@bongos/core 1.19.372 → 1.19.374

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.372",
-  "core_contract": "1.19.372",
-  "source_commit": "55e9c32ab7bdeda662fa00ca1ac329f7c9350f35",
+  "core_version": "1.19.374",
+  "core_contract": "1.19.374",
+  "source_commit": "ef487914ca1cc1439cbbe614d215ac0bcc4a7a11",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T22:14:48.327Z",
+  "built_at": "2026-08-25T22:31:01.224Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 334,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1545,
+    "functional_verbatim": 1549,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1901,
-  "tree_sha256": "d935d4f065823168da32ef35c6b17f66ecb8937ea59a28be97e7aafc26cfa39d",
+  "file_count": 1905,
+  "tree_sha256": "7a78e601f7e02412f566e605aed571ee145c0daa03911d7f8ad188e9369fd34f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -147,7 +147,7 @@
     {
       "path": ".claude/skills/goal-create/SKILL.md",
       "mode": "0000644",
-      "sha256": "e52032cb787f813a84e16a16c0ac75751ca111ad16f5502cf5f6bd8fb7a91068"
+      "sha256": "88494b0c9604992c43fb0efbb5d2cc34de51fd3645e7d65b22a65f0538e8f26f"
     },
     {
       "path": ".claude/skills/goal-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "fc26e581e9ba06ec9fd798e982539f0bd8dc4c27a5f6c248b395f62214daaf78"
+      "sha256": "4855d865dbe79d1d6b9d774c8cbf480c36c6a3eae28392845850efb0689a6997"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "e50696e5b7b9c1abab280665dd57ab6f8f8883d3bfd0f2701a45ee7d9a6fb728"
+      "sha256": "e5bde7c338fc07f45f8f58dec2fa8826c0ea11d85c33146c9b6e7bdcc7049ba2"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "b13e62181adbc47a9ba6d3349a4abcb63fca123f3b0202414a1f7a2ba5e7d088"
+      "sha256": "8f3092af15067a6ed54092a10b4d43cd64eda7ae8fec0e50fe43de91428c9157"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "f918564f73e753583651a8d963824c981cd82dc02d1e0d809d245e541219513e"
+      "sha256": "70cc0227b4003bf47a6942656c8ce652c9884022cee81006c0c73e552eec6361"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "d4f2e6c3b376c35679416efcd30bbe54bae396cbaa8ee1e4078c56b6175da3d4"
+      "sha256": "819100f31cb468e82a0f2684a0e16b5ae1252cf91ef30b1923398af968ee5170"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1277,7 +1277,7 @@
     {
       "path": "docs/adr/0161-publish-on-merge.md",
       "mode": "0000644",
-      "sha256": "056633fe7521143b0e8ba89297426ffd7253deb9ae5aa2fad65c3dfbffddc44f"
+      "sha256": "b625ad07227ce25f8fe082fa9ccd93d3d704fd726aceb967d1f43677e164239a"
     },
     {
       "path": "docs/adr/0162-review-gates-retired-rank-consistent-ci-only.md",
@@ -1382,7 +1382,7 @@
     {
       "path": "docs/adr/0180-dependency-intake-and-drift-policy.md",
       "mode": "0000644",
-      "sha256": "62de8180208c3945c7a040b2b2799dceafd59b1c5a117aab7db56a57eb538e44"
+      "sha256": "9d50f2f71de5c4eba8d5af40aca201c6e054b1eec937a9e1342d1bb3b4ce45c1"
     },
     {
       "path": "docs/adr/0181-teardown-state-gate-and-address-retention.md",
@@ -1472,12 +1472,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "544b25f700d89d7f51dd84cb4faa740bc1c9bb4bf52853470e7d645040215033"
+      "sha256": "5972f14220674de9bcb4fbcdbe6859f208555bf0adc3de70ccefd64544545344"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "ada26795f34a9ce26711b788abc87bf277c475aa14ee7bb1f92e9376f1e50cc8"
+      "sha256": "342d1060be381a873d917c47037097e9f2561546900c4ca16986aed10913c553"
     },
     {
       "path": "docs/architecture.md",
@@ -1502,12 +1502,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "23502315ff7f5e758ad3171a7bd28f8861ccb6640be93bd6a3a3f681c1ff0606"
