@bongos/core 1.24.78 → 1.24.80

package/docs/api/openapi.json

@@ -7615,6 +7615,37 @@
         ]
       }
     },
+    "/founding/skip": {
+      "post": {
+        "operationId": "post_founding_skip",
+        "tags": [
+          "founding"
+        ],
+        "summary": "POST /founding/skip",
+        "description": "Skip genesis: the owner opens the full hall from any stage, no sitting, no gate.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/onboarding/routes/onboarding.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/founding/stages/{stage}/close": {
       "post": {
         "operationId": "post_founding_stages_stage_close",
@@ -7812,6 +7843,83 @@
         ]
       }
     },
+    "/github/repo-invite": {
+      "get": {
+        "operationId": "get_github_repo_invite",
+        "tags": [
+          "github"
+        ],
+        "summary": "GET /github/repo-invite",
+        "description": "(permission access_request.review) — where one person stands on the project's repo: collaborator, pending (invite sent, not yet accepted) or none.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `access_request.review` (all required).",
+        "x-rank": "archon",
+        "x-source": "src/bongos/routes/github.js",
+        "x-permissions": [
+          "access_request.review"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "post": {
+        "operationId": "post_github_repo_invite",
+        "tags": [
+          "github"
+        ],
+        "summary": "POST /github/repo-invite",
+        "description": "(permission access_request.review, the same gate as a hall invite) — invites a person to THIS project's GitHub repository, acting as the caller's OWN GitHub account (their stored repo token), never a platform credential. GitHub decides whether the caller may add people. The access is always READ-ONLY: write ('push') and above are refused, since a builder ships through the server. It grants no Bongos rank and does not admit anyone to the hall: those are the hall invite's own record.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `access_request.review` (all required).",
+        "x-rank": "archon",
+        "x-source": "src/bongos/routes/github.js",
+        "x-permissions": [
+          "access_request.review"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostGithubRepoInviteRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/github/repo/visibility": {
       "post": {
         "operationId": "post_github_repo_visibility",
@@ -15422,6 +15530,55 @@
         ]
       }
     },
+    "/me/character": {
+      "put": {
+        "operationId": "put_me_character",
+        "tags": [
+          "me"
+        ],
+        "summary": "PUT /me/character",
+        "description": "task 1005147 (BONGOS-V3 G2): character creation. Body: { character } — 'artisan' | 'artist' | 'patron', or null to clear it (the hall clears it and signs out: switching character is signing out and back in, spec settled point 2). Identity and view only: no claim, vote, deploy or spend gate reads it (criterion character-is-identity-not-authority). 422 invalid_character otherwise. rank: any-builder — a builder writes only their own row (req.builder.id), the /me/disciplines posture.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/me.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PutMeCharacterRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PutMeCharacterResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me/checkout-freshness": {
       "patch": {
         "operationId": "patch_me_checkout_freshness",
@@ -37483,6 +37640,22 @@
         },
         "additionalProperties": false
       },
+      "PostGithubRepoInviteRequest": {
+        "type": "object",
+        "properties": {
+          "github_login": {
+            "type": "string",
+            "maxLength": 60
+          },
+          "permission": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "github_login"
+        ],
+        "additionalProperties": false
+      },
       "PostGithubRepoVisibilityRequest": {
         "type": "object",
         "properties": {
@@ -42942,6 +43115,25 @@
         ],
         "additionalProperties": false
       },
+      "PutMeCharacterRequest": {
+        "type": "object",
+        "properties": {
+          "character": {
+            "type": "string",
+            "maxLength": 32
+          }
+        },
+        "additionalProperties": false
+      },
+      "PutMeCharacterResponse": {
+        "type": "object",
+        "properties": {
+          "character": {}
+        },
+        "required": [
+          "character"
+        ]
+      },
       "PutMingleOptInRequest": {
         "type": "object",
         "properties": {
@@ -43265,9 +43457,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 690,
-  "x-schema-count": 726,
+  "x-endpoint-count": 694,
+  "x-schema-count": 729,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 461,
+  "x-response-schemas": 462,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 690 endpoints across 117 route files.
+> **Generated from the live route files** — the route file is authoritative. 694 endpoints across 117 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -313,7 +313,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/feedback/receipt` | `any-builder` | `sha256`, `kind` | signed-in builder — a receipt only says "this builder sent this text"; it grants nothing here, and the hub files every report behind a nod. |
 | GET | `/api/bongos/feedback/receipt/:id` | `public` | — | the hub redeems a receipt with no session of its own. |
 
