@bongos/core 1.18.3 → 1.18.19

package/modules/hall-ui/public/dom-utils.js

@@ -145,11 +145,38 @@
   //          to it by id exactly as before.
   // Empty until something registers → builders.js renders the hall it does today
   // once it registers the core widgets unconditionally.
+  //
+  // task 2177 — placement governance. The rules and their rationale live in
+  // ../CLAUDE.md §Placement, which every reject message below links to; these
+  // vocabularies are the browser twin of builders.js VIEW_CONTAINERS/ZONE_BUDGETS.
+  // Violations console.error + return null rather than throw, so one bad
+  // third-party widget can't blank the hall (the structural id/label/mount
+  // contract below still throws — that one is first-party programmer error).
+  const HALL_ZONES = ['home-banner', 'home-stats', 'home-band', 'home-main'];
+  const HALL_VIEWS = ['home', 'standing', 'leaderboard'];
+
   const _hallWidgets = [];
   function contributeHallWidget(widget) {
     if (!widget || typeof widget.mount !== 'function' || !widget.id || !widget.label) {
       throw new Error('contributeHallWidget({ id, label, order?, rank?, module?, mount }) requires id + label + mount()');
     }
+    const reject = (why) => {
+      console.error(`[hall] widget "${widget.id}" rejected: ${why} See modules/hall-ui/CLAUDE.md §Placement.`);
+      return null;
+    };
+    if (widget.view && !HALL_VIEWS.includes(widget.view)) {
+      return reject(`unknown view "${widget.view}" — expected one of ${HALL_VIEWS.join(', ')}.`);
+    }
+    if (widget.zone && !HALL_ZONES.includes(widget.zone)) {
+      return reject(`unknown zone "${widget.zone}" — expected one of ${HALL_ZONES.join(', ')}.`);
+    }
+    const view = widget.view || 'home';
+    if (view === 'home' && !widget.zone) {
+      return reject(`Home widgets must declare a zone (${HALL_ZONES.join(', ')}); there is no default.`);
+    }
+    if (widget.zone === 'home-main' && !widget.core && !widget.summary && !widget.collapsedByDefault) {
+      return reject('a non-core home-main widget must declare summary:true (row-capped, no pager/filter) or collapsedByDefault:true.');
+    }
     if (widget.module && !moduleOn(widget.module)) return null; // off module → not registered
     _hallWidgets.push(widget);
     return widget;

package/modules/hall-ui/public/drachmae.html

@@ -61,6 +61,8 @@
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
 <script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
+<script src="/builders/palette.js" defer></script>
 <script src="/builders/md-reader.js?v=2026-07-05-mdreader-1"></script>
 <script src="/builders/drachmae.js?v=2026-07-05-drachmae-1" defer></script>
 <script src="/builders/copy-on-click.js?v=2026-06-01-copy-1" defer></script>

package/modules/hall-ui/public/drachmae.js

@@ -5,6 +5,14 @@
 // so builders can read exactly how they get paid without leaving the hall for
 // GitHub. Reuses the primer's layout/TOC/progress DOM + primer.css; no ack gate
 // (this is reference reading, not an onboarding checkpoint).
+//
+// task 2174: the red-team bounty rate card moved here off Standing. It is a
+// published reward SCHEDULE — reference material that reads the same for every
+// builder — so it belongs with the rest of the reward model, not in a personal
+// standing view. The doc's §"Red-team / security bounty" describes it in prose;
+// the LIVE numbers come from /public/bounty-table and are appended as a real
+// section (h2 + table) so the TOC, scrollspy and progress bar pick it up like
+// any other section of the article.
 
