@bongos/core 1.19.1038 → 1.19.1040

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1038",
-  "core_contract": "1.19.1038",
-  "source_commit": "da6abbe0d3be205fbf1468053e22d062f0f88c53",
+  "core_version": "1.19.1040",
+  "core_contract": "1.19.1040",
+  "source_commit": "a256763721159dea620730a17c310ed3822eeacc",
   "source_ref": "HEAD",
-  "built_at": "2026-09-26T08:02:16.753Z",
+  "built_at": "2026-09-26T15:14:19.754Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 542,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2493,
+    "functional_verbatim": 2505,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3062,
-  "tree_sha256": "809d2cff15d7aea1e31dcb2a5d161eae233d7b7b4edaae142688cd13b33ef9a4",
+  "file_count": 3074,
+  "tree_sha256": "4e0126a091e5b21480bcca26c7d5619daa813b1aa63a1d2e3cf82012025e18ef",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -352,12 +352,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "e5aa86f924b3c8f3b216daa93f707a583a74e82ad3cb6162288ec987ac70bc24"
+      "sha256": "313943caf3bc117539688dafeecb7a3bc1746c3038d68e471e652e303bad53d7"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "bafe28d4273b7c1959fe9737bdd17a02cea669fea51495393863570030b605f9"
+      "sha256": "b8972ecc571abd7e67151dceaea762241533a96e2281c1bd42562416b370a649"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -367,17 +367,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "2a53db773795e45a22fad49b6483613219ca7a6d230965ae8974ece117b7ea78"
+      "sha256": "77be4a5c54473480d9d207196f89563cf2919b9e9b05abb5769e2b5d98f1fd43"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "9f07e5e4cc88e90ec9f7ced7c258890724f9457bb3412eccad177c14805c29dd"
+      "sha256": "bf10bd20b8e9c2f9d2413cffb5f7e94b9bab9086856e019305e2a1cae62a1963"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "4eb0b66ce4a75e30a6013a2f03fcc65775d2fa6e0b9caed2d630f1b89418f0da"
+      "sha256": "4b3bcb695919ecd21808b8b106bcceda7beab220212680f4c08ec89d493b3d27"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2202,12 +2202,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "39a0682dabb9b1d64c1b8641963e04e1a22ead6bdb29a51ed4d516609f287e4d"
+      "sha256": "7a11df448a86acf04143ae17c6a741119b51f2f62278fe7eae195dd2a09fb846"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "9ba85d53f945f62060b03de6a7638d025edd5c3a83942404876fb618c96f36da"
+      "sha256": "f152200f08b6783021523222a58efcaf32a927cefca1e8a71cc32684d88c0bda"
     },
     {
       "path": "docs/architecture.md",
@@ -2232,12 +2232,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "9256c15d5c0e1227d33babd5b036e3d15af58d52a4a7204eb016a9f435e4de0b"
+      "sha256": "6f6e42a31cc92468b5a97dcae218c38e3e9df372a20151ffebd73216c91a6b63"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "5bbc6bda98aead6a950661199dd0547b06e6b6d8555a4576339a9795dad9ac61"
+      "sha256": "db41770b13c6825c74fe130cfd3de8c96eaf73596c2b26a31470d8e3c6b7e47c"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2757,7 +2757,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "f2d5d90c71f92f4f20e78375fd75b8df59c084a795ff6c1e9a5aea5c385b160d"
+      "sha256": "530aabbf1f0d3f5ba938dbfa5d6df1755c288d15fe5eb076b6c94fd89098a1d2"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2767,7 +2767,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f4e772d2b38f923f36c45a1e2fc9254a2843370b4703d291ab82b0e5b126e998"
