@bongos/core 1.21.69 → 1.21.70

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.69",
-  "core_contract": "1.21.69",
-  "source_commit": "eef6b6776aba51af624676414f9e35506d67b43d",
+  "core_version": "1.21.70",
+  "core_contract": "1.21.70",
+  "source_commit": "799c79fb4bc15a5e245ed46a99e5dd64f4919cb3",
   "source_ref": "HEAD",
-  "built_at": "2026-10-06T19:05:34.159Z",
+  "built_at": "2026-10-06T20:12:59.064Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 587,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3583,
-  "tree_sha256": "1a825682b5a9946091564b39221830171a30d45b5e8fa21c37d7dda4be1300be",
+  "tree_sha256": "2b64f5c207fa75236b6cbc9a1d184fe7952421dd51a20fd2f5e31ec352a8be40",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -42,7 +42,7 @@
     {
       "path": ".claude/skills/bongos-feedback/SKILL.md",
       "mode": "0000644",
-      "sha256": "b30912b54c07c873cc94398af0ffd6c8e364a0f7f81a866343667cc5a87da25a"
+      "sha256": "8cbf792ddc9aec8f9be65c6be4532a7f4593d2b3818311c6daf6aabec99b1bc7"
     },
     {
       "path": ".claude/skills/bug-triage/SKILL.md",
@@ -312,12 +312,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "64898ab4e4c50f816f893db4d935ac04bee0e674129b10840d0ac88b5fe6ce0b"
+      "sha256": "5b0af2f15d83dcd9e74eb5a381f28d28af9ea0af33881da240729ca1e392bf0a"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "71502f60514d4e9dfc93a8c812302423d776db48d8035ca9e0ce0ef0a5bb2dce"
+      "sha256": "d0c9745553265fcc941c29753b44cd526b5e6e3ffc4da98676a3a31becd9d09a"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -327,17 +327,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "ca9bacfcb336995f72080cc7d6574c7a6a6a22ae38f5c3ae226299471551f60d"
+      "sha256": "fd19be4bddd44f6e14bdf0a86903d65dc2aa7d1642a3228f1594bcca1cc9fd09"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "13975c1817d7441022af0decfcc9561e09e7c953eb92aa8ce36831abdd61223b"
+      "sha256": "a8a84e3a327cd6c8962865573b0e35487b41f64f2e287b5df80e1499f42e9e15"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "968533c3b36431c47ff8dc6a0b0f8719e10fd24f979d54531227195535d95d56"
+      "sha256": "af56c93778ef8d471a247e7acf936d3635e0852da6733afd22691801fda343d5"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2302,12 +2302,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "0b828454e83a6321177f11793f120372fdddaef0dec6a02471937785685944df"
+      "sha256": "79ac8643ddda444a597821f6cf81c25e58baaf9eaee7422dc0d597c8557d8097"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "3ee03a72d3757bca0938a893421ca02710d4f0c73634a381b873664c086b435a"
+      "sha256": "2e745e8f23dd12587b9ce79c642f932c885ad3263d38144949281f9b26563b2b"
     },
     {
       "path": "docs/architecture.md",
@@ -2847,7 +2847,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "e3e3182f90cc2d0529737263c500bf43eca18c25d6acb18f39d64a4dca5461b8"
+      "sha256": "b43fd3370397bc58fc63f7f9c3a1616f9c429613174a8498d69ca19697d7ee25"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7797,7 +7797,7 @@
