@bongos/core 1.25.21 → 1.25.23

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.25.21",
-  "core_contract": "1.25.21",
-  "source_commit": "edec2e881467ab2a9a71c1e4d73a4b3eac5644b4",
+  "core_version": "1.25.23",
+  "core_contract": "1.25.23",
+  "source_commit": "d44d5d0d3ac522246a0d48b80f5242a91ff07993",
   "source_ref": "HEAD",
-  "built_at": "2026-11-13T23:42:24.852Z",
+  "built_at": "2026-11-14T00:30:52.761Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 658,
     "agent_docs_stubbed": 34,
-    "functional_verbatim": 4079,
+    "functional_verbatim": 4087,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4772,
-  "tree_sha256": "93a366dc7cd95fda7d827b0d346bf6594531a25809e3f042fe56c36a4c6e2628",
+  "file_count": 4780,
+  "tree_sha256": "c0fb506fb3f6b9181476ed72898814cc4e63103372b56ee2d2a34d862fa94770",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -332,12 +332,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "ddde16f707ff0385bad50c6a1581792d094eaf71c24056880c6ae64e76a5d98e"
+      "sha256": "0304791b677adf1ad3b29232d25d401906717ffa939d91978eda5300560079f9"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "5b02f9bd936d62be25dade68132bc8beafcef97ad6dce9421a431408692decc6"
+      "sha256": "22a8d01073ff817c4216441793f6c036b8550316be0b48c8f7d9abd285337ca1"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -347,17 +347,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "4563e8b2002556033029ec0e458d7fe1e690cc0f637f2e3c4fc0beb2bb7a80af"
+      "sha256": "8a4f7994d2d3c7c3864ec2254c4d892437b6b71d723615830e5b40a541f2db58"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "c3db9753a4b3d8d59f223fa20b36ec95b89667c3f8e75b65b8b76fbe6a44fb19"
+      "sha256": "9da38b663cbe1414270d88c77cea4ac35f1bcc11101d768522bed195c03f3818"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "c05d9cdfe867d81257f3aaecdf6cb8a88133e280d7147065151da29f19fff751"
+      "sha256": "b9e24350b0be77271687738665bbba2dc9173313a1563450367ae715a221627b"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2492,7 +2492,7 @@
     {
       "path": "docs/adr/0406-every-project-gets-a-sandbox-that-follows-main-and-live-moves-only-when-a-person-promotes.md",
       "mode": "0000644",
-      "sha256": "73e2506a621dbc141089ce7c827c530f21a5604d26871c028b25cf9e79c1681c"
+      "sha256": "74432c80fc96290a67ece45663a956e296f7351dbc3099c2ec2d691adf7378c9"
     },
     {
       "path": "docs/adr/0407-a-project-grant-is-made-by-the-owner-not-witnessed-at-sign-in.md",
@@ -2512,12 +2512,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "8958d5017da37110048c273b1ae365fa7ce093668cf63e98f6ebaf6c1036a861"
+      "sha256": "85e880fb33314f7857b68348002b521d6f81b80a8d1d2b5c3a8cacc388285b30"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "e576e79ca02594739010e1baa389204a99986c79b63561dfcb0ed1574306e764"
+      "sha256": "7230b0899b0d31ab67024901e84e8aecc4b7b25abebac413c731e6eb3e08ed98"
     },
     {
       "path": "docs/architecture.md",
@@ -2542,12 +2542,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "007c078a8859b38d8d9dde3c6d90ffbf1b2f688f284016c5b18da82de32601da"
+      "sha256": "2336261aeb9028b6bff1fbeaa530a099b2ed2069dac2b5920152ec6f33555cb7"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "b2978248d9694ee0a36200ce110b9c937bcfe66cb10bd3aa2814327664ccb3b7"
+      "sha256": "1b571de216bf571c87618addcdf4c169c4c7b9d4bc1d6b01fa8a4e292b86542c"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -3092,7 +3092,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "39873c50e006b944e9d7ef17712af1252cb6e667c40b0695fe1e8818e0d47aff"
