@bongos/core 1.19.298 → 1.19.299

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.298",
-  "core_contract": "1.19.298",
-  "source_commit": "89c91526e13db0ef8a1fbc4091e6691df74f71fc",
+  "core_version": "1.19.299",
+  "core_contract": "1.19.299",
+  "source_commit": "d591d374828ca13a2d6a3669ba194a33d25f7c82",
   "source_ref": "HEAD",
-  "built_at": "2026-08-22T20:51:27.946Z",
+  "built_at": "2026-08-22T21:42:14.117Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 322,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1401,
+    "functional_verbatim": 1405,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1745,
-  "tree_sha256": "885d55252052de946b48981a842f0b6230d156fbb900f77f02c2e1daf0e0d511",
+  "file_count": 1749,
+  "tree_sha256": "19e6ca4bdb8b1113057e5390e82e3e12947e0d43b2dbae6b81b4c07811ae6dc4",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "6e44e5da05194cc5aae1784d591d5f560dc36527939eda359de794e3d29fdb37"
+      "sha256": "162edc8df3b6354b06337ad981f473ea798151002d6c2eda728b25c0545ea70c"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "b05f34f719999b987f9ea6dcecec7bed016a0486ffb43a2ba95fcabbbe7457db"
+      "sha256": "f8df65df7eaaccb15fe2a1aeda1c690e377cecc3617b408c4ff8a71f4c79edea"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "5fbf0ea8c5b9eba86cc1d471407d8f4bb1df23af72d4fe7a618576bf67233a14"
+      "sha256": "53dec4d0e2958ddb66fe794b74cdc0bb8823fa7d8a5da90a4c2dd731a1bb0e04"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "db6c391a39f2caea99486c5f03993b0cc52e3506835d750a28a4a0b2108bb441"
+      "sha256": "85041b30fb2113ca5b3684ae961e67dc2bd5dfdb152064b151af3f0a93a29f31"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "5ef5dcc11f3713394c6a6225c4206ef8955b27b17c95a47fd51ca43b7965729f"
+      "sha256": "f01af61309e843cf15fc8b5c4cb01e8383927890ea1734d91a2ed490424d2d77"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1417,12 +1417,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "0c2b5d0fd5e05cbe3b3c06ab10baf7e6af0414d85599519e3ef2eb289008b672"
+      "sha256": "d545aada2bc0127be904c5df12c393c3ab8756f84ef86cc7bcee1348074769f9"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "f77f37d52d726cf7df447b7988416e5eca802cc2da0398ac1e6e1df212ba664e"
+      "sha256": "828558b3bd6cc8d7c9c720eef962e098e4f886ab33360833b2c6d3946acbd1d1"
     },
     {
       "path": "docs/architecture.md",
@@ -1447,12 +1447,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "8cb5bb088aae803e6889571712cc4439fc870c88e104b1bb81dbd5fd1f9b9bd3"
+      "sha256": "10fff8940c3533b2da9e5cd034ee3b85e8f8924615450a037c5dc1118cc515fc"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "18599cab2b3de43e33513c20cfaa241d3fe0545b861a27942d7f63d11f646750"
+      "sha256": "de5de5aa328f46061c7ee63d2fdea8117141fb18331324f1560cb3344f982a14"
     },
     {
       "path": "docs/design-contract.md",
@@ -1557,7 +1557,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "b017e7a4425f92cc5cbec8d0a5fc192e3225794fb97955acb3689b12dc0de667"
+      "sha256": "fe7af041ba95eb5bdf58b92dcedbe8c7694a1ea8128d980cff566edb6cf32352"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2812,7 +2812,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "5fbf0ea8c5b9eba86cc1d471407d8f4bb1df23af72d4fe7a618576bf67233a14"
+      "sha256": "53dec4d0e2958ddb66fe794b74cdc0bb8823fa7d8a5da90a4c2dd731a1bb0e04"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3469,6 +3469,21 @@
       "mode": "0000644",
       "sha256": "7a102f4fd675910b0c80416c3ed05397d38f977e647fffb00c593732d05a3712"
     },
+    {
+      "path": "modules/hall-ui/public/ideas.css",
+      "mode": "0000644",
+      "sha256": "ee6e640e9e23a7e724a3876171fe20ca9d758458f90bb443968f761d296500f1"
+    },
+    {
+      "path": "modules/hall-ui/public/ideas.html",
