@bongos/core 1.25.17 → 1.25.18

package/clients/bongos-client/index.cjs

@@ -153,6 +153,10 @@ function createClient(opts = {}) {
       // GET /analytics/builder/{id} — rank: any-builder — GET /analytics/builder/:id
       getAnalyticsBuilderId: (args) => request("GET", "/analytics/builder/{id}", { hasBody: false }, args),
     },
+    "appHost": {
+      // GET /app-host — rank: any-builder — GET /app-host
+      getAppHost: (args) => request("GET", "/app-host", { hasBody: false }, args),
+    },
     "artistGate": {
       // GET /artist-gate — rank: any-builder — GET /artist-gate
       getArtistGate: (args) => request("GET", "/artist-gate", { hasBody: false }, args),
@@ -468,12 +472,16 @@ function createClient(opts = {}) {
       getFeedbackReceiptId: (args) => request("GET", "/feedback/receipt/{id}", { hasBody: false }, args),
     },
     "firstRead": {
+      // GET /first-read/catalog — rank: any-builder — GET /first-read/catalog
+      getFirstReadCatalog: (args) => request("GET", "/first-read/catalog", { hasBody: false }, args),
       // POST /first-read/maps — rank: metic+archon — POST /first-read/maps
       postFirstReadMaps: (args) => request("POST", "/first-read/maps", { hasBody: true }, args),
       // GET /first-read/maps/{id} — rank: metic+archon — GET /first-read/maps/:id
       getFirstReadMapsId: (args) => request("GET", "/first-read/maps/{id}", { hasBody: false }, args),
       // POST /first-read/maps/{id}/accept — rank: metic+archon — POST /first-read/maps/:id/accept
       postFirstReadMapsIdAccept: (args) => request("POST", "/first-read/maps/{id}/accept", { hasBody: true }, args),
+      // POST /first-read/maps/{id}/dismiss — rank: metic+archon — POST /first-read/maps/:id/dismiss
+      postFirstReadMapsIdDismiss: (args) => request("POST", "/first-read/maps/{id}/dismiss", { hasBody: true }, args),
       // POST /first-read/maps/{id}/reject — rank: metic+archon — POST /first-read/maps/:id/reject
       postFirstReadMapsIdReject: (args) => request("POST", "/first-read/maps/{id}/reject", { hasBody: true }, args),
       // GET /first-read/prompt — rank: any-builder — GET /first-read/prompt
@@ -1514,6 +1522,8 @@ function createClient(opts = {}) {
     "sso": {
       // POST /sso/activity/rollup — rank: public — POST /sso/activity/rollup
       postSsoActivityRollup: (args) => request("POST", "/sso/activity/rollup", { hasBody: true }, args),
+      // POST /sso/app-status — rank: public — POST /sso/app-status
+      postSsoAppStatus: (args) => request("POST", "/sso/app-status", { hasBody: true }, args),
       // POST /sso/applicant-profile — rank: public — POST /sso/applicant-profile
       postSsoApplicantProfile: (args) => request("POST", "/sso/applicant-profile", { hasBody: true }, args),
       // GET /sso/authorize — rank: public — GET /sso/authorize