+      "sha256": "32a5a774019d20cc0194f5128c737907e86ba94dc47de230afbd061f52e7c8a9"
     },
     {
       "path": "docs/handoff-template.md",
@@ -3102,7 +3102,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "4c4d9ba1532cb57da74961f0cbeba5052349e20784eabd572915494938489f85"
+      "sha256": "cdc7967cb5713ea9041d69fea21e7a1ef5a2b74b7c29f86d89a290fe863058e1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3187,7 +3187,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "11b2e6ec69ff67de20e9110fbffa1dca245c8343a0bde0c4a0c71d744c596b7d"
+      "sha256": "4374b8ba743d5dd03cf35b03fbd84024e63d749a0a5aa63d669d94fc69357eb3"
     },
     {
       "path": "docs/project-context.template.md",
@@ -7177,7 +7177,7 @@
     {
       "path": "modules/hall-ui/public/palette.js",
       "mode": "0000644",
-      "sha256": "1b52b9df0762f7eed34ec6f226e8e9a10cce6f9797a564cd3416786209a5e1d5"
+      "sha256": "60296972ebfb14296a0a12d8fc85b41551ad699d90537e554876bb6653636fb3"
     },
     {
       "path": "modules/hall-ui/public/panel.css",
@@ -7832,7 +7832,7 @@
     {
       "path": "modules/hall-ui/records/founding-mode.md",
       "mode": "0000644",
-      "sha256": "25e506d34ff52b2d358b608ca17d9403b3d3674f5cf647030bb69c3fb235c487"
+      "sha256": "cfaf28f0c396215cd2b5f1131f01fed12e7de37a89e8520bbce983d7a9c79a72"
     },
     {
       "path": "modules/hall-ui/records/game-menu.md",
@@ -8587,7 +8587,7 @@
     {
       "path": "modules/lifecycle/kickoff-checklist.js",
       "mode": "0000644",
-      "sha256": "43d5f3c3bab9c9b3fddab524d111224215d0661a48fce782d0d7980b1c333ee7"
+      "sha256": "2e3eebac363df54307fe0592eaa2c69d08556469be7456985cfd3ae6dc49e6e6"
     },
     {
       "path": "modules/lifecycle/kickoff-seed.js",
@@ -8952,7 +8952,7 @@
     {
       "path": "modules/lifecycle/routes/pay-type-gates.js",
       "mode": "0000644",
-      "sha256": "ef0f4aa074e4391b01a3c863a9836e2dacc4047fe15a2ee58cb574e83b8e6850"
+      "sha256": "ce0dad88d5d0f5542117c50923c780603b4a33609049b718967b13e70304859b"
     },
     {
       "path": "modules/lifecycle/routes/project-settings.js",
@@ -9499,6 +9499,11 @@
       "mode": "0000644",
       "sha256": "9c279c29c73a52aca400674e8a369972609e4c295d6b10f3997fd0ffc3064644"
     },
+    {
+      "path": "modules/onboarding/project-facts.js",
+      "mode": "0000644",
+      "sha256": "2a00fcc47148e4d2a01a57c25429df47cc6851c48dc44a772dd2c8c89b111a80"
+    },
     {
       "path": "modules/onboarding/routes/access-requests.js",
       "mode": "0000644",
@@ -9507,7 +9512,7 @@
     {
       "path": "modules/onboarding/routes/genesis-work.js",
       "mode": "0000644",
-      "sha256": "48669d7c25c316c903169281fd3a9fd80aa14c3f3af5eb170869173ee81983bf"
+      "sha256": "3bdab7a940576497a089d0b9ab5b5550ed9a19f6aede09a300723f2d25a84d03"
     },
     {
       "path": "modules/onboarding/routes/onboarding.js",
@@ -10414,6 +10419,11 @@
       "mode": "0000644",
       "sha256": "91ef53244d6290440eafec263168a70dc74085f9ad12cb14c4278ff3ba515293"
     },
+    {
+      "path": "modules/provisioning/project-facts.js",
+      "mode": "0000644",
+      "sha256": "510d25be60459e2a04b2441608d44ae80dfe379b70fef5fdad381eecbe94d13a"
+    },
     {
       "path": "modules/provisioning/project-refusal.js",
       "mode": "0000644",
@@ -10422,7 +10432,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "a947d71cacba76538a51f6ec687b7a68b22dd99bd215fc85c36301e530bb6999"
+      "sha256": "754b1ffbc4ec4ccad42944f576d779407a86cbd34c3f162cb2506a46328477e4"
     },
     {
       "path": "modules/provisioning/public-refusal.js",