+      "sha256": "8d485d36bc3666b90612951d770aafd501c99685b47037fe1266067e2e25ee6e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2887,7 +2887,7 @@
     {
       "path": "docs/recipes/core-release-pipeline.md",
       "mode": "0000644",
-      "sha256": "12e2fdc72d1bed7d524b50960dea3a67791b098b7dbafaff9c6f95cd356b185a"
+      "sha256": "4f006e07e58a861399d8d04ab0b52a1752f4ff605475288d60b60bffb7e123e7"
     },
     {
       "path": "docs/recipes/failed-ship-recovery-proof.md",
@@ -2967,7 +2967,7 @@
     {
       "path": "docs/recipes/private-npm-distribution.md",
       "mode": "0000644",
-      "sha256": "5e4213d19d7f13ff0a378f996c7e909e00cf262516e72f96e44d4ddf0d4cc861"
+      "sha256": "0125fca7ef4c910f87a03e20ccfb06ae8a81cf5ebc8f9821e4bc3e8a8d0a7ea1"
     },
     {
       "path": "docs/recipes/redteam-patrol.md",
@@ -4932,12 +4932,17 @@
     {
       "path": "modules/hall-ui/public/deploy.html",
       "mode": "0000644",
-      "sha256": "77173078fe8aa93fa9bf9ad98ca7bc1c5698999c2f837b0ae9d0c38be12fd2b2"
+      "sha256": "1b4e38bbd7abc278fe9578c96095d67d1ff46916b30387a315a46ab2167b613a"
     },
     {
       "path": "modules/hall-ui/public/deploy.js",
       "mode": "0000644",
-      "sha256": "a6fd24a634a64deb3515993609457313a176e42e66214d6a32f70c28b53e3cdc"
+      "sha256": "bf526004ab0a5bab8005a6e9854d9bcbec28661285d39c95641bc9682688c96b"
+    },
+    {
+      "path": "modules/hall-ui/public/deploy.states.json",
+      "mode": "0000644",
+      "sha256": "b8818dd51e671769cb84a85d288674571f278a6b6736353288d206156f4fd4c3"
     },
     {
       "path": "modules/hall-ui/public/diagram-viewer.css",
@@ -5922,7 +5927,7 @@
     {
       "path": "modules/lifecycle/conflict-resolve.js",
       "mode": "0000644",
-      "sha256": "107dec0deb790b7439da27761235631ab79a29a6cfcea58db9a57460e04df1bd"
+      "sha256": "81d5ad21661d08403cb008c6ae8b92cd5e142b552a00f6a5a39423cf7eb3042e"
     },
     {
       "path": "modules/lifecycle/criterion-ref.js",
@@ -6469,6 +6474,36 @@
       "mode": "0000644",
       "sha256": "43ede2e90d0124c42f6f9dfc3695898b83c8e876c01f70b0ae6e9d2f61d41085"
     },
+    {
+      "path": "modules/npm-release/module.json",
+      "mode": "0000644",
+      "sha256": "aa8289ee59e7d526263aed9500a54a9f8abbdc57220059a710170578c89d3704"
+    },
+    {
+      "path": "modules/npm-release/public/work.css",
+      "mode": "0000644",
+      "sha256": "d0625e8cd454c7f58f86048bf243232ee368f6b667969b366fbb8e59d9a06c9c"
+    },
+    {
+      "path": "modules/npm-release/public/work.js",
+      "mode": "0000644",
+      "sha256": "f71f7c17e834fc7b38874370519bd358ba4b38ace480a4e7ef752b6862795fb6"
+    },
+    {
+      "path": "modules/npm-release/registry.js",
+      "mode": "0000644",
+      "sha256": "246b9dfd4e6db04573747e2fa6f75a3f101250d002702e3007a20aa81c240f37"
+    },
+    {
+      "path": "modules/npm-release/routes/work.js",
+      "mode": "0000644",
+      "sha256": "ed549b53d9954f198b265c88ac1978dd4da0bf30a4ebb060f720eceb3d4e6394"
+    },
+    {
+      "path": "modules/npm-release/work.js",
+      "mode": "0000644",
+      "sha256": "04297befb32b79a5ae88e1d44a8cc903b355bbcd6fe7935d64c2b560c10f15d2"
+    },
     {
       "path": "modules/onboarding/CLAUDE.md",
       "mode": "0000644",
@@ -7162,7 +7197,7 @@
     {
       "path": "modules/provisioning/starter-bundles.js",
       "mode": "0000644",
-      "sha256": "afb39d1642004ff98d3b722436e789542b87f0b4929f7d85826e8e07ebbd2570"
