@bongos/core 1.21.73 → 1.21.74

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.73",
-  "core_contract": "1.21.73",
-  "source_commit": "97aef7c88669d46fe182a6492680920e2acb9d22",
+  "core_version": "1.21.74",
+  "core_contract": "1.21.74",
+  "source_commit": "e1a614cc89edf2e1f13bf098fe70e5d6909887f9",
   "source_ref": "HEAD",
-  "built_at": "2026-10-08T15:46:54.586Z",
+  "built_at": "2026-10-08T17:20:42.399Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 588,
+    "docs_redacted": 589,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 2978,
+    "functional_verbatim": 2980,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3595,
-  "tree_sha256": "9783a74d8668b8d747aa247f6a1a137816676d1ba262bca760d2ffedca9aed37",
+  "file_count": 3598,
+  "tree_sha256": "a36fc59cee5bf88f0f473a9967f3a2a30e9ab3d59e59ef3d5b91df49789fc855",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -307,17 +307,17 @@
     {
       "path": "bin/bongos.js",
       "mode": "0000755",
-      "sha256": "7caac78124c7c13464f7f40d0d994cace8651de872a87cbb07deff24413e13cd"
+      "sha256": "20794ff2c632668d2a65ab1ca1a0e6d5b240c19769dbabf6999c7347d41f54e6"
     },
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "a7328558d0724745cabe93f27b6a322da00877dbeeb432e6e4b8a0d01046c886"
+      "sha256": "92ec02892192cb3ec336b8feb68516981334c6c5e9951d6983855296b6d79dfc"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "04976427be615436fb945535304723b1f8238850477c1ae9014170029e1c9458"
+      "sha256": "16b666c57928d55b8c5b8b96f90e77e3d1702ea2b601d43a118853ae7d6f5f10"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -327,17 +327,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "f04ec9816574187ddb9abd02e04cabeba674aef3e5f662954d996cbddb3737a2"
+      "sha256": "cac495a3acbe96e8036f79dd772cce00372bac4c3a162c7a050d572cabccb464"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "4b9c887d6326a7c2bdb9277a668762c809a56901fe9c3647367426c8959ef3ff"
+      "sha256": "4ecbd807e9ddbd35f4c076b6daa559fa4a6eeaab80e3f03065d61e4ca139f6dd"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "8d44ac1885a1fa52bdecb21fb7b26fa34744b6a37a9de69f385a98955ed76453"
+      "sha256": "6217699f613e7839e12aee3465717863397243daf741c022d43a704993c9023d"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2299,20 +2299,25 @@
       "mode": "0000644",
       "sha256": "9269694c53caf6a7d00ab86908503ff2719bc6cb35e7305ab6993668fe7f2234"
     },
+    {
+      "path": "docs/adr/0369-ship-mode-decides-who-starts-a-ship-not-how-it-lands.md",
+      "mode": "0000644",
+      "sha256": "10d2509453f6ab9c511adb9ca2e01927fdfbcb5d854830c66774cd07bc340a7c"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "e2cd858f72e99fbf010904983a8e2e54e8104cda8e623b451834036bd231bba4"
+      "sha256": "84f7c062a62513d4e241b76d537708460e95da9a9caadc9c9f406632af828050"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "4434a7877238251b38f5b5a2112d5ea7a3cc0d3dce871a50f8d2f2e37fc34503"
+      "sha256": "7ee0c370728c049634024bb204f60667a3a975f7d42dc0a714d14a1feb24f7f5"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "7d3a5a8ca2f543ed69d8c7e39a50e05ef6d534510cde3e8db58ab68561a99922"
+      "sha256": "3e3bcaac1dbdd052ad5e7c44ec77bf057faf71c76202bb6d43bd7852b0b1999a"
     },
     {
       "path": "docs/architecture.md",
@@ -2337,12 +2342,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "817c7944da1f2607edc9deb30e7d600362806c99c056fc6fe5635174d44694a1"
+      "sha256": "6b9b8e7d611dd3a8785b752670304ce584bba798f45c905e76b220900bf88664"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "36b64a5d0fe9c508a7bbe8574f368071d44fda9d5cb7779264b651431b2699b5"
+      "sha256": "259281afa0ea0362844df697c796adab5287a13caee6aa8e87c3a99850992d61"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2852,7 +2857,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1bbd3deafbd05dffdbddd7286279c4302c196c364eb634a79bfba6595b249126"