@@ -10452,7 +10462,7 @@
     {
       "path": "modules/provisioning/render-sandbox.js",
       "mode": "0000644",
-      "sha256": "4bae78107ff351f73d27162aa9462215f383918a44f5ffda649a01e42ea2c558"
+      "sha256": "9061d1444dfcb216ffc0a7a63c27338aa2655ce711b75fa4be680b3a902429b0"
     },
     {
       "path": "modules/provisioning/render-standup.js",
@@ -11437,7 +11447,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "5732456fd9b1ad4c96295a9648cec0079d59e83f5f4ca153d68394ab5b9bff89"
+      "sha256": "8797889f6b40d5bb0f006ee4e8e7b11403e14365272896654860854c9e19ca65"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -12507,12 +12517,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "05428b8be0243029ed46a428993ca620906b0ee1f57e3429e4781b1f7edf3ee9"
+      "sha256": "fb52a39386be4cbb092a7112152fee766f3e249d0569bfc3171f3cfafe08738d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4154f2c35e85c1fca115795e41e798e9cb2961b3df795e70e0f85ab095fca6da"
+      "sha256": "19858223618afc07847976141572ba53768e53959b06a858b7c6311c1609425d"
     },
     {
       "path": "public-docs/index.html",
@@ -12532,7 +12542,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "781944afcbb4c680e67701912d7e5480e3abaa4b9130c91aedfcb488fda5b4b9"
+      "sha256": "9af40f9fbb9bc2657ff9836096bcba8105ab9bb1325003733cd02e0ddb60c914"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -13202,7 +13212,7 @@
     {
       "path": "scripts/bongos/genesis.js",
       "mode": "0000644",
-      "sha256": "de894ba7c88ff237c9852360482a683ef30b0b55e64a516e83a180303e7c3fb0"
+      "sha256": "ce17d715c254a00de8f000a8aa3e5d6c5dd3d21cfd877e1e6ce29d3d13767aed"
     },
     {
       "path": "scripts/bongos/git-merge-regen.js",
@@ -13277,7 +13287,7 @@
     {
       "path": "scripts/bongos/init.js",
       "mode": "0000644",
-      "sha256": "ac30376e6e1987bbd3768ab171734d57552b24314003d6d5efea1eab8285347e"
+      "sha256": "4a95fd486ff36ffa673669885caf7f0feb36d4f66ab103a10275beffee518804"
     },
     {
       "path": "scripts/bongos/install-git-hooks.js",
@@ -13527,7 +13537,7 @@
     {
       "path": "scripts/bongos/package-core.js",
       "mode": "0000644",
-      "sha256": "a4b7f10de4674acfbcd6fb310c39b0e30d8ea4b4cdb81b4eeb0c5be05708ed1b"
+      "sha256": "f3d161dafdf2e051018aef11d813ac5a479f592d44d542252a0f9342b081a787"
     },
     {
       "path": "scripts/bongos/page-inventory.js",
@@ -13647,7 +13657,7 @@
     {
       "path": "scripts/bongos/provision-render-sandbox.js",
       "mode": "0000644",
-      "sha256": "14399a81a19ab80d2ce59c9ed27eb5741618c6305a9505716114e5354d4004e9"
+      "sha256": "c30bfde5525f3d93e6da60c9c6f4861c7f17196307fe42d72574b517c7180af1"
     },
     {
       "path": "scripts/bongos/provision-render.js",
@@ -13787,7 +13797,7 @@
     {
       "path": "scripts/bongos/render-payload.js",
       "mode": "0000644",
-      "sha256": "31b53f494f011ce8eb0de4058b60842eca72a843f885f2619e9db8f99490958a"
+      "sha256": "54292fba8eec8c63adee38eafa605edd18adf473e0fca42ec1fd19c04073b87a"
     },
     {
       "path": "scripts/bongos/repo-metrics.js",
@@ -15947,7 +15957,7 @@
     {
       "path": "scripts/hall-preview/README.md",
       "mode": "0000644",
-      "sha256": "5ebfcc1c49fecb023da46731d4149f29f479a1fb1bec7acb2bfdd1706d75da95"
+      "sha256": "b9c84c8fdbb9a3c5a3956dbdb0a3e2fde619d5b9e8f11b1b0811689194afaae8"
     },
     {
       "path": "scripts/hall-preview/live-identity.js",
@@ -15972,7 +15982,7 @@
     {
       "path": "scripts/hall-preview/server.js",
       "mode": "0000644",
-      "sha256": "c3d56c9926dfcacde1e279ec66708891c0cde3f27a66703bdcbe84847a19131d"