+      "sha256": "cca574f26ccc944f6e95a9644415d4d89c7239499bf6f79bae36869b69b6f992"
     },
     {
       "path": "modules/provisioning/tests/liveness-notify.mjs",
@@ -8452,12 +8487,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b884a2821059a8a69b9757b7eb9cb8432983a1563b5a5461044aed5129119a69"
+      "sha256": "d83c4076ed5e94de9befd99c7ff4800562337eb0f3d9fc9f0c62d1ae3b3e6dad"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "735b76d59c3bbe7444b3354e6bba1a1e72bcf639236fb4dd7925561290c71e96"
+      "sha256": "4425872eb0b34a10053885be882b6f7e44a332c7c01c18f1d3c9d919b0303f5c"
     },
     {
       "path": "public-docs/index.html",
@@ -8477,7 +8512,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "bd9f61be14683fe846ffb42627b8cd3b24e1a4a732c793248d4eb4d845dae5cd"
+      "sha256": "2d5fb0f342a3fa42c5edad00a107bf216de3983d04d0e7a458d43176fcaca9f8"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -8982,7 +9017,7 @@
     {
       "path": "scripts/gds/exec-path-guard.js",
       "mode": "0000644",
-      "sha256": "176e26885f96247bbeec1b04d3a668bbc2fac2d944fc1f1028781241a45d613c"
+      "sha256": "254c0ff06409c015e2a821ddc59a2e9ad438a4107c2dca8cff2403e99b8417bc"
     },
     {
       "path": "scripts/gds/feedback-latest.js",
@@ -9207,7 +9242,7 @@
     {
       "path": "scripts/gds/install-git-hooks.js",
       "mode": "0000644",
-      "sha256": "6234ca799f99e5a16622043b0f43d42624efe5fb6862d74e4b8c2b7603cf8bef"
+      "sha256": "67ee7468f68a48794ab1eac0cfe336996aa6d31d82ba0663883805004536a7fb"
     },
     {
       "path": "scripts/gds/instance-apex.js",
@@ -9382,7 +9417,7 @@
     {
       "path": "scripts/gds/plain-cards.js",
       "mode": "0000644",
-      "sha256": "59735337e798c66feedeabfde750a9639a0def9c64ded40faa4c8b35b40adc5f"
+      "sha256": "b253a6c0e34cac3d18fb031b9a445d4db0589484da016309ecd7481a1ec1f311"
     },
     {
       "path": "scripts/gds/portability-smoke-art.sh",
@@ -9479,10 +9514,15 @@
       "mode": "0000644",
       "sha256": "3fbf7c20f83e3de8b47f834414c2bec9ba35f528cfb93995db73d627c8d46e73"
     },
+    {
+      "path": "scripts/gds/publish-integration-gate.js",
+      "mode": "0000644",
+      "sha256": "f797bfe1b72d0bb50587093ab93f32fd86b916f644dbf782cedf0b0e177b2b25"
+    },
     {
       "path": "scripts/gds/publish-manifest.js",
       "mode": "0000644",
-      "sha256": "da74b7bf9aa1453eb56f922f3733aa06ac2d00216f668a06dc134934f1d4fde7"
+      "sha256": "dc5845faf4042a4272b2fbc72d8d62bb6f95b9f860d9501d3f5e710e47e910e3"
     },
     {
       "path": "scripts/gds/publish-watch.js",
@@ -9872,7 +9912,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "92fcb61d2f0a1ee08912972fa153295e15684535d34e115574ff58e72d0d3615"
+      "sha256": "699e58b44e1be60c9e17acf108f7cd895a75d43a2854dac494583df35f522dbc"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -10337,7 +10377,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "6a0ba1ebba51ecbce958e2b2d97d244f589108592647be0261ae556aee078680"
+      "sha256": "a5510df1cd4704db5d7c0a3c381ecdf591c9fa7b6ed6bd4fddcfd002611e288c"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -10532,7 +10572,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b1619ae083207e98797c5198861f067a405ee89c80ccc5a0b83d1fc1d381a465"
+      "sha256": "fea845918024c63fe58a76857f8cc0ab2dadb385e6258d6298f8c5dbead05a0a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11437,7 +11477,7 @@
