArgs & { body: PostSsoDevicePollRequest }): Promise<ApiResponse>;
     /** POST /sso/device/start — rank: public */
     postSsoDeviceStart(args: RequestArgs & { body: PostSsoDeviceStartRequest }): Promise<ApiResponse>;
+    /** POST /sso/feedback — rank: public */
+    postSsoFeedback(args: RequestArgs & { body: PostSsoFeedbackRequest }): Promise<ApiResponse>;
     /** POST /sso/invites/clear — rank: public */
     postSsoInvitesClear(args: RequestArgs & { body: PostSsoInvitesClearRequest }): Promise<ApiResponse>;
     /** POST /sso/invites/notify — rank: public */

package/clients/bongos-client/index.mjs

@@ -173,6 +173,8 @@ export function createClient(opts = {}) {
       postAutonomyFenceGoals: (args) => request("POST", "/autonomy/fence/goals", { hasBody: true }, args),
       // DELETE /autonomy/fence/goals/{goalId} — rank: archon — DELETE /autonomy/fence/goals/:goalId
       deleteAutonomyFenceGoalsGoalId: (args) => request("DELETE", "/autonomy/fence/goals/{goalId}", { hasBody: false }, args),
+      // POST /autonomy/fence/priority — rank: archon — POST /autonomy/fence/priority
+      postAutonomyFencePriority: (args) => request("POST", "/autonomy/fence/priority", { hasBody: true }, args),
       // POST /autonomy/heartbeat — rank: any-builder — POST /autonomy/heartbeat
       postAutonomyHeartbeat: (args) => request("POST", "/autonomy/heartbeat", { hasBody: true }, args),
       // GET /autonomy/precheck — rank: metic+archon — GET /autonomy/precheck
@@ -364,6 +366,10 @@ export function createClient(opts = {}) {
       // GET /done-when/pending-review — rank: metic+archon — GET /done-when/pending-review
       getDoneWhenPendingReview: (args) => request("GET", "/done-when/pending-review", { hasBody: false }, args),
     },
+    "feedback": {
+      // POST /feedback — rank: any-builder — POST /feedback
+      postFeedback: (args) => request("POST", "/feedback", { hasBody: true }, args),
+    },
     "gateApprovals": {
       // GET /gate-approvals — rank: metic+archon — GET /gate-approvals
       getGateApprovals: (args) => request("GET", "/gate-approvals", { hasBody: false }, args),
@@ -1015,6 +1021,8 @@ export function createClient(opts = {}) {
       postSsoDevicePoll: (args) => request("POST", "/sso/device/poll", { hasBody: true }, args),
       // POST /sso/device/start — rank: public — POST /sso/device/start
       postSsoDeviceStart: (args) => request("POST", "/sso/device/start", { hasBody: true }, args),
+      // POST /sso/feedback — rank: public — POST /sso/feedback
+      postSsoFeedback: (args) => request("POST", "/sso/feedback", { hasBody: true }, args),
       // POST /sso/invites/clear — rank: public — POST /sso/invites/clear
       postSsoInvitesClear: (args) => request("POST", "/sso/invites/clear", { hasBody: true }, args),
       // POST /sso/invites/notify — rank: public — POST /sso/invites/notify

package/docs/adr/0136-update-channel-subscription-policy.md

@@ -1,7 +1,7 @@
 # ADR 0136 — Update-channel subscription policy (patch-only, health-gated, opt-in, autonomy-gated)
 
 **Date:** 2026-07-10
-**Status:** Accepted.
+**Status:** Accepted. Amended by [ADR 0357](0357-the-update-rule-set-on-deploy-is-the-one-the-sweep-follows.md) (2026-09-30): a project's channel is now its `provisioning_instances.update_channel`, set on /deploy; the roster's `channel` is only the fallback.
 **Context:** [task 2150](https://example.com/builders#/task/2150) (BONGOS-V1, goal 26). The last piece of the update-consumption workstream: [ADR 0100](0100-two-repo-instance-model.md) §2 / [task 1690](https://example.com/builders#/task/1690) gave a consumer the manual `bongos upgrade` channel; [ADR 0134](0134-private-first-npm-distribution.md) / [task 2090](https://example.com/builders#/task/2090) added the private-registry source; [task 2149](https://example.com/builders#/task/2149) added auto-rollback; [task 2157](https://example.com/builders#/task/2157) proved rollback live on the demo instance. What was missing is the **subscription** — how a consumer instance takes new releases *on a cadence, unattended*, rather than a human running `bongos upgrade` each time. Builds on the scheduled-routines portability contract ([ADR 0115](0115-scheduled-routines-portability.md)).
 
