@bongos/core 1.17.0

package/modules/hall-ui/public/task-detail.js

@@ -0,0 +1,253 @@
+// task-detail.js — the shared, hall-wide record overlay (task 1753), now IDEA +
+// BLOCKER only (task 751).
+//
+// Owns the `#/idea|blocker/N` deep-link overlay for EVERY hall page — the compact
+// summary card. `#/task/N` used to open a third, deeper overlay variant here (full
+// description, status/version/kind/discipline/priority/min-rank/credits meta, the
+// goal it belongs to, touches, blocked-by / blocks dependency links, and Claim +
+// Copy-prompt actions); task 751 replaced that with a real page
+// (/task/:id — task.js) so a task gets a shareable URL and working back/forward
+// instead of a modal. This file now just REDIRECTS `#/task/N` to that page — for
+// every `#/task/N` link already written across the codebase (ADRs, session logs,
+// CLAUDE.md, scripts/gds/linkify-refs.js's RESOLVER_BASE) to keep resolving.
+//
+// Self-contained (its own getJSON, no framework), loaded AFTER dom-utils.js on
+// each page. It self-boots on DOMContentLoaded and survives the sign-in round-trip
+// by stashing the target hash (a logged-out viewer sees a "sign in" card). Any page
+// script opens an idea/blocker with `window.OTBTaskDetail.open(id)` — which now
+// navigates a TASK id straight to /task/:id — or by setting the hash.
+(function () {
+  'use strict';
+  var API = '/api/bongos';
+  // Generated typed client (task 1996 / R09), served as window.BongosClient by
+  // /lib/bongos-client.js. baseUrl:'' passes the full same-origin paths this file
+  // builds through unchanged; result-mode ({ status, ok, data }) preserves control flow 1:1.
+  var api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  var AUTH_NEEDED = 'auth-needed';
+  var DEEPLINK_RE = /^#\/(task|idea|blocker)\/(\d+)$/;
+  var STASH = 'otb-hall-deeplink';
+
+  function fmtRel(iso) {
+    if (!iso) return '';
+    var sec = (Date.now() - new Date(iso).getTime()) / 1000;
+    if (sec < 3600) return Math.max(1, Math.floor(sec / 60)) + 'm ago';
+    if (sec < 86400) return Math.floor(sec / 3600) + 'h ago';
+    return Math.floor(sec / 86400) + 'd ago';
+  }
+  // The hall is mounted at "/" on builders.<apex> and at "/builders" on the apex
+  // host (same rule work.js's buildPromptForTask / task.js use).
+  function hallBase() {
+    return location.hostname.startsWith('builders.') ? '' : '/builders';
+  }
+
+  async function getJSON(path, opts) {
+    var softAuth = opts && opts.softAuth;
+    var res = await api.request('GET', path);
+    if (res.status === 401) {
+      if (softAuth) { var e = new Error('auth-needed'); e.code = AUTH_NEEDED; throw e; }
+      window.location.assign(API + '/auth/web/start');
+      throw new Error('redirecting to auth');
+    }
+    if (!res.ok) { var err = new Error(path + ' → ' + res.status); err.status = res.status; throw err; }
+    return res.data;
+  }
+
+  var toast = function (m) { if (window.OTB && window.OTB.toast) window.OTB.toast(m, { duration: 2600 }); };
+
+  // task 759: idea triage (Metic+) — discard an open idea from the overlay.
+  // Cookie-authed PATCH; throws { status, data } on a non-2xx. The server enforces
+  // the Metic+ gate (ADR 0018); the button only renders for metic+ below.
