@bongos/core 1.18.0 → 1.18.3

package/scripts/hall-preview/fixtures/goals__3.json

@@ -1,103 +0,0 @@
-{
-  "goal": {
-    "id": "3",
-    "version_id": "BONGOS-V1",
-    "title": "BONGOS-V1 — general",
-    "description": "Default catch-all goal for BONGOS-V1, auto-created by migration 160 (ADR 0086 §2). Holds the criteria that predate the goal tier; Archon-owned, members empty.",
-    "scope_modules": [],
-    "status": "open",
-    "visibility": "public",
-    "created_by": null,
-    "succeeded_by_goal_id": null,
-    "sort_order": 5,
-    "created_at": "2026-06-24T19:35:31.472Z",
-    "updated_at": "2026-07-05T21:41:32.144Z"
-  },
-  "members": [
-    {
-      "goal_id": "3",
-      "builder_id": "1",
-      "role": "member",
-      "joined_at": "2026-07-02T11:53:56.350Z",
-      "github_login": "lars589",
-      "display_name": "lars589",
-      "avatar_url": "https://avatars.githubusercontent.com/u/283020391?v=4",
-      "rank": "archon"
-    },
-    {
-      "goal_id": "3",
-      "builder_id": "95",
-      "role": "member",
-      "joined_at": "2026-07-02T17:01:01.676Z",
-      "github_login": "jaxri",
-      "display_name": "Jackson Rini",
-      "avatar_url": "https://avatars.githubusercontent.com/u/64553469?v=4",
-      "rank": "metic"
-    }
-  ],
-  "criteria": [
-    {
-      "id": "101",
-      "version_id": "BONGOS-V1",
-      "criterion_id": "signed-installable",
-      "criterion_md": "**Signed, installable, and permission-guided on Mac + Windows.** A code-signed, notarized macOS build and a signed Windows build install from a branded download and launch as a floating menu-bar/tray app, reusing the existing Dev Box app distribution + Apple Developer ID; the Dev Box switch is absorbed as a module of the bongos app rather than shipping as a separate install. Done when: the bongos app is one Electron app that contains the prior Dev Box functionality as a module; a signed+notarized Mac build and a signed Windows build install from the branded /downloads redirect and auto-update; a first-run permission wizard detects + deep-links Screen Recording and Microphone grants with live grant-state; and an unsigned dev-build path exists for local iteration.",
-      "satisfied": false,
-      "sort_order": 1,
-      "goal_id": "3"
-    },
-    {
-      "id": "102",
-      "version_id": "BONGOS-V1",
-      "criterion_id": "captures-anywhere",
-      "criterion_md": "**Captures narrated feedback over any on-screen target.** The floating toolbar overlays any window (the Zoom annotation model) and records the microphone plus time-aligned ~1/sec snapshots of the chosen target, with freehand/box/arrow/text markup and a freeze-frame, on macOS and Windows. Done when: a transparent, always-on-top, click-through overlay draws over arbitrary other apps (surviving macOS fullscreen/Spaces and Windows multi-monitor DPI); a global hotkey summons/dismisses the bar; Record captures mic + the chosen window/screen at ~1/sec with snapshot-on-change + perceptual dedup + a frame cap; and Markup draws and freezes over any pixels.",
-      "satisfied": false,
-      "sort_order": 2,
-      "goal_id": "3"
-    },
-    {
-      "id": "103",
-      "version_id": "BONGOS-V1",
-      "criterion_id": "cheap-complete-synthesis",
-      "criterion_md": "**Synthesizes one cheap, complete, model-agnostic prompt.** The capture is fused into a single LLM-ready bundle at a disciplined token envelope — frames dominate cost, so audio is transcribed on-device to text and frames are deduped + salience-escalated rather than sent 1/sec at full resolution. Done when: on-device transcription (whisper.cpp) yields word-timestamped text; transcript and frames are time-aligned and only transcript/markup-flagged frames escalate to full resolution; a deterministic prompt.md is assembled with inlined absolute image paths; and a typical multi-minute session lands at the disciplined envelope (~5-11k tokens), not the ~70k+ naive cost.",
-      "satisfied": false,
-      "sort_order": 3,
-      "goal_id": "3"
-    },
-    {
-      "id": "104",
-      "version_id": "BONGOS-V1",
-      "criterion_id": "lands-in-claude",
-      "criterion_md": "**Lands in Claude — Desktop and Code — reliably and model-agnostically.** The synthesized bundle reaches both Claude surfaces without a fragile step, under a documented contract that works for any agent. Done when: a file-bundle handoff (prompt.md + image files) plus clipboard text works for Claude Desktop; a /feedback path injects the prompt and loads the image paths in Claude Code; an optional local stdio MCP server exposes the latest bundle for a hands-free pull; and an ADR + README document the architecture and the model-agnostic prompt/handoff contract.",
