@bongos/core 1.17.0

package/scripts/gds/module.js

@@ -0,0 +1,482 @@
+#!/usr/bin/env node
+'use strict';
+//
+// scripts/gds/module.js — `bongos module new <key>` (scaffolder) + `bongos upgrade`
+// (coreVersion pre-check). BONGOS-V1 · BV1.R50 · task 1419 (ADR 0083 / design 04§2).
+//
+// Two halves of "operating the module system from the terminal":
+//
+//   bongos module new <key>
+//     Scaffolds modules/<key>/ — a VALID, loader-discoverable module.json (M03),
+//     the dir skeleton (routes/, migrations/, ui/), a sample route factory, and a
+//     nested CLAUDE.md — with NO edit to any core file. The loader
+//     (src/module-loader/loader.js) discovers it; enabling it (config/modules.json
+//     or env) mounts its routes behind the kernel's auth — the strangler endgame
+//     where adding a feature is "drop a directory," not "edit routes.js + modules.js".
+//
+//   bongos upgrade
+//     A fail-closed pre-flight: every ENABLED discovered module declares the
+//     src/module-api.js CORE_VERSION range (`coreVersion`) it supports. This
+//     reports each module's compatibility and REFUSES (exit 1) if an enabled
+//     module no longer satisfies the current core — the loud, ahead-of-time
+//     version of the loader's silent coreVersion SKIP (which would just drop the
+//     module at boot). Disabled mismatches are warnings, not blockers.
+//
+//   bongos module check <key>
+//     ADR 0107 §4 — the submit-time pre-check a module must clear before it can
+//     be upstreamed into the shared core catalog. REUSES (never re-types) the
+//     public-mirror publish boundary (scripts/gds/publish-manifest.js): every
+//     file the module carries is classified as if it already lived at its
+//     canonical modules/<key>/ location, and anything the DENYLIST forbids
+//     (game content, pixel art, copyrighted reference material, instance
+//     secrets, deploy/CI topology) fails the check with a clear reason — this
+//     is deliberately the DENY half only, not the full isPublishable() gate,
+//     because a brand-new module is never on the ALLOWLIST until it is
+//     accepted (§6); that omission must not read as "denied content." Also
+//     requires the manifest to declare an AGPL-3.0 license (inbound = outbound,
+//     ADR 0107 §4 — no CLA). On a pass, `--sign-off "Name <email>"` records a
+//     lightweight DCO-style affirmation (own work, licensed AGPL-3.0 — never a
+//     copyright-assignment CLA) to modules/<key>/.upstream-signoff.json.
+//
+// This is build tooling (scripts/), so — unlike a module — it may freely require
+// the core (src/*). It makes NO API/network calls: it is pure local fs + config
+// resolution, so it runs anywhere (a box, CI, a laptop) with no GDS session.
+//
+// Usage:
+//   bongos module new <key>            scaffold modules/<key>/
+//   bongos module new <key> --force    overwrite an existing modules/<key>/
+//   bongos upgrade                     pre-check enabled modules vs the core version
+//   bongos module check <key> [--sign-off "Name <email>"]   AGPL/publish pre-check + DCO sign-off
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const MODULES_DIR = path.join(REPO_ROOT, 'modules');
+
+const { validateManifest, assertValidManifest, KEY_RE } = require('../../src/module-loader/manifest-schema');
+const loader = require('../../src/module-loader/loader');
+const { resolveModules, MODULE_REGISTRY, NEUTRAL_PATH, INSTANCE_PATH } = require('../../src/modules');
+// The public-mirror publish boundary (ADR 0098) — REUSED, never re-typed, for
+// the ADR 0107 §4 upstreaming pre-check. Only matchesDeny is used (not the full
+// isPublishable), because a brand-new module is never on the ALLOWLIST until
+// accepted (§6) — gating on the allowlist here would reject every legitimate
+// new module. The denylist is the copyright/content classification we want.
+const { matchesDeny } = require('./publish-manifest');
+
+// CORE_VERSION via the doorway, lazily + fail-soft (mirrors loader.coreVersion):
+// requiring src/module-api pulls auth/pool, so a tooling context with no DB still
+// resolves to the known initial version rather than crashing.