 ## Problem

package/docs/adr/0357-the-update-rule-set-on-deploy-is-the-one-the-sweep-follows.md

@@ -0,0 +1,41 @@
+# ADR 0357 — The update rule set on /deploy is the one the sweep follows
+
+- **Status:** accepted
+- **Date:** 2026-09-30
+- **Task:** [task 1004468](https://cloudbongos.com/builders#/task/1004468) (goal 1000090, BONGOS-V2)
+- **Amends:** [ADR 0136](0136-update-channel-subscription-policy.md), "Alternatives considered" (a `provisioning_instances` column for the channel) and its Consequences line naming `config/update-subscriptions.json` as the one place a channel is set
+- **Builds on:** [task 1004445](https://cloudbongos.com/builders#/task/1004445) (migration provisioning_029, `POST /provisioning/instances/:id/update-channel`), [ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md) (the deploy door)
+- **Decided with:** the owner, 2026-09-30. Asked "which one decides how far a project auto-updates, the site setting or the server file?", they chose the site setting.
+
+## Context
+
+ADR 0136 put each subscribed instance's update channel (`pinned` / `patch` / `minor`) in the roster file `config/update-subscriptions.json`, and it rejected a `provisioning_instances` column because the fleet registry was not yet designed. By the time of [ADR 0325](0325-the-managed-fleet-control-plane-is-the-hub-we-already-run.md), `provisioning_instances` *was* the registry. Task 1004445 then added `update_channel` to it, so the owner could set the rule on /deploy, and the deploy door's runner obeys it.
+
+That left two rules for one project. On 2026-09-30 cloudbongos.com was set to `minor` on /deploy and still `patch` in the box roster. The button followed the first and the unattended sweep the second, so a step-up release (1.20 → 1.21) would never land unattended even though /deploy said it would. Task 1004451's proof was graded down for exactly this.
+
+## Decision
+
+**D1. The project row is the rule.** For a roster entry whose `slug` matches a `provisioning_instances` row, the sweep uses that row's `update_channel`. The match is by slug, the only stable key the table carries (it records no directory).
+
+**D2. The roster's `channel` is a fallback, not a second vote.** It applies only when no row matches (an instance the control plane never provisioned) or when the sweep cannot read the database. The roster keeps everything else it holds — `dir`, service, health URL, topology, `env`, pin mode — because the registry doesn't record those.
+
+**D3. Every fallback says so.** The sweep prints each entry's channel and where it came from ("set on /deploy", or "from the roster — <reason>"). When the row overrides a different roster value, the log names the ignored value too. A silent fallback is how two rules drifted apart in the first place.
+
+**D4. It reads the control plane's database, over psql, from the sweep's own environment** — `DATABASE_URL`, else `PGDATABASE` (socket + peer auth). These are the two variables `upgrade.js` `recordLedger` reads. Unlike recordLedger, it hands a `DATABASE_URL` to `psql -d` rather than the pg driver, because the sweep is synchronous. An entry's `env` is never used, because it names *that instance's* database. A core too old to carry the reader keeps the roster behaviour unchanged. A failure is logged as a fixed class (unreachable, login refused, table missing…), never psql's own text, which can name a user or host.
+
+**D1a. Why not slug *or* directory.** The task brief suggested matching by slug or dir. `provisioning_instances` stores no directory, so there is nothing to match a dir against, and a roster slug that differs from its row's slug falls back to the roster, visibly (D3).
+
+**D5. Nothing is migrated or copied.** Every row already has a channel (the column defaults to `patch`, the old behaviour). So once this is live, an entry the roster listed as `minor` but whose row was never changed on /deploy is swept as `patch`. That is the ruling applied, not a regression, and D3 makes it visible in the log.
+
+## Consequences
+
+- One place to change how far a project auto-updates, on the site, with no SSH.
+- ADR 0136's policy is otherwise unchanged: majors and prereleases are never automatic, every move is health-gated with auto-rollback, and the routine stays opt-in and autonomy-gated. Enrollment itself (which instances the sweep touches, and where they live) is still the roster.
+- **Delivery depends on the sweep running current code.** On cloudbongos.com the sweep runs from a checkout frozen at 2026-08-25 ([task 1004307](https://cloudbongos.com/builders#/task/1004307)). Until that is fixed, or the checkout is updated, a release carrying this change does not reach the sweep.
+- The rule is now testable in isolation: `tests/update_channel_db.mjs`.
+
+## Alternatives considered
+
+- **Keep the roster in charge (ADR 0136 as written).** Rejected by the owner: changing the unattended behaviour would stay an SSH edit, and /deploy would keep showing a setting the sweep ignores.
+- **Take the stricter of the two.** Rejected: safe, but setting `minor` on the site would do nothing until someone also edited the file, which is the same confusion in a new form.
+- **Copy the roster's channels into the rows first.** Rejected: the rows already hold the owner's deliberate choices (cloudbongos = `minor`), and a copy would overwrite a newer decision with an older file.