     {
       "path": "modules/platform-identity/instance-feedback.js",
       "mode": "0000644",
-      "sha256": "a23b225541730f48ddd620c80b8393f8468d7438543aac77febbc52d7cc42b0c"
+      "sha256": "e1786bed35fb98b4d47113b6d8486891c67f72505d4ad74819bac02a1b3b6eab"
     },
     {
       "path": "modules/platform-identity/invite-authz.js",
@@ -8082,7 +8082,7 @@
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "0ecc3f416dbd03ee47a2c18a64faa6e0e0fac1d19c10a5246f7c77aa313d8264"
+      "sha256": "d2aa5ee441648f4167db2453385c6c022ebad3a86afcd6187071deb1be90e402"
     },
     {
       "path": "modules/platform-identity/scouting-authz.js",
@@ -10037,12 +10037,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0c868cd910230554e376e2eecccb757a0956fca36ab7b9503392c564a8874d2b"
+      "sha256": "0abde492bc94b4bafd14a5f402b76fb5e9063f66f5ec9a9a930b17edff3363e1"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1a3883e42303e3f9b9623b509a21475bba131d05ace51155bafc89731b64e345"
+      "sha256": "152af0cc2be56f12652515999ee93e697cdd85749c2eb5c430e39d76eada090e"
     },
     {
       "path": "public-docs/index.html",
@@ -10062,7 +10062,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "258c1c9dfcfd252659cfd3ffc1f501fd380b650aa3546a60e52bc3bffd295df9"
+      "sha256": "62116e737a2e0bbf80e7d5f0f539f65be938c7823e3dc5b97ee3ae5d5f4f02df"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -10562,7 +10562,7 @@
     {
       "path": "scripts/gds/feedback-send.js",
       "mode": "0000644",
-      "sha256": "9b5b7002dc26d36b48da20dfc8cd44b6dd64089b1ae66c1f589135808d6c6f1a"
+      "sha256": "3b043beaecc95b9e1019d8b56c5e1e16a279bfcf5904e8547db6ca620309390b"
     },
     {
       "path": "scripts/gds/fetch-art-key.js",
@@ -12087,7 +12087,7 @@
     {
       "path": "src/bongos/platform-visibility-gate.js",
       "mode": "0000644",
-      "sha256": "c5c258b7a0be2b6c3be9ee9aac8cb55afc156f04e279579c648f9e70a06e0e2b"
+      "sha256": "7238926a2efa205bf6efa49b111940687549a6466e43a327ba56d9121d18cbc5"
     },
     {
       "path": "src/bongos/pool.js",
@@ -12172,7 +12172,7 @@
     {
       "path": "src/bongos/routes/feedback.js",
       "mode": "0000644",
-      "sha256": "691924ef1295a5d50cb035b998879b15d47d92a09526feab3c5e46c63f5c51b1"
+      "sha256": "6307d32f0739bd5107d8259b0b9f316da8e875257975d8465559db8f7d232167"
     },
     {
       "path": "src/bongos/routes/github.js",
@@ -12282,7 +12282,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "465ea427cc15418f1e567c9770276d1dd5087f82c9d11aeb99f2f06d042f4d9e"
+      "sha256": "c297a4a84c33a4b846abd7707f0b10a813ca418841c2455dba9a453c283c9752"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -15122,7 +15122,7 @@
     {
       "path": "tests/instance_feedback.mjs",
       "mode": "0000644",
-      "sha256": "e3402d4767d21bd6d5ab80ad6f0670d4c94c9c56ff1c4656ebd4218b191a8b1c"
+      "sha256": "704a506419ff49032b9604dc039113eaa63db68ac7a57fa09e09162ce7acfae5"
     },
     {
       "path": "tests/instance_manifest.mjs",

