@bongos/core 1.20.79 → 1.20.81

package/docs/adr/0161-publish-on-merge.md

@@ -1,6 +1,6 @@
 # 0161 — Publish on merge: every merge to core `main` auto-publishes `@bongos/core`
 
-- **Status:** Accepted
+- **Status:** Accepted. **Amended by [ADR 0361](0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md)** (task 1004298): merges publish as candidates under `next`; `latest` moves only on Release.
 - **Date:** 2026-08-08
 - **Deciders:** the owner (Archon), Claude. The owner chose this directly after reviewing the pipeline end-to-end: "any merge can publish, we can add in more complexity later."
 - **Task:** task 1002620 (BONGOS-V1, goal 1000024 — build-pipeline integrity)

package/docs/adr/0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md

@@ -0,0 +1,59 @@
+# ADR 0361 — Merges publish as candidates; Release on /deploy decides what other projects are offered
+
+- **Status:** Accepted. Ships **inert**: candidates start only when the owner sets `PUBLISH_AS_CANDIDATE=1` (see *Arming*).
+- **Date:** 2026-10-01
+- **Task:** [task 1004298](https://cloudbongos.com/builders#/task/1004298) (goal 1000090 — BONGOS-V2), split out of [task 1002622](https://cloudbongos.com/builders#/task/1002622) §3.
+- **Deciders:** the owner. Decisions of 2026-09-25/26: nothing reaches other projects until it is released, **patches included**; the button belongs to the `npm-release` module.
+- **Amends:** [ADR 0161](0161-publish-on-merge.md) (publish on merge). Every merge still publishes; it no longer becomes what every project is offered.
+- **Builds on:** [ADR 0360](0360-bongos-follows-every-candidate-every-other-project-follows-releases.md) (the per-instance follow), [ADR 0136](0136-update-channel-subscription-policy.md) (channels).
+
+## Context
+
+Under ADR 0161 every merge to core `main` publishes a new `@bongos/core` under npm's `latest` label, and every consumer read "newest on npm" as "what you may move to". So a merge was a release to every project, minutes after it landed, with no point at which the owner said yes.
+
+ADR 0360 gave each instance a **follow**: `released` (at or below `latest`) or `candidates` (every version). Until now the two picked the same target, because `latest` was always the newest version.
+
+## Decision
+
+### D1 — Merges publish under `next`
+
+`publish.yml` publishes with `--tag next` when the repository variable `PUBLISH_AS_CANDIDATE=1`. The version is on npm, installable by exact number, and `latest` does not move. Unset, the lane publishes under `latest` exactly as before. That is what lets this change land without changing anything.
+
+### D2 — Release moves `latest`, in GitHub
+
+Release is a second job in `publish.yml` (`release`, on `workflow_dispatch` with `release_version`). It asks `scripts/gds/release-core.js` whether the version may be released, then runs `npm dist-tag add @bongos/core@<v> latest`.
+
+- **The version must be published, stable, and newer than the current release.** An older version would move every project's offer backwards. That is a rollback for everyone, and it stays a terminal act. Releasing the current release again is a no-op.
+- **It lives in `publish.yml`, not a new file.** npm's trusted publisher for `@bongos/core` names `publish.yml`. Since 2026-09-30 the same OIDC identity can move dist-tags once "Allow npm dist-tag" is ticked on that entry. A separate file would need a second trusted-publisher entry or a long-lived token, and this lane was built to be rid of the token (task 1003202).
+- **The version reaches the shell through `env`**, never `${{ }}` inside a script, and is refused unless it is `x.y.z`.
+
+### D3 — The button starts the job; the server never holds an npm credential
+
+`POST /api/bongos/npm-release/release` (`core.pin.move`, the deploy page's own atom) dispatches the release job through GitHub's API. The GitHub credential is the server's existing GitHub App; the call reaches it through a one-function port, `lifecycle.workflowDispatch`. The `npm-release` module can start a workflow and do nothing else with that credential. The route applies `releaseDecision` first, the same function the job applies again. So the button cannot promise what the job would refuse, and the job remains the gate.
+
+### D4 — The button shows the evidence
+
+The deploy page's **Release** section lists the versions this hall runs that are not released, newest first. Each shows how long it has run on this hall and whether a move to it was ever rolled back here, from the `core_upgrades` ledger. Release covers a whole version: everything merged up to it.
+
+### D5 — Every consumer offers only what is released
+
+- The update sweep (ADR 0360) already follows `released` by default.
+- The "update available" banner (`src/bongos/core-update.js`) offers versions at or below `latest`, read from the same packument. With no readable label it has no answer.
+- The platform's upgrade runner for hosted projects (`scripts/gds/provision-core-upgrade.js`) offers a project the versions its follow admits. The follow comes from its hosting shape: the `control-plane` row is the platform hall and takes candidates; every other shape takes releases (`followForShape`). It is derived, not a column, because there is exactly one platform hall. A column someone could set on a tenant would be one more way to hand a project an unreleased version.
+
+## Arming (owner steps, in this order)
+
+1. **Platform hall follows candidates.** On the control plane, set the platform's entry in `config/update-subscriptions.json` to `"follow": "candidates"` (ADR 0360). Otherwise, once D1 is on, cloudbongos.com stops updating itself.
+2. **npm:** on npmjs.com → `@bongos/core` → Settings → Trusted publishing, tick **Allow npm dist-tag** on the `publish.yml` entry.
+3. **GitHub App:** give the server's GitHub App **Actions: Read and write** on this repository, and accept the permission change on the installation.
+4. **Switch on:** set the repository Actions variable `PUBLISH_AS_CANDIDATE=1`.
+
+Until step 4, every version this hall runs is already `latest`, so the Release section reads "Nothing is waiting" and nothing else changes. A press made before steps 2–3 fails with the reason (no dist-tag permission, or the App lacks Actions: write) and moves nothing.
+
+## Consequences
+
+- Other projects stop receiving merges the moment step 4 is done. They receive the next version the owner releases, and everything merged before it.
+- The deploy page's "Running here, not released" stage fills between merges and a Release, and empties after one.
+- A version can be released only after this hall has run it, because the candidate list stops at the live version. The evidence is real, not inferred.
+- **Rejected:** a long-lived npm token in a separate release workflow (the risk task 1003202 removed). Choosing "released" by a git tag or a file in the repo (every instance already reads npm, and a second source of truth would drift). A per-instance follow column (D5).
+- **Proof:** `tests/release_core.mjs` (the rule and the workflow wiring), `tests/npm_release_release.mjs` (evidence, the press, the GitHub call, the route gate), `tests/core_update_banner.mjs` (only released versions offered), `tests/core_upgrade_runner.mjs` (the platform hall takes a candidate; a tenant is refused one), `tests/update_channel.mjs` (`followForShape`).

