@bongos/core 1.21.177 → 1.21.179

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 580 operations across 77 resource groups
+- 578 operations across 76 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -408,12 +408,6 @@ function createClient(opts = {}) {
       // POST /founding/start — rank: any-builder — POST /founding/start
       postFoundingStart: (args) => request("POST", "/founding/start", { hasBody: true }, args),
     },
-    "gateApprovals": {
-      // GET /gate-approvals — rank: metic+archon — GET /gate-approvals
-      getGateApprovals: (args) => request("GET", "/gate-approvals", { hasBody: false }, args),
-      // POST /gate-approvals/{pr}/approve — rank: archon — POST /gate-approvals/:pr/approve
-      postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
-    },
     "github": {
       // GET /github/orgs — rank: any-builder — GET /github/orgs
       getGithubOrgs: (args) => request("GET", "/github/orgs", { hasBody: false }, args),

package/clients/bongos-client/index.cjs

@@ -407,12 +407,6 @@ function createClient(opts = {}) {
       // POST /founding/start — rank: any-builder — POST /founding/start
       postFoundingStart: (args) => request("POST", "/founding/start", { hasBody: true }, args),
     },
-    "gateApprovals": {
-      // GET /gate-approvals — rank: metic+archon — GET /gate-approvals
-      getGateApprovals: (args) => request("GET", "/gate-approvals", { hasBody: false }, args),
-      // POST /gate-approvals/{pr}/approve — rank: archon — POST /gate-approvals/:pr/approve
-      postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
-    },
     "github": {
       // GET /github/orgs — rank: any-builder — GET /github/orgs
       getGithubOrgs: (args) => request("GET", "/github/orgs", { hasBody: false }, args),

package/clients/bongos-client/index.d.ts

@@ -963,12 +963,6 @@ export interface BongosClient {
     /** POST /founding/start — rank: any-builder */
     postFoundingStart(args?: RequestArgs): Promise<ApiResponse>;
   };
-  "gateApprovals": {
-    /** GET /gate-approvals — rank: metic+archon */
-    getGateApprovals(args?: RequestArgs): Promise<ApiResponse>;
-    /** POST /gate-approvals/{pr}/approve — rank: archon */
-    postGateApprovalsPrApprove(args?: RequestArgs): Promise<ApiResponse>;
-  };
   "github": {
     /** GET /github/orgs — rank: any-builder */
     getGithubOrgs(args?: RequestArgs): Promise<ApiResponse>;

package/clients/bongos-client/index.mjs

@@ -404,12 +404,6 @@ export function createClient(opts = {}) {
       // POST /founding/start — rank: any-builder — POST /founding/start
       postFoundingStart: (args) => request("POST", "/founding/start", { hasBody: true }, args),
     },
-    "gateApprovals": {
-      // GET /gate-approvals — rank: metic+archon — GET /gate-approvals
-      getGateApprovals: (args) => request("GET", "/gate-approvals", { hasBody: false }, args),
-      // POST /gate-approvals/{pr}/approve — rank: archon — POST /gate-approvals/:pr/approve
-      postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
-    },
     "github": {
       // GET /github/orgs — rank: any-builder — GET /github/orgs
       getGithubOrgs: (args) => request("GET", "/github/orgs", { hasBody: false }, args),

package/docs/adr/0042-builder-self-deploy-ci-auto-merge.md

@@ -2,7 +2,8 @@
 
 **Date:** 2026-06-07
 **Context:** GDS-V3, task [#679](https://example.com/builders#/task/679) (cut prod deploy over to CI). Completes the [#597](https://example.com/builders#/task/597) / [ADR 0031](0031-cloud-dev-environments-for-builders.md) §6 goal — *no builder box holds the production droplet SSH key*. Extends [ADR 0031](0031-cloud-dev-environments-for-builders.md) §6; re-applies [ADR 0016](0016-trust-boundary-server-enforced-permissions.md) to CI.
-**Status:** Accepted — **armed in production 2026-06-13** (interim, grader-off variant — task [#859](https://example.com/builders#/task/859); `config/deploy.json` `mode: ci`; see the *Arming record* below + session log [`<redacted>.md`](../session-logs/<redacted>.md)).
 **Amended 2026-09-30:** the CI grade-gate (precondition 1) is permanently retired, not deferred — see the *Amendment* at the end (task 1004456, blocker 1000103).
+**Status:** Accepted — **armed in production 2026-06-13** (interim, grader-off variant — task [#859](https://example.com/builders#/task/859); `config/deploy.json` `mode: ci`; see the *Arming record* below + session log [`<redacted>.md`](../session-logs/<redacted>.md)).
+ **Amended 2026-09-30:** the CI grade-gate (precondition 1) is permanently retired, not deferred — see the *Amendment* at the end (task 1004456, blocker 1000103).
 