package/clients/bongos-client/index.d.ts

@@ -75,7 +75,8 @@ export interface GetCoreUpgradesResponse { ok: boolean; running: unknown; limit:
 export interface GetDiscordChannelsPlanResponse { ok: boolean; guild_id: unknown; op_count: unknown; ops: unknown; warnings: unknown }
 export interface GetDiscordChannelsSnapshotResponse { ok: boolean; guild_id: unknown; config: unknown; warnings: unknown }
 export interface GetDoneWhenPendingReviewResponse { criteria: unknown; count: unknown }
-export interface GetFirstReadPromptResponse { schema: unknown; file: unknown; prompt: unknown; example: unknown; limits: unknown }
+export interface GetFirstReadCatalogResponse { available: unknown; modules: unknown }
+export interface GetFirstReadPromptResponse { schema: unknown; file: unknown; prompt: unknown; example: unknown; limits: unknown; catalog: unknown }
 export interface GetFrontDoorGuideMineResponse { ok: boolean; conversation: unknown }
 export interface GetGithubOrgsOrgResponse { org: unknown }
 export interface GetGithubRepoResponse { ok: boolean; repo: unknown; private_deployable: boolean }
@@ -391,6 +392,7 @@ export interface PostDoneWhenCriterionIdUnsatisfyResponse { criterion: unknown }
 export interface PostFeedbackReceiptRequest { sha256: string; kind?: "bug" | "idea" }
 export interface PostFeedbackReceiptResponse { ok: boolean; receipt: unknown; hub: unknown }
 export interface PostFirstReadMapsIdAcceptRequest { all?: boolean; items?: string[] }
+export interface PostFirstReadMapsIdDismissRequest { items: string[] }
 export interface PostFirstReadMapsRequest { map: Record<string, unknown> }
 export interface PostFirstReadMapsResponse { map_id: unknown; status: unknown; items: unknown; next: unknown }
 export interface PostFoundingPlanRequest { days?: Record<string, unknown>; passes?: number; advisors?: string; government?: string; expected_builders?: number; existing?: boolean }
@@ -658,6 +660,8 @@ export interface PostSpecialitiesRequest { name: string; discipline: string; sum
 export interface PostSpecialitiesResponse { speciality: unknown }
 export interface PostSsoActivityRollupRequest { client_id: string; client_secret: string; github_id: StringifiableId; credits?: number; tasks_shipped?: number; karma?: number; rank?: string; disciplines?: unknown; recent_ships?: unknown; crafts?: unknown }
 export interface PostSsoActivityRollupResponse { ok: boolean }
+export interface PostSsoAppStatusRequest { client_id: string; client_secret: string }
+export interface PostSsoAppStatusResponse { ok: boolean; known: boolean; app: unknown; sandbox: unknown }
 export interface PostSsoApplicantProfileRequest { client_id: string; client_secret: string; github_id: StringifiableId }
 export interface PostSsoApplicantProfileResponse { profile: unknown; guild: unknown }
 export interface PostSsoDevicePollRequest { device_code: string }
@@ -842,6 +846,10 @@ export interface BongosClient {
     /** GET /analytics/builder/{id} — rank: any-builder */
     getAnalyticsBuilderId(args?: RequestArgs): Promise<ApiResponse>;
   };
+  "appHost": {
+    /** GET /app-host — rank: any-builder */
+    getAppHost(args?: RequestArgs): Promise<ApiResponse>;
+  };
   "artistGate": {
     /** GET /artist-gate — rank: any-builder */
     getArtistGate(args?: RequestArgs): Promise<GetArtistGateResponse>;
@@ -1157,12 +1165,16 @@ export interface BongosClient {
     getFeedbackReceiptId(args?: RequestArgs): Promise<ApiResponse>;
   };
   "firstRead": {
+    /** GET /first-read/catalog — rank: any-builder */
+    getFirstReadCatalog(args?: RequestArgs): Promise<GetFirstReadCatalogResponse>;
     /** POST /first-read/maps — rank: metic+archon */
     postFirstReadMaps(args: RequestArgs & { body: PostFirstReadMapsRequest }): Promise<PostFirstReadMapsResponse>;
     /** GET /first-read/maps/{id} — rank: metic+archon */
     getFirstReadMapsId(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /first-read/maps/{id}/accept — rank: metic+archon */
     postFirstReadMapsIdAccept(args?: RequestArgs & { body?: PostFirstReadMapsIdAcceptRequest }): Promise<ApiResponse>;
+    /** POST /first-read/maps/{id}/dismiss — rank: metic+archon */
+    postFirstReadMapsIdDismiss(args: RequestArgs & { body: PostFirstReadMapsIdDismissRequest }): Promise<ApiResponse>;
     /** POST /first-read/maps/{id}/reject — rank: metic+archon */
     postFirstReadMapsIdReject(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /first-read/prompt — rank: any-builder */
@@ -2203,6 +2215,8 @@ export interface BongosClient {
   "sso": {
     /** POST /sso/activity/rollup — rank: public */
     postSsoActivityRollup(args: RequestArgs & { body: PostSsoActivityRollupRequest }): Promise<PostSsoActivityRollupResponse>;
+    /** POST /sso/app-status — rank: public */
+    postSsoAppStatus(args: RequestArgs & { body: PostSsoAppStatusRequest }): Promise<PostSsoAppStatusResponse>;
     /** POST /sso/applicant-profile — rank: public */
     postSsoApplicantProfile(args: RequestArgs & { body: PostSsoApplicantProfileRequest }): Promise<PostSsoApplicantProfileResponse>;
     /** GET /sso/authorize — rank: public */