+function coreVersion() {
+  try { return require('../../src/module-api').CORE_VERSION; }
+  catch { return '1.0.0'; }
+}
+
+function readJson(p) {
+  try { return JSON.parse(fs.readFileSync(p, 'utf8')); }
+  catch (e) { if (e.code === 'ENOENT') return null; throw e; }
+}
+
+function envPrefix() {
+  try { return require('../../src/branding').branding().envPrefix || 'CLOUDBONGOS'; }
+  catch { return 'CLOUDBONGOS'; }
+}
+
+// ---------------------------------------------------------------------------
+// Pure builders (exported for tests — no I/O, no network)
+// ---------------------------------------------------------------------------
+
+// dev-box -> "Dev Box"; economy -> "Economy". A readable default title.
+function titleize(key) {
+  return String(key).split(/[-_]+/).filter(Boolean)
+    .map((w) => w[0].toUpperCase() + w.slice(1)).join(' ');
+}
+// dev-box -> devBox (for the generated route-factory function name).
+function camel(key) {
+  return String(key).replace(/[-_]+(.)/g, (_, c) => c.toUpperCase());
+}
+
+// The minimal-but-valid manifest a fresh module starts from. coreVersion is a
+// caret on the CURRENT core, so the module supports this core + its future
+// minors; it declares one sample route so the scaffold mounts something real.
+// The four attribution fields (ADR 0107 §2) are stamped as TODO placeholders —
+// non-empty so they self-validate — so authorship travels with the module from
+// the start rather than being an afterthought bolted on at upstream-submit time.
+// `license` defaults to the core's own license (AGPL-3.0, ADR 0065) since
+// inbound = outbound is the project's default posture; override if different.
+function buildManifest(key, { core = coreVersion() } = {}) {
+  return {
+    key,
+    title: titleize(key),
+    description: `TODO: one sentence describing the ${key} module.`,
+    coreVersion: `^${core}`,
+    default: false,
+    author: 'TODO: your name or builder handle',
+    origin: 'TODO: the instance/project this module was built in',
+    license: 'AGPL-3.0',
+    maintainer: 'TODO: who to credit/contact if this module is upstreamed',
+    contributes: { routes: [key] },
+  };
+}
+
+function routeTemplate(key) {
+  const fn = `${camel(key)}Routes`;
+  return `// modules/${key}/routes/${key}.js — sample route factory for the "${key}" module.
+//
+// A route factory is \`() => express.Router()\`. The loader (src/module-loader)
+// mounts it behind the kernel's auth + audit when this module is enabled — you
+// never edit the core to add a route. Reach core capabilities ONLY through the
+// published doorway src/module-api.js; never deep-import core internals or a
+// sibling module (the one-way rule, ADR 0083).
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+
+module.exports = function ${fn}() {
+  const router = express.Router();
+
+  // Read routes need no rank gate. EVERY write route MUST be rank-gated — list
+  // every rank allowed; ('metic', 'archon') means Metic-and-above, e.g.:
+  //   router.post('/${key}/thing', api.requireRank('metic', 'archon'), (req, res) => { ... });
+  // the BV1.R44 fitness check fails the build on an ungated module write route.
+  router.get('/${key}/health', (req, res) => {
+    res.json({ module: '${key}', ok: true, coreVersion: api.CORE_VERSION });
+  });
+
+  return router;
+};
+`;
+}
+
+function claudeMdTemplate(key, manifest) {
+  const ENVKEY = key.toUpperCase().replace(/-/g, '_');
+  return `# ${manifest.title} module (\`modules/${key}/\`)
+
+> A Cloud Bongos feature module. It contributes routes / rooms / migrations / UI
+> to the host **only** through its \`module.json\` manifest + the published doorway
+> \`src/module-api.js\`. The core never imports it; it never imports core internals
+> or a sibling module (the one-way rule, ADR 0083).
+
+## Manifest (\`module.json\`)
+- \`key\` — must equal this directory name (\`${key}\`).
+- \`coreVersion\` — the \`src/module-api.js\` CORE_VERSION range this module supports.
+  \`bongos upgrade\` refuses to advance the core if an enabled module no longer
+  satisfies it; the loader silently skips a mismatched module at boot.
+- \`contributes\` — what mounts: \`routes\`, \`rooms\`, \`pollers\`, \`disciplines\`,
+  \`skills\`, \`uiSections\`, \`migrations\`. An empty \`{}\` is valid (mounts nothing).
+- \`default\` — fail-safe enablement when no config names the module (keep \`false\`).
+- \`author\` / \`origin\` / \`license\` / \`maintainer\` — attribution (ADR 0107 §2).