 (() => {
   'use strict';
@@ -12,6 +20,9 @@
   const DOC_URL = '/builders/drachmae-and-karma.md';
   // The doc lives at docs/onboarding/, so relative links resolve against it.
   const DOC_DIR = 'docs/onboarding/';
+  const BOUNTY_URL = '/api/gds/public/bounty-table';
+  const BOUNTY_SECTION_ID = 'security-bounty-rates';
+  const BOUNTY_SECTION_TITLE = 'Security bounty rates';
 
   let repoBlobBase = null;
   let repoTreeBase = null;
@@ -28,6 +39,45 @@
     } catch (_) { /* links degrade to the original href */ }
   }
 
+  // Append the live bounty rate card to the article and return its TOC heading,
+  // or null when the schedule can't be read (the prose section stays; we just
+  // don't show an empty table or a TOC entry that leads nowhere).
+  async function appendBountySection(article) {
+    let payload;
+    try {
+      const r = await fetch(BOUNTY_URL, { credentials: 'same-origin' });
+      if (!r.ok) throw new Error(`${BOUNTY_URL} → ${r.status}`);
+      payload = await r.json();
+    } catch (err) {
+      console.warn('[drachmae] bounty schedule unavailable:', err.message);
+      return null;
+    }
+    const rows = Array.isArray(payload && payload.table) ? payload.table : [];
+    if (!rows.length) return null;
+
+    const esc = window.OTBMdReader.escapeHtml;
+    const currency = payload.currency || 'credits';
+    const section = document.createElement('section');
+    section.innerHTML =
+      `<h2 id="${esc(BOUNTY_SECTION_ID)}">${esc(BOUNTY_SECTION_TITLE)}</h2>` +
+      `<p>Find a flaw in the system’s own walls and report it — rewards are paid in ` +
+      `${esc(currency)} by severity. These are the live numbers, read from the server ` +
+      `just now, so a tuned rate shows up here immediately.</p>` +
+      '<table><thead><tr><th>Severity</th>' +
+      `<th>${esc(currency.charAt(0).toUpperCase() + currency.slice(1))}</th>` +
+      '<th>What counts</th></tr></thead><tbody>' +
+      rows.map((r) => {
+        // `overridden` means this instance tuned the tier off its default.
+        const tuned = r.overridden ? ' <em>(tuned)</em>' : '';
+        return `<tr><td><strong>${esc(r.severity || '')}</strong></td>` +
+          `<td>${esc(String(r.drachmae ?? ''))}${tuned}</td>` +
+          `<td>${esc(r.blurb || '')}</td></tr>`;
+      }).join('') +
+      '</tbody></table>';
+    article.appendChild(section);
+    return { level: 2, id: BOUNTY_SECTION_ID, text: BOUNTY_SECTION_TITLE };
+  }
+
   function renderToc(headings) {
     const list = $('#primer-toc-list');
     if (!list) return [];
@@ -122,7 +172,10 @@
     const { html, headings } = window.OTBMdReader.parseMarkdown(md, resolveLinkHref);
     article.innerHTML = html;
     article.removeAttribute('aria-busy');
-    const tocSections = renderToc(headings);
+    // Awaited before the TOC is built so the rate card gets a TOC entry and a
+    // scrollspy target; the article itself is already on screen by now.
+    const bountyHeading = await appendBountySection(article);
+    const tocSections = renderToc(bountyHeading ? [...headings, bountyHeading] : headings);
     setupTocToggle();
     setupScrollspy(tocSections);
     setupProgressBar(article);

