@bongos/core 1.19.371 → 1.19.373

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.371",
-  "core_contract": "1.19.371",
-  "source_commit": "587eb4ed0b68da54bf63fb01b69fab937450bd66",
+  "core_version": "1.19.373",
+  "core_contract": "1.19.373",
+  "source_commit": "fbe2ff6cdfb5154f956f0a473085ad2f55a9e7e2",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T22:08:11.031Z",
+  "built_at": "2026-08-25T22:26:30.155Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 334,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1544,
+    "functional_verbatim": 1545,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1900,
-  "tree_sha256": "55cb6adeadbe8a337b32bba8352f2dbc38d655ec2cdd807c550d527b9f49822d",
+  "file_count": 1901,
+  "tree_sha256": "028f3591a335092742ce9ca6791ae17cc69d690bbe3895e09e10742a648eb04e",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -147,7 +147,7 @@
     {
       "path": ".claude/skills/goal-create/SKILL.md",
       "mode": "0000644",
-      "sha256": "e52032cb787f813a84e16a16c0ac75751ca111ad16f5502cf5f6bd8fb7a91068"
+      "sha256": "88494b0c9604992c43fb0efbb5d2cc34de51fd3645e7d65b22a65f0538e8f26f"
     },
     {
       "path": ".claude/skills/goal-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "f918564f73e753583651a8d963824c981cd82dc02d1e0d809d245e541219513e"
+      "sha256": "bebe9282f7f60c62dc554c24bbec1fb7c9a8453e98015d5207c3b70260bcbb56"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1277,7 +1277,7 @@
     {
       "path": "docs/adr/0161-publish-on-merge.md",
       "mode": "0000644",
-      "sha256": "056633fe7521143b0e8ba89297426ffd7253deb9ae5aa2fad65c3dfbffddc44f"
+      "sha256": "b625ad07227ce25f8fe082fa9ccd93d3d704fd726aceb967d1f43677e164239a"
     },
     {
       "path": "docs/adr/0162-review-gates-retired-rank-consistent-ci-only.md",
@@ -1382,7 +1382,7 @@
     {
       "path": "docs/adr/0180-dependency-intake-and-drift-policy.md",
       "mode": "0000644",
-      "sha256": "62de8180208c3945c7a040b2b2799dceafd59b1c5a117aab7db56a57eb538e44"
+      "sha256": "9d50f2f71de5c4eba8d5af40aca201c6e054b1eec937a9e1342d1bb3b4ce45c1"
     },
     {
       "path": "docs/adr/0181-teardown-state-gate-and-address-retention.md",
@@ -1477,7 +1477,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "ada26795f34a9ce26711b788abc87bf277c475aa14ee7bb1f92e9376f1e50cc8"
+      "sha256": "dbc90270a1754caf816ce9fde9cde35af21e977da08309f56c4d96dbf7cad9bf"
     },
     {
       "path": "docs/architecture.md",
@@ -1502,12 +1502,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "e2c301d24dae22625ba110dc671a5cfc861fd1ae4100bdefd0e563857279fc94"
+      "sha256": "23502315ff7f5e758ad3171a7bd28f8861ccb6640be93bd6a3a3f681c1ff0606"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "9e3b3f18ba94a2fd2fd35c02403aa45f3ff7a4dd5268dec720bb6b211666e6f9"
+      "sha256": "85ead9ad5f556a449495e0e7f7af09a29fb9e54e663ef3fbf9f1fe1c390bc8d6"
     },
     {
       "path": "docs/design-contract.md",
@@ -3522,7 +3522,7 @@
     {
       "path": "modules/hall-ui/public/dom-utils.js",
       "mode": "0000644",
-      "sha256": "ab48833410d7dc97bd2f0cd332d2ede95a632c87af50338bce660034e71d881a"
+      "sha256": "f0d0b87de9c678c3728c20eeb43818a39d35f2507b4b55ac58e2a4663ff2ceac"
     },
     {
       "path": "modules/hall-ui/public/drachmae.html",
@@ -3567,12 +3567,12 @@
     {
       "path": "modules/hall-ui/public/goals-page.js",
       "mode": "0000644",
-      "sha256": "d99cbf101ba10a46d7a612aadec417c31679a77b1deb5e02e1824dc1d8d52b5e"
+      "sha256": "0855874df7337e46cc17251dd98155f69eb3469c59a8622cfdcaf7aa4c3941e8"
     },
     {
       "path": "modules/hall-ui/public/goals-render.js",
       "mode": "0000644",
-      "sha256": "65bc90adc3eaf46c8aa38b1bcbf197fd17e302ef8128e1e8f8ff22f95fd28229"
+      "sha256": "52f00a63296f8f2068980d86e2bbd70a966d06da4b8adf42a7caa987a5a5704a"
     },
     {
       "path": "modules/hall-ui/public/goals.css",
@@ -3842,7 +3842,7 @@
     {
       "path": "modules/hall-ui/public/style.css",