+      "sha256": "5805bd8d2f443b028c4f6934ce1619254d3e6dc47f2ebc3f24ced87f5614066f"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "85ead9ad5f556a449495e0e7f7af09a29fb9e54e663ef3fbf9f1fe1c390bc8d6"
+      "sha256": "11839e3afac4b57f3a230f32bfa004a08ed34d0315ec94096cd0f83949b104a5"
     },
     {
       "path": "docs/design-contract.md",
@@ -2609,6 +2609,11 @@
       "mode": "0000644",
       "sha256": "5d79d4f6f0e24b0ae9731a31ebabadc43faa3b6a423d31800b664960dc16145c"
     },
+    {
+      "path": "modules/builder-settings/profile-nudge-prefs.js",
+      "mode": "0000644",
+      "sha256": "26935726b1b388fb90793145d22f95641b2222a7b8ee29b2ed418bb2725f9fba"
+    },
     {
       "path": "modules/builder-settings/render-prefs.js",
       "mode": "0000644",
@@ -2617,7 +2622,7 @@
     {
       "path": "modules/builder-settings/routes/settings.js",
       "mode": "0000644",
-      "sha256": "c5198a5fb915be1015eec09ca0b614c96d820fdf491cb56d1c735b8839a441c0"
+      "sha256": "e1de49abd66d5dece54d5a794bb1af28469028903b022f3d7b1e2c453ea0b851"
     },
     {
       "path": "modules/builder-settings/settings.js",
@@ -2907,7 +2912,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "b13e62181adbc47a9ba6d3349a4abcb63fca123f3b0202414a1f7a2ba5e7d088"
+      "sha256": "8f3092af15067a6ed54092a10b4d43cd64eda7ae8fec0e50fe43de91428c9157"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3557,7 +3562,7 @@
     {
       "path": "modules/hall-ui/public/goal-inbox.js",
       "mode": "0000644",
-      "sha256": "ede756a5c11c8c6a9eca4c841f2110a5e05293b0fbd6d34a5c90a05dc02943c4"
+      "sha256": "71836d70e751ea8c7363c3217931a2cdfaeea38b770b90e564baf69cfe75f40f"
     },
     {
       "path": "modules/hall-ui/public/goals-lib.js",
@@ -3667,7 +3672,7 @@
     {
       "path": "modules/hall-ui/public/index.html",
       "mode": "0000644",
-      "sha256": "6564fe67e5987fbc25a4dd84d0288302ddcd81050e6afa1e5ab1b1dea873c0d8"
+      "sha256": "78cb8c70e92e70d996a8f1694b7b01bf893f6aa3f210bc297e48cdd961b971ae"
     },
     {
       "path": "modules/hall-ui/public/md-reader.js",
@@ -3754,6 +3759,11 @@
       "mode": "0000644",
       "sha256": "40f6f44283aa7dba25a2c983d77b6e6f53f40eefef3394122d34f7f42fc5f676"
     },
+    {
+      "path": "modules/hall-ui/public/profile-nudge.js",
+      "mode": "0000644",
+      "sha256": "b86a8a2b12e30671cc00a4495fbc9789967d38622ce803f1ffc2d95ae45b7d03"
+    },
     {
       "path": "modules/hall-ui/public/profile.html",
       "mode": "0000644",
@@ -4102,7 +4112,7 @@
     {
       "path": "modules/lifecycle/goal-category.js",
       "mode": "0000644",
-      "sha256": "6bc1bc0152900b49d79a6c09560020dc96ff5fae6c78d7dbb84d72dfed1953d2"
+      "sha256": "5b64317b3c687a08c80d0ebe78619b6b4bb8a9cdf4cf37673a0f29785fd5a7ca"
     },
     {
       "path": "modules/lifecycle/goal-conflicts.js",
@@ -4212,7 +4222,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "5e01d0da935758aa24c8f13d2f4e97d9f561c2b1044b326fb4184c5dbc4bf6fb"
+      "sha256": "db587e3a79c76671cdba1900bfdce156d62d0ef270319adb82a3b0805f3d091c"
     },
     {
       "path": "modules/lifecycle/routes/help-requests.js",
@@ -4902,12 +4912,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2f3c61f9360a509a95f00a50e5b297f727fa3ad9a0eb4dc60d237c7367c82962"
+      "sha256": "eb5cb1b57d8467f5d70ced6de47f1963a802fe5ae00bbaf960befcf5000efa75"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f3dca0d69c0457b6ff3a4fcc16f01eedb758732e5e2fec7f5cfe65c82782b2df"
+      "sha256": "61856d92a07e11bb5aa53a7ab2be103c7cf31e555a616086f603fdea79485344"
     },
     {
       "path": "public-docs/index.html",
@@ -5367,7 +5377,7 @@
     {
       "path": "scripts/gds/bump-version.js",
       "mode": "0000644",
-      "sha256": "9709fcffab1d386c174666788687b1dfd974f141ab552ffd5641abd690259619"
+      "sha256": "7289ba7894edd4ae6154615f2464c55ee8c8835f3c61988dbad2354aaafeac2e"
     },
     {
       "path": "scripts/gds/capture.js",
@@ -5587,7 +5597,7 @@
     {
       "path": "scripts/gds/fitness-checks-write-validation.js",
       "mode": "0000644",
-      "sha256": "7ee041817c06a56d4801f4367a618384ad856235a5034d3abdafa9f9344bff0b"
+      "sha256": "7501680e8b657a1002c185750951f16af1b2e7e30c04c72a3f03a94d286e02c4"
     },
     {
       "path": "scripts/gds/fitness-lib.js",
@@ -6257,7 +6267,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "e091557b4cc29c081cb82f9cd650b4c110f1dede4e72b704893f8397cd7bbaf2"
+      "sha256": "72efd4268060fb5ddf8a176d91baf01353dc1e82594d70feef029c45f748d8f9"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -6792,7 +6802,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d5baf1741759cab821c57eb5c9b701e4e256838612b81835102c6286447f884e"
+      "sha256": "abace193194919c4b75a9c461890b24be8e8c06093311c956c91894305980725"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7217,7 +7227,7 @@
     {
       "path": "tests/bump_version.mjs",
       "mode": "0000644",
-      "sha256": "98ec16d513074b30de8cd897143e4a3df1b3e54132a09d015b99e13e870de384"
+      "sha256": "b7c9d529eba81e1e7ea11aaed734e3a30355483cf69972453c3bb03fdd3aab97"
     },
     {
       "path": "tests/cap_newcomer_tasks.mjs",
@@ -7767,7 +7777,7 @@
     {
       "path": "tests/goal_category.mjs",
       "mode": "0000644",
-      "sha256": "19e6987712231ac54e58c4b6658d12bb7df3d6681344bf358c38c1655243f058"
+      "sha256": "05d46d4dcfd3a3b21ef0fc258263081cf4e624bdef4348daf84a90da589387c3"
     },
     {
       "path": "tests/goal_category_ui.mjs",
@@ -8704,6 +8714,11 @@
       "mode": "0000644",
       "sha256": "ff73579dd2416a81648d85dcd5d1a77cb776c32047bd0cc7897dff132cbae5b7"
     },
+    {
+      "path": "tests/profile_nudge_prefs.mjs",
+      "mode": "0000644",
+      "sha256": "a7f70fa612494593438565f4bd1e3d454a3dbca862c8396a7dcb252d38e3e489"
+    },
     {
       "path": "tests/profile_rollup_consent.mjs",
       "mode": "0000644",
@@ -9219,6 +9234,11 @@
       "mode": "0000644",
       "sha256": "5c0d5961408ac202eb53fe648c4c8b00e5552b231b35f39a39e006b705cb34f1"
     },
+    {
+      "path": "tests/ship_push_diagnosis.mjs",
+      "mode": "0000644",
+      "sha256": "d69bad6c8b3a01434b4fd5230f2b781bbe7fd9938df3d96b2a4ef34906287e54"
+    },
     {
       "path": "tests/ship_resume.mjs",
       "mode": "0000644",
@@ -9292,7 +9312,7 @@
     {
       "path": "tests/sound_player.mjs",
       "mode": "0000644",
-      "sha256": "42398e730349be5f10e07eb3ec42aa47c9a024371f2f95f96802b990ff0e6f80"
+      "sha256": "5b42ae4236e203c69feb3b8885ebec3a5f2b0d7f6880128536dfe5b8088fd4e8"
     },
     {
       "path": "tests/sound_prefs.mjs",

package/.claude/skills/goal-create/SKILL.md

@@ -63,6 +63,7 @@ Everything here is your call. It is presented in Phase 4 as a proposal, not as q
 - **Title** — the outcome the goal owns, not a task list. One line.
 - **`description`** — 2–4 sentences: what is true when this goal is achieved, and what it explicitly does not cover.
 - **`scope_modules`** — infer from the planned work's file paths, then **verify every key against `moduleKeys()`**. An unknown key is a hard `400 unknown_module` (the response helpfully returns the full valid roster). Keep it tight: the wall is set here and only here. **No covering key?** Do not invent one — file a `kind='refactor'` prep task scoped to `kernel` to extend `MODULE_GLOBS`, and make this goal's tasks depend on it.
