@bongos/core 1.21.68 → 1.21.70

package/docs/api/openapi.json

@@ -6000,14 +6000,14 @@
         ]
       }
     },
-    "/feedback": {
+    "/feedback/receipt": {
       "post": {
-        "operationId": "post_feedback",
+        "operationId": "post_feedback_receipt",
         "tags": [
           "feedback"
         ],
-        "summary": "POST /feedback",
-        "description": "signed-in builder — reporting a problem with Bongos grants nothing here, and the hub files every report at 'backlog' behind a Metic+ nod.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "summary": "POST /feedback/receipt",
+        "description": "signed-in builder — a receipt only says \"this builder sent this text\"; it grants nothing here, and the hub files every report behind a nod.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "src/bongos/routes/feedback.js",
         "requestBody": {
@@ -6015,7 +6015,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/PostFeedbackRequest"
+                "$ref": "#/components/schemas/PostFeedbackReceiptRequest"
               }
             }
           },
@@ -6023,7 +6023,14 @@
         },
         "responses": {
           "200": {
-            "description": "Success."
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostFeedbackReceiptResponse"
+                }
+              }
+            }
           },
           "400": {
             "$ref": "#/components/responses/ValidationFailed"
@@ -6042,6 +6049,41 @@
         ]
       }
     },
+    "/feedback/receipt/{id}": {
+      "get": {
+        "operationId": "get_feedback_receipt_id",
+        "tags": [
+          "feedback"
+        ],
+        "summary": "GET /feedback/receipt/:id",
+        "description": "the hub redeems a receipt with no session of its own. The id is 144 random bits, known only to the CLI that asked for it and the hub it sent it to, and it works once.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/feedback.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": []
+      }
+    },
     "/founding/alive": {
       "post": {
         "operationId": "post_founding_alive",
@@ -21081,6 +21123,45 @@
         "security": []
       }
     },
+    "/sso/feedback/direct": {
+      "post": {
+        "operationId": "post_sso_feedback_direct",
+        "tags": [
+          "sso"
+        ],
+        "summary": "POST /sso/feedback/direct",
+        "description": "POST /sso/feedback/direct — `bongos feedback` straight from a builder's CLI, with a one-time receipt from their own project (task 1004591). Answers 202 at once so the builder never waits; the receipt is redeemed AFTER, and a report the project does not vouch for is dropped (logged, never filed). Why this proves the sender, and what \"hosted\" earns: ../instance-feedback.js. rank: public — no session on the hub; the proof is the project's receipt. Capped per caller address (10/h whatever host it names), then per named project (30/h), BEFORE anything is fetched.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/sso.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostSsoFeedbackDirectRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostSsoFeedbackDirectResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          }
+        },
+        "security": []
+      }
+    },
     "/sso/invites/clear": {
       "post": {
         "operationId": "post_sso_invites_clear",
@@ -28936,12 +29017,12 @@
           "criterion"
         ]
       },
-      "PostFeedbackRequest": {
+      "PostFeedbackReceiptRequest": {
         "type": "object",
         "properties": {
-          "message": {
+          "sha256": {
             "type": "string",
-            "maxLength": 4000
+            "maxLength": 64
           },
           "kind": {
             "type": "string",
@@ -28949,14 +29030,28 @@
               "bug",
               "idea"
             ]
-          },
-          "context": {}
+          }
         },
         "required": [
-          "message"
+          "sha256"
         ],
         "additionalProperties": false
       },
+      "PostFeedbackReceiptResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "receipt": {},
+          "hub": {}
+        },
+        "required": [
+          "ok",
+          "receipt",
+          "hub"
+        ]
+      },
       "PostFoundingPlanRequest": {
         "type": "object",
         "properties": {
@@ -32099,6 +32194,47 @@
         ],
         "additionalProperties": false
       },
+      "PostSsoFeedbackDirectRequest": {
+        "type": "object",
+        "properties": {
+          "origin": {
+            "type": "string",
+            "maxLength": 200
+          },
+          "receipt": {
+            "type": "string",
+            "maxLength": 64
+          },
+          "message": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "context": {}
+        },
+        "required": [
+          "origin",
+          "receipt",
+          "message"
+        ],
+        "additionalProperties": false
+      },
+      "PostSsoFeedbackDirectResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "accepted": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "ok",
+          "accepted"
+        ]
+      },
       "PostSsoFeedbackRequest": {
         "type": "object",
         "properties": {
@@ -33434,9 +33570,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 520,
-  "x-schema-count": 561,
+  "x-endpoint-count": 522,
+  "x-schema-count": 564,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 372,
+  "x-response-schemas": 374,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 520 endpoints across 93 route files.
+> **Generated from the live route files** — the route file is authoritative. 522 endpoints across 93 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -261,11 +261,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/done-when/:criterionId/unsatisfy` | `metic+archon` | `reason` | Auth: flip a criterion back to unsatisfied (rare; for corrections). |
 | GET | `/api/bongos/done-when/pending-review` | `metic+archon` | — | Auth (Metic+): the criterion review queue — every criterion auto-flagged "met — pending review" (≥1 linked task, all shipped, not yet con… |
 
-## `feedback` (1)
+## `feedback` (2)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| POST | `/api/bongos/feedback` | `any-builder` | `message`, `kind`, `context` | signed-in builder — reporting a problem with Bongos grants nothing here, and the hub files every report at 'backlog' behind a Metic+ nod. |
+| POST | `/api/bongos/feedback/receipt` | `any-builder` | `sha256`, `kind` | signed-in builder — a receipt only says "this builder sent this text"; it grants nothing here, and the hub files every report behind a nod. |
+| GET | `/api/bongos/feedback/receipt/:id` | `public` | — | the hub redeems a receipt with no session of its own. |
 
 ## `founding` (6)
 
@@ -793,7 +794,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/specialities/installed-skills` | `any-builder` | — | GET /specialities/installed-skills — every skill THIS instance has, each explained the way the adoption walkthrough explains it, so a spe… |
 | GET | `/api/bongos/specialities/offered` | `any-builder` | — | GET /specialities/offered — the suggestions for THIS builder. |
 
-## `sso` (11)
+## `sso` (12)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -803,6 +804,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/sso/device/poll` | `public` | `device_code` | POST /sso/device/poll — poll the hub device flow. |
 | POST | `/api/bongos/sso/device/start` | `public` | `origin` | POST /sso/device/start — begin CLI federation. |
 | POST | `/api/bongos/sso/feedback` | `public` | `client_id`, `client_secret`, `github_id`, `message`, `kind`, `context` | POST /sso/feedback — a federated project relays one builder's feedback about Bongos itself (task 1004462). |
+| POST | `/api/bongos/sso/feedback/direct` | `public` | `origin`, `receipt`, `message`, `kind`, `context` | POST /sso/feedback/direct — `bongos feedback` straight from a builder's CLI, with a one-time receipt from their own project (task 1004591). |
 | POST | `/api/bongos/sso/invites/clear` | `public` | `client_id`, `client_secret`, `github_login` | authenticated by client_id + client_secret, not a builder rank. |
 | POST | `/api/bongos/sso/invites/notify` | `public` | `client_id`, `client_secret`, `github_login` | authenticated by client_id + client_secret, not a builder rank. |
 | POST | `/api/bongos/sso/membership/check-in` | `public` | `client_id`, `client_secret`, `github_id`, `github_login`, `display_name`, `avatar_url`, `membership_kind` | POST /sso/membership/check-in — a federated instance reports, on every sign-in, that a builder builds on its project (ADR 0141 §3). |