+      "sha256": "c7e9c7aca0d3cd56831ac26804a274cf0a2857224725469564c587949d6ed57d"
     },
     {
       "path": "scripts/hall-preview/task-visual.js",
@@ -16154,6 +16164,11 @@
       "mode": "0000644",
       "sha256": "f34153ac5fd891904dd6ef06e2c4b3c1f860f487a2b11c9a41c1109369ac570f"
     },
+    {
+      "path": "src/bongos/folder-upload.js",
+      "mode": "0000644",
+      "sha256": "8085da5ea9ba68253edb02293770bfc1c65f626d0bcc71fdba597dab792c3be1"
+    },
     {
       "path": "src/bongos/founding-page-gate.js",
       "mode": "0000644",
@@ -16362,7 +16377,7 @@
     {
       "path": "src/bongos/routes.js",
       "mode": "0000644",
-      "sha256": "72df63aadd1a96a5eaf2f0c2721f3db6b8767f7b3f7f569ba8354c60378e2463"
+      "sha256": "a7c3cbf705fee36ce45fdf49e27956274eb14ded9af24c32cc0632f90d8078de"
     },
     {
       "path": "src/bongos/routes/CLAUDE.md",
@@ -16422,7 +16437,7 @@
     {
       "path": "src/bongos/routes/github.js",
       "mode": "0000644",
-      "sha256": "336f1cbca753a05e590d7877c625ebc62043f0d39f266e88f1cc6cb7c63e3778"
+      "sha256": "d5b236595cf55552c988e7259217c93423de666a4cc22dfda5526b15f6fe5e1f"
     },
     {
       "path": "src/bongos/routes/healthz.js",
@@ -16562,7 +16577,7 @@
     {
       "path": "src/branding.js",
       "mode": "0000644",
-      "sha256": "421b6bfb2878807d015f6f3de9e7a615713901d6d6e99cc4cf264025f0e4ad7e"
+      "sha256": "f0803ec719002667edd05f8c20653081ea9b86d6232b8f5a65ab2b464498e754"
     },
     {
       "path": "src/build-info.js",
@@ -16607,7 +16622,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "821750045960b4c9db0c3e1ccd95a0d74e7139d1746c19f81020bc66f54d9c9a"
+      "sha256": "8cfb866517943458ee73f0c88d6b57db10b7f57aed7adbf6ee9e8df4afb6f83f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16664,6 +16679,16 @@
       "mode": "0000644",
       "sha256": "cd93b675c2567887c29528bfe0cc36f5975b992d564f75ef5179230161da4439"
     },
+    {
+      "path": "src/sandbox/gate.js",
+      "mode": "0000644",
+      "sha256": "56f9c561130c5fb74ac119bf9e398a53eb163af7a7ba7c275c984796da05b6a6"
+    },
+    {
+      "path": "src/sandbox/index.js",
+      "mode": "0000644",
+      "sha256": "589d7fe4ac8a7213eaa432e337dd00cf5855e1387a8d771f738c0e5cb2a62555"
+    },
     {
       "path": "src/sleep.js",
       "mode": "0000644",
@@ -18599,6 +18624,11 @@
       "mode": "0000644",
       "sha256": "0217525dea3e388ea5ce6a2a32287824aadbfe8f0118bfac85a5c8de01dee67e"
     },
+    {
+      "path": "tests/folder_upload_project.mjs",
+      "mode": "0000644",
+      "sha256": "6430a507884d07b9fa1c6990ebe494a0f49f7265bc508e43e88f8640ccf2349d"
+    },
     {
       "path": "tests/founding_birth.mjs",
       "mode": "0000644",
@@ -18692,7 +18722,7 @@
     {
       "path": "tests/genesis_work_routes.mjs",
       "mode": "0000644",
-      "sha256": "3d91108a7cb6ddb1bfc3b0ca8a10459c52658f90e50be93397fd9964caee3eb7"
+      "sha256": "5ada4e8783c322abab4f5e30ad405abab6a1a514f3186b9e7413b0eec2a3aa7e"
     },
     {
       "path": "tests/git_guard.mjs",
@@ -19762,7 +19792,7 @@
     {
       "path": "tests/hall_palette.mjs",
       "mode": "0000644",
-      "sha256": "b2f567dc83c9c68cc1d7793df5334cd61d390b51e55be21a869f9a4cb0b8ad7e"
+      "sha256": "86614581ff3bf9b07210d88d2fea5d4f7ffbd8361339209cff07f3036a5c9fee"
     },
     {
       "path": "tests/hall_preview_encoded_paths.mjs",
@@ -21759,6 +21789,11 @@
       "mode": "0000644",
       "sha256": "97d570d16414bb5c71d54223702058018a13c58cdf563448c7d28e2fcf80488e"
     },
+    {
+      "path": "tests/project_facts.mjs",