+  async function patchJSON(path, body) {
+    var res = await api.request('PATCH', path, { body: body || {} });
+    if (res.status === 401) { window.location.assign(API + '/auth/web/start'); throw new Error('redirecting to auth'); }
+    var data = null;
+    try { data = res.data; } catch (_) { /* empty / non-JSON */ }
+    if (!res.ok) { var err = new Error(path + ' → ' + res.status); err.status = res.status; err.data = data || {}; throw err; }
+    return data;
+  }
+
+  async function fetchRef(kind, id) {
+    if (kind === 'blocker') {
+      var db = await getJSON(API + '/blockers/' + encodeURIComponent(id), { softAuth: true });
+      var b = db && (db.blocker || db);
+      return b && b.id != null ? Object.assign({ kind: kind }, b) : null;
+    }
+    var di = await getJSON(API + '/inbox/' + encodeURIComponent(id), { softAuth: true });
+    var i = di && (di.idea || di);
+    return i && i.id != null ? Object.assign({ kind: kind }, i) : null;
+  }
+
+  var h = function (tag, cls, text) {
+    var e = document.createElement(tag);
+    if (cls) e.className = cls;
+    if (text != null) e.textContent = text;
+    return e;
+  };
+
+  function simpleBody(kind, r, viewer) {
+    var nodes = [];
+    var label = '#' + r.id;
+    nodes.push(h('p', 'deeplink-card__kind', kind.toUpperCase()));
+    nodes.push(h('p', 'deeplink-card__title', r.title ? label + ' — ' + r.title : label));
+    var meta = [];
+    if (r.status) meta.push(r.status);
+    if (r.version_id) meta.push(r.version_id);
+    if (r.priority != null) meta.push('P' + r.priority);
+    if (meta.length) nodes.push(h('p', 'deeplink-card__meta', meta.join(' · ')));
+    var summary = r.value_summary || r.summary || r.description || r.body_md || r.notes_md;
+    if (summary) {
+      var d = h('div', 'td-desc');
+      d.textContent = String(summary);
+      nodes.push(d);
+    }
+    if (r.shipped_at) nodes.push(h('p', 'deeplink-card__note', 'Shipped ' + fmtRel(r.shipped_at)));
+
+    // task 759: Metic+ idea triage — a Discard control on an OPEN idea, right in
+    // the overlay (no /idea-triage skill / LLM in the loop). The button only
+    // renders for metic/archon; the server enforces the same gate regardless.
+    var rank = (viewer && viewer.rank) ? String(viewer.rank).toLowerCase() : '';
+    if (kind === 'idea' && r.status === 'open' && (rank === 'metic' || rank === 'archon')) {
+      var actions = h('div', 'td-actions');
+      var discardBtn = document.createElement('button');
+      discardBtn.type = 'button';
+      discardBtn.className = 'td-btn';
+      discardBtn.textContent = 'Discard';
+      discardBtn.addEventListener('click', function () {
+        discardBtn.disabled = true;
+        discardBtn.textContent = '…';
+        patchJSON(API + '/inbox/' + encodeURIComponent(r.id), { status: 'discarded' })
+          .then(function () { toast('Idea ' + label + ' discarded.'); clearLink(); })
+          .catch(function (err) {
+            if (err && err.message === 'redirecting to auth') return;
+            var code = err && err.data && err.data.error;
+            toast(code === 'INSUFFICIENT_RANK' || err.status === 403
+              ? 'Only Metic+ can triage ideas.'