package/modules/hall-ui/public/gate.css

@@ -0,0 +1,98 @@
+/* gate.css — Page-local styles for the Gate page (Archon-only).
+   Lifted verbatim out of the page's inline <style> block (task 1002176);
+   the ?v= cache-bust is stamped automatically from this file's content hash
+   at boot (src/asset-version.js). */
+
+/* Page-local styles for the Gate — approvals for held pull requests. Built
+   on the shared design tokens (style.css): each held PR is a card with a
+   verdict-colored top band and per-file reasons for the hold. */
+.gate-summary {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(150px, 1fr));
+  gap: 14px;
+  margin: 6px 0 22px;
+}
+.gate-stat {
+  border: 1px solid var(--border); border-radius: var(--radius-sm);
+  background: var(--surface); padding: 12px 14px;
+}
+.gate-stat__label {
+  font-size: 11.5px; font-weight: 600;
+  letter-spacing: 0.04em; text-transform: uppercase; color: var(--ink-soft);
+}
+.gate-stat__value {
+  font-size: 1.6rem; font-weight: 600; color: var(--ink);
+  font-variant-numeric: tabular-nums; margin-top: 2px;
+}
+
+.gate-list { display: flex; flex-direction: column; gap: 16px; }
+
+.gate-crate {
+  border: 1px solid var(--border); border-radius: var(--radius);
+  background: var(--surface); overflow: hidden;
+}
+/* Verdict band along the top, painted by the held-verdict. */
+.gate-crate__seal { height: 4px; background-color: var(--danger); }
+.gate-crate--needs_trust .gate-crate__seal { background-color: var(--warn); }
+.gate-crate__body { padding: 14px 16px 16px; display: flex; flex-direction: column; gap: 10px; }
+.gate-crate__head { display: flex; align-items: baseline; justify-content: space-between; gap: 10px; flex-wrap: wrap; }
+.gate-crate__title { font-weight: 600; color: var(--ink); font-size: 15px; }
+.gate-crate__title a { color: inherit; text-decoration: none; }
+.gate-crate__title a:hover { text-decoration: underline; }
+.gate-crate__meta { color: var(--ink-soft); font-size: 12.5px; }
+.gate-crate__meta a { color: var(--accent-text); }
+
+.gate-pill {
+  font-size: 11px; font-weight: 600;
+  letter-spacing: 0.04em; text-transform: uppercase;
+  padding: 2px 8px; border-radius: 999px; white-space: nowrap;
+  border: 1px solid var(--border); color: var(--ink-soft); background: var(--surface-2);
+}
+.gate-pill--escalate { background: var(--danger-weak); border-color: color-mix(in srgb, var(--danger) 30%, transparent); color: var(--danger); }
+.gate-pill--needs_trust { background: var(--warn-weak); border-color: color-mix(in srgb, var(--warn) 30%, transparent); color: var(--warn); }
+.gate-pill--trusted { background: var(--info-weak); border-color: color-mix(in srgb, var(--info) 30%, transparent); color: var(--info); }
+
+.gate-reasons { list-style: none; padding: 0; margin: 0; }
+.gate-reasons li {
+  padding: 6px 0; border-bottom: 1px solid var(--border);
+  font-size: 13px; color: var(--ink);
+}
+.gate-reasons li:last-child { border-bottom: 0; }
+.gate-reasons code {
+  font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 12px;
+  color: var(--accent-text); background: var(--surface-2);
+  padding: 1px 5px; border-radius: 4px;
+}
+.gate-reasons .floor { color: var(--danger); font-weight: 600; }
+
+.gate-files { font-size: 12.5px; color: var(--ink-soft); }
+.gate-files code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
+
+.gate-actions { display: flex; gap: 10px; flex-wrap: wrap; align-items: center; margin-top: 2px; }
+.gate-btn {
+  font: inherit; font-size: 13px; font-weight: 600;
+  padding: 7px 16px; border: 1px solid var(--accent);
+  background: var(--accent); color: #fff;
+  border-radius: var(--radius-sm); cursor: pointer;
+}
+.gate-btn:hover:not(:disabled) { background: var(--accent-deep); border-color: var(--accent-deep); }
+.gate-btn:disabled { opacity: 0.45; cursor: default; }
+.gate-btn--ghost { background: var(--surface); color: var(--ink); border-color: var(--border-strong); }
+.gate-btn--ghost:hover:not(:disabled) { background: var(--surface-2); border-color: var(--border-strong); }
+.gate-approved-note { color: var(--ok); font-size: 13px; }
+
+.gate-empty, .gate-sealed { color: var(--ink-soft); padding: 16px 0; }
+.gate-checking { color: var(--ink-faint); font-size: 12.5px; margin-top: 10px; }
+
+/* Lightweight confirm modal (mirrors harbor). */
+.gate-modal-bg {
+  position: fixed; inset: 0; background: color-mix(in srgb, var(--ink) 40%, transparent);
+  display: flex; align-items: center; justify-content: center; z-index: 50; padding: 20px;
+}
+.gate-modal {
+  background: var(--surface); border: 1px solid var(--border-strong); border-radius: var(--radius);
+  max-width: 480px; width: 100%; padding: 20px 22px; box-shadow: var(--shadow-pop);
+}
+.gate-modal h2 { color: var(--ink); margin: 0 0 8px; font-size: 17px; font-weight: 600; }
+.gate-modal p { color: var(--ink); font-size: 13.5px; margin: 0 0 12px; }
+.gate-modal__actions { display: flex; gap: 10px; justify-content: flex-end; margin-top: 18px; }

