@bongos/core 1.17.0 → 1.17.2

package/modules/hall-ui/public/goals-page.js

@@ -94,6 +94,13 @@
       todo: { page: 1, perPage: loadPerPageFor(WORK_PER_PAGE_KEY.todo) },
       done: { page: 1, perPage: loadPerPageFor(WORK_PER_PAGE_KEY.done) },
     },
+    // task 1953 — private goals: my own pending join-request on the OPEN goal (row
+    // from GET /goals/inbox's myPendingRequests, filtered to this goal), or null.
+    myPendingRequest: null,
+    // task 1953 — the open goal's own pending invite/join-request queue (manager
+    // view, GET /goals/:id/requests), or null while loading / on error / not a
+    // manager. Feature-detected: an older server 404s and the panel just stays hidden.
+    pendingRequests: null,
   };
 
   async function getJSON(path) {
@@ -112,6 +119,13 @@
     if (!res.ok) { const e = new Error(`${path} → ${res.status}`); e.status = res.status; e.data = data; throw e; }
     return data;
   }
+  // task 1953 — the visibility toggle is the only PATCH this page makes.
+  async function patchJSON(path, body) {
+    const res = await api.request('PATCH', path, { body: body || {} });
+    const data = res.data || {};
+    if (!res.ok) { const e = new Error(`${path} → ${res.status}`); e.status = res.status; e.data = data; throw e; }
+    return data;
+  }
 
   const curLabel = () => window.OTBBranding?.currencyLabel?.() ?? 'credits';
   // task 1957 — a task's drachmae is an ESTIMATE until it SETTLES (confirmed/
@@ -857,38 +871,74 @@
       const depsSpan = deps.length
         ? `<span class="goal-deps${(g.status === 'open' && unmet.length) ? ' goal-deps--blocked' : ''}" title="This goal is blocked until each prerequisite goal is achieved">${(g.status === 'open' && unmet.length) ? '🔒 ' : ''}depends on: ${deps.map((dep) => `${escapeHtml(dep.title || ('goal ' + dep.id))} ${dep.satisfied ? '✓' : '○'}`).join(', ')}</span>`
         : '';
-      meta.innerHTML = `<span>${escapeHtml(g.version_id || '')}</span> ${statusBadge(g.status)} ${scope} ${depsSpan}`;
+      // task 1953 — a private goal is join-GATED, not hidden, so the lock badge is
+      // informational for every viewer (the toggle that flips it lives in Actions,
+      // manager-only).
+      const lockSpan = g.visibility === 'private'
+        ? '<span class="goal-badge goal-badge--locked" title="Private — join is by invitation or an approved request">🔒 Private</span>' : '';
+      meta.innerHTML = `<span>${escapeHtml(g.version_id || '')}</span> ${statusBadge(g.status)} ${lockSpan} ${scope} ${depsSpan}`;
     }
 
-    const actions = $('#goal-detail-actions');
-    if (actions) {
-      actions.innerHTML = g.status === 'open'
-        ? (joined
-          ? '<button class="btn-ghost" id="goal-leave-btn" type="button">Leave goal</button>'
-          : '<button class="landing__btn" id="goal-join-btn" type="button">Join goal</button>')
-        : '';
-      $('#goal-join-btn')?.addEventListener('click', () => joinLeave(g.id, 'join'));
-      $('#goal-leave-btn')?.addEventListener('click', () => joinLeave(g.id, 'leave'));
-    }
+    // task 1762: the goal's own owner/manager (or an Archon) can invite/manage
+    // without an Archon in the loop — mirrors the server's authorizeGoalManagement
+    // gate. A protected-scope goal stays Archon-only on the SERVER (goals.js);
+    // this client gate deliberately doesn't re-derive the protected-module list
+    // (that roster lives server-side only, module-scope-map.js) — a non-Archon
+    // owner/manager sees the control on a protected-scope goal and gets a clear
+    // toast if the server 403s (see inviteMember's error handling below).
+    const isOwner = sameId(g.created_by, selfId());
+    const canManage = g.status === 'open' && (isArchon() || isOwner || iAmLead);
+    renderActions(g, { joined, canManage });
 
     // task 1828 — Completion + Members each render into their band column AND
     // their dedicated full view (capped in the band, "View all →" into the view).
     renderCompletion();
-    // task 1762: the goal's own owner/manager (or an Archon) can invite without
-    // an Archon in the loop — mirrors the server's authorizeGoalManagement gate.
-    // A protected-scope goal stays Archon-only on the SERVER (goals.js); this
-    // client gate deliberately doesn't re-derive the protected-module list (that
-    // roster lives server-side only, module-scope-map.js) — a non-Archon owner/
-    // manager sees the control on a protected-scope goal and gets a clear toast
-    // if the server 403s (see inviteMember's error handling below).
-    const isOwner = sameId(g.created_by, selfId());
-    const canInvite = g.status === 'open' && (isArchon() || isOwner || iAmLead);
-    renderInviteBox(g.id, canInvite, members);
+    renderInviteBox(g.id, canManage, members);
     renderMembers();
 