+              : 'Could not discard that idea. Try again.');
+            discardBtn.disabled = false;
+            discardBtn.textContent = 'Discard';
+          });
+      });
+      actions.appendChild(discardBtn);
+      nodes.push(actions);
+    }
+    return nodes;
+  }
+
+  function bodyFor(state) {
+    var nodes = [];
+    var label = '#' + state.id;
+    if (state.loading) { nodes.push(h('p', 'deeplink-card__title', 'Loading ' + label + '…')); return nodes; }
+    if (state.needsAuth) {
+      nodes.push(h('p', 'deeplink-card__title', label));
+      nodes.push(h('p', 'deeplink-card__note', 'Sign in to the Builders’ Hall to view this record.'));
+      var a = h('a', 'deeplink-card__link', 'Sign in with GitHub →');
+      a.href = API + '/auth/web/start';
+      nodes.push(a);
+      return nodes;
+    }
+    if (state.notFound) {
+      nodes.push(h('p', 'deeplink-card__title', label + ' — no such ' + state.kind));
+      nodes.push(h('p', 'deeplink-card__note', 'Tasks, ideas, and blockers are numbered separately from GitHub pull requests, so this may be a PR rather than a record here.'));
+      return nodes;
+    }
+    if (state.error) {
+      nodes.push(h('p', 'deeplink-card__title', 'Could not load ' + label));
+      nodes.push(h('p', 'deeplink-card__note', 'Try again in a moment.'));
+      return nodes;
+    }
+    return simpleBody(state.kind, state.ref, state.viewer);
+  }
+
+  function dismiss() {
+    var c = document.getElementById('deeplink-card');
+    if (c) c.remove();
+  }
+  function clearLink() {
+    history.replaceState(null, '', location.pathname + location.search);
+    dismiss();
+  }
+  function render(state) {
+    dismiss();
+    var overlay = document.createElement('div');
+    overlay.id = 'deeplink-card';
+    overlay.className = 'deeplink-card';
+    overlay.setAttribute('role', 'dialog');
+    overlay.setAttribute('aria-modal', 'true');
+    overlay.setAttribute('aria-label', state.kind + ' #' + state.id);
+    var panel = document.createElement('div');
+    panel.className = 'deeplink-card__panel';
+    var close = document.createElement('button');
+    close.type = 'button';
+    close.className = 'deeplink-card__close';
+    close.setAttribute('aria-label', 'Close');
+    close.textContent = '×';
+    close.addEventListener('click', clearLink);
+    panel.appendChild(close);
+    bodyFor(state).forEach(function (n) { panel.appendChild(n); });
+    overlay.appendChild(panel);
+    overlay.addEventListener('click', function (e) { if (e.target === overlay) clearLink(); });
+    document.body.appendChild(overlay);
+  }
+
+  async function resolve() {
+    var m = DEEPLINK_RE.exec(location.hash);
+    if (!m) { dismiss(); return; }
+    var kind = m[1], id = m[2];
+    if (kind === 'task') {
+      // task 751: the task overlay moved to a real page. Redirect rather than
+      // render here so every #/task/N link already written across the codebase
+      // (ADRs, session logs, CLAUDE.md, linkify-refs.js's RESOLVER_BASE) keeps
+      // resolving, without a second click. replace(), not assign(), so the
+      // dead hash URL never lands in browser history.
+      location.replace(hallBase() + '/task/' + encodeURIComponent(id));
+      return;
+    }
+    render({ loading: true, kind: kind, id: id });
+    try {
+      var ref = await fetchRef(kind, id);
+      // task 759: probe the viewer's rank only for an idea (so the overlay can
+      // offer Metic+ triage). Best-effort — a failure just hides the button.
+      var viewer = null;
+      if (kind === 'idea' && ref) {
+        try {
+          var me = await getJSON(API + '/me', { softAuth: true });
+          viewer = (me && me.builder) ? me.builder : null;
+        } catch (_) { /* cosmetic — server enforces the gate regardless */ }
+      }
+      render(ref ? { kind: kind, id: id, ref: ref, viewer: viewer } : { kind: kind, id: id, notFound: true });
+    } catch (err) {
+      if (err && err.code === AUTH_NEEDED) {
+        try { sessionStorage.setItem(STASH, location.hash); } catch (_) { /* ignore */ }
+        render({ kind: kind, id: id, needsAuth: true });
+        return;
+      }
+      if (err && err.message === 'redirecting to auth') return;
+      render({ kind: kind, id: id, error: true });
+    }
+  }
+
+  window.addEventListener('keydown', function (e) {
+    if (e.key === 'Escape' && document.getElementById('deeplink-card')) clearLink();
+  });
+  window.addEventListener('hashchange', resolve);
+
+  function boot() {
+    var stashed = null;
+    try { stashed = sessionStorage.getItem(STASH); } catch (_) { /* ignore */ }
+    if (stashed) {
+      try { sessionStorage.removeItem(STASH); } catch (_) { /* ignore */ }
+      if (DEEPLINK_RE.test(stashed) && location.hash !== stashed) { location.hash = stashed; return; }
+    }
+    if (DEEPLINK_RE.test(location.hash)) resolve();
+  }
+  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', boot);
+  else boot();
+
+  window.OTBTaskDetail = {
+    resolve: resolve,
+    // Every existing caller (Work Board's open-detail button + backlog rows,
+    // the Goals page) passes a TASK id — navigate straight to the real page
+    // rather than round-tripping through the hash redirect above.
