@bongos/core 1.21.78 → 1.21.80

package/.claude/skills/goal-create/SKILL.md

@@ -174,8 +174,9 @@ A goal created from the hall's form has only a name, a description, a version an
    - **Scope:** `POST /api/bongos/goals/<N>/scope --body '{"add":["<key>"]}'` (keys only, safe inline). The goal's owner or a manager; an Archon for a protected key.
    - **Criteria:** `POST /api/bongos/versions/<ver>/done-when` with `"goal_id":<N>`, exactly as 5b.
    - **Seed tasks:** `POST /api/bongos/tasks` with `"goal_id":<N>`, exactly as 5c. **Each one is automatically made to wait on the spec task** — do not remove that edge, and **do not promote them**: they move to `ready` by themselves the moment the spec task ships (the ordinary auto-promotion). Add their own dependency edges (5d) as usual.
-   - **Then ship the spec task** with `/builder-ship`. That ship is what releases the goal's work. Its value summary says what the goal now owns and which tasks became claimable.
+   - **Then ship the spec task** with `/builder-ship`. That ship is what releases the goal's work. Its value summary says what the goal now owns and which tasks became claimable. The spec task changes no files, so `ship.js` refuses with "Nothing to ship"; ship a `source: goal-spec` task with `--allow-empty` (only that kind of task) (the dry run in task 1004618 confirmed the seed tasks then move to `ready`).
 7. **If you do not own or manage the goal,** the scope and criteria writes are refused (403 / `400 bad_goal_id`, see above). Do not work around it: send the drafted scope, criteria and task table to the goal's owner (`/ask-for-help` naming them, or paste it on the spec task), file the seed tasks you are allowed to file, and leave the spec task claimed until the owner has written the rest. A spec task shipped with no scope and no criteria releases a goal that is still undefined, which is the state this task exists to prevent.
+8. **Making the goal on a version that is already `building`:** `POST /goals` returns `409 version_not_planning`. An Archon can admit the goal with `admit_reason`; anyone else asks an Archon or scopes it onto the planning version.
 
 ## The sibling advisory: `dependency_advisory` (task 1002827)
 

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 527 operations across 75 resource groups
+- 531 operations across 75 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -1163,14 +1163,22 @@ function createClient(opts = {}) {
       getStoreModulesKeyEntitlement: (args) => request("GET", "/store/modules/{key}/entitlement", { hasBody: false }, args),
       // POST /store/modules/{key}/versions — rank: metic+archon — POST /store/modules/:key/versions
       postStoreModulesKeyVersions: (args) => request("POST", "/store/modules/{key}/versions", { hasBody: true }, args),
+      // POST /store/modules/{key}/versions/{version}/error-count — rank: any-builder — POST /store/modules/:key/versions/:version/error-count
+      postStoreModulesKeyVersionsVersionErrorCount: (args) => request("POST", "/store/modules/{key}/versions/{version}/error-count", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/howto — rank: any-builder — GET /store/modules/:key/versions/:version/howto
       getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
+      // POST /store/modules/{key}/versions/{version}/install-report — rank: any-builder — POST /store/modules/:key/versions/:version/install-report
+      postStoreModulesKeyVersionsVersionInstallReport: (args) => request("POST", "/store/modules/{key}/versions/{version}/install-report", { hasBody: true }, args),
       // POST /store/modules/{key}/versions/{version}/reassess — rank: metic+archon — POST /store/modules/:key/versions/:version/reassess
       postStoreModulesKeyVersionsVersionReassess: (args) => request("POST", "/store/modules/{key}/versions/{version}/reassess", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
       // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest
       getStoreModulesLatest: (args) => request("GET", "/store/modules/latest", { hasBody: false }, args),
+      // GET /store/usage-reporting — rank: any-builder — GET /store/usage-reporting
+      getStoreUsageReporting: (args) => request("GET", "/store/usage-reporting", { hasBody: false }, args),
+      // POST /store/usage-reporting — rank: any-builder — POST /store/usage-reporting
+      postStoreUsageReporting: (args) => request("POST", "/store/usage-reporting", { hasBody: true }, args),
     },
     "taskRecommendations": {
       // POST /task-recommendations — rank: any-builder — POST /task-recommendations