package/docs/adr/README.md

@@ -479,3 +479,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0358 | [**A hall wears a look, and its night takes a tint of it** ([task 1004421](https://cloudbongos.com/builders#/task/1004421), goal 1000121 — BV2.PS06; owner D2 + D8, 2026-09-30). Amends [ADR 0219](0219-a-look-is-a-branding-pack-the-style-library.md) (a look could not carry a dark ground) and DESIGN.md's pure-black rule, for halls only. **D1:** the night tint is a formula over the thirteen — the four dark grounds take 5–6% of the look's accent (src/night-tint.js), emitted after the sheet as both dark twins; no token added. **D2:** on by default, and only a chosen look turns it on — a hall with no look is unchanged. **D3:** the apex and hub stay pure black (ADR 0204). **D4:** a custom look is ONE accent for both modes, its lightness nudged until every pair the hall paints with it reads (lookAdjustAccent, client copy test-pinned). **D5:** look + night_tint join the provisioning settings vocabulary; the accent and logo address ride as companion env; the instance resolves the look from the style library. **D6:** a logo is PNG/JPEG/WebP ≤256 KB, magic-sniffed, never SVG, served content-addressed; it is the hall mark and the favicon. Rejected: per-look dark palettes, two custom accents, refusing an unreadable accent, sending the palette over env.](0358-a-hall-wears-a-look-and-its-night-takes-a-tint.md) | hall / branding / design world |
 | 0359 | [**Nobody sets a module's score by hand; a Metic+ person can ask for a re-check** ([task 1003796](https://cloudbongos.com/builders#/task/1003796) · goal 1000091, criterion `wa5-quality-assessed`). Amends [ADR 0343](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) D6 and [ADR 0347](0347-every-store-module-ships-a-how-to.md) D5 on the owner's ruling: there is no score override. A score only ever comes from its signals. Instead `POST /store/modules/:key/versions/:version/reassess { reason }`, gated by the new `module.assessment.rerun` atom (metic floor, granted to metic + archon by `government_021`), queues the same assessment a publish runs. A reason is required and nothing else is accepted. The delist (task 1003797) is unchanged.](0359-nobody-sets-a-module-score-by-hand-metic-can-ask-for-a-re-check.md) | module store / assessment / permissions |
 | 0360 | [**Bongos follows every candidate; every other project follows releases** ([task 1004297](https://cloudbongos.com/builders#/task/1004297), goal 1000090 — the owner's 2026-09-26 decision that the Bongos hall takes every candidate automatically). Amends ADR 0136. **D1:** a per-instance `follow` beside the channel — `released` (default: at or below the registry's `latest` label) or `candidates` (every version, the platform hall only). **D2:** released is the `latest` dist-tag, read separately; an unreadable label skips the instance, never a guess. **D3:** the timer period is the lag — 15 min declared, installed by task 1003969. **D4:** a version that failed here is held for a day per instance (recorded in the sweep's config home), while any newer version is taken at once — no restart loop at a 15-minute cadence. **D5:** the deploy page's "Upgrades on this hall" — the core_upgrades ledger, rollbacks flagged, and a published version waiting past 30 min said to be the automation stopping. Rejected: a second runner, CI pushing to the box, a hold only a human clears.](0360-bongos-follows-every-candidate-every-other-project-follows-releases.md) | update channel / deploy / core update |
+| 0361 | [**Merges publish as candidates; Release on /deploy decides what other projects are offered** ([task 1004298](https://cloudbongos.com/builders#/task/1004298), goal 1000090). Amends ADR 0161. **D1:** merges publish under `next` when `PUBLISH_AS_CANDIDATE=1` (ships inert). **D2:** a `release` job in publish.yml moves `latest` (release-core.js: published, stable, newer than the release) over the same OIDC trusted publisher — no npm token. **D3:** /deploy's Release button (`core.pin.move`) dispatches it through the one-function `lifecycle.workflowDispatch` port. **D4:** evidence beside each button — hours on this hall, ever rolled back. **D5:** the banner and the hosted-project runner offer only released versions; the control-plane row follows candidates. Arming: roster follow → npm dist-tag permission → App Actions: write → the variable.](0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md) | publish / release / update channel |