+    open: function (id) { location.href = hallBase() + '/task/' + encodeURIComponent(id); },
+  };
+})();

package/modules/hall-ui/public/task.html

@@ -0,0 +1,83 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Task — {{worldName}}</title>
+  <meta name="description" content="Task details — {{worldName}}.">
+  <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet">
+  <link rel="stylesheet" href="/builders/style.css?v=2026-07-03-roadmap1">
+  <style>
+    /* Page-local styles for the task-detail page (task 751) — the full-page
+       replacement for the old #/task/N overlay (task-detail.js). Reuses the
+       overlay's .deeplink-card__*/.td-* content classes (style.css) since the
+       body markup is the same shape, just not wrapped in a modal panel. */
+
+    .task-detail__back { font-size: 13px; color: var(--ink-soft); text-decoration: none; display: inline-block; margin-bottom: 10px; }
+    .task-detail__back:hover { color: var(--ink); text-decoration: underline; }
+
+    .task-status-pill {
+      display: inline-flex; align-items: center; height: 20px; padding: 0 10px;
+      border-radius: 999px; font-size: 12px; font-weight: 600;
+      background: var(--surface-2); border: 1px solid var(--border); color: var(--ink-soft);
+      text-transform: capitalize;
+    }
+    .task-status-pill--ready,
+    .task-status-pill--shipped,
+    .task-status-pill--confirmed { background: var(--ok-weak); color: var(--ok); border-color: color-mix(in srgb, var(--ok) 30%, transparent); }
+    .task-status-pill--active,
+    .task-status-pill--completed { background: var(--accent-weak); color: var(--accent-text); border-color: color-mix(in srgb, var(--accent) 30%, transparent); }
+    .task-status-pill--blocked,
+    .task-status-pill--backlog { background: var(--warn-weak); color: var(--warn); border-color: color-mix(in srgb, var(--warn) 30%, transparent); }
+
+    .task-detail__claim {
+      font-size: 13px; color: var(--ink-soft); margin: 0 0 12px;
+      display: flex; flex-wrap: wrap; gap: 4px 8px; align-items: baseline;
+    }
+    .task-detail__claim strong { color: var(--ink); font-weight: 600; }
+  </style>
+</head>
+<body data-page="task" data-page-title="Task">
+
+<div class="app">
+  <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
+  <div class="app-scrim" id="app-scrim" hidden></div>
+  <div class="app-body">
+    <header class="app-topbar" id="app-topbar"></header>
+    <div class="app-content">
+      <div class="page-head">
+        <p class="page-head__sub" id="task-sub">Loading task…</p>
+      </div>
+
+      <main>
+        <section class="scroll" id="task-scroll" aria-labelledby="task-h">
+          <a class="task-detail__back" href="/work">← Back to the Work Board</a>
+          <div id="task-body">
+            <p class="deeplink-card__title" id="task-h">Loading…</p>
+          </div>
+        </section>
+      </main>
+
+      <footer class="app-foot" id="app-foot"></footer>
+    </div>
+  </div>
+</div>
+
+<div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
+
+<!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
+     time so the chrome exists before the deferred page scripts execute. -->
+<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->
+<script src="/builders/dom-utils.js?v=2026-06-14-domutils" defer></script>
+<!-- task-detail.js still owns the #/idea/N and #/blocker/N deep-link overlay
+     (and the #/task/N → /task/N redirect, task 751); load it here too so those
+     links still resolve from this page. -->
+<script src="/builders/task-detail.js?v=2026-07-03-taskdetail2" defer></script>
+<script src="/builders/brand-apply.js?v=2026-06-19-r56" defer></script>
+<script src="/builders/task.js?v=2026-07-03-taskpage1" defer></script>
+</body>
+</html>

package/modules/hall-ui/public/task.js

@@ -0,0 +1,326 @@
+// public-builders/task.js — the task-detail PAGE (/task/:id, task 751).