 ## Problem
 
@@ -35,7 +36,7 @@ With no human in the merge loop, **the CI checks *are* the authority**. The thre
 
 1. **[`CODEOWNERS`](../../CODEOWNERS)** — a PR touching any gate surface (`.github/`, `config/deploy.json`, `ship.js`, the grader, `auth.js`/`route-rank-check.js`) **or any code that executes on the droplet at deploy** (`migrations/`, `scripts/migrate.sh`, `package.json`/`package-lock.json`, `scripts/deploy/` — `~/deploy.sh` runs migrations + `npm ci` from the merged tree, so a malicious migration or poisoned lockfile would otherwise auto-merge and run on prod) requires Archon review *even under auto-merge*, when branch protection has "Require review from Code Owners" on. Ordinary PRs (game, art, docs) carry no code owner and auto-merge freely — that's the point.
 
-2. **The grader must RE-RUN in CI** — CODEOWNERS only catches *committed* changes to `ship.js`. A builder could run a **locally-edited, uncommitted** `ship.js` that skips the grade and opens an auto-merge PR anyway. An earlier draft of this ADR proposed a CI check that *reads the server-recorded grade* — but that is **theater**: `POST /tasks/:id/grade` records the grader scores *from the request body* (the server does not recompute them), so a tampered local ship.js can POST a fake passing grade. The only tamper-proof gate runs the grader **in CI, against the PR diff**, where the builder cannot touch it — [`.github/workflows/grade-gate.yml`](../../.github/workflows/grade-gate.yml) + [`scripts/gds/ci-grade.js`](../../scripts/gds/ci-grade.js) ([#855](https://example.com/builders#/task/855)), which reuse the exact production grading path (`ship.js runSubagentGrader` → the adversarial worker panel) and **fail closed**. It is **skip-safe** (green-but-not-gating) until the operator wires a grader auth secret AND marks it a required check — the same inert-until-armed pattern as `deploy-prod.yml`. This was written as a **hard precondition** of arming `ci` mode. *(Superseded 2026-09-30: the CI grade-gate is permanently retired — see the Amendment below.)*
+2. **The grader must RE-RUN in CI** — CODEOWNERS only catches *committed* changes to `ship.js`. A builder could run a **locally-edited, uncommitted** `ship.js` that skips the grade and opens an auto-merge PR anyway. An earlier draft of this ADR proposed a CI check that *reads the server-recorded grade* — but that is **theater**: `POST /tasks/:id/grade` records the grader scores *from the request body* (the server does not recompute them), so a tampered local ship.js can POST a fake passing grade. The only tamper-proof gate runs the grader **in CI, against the PR diff**, where the builder cannot touch it — [`.github/workflows/grade-gate.yml`](../../.github/workflows/grade-gate.yml) + `scripts/gds/ci-grade.js` (deleted by task 1004859) ([#855](https://example.com/builders#/task/855)), which reuse the exact production grading path (`ship.js runSubagentGrader` → the adversarial worker panel) and **fail closed**. It is **skip-safe** (green-but-not-gating) until the operator wires a grader auth secret AND marks it a required check — the same inert-until-armed pattern as `deploy-prod.yml`. This was written as a **hard precondition** of arming `ci` mode. *(Superseded 2026-09-30: the CI grade-gate is permanently retired — see the Amendment below.)*
 