package/docs/api/openapi.json

@@ -1728,6 +1728,65 @@
         "security": []
       }
     },
+    "/autonomy/builders/{builderId}/pause": {
+      "post": {
+        "operationId": "post_autonomy_builders_builderId_pause",
+        "tags": [
+          "autonomy"
+        ],
+        "summary": "POST /autonomy/builders/:builderId/pause",
+        "description": "The owner pauses or resumes ONE builder's runner without throwing the master switch. Same atom as the kill switch: stopping a machine is the same act whether it is everyone's or one person's, and the paused builder must not be able to lift it (autonomy.run does not reach this route).\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `autonomy.fence.manage` (all required).",
+        "x-rank": "archon",
+        "x-source": "modules/autonomy/routes/autonomy.js",
+        "x-permissions": [
+          "autonomy.fence.manage"
+        ],
+        "parameters": [
+          {
+            "name": "builderId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `builderId`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostAutonomyBuildersBuilderIdPauseRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/autonomy/fence": {
       "get": {
         "operationId": "get_autonomy_fence",
@@ -1735,7 +1794,7 @@
           "autonomy"
         ],
         "summary": "GET /autonomy/fence",
-        "description": "The runner's own read, every iteration. ANY-BUILDER on purpose: learning that you must stop should never require an elevated session, because the failure mode of \"could not read the fence\" is a machine that keeps going. The body carries no secret — it is a boolean, a reason string and a list of goal ids.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "The runner's own read, every iteration. ANY-BUILDER on purpose: learning that you must stop should never require an elevated session, because the failure mode of \"could not read the fence\" is a machine that keeps going. The body carries no secret — it is a boolean, a reason string and a list of goal ids. THE CALLER'S fence, not the project's (task 1004501). The top-level `enabled` and `goals` are what THIS builder's runner may do: the project switch, then `autonomy.run`, then the owner's pause on this builder, and the allowlist narrowed to their own picks (fence.js effectiveFence). Computing it here keeps the runner dumb and means a runner that predates this change is narrowed too. The unnarrowed project fence rides along as `project` for the owner's page.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/autonomy/routes/autonomy.js",
         "responses": {
@@ -1996,6 +2055,58 @@
         ]
       }
     },
+    "/autonomy/me/goals": {
+      "put": {
+        "operationId": "put_autonomy_me_goals",
+        "tags": [
+          "autonomy"
+        ],
+        "summary": "PUT /autonomy/me/goals",
+        "description": "A builder picks which allowlisted goals THEIR runner works. Replaces the whole list; `[]` means \"my runner takes no work\". Keyed by the session, never the body, so nobody can set another builder's picks. Behind `autonomy.run`: a builder who may not run a runner has nothing to scope. A goal not on the project allowlist is refused with 409 and nothing is written — the pick can narrow the project fence and never widen it.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `autonomy.run` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/autonomy/routes/autonomy.js",
+        "x-permissions": [
+          "autonomy.run"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PutAutonomyMeGoalsRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PutAutonomyMeGoalsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/autonomy/precheck": {
       "get": {
         "operationId": "get_autonomy_precheck",
@@ -2068,6 +2179,47 @@
         ]
       }
     },
+    "/autonomy/runners/all": {
+      "get": {
+        "operationId": "get_autonomy_runners_all",
+        "tags": [
+          "autonomy"
+        ],
+        "summary": "GET /autonomy/runners/all",
