@bongos/core 1.21.70 → 1.21.72

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.70",
-  "core_contract": "1.21.70",
-  "source_commit": "799c79fb4bc15a5e245ed46a99e5dd64f4919cb3",
+  "core_version": "1.21.72",
+  "core_contract": "1.21.72",
+  "source_commit": "7feb4a1d184cb77ea4198b4ddff63894a59ebb2c",
   "source_ref": "HEAD",
-  "built_at": "2026-10-06T20:12:59.064Z",
+  "built_at": "2026-10-08T15:24:37.754Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 587,
+    "docs_redacted": 588,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 2967,
+    "functional_verbatim": 2978,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3583,
-  "tree_sha256": "2b64f5c207fa75236b6cbc9a1d184fe7952421dd51a20fd2f5e31ec352a8be40",
+  "file_count": 3595,
+  "tree_sha256": "5c2510a4bc066618a3263519ccbcd1f4fcab0b5f6215543c8b4e0a74b9e0577e",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -152,7 +152,7 @@
     {
       "path": ".claude/skills/goal-create/SKILL.md",
       "mode": "0000644",
-      "sha256": "8226e410c256a4b13a38b1b6cad0d685faae5d6e1f7bd3f0d724582c1269eedf"
+      "sha256": "e29973b30b5eaed3362abc549c08797ac3e32bd36071b4670c3e058a18a1dfc2"
     },
     {
       "path": ".claude/skills/goal-review/SKILL.md",
@@ -312,12 +312,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "5b0af2f15d83dcd9e74eb5a381f28d28af9ea0af33881da240729ca1e392bf0a"
+      "sha256": "a7328558d0724745cabe93f27b6a322da00877dbeeb432e6e4b8a0d01046c886"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "d0c9745553265fcc941c29753b44cd526b5e6e3ffc4da98676a3a31becd9d09a"
+      "sha256": "04976427be615436fb945535304723b1f8238850477c1ae9014170029e1c9458"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -327,17 +327,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "fd19be4bddd44f6e14bdf0a86903d65dc2aa7d1642a3228f1594bcca1cc9fd09"
+      "sha256": "f04ec9816574187ddb9abd02e04cabeba674aef3e5f662954d996cbddb3737a2"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "a8a84e3a327cd6c8962865573b0e35487b41f64f2e287b5df80e1499f42e9e15"
+      "sha256": "4b9c887d6326a7c2bdb9277a668762c809a56901fe9c3647367426c8959ef3ff"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "af56c93778ef8d471a247e7acf936d3635e0852da6733afd22691801fda343d5"
+      "sha256": "8d44ac1885a1fa52bdecb21fb7b26fa34744b6a37a9de69f385a98955ed76453"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2294,20 +2294,25 @@
       "mode": "0000644",
       "sha256": "6d02d69a8d1bc0378f143960b280e06b4d7777b0ef4d3e7aa8c2d5a4337f85b8"
     },
+    {
+      "path": "docs/adr/0368-red-and-blue-teams-practice-on-a-range-never-on-live.md",
+      "mode": "0000644",
+      "sha256": "9269694c53caf6a7d00ab86908503ff2719bc6cb35e7305ab6993668fe7f2234"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "2d9e4ea00f57234d18adc9a8b95b1ccabb3fca6b61b859d629eb8e8f533cc9f8"
+      "sha256": "e2cd858f72e99fbf010904983a8e2e54e8104cda8e623b451834036bd231bba4"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "79ac8643ddda444a597821f6cf81c25e58baaf9eaee7422dc0d597c8557d8097"
+      "sha256": "4434a7877238251b38f5b5a2112d5ea7a3cc0d3dce871a50f8d2f2e37fc34503"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "2e745e8f23dd12587b9ce79c642f932c885ad3263d38144949281f9b26563b2b"
+      "sha256": "7d3a5a8ca2f543ed69d8c7e39a50e05ef6d534510cde3e8db58ab68561a99922"
