@bongos/core 1.21.176 → 1.21.178

package/.claude/skills/planning-session/SKILL.md

@@ -303,7 +303,7 @@ Once the spec is finalized (Phase 4), **read `docs/specs/<ver>-<goal-slug>.md` a
      - **For a brand-new version scaffolded from scratch (DR / a fresh instance):** put the `INSERT INTO done_when_criteria` (with `goal_id`, `ON CONFLICT ... DO UPDATE`) in **`migrations/instance/<NN>_<ver_slug>_planning_seed.sql`** — and recreate the goal idempotently in the same file (the goal is a runtime row a replay won't have). Applies only under `GDS_APPLY_INSTANCE_SEEDS=1`.
    - **Migration** at `migrations/<NN>_<ver_slug>_planning_seed.sql` (CORE — platform-universal, non-scope-truth changes only): `UPDATE versions SET done_when = ...` and `UPDATE tasks` for existing-task priority + V##.R## title prefix (guarded by `WHERE title NOT LIKE 'V<ver>.R%'`). **Do NOT put versions/goals/`done_when_criteria` INSERTs here** — that's scope-truth and fails the `selfhost-boot` gate (ADR 0105).
 
-3. **Write a seed script** at `scripts/bongos/seed-<ver_slug>-tasks.js` modeled on `scripts/bongos/seed-v3-tasks.js` containing:
+3. **Write a seed script** at `scripts/bongos/seed-<ver_slug>-tasks.js` modeled on `scripts/bongos/<redacted>.js` (or `<redacted>.js`) containing:
    - The TASKS array — one entry per net-new task with full description, kind, discipline, priority, est_minutes, manual_degree, credits_reward, **optional** `touches` (see below), optional `promoted_idea_id`, `depends_on_refs: ['R##', ...]` (the dep edges captured during brainstorm), AND **`criterion_ids: ['Cn', ...]`** — the done-when criterion(s) this task gates. The brainstorm in Phase 3 is already grouped by criterion, so this is just transcribing that grouping. **Use the criterion_id SLUG, not a positional `"Cn"` token.** `Cn` ranks over the whole VERSION's criteria, so on a version holding more than one goal it resolves to some other goal's criterion — which is how all 15 tasks of goal 1000071 were mislinked while the seed printed success (learning 1000188). Since task 1003108 the server **refuses** a positional ref on a multi-goal version (`400 ambiguous_criterion_ref`) rather than guessing, so a slug is the only ref that works there. The server resolves it against the task's version at create (ADR 0025 / task 438). **This replaces the old `**Criterion:** Cn` prose** — don't write that line anymore; pass `criterion_ids` instead so the task is linked in `task_criteria` at creation and `/status` counts it with no backfill.
    - **`touches` is now OPTIONAL (task 882 / [ADR 0049](../../../docs/adr/0049-split-parallel-safety-contract.md)).** Omit it (or leave it blank) unless you already know a tight file set and want the advisory overlap signal during the brainstorm. At first `/builder-ship` the server backfills `touches[]` from the real committed diff — the declared set becomes what git actually reported. Don't burn planning effort predicting file lists; a rough or absent prediction is fine and no longer ship-blocking.
    - **`requires_rank` AUTO-DERIVES — you don't hand-set it per task (task [#1498](https://example.com/builders#/task/1498) / [ADR 0084](../../../docs/adr/0084-auto-derived-per-task-rank-floor.md)).** On create the server floors a task at `metic` when it is `security_sensitive` or its `touches` reach the permission / authz / ship-grade / deploy / migration core (the same protected paths a sub-Metic builder can't push to); everything else stays the open `xenos` default. To deliberately gate a task **higher** than the auto-floor (e.g. owner-only work), pass `requires_rank: 'metic' | 'archon'` on the task — it can only RAISE the floor, never drop below it.
@@ -395,7 +395,7 @@ node scripts/bongos/api.js GET /api/bongos/inbox
 node scripts/bongos/api.js GET /api/bongos/versions/<id>/done-when
 ```
 
-Phase 5 writes use the same `POST /tasks`, `PATCH /inbox/:id` shape as `idea-triage` and `seed-v3-tasks.js`. Mirror those patterns rather than inventing new ones.