     loadGoalTasks(g.id);
+    // task 1953 — my own pending request (any viewer) + the goal's pending queue
+    // (managers only); async, re-renders Actions + the pending panel on arrival.
+    loadGoalMembership(g.id, canManage);
     void sat; void crit; // now read inside renderCompletion()
-    void iAmLead; // lead-only resolution actions arrive with tasks 1735/1736
+  }
+
+  // task 1953 — the goal-detail Actions row: Leave/Join (unchanged), a manager's
+  // Private/Public toggle (PATCH /goals/:id/visibility), and — for a non-member
+  // viewer of a PRIVATE goal — Request to join / Requested (withdraw) in place of
+  // Join (private goals are join-GATED: POST /goals/:id/join 409s goal_private for
+  // a non-Archon non-member). An Archon keeps the plain Join button: the server
+  // lets them self-join any goal regardless of visibility (POST /goals/:id/join),
+  // so "request" would be a pointless extra step for them.
+  function renderActions(g, { joined, canManage }) {
+    const actions = $('#goal-detail-actions');
+    if (!actions) return;
+    const parts = [];
+    if (canManage) {
+      const nextVisibility = g.visibility === 'private' ? 'public' : 'private';
+      const label = g.visibility === 'private' ? '🔒 Private — make public' : 'Make private';
+      parts.push(`<button class="btn-ghost" id="goal-visibility-btn" type="button" data-next-visibility="${escapeHtml(nextVisibility)}">${label}</button>`);
+    }
+    if (g.status === 'open') {
+      if (joined) {
+        parts.push('<button class="btn-ghost" id="goal-leave-btn" type="button">Leave goal</button>');
+      } else if (g.visibility === 'private' && !isArchon()) {
+        if (state.myPendingRequest) {
+          parts.push('<span class="role-pill" title="Awaiting the owner/manager\'s approval">Requested</span>');
+          parts.push('<button class="btn-ghost" id="goal-withdraw-btn" type="button">Withdraw</button>');
+        } else {
+          parts.push('<button class="btn-ghost" id="goal-request-btn" type="button">🔒 Request to join</button>');
+        }
+      } else {
+        parts.push('<button class="landing__btn" id="goal-join-btn" type="button">Join goal</button>');
+      }
+    }
+    actions.innerHTML = parts.join(' ');
+    $('#goal-join-btn')?.addEventListener('click', () => joinLeave(g.id, 'join'));
+    $('#goal-leave-btn')?.addEventListener('click', () => joinLeave(g.id, 'leave'));
+    $('#goal-visibility-btn')?.addEventListener('click', (e) => toggleVisibility(g.id, e.currentTarget.dataset.nextVisibility));
+    $('#goal-request-btn')?.addEventListener('click', () => requestToJoin(g.id));
+    $('#goal-withdraw-btn')?.addEventListener('click', () => withdrawRequest(g.id, state.myPendingRequest && state.myPendingRequest.id));
   }
 
   // task 1828 — the active-claim feed (all builders' in-flight claims) powers the
@@ -1056,12 +1106,153 @@
     } catch (err) {
       const code = err?.data?.error;
       if (code === 'archon_approval_required') toast('This goal is Archon-mediated — an Archon must add you.');
+      else if (code === 'goal_private') toast('This goal is private — request to join instead.');
       else if (code === 'not_a_member') toast('You are not a member of this goal.');
       else if (code === 'goal_not_open') toast('This goal is not open.');
       else toast(`Could not ${action} just now.`);
     }
   }
 