     },
     {
       "path": "docs/architecture.md",
@@ -2332,12 +2337,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "508f0fb0fa81fd8613210b247e7a52d3f04f28a4e150cd832f05fba7b5ff455f"
+      "sha256": "db10429d24d5fb151849ec1f70d03470dc7fcb467fbeae810ec64d7c74e2b7a7"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "4d7ae0a88ecbfac2dae3ece480733dfb5041ecd6e43dede7a311886d9a65c802"
+      "sha256": "b0f71308a03fa56b7cc5259adc9e1aea2909cfb000a3fde8401870cc88f4c5f8"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2837,7 +2842,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "02cf56634d27c40165380ae536c0497cc75b56c106df7611d0aee602d403bc93"
+      "sha256": "979635d258babf1fdfdfb479a3c47807ab64cad135aeac7b7b77579db06f57dc"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2847,7 +2852,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "b43fd3370397bc58fc63f7f9c3a1616f9c429613174a8498d69ca19697d7ee25"
+      "sha256": "aa17eaafbaf7d56313bf919f359d3dfc1acf0a4ed747eb13cc5873a05ac46870"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2937,7 +2942,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "f503601476e44b6a2e939d9e1858e3c4756bd3e52159b15bcbd3907d46917ead"
+      "sha256": "2620b3d29e24ac6efd11dd84f782ad4250342d218bf0243e6f3290c5ee120187"
     },
     {
       "path": "docs/project-context.template.md",
@@ -2972,7 +2977,7 @@
     {
       "path": "docs/recipes/core-release-pipeline.md",
       "mode": "0000644",
-      "sha256": "1558473dea0e6c41e623ede06f0bf006fcd58cb1ab388b7e7e149872fcdbb00b"
+      "sha256": "23ebe6ce28667a82c457badf8db3116c5dc86e19fd799603bbfe8b22be4fc560"
     },
     {
       "path": "docs/recipes/failed-ship-recovery-proof.md",
@@ -3102,7 +3107,7 @@
     {
       "path": "docs/recipes/upgrading-the-core.md",
       "mode": "0000644",
-      "sha256": "cc1253d5b13243b04d343db140c557b9c78c9345b001be71f3c7b782e9982860"
+      "sha256": "6a6dde2f442d101c4f84a24d3ec44196c1b5b0dfe71e55e980defc9aec082068"
     },
     {
       "path": "docs/recipes/windows-builders.md",
@@ -6142,7 +6147,7 @@
     {
       "path": "modules/hall-ui/public/settings-software-update.js",
       "mode": "0000644",
-      "sha256": "7eaebcf13d3f066af6b743e447df685fe7d9a6bee684fd5c781824119fc0c4e2"
+      "sha256": "b1cdeaf19b178b1912e7eda8cf78ecf71c43dbd40eae6155e38a250c2e7a04e6"
     },
     {
       "path": "modules/hall-ui/public/settings-specialities.js",
@@ -6157,7 +6162,7 @@
     {
       "path": "modules/hall-ui/public/settings.html",
       "mode": "0000644",
-      "sha256": "24bfda8ad2b26b587e73c4694d75d9bab1f5389b36e8607231e6533835d723a2"
+      "sha256": "a87efe78220d50c1c00644550e7b9a26bb21417d1965843e325b47d24e033c24"
     },
     {
       "path": "modules/hall-ui/public/settings.js",
@@ -6902,7 +6907,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "2efcf47f6240b7a21e1d908440a04e3f0af3e86ca22aed5b74ba03ed354de437"
+      "sha256": "d611c0e5dd9b1f38779b97f6585bb02bdc9fda1a20453348cf86f978e4abb8b5"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -7004,6 +7009,11 @@
       "mode": "0000644",
       "sha256": "646d48ee5c1e4d49a5824799a369595dfd1f63bd1c2d0f571c4e6b584b1202f5"
     },
+    {
+      "path": "modules/lifecycle/goal-spec-task.js",
+      "mode": "0000644",
+      "sha256": "1fc60c3f9388ff2f4a9ea71d70e47a4e091a529f323b1b8d0e4ad724a469c664"