+Phase 5 writes use the same `POST /tasks`, `PATCH /inbox/:id` shape as `idea-triage` and `scripts/bongos/<redacted>.js`. Mirror those patterns rather than inventing new ones.
 
 ## Tone for the user
 

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 580 operations across 77 resource groups
+- 578 operations across 76 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -408,12 +408,6 @@ function createClient(opts = {}) {
       // POST /founding/start — rank: any-builder — POST /founding/start
       postFoundingStart: (args) => request("POST", "/founding/start", { hasBody: true }, args),
     },
-    "gateApprovals": {
-      // GET /gate-approvals — rank: metic+archon — GET /gate-approvals
-      getGateApprovals: (args) => request("GET", "/gate-approvals", { hasBody: false }, args),
-      // POST /gate-approvals/{pr}/approve — rank: archon — POST /gate-approvals/:pr/approve
-      postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
-    },
     "github": {
       // GET /github/orgs — rank: any-builder — GET /github/orgs
       getGithubOrgs: (args) => request("GET", "/github/orgs", { hasBody: false }, args),

package/clients/bongos-client/index.cjs

@@ -407,12 +407,6 @@ function createClient(opts = {}) {
       // POST /founding/start — rank: any-builder — POST /founding/start
       postFoundingStart: (args) => request("POST", "/founding/start", { hasBody: true }, args),
     },
-    "gateApprovals": {
-      // GET /gate-approvals — rank: metic+archon — GET /gate-approvals
-      getGateApprovals: (args) => request("GET", "/gate-approvals", { hasBody: false }, args),
-      // POST /gate-approvals/{pr}/approve — rank: archon — POST /gate-approvals/:pr/approve
-      postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
-    },
     "github": {
       // GET /github/orgs — rank: any-builder — GET /github/orgs
       getGithubOrgs: (args) => request("GET", "/github/orgs", { hasBody: false }, args),

package/clients/bongos-client/index.d.ts

@@ -963,12 +963,6 @@ export interface BongosClient {
     /** POST /founding/start — rank: any-builder */
     postFoundingStart(args?: RequestArgs): Promise<ApiResponse>;
   };
-  "gateApprovals": {
-    /** GET /gate-approvals — rank: metic+archon */
-    getGateApprovals(args?: RequestArgs): Promise<ApiResponse>;
-    /** POST /gate-approvals/{pr}/approve — rank: archon */
-    postGateApprovalsPrApprove(args?: RequestArgs): Promise<ApiResponse>;
-  };
   "github": {
     /** GET /github/orgs — rank: any-builder */
     getGithubOrgs(args?: RequestArgs): Promise<ApiResponse>;

package/clients/bongos-client/index.mjs

@@ -404,12 +404,6 @@ export function createClient(opts = {}) {
       // POST /founding/start — rank: any-builder — POST /founding/start
       postFoundingStart: (args) => request("POST", "/founding/start", { hasBody: true }, args),
     },
-    "gateApprovals": {
-      // GET /gate-approvals — rank: metic+archon — GET /gate-approvals
-      getGateApprovals: (args) => request("GET", "/gate-approvals", { hasBody: false }, args),
-      // POST /gate-approvals/{pr}/approve — rank: archon — POST /gate-approvals/:pr/approve
-      postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
-    },
     "github": {
       // GET /github/orgs — rank: any-builder — GET /github/orgs
       getGithubOrgs: (args) => request("GET", "/github/orgs", { hasBody: false }, args),

package/config/scheduled-routines.json

@@ -3,25 +3,20 @@
   "defaults": { "scope": "instance-wide", "enabled": true, "requiresAutonomy": false },
   "routines": {
     "artifact-audit":        { "scope": "instance-wide", "enabled": true,  "cadence": "weekly",  "requiresAutonomy": false, "note": "deterministic; task 1003200. Reads main's own history + tree, so it runs in CI (a vendored core is not a git repo) — .github/workflows/artifact-audit.yml." },