package/clients/bongos-client/index.mjs

@@ -150,6 +150,10 @@ export function createClient(opts = {}) {
       // GET /analytics/builder/{id} — rank: any-builder — GET /analytics/builder/:id
       getAnalyticsBuilderId: (args) => request("GET", "/analytics/builder/{id}", { hasBody: false }, args),
     },
+    "appHost": {
+      // GET /app-host — rank: any-builder — GET /app-host
+      getAppHost: (args) => request("GET", "/app-host", { hasBody: false }, args),
+    },
     "artistGate": {
       // GET /artist-gate — rank: any-builder — GET /artist-gate
       getArtistGate: (args) => request("GET", "/artist-gate", { hasBody: false }, args),
@@ -465,12 +469,16 @@ export function createClient(opts = {}) {
       getFeedbackReceiptId: (args) => request("GET", "/feedback/receipt/{id}", { hasBody: false }, args),
     },
     "firstRead": {
+      // GET /first-read/catalog — rank: any-builder — GET /first-read/catalog
+      getFirstReadCatalog: (args) => request("GET", "/first-read/catalog", { hasBody: false }, args),
       // POST /first-read/maps — rank: metic+archon — POST /first-read/maps
       postFirstReadMaps: (args) => request("POST", "/first-read/maps", { hasBody: true }, args),
       // GET /first-read/maps/{id} — rank: metic+archon — GET /first-read/maps/:id
       getFirstReadMapsId: (args) => request("GET", "/first-read/maps/{id}", { hasBody: false }, args),
       // POST /first-read/maps/{id}/accept — rank: metic+archon — POST /first-read/maps/:id/accept
       postFirstReadMapsIdAccept: (args) => request("POST", "/first-read/maps/{id}/accept", { hasBody: true }, args),
+      // POST /first-read/maps/{id}/dismiss — rank: metic+archon — POST /first-read/maps/:id/dismiss
+      postFirstReadMapsIdDismiss: (args) => request("POST", "/first-read/maps/{id}/dismiss", { hasBody: true }, args),
       // POST /first-read/maps/{id}/reject — rank: metic+archon — POST /first-read/maps/:id/reject
       postFirstReadMapsIdReject: (args) => request("POST", "/first-read/maps/{id}/reject", { hasBody: true }, args),
       // GET /first-read/prompt — rank: any-builder — GET /first-read/prompt
@@ -1511,6 +1519,8 @@ export function createClient(opts = {}) {
     "sso": {
       // POST /sso/activity/rollup — rank: public — POST /sso/activity/rollup
       postSsoActivityRollup: (args) => request("POST", "/sso/activity/rollup", { hasBody: true }, args),
+      // POST /sso/app-status — rank: public — POST /sso/app-status
+      postSsoAppStatus: (args) => request("POST", "/sso/app-status", { hasBody: true }, args),
       // POST /sso/applicant-profile — rank: public — POST /sso/applicant-profile
       postSsoApplicantProfile: (args) => request("POST", "/sso/applicant-profile", { hasBody: true }, args),
       // GET /sso/authorize — rank: public — GET /sso/authorize

package/docs/adr/0408-a-genesis-stage-is-three-doors-onto-one-record.md

@@ -58,4 +58,5 @@ every stage, not a strategize feature that charter then copies.
   the hall version (task 1005285). Today a founder works a stage through their AI session
   and `npx bongos genesis …`.
 - Task 1005115 renders each stage's record as an editable document from this store.
+- Charter adopted it (task 1005119): how decisions should go and the founder's principles. A question may declare `choices` (a closed answer, stored as its key) where another module reads the answer; the charter stage's read carries the government module's recommendation built from them.
 - Scope adopted it with the project interview (task 1005114): six questions in three groups. `/goal-create` and `/planning-session` read the answers before planning, through `genesis.js context`.