+    },
     {
       "path": "modules/lifecycle/goal-suggest.js",
       "mode": "0000644",
@@ -7282,7 +7292,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "70e8d595822e25e7e1028547363804aa7964a70e708d273ab2a939b185da9c60"
+      "sha256": "88cd70b4b1912c40bb9a40af9dd499f28461175e33a3c0a702ce35d4f805de79"
     },
     {
       "path": "modules/lifecycle/routes/help-requests.js",
@@ -7337,7 +7347,7 @@
     {
       "path": "modules/lifecycle/routes/task-write-routes.js",
       "mode": "0000644",
-      "sha256": "7f9419719070ec7048a2c81149427cbdaf3bf0e4a33993c1c79453161bdc06cc"
+      "sha256": "c6f215e585c88da159cd6b1c939c46b1a1e7e873c908fb26c4a82c99fcfcfaf9"
     },
     {
       "path": "modules/lifecycle/routes/tasks.js",
@@ -7419,6 +7429,11 @@
       "mode": "0000644",
       "sha256": "a3d220d0b9fcac0413a51815e04940fef82ac31ca92be06da361d20a076ec757"
     },
+    {
+      "path": "modules/lifecycle/upkeep-home.js",
+      "mode": "0000644",
+      "sha256": "dd8c7315e94023de136173c7b4844b5dcc45e63661027fe486c8aa26fe4102d8"
+    },
     {
       "path": "modules/lifecycle/version-autoclose.js",
       "mode": "0000644",
@@ -9252,22 +9267,22 @@
     {
       "path": "modules/public-landing/public/projects-hall-live.states.json",
       "mode": "0000644",
-      "sha256": "20c5e614cffac0f2f8e6454c230bbc188e16e2364b431412313cfe58cd3332b2"
+      "sha256": "2dd5cd7e389dc1d536bf7e9980ce55a35b2e075cf7459ac14db7af7311b51bbc"
     },
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "d3c1e65e6ae86b97b9ff6705520016e122ef48101d0fd0907730e90df3b3ce57"
+      "sha256": "de3345dd157fe180f0b5cf8ed36d448f2241620d30ec349ec0d3ff988f2ba8c1"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
       "mode": "0000644",
-      "sha256": "83eea7f0245ef4984332853e0e08e217062ba06733ac061d33280ab5a92c0e7a"
+      "sha256": "d6108920cff677ad0083e9ba2b90d3c1518c1b5702728cdad7599ed81bfcc59f"
     },
     {
       "path": "modules/public-landing/public/projects.states.json",
       "mode": "0000644",
-      "sha256": "7c31d8b005c8656f41b0fa7ab0e634ea96e73d6f550b554d6e5bd77406e5de3f"
+      "sha256": "8207f2b2bf17964224b93a2f354ce0fff24a84b323d8926b5a17a9eb9e0b13fb"
     },
     {
       "path": "modules/public-landing/public/terms.html",
@@ -10037,12 +10052,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0abde492bc94b4bafd14a5f402b76fb5e9063f66f5ec9a9a930b17edff3363e1"
+      "sha256": "4591ed6dbe49ed8fee3b4c4396cb0e7f8c68c29d16c0a997b385632e280babfb"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "152af0cc2be56f12652515999ee93e697cdd85749c2eb5c430e39d76eada090e"
+      "sha256": "006af57032fa462de11d39a10f9191f67952c0076da4012be4118c8e3054eff1"
     },
     {
       "path": "public-docs/index.html",
@@ -10062,7 +10077,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "62116e737a2e0bbf80e7d5f0f539f65be938c7823e3dc5b97ee3ae5d5f4f02df"
+      "sha256": "5ec4fc9611858f96ee5d3ce7486c56e141c7b590bd7b2174d589f1cc50c63cd2"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -10367,12 +10382,12 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "f2aa97cbecc191570a132ea93422226998708328aa755075bbca27924c5a4b75"
+      "sha256": "3dbededc4c7c82f844bc772ef10a9aefdf73bc3b1357db70177d164c7e2be87e"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