+  // task 1953 — a manager (or Archon) flips a goal public|private.
+  async function toggleVisibility(goalId, visibility) {
+    try {
+      await patchJSON(`${API}/goals/${encodeURIComponent(goalId)}/visibility`, { visibility });
+      toast(visibility === 'private' ? 'Goal is now private.' : 'Goal is now public.');
+      await loadDetail(goalId, { force: true });
+      renderDetail(goalId);
+      renderList();
+    } catch (err) {
+      const code = err?.data?.error;
+      if (code === 'not_owner_or_manager') toast('Only this goal\'s owner or a manager (or an Archon) may do this.');
+      else if (code === 'goal_not_open') toast('Only an open goal can be managed.');
+      else toast('Could not update visibility just now.');
+    }
+  }
+
+  // task 1953 — a non-member asks to join a private (or protected) goal.
+  // renderDetail (below) re-derives canManage/joined and re-triggers
+  // loadGoalMembership, so a plain reload-and-rerender is enough here — same
+  // shape as joinLeave/inviteMember.
+  async function requestToJoin(goalId) {
+    try {
+      await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/requests`, {});
+      toast('Request sent — the owner or a manager will review it.');
+      await loadDetail(goalId, { force: true });
+      renderDetail(goalId);
+    } catch (err) {
+      const code = err?.data?.error;
+      if (code === 'request_pending') toast('You already have a pending request or invitation for this goal.');
+      else if (code === 'already_a_member') toast('You are already a member of this goal.');
+      else if (code === 'goal_is_open') toast('This goal is open — joining directly instead.');
+      else toast('Could not send the request just now.');
+    }
+  }
+
+  // task 1953 — withdraw MY OWN pending join-request (self-served, no manager needed).
+  async function withdrawRequest(goalId, reqId) {
+    if (reqId == null) return;
+    try {
+      await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/requests/${encodeURIComponent(reqId)}/withdraw`, {});
+      toast('Request withdrawn.');
+      await loadDetail(goalId, { force: true });
+      renderDetail(goalId);
+    } catch (err) {
+      toast((err && err.data && err.data.message) || 'Could not withdraw that request just now.');
+    }
+  }
+
+  // task 1953 — a manager approves/denies a pending join-request from the goal's
+  // own pending panel (mirrors the home-inbox action, POST …/requests/:reqId/respond).
+  const pendingActionsPending = new Set();
+  async function respondToJoinRequest(goalId, reqId, action, btn) {
+    const key = `respond:${reqId}`;
+    if (pendingActionsPending.has(key)) return;
+    pendingActionsPending.add(key);
+    if (btn) btn.disabled = true;
+    try {
+      await postJSON(`${API}/goals/${encodeURIComponent(goalId)}/requests/${encodeURIComponent(reqId)}/respond`, { action });
+      toast(action === 'approve' ? 'Approved — they’re now a member.' : 'Request denied.');
+      await loadDetail(goalId, { force: true });
+      renderDetail(goalId);
+      renderList();
+    } catch (err) {
+      toast((err && err.data && err.data.message) || 'Could not resolve that request just now.');
+      if (btn) btn.disabled = false;
+    } finally {
+      pendingActionsPending.delete(key);
+    }
+  }
+
+  // task 1953 — every pending row on THIS goal, rendered for a manager: join
+  // requests get Approve/Deny; outstanding invites are informational (only the
+  // invitee can accept/decline theirs — the server has no manager-cancel route).
+  function pendingRequestWho(r) {
+    return r.display_name || (r.github_login ? `@${r.github_login}` : `builder #${r.builder_id}`);
+  }
+  function pendingRequestsHtml(rows) {
+    const requests = rows.filter((r) => r.kind === 'request');
+    const invites = rows.filter((r) => r.kind === 'invite');
+    const requestLi = (r) => `<li class="pending-row">
+        <span class="pending-row__who">${escapeHtml(pendingRequestWho(r))}</span>
+        ${r.note ? `<span class="pending-row__note">“${escapeHtml(r.note)}”</span>` : ''}
+        <span class="pending-row__actions">
+          <button class="btn-ghost" type="button" data-approve-req="${escapeHtml(String(r.id))}">Approve</button>
+          <button class="btn-ghost" type="button" data-deny-req="${escapeHtml(String(r.id))}">Deny</button>
+        </span>
+      </li>`;
+    const inviteLi = (r) => `<li class="pending-row">
+        <span class="pending-row__who">${escapeHtml(pendingRequestWho(r))}</span>
+        <span class="pending-row__note">invited — awaiting their response</span>
+      </li>`;
+    const parts = [];
+    if (requests.length) parts.push(`<div class="pending-group"><h3 class="pending-group__h">Join requests<span class="goal-count">${requests.length}</span></h3><ul class="pending-list">${requests.map(requestLi).join('')}</ul></div>`);
+    if (invites.length) parts.push(`<div class="pending-group"><h3 class="pending-group__h">Pending invitations<span class="goal-count">${invites.length}</span></h3><ul class="pending-list">${invites.map(inviteLi).join('')}</ul></div>`);
+    return parts.join('');
+  }
+  function renderPendingRequests() {
+    const box = $('#goal-pending');
+    if (!box) return;
+    const rows = state.pendingRequests;
+    if (!rows || !rows.length) { box.hidden = true; box.innerHTML = ''; return; }
+    box.hidden = false;
+    box.innerHTML = pendingRequestsHtml(rows);
+  }
+
+  // task 1953 — async membership-queue load, kicked off (fire-and-forget) from
+  // renderDetail like loadGoalTasks: my own pending request on this goal (any
+  // viewer, from GET /goals/inbox's myPendingRequests) + — for a manager — the
+  // goal's own pending queue (GET /goals/:id/requests, task 1953's new route).
+  // Feature-detected the way the conflicts panel 404-detects the server-side
+  // detector: an older server (or a non-manager 403) just hides the panel.
+  async function loadGoalMembership(goalId, canManage) {
+    try {
+      const inbox = await getJSON(`${API}/goals/inbox`);
+      if (!sameId(state.current, goalId)) return;
+      state.myPendingRequest = (inbox.myPendingRequests || []).find((r) => sameId(r.goal_id, goalId)) || null;
+    } catch (err) {
+      if (err && err.message === 'redirecting to auth') return;
+      if (!sameId(state.current, goalId)) return;
+      state.myPendingRequest = null;
+    }
+    if (canManage) {
+      try {
+        const r = await getJSON(`${API}/goals/${encodeURIComponent(goalId)}/requests`);
+        if (!sameId(state.current, goalId)) return;
+        state.pendingRequests = r.requests || [];
+      } catch (err) {
+        if (err && err.message === 'redirecting to auth') return;
+        if (!sameId(state.current, goalId)) return;
+        state.pendingRequests = null;
+      }
+    } else {
+      state.pendingRequests = null;
+    }
+    if (!sameId(state.current, goalId)) return;
+    renderPendingRequests();
+    const d = currentDetail();
+    if (d) renderActions(d.goal, { joined: (d.members || []).some((m) => sameId(m.builder_id, selfId())), canManage });
+  }
+
   /* ---------------- data + routing ---------------- */
 
   async function loadDetail(goalId, { force = false } = {}) {
@@ -1084,6 +1275,12 @@
     state.claimsByTask = new Map();
     state.conflictPairs = null;
     state.conflictSource = null;
+    // task 1953 — a freshly opened goal starts with no known membership-queue
+    // state; loadGoalMembership (kicked off from renderDetail) fills it in.
+    state.myPendingRequest = null;
+    state.pendingRequests = null;
+    const pending = $('#goal-pending');
+    if (pending) { pending.hidden = true; pending.innerHTML = ''; }
     setWorkTab('todo');
     ['#goal-todo-count', '#goal-done-count', '#goal-conflicts-count', '#goal-conflicts-view-count',
       '#goal-members-count', '#goal-members-view-count', '#goal-completion-count'].forEach((sel) => {
@@ -1290,6 +1487,14 @@
       if (row && row.dataset.taskId && window.OTBTaskDetail) window.OTBTaskDetail.open(row.dataset.taskId);
     });
   });
+  // task 1953 — Approve/Deny on the goal's own pending-requests panel.
+  $('#goal-pending')?.addEventListener('click', (e) => {
+    if (state.current == null) return;
+    const approveBtn = e.target.closest('[data-approve-req]');
+    if (approveBtn) { respondToJoinRequest(state.current, approveBtn.dataset.approveReq, 'approve', approveBtn); return; }
+    const denyBtn = e.target.closest('[data-deny-req]');
+    if (denyBtn) { respondToJoinRequest(state.current, denyBtn.dataset.denyReq, 'deny', denyBtn); return; }
+  });
   window.addEventListener('hashchange', route);
   wireDragReorder();
 

package/modules/hall-ui/public/goals.html

@@ -150,6 +150,18 @@
     .goal-invite__form { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
     .goal-invite__form select#goal-invite-builder { flex: 1; min-width: 180px; }
 