+      "sha256": "6028080759e4c92a71ed09f4bbe67d8bfae0152377c4f3a635d02841b29fa2c7"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2942,7 +2947,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "41e7fd8617a89f2415c753fa74e5efd050dd2b623562b17e3b4819b0fc63c1db"
+      "sha256": "3850e40624d9840ed56e9572fe99210c0f864d6a176abb99b45244cd4a89b195"
     },
     {
       "path": "docs/project-context.template.md",
@@ -6017,17 +6022,17 @@
     {
       "path": "modules/hall-ui/public/project-settings.css",
       "mode": "0000644",
-      "sha256": "bc2d2bcf19334eff2232e716ca9c7961dbe84502a935238d4808dabd1d9e8454"
+      "sha256": "d554081a9d5d8c702a00e3f305b9927a3e9b72c1c34757876e874f0ab6ed61f4"
     },
     {
       "path": "modules/hall-ui/public/project-settings.html",
       "mode": "0000644",
-      "sha256": "adb9e4c570c87c0f43cb94cea06debf5f904a1be4af95550cc04b1d4924019de"
+      "sha256": "5e83d5bc721a92f2dc9d9382bbdcccc759d6d3dbbedfbba9eafbf447bc6e1561"
     },
     {
       "path": "modules/hall-ui/public/project-settings.js",
       "mode": "0000644",
-      "sha256": "6b814a44f884b4ae4fca13336cf9caf83da8c21a2317ea09b24d02f514cfb6fa"
+      "sha256": "960cf27bc5c9a45f7d1c321755935264957d86dac4f51cb4729c2770ae3b65f0"
     },
     {
       "path": "modules/hall-ui/public/ranks-founding.states.json",
@@ -7317,7 +7322,7 @@
     {
       "path": "modules/lifecycle/routes/project-settings.js",
       "mode": "0000644",
-      "sha256": "d9ea6b9a8f2290c8618ced3da55547a07f86f02cdaba04e7ec6dd5c4a81b8616"
+      "sha256": "069f431d53ff1219d15e81dbf6c6a0e58413b97ba0b116f6113f6e41755b2aca"
     },
     {
       "path": "modules/lifecycle/routes/recommendations.js",
@@ -10052,12 +10057,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "429d576b432d580dabb9b4a4407769f5afc4e36bbc7ef3085eb814ab0c6b1741"
+      "sha256": "ebda74c3eebe46d4e8a441c4b63a195fc9d6aa911edfffdca7d9a5189ce29014"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "eb49995d04dde9da8c6cee824dad63a7155dfc5ab5a4dd45c4d82e44f2e998d7"
+      "sha256": "5c6a09991c3531cf64543c466ed124dc5f19825906c42e176c00e5cdae44c0d5"
     },
     {
       "path": "public-docs/index.html",
@@ -10077,7 +10082,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "eefd427bd7affa45d55914a748ff5f4849ad51f19570525f6a08a392086f01b7"
+      "sha256": "b64964b1e7abbaa7a3f508f4ae02c06928e4e59d61adf1c6402584a6e681e710"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11624,6 +11629,11 @@
       "mode": "0000644",
       "sha256": "96bda284d66eb2428bbd05d359143fb6090fe6ce51bc2deca0a47590a8f392ca"
     },
+    {
+      "path": "scripts/gds/shipping-mode.js",
+      "mode": "0000644",
+      "sha256": "64870b1536fe874a9866b49a51bc47f9c5074ad364e5af0dcce4594e1269de75"
+    },
     {
       "path": "scripts/gds/skill-lint.js",
       "mode": "0000644",
@@ -12127,7 +12137,7 @@
     {
       "path": "src/bongos/project-settings.js",
       "mode": "0000644",
-      "sha256": "314c81c0837fcb79c15bb9e2761f902e7216c0411582c006123cc9014d883f16"
+      "sha256": "9fed7bf82adcac7c19b4b1849987c273d4dc995598cfb8f1760367858786d009"
     },
     {
       "path": "src/bongos/repo-info.js",
@@ -12307,7 +12317,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "42a520e6a12c2086cb86b4cb39a3bcbaa5ad47f5008a86f850df269b78d980be"
+      "sha256": "f0769084872b98cacd871ea7e0b062dd1fcaad8c759e38acad6393f94084b418"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16202,7 +16212,7 @@
     {
       "path": "tests/project_settings_page.mjs",
       "mode": "0000644",
-      "sha256": "7fbee4c75fe95ba9c49ace4b492c2fb0a8a6c964da6ce84251e7daa27b974611"
+      "sha256": "e6b41d59daccc5516b97164ad311fe0b69feecbefed0ca7237c2a7d2229801ec"
     },
     {
       "path": "tests/project_stats.mjs",
@@ -17169,6 +17179,11 @@
       "mode": "0000644",
       "sha256": "28ad67a5ee8be6807f8d16149ea42cb837b7bc4e4084068b74d8e944db09d291"
     },
+    {
+      "path": "tests/ship_mode.mjs",
+      "mode": "0000644",
+      "sha256": "b545f8efbf7ae42b5db2b22e275fac2de65a268e46331bd018b515c69b274f25"
+    },
     {
       "path": "tests/ship_post_land_verify.mjs",
       "mode": "0000644",

