@bongos/core 1.25.4 → 1.25.5

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.25.4",
-  "core_contract": "1.25.4",
-  "source_commit": "54f92d0726f9d8abd3e0e893a0122299963078fc",
+  "core_version": "1.25.5",
+  "core_contract": "1.25.5",
+  "source_commit": "095393e44481a16a8764084c02bc478f88127826",
   "source_ref": "HEAD",
-  "built_at": "2026-11-12T23:46:04.539Z",
+  "built_at": "2026-11-13T04:03:13.962Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 654,
     "agent_docs_stubbed": 32,
-    "functional_verbatim": 3992,
+    "functional_verbatim": 3996,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4679,
-  "tree_sha256": "37542ae5f076d40f03deb3171f2900d791d77910c8b0e008ac9ef0c94ac9a96a",
+  "file_count": 4683,
+  "tree_sha256": "7bee86259715879e702ebce474621fdcacaefdcbfec4f526604e05b59c9b3484",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -332,12 +332,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "ed95879a40c6624dda1681930638ce528645de0de79003c4622e8edf97a9cfec"
+      "sha256": "f708a93778599fa4e5598d265766436184beb03b1ab2876aecd68c41eeab6358"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "534f04acb46cdf1a13ebbaf15af37488b93daba3eef39ab05c827ebeeebc551f"
+      "sha256": "01e1b81c1bd594dd0d2f044dfa2a366aa0b185dde4cd041001c551742e1b52d3"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -347,17 +347,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "d4a8ca745ce3c3aa7ee83e3b6dad2071d9bb31d82104002c0f8d62785a24fd8f"
+      "sha256": "1e8e8ff332ccdd9fcf9f5b0847b6a7938903bf9564abc9a1e3c1070682afd1c7"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "e7ce03b5c6d9c370c9fa0380911a83c17945c3eb9535252b4d396da5675149cf"
+      "sha256": "9fa2ee83d1d6b068f727c32f510dd9fdf1bd98d6caa1a401e9b263fd5af5eea9"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "2f6c7c1de4f5fe6abb98aec6993ef7fa212f42dcf513b33f82213578765cc952"
+      "sha256": "6e9d62b3dcf0e8e760afa2aab9afcd0470ae4a1f649918486f8839ba12fd18c8"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2497,12 +2497,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "63bf723ba632d53f26bc2850623f0ce85d40fabcb65aadd693808663c5822ded"
+      "sha256": "2ad27bf8ccbe4b3349d7f45ac2756bb314478eac2563239dd708cc82b7871e6a"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "4b1c9bdd62f88e916be092ecffe6b70c90ac08fc709afa372ce992c88a2070f6"
+      "sha256": "98b41ef963ce5a1009851a8d2cea6e421b02edb46c2f50a9cb809c2d1670bf6b"
     },
     {
       "path": "docs/architecture.md",
@@ -3087,7 +3087,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "14a5fc426f87175460ed546e7e421cfb6d1d7fc067b7ec5fe1cc16bbaa8b4651"
+      "sha256": "6c8db5f3d03887690f13f153942bcd1a8485e51473bd6e8a8584fc9de13c46f5"
     },
     {
       "path": "docs/modules-contract.md",
@@ -10139,10 +10139,15 @@
       "mode": "0000644",
       "sha256": "ff20f9e15d437638b4122392f21283598681c0564bb50788f6fb7ec770722e35"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_037_update_subscribed.sql",
+      "mode": "0000644",
+      "sha256": "bb1f63759204c9c8022bda6dc2619dc9f12d6e512c1c129a30ba8c6e9ec41ab6"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
-      "sha256": "a1ac12bb92dc303a819878b15f620f59c1edd4a4a3317eacc965117a9a8ce679"
+      "sha256": "cf3310beddd37559b57a4fa996430d73e6957b297bfa675ed46148b926dd4150"
     },
     {
       "path": "modules/provisioning/onboard-plan.js",
@@ -10272,7 +10277,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "c72d11bef0a5fd0f8bbf070dbc28152caac1b1babbdfc9de101172c4fc99d33d"
+      "sha256": "955f854e4b90892aae4bfc58f258f96f72de06af35389362f61b204cef80bfaf"
     },
     {
       "path": "modules/provisioning/routes/render-standup.js",
@@ -10284,6 +10289,11 @@
       "mode": "0000644",
       "sha256": "70a66e07e1bec13759b7b41b76ef009931c674867a6fa5270aff7bf3f6d31ecc"
     },
+    {
+      "path": "modules/provisioning/routes/update-subscription.js",
+      "mode": "0000644",
+      "sha256": "6595fcab0d5de5a6281aae1ec3db376aa5cbdf8406e3dfbb4d750a7ff0be2a64"
+    },
     {
       "path": "modules/provisioning/screening.js",
       "mode": "0000644",
@@ -12227,12 +12237,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "64aca3f420ab1c244e6e0da1c255f7c7a41c49f9370cda2ecebaa8a47d006da3"
+      "sha256": "78d48441e049a15bee43f6853bc005719770cdb7144bb4b40404f06b87cbf65a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3b1217c94f2a73ef137b3cef6a150ffaded568479178ad1f0a8f4b57c0d1983f"
+      "sha256": "cdec3c6aaf13f30b623f43c601a6ca5765a39d9408f35c0901335ea6d55ff3e6"
     },
     {
       "path": "public-docs/index.html",
@@ -12252,7 +12262,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "c29dbb324350fdc524b08c15fba8be85bdd78fb3a8759812f8335d83b3803ce1"
+      "sha256": "678e09f8d3f0e83ad0c1b9e02421db99231530fb7b5d951e603e4257c1fa14e0"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -13877,12 +13887,12 @@
     {
       "path": "scripts/bongos/update-channel.js",
       "mode": "0000644",
-      "sha256": "f23e3667cc373215997c412e731e6e3252d9f9b85fa6f6b46024ba5d9dfb1bf9"
+      "sha256": "b36cf627b9dd862f171822156dcb6d9623ba2d61a609125c75b38ab8dd6536d4"
     },
     {
       "path": "scripts/bongos/update-sweep.js",
       "mode": "0000644",
-      "sha256": "0b980f1b667ee73e52229bec63b40b8b50725c96178452df2508622724f50e8e"
+      "sha256": "6aa3e527c2cb49ab147d8156a49bda9084131a708122b28eba797b090836048b"
     },
     {
       "path": "scripts/bongos/upgrade-artist-gate.js",
@@ -15707,7 +15717,7 @@
     {
       "path": "src/bongos/api-errors.js",
       "mode": "0000644",
-      "sha256": "031bc92f93daba9fd332449f69832261af8d9fbb83026cbe700a504531f5a61a"
+      "sha256": "b3527d2014da3f141a6351f7c1daa2aec1ef43935b779a99d1d2a7faa21521ae"
     },
     {
       "path": "src/bongos/api-path-404.js",
@@ -15802,7 +15812,7 @@
     {
       "path": "src/bongos/db.js",
       "mode": "0000644",
-      "sha256": "5eb2da3ce4e2b2340cea3eb8b391c28415ea848ae8016504c100a3e8a90f445e"
+      "sha256": "db2eefddf1d69a5ae5a43f1c6a5235f951ee1e23cca9ff4ce45910f1c7880a61"
     },
     {
       "path": "src/bongos/device-approval.js",
@@ -16012,7 +16022,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "c25614561abc45b7ab1f9e014e9b1ff7ee027d4928618a50d2f3d13d0b7a3773"
+      "sha256": "374034d7015bccdb28729f328e752773219f8b703f89affe154c04fdb130865d"
     },
     {
       "path": "src/bongos/routes.js",
@@ -16057,7 +16067,7 @@
     {
       "path": "src/bongos/routes/builders.js",
       "mode": "0000644",
-      "sha256": "775ab4581124e9ccb0d4c195ade3147e65e301ca5c055fdeb3bf8fc68aa8b856"
+      "sha256": "9fccaac46052db95614c66396719b7b710e5480e5b1381ba1677fb768239576e"
     },
     {
       "path": "src/bongos/routes/cli-commands.js",
@@ -16262,7 +16272,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "bc5de69383b4a204e65b36fe8bf271bea18abdba915771abec35da1096614a91"
+      "sha256": "020b1e30dd86433757c2939761aa01abe097e1e5aa6f1043d0a0050138b4d06c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -17109,6 +17119,11 @@
       "mode": "0000644",
       "sha256": "215f53db8e7fd45d0f229ff7e67d8b1d16ec80b25e8d9f7070dfe65898b6cb8a"
     },
+    {
+      "path": "tests/builder_card_requirement.mjs",
+      "mode": "0000644",
+      "sha256": "612308a0650bc6bb7eedbd3340bb863f5893a907bc62ae4a8b2f49829820af71"
+    },
     {
       "path": "tests/builder_needs.mjs",
       "mode": "0000644",
@@ -21714,6 +21729,11 @@
       "mode": "0000644",
       "sha256": "31f7a766772450f2f79a43126154f9840d9a22972f0fcc9399f71dfbf95c43a2"
     },
+    {
+      "path": "tests/provisioning_update_subscription_route.mjs",
+      "mode": "0000644",
+      "sha256": "5ffe5b0271b8a256da33617e30b20baf4a037523fc6e23298b6826fdb8fc3208"
+    },
     {
       "path": "tests/provisioning_wizard_create_xenos.mjs",
       "mode": "0000644",
@@ -23117,7 +23137,7 @@
     {
       "path": "tests/update_channel_db.mjs",
       "mode": "0000644",
-      "sha256": "2f4e16a3bffef6bf1d3dccc04a325c694760faf19c70e3678d58c21c17a851a7"
+      "sha256": "ee73e3a43fc0b9133b72a032b1ffc88f5be2a8f4abcb39333a58e4a2c47aaedd"
     },
     {
       "path": "tests/update_pill.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 699 operations across 85 resource groups
+- 701 operations across 85 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -293,6 +293,8 @@ function createClient(opts = {}) {
       patchBuildersIdBudget: (args) => request("PATCH", "/builders/{id}/budget", { hasBody: true }, args),
       // PATCH /builders/{id}/capabilities — rank: archon — PATCH /builders/:id/capabilities
       patchBuildersIdCapabilities: (args) => request("PATCH", "/builders/{id}/capabilities", { hasBody: true }, args),
+      // PATCH /builders/{id}/card-requirement — rank: archon — PATCH /builders/:id/card-requirement
+      patchBuildersIdCardRequirement: (args) => request("PATCH", "/builders/{id}/card-requirement", { hasBody: true }, args),
       // GET /builders/{id}/onboarding — rank: public — GET /builders/:id/onboarding
       getBuildersIdOnboarding: (args) => request("GET", "/builders/{id}/onboarding", { hasBody: false }, args),
       // GET /builders/{id}/profile — rank: public — GET /builders/:id/profile
@@ -1279,6 +1281,8 @@ function createClient(opts = {}) {
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/update-channel — rank: archon — POST /provisioning/instances/:id/update-channel
       postProvisioningInstancesIdUpdateChannel: (args) => request("POST", "/provisioning/instances/{id}/update-channel", { hasBody: true }, args),
+      // POST /provisioning/instances/{id}/update-subscription — rank: metic+archon — POST /provisioning/instances/:id/update-subscription
+      postProvisioningInstancesIdUpdateSubscription: (args) => request("POST", "/provisioning/instances/{id}/update-subscription", { hasBody: true }, args),
       // GET /provisioning/logos/{file} — rank: public — GET /provisioning/logos/:file
       getProvisioningLogosFile: (args) => request("GET", "/provisioning/logos/{file}", { hasBody: false }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan

package/clients/bongos-client/index.cjs

@@ -292,6 +292,8 @@ function createClient(opts = {}) {
       patchBuildersIdBudget: (args) => request("PATCH", "/builders/{id}/budget", { hasBody: true }, args),
       // PATCH /builders/{id}/capabilities — rank: archon — PATCH /builders/:id/capabilities
       patchBuildersIdCapabilities: (args) => request("PATCH", "/builders/{id}/capabilities", { hasBody: true }, args),
+      // PATCH /builders/{id}/card-requirement — rank: archon — PATCH /builders/:id/card-requirement
+      patchBuildersIdCardRequirement: (args) => request("PATCH", "/builders/{id}/card-requirement", { hasBody: true }, args),
       // GET /builders/{id}/onboarding — rank: public — GET /builders/:id/onboarding
       getBuildersIdOnboarding: (args) => request("GET", "/builders/{id}/onboarding", { hasBody: false }, args),
       // GET /builders/{id}/profile — rank: public — GET /builders/:id/profile
@@ -1278,6 +1280,8 @@ function createClient(opts = {}) {
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/update-channel — rank: archon — POST /provisioning/instances/:id/update-channel
       postProvisioningInstancesIdUpdateChannel: (args) => request("POST", "/provisioning/instances/{id}/update-channel", { hasBody: true }, args),
+      // POST /provisioning/instances/{id}/update-subscription — rank: metic+archon — POST /provisioning/instances/:id/update-subscription
+      postProvisioningInstancesIdUpdateSubscription: (args) => request("POST", "/provisioning/instances/{id}/update-subscription", { hasBody: true }, args),
       // GET /provisioning/logos/{file} — rank: public — GET /provisioning/logos/:file
       getProvisioningLogosFile: (args) => request("GET", "/provisioning/logos/{file}", { hasBody: false }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan

package/clients/bongos-client/index.d.ts

@@ -231,6 +231,8 @@ export interface PatchBuildersIdBudgetRequest { monthly_budget_usd?: unknown }
 export interface PatchBuildersIdBudgetResponse { builder: unknown }
 export interface PatchBuildersIdCapabilitiesRequest { server: boolean }
 export interface PatchBuildersIdCapabilitiesResponse { builder: unknown }
+export interface PatchBuildersIdCardRequirementRequest { require_card: boolean }
+export interface PatchBuildersIdCardRequirementResponse { builder: unknown }
 export interface PatchBuildersIdRankRequest { rank: string }
 export interface PatchBuildersIdRankResponse { builder: unknown; previous_rank: unknown; direction: unknown; credit_delta: unknown; broadcast: unknown }
 export interface PatchBuildersIdStatusRequest { status: "active" | "inactive"; reason?: string }
@@ -602,6 +604,8 @@ export interface PostProvisioningInstancesIdRenderResponse { ok: boolean; queued
 export interface PostProvisioningInstancesIdRepoPrivateResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; message: unknown }
 export interface PostProvisioningInstancesIdRestartResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; message: unknown }
 export interface PostProvisioningInstancesIdTeardownResponse { ok: boolean; queued: unknown; action: unknown; status: unknown; superseded: unknown; message: unknown }
+export interface PostProvisioningInstancesIdUpdateSubscriptionRequest { subscribed: boolean }
+export interface PostProvisioningInstancesIdUpdateSubscriptionResponse { ok: boolean; update_subscribed: unknown; previous: unknown; changed: unknown }
 export interface PostProvisioningInstancesRequest { slug: string; target_ref?: string; hosting_shape?: string; domain?: string; no_address?: boolean; tier?: string; onboard_mode?: string; type?: string; description?: string; detail?: Record<string, unknown>; modules?: string[]; terms_acknowledged?: boolean; demo?: Record<string, unknown>; ship_mode?: "auto" | "manual"; genesis?: boolean }
 export interface PostProvisioningPhysicsCheckRequest { description?: string; detail?: Record<string, unknown> }
 export interface PostProvisioningPhysicsCheckResponse { stop: boolean; message: unknown; soft_limits: unknown }
@@ -960,6 +964,8 @@ export interface BongosClient {
     patchBuildersIdBudget(args?: RequestArgs & { body?: PatchBuildersIdBudgetRequest }): Promise<PatchBuildersIdBudgetResponse>;
     /** PATCH /builders/{id}/capabilities — rank: archon */
     patchBuildersIdCapabilities(args: RequestArgs & { body: PatchBuildersIdCapabilitiesRequest }): Promise<PatchBuildersIdCapabilitiesResponse>;
+    /** PATCH /builders/{id}/card-requirement — rank: archon */
+    patchBuildersIdCardRequirement(args: RequestArgs & { body: PatchBuildersIdCardRequirementRequest }): Promise<PatchBuildersIdCardRequirementResponse>;
     /** GET /builders/{id}/onboarding — rank: public */
     getBuildersIdOnboarding(args?: RequestArgs): Promise<GetBuildersIdOnboardingResponse>;
     /** GET /builders/{id}/profile — rank: public */
@@ -1946,6 +1952,8 @@ export interface BongosClient {
     postProvisioningInstancesIdTeardown(args?: RequestArgs): Promise<PostProvisioningInstancesIdTeardownResponse>;
     /** POST /provisioning/instances/{id}/update-channel — rank: archon */
     postProvisioningInstancesIdUpdateChannel(args?: RequestArgs): Promise<ApiResponse>;
+    /** POST /provisioning/instances/{id}/update-subscription — rank: metic+archon */
+    postProvisioningInstancesIdUpdateSubscription(args: RequestArgs & { body: PostProvisioningInstancesIdUpdateSubscriptionRequest }): Promise<PostProvisioningInstancesIdUpdateSubscriptionResponse>;
     /** GET /provisioning/logos/{file} — rank: public */
     getProvisioningLogosFile(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /provisioning/onboard-plan — rank: public */

package/clients/bongos-client/index.mjs

@@ -289,6 +289,8 @@ export function createClient(opts = {}) {
       patchBuildersIdBudget: (args) => request("PATCH", "/builders/{id}/budget", { hasBody: true }, args),
       // PATCH /builders/{id}/capabilities — rank: archon — PATCH /builders/:id/capabilities
       patchBuildersIdCapabilities: (args) => request("PATCH", "/builders/{id}/capabilities", { hasBody: true }, args),
+      // PATCH /builders/{id}/card-requirement — rank: archon — PATCH /builders/:id/card-requirement
+      patchBuildersIdCardRequirement: (args) => request("PATCH", "/builders/{id}/card-requirement", { hasBody: true }, args),
       // GET /builders/{id}/onboarding — rank: public — GET /builders/:id/onboarding
       getBuildersIdOnboarding: (args) => request("GET", "/builders/{id}/onboarding", { hasBody: false }, args),
       // GET /builders/{id}/profile — rank: public — GET /builders/:id/profile
@@ -1275,6 +1277,8 @@ export function createClient(opts = {}) {
       postProvisioningInstancesIdTeardown: (args) => request("POST", "/provisioning/instances/{id}/teardown", { hasBody: true }, args),
       // POST /provisioning/instances/{id}/update-channel — rank: archon — POST /provisioning/instances/:id/update-channel
       postProvisioningInstancesIdUpdateChannel: (args) => request("POST", "/provisioning/instances/{id}/update-channel", { hasBody: true }, args),
+      // POST /provisioning/instances/{id}/update-subscription — rank: metic+archon — POST /provisioning/instances/:id/update-subscription
+      postProvisioningInstancesIdUpdateSubscription: (args) => request("POST", "/provisioning/instances/{id}/update-subscription", { hasBody: true }, args),
       // GET /provisioning/logos/{file} — rank: public — GET /provisioning/logos/:file
       getProvisioningLogosFile: (args) => request("GET", "/provisioning/logos/{file}", { hasBody: false }, args),
       // GET /provisioning/onboard-plan — rank: public — GET /provisioning/onboard-plan