+//
+// Replaces the #/task/N overlay (task-detail.js's old ~166-LOC taskBody) with a
+// real, shareable, indexable page: /builders/task/:id on the apex,
+// builders.<apex>/task/:id on the subdomain (the rewrite shim in
+// serve-internal.js normalizes both to the same served HTML). The server gates
+// the page itself (SIGNEDIN_BUILDERS_PAGE_RE + the two-segment TASK_DETAIL_PAGE_RE),
+// so an unauthenticated visitor never reaches this script.
+//
+// READ + NAVIGATION ONLY (task 751 scope) — no claim/release/ship action lives
+// here. The "Copy prompt" button is purely client-side (clipboard write, no
+// server call), same posture as the Work Board's copy action. Claim/release
+// from the browser is the dependent follow-up task.
+
+(() => {
+  'use strict';
+
+  const API = '/api/gds';
+  // Generated typed client (task 1996 / R09), served as window.BongosClient by
+  // /lib/bongos-client.js. baseUrl:'' passes the full same-origin paths this file
+  // builds through unchanged; result-mode ({ status, ok, data }) preserves control flow 1:1.
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  const AUTH_NEEDED = 'auth-needed';
+  const { escapeHtml, $, fmtDate } = window.OTB;
+  const toast = (msg) => window.OTB.toast(msg, { duration: 2600 });
+  const curLabel = () => (window.__BRANDING__ && window.__BRANDING__.currency && window.__BRANDING__.currency.label) || 'credits';
+
+  function toAuth() {
+    window.location.assign(`${API}/auth/web/start`);
+  }
+
+  async function getJSON(path, opts = {}) {
+    const res = await api.request('GET', path);
+    if (res.status === 401) {
+      if (opts.softAuth) {
+        const err = new Error(AUTH_NEEDED);
+        err.code = AUTH_NEEDED;
+        throw err;
+      }
+      toAuth();
+      throw new Error('redirecting to auth');
+    }
+    if (!res.ok) {
+      const err = new Error(`${path} → ${res.status}`);
+      err.status = res.status;
+      throw err;
+    }
+    return res.data;
+  }
+
+  // task 759: mutating call (ship / confirm). Cookie-authed, same posture as the
+  // Work Board's postJSON — resolves to the parsed 2xx body, throws an Error
+  // carrying { status, data } on a non-2xx so the caller can map the server's
+  // typed lifecycle-error code to a friendly line. A 401 bounces to sign-in.
+  async function postJSON(path, body) {
+    const res = await api.request('POST', path, { body: body || {} });
+    if (res.status === 401) { toAuth(); throw new Error('redirecting to auth'); }
+    let data = null;
+    try { data = res.data; } catch (_) { /* empty / non-JSON body */ }
+    if (!res.ok) {
+      const err = new Error(`${path} → ${res.status}`);
+      err.status = res.status;
+      err.data = data || {};
+      throw err;
+    }
+    return data;
+  }
+
+  // Map the server's typed lifecycle-error to a builder-readable line. Codes are
+  // exactly those POST /tasks/:id/ship + /confirm can return. The server is the
+  // authority (ADR 0016); the UI only surfaces the refusal.
+  function friendlyActionError(status, data) {
+    switch (data && data.error) {
+      case 'task_not_confirmed':
+        return 'That task can only be shipped once it is confirmed (its grade has landed).';
+      case 'task_not_completed':
+        return 'That task is not marked complete yet.';
+      case 'verify_attestation_required':
+        return (data && data.message) || 'Confirm a verification task only after the verify actually passed.';
+      case 'rank_too_low_for_task':
+      case 'INSUFFICIENT_RANK':
+        return 'Your rank is not high enough for that action.';
+      case 'not_your_task':
+        return 'Only the task’s claim holder or an Archon can take that action.';
+      default:
+        return status === 403
+          ? 'You are not allowed to take that action.'
+          : `Could not complete that (${status || '?'}). Try again.`;
+    }
+  }
+
+  // task 759: run a lifecycle action (ship / confirm), then reload so the page
+  // re-renders at the new status. On failure, surface the server's refusal and
+  // re-enable the button. `load` is hoisted below.
+  async function runLifecycle(btn, url, body, okMsg) {
+    const orig = btn.textContent;
+    btn.disabled = true;
+    btn.textContent = '…';
+    try {
+      await postJSON(url, body);
+      toast(okMsg);
+      await load();
+    } catch (err) {
+      if (err && err.message === 'redirecting to auth') return;
+      toast(friendlyActionError(err && err.status, err && err.data));
+      btn.disabled = false;
+      btn.textContent = orig;
+    }
+  }
+
+  // Same base-URL logic as work.js's buildPromptForTask / task-detail.js's
+  // redirect — the hall is mounted at "/" on builders.<apex> and at "/builders"
+  // on the apex host.
+  function hallBase() {
+    return location.hostname.startsWith('builders.') ? '' : '/builders';
+  }
+
+  function taskIdFromPath() {
+    const m = /\/task\/(\d+)/.exec(location.pathname);
+    return m ? m[1] : null;
+  }
+
+  function rankText(rr) {
+    const r = (rr || 'xenos').toLowerCase();
+    if (r === 'xenos') return 'any rank';
+    if (r === 'archon') return 'Archon';
+    return r.charAt(0).toUpperCase() + r.slice(1) + '+';
+  }
+
+  function fmtRel(iso) {
+    if (!iso) return '';
+    const sec = (Date.now() - new Date(iso).getTime()) / 1000;
+    if (sec < 3600) return `${Math.max(1, Math.floor(sec / 60))}m ago`;
+    if (sec < 86400) return `${Math.floor(sec / 3600)}h ago`;
+    return `${Math.floor(sec / 86400)}d ago`;
+  }
+
+  function depList(kindWord, items) {
+    const rows = items.map((d) => {
+      const status = d.status ? `<span class="td-dep-status">${escapeHtml(d.status)}</span>` : '';
+      return `<li><a class="td-dep" href="${hallBase()}/task/${escapeHtml(String(d.id))}">#${escapeHtml(String(d.id))} — ${escapeHtml(d.title || 'task')}</a>${status}</li>`;
+    }).join('');
+    return `<div class="td-deps"><p class="td-section-h">${escapeHtml(kindWord)}</p><ul class="td-dep-list">${rows}</ul></div>`;
+  }
+
+  async function copyText(text) {
+    try { await navigator.clipboard.writeText(text); return true; }
+    catch (_) {
+      try {
+        const ta = document.createElement('textarea');
+        ta.value = text; ta.style.position = 'fixed'; ta.style.opacity = '0';
+        document.body.appendChild(ta); ta.select();
+        const ok = document.execCommand('copy'); ta.remove();
+        return ok;
+      } catch (_e) { return false; }
+    }
+  }
+
+  function buildPrompt(t) {
+    const url = `${location.origin}${hallBase()}/task/${t.id}`;
+    const desc = String(t.description || '').replace(/(^|\s)#(\d+)\b/g, '$1$2');
+    return `I am working on GDS task ${t.id} (${t.title || ''}) — ${url}\n\n` +
+      `Claim it with \`/builder-claim ${t.id}\`, build it, then \`/builder-ship ${t.id}\`.\n\n` +
+      `Task description:\n${desc}`;
+  }
+
+  function renderTask(t, lastClaim, viewer) {
+    document.title = `#${t.id} — ${t.title || 'Task'} — ${document.title.split(' — ').pop()}`;
+    const sub = $('#task-sub');
+    if (sub) sub.textContent = `Task #${t.id}`;
+
+    const parts = [];
+    parts.push(`<p class="deeplink-card__kind">TASK <span class="task-status-pill task-status-pill--${escapeHtml(t.status || '')}">${escapeHtml(t.status || 'unknown')}</span></p>`);
+    parts.push(`<h1 class="deeplink-card__title" id="task-h">#${t.id}${t.title ? ' — ' + escapeHtml(t.title) : ''}</h1>`);
+
+    const meta = [];
+    if (t.version_id) meta.push(escapeHtml(t.version_id));
+    if (t.kind) meta.push(escapeHtml(t.kind));
+    if (t.discipline && t.discipline !== 'unclassified') meta.push(escapeHtml(t.discipline));
+    if (t.priority != null) meta.push('P' + escapeHtml(String(t.priority)));
+    meta.push('min: ' + escapeHtml(rankText(t.requires_rank)));
+    const creditVal = window.OTBBranding?.taskCreditValue?.(t) ?? t.credits_reward;
+    if (creditVal != null) meta.push(`${creditVal} ${window.OTBBranding?.taskCreditLabel?.(t) ?? curLabel()}`);
+    if (t.est_minutes) meta.push(`${t.est_minutes}m`);
+    parts.push(`<p class="deeplink-card__meta">${meta.join(' · ')}</p>`);
+
+    if (t.goal_id) {
+      parts.push(`<p class="td-goal">Goal: <a href="/goals#/goal/${encodeURIComponent(t.goal_id)}">Goal #${escapeHtml(String(t.goal_id))}</a></p>`);
+    }
+
+    // Claim history (task 751 — best-effort: the API surfaces the most recent
+    // claim holder, not the full ledger of every past claim).
+    if (lastClaim) {
+      const who = escapeHtml(lastClaim.github_login || 'a builder');
+      const when = lastClaim.claimed_at ? fmtDate(lastClaim.claimed_at, { time: true }) : '';
+      const state = lastClaim.released_at
+        ? (lastClaim.outcome ? `released (${escapeHtml(lastClaim.outcome)})` : 'released')
+        : 'holding this claim';
+      parts.push(`<p class="task-detail__claim">Last claimed by <strong>${who}</strong> ${when ? 'on ' + escapeHtml(when) : ''} — ${state}.</p>`);
+    }
+
+    if (t.value_summary) {
+      parts.push(`<p class="td-goal"><strong>Value:</strong> ${escapeHtml(t.value_summary)}</p>`);
+    }
+
+    if (t.description) {
+      parts.push(`<div class="td-desc">${escapeHtml(t.description)}</div>`);
+    }
+
+    const touches = Array.isArray(t.touches) ? t.touches : [];
+    if (touches.length) parts.push(`<p class="td-touches">✎ ${touches.map(escapeHtml).join(', ')}</p>`);
+
+    const deps = Array.isArray(t.dependencies) ? t.dependencies : [];
+    const dependents = Array.isArray(t.dependents) ? t.dependents : [];
+    if (deps.length) parts.push(depList('Blocked by', deps));
+    if (dependents.length) parts.push(depList('Blocks', dependents));
+
+    if (t.shipped_at) {
+      const by = t.shipped_by ? ` by builder #${escapeHtml(String(t.shipped_by))}` : '';
+      parts.push(`<p class="deeplink-card__note">Shipped ${escapeHtml(fmtRel(t.shipped_at))}${by}.</p>`);
+    }
+
+    // task 759: lifecycle action from the browser (no /builder-* CLI). The server
+    // enforces every rank + ownership gate (ADR 0016); we only surface the control
+    // the caller is actually allowed to use, and map any refusal to a friendly
+    // toast. `confirmed → shipped` is the any-builder-supervisor / own-claim ship;
+    // `completed → confirmed` is the Archon-only grader-bypass confirm (others see
+    // a read-only note — the grader/Archon still has to act).
+    const rank = (viewer && viewer.rank) ? String(viewer.rank).toLowerCase() : '';
+    const isSupervisor = rank === 'metic' || rank === 'archon';
+    const ownsLastClaim = !!(viewer && lastClaim && lastClaim.github_login &&
+      lastClaim.github_login === viewer.github_login);
+    let lifecycle = '';
+    if (t.status === 'confirmed' && (isSupervisor || ownsLastClaim)) {
+      lifecycle = `<button class="td-btn td-btn--primary" type="button" id="ship-btn">Ship it</button>`;
+    } else if (t.status === 'completed') {
+      lifecycle = rank === 'archon'
+        ? `<button class="td-btn td-btn--primary" type="button" id="confirm-btn">Confirm</button>`
+        : `<p class="td-action-note">Awaiting the grader / a confirmation before it can ship.</p>`;
+    }
+
+    // Copy prompt (the "ship link") — the same claim/build/ship prompt the Work
+    // Board hands an agent. Purely client-side (clipboard write, no server call).