+    /* task 1953 — private goals: the lock badge (meta line) + the goal's own
+       pending invite/join-request queue (manager view, next to the invite box). */
+    .goal-badge--locked { background: var(--warn-weak); color: var(--warn); }
+    .goal-pending { margin: 4px 0 10px; display: flex; flex-direction: column; gap: 10px; }
+    .pending-group__h { font-size: 12px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.02em; color: var(--ink-faint); margin: 0 0 4px; display: flex; align-items: center; gap: 6px; }
+    .pending-list { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; }
+    .pending-row { display: flex; align-items: center; gap: 8px; padding: 6px 0; border-bottom: 1px solid var(--rule-soft); font-size: 13px; flex-wrap: wrap; }
+    .pending-row:last-child { border-bottom: none; }
+    .pending-row__who { font-weight: 600; }
+    .pending-row__note { color: var(--ink-faint); font-size: 12px; flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+    .pending-row__actions { display: flex; gap: 6px; margin-left: auto; }
+
     .conflict { border: 1px solid color-mix(in srgb, var(--warn) 30%, var(--border)); background: var(--warn-weak); border-radius: var(--radius-sm); padding: 10px 14px; font-size: 13px; margin: 10px 0 0; }
     .conflict__pair { font-weight: 600; }
     .conflict__paths { font-family: ui-monospace, "SF Mono", Menlo, Consolas, monospace; font-size: 11.5px; color: var(--ink-soft); margin-top: 4px; word-break: break-all; }
@@ -246,6 +258,10 @@
               <h2 class="scroll__h">Members<span class="goal-count" id="goal-members-count" hidden></span></h2>
               <p class="scroll__lede" id="goal-members-lede"></p>
               <div class="goal-invite" id="goal-invite" hidden></div>
+              <!-- task 1953 — the goal's own pending invite/join-request queue
+                   (manager view; feature-detected, hidden on an older server or
+                   when the viewer isn't owner/manager/Archon). -->
+              <div class="goal-pending" id="goal-pending" hidden></div>
               <ul class="member-list" id="goal-members"></ul>
               <div class="goal-col__foot" id="goal-members-foot" hidden></div>
             </div>

package/modules/hall-ui/public/hall-widgets.js

@@ -73,6 +73,18 @@
 
   // (Goals — goals.js registers itself into the other half of the Home band.)
 
+  // 0d-triage. Idea inbox triage cue — task 1471. Surfaces the open idea_inbox
+  // (count + a few recent titles) so a triager knows when triage is due. Starts
+  // hidden; builders.js fetches /inbox and un-hides ONLY for Metic+ (triage is
+  // Metic+), so no idea data loads for anyone who can't triage. Each row deep-
+  // links to #/idea/N — the task-detail overlay opens it with the Metic+ Discard
+  // control, so triage happens in place.
+  w('triage-inbox', 'Idea inbox', 26,
+    '<h2 id="triage-inbox-h" class="scroll__h">Idea inbox<span class="count-pill" id="triage-inbox-count" hidden></span></h2>' +
+    '<p class="scroll__lede">Open ideas awaiting triage. Open one to promote it to a task or discard it.</p>' +
+    '<ul class="triage-inbox" id="triage-inbox-list"><li class="profile__placeholder">…</li></ul>',
+    { view: 'home', zone: 'home-main', labelledby: 'triage-inbox-h', hiddenByDefault: true });
+
   // 0e. Recent work — compact 5-row table (task 1723). Filled by builders.js
   // renderRecentShips from the same feed as the full Your-work table.
   w('home-recent', 'Recent work', 28,
@@ -179,7 +191,8 @@
       '<th class="ledger__sortable" id="lb-sort-rank" aria-sort="none" title="Sort by rank">Rank</th>' +
       '<th class="ledger__sortable" id="lb-sort-drachmae" aria-sort="descending" title="Sort by ' + curLabel() + ' (work shipped)" data-currency-label="caps">Credits</th>' +
       '<th class="ledger__sortable" id="lb-sort-karma" aria-sort="none" title="Sort by karma (peer recognition + approvals)">Karma</th>' +
-    '</tr></thead><tbody><tr><td colspan="5" class="ledger__empty">…</td></tr></tbody></table>' +
+      '<th class="ledger__sortable" id="lb-sort-tokens" aria-sort="none" title="Sort by tokens used across recorded sessions — efficiency is tokens ÷ credits (hover a row for tokens-per-drachma)">Tokens</th>' +
+    '</tr></thead><tbody><tr><td colspan="6" class="ledger__empty">…</td></tr></tbody></table>' +
     '<div class="pager">' +
       '<button class="btn-ghost" id="lb-prev" disabled>← earlier</button>' +
       '<span id="lb-range" class="pager__range">1–10</span>' +

package/modules/hall-ui/public/index.html

@@ -107,6 +107,9 @@
 <script src="/builders/hall-widgets.js?v=2026-06-27-r75" defer></script>
 <!-- BV1.R78 (task 1694): the Goals widget registers into the same registry. -->
 <script src="/builders/goals.js?v=2026-07-01-goals" defer></script>
+<!-- ADR 0112 (task 1954): the home-page goal-membership inbox — invitations to
+     accept + join-requests to approve. Self-registers; hidden when empty. -->
+<script src="/builders/goal-inbox.js?v=2026-07-10-goal-inbox" defer></script>
 <!-- BV1-prov-P6 (task 1947): the Instances widget — self-registers, gated on the provisioning module. -->
 <script src="/builders/new-project-wizard.js?v=2026-07-04-goal35" defer></script>
 <script src="/builders/instances-panel.js?v=2026-07-03-prov-p6" defer></script>