package/docs/api/openapi.json

@@ -4324,6 +4324,72 @@
         ]
       }
     },
+    "/builders/{id}/card-requirement": {
+      "patch": {
+        "operationId": "patch_builders_id_card_requirement",
+        "tags": [
+          "builders"
+        ],
+        "summary": "PATCH /builders/:id/card-requirement",
+        "description": "PATCH /builders/:id/card-requirement — an Archon switches the hardware-card requirement on or off for one builder (task 1004748, ADR 0382 D4). Body: { require_card: boolean }. Default is off for everyone. Switching ON refuses 409 no_card_registered unless the builder has a registered card, so the switch cannot lock anyone out. You cannot switch OFF your own requirement (403 cannot_disable_own_card_requirement) — a stolen session must not be able to drop it; another Archon does it. Every change writes an audit row naming the target. rank: archon. Gate: requirePermission('builder.rank.set') (the non-delegable atom that guards the step-up's own target route) then requireCardStepUp; read fresh per request.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `builder.rank.set` (all required).",
+        "x-rank": "archon",
+        "x-source": "src/bongos/routes/builders.js",
+        "x-permissions": [
+          "builder.rank.set"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PatchBuildersIdCardRequirementRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PatchBuildersIdCardRequirementResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/builders/{id}/onboarding": {
       "get": {
         "operationId": "get_builders_id_onboarding",
@@ -24804,6 +24870,72 @@
         ]
       }
     },
+    "/provisioning/instances/{id}/update-subscription": {
+      "post": {
+        "operationId": "post_provisioning_instances_id_update_subscription",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "POST /provisioning/instances/:id/update-subscription",
+        "description": "Body: { subscribed: boolean }. Gate: the 'provisioning.fleet.manage' permission — the fleet's own.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `provisioning.fleet.manage` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/provisioning/routes/update-subscription.js",
+        "x-permissions": [
+          "provisioning.fleet.manage"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostProvisioningInstancesIdUpdateSubscriptionRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostProvisioningInstancesIdUpdateSubscriptionResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/provisioning/logos/{file}": {
       "get": {
         "operationId": "get_provisioning_logos_file",
@@ -35357,6 +35489,27 @@
           "builder"
         ]
       },
+      "PatchBuildersIdCardRequirementRequest": {
+        "type": "object",
+        "properties": {
+          "require_card": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "require_card"
+        ],
+        "additionalProperties": false
+      },
+      "PatchBuildersIdCardRequirementResponse": {
+        "type": "object",
+        "properties": {
+          "builder": {}
+        },
+        "required": [
+          "builder"
+        ]
+      },
       "PatchBuildersIdRankRequest": {
         "type": "object",
         "properties": {
@@ -41304,6 +41457,35 @@
           "message"
         ]
       },
+      "PostProvisioningInstancesIdUpdateSubscriptionRequest": {
+        "type": "object",
+        "properties": {
+          "subscribed": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "subscribed"
+        ],
+        "additionalProperties": false
+      },
+      "PostProvisioningInstancesIdUpdateSubscriptionResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "update_subscribed": {},
+          "previous": {},
+          "changed": {}
+        },
+        "required": [
+          "ok",
+          "update_subscribed",
+          "previous",
+          "changed"
+        ]
+      },
       "PostProvisioningInstancesRequest": {
         "type": "object",
         "properties": {
@@ -43737,9 +43919,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 699,
-  "x-schema-count": 734,
+  "x-endpoint-count": 701,
+  "x-schema-count": 738,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 464,
+  "x-response-schemas": 466,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 699 endpoints across 117 route files.
+> **Generated from the live route files** — the route file is authoritative. 701 endpoints across 118 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -161,7 +161,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 |---|---|---|---|---|
 | GET | `/api/bongos/bug-attachments/:name` | `any-builder` | — | GET /api/bongos/bug-attachments/:name — stream one stored image. |
 
-## `builders` (14)
+## `builders` (15)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -171,6 +171,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/builders/:id/activity` | `any-builder` | — | GET /builders/:id/activity — the profile's PER-CRAFT activity log (task 1003281, goal 1000072, criterion legibility-activity-by-role). |
 | PATCH | `/api/bongos/builders/:id/budget` | `metic+archon` | `monthly_budget_usd` | PATCH /builders/:id/budget — set or clear a builder's monthly spend ceiling (V3.R84 task 302, criterion C3). |
 | PATCH | `/api/bongos/builders/:id/capabilities` | `archon` | `server` | PATCH /builders/:id/capabilities — the owner gives or takes a builder's server access (task 1004950, ADR 0395). |
+| PATCH | `/api/bongos/builders/:id/card-requirement` | `archon` | `require_card` | PATCH /builders/:id/card-requirement — an Archon switches the hardware-card requirement on or off for one builder (task 1004748, ADR 0382… |
 | GET | `/api/bongos/builders/:id/onboarding` | `public` | — | GET /builders/:id/onboarding — V3.R75 (task 294) onboarding checklist read. |
 | GET | `/api/bongos/builders/:id/profile` | `public` | — | GET /builders/:id/profile — the viewable builder profile page's read (task 1467, goal 25 "bx-identity"). |
 | PATCH | `/api/bongos/builders/:id/rank` | `archon` | `rank` | sole chokepoint that mutates builders.rank; ADR 0016 §enforcement. |
@@ -826,7 +827,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/projects/invite` | `metic+archon` | `client_id`, `github_login` | own-or-metic in effect: where to invite a builder into a project, asked by a `project.curate` holder OR the project's OWN OWNER (task 100… |
 | POST | `/api/bongos/projects/invite-guild` | `metic+archon` | `client_id`, `guild` | own-or-metic in effect, the SAME gate as POST /projects/invite above and for the same reasons (a non-inviter gets that route's unchanged … |
 
-## `provisioning` (46)
+## `provisioning` (47)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -868,6 +869,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | PATCH | `/api/bongos/provisioning/instances/:id/settings` | `any-builder` | validated | PATCH /provisioning/instances/:id/settings — change a project's settings. |
 | POST | `/api/bongos/provisioning/instances/:id/teardown` | `any-builder` | — | POST /provisioning/instances/:id/teardown — request teardown of the caller's OWN instance. |
 | POST | `/api/bongos/provisioning/instances/:id/update-channel` | `archon` | — | POST /provisioning/instances/:id/update-channel — set the project's update rule (task 1004445). |
+| POST | `/api/bongos/provisioning/instances/:id/update-subscription` | `metic+archon` | `subscribed` | Body: { subscribed: boolean }. |
 | GET | `/api/bongos/provisioning/logos/:file` | `public` | — | a logo is shown on a public hall, and its address is its own sha256, so it names no project and cannot be guessed. |
 | GET | `/api/bongos/provisioning/onboard-plan` | `public` | — | GET /provisioning/onboard-plan?mode=greenfield\|adopt&domain=<host> — the CANONICAL onboarding step sequence (task 2085; goal 35 / criteri… |
 | POST | `/api/bongos/provisioning/physics-check` | `any-builder` | `description`, `detail` | POST /provisioning/physics-check — the planet-physics questions' read BEFORE anything exists (task 1004418, BV2.PS07). |

package/docs/module-api-changelog.md

@@ -3450,5 +3450,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.25.2 with no explicit bump. run 43328266045. (task 1002620)
   1.25.4 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.25.3 with no explicit bump. run 43331422033. (task 1002620)
+  1.25.5 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.25.4 with no explicit bump. run 43362791111. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/migrations/provisioning_037_update_subscribed.sql