-## `founding` (6)
+## `founding` (7)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -321,16 +321,19 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/founding/builders` | `any-builder` | — | The founding mark (task 1004424): who joined while the project was founding, in join order, with the stage each joined at. |
 | GET | `/api/bongos/founding/genesis` | `any-builder` | — | A project born through the startup flow enters genesis on its first founding read (founding-birth.js, task 1004506) — here and on GET /me… |
 | POST | `/api/bongos/founding/plan` | `any-builder` | `days`, `passes`, `advisors`, `government`, `expected_builders`, `existing` | The plan's ranges and vocabularies are genesis-home.js parsePlan's (one source); this schema only names the fields so an unknown one is r… |
+| POST | `/api/bongos/founding/skip` | `any-builder` | — | Skip genesis: the owner opens the full hall from any stage, no sitting, no gate. |
 | POST | `/api/bongos/founding/stages/:stage/close` | `any-builder` | — | task 1005121: one call. |
 | POST | `/api/bongos/founding/start` | `any-builder` | — |  |
 
-## `github` (6)
+## `github` (8)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/github/orgs` | `any-builder` | — | the caller's OWN GitHub organisations (task 1004651), for the project page's "on an organisation" choice. |
 | GET | `/api/bongos/github/orgs/:org` | `any-builder` | — | checks ONE organisation name the caller typed, as their own GitHub credential sees it (task 1004651). |
 | GET | `/api/bongos/github/repo` | `any-builder` | — | reads one repo AS the caller's own GitHub credential sees it (the manage page's repo-visibility read, task 1003045). |
+| GET | `/api/bongos/github/repo-invite` | `archon` | — | (permission access_request.review) — where one person stands on the project's repo: collaborator, pending (invite sent, not yet accepted)… |
+| POST | `/api/bongos/github/repo-invite` | `archon` | `github_login`, `permission` | (permission access_request.review, the same gate as a hall invite) — invites a person to THIS project's GitHub repository, acting as the … |
 | POST | `/api/bongos/github/repo/visibility` | `any-builder` | `repo`, `visibility` | flips one of the caller's repos PUBLIC, with their own credential. |
 | GET | `/api/bongos/github/repos` | `any-builder` | — | acts only on the caller's OWN GitHub identity (the token they granted). |
 | POST | `/api/bongos/github/repos` | `any-builder` | `name`, `org` | creates a repo in the caller's OWN account, or (task 1004651) under an organisation they name in `org`. |
@@ -564,7 +567,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | PUT | `/api/bongos/market-watch/settings/key` | `metic+archon` | `key` |  |
 | DELETE | `/api/bongos/market-watch/settings/key` | `metic+archon` | — |  |
 
-## `me` (60)
+## `me` (61)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -575,6 +578,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/me/cash-outs` | `any-builder` | `amount_cents`, `instruction_id` | POST /api/bongos/me/cash-outs — ask to take amount_cents of my balance to my bank. |
 | POST | `/api/bongos/me/cash-outs/:id/cancel` | `any-builder` | — | POST /api/bongos/me/cash-outs/:id/cancel — withdraw one of my requests that has not been sent. |
 | POST | `/api/bongos/me/cash-outs/:id/retry` | `any-builder` | — | POST /api/bongos/me/cash-outs/:id/retry — try one of my unfinished withdrawals again. |
+| PUT | `/api/bongos/me/character` | `any-builder` | `character` | task 1005147 (BONGOS-V3 G2): character creation. |
 | PATCH | `/api/bongos/me/checkout-freshness` | `any-builder` | `behind`, `branch`, `reason` | How far behind this builder's local project folder is (task 1005021, checkout-freshness.js). |
 | PATCH | `/api/bongos/me/core-move-seen` | `any-builder` | `id` | The core move this builder has been told about (task 1004731, core-move-seen.js): closing the hall's "Upgraded to core X" notice stores t… |
 | GET | `/api/bongos/me/credits` | `any-builder` | — | GET /me/credits — the caller's own ledger. |

package/docs/architecture.md

@@ -163,11 +163,15 @@ tasks  + kind text NOT NULL DEFAULT 'unclassified'  CHECK IN (feature|bug|infra|
                                               -- claim and is deliberately not counted (task 1003964)
        + scoping_confidence integer  CHECK (1..5)
        + discipline text NOT NULL DEFAULT 'unclassified' (mig 014; renamed mig 086)
-                                              CHECK IN (engineer|artist|ideator|unclassified)
+                                              CHECK IN (artisan|artist|ui|engineer|ideator)
+                                              -- (core_296, task 1005141: engineer/ideator still
+                                              -- accepted for rollback, read as artisan/artist;
+                                              -- unclassified dropped by core_247)
                                               -- orthogonal to kind; classifies builder
-                                              -- interest area (engineer = code/infra/mechanics/bugs,
+                                              -- interest area (artisan = code/infra/mechanics/bugs,
                                               -- artist = pixel art/sprites/pipeline,
-                                              -- ideator = scoping/research/docs/narrative/lore)
+                                              -- ideas = scoping/research/docs/narrative/lore,
+                                              -- the artist's since the ideator folded in)
 claims + head_sha text                              -- captured at claim time for incidental-work scanner
 builders + timezone text NOT NULL DEFAULT 'America/New_York'