     {
       "path": "tests/conflict_resolve.mjs",
       "mode": "0000644",
-      "sha256": "da8182c4235c7735bdee351cfa7dc1146f7ded33b9d594dc0ba498a3b5206d83"
+      "sha256": "9714c6bc9e363f847469a93e42958dae25f3abc9266c7adf937cde0aa2439f9c"
     },
     {
       "path": "tests/connection_suggestions.mjs",
@@ -13267,7 +13307,7 @@
     {
       "path": "tests/merge_driver_register.mjs",
       "mode": "0000644",
-      "sha256": "c75880064b52b6edb2689232eb1e6401567618f46b16581140685ccceee2d41c"
+      "sha256": "cb17d06221d770ba7dca2eba4616ce67c14dba2152c4c37c9bed08d2931297d3"
     },
     {
       "path": "tests/merge_lease.mjs",
@@ -13387,7 +13427,7 @@
     {
       "path": "tests/module_loader.mjs",
       "mode": "0000644",
-      "sha256": "c76510c090ff1162ed88bc753c2ae90842e48f234e050036e6c558a7d8681c2e"
+      "sha256": "41fac167f1c2e1377e692193f752c370081cedc5e3497b228a6f5e4117139ac1"
     },
     {
       "path": "tests/module_manifest.mjs",
@@ -13474,6 +13514,16 @@
       "mode": "0000644",
       "sha256": "f1523ee48247d18c7326b9aa0b442ca2c9fab8bd41dbe9f23a4cb89e1986bee0"
     },
+    {
+      "path": "tests/npm_release_page.mjs",
+      "mode": "0000644",
+      "sha256": "ea16fe71cc4a97555334ca939b29d3227ee067fdea4dd50adaa072f6ebcd08b7"
+    },
+    {
+      "path": "tests/npm_release_work.mjs",
+      "mode": "0000644",
+      "sha256": "373c47030bd02333008a7fec237ae8eb0bfad48574558b0362632b01d5c466f4"
+    },
     {
       "path": "tests/oauth_secret.mjs",
       "mode": "0000644",
@@ -14064,6 +14114,11 @@
       "mode": "0000644",
       "sha256": "3e3b97d2c7e4e67a412eaa04bbf3d8fd4ad649ae46f9e194c8e07eedfc2349bb"
     },
+    {
+      "path": "tests/publish_integration_gate.mjs",
+      "mode": "0000644",
+      "sha256": "f220032a0e9d58bfc07316f4192744294d2eef023677e602c23fc2c775e87390"
+    },
     {
       "path": "tests/publish_manifest.mjs",
       "mode": "0000644",
@@ -14207,7 +14262,7 @@
     {
       "path": "tests/render_check.mjs",
       "mode": "0000644",
-      "sha256": "88d6f0edf277344787be817885a6c78a811f01a300d94accbe1e16ed8d6230c3"
+      "sha256": "677679afe67e0c4ef56827f7a3c7a37cc63475bf67ee0ba31644dc872baf3d16"
     },
     {
       "path": "tests/render_prefs.mjs",
@@ -14619,6 +14674,11 @@
       "mode": "0000644",
       "sha256": "a3b7858c255f1c7ea692866dbadd7321f77bd88c8380c429b7cb5f6b1b65496b"
     },
+    {
+      "path": "tests/ship_land_ci_not_started.mjs",
+      "mode": "0000644",
+      "sha256": "9d7902dfb2183713a06ecc845c4f466d3dc04fcf7d34a0f79cb2c6b6f89587af"
+    },
     {
       "path": "tests/ship_land_conflict.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 439 operations across 66 resource groups
+- 440 operations across 67 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -744,6 +744,10 @@ function createClient(opts = {}) {
       // POST /my-projects/join — rank: any-builder — POST /my-projects/join
       postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
     },
+    "npmRelease": {
+      // GET /npm-release/work — rank: archon — GET /npm-release/work
+      getNpmReleaseWork: (args) => request("GET", "/npm-release/work", { hasBody: false }, args),
+    },
     "overrideRequests": {
       // GET /override-requests — rank: metic+archon — GET /override-requests
       getOverrideRequests: (args) => request("GET", "/override-requests", { hasBody: false }, args),