@@ -0,0 +1,21 @@
+-- provisioning_037_update_subscribed.sql — whether an instance takes unattended patch upgrades,
+-- stored on the instance row (task 1004150, ADR 0325 decision 5).
+--
+-- WHY. Every other fleet fact lives in provisioning_instances; "which instances the nightly sweep
+-- moves on its own" lived only in config/update-subscriptions.json. That left GET /provisioning/fleet
+-- unable to answer the one question a fleet view exists for, and let a restored control-plane backup
+-- bring back every instance row with an empty roster — the sweep then reported failed=0 while
+-- upgrading nothing. On the row, the subscription and its update_channel (provisioning_029) travel
+-- and restore together.
+--
+-- DEFAULT false: an instance is armed only by an explicit act, as the shipped-empty roster was
+-- (ADR 0136). The roster file stays honoured as an override, so an operator's current arming is
+-- not silently dropped.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS update_subscribed boolean NOT NULL DEFAULT false;
+
+COMMIT;

package/modules/provisioning/module.json

@@ -20,6 +20,7 @@
       "core-upgrade",
       "env-manifest",
       "repo-private",
+      "update-subscription",
       "render-standup",
       "look",
       "demo",

package/modules/provisioning/routes/provisioning.js

@@ -164,6 +164,10 @@ function ownerInstance(row) {
 function fleetInstance(row) {
   return {
     owner: { id: row.owner_builder_id, github_login: row.github_login, display_name: row.display_name, rank: row.rank },
+    // Fleet-only (task 1004150): which rows take unattended upgrades, and under what rule. Kept off
+    // publicInstance, which feeds owner reads — who auto-upgrades is an operator's question.
+    update_channel: row.update_channel || 'patch',
+    update_subscribed: row.update_subscribed === true,
     ...ownerInstance(row),
   };
 }

package/modules/provisioning/routes/update-subscription.js

@@ -0,0 +1,51 @@
+// modules/provisioning/routes/update-subscription.js — POST /provisioning/instances/:id/update-subscription
+// (task 1004150, ADR 0325 decision 5).
+//
+// WHY. Whether the nightly sweep moves an instance on its own was only a line in
+// config/update-subscriptions.json, so the fleet roster could not report it and a restored
+// backup brought back every row with an empty roster. The flag lives on the row now
+// (provisioning_037); this is how an operator arms or disarms it. It changes a rule, never the
+// core: nothing is queued.
+//
+// Its own routes file (declared in module.json) because routes/provisioning.js sits at the
+// size ratchet — the routes/repo-private.js precedent.
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { pool, validateOrRespond, parseId } = api;
+const provisioning = require('../provisioning');
+const { failFrom } = require('../public-refusal');
+
+const log = api.logger('provisioning');
+
+module.exports = function buildUpdateSubscriptionRouter() {
+  const router = express.Router();
+
+  // Body: { subscribed: boolean }. Gate: the 'provisioning.fleet.manage' permission — the fleet's own.
+  router.post('/provisioning/instances/:id/update-subscription', api.requireBuilder, api.requirePermission('provisioning.fleet.manage'), async (req, res) => {
+    const id = parseId(req, res);
+    if (!id) return;
+    if (validateOrRespond(req, res, { subscribed: { type: 'boolean', required: true } }, { strict: true })) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!inst) return res.fail('instance_not_found', 404);
+      const subscribed = req.body.subscribed === true;
+      const was = inst.update_subscribed === true;
+      if (was !== subscribed) {
+        await pool.query('UPDATE provisioning_instances SET update_subscribed = $2, updated_at = now() WHERE id = $1', [id, subscribed]);
+        await provisioning.recordEvent(pool, {
+          instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'update-subscription-changed',
+          detail: `unattended patch upgrades ${subscribed ? 'armed' : 'disarmed'} by ${req.builder.github_login || req.builder.id}`,
+          actor: `api:fleet:${req.builder.id}`,
+        }).catch(() => {});
+      }
+      res.json({ ok: true, update_subscribed: subscribed, previous: was, changed: was !== subscribed });
+    } catch (err) {
+      log.error('[provisioning] POST /provisioning/instances/:id/update-subscription', err);
+      failFrom(res, err, 'update_subscription_failed');
+    }
+  });
+
+  return router;
+};

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.4",
+  "version": "1.25.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.25.4",
+      "version": "1.25.5",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.4",
+  "version": "1.25.5",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11718,5 +11718,15 @@
       "id": "1005249",
       "text": "Your details now sit on your character at the bottom left of the game: hover to see them, click to open your full profile without leaving the scene. The old profile card at the top right is gone."
     }
+  ],
+  "1.25.5": [
+    {
+      "id": "1004748",
+      "text": "Archon can now switch on a card requirement for a builder who has registered a card, with every change recorded."
+    },
+    {
+      "id": "1004150",
+      "text": "The fleet view can now show which projects get automatic patch upgrades, and the nightly upgrade run says so out loud when it has nothing to do."
+    }
   ]
 }

package/scripts/bongos/update-channel.js

@@ -333,13 +333,14 @@ function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SU
 const CHANNEL_DB_ENV = 'UPDATE_CHANNEL_DB';
 const CHANNEL_SOURCE_DEPLOY = 'deploy';
 const CHANNEL_SOURCE_ROSTER = 'roster';
-const DB_CHANNELS_SQL = 'SELECT slug, update_channel FROM provisioning_instances';
+const DB_CHANNELS_SQL = 'SELECT slug, update_channel, update_subscribed FROM provisioning_instances';
 const DB_CHANNELS_TIMEOUT_MS = 15000;
 
 // PURE. psql's stderr reduced to a class that is safe to log.
 function psqlFailureClass(stderr) {
   const s = String(stderr || '');
   if (/relation .*provisioning_instances.* does not exist/i.test(s)) return 'no provisioning_instances table (provisioning module off?)';
+  if (/column .*update_subscribed.* does not exist/i.test(s)) return 'no update_subscribed column (migration provisioning_037 not applied)';
   if (/column .*update_channel.* does not exist/i.test(s)) return 'no update_channel column (migration provisioning_029 not applied)';
   if (/authentication failed|role .* does not exist|permission denied/i.test(s)) return 'the sweep\'s database login was refused';
   if (/could not connect|connection refused|no such file or directory|could not translate host/i.test(s)) return 'database unreachable';
@@ -366,11 +367,32 @@ function readDbChannels({ env = process.env, run = spawnSync } = {}) {
   }
   if (r.status !== 0) return { ok: false, reason: `psql exit ${r.status}: ${psqlFailureClass(r.stderr)}` };
   const channels = new Map();
+  const subscribed = new Map();
   for (const line of String(r.stdout || '').split('\n')) {
-    const [slug, ch] = line.split('\t');
-    if (slug && ch) channels.set(slug.trim(), ch.trim());
+    const [slug, ch, sub] = line.split('\t');
+    if (!slug || !ch) continue;
+    channels.set(slug.trim(), ch.trim());
+    subscribed.set(slug.trim(), String(sub || '').trim() === 't');
   }
-  return { ok: true, channels };
+  return { ok: true, channels, subscribed };
+}
+
+// PURE. Merge the two places a subscription can be written: the project row
+// (provisioning_instances.update_subscribed, task 1004150) and the roster file. The file is an
+// OVERRIDE — an entry in it is subscribed whatever the row says, so an operator's current arming
+// is not dropped — but a row subscribed with NO file entry can't be upgraded (the file carries the
+// `dir`), and it is returned in `unreachable` rather than vanishing, because "subscribed on the
+// fleet view, never touched by the sweep" is the silent failure this column exists to end.
+function applyDbSubscriptions(instances, db) {
+  const subscribed = db && db.ok && db.subscribed instanceof Map ? db.subscribed : null;
+  const slugs = new Set(instances.map((i) => i.slug));
+  const out = instances.map((inst) => {
+    if (!subscribed) return { ...inst, subscribedSource: CHANNEL_SOURCE_ROSTER };
+    if (subscribed.get(inst.slug) === true) return { ...inst, subscribedSource: CHANNEL_SOURCE_DEPLOY };
+    return { ...inst, subscribedSource: CHANNEL_SOURCE_ROSTER, subscribedNote: 'subscribed by the roster file only (the project row says not subscribed)' };
+  });
+  const unreachable = subscribed ? [...subscribed].filter(([slug, on]) => on && !slugs.has(slug)).map(([slug]) => slug) : [];
+  return { instances: out, unreachable };
 }
 