       "mode": "0000644",
-      "sha256": "afd825409590fa0c81cdc072bb925555e70bd543f819b8c68110760919ca67e1"
+      "sha256": "7659039447e370fe143327a8e55a730781d035fe6831e2af895288680ac5334f"
     },
     {
       "path": "scripts/gds/cleanup-orphans.js",
@@ -10382,7 +10397,7 @@
     {
       "path": "scripts/gds/cli-lib.js",
       "mode": "0000644",
-      "sha256": "2e83ab5c93b100c0bcce0079b4434fdc9cef6358e50e3c2d6be163bd4fd6e35b"
+      "sha256": "126c33b852a8c4ccec4cee04ac44131ffdbf50a732e62ba7912500b2f093cbbb"
     },
     {
       "path": "scripts/gds/client-baseurl-guard.js",
@@ -10562,7 +10577,7 @@
     {
       "path": "scripts/gds/feedback-send.js",
       "mode": "0000644",
-      "sha256": "3b043beaecc95b9e1019d8b56c5e1e16a279bfcf5904e8547db6ca620309390b"
+      "sha256": "2ea43986744a893b0f44954926447a4c817fae8af8ef4956d149b31ea51e96c2"
     },
     {
       "path": "scripts/gds/fetch-art-key.js",
@@ -11012,7 +11027,7 @@
     {
       "path": "scripts/gds/paste-token.js",
       "mode": "0000644",
-      "sha256": "9c3fd12318b04062382d8f1309d2da64de7436c93ff7bb25d2b1f5ac5cec7795"
+      "sha256": "64a194fa0a8c6ca9fdea097dde5754b80d1a571f21ffc4b4674bf5e1fd0ccc1c"
     },
     {
       "path": "scripts/gds/plain-cards.js",
@@ -11072,7 +11087,7 @@
     {
       "path": "scripts/gds/provision-net.js",
       "mode": "0000644",
-      "sha256": "cc3bd9146e6f513239f564df67fe3dd0a4b50e7889a759c7528c9a4d34e64ce4"
+      "sha256": "a1d28d4913dc830089f8a1ff8884e16e8df19395148593f31851dda1275c342d"
     },
     {
       "path": "scripts/gds/provision-pin-key.js",
@@ -11112,7 +11127,7 @@
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "87e88c2f2f2aedad871b5d56d7d1528d9ee89fa568f0386eaa170843146db040"
+      "sha256": "eb6cf09ce1eb97330b20fe97c61068e2b7cc8bb4556a54df39e3a3978fe6ffa2"
     },
     {
       "path": "scripts/gds/provision.js",
@@ -11162,7 +11177,7 @@
     {
       "path": "scripts/gds/reauth.js",
       "mode": "0000644",
-      "sha256": "b0f4472572b0b24f851625515a806ce56ba0418383eaaed4c6862e44b580ddc5"
+      "sha256": "7f321798f02c94c5e55c0105d81d9236d32f9369304ead210c69bb6d09161659"
     },
     {
       "path": "scripts/gds/recall.js",
@@ -11267,7 +11282,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "bd2c9b3fc469feda913bc58db6106b6bcc2c59bfacfc90fe23cb89c076ac1762"
+      "sha256": "22dfb39178515162ef7c4f9be943d5b4f520925e8f401a2e38394d363f503173"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -11497,7 +11512,7 @@
     {
       "path": "scripts/gds/setup.js",
       "mode": "0000644",
-      "sha256": "156e63c837a5b3bd57ac3f76c4770ef73ad469d27a6f03f8b8a617b57f4020d0"
+      "sha256": "7162c8825eec04e1b6bd67543a9b05b8712f020c9a410f42a01f11f7a48bf14b"
     },
     {
       "path": "scripts/gds/ship-check.js",
@@ -11667,7 +11682,7 @@
     {
       "path": "scripts/gds/start.js",
       "mode": "0000644",
-      "sha256": "0b1c0879a4eff9afaf59db8a2c3847f49a402985eb910d0b8b358e350c073d49"
+      "sha256": "4bc438bb7859c7a405088b2e386b33fb550532a71dbe66866d711e5b1d4b3e69"
     },
     {
       "path": "scripts/gds/status.js",
@@ -11692,12 +11707,12 @@
     {
       "path": "scripts/gds/surface.js",
       "mode": "0000644",
-      "sha256": "cc730dc2d59f5d6f06bad92e9c2b69cb7835142deefd31a8dfdd58b300c38e30"