package/.claude/skills/bongos-feedback/SKILL.md

@@ -7,61 +7,25 @@ plain: >-
 reach-for: >-
   When Bongos itself got in your way — a command that failed or confused you, or something you wish it did. You do not have to ask; complaining is enough.
 cost: >-
-  Free. It files one note with the Bongos maintainers and changes nothing in your project.
+  Free, and instant: one line back, and it sends in the background. It changes nothing in your project.
 ---
 
-**Script skill (authoritative).** The core action is `bongos feedback "<message>"` (or `--idea "<message>"`, or `--message-file <path>`). Run it and print its output verbatim.
+Sends a note about Bongos — the tool — straight to its maintainers (tasks 1004462, 1004591). One tool call, one line back.
 
-This **sends** a note about Bongos — the tool — upstream to its maintainers on Cloud Bongos, where a bug becomes a task waiting for a maintainer's approval (tasks 1004462, 1004467).
+**When.** File when the builder (a) labels it — "Bongos feedback: …", "tell the Bongos team" — that **is** the go; (b) wishes — "Bongos should…" (**Suggestions count**: send with `--idea`, even if you also fix it in their project); or (c) vents that Bongos is broken — **File it without being asked**, don't argue them out of it. Only about **Bongos itself** (a `bongos`/`/builder-*` command, claim, ship, grade, deploy, upgrade, hall, Settings, sign-in, credits, how it organises work). Not their own project's code, Claude, their laptop or GitHub, nor a rule working as designed. **One filing per distinct problem per session.**
 
-## Two ways in
+**Write it yourself — Never paste the rant.** First line = what went wrong (it becomes the title); then what they did, what they expected, what happened, the exact error line. No code, file contents, secrets or personal data.
 
-- **Asked** — the builder labels a message as feedback for Bongos ("Bongos feedback: …", "feedback for Bongos", "tell the Bongos team", "report this") or runs `/bongos-feedback`. A message that already says what the feedback is **is** the go: write the report, send it, and show them what was sent. Only when they ask you to report something without saying what, draft it and send on their go.
-- **Suggestions count.** Feedback is not only breakage. "Bongos should…", "I don't want Bongos to…", or a complaint about how Bongos organises their work (versions, goals, tasks, ranks) is feedback too — send it with `--idea`. Fixing it in their own project (moving the goal, saving a preference) is fine, but it does not replace sending it: the next project would hit the same thing.
-- **Proactive** — the builder is venting that Bongos is not working: frustration, swearing, "this is broken again", "why does X keep failing", "Bongos is useless today". **File it without being asked**, then tell them in one line (below). The owner's standing rule (2026-09-30): every rant about Bongos not working becomes something to fix. Do not ask permission first, and do not argue them out of it.
-
-## Is it about Bongos? (proactive mode files only when yes)
-
-File when the complaint is about **Bongos itself**: how it organises their work (a goal that forced a new version, a version they did not want), a `bongos`/`/builder-*` command, a claim, ship, grade, merge or deploy step, the hall, Settings, sign-in, credits, the upgrade, or a Bongos message that confused them.
-
-Do **not** file when it is about their **own project's** code, tests or design, about Claude itself, their laptop, GitHub or another service — or when the "problem" is a rule working as designed (an `[otb-plain]` card saying `By design: Yes`). If it is genuinely unclear, fix the thing in front of you first and file only if it turns out to be Bongos.
-
-**One filing per distinct problem per session.** A second rant about the same failure adds nothing; say it is already filed (with the number) instead.
-
-## Writing the report
-
-Write it yourself from what you saw. **Never paste the rant.** The maintainers need the facts, not the mood:
-
-1. A plain first line naming what went wrong — it becomes the title. (`bongos claim hung for two minutes, then failed with fetch failed`)
-2. What the builder was doing, what they expected, what happened instead, and the exact error line if there was one.
-3. Whether it happened more than once, and any workaround you found.
-
-**Leave out:** code, file contents, secrets, tokens, customer or personal data, and anything about their project the maintainers do not need. Only the text you send travels (plus the Bongos and CLI versions, added automatically). As a backstop the command runs every report through Bongos's secret scrubber and refuses to send if it can't, but it is a backstop, not permission to be careless.
-
-A report that is really a wish ("I'd like Bongos to…") goes with `--idea`.
-
-## Sending
-
-From the project checkout. For anything longer than one line, write the report to a file with the Write tool first — the shell eats backticks inside a quoted argument:
+**Send** (stdin, so nothing in the text is mangled by the shell):
 
 ```bash
-bongos feedback --message-file <path>
+bongos feedback --message-file - <<'EOF'
+<report>
+EOF
 ```
 