-    "artifact-staleness":    { "scope": "instance-wide", "enabled": true,  "cadence": "daily",   "requiresAutonomy": false, "note": "deterministic; task 1001930 / ADR 0110 pt.5. INSTANCE-SIDE ONLY, and the opposite of artifact-audit above: it reads the gitignored deploy-generated files on the serving machine's disk, which a CI checkout legitimately does not have — so it declares no cadence in its SKILL.md and no workflow fires it. This cadence is the hint the operator's own scheduler reads." },
     "bfg":                    { "scope": "instance-wide", "builderAware": true, "enabled": true,  "cadence": "nightly", "requiresAutonomy": false, "note": "Parts A+B read-only + always-on; Part C (cross-builder write) is separately gated by BFG_WRITE_ENABLED + a provisioned principal token." },
     "bfg-session-eval":       { "scope": "instance-wide", "builderAware": true, "enabled": true,  "cadence": "nightly", "requiresAutonomy": false },
     "core-update-subscription": { "scope": "instance-wide", "enabled": true, "cadence": "15min", "requiresAutonomy": true, "note": "Patch-only auto-upgrade of subscribed consumer instances (ADR 0136 / task 2150). Default OFF + opt-in: the roster (config/update-subscriptions.json) ships empty, so this is a no-op until an operator arms autonomy AND lists an instance. Every upgrade is health-gated with auto-rollback (task 2149). CADENCE (task 1003674): this is the knob that decides how long a published release waits before a subscribed instance takes it — at 'daily' a builder's ship reached the live site up to 24h late, because everything upstream is already fast (CI publishes to npm within ~2 min of merge) and this sweep was the only slow step. 15min is the worst-case lag, not a re-check cost: the sweep exits immediately when the registry has nothing newer. FLOOR ~5min: an upgrading run takes ~2 min, and runs must not overlap. Installing the period is the operator's half — see docs/recipes/upgrading-the-core.md." },
-    "dep-audit-nightly":      { "scope": "instance-wide", "enabled": true,  "cadence": "nightly", "requiresAutonomy": false },
-    "diagram-drift":          { "scope": "instance-wide", "enabled": true,  "cadence": "daily",  "requiresAutonomy": false },
+    "dep-audit-nightly":      { "scope": "instance-wide", "enabled": true,  "cadence": "daily",  "requiresAutonomy": false, "note": "deterministic; task 1004878. Fired by the in-process daily-checks poller (modules/autonomy/pollers/daily-checks.js): npm audit of the deployed instance, high/critical findings filed as ONE idea, re-filed only when the set changes." },
     "idea-triage-nightly":    { "scope": "instance-wide", "enabled": false, "cadence": "nightly", "requiresAutonomy": true },
     "main-audit":             { "scope": "instance-wide", "enabled": true,  "cadence": "on-merge", "requiresAutonomy": false, "note": "Trust-boundary backstop — audits commits landed on main." },
-    "newcomer-floor":         { "scope": "instance-wide", "enabled": true,  "cadence": "daily",  "requiresAutonomy": false },
-    "newcomer-generator":     { "scope": "instance-wide", "enabled": true,  "cadence": "daily",  "requiresAutonomy": false },
     "overnight-builder":      { "scope": "instance-wide", "enabled": false, "cadence": "nightly", "requiresAutonomy": true, "note": "Autonomous claim+ship; OFF until the instance arms autonomy." },
     "overnight-code-review":  { "scope": "instance-wide", "enabled": false, "cadence": "nightly", "requiresAutonomy": true },
-    "peer-vote-tally":        { "scope": "instance-wide", "enabled": true,  "cadence": "daily",  "requiresAutonomy": false },