+      "sha256": "760bc60415690ac645b8636370485ae48146b751c490c0fb2fb524d8f82a9ade"
     },
     {
       "path": "scripts/gds/task.js",
       "mode": "0000644",
-      "sha256": "9dd3cdc4c6cf793d219cc7de63da8ecc476425e899abe3728d89f382b827d72e"
+      "sha256": "8541bd54d0edc94e77f48f3b822009da79c314cbc82f6082ada0a48580f62857"
     },
     {
       "path": "scripts/gds/test-path-guard.js",
@@ -11754,6 +11769,11 @@
       "mode": "0000644",
       "sha256": "f13cdc8f5f55b76a28230b1d20ed5116159106ea66dcce8db1dcb37302a41fa7"
     },
+    {
+      "path": "scripts/gds/upgrade-operator.js",
+      "mode": "0000644",
+      "sha256": "d33bedf44e0e95a200a086fd67e2309319897a44bbfd9e74725c47adf001edc3"
+    },
     {
       "path": "scripts/gds/upgrade-outcome.js",
       "mode": "0000644",
@@ -11762,7 +11782,7 @@
     {
       "path": "scripts/gds/upgrade.js",
       "mode": "0000644",
-      "sha256": "5197985fef3098ca0f5ba49e84a3585815bfd24e33c889cc4708c76ef1bc1a64"
+      "sha256": "63d9c0b08d061fb4b5282fcad15c15317daed7fd0ece6ad33510893608137ac0"
     },
     {
       "path": "scripts/gds/validate-design.js",
@@ -11827,7 +11847,7 @@
     {
       "path": "scripts/hall-preview/server.js",
       "mode": "0000644",
-      "sha256": "0b9efd2f55ab012632b20be67821d97edd36b7f79703ba6ab481eaba1b4d2a72"
+      "sha256": "73f90a45a8dbe04de03bdca1ad42f61c6dfe6e75982c3df8f311c8f1fa9eeed9"
     },
     {
       "path": "scripts/hall-preview/task-visual.js",
@@ -12167,12 +12187,12 @@
     {
       "path": "src/bongos/routes/core-update.js",
       "mode": "0000644",
-      "sha256": "cc6bb5e7a69278083d834af70c1963c1d535bf1dc9321b543e3440609cd24502"
+      "sha256": "ff6b84a1453cf6fc58792f49d35f39ca79f77d96a39be8219c5a570e12f4e5c8"
     },
     {
       "path": "src/bongos/routes/feedback.js",
       "mode": "0000644",
-      "sha256": "6307d32f0739bd5107d8259b0b9f316da8e875257975d8465559db8f7d232167"
+      "sha256": "4d050c4d37596b87a67727a4f38997d57170045dbf4a6ac769b91978aff4874b"
     },
     {
       "path": "src/bongos/routes/github.js",
@@ -12254,6 +12274,11 @@
       "mode": "0000644",
       "sha256": "e19bb5a7bb437ba3a589100bf7f88b0c0c5cc805347aec9f5e91221a0af2fae8"
     },
+    {
+      "path": "src/bongos/upgrade-request.js",
+      "mode": "0000644",
+      "sha256": "afa7ce2a38cc86bcf934902f65913fd03af58942da2d0777569fe71319900e63"
+    },
     {
       "path": "src/bongos/uptime-poller.js",
       "mode": "0000644",
@@ -12282,7 +12307,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c297a4a84c33a4b846abd7707f0b10a813ca418841c2455dba9a453c283c9752"
+      "sha256": "dae9d029b948f5846186132752104cc22da907bc8ab073228b6364da12dc88a5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13062,7 +13087,7 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "52e361bfe57ec4e8719df50275a02e3b2b6238d1da477d70f003926c0b102a22"
+      "sha256": "bf30601c49fb27cc0b230e6f48e4ed75af68c9cb6b8e8b5f7e13b38eb0241eec"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",
@@ -13072,7 +13097,7 @@
     {
       "path": "tests/cli_allowlist_permissions.mjs",
       "mode": "0000644",
-      "sha256": "1d490fb23fce3d6c39322dcef6cfceb8ac2a767c12deb842174b8d9e675561d2"
+      "sha256": "ce1d4031bf29064a8522440116e4da5dde78ffd59eb0c396b5d32a72790a260a"
     },
     {
       "path": "tests/cli_dispatcher.mjs",
@@ -13102,7 +13127,7 @@