package/clients/bongos-client/index.cjs

@@ -1162,14 +1162,22 @@ function createClient(opts = {}) {
       getStoreModulesKeyEntitlement: (args) => request("GET", "/store/modules/{key}/entitlement", { hasBody: false }, args),
       // POST /store/modules/{key}/versions — rank: metic+archon — POST /store/modules/:key/versions
       postStoreModulesKeyVersions: (args) => request("POST", "/store/modules/{key}/versions", { hasBody: true }, args),
+      // POST /store/modules/{key}/versions/{version}/error-count — rank: any-builder — POST /store/modules/:key/versions/:version/error-count
+      postStoreModulesKeyVersionsVersionErrorCount: (args) => request("POST", "/store/modules/{key}/versions/{version}/error-count", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/howto — rank: any-builder — GET /store/modules/:key/versions/:version/howto
       getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
+      // POST /store/modules/{key}/versions/{version}/install-report — rank: any-builder — POST /store/modules/:key/versions/:version/install-report
+      postStoreModulesKeyVersionsVersionInstallReport: (args) => request("POST", "/store/modules/{key}/versions/{version}/install-report", { hasBody: true }, args),
       // POST /store/modules/{key}/versions/{version}/reassess — rank: metic+archon — POST /store/modules/:key/versions/:version/reassess
       postStoreModulesKeyVersionsVersionReassess: (args) => request("POST", "/store/modules/{key}/versions/{version}/reassess", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
       // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest
       getStoreModulesLatest: (args) => request("GET", "/store/modules/latest", { hasBody: false }, args),
+      // GET /store/usage-reporting — rank: any-builder — GET /store/usage-reporting
+      getStoreUsageReporting: (args) => request("GET", "/store/usage-reporting", { hasBody: false }, args),
+      // POST /store/usage-reporting — rank: any-builder — POST /store/usage-reporting
+      postStoreUsageReporting: (args) => request("POST", "/store/usage-reporting", { hasBody: true }, args),
     },
     "taskRecommendations": {
       // POST /task-recommendations — rank: any-builder — POST /task-recommendations