-      "satisfied": false,
-      "sort_order": 4,
-      "goal_id": "3"
-    },
-    {
-      "id": "106",
-      "version_id": "BONGOS-V1",
-      "criterion_id": "module-system-live",
-      "criterion_md": "**The project-extensible module system is live — the whole product is `core + modules`.** Cloud Bongos's closed four-module registry becomes self-describing packages the platform discovers, validates, and mounts; a host can ADD or CONFIGURE modules without forking core, and the trust boundary (ADR 0016) is ENFORCED across module routes, not trusted. Built as an incremental strangler migration (ADR 0083) — reorganize, not rewrite; single-package, single-process, no-bundler preserved. Done when: (1) `src/module-api.js` is the stable, semver'd doorway and the only core file a module may import; (2) a loader discovers/validates/mounts `modules/*/module.json` behind kernel-composed auth and replaces the hardcoded `KNOWN_MODULES` registry, with a kernel seam registry (ports + events) for cross-module capability; (3) the four feature modules (dev-box, game, discord, art-pipeline) are moved into `modules/<key>/` and the inline `if (isModuleEnabled())` gates are deleted, with OTB behaving byte-identically (the proof); (4) fitness functions fail the build on any boundary violation (core never imports a module, modules import only the published API, every module write-route is rank-gated, core carries no module code, module migrations are additive + namespaced); (5) module-owned migrations generalize the `migrations/game/` precedent to `modules/<key>/migrations/` (enabled-gated apply, disable-preserves-data); (6) `bongos module new <key>` scaffolds a module and `bongos upgrade` pre-checks coreVersion; and (7) docs/modules-contract.md documents the plugin-API contract + a module-author recipe.",
-      "satisfied": true,
-      "sort_order": 5,
-      "goal_id": "3"
-    },
-    {
-      "id": "108",
-      "version_id": "BONGOS-V1",
-      "criterion_id": "goal-scoped-work-hierarchy",
-      "criterion_md": "**Builders are assigned module-scoped goals, not individual tasks — and can author their own work within a goal's wall, enforced server-side.** The owner stops hand-authoring every task; a builder joins a shared, module-scoped goal and gains bounded authority to create + organize tasks beneath it, never exceeding the goal's module scope or touching the protected core. The six-tier hierarchy (Project → Version → Goal → Criteria → Task → Sub-task) is a per-instance config preset; enforcement is core (ADR 0086, building on ADR 0016/0043/0049/0083/0084). Done when: (1) a module-scope map (`module-scope-map.js`, importing `PROTECTED_GLOBS`) + a configurable hierarchy preset (`config/hierarchy.json` + `hierarchy-config.js`, onboarding-edited) exist; (2) a `goals` tier (shared, joinable, `scope_modules`) sits between versions and criteria, `done_when_criteria` re-parent under goals (backfilled under a per-version default goal), and `tasks` carry `goal_id`, with the `/status` rollup running Version → Goals → Criteria → Tasks; (3) a goal member can author a task via `POST /goals/:id/tasks` only if it is scope-subset + clears the protected-path gate + the auto-derived rank floor, with two fitness checks (goal routes pinned in `route-rank-check`; scope code imports `PROTECTED_GLOBS`) and an abuse-matrix test proving the wall holds; (4) a polymorphic dependency edge spans tasks/goals/criteria and resolves at the existing claim gate, a criterion auto-flags \"met — pending review\" when its tasks ship, a `/goal-review` cadence (Metic+) confirms → auto-achieves goals, and goals archive/reopen/carry-forward at rescope; and (5) a sub-Metic builder demonstrably authors, claims, and ships a task inside an assigned goal while being BLOCKED server-side from authoring one that touches a protected path outside scope (the live proof). Phase 5 of the ADR (an AI relevance judge + sub-Metic membership inside protected-scope goals) is deferred to its own security-reviewed ADR.",
-      "satisfied": false,
-      "sort_order": 6,
-      "goal_id": "3"
-    }
-  ],
-  "dependencies": [
-    {
-      "id": "26",
-      "title": "Cloud Bongos productization and self-host",
-      "status": "open",
-      "version_id": "BONGOS-V1",
-      "satisfied": false
-    }
-  ]
-}