package/docs/adr/README.md

@@ -475,3 +475,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0354 | [**A builder hosts one project for free, and more takes the fleet permission** ([task 1004412](https://cloudbongos.com/builders#/task/1004412), goal 1000106 — working area 1, the owner's ruling of 2026-09-30). The create wizard always asks for `cloud-host`, which task 1003370 had gated behind `provisioning.fleet.manage`, so every new (Xenos) user was refused at "Create my project" — against ADR 0345 decision 1. **D1:** a builder's first live `cloud-host` project needs no permission; a further one needs the fleet permission (a retry of your own slug is the same project; only `torn_down` frees the place; an unreadable count refuses). **D2:** one first-free request per builder at a time (409 `create_in_progress`), held as a Postgres advisory lock so it holds across processes. **D3:** the wizard states `permission_forbidden` and `box_full` in plain words. Nothing yet caps a hosted project's memory.](0354-a-builder-hosts-one-project-free-and-more-takes-the-fleet-permission.md) | provisioning / security / project creation |
 | 0355 | [**A soft limit is a rule with a reason, and nobody enforces it** ([task 1004416](https://cloudbongos.com/builders#/task/1004416), goal 1000121 — BV2.PS02). The startup flow's seven planet-physics answers and what they rule out. **D1:** the answers are more provisioning `detail` keys under `team_shape`'s contract (no defaults, refused loudly, `null` un-answers), with two new kinds — a list (`many`) and a whole number (`count`); the country is a closed ISO list. **D2:** answers must agree only within one request, so a merge patch's edit order never matters. **D3:** one declarative soft-limit table (`soft-limits.js`) — data conditions, `hide`/`grey`/`note`, a reason on every rule — and every resolution says `enforced: false`. **D4:** screening is a seam (`screening.js`) with a deliberately small rule set; a stop is 422 `screened_out` before anything exists. **D5:** the edit route screens a new description too.](0355-a-soft-limit-is-a-rule-with-a-reason-and-nobody-enforces-it.md) | provisioning / project startup |
 | 0356 | [**A recruit invite expires 30 days after it is sent, decided at read time** ([task 1002969](https://cloudbongos.com/builders#/task/1002969), goal 1000110 — privacy spec D4, owner-signed). **D1:** one definition, `src/bongos/invite-expiry.js` (`INVITE_EXPIRY_DAYS` + the SQL), read by the sign-in gate, the waiting-page probe, the onboarding routes and, through the doorway's `inviteExpiry`, the hub. Nothing is stored and nothing sweeps. **D2:** only `kind='invite'` rows expire; approved applications and goal invites do not. **D3:** amends ADR 0335 D2.5: the gate reads `kind` only inside the expiry unit, which can close a door and never open one. **D4:** an expired invite is refused, marked `expired` + `expires_at` in the queues, reported `expired` by the status probe (the CLI stops), and replaced by a re-invite's fresh row. **D5:** the hub hides a `pending` notice past 30 days and a re-invite restamps it. Split out: `seen_at` (task 1004443), the decline relay (task 1004444).](0356-a-recruit-invite-expires-30-days-after-it-is-sent-read-time.md) | platform identity / admission / invites |
+| 0357 | [**The update rule set on /deploy is the one the sweep follows** ([task 1004468](https://cloudbongos.com/builders#/task/1004468), goal 1000090 — BONGOS-V2, owner's ruling 2026-09-30). Amends [ADR 0136](0136-update-channel-subscription-policy.md)'s rejected DB-column alternative. **D1:** for a roster entry whose slug matches a `provisioning_instances` row, the unattended sweep uses that row's `update_channel` (set on /deploy, task 1004445). **D2:** the roster's `channel` is only the fallback — no matching row, or the database unreadable; enrollment and topology stay in the roster. **D3:** the sweep logs each entry's channel and its source, naming an overridden roster value. **D4:** read over psql from the sweep's own `DATABASE_URL`/`PGDATABASE`, never an entry's `env`. **D5:** nothing is copied; a row never changed is `patch`. Delivery to cloudbongos.com waits on the frozen sweep checkout (task 1004307). Rejected: roster stays in charge; stricter-of-the-two; copying roster values into rows.](0357-the-update-rule-set-on-deploy-is-the-one-the-sweep-follows.md) | distribution / updates |