package/clients/bongos-client/index.d.ts

@@ -180,6 +180,7 @@ export interface GetSsoPubkeyResponse { alg: unknown; format: unknown; public_ke
 export interface GetStoreEntitlementsResponse { entitlements: unknown }
 export interface GetStoreModulesKeyVersionsVersionHowtoResponse { module_key: unknown; title: unknown; version: unknown; published_at: unknown; delisted: unknown; markdown: unknown; artifact_url: unknown }
 export interface GetStoreModulesLatestResponse { latest: unknown }
+export interface GetStoreUsageReportingResponse { enabled: unknown }
 export interface GetTaskRecommendationsForMeResponse { recommendations: unknown; count: unknown }
 export interface GetTaskRecommendationsMineResponse { recommendations: unknown; count: unknown }
 export interface GetTasksClaimableResponse { claimable: unknown; claimable_total: unknown; active_claims: unknown }
@@ -517,8 +518,12 @@ export interface PostStoreModulesKeyAcquiredResponse { ok: boolean; entitlement:
 export interface PostStoreModulesKeyDelistRequest { reason?: string }
 export interface PostStoreModulesKeyDelistResponse { ok: boolean; module_key: unknown; status: unknown; delisted_at: unknown }
 export interface PostStoreModulesKeyVersionsResponse { ok: boolean; created_module: unknown; version: unknown }
+export interface PostStoreModulesKeyVersionsVersionErrorCountRequest { day: string; count: number }
+export interface PostStoreModulesKeyVersionsVersionInstallReportRequest { ok: boolean; error_code?: string }
 export interface PostStoreModulesKeyVersionsVersionReassessRequest { reason?: string }
 export interface PostStoreModulesKeyVersionsVersionReassessResponse { ok: boolean; queued: boolean; module_key: unknown; version: unknown; version_id: unknown }
+export interface PostStoreUsageReportingRequest { enabled: boolean }
+export interface PostStoreUsageReportingResponse { ok: boolean; enabled: unknown }
 export interface PostTaskRecommendationsRequest { task_id: number; recommended_to: number; reason: string }
 export interface PostTaskRecommendationsResponse { ok: boolean; recommendation: unknown }
 export interface PostTasksIdAttestGateRequest { head_sha: string }
@@ -1664,14 +1669,22 @@ export interface BongosClient {
     getStoreModulesKeyEntitlement(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /store/modules/{key}/versions — rank: metic+archon */
     postStoreModulesKeyVersions(args?: RequestArgs): Promise<PostStoreModulesKeyVersionsResponse>;
+    /** POST /store/modules/{key}/versions/{version}/error-count — rank: any-builder */
+    postStoreModulesKeyVersionsVersionErrorCount(args: RequestArgs & { body: PostStoreModulesKeyVersionsVersionErrorCountRequest }): Promise<ApiResponse>;
     /** GET /store/modules/{key}/versions/{version}/howto — rank: any-builder */
     getStoreModulesKeyVersionsVersionHowto(args?: RequestArgs): Promise<GetStoreModulesKeyVersionsVersionHowtoResponse>;
+    /** POST /store/modules/{key}/versions/{version}/install-report — rank: any-builder */
+    postStoreModulesKeyVersionsVersionInstallReport(args: RequestArgs & { body: PostStoreModulesKeyVersionsVersionInstallReportRequest }): Promise<ApiResponse>;
     /** POST /store/modules/{key}/versions/{version}/reassess — rank: metic+archon */
     postStoreModulesKeyVersionsVersionReassess(args?: RequestArgs & { body?: PostStoreModulesKeyVersionsVersionReassessRequest }): Promise<PostStoreModulesKeyVersionsVersionReassessResponse>;
     /** GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder */
     getStoreModulesKeyVersionsVersionTarball(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /store/modules/latest — rank: any-builder */
     getStoreModulesLatest(args?: RequestArgs): Promise<GetStoreModulesLatestResponse>;
+    /** GET /store/usage-reporting — rank: any-builder */
+    getStoreUsageReporting(args?: RequestArgs): Promise<GetStoreUsageReportingResponse>;
+    /** POST /store/usage-reporting — rank: any-builder */
+    postStoreUsageReporting(args: RequestArgs & { body: PostStoreUsageReportingRequest }): Promise<PostStoreUsageReportingResponse>;
   };
   "taskRecommendations": {
     /** POST /task-recommendations — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -1159,14 +1159,22 @@ export function createClient(opts = {}) {
       getStoreModulesKeyEntitlement: (args) => request("GET", "/store/modules/{key}/entitlement", { hasBody: false }, args),
       // POST /store/modules/{key}/versions — rank: metic+archon — POST /store/modules/:key/versions
       postStoreModulesKeyVersions: (args) => request("POST", "/store/modules/{key}/versions", { hasBody: true }, args),
+      // POST /store/modules/{key}/versions/{version}/error-count — rank: any-builder — POST /store/modules/:key/versions/:version/error-count
+      postStoreModulesKeyVersionsVersionErrorCount: (args) => request("POST", "/store/modules/{key}/versions/{version}/error-count", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/howto — rank: any-builder — GET /store/modules/:key/versions/:version/howto
       getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
+      // POST /store/modules/{key}/versions/{version}/install-report — rank: any-builder — POST /store/modules/:key/versions/:version/install-report
+      postStoreModulesKeyVersionsVersionInstallReport: (args) => request("POST", "/store/modules/{key}/versions/{version}/install-report", { hasBody: true }, args),
       // POST /store/modules/{key}/versions/{version}/reassess — rank: metic+archon — POST /store/modules/:key/versions/:version/reassess
       postStoreModulesKeyVersionsVersionReassess: (args) => request("POST", "/store/modules/{key}/versions/{version}/reassess", { hasBody: true }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
       // GET /store/modules/latest — rank: any-builder — GET /store/modules/latest
       getStoreModulesLatest: (args) => request("GET", "/store/modules/latest", { hasBody: false }, args),
+      // GET /store/usage-reporting — rank: any-builder — GET /store/usage-reporting
+      getStoreUsageReporting: (args) => request("GET", "/store/usage-reporting", { hasBody: false }, args),
+      // POST /store/usage-reporting — rank: any-builder — POST /store/usage-reporting
+      postStoreUsageReporting: (args) => request("POST", "/store/usage-reporting", { hasBody: true }, args),
     },
     "taskRecommendations": {
       // POST /task-recommendations — rank: any-builder — POST /task-recommendations