package/modules/hall-ui/public/new-project-wizard.js

@@ -74,20 +74,22 @@
     const oa = domain ? oauthAppValues(domain) : null;
     const dnsNote = domain ? '' : '<li>Add a domain you own, then re-run to wire the address (a domain is needed before sign-in works).</li>';
     const repoStep = adopt
-      ? `<li><strong>Layer onto your existing repo</strong> — in your repo run <code>bongos init --adopt</code>. It shows a conflict pre-flight (migrations, CI, protected paths) and writes <em>nothing</em> until you accept; it never overwrites your files, and it imports your existing backlog (GitHub issues / a TODO/ROADMAP file). Commit + push.</li>`
-      : '<li><strong>Create the empty GitHub repo</strong> — github.com → New repository, leave it empty.</li>';
+      ? `<li data-onboard-step="github-repo"><strong>Layer onto your existing repo</strong> — in your repo run <code>bongos init --adopt</code>. It shows a conflict pre-flight (migrations, CI, protected paths) and writes <em>nothing</em> until you accept; it never overwrites your files, and it imports your existing backlog (GitHub issues / a TODO/ROADMAP file). Commit + push.</li>`
+      : '<li data-onboard-step="github-repo"><strong>Create the empty GitHub repo</strong> — github.com → New repository, leave it empty.</li>';
     // The one-click GitHub sign-in step + a collapsible manual fallback (only when a
     // domain is set — the App needs a real callback host).
-    const signInStep = oa ? `<li><strong>Set up GitHub sign-in — one click</strong>. We’ll open GitHub with a pre-filled app; approve it, and we place the credentials on your instance automatically (no secret to copy).
+    const signInStep = oa ? `<li data-onboard-step="oauth-app"><strong>Set up GitHub sign-in — one click</strong>. We’ll open GitHub with a pre-filled app; approve it, and we place the credentials on your instance automatically (no secret to copy).
         <div class="np-signin-actions">
           <button id="np-github-app" type="button" class="np-create-btn" data-instance="${escapeHtml(String(instanceId))}">Set up GitHub sign-in</button>
           <span id="np-github-app-msg" class="ledger__note"></span>
         </div>
+        <p class="ledger__note">Terminal CLI only: after approving, enable <strong>Device Flow</strong> on the app (GitHub → Settings → Developer settings → GitHub Apps → your app → “Enable Device Flow”) so <code>bongos login</code> works. Web sign-in needs nothing.</p>
         <details class="np-manual"><summary class="ledger__note">Prefer to do it by hand?</summary>
           <ol class="np-steps">
             <li><strong>Create the GitHub OAuth app</strong> — GitHub → <em>your account's</em> Settings → Developer settings → OAuth Apps → New OAuth App.
               <div class="np-kv"><span>Homepage URL</span><code>${escapeHtml(oa.homepageUrl)}</code></div>
               <div class="np-kv"><span>Authorization callback URL</span><code>${escapeHtml(oa.callbackUrl)}</code></div>
+              <div class="np-kv"><span>Enable Device Flow</span><code>✅ required — the terminal login uses it (off by default)</code></div>
             </li>
             <li><strong>Place the secret — verified</strong> (never hand-edit the env file): on the control plane run
               <code>bongos … oauth-secret place ${escapeHtml(slug)} --client-id &lt;id&gt; --client-secret &lt;secret&gt; --apply</code>.</li>
@@ -101,7 +103,7 @@
         ${repoStep}
         ${dnsNote}
         ${signInStep}
-        ${oa ? `<li><strong>First sign-in</strong> — once the instance is live, open <code>${escapeHtml(oa.homepageUrl)}</code> and sign in with GitHub; that makes you the owner (Archon).</li>
+        ${oa ? `<li data-onboard-step="first-sign-in"><strong>First sign-in</strong> — once the instance is live, open <code>${escapeHtml(oa.homepageUrl)}</code> and sign in with GitHub; that makes you the owner (Archon).</li>
         <li><strong>Verify</strong> — <code>${escapeHtml(oa.homepageUrl)}/healthz</code> should report <code>auth_configured: true</code>.</li>` : ''}
       </ol>
       <p class="ledger__note">This is the same sequence the <code>/new-project</code> assistant and <code>bongos onboard</code> use.</p>

package/modules/hall-ui/public/style.css

@@ -1746,3 +1746,46 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
 .np-kv span { color: var(--ink-faint); font-size: 0.85rem; min-width: 12rem; }
 .np-kv code, .np-steps code { background: var(--surface-2); padding: 0.1rem 0.35rem; border-radius: 4px; word-break: break-all; }
 .np-done { margin-top: 0.5rem; }
+
+/* ---- task 1471: idea-inbox triage cue (Home widget, Metic+) ---- */
+/* Shared .count-pill — work.html defines its own page-scoped copy; the hall
+   index widget needs the same look, so it lives in the shared sheet now. */
+.count-pill {
+  display: inline-flex; align-items: center; justify-content: center;
+  min-width: 20px; height: 18px; padding: 0 6px; margin-left: 8px;
+  border-radius: 999px; background: var(--surface-2); color: var(--ink-soft);
+  font-size: 11px; font-weight: 600; font-variant-numeric: tabular-nums;
+  vertical-align: 2px;
+}
+.triage-inbox { list-style: none; margin: 0; padding: 0; }
+.triage-inbox__item {
+  display: flex; align-items: baseline; gap: 0.5rem;
+  padding: 0.3rem 0; border-top: 1px solid var(--rule-soft);
+}
+.triage-inbox__item:first-child { border-top: 0; }
+.triage-inbox__link { flex: 1 1 auto; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.triage-inbox__kind {
+  flex: 0 0 auto; font-size: 11px; color: var(--ink-faint);
+  text-transform: uppercase; letter-spacing: 0.04em;
+}
+.triage-inbox__empty { color: var(--ink-faint); padding: 0.3rem 0; }
+
+/* Goal inbox (task 1954, ADR 0112) — the home-page two-sided membership queue:
+   invitations to accept + join-requests to approve. Matches the home widgets'
+   card language (.scroll host); each row is body-left / actions-right. */
+.ginbox { list-style: none; margin: 0 0 4px; padding: 0; }
+.ginbox__sec-h {
+  margin: 14px 0 6px; font-size: 12px; font-weight: 600;
+  text-transform: uppercase; letter-spacing: 0.04em; color: var(--ink-faint);
+}
+.ginbox__item {
+  display: flex; align-items: flex-start; gap: 12px;
+  padding: 9px 0; border-top: 1px solid var(--rule-soft);
+}
+.ginbox__item:first-child { border-top: 0; }
+.ginbox__body { flex: 1 1 auto; min-width: 0; display: flex; flex-direction: column; gap: 2px; }
+.ginbox__goal { font-weight: 600; font-size: 13.5px; }
+.ginbox__sub { font-size: 12.5px; color: var(--ink-soft); }
+.ginbox__note { margin: 3px 0 0; font-size: 12.5px; color: var(--ink-soft); font-style: italic; }
+.ginbox__actions { flex: 0 0 auto; display: flex; gap: 6px; }
+.ginbox__pending { font-size: 12.5px; margin: 10px 0 0; color: var(--ink-soft); }

