@bongos/core 1.21.95 → 1.21.96

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.95",
-  "core_contract": "1.21.95",
-  "source_commit": "1895cbf114f5a8932e751d9208a592dfbbf99ff8",
+  "core_version": "1.21.96",
+  "core_contract": "1.21.96",
+  "source_commit": "7fe8cc68952fc52e5a2f6620ee7f55c89bd72728",
   "source_ref": "HEAD",
-  "built_at": "2026-10-09T08:47:23.210Z",
+  "built_at": "2026-10-09T10:00:46.973Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 590,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3013,
+    "functional_verbatim": 3014,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3632,
-  "tree_sha256": "82e713c766d3a2684a614b15ca98c09c047238193da0dc6be4ab5f95b9dbb975",
+  "file_count": 3633,
+  "tree_sha256": "3b6bd78cdd3212bf3c1010e59d8d2c6101c0857f1bb1bee230fb85b7f83e51ee",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -312,12 +312,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "ddef69b1dc2ff76269e9f84955ca554ec70f1f18aeb502e408bf20920f694669"
+      "sha256": "3e9f5bc0b7e0ede71e6ad8b88e6770faa836227d029f0d9e7e1ce5d38d94866c"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "35ac01d598a9ba76e928f115f5de99e952128d37de311e3bab548d9a74bfe53a"
+      "sha256": "cd0300814bc05a6309264b232aaa6f14ccba9d0b1af5f379f88678c51b50452e"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -327,17 +327,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "0793d04a2a43eef50144bc607927c7b3560af4948877926edf24aa3d781e7323"
+      "sha256": "714ebd69e4d8ab4d1e155e383150e6d293e45f37caea516acff7d3277d2df933"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "c4708244379cd28709caf48d817266b184ffe18a65f9590bc62c2b1aeb71d824"
+      "sha256": "1f25c3084694cef28c60e61b170cfa7d3c99cacd911a17063085c6b83b0b9eae"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "e143421ec34b742f29a21690b81ed8fdf2b01a7c87d380fcea43a56dbba42465"
+      "sha256": "c8aa4619d61ebd5d3f4c593010bfad32591229de234ffa412443fc1811546926"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2317,12 +2317,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "3b3f6ed65d2c90fa08c7a2000862c7c9ffd8b7625420f377b52d132d9b17d8d3"
+      "sha256": "650244908092826b311d3b87c8943bba0c4d95d2b196698a897de3accbc5f17a"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "8704ce350de56a1b955a41296cb7fa053128d2b4fc8a76e156a4e8578afef6a3"
+      "sha256": "d4a92b1fd93c0a8b9c7e48f89d79766d5e298a2dae1fe3db588ed6fdaeff3ce1"
     },
     {
       "path": "docs/architecture.md",
@@ -2347,12 +2347,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "d9eb86aa5d3c208883783df0deef2ad776e403fa5896a422d88adc5e11079e6d"
+      "sha256": "99d765694dcd9dfcc5343f41f4202a7e24beeac1b8b48574686b0fde7eca5a4e"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "d5af39196ca0a235dcb225c0966f2df4d930417c109298f86e03429cdc4d7a91"
+      "sha256": "a0820afa8785e8c5d73f3fc4680939b28b12b51ca44bc67209d390cc6853a6f1"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2432,7 +2432,7 @@
     {
       "path": "docs/design/project-startup-direction.md",
       "mode": "0000644",
-      "sha256": "1fc48632ac7af6d55bc62cf0207affb597956c2243febe1faa0b39e22bdef829"
+      "sha256": "ab970c9b8903537174d7edd6ba3980480373df9c67d88c6fad81714dfe8c185d"
     },
     {
       "path": "docs/design/projects-hub-direction-v2.md",
@@ -2862,7 +2862,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "4b50f866b73e605791b602d3d0dd212aeebc0b406f1f8579a8f3f4625fb9a8f2"
+      "sha256": "fe148fd74b342e433645b14587ff11c31faf3bccdedd032335d254bbc5afaa5d"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2952,7 +2952,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "998e448cf903b275a9c44c0f326197963e83929626cce5dc506e980148690b98"
+      "sha256": "6dafc2854956f0628a7a1ad6fe0c47dd4c530e7e3962c3664b8c87b5e9ba96c3"
     },
     {
       "path": "docs/project-context.template.md",
@@ -8267,7 +8267,7 @@
     {
       "path": "modules/provisioning/github-setup.js",
       "mode": "0000644",
-      "sha256": "e97ee19b2ba5e607557d0794e528f2e7e19d68cbe6e208ab88af7a9dba92d06b"