package/docs/adr/0155-adopt-private-repo-widen-oauth-scope.md

@@ -4,6 +4,7 @@
 - **Date:** 2026-08-04
 - **Deciders:** the owner chose the credential approach after being shown the trade-off; Claude diagnosed + built.
 - **Amends:** [ADR 0143](0143-onboarding-repo-picker-oauth-scope.md) §1 (its Decision 1 — scope choice). 0143 otherwise stands unchanged: opt-in per sign-in, lazy consent, encrypted short-TTL token store, personal repos only, 503-degrade. Per 0143's own append-only rule, this is a new ADR, not an edit.
+- **Superseded in part by:** [ADR 0370](0370-a-repo-we-create-is-private.md) — Decision 3 (a repo we create stays public) is reversed: a repo we create is private.
 - **Related:** [ADR 0121](0121-greenfield-vs-brownfield-onboarding-adopt-existing-repo.md) (greenfield vs brownfield onboarding).
 
 ## Context

package/docs/adr/0370-a-repo-we-create-is-private.md

@@ -0,0 +1,29 @@
+# ADR 0370 — A repo we create for a new project is private
+
+- **Status:** accepted
+- **Date:** 2026-10-08
+- **Task:** [task 1004645](https://cloudbongos.com/builders#/task/1004645) (goal 1000106, BONGOS-V2)
+- **Supersedes:** [ADR 0155](0155-adopt-private-repo-widen-oauth-scope.md) Decision 3 ("a repo *we* create stays public"). The rest of 0155 stands.
+- **Builds on:** [ADR 0176](0176-private-repo-deploy-keys.md) (a private target repo gets its own read-only deploy key before the first pull)
+- **Decided with:** the owner, 2026-10-08: the public default is a major security issue, and the default must be private.
+
+## Context
+
+When the create wizard makes a new GitHub repository for a project, `createUserRepo` (`src/bongos/github-repos.js`) sent `private: false`. ADR 0155 kept that on purpose: a Cloud Bongos instance was meant to be open source by design, and an owner who wanted private code had to make the repo on GitHub themselves and adopt it.
+
+That put every new project's code on the public internet from its first push, without the owner ever choosing it. A first-time owner does not know to take the side door. Anything they commit by mistake, such as a key, a customer file or unreleased work, is world-readable and may already be copied before they notice.
+
+The reason the public default was once forced has gone. ADR 0155 widened the token to `repo`, which can create a private repo. ADR 0176 taught provisioning to stand up a private repo: `ensurePrivateRepoAccess` registers the project's own read-only deploy key right after the scaffold push and before the first `git pull`. The greenfield push already uses the owner's token over HTTPS. The owner creates the repo in their own account, so they are its admin, which is what registering a deploy key needs.
+
+## Decision
+
+1. **`createUserRepo` sends `private: true`.** It is still not a parameter, so nothing can flip it by accident. The unit test pins `true` exactly; a dropped field would fall back to GitHub's own public default and red the test.
+2. **The wizard says so.** The "A new repo" choice reads "Private, set up for you", and the name field's hint says the new repo is private and can be made public later.
+3. **Going public stays the owner's choice.** The manage page's repo-visibility control (`makeRepoPublic`) is unchanged.
+
+## Consequences
+
+- A new project's code is private unless its owner makes it public.
+- Every new cloud-hosted project now takes the private standup path: one extra deploy key per project, registered on the owner's repo. That path has run on adopted private repos since ADR 0176.
+- Projects created before this change keep their public repos. Nothing flips an existing repo.
+- An instance that wants to be open source now makes that choice on the manage page instead of getting it by default.