package/scripts/hall-preview/fixtures/goals__35.json

@@ -1,49 +0,0 @@
-{
-  "goal": {
-    "id": "35",
-    "version_id": "BONGOS-V1",
-    "title": "Project creation flow",
-    "description": "A new owner goes from zero to a live, owned STANDALONE Cloud Bongos instance (own repo + pinned @cloudbongos/core, ADR 0108) through one guided flow — no hand-editing of servers — with the human-only steps (GitHub repo, OAuth app + secret, domain, first sign-in) precise, UI-first, and verified. The canonical step sequence is the source of truth; skill/CLI/hall are forms over it. Distilled from the Emersonian Circles standup (task 1917).",
-    "scope_modules": [],
-    "status": "open",
-    "visibility": "public",
-    "created_by": "1",
-    "succeeded_by_goal_id": null,
-    "sort_order": 3,
-    "created_at": "2026-07-04T09:16:29.595Z",
-    "updated_at": "2026-07-08T22:08:03.567Z"
-  },
-  "members": [
-    {
-      "goal_id": "35",
-      "builder_id": "1",
-      "role": "lead",
-      "joined_at": "2026-07-04T09:16:29.595Z",
-      "github_login": "lars589",
-      "display_name": "lars589",
-      "avatar_url": "https://avatars.githubusercontent.com/u/283020391?v=4",
-      "rank": "archon"
-    }
-  ],
-  "criteria": [
-    {
-      "id": "165",
-      "version_id": "BONGOS-V1",
-      "criterion_id": "project-creation-flow",
-      "criterion_md": "A new owner goes from zero to a live, owned STANDALONE Cloud Bongos instance (own repo + pinned @cloudbongos/core, ADR 0108) through one guided flow — no hand-editing of servers — with the human-only steps (GitHub repo, OAuth app + secret, domain, first sign-in) precise, UI-first, and verified. The canonical step sequence is the source of truth; skill/CLI/hall are forms over it. Distilled from the Emersonian Circles standup (task 1917).",
-      "satisfied": true,
-      "sort_order": 41,
-      "goal_id": "35"
-    },
-    {
-      "id": "166",
-      "version_id": "BONGOS-V1",
-      "criterion_id": "adopt-existing-repo",
-      "criterion_md": "An owner with an EXISTING repository (app code, git history, backlog) can adopt Cloud Bongos onto it — layer the pinned @cloudbongos/core + config/ + .claude/ without clobbering, reflect the repo's REAL current state (not a synthetic 'V1 — Prove the loop'), import its existing backlog into GDS tasks, and get a conflict pre-flight — through the same guided flow. Complements the greenfield criterion (project-creation-flow); this is the brownfield branch. Raised while abandoning task 1689 (2026-07-04); the standalone two-repo model is already proven by Emersonian Circles (task 1917).",
-      "satisfied": true,
-      "sort_order": 42,
-      "goal_id": "35"
-    }
-  ],
-  "dependencies": []
-}