+      "sha256": "5bce3df9db40089e773d6cf45ae116ccab50b68ecd385df361a09c6aa6c8fe5c"
     },
     {
       "path": "modules/provisioning/look.js",
@@ -8577,7 +8577,7 @@
     {
       "path": "modules/provisioning/routes/github-setup.js",
       "mode": "0000644",
-      "sha256": "652c1aafba1e38ae46b02b54d3e6cfa8c18a0ceadcf8a94ea67d664d773cce85"
+      "sha256": "1551d38419839bc2ad84cb1cbd819419e15d00ead14e3b68e61f65d422dc8629"
     },
     {
       "path": "modules/provisioning/routes/look.js",
@@ -8587,7 +8587,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "a4ab4c1f5c98f5fe85489f0f2f7e23e6897c178b62f2bcc9b2d9e5502fd26458"
+      "sha256": "9e195130cfd5fd1b9ef086f2e33bf1a6a91afe2fcaa234b8e45f0c2bedf198a6"
     },
     {
       "path": "modules/provisioning/routes/render-standup.js",
@@ -9337,7 +9337,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "99b6553bb9756a91713c0842510d0dc8545111d0366fd59237968df21e69bf99"
+      "sha256": "600e34896afe2f555bf8651a3636a07fbf0156ceda1ad2aa84ab2d2d7b161a77"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -10117,12 +10117,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8a3f6a8660b0f20118070b8adaad21cbbd3866e6a272720b94c2719fafe53b77"
+      "sha256": "1108a8c0201d8bf012906969b018d65498d9fab8d3d399e9ba86df6388d713b2"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "256622b8d3de980cdb9dc368b115d0259af8e192f43d3757fcbc399ea053b00b"
+      "sha256": "f03398091a4557a6f0347eda8a60d38fa846bb10b9df44fc242ec4b1b0de4ec9"
     },
     {
       "path": "public-docs/index.html",
@@ -10142,7 +10142,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "f0933c625fe42e498bad837a26383cbd38181bb7dba0f02d33457789fdbac345"
+      "sha256": "eb303846cdf391b5bbf69c5a0d5ab480e804a23e15c324e9b1e63aee43f24555"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12092,7 +12092,7 @@
     {
       "path": "src/bongos/github-repos.js",
       "mode": "0000644",
-      "sha256": "af5600f22a3421c8197e91c77d422e9bca789eb458789924e8d75a00818f314a"
+      "sha256": "c209eae2cd75714bfffd5a0fcd544cc35de5f4693b8794eedc1dcbea44e93740"
     },
     {
       "path": "src/bongos/goal-scope-check.js",
@@ -12302,7 +12302,7 @@
     {
       "path": "src/bongos/routes/github.js",
       "mode": "0000644",
-      "sha256": "752056364c7a826bdd4d6da2f14a0ce48284c93621ccdf5bea10bac3bbb2941f"
+      "sha256": "21185f749b018027a291d50db721213142f0b8f550ba5d5c93e8ce7cb3713d36"
     },
     {
       "path": "src/bongos/routes/healthz.js",
@@ -12412,7 +12412,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5cabb78f9a62e76cbe3b084a14f0f4a50c5dc73b9c359cded8b13c64c5158f38"
+      "sha256": "f836e60518d2f8b4e6f54235518d1f4e7bde80d9c226268c8880418fe1008812"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14044,6 +14044,11 @@
       "mode": "0000644",
       "sha256": "b04dbcd87504e696367a03db39c0a3c0ae9b647039ab25b354c89884c74d2ba5"
     },
+    {
+      "path": "tests/github_org_account.mjs",
+      "mode": "0000644",
+      "sha256": "0745d0da6a5bd0494fc067756285ffedff62a6fd946aa1508690321d5f52cee2"
+    },
     {
       "path": "tests/github_push_ancestry.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 536 operations across 76 resource groups
+- 538 operations across 76 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -411,6 +411,10 @@ function createClient(opts = {}) {
       postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
     },
     "github": {
+      // GET /github/orgs — rank: any-builder — GET /github/orgs
+      getGithubOrgs: (args) => request("GET", "/github/orgs", { hasBody: false }, args),
+      // GET /github/orgs/{org} — rank: any-builder — GET /github/orgs/:org
+      getGithubOrgsOrg: (args) => request("GET", "/github/orgs/{org}", { hasBody: false }, args),
       // GET /github/repo — rank: any-builder — GET /github/repo
       getGithubRepo: (args) => request("GET", "/github/repo", { hasBody: false }, args),
       // POST /github/repo/visibility — rank: any-builder — POST /github/repo/visibility

package/clients/bongos-client/index.cjs

@@ -410,6 +410,10 @@ function createClient(opts = {}) {
       postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
     },
     "github": {
+      // GET /github/orgs — rank: any-builder — GET /github/orgs
+      getGithubOrgs: (args) => request("GET", "/github/orgs", { hasBody: false }, args),
+      // GET /github/orgs/{org} — rank: any-builder — GET /github/orgs/:org
+      getGithubOrgsOrg: (args) => request("GET", "/github/orgs/{org}", { hasBody: false }, args),
       // GET /github/repo — rank: any-builder — GET /github/repo
       getGithubRepo: (args) => request("GET", "/github/repo", { hasBody: false }, args),
       // POST /github/repo/visibility — rank: any-builder — POST /github/repo/visibility

package/clients/bongos-client/index.d.ts

@@ -65,6 +65,7 @@ export interface GetCoreUpgradesResponse { ok: boolean; running: unknown; limit:
 export interface GetDiscordChannelsPlanResponse { ok: boolean; guild_id: unknown; op_count: unknown; ops: unknown; warnings: unknown }
 export interface GetDiscordChannelsSnapshotResponse { ok: boolean; guild_id: unknown; config: unknown; warnings: unknown }
 export interface GetDoneWhenPendingReviewResponse { criteria: unknown; count: unknown }
+export interface GetGithubOrgsOrgResponse { org: unknown }
 export interface GetGithubRepoResponse { ok: boolean; repo: unknown; private_deployable: boolean }
 export interface GetGithubReposResponse { repos: unknown }
 export interface GetGoalTaskRelevancePendingResponse { flags: unknown; count: unknown }
@@ -133,7 +134,7 @@ export interface GetProjectsFeaturedResponse { projects: unknown; page: PageInfo
 export interface GetProjectsResponse { projects: unknown }
 export interface GetProvisioningFleetResponse { instances: unknown; capacity: unknown }
 export interface GetProvisioningGithubAppResumeResponse { ok: boolean; project: unknown }
-export interface GetProvisioningGithubAppStatusResponse { ok: boolean; status: unknown; failure: unknown; ready: unknown; terminal: unknown; domain: unknown; instance_status: unknown; app_slug: unknown; checklist: unknown; install_url: unknown; repo: unknown; verifying: unknown }
+export interface GetProvisioningGithubAppStatusResponse { ok: boolean; status: unknown; failure: unknown; ready: unknown; terminal: unknown; domain: unknown; instance_status: unknown; app_slug: unknown; checklist: unknown; install_url: unknown; repo: unknown; verifying: unknown; app_org: unknown }
 export interface GetProvisioningHealthResponse { module: unknown; ok: boolean; coreVersion: unknown }
 export interface GetProvisioningInstancesIdEnvManifestResponse { instance: unknown; env_vars: unknown; environments: unknown; values_held: boolean; note: unknown }
 export interface GetProvisioningInstancesIdInviteSuggestionsResponse { suggested: unknown; seeking: unknown; reason: unknown; unavailable?: unknown }
@@ -328,7 +329,7 @@ export interface PostFeedbackReceiptResponse { ok: boolean; receipt: unknown; hu
 export interface PostFoundingPlanRequest { days?: Record<string, unknown>; passes?: number; advisors?: string; government?: string; expected_builders?: number; existing?: boolean }
 export interface PostGithubRepoVisibilityRequest { repo: string; visibility: "public" | "private" }
 export interface PostGithubRepoVisibilityResponse { ok: boolean; repo: unknown; private_deployable: boolean }
-export interface PostGithubReposRequest { name: string }
+export interface PostGithubReposRequest { name: string; org?: string }
 export interface PostGithubReposResponse { repo: unknown }
 export interface PostGoalTaskRelevanceIdDecideRequest { decision: "confirmed_gaming" | "false_positive"; note?: string }
 export interface PostGoalTaskRelevanceIdDecideResponse { ok: boolean; flag: unknown }
@@ -458,7 +459,7 @@ export interface PostProvisioningInstancesIdDomainRequest { domain: string }
 export interface PostProvisioningInstancesIdDomainResponse { ok: boolean; changed: boolean; queued: unknown; domain: unknown; message: unknown; replaced?: unknown }
 export interface PostProvisioningInstancesIdEnvManifestRequest { name: string; description?: string; environments?: unknown[]; required?: boolean }
 export interface PostProvisioningInstancesIdForceTeardownResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; superseded: unknown; message: unknown }
-export interface PostProvisioningInstancesIdGithubAppRequest { account?: string }
+export interface PostProvisioningInstancesIdGithubAppRequest { account?: string; org?: string }
 export interface PostProvisioningInstancesIdGithubAppResponse { state: unknown; account: unknown; post_url: unknown; personal_url: unknown; org_url: unknown; org_login: unknown; manifest: unknown; redirect_url: unknown; expires_at: unknown }
 export interface PostProvisioningInstancesIdRenderRequest { key: string; owner_id: string; mode: string; service_id?: string; web_plan?: string; db_plan?: string; region?: string; runtime?: string; build_command?: string; start_command?: string; database?: boolean }
 export interface PostProvisioningInstancesIdRenderResponse { ok: boolean; queued: boolean; action: unknown; mode: unknown; with_setup: boolean; message: unknown }
@@ -919,6 +920,10 @@ export interface BongosClient {
     postGateApprovalsPrApprove(args?: RequestArgs): Promise<ApiResponse>;
   };
   "github": {
+    /** GET /github/orgs — rank: any-builder */
+    getGithubOrgs(args?: RequestArgs): Promise<ApiResponse>;
+    /** GET /github/orgs/{org} — rank: any-builder */
+    getGithubOrgsOrg(args?: RequestArgs): Promise<GetGithubOrgsOrgResponse>;
     /** GET /github/repo — rank: any-builder */
     getGithubRepo(args?: RequestArgs): Promise<GetGithubRepoResponse>;
     /** POST /github/repo/visibility — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -407,6 +407,10 @@ export function createClient(opts = {}) {
       postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
     },
     "github": {
+      // GET /github/orgs — rank: any-builder — GET /github/orgs
+      getGithubOrgs: (args) => request("GET", "/github/orgs", { hasBody: false }, args),
+      // GET /github/orgs/{org} — rank: any-builder — GET /github/orgs/:org
+      getGithubOrgsOrg: (args) => request("GET", "/github/orgs/{org}", { hasBody: false }, args),
       // GET /github/repo — rank: any-builder — GET /github/repo
       getGithubRepo: (args) => request("GET", "/github/repo", { hasBody: false }, args),
       // POST /github/repo/visibility — rank: any-builder — POST /github/repo/visibility

package/docs/api/openapi.json

@@ -6381,6 +6381,89 @@
         ]
       }
     },
+    "/github/orgs": {
+      "get": {
+        "operationId": "get_github_orgs",
+        "tags": [
+          "github"
+        ],
+        "summary": "GET /github/orgs",
+        "description": "the caller's OWN GitHub organisations (task 1004651), for the project page's \"on an organisation\" choice. Each row says whether the caller can make an app there and, when not, why. `listed` says how much GitHub showed this token (github-repos.listUserOrgs): the page always offers a typed name beside the list.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/github.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/github/orgs/{org}": {
+      "get": {
+        "operationId": "get_github_orgs_org",
+        "tags": [
+          "github"
+        ],
+        "summary": "GET /github/orgs/:org",
+        "description": "checks ONE organisation name the caller typed, as their own GitHub credential sees it (task 1004651). The name is checked against GitHub's login rules before it reaches a URL.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/github.js",
+        "parameters": [
+          {
+            "name": "org",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `org`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetGithubOrgsOrgResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/github/repo": {
       "get": {
         "operationId": "get_github_repo",
@@ -6511,7 +6594,7 @@
           "github"
         ],
         "summary": "POST /github/repos",
-        "description": "creates a repo in the caller's OWN account.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "creates a repo in the caller's OWN account, or (task 1004651) under an organisation they name in `org`. GitHub decides whether they may; its refusals come back as 409s with the reason, never as a 403 (the page reads a 403 as \"sign in again\").\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "src/bongos/routes/github.js",
         "requestBody": {
@@ -17371,7 +17454,7 @@
           "provisioning"
         ],
         "summary": "POST /provisioning/instances/:id/github-app",
-        "description": "POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 0133). rank: any authenticated builder (own resource). Returns the pre-filled manifest + the GitHub form-POST target (personal + org variants) + a one-time `state`; the browser POSTs the manifest to GitHub, the owner approves, and GitHub redirects back to the public callback below. The web tier only RECORDS the attempt (state token) — the control-plane runner does the token exchange + cred placement (trust boundary intact, ADR 0111 §2). Body: { account? ('personal'|'org') }.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 0133). rank: any authenticated builder (own resource). Returns the pre-filled manifest + the GitHub form-POST target (personal + org variants) + a one-time `state`; the browser POSTs the manifest to GitHub, the owner approves, and GitHub redirects back to the public callback below. The web tier only RECORDS the attempt (state token) — the control-plane runner does the token exchange + cred placement (trust boundary intact, ADR 0111 §2). Body: { account? ('personal'|'org'), org? (a GitHub organisation login) }. A personal or an organisation account (task 1004651): account 'org' makes the app on the organisation the founder chose on the page (`org`), else on the repo's owner. The org name is checked against GitHub's login rules here, never trusted from the page; whether the founder may make an app there is GitHub's to enforce on its own page (this module holds no GitHub token to ask with, ADR 0111 §2). Anything other than account 'org' is the founder's personal account, exactly as before.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "parameters": [
@@ -25946,6 +26029,15 @@
           "count"
         ]
       },
+      "GetGithubOrgsOrgResponse": {
+        "type": "object",
+        "properties": {
+          "org": {}
+        },
+        "required": [
+          "org"
+        ]
+      },
       "GetGithubRepoResponse": {
         "type": "object",
         "properties": {
@@ -26861,7 +26953,8 @@
           "checklist": {},
           "install_url": {},
           "repo": {},
-          "verifying": {}
+          "verifying": {},
+          "app_org": {}
         },
         "required": [
           "ok",
@@ -26875,7 +26968,8 @@
           "checklist",
           "install_url",
           "repo",
-          "verifying"
+          "verifying",
+          "app_org"
         ]
       },
       "GetProvisioningHealthResponse": {
@@ -29810,6 +29904,10 @@
           "name": {
             "type": "string",
             "maxLength": 100
+          },
+          "org": {
+            "type": "string",
+            "maxLength": 39
           }
         },
         "required": [
@@ -32003,6 +32101,10 @@
           "account": {
             "type": "string",
             "maxLength": 12
+          },
+          "org": {
+            "type": "string",
+            "maxLength": 39
           }
         },
         "additionalProperties": false
@@ -34325,9 +34427,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 536,
-  "x-schema-count": 575,
+  "x-endpoint-count": 538,
+  "x-schema-count": 576,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 381,
+  "x-response-schemas": 382,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 536 endpoints across 95 route files.
+> **Generated from the live route files** — the route file is authoritative. 538 endpoints across 95 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -286,14 +286,16 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/gate-approvals` | `metic+archon` | — | GET /gate-approvals — open PRs awaiting owner approval (gate-review red), with the verdict + per-file reasons + changed files + diff link. |
 | POST | `/api/bongos/gate-approvals/:pr/approve` | `archon` | — | POST /gate-approvals/:pr/approve — record owner approval for a stuck gate PR and re-run the gate-review check so it clears. |
 
-## `github` (4)
+## `github` (6)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
+| GET | `/api/bongos/github/orgs` | `any-builder` | — | the caller's OWN GitHub organisations (task 1004651), for the project page's "on an organisation" choice. |
+| GET | `/api/bongos/github/orgs/:org` | `any-builder` | — | checks ONE organisation name the caller typed, as their own GitHub credential sees it (task 1004651). |
 | GET | `/api/bongos/github/repo` | `any-builder` | — | reads one repo AS the caller's own GitHub credential sees it (the manage page's repo-visibility read, task 1003045). |
 | POST | `/api/bongos/github/repo/visibility` | `any-builder` | `repo`, `visibility` | flips one of the caller's repos PUBLIC, with their own credential. |
 | GET | `/api/bongos/github/repos` | `any-builder` | — | acts only on the caller's OWN GitHub identity (the token they granted). |
-| POST | `/api/bongos/github/repos` | `any-builder` | `name` | creates a repo in the caller's OWN account. |
+| POST | `/api/bongos/github/repos` | `any-builder` | `name`, `org` | creates a repo in the caller's OWN account, or (task 1004651) under an organisation they name in `org`. |
 
 ## `goal-task-relevance` (2)
 
@@ -663,7 +665,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | PATCH | `/api/bongos/provisioning/instances/:id/env-manifest/:varId` | `any-builder` | `name`, `description`, `environments`, `required` | PATCH — edit one declaration. |
 | DELETE | `/api/bongos/provisioning/instances/:id/env-manifest/:varId` | `any-builder` | — | DELETE — remove one declaration. |
 | POST | `/api/bongos/provisioning/instances/:id/force-teardown` | `metic+archon` | — | POST /provisioning/instances/:id/force-teardown — Archon tears down ANY instance. |
-| POST | `/api/bongos/provisioning/instances/:id/github-app` | `any-builder` | `account` | POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 01… |
+| POST | `/api/bongos/provisioning/instances/:id/github-app` | `any-builder` | `account`, `org` | POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 01… |
 | GET | `/api/bongos/provisioning/instances/:id/invite-suggestions` | `any-builder` | — | ── Who is worth inviting (BV1.R28, task 1002347, goal 1000046 C6) ──────── GET /provisioning/instances/:id/invite-suggestions — turn the … |
 | PUT | `/api/bongos/provisioning/instances/:id/logo` | `any-builder` | `image_b64`, `content_type` | PUT …/logo — rank: any authenticated builder (own resource; archon may change any). |
 | DELETE | `/api/bongos/provisioning/instances/:id/logo` | `any-builder` | validated | DELETE …/logo — rank: any authenticated builder (own resource; archon may change any). |