-## Telling the builder
-
-**Proactive:** one line, after sending, then carry on with what they were doing. For example: *"I've reported this to the Bongos team as task 1004500 — it's waiting for a maintainer to approve it."* No more than that, unless they ask what was sent — then show them the report.
-
-**Asked:** report the CLI's output verbatim.
-
-## If it refuses
-
-The CLI prints one plain line for each refusal. In proactive mode, a refusal is one line to the builder and nothing more — never retry in a loop.
-
-- **"not connected to Cloud Bongos"** — a self-hosted project has no link to the hub. Point the builder at the Bongos core repository's issue tracker.
-- **"does not yet know you as a member"** — the hub only accepts reports from someone it has seen sign in to this project. Signing in to the project once through Cloud Bongos in a browser fixes it.
-- **"Too much feedback"** — the hourly cap. Don't retry; mention it once.
+Add `--idea` for a wish. The command prints one line — relay it, then carry on. Proactive filing: one short sentence, e.g. *"I've sent that to the Bongos team."* If it says the project runs only on this computer, tell the builder in one line; never retry.
 
 ## Files this skill touches
 
-- Runs: `bongos feedback` → `scripts/gds/feedback-send.js` → `POST /api/bongos/feedback` on this project (`src/bongos/routes/feedback.js`) → the hub's `POST /api/bongos/sso/feedback` (`modules/platform-identity/instance-feedback.js`).
+- Runs: `bongos feedback` → `scripts/gds/feedback-send.js` → a receipt from this project (`POST /api/bongos/feedback/receipt`, `src/bongos/routes/feedback.js`) → the hub's `POST /api/bongos/sso/feedback/direct` (`modules/platform-identity/instance-feedback.js`), which redeems the receipt before filing.

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 520 operations across 75 resource groups
+- 522 operations across 75 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -385,8 +385,10 @@ function createClient(opts = {}) {
       getDoneWhenPendingReview: (args) => request("GET", "/done-when/pending-review", { hasBody: false }, args),
     },
     "feedback": {
-      // POST /feedback — rank: any-builder — POST /feedback
-      postFeedback: (args) => request("POST", "/feedback", { hasBody: true }, args),
+      // POST /feedback/receipt — rank: any-builder — POST /feedback/receipt
+      postFeedbackReceipt: (args) => request("POST", "/feedback/receipt", { hasBody: true }, args),
+      // GET /feedback/receipt/{id} — rank: public — GET /feedback/receipt/:id
+      getFeedbackReceiptId: (args) => request("GET", "/feedback/receipt/{id}", { hasBody: false }, args),
     },
     "founding": {
       // POST /founding/alive — rank: any-builder — POST /founding/alive
@@ -1125,6 +1127,8 @@ function createClient(opts = {}) {
       postSsoDeviceStart: (args) => request("POST", "/sso/device/start", { hasBody: true }, args),
       // POST /sso/feedback — rank: public — POST /sso/feedback
       postSsoFeedback: (args) => request("POST", "/sso/feedback", { hasBody: true }, args),
+      // POST /sso/feedback/direct — rank: public — POST /sso/feedback/direct
+      postSsoFeedbackDirect: (args) => request("POST", "/sso/feedback/direct", { hasBody: true }, args),
       // POST /sso/invites/clear — rank: public — POST /sso/invites/clear
       postSsoInvitesClear: (args) => request("POST", "/sso/invites/clear", { hasBody: true }, args),
       // POST /sso/invites/notify — rank: public — POST /sso/invites/notify