package/docs/api/openapi.json

@@ -45,6 +45,10 @@
       "name": "analytics",
       "description": "Endpoints under `/api/bongos/analytics`."
     },
+    {
+      "name": "app-host",
+      "description": "Endpoints under `/api/bongos/app-host`."
+    },
     {
       "name": "artist-gate",
       "description": "Endpoints under `/api/bongos/artist-gate`."
@@ -1748,6 +1752,37 @@
         ]
       }
     },
+    "/app-host": {
+      "get": {
+        "operationId": "get_app_host",
+        "tags": [
+          "app-host"
+        ],
+        "summary": "GET /app-host",
+        "description": "GET /app-host — rank: any signed-in builder; owner-only parts gated on core.pin.move.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/app-host/routes/app-host.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/artist-gate": {
       "get": {
         "operationId": "get_artist_gate",
@@ -7613,6 +7648,44 @@
         "security": []
       }
     },
+    "/first-read/catalog": {
+      "get": {
+        "operationId": "get_first_read_catalog",
+        "tags": [
+          "first-read"
+        ],
+        "summary": "GET /first-read/catalog",
+        "description": "the modules this project can switch on, the only ones a map may recommend. `available: false` when the list cannot be read here.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/lifecycle/routes/first-read.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetFirstReadCatalogResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/first-read/maps": {
       "post": {
         "operationId": "post_first_read_maps",
@@ -7772,6 +7845,65 @@
         ]
       }
     },
+    "/first-read/maps/{id}/dismiss": {
+      "post": {
+        "operationId": "post_first_read_maps_id_dismiss",
+        "tags": [
+          "first-read"
+        ],
+        "summary": "POST /first-read/maps/:id/dismiss",
+        "description": ".create — the owner's no to named items (a module recommendation, usually). Files nothing; a later \"accept all\" passes them by.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `goal.create` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/lifecycle/routes/first-read.js",
+        "x-permissions": [
+          "goal.create"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostFirstReadMapsIdDismissRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/first-read/maps/{id}/reject": {
       "post": {
         "operationId": "post_first_read_maps_id_reject",
@@ -7827,7 +7959,7 @@
           "first-read"
         ],
         "summary": "GET /first-read/prompt",
-        "description": "the prompt and the shape are instructions, not project data.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "the prompt and the shape are instructions, not project data. The prompt carries the live module list (task 1005281), so a session recommends from it.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/lifecycle/routes/first-read.js",
         "responses": {
@@ -29282,6 +29414,45 @@
         "security": []
       }
     },
+    "/sso/app-status": {
+      "post": {
+        "operationId": "post_sso_app_status",
+        "tags": [
+          "sso"
+        ],
+        "summary": "POST /sso/app-status",
+        "description": "authenticated by client_id + client_secret, not a builder rank.\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/sso-app-status.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostSsoAppStatusRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostSsoAppStatusResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          }
+        },
+        "security": []
+      }
+    },
     "/sso/applicant-profile": {
       "post": {
         "operationId": "post_sso_applicant_profile",
@@ -34664,6 +34835,17 @@
           "count"
         ]
       },
+      "GetFirstReadCatalogResponse": {
+        "type": "object",
+        "properties": {
+          "available": {},
+          "modules": {}
+        },
+        "required": [
+          "available",
+          "modules"
+        ]
+      },
       "GetFirstReadPromptResponse": {
         "type": "object",
         "properties": {
@@ -34671,14 +34853,16 @@
           "file": {},
           "prompt": {},
           "example": {},
-          "limits": {}
+          "limits": {},
+          "catalog": {}
         },
         "required": [
           "schema",
           "file",
           "prompt",
           "example",
-          "limits"
+          "limits",
+          "catalog"
         ]
       },
       "GetFrontDoorGuideMineResponse": {
@@ -39192,6 +39376,22 @@
         },
         "additionalProperties": false
       },
+      "PostFirstReadMapsIdDismissRequest": {
+        "type": "object",
+        "properties": {
+          "items": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "maxItems": 500
+          }
+        },
+        "required": [
+          "items"
+        ],
+        "additionalProperties": false
+      },
       "PostFirstReadMapsRequest": {
         "type": "object",
         "properties": {
@@ -43544,6 +43744,43 @@
           "ok"
         ]
       },
+      "PostSsoAppStatusRequest": {
+        "type": "object",
+        "properties": {
+          "client_id": {
+            "type": "string",
+            "maxLength": 200
+          },
+          "client_secret": {
+            "type": "string",
+            "maxLength": 512
+          }
+        },
+        "required": [
+          "client_id",
+          "client_secret"
+        ],
+        "additionalProperties": false
+      },
+      "PostSsoAppStatusResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "known": {
+            "type": "boolean"
+          },
+          "app": {},
+          "sandbox": {}
+        },
+        "required": [
+          "ok",
+          "known",
+          "app",
+          "sandbox"
+        ]
+      },
       "PostSsoApplicantProfileRequest": {
         "type": "object",
         "properties": {
@@ -45306,9 +45543,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 725,
-  "x-schema-count": 755,
+  "x-endpoint-count": 729,
+  "x-schema-count": 759,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 471,
+  "x-response-schemas": 473,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 725 endpoints across 122 route files.
+> **Generated from the live route files** — the route file is authoritative. 729 endpoints across 124 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -66,6 +66,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 |---|---|---|---|---|
 | GET | `/api/bongos/analytics/builder/:id` | `any-builder` | — | a builder's historical AI dev curve. |
 