+      "mode": "0000644",
+      "sha256": "284f2b969f2d6133df16a3d557af1b4378fbb983619082aa2c8c15a609462ca7"
+    },
     {
       "path": "tests/project_invite_ownership.mjs",
       "mode": "0000644",
@@ -21837,7 +21872,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "923adae7fafc44c933deb8eef4d8861d90d150d4af4f9c52d055143957f5ea16"
+      "sha256": "83728120344e4c62cf70cfa82d5b7bdd7de38ebc87dae0f752e874b3d9e102d1"
     },
     {
       "path": "tests/projects_hub_app_status.mjs",
@@ -21967,7 +22002,7 @@
     {
       "path": "tests/provision_settings_apply.mjs",
       "mode": "0000644",
-      "sha256": "789c04d0ad40943d288597ee3217121160dea94f1033e451f743808dd5ce2b1e"
+      "sha256": "c48b2964fd343ce9fb000b181bdaf5f630945bbca71adfd38958764f399b958a"
     },
     {
       "path": "tests/provision_teardown_address.mjs",
@@ -22132,7 +22167,7 @@
     {
       "path": "tests/provisioning_settings_env.mjs",
       "mode": "0000644",
-      "sha256": "8f3735a2b63020d617312827b5594c2cb2ee6aecbffcf4aabbf7083a4306990b"
+      "sha256": "481fa827c79c2d2a0d89d5029e5b991fe8bc62200906b1b560f0d725863aff67"
     },
     {
       "path": "tests/provisioning_slug_available.mjs",
@@ -22177,7 +22212,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "5c4afce4ed9e455816aa72bb307751e393dc483de21e9fde4624e7788c0a40fa"
+      "sha256": "fbad66e017c8234900903b248f1f0caa26b54ce6b886b40e2389c6d7c329aa5e"
     },
     {
       "path": "tests/public_mirror_export.mjs",
@@ -22402,7 +22437,7 @@
     {
       "path": "tests/render_sandbox.mjs",
       "mode": "0000644",
-      "sha256": "680d32b52f8bc4a9d04d7bd469ef64e42a236ba230d8b46bab7c08680f80ae60"
+      "sha256": "61229d01a0498a0fa83bf68079ef3d8634b1c89d1f95fef1e8d5eb128768d62c"
     },
     {
       "path": "tests/repo_info_binding.mjs",
@@ -22529,6 +22564,11 @@
       "mode": "0000644",
       "sha256": "285f803272da6da754355017a32eda02b0639ed45c0fdf13366fcb5ad64b9b2e"
     },
+    {
+      "path": "tests/sandbox_gate.mjs",
+      "mode": "0000644",
+      "sha256": "805b16f338cfc69e9b9c0a9ef606258942c349ddad985a050d10cff541129caf"
+    },
     {
       "path": "tests/sandbox_stage.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 736 operations across 88 resource groups
+- 740 operations across 88 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -497,8 +497,14 @@ function createClient(opts = {}) {
       getFoundingContext: (args) => request("GET", "/founding/context", { hasBody: false }, args),
       // PUT /founding/enabled — rank: any-builder — PUT /founding/enabled
       putFoundingEnabled: (args) => request("PUT", "/founding/enabled", { hasBody: true }, args),
+      // GET /founding/facts — rank: any-builder — GET /founding/facts
+      getFoundingFacts: (args) => request("GET", "/founding/facts", { hasBody: false }, args),
+      // PUT /founding/facts — rank: any-builder — PUT /founding/facts
+      putFoundingFacts: (args) => request("PUT", "/founding/facts", { hasBody: true }, args),
       // GET /founding/genesis — rank: any-builder — GET /founding/genesis
       getFoundingGenesis: (args) => request("GET", "/founding/genesis", { hasBody: false }, args),
+      // GET /founding/legalize/options — rank: any-builder — GET /founding/legalize/options
+      getFoundingLegalizeOptions: (args) => request("GET", "/founding/legalize/options", { hasBody: false }, args),
       // POST /founding/plan — rank: any-builder — POST /founding/plan
       postFoundingPlan: (args) => request("POST", "/founding/plan", { hasBody: true }, args),