       "mode": "0000644",
-      "sha256": "2c2f2196d75881495c8ba4dcec5e4e69bb78860e993ed3d22a8ee5299d250dcb"
+      "sha256": "316a9cc264946e81f554dbd882604ad11bcf63de8799fb74803dbcb4958edd3f"
     },
     {
       "path": "modules/hall-ui/public/task-detail.js",
@@ -3862,7 +3862,7 @@
     {
       "path": "modules/hall-ui/public/task.js",
       "mode": "0000644",
-      "sha256": "f2c4c154920e8f1019fb1628e187201e6e582ec61b04fa9fb9620be097f44b62"
+      "sha256": "8f0bec61f46b0d3317dda20e7a3de53653fdd39775076ed7287a75af0de881cc"
     },
     {
       "path": "modules/hall-ui/public/triumph.wav",
@@ -3897,7 +3897,7 @@
     {
       "path": "modules/hall-ui/public/work.js",
       "mode": "0000644",
-      "sha256": "296b44d30dfc32579518290316ee934f5abe652ecd481a057feee221de6eae9b"
+      "sha256": "5492625cba8e190637faee5bf74fbc868ecb2e6e21833d10dc8210cac7a19510"
     },
     {
       "path": "modules/ideas/CLAUDE.md",
@@ -4102,7 +4102,7 @@
     {
       "path": "modules/lifecycle/goal-category.js",
       "mode": "0000644",
-      "sha256": "6bc1bc0152900b49d79a6c09560020dc96ff5fae6c78d7dbb84d72dfed1953d2"
+      "sha256": "5b64317b3c687a08c80d0ebe78619b6b4bb8a9cdf4cf37673a0f29785fd5a7ca"
     },
     {
       "path": "modules/lifecycle/goal-conflicts.js",
@@ -4212,7 +4212,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "5e01d0da935758aa24c8f13d2f4e97d9f561c2b1044b326fb4184c5dbc4bf6fb"
+      "sha256": "db587e3a79c76671cdba1900bfdce156d62d0ef270319adb82a3b0805f3d091c"
     },
     {
       "path": "modules/lifecycle/routes/help-requests.js",
@@ -4902,12 +4902,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9013a462765ac09e02093fd322534183ef67983cba7fb17b01ffd9e514c904ba"
+      "sha256": "01e0ec5418014e61e5a0bdf1781ea84ee46c4c8bfc1b63b0e55bb6397ec06498"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "02ba6d7d5c371b3b07671bb84216d7a38a23b9ab97f3ab491d218fb31f9afa46"
+      "sha256": "f38add7db0b96f5b469c5127f7e06336ef5626edc93d61f797d3439e0ca51760"
     },
     {
       "path": "public-docs/index.html",
@@ -5367,7 +5367,7 @@
     {
       "path": "scripts/gds/bump-version.js",
       "mode": "0000644",
-      "sha256": "9709fcffab1d386c174666788687b1dfd974f141ab552ffd5641abd690259619"
+      "sha256": "7289ba7894edd4ae6154615f2464c55ee8c8835f3c61988dbad2354aaafeac2e"
     },
     {
       "path": "scripts/gds/capture.js",
@@ -6792,7 +6792,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "acc072cf951d0eb479345626f462425a47d7f8a0247db473375fa614f64e7589"
+      "sha256": "88ea06ed6759765c78ff0fc67ddd0a65041e7b8fda60e0f18b5809c44107ad7d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7217,7 +7217,7 @@
     {
       "path": "tests/bump_version.mjs",
       "mode": "0000644",
-      "sha256": "98ec16d513074b30de8cd897143e4a3df1b3e54132a09d015b99e13e870de384"
+      "sha256": "b7c9d529eba81e1e7ea11aaed734e3a30355483cf69972453c3bb03fdd3aab97"
     },
     {
       "path": "tests/cap_newcomer_tasks.mjs",
@@ -7767,7 +7767,12 @@
     {
       "path": "tests/goal_category.mjs",
       "mode": "0000644",
-      "sha256": "19e6987712231ac54e58c4b6658d12bb7df3d6681344bf358c38c1655243f058"
+      "sha256": "05d46d4dcfd3a3b21ef0fc258263081cf4e624bdef4348daf84a90da589387c3"
+    },
+    {
+      "path": "tests/goal_category_ui.mjs",
+      "mode": "0000644",
+      "sha256": "9da4d0762b665e5e622a3a26d754e13206da52ef591b14bf35e73da5e8c39317"
     },
     {
       "path": "tests/goal_cli.mjs",
@@ -7782,7 +7787,7 @@
     {
       "path": "tests/goal_criterion_confirm_ui.mjs",
       "mode": "0000644",
-      "sha256": "4f3979378f660463df2af31a3e56252ba839f6d63e70fd27441cf13fe05743f2"
+      "sha256": "b2d6774b93287654f0e5580bbc0a10b3fe4d0d24ec95236002770b2fcac702dc"
     },
     {
       "path": "tests/goal_dependencies_read.mjs",

package/.claude/skills/goal-create/SKILL.md

@@ -63,6 +63,7 @@ Everything here is your call. It is presented in Phase 4 as a proposal, not as q
 - **Title** — the outcome the goal owns, not a task list. One line.