package/docs/adr/README.md

@@ -488,3 +488,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0367 | [**The Discord support bot answers from public docs only, under a monthly cap that fails closed** ([task 1002534](https://cloudbongos.com/builders#/task/1002534), goal 1000110). **D1:** one pinned channel, only when @-mentioned; the first gateway reply. **D2:** the corpus is an allowlist (`README.md`, `docs/onboarding/`, `docs/api-reference.md`) served by a new `memory.searchPublicDocs` port whose scope (doc, xenos, no owner, allowlisted ref) is fixed in SQL; the asker is never looked up. **D3:** no writes but the reply and one `audit_log` row per answer, which is also the spend ledger, so no migration. **D4:** a nonce-fenced prompt, no tools, mentions disabled. **D5:** `claude-haiku-4-5`, `DISCORD_SUPPORT_MONTHLY_CAP_USD` default $5, fail closed, with in-flight answers reserved at worst case. **D6:** off by default; its own switch and an env-only, namespaced key. **D7:** the channel's humans review wrong answers; the fix is the doc.](0367-the-support-bot-answers-from-public-docs-only.md) | discord / support / spend |
 | 0368 | [**Red and blue teams practise on a range, never on live** (goal 1000094 — *Working area 10, Security*; proposed). **D2:** the range is its own small server, rebuilt from the candidate the owner marks "stage for attack". **D3:** it shares no identity hub, secret or data with live. **D5:** red is AI plus Metic+, with one side at a time and a 30-day switch. **D6:** attacks run on subscriptions, never the metered API. **D7:** 3 runs on the newest model with 0 high+ breaks, advisory until an outside tenant exists. **D8:** points only, no credits yet. **D9:** three live signals to `#security-alerts`.](0368-red-and-blue-teams-practice-on-a-range-never-on-live.md) | security / red-team / range |
 | 0369 | [**Ship mode decides who starts a ship, not how it lands** ([task 1004628](https://cloudbongos.com/builders#/task/1004628), goal 1000106). **D1:** a `ship.mode` project setting, `auto` (the AI ships and lands a finished task with no commands) or `manual` (a person approves each ship), in `project_settings` with no migration. **D2:** Auto is the default, and the resolver reports whether anyone has chosen. **D3:** it is separate from deploy mode (`config/deploy.json`), which decides how a land happens. **D4:** any builder can read it (the AI must know), and `project.settings.manage` writes it, from the settings page or `bongos ship-mode`.](0369-ship-mode-decides-who-starts-a-ship-not-how-it-lands.md) | lifecycle / shipping / project settings |
+| 0370 | [**A repo we create for a new project is private** ([task 1004645](https://cloudbongos.com/builders#/task/1004645), goal 1000106). Supersedes ADR 0155 Decision 3: `createUserRepo` sends `private: true`, still not a parameter, and the wizard says the new repo is private. Safe because ADR 0176 already gives a private repo its own read-only deploy key before the first pull; the owner can make it public from the manage page.](0370-a-repo-we-create-is-private.md) | onboarding / security / github |