package/modules/ideas/CLAUDE.md

@@ -1,37 +1,15 @@
-# `ideas` module — the idea inbox + blockers + the `ideas.capture` kernel port
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
 
-> The **fourth CORE-domain** carved into a module (BV1.R78, [ADR 0093](../../docs/adr/<redacted>.md) §1) — after memory (R72), grading (R73), and economy (R77). A clean, self-contained slice: its SQL already lived in dedicated `inbox.js`/`blockers.js` files (not the `db.js` monolith), so the carve is a move + a doorway re-point, OTB byte-identical. `default: true` in `module.json` — every instance captures ideas and tracks what's stuck on its owner, so it mounts unconditionally unless explicitly disabled.
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
 
-Owns the **methodology intake surfaces** that feed the backlog: the `idea_inbox` (free-form capture → triage → promote/discard/merge, plus the Metic-proposes / Archon-ratifies `criterion-proposal` flow that writes `done_when_criteria`), and the `blockers` queue (a thing stuck on a human; resolving one auto-promotes its linked `blocked` tasks via a DB trigger).
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
 
-## The boundary (the one rule)
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
 
-This module reaches core **only** through the published doorway `../../src/module-api.js` (`coreVersion ^1.8.0` — it needs the R78 doorway addition `parseId`, the route-param validator alongside `validateOrRespond`/`LIMITS`). It must **never** `require()` a core internal directly, and never another module. Core, in turn, must never `require()` a file in here — it reaches ideas only through the `ideas.capture` port (below). Both directions are enforced by the BV1.R44/R45 fitness checks.
-
-## The `ideas.capture` kernel PORT (ADR 0093 §5 — the headline of this carve)
-
-- **Provides — port `ideas.capture`** → `inbox.captureIdea`. Registered in `routes/inbox.js`'s factory (the loader runs it at boot, and again whenever a test rebuilds the GDS router — `hasProvider`-guarded so re-instantiation never trips the single-provider duplicate guard). Mirrors `modules/economy/routes/reward.js` (a capability registered from a route factory).
-- **It retires the `captureIdea` doorway leak.** ADR 0091 §3 parked `captureIdea` on `src/module-api.js` as a temporary "domain-leak-pending-carve" because the ideas domain wasn't a module yet. This carve deletes that re-export; the discord `#ideas` inbound (`modules/discord/discord-inbound.js`, the **sole** consumer) now resolves `ideas.capture` at call time instead of importing the doorway helper. This is the codebase's **first module→module port** (every prior port is consumed by core); discord declares it in `consumes`.
-- **Why a verb-noun port, not a doorway re-export:** the same reason `grade`/`reward` are ports — a module capability another module invokes goes behind the kernel switchboard, never a direct import (ADR 0091 §4).
-
-## Files
-
-| File | What |
-|---|---|
-| `inbox.js` | the `idea_inbox` domain: `captureIdea` (the port provider) + the keyword `classify` fallback, `listOpenIdeas`/`getIdea`/`countOpenIdeas` (with the V3.R70 skill-friction rank-visibility gate), `updateIdea`, and the `ratifyCriterionProposal` transaction (criterion-proposal → `done_when_criteria` + `karma_log` + `criterion_proposal_audit`, all in one `pool.connect()` tx). Reaches the shared pool through the doorway. |
-| `blockers.js` | the `blockers` domain: `listOpenBlockers`/`getBlocker`/`createBlocker`/`resolveBlocker`/`linkBlockerToTask`. `resolveBlocker` relies on the DB trigger on `blockers.status` to auto-promote linked `blocked` tasks. |
-| `routes/inbox.js` | `POST/GET /inbox`, `GET /inbox/:id`, `PATCH /inbox/:id` (Metic+ triage), `POST /inbox/:id/ratify` (Archon). Its factory **registers the `ideas.capture` port**. |
-| `routes/blockers.js` | `GET /blockers` (**public** — the status page reads it), `GET /blockers/:id`, `POST /blockers` (any builder files), `POST /blockers/:id/{resolve,link}` (Metic+). |
-
-## NOT in this module (deliberately left in core)
-
-- **The public idea/blocker projections** — `routes/public.js` (`projectPublicIdea`/`projectPublicBlocker`) reads `idea_inbox`/`blockers` with its **own** inline `pool.query` SELECTs (existence/ref checks for the hall's `#NNN` deep-link resolver + the public sitemap). Core querying a shared table with its own SQL is allowed; it does **not** import this module, so there is no vendored twin to keep in sync — the boundary is about code imports, not table access.
-- **The ideas/blockers CLIs** — `scripts/gds/{capture,triage,render-ideas}.js` travel with the domain but stay under `scripts/`; they now `require('../../modules/ideas/inbox')` (the economy/memory CLI precedent — `scripts/gds/autonomy-gate.js` does the same for its idea-inbox read).
-
-## Tables
-
-None owned. `idea_inbox`, `blockers`, `task_blockers`, `criterion_proposal_audit` (+ the `done_when_criteria`/`karma_log` rows the ratify tx touches) were created before the module system and stay in core `migrations/` (the `schema_migrations` stem-key makes a later relocation a no-op). The module owns the *queries*; any **new** ideas migration belongs in `modules/ideas/migrations/` namespaced `ideas_*` (the additive rule).
-
-## Tests
-
-`tests/criterion_proposal.mjs` imports `modules/ideas/inbox` (the ratify transaction). `tests/discord_inbound.mjs` exercises the consumer (it injects a stub `captureIdea` via dependency injection, so it never hits the real port). `tests/route_validation.mjs` exercises the inbox/blocker write-schemas via the dependency-free `validate()` helper (it imports `_helpers`, not these routes). The doorway-surface contract (`tests/module_api.mjs`) asserts `captureIdea` is **gone** and `parseId` is present. See ADR 0093.
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/lifecycle/CLAUDE.md

