@bongos/core 1.19.1080 → 1.20.1

package/docs/file-map.md

@@ -115,6 +115,7 @@
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a Bongos task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/gds/copy-apply.js lands it as a real diff under a claim. BV2.TW05 (task 1004316, ADR 0341 D8) added Tweak Mode's three derived READS — GET /copy-desk/pages, /copy-desk/pages/:pageId, /copy-desk/tally: page status and count, changelog, drift, "N of M tweaked" per surface, and the artist's tally — over the page-tweak tasks (lifecycle port), docs/page-inventory.json and docs/page-readings.json (both now in the publish manifest), with no status table. BV2.TW06 (task 1004317, ADR 0341 D2, D5, D6) added its first two page WRITES: POST /copy-desk/pages/:pageId/claim (an artist-craft builder opens or takes the page's tweak round as a web-claimed task, through the lifecycle port's webClaimPageTweak, under an advisory lock on the page) and POST /copy-desk/pages/:pageId/asks (anyone files a page ask, a copy_desk_flags row with scope 'page', added by copy_desk_002_page_asks.sql). CLAUDE.md, module.json, registry.js, flags.js, proposals.js, pages.js (the page-tweak block format), page-status.js (the pure derivation), page-data.js (the page artifacts' read side), routes/copy-desk.js, migrations/copy_desk_001_flags.sql, migrations/copy_desk_002_page_asks.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals,copy_page_status}.mjs + tests/fixtures/page-tweak.cjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
 │   ├── npm-release/             ← the deploy page for a project that publishes an npm package from GitHub (task 1002622, default-OFF — on only in the Bongos hall, which publishes @bongos/core). "Where the work is": every task finished in the last 14 days, placed in the stage it has actually reached (not merged · merged, no version yet · published, not running here · running here, not released · released · in no version), plus the version history — each version's tasks. The version↔task join reads the release-notes.json the package itself carries (scripts/gds/release-notes.js writes it at pack time), streamed out of the NEWEST version's npm tarball in-process (no child process, no sync call) when the running core's own copy stops short. module.json, work.js (the reading + the stage placement — the packument, tarball stream and tar reader it uses are the core's src/bongos/package-registry.js, reached through the doorway's readPackageRegistry since task 1004296), routes/work.js (GET /npm-release/work, gated core.pin.move like the page), public/work.{js,css} (the two sections /deploy lends it: #nr-work, #nr-versions). Task 1004301 added the same line on a task's own page: routes/task-where.js (GET /npm-release/task/:id, any signed-in builder — it shows nothing not already public) + public/task-widget.js, injected into task.html by the loader's uiSections seam (hallWidgetScripts file task-widget.js) to fill #task-contrib on otb:task-shown. Tests sit at the repo root — tests/npm_release_{work,page}.mjs — because a default-off module's own tests/ is skipped by the unit runner.
+│   ├── render-deploy/           ← the deploy page for a project whose app deploys through Render (task 1004270, default-OFF). The service's Render deploys, each tied to its commit and the Bongos tasks in it, what is live now, and deploy + roll back behind a two-step confirm the server also holds. The owner's Render key is never stored: it rides each request in a header. Uses the one Render client, scripts/gds/render-api.js, and its ownerId guard. `deploys.js` (shaping + ledger), `render.js` (key + client), `routes/` (app, history, act), `public/deploy.js` (the page, mounted in /deploy), `migrations/` (one two-id table)
 │   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. minimalist-ui/, industrial-brutalist-ui/, gpt-taste/, stitch-design-taste/ (task 1003327 / ADR 0230) are the four looks, composition grammars with no colours of their own: the palette is the instance's pack and the texture is a named entry in styles/; a substrate is an archetype that still ships both modes, gpt-taste's selection is derived from the route rather than rolled, and stitch-design-taste writes a DESIGN.md-shaped contract document whose thirteen are transcribed from the pack. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's styles/grove/assets/ is the worked example. style/ (task 1003475 / ADR 0231) is the module's first FIRST-PARTY skill (no upstream, so a `## First party` section instead of `## Rebuilt from`): the /style session in which an owner authors their own look in four bounded steps, rendering the nearest library entries before asking, drafting inside the contract, retuning by measurement, and handing over the one-step adoption without ever writing config/branding.json. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest, the otb-character-review skill. CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.
@@ -251,6 +252,7 @@
 │   ├── index.html                  ← the landing (/) — v3 "the template's page" of the chrome world (task 1003298, ADR 0196): server-stamped head, the breath (CSS-only signature), live figures/ledger/orbs from the public feeds baked inside sentinels; page-local <style> only (no :root), links /assets/world.css
 │   ├── projects.html               ← the hub (/projects?view=map|mine|manage|new) on cosmos.css (A4, task 1003299, rebuilds it in the world)
 │   ├── privacy.html / terms.html / contact.html ← the footer doors (task 1003251), on cosmos.css
+│   ├── account.html                ← the hub account page (/account, task 1004259, ADR 0337 D4.3): handle, name, bio, links, public/private, recruiters, hide-my-numbers — the platform account's own settings, edited once; served only where platform-identity runs; account{,-private}.states.json + account.probes.json beside it
 │   ├── assets/
 │   │   ├── world.css               ← the WORLD token layer (ADR 0196): contract tier = the pack, derived tier both modes, root-absolute plate token pairs, the reduced-motion kill switch; no page composition
 │   │   ├── world/                  ← the six production plates + <file>.json provenance sidecars (embed-prompt.mjs --scan clean): r2-chrome-blobs-set.jpg, r2-chrome-blob-one.jpg, r2-bongos-chrome-b.jpg (black plates, dark mode, lighten) and their -cut.webp alpha twins (light mode); og-card.jpg (the social card, captured from the page)