     {
       "path": "tests/cli_surface.mjs",
       "mode": "0000644",
-      "sha256": "90427212f57df834e9e64e6423d38f2b2878eb8bea16c3874b3e30159db1ebd9"
+      "sha256": "434290c02b2b9604fdc475f3efcf7e43da0e42c6e01d62adfb7dc660f9191bb2"
     },
     {
       "path": "tests/cli_token_reissue.mjs",
@@ -13812,7 +13837,7 @@
     {
       "path": "tests/fixtures/page-ledger.mjs",
       "mode": "0000644",
-      "sha256": "334af36c6207995d2fa55023ba43c47cd00d41f09cfbb6a86416b4f785e85a5b"
+      "sha256": "b36096f0bc3f6ea645c5e29e8bc1c769d7fb78fa8cd6d4985ab573a5a3cb0e88"
     },
     {
       "path": "tests/fixtures/session-506-digest.json",
@@ -13947,7 +13972,7 @@
     {
       "path": "tests/goal_admission_override.mjs",
       "mode": "0000644",
-      "sha256": "94b378fb96bbbb6285b61c4d00827f57e0b29d64d9036576670ffaf8ca233239"
+      "sha256": "ae11c905bbe35a479345c2cbfe3c23403a914852ef9593cf7c6b7d6c13fb19c2"
     },
     {
       "path": "tests/goal_advisory.mjs",
@@ -13972,7 +13997,7 @@
     {
       "path": "tests/goal_category.mjs",
       "mode": "0000644",
-      "sha256": "0f21ed0244ece6c1ccf38f34cc3602370360e4cfde90227b1293238f5bf76a52"
+      "sha256": "ec1fa1767742b32f4ab85b29aebd95c32bb8dd3179491fc5d7e747316a125ae0"
     },
     {
       "path": "tests/goal_category_ui.mjs",
@@ -13999,6 +14024,11 @@
       "mode": "0000644",
       "sha256": "1052d7e73806b97a41324d5c2cd2ffc298db5d00df5a274ac3ae596e27b82948"
     },
+    {
+      "path": "tests/goal_create_spec_entry.mjs",
+      "mode": "0000644",
+      "sha256": "c7f798aeacdf2cc11667a8500f8a7dd3fd29e6acde1a118a8644ffd36445446e"
+    },
     {
       "path": "tests/goal_create_version_gate.mjs",
       "mode": "0000644",
@@ -14089,6 +14119,16 @@
       "mode": "0000644",
       "sha256": "cab3b1a34a3f5a5d6d5868f8bbdc88e98159ae3104e520e3a7bf6308682c1b99"
     },
+    {
+      "path": "tests/goal_spec_task.mjs",
+      "mode": "0000644",
+      "sha256": "cc7b900fa280079ec14f077c551181e882d7ff85367e3ca2048ff06c899398ab"
+    },
+    {
+      "path": "tests/goal_spec_task_db.mjs",
+      "mode": "0000644",
+      "sha256": "eae74c47b73bb154a299b55d007584830ae2df985fe80b1374060e32eacacf20"
+    },
     {
       "path": "tests/goal_subtitle.mjs",
       "mode": "0000644",
@@ -16199,6 +16239,11 @@
       "mode": "0000644",
       "sha256": "3442d3960b8671e07b0f00d85a31e6a9a5dd0ed316c23466e3e564cedbce9257"
     },
+    {
+      "path": "tests/projects_hub_cloud_hop.mjs",
+      "mode": "0000644",
+      "sha256": "49cbdb95edf1eec175771d906901dfcc95e8d5dea45af9a74465a9068686a96f"
+    },
     {
       "path": "tests/projects_hub_dns_ready.mjs",
       "mode": "0000644",
@@ -16307,7 +16352,7 @@
     {
       "path": "tests/provision_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "cb09dca84c1a8c369e0770de4661aa84cbdf34fd3361b6fb6aa84b336ba89245"
+      "sha256": "9af0bd0f6fe2ba90e338d41bbf45811f797a91584c2bf8e438c9c86217bb090a"
     },
     {
       "path": "tests/provision_teardown_address.mjs",
@@ -17287,7 +17332,7 @@
     {
       "path": "tests/software_update.mjs",
       "mode": "0000644",
-      "sha256": "d04938f036226db103ad4a503286df3a635ade3eee317e81012378c22a7ba7c4"
+      "sha256": "0f3b40a9560dc3f8ae7ee84e517316a4b4dce9de47554e443f804942a18909a6"
     },
     {
       "path": "tests/sound_player.mjs",