 ### Why not just hand builders the droplet key
 

package/docs/api/openapi.json

@@ -133,10 +133,6 @@
       "name": "founding",
       "description": "Endpoints under `/api/bongos/founding`."
     },
-    {
-      "name": "gate-approvals",
-      "description": "Endpoints under `/api/bongos/gate-approvals`."
-    },
     {
       "name": "github",
       "description": "Endpoints under `/api/bongos/github`."
@@ -6435,88 +6431,6 @@
         ]
       }
     },
-    "/gate-approvals": {
-      "get": {
-        "operationId": "get_gate_approvals",
-        "tags": [
-          "gate-approvals"
-        ],
-        "summary": "GET /gate-approvals",
-        "description": "GET /gate-approvals — open PRs awaiting owner approval (gate-review red), with the verdict + per-file reasons + changed files + diff link. rank: metic+archon. BV1.R105 left this on requireRank because `gate_approval.decide` was declared over the /approve WRITE only and no atom named the read. ADR 0157 extends the catalog with exactly that atom — `gate_approval.read`, floor metic — so the mapping is now one the catalog makes. The split is load-bearing, not cosmetic: `page.view.government` opens /gate to Metic, and without a Metic-readable data endpoint that page would render nothing but a 403. Approving a held PR stays archon (`.decide`, system).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `gate_approval.read` (all required).",
-        "x-rank": "metic+archon",
-        "x-source": "modules/lifecycle/routes/gate-approvals.js",
-        "x-permissions": [
-          "gate_approval.read"
-        ],
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
-    "/gate-approvals/{pr}/approve": {
-      "post": {
-        "operationId": "post_gate_approvals_pr_approve",
-        "tags": [
-          "gate-approvals"
-        ],
-        "summary": "POST /gate-approvals/:pr/approve",
-        "description": "POST /gate-approvals/:pr/approve — record owner approval for a stuck gate PR and re-run the gate-review check so it clears. rank: archon (clears the hard floor — pinned in route-rank-check.EXPECTED_RANKS for downgrade protection).\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `gate_approval.decide` (all required).",
-        "x-rank": "archon",
-        "x-source": "modules/lifecycle/routes/gate-approvals.js",
-        "x-permissions": [
-          "gate_approval.decide"
-        ],
-        "parameters": [
-          {
-            "name": "pr",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string"
-            },
-            "description": "Path parameter `pr`."
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Success."
-          },
-          "400": {
-            "$ref": "#/components/responses/BadRequest"
-          },
-          "401": {
-            "$ref": "#/components/responses/Unauthorized"
-          },
-          "403": {
-            "$ref": "#/components/responses/Forbidden"
-          },
-          "404": {
-            "$ref": "#/components/responses/NotFound"
-          }
-        },
-        "security": [
-          {
-            "builderSession": []
-          }
-        ]
-      }
-    },
     "/github/orgs": {
       "get": {
         "operationId": "get_github_orgs",
@@ -37066,7 +36980,7 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 580,
+  "x-endpoint-count": 578,
   "x-schema-count": 622,
   "x-undocumented-bodies": 12,
   "x-response-schemas": 404,

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 580 endpoints across 99 route files.
+> **Generated from the live route files** — the route file is authoritative. 578 endpoints across 98 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -281,13 +281,6 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/founding/stages/:stage/close` | `any-builder` | — |  |
 | POST | `/api/bongos/founding/start` | `any-builder` | — |  |
 
-## `gate-approvals` (2)
-
-| Method | Path | Rank | Body | Description |
-|---|---|---|---|---|
-| GET | `/api/bongos/gate-approvals` | `metic+archon` | — | GET /gate-approvals — open PRs awaiting owner approval (gate-review red), with the verdict + per-file reasons + changed files + diff link. |
-| POST | `/api/bongos/gate-approvals/:pr/approve` | `archon` | — | POST /gate-approvals/:pr/approve — record owner approval for a stuck gate PR and re-run the gate-review check so it clears. |
-
 ## `github` (6)
 
 | Method | Path | Rank | Body | Description |

package/docs/canonical-permissions.md

@@ -141,7 +141,7 @@ or missing ranks fail closed.
   - **identity** — `PATCH /api/bongos/builders/:id/status` (offboard/(de)activate), `GET|PATCH /api/bongos/access-requests[/:id]`
     (who is admitted), `POST /api/gds/auth/revoke[-all]` (whose sessions are valid).
   - **the four escalation keys**, which look operational but are not: `POST /api/bongos/tasks/:id/confirm`
-    (grader-bypass), `POST /api/bongos/gate-approvals/:pr/approve` (CI deploy-gate override), protected-module
+    (grader-bypass), `POST /api/bongos/gate-approvals/:pr/approve` (CI deploy-gate override — the route was removed by task 1004859 because the CI check it overrode never ran; its key `gate_approval.decide` stays in the catalog, retired), protected-module
     **goal scope** ([ADR 0086](adr/0086-goal-scoped-work-hierarchy.md)), and `government.manage` (the
     ranks/permissions tab). Delegating any one of them lets a Metic reach Archon in four steps — create a
     protected-scope goal in the permission core, claim a task there (protected paths already floor at
@@ -235,8 +235,8 @@ or missing ranks fail closed.
   `GET /override-requests` + `POST .../:id/decide`; `POST /claims/:id/release-on-behalf`;
   `POST /done-when/:id/unsatisfy`; `POST /goals/reorder`; `POST /versions`;
   `POST /tasks/newcomer-restock`; `POST /tasks/peer-votes/tally`; `GET /discord/channels/plan` +
-  `POST .../reconcile`; `GET /autonomy/precheck`. Plus `GET /gate-approvals`, whose read was split out as
-  `gate_approval.read` so the Gate page is usable at Metic while **approving** stays Archon.
+  `POST .../reconcile`; `GET /autonomy/precheck`. `GET /gate-approvals` (key `gate_approval.read`) was removed with its approve
+  route by task 1004859; the key stays in the catalog, retired.
 
   > **Note the one confidentiality widening:** `/security/docs` (the engagement-report store with
   > attacker-usable exploit detail) is now Metic-readable, because it shares `security.report.adjudicate`