       // POST /founding/skip — rank: any-builder — POST /founding/skip
@@ -563,6 +569,8 @@ function createClient(opts = {}) {
       getGithubRepos: (args) => request("GET", "/github/repos", { hasBody: false }, args),
       // POST /github/repos — rank: any-builder — POST /github/repos
       postGithubRepos: (args) => request("POST", "/github/repos", { hasBody: true }, args),
+      // POST /github/repos/upload — rank: any-builder — POST /github/repos/upload
+      postGithubReposUpload: (args) => request("POST", "/github/repos/upload", { hasBody: true }, args),
     },
     "goalTaskRelevance": {
       // POST /goal-task-relevance/{id}/decide — rank: metic+archon — POST /goal-task-relevance/:id/decide

package/clients/bongos-client/index.cjs

@@ -496,8 +496,14 @@ function createClient(opts = {}) {
       getFoundingContext: (args) => request("GET", "/founding/context", { hasBody: false }, args),
       // PUT /founding/enabled — rank: any-builder — PUT /founding/enabled
       putFoundingEnabled: (args) => request("PUT", "/founding/enabled", { hasBody: true }, args),
+      // GET /founding/facts — rank: any-builder — GET /founding/facts
+      getFoundingFacts: (args) => request("GET", "/founding/facts", { hasBody: false }, args),
+      // PUT /founding/facts — rank: any-builder — PUT /founding/facts
+      putFoundingFacts: (args) => request("PUT", "/founding/facts", { hasBody: true }, args),
       // GET /founding/genesis — rank: any-builder — GET /founding/genesis
       getFoundingGenesis: (args) => request("GET", "/founding/genesis", { hasBody: false }, args),
+      // GET /founding/legalize/options — rank: any-builder — GET /founding/legalize/options
+      getFoundingLegalizeOptions: (args) => request("GET", "/founding/legalize/options", { hasBody: false }, args),
       // POST /founding/plan — rank: any-builder — POST /founding/plan
       postFoundingPlan: (args) => request("POST", "/founding/plan", { hasBody: true }, args),
       // POST /founding/skip — rank: any-builder — POST /founding/skip
@@ -562,6 +568,8 @@ function createClient(opts = {}) {
       getGithubRepos: (args) => request("GET", "/github/repos", { hasBody: false }, args),
       // POST /github/repos — rank: any-builder — POST /github/repos
       postGithubRepos: (args) => request("POST", "/github/repos", { hasBody: true }, args),
+      // POST /github/repos/upload — rank: any-builder — POST /github/repos/upload
+      postGithubReposUpload: (args) => request("POST", "/github/repos/upload", { hasBody: true }, args),
     },
     "goalTaskRelevance": {
       // POST /goal-task-relevance/{id}/decide — rank: metic+archon — POST /goal-task-relevance/:id/decide

package/clients/bongos-client/index.d.ts

@@ -407,6 +407,8 @@ export interface PostGithubRepoVisibilityRequest { repo: string; visibility: "pu
 export interface PostGithubRepoVisibilityResponse { ok: boolean; repo: unknown; private_deployable: boolean }
 export interface PostGithubReposRequest { name: string; org?: string }
 export interface PostGithubReposResponse { repo: unknown }
+export interface PostGithubReposUploadRequest { name?: string; org?: string; into?: string; files?: unknown[] }
+export interface PostGithubReposUploadResponse { repo: unknown; uploaded: unknown }
 export interface PostGoalTaskRelevanceIdDecideRequest { decision: "confirmed_gaming" | "false_positive"; note?: string }
 export interface PostGoalTaskRelevanceIdDecideResponse { ok: boolean; flag: unknown }
 export interface PostGoalsIdArchiveRequest { reason?: string; dispositions?: Record<string, unknown> }