package/bin/bongos.js

@@ -78,6 +78,7 @@ const VERBS = {
   claim:   { script: 'claim.js',   group: 'work', summary: 'Claim a task by id  (bongos claim 1246)' },
   ship:    { script: 'ship.js',    group: 'work', summary: 'Grade, merge, and deploy your claimed task' },
   release: { script: 'release.js', group: 'work', summary: 'Cancel a claim — task returns to ready (no credits)' },
+  'ship-mode': { script: 'shipping-mode.js', group: 'work', summary: 'Show or set who starts a ship  (bongos ship-mode auto|manual)' },
   status:  { script: 'status.js',  group: 'work', summary: 'Version / criterion progress  (bongos status C8)', selfHelp: true },
   recall:  { script: 'recall.js',  group: 'work', summary: 'Search the docs + project knowledge  (bongos recall "x")' },
   cost:    { script: 'cost.js',    group: 'work', summary: 'Log a cost entry' },

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 523 operations across 75 resource groups
+- 525 operations across 75 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -855,6 +855,10 @@ function createClient(opts = {}) {
       getProjectSettings: (args) => request("GET", "/project-settings", { hasBody: false }, args),
       // PATCH /project-settings/rot-days — rank: metic+archon — PATCH /project-settings/rot-days
       patchProjectSettingsRotDays: (args) => request("PATCH", "/project-settings/rot-days", { hasBody: true }, args),
+      // GET /project-settings/ship-mode — rank: any-builder — GET /project-settings/ship-mode
+      getProjectSettingsShipMode: (args) => request("GET", "/project-settings/ship-mode", { hasBody: false }, args),
+      // PATCH /project-settings/ship-mode — rank: metic+archon — PATCH /project-settings/ship-mode
+      patchProjectSettingsShipMode: (args) => request("PATCH", "/project-settings/ship-mode", { hasBody: true }, args),
     },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects

package/clients/bongos-client/index.cjs

@@ -854,6 +854,10 @@ function createClient(opts = {}) {
       getProjectSettings: (args) => request("GET", "/project-settings", { hasBody: false }, args),
       // PATCH /project-settings/rot-days — rank: metic+archon — PATCH /project-settings/rot-days
       patchProjectSettingsRotDays: (args) => request("PATCH", "/project-settings/rot-days", { hasBody: true }, args),
+      // GET /project-settings/ship-mode — rank: any-builder — GET /project-settings/ship-mode
+      getProjectSettingsShipMode: (args) => request("GET", "/project-settings/ship-mode", { hasBody: false }, args),
+      // PATCH /project-settings/ship-mode — rank: metic+archon — PATCH /project-settings/ship-mode
+      patchProjectSettingsShipMode: (args) => request("PATCH", "/project-settings/ship-mode", { hasBody: true }, args),
     },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects

package/clients/bongos-client/index.d.ts

@@ -126,6 +126,7 @@ export interface GetPageNotesResponse { page_id: unknown; notes: unknown }
 export interface GetProfilesHandleResponse { account: unknown; cross_project: unknown }
 export interface GetProjectManageLinkResponse { ok: boolean; link: unknown }
 export interface GetProjectSettingsResponse { rows: unknown }
+export interface GetProjectSettingsShipModeResponse { mode: unknown; chosen: unknown; source: unknown; sentence: unknown; choices: unknown }
 export interface GetProjectsFeaturedResponse { projects: unknown; page: PageInfo }
 export interface GetProjectsResponse { projects: unknown }
 export interface GetProvisioningFleetResponse { instances: unknown; capacity: unknown }
@@ -233,6 +234,8 @@ export interface PatchPageNotesIdRequest { body_md: string }
 export interface PatchPageNotesIdResponse { ok: boolean; updated_at: unknown }
 export interface PatchProjectSettingsRotDaysRequest { days: number }
 export interface PatchProjectSettingsRotDaysResponse { ok: boolean; rot_days: unknown; source: unknown; describe: unknown }
+export interface PatchProjectSettingsShipModeRequest { mode: string }
+export interface PatchProjectSettingsShipModeResponse { ok: boolean; mode: unknown; chosen: unknown; source: unknown; sentence: unknown }
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
 export interface PatchProjectsIdStatusRequest { status: string }
@@ -1352,6 +1355,10 @@ export interface BongosClient {
     getProjectSettings(args?: RequestArgs): Promise<GetProjectSettingsResponse>;
     /** PATCH /project-settings/rot-days — rank: metic+archon */
     patchProjectSettingsRotDays(args: RequestArgs & { body: PatchProjectSettingsRotDaysRequest }): Promise<PatchProjectSettingsRotDaysResponse>;
+    /** GET /project-settings/ship-mode — rank: any-builder */
+    getProjectSettingsShipMode(args?: RequestArgs): Promise<GetProjectSettingsShipModeResponse>;
+    /** PATCH /project-settings/ship-mode — rank: metic+archon */
+    patchProjectSettingsShipMode(args: RequestArgs & { body: PatchProjectSettingsShipModeRequest }): Promise<PatchProjectSettingsShipModeResponse>;
   };
   "projects": {
     /** GET /projects — rank: metic+archon */

package/clients/bongos-client/index.mjs

@@ -851,6 +851,10 @@ export function createClient(opts = {}) {
       getProjectSettings: (args) => request("GET", "/project-settings", { hasBody: false }, args),
       // PATCH /project-settings/rot-days — rank: metic+archon — PATCH /project-settings/rot-days
       patchProjectSettingsRotDays: (args) => request("PATCH", "/project-settings/rot-days", { hasBody: true }, args),
+      // GET /project-settings/ship-mode — rank: any-builder — GET /project-settings/ship-mode
+      getProjectSettingsShipMode: (args) => request("GET", "/project-settings/ship-mode", { hasBody: false }, args),
+      // PATCH /project-settings/ship-mode — rank: metic+archon — PATCH /project-settings/ship-mode
+      patchProjectSettingsShipMode: (args) => request("PATCH", "/project-settings/ship-mode", { hasBody: true }, args),
     },
     "projects": {
       // GET /projects — rank: metic+archon — GET /projects

package/docs/adr/0369-ship-mode-decides-who-starts-a-ship-not-how-it-lands.md

@@ -0,0 +1,44 @@
+# ADR 0369 — Ship mode decides who starts a ship, not how it lands
+
+- **Status:** accepted
+- **Date:** 2026-10-08
+- **Task:** [task 1004628](https://cloudbongos.com/builders#/task/1004628) (goal 1000106, BONGOS-V2)
+- **Builds on:** [ADR 0226](0226-one-stale-timer-reporting-degrades-enforcement-refuses.md) (a live knob lives in `project_settings` and is read through one resolver that reports where its value came from)
+- **Decided with:** the owner, 2026-10-08, after using Bongos on their own project. New projects default to Auto. The owner picks it when creating a project and can change it later.
+
+## Context
+
+Shipping at the start of a project was the owner's worst experience. The AI finished a task, then handed back terminal commands (`cd …`, `npx bongos ship 49`) and said it was not allowed to ship. To someone new, a project that answers every finished task with commands to copy reads as broken.
+
+Bongos had no setting for this. The nearest switch was the **deploy mode** in `config/deploy.json` (`ci` or `laptop`, resolved in `scripts/gds/ship-deploy-target.js`). That switch decides the mechanics of landing once a ship has started: a pull request with auto-merge, or a direct merge. It is committed config and nobody can change it from a page.
+
+## Decision
+
+**D1 — A new project setting, `ship.mode`, with two values.**
+- `auto`: when the AI finishes a task it ships and lands it, with no commands from the person.
+- `manual`: the AI stops before shipping, and a person approves each ship.
+
+It lives in `project_settings` (migration `core_231`), so it needs no migration. It is read through `resolveShipMode()` in `src/bongos/project-settings.js`, which follows the rot timer's pattern: a value plus its source, and an unusable stored value is reported rather than thrown.
+
+**D2 — Auto is the default.** A project nobody has configured ships automatically. The resolver also reports `chosen`, because "never chosen" and "chose Auto" are different answers. The first-ship prompt (task 1004630) asks only when nobody has chosen.
+
+**D3 — Ship mode and deploy mode are separate settings.** Ship mode answers *who presses go*. Deploy mode answers *how the land happens*. Either combination is valid, and neither setting reads the other. Merging them would make a person's choice about being asked rewrite the committed landing mechanics of a repository.
+
+**D4 — Everyone can read it, only settings managers can write it.**
+- `GET /project-settings/ship-mode` is open to any signed-in builder, because every AI session has to know whether to ship on its own.
+- `PATCH /project-settings/ship-mode` needs `project.settings.manage`, the same permission as the page's other settings.
+- The mode is also on the project settings page, and `bongos ship-mode [auto|manual]` reads or sets it from a terminal.
+
+## Consequences
+
+- This task adds the setting only. Behaviour follows in the dependent tasks:
+  - the creation wizard asks for it (task 1004629);
+  - the first ship asks once if nobody has chosen (task 1004630);
+  - the AI obeys it (task 1004631).
+- A database read failure answers Auto rather than blocking a ship. That matches the setting's default, and blocking would be the worse outcome for a person mid-task.
+
+## Rejected
+
+- **Reusing deploy mode.** It answers a different question, and it is committed config that cannot be edited from a page.
+- **A per-builder setting.** The project owner decides how the project's work lands. One teammate's preference should not change that for everyone.
+- **Defaulting to Manual.** That keeps the exact experience the owner reported as the problem.