package/clients/bongos-client/index.cjs

@@ -743,6 +743,10 @@ function createClient(opts = {}) {
       // POST /my-projects/join — rank: any-builder — POST /my-projects/join
       postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
     },
+    "npmRelease": {
+      // GET /npm-release/work — rank: archon — GET /npm-release/work
+      getNpmReleaseWork: (args) => request("GET", "/npm-release/work", { hasBody: false }, args),
+    },
     "overrideRequests": {
       // GET /override-requests — rank: metic+archon — GET /override-requests
       getOverrideRequests: (args) => request("GET", "/override-requests", { hasBody: false }, args),

package/clients/bongos-client/index.d.ts

@@ -1158,6 +1158,10 @@ export interface BongosClient {
     /** POST /my-projects/join — rank: any-builder */
     postMyProjectsJoin(args: RequestArgs & { body: PostMyProjectsJoinRequest }): Promise<PostMyProjectsJoinResponse>;
   };
+  "npmRelease": {
+    /** GET /npm-release/work — rank: archon */
+    getNpmReleaseWork(args?: RequestArgs): Promise<ApiResponse>;
+  };
   "overrideRequests": {
     /** GET /override-requests — rank: metic+archon */
     getOverrideRequests(args?: RequestArgs): Promise<GetOverrideRequestsResponse>;

package/clients/bongos-client/index.mjs

@@ -740,6 +740,10 @@ export function createClient(opts = {}) {
       // POST /my-projects/join — rank: any-builder — POST /my-projects/join
       postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
     },
+    "npmRelease": {
+      // GET /npm-release/work — rank: archon — GET /npm-release/work
+      getNpmReleaseWork: (args) => request("GET", "/npm-release/work", { hasBody: false }, args),
+    },
     "overrideRequests": {
       // GET /override-requests — rank: metic+archon — GET /override-requests
       getOverrideRequests: (args) => request("GET", "/override-requests", { hasBody: false }, args),

package/docs/api/openapi.json

@@ -205,6 +205,10 @@
       "name": "my-projects",
       "description": "Endpoints under `/api/bongos/my-projects`."
     },
+    {
+      "name": "npm-release",
+      "description": "Endpoints under `/api/bongos/npm-release`."
+    },
     {
       "name": "override-requests",
       "description": "Endpoints under `/api/bongos/override-requests`."
@@ -13314,6 +13318,40 @@
         ]
       }
     },
+    "/npm-release/work": {
+      "get": {
+        "operationId": "get_npm_release_work",
+        "tags": [
+          "npm-release"
+        ],
+        "summary": "GET /npm-release/work",
+        "description": "Query: days (ledger window, default 14, max 60), before + limit (history paging). Read by hand rather than through validateOrRespond: every field is optional and clamped, so there is nothing to refuse.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "x-rank": "archon",
+        "x-source": "modules/npm-release/routes/work.js",
+        "x-permissions": [
+          "core.pin.move"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/override-requests": {
       "get": {
         "operationId": "get_override_requests",
@@ -27900,7 +27938,7 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 439,
+  "x-endpoint-count": 440,
   "x-schema-count": 481,
   "x-undocumented-bodies": 9,
   "x-response-schemas": 329,