@@ -741,6 +743,7 @@ export interface PutCopyDeskPagesPageIdDraftResponse { ok: boolean; outcome: unk
 export interface PutDoneWhenCriterionIdBackendOnlyRequest { backend_only: boolean }
 export interface PutDoneWhenCriterionIdBackendOnlyResponse { ok: boolean; criterion_id: unknown; backend_only: unknown }
 export interface PutFoundingEnabledRequest { enabled?: boolean }
+export interface PutFoundingFactsRequest { facts: Record<string, unknown> }
 export interface PutFoundingWorkStageAnswersQuestionRequest { state?: string; text?: string; origin?: string; if_empty?: boolean }
 export interface PutFoundingWorkStageDoorRequest { door: string }
 export interface PutFoundingWorkStageLinkRequest { url?: string }
@@ -1194,8 +1197,14 @@ export interface BongosClient {
     getFoundingContext(args?: RequestArgs): Promise<ApiResponse>;
     /** PUT /founding/enabled — rank: any-builder */
     putFoundingEnabled(args?: RequestArgs & { body?: PutFoundingEnabledRequest }): Promise<ApiResponse>;
+    /** GET /founding/facts — rank: any-builder */
+    getFoundingFacts(args?: RequestArgs): Promise<ApiResponse>;
+    /** PUT /founding/facts — rank: any-builder */
+    putFoundingFacts(args: RequestArgs & { body: PutFoundingFactsRequest }): Promise<ApiResponse>;
     /** GET /founding/genesis — rank: any-builder */
     getFoundingGenesis(args?: RequestArgs): Promise<ApiResponse>;
+    /** GET /founding/legalize/options — rank: any-builder */
+    getFoundingLegalizeOptions(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /founding/plan — rank: any-builder */
     postFoundingPlan(args?: RequestArgs & { body?: PostFoundingPlanRequest }): Promise<ApiResponse>;
     /** POST /founding/skip — rank: any-builder */
@@ -1260,6 +1269,8 @@ export interface BongosClient {
     getGithubRepos(args?: RequestArgs): Promise<GetGithubReposResponse>;
     /** POST /github/repos — rank: any-builder */
     postGithubRepos(args: RequestArgs & { body: PostGithubReposRequest }): Promise<PostGithubReposResponse>;
+    /** POST /github/repos/upload — rank: any-builder */
+    postGithubReposUpload(args?: RequestArgs & { body?: PostGithubReposUploadRequest }): Promise<PostGithubReposUploadResponse>;
   };
   "goalTaskRelevance": {
     /** POST /goal-task-relevance/{id}/decide — rank: metic+archon */

package/clients/bongos-client/index.mjs

@@ -493,8 +493,14 @@ export function createClient(opts = {}) {
       getFoundingContext: (args) => request("GET", "/founding/context", { hasBody: false }, args),
       // PUT /founding/enabled — rank: any-builder — PUT /founding/enabled
       putFoundingEnabled: (args) => request("PUT", "/founding/enabled", { hasBody: true }, args),
+      // GET /founding/facts — rank: any-builder — GET /founding/facts
+      getFoundingFacts: (args) => request("GET", "/founding/facts", { hasBody: false }, args),
+      // PUT /founding/facts — rank: any-builder — PUT /founding/facts
+      putFoundingFacts: (args) => request("PUT", "/founding/facts", { hasBody: true }, args),
       // GET /founding/genesis — rank: any-builder — GET /founding/genesis
       getFoundingGenesis: (args) => request("GET", "/founding/genesis", { hasBody: false }, args),
+      // GET /founding/legalize/options — rank: any-builder — GET /founding/legalize/options
+      getFoundingLegalizeOptions: (args) => request("GET", "/founding/legalize/options", { hasBody: false }, args),
       // POST /founding/plan — rank: any-builder — POST /founding/plan
       postFoundingPlan: (args) => request("POST", "/founding/plan", { hasBody: true }, args),