@@ -1,63 +1,15 @@
-# `lifecycle` module — the build state machine + the `lifecycle` kernel port
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
 
-> The **LAST and most-coupled CORE-domain** carved into a module (BV1.R86, [ADR 0093](../../docs/adr/<redacted>.md) §1,§3) — after memory (R72), grading (R73), economy (R77), ideas (R78), security (R79), builder-settings (R80), onboarding (R81), sessions (R82), autonomy (R83), status-UI (R84), hall-UI (R85). Carved last on purpose: by now every capability it INVOKES (`grade`, `reward`, `onboarding`) is a kernel port it resolves, so the lifecycle imports only the kernel + resolves those ports ([02-module-map §4](../../docs/design/modular-architecture/02-module-map.md): keep the state machine WHOLE, never split). `default: true` — every instance runs the lifecycle. This carve makes the `db.js` residue exactly what ADR 0093 §3 predicted: the kernel identity/auth/twin slice + `db-kernel.js`.
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
 
-Owns the **build state machine**: tasks · claims · versions · done-when criteria · goals · dependencies · the claim→ship→grade→credit lifecycle · override requests · the ship/confirm/promote orchestration · `github-push` (server-mediated branch publish) · `merge-lock` · `conflict-resolve` · the `publish-reconciler` (confirmed→shipped auto-heal) · `ship-card`/`ship-preflight` · `version-close` · the peer-vote→karma fold-in · the work-tracking analytics (est-drift, grade trend, AI-dev curve).
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
 
-## The boundary (the one rule)
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
 