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 439 endpoints across 74 route files.
+> **Generated from the live route files** — the route file is authoritative. 440 endpoints across 75 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -521,6 +521,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/my-projects/invites/:clientId/decline` | `any-builder` | — | decline an invite (delete the pending row) for the caller's OWN account. |
 | POST | `/api/bongos/my-projects/join` | `any-builder` | `origin`, `note` | request to join a project. |
 
+## `npm-release` (1)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/npm-release/work` | `archon` | — | Query: days (ledger window, default 14, max 60), before + limit (history paging). |
+
 ## `override-requests` (2)
 
 | Method | Path | Rank | Body | Description |

package/docs/copy-inventory.md

@@ -653,7 +653,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `df335a1224ae` | certain | Member since {…} | `modules/hall-ui/public/hall-render.js:563` |
 | `df335a1224ae` | certain | Member since {…} | `modules/hall-ui/public/profile.js:94` |
 | `c7a670e9552d` | certain | Merged into | `modules/hall-ui/public/profile.js:489` |
-| `f3ba5b1b7849` | certain | Merging work does not put it in front of anyone. This is the step that does: it moves this project onto a newe | `modules/hall-ui/public/deploy.html:42` |
+| `f3ba5b1b7849` | certain | Merging work does not put it in front of anyone. This is the step that does: it moves this project onto a newe | `modules/hall-ui/public/deploy.html:49` |
 | `7637613c231b` | certain | Metic rank and above may vote | `modules/hall-ui/public/builders.js:781` |
 | `91328a97fe68` | certain | Mingle pairs you with someone from another role. Saying no costs nothing. | `modules/hall-ui/public/collab.html:96` |
 | `d7ce4a3bb745` | certain | Minimize the welcome panel | `modules/hall-ui/public/hall-widgets.js:52` |
@@ -1208,7 +1208,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `5a58392783fd` | certain | What this brings in | `modules/hall-ui/public/deploy.js:384` |
 | `a444ad812e4f` | certain | What this builder has done, seen one role at a time. | `modules/hall-ui/public/profile.html:134` |
 | `32d675a2b022` | certain | What this rank is for (optional) | `modules/hall-ui/public/government.html:90` |
-| `04b3ff4c4f4c` | certain | What users can see | `modules/hall-ui/public/deploy.html:35` |
+| `04b3ff4c4f4c` | certain | What users can see | `modules/hall-ui/public/deploy.html:42` |
 | `1d5bfd09068c` | certain | What you saw | `modules/hall-ui/public/studio.js:162` |
 | `b8743d16eab8` | certain | What {…} unlocks | `modules/hall-ui/public/hall-render.js:82` |
 | `ecfd34bf5e6f` | certain | What’s stuck (optional) | `modules/hall-ui/public/blockers.js:308` |

package/docs/copy-registry.json

@@ -7381,7 +7381,7 @@
       "surface": "builders-hall",
       "text": "Merging work does not put it in front of anyone. This is the step that does: it moves this project onto a newer core, waits for its box to answer, and puts it back if it does not. Every project has this control in its own hall, this platform included — so what you see below is one project, the one whose hall you are in.",
       "file": "modules/hall-ui/public/deploy.html",
-      "line": 42,
+      "line": 49,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -12376,7 +12376,7 @@
       "surface": "builders-hall",
       "text": "What users can see",
       "file": "modules/hall-ui/public/deploy.html",
-      "line": 35,
+      "line": 42,
       "origin": "html-text",
       "confidence": "certain"
     },