-    "rank-roles-audit":       { "scope": "instance-wide", "enabled": true,  "cadence": "nightly", "requiresAutonomy": false, "note": "deterministic; read-only; never fatal at boot (idea 1000622) — task 1002873" },
+    "peer-vote-tally":        { "scope": "instance-wide", "enabled": true,  "cadence": "weekly", "requiresAutonomy": false, "note": "deterministic; fired weekly by the in-process routine-timers poller (modules/autonomy/pollers/routine-timers.js)." },
+    "rank-roles-audit":       { "scope": "instance-wide", "enabled": true,  "cadence": "daily", "requiresAutonomy": false, "note": "deterministic; read-only; never fatal at boot (idea 1000622) — task 1002873. Fired by the in-process daily-checks poller (task 1004878)." },
     "redteam-weekly":         { "scope": "instance-wide", "enabled": true,  "cadence": "weekly", "requiresAutonomy": false, "note": "deterministic; task 1003128" },
     "repo-simplify-sweep":    { "scope": "instance-wide", "enabled": true,  "cadence": "weekly", "requiresAutonomy": false },
     "security-review-weekly": { "scope": "instance-wide", "enabled": true,  "cadence": "weekly", "requiresAutonomy": false },
     "skill-usage-review":     { "scope": "instance-wide", "enabled": true,  "cadence": "nightly", "requiresAutonomy": false },
-    "stale-claim-release":    { "scope": "instance-wide", "enabled": true,  "cadence": "hourly", "requiresAutonomy": false },
     "stranded-rows":          { "scope": "instance-wide", "enabled": true,  "requiresAutonomy": false, "note": "no cadence: nothing schedules it yet, so it is run by hand — declaring one with no cron firing it fails fitness Check 25 (task 1003775)" }
   }
 }

package/docs/adr/0042-builder-self-deploy-ci-auto-merge.md

@@ -2,7 +2,8 @@
 
 **Date:** 2026-06-07
 **Context:** GDS-V3, task [#679](https://example.com/builders#/task/679) (cut prod deploy over to CI). Completes the [#597](https://example.com/builders#/task/597) / [ADR 0031](0031-cloud-dev-environments-for-builders.md) §6 goal — *no builder box holds the production droplet SSH key*. Extends [ADR 0031](0031-cloud-dev-environments-for-builders.md) §6; re-applies [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) to CI.
-**Status:** Accepted — **armed in production 2026-06-13** (interim, grader-off variant — task [#859](https://example.com/builders#/task/859); `config/deploy.json` `mode: ci`; see the *Arming record* below + session log [`<redacted>.md`](../session-logs/<redacted>.md)).
 **Amended 2026-09-30:** the CI grade-gate (precondition 1) is permanently retired, not deferred — see the *Amendment* at the end (task 1004456, blocker 1000103).
+**Status:** Accepted — **armed in production 2026-06-13** (interim, grader-off variant — task [#859](https://example.com/builders#/task/859); `config/deploy.json` `mode: ci`; see the *Arming record* below + session log [`<redacted>.md`](../session-logs/<redacted>.md)).
+ **Amended 2026-09-30:** the CI grade-gate (precondition 1) is permanently retired, not deferred — see the *Amendment* at the end (task 1004456, blocker 1000103).
 
 ## Problem
 
@@ -35,7 +36,7 @@ With no human in the merge loop, **the CI checks *are* the authority**. The thre
 
 1. **[`CODEOWNERS`](../../CODEOWNERS)** — a PR touching any gate surface (`.github/`, `config/deploy.json`, `ship.js`, the grader, `auth.js`/`route-rank-check.js`) **or any code that executes on the droplet at deploy** (`migrations/`, `scripts/migrate.sh`, `package.json`/`package-lock.json`, `scripts/deploy/` — `~/deploy.sh` runs migrations + `npm ci` from the merged tree, so a malicious migration or poisoned lockfile would otherwise auto-merge and run on prod) requires Archon review *even under auto-merge*, when branch protection has "Require review from Code Owners" on. Ordinary PRs (game, art, docs) carry no code owner and auto-merge freely — that's the point.