package/docs/adr/README.md

@@ -487,3 +487,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0366 | [**Hall planning is forms; a goal made there carries its own spec task, and the interviews stay in the CLI** ([task 1003461](https://cloudbongos.com/builders#/task/1003461), goal 1000089). Spike answer. **D1:** form-shaped, build in the hall: create a task under a goal, create a goal (name + subtitle, version, category, no scope field), attach a criterion to a goal you hold; every server refusal rendered as copy. **D2:** interview-shaped, deliberately absent from the hall: version planning, scope inference, drafting criteria and seed tasks, reuse-vs-create judgement, carry-forward. **D3 (owner):** a hall-made goal is created with a "Spec goal N" task (`POST /goals` `spec_task: true`, `source_ref goal-<id>-spec`) and every task in the goal depends on it until it ships; no new permission, no migration. **D4:** an optional "Plan with Claude" hand-off button.](0366-hall-planning-is-forms-and-a-goal-made-there-carries-its-own-spec-task.md) | lifecycle / planning |
 | 0367 | [**The Discord support bot answers from public docs only, under a monthly cap that fails closed** ([task 1002534](https://cloudbongos.com/builders#/task/1002534), goal 1000110). **D1:** one pinned channel, only when @-mentioned; the first gateway reply. **D2:** the corpus is an allowlist (`README.md`, `docs/onboarding/`, `docs/api-reference.md`) served by a new `memory.searchPublicDocs` port whose scope (doc, xenos, no owner, allowlisted ref) is fixed in SQL; the asker is never looked up. **D3:** no writes but the reply and one `audit_log` row per answer, which is also the spend ledger, so no migration. **D4:** a nonce-fenced prompt, no tools, mentions disabled. **D5:** `claude-haiku-4-5`, `DISCORD_SUPPORT_MONTHLY_CAP_USD` default $5, fail closed, with in-flight answers reserved at worst case. **D6:** off by default; its own switch and an env-only, namespaced key. **D7:** the channel's humans review wrong answers; the fix is the doc.](0367-the-support-bot-answers-from-public-docs-only.md) | discord / support / spend |
 | 0368 | [**Red and blue teams practise on a range, never on live** (goal 1000094 — *Working area 10, Security*; proposed). **D2:** the range is its own small server, rebuilt from the candidate the owner marks "stage for attack". **D3:** it shares no identity hub, secret or data with live. **D5:** red is AI plus Metic+, with one side at a time and a 30-day switch. **D6:** attacks run on subscriptions, never the metered API. **D7:** 3 runs on the newest model with 0 high+ breaks, advisory until an outside tenant exists. **D8:** points only, no credits yet. **D9:** three live signals to `#security-alerts`.](0368-red-and-blue-teams-practice-on-a-range-never-on-live.md) | security / red-team / range |
+| 0369 | [**Ship mode decides who starts a ship, not how it lands** ([task 1004628](https://cloudbongos.com/builders#/task/1004628), goal 1000106). **D1:** a `ship.mode` project setting, `auto` (the AI ships and lands a finished task with no commands) or `manual` (a person approves each ship), in `project_settings` with no migration. **D2:** Auto is the default, and the resolver reports whether anyone has chosen. **D3:** it is separate from deploy mode (`config/deploy.json`), which decides how a land happens. **D4:** any builder can read it (the AI must know), and `project.settings.manage` writes it, from the settings page or `bongos ship-mode`.](0369-ship-mode-decides-who-starts-a-ship-not-how-it-lands.md) | lifecycle / shipping / project settings |