       // POST /founding/skip — rank: any-builder — POST /founding/skip
@@ -559,6 +565,8 @@ export function createClient(opts = {}) {
       getGithubRepos: (args) => request("GET", "/github/repos", { hasBody: false }, args),
       // POST /github/repos — rank: any-builder — POST /github/repos
       postGithubRepos: (args) => request("POST", "/github/repos", { hasBody: true }, args),
+      // POST /github/repos/upload — rank: any-builder — POST /github/repos/upload
+      postGithubReposUpload: (args) => request("POST", "/github/repos/upload", { hasBody: true }, args),
     },
     "goalTaskRelevance": {
       // POST /goal-task-relevance/{id}/decide — rank: metic+archon — POST /goal-task-relevance/:id/decide

package/docs/adr/0406-every-project-gets-a-sandbox-that-follows-main-and-live-moves-only-when-a-person-promotes.md

@@ -124,3 +124,11 @@ Each sibling task's description now opens with a dated note, *"Re-read against A
 - **Ship mode is untouched.** No ship, in Auto or Manual mode, reaches the promote leg; landing reaches the sandbox only.
 - **What this cannot stop, said plainly.** The owner can still deploy the live service from Render's own dashboard, or turn its automatic deploys back on there. Bongos does not see or record those. "Nothing reaches the main site without a recorded promotion" holds for everything Bongos does, not for what the owner does in Render directly.
 
+## 12. Amendment — the sandbox's safety, as built (2026-11-13, [task 1005291](https://cloudbongos.com/builders#/task/1005291))
+
+- **Fake by default, by construction.** The sandbox service is created with only `BONGOS_SANDBOX=1` and its own `DATABASE_URL`; none of the live app's keys are copied to it. A sandbox the owner has not touched holds no real key, so nothing it does can reach a real customer. Test keys and test data are added by the owner or seeded by the app (`isSandbox()`).
+- **The gate ships in the core package** as `@bongos/core/sandbox` (`src/sandbox/`). One line at the top of a Node app — `require('@bongos/core/sandbox').install()` — does nothing on the live site and, under `BONGOS_SANDBOX=1`, puts the gate in front of `fetch`, `http` and `https`. For each known provider (payments, email, messaging, code hosting and a few data services) a read passes; a send, a charge or a write is refused, never sent, written to the log as `[bongos-sandbox] refused …` (Render shows it), and kept for the owner. A Stripe **test-mode** key is let through, since it cannot move real money.
+- **Visibly a sandbox.** `sandbox.middleware` puts a fixed "Sandbox" band on every HTML page and serves `/__bongos/sandbox`, which tells anyone what a sandbox is and what the gate cannot catch. The refusals and which real keys are lent (by variable name, never value) show only to a visitor carrying the sandbox's page key — a random value the platform sets on the sandbox (`BONGOS_SANDBOX_PAGE_KEY`) and keeps on the project's row, so only the owner's project page links with it. A passer-by on the sandbox's public address learns nothing about the owner's keys.
+- **The starter says how.** The scaffold's README (`bongos init`) carries the one line, and the advice to lend a read-only key.
+- **What it cannot catch, said plainly — here, on the sandbox page, and on the project page.** Only calls the app makes through Node's own web requests, and only to providers in its table. Code that goes around them, an app not written in Node, or an unknown provider is not stopped. A read-only key is the floor; the gate is the second wall. The free plan also blocks outgoing email ports.
+