 
-2. **The grader must RE-RUN in CI** — CODEOWNERS only catches *committed* changes to `ship.js`. A builder could run a **locally-edited, uncommitted** `ship.js` that skips the grade and opens an auto-merge PR anyway. An earlier draft of this ADR proposed a CI check that *reads the server-recorded grade* — but that is **theater**: `POST /tasks/:id/grade` records the grader scores *from the request body* (the server does not recompute them), so a tampered local ship.js can POST a fake passing grade. The only tamper-proof gate runs the grader **in CI, against the PR diff**, where the builder cannot touch it — [`.github/workflows/grade-gate.yml`](../../.github/workflows/grade-gate.yml) + [`scripts/gds/ci-grade.js`](../../scripts/gds/ci-grade.js) ([#855](https://example.com/builders#/task/855)), which reuse the exact production grading path (`ship.js runSubagentGrader` → the adversarial worker panel) and **fail closed**. It is **skip-safe** (green-but-not-gating) until the operator wires a grader auth secret AND marks it a required check — the same inert-until-armed pattern as `deploy-prod.yml`. This was written as a **hard precondition** of arming `ci` mode. *(Superseded 2026-09-30: the CI grade-gate is permanently retired — see the Amendment below.)*
+2. **The grader must RE-RUN in CI** — CODEOWNERS only catches *committed* changes to `ship.js`. A builder could run a **locally-edited, uncommitted** `ship.js` that skips the grade and opens an auto-merge PR anyway. An earlier draft of this ADR proposed a CI check that *reads the server-recorded grade* — but that is **theater**: `POST /tasks/:id/grade` records the grader scores *from the request body* (the server does not recompute them), so a tampered local ship.js can POST a fake passing grade. The only tamper-proof gate runs the grader **in CI, against the PR diff**, where the builder cannot touch it — [`.github/workflows/grade-gate.yml`](../../.github/workflows/grade-gate.yml) + `scripts/gds/ci-grade.js` (deleted by task 1004859) ([#855](https://example.com/builders#/task/855)), which reuse the exact production grading path (`ship.js runSubagentGrader` → the adversarial worker panel) and **fail closed**. It is **skip-safe** (green-but-not-gating) until the operator wires a grader auth secret AND marks it a required check — the same inert-until-armed pattern as `deploy-prod.yml`. This was written as a **hard precondition** of arming `ci` mode. *(Superseded 2026-09-30: the CI grade-gate is permanently retired — see the Amendment below.)*
 
 ### Why not just hand builders the droplet key
 

package/docs/adr/0091-bounding-the-kernel-and-db-carve.md

@@ -84,7 +84,7 @@ This ADR's deliverable is the decision above **plus** the carve broken into clai
 
 **Proof of equivalence at every step** (ADR 0083 / 0062 discipline): after each carve, OTB behaves **byte-for-byte the same**. That is the per-task done-when.
 
-**Tranche-1 status: PROVEN** (R74, [#1578](https://example.com/builders#/task/1578)). The five claims above are demonstrated, in one re-runnable command, by [`scripts/gds/coreB-carve-proof.sh`](../../scripts/gds/coreB-carve-proof.sh): memory + grading are loader-discovered modules; `db-kernel.js` + the memory query slice left the `db.js` monolith; `KERNEL_FILES` is the bounded 17-file roster with zero fitness hard-failures (incl. the three ENFORCING C7 boundary checks); grading resolves through the `grade` kernel port (`seams.resolveOptional('grade')`) with no core→grader import; and the 27 DB-free tests exercising the carved surfaces pass unchanged (byte-identical). The ongoing guard is CI — `fitness.js` (the kernel-imports-no-domain ratchet flips red at zero leaks) + `run-unit-tests.js` on every PR; the script is the consolidated demonstration, not a new gate. Tranche 2 (the remaining ~8 core domains) stays deferred per owner until greenlit.
+**Tranche-1 status: PROVEN** (R74, [#1578](https://example.com/builders#/task/1578)). The five claims above are demonstrated, in one re-runnable command, by `scripts/gds/coreB-carve-proof.sh` (deleted once the carve was done, task 1004856; in history at dc7d88169): memory + grading are loader-discovered modules; `db-kernel.js` + the memory query slice left the `db.js` monolith; `KERNEL_FILES` is the bounded 17-file roster with zero fitness hard-failures (incl. the three ENFORCING C7 boundary checks); grading resolves through the `grade` kernel port (`seams.resolveOptional('grade')`) with no core→grader import; and the 27 DB-free tests exercising the carved surfaces pass unchanged (byte-identical). The ongoing guard is CI — `fitness.js` (the kernel-imports-no-domain ratchet flips red at zero leaks) + `run-unit-tests.js` on every PR; the script is the consolidated demonstration, not a new gate. Tranche 2 (the remaining ~8 core domains) stays deferred per owner until greenlit.