package/clients/bongos-client/index.cjs

@@ -384,8 +384,10 @@ function createClient(opts = {}) {
       getDoneWhenPendingReview: (args) => request("GET", "/done-when/pending-review", { hasBody: false }, args),
     },
     "feedback": {
-      // POST /feedback — rank: any-builder — POST /feedback
-      postFeedback: (args) => request("POST", "/feedback", { hasBody: true }, args),
+      // POST /feedback/receipt — rank: any-builder — POST /feedback/receipt
+      postFeedbackReceipt: (args) => request("POST", "/feedback/receipt", { hasBody: true }, args),
+      // GET /feedback/receipt/{id} — rank: public — GET /feedback/receipt/:id
+      getFeedbackReceiptId: (args) => request("GET", "/feedback/receipt/{id}", { hasBody: false }, args),
     },
     "founding": {
       // POST /founding/alive — rank: any-builder — POST /founding/alive
@@ -1124,6 +1126,8 @@ function createClient(opts = {}) {
       postSsoDeviceStart: (args) => request("POST", "/sso/device/start", { hasBody: true }, args),
       // POST /sso/feedback — rank: public — POST /sso/feedback
       postSsoFeedback: (args) => request("POST", "/sso/feedback", { hasBody: true }, args),
+      // POST /sso/feedback/direct — rank: public — POST /sso/feedback/direct
+      postSsoFeedbackDirect: (args) => request("POST", "/sso/feedback/direct", { hasBody: true }, args),
       // POST /sso/invites/clear — rank: public — POST /sso/invites/clear
       postSsoInvitesClear: (args) => request("POST", "/sso/invites/clear", { hasBody: true }, args),
       // POST /sso/invites/notify — rank: public — POST /sso/invites/notify

package/clients/bongos-client/index.d.ts

@@ -316,7 +316,8 @@ export interface PostDoneWhenCriterionIdUatRequest { kind: string; recording?: s
 export interface PostDoneWhenCriterionIdUatResponse { ok: boolean; signoff: unknown; criterion_closed: unknown; achieved_goals: unknown; closed_versions: unknown }
 export interface PostDoneWhenCriterionIdUnsatisfyRequest { reason?: string }
 export interface PostDoneWhenCriterionIdUnsatisfyResponse { criterion: unknown }
-export interface PostFeedbackRequest { message: string; kind?: "bug" | "idea"; context?: unknown }
+export interface PostFeedbackReceiptRequest { sha256: string; kind?: "bug" | "idea" }
+export interface PostFeedbackReceiptResponse { ok: boolean; receipt: unknown; hub: unknown }
 export interface PostFoundingPlanRequest { days?: Record<string, unknown>; passes?: number; advisors?: string; government?: string; expected_builders?: number; existing?: boolean }
 export interface PostGithubRepoVisibilityRequest { repo: string; visibility: "public" | "private" }
 export interface PostGithubRepoVisibilityResponse { ok: boolean; repo: unknown; private_deployable: boolean }
@@ -496,6 +497,8 @@ export interface PostSsoApplicantProfileRequest { client_id: string; client_secr
 export interface PostSsoApplicantProfileResponse { profile: unknown; guild: unknown }
 export interface PostSsoDevicePollRequest { device_code: string }
 export interface PostSsoDeviceStartRequest { origin: string }
+export interface PostSsoFeedbackDirectRequest { origin: string; receipt: string; message: string; kind?: string; context?: unknown }
+export interface PostSsoFeedbackDirectResponse { ok: boolean; accepted: boolean }
 export interface PostSsoFeedbackRequest { client_id: string; client_secret: string; github_id: StringifiableId; message: string; kind?: string; context?: unknown }
 export interface PostSsoInvitesClearRequest { client_id: string; client_secret: string; github_login: string }
 export interface PostSsoInvitesNotifyRequest { client_id: string; client_secret: string; github_login: string }
@@ -879,8 +882,10 @@ export interface BongosClient {
     getDoneWhenPendingReview(args?: RequestArgs): Promise<GetDoneWhenPendingReviewResponse>;
   };
   "feedback": {
-    /** POST /feedback — rank: any-builder */
-    postFeedback(args: RequestArgs & { body: PostFeedbackRequest }): Promise<ApiResponse>;
+    /** POST /feedback/receipt — rank: any-builder */
+    postFeedbackReceipt(args: RequestArgs & { body: PostFeedbackReceiptRequest }): Promise<PostFeedbackReceiptResponse>;
+    /** GET /feedback/receipt/{id} — rank: public */
+    getFeedbackReceiptId(args?: RequestArgs): Promise<ApiResponse>;
   };
   "founding": {
     /** POST /founding/alive — rank: any-builder */
@@ -1619,6 +1624,8 @@ export interface BongosClient {
     postSsoDeviceStart(args: RequestArgs & { body: PostSsoDeviceStartRequest }): Promise<ApiResponse>;
     /** POST /sso/feedback — rank: public */
     postSsoFeedback(args: RequestArgs & { body: PostSsoFeedbackRequest }): Promise<ApiResponse>;
+    /** POST /sso/feedback/direct — rank: public */
+    postSsoFeedbackDirect(args: RequestArgs & { body: PostSsoFeedbackDirectRequest }): Promise<PostSsoFeedbackDirectResponse>;
     /** POST /sso/invites/clear — rank: public */
     postSsoInvitesClear(args: RequestArgs & { body: PostSsoInvitesClearRequest }): Promise<ApiResponse>;
     /** POST /sso/invites/notify — rank: public */