package/docs/api/openapi.json

@@ -121,6 +121,10 @@
       "name": "done-when",
       "description": "Endpoints under `/api/bongos/done-when`."
     },
+    {
+      "name": "feedback",
+      "description": "Endpoints under `/api/bongos/feedback`."
+    },
     {
       "name": "gate-approvals",
       "description": "Endpoints under `/api/bongos/gate-approvals`."
@@ -1890,6 +1894,51 @@
         ]
       }
     },
+    "/autonomy/fence/priority": {
+      "post": {
+        "operationId": "post_autonomy_fence_priority",
+        "tags": [
+          "autonomy"
+        ],
+        "summary": "POST /autonomy/fence/priority",
+        "description": "The priority goal (task 1004453): which allowlisted goal the runner works first. Same gate as the allowlist — choosing what an unattended machine does first is part of choosing what it may do. The goal must already be on the allowlist (409 otherwise), so a priority can order the list and never widen it. `goal_id: null` clears it.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `autonomy.fence.manage` (all required).",
+        "x-rank": "archon",
+        "x-source": "modules/autonomy/routes/autonomy.js",
+        "x-permissions": [
+          "autonomy.fence.manage"
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostAutonomyFencePriorityRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/autonomy/heartbeat": {
       "post": {
         "operationId": "post_autonomy_heartbeat",
@@ -5637,6 +5686,48 @@
         ]
       }
     },
+    "/feedback": {
+      "post": {
+        "operationId": "post_feedback",
+        "tags": [
+          "feedback"
+        ],
+        "summary": "POST /feedback",
+        "description": "signed-in builder — reporting a problem with Bongos grants nothing here, and the hub files every report at 'backlog' behind a Metic+ nod.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/feedback.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostFeedbackRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/gate-approvals": {
       "get": {
         "operationId": "get_gate_approvals",
@@ -18773,6 +18864,38 @@
         "security": []
       }
     },
+    "/sso/feedback": {
+      "post": {
+        "operationId": "post_sso_feedback",
+        "tags": [
+          "sso"
+        ],
+        "summary": "POST /sso/feedback",
+        "description": "POST /sso/feedback — a federated project relays one builder's feedback about Bongos itself (task 1004462). A bug becomes a 'backlog' task in the building version's maintenance goal; an idea becomes an inbox row. Why always backlog, and why the sender must be a witnessed member: ../instance-feedback.js. rank: public — authenticated by client_id + client_secret, not a builder rank. The per-project and per-sender caps run after the client check, so an unauthenticated caller cannot spend a real project's allowance.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/sso.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostSsoFeedbackRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          }
+        },
+        "security": []
+      }
+    },
     "/sso/invites/clear": {
       "post": {
         "operationId": "post_sso_invites_clear",
@@ -25188,6 +25311,15 @@
           "goal"
         ]
       },
+      "PostAutonomyFencePriorityRequest": {
+        "type": "object",
+        "properties": {
+          "goal_id": {
+            "$ref": "#/components/schemas/StringifiableId"
+          }
+        },
+        "additionalProperties": false
+      },
       "PostAutonomyFenceRequest": {
         "type": "object",
         "properties": {
@@ -25232,6 +25364,9 @@
           },
           "working_task_id": {
             "type": "number"
+          },
+          "working_goal_id": {
+            "type": "number"
           }
         },
         "required": [
@@ -25977,6 +26112,27 @@
           "criterion"
         ]
       },
+      "PostFeedbackRequest": {
+        "type": "object",
+        "properties": {
+          "message": {
+            "type": "string",
+            "maxLength": 4000
+          },
+          "kind": {
+            "type": "string",
+            "enum": [
+              "bug",
+              "idea"
+            ]
+          },
+          "context": {}
+        },
+        "required": [
+          "message"
+        ],
+        "additionalProperties": false
+      },
       "PostGateApprovalsPrApproveResponse": {
         "type": "object",
         "properties": {
@@ -28652,6 +28808,36 @@
         ],
         "additionalProperties": false
       },
+      "PostSsoFeedbackRequest": {
+        "type": "object",
+        "properties": {
+          "client_id": {
+            "type": "string",
+            "maxLength": 200
+          },
+          "client_secret": {
+            "type": "string",
+            "maxLength": 512
+          },
+          "github_id": {
+            "$ref": "#/components/schemas/StringifiableId"
+          },
+          "message": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "context": {}
+        },
+        "required": [
+          "client_id",
+          "client_secret",
+          "github_id",
+          "message"
+        ],
+        "additionalProperties": false
+      },
       "PostSsoInvitesClearRequest": {
         "type": "object",
         "properties": {
@@ -29812,8 +29998,8 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 466,
-  "x-schema-count": 498,
+  "x-endpoint-count": 469,
+  "x-schema-count": 501,
   "x-undocumented-bodies": 12,
   "x-response-schemas": 337,
   "x-generated-by": "scripts/gds/gen-api-docs.js"