 
 ---
 

package/docs/adr/0093-tranche-2-core-carve-sequence.md

@@ -10,7 +10,7 @@
 
 ## Context
 
-Tranche 1 ([ADR 0091](0091-bounding-the-kernel-and-db-carve.md)) did two things: it **proved the core-carve pattern** on the two cleanest-slicing domains (memory, grading — demonstrated by [`scripts/gds/coreB-carve-proof.sh`](../../scripts/gds/coreB-carve-proof.sh), R74), and it **shipped the infrastructure** every later carve reuses — the bounded kernel roster + `KERNEL_FILES` fitness ratchet (R70), the doorway with `withTx` (R68), the per-domain `db.js` slice pattern + `db-kernel.js` (R69), and the `grade` kernel **port** (R73). That infrastructure is generic: each remaining core domain is now a *pure carve* copying R72/R73, with **no new scaffolding**.
+Tranche 1 ([ADR 0091](0091-bounding-the-kernel-and-db-carve.md)) did two things: it **proved the core-carve pattern** on the two cleanest-slicing domains (memory, grading — demonstrated by `scripts/gds/coreB-carve-proof.sh` (deleted once the carve was done, task 1004856; in history at dc7d88169), R74), and it **shipped the infrastructure** every later carve reuses — the bounded kernel roster + `KERNEL_FILES` fitness ratchet (R70), the doorway with `withTx` (R68), the per-domain `db.js` slice pattern + `db-kernel.js` (R69), and the `grade` kernel **port** (R73). That infrastructure is generic: each remaining core domain is now a *pure carve* copying R72/R73, with **no new scaffolding**.
 
 What remains is the bulk of the core: ~8 cohesive domains + the two web UIs + the lifecycle state machine ([02 §6](../design/modular-architecture/02-module-map.md) roster). The import-graph scan ([02 §2](../design/modular-architecture/02-module-map.md)) already told us which slice cleanly (economy, ideas, security alongside the proven memory/grading) and which is the coupled cluster (the lifecycle — `tasks → grader/github-push/ship-broadcast`). This ADR turns that evidence into a sequence.
 

package/docs/api/openapi.json

@@ -133,10 +133,6 @@
       "name": "founding",
       "description": "Endpoints under `/api/bongos/founding`."
     },
-    {
-      "name": "gate-approvals",
-      "description": "Endpoints under `/api/bongos/gate-approvals`."
-    },
     {
       "name": "github",
       "description": "Endpoints under `/api/bongos/github`."
@@ -6435,88 +6431,6 @@
         ]
       }
     },
-    "/gate-approvals": {
-      "get": {
-        "operationId": "get_gate_approvals",
-        "tags": [
-          "gate-approvals"
-        ],
-        "summary": "GET /gate-approvals",
-        "description": "GET /gate-approvals — open PRs awaiting owner approval (gate-review red), with the verdict + per-file reasons + changed files + diff link. rank: metic+archon. BV1.R105 left this on requireRank because `gate_approval.decide` was declared over the /approve WRITE only and no atom named the read. ADR 0157 extends the catalog with exactly that atom — `gate_approval.read`, floor metic — so the mapping is now one the catalog makes. The split is load-bearing, not cosmetic: `page.view.government` opens /gate to Metic, and without a Metic-readable data endpoint that page would render nothing but a 403. Approving a held PR stays archon (`.decide`, system).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `gate_approval.read` (all required).",
-        "x-rank": "metic+archon",
-        "x-source": "modules/lifecycle/routes/gate-approvals.js",
-        "x-permissions": [
-          "gate_approval.read"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/gate-approvals/{pr}/approve": {
-      "post": {
-        "operationId": "post_gate_approvals_pr_approve",
-        "tags": [
-          "gate-approvals"
-        ],
-        "summary": "POST /gate-approvals/:pr/approve",
-        "description": "POST /gate-approvals/:pr/approve — record owner approval for a stuck gate PR and re-run the gate-review check so it clears. rank: archon (clears the hard floor — pinned in route-rank-check.EXPECTED_RANKS for downgrade protection).\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `gate_approval.decide` (all required).",
-        "x-rank": "archon",
-        "x-source": "modules/lifecycle/routes/gate-approvals.js",
-        "x-permissions": [
-          "gate_approval.decide"
-        ],
-        "parameters": [
-          {
-            "name": "pr",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string"
-            },
-            "description": "Path parameter `pr`."