 // PURE. Give each roster entry the channel it is actually under, and say where it came from:
@@ -496,6 +518,7 @@ module.exports = {
   readDbChannels,
   CHANNEL_DB_ENV,
   applyDbChannels,
+  applyDbSubscriptions,
   channelLine,
   psqlFailureClass,
   CHANNEL_SOURCE_DEPLOY,

package/scripts/bongos/update-sweep.js

@@ -593,16 +593,29 @@ function main({ instanceRoot: defaultRoot = process.cwd() } = {}) {
   // CONTROL PLANE's database — this process's own env, never an entry's `env`, which points at that
   // instance's database. A core too old to carry the reader keeps the roster, as before.
   const db = typeof channel.readDbChannels === 'function' ? channel.readDbChannels({ env: process.env }) : null;
-  const instances = db ? channel.applyDbChannels(loaded.instances, db) : loaded.instances;
-  if (db && !db.ok && instances.length) console.log(`  • update rules: read from the roster — ${db.reason}`);
+  const withChannels = db ? channel.applyDbChannels(loaded.instances, db) : loaded.instances;
+  if (db && !db.ok && withChannels.length) console.log(`  • update rules: read from the roster — ${db.reason}`);
+  // Who is subscribed is also on the project row (task 1004150). The roster file stays an override.
+  const merged = db && typeof channel.applyDbSubscriptions === 'function'
+    ? channel.applyDbSubscriptions(withChannels, db) : { instances: withChannels, unreachable: [] };
+  const instances = merged.instances;
 
   const roster = only ? instances.filter((i) => i.slug === only || i.dir === only) : instances;
   const mode = apply ? 'apply' : 'dry-run';
   console.log(`core-update-subscription (${mode}) — ${roster.length} subscribed instance(s)${present ? '' : ' [no roster file — nothing subscribed]'}`);
-  for (const inst of roster) if (inst.channelNote) console.log(channel.channelLine(inst));
+  for (const inst of roster) {
+    if (inst.channelNote) console.log(channel.channelLine(inst));
+    if (inst.subscribedNote) console.log(`  • ${inst.slug}: ${inst.subscribedNote}`);
+  }
   if (only && roster.length === 0) console.error(`  ! --only ${only} matched no subscribed instance`);
 
   let upgraded = 0, skipped = 0, failed = 0, upToDate = 0, healed = 0;
+  // Subscribed on the project row but absent from this roster: there is no `dir` to upgrade, so say
+  // so and count it a skip. Silence here is how a restored backup reported failed=0 on a dead sweep.
+  for (const slug of only ? [] : merged.unreachable) {
+    console.error(`  ! ${slug}: subscribed on its project row, but this roster has no entry with a dir for it — not upgraded`);
+    skipped++;
+  }
   const refusalsFile = refusalsPath();
   const refusals = readRefusals(refusalsFile);
 
@@ -817,6 +830,7 @@ function main({ instanceRoot: defaultRoot = process.cwd() } = {}) {
     upgraded++;
   }
 
+  if (!only && roster.length === 0 && skipped === 0) console.log('\ncore-update-subscription: NOTHING SUBSCRIBED — no instance was considered, so no upgrade was attempted (this is not a clean run).');
   console.log(`\ncore-update-subscription: upgraded=${upgraded} up-to-date=${upToDate} skipped=${skipped} failed=${failed}${healed ? ` healed=${healed}` : ''} (${mode})`);
   return failed > 0 ? 1 : 0;
 }

package/src/bongos/api-errors.js

@@ -89,6 +89,8 @@ const OVERRIDES = Object.freeze({
   bfg_write_disabled: 'forbidden',
   target_is_system_principal: 'forbidden',
   cannot_change_own_tester: 'forbidden',
+  cannot_disable_own_card_requirement: 'forbidden',
+  no_card_registered: 'conflict',
   self_vote_forbidden: 'forbidden',
   self_dep: 'conflict',
   newcomer_must_ship_first: 'forbidden',

package/src/bongos/db.js

@@ -724,6 +724,48 @@ async function setBuilderTester({ builderId, isTester }) {
   });
 }
 
+// setRequireCard — an Archon switches the hardware-card requirement on or off for one
+// builder (task 1004748, ADR 0382 D3/D4). Switching ON needs at least one registered
+// card, so nobody is locked out by the switch. The audit row is written in the SAME
+// transaction as the flag, so a change cannot happen without its entry; unlike the
+// generic request log it names the builder it was done TO.
+async function setRequireCard({ builderId, required, actorBuilderId, ip = null, userAgent = null }) {
+  return withTx(async (client) => {
+    const { rows: found } = await client.query(
+      `SELECT id, system_role, require_card FROM builders WHERE id = $1 FOR UPDATE`,
+      [builderId]
+    );
+    const before = found[0];
+    if (!before) return null;
+    if (before.system_role) throw { code: 'TARGET_IS_SYSTEM_PRINCIPAL' };
+    if (required) {
+      const { rows: cards } = await client.query(
+        `SELECT 1 FROM passkey_credentials WHERE builder_id = $1 LIMIT 1 FOR SHARE`,
+        [builderId]
+      );
+      if (!cards[0]) throw { code: 'NO_CARD_REGISTERED' };
+    }
+    const { rows } = await client.query(
+      `UPDATE builders SET require_card = $2 WHERE id = $1
+       RETURNING id, github_login, display_name, rank, status, require_card`,
+      [builderId, !!required]
+    );
+    await client.query(
+      `INSERT INTO audit_log
+         (builder_id, route, method, request_body_redacted, response_status, ip, user_agent, surface)
+       VALUES ($1, $2, 'PATCH', $3, 200, $4, $5, NULL)`,
+      [
+        actorBuilderId,
+        `${require('./api-prefix').API_PREFIX}/builders/:id/card-requirement`,
+        { target_builder_id: String(builderId), require_card: !!required, was: before.require_card === true },
+        ip,
+        userAgent,
+      ]
+    );
+    return rows[0];
+  });
+}
+
 async function reactivateBuilder({ builderId, actorBuilderId }) {
   return withTx(async (client) => {
     const { rows } = await client.query(
@@ -1183,6 +1225,7 @@ module.exports = {
   RANKS,
   setBuilderRank,
   setBuilderTester,
+  setRequireCard,
   getLatestRankChangeForBuilder,
   deactivateBuilder,
   reactivateBuilder,