@@ -17377,7 +17422,7 @@
     {
       "path": "tests/start_env_guard.mjs",
       "mode": "0000644",
-      "sha256": "3658e5abc57103ed9de214b79ddeac10367d780a99690e28f27627014315e15c"
+      "sha256": "39e62a5fc50113e719cdaacf15e6fd054f38f8703fc64137eddee7901b374f16"
     },
     {
       "path": "tests/start_inbox_count.mjs",
@@ -17724,6 +17769,11 @@
       "mode": "0000644",
       "sha256": "47048521bb37c9debc02ef5c366bfe863450eb944023cce60ba182b9640563ee"
     },
+    {
+      "path": "tests/upgrade_operator.mjs",
+      "mode": "0000644",
+      "sha256": "2f3f1a733e18be81f62f4c19bc0d74620a4b5ee7ffaebae918f44ecd88085a04"
+    },
     {
       "path": "tests/upgrade_outcome.mjs",
       "mode": "0000644",
@@ -17734,6 +17784,16 @@
       "mode": "0000644",
       "sha256": "4bfb30a2f868fbbc67b3ccc294626861069b2b74607b44aea098883b2072b552"
     },
+    {
+      "path": "tests/upgrade_request.mjs",
+      "mode": "0000644",
+      "sha256": "5ff095b7fba7e04ee1fee01ee3096a627b80f2100d0fcae94314efcf3928c4cb"
+    },
+    {
+      "path": "tests/upkeep_home.mjs",
+      "mode": "0000644",
+      "sha256": "a8bafbe939e93b53c9033f4f9de7ed0bcf8c07c26710ba8f50da9a770b25bb2c"
+    },
     {
       "path": "tests/verify_task_guard.mjs",
       "mode": "0000644",

package/.claude/skills/goal-create/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: goal-create
 description: >-
-  Plan and create ONE goal (the module-scoped workspace between a version and its criteria) with its done-when criteria and seed tasks. Metic+. Triggers: "/goal-create", "create a goal", "what goal should this live in", a task created with no goal.
+  Plan and create ONE goal (a module-scoped workspace) with its criteria and seed tasks, or spec one made in the hall. Metic+. Triggers: "/goal-create", "create a goal", "what goal should this live in", "spec goal N", a task created with no goal.
 plain: >-
   Helps you set up a new goal: what it is for, how you will know it is done, and the first tasks to get there.
 reach-for: >-
@@ -89,8 +89,10 @@ The order is forced: a criterion needs `goal_id`, a task needs both `goal_id` an
 > **Always `--body-file`, never inline `--body`, for anything carrying a title, description or criterion prose.** Those strings are authored in this session and routinely contain an apostrophe ("the builder's hall"), which terminates a single-quoted shell argument and corrupts the JSON — or, with a hostile string, runs whatever follows on the builder's machine. Write the body to a temp `.json` file and pass its path. On Windows also heed `scripts/gds/CLAUDE.md`: do **not** create that file with `Out-File`/`>` (the UTF-8 BOM breaks `JSON.parse`), and never pipe `api.js` through `2>&1` (its banner goes to stderr by design).
 
 ```
-# 5a — the goal. STRICT validation: exactly these seven fields are accepted
-#      (version_id*, title*, subtitle, description, scope_modules[], succeeds_goal_id, category_id).
+# 5a — the goal. STRICT validation: exactly these fields are accepted
+#      (version_id*, title*, subtitle, description, scope_modules[], succeeds_goal_id, category_id,
+#      plus admit_reason — Archon only — and spec_task, which ONLY the hall form sends: it makes
+#      the goal arrive with a "Spec goal N" task, the job this skill does inline. Never send it here).