package/docs/file-map.md

@@ -137,6 +137,7 @@
 │   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, records/ (one file per page family — what each family's redesign settled; CLAUDE.md points at them, and a new record is a new file there so concurrent hall tasks stop colliding on one insertion point, task 1003499), public/{index.html,builders.js,style.css,work,watch,gate,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Four ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages), `oversight.css` (the OVERSIGHT family — government, watch, gate, task 1003469 (harbor was its fourth until task 1003890 removed the dev box): the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface) and `panel.css` (the PANEL family — settings, profile, task 1003308 (pair was its third until task 1003890 removed the dev box): the row, the switch, the field with its label above, the chip control, the four voices and the sign-in gate; the hall's my-projects page was DELETED in the same task — "my projects" is the hub's user-level page, and the hall keeps no link or redirect; the family's fourth page `not-ready.html` was deleted by task 1003450, along with the emptied `requireNonXenosPage` gate that was the only thing redirecting to it). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `settings.css` the rail layout, the group head, the token ladder and the voices grid, `profile.css` the identity band and the shelf, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`), `thinking.css` THE SKY's one sheet (task 1004231 / sky part 3 — `thinking.html` at `/thinking` is the prototype the owner adopted as the design of record, `docs/design/mocks/sky/`, built over `GET /sky` + `GET /sky/mine`; its script is the seven `sky-*.js` files on one shared `window.OTBSky`; it replaced THE ROOM of task 1004098, which survives as the list drawer, and the old `/sky` page, whose URL 301s here; `idea-objects.js` beside it is the shared five-object vocabulary).
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a Bongos task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/gds/copy-apply.js lands it as a real diff under a claim. CLAUDE.md, module.json, registry.js, flags.js, proposals.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
+│   ├── npm-release/             ← the deploy page for a project that publishes an npm package from GitHub (task 1002622, default-OFF — on only in the Bongos hall, which publishes @bongos/core). "Where the work is": every task finished in the last 14 days, placed in the stage it has actually reached (not merged · merged, no version yet · published, not running here · running here, not released · released · in no version), plus the version history — each version's tasks. The version↔task join reads the release-notes.json the package itself carries (scripts/gds/release-notes.js writes it at pack time), streamed out of the NEWEST version's npm tarball in-process (no child process, no sync call) when the running core's own copy stops short. module.json, work.js (the reading + the stage placement), registry.js (packument + tarball stream + a small tar reader, cached), routes/work.js (GET /npm-release/work, gated core.pin.move like the page), public/work.{js,css} (the two sections /deploy lends it: #nr-work, #nr-versions). Tests sit at the repo root — tests/npm_release_{work,page}.mjs — because a default-off module's own tests/ is skipped by the unit runner.
 │   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. minimalist-ui/, industrial-brutalist-ui/, gpt-taste/, stitch-design-taste/ (task 1003327 / ADR 0230) are the four looks, composition grammars with no colours of their own: the palette is the instance's pack and the texture is a named entry in styles/; a substrate is an archetype that still ships both modes, gpt-taste's selection is derived from the route rather than rolled, and stitch-design-taste writes a DESIGN.md-shaped contract document whose thirteen are transcribed from the pack. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's styles/grove/assets/ is the worked example. style/ (task 1003475 / ADR 0231) is the module's first FIRST-PARTY skill (no upstream, so a `## First party` section instead of `## Rebuilt from`): the /style session in which an owner authors their own look in four bounded steps, rendering the nearest library entries before asking, drafting inside the contract, retuning by measurement, and handing over the one-step adoption without ever writing config/branding.json. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest, the otb-character-review skill. CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.

package/docs/module-api-changelog.md

@@ -2554,6 +2554,10 @@ is load-bearing: the script throws rather than guess if it is missing, and
   1.19.1037 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1036 with no explicit bump. run 36227523642. (task 1002620)
   1.19.1038 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
-        landed since 1.19.1037 with no explicit bump. run 36228544921. (task 1002620)
+        landed since 1.19.1037 with no explicit bump. run 36228854271. (task 1002620)
+  1.19.1039 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1038 with no explicit bump. run 36229255566. (task 1002620)
+  1.19.1040 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1039 with no explicit bump. run 36251192410. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/core-release-pipeline.md