package/src/bongos/route-rank-check.js

@@ -194,6 +194,7 @@ const EXPECTED_RANKS = {
   // builder authority — rank + lifecycle status mutation
   'PATCH /builders/:id/rank': 'perm:builder.rank.set',
   'PATCH /builders/:id/status': 'perm:builder.status.set',
+  'PATCH /builders/:id/card-requirement': 'perm:builder.rank.set',
   // task 1004561: the Treasury desk sets a builder's monthly limit through it
   'PATCH /builders/:id/budget': 'perm:builder.budget.set',
   // session revocation (kill another builder's / all sessions)

package/src/bongos/routes/builders.js

@@ -421,6 +421,43 @@ module.exports = function buildBuildersRouter() {
     }
   });
 
+  // PATCH /builders/:id/card-requirement — an Archon switches the hardware-card
+  // requirement on or off for one builder (task 1004748, ADR 0382 D4). Body:
+  // { require_card: boolean }. Default is off for everyone. Switching ON refuses 409
+  // no_card_registered unless the builder has a registered card, so the switch cannot
+  // lock anyone out. You cannot switch OFF your own requirement (403
+  // cannot_disable_own_card_requirement) — a stolen session must not be able to drop
+  // it; another Archon does it. Every change writes an audit row naming the target.
+  // rank: archon. Gate: requirePermission('builder.rank.set') (the non-delegable atom that
+  // guards the step-up's own target route) then requireCardStepUp; read fresh per request.
+  router.patch('/builders/:id/card-requirement', auth.requireBuilder, auth.requirePermission('builder.rank.set'), requireCardStepUp, async (req, res) => {
+    if (validateOrRespond(req, res, { require_card: { required: true, type: 'boolean' } })) return;
+    const targetId = parseId(req, res, { code: 'bad_builder_id', positiveInt: true });
+    if (targetId === null) return;
+    const required = req.body.require_card;
+    if (!required && String(targetId) === String(req.builder.id)) {
+      return res.fail('cannot_disable_own_card_requirement', 403);
+    }
+    try {
+      const builder = await db.setRequireCard({
+        builderId: targetId,
+        required,
+        actorBuilderId: req.builder.id,
+        ip: req.ip || null,
+        userAgent: req.headers['user-agent'] || null,
+      });
+      if (!builder) return res.fail('builder_not_found', 404);
+      res.json({ builder });
+    } catch (err) {
+      if (err && err.code === 'TARGET_IS_SYSTEM_PRINCIPAL') return res.fail('target_is_system_principal', 403);
+      if (err && err.code === 'NO_CARD_REGISTERED') {
+        return res.fail('no_card_registered', 409, { message: 'That builder has no registered card yet; they must register one before the requirement can be switched on.' });
+      }
+      log.error('[gds] PATCH /builders/:id/card-requirement', err);
+      res.fail('card_requirement_change_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // PATCH /builders/:id/capabilities — the owner gives or takes a builder's server
   // access (task 1004950, ADR 0395). Body: { server: boolean }. A task that needs
   // the server is shown to and claimable by a builder only while this is on.

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.25.4'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.25.5'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/builder_card_requirement.mjs

@@ -0,0 +1,75 @@
+// tests/builder_card_requirement.mjs
+//
+// Task 1004748 (ADR 0382 D3/D4) — an Archon switches the hardware-card requirement on
+// per builder. DB-free: the shared pool's client is a recorder.
+//
+// Run:  node tests/builder_card_requirement.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const { pool } = require('../src/bongos/pool');
+const { test, summary } = makeRunner();
+
+let builderRow; let hasCard; const sent = [];
+pool.connect = async () => ({
+  query: async (sql, params = []) => {
+    const q = String(sql);
+    sent.push({ sql: q, params });
+    if (/^\s*(BEGIN|COMMIT|ROLLBACK)/i.test(q)) return { rows: [] };
+    if (/FROM builders WHERE id/.test(q)) return { rows: builderRow ? [builderRow] : [] };
+    if (/FROM passkey_credentials/.test(q)) return { rows: hasCard ? [{}] : [] };
+    if (/UPDATE builders SET require_card/.test(q)) return { rows: [{ id: params[0], require_card: params[1] }] };
+    return { rows: [] };
+  },
+  release() {},
+});
+
+const { setRequireCard } = require('../src/bongos/db');
+const reset = () => { sent.length = 0; };
+
+await test('switching on refuses a builder with no registered card, writes nothing', async () => {
+  reset(); builderRow = { id: '7', system_role: null, require_card: false }; hasCard = false;
+  await assert.rejects(setRequireCard({ builderId: '7', required: true, actorBuilderId: '1' }), { code: 'NO_CARD_REGISTERED' });
+  assert.equal(sent.some((s) => /UPDATE builders|INSERT INTO audit_log/.test(s.sql)), false);
+});
+
+await test('switching on with a card sets the flag and audits the target in the same transaction', async () => {
+  reset(); hasCard = true;
+  const r = await setRequireCard({ builderId: '7', required: true, actorBuilderId: '1' });
+  assert.equal(r.require_card, true);
+  const audit = sent.find((s) => /INSERT INTO audit_log/.test(s.sql));
+  assert.ok(audit);
+  assert.equal(audit.params[0], '1');
+  assert.deepEqual(audit.params[2], { target_builder_id: '7', require_card: true, was: false });
+});
+
+await test('switching off needs no card and is audited', async () => {
+  reset(); hasCard = false; builderRow = { id: '7', system_role: null, require_card: true };
+  const r = await setRequireCard({ builderId: '7', required: false, actorBuilderId: '1' });
+  assert.equal(r.require_card, false);
+  assert.deepEqual(sent.find((s) => /INSERT INTO audit_log/.test(s.sql)).params[2].was, true);
+});
+
+await test('unknown builder is null; a system principal is refused', async () => {
+  reset(); builderRow = null;
+  assert.equal(await setRequireCard({ builderId: '9', required: false, actorBuilderId: '1' }), null);
+  builderRow = { id: '9', system_role: 'runner', require_card: false };
+  await assert.rejects(setRequireCard({ builderId: '9', required: false, actorBuilderId: '1' }), { code: 'TARGET_IS_SYSTEM_PRINCIPAL' });
+});
+
+await test('route: rank atom + step-up gate, self-disable refused, 409 mapped, errors classified', async () => {
+  const fs = await import('node:fs');
+  const src = fs.readFileSync(new URL('../src/bongos/routes/builders.js', import.meta.url), 'utf8');
+  const line = src.split(/\r?\n/).find((l) => l.includes("router.patch('/builders/:id/card-requirement'"));
+  assert.match(line, /requirePermission\('builder\.rank\.set'\), requireCardStepUp/);
+  assert.match(src, /cannot_disable_own_card_requirement', 403/);
+  assert.match(src, /NO_CARD_REGISTERED[\s\S]{0,80}no_card_registered', 409/);
+  const { classify } = require('../src/bongos/api-errors');
+  assert.equal(classify('no_card_registered'), 'conflict');
+  assert.equal(classify('cannot_disable_own_card_requirement'), 'forbidden');
+});
+
+summary();