 #      ANY other key is a 400 unknown_field — do NOT pass criteria, tasks, lead or visibility.
 #   goal.json: {"version_id":"<ver>","title":"...","description":"...","scope_modules":["<key>"],"category_id":<id>}
 #   category_id comes from GET /api/bongos/work-categories (task 1003277); omitting it is
@@ -159,6 +161,22 @@ Run the phases above **with the orphan task as the seed** — its title, descrip
 
 **A goal-less task is not an error and was never blocked.** `goal_advisory` is advice on a request that already succeeded. Never fail a build, refuse work, or badger the builder over it — if they say "later", file the idea and move on.
 
+## Finishing a hall-made goal's spec task (task 1004586, ADR 0366 D3)
+
+A goal created from the hall's form has only a name, a description, a version and a category. It arrives with one task inside it, **"Spec goal N: its scope, criteria and first tasks"** (`source: goal-spec`, `source_ref: goal-<N>-spec`), and every other task in that goal waits on it: the server gives each one a dependency on the spec task, so nothing in the goal can be claimed until the spec ships. This skill is how that task gets done. Invoke it with the goal id ("spec goal 1000123") or from the claimed spec task.
+
+1. **Claim the spec task** (`/builder-claim <id>`) if it is not already yours. Find it with `GET "/api/bongos/tasks?goal_id=<N>"` — the row whose `source_ref` is `goal-<N>-spec`.
+2. **Phase 1, with the goal fixed.** Read the goal (`GET /api/bongos/goals/<N>`), its version's other open goals and criteria, and the live module roster exactly as above. The goal's name and description are the person's statement of intent: they are your evidence, as an orphan task's text is in the orphan hook.
+3. **Phase 2 becomes a duplicate check.** Do not create a goal. If another open goal already owns this outcome, raise it in the grey-area round (archive one, or move the work) rather than speccing a duplicate.
+4. **Phase 3 drafts what the form could not ask:** `scope_modules` (inferred and verified exactly as above, never ticked from a list), 2–4 criteria, and the seed tasks with their dependencies. Do not re-draft the name or description; suggest an edit in the grey-area round if one is wrong.
+5. **Phase 4 is unchanged:** at most one grey-area round, then one approval round.
+6. **Phase 5 writes onto the EXISTING goal**, in this order:
+   - **Scope:** `POST /api/bongos/goals/<N>/scope --body '{"add":["<key>"]}'` (keys only, safe inline). The goal's owner or a manager; an Archon for a protected key.
+   - **Criteria:** `POST /api/bongos/versions/<ver>/done-when` with `"goal_id":<N>`, exactly as 5b.
+   - **Seed tasks:** `POST /api/bongos/tasks` with `"goal_id":<N>`, exactly as 5c. **Each one is automatically made to wait on the spec task** — do not remove that edge, and **do not promote them**: they move to `ready` by themselves the moment the spec task ships (the ordinary auto-promotion). Add their own dependency edges (5d) as usual.
+   - **Then ship the spec task** with `/builder-ship`. That ship is what releases the goal's work. Its value summary says what the goal now owns and which tasks became claimable.
+7. **If you do not own or manage the goal,** the scope and criteria writes are refused (403 / `400 bad_goal_id`, see above). Do not work around it: send the drafted scope, criteria and task table to the goal's owner (`/ask-for-help` naming them, or paste it on the spec task), file the seed tasks you are allowed to file, and leave the spec task claimed until the owner has written the rest. A spec task shipped with no scope and no criteria releases a goal that is still undefined, which is the state this task exists to prevent.
+
 ## The sibling advisory: `dependency_advisory` (task 1002827)
 
 The same `POST /tasks` response can also carry a non-null **`dependency_advisory`** — a *different* check, unrelated to which goal the task landed in: it names OPEN tasks in the same version whose `touches[]` overlap this one's, with no declared dependency between them (`scripts/gds/audit-deps.js`'s detector, run live for the first time).

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 522 operations across 75 resource groups
+- 523 operations across 75 resource groups
 
 ## Use it from your project