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          },
-          "404": {
-            "$ref": "#/components/responses/NotFound"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
     "/github/orgs": {
       "get": {
         "operationId": "get_github_orgs",
@@ -37066,7 +36980,7 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 580,
+  "x-endpoint-count": 578,
   "x-schema-count": 622,
   "x-undocumented-bodies": 12,
   "x-response-schemas": 404,

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 580 endpoints across 99 route files.
+> **Generated from the live route files** — the route file is authoritative. 578 endpoints across 98 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -281,13 +281,6 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/founding/stages/:stage/close` | `any-builder` | — |  |
 | POST | `/api/bongos/founding/start` | `any-builder` | — |  |
 
-## `gate-approvals` (2)
-
-| Method | Path | Rank | Body | Description |
-|---|---|---|---|---|
-| GET | `/api/bongos/gate-approvals` | `metic+archon` | — | GET /gate-approvals — open PRs awaiting owner approval (gate-review red), with the verdict + per-file reasons + changed files + diff link. |
-| POST | `/api/bongos/gate-approvals/:pr/approve` | `archon` | — | POST /gate-approvals/:pr/approve — record owner approval for a stuck gate PR and re-run the gate-review check so it clears. |
-
 ## `github` (6)
 
 | Method | Path | Rank | Body | Description |

package/docs/canonical-permissions.md

@@ -94,7 +94,7 @@ forming the ordered claim-gate tier **`xenos` (1) < `thetes` (2) < `metic` (3) <
   deliberate Archon promotion.
 - **`xenos`** — the **sandboxed entry rank** every new GitHub-authed builder defaults to (migration
   029 flipped the column default here). Read-only on public surfaces; may claim + ship **only** tasks
-  an Archon (or the newcomer-generator) has flagged `newcomer_friendly = true` (enforced in
+  an Archon has flagged `newcomer_friendly = true` (enforced in
   `db.claimTask` / `claimTasksBatch`, returns `rank_too_low_for_task`). Cannot triage, resolve
   blockers, or run planning/priority sessions. This is also the tier a deactivated/offboarded builder
   is dropped to by `/builder-exit` (migration `025`); for them `status='inactive'` additionally blocks
@@ -141,7 +141,7 @@ or missing ranks fail closed.
   - **identity** — `PATCH /api/bongos/builders/:id/status` (offboard/(de)activate), `GET|PATCH /api/bongos/access-requests[/:id]`
     (who is admitted), `POST /api/gds/auth/revoke[-all]` (whose sessions are valid).
   - **the four escalation keys**, which look operational but are not: `POST /api/bongos/tasks/:id/confirm`
-    (grader-bypass), `POST /api/bongos/gate-approvals/:pr/approve` (CI deploy-gate override), protected-module
+    (grader-bypass), `POST /api/bongos/gate-approvals/:pr/approve` (CI deploy-gate override — the route was removed by task 1004859 because the CI check it overrode never ran; its key `gate_approval.decide` stays in the catalog, retired), protected-module
     **goal scope** ([ADR 0086](adr/0086-goal-scoped-work-hierarchy.md)), and `government.manage` (the
     ranks/permissions tab). Delegating any one of them lets a Metic reach Archon in four steps — create a
     protected-scope goal in the permission core, claim a task there (protected paths already floor at
@@ -235,8 +235,8 @@ or missing ranks fail closed.
   `GET /override-requests` + `POST .../:id/decide`; `POST /claims/:id/release-on-behalf`;
   `POST /done-when/:id/unsatisfy`; `POST /goals/reorder`; `POST /versions`;
   `POST /tasks/newcomer-restock`; `POST /tasks/peer-votes/tally`; `GET /discord/channels/plan` +
-  `POST .../reconcile`; `GET /autonomy/precheck`. Plus `GET /gate-approvals`, whose read was split out as
-  `gate_approval.read` so the Gate page is usable at Metic while **approving** stays Archon.
+  `POST .../reconcile`; `GET /autonomy/precheck`. `GET /gate-approvals` (key `gate_approval.read`) was removed with its approve
+  route by task 1004859; the key stays in the catalog, retired.
 
   > **Note the one confidentiality widening:** `/security/docs` (the engagement-report store with
   > attacker-usable exploit detail) is now Metic-readable, because it shares `security.report.adjudicate`