-This module reaches core **only** through the published doorway [`../../src/module-api.js`](../../src/module-api.js) (`coreVersion ^1.12.0` — it needs the R86 doorway additions: `repoInfo`, `moduleScopeMap`, `pathMatch`, `userAgent`, `asyncHandler`, `corsPublicGet`). It must **never** `require()` a core internal directly, and never another module. Core, in turn, must never `require()` a file in here — it reaches the lifecycle only through the `lifecycle` port (below). Both directions are enforced by the BV1.R44/R45 fitness checks.
-
-## The `lifecycle` kernel PORT (ADR 0093 §3 — the headline of this carve)
-
-The inverse of every prior carve: the lifecycle is carved last, so every capability it *invokes* (`grade`/`reward`/`onboarding`) is already a port it RESOLVES; the `lifecycle` port is the surface **core and the other modules resolve to reach the build state machine** without importing this module.
-
-- **Provides — port `lifecycle`** → the surface in [`lifecycle.js`](lifecycle.js) (DELEGATES, does not spread, to `./db` + `./task-classifier` so test stubs bite at call time — the economy `reward` precedent). Registered in [`routes/lifecycle.js`](routes/lifecycle.js)'s factory (the loader runs it at boot + on every test router rebuild; `hasProvider`-guarded). It **retires the three ADR-0091 §3 doorway leaks** — `createTask`, `VOTABLE_TASK_STATUSES`, `tallyPeerVotes` — plus exposes `classifyTaskKind` and the work-tracking READS the staying-core read routes need.
-- **Core + the other modules consume it WITHOUT importing this module** (all via `seams.resolveOptional('lifecycle')`):
-  - `src/bongos/routes/public.js` (the status surface) — `getTask`/`listVersions`/`versionProgress`/`recentShippedTasks`/`estimationDriftSummary`/`rollingAvgGrade`/`gradeTrendByDay`.
-  - `src/bongos/routes/me.js` (the profile reader) — `<redacted>`/`getEstVsActualRatio`/`recentGradesForBuilder`/`<redacted>`/`<redacted>`.
-  - `src/bongos/routes/builders.js` (the Archon roster) — `getBuildersRoster`/`<redacted>`/`gradeByBuilder`/`<redacted>`.
-  - `src/bongos/cascade-dispatch.js` (dormant System 3) — `classifyTaskKind`.
-  - `modules/onboarding/db.js` (newcomer-restock) + `modules/discord/db.js` (#bugs→task) — `createTask`.
-  - `modules/discord/discord-reaction.js` — `VOTABLE_TASK_STATUSES`.
-  - `modules/autonomy/pollers/routine-timers.js` — `tallyPeerVotes`.
-- **It RESOLVES (as a transaction-participant consumer)** the `reward` + `onboarding` ports inside its own `withTx` — `claimTask`/`confirmTask`/`decideOverrideRequest`/`applyGrade` open the tx, run the state-machine SQL, and call `seams.resolveOptional('reward')|('onboarding').*(client, …)` so the credit/achievement/stage writes commit atomically with the status flip (ADR 0093 §2). It resolves via `resolveOptional` (graceful), so `consumes: []` — a vanilla instance without economy/onboarding degrades those writes to best-effort no-ops, it does not fail.
-
-## Files
-
-| File | What |
-|---|---|
-| `db.js` | the lifecycle data layer — ~97 functions: tasks/claims/versions/goals/dependencies/criteria, the claim→ship→grade→credit lifecycle (`claimTask`/`resolveClaim`/`confirmTask`/`shipTask`/`applyGrade`/`abandonTask`), overrides, estimation + work analytics, the merge lease, `tallyPeerVotes`, `createTask`. Reaches the pool/withTx/seams via the doorway; resolves `reward`/`onboarding` as a consumer. |
-| `task-classifier.js` | the `tasks.kind`/discipline heuristic + `VOTABLE_TASK_STATUSES`/`VALID_KINDS`/`VALID_DISCIPLINES`/`TASK_FIELD_BOUNDS`. `branding()` (instance blocker-vendors) via the doorway. |
-| `done-when.js` · `hierarchy.js` · `version-close.js` | the done-when criterion read/write surface, the shallow one-level task hierarchy, and the version-close gate evaluator. Pool via the doorway. |
-| `github-push.js` · `conflict-resolve.js` · `publish-reconciler.js` | server-mediated branch publish ([ADR 0055](../../docs/adr/<redacted>.md)) + the [ADR 0082](../../docs/adr/<redacted>.md) generated-file conflict resolver + the confirmed→shipped reconciler. `repoInfo`/`branding`/`userAgent` via the doorway; siblings require each other. |
-| `ship-card.js` · `ship-preflight.js` · `merge-lock.js` | the CLI lifecycle card, the ship preflight guards, and the cross-machine merge lease serializer (pure; `branding` via the doorway). |
-| `lifecycle.js` | the `lifecycle` port provider surface (delegates to `./db` + `./task-classifier`). |
-| `routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js` | the lifecycle HTTP surface — moved out of `src/bongos/routes/`; the loader mounts them via `contributes.routes`. Auth/validators/seams via the doorway; `./db` + libs are siblings. |
-| `routes/lifecycle.js` | the route factory that registers the `lifecycle` port (no HTTP endpoint). |
-| `pollers/publish-reconciler.js` | the loader poller entry (`start`/`stop`) for the publish reconciler — inverts the old `server.js` hardcoded start (the autonomy routine-timers precedent). |
-
-## Boundary-forced duplication (keep in sync)
-
-Two helpers are **deliberately duplicated** with core `src/bongos/db.js` (ADR 0091 §2 — "boundary-forced duplication is allowed + documented"): the same SQL runs on both sides of the kernel↔module line, and a module can't import core:
-
-- **`sealSessionLog`** — core `deactivateBuilder` (rank/identity management, stays core) writes the same `session_logs` close row; here `resolveClaim`/`shipTask` write it.
-- **`_applyRankChangeTx` (+ its `RANKS` / `singleRungPromotionError` deps)** — core `setBuilderRank` (Archon-driven, stays core) runs the same in-tx rank change; here it backs the automatic xenos→thetes graduation on ship (`maybeAutoGraduateToThetes`).
-- **the `gradePassCount` SQL fragment** — core `builderRollingAvgGrade` (the grade-trend read the sessions BFG also consumes, kept on the doorway) + the module's grade reads share it.
-
-## NOT in this module (the db.js residue — stays core)
-
-- **Builder IDENTITY + admission** (`upsertBuilder`/`getBuilderByGithubId`/`hasInvitedAccessRequest`/`linkAnthropicAccount`/`updateBuilderDisciplines`) — `auth.js` imports these; they CANNOT live in a module.
-- **Rank + status MANAGEMENT** (`setBuilderRank`/`_applyRankChangeTx`/`<redacted>`/`deactivate`/`reactivateBuilder`) — Archon identity ops consumed by `routes/builders.js`, NOT the task lifecycle.
-- **AUTH sessions** (`createSession`/`lookupSession`/`revoke*`/`hasCliSession`/`SESSION_TTL_MS`) — the `builder_sessions` token store `auth.js` drives.
-- **TWIN / social** (Discord link flow, karma feed, `listAuditLog`, the grade-trend `builderRollingAvgGrade`) + the **security_docs** store (the kernel security-PROPERTY plane).
-- **The Gemini-key leak** (`getBuilderGeminiKeyRow`/…) — art-pipeline credential infra.
-- **The lifecycle CLIs** — a command travels with its domain but stays a CLI under `scripts/gds/` (`ship.js`/`claim.js`/`release.js`/`merge-mode.js`/`confirm.js`/`merge-lock.js`/`version-close.js`/`main-audit.js`/`gate-review.js`/`push-main.js`/`ci-grade.js`), outside the kernel boundary — they may require this module directly (the grading/economy precedent).
-
-## Tables
-
-None owned. `tasks`/`claims`/`versions`/`goals`/`done_when_criteria`/`dependencies`/`task_grades`/`task_override_requests`/`merge_leases` (+ their migrations) were created before the module system and stay in core `migrations/` (the shared-schema additive rule). The module owns the *queries*; any **new** lifecycle migration belongs in `modules/lifecycle/migrations/` namespaced `lifecycle_*`.
-
-## Tests
-
-The DB-free carved-surface tests in `scripts/gds/coreB-carve-proof.sh` (`task_classifier_vocab`, `criterion_progress`, `github_push_*`, `ship_card`, `ship_preflight`, `merge_lock`, `conflict_resolve`, `publish_reconciler`, `goal_achievement`, `context_pack`) import from `modules/lifecycle/…` and pass byte-identical. The DB-integration tests (`grade_attempts`, `rank_gate`, `abandon_task`, `confirm_attribution`/`override_attribution`/`grade_attribution`, `goal_routes`/`goal_tier`/`goal_achievement`, `dependencies_*`, `task_create_idempotency`, `worktree_disambiguation`, `cap_newcomer_tasks`, `migration_allocation`, `task_ownership_gate`, `verify_task_guard`, `versions_route`, `gate_approvals`, `merge_lease`, `autonomous_fit_protected_paths`, …) require/read `modules/lifecycle/{db,routes/*,libs}.js`; the route-consumer tests (`onboarding_route_signals`, `onboarding_observability`, `discord_reaction`) register the `lifecycle` port. See [ADR 0093](../../docs/adr/<redacted>.md).
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._