package/tests/provisioning_update_subscription_route.mjs

@@ -0,0 +1,141 @@
+// tests/provisioning_update_subscription_route.mjs
+//
+// Task 1004150 (ADR 0325 decision 5): POST /provisioning/instances/:id/update-subscription — the
+// operator's switch for "does the nightly sweep move this instance on its own".
+//
+// The load-bearing assertions:
+//   • the fleet permission gate is what stands in front of it (an ungated route could arm any
+//     instance for unattended upgrades)
+//   • the body is strict and boolean: a string, a missing field or an extra field is a 400 and
+//     nothing is written
+//   • a real change writes the column and one audit event; a no-op writes and records nothing
+//   • an unknown id is a 404
+//
+// DB-free: the pool and data access are stubbed on the cached module objects over a real mounted
+// router (the provisioning_repo_private_route.mjs pattern).
+//
+// Run:  node tests/provisioning_update_subscription_route.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+const api = require('../src/module-api.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+let instance = null;
+let writes = [];
+let events = [];
+let permissionAsked = null;
+let allowed = true;
+provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
+provisioning.recordEvent = async (_db, e) => { events.push(e); };
+api.pool.query = async (sql, params) => { writes.push({ sql, params }); return { rows: [] }; };
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 5, github_login: 'op', rank: 'metic' }; next(); };
+api.requirePermission = (atom) => {
+  permissionAsked = atom;
+  return (req, res, next) => (allowed ? next() : res.status(403).json({ error: { code: 'forbidden' } }));
+};
+api.logger = () => ({ error() {}, warn() {}, info() {}, debug() {} });
+
+const express = require('express');
+const buildRouter = require('../modules/provisioning/routes/update-subscription.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}) } });
+  };
+  next();
+});
+app.use('/api/bongos', buildRouter());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${path}`, { method: 'POST', headers: { 'Content-Type': 'application/json' } }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.write(payload);
+    req.end();
+  });
+}
+
+function reset(patch = {}) {
+  instance = { owner_builder_id: 7, slug: 'spike', update_subscribed: false, ...patch };
+  writes = []; events = []; allowed = true;
+}
+const URL_18 = '/provisioning/instances/18/update-subscription';
+
+console.log('POST /provisioning/instances/:id/update-subscription:');
+
+await ta('is gated on the fleet permission, and a caller without it writes nothing', async () => {
+  reset(); allowed = false;
+  const r = await post(URL_18, { subscribed: true });
+  assert.equal(permissionAsked, 'provisioning.fleet.manage');
+  assert.equal(r.status, 403, r.raw);
+  assert.equal(writes.length, 0);
+});
+
+await ta('arming writes the column once and records one audit event', async () => {
+  reset();
+  const r = await post(URL_18, { subscribed: true });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body, { ok: true, update_subscribed: true, previous: false, changed: true });
+  assert.equal(writes.length, 1);
+  assert.match(writes[0].sql, /SET update_subscribed = \$2/);
+  assert.deepEqual(writes[0].params, [18, true]);
+  assert.equal(events.length, 1);
+  assert.equal(events[0].event, 'update-subscription-changed');
+});
+
+await ta('a no-op (already in that state) writes nothing and records nothing', async () => {
+  reset({ update_subscribed: true });
+  const r = await post(URL_18, { subscribed: true });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.changed, false);
+  assert.equal(writes.length, 0);
+  assert.equal(events.length, 0);
+});
+
+await ta('disarming is symmetric', async () => {
+  reset({ update_subscribed: true });
+  const r = await post(URL_18, { subscribed: false });
+  assert.equal(r.body.update_subscribed, false);
+  assert.deepEqual(writes[0].params, [18, false]);
+});
+
+await ta('a non-boolean, a missing field and an extra field are all 400 with nothing written', async () => {
+  for (const body of [{ subscribed: 'yes' }, {}, { subscribed: true, channel: 'minor' }]) {
+    reset();
+    const r = await post(URL_18, body);
+    assert.equal(r.status, 400, `${JSON.stringify(body)} → ${r.raw}`);
+    assert.equal(writes.length, 0);
+  }
+});
+
+await ta('an unknown id is 404', async () => {
+  reset(); instance = null;
+  const r = await post(URL_18, { subscribed: true });
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(r.body.error.code, 'instance_not_found');
+});
+
+server.close();
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/update_channel_db.mjs

@@ -129,3 +129,27 @@ test('update-sweep.js reads the DB from its own env, never an entry env (which n
   // A core too old to carry the reader must keep the roster rather than crash the sweep.
   assert.match(src, /typeof channel\.readDbChannels === 'function'/);
 });
+
+// ---- task 1004150: the subscription roster lives on the project row too ----
+
+const subDb = (subs) => ({ ok: true, channels: new Map(), subscribed: new Map(Object.entries(subs)) });
+
+test('subscribed on the row: reported as deploy-sourced; a file-only entry is kept as an override', () => {
+  const { instances, unreachable } = uc.applyDbSubscriptions([entry(), entry({ slug: 'charter' })], subDb({ cloudbongos: true, charter: false }));
+  assert.equal(instances[0].subscribedSource, uc.CHANNEL_SOURCE_DEPLOY);
+  assert.equal(instances[1].subscribedSource, uc.CHANNEL_SOURCE_ROSTER);
+  assert.match(instances[1].subscribedNote, /roster file only/);
+  assert.deepEqual(unreachable, []);
+});
+
+test('subscribed on the row with no roster entry: surfaced as unreachable, never dropped', () => {
+  const { instances, unreachable } = uc.applyDbSubscriptions([], subDb({ mercury: true, venus: false }));
+  assert.equal(instances.length, 0);
+  assert.deepEqual(unreachable, ['mercury']);
+});
+
+test('database unreachable: the roster alone decides and nothing is reported unreachable', () => {
+  const { instances, unreachable } = uc.applyDbSubscriptions([entry()], { ok: false, reason: 'psql not found' });
+  assert.equal(instances.length, 1);
+  assert.deepEqual(unreachable, []);
+});