package/modules/hall-ui/public/gate.html

@@ -10,101 +10,7 @@
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet">
   <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
-  <style>
-    /* Page-local styles for the Gate — approvals for held pull requests. Built
-       on the shared design tokens (style.css): each held PR is a card with a
-       verdict-colored top band and per-file reasons for the hold. */
-    .gate-summary {
-      display: grid;
-      grid-template-columns: repeat(auto-fit, minmax(150px, 1fr));
-      gap: 14px;
-      margin: 6px 0 22px;
-    }
-    .gate-stat {
-      border: 1px solid var(--border); border-radius: var(--radius-sm);
-      background: var(--surface); padding: 12px 14px;
-    }
-    .gate-stat__label {
-      font-size: 11.5px; font-weight: 600;
-      letter-spacing: 0.04em; text-transform: uppercase; color: var(--ink-soft);
-    }
-    .gate-stat__value {
-      font-size: 1.6rem; font-weight: 600; color: var(--ink);
-      font-variant-numeric: tabular-nums; margin-top: 2px;
-    }
-
-    .gate-list { display: flex; flex-direction: column; gap: 16px; }
-
-    .gate-crate {
-      border: 1px solid var(--border); border-radius: var(--radius);
-      background: var(--surface); overflow: hidden;
-    }
-    /* Verdict band along the top, painted by the held-verdict. */
-    .gate-crate__seal { height: 4px; background-color: var(--danger); }
-    .gate-crate--needs_trust .gate-crate__seal { background-color: var(--warn); }
-    .gate-crate__body { padding: 14px 16px 16px; display: flex; flex-direction: column; gap: 10px; }
-    .gate-crate__head { display: flex; align-items: baseline; justify-content: space-between; gap: 10px; flex-wrap: wrap; }
-    .gate-crate__title { font-weight: 600; color: var(--ink); font-size: 15px; }
-    .gate-crate__title a { color: inherit; text-decoration: none; }
-    .gate-crate__title a:hover { text-decoration: underline; }
-    .gate-crate__meta { color: var(--ink-soft); font-size: 12.5px; }
-    .gate-crate__meta a { color: var(--accent-text); }
-
-    .gate-pill {
-      font-size: 11px; font-weight: 600;
-      letter-spacing: 0.04em; text-transform: uppercase;
-      padding: 2px 8px; border-radius: 999px; white-space: nowrap;
-      border: 1px solid var(--border); color: var(--ink-soft); background: var(--surface-2);
-    }
-    .gate-pill--escalate { background: var(--danger-weak); border-color: color-mix(in srgb, var(--danger) 30%, transparent); color: var(--danger); }
-    .gate-pill--needs_trust { background: var(--warn-weak); border-color: color-mix(in srgb, var(--warn) 30%, transparent); color: var(--warn); }
-    .gate-pill--trusted { background: var(--info-weak); border-color: color-mix(in srgb, var(--info) 30%, transparent); color: var(--info); }
-
-    .gate-reasons { list-style: none; padding: 0; margin: 0; }
-    .gate-reasons li {
-      padding: 6px 0; border-bottom: 1px solid var(--border);
-      font-size: 13px; color: var(--ink);
-    }
-    .gate-reasons li:last-child { border-bottom: 0; }
-    .gate-reasons code {
-      font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 12px;