package/scripts/hall-preview/fixtures/goals__conflicts.json

@@ -1,154 +0,0 @@
-{
-  "ok": true,
-  "goal_id": 25,
-  "conflicts": [
-    {
-      "task_a": 2168,
-      "task_b": 2169,
-      "title_a": "Delete orphaned builders.js render paths (security-reports, roster, skill-prefs)",
-      "title_b": "Home redesign: attention inbox, Projects card, linked stat tiles, zone budgets",
-      "overlapping_paths": [
-        "modules/hall-ui/public/builders.js"
-      ],
-      "severity": "low",
-      "has_active_claims": false,
-      "cross_goal": false
-    },
-    {
-      "task_a": 2168,
-      "task_b": 2174,
-      "title_a": "Delete orphaned builders.js render paths (security-reports, roster, skill-prefs)",
-      "title_b": "Standing consolidation: 4 rail sections, Achievements folded in, bounties to Economy",
-      "overlapping_paths": [
-        "modules/hall-ui/public/builders.js"
-      ],
-      "severity": "low",
-      "has_active_claims": false,
-      "cross_goal": false
-    },
-    {
-      "task_a": 2168,
-      "task_b": 2177,
-      "title_a": "Delete orphaned builders.js render paths (security-reports, roster, skill-prefs)",
-      "title_b": "Widget-registry governance: zone budgets, metadata validation, placement doctrine",
-      "overlapping_paths": [
-        "modules/hall-ui/public/builders.js"
-      ],
-      "severity": "low",
-      "has_active_claims": false,
-      "cross_goal": false
-    },
-    {
-      "task_a": 2169,
-      "task_b": 2174,
-      "title_a": "Home redesign: attention inbox, Projects card, linked stat tiles, zone budgets",
-      "title_b": "Standing consolidation: 4 rail sections, Achievements folded in, bounties to Economy",
-      "overlapping_paths": [
-        "modules/hall-ui/public/builders.js",
-        "modules/hall-ui/public/hall-widgets.js",
-        "modules/hall-ui/public/index.html"
-      ],
-      "severity": "low",
-      "has_active_claims": false,
-      "cross_goal": false
-    },
-    {
-      "task_a": 2169,
-      "task_b": 2177,
-      "title_a": "Home redesign: attention inbox, Projects card, linked stat tiles, zone budgets",
-      "title_b": "Widget-registry governance: zone budgets, metadata validation, placement doctrine",
-      "overlapping_paths": [
-        "modules/hall-ui/public/builders.js"
-      ],
-      "severity": "low",
-      "has_active_claims": false,
-      "cross_goal": false
-    },
-    {
-      "task_a": 2174,
-      "task_b": 2175,
-      "title_a": "Standing consolidation: 4 rail sections, Achievements folded in, bounties to Economy",
-      "title_b": "Sidebar IA regroup by audience + Economy in Docs + task page breadcrumb",
-      "overlapping_paths": [
-        "modules/hall-ui/public/shell.js"
-      ],
-      "severity": "low",
-      "has_active_claims": false,
-      "cross_goal": false
-    },
-    {
-      "task_a": 2174,
-      "task_b": 2177,
-      "title_a": "Standing consolidation: 4 rail sections, Achievements folded in, bounties to Economy",
-      "title_b": "Widget-registry governance: zone budgets, metadata validation, placement doctrine",
-      "overlapping_paths": [
-        "modules/hall-ui/public/builders.js"
-      ],
-      "severity": "low",
-      "has_active_claims": false,
-      "cross_goal": false
-    },
-    {
-      "task_a": 2174,
-      "task_b": 2178,
-      "title_a": "Standing consolidation: 4 rail sections, Achievements folded in, bounties to Economy",
-      "title_b": "Jump palette: Ctrl/Cmd-K + top-bar search slot (client-side)",
-      "overlapping_paths": [
-        "modules/hall-ui/public/shell.js"
-      ],
-      "severity": "low",
-      "has_active_claims": false,
-      "cross_goal": false
-    },
-    {
-      "task_a": 2175,
-      "task_b": 2178,
-      "title_a": "Sidebar IA regroup by audience + Economy in Docs + task page breadcrumb",
-      "title_b": "Jump palette: Ctrl/Cmd-K + top-bar search slot (client-side)",
-      "overlapping_paths": [
-        "modules/hall-ui/public/shell.js",
-        "modules/hall-ui/public/style.css"
-      ],
-      "severity": "low",
-      "has_active_claims": false,
-      "cross_goal": false
-    },
-    {
-      "task_a": 2175,
-      "task_b": 2179,
-      "title_a": "Sidebar IA regroup by audience + Economy in Docs + task page breadcrumb",
-      "title_b": "Hall consistency audit + density polish (final)",
-      "overlapping_paths": [
-        "modules/hall-ui/public/style.css"
-      ],
-      "severity": "low",
-      "has_active_claims": false,
-      "cross_goal": false
-    },
-    {
-      "task_a": 2177,
-      "task_b": 2179,
-      "title_a": "Widget-registry governance: zone budgets, metadata validation, placement doctrine",
-      "title_b": "Hall consistency audit + density polish (final)",
-      "overlapping_paths": [
-        "modules/hall-ui/CLAUDE.md"
-      ],
-      "severity": "low",
-      "has_active_claims": false,
-      "cross_goal": false
-    },
-    {
-      "task_a": 2178,
-      "task_b": 2179,
-      "title_a": "Jump palette: Ctrl/Cmd-K + top-bar search slot (client-side)",
-      "title_b": "Hall consistency audit + density polish (final)",
-      "overlapping_paths": [
-        "modules/hall-ui/public/style.css"
-      ],
-      "severity": "low",
-      "has_active_claims": false,
-      "cross_goal": false
-    }
-  ],
-  "cross_goals_considered": []
-}

package/scripts/hall-preview/fixtures/goals__detail.json

@@ -1,96 +0,0 @@
-{
-  "goal": {
-    "id": "25",
-    "version_id": "BONGOS-V1",
-    "title": "Builder experience — hall, dev box, and skills",
-    "description": "GDS-V4 carryover (ADR 0103): everything a builder directly touches — the builders hall UI, the dev box + sandbox, and the day-to-day skills — works without needing Claude for routine actions.",
-    "scope_modules": [],
-    "status": "open",
-    "visibility": "public",
-    "created_by": "1",
-    "succeeded_by_goal_id": null,
-    "sort_order": 7,
-    "created_at": "2026-07-02T21:03:02.890Z",
-    "updated_at": "2026-07-05T21:41:32.144Z"
-  },
-  "members": [
-    {
-      "goal_id": "25",
-      "builder_id": "1",
-      "role": "lead",
-      "joined_at": "2026-07-03T02:29:09.054Z",
-      "github_login": "lars589",
-      "display_name": "lars589",
-      "avatar_url": "https://avatars.githubusercontent.com/u/283020391?v=4",
-      "rank": "archon"
-    },
-    {
-      "goal_id": "25",
-      "builder_id": "95",
-      "role": "lead",
-      "joined_at": "2026-07-03T14:54:15.322Z",
-      "github_login": "jaxri",
-      "display_name": "Jackson Rini",
-      "avatar_url": "https://avatars.githubusercontent.com/u/64553469?v=4",
-      "rank": "metic"
-    },
-    {
-      "goal_id": "25",
-      "builder_id": "94",
-      "role": "member",
-      "joined_at": "2026-07-03T19:06:25.045Z",
-      "github_login": "scootermack",
-      "display_name": "scootermack",
-      "avatar_url": "https://avatars.githubusercontent.com/u/295990394?v=4",
-      "rank": "metic"
-    }
-  ],
-  "criteria": [
-    {
-      "id": "138",
-      "version_id": "BONGOS-V1",
-      "criterion_id": "gcarry-bx-hall",
-      "criterion_md": "Core task actions (claim, release, ship-trigger, triage) and a task board work in the builders hall WITHOUT invoking the LLM.",
-      "satisfied": false,
-      "sort_order": 10,
-      "goal_id": "25"
-    },
-    {
-      "id": "139",
-      "version_id": "BONGOS-V1",
-      "criterion_id": "gcarry-bx-identity",
-      "criterion_md": "A builder can view and edit their own profile, see works-completed, and read an efficiency-aware leaderboard.",
-      "satisfied": false,
-      "sort_order": 20,
-      "goal_id": "25"
-    },
-    {
-      "id": "140",
-      "version_id": "BONGOS-V1",
-      "criterion_id": "gcarry-bx-onramp",
-      "criterion_md": "Newcomers never dead-end: auth/re-auth is browser-clickable and self-explanatory, and the dev box + sandbox are discoverable.",
-      "satisfied": false,
-      "sort_order": 30,
-      "goal_id": "25"
-    },
-    {
-      "id": "141",
-      "version_id": "BONGOS-V1",
-      "criterion_id": "gcarry-bx-box",
-      "criterion_md": "A builder dev box + sandbox is robust: uncommitted work is not lost on reclaim, host-keys survive rebuilds, and staging is cross-platform.",
-      "satisfied": false,
-      "sort_order": 40,
-      "goal_id": "25"
-    },
-    {
-      "id": "172",
-      "version_id": "BONGOS-V1",
-      "criterion_id": "accessibility-fluency-profile",
-      "criterion_md": "**The build experience is accessible to every builder type — by default, and measured — not just tuned for engineers.** A non-technical owner-builder and an expert engineer can issue the same prompt and each gets an experience pitched to them, without having to know to ask; accessibility is a default the system owns and measures, and an expert's terse experience is never degraded to help a newcomer. **Done when:** a portable per-builder communication/fluency profile lives in the core (a reserved `behavior_prefs` key, server-resolved and injected each session like the wandering knob, accessible-leaning default, no rank cap); CLAUDE.md §2 'The Prompter' is refactored to express itself through that core knob so the behavior ships to any scaffolded instance; the methodology core carries a plain-language posture (product/cost framing before pattern taxonomy, jargon defined on first use, UI click-path before terminal command) injected via the Conductor hook and scaled by the profile; the session evaluator (grader or BFG 6D) gains an accessibility dimension scored from the transcript (unexplained-jargon density, terminal-where-a-UI-exists, outcome-vs-implementation), tracked per-builder and surfaced on the dashboard; a small replayable 'same prompts, two experiences' regression is graded against a floor; widget richness is profile-aware not binary; and the system biases toward the supported path over a bespoke technical fix. Proof: replay a fixed beginner-prompt set under a non-technical vs engineer profile and show the accessibility score clears the floor for the former without regressing terseness for the latter. (Carried from GDS-V4 C10 / proposal-337 on 2026-07-04; foundation shipped as the wandering (task 1268) + widget (task 1279) behavior_prefs knobs; primary implementation task is 2010 / BV1.R130.)",
-      "satisfied": false,
-      "sort_order": 51,
-      "goal_id": "25"
-    }
-  ],
-  "dependencies": []
-}

package/scripts/hall-preview/fixtures/goals__inbox.json

@@ -1,5 +0,0 @@
-{
-  "invitations": [],
-  "joinRequests": [],
-  "myPendingRequests": []
-}

package/scripts/hall-preview/fixtures/goals__requests.json

@@ -1,3 +0,0 @@
-{
-  "requests": []
-}

package/scripts/hall-preview/fixtures/grades__by-builder.json

@@ -1,32 +0,0 @@
-{
-  "window_days": 30,
-  "builders": [
-    {
-      "builder_id": "90",
-      "display_name": "Preview Alpha",
-      "github_login": "preview-alpha",
-      "n": 14,
-      "avg_score": "8.6",
-      "pass_rate": 0.93,
-      "last_graded_at": "2026-07-10T11:00:00.000Z"
-    },
-    {
-      "builder_id": "91",
-      "display_name": "Preview Beta",
-      "github_login": "preview-beta",
-      "n": 9,
-      "avg_score": "7.9",
-      "pass_rate": 0.78,
-      "last_graded_at": "2026-07-09T16:20:00.000Z"
-    },
-    {
-      "builder_id": "92",
-      "display_name": "Preview Gamma",
-      "github_login": "preview-gamma",
-      "n": 4,
-      "avg_score": "9.1",
-      "pass_rate": 1.0,
-      "last_graded_at": "2026-07-08T08:05:00.000Z"
-    }
-  ]
-}