+  Optional but scaffolded as TODOs — fill them in now so credit travels with the
+  module if it's ever upstreamed to core. Portable metadata, not a cross-GDS link.
+
+## Enable it
+This module is OFF until an instance turns it on, via \`config/modules.json\`
+(\`{ "modules": { "${key}": true } }\`) or env (\`<PREFIX>_MODULE_${ENVKEY}=1\`). The
+loader then discovers and mounts it — no core edit.
+
+## Add a route
+\`contributes.routes: ["${key}"]\` → \`routes/${key}.js\` exports \`() => express.Router()\`.
+Gate every write route with \`api.requireRank('metic', 'archon')\` (Metic-and-above —
+list every allowed rank; BV1.R44 enforces this).
+
+## Add a migration
+Put \`NNN_*.sql\` under \`migrations/\` and set \`contributes.migrations: true\`
+(BV1.R46). Own only your \`${key}_*\` tables.
+
+## The one-way rule
+\`require('../../../src/module-api')\` — the doorway — is the ONLY core import
+allowed. No deep core imports, no sibling-module imports; cooperate through
+kernel seams (\`api.registerProvider\` / \`api.resolve\` / \`api.on\` / \`api.emit\`).
+`;
+}
+
+// Decide compatibility from rows (pure — tests drive it with injected rows).
+// A row: { key, coreVersion, enabled, satisfied }. BLOCKING = an enabled module
+// that does not satisfy the core (fail-closed). A disabled mismatch is a warning.
+function evaluateUpgrade({ rows = [], errors = [], core } = {}) {
+  const blocking = rows.filter((r) => r.enabled && !r.satisfied);
+  const warnings = rows.filter((r) => !r.enabled && !r.satisfied);
+  return { ok: blocking.length === 0, blocking, warnings, rows, errors, core };
+}
+
+// ---------------------------------------------------------------------------
+// Scaffolder (fs)
+// ---------------------------------------------------------------------------
+
+function scaffoldModule({ key, modulesDir = MODULES_DIR, core = coreVersion(), force = false } = {}) {
+  if (!key || !KEY_RE.test(key)) {
+    throw new Error(`invalid module key "${key}" — must match ${KEY_RE} (lowercase kebab-case, e.g. "dev-box")`);
+  }
+  const dir = path.join(modulesDir, key);
+  if (fs.existsSync(dir) && !force) {
+    throw new Error(`${path.relative(REPO_ROOT, dir)} already exists — use --force to overwrite, or pick another key.`);
+  }
+  const manifest = buildManifest(key, { core });
+  // self-check: a scaffolder that emits an INVALID manifest is a bug, not a typo.
+  assertValidManifest(manifest, `generated modules/${key}/module.json`);
+
+  const files = {
+    'module.json': JSON.stringify(manifest, null, 2) + '\n',
+    [`routes/${key}.js`]: routeTemplate(key),
+    'CLAUDE.md': claudeMdTemplate(key, manifest),
+    // git does not track empty dirs — keep the rest of the skeleton with placeholders.
+    'migrations/.gitkeep': '',
+    'ui/.gitkeep': '',
+  };
+  for (const [relp, content] of Object.entries(files)) {
+    const fp = path.join(dir, relp);
+    fs.mkdirSync(path.dirname(fp), { recursive: true });
+    fs.writeFileSync(fp, content);
+  }
+  return { dir, files: Object.keys(files), manifest };
+}
+
+// Gather the live compatibility state from disk + config (the I/O half of upgrade).
+function gatherUpgrade({ modulesDir = MODULES_DIR, core = coreVersion(), env = process.env, neutral, instance, prefix } = {}) {
+  neutral = neutral || readJson(NEUTRAL_PATH) || {};
+  instance = instance || readJson(INSTANCE_PATH) || {};
+  prefix = prefix || envPrefix();
+
+  const { loaded, skipped, errors } = loader.discoverModules({ roots: [modulesDir], core });
+  // the loader drops skipped manifests; re-read them so we can show coreVersion + default.
+  const skippedFull = skipped.map((s) => {
+    let manifest = null;
+    try { manifest = JSON.parse(fs.readFileSync(path.join(s.dir, 'module.json'), 'utf8')); } catch { /* gone/garbled */ }
+    return { ...s, manifest };
+  });
+
+  // resolveModules throws on an unknown key, so the registry MUST span every
+  // discovered key (loaded + skipped) — built-in entries plus a synthesized
+  // {default} for each discovered module.
+  const registry = { ...MODULE_REGISTRY };
+  for (const { key, manifest } of loaded) {
+    if (!(key in registry)) registry[key] = { default: manifest.default === true, contributes: manifest.contributes || {} };
+  }
+  for (const { key, manifest } of skippedFull) {
+    if (key && !(key in registry)) registry[key] = { default: manifest && manifest.default === true, contributes: (manifest && manifest.contributes) || {} };
+  }
+
+  let enabled = {};
+  try { enabled = resolveModules({ neutral, instance, env, envPrefix: prefix, registry }); }
+  catch { /* a malformed config shouldn't crash the pre-check; treat all as disabled */ }
+
+  const rows = [];
+  for (const { key, manifest } of loaded) {
+    rows.push({ key, coreVersion: manifest.coreVersion, enabled: enabled[key] === true, satisfied: true });
+  }
+  for (const { key, manifest, reason } of skippedFull) {
+    rows.push({ key, coreVersion: manifest ? manifest.coreVersion : null, enabled: enabled[key] === true, satisfied: false, reason });
+  }
+  rows.sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0));
+  return { rows, errors, core };
+}
+
+// ---------------------------------------------------------------------------
+// bongos module check <key> — ADR 0107 §4 upstreaming pre-check + DCO sign-off
+// ---------------------------------------------------------------------------
+
+// The DCO-style affirmation recorded on a pass. Deliberately NOT a
+// copyright-assignment CLA (ADR 0065 rejects relicensing-as-capture; ADR 0107
+// §4 "inbound = outbound") — the contributor affirms and RETAINS copyright.
+const DCO_STATEMENT =
+  'I affirm that this contribution is my own original work, or that I have the right to ' +
+  'submit it, and that I license it under AGPL-3.0. This is a Developer Certificate of ' +
+  'Origin-style affirmation, not a copyright-assignment CLA — I retain my copyright.';
+
+// Recursively list files under dir (skip VCS/dependency noise no module should ship).
+function listModuleFiles(dir) {
+  const out = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name === 'node_modules' || entry.name === '.git') continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...listModuleFiles(full));
+    else out.push(full);
+  }
+  return out;
+}
+
+// Pure(ish) — reads modules/<key>/ off disk, no network. Returns
+// { key, ok, findings[], files[] }. findings are { kind, detail } — kind is
+// 'manifest' | 'license' | 'content'.
+function checkModulePublishability(key, { modulesDir = MODULES_DIR } = {}) {
+  const dir = path.join(modulesDir, key);
+  if (!fs.existsSync(dir)) {
+    throw new Error(`modules/${key} does not exist under ${path.relative(REPO_ROOT, modulesDir) || '.'}`);
+  }
+
+  const findings = [];
+  const manifestRaw = readJson(path.join(dir, 'module.json'));
+  if (!manifestRaw) {
+    findings.push({ kind: 'manifest', detail: 'module.json missing or unreadable' });
+  } else {
+    const { valid, errors } = validateManifest(manifestRaw);
+    if (!valid) findings.push({ kind: 'manifest', detail: `module.json invalid: ${errors.join('; ')}` });
+    const license = manifestRaw.license;
+    if (!license || !/^AGPL-3\.0/.test(license)) {
+      findings.push({
+        kind: 'license',
+        detail: `module.json license is ${license ? JSON.stringify(license) : 'unset'} — upstreaming requires ` +
+          'AGPL-3.0 (inbound = outbound, ADR 0107 §4)',
+      });
+    }
+  }
+
+  // Classify every file AS IF it already lived at its canonical modules/<key>/
+  // path — this is what makes the check hermetically testable against a temp
+  // modulesDir while still reusing the REAL repo-wide denylist.
+  const files = listModuleFiles(dir)
+    .map((abs) => `modules/${key}/${path.relative(dir, abs).split(path.sep).join('/')}`)
+    .sort();
+  const denied = files.filter((f) => matchesDeny(f));
+  if (denied.length) {
+    findings.push({
+      kind: 'content',
+      detail: 'contains content the AGPL core publish boundary denies (game content, pixel art, ' +
+        `copyrighted reference material, or instance/topology secrets): ${denied.join(', ')}`,
+    });
+  }
+
+  return { key, ok: findings.length === 0, findings, files, denied };
+}
+
+// Records the sign-off ONLY once the content/license check has passed —
+// there is nothing to affirm over rejected content.
+function recordSignOff(key, signedBy, { modulesDir = MODULES_DIR } = {}) {
+  const dir = path.join(modulesDir, key);
+  const now = new Date().toISOString();
+  const record = { module: key, checkedAt: now, statement: DCO_STATEMENT, signOff: { signedBy, date: now } };
+  const file = path.join(dir, '.upstream-signoff.json');
+  fs.writeFileSync(file, JSON.stringify(record, null, 2) + '\n');
+  return { ...record, path: path.relative(REPO_ROOT, file) };
+}
+
+// ---------------------------------------------------------------------------
+// Commands
+// ---------------------------------------------------------------------------
+
+function cmdNew(args, { log = console.log, errlog = console.error } = {}) {
+  const key = args.find((a) => !a.startsWith('-'));
+  const force = args.includes('--force');
+  if (!key) {
+    errlog('usage: bongos module new <key>   (e.g. bongos module new economy)');
+    return 2;
+  }
+  let res;
+  try { res = scaffoldModule({ key, force }); }
+  catch (e) { errlog(`bongos module new: ${e.message}`); return 1; }
+
+  log(`Scaffolded module "${key}" at modules/${key}/ (no core edit needed):`);
+  for (const f of res.files) log(`  ✓ modules/${key}/${f}`);
+  const ENVKEY = key.toUpperCase().replace(/-/g, '_');
+  log('\nNext:');
+  log(`  • describe it   — edit modules/${key}/module.json (title + description)`);
+  log(`  • credit it     — fill in author/origin/maintainer in module.json (license defaults to AGPL-3.0)`);
+  log(`  • enable it     — add "${key}": true to config/modules.json (or set <PREFIX>_MODULE_${ENVKEY}=1)`);
+  log(`  • build it      — fill routes/${key}.js; add migrations/ + ui/ (see modules/${key}/CLAUDE.md)`);
+  log('  • verify        — bongos upgrade  (checks coreVersion compatibility)');
+  return 0;
+}
+
+function cmdUpgrade(_args, { log = console.log, errlog = console.error, gather = gatherUpgrade } = {}) {
+  const data = gather();
+  const verdict = evaluateUpgrade(data);
+
+  log('bongos upgrade — module compatibility pre-check');
+  log(`  core (src/module-api.js CORE_VERSION): ${verdict.core}`);
+
+  if (!verdict.rows.length && !data.errors.length) {
+    log('  no modules discovered under modules/ — nothing to check.');
+    return 0;
+  }
+  for (const r of verdict.rows) {
+    const mark = r.satisfied ? '✓' : (r.enabled ? '✗' : '!');
+    const state = r.enabled ? 'enabled' : 'disabled';
+    let note = '';
+    if (!r.satisfied) {
+      note = `  — coreVersion ${r.coreVersion || '(none)'} not satisfied by core ${verdict.core}` +
+        (r.enabled ? ' — will NOT mount' : ' (disabled, harmless)');
+    }
+    log(`  ${mark} ${r.key.padEnd(18)} ${String(r.coreVersion || '').padEnd(10)} ${state}${note}`);
+  }
+  for (const e of data.errors) errlog(`  ! ${e.dir}: ${(e.errors || []).join('; ')}`);
+
+  if (!verdict.ok) {
+    errlog(`\nREFUSING: ${verdict.blocking.length} enabled module(s) incompatible with core ${verdict.core}: ${verdict.blocking.map((b) => b.key).join(', ')}.`);
+    errlog(`Widen each module's coreVersion to a range that includes ${verdict.core} (or hold the core upgrade) before proceeding.`);
+    return 1;
+  }
+  log(`\nOK — every enabled module satisfies core ${verdict.core}.`);
+  return 0;
+}
+
+function cmdCheck(args, { log = console.log, errlog = console.error, check = checkModulePublishability, sign = recordSignOff } = {}) {
+  const key = args.find((a) => !a.startsWith('-'));
+  if (!key) {
+    errlog('usage: bongos module check <key> [--sign-off "Name <email>"]');
+    return 2;
+  }
+  const signIdx = args.indexOf('--sign-off');
+  const signedBy = signIdx !== -1 ? args[signIdx + 1] : null;
+
+  let result;
+  try { result = check(key); }
+  catch (e) { errlog(`bongos module check: ${e.message}`); return 1; }
+
+  log(`bongos module check — upstreaming pre-check for "${key}"`);
+  if (result.ok) {
+    log('  ✓ AGPL/publish pre-check passed — no denied content, license is AGPL-3.0.');
+  } else {
+    for (const f of result.findings) errlog(`  ✗ ${f.kind}: ${f.detail}`);
+  }
+
+  if (!result.ok) {
+    errlog(`\nREFUSING: "${key}" is not clear to submit upstream. Fix the finding(s) above and re-run.`);
+    return 1;
+  }
+
+  if (signedBy) {
+    const record = sign(key, signedBy);
+    log(`\nSign-off recorded — ${record.path}`);
+    log(`  "${record.signOff.signedBy}", ${record.signOff.date}`);
+  } else {
+    log('\nNo --sign-off given — pass --sign-off "Name <email>" to affirm + record the DCO-style sign-off.');
+  }
+  return 0;
+}
+
+function printHelp(out = console.log) {
+  out('bongos module — scaffold + manage Cloud Bongos modules\n');
+  out('Usage:');
+  out('  bongos module new <key>     Scaffold modules/<key>/ (manifest + skeleton + sample route + CLAUDE.md)');
+  out('  bongos upgrade              Pre-check enabled modules against the core version (fail-closed)');
+  out('  bongos module check <key> [--sign-off "Name <email>"]');
+  out('                              AGPL/publish pre-check before upstreaming + record a DCO-style sign-off');
+}
+
+function main(argv) {
+  const args = argv.slice(2);
+  const sub = args[0];
+  if (sub === 'new') return cmdNew(args.slice(1));
+  if (sub === 'upgrade') return cmdUpgrade(args.slice(1));
+  if (sub === 'check') return cmdCheck(args.slice(1));
+  if (!sub || sub === 'help' || sub === '--help' || sub === '-h') {
+    printHelp();
+    return sub ? 0 : 2;
+  }
+  console.error(`bongos module: unknown subcommand "${sub}"`);
+  printHelp(console.error);
+  return 2;
+}
+
+module.exports = {
+  main, cmdNew, cmdUpgrade, cmdCheck, printHelp,
+  scaffoldModule, gatherUpgrade, evaluateUpgrade, buildManifest,
+  checkModulePublishability, recordSignOff, DCO_STATEMENT,
+  routeTemplate, claudeMdTemplate, titleize, camel, coreVersion,
+  MODULES_DIR,
+};
+
+if (require.main === module) {
+  process.exit(main(process.argv));
+}

package/scripts/gds/newcomer-floor.config.json

@@ -0,0 +1,13 @@
+{
+  "_doc": "Supply knob for the deterministic newcomer-task floor replenisher (scripts/gds/newcomer-floor.js) and the on-claim restock (src/bongos/newcomer-restock.js). As of task 1488 each discipline holds a LIST of chore templates, and each chore keeps its OWN standing pool to its OWN `floor` (declared per-template in newcomer-floor.templates.json). The `floor` in this disciplines map is now the DEFAULT applied to any template that omits its own — i.e. a fallback, not the primary knob. The pool is measured in READY copies of each template (source_ref tmpl:<discipline>:<template_id>:<seq>); when a chore's ready copies drop below its floor, fresh identical copies are stamped — deterministic, no AI subagent, no 401. The CHORE definitions (and their per-template floors) live in templates.json (edit there to add/change a chore or tune its pool depth).",
+  "_review_gate": "`auto_promote` is the review toggle for the CLI seeder. true -> stamped copies land at status='ready' (claimable immediately). Safe here because output is deterministic and the templates are pre-approved (set true 2026-06-16, owner decision). false -> copies land at status='backlog' (NOT Xenos-claimable) for an Archon to promote via POST /api/gds/tasks/:id/promote. (The on-claim restock always stamps 'ready' — it tops a just-claimed chore's pool back up so the shelf is never empty.)",
+  "_floor_note": "Per-template `floor` lives in newcomer-floor.templates.json (next to each chore's credits_reward + est_minutes). The disciplines map below is only the per-discipline DEFAULT used when a template omits its own floor. credits_reward is never read from here.",
+  "templates_path": "newcomer-floor.templates.json",
+  "auto_promote": true,
+  "max_generate_per_run": 8,
+  "disciplines": {
+    "engineer": { "floor": 2 },
+    "artist": { "floor": 3 },
+    "ideator": { "floor": 2 }
+  }
+}