-      color: var(--accent-text); background: var(--surface-2);
-      padding: 1px 5px; border-radius: 4px;
-    }
-    .gate-reasons .floor { color: var(--danger); font-weight: 600; }
-
-    .gate-files { font-size: 12.5px; color: var(--ink-soft); }
-    .gate-files code { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
-
-    .gate-actions { display: flex; gap: 10px; flex-wrap: wrap; align-items: center; margin-top: 2px; }
-    .gate-btn {
-      font: inherit; font-size: 13px; font-weight: 600;
-      padding: 7px 16px; border: 1px solid var(--accent);
-      background: var(--accent); color: #fff;
-      border-radius: var(--radius-sm); cursor: pointer;
-    }
-    .gate-btn:hover:not(:disabled) { background: var(--accent-deep); border-color: var(--accent-deep); }
-    .gate-btn:disabled { opacity: 0.45; cursor: default; }
-    .gate-btn--ghost { background: var(--surface); color: var(--ink); border-color: var(--border-strong); }
-    .gate-btn--ghost:hover:not(:disabled) { background: var(--surface-2); border-color: var(--border-strong); }
-    .gate-approved-note { color: var(--ok); font-size: 13px; }
-
-    .gate-empty, .gate-sealed { color: var(--ink-soft); padding: 16px 0; }
-    .gate-checking { color: var(--ink-faint); font-size: 12.5px; margin-top: 10px; }
-
-    /* Lightweight confirm modal (mirrors harbor). */
-    .gate-modal-bg {
-      position: fixed; inset: 0; background: color-mix(in srgb, var(--ink) 40%, transparent);
-      display: flex; align-items: center; justify-content: center; z-index: 50; padding: 20px;
-    }
-    .gate-modal {
-      background: var(--surface); border: 1px solid var(--border-strong); border-radius: var(--radius);
-      max-width: 480px; width: 100%; padding: 20px 22px; box-shadow: var(--shadow-pop);
-    }
-    .gate-modal h2 { color: var(--ink); margin: 0 0 8px; font-size: 17px; font-weight: 600; }
-    .gate-modal p { color: var(--ink); font-size: 13.5px; margin: 0 0 12px; }
-    .gate-modal__actions { display: flex; gap: 10px; justify-content: flex-end; margin-top: 18px; }
-  </style>
+  <link rel="stylesheet" href="/builders/gate.css">
 </head>
 <body data-page="gate" data-page-title="Gate">
 
@@ -137,6 +43,8 @@
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
 <script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
+<script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/gate.js?v=2026-07-03-gate-shell"></script>
 </body>

package/modules/hall-ui/public/goal-inbox.js

@@ -225,8 +225,11 @@
 
   // order 20 → the top of the Home main zone: personal + actionable beats
   // informational. hiddenByDefault so a quiet inbox costs nothing.
+  // core: true (task 2177) — this is the hall's own Needs-attention inbox, the
+  // designated landing place for anything awaiting the builder, so it is exempt
+  // from the summary/collapsed rule that keeps OTHER cards off home-main.
   window.OTB.contributeHallWidget({
-    id: 'attention-scroll', label: 'Needs your attention', order: 20, mount,
+    id: 'attention-scroll', label: 'Needs your attention', order: 20, mount, core: true,
     labelledby: 'attention-h', view: 'home', zone: 'home-main', hiddenByDefault: true,
   });
 })();