+        "description": "The owner's view of every builder's runners: who, which goals they picked, whether they are paused, and each runner's health — the server's verdict, as GET /autonomy/runners attaches it. Owner-only: a heartbeat names a machine and its hostname, which is each builder's own business (task 1003905), and the owner is the one person who needs every row to run the fence.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `autonomy.fence.manage` (all required).",
+        "x-rank": "archon",
+        "x-source": "modules/autonomy/routes/autonomy.js",
+        "x-permissions": [
+          "autonomy.fence.manage"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetAutonomyRunnersAllResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/autonomy/runs": {
       "get": {
         "operationId": "get_autonomy_runs",
@@ -14113,6 +14265,51 @@
         ]
       }
     },
+    "/npm-release/release": {
+      "post": {
+        "operationId": "post_npm_release_release",
+        "tags": [
+          "npm-release"
+        ],
+        "summary": "POST /npm-release/release",
+        "description": "**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "x-rank": "archon",
+        "x-source": "modules/npm-release/routes/release.js",
+        "x-permissions": [
+          "core.pin.move"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostNpmReleaseReleaseRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/npm-release/task/{id}": {
       "get": {
         "operationId": "get_npm_release_task_id",
@@ -23317,6 +23514,15 @@
           "admitted"
         ]
       },
+      "GetAutonomyRunnersAllResponse": {
+        "type": "object",
+        "properties": {
+          "builders": {}
+        },
+        "required": [
+          "builders"
+        ]
+      },
       "GetAutonomyRunnersResponse": {
         "type": "object",
         "properties": {
@@ -26346,6 +26552,22 @@
           "revoked"
         ]
       },
+      "PostAutonomyBuildersBuilderIdPauseRequest": {
+        "type": "object",
+        "properties": {
+          "paused": {
+            "type": "boolean"
+          },
+          "reason": {
+            "type": "string",
+            "maxLength": 500
+          }
+        },
+        "required": [
+          "paused"
+        ],
+        "additionalProperties": false
+      },
       "PostAutonomyFenceGoalsRequest": {
         "type": "object",
         "properties": {
@@ -28893,6 +29115,19 @@
         ],
         "additionalProperties": false
       },
+      "PostNpmReleaseReleaseRequest": {
+        "type": "object",
+        "properties": {
+          "version": {
+            "type": "string",
+            "maxLength": 32
+          }
+        },
+        "required": [
+          "version"
+        ],
+        "additionalProperties": false
+      },
       "PostOverrideRequestsIdDecideRequest": {
         "type": "object",
         "properties": {
@@ -30957,6 +31192,25 @@
           "criteria"
         ]
       },
+      "PutAutonomyMeGoalsRequest": {
+        "type": "object",
+        "properties": {
+          "goal_ids": {}
+        },
+        "required": [
+          "goal_ids"
+        ],
+        "additionalProperties": false
+      },
+      "PutAutonomyMeGoalsResponse": {
+        "type": "object",
+        "properties": {
+          "goals": {}
+        },
+        "required": [
+          "goals"
+        ]
+      },
       "PutCopyDeskPagesPageIdDraftRequest": {
         "type": "object",
         "properties": {
@@ -31293,9 +31547,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 489,
-  "x-schema-count": 519,
+  "x-endpoint-count": 493,
+  "x-schema-count": 524,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 347,
+  "x-response-schemas": 349,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 489 endpoints across 90 route files.
+> **Generated from the live route files** — the route file is authoritative. 493 endpoints across 91 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -81,18 +81,21 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/auth/web/handoff` | `public` | — | GET /auth/web/handoff?code=&return= — the far side of the one-time session handoff (task 1004357). |
 | GET | `/api/bongos/auth/web/start` | `public` | — | /auth/web — browser flow (used by the /builders page). |
 