package/clients/bongos-client/index.mjs

@@ -381,8 +381,10 @@ export function createClient(opts = {}) {
       getDoneWhenPendingReview: (args) => request("GET", "/done-when/pending-review", { hasBody: false }, args),
     },
     "feedback": {
-      // POST /feedback — rank: any-builder — POST /feedback
-      postFeedback: (args) => request("POST", "/feedback", { hasBody: true }, args),
+      // POST /feedback/receipt — rank: any-builder — POST /feedback/receipt
+      postFeedbackReceipt: (args) => request("POST", "/feedback/receipt", { hasBody: true }, args),
+      // GET /feedback/receipt/{id} — rank: public — GET /feedback/receipt/:id
+      getFeedbackReceiptId: (args) => request("GET", "/feedback/receipt/{id}", { hasBody: false }, args),
     },
     "founding": {
       // POST /founding/alive — rank: any-builder — POST /founding/alive
@@ -1121,6 +1123,8 @@ export function createClient(opts = {}) {
       postSsoDeviceStart: (args) => request("POST", "/sso/device/start", { hasBody: true }, args),
       // POST /sso/feedback — rank: public — POST /sso/feedback
       postSsoFeedback: (args) => request("POST", "/sso/feedback", { hasBody: true }, args),
+      // POST /sso/feedback/direct — rank: public — POST /sso/feedback/direct
+      postSsoFeedbackDirect: (args) => request("POST", "/sso/feedback/direct", { hasBody: true }, args),
       // POST /sso/invites/clear — rank: public — POST /sso/invites/clear
       postSsoInvitesClear: (args) => request("POST", "/sso/invites/clear", { hasBody: true }, args),
       // POST /sso/invites/notify — rank: public — POST /sso/invites/notify