@@ -99,7 +99,7 @@ node scripts/gds/package-core.js --ref main --self-verify
 
 ### 2c. Publish — automatic on merge
 
-**Every merge to `main` publishes** ([ADR 0161](../adr/0161-publish-on-merge.md), superseding ADR 0137's manual gate): once the required `unit` check succeeds on a main push, the `publish` workflow auto-bumps a **patch** if nobody bumped (via `scripts/gds/bump-version.js`, which writes the literal AND appends the ledger entry to [`docs/module-api-changelog.md`](../module-api-changelog.md) — ADR 0203; the carrier commit stages both), builds through the fail-closed no-leak gate with `--self-verify`, publishes, and tags `core-v<version>`. A **minor/major is still a human in-task bump** — CI never makes that call, because it decides what patch-channel subscribers receive unattended.
+**Every merge to `main` publishes** ([ADR 0161](../adr/0161-publish-on-merge.md), superseding ADR 0137's manual gate): once the required `unit` check succeeds on a main push — and the `integration` lane is green on the commit being released, which carries the packaged-core empty-database proof (task 1002863; the wait is task 1004290) — the `publish` workflow auto-bumps a **patch** if nobody bumped (via `scripts/gds/bump-version.js`, which writes the literal AND appends the ledger entry to [`docs/module-api-changelog.md`](../module-api-changelog.md) — ADR 0203; the carrier commit stages both), builds through the fail-closed no-leak gate with `--self-verify`, publishes, and tags `core-v<version>`. A **minor/major is still a human in-task bump** — CI never makes that call, because it decides what patch-channel subscribers receive unattended.
 
 The lane is armed by the owner via the `PUBLISH_ON_MERGE=1` repo variable + two secrets (`NPM_TOKEN`, `RELEASE_PUSH_TOKEN`); while disarmed it no-ops loudly. Manual fallback, same command CI runs:
 

package/docs/recipes/private-npm-distribution.md

@@ -55,7 +55,7 @@ npm publish ./clients/bongos-client               # real (publishConfig makes it
 
 ## Cutting a core release (the policy — [ADR 0161](../adr/0161-publish-on-merge.md), superseding ADR 0137)
 
-**Publishing is automatic on merge** as of 2026-08-08: the `publish` workflow rides behind the required `unit` check, auto-bumps a patch when nobody bumped, builds through the fail-closed no-leak gate, publishes, and tags — see the workflow header (`.github/workflows/publish.yml`) and ADR 0161. It ships inert until the owner arms it: repo variable `PUBLISH_ON_MERGE=1`, a **trusted publisher** registered on npmjs.com for `@bongos/core` naming this repo + `publish.yml`, and the secret `RELEASE_PUSH_TOKEN` (contents:write, for the bump commit). There is deliberately **no** `NPM_TOKEN` — the lane authenticates by OIDC, and the workflow sets neither `NPM_TOKEN` nor `NODE_AUTH_TOKEN` because either one would send npm down the legacy token path and skip the OIDC exchange entirely. A **minor/major bump stays a human in-task edit**. The update subscription ([ADR 0136](../adr/0136-update-channel-subscription-policy.md)) consumes whatever is published, on its next sweep.
+**Publishing is automatic on merge** as of 2026-08-08: the `publish` workflow rides behind the required `unit` check and waits for the `integration` lane's verdict on the commit it releases (task 1004290), auto-bumps a patch when nobody bumped, builds through the fail-closed no-leak gate, publishes, and tags — see the workflow header (`.github/workflows/publish.yml`) and ADR 0161. It ships inert until the owner arms it: repo variable `PUBLISH_ON_MERGE=1`, a **trusted publisher** registered on npmjs.com for `@bongos/core` naming this repo + `publish.yml`, and the secret `RELEASE_PUSH_TOKEN` (contents:write, for the bump commit). There is deliberately **no** `NPM_TOKEN` — the lane authenticates by OIDC, and the workflow sets neither `NPM_TOKEN` nor `NODE_AUTH_TOKEN` because either one would send npm down the legacy token path and skip the OIDC exchange entirely. A **minor/major bump stays a human in-task edit**. The update subscription ([ADR 0136](../adr/0136-update-channel-subscription-policy.md)) consumes whatever is published, on its next sweep.
 
 The steps below remain as the **manual fallback** (lane disarmed, npm outage, or a deliberate out-of-band release):