package/docs/module-api-changelog.md

@@ -2651,5 +2651,13 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1078 with no explicit bump. run 36602720244. (task 1002620)
   1.19.1080 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1079 with no explicit bump. run 36638268217. (task 1002620)
+  1.19.1081 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1080 with no explicit bump. run 36639564721. (task 1002620)
+  1.20.0 — cascadeDispatch: the cheapest-model-first cascade router
+        (src/bongos/cascade-dispatch.js), for the lifecycle module's ADR 0101
+        Part 1 relevance/anti-hack judge — its first real caller (task 1001691).
+        Additive, so MINOR.
+  1.20.1 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.0 with no explicit bump. run 36658043092. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -229,6 +229,7 @@ A module calls `api.seams.emit(eventName, payload)` to broadcast. Any module tha
 | Port: `security` | `security` (R79) | core `routes/public.js` (`/public/bounty-table`) | `{ bountyTableDetailed(), bountyTable() }` — the env-aware red-team bounty payout schedule. Core reads via `resolveOptional('security').bountyTableDetailed()` instead of importing the module (security is default-on; only <redacted> moved — [ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1, [02-module-map §5](design/modular-architecture/02-module-map.md)). |
 | Port: `builder-settings` | `builder-settings` (R80) | core `routes/me.js` (`GET /me`) + `cascade-dispatch.js` | `{ getBuilderBehaviorPrefs, describeWandering, describeRender, computeNeeds, skillCeiling }` — the per-builder prefs read surface. The `GET /me` aggregator resolves it for its wandering/render/needs slices; the dormant cascade router for the skill ceiling. Default-on; degrades gracefully when off ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1, [02-module-map §2](design/modular-architecture/02-module-map.md)). |
 | Port: `onboarding` | `onboarding` (R81) | the lifecycle (`db.js` claim/ship — transaction-participant `markStage`) + `auth.js` + `routes/me.js`/`builders.js`/`tasks.js`/`claims.js` | `{ getState, shapeForApi, safeMarkStage, markStage, broadcastGraduation, restockForClaim, restockAll, SOURCE_TAG }` — the onboarding state-machine + newcomer-restock surface. The FIRST core→module port the lifecycle ticks inside its own txn (alongside `reward`). Default-on; degrades to best-effort no-ops when off ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1). |
+| Port: `request.divert` | `npm-release` (its version preview; task 1004300, [ADR 0349](adr/0349-a-version-preview-is-a-sandboxed-child-the-web-tier-launches.md)) | core `src/platform-server.js`, just before `mountInternalSurfaces(app)` | `(req, res, next) → void|Promise` — an **optional** provider, looked up on every request. It either answers the request or calls `next()`. With no provider registered the kernel calls `next()` at once, so an instance without the module is served exactly as before; a provider that throws is treated as absent for that request. Consumed with `resolveOptional`, never `resolve`. |
 | Event: `builder.secrets-scrub-needed` | core `db.js` (`deactivateBuilder`) | `art-pipeline` (when installed) | `{ builderId, actor }` — task 1003338 / [ADR 0332](adr/0332-offboarding-secret-scrub-semantics.md): best-effort teardown port for a MODULE-owned builder-keyed secret (today: the Gemini BYOK key, `gemini_key_enc`/`last4`/`set_at`). Core does not write those columns directly (ADR 0102) — the module listens and clears its own store. `github_oauth_tokens` (core-owned) is deleted synchronously inside `deactivateBuilder`'s transaction instead, no event needed. |
 