 - **`description`** — 2–4 sentences: what is true when this goal is achieved, and what it explicitly does not cover.
 - **`scope_modules`** — infer from the planned work's file paths, then **verify every key against `moduleKeys()`**. An unknown key is a hard `400 unknown_module` (the response helpfully returns the full valid roster). Keep it tight: the wall is set here and only here. **No covering key?** Do not invent one — file a `kind='refactor'` prep task scoped to `kernel` to extend `MODULE_GLOBS`, and make this goal's tasks depend on it.
+- **`category_id`** — the goal's HUMAN category (task 1003277; ADR 0192 — advisory, it gates nothing). Read the live set with `GET /api/gds/work-categories` (never hard-code the labels), infer the best fit from the goal's outcome and its `scope_modules`, and state your pick in the Phase-4 approval round like every other drafted field. **When nothing in the set fits, that is a designed prompt, not an error**: do NOT silently pick the nearest, and do NOT leave it null and move on — surface the gap in the gray-area round and offer to create a new category (`POST /api/gds/work-categories` with `{"label":"..."}`; a duplicate slug converges on the existing row), then use it. Creating uncategorised stays legal — if the user declines to name one, POST the goal without `category_id` and note that the 201 body will carry a `category_advisory` reminding whoever looks next.
 - **`succeeds_goal_id`** — set it when carrying an achieved goal forward. `POST /goals` validates the predecessor exists *before* creating, so a bad ref can't orphan a goal; it then stamps the predecessor's `succeeded_by_goal_id`. Archiving the predecessor is a **separate** call.
 - **Criteria — 2 to 4.** A goal's criteria are narrower than a version's: each should plausibly anchor 2–5 tasks. Draft `criterion_id` as a stable kebab slug (position-independent, and what `criterion_ids` on `POST /tasks` should reference); `criterion_md` is the outcome prose.
 - **Seed tasks — 3 to 8.** Per criterion, with `kind`, a one-line done-when, `criterion_ids: ["<slug>"]`, and dependency edges. Omit `touches[]` (advisory, ADR 0049 — backfilled from the real diff at ship). Never hand-set `requires_rank` (auto-derives, ADR 0084). Proof tasks use `kind='verify'`; exploration uses `kind='spike'` (and spikes are deliberately left in backlog).
@@ -72,7 +73,7 @@ Everything here is your call. It is presented in Phase 4 as a proposal, not as q
 Two rounds at most, both via **AskUserQuestion**.
 
 1. **Gray-area round — at most one round, at most 4 questions, often zero.** A question earns its place only if the work is genuinely underspecified on it, reasonable people would disagree, **and** the answer changes the goal's shape. Put your recommendation first and leave room for "Other". Legitimate gray areas: where this goal's boundary falls against an adjacent one; whether a module belongs inside the wall or is a dependency; whether this succeeds a prior goal or replaces it; whether a criterion belongs to this goal or the version. **Do not ask** anything the goal board, the criteria list, or `moduleKeys()` already answers, and never ask a yes/no rubber-stamp.
-2. **The approval round — always exactly one, always last.** Present the goal (title · `scope_modules` · join policy · succeeds), the **numbered** criteria, and the seed-task table. Then one question: **Create it** / **Goal + criteria only** (skip the seed tasks) / **Edit first** / **Cancel**. Number the criteria so the user edits by number rather than by copy/paste.
+2. **The approval round — always exactly one, always last.** Present the goal (title · category · `scope_modules` · join policy · succeeds), the **numbered** criteria, and the seed-task table. Then one question: **Create it** / **Goal + criteria only** (skip the seed tasks) / **Edit first** / **Cancel**. Number the criteria so the user edits by number rather than by copy/paste.
 
 ## Phase 5 — Land it (write order: goal → criteria → tasks)
 
@@ -81,10 +82,12 @@ The order is forced: a criterion needs `goal_id`, a task needs both `goal_id` an
 > **Always `--body-file`, never inline `--body`, for anything carrying a title, description or criterion prose.** Those strings are authored in this session and routinely contain an apostrophe ("the builder's hall"), which terminates a single-quoted shell argument and corrupts the JSON — or, with a hostile string, runs whatever follows on the builder's machine. Write the body to a temp `.json` file and pass its path. On Windows also heed `scripts/gds/CLAUDE.md`: do **not** create that file with `Out-File`/`>` (the UTF-8 BOM breaks `JSON.parse`), and never pipe `api.js` through `2>&1` (its banner goes to stderr by design).
 
 ```
-# 5a — the goal. STRICT validation: exactly these five fields are accepted
-#      (version_id*, title*, description, scope_modules[], succeeds_goal_id).
+# 5a — the goal. STRICT validation: exactly these seven fields are accepted
+#      (version_id*, title*, subtitle, description, scope_modules[], succeeds_goal_id, category_id).
 #      ANY other key is a 400 unknown_field — do NOT pass criteria, tasks, lead or visibility.
-#   goal.json: {"version_id":"<ver>","title":"...","description":"...","scope_modules":["<key>"]}
+#   goal.json: {"version_id":"<ver>","title":"...","description":"...","scope_modules":["<key>"],"category_id":<id>}
+#   category_id comes from GET /api/gds/work-categories (task 1003277); omitting it is
+#   legal — the 201 body then carries a category_advisory, never a refusal.
 #   carry-forward: add "succeeds_goal_id":<prior_goal_id>
 node scripts/gds/api.js POST /api/gds/goals --body-file <path-to-goal.json>
 # → 201 {ok, goal, succeeds_goal_id}. CAPTURE goal.id.

package/clients/bongos-client/index.d.ts

@@ -252,7 +252,7 @@ export interface PostGoalsIdTransferResponse { ok: boolean; goal: unknown; chang
 export interface PostGoalsReorderRequest { version_id: string; ordered_ids: number[] }
 export interface PostGoalsReorderResponse { ok: boolean; goals: unknown }
 export interface PostGoalsRequest { version_id: string; title: string; subtitle?: string; description?: string; scope_modules?: string[]; succeeds_goal_id?: number; category_id?: number }
-export interface PostGoalsResponse { ok: boolean; goal: unknown; succeeds_goal_id: unknown }
+export interface PostGoalsResponse { ok: boolean; goal: unknown; succeeds_goal_id: unknown; category_advisory: unknown }
 export interface PostGovernmentAssignmentsRequest { builder_id: number; rank_key: string }
 export interface PostGovernmentBoardItemsItemIdVotesRequest { direction: string; reason_md?: string; section_key?: string }
 export interface PostGovernmentBoardItemsRequest { subject_type: string; proposal: Record<string, unknown>; rationale_md?: string; acknowledge_self_removal?: boolean }

package/docs/adr/0161-publish-on-merge.md

@@ -22,7 +22,7 @@ The consumption side (ADR 0136's subscription) was never the problem; supply was
 
 1. **Every merge to `main` publishes.** A `publish` workflow fires on the `unit` check succeeding on a main push (never on a red suite), builds via `package-core` — the fail-closed no-leak gate and `--self-verify` pin check run inside the build — publishes (restricted), and tags `core-v<version>`.
 2. **CI bumps PATCH only.** When a merge lands without a human bump, `scripts/gds/bump-version.js` bumps the patch and writes the changelog line (shape-preserving; pinned by `tests/bump_version.mjs`). A **minor or major stays a deliberate in-task human edit** — it is a statement about the doorway surface, and it decides what patch-channel subscribers receive unattended (ADR 0136). CI is not allowed to make that call.
-3. **Token custody reverses, knowingly.** A standing npm **write** Automation token (`NPM_TOKEN`) and a fine-grained **contents:write** PAT (`RELEASE_PUSH_TOKEN`, for the bump commit — the default `GITHUB_TOKEN` cannot push past the required `unit` check) live as GitHub Actions secrets. This is exactly the surface 0137 declined; the owner accepted it with the incidents as evidence. Mitigations: the lane is **default-inert** behind the repo variable `PUBLISH_ON_MERGE=1` (an owner kill-switch symmetrical to `gating.js`), packages publish `restricted`, and the no-leak gate structurally cannot upload a leaking artifact.
+3. **Token custody reverses, knowingly.** A standing npm **write** Automation token (`NPM_TOKEN`) and a fine-grained **contents:write** PAT (`RELEASE_PUSH_TOKEN`, for the bump commit — the default `GITHUB_TOKEN` cannot push past the required `unit` check) live as GitHub Actions secrets. This is exactly the surface 0137 declined; the owner accepted it with the incidents as evidence. **Superseded for the npm half at task 1003202 (2026-08-25):** the write token is gone — the lane publishes via OIDC trusted publishing (ADR 0180), so no long-lived npm credential exists to steal. `RELEASE_PUSH_TOKEN` remains, as the bump commit still needs contents:write. Mitigations: the lane is **default-inert** behind the repo variable `PUBLISH_ON_MERGE=1` (an owner kill-switch symmetrical to `gating.js`), packages publish `restricted`, and the no-leak gate structurally cannot upload a leaking artifact.
 4. **Idempotent by version-compare.** The bump commit re-triggers `unit` → `publish`, which then finds HEAD's version already on npm and no-ops. npm's duplicate-version rejection is the backstop; concurrent merges queue behind a no-cancel concurrency group.
 
 ## Consequences

package/docs/adr/0180-dependency-intake-and-drift-policy.md

@@ -31,6 +31,12 @@ The consensus post-Shai-Hulud control is a **release-age cooldown** (don't insta
 
 The publish-on-merge lane (ADR 0161) authenticates with a long-lived `NPM_TOKEN` repository secret — exactly the credential class the Sept-2025 attacks monetized, and why GitHub revoked classic tokens and capped granular ones at 90 days. Decision: **adopt npm trusted publishing (OIDC)** — no long-lived secret, provenance for free. It needs a one-time owner action on npmjs.com (register the repo+workflow as a trusted publisher for `@bongos/core`), filed as a blocker. **Until then** the granular `NPM_TOKEN` remains a *documented exception*: 90-day expiry, publish-only scope, rotated on expiry.
 
+> **Landed 2026-08-25 — task 1003202, blocker 1000115 resolved.** The owner registered the trusted publisher; `publish.yml` now carries `id-token: write` and publishes with no secret. Three things this needed that the decision above did not anticipate, each of which fails SILENTLY if missed:
+>
+> - **npm ≥ 11.5.1.** Node 22 ships npm 10.x, which ignores the OIDC token and publishes unauthenticated. The lane now installs a pinned npm and refuses to continue below that version.
+> - **Provenance had to be turned OFF.** Trusted publishing enables it by default and npm *refuses* to generate provenance from a **private source repository** — so the "provenance for free" clause above does not apply to this repo, and leaving the default would have failed every publish.
+> - **The registry could no longer answer "is this version taken?".** `@bongos/core` is private, so an unauthenticated `npm view` is a flat `E404` rather than a "no", and OIDC authenticates `npm publish` and nothing else. Keeping that check would have skipped the auto-bump on every run and collided on the published version — **breaking after exactly one release**. The lane now reads its own `release: core X.Y.Z` commits (`laneReleasedVersions`), which need no auth and are the source the cascade terminator already trusts.
+
 ## What this deliberately does not cover
 
 New-dependency *intake vetting* (registry existence/age/download checks — the slopsquatting defense) lives in the weekly patrol (task 1003128), and one-off vulnerability *fixes* (sharp ≥ 0.35 for the libvips CVEs, the colyseus chain for nanoid) are ordinary tasks that shrink the baseline — filed in the idea inbox at adoption time.

package/docs/api/openapi.json

@@ -18019,12 +18019,14 @@
             "type": "boolean"
           },
           "goal": {},
-          "succeeds_goal_id": {}
+          "succeeds_goal_id": {},
+          "category_advisory": {}
         },
         "required": [
           "ok",
           "goal",
-          "succeeds_goal_id"
+          "succeeds_goal_id",
+          "category_advisory"
         ]
       },
       "PostGovernmentAssignmentsRequest": {