+      "mode": "0000644",
+      "sha256": "ad1ef56e043b2c1a93996b93ff098c4ca9555cdcb063df6387ba1d2c92a825e1"
+    },
+    {
+      "path": "modules/hall-ui/public/ideas.js",
+      "mode": "0000644",
+      "sha256": "b3910cd9e1c77e9402f75522a1972c7ed59da784d9bc64a991072465414cb999"
+    },
     {
       "path": "modules/hall-ui/public/index.html",
       "mode": "0000644",
@@ -3637,7 +3652,7 @@
     {
       "path": "modules/hall-ui/public/shell.js",
       "mode": "0000644",
-      "sha256": "bfaa74784ee0578fe8e950f55585522a39c892c58f663330a3b724f34a8a0603"
+      "sha256": "cc9fd3033b528ca2e5761054219653926341a6c10ee27ab10b42779cfc3b46a3"
     },
     {
       "path": "modules/hall-ui/public/style.css",
@@ -3752,7 +3767,7 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "44e918d0fe82a22a986f66b33e1165c1f30d3e67b04cde9019a6c293d42f1f72"
+      "sha256": "33a5eadf8400285304e3a1958f25ca104b67c7c5a8c1ac59698cff64b4c70589"
     },
     {
       "path": "modules/ideas/routing.js",
@@ -4547,12 +4562,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "56a2a9e3416c259a9ee31664dae5bb5509baa1410c40e6e6b0fceca4b3bff209"
+      "sha256": "407f202c0d8cd88cf0f622c4873b9feb1931ceb1dd273723862f8ccd19ec4142"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b58f5b7eddb94b3ec917dfe1694957f1da4f7154c4ad655b4aed06bafaf033ac"
+      "sha256": "ddf2bb2fee835a734a8e1ec4524c33590958b44f82f86a814e953d8ee59b110d"
     },
     {
       "path": "public-docs/index.html",
@@ -6172,7 +6187,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "2ce782b00c80482ef9b9d3e4a54a634e73c6d956e13e32cc7e3d2ff63e8282cd"
+      "sha256": "f54837753cf2b432634f044f84f8f198b39b1a18bf48c3ffb3df27f2c3a37cd2"
     },
     {
       "path": "src/bongos/stealth-gate.js",
@@ -6207,7 +6222,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3a94110af825d5235724b6d1552ae99b13f90f74ff9b8e82e4ada09885c8b3fd"
+      "sha256": "e714212ca02e064dd7778d83523dcf96f8bfdb8a93f86b87ecde046c8dbba994"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7437,7 +7452,7 @@
     {
       "path": "tests/hall_nav.mjs",
       "mode": "0000644",
-      "sha256": "7ab365a19909a0a73b446339d5109f8f1f818dd6fdc49c8792a42bde5757e5ed"
+      "sha256": "59de791cd5497e7d73e3d34841f5e816efe36bc34d1580f3e9afbae3055f2f5c"
     },
     {
       "path": "tests/hall_page_gate_map.mjs",
@@ -7519,6 +7534,11 @@
       "mode": "0000644",
       "sha256": "07cacc97990f0e775342f8b30171c87128e0acb1abd38d64c683c3f257927ebd"
     },
+    {
+      "path": "tests/idea_hall_composer.mjs",
+      "mode": "0000644",
+      "sha256": "cf3071e8180dbb1bdacbafb7a1b40569691afe32b053db0f8de908a5726ca8fe"
+    },
     {
       "path": "tests/idea_quick_guard.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 298 operations across 47 resource groups
+- 300 operations across 47 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -417,8 +417,12 @@ function createClient(opts = {}) {
       postInboxIdSpark: (args) => request("POST", "/inbox/{id}/spark", { hasBody: true }, args),
       // GET /inbox/awaiting-nod — rank: metic+archon — GET /inbox/awaiting-nod
       getInboxAwaitingNod: (args) => request("GET", "/inbox/awaiting-nod", { hasBody: false }, args),
+      // POST /inbox/score — rank: any-builder — POST /inbox/score
+      postInboxScore: (args) => request("POST", "/inbox/score", { hasBody: true }, args),
       // GET /inbox/sparks — rank: any-builder — GET /inbox/sparks
       getInboxSparks: (args) => request("GET", "/inbox/sparks", { hasBody: false }, args),
+      // GET /inbox/template — rank: any-builder — GET /inbox/template
+      getInboxTemplate: (args) => request("GET", "/inbox/template", { hasBody: false }, args),
     },
     "instance": {
       // GET /instance — rank: public — GET /instance