package/docs/api/openapi.json

@@ -21904,6 +21904,71 @@
         ]
       }
     },
+    "/store/modules/{key}/versions/{version}/error-count": {
+      "post": {
+        "operationId": "post_store_modules_key_versions_version_error_count",
+        "tags": [
+          "store"
+        ],
+        "summary": "POST /store/modules/:key/versions/:version/error-count",
+        "description": "**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/modules.js",
+        "parameters": [
+          {
+            "name": "key",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `key`."
+          },
+          {
+            "name": "version",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `version`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostStoreModulesKeyVersionsVersionErrorCountRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/store/modules/{key}/versions/{version}/howto": {
       "get": {
         "operationId": "get_store_modules_key_versions_version_howto",
@@ -21965,6 +22030,71 @@
         ]
       }
     },
+    "/store/modules/{key}/versions/{version}/install-report": {
+      "post": {
+        "operationId": "post_store_modules_key_versions_version_install_report",
+        "tags": [
+          "store"
+        ],
+        "summary": "POST /store/modules/:key/versions/:version/install-report",
+        "description": "**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/modules.js",
+        "parameters": [
+          {
+            "name": "key",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `key`."
+          },
+          {
+            "name": "version",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `version`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostStoreModulesKeyVersionsVersionInstallReportRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/store/modules/{key}/versions/{version}/reassess": {
       "post": {
         "operationId": "post_store_modules_key_versions_version_reassess",
@@ -22094,6 +22224,91 @@
         ]
       }
     },
+    "/store/usage-reporting": {
+      "get": {
+        "operationId": "get_store_usage_reporting",
+        "tags": [
+          "store"
+        ],
+        "summary": "GET /store/usage-reporting",
+        "description": "The caller's own reporting switch (Settings → Profile and privacy). On unless they turned it off.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/modules.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetStoreUsageReportingResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "post": {
+        "operationId": "post_store_usage_reporting",
+        "tags": [
+          "store"
+        ],
+        "summary": "POST /store/usage-reporting",
+        "description": "**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/modules.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostStoreUsageReportingRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostStoreUsageReportingResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/task-recommendations": {
       "post": {
         "operationId": "post_task_recommendations",
@@ -27042,6 +27257,15 @@
           "latest"
         ]
       },
+      "GetStoreUsageReportingResponse": {
+        "type": "object",
+        "properties": {
+          "enabled": {}
+        },
+        "required": [
+          "enabled"
+        ]
+      },
       "GetTaskRecommendationsForMeResponse": {
         "type": "object",
         "properties": {
@@ -32766,6 +32990,39 @@
           "version"
         ]
       },
+      "PostStoreModulesKeyVersionsVersionErrorCountRequest": {
+        "type": "object",
+        "properties": {
+          "day": {
+            "type": "string",
+            "maxLength": 10
+          },
+          "count": {
+            "type": "integer"
+          }
+        },
+        "required": [
+          "day",
+          "count"
+        ],
+        "additionalProperties": false
+      },
+      "PostStoreModulesKeyVersionsVersionInstallReportRequest": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "error_code": {
+            "type": "string",
+            "maxLength": 40
+          }
+        },
+        "required": [
+          "ok"
+        ],
+        "additionalProperties": false
+      },
       "PostStoreModulesKeyVersionsVersionReassessRequest": {
         "type": "object",
         "properties": {
@@ -32797,6 +33054,31 @@
           "version_id"
         ]
       },
+      "PostStoreUsageReportingRequest": {
+        "type": "object",
+        "properties": {
+          "enabled": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "enabled"
+        ],
+        "additionalProperties": false
+      },
+      "PostStoreUsageReportingResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "enabled": {}
+        },
+        "required": [
+          "ok",
+          "enabled"
+        ]
+      },
       "PostTaskRecommendationsRequest": {
         "type": "object",
         "properties": {
@@ -33825,9 +34107,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 527,
-  "x-schema-count": 568,
+  "x-endpoint-count": 531,
+  "x-schema-count": 573,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 377,
+  "x-response-schemas": 379,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 527 endpoints across 93 route files.
+> **Generated from the live route files** — the route file is authoritative. 531 endpoints across 93 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -815,7 +815,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sso/pubkey` | `public` | — | GET /sso/pubkey — the hub's Ed25519 assertion-verification key (public). |
 | POST | `/api/bongos/sso/token` | `public` | `client_id`, `client_secret`, `code`, `redirect_uri` | POST /sso/token — server-to-server code redemption. |
 
-## `store` (11)
+## `store` (15)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -826,10 +826,14 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/store/modules/:key/delist` | `metic+archon` | `reason` | POST /api/bongos/store/modules/:key/delist — a Metic+ person takes a module out of the store (task 1003797, ADR 0338 D2). |
 | GET | `/api/bongos/store/modules/:key/entitlement` | `any-builder` | — |  |
 | POST | `/api/bongos/store/modules/:key/versions` | `metic+archon` | _undocumented_ | POST /api/bongos/store/modules/:key/versions — publish one module version to the store (task 1004271, ADR 0338 D1). |
+| POST | `/api/bongos/store/modules/:key/versions/:version/error-count` | `any-builder` | `day`, `count` |  |
 | GET | `/api/bongos/store/modules/:key/versions/:version/howto` | `any-builder` | — | GET /api/bongos/store/modules/:key/versions/:version/howto — the how-to a version shipped with (task 1004366, ADR 0347 D1/D3), read from … |
+| POST | `/api/bongos/store/modules/:key/versions/:version/install-report` | `any-builder` | `ok`, `error_code` |  |
 | POST | `/api/bongos/store/modules/:key/versions/:version/reassess` | `metic+archon` | `reason` | POST /api/bongos/store/modules/:key/versions/:version/reassess — a Metic+ person asks for a published version's assessment to run again: … |
 | GET | `/api/bongos/store/modules/:key/versions/:version/tarball` | `any-builder` | — |  |
 | GET | `/api/bongos/store/modules/latest` | `any-builder` | — | The newest published version of each named module — what `bongos upgrade` compares an instance's installed store modules against to repor… |
+| GET | `/api/bongos/store/usage-reporting` | `any-builder` | — | The caller's own reporting switch (Settings → Profile and privacy). |
+| POST | `/api/bongos/store/usage-reporting` | `any-builder` | `enabled` |  |
 
 ## `task-recommendations` (4)