package/docs/api/openapi.json

@@ -6000,14 +6000,14 @@
         ]
       }
     },
-    "/feedback": {
+    "/feedback/receipt": {
       "post": {
-        "operationId": "post_feedback",
+        "operationId": "post_feedback_receipt",
         "tags": [
           "feedback"
         ],
-        "summary": "POST /feedback",
-        "description": "signed-in builder — reporting a problem with Bongos grants nothing here, and the hub files every report at 'backlog' behind a Metic+ nod.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "summary": "POST /feedback/receipt",
+        "description": "signed-in builder — a receipt only says \"this builder sent this text\"; it grants nothing here, and the hub files every report behind a nod.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "src/bongos/routes/feedback.js",
         "requestBody": {
@@ -6015,7 +6015,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/PostFeedbackRequest"
+                "$ref": "#/components/schemas/PostFeedbackReceiptRequest"
               }
             }
           },
@@ -6023,7 +6023,14 @@
         },
         "responses": {
           "200": {
-            "description": "Success."
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostFeedbackReceiptResponse"
+                }
+              }
+            }
           },
           "400": {
             "$ref": "#/components/responses/ValidationFailed"
@@ -6042,6 +6049,41 @@
         ]
       }
     },
+    "/feedback/receipt/{id}": {
+      "get": {
+        "operationId": "get_feedback_receipt_id",
+        "tags": [
+          "feedback"
+        ],
+        "summary": "GET /feedback/receipt/:id",
+        "description": "the hub redeems a receipt with no session of its own. The id is 144 random bits, known only to the CLI that asked for it and the hub it sent it to, and it works once.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/feedback.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": []
+      }
+    },
     "/founding/alive": {
       "post": {
         "operationId": "post_founding_alive",
@@ -21081,6 +21123,45 @@
         "security": []
       }
     },
+    "/sso/feedback/direct": {
+      "post": {
+        "operationId": "post_sso_feedback_direct",
+        "tags": [
+          "sso"
+        ],
+        "summary": "POST /sso/feedback/direct",
+        "description": "POST /sso/feedback/direct — `bongos feedback` straight from a builder's CLI, with a one-time receipt from their own project (task 1004591). Answers 202 at once so the builder never waits; the receipt is redeemed AFTER, and a report the project does not vouch for is dropped (logged, never filed). Why this proves the sender, and what \"hosted\" earns: ../instance-feedback.js. rank: public — no session on the hub; the proof is the project's receipt. Capped per caller address (10/h whatever host it names), then per named project (30/h), BEFORE anything is fetched.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/sso.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostSsoFeedbackDirectRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostSsoFeedbackDirectResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          }
+        },
+        "security": []
+      }
+    },
     "/sso/invites/clear": {
       "post": {
         "operationId": "post_sso_invites_clear",
@@ -28936,12 +29017,12 @@
           "criterion"
         ]
       },
-      "PostFeedbackRequest": {
+      "PostFeedbackReceiptRequest": {
         "type": "object",
         "properties": {
-          "message": {
+          "sha256": {
             "type": "string",
-            "maxLength": 4000
+            "maxLength": 64
           },
           "kind": {
             "type": "string",
@@ -28949,14 +29030,28 @@
               "bug",
               "idea"
             ]
-          },
-          "context": {}
+          }
         },
         "required": [
-          "message"
+          "sha256"
         ],
         "additionalProperties": false
       },
+      "PostFeedbackReceiptResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "receipt": {},
+          "hub": {}
+        },
+        "required": [
+          "ok",
+          "receipt",
+          "hub"
+        ]
+      },
       "PostFoundingPlanRequest": {
         "type": "object",
         "properties": {
@@ -32099,6 +32194,47 @@
         ],
         "additionalProperties": false
       },
+      "PostSsoFeedbackDirectRequest": {
+        "type": "object",
+        "properties": {
+          "origin": {
+            "type": "string",
+            "maxLength": 200
+          },
+          "receipt": {
+            "type": "string",
+            "maxLength": 64
+          },
+          "message": {
+            "type": "string"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "context": {}
+        },
+        "required": [
+          "origin",
+          "receipt",
+          "message"
+        ],
+        "additionalProperties": false
+      },
+      "PostSsoFeedbackDirectResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "accepted": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "ok",
+          "accepted"
+        ]
+      },
       "PostSsoFeedbackRequest": {
         "type": "object",
         "properties": {
@@ -33434,9 +33570,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 520,
-  "x-schema-count": 561,
+  "x-endpoint-count": 522,
+  "x-schema-count": 564,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 372,
+  "x-response-schemas": 374,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }