@bongos/core 1.23.22 → 1.24.1

package/.claude/skills/blocker-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: blocker-review
 description: >-
-  Daily review of open blockers: resolve, escalate or note; resolving auto-promotes linked tasks. Metic+. Triggers: "/blocker-review", "review blockers", "what's stuck on me", "what's stuck on Lars", "check blockers", a scheduled daily run.
+  Review open blockers daily: resolve (auto-promotes linked tasks), escalate or note. Metic+. Triggers: "/blocker-review", "review blockers", "what's stuck on me", "what's stuck on Lars", "check blockers", a scheduled daily run.
 plain: >-
   Goes through everything the project is stuck on, one item at a time, so each can be cleared, passed up, or noted as still stuck.
 reach-for: >-
@@ -47,6 +47,14 @@ node scripts/bongos/api.js GET /api/bongos/blockers
 
 If the list is empty, print "no open blockers — nothing to review today" and exit.
 
+**"What's stuck on me" reads the per-person list instead (task 1004999).** A blocker has no assignee; who it waits on is the seat its ask names (owner, a building's Lead, a board), resolved to people by the same routing the City uses. When the builder asks what is stuck on THEM, fetch only theirs, and name each one's seat ("as the owner", "as the Planning Lead"):
+
+```
+node scripts/bongos/api.js GET /api/bongos/government/blockers/for-me
+```
+
+For "what's stuck on <name>", read `GET /api/bongos/government/blockers/people` and take that person's group. Never frame every blocker as the owner's: one routed to a Lead is the Lead's.
+
 **Step 2 — walk the list, blocker by blocker.**
 
 Present each blocker with:

package/.claude/skills/blocker-solve/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: blocker-solve
 description: >-
-  Drive ONE blocker to done and auto-close it, handing the owner-only parts back as precise steps. Unlike /blocker-review, which walks the whole list. Metic+ only. Triggers: "/blocker-solve N", "solve blocker N", "fix the thing blocking task M".
+  Drive ONE blocker to done and auto-close it, handing owner-only parts back as precise steps (/blocker-review walks the list). Metic+. Triggers: "/blocker-solve N", "solve blocker N", "fix the thing blocking task M".
 plain: >-
   Takes one thing the project is stuck on and works it through to the end, handing back as clear steps anything only the owner can do.
 reach-for: >-

package/.claude/skills/builder-claim/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: builder-claim
 description: >-
-  Atomically claim a task by id. Refuses if already claimed, not ready, or holding unshipped dependencies; a touches[] overlap only warns. Triggers: "/builder-claim N", "claim task N", "I'll work on N", or picking one after /builder-start.
+  Claim a task by id. Refuses if claimed, not ready, or deps unshipped; a touches[] overlap only warns. Triggers: "/builder-claim N", "claim task N", "I'll work on N", or picking one after /builder-start.
 plain: >-
   Reserves a task for you, so nobody else works on the same thing at the same time.
 reach-for: >-

package/.claude/skills/builder-reauth/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: builder-reauth
 description: >-
-  Refresh an expired Bongos CLI session the UI-first way. Triggers: "/builder-reauth", "re-auth", "refresh my session", "my Bongos session expired", "re-issue my CLI token", or any /builder-* failing with "Bongos CLI session is no longer valid".
+  Refresh an expired Bongos CLI session, UI-first. Triggers: "/builder-reauth", "re-auth", "refresh my session", "my Bongos session expired", "re-issue my CLI token", or any /builder-* failing with "Bongos CLI session is no longer valid".
 plain: >-
   Signs your assistant back in when its sign-in to the project has expired.
 reach-for: >-

package/.claude/skills/builder-redteam/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: builder-redteam
 description: >-
-  File a red-team or vulnerability report (severity, repro, expected vs actual) for the Archon. Metic+ only. Triggers: "/builder-redteam", "I found a security issue", "redteam report", "file a vuln", or describing a flaw in the system's own walls.
+  File a red-team or vulnerability report (severity, repro, expected vs actual) for the Archon. Metic+. Triggers: "/builder-redteam", "I found a security issue", "redteam report", "file a vuln", or describing a flaw in the system's own walls.
 plain: >-
   Files a private report about a security weakness you found, for the project's leads to see.
 reach-for: >-

package/.claude/skills/builder-sequence/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: builder-sequence
 description: >-
-  Work a dependency chain from one kickoff: claim, build, ship, repeat; --goal N scopes it. Triggers: "/builder-sequence N", "work the chain from task N", "continue goal N", "let's tackle goal N", "run goal N end to end".
+  Work a dependency chain: claim, build, ship, repeat; --goal N scopes it. Triggers: "/builder-sequence N", "work the chain from task N", "continue goal N", "let's tackle goal N", "run goal N end to end".
 plain: >-
   Works through a chain of related tasks in order, finishing each one completely before starting the next.
 reach-for: >-

package/.claude/skills/builder-setup/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: builder-setup
 description: >-
-  One-time builder setup: GitHub sign-in and a stored CLI session token; asks which account if another is signed in. Triggers: "/builder-setup", "set up builder", "register me", "set up Bongos", or any /builder-* failing with "no Bongos session".
+  One-time builder setup: GitHub sign-in and a stored CLI token; asks which account if another is signed in. Triggers: "/builder-setup", "set up builder", "register me", "set up Bongos", or any /builder-* failing with "no Bongos session".
 plain: >-
   Connects your assistant to the project for the first time, using your GitHub account to sign in.
 reach-for: >-

package/.claude/skills/builder-ship/SKILL.md

@@ -22,7 +22,7 @@ The CLI drives a **three-state lifecycle** with a subagent grader between states
 2. **`confirmed`** — smoke green + the subagent grader passed. **Verified, but not yet paid** — no credits land here ([ADR 0120](../../../docs/adr/0120-pay-on-land-and-builder-owned-rebase-gate.md) pays on land, not on confirm). If the grade fails, the task stays at `completed` for human follow-up.
 3. **`shipped`** — the branch is merged into `main` + deployed (visible in production). The claim is released and the task is stamped `shipped_at` + `shipped_by`. **Credits land here**, as `credit_log.reason = 'task.shipped'` (a trigger updates `builders.total_credits`). If this step fails (conflicts, smoke red), the task stays at `confirmed` for `/merge-mode` to land later.
 
-   > **What actually pays depends on the instance's reward mode** ([ADR 0146](../../../docs/adr/<redacted><redacted>.md)). The default `cost-plus-and-estimate` books both the per-task estimate and the cost-plus session reward. **Cloud Bongos runs `cost-plus-only`**, so the per-task `credits_reward` estimate is *never* paid here — it is an advertised guide only, and the cost-plus session reward (`round(true_cost_usd × 1.20)`) is the sole equity stream. A `Credits +0` on the ship card is expected on this instance, not a bug.
+   > **What actually pays depends on the instance's reward mode** ([ADR 0146](../../../docs/adr/<redacted><redacted>.md)). The default `cost-plus-and-estimate` books both the per-task estimate and the cost-plus session reward. **Cloud Bongos runs `cost-plus-only`**, so the per-task `credits_reward` estimate is *never* paid here — it is an advertised guide only, and the cost-plus session reward (`round(true_cost_usd × 1.20)`) is the sole credit stream (credits are a work meter, not equity — ADR 0387). A `Credits +0` on the ship card is expected on this instance, not a bug.
 
 `/builder-ship` runs steps 1 + 2 inline; on auto-confirm it chains into step 3 (push, merge on main, smoke, deploy).
 

package/.claude/skills/collab-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: collab-review
 description: >-
-  Walk the help requests and task recommendations addressed to YOU, one decision at a time. Triggers: "/collab-review", "what have people asked me", "answer my asks", "work my collab queue", a pasted "Copy for Session Start" prompt.
+  Answer the help requests and recommendations sent to YOU, one decision at a time. Triggers: "/collab-review", "what have people asked me", "answer my asks", "work my collab queue", a pasted "Copy for Session Start" prompt.
 plain: >-
   Goes through the requests other people have sent you, such as asks for help or suggested tasks, and brings you one decision at a time.
 reach-for: >-
@@ -32,8 +32,11 @@ There is a skill for *asking* (`/ask-for-help`) and this is the one for *answeri
 ```bash
 node scripts/bongos/api.js GET /api/bongos/help-requests/for-me
 node scripts/bongos/api.js GET /api/bongos/task-recommendations/for-me
+node scripts/bongos/api.js GET /api/bongos/government/blockers/for-me
 ```
 
+The third is the open blockers whose seat resolves to the reader (as the owner, a building's Lead, or a board member; task 1004999). Each one is answered on its own blocker, not as a help request: say what it waits on and point at `/blockers`.
+
 `for-me` derives the reader's crafts from their own profile server-side. **Never send a `?craft=`** you did not first read back from `crafts` in the response — a craft param that widened rather than narrowed was the privacy hole this surface's grader found.
 
 Empty both ways → say "nothing is waiting on you" and stop. Otherwise sort **oldest `created_at` first**: age is the whole point of the queue, and the oldest ask is the one that has already cost the most.
@@ -135,6 +138,6 @@ Reviewed, decided, executed (with the ids of every write), replied to, and **lef
 
 ## Files this skill touches
 
-- Calls: `GET /api/bongos/help-requests/for-me`, `GET /api/bongos/task-recommendations/for-me`, `GET /api/bongos/tasks/:id`, `POST /api/bongos/help-requests/:id/replies`, `PATCH /api/bongos/help-requests/:id` (on instruction), `PATCH /api/bongos/task-recommendations/:id`, and the task lifecycle routes above.
+- Calls: `GET /api/bongos/help-requests/for-me`, `GET /api/bongos/task-recommendations/for-me`, `GET /api/bongos/government/blockers/for-me`, `GET /api/bongos/tasks/:id`, `POST /api/bongos/help-requests/:id/replies`, `PATCH /api/bongos/help-requests/:id` (on instruction), `PATCH /api/bongos/task-recommendations/:id`, and the task lifecycle routes above.
 - Reads: `modules/lifecycle/routes/help-requests.js` and `recommendations.js` (who may reply, who may close), `modules/hall-ui/public/collab-lib.js` (the prompt the page pastes), ADR 0330 (replies, and who may close), ADR 0187 §3 (recommend, never transfer).
 - The asking half: `/ask-for-help`. The owner's own review queue: `/blocker-review`.

package/.claude/skills/design/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: design
 description: >-
-  The UI design playbook: layouts, pages, components, design systems, the hall, status and landing. World-first: the branding pack and DESIGN.md before any taste rule. Triggers: "/design", "design this page", "let's work on the UI", a claimed ui task.
+  The UI design playbook: layouts, pages, components, design systems, hall, status, landing. World-first: branding pack and DESIGN.md before taste rules. Triggers: "/design", "design this page", "let's work on the UI", a claimed ui task.
 plain: >-
   The guided way to design or change how a page or screen looks, starting from the project's own style.
 reach-for: >-

package/.claude/skills/goal-create/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: goal-create
 description: >-
-  Plan and create ONE goal (a module-scoped workspace) with its criteria and seed tasks, or spec one made in the hall. Metic+. Triggers: "/goal-create", "create a goal", "what goal should this live in", "spec goal N", a task created with no goal.
+  Plan and create ONE goal (module-scoped) with criteria and seed tasks, or spec a hall-made one. Metic+. Triggers: "/goal-create", "create a goal", "what goal should this live in", "spec goal N", a task created with no goal.
 plain: >-
   Helps you set up a new goal: what it is for, how you will know it is done, and the first tasks to get there.
 reach-for: >-
@@ -73,7 +73,7 @@ Everything here is your call. It is presented in Phase 4 as a proposal, not as q
 - **`category_id`** — the goal's HUMAN category (task 1003277; ADR 0192 — advisory, it gates nothing). Read the live set with `GET /api/bongos/work-categories` (never hard-code the labels), infer the best fit from the goal's outcome and its `scope_modules`, and state your pick in the Phase-4 approval round like every other drafted field. **When nothing in the set fits, that is a designed prompt, not an error**: do NOT silently pick the nearest, and do NOT leave it null and move on — surface the gap in the gray-area round and offer to create a new category (`POST /api/bongos/work-categories` with `{"label":"..."}`; a duplicate slug converges on the existing row), then use it. Creating uncategorised stays legal — if the user declines to name one, POST the goal without `category_id` and note that the 201 body will carry a `category_advisory` reminding whoever looks next.
 - **`succeeds_goal_id`** — set it when carrying an achieved goal forward. `POST /goals` validates the predecessor exists *before* creating, so a bad ref can't orphan a goal; it then stamps the predecessor's `succeeded_by_goal_id`. Archiving the predecessor is a **separate** call.
 - **Criteria — 2 to 4.** A goal's criteria are narrower than a version's: each should plausibly anchor 2–5 tasks. Draft `criterion_id` as a stable kebab slug (position-independent, and what `criterion_ids` on `POST /tasks` should reference); `criterion_md` is the outcome prose.
-- **Seed tasks — 3 to 8.** Per criterion, with `kind`, a one-line done-when, `criterion_ids: ["<slug>"]`, and dependency edges. Omit `touches[]` (advisory, ADR 0049 — backfilled from the real diff at ship). Never hand-set `requires_rank`: it auto-derives (ADR 0084) from `needs_migration` and the goal's own scope wall, neither of which needs a prediction (ADR 0270). **Make sure `needs_migration` is true on any task that will alter the live database** — it is the input that floors such a task at Metic, and leaving it false is how a schema change lands in the open queue. `POST /tasks` does **not** accept the field (400 `unknown_field`): it infers it from the title and description, so say "migration" or "schema" there, then re-read the created task and, if the guess missed, set it with `PATCH /tasks/<id> {"needs_migration": true}`. **Give every seed task a `discipline`** (`engineer | artist | ideator | ui`): when it is omitted the route infers it from the text, and a task it cannot place is refused 400 `bad_discipline`. Proof tasks use `kind='verify'`; exploration uses `kind='spike'` (and spikes are deliberately left in backlog).
+- **Seed tasks — 3 to 8.** Per criterion, with `kind`, a one-line done-when, `criterion_ids: ["<slug>"]`, and dependency edges. Omit `touches[]` (advisory, ADR 0049 — backfilled from the real diff at ship). Never hand-set `requires_rank`: it auto-derives (ADR 0084) from `needs_migration` and the goal's own scope wall, neither of which needs a prediction (ADR 0270). **Make sure `needs_migration` is true on any task that will alter the live database** — it is the input that floors such a task at Metic, and leaving it false is how a schema change lands in the open queue. `POST /tasks` does **not** accept the field (400 `unknown_field`): it infers it from the title and description, so say "migration" or "schema" there, then re-read the created task and, if the guess missed, set it with `PATCH /tasks/<id> {"needs_migration": true}`. **Give every seed task a `discipline`** (`engineer | artist | ideator | ui`): when it is omitted the route infers it from the text, and a task it cannot place is refused 400 `bad_discipline`. Proof tasks use `kind='verify'`; exploration uses `kind='spike'` (and spikes are deliberately left in backlog). **Say what a task needs** when it needs more than the build loop: `"needs": ["owner"]` for a decision, account or permission only the project owner holds, `"needs": ["server"]` for hands-on work on the live host (DNS, secrets, the database by hand), both if both; omit it otherwise (most tasks). It narrows who is SHOWN the task, never who may read it (ADR 0395).
 
 ## Phase 4 — Ask, then get sign-off
 

package/.claude/skills/grade-recover/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: grade-recover
 description: >-
-  Diagnose why a ship parked at completed (grader outage, fabricated fail, or a real quality fail) and run the right recovery. Triggers: "/grade-recover N", "my grade failed", "grader unavailable", or a ship that landed at completed.
+  Diagnose why a ship parked at completed (grader outage, fabricated fail or real fail) and run the right recovery. Triggers: "/grade-recover N", "my grade failed", "grader unavailable", or a ship that landed at completed.
 plain: >-
   Works out why a quality review held your work back, whether the reviewer broke, got it wrong, or found a real problem, and takes the right next step.
 reach-for: >-

package/.claude/skills/merge-mode/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: merge-mode
 description: >-
-  Manual fallback for the /builder-ship auto-merge: walks each confirmed task through merge, smoke and deploy. Triggers: "/merge-mode", "merge the queue", "land confirmed tasks", "land the queue", or a /builder-ship that reported the auto-merge bailed.
+  Manual fallback for the /builder-ship auto-merge: walks each confirmed task through merge, smoke, deploy. Triggers: "/merge-mode", "merge the queue", "land confirmed tasks", "land the queue", or a /builder-ship whose auto-merge bailed.
 requires: [main-checkout, push-credential, gh, droplet-ssh]
 plain: >-
   The manual backup for finishing hand-ins: it takes approved work that did not merge by itself and puts it live.

package/.claude/skills/owner-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: owner-review
 description: >-
-  The owner's review in one walk: backlog (what needs a go), bugs (dedupe), ideas (promote, drop, merge), then priorities. Metic+. Triggers: "/owner-review", "review the backlog", "triage bugs", "triage ideas", "review the inbox", "reprioritize".
+  The owner's review in one walk: backlog, bugs, ideas, then priorities. Metic+. Triggers: "/owner-review", "review the backlog", "triage bugs", "triage ideas", "review the inbox", "reprioritize".
 plain: >-
   One place to go through everything waiting on you: work that needs a go-ahead, reported problems, new ideas, and what matters most next.
 reach-for: >-

package/.claude/skills/planning-session/SKILL.md

@@ -285,7 +285,7 @@ This is what the V3.R02 (task 309) dependency system encodes; Phase 5 writes bot
 
 Once the spec is finalized (Phase 4), **read `docs/specs/<ver>-<goal-slug>.md` as the source of truth** and do the writes in this exact order.
 
-**Probe the session right before the first write, and recover on a 401 (task 1002865).** Call `GET /api/bongos/me` again here: a session that passed the gate at Phase 1 can expire during a long interview (the retro that filed this: 200 at the gate, 401 by Phase 5). If the probe — or ANY write below — answers `401` / "session is no longer valid", **do not abandon the session**: tell the builder to run `/builder-reauth`, wait for it, then **resume** from the write that failed. Everything the session decided is already in the spec file (Phase 4 spooled it), and the writes are idempotent — the meta task and every seeded task on `source_ref`, criteria on `criterion_id` (a 409 means already seeded), dependencies on `(task_id, depends_on_task_id)` — so re-running the seed script after a re-auth creates nothing twice. (If the goal and its criteria already exist — e.g. this session planned tasks for a pre-existing goal — skip the goal/criteria creation in step 2 and seed the tasks under the existing goal, linking them via `criterion_ids` + `goal_id`.)
+**Probe the session right before the first write, and recover on a 401 (task 1002865).** Call `GET /api/bongos/me` again here: a session that passed the gate at Phase 1 can expire during a long interview (the retro that filed this: 200 at the gate, 401 by Phase 5). If the probe — or ANY write below — answers `401` / "session is no longer valid", **do not abandon the session**: tell the builder to run `/builder-reauth`, wait for it, then **resume** from the write that failed. Everything the session decided is already in the spec file (Phase 4 spooled it), and the writes are idempotent — the meta task and every seeded task on `source_ref`, criteria on `criterion_id` (a 409 means already seeded), dependencies on `(task_id, depends_on_task_id)` — so re-running `seed-tasks.js` after a re-auth creates nothing twice. (If the goal and its criteria already exist — e.g. this session planned tasks for a pre-existing goal — skip the goal/criteria creation in step 2 and seed the tasks under the existing goal, linking them via `criterion_ids` + `goal_id`.)
 
 1. **Create a meta planning-session task** (`source_ref='<ver>-planning-N'`) that backs all the writes — version='<ver>', kind='decision', status='ready', priority=5, the full session described in its body. Claim it. (For a long session — a big spec + a multi-round interview — create and claim this meta task **early, at Phase 1**, so the spec-write and interview are themselves covered by a claim. A rebase-gated builder can't claim new work; as Archon, proceed and record the session in the meta task even if the claim is blocked, noting it.)
 
@@ -303,20 +303,20 @@ Once the spec is finalized (Phase 4), **read `docs/specs/<ver>-<goal-slug>.md` a
      - **For a brand-new version scaffolded from scratch (DR / a fresh instance):** put the `INSERT INTO done_when_criteria` (with `goal_id`, `ON CONFLICT ... DO UPDATE`) in **`migrations/instance/<NN>_<ver_slug>_planning_seed.sql`** — and recreate the goal idempotently in the same file (the goal is a runtime row a replay won't have). Applies only under `GDS_APPLY_INSTANCE_SEEDS=1`.
    - **Migration** at `migrations/<NN>_<ver_slug>_planning_seed.sql` (CORE — platform-universal, non-scope-truth changes only): `UPDATE versions SET done_when = ...` and `UPDATE tasks` for existing-task priority + V##.R## title prefix (guarded by `WHERE title NOT LIKE 'V<ver>.R%'`). **Do NOT put versions/goals/`done_when_criteria` INSERTs here** — that's scope-truth and fails the `selfhost-boot` gate (ADR 0105).
 
-3. **Write a seed script** at `scripts/bongos/seed-<ver_slug>-tasks.js` modeled on `scripts/bongos/<redacted>.js` (or `<redacted>.js`) containing:
-   - The TASKS array — one entry per net-new task with full description, kind, discipline, priority, est_minutes, manual_degree, credits_reward, **optional** `touches` (see below), optional `promoted_idea_id`, `depends_on_refs: ['R##', ...]` (the dep edges captured during brainstorm), AND **`criterion_ids: ['Cn', ...]`** — the done-when criterion(s) this task gates. The brainstorm in Phase 3 is already grouped by criterion, so this is just transcribing that grouping. **Use the criterion_id SLUG, not a positional `"Cn"` token.** `Cn` ranks over the whole VERSION's criteria, so on a version holding more than one goal it resolves to some other goal's criterion — which is how all 15 tasks of goal 1000071 were mislinked while the seed printed success (learning 1000188). Since task 1003108 the server **refuses** a positional ref on a multi-goal version (`400 ambiguous_criterion_ref`) rather than guessing, so a slug is the only ref that works there. The server resolves it against the task's version at create (ADR 0025 / task 438). **This replaces the old `**Criterion:** Cn` prose** — don't write that line anymore; pass `criterion_ids` instead so the task is linked in `task_criteria` at creation and `/status` counts it with no backfill.
+3. **Write a seed spec** — a JSON file for `scripts/bongos/seed-tasks.js`, the one task seeder (task 1004979; it replaced the per-version seed scripts sessions used to copy). Start from `scripts/bongos/seed-tasks.example.json`; the three historical seeds live on as specs under `tests/fixtures/seed-tasks/`. Keep the spec out of the repo unless the session wants it recorded. It holds `version_id`, `goal_id`, a per-seed `source_ref_prefix`, optional `promote: ['R##', ...]` and `links[]` (follow-up writes), and:
+   - `tasks[]` — one entry per net-new task: `ref`, `title`, full `description`, `kind`, `discipline`, `priority`, optional `est_minutes` / `manual_degree` / `credits_reward` / `requires_rank`, **optional** `touches` (see below), `deps: ['R##', ...]` (the dep edges captured during brainstorm), AND **`criterion_ids: ['<slug>', ...]`** — the done-when criterion(s) this task gates. The brainstorm in Phase 3 is already grouped by criterion, so this is just transcribing that grouping. **Use the criterion_id SLUG, not a positional `"Cn"` token.** `Cn` ranks over the whole VERSION's criteria, so on a version holding more than one goal it resolves to some other goal's criterion — which is how all 15 tasks of goal 1000071 were mislinked while the seed printed success (learning 1000188). Since task 1003108 the server **refuses** a positional ref on a multi-goal version (`400 ambiguous_criterion_ref`) rather than guessing, so a slug is the only ref that works there. The server resolves it against the task's version at create (ADR 0025 / task 438). **This replaces the old `**Criterion:** Cn` prose** — don't write that line anymore; pass `criterion_ids` instead so the task is linked in `task_criteria` at creation and `/status` counts it with no backfill.
    - **`touches` is now OPTIONAL (task 882 / [ADR 0049](../../../docs/adr/0049-split-parallel-safety-contract.md)).** Omit it (or leave it blank) unless you already know a tight file set and want the advisory overlap signal during the brainstorm. At first `/builder-ship` the server backfills `touches[]` from the real committed diff — the declared set becomes what git actually reported. Don't burn planning effort predicting file lists; a rough or absent prediction is fine and no longer ship-blocking.
    - **`requires_rank` AUTO-DERIVES — you don't hand-set it per task (task [#1498](https://example.com/builders#/task/1498) / [ADR 0084](../../../docs/adr/0084-auto-derived-per-task-rank-floor.md)).** On create the server floors a task at `metic` when it is `security_sensitive` or its `touches` reach the permission / authz / ship-grade / deploy / migration core (the same protected paths a sub-Metic builder can't push to); everything else stays the open `xenos` default. To deliberately gate a task **higher** than the auto-floor (e.g. owner-only work), pass `requires_rank: 'metic' | 'archon'` on the task — it can only RAISE the floor, never drop below it.
-   - **Pass `goal_id: <gid>` on each task** so it lands under its goal (not the version's default catch-all). `POST /tasks` now honors `goal_id` (validated to belong to the version); to move an already-created task, `PATCH /tasks/:id` with `{goal_id}` (task 1763). `criterion_ids` accepts a **slug** (the `criterion_id` you set above), a numeric id, or a `"Cn"` position — **but `Cn` is rejected outright once the version holds a second goal**, and a version almost always gains one. Treat the slug as the only form you write.
-   - A main() that POSTs each task **with its `criterion_ids`** (idempotent on `source_ref`; the criterion links are inserted at create, idempotent on `(task_id, criterion_id)`), PATCHes `idea_inbox` for promotions, and after all tasks exist, POSTs `task_dependencies` via `POST /tasks/:id/dependencies` (resolving each R## to the just-created task ID). Idempotent on `(task_id, depends_on_task_id)`. (Need to re-attribute an already-seeded task? `POST /tasks/:id/criteria` with `{criterion_ids:['Cn',...]}`; `DELETE /tasks/:id/criteria/:criterionId` to detach — both Metic+ ([ADR 0090](../../../docs/adr/0090-metic-task-authoring.md)), mirroring the dependency endpoints.)
+   - **The spec's `goal_id` is sent on each task** so it lands under its goal (not the version's default catch-all). `POST /tasks` now honors `goal_id` (validated to belong to the version); to move an already-created task, `PATCH /tasks/:id` with `{goal_id}` (task 1763). `criterion_ids` accepts a **slug** (the `criterion_id` you set above), a numeric id, or a `"Cn"` position — **but `Cn` is rejected outright once the version holds a second goal**, and a version almost always gains one. Treat the slug as the only form you write.
+   - **You write no HTTP code.** `seed-tasks.js` POSTs each task **with its `criterion_ids`** (idempotent on `source_ref`; the criterion links are inserted at create, idempotent on `(task_id, criterion_id)`), and after all tasks exist, POSTs `task_dependencies` via `POST /tasks/:id/dependencies` (resolving each R## to the just-created task ID; idempotent on `(task_id, depends_on_task_id)`), then the `promote` list, then `links[]`. Mark a promoted idea with a link: `{"method":"PATCH","path":"/inbox/<idea>","body":{"status":"promoted","promoted_to_task_id":{"$task":"R##"}}}` — the `$task` value becomes that ref's task id. It refuses a positional `"Cn"` ref before its first write. Run `node scripts/bongos/seed-tasks.js <spec.json> --dry-run` first: it validates the spec and prints the plan, and files nothing. (Need to re-attribute an already-seeded task? `POST /tasks/:id/criteria` with `{criterion_ids:['Cn',...]}`; `DELETE /tasks/:id/criteria/:criterionId` to detach — both Metic+ ([ADR 0090](../../../docs/adr/0090-metic-task-authoring.md)), mirroring the dependency endpoints.)
 
-> **Seeding contract — validated on goal 1000045 (2026-07-16):** proof-tasks use `kind='verify'` (a deliverable that IS a verification; can't be prematurely confirmed), spikes `kind='spike'`; `POST /tasks` accepts `criterion_ids` + `goal_id` inline and disciplines include `ui`; there is **no `promoted_idea_id`** field on `POST /tasks` — mark a promoted idea via `PATCH /inbox/:id`; **descoping a criterion has no API** (done-when is create/satisfy/unsatisfy only) — remove the row via a direct DB delete (`ssh … "sudo -u postgres psql -d <db> -c \"DELETE FROM done_when_criteria WHERE id=…\""`) under the meta-task claim, capturing the SQL in its notes; and a seed script **must throttle + honor `429` `retry_after`** (per-IP rate limit) — add a base delay between calls and back off on 429, or a large seed dies halfway. A completed reference seed: `scripts/bongos/<redacted>.js`.
+> **Seeding contract — validated on goal 1000045 (2026-07-16):** proof-tasks use `kind='verify'` (a deliverable that IS a verification; can't be prematurely confirmed), spikes `kind='spike'`; `POST /tasks` accepts `criterion_ids` + `goal_id` inline and disciplines include `ui`; there is **no `promoted_idea_id`** field on `POST /tasks` — mark a promoted idea via `PATCH /inbox/:id`; **descoping a criterion has no API** (done-when is create/satisfy/unsatisfy only) — remove the row via a direct DB delete (`ssh … "sudo -u postgres psql -d <db> -c \"DELETE FROM done_when_criteria WHERE id=…\""`) under the meta-task claim, capturing the SQL in its notes; and a seed **must throttle + honor `429` `retry_after`** (per-IP rate limit) or a large seed dies halfway — `seed-tasks.js` waits 400 ms between calls and backs off on 429. A completed reference seed: `tests/fixtures/seed-tasks/bv1-profiles.json`.
 >
-> **Every seed script verifies its own criterion links — fail loudly on any mismatch, zero included (task 1003076, retro on goal 1000071).** The goal-1000071 seeder linked all 15 tasks to the WRONG criteria (a positional `"Cn"` token resolved against the whole VERSION's criterion order, not the goal's — learning 1000188) and still printed success; only a manual `GET /goals` rollup caught it, after the fact. Every seed script's `main()` must end by tallying the `criterion_ids` it actually POSTed per task, then calling `verifySeedCriteriaLinks` from [`scripts/bongos/seed-verify-criteria.js`](../../../scripts/bongos/seed-verify-criteria.js) — it fetches `GET /api/bongos/goals/<id>`, diffs the returned `criteria[].linked_tasks` against that plan, and `exit(1)`s with a loud per-criterion diff on any mismatch (see `expectedCriterionCounts` + `verifySeedCriteriaLinks`). Reference implementation: `scripts/bongos/<redacted>.js`. **Seeding into a goal that already has linked tasks?** Call `baselineSeedCriteria` BEFORE the first write and pass its result as `baseline` to the verify (task 1004668; reference: `scripts/bongos/<redacted>.js`) — the check then covers every criterion on the goal, pre-existing counts included, and still catches a stray link on one the seed never meant to touch. With a baseline, tally only the tasks this run CREATED — skip any create that answers `idempotent: true`, since a re-run's replayed task is already inside the baseline and counting it again expects its links twice. Without a baseline only the plan's own criteria are checked. This is a script-level check, independent of whatever caused the mislink — it catches the *symptom* (a criterion silently under- or over-linked) whichever bug produces it.
+> **Every seed verifies its own criterion links — fail loudly on any mismatch, zero included (task 1003076, retro on goal 1000071).** The goal-1000071 seeder linked all 15 tasks to the WRONG criteria (a positional `"Cn"` token resolved against the whole VERSION's criterion order, not the goal's — learning 1000188) and still printed success; only a manual `GET /goals` rollup caught it, after the fact. Every seed must end by tallying the `criterion_ids` it actually POSTed per task, then calling `verifySeedCriteriaLinks` from [`scripts/bongos/seed-verify-criteria.js`](../../../scripts/bongos/seed-verify-criteria.js) — it fetches `GET /api/bongos/goals/<id>`, diffs the returned `criteria[].linked_tasks` against that plan, and `exit(1)`s with a loud per-criterion diff on any mismatch (see `expectedCriterionCounts` + `verifySeedCriteriaLinks`). Reference implementation: `scripts/bongos/seed-tasks.js`, which does all of this for every spec unless the spec sets `"verify_criteria": false`. **Seeding into a goal that already has linked tasks?** `seed-tasks.js` calls `baselineSeedCriteria` BEFORE the first write and passes its result as `baseline` to the verify (task 1004668) — the check then covers every criterion on the goal, pre-existing counts included, and still catches a stray link on one the seed never meant to touch. With a baseline, tally only the tasks this run CREATED — skip any create that answers `idempotent: true`, since a re-run's replayed task is already inside the baseline and counting it again expects its links twice. Without a baseline only the plan's own criteria are checked. This is a script-level check, independent of whatever caused the mislink — it catches the *symptom* (a criterion silently under- or over-linked) whichever bug produces it.
 
 4. **Apply the migration** (commit + push + deploy, or direct psql via SSH for hot-fix style).
 
-5. **Run the seed script.** Verify exit code 0 — the seed's own final step (the Seeding contract's `verifySeedCriteriaLinks` call, above) already fails loudly if any criterion's linked task count doesn't match the plan, so a 0 exit means the links landed correctly, not just that the POSTs didn't error. Also spot-check totals via `GET /api/bongos/public/progress` and `GET /api/bongos/versions/<ver>/done-when`.
+5. **Run the seed:** `node scripts/bongos/seed-tasks.js <spec.json>`. Verify exit code 0 — the seed's own final step (the Seeding contract's `verifySeedCriteriaLinks` call, above) already fails loudly if any criterion's linked task count doesn't match the plan, so a 0 exit means the links landed correctly, not just that the POSTs didn't error. Also spot-check totals via `GET /api/bongos/public/progress` and `GET /api/bongos/versions/<ver>/done-when`.
 
 6. **Promote the zero-dep layer to `ready` — scoped to the tasks you just seeded, and only what is still at `backlog`.** Do **not** assume the seed landed at `backlog`: read the seeded rows' statuses and report them (task 1004668). `POST /tasks` answers `backlog`, but the reconciler's backlog sweep (`PROMOTABLE_BACKLOG_WHERE` in `modules/lifecycle/db-tasks.js`, task 1003932) promotes any task with no unmet dependency and no open blocker within about a minute — seeding 27 tasks into goal 1000095 found 24 already at `ready`, spikes included, and the promote below had almost nothing to do. A zero-dep task the sweep has not reached yet is the only thing this step is for.
 
@@ -328,7 +328,7 @@ Once the spec is finalized (Phase 4), **read `docs/specs/<ver>-<goal-slug>.md` a
 
    Both are ordinary carry-overs in any version that has been live for a while, so the blast radius grows the longer an instance runs.
 
-   Every seed script POSTs with `source: 'planning-session'` and a per-seed `source_ref` prefix (see `scripts/bongos/<redacted>.js`), which is the handle to scope by — it needs no id transcription and cannot drift from what the seed actually created. **Dry-run the SELECT first and read the rows**, in the same psql session as the migration (or via SSH to the droplet):
+   Every seed POSTs with `source: 'planning-session'` and a per-seed `source_ref` prefix (`seed-tasks.js` sends `<source_ref_prefix>-<ref>`), which is the handle to scope by — it needs no id transcription and cannot drift from what the seed actually created. **Dry-run the SELECT first and read the rows**, in the same psql session as the migration (or via SSH to the droplet):
 
    ```sql
    SELECT id, title, priority, kind
@@ -377,7 +377,7 @@ Once the spec is finalized (Phase 4), **read `docs/specs/<ver>-<goal-slug>.md` a
 
    If the query returns nothing, stay silent. Don't volunteer info about lower-priority spikes — the next planning session or `/idea-triage` walk will handle those at the right moment.
 
-8. **Commit + push** the spec file (`docs/specs/<ver>-<goal-slug>.md`) + the migration + seed script + any new skill files + the session-log entry.
+8. **Commit + push** the spec file (`docs/specs/<ver>-<goal-slug>.md`) + the migration + the seed spec (if the session keeps it) + any new skill files + the session-log entry.
 
 9. **Ship the meta task** via `/builder-ship` with a clean value-summary.
 
@@ -395,7 +395,7 @@ node scripts/bongos/api.js GET /api/bongos/inbox
 node scripts/bongos/api.js GET /api/bongos/versions/<id>/done-when
 ```
 
-Phase 5 writes use the same `POST /tasks`, `PATCH /inbox/:id` shape as `idea-triage` and `scripts/bongos/<redacted>.js`. Mirror those patterns rather than inventing new ones.
+Phase 5 writes use the same `POST /tasks`, `PATCH /inbox/:id` shape as `idea-triage` and `scripts/bongos/seed-tasks.js`. Mirror those patterns rather than inventing new ones.
 
 ## Tone for the user
 

package/.claude/skills/read-session-export/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: read-session-export
 description: >-
-  Read a Claude Code /export zip to answer questions about a past session; never creates one. Triggers: a dropped session-export-*.zip, "read/summarize this session", "what happened in this session", "what was I/you thinking", "/read-session-export".
+  Read a Claude Code /export zip to answer questions about a past session; never makes one. Triggers: a dropped session-export-*.zip, "read/summarize this session", "what happened in this session", "what was I/you thinking", "/read-session-export".
 plain: >-
   Reads a saved copy of a past conversation with your assistant and answers questions about what happened in it.
 reach-for: >-

package/.claude/skills/recall/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: recall
 description: >-
-  Read-only, rank-scoped search over repo docs and DB prose; use it instead of grepping. Triggers: "/recall", "what do we know about X", "have we done X before", "did a past session hit X", "search the docs/ADRs for X", "is there an ADR about X".
+  Read-only, rank-scoped search of repo docs and DB prose; use it instead of grepping. Triggers: "/recall", "what do we know about X", "have we done X before", "did a past session hit X", "search the docs/ADRs for X", "is there an ADR about X".
 plain: >-
   Searches everything the project already knows, its documents and past decisions, in one go.
 reach-for: >-

package/.claude/skills/scan-before-install/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: scan-before-install
 description: >-
-  Vet a third-party GitHub repo or Claude plugin BEFORE installing: quarantined fetch, deterministic floor, subagent panel, verdict. Never installs. Triggers: "/scan-before-install", "is this plugin safe to install", "vet this GitHub repo".
+  Vet a third-party GitHub repo or Claude plugin BEFORE installing (quarantined fetch, checks, subagent panel, verdict); never installs. Triggers: "/scan-before-install", "is this plugin safe to install", "vet this GitHub repo".
 plain: >-
   Checks an outside add-on or code project for safety problems before you install it.
 reach-for: >-

package/.claude/skills/session-handoff/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: session-handoff
 description: >-
-  Emit a paste-ready next-steps prompt so a FRESH session starts with curated context. Triggers: "/session-handoff", "hand off to a fresh session", "give me a handoff prompt", "wrap up context for next time", "continue this in a new session".
+  Emit a paste-ready prompt so a FRESH session starts with curated context. Triggers: "/session-handoff", "hand off to a fresh session", "give me a handoff prompt", "wrap up context for next time", "continue this in a new session".
 plain: >-
   Writes a ready-to-paste note so a fresh conversation can pick up exactly where this one left off.
 reach-for: >-

package/.claude/skills/strand-fix/SKILL.md

@@ -19,6 +19,18 @@ You are landing one stranded task. The reconciler is not coming back for it —
 node scripts/bongos/skill-preflight.js strand-fix   # exits 1 naming what is MISSING (gh)
 ```
 
+## Take the strand before you touch it (task 1004956)
+
+Several sessions see the same strand note. ONE fixes it; the rest are told who has it.
+
+```bash
+node scripts/bongos/strand-lease.js take N   # exit 0: it is yours · exit 3: another session has it
+```
+
+- **Exit 3** — it prints which session holds it. **Stop here**: leave that strand to that session and go back to your own work. Do not walk it in parallel. The hold runs out by itself (45 minutes after its last renewal) if that session stops, and the next startup note will offer it again.
+- **Exit 0** — it is yours. Run `take N` again before each slow step (a merge, a test run, a ship) to renew it; renewing is how other sessions know you are still on it.
+- Landing it (`ship.js`) or releasing it (`release.js`) clears the hold. If you stop without either — the work needs a person, say — run `node scripts/bongos/strand-lease.js release N` so another session can try.
+
 ## Which shape is this? (read first)
 
 `node scripts/bongos/strand-watch.js --json` — find the task. Three shapes, three owners:
@@ -57,6 +69,7 @@ node scripts/bongos/skill-preflight.js strand-fix   # exits 1 naming what is MIS
 ## Rules
 
 - One task per invocation; the strand list is short and every case differs.
+- One session per strand: take the lease first, and never walk a strand another session holds.
 - Never `git push origin main`, never force-push, never re-`confirm` around the grader — the fix is always land, flip, or release.
 - Wrong shape → hand off (`/merge-mode`, `/grade-recover`) instead of improvising.
 - No claim is needed to walk someone else's strand — landing confirmed work is the reconciler's job, and this is its manual fallback (Metic+; the ship route is rank-gated server-side).

package/.claude/skills/worktree-clean/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: worktree-clean
 description: >-
-  Remove per-claim worktrees whose work landed, and sweep the husks a locked remove leaves, via junction-safe worktree.js, never raw git worktree remove. Triggers: "/worktree-clean", "prune stale worktrees", "worktree husks".
+  Remove per-claim worktrees whose work landed and sweep locked-remove husks, via junction-safe worktree.js, never raw git worktree remove. Triggers: "/worktree-clean", "prune stale worktrees", "worktree husks".
 plain: >-
   Tidies away old workspace folders on your computer whose work has already been merged.
 reach-for: >-

package/AGENTS.md

@@ -0,0 +1,15 @@
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
+
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
+
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
+
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
+
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/GEMINI.md

@@ -0,0 +1,5 @@
+# GEMINI.md
+
+Gemini: this project's rules for every AI model are in [`AGENTS.md`](AGENTS.md) — read it, then [`CLAUDE.md`](CLAUDE.md).
+
+When you need the person, start the line with `🙋 **HUMAN TASK:**` (they must do something) or `🔀 **HUMAN DECISION:**` (they must choose; list the options and mark your pick).

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 588 operations across 77 resource groups
+- 631 operations across 79 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -125,8 +125,30 @@ function createClient(opts = {}) {
       postAgentsNameInvoke: (args) => request("POST", "/agents/{name}/invoke", { hasBody: true }, args),
     },
     "aiStudio": {
+      // GET /ai-studio/balance — rank: any-builder — GET /ai-studio/balance
+      getAiStudioBalance: (args) => request("GET", "/ai-studio/balance", { hasBody: false }, args),
+      // GET /ai-studio/files/{id} — rank: any-builder — GET /ai-studio/files/:id
+      getAiStudioFilesId: (args) => request("GET", "/ai-studio/files/{id}", { hasBody: false }, args),
+      // GET /ai-studio/keys — rank: any-builder — GET /ai-studio/keys
+      getAiStudioKeys: (args) => request("GET", "/ai-studio/keys", { hasBody: false }, args),
+      // DELETE /ai-studio/keys/{provider} — rank: any-builder — DELETE /ai-studio/keys/:provider
+      deleteAiStudioKeysProvider: (args) => request("DELETE", "/ai-studio/keys/{provider}", { hasBody: false }, args),
+      // PUT /ai-studio/keys/{provider} — rank: any-builder — PUT /ai-studio/keys/:provider
+      putAiStudioKeysProvider: (args) => request("PUT", "/ai-studio/keys/{provider}", { hasBody: true }, args),
+      // GET /ai-studio/requests — rank: any-builder — GET /ai-studio/requests
+      getAiStudioRequests: (args) => request("GET", "/ai-studio/requests", { hasBody: false }, args),
+      // POST /ai-studio/requests — rank: any-builder — POST /ai-studio/requests
+      postAiStudioRequests: (args) => request("POST", "/ai-studio/requests", { hasBody: true }, args),
+      // GET /ai-studio/requests/{id} — rank: any-builder — GET /ai-studio/requests/:id
+      getAiStudioRequestsId: (args) => request("GET", "/ai-studio/requests/{id}", { hasBody: false }, args),
       // GET /ai-studio/status — rank: any-builder — GET /ai-studio/status
       getAiStudioStatus: (args) => request("GET", "/ai-studio/status", { hasBody: false }, args),
+      // POST /ai-studio/topup — rank: any-builder — POST /ai-studio/topup
+      postAiStudioTopup: (args) => request("POST", "/ai-studio/topup", { hasBody: true }, args),
+      // GET /ai-studio/topup/quote — rank: any-builder — GET /ai-studio/topup/quote
+      getAiStudioTopupQuote: (args) => request("GET", "/ai-studio/topup/quote", { hasBody: false }, args),
+      // POST /ai-studio/uploads — rank: any-builder — POST /ai-studio/uploads
+      postAiStudioUploads: (args) => request("POST", "/ai-studio/uploads", { hasBody: true }, args),
     },
     "analytics": {
       // GET /analytics/builder/{id} — rank: any-builder — GET /analytics/builder/:id
@@ -145,6 +167,10 @@ function createClient(opts = {}) {
       postAuthBackchannelLogout: (args) => request("POST", "/auth/backchannel-logout", { hasBody: true }, args),
       // POST /auth/cli-token/issue — rank: any-builder — POST /auth/cli-token/issue
       postAuthCliTokenIssue: (args) => request("POST", "/auth/cli-token/issue", { hasBody: true }, args),
+      // GET /auth/device — rank: public — GET /auth/device
+      getAuthDevice: (args) => request("GET", "/auth/device", { hasBody: false }, args),
+      // POST /auth/device/approve — rank: any-builder — POST /auth/device/approve
+      postAuthDeviceApprove: (args) => request("POST", "/auth/device/approve", { hasBody: true }, args),
       // POST /auth/device/exchange — rank: public — POST /auth/device/exchange
       postAuthDeviceExchange: (args) => request("POST", "/auth/device/exchange", { hasBody: true }, args),
       // POST /auth/device/poll — rank: public — POST /auth/device/poll
@@ -157,6 +183,10 @@ function createClient(opts = {}) {
       getAuthDiscordStart: (args) => request("GET", "/auth/discord/start", { hasBody: false }, args),
       // POST /auth/discord/unlink — rank: any-builder — POST /auth/discord/unlink
       postAuthDiscordUnlink: (args) => request("POST", "/auth/discord/unlink", { hasBody: true }, args),
+      // GET /auth/google/callback — rank: public — GET /auth/google/callback
+      getAuthGoogleCallback: (args) => request("GET", "/auth/google/callback", { hasBody: false }, args),
+      // GET /auth/google/start — rank: public — GET /auth/google/start
+      getAuthGoogleStart: (args) => request("GET", "/auth/google/start", { hasBody: false }, args),
       // POST /auth/logout — rank: any-builder — POST /auth/logout
       postAuthLogout: (args) => request("POST", "/auth/logout", { hasBody: true }, args),
       // POST /auth/revoke — rank: archon — POST /auth/revoke
@@ -233,6 +263,8 @@ function createClient(opts = {}) {
       getBuildersIdActivity: (args) => request("GET", "/builders/{id}/activity", { hasBody: false }, args),
       // PATCH /builders/{id}/budget — rank: metic+archon — PATCH /builders/:id/budget
       patchBuildersIdBudget: (args) => request("PATCH", "/builders/{id}/budget", { hasBody: true }, args),
+      // PATCH /builders/{id}/capabilities — rank: archon — PATCH /builders/:id/capabilities
+      patchBuildersIdCapabilities: (args) => request("PATCH", "/builders/{id}/capabilities", { hasBody: true }, args),
       // GET /builders/{id}/onboarding — rank: public — GET /builders/:id/onboarding
       getBuildersIdOnboarding: (args) => request("GET", "/builders/{id}/onboarding", { hasBody: false }, args),
       // GET /builders/{id}/profile — rank: public — GET /builders/:id/profile
@@ -525,6 +557,10 @@ function createClient(opts = {}) {
       postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
       // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
       deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // GET /government/blockers/for-me — rank: any-builder — GET /government/blockers/for-me
+      getGovernmentBlockersForMe: (args) => request("GET", "/government/blockers/for-me", { hasBody: false }, args),
+      // GET /government/blockers/people — rank: any-builder — GET /government/blockers/people
+      getGovernmentBlockersPeople: (args) => request("GET", "/government/blockers/people", { hasBody: false }, args),
       // POST /government/board/charter — rank: metic+archon — POST /government/board/charter
       postGovernmentBoardCharter: (args) => request("POST", "/government/board/charter", { hasBody: true }, args),
       // POST /government/board/decision-rules — rank: metic+archon — POST /government/board/decision-rules
@@ -745,6 +781,8 @@ function createClient(opts = {}) {
       deleteMeFilterViewsId: (args) => request("DELETE", "/me/filter-views/{id}", { hasBody: false }, args),
       // PATCH /me/filter-views/{id} — rank: any-builder — PATCH /me/filter-views/:id
       patchMeFilterViewsId: (args) => request("PATCH", "/me/filter-views/{id}", { hasBody: true }, args),
+      // POST /me/guardian-cosigns — rank: any-builder — POST /me/guardian-cosigns
+      postMeGuardianCosigns: (args) => request("POST", "/me/guardian-cosigns", { hasBody: true }, args),
       // GET /me/guild-engagements — rank: any-builder — GET /me/guild-engagements
       getMeGuildEngagements: (args) => request("GET", "/me/guild-engagements", { hasBody: false }, args),
       // GET /me/guild-requests — rank: any-builder — GET /me/guild-requests
@@ -779,6 +817,12 @@ function createClient(opts = {}) {
       postMePasskeysRemove: (args) => request("POST", "/me/passkeys/remove", { hasBody: true }, args),
       // POST /me/passkeys/rename — rank: any-builder — POST /me/passkeys/rename
       postMePasskeysRename: (args) => request("POST", "/me/passkeys/rename", { hasBody: true }, args),
+      // POST /me/payout-age — rank: any-builder — POST /me/payout-age
+      postMePayoutAge: (args) => request("POST", "/me/payout-age", { hasBody: true }, args),
+      // POST /me/payout-freezes/{id}/appeal — rank: any-builder — POST /me/payout-freezes/:id/appeal
+      postMePayoutFreezesIdAppeal: (args) => request("POST", "/me/payout-freezes/{id}/appeal", { hasBody: true }, args),
+      // GET /me/payouts — rank: any-builder — GET /me/payouts
+      getMePayouts: (args) => request("GET", "/me/payouts", { hasBody: false }, args),
       // PATCH /me/profile — rank: any-builder — PATCH /me/profile
       patchMeProfile: (args) => request("PATCH", "/me/profile", { hasBody: true }, args),
       // GET /me/profile-nudge — rank: any-builder — GET /me/profile-nudge
@@ -797,6 +841,8 @@ function createClient(opts = {}) {
       postMeSessionsRevoke: (args) => request("POST", "/me/sessions/revoke", { hasBody: true }, args),
       // POST /me/sessions/revoke-all — rank: any-builder — POST /me/sessions/revoke-all
       postMeSessionsRevokeAll: (args) => request("POST", "/me/sessions/revoke-all", { hasBody: true }, args),
+      // GET /me/sign-in-methods — rank: any-builder — GET /me/sign-in-methods
+      getMeSignInMethods: (args) => request("GET", "/me/sign-in-methods", { hasBody: false }, args),
       // GET /me/skill-prefs — rank: any-builder — GET /me/skill-prefs
       getMeSkillPrefs: (args) => request("GET", "/me/skill-prefs", { hasBody: false }, args),
       // PATCH /me/skill-prefs — rank: any-builder — PATCH /me/skill-prefs
@@ -876,6 +922,16 @@ function createClient(opts = {}) {
       // POST /my-projects/join — rank: any-builder — POST /my-projects/join
       postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
     },
+    "notes": {
+      // GET /notes — rank: any-builder — GET /notes
+      getNotes: (args) => request("GET", "/notes", { hasBody: false }, args),
+      // POST /notes — rank: any-builder — POST /notes
+      postNotes: (args) => request("POST", "/notes", { hasBody: true }, args),
+      // DELETE /notes/{id} — rank: any-builder — DELETE /notes/:id
+      deleteNotesId: (args) => request("DELETE", "/notes/{id}", { hasBody: false }, args),
+      // PATCH /notes/{id} — rank: any-builder — PATCH /notes/:id
+      patchNotesId: (args) => request("PATCH", "/notes/{id}", { hasBody: true }, args),
+    },
     "npmRelease": {
       // DELETE /npm-release/preview — rank: any-builder — DELETE /npm-release/preview
       deleteNpmReleasePreview: (args) => request("DELETE", "/npm-release/preview", { hasBody: false }, args),
@@ -922,6 +978,40 @@ function createClient(opts = {}) {
       // GET /page-notes/site — rank: any-builder — GET /page-notes/site
       getPageNotesSite: (args) => request("GET", "/page-notes/site", { hasBody: false }, args),
     },
+    "payouts": {
+      // POST /payouts/age-records — rank: archon — POST /payouts/age-records
+      postPayoutsAgeRecords: (args) => request("POST", "/payouts/age-records", { hasBody: true }, args),
+      // GET /payouts/approvals — rank: archon — GET /payouts/approvals
+      getPayoutsApprovals: (args) => request("GET", "/payouts/approvals", { hasBody: false }, args),
+      // POST /payouts/approve — rank: archon — POST /payouts/approve
+      postPayoutsApprove: (args) => request("POST", "/payouts/approve", { hasBody: true }, args),
+      // POST /payouts/contracts — rank: archon — POST /payouts/contracts
+      postPayoutsContracts: (args) => request("POST", "/payouts/contracts", { hasBody: true }, args),
+      // POST /payouts/freezes — rank: archon — POST /payouts/freezes
+      postPayoutsFreezes: (args) => request("POST", "/payouts/freezes", { hasBody: true }, args),
+      // POST /payouts/freezes/{id}/decide — rank: archon — POST /payouts/freezes/:id/decide
+      postPayoutsFreezesIdDecide: (args) => request("POST", "/payouts/freezes/{id}/decide", { hasBody: true }, args),
+      // GET /payouts/gates/{builderId} — rank: archon — GET /payouts/gates/:builderId
+      getPayoutsGatesBuilderId: (args) => request("GET", "/payouts/gates/{builderId}", { hasBody: false }, args),
+      // POST /payouts/grants — rank: archon — POST /payouts/grants
+      postPayoutsGrants: (args) => request("POST", "/payouts/grants", { hasBody: true }, args),
+      // POST /payouts/guardians — rank: archon — POST /payouts/guardians
+      postPayoutsGuardians: (args) => request("POST", "/payouts/guardians", { hasBody: true }, args),
+      // GET /payouts/rules — rank: archon — GET /payouts/rules
+      getPayoutsRules: (args) => request("GET", "/payouts/rules", { hasBody: false }, args),
+      // POST /payouts/rules — rank: archon — POST /payouts/rules
+      postPayoutsRules: (args) => request("POST", "/payouts/rules", { hasBody: true }, args),
+      // POST /payouts/rules/{id}/narrow — rank: archon — POST /payouts/rules/:id/narrow
+      postPayoutsRulesIdNarrow: (args) => request("POST", "/payouts/rules/{id}/narrow", { hasBody: true }, args),
+      // POST /payouts/rules/{id}/revoke — rank: archon — POST /payouts/rules/:id/revoke
+      postPayoutsRulesIdRevoke: (args) => request("POST", "/payouts/rules/{id}/revoke", { hasBody: true }, args),
+      // POST /payouts/rules/{id}/runs — rank: archon — POST /payouts/rules/:id/runs
+      postPayoutsRulesIdRuns: (args) => request("POST", "/payouts/rules/{id}/runs", { hasBody: true }, args),
+      // POST /payouts/rules/{id}/runs/{runKey}/hold — rank: archon — POST /payouts/rules/:id/runs/:runKey/hold
+      postPayoutsRulesIdRunsRunKeyHold: (args) => request("POST", "/payouts/rules/{id}/runs/{runKey}/hold", { hasBody: true }, args),
+      // POST /payouts/screenings — rank: archon — POST /payouts/screenings
+      postPayoutsScreenings: (args) => request("POST", "/payouts/screenings", { hasBody: true }, args),
+    },
     "profiles": {
       // GET /profiles/{handle} — rank: public — GET /profiles/:handle
       getProfilesHandle: (args) => request("GET", "/profiles/{handle}", { hasBody: false }, args),