 ---

package/docs/page-inventory.json

@@ -10,10 +10,10 @@
     "An id changes only when the host prefix, the data-page value or the file name changes; that is a rename, and records keyed on the old id move with it."
   ],
   "counts": {
-    "pages": 38,
+    "pages": 39,
     "surfaces": 3,
-    "with_states": 31,
-    "states": 168
+    "with_states": 32,
+    "states": 179
   },
   "surfaces": [
     {
@@ -30,7 +30,7 @@
       "at": "modules/public-landing/public",
       "answers_at": "apex root",
       "origin": "https://{apex}",
-      "pages": 5
+      "pages": 6
     },
     {
       "id": "status",
@@ -849,6 +849,7 @@
         "modules/hall-ui/public/dom-utils.js",
         "modules/hall-ui/public/hall-visual.js",
         "modules/hall-ui/public/hall-kit.js",
+        "modules/hall-ui/public/brand-holes.js",
         "modules/hall-ui/public/approval-queue-lib.js",
         "modules/hall-ui/public/approval-queue.js",
         "modules/hall-ui/public/tweak-editor-lib.js",
@@ -968,6 +969,7 @@
         "modules/hall-ui/public/shell.js",
         "modules/hall-ui/public/palette.js",
         "modules/hall-ui/public/dom-utils.js",
+        "modules/hall-ui/public/brand-holes.js",
         "modules/hall-ui/public/tweak-editor-lib.js",
         "modules/hall-ui/public/tweak-editor.js"
       ],
@@ -1055,6 +1057,31 @@
         "out"
       ]
     },
+    {
+      "id": "landing:account",
+      "surface": "landing",
+      "module": "public-landing",
+      "page": "account",
+      "id_from": "file-name",
+      "title": "{{productName}} — Your account",
+      "document_title": "{{productName}} — Your account",
+      "path": "/account",
+      "url": "https://{apex}/account",
+      "files": [
+        "modules/public-landing/public/account.html",
+        "modules/public-landing/public/assets/cosmos.css"
+      ],
+      "states_files": [
+        "modules/public-landing/public/account.states.json",
+        "modules/public-landing/public/account-private.states.json"
+      ],
+      "states": [
+        "out",
+        "in",
+        "in-privacy",
+        "in-private"
+      ]
+    },
     {
       "id": "landing:contact",
       "surface": "landing",
@@ -1149,6 +1176,12 @@
         "in-manage-card",
         "in-manage-kind",
         "in-manage-invite",
+        "in-manage-app-live",
+        "in-manage-app-building",
+        "in-manage-app-failed",
+        "in-manage-app-retry",
+        "in-manage-app-offer",
+        "in-manage-app-connect",
         "in-manage-snag",
         "in-manage-gone",
         "in-manage-missing",
@@ -1162,6 +1195,7 @@
         "in-new-home",
         "in-new-address",
         "in-new-app",
+        "in-new-app-render",
         "in-new-review",
         "in-new-done",
         "in-new-resume-offer",