-## `autonomy` (9)
+## `autonomy` (12)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
+| POST | `/api/bongos/autonomy/builders/:builderId/pause` | `archon` | `paused`, `reason` | The owner pauses or resumes ONE builder's runner without throwing the master switch. |
 | GET | `/api/bongos/autonomy/fence` | `any-builder` | — | The runner's own read, every iteration. |
 | POST | `/api/bongos/autonomy/fence` | `archon` | `enabled`, `reason` | The kill switch. |
 | POST | `/api/bongos/autonomy/fence/goals` | `archon` | `goal_id`, `note` | Add a goal to the allowlist. |
 | DELETE | `/api/bongos/autonomy/fence/goals/:goalId` | `archon` | — | Revoke one. |
 | POST | `/api/bongos/autonomy/fence/priority` | `archon` | `goal_id` | The priority goal (task 1004453): which allowlisted goal the runner works first. |
 | POST | `/api/bongos/autonomy/heartbeat` | `any-builder` | `host`, `pid`, `started_at`, `mode`, `consecutive_failures`, `last_event`, `working_task_id`, `working_goal_id`, `head`, `disk_head`, `main_head`, `claude_account` | The runner's check-in, once per loop. |
+| PUT | `/api/bongos/autonomy/me/goals` | `metic+archon` | `goal_ids` | A builder picks which allowlisted goals THEIR runner works. |
 | GET | `/api/bongos/autonomy/precheck` | `metic+archon` | — |  |
 | GET | `/api/bongos/autonomy/runners` | `any-builder` | — | What the hall renders: the CALLER'S OWN runners, with the pure verdict attached so the page and any future alert cannot disagree about wh… |
+| GET | `/api/bongos/autonomy/runners/all` | `archon` | — | The owner's view of every builder's runners: who, which goals they picked, whether they are paused, and each runner's health — the server… |
 | GET | `/api/bongos/autonomy/runs` | `metic+archon` | — | The gate's past decisions — did a routine fire, and what did it decide, and why (task 1002669). |
 
 ## `backup` (2)
@@ -545,7 +548,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/my-projects/invites/:clientId/decline` | `any-builder` | — | decline an invite (delete the pending row) for the caller's OWN account. |
 | POST | `/api/bongos/my-projects/join` | `any-builder` | `origin`, `note` | request to join a project. |
 
-## `npm-release` (7)
+## `npm-release` (8)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -554,6 +557,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | DELETE | `/api/bongos/npm-release/preview` | `any-builder` | — |  |
 | GET | `/api/bongos/npm-release/preview/enter` | `any-builder` | — |  |
 | GET | `/api/bongos/npm-release/preview/exit` | `any-builder` | — |  |
+| POST | `/api/bongos/npm-release/release` | `archon` | `version` |  |
 | GET | `/api/bongos/npm-release/task/:id` | `any-builder` | — |  |
 | GET | `/api/bongos/npm-release/work` | `archon` | — | Query: days (ledger window, default 14, max 60), before + limit (history paging). |