package/clients/bongos-client/index.cjs

@@ -416,8 +416,12 @@ function createClient(opts = {}) {
       postInboxIdSpark: (args) => request("POST", "/inbox/{id}/spark", { hasBody: true }, args),
       // GET /inbox/awaiting-nod — rank: metic+archon — GET /inbox/awaiting-nod
       getInboxAwaitingNod: (args) => request("GET", "/inbox/awaiting-nod", { hasBody: false }, args),
+      // POST /inbox/score — rank: any-builder — POST /inbox/score
+      postInboxScore: (args) => request("POST", "/inbox/score", { hasBody: true }, args),
       // GET /inbox/sparks — rank: any-builder — GET /inbox/sparks
       getInboxSparks: (args) => request("GET", "/inbox/sparks", { hasBody: false }, args),
+      // GET /inbox/template — rank: any-builder — GET /inbox/template
+      getInboxTemplate: (args) => request("GET", "/inbox/template", { hasBody: false }, args),
     },
     "instance": {
       // GET /instance — rank: public — GET /instance

package/clients/bongos-client/index.d.ts

@@ -51,6 +51,7 @@ export interface GetInboxAwaitingNodResponse { awaiting: unknown; count: unknown
 export interface GetInboxIdResponse { idea: unknown }
 export interface GetInboxResponse { ideas: unknown; open_count: unknown }
 export interface GetInboxSparksResponse { sparks: unknown; count: unknown }
+export interface GetInboxTemplateResponse { template: unknown }
 export interface GetLeaderboardResponse { leaderboard: unknown; page: unknown }
 export interface GetLearningsResponse { learnings: unknown }
 export interface GetMeAchievementsResponse { unlocked: unknown }
@@ -251,6 +252,8 @@ export interface PostInboxIdRatifyRequest { notes_md?: string }
 export interface PostInboxIdResubmitRequest { field_values: Record<string, unknown>; template_key?: string }
 export interface PostInboxIdSparkResponse { idea: unknown; sparked: boolean; unchanged: boolean }
 export interface PostInboxRequest { title: string; body_md?: string; kind?: string; suggested_version?: string; suggested_priority?: number; goal_id?: number; grade?: string; template_key?: string; field_values?: Record<string, unknown> }
+export interface PostInboxScoreRequest { field_values: Record<string, unknown>; template_key?: string }
+export interface PostInboxScoreResponse { score: unknown; fields: unknown; template_key: unknown }
 export interface PostLearningsRequest { title: string; body_md: string; tags?: string[]; related_files?: string[]; source?: string; source_ref?: string; task_id?: number }
 export interface PostLearningsResponse { skipped?: boolean; reason?: unknown; learning?: unknown }
 export interface PostLlmCacheLookupRequest { cache_key?: unknown; tokens_saved_est?: unknown }
@@ -681,8 +684,12 @@ export interface BongosClient {
     postInboxIdSpark(args?: RequestArgs): Promise<PostInboxIdSparkResponse>;
     /** GET /inbox/awaiting-nod — rank: metic+archon */
     getInboxAwaitingNod(args?: RequestArgs): Promise<GetInboxAwaitingNodResponse>;
+    /** POST /inbox/score — rank: any-builder */
+    postInboxScore(args: RequestArgs & { body: PostInboxScoreRequest }): Promise<PostInboxScoreResponse>;
     /** GET /inbox/sparks — rank: any-builder */
     getInboxSparks(args?: RequestArgs): Promise<GetInboxSparksResponse>;
+    /** GET /inbox/template — rank: any-builder */
+    getInboxTemplate(args?: RequestArgs): Promise<GetInboxTemplateResponse>;
   };
   "instance": {
     /** GET /instance — rank: public */

package/clients/bongos-client/index.mjs

@@ -413,8 +413,12 @@ export function createClient(opts = {}) {
       postInboxIdSpark: (args) => request("POST", "/inbox/{id}/spark", { hasBody: true }, args),
       // GET /inbox/awaiting-nod — rank: metic+archon — GET /inbox/awaiting-nod
       getInboxAwaitingNod: (args) => request("GET", "/inbox/awaiting-nod", { hasBody: false }, args),
+      // POST /inbox/score — rank: any-builder — POST /inbox/score
+      postInboxScore: (args) => request("POST", "/inbox/score", { hasBody: true }, args),
       // GET /inbox/sparks — rank: any-builder — GET /inbox/sparks
       getInboxSparks: (args) => request("GET", "/inbox/sparks", { hasBody: false }, args),
+      // GET /inbox/template — rank: any-builder — GET /inbox/template
+      getInboxTemplate: (args) => request("GET", "/inbox/template", { hasBody: false }, args),
     },
     "instance": {
       // GET /instance — rank: public — GET /instance