+    parts.push(`
+      <div class="td-actions">
+        ${lifecycle}
+        <button class="td-btn" type="button" id="copy-prompt-btn">Copy prompt</button>
+        <a class="td-btn" href="${hallBase()}/work">Open the Work Board</a>
+      </div>
+    `);
+
+    const body = $('#task-body');
+    if (body) body.innerHTML = parts.join('');
+
+    const copyBtn = $('#copy-prompt-btn');
+    if (copyBtn) {
+      copyBtn.addEventListener('click', async () => {
+        const ok = await copyText(buildPrompt(t));
+        copyBtn.textContent = ok ? 'Copied ✓' : 'Copy failed';
+        toast(ok ? `Prompt for #${t.id} copied to your clipboard.` : 'Could not copy to the clipboard.');
+        setTimeout(() => { copyBtn.textContent = 'Copy prompt'; }, 1600);
+      });
+    }
+
+    const shipBtn = $('#ship-btn');
+    if (shipBtn) {
+      shipBtn.addEventListener('click', () => {
+        runLifecycle(shipBtn, `${API}/tasks/${encodeURIComponent(t.id)}/ship`, null, `#${t.id} shipped.`);
+      });
+    }
+    const confirmBtn = $('#confirm-btn');
+    if (confirmBtn) {
+      confirmBtn.addEventListener('click', () => {
+        // A verify-kind task's confirm attests the verification actually passed
+        // (the server requires { verified: true }); make the Archon affirm it.
+        if (t.kind === 'verify' && !window.confirm(`Confirm that verification for #${t.id} actually passed?`)) return;
+        const body = t.kind === 'verify' ? { verified: true } : {};
+        runLifecycle(confirmBtn, `${API}/tasks/${encodeURIComponent(t.id)}/confirm`, body, `#${t.id} confirmed.`);
+      });
+    }
+  }
+
+  function renderNotFound(id) {
+    const body = $('#task-body');
+    if (body) body.innerHTML = `
+      <p class="deeplink-card__title" id="task-h">#${escapeHtml(String(id))} — no such task</p>
+      <p class="deeplink-card__note">Tasks are numbered separately from GitHub pull requests, so this may be a PR rather than a GDS task.</p>
+    `;
+    const sub = $('#task-sub');
+    if (sub) sub.textContent = 'Not found';
+  }
+
+  function renderError(id) {
+    const body = $('#task-body');
+    if (body) body.innerHTML = `
+      <p class="deeplink-card__title" id="task-h">Could not load #${escapeHtml(String(id))}</p>
+      <p class="deeplink-card__note">Try reloading in a moment.</p>
+    `;
+  }
+
+  async function load() {
+    const id = taskIdFromPath();
+    if (!id) { renderNotFound(''); return; }
+    try {
+      const d = await getJSON(`${API}/tasks/${encodeURIComponent(id)}?include=last_claim`, { softAuth: true });
+      if (!d || !d.task) { renderNotFound(id); return; }
+      // Best-effort viewer probe so we know which lifecycle control (if any) the
+      // caller is allowed to see. A failure just means no action buttons render —
+      // the page still reads (task 759).
+      let viewer = null;
+      try {
+        const me = await getJSON(`${API}/me`, { softAuth: true });
+        viewer = (me && me.builder) ? me.builder : null;
+      } catch (_) { /* cosmetic — the server enforces regardless */ }
+      renderTask(d.task, d.last_claim || null, viewer);
+    } catch (err) {
+      if (err && err.code === AUTH_NEEDED) { toAuth(); return; }
+      if (err && err.status === 404) { renderNotFound(id); return; }
+      if (err && err.message === 'redirecting to auth') return;
+      console.error('[task] load failed:', err);
+      renderError(id);
+    }
+  }
+
+  document.addEventListener('DOMContentLoaded', load);
+})();