package/docs/api/openapi.json

@@ -15658,6 +15658,94 @@
         ]
       }
     },
+    "/project-settings/ship-mode": {
+      "get": {
+        "operationId": "get_project_settings_ship_mode",
+        "tags": [
+          "project-settings"
+        ],
+        "summary": "GET /project-settings/ship-mode",
+        "description": "GET /project-settings/ship-mode — the ship mode alone, for the CLI and the AI. rank: any signed-in builder. Unlike the full settings read this carries no reward internals or file paths an agent could not already read, and every builder's AI session must know whether to ship on its own or stop and ask — gating it Metic+ would leave a newcomer's session guessing.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/lifecycle/routes/project-settings.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProjectSettingsShipModeResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "patch": {
+        "operationId": "patch_project_settings_ship_mode",
+        "tags": [
+          "project-settings"
+        ],
+        "summary": "PATCH /project-settings/ship-mode",
+        "description": "PATCH /project-settings/ship-mode — body { mode: 'auto' | 'manual' }. rank: project.settings.manage (metic+, government_010) — the same atom as the other writes on this page. Validated with the resolver's own parser, so the page, the CLI and the reader can never disagree about what a mode is.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.settings.manage` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/lifecycle/routes/project-settings.js",
+        "x-permissions": [
+          "project.settings.manage"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PatchProjectSettingsShipModeRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PatchProjectSettingsShipModeResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/project/manage-link": {
       "get": {
         "operationId": "get_project_manage_link",
@@ -26214,6 +26302,23 @@
           "rows"
         ]
       },
+      "GetProjectSettingsShipModeResponse": {
+        "type": "object",
+        "properties": {
+          "mode": {},
+          "chosen": {},
+          "source": {},
+          "sentence": {},
+          "choices": {}
+        },
+        "required": [
+          "mode",
+          "chosen",
+          "source",
+          "sentence",
+          "choices"
+        ]
+      },
       "GetProjectsFeaturedResponse": {
         "type": "object",
         "properties": {
@@ -27609,6 +27714,37 @@
           "describe"
         ]
       },
+      "PatchProjectSettingsShipModeRequest": {
+        "type": "object",
+        "properties": {
+          "mode": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "mode"
+        ],
+        "additionalProperties": false
+      },
+      "PatchProjectSettingsShipModeResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "mode": {},
+          "chosen": {},
+          "source": {},
+          "sentence": {}
+        },
+        "required": [
+          "ok",
+          "mode",
+          "chosen",
+          "source",
+          "sentence"
+        ]
+      },
       "PatchProjectsIdFeaturedRequest": {
         "type": "object",
         "properties": {
@@ -33611,9 +33747,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 523,
-  "x-schema-count": 564,
+  "x-endpoint-count": 525,
+  "x-schema-count": 567,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 374,
+  "x-response-schemas": 376,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 523 endpoints across 93 route files.
+> **Generated from the live route files** — the route file is authoritative. 525 endpoints across 93 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -606,12 +606,14 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 |---|---|---|---|---|
 | GET | `/api/bongos/project/manage-link` | `archon` | — | GET /project/manage-link — the hub's page for THIS project, where its owner takes it offline or disconnects it (task 1004570). |
 
-## `project-settings` (2)
+## `project-settings` (4)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/project-settings` | `metic+archon` | — | GET /project-settings — all five rows in ONE read. |
 | PATCH | `/api/bongos/project-settings/rot-days` | `metic+archon` | `days` | PATCH /project-settings/rot-days — body { days }. |
+| GET | `/api/bongos/project-settings/ship-mode` | `any-builder` | — | GET /project-settings/ship-mode — the ship mode alone, for the CLI and the AI. |
+| PATCH | `/api/bongos/project-settings/ship-mode` | `metic+archon` | `mode` | PATCH /project-settings/ship-mode — body { mode: 'auto' \| 'manual' }. |
 
 ## `projects` (8)