+## `app-host` (1)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/app-host` | `any-builder` | — | GET /app-host — rank: any signed-in builder; owner-only parts gated on core.pin.move. |
+
 ## `artist-gate` (1)
 
 | Method | Path | Rank | Body | Description |
@@ -315,13 +321,15 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/feedback/receipt` | `any-builder` | `sha256`, `kind` | signed-in builder — a receipt only says "this builder sent this text"; it grants nothing here, and the hub files every report behind a nod. |
 | GET | `/api/bongos/feedback/receipt/:id` | `public` | — | the hub redeems a receipt with no session of its own. |
 
-## `first-read` (5)
+## `first-read` (7)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
+| GET | `/api/bongos/first-read/catalog` | `any-builder` | — | the modules this project can switch on, the only ones a map may recommend. |
 | POST | `/api/bongos/first-read/maps` | `metic+archon` | `map` | .create — a map is a planning proposal for this project. |
 | GET | `/api/bongos/first-read/maps/:id` | `metic+archon` | — | .create — the review is for whoever may accept or reject it. |
 | POST | `/api/bongos/first-read/maps/:id/accept` | `metic+archon` | `all`, `items` | .create + act-alone planning — the owner's yes. |
+| POST | `/api/bongos/first-read/maps/:id/dismiss` | `metic+archon` | `items` | .create — the owner's no to named items (a module recommendation, usually). |
 | POST | `/api/bongos/first-read/maps/:id/reject` | `metic+archon` | — | .create — the owner's no. |
 | GET | `/api/bongos/first-read/prompt` | `any-builder` | — | the prompt and the shape are instructions, not project data. |
 
@@ -1041,11 +1049,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/specialities/installed-skills` | `any-builder` | — | GET /specialities/installed-skills — every skill THIS instance has, each explained the way the adoption walkthrough explains it, so a spe… |
 | GET | `/api/bongos/specialities/offered` | `any-builder` | — | GET /specialities/offered — the suggestions for THIS builder. |
 
-## `sso` (12)
+## `sso` (13)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | POST | `/api/bongos/sso/activity/rollup` | `public` | `client_id`, `client_secret`, `github_id`, `credits`, `tasks_shipped`, `karma`, `rank`, `disciplines`, `recent_ships`, `crafts` | POST /sso/activity/rollup — a federated instance reports a builder's activity snapshot (ADR 0141 §4). |
+| POST | `/api/bongos/sso/app-status` | `public` | `client_id`, `client_secret` | authenticated by client_id + client_secret, not a builder rank. |
 | POST | `/api/bongos/sso/applicant-profile` | `public` | `client_id`, `client_secret`, `github_id` | POST /sso/applicant-profile — a federated instance resolves ONE applicant's profile view for its own reviewer queue, LIVE at render (priv… |
 | GET | `/api/bongos/sso/authorize` | `public` | — | GET /sso/authorize?client_id=&redirect_uri=&state= — the browser authorize leg. |
 | POST | `/api/bongos/sso/device/poll` | `public` | `device_code` | POST /sso/device/poll — poll the hub device flow. |