package/docs/api/openapi.json

@@ -6307,6 +6307,55 @@
         ]
       }
     },
+    "/inbox/score": {
+      "post": {
+        "operationId": "post_inbox_score",
+        "tags": [
+          "inbox"
+        ],
+        "summary": "POST /inbox/score",
+        "description": "**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/ideas/routes/inbox.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostInboxScoreRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostInboxScoreResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/inbox/sparks": {
       "get": {
         "operationId": "get_inbox_sparks",
@@ -6345,6 +6394,44 @@
         ]
       }
     },
+    "/inbox/template": {
+      "get": {
+        "operationId": "get_inbox_template",
+        "tags": [
+          "inbox"
+        ],
+        "summary": "GET /inbox/template",
+        "description": "----------------------------------------------------------------------- The two reads the hall's Full Idea composer is built from (task 1002928 / BV1.R152, goal 1000062). The done-when says the live meter must reflect THE REAL SCORER, \"not a second copy of the rules\". A browser cannot require() this module — completeness.js and templates.js are CJS and templates.js reaches inbox.js for DEFAULT_TEMPLATE_KEY, which reaches the pool — so the choice is between re-implementing the arithmetic in page JS and asking the server. These two routes are that ask, and they are why the composer contains no rules at all: GET /inbox/template → what the five fields ARE (so the FORM is rendered from the R141 declaration, not from five <textarea> elements hand-written into the HTML — a hard-coded form is the same \"second copy\" defect as a hard-coded scorer, one step earlier, and it would silently ignore a per-project template (R156)). POST /inbox/score → what it is WORTH right now (the R142 scorer itself, per-field, in template order). BOTH ARE PURE. No DB read, no write, no idea id: they describe and score a payload the caller already holds. That is what makes a debounced call on every keystroke reasonable, and why scoring carries no rank beyond sign-in — it tells you nothing you did not just type. DECLARED BEFORE `GET /inbox/:id`, and for GET /inbox/template that ordering is LOAD-BEARING: Express matches in declaration order, so with `:id` first the literal \"/inbox/template\" binds id='template' and parseId 400s it. Same trap as /inbox/sparks and /inbox/awaiting-nod above. rank: any-builder — filing a Full Idea is open to every role by the goal's own settled decision (\"no permission gate on Full Ideas; completeness scoring and triage do the filtering\"), so describing and scoring one must be too. Deliberately NOT pinned in route-rank-check: neither has a gate to protect.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/ideas/routes/inbox.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetInboxTemplateResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/inbox/{id}": {
       "get": {
         "operationId": "get_inbox_id",
@@ -14133,6 +14220,15 @@
           "count"
         ]
       },
+      "GetInboxTemplateResponse": {
+        "type": "object",
+        "properties": {
+          "template": {}
+        },
+        "required": [
+          "template"
+        ]
+      },
       "GetLeaderboardResponse": {
         "type": "object",
         "properties": {
@@ -17157,6 +17253,34 @@
         ],
         "additionalProperties": false
       },
+      "PostInboxScoreRequest": {
+        "type": "object",
+        "properties": {
+          "field_values": {
+            "type": "object"
+          },
+          "template_key": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "field_values"
+        ],
+        "additionalProperties": false
+      },
+      "PostInboxScoreResponse": {
+        "type": "object",
+        "properties": {
+          "score": {},
+          "fields": {},
+          "template_key": {}
+        },
+        "required": [
+          "score",
+          "fields",
+          "template_key"
+        ]
+      },
       "PostLearningsRequest": {
         "type": "object",
         "properties": {
@@ -18828,9 +18952,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 298,
-  "x-schema-count": 331,
+  "x-endpoint-count": 300,
+  "x-schema-count": 334,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 221,
+  "x-response-schemas": 223,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 298 endpoints across 47 route files.
+> **Generated from the live route files** — the route file is authoritative. 300 endpoints across 47 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -258,7 +258,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | GET | `/api/bongos/healthz` | `public` | — | liveness probe; status.example.com hits this anonymously. |
 
-## `inbox` (12)
+## `inbox` (14)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -273,7 +273,9 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/inbox/:id/spark` | `any-builder` | — | Mark a Quick Idea as a Big Idea Spark — "I have the spark but not the full picture, someone develop this". |
 | DELETE | `/api/bongos/inbox/:id/spark` | `any-builder` | — | Withdraw the Big Idea Spark mark — the reversibility half of R144. |
 | GET | `/api/bongos/inbox/awaiting-nod` | `metic+archon` | — | GET /inbox/awaiting-nod — the NOD QUEUE (task 1003066, BV1.R05). |
+| POST | `/api/bongos/inbox/score` | `any-builder` | `field_values`, `template_key` |  |
 | GET | `/api/bongos/inbox/sparks` | `any-builder` | — | GET /inbox/sparks — THE SPARK QUEUE (task 1002921 / BV1.R145, goal 1000062). |
+| GET | `/api/bongos/inbox/template` | `any-builder` | — | ----------------------------------------------------------------------- The two reads the hall's Full Idea composer is built from (task 1… |
 
 ## `instance` (1)