+- **`category_id`** — the goal's HUMAN category (task 1003277; ADR 0192 — advisory, it gates nothing). Read the live set with `GET /api/gds/work-categories` (never hard-code the labels), infer the best fit from the goal's outcome and its `scope_modules`, and state your pick in the Phase-4 approval round like every other drafted field. **When nothing in the set fits, that is a designed prompt, not an error**: do NOT silently pick the nearest, and do NOT leave it null and move on — surface the gap in the gray-area round and offer to create a new category (`POST /api/gds/work-categories` with `{"label":"..."}`; a duplicate slug converges on the existing row), then use it. Creating uncategorised stays legal — if the user declines to name one, POST the goal without `category_id` and note that the 201 body will carry a `category_advisory` reminding whoever looks next.
 - **`succeeds_goal_id`** — set it when carrying an achieved goal forward. `POST /goals` validates the predecessor exists *before* creating, so a bad ref can't orphan a goal; it then stamps the predecessor's `succeeded_by_goal_id`. Archiving the predecessor is a **separate** call.
 - **Criteria — 2 to 4.** A goal's criteria are narrower than a version's: each should plausibly anchor 2–5 tasks. Draft `criterion_id` as a stable kebab slug (position-independent, and what `criterion_ids` on `POST /tasks` should reference); `criterion_md` is the outcome prose.
 - **Seed tasks — 3 to 8.** Per criterion, with `kind`, a one-line done-when, `criterion_ids: ["<slug>"]`, and dependency edges. Omit `touches[]` (advisory, ADR 0049 — backfilled from the real diff at ship). Never hand-set `requires_rank` (auto-derives, ADR 0084). Proof tasks use `kind='verify'`; exploration uses `kind='spike'` (and spikes are deliberately left in backlog).
@@ -72,7 +73,7 @@ Everything here is your call. It is presented in Phase 4 as a proposal, not as q
 Two rounds at most, both via **AskUserQuestion**.
 
 1. **Gray-area round — at most one round, at most 4 questions, often zero.** A question earns its place only if the work is genuinely underspecified on it, reasonable people would disagree, **and** the answer changes the goal's shape. Put your recommendation first and leave room for "Other". Legitimate gray areas: where this goal's boundary falls against an adjacent one; whether a module belongs inside the wall or is a dependency; whether this succeeds a prior goal or replaces it; whether a criterion belongs to this goal or the version. **Do not ask** anything the goal board, the criteria list, or `moduleKeys()` already answers, and never ask a yes/no rubber-stamp.
-2. **The approval round — always exactly one, always last.** Present the goal (title · `scope_modules` · join policy · succeeds), the **numbered** criteria, and the seed-task table. Then one question: **Create it** / **Goal + criteria only** (skip the seed tasks) / **Edit first** / **Cancel**. Number the criteria so the user edits by number rather than by copy/paste.
+2. **The approval round — always exactly one, always last.** Present the goal (title · category · `scope_modules` · join policy · succeeds), the **numbered** criteria, and the seed-task table. Then one question: **Create it** / **Goal + criteria only** (skip the seed tasks) / **Edit first** / **Cancel**. Number the criteria so the user edits by number rather than by copy/paste.
 
 ## Phase 5 — Land it (write order: goal → criteria → tasks)
 
@@ -81,10 +82,12 @@ The order is forced: a criterion needs `goal_id`, a task needs both `goal_id` an
 > **Always `--body-file`, never inline `--body`, for anything carrying a title, description or criterion prose.** Those strings are authored in this session and routinely contain an apostrophe ("the builder's hall"), which terminates a single-quoted shell argument and corrupts the JSON — or, with a hostile string, runs whatever follows on the builder's machine. Write the body to a temp `.json` file and pass its path. On Windows also heed `scripts/gds/CLAUDE.md`: do **not** create that file with `Out-File`/`>` (the UTF-8 BOM breaks `JSON.parse`), and never pipe `api.js` through `2>&1` (its banner goes to stderr by design).
 
 ```
-# 5a — the goal. STRICT validation: exactly these five fields are accepted
-#      (version_id*, title*, description, scope_modules[], succeeds_goal_id).
+# 5a — the goal. STRICT validation: exactly these seven fields are accepted
+#      (version_id*, title*, subtitle, description, scope_modules[], succeeds_goal_id, category_id).
 #      ANY other key is a 400 unknown_field — do NOT pass criteria, tasks, lead or visibility.
-#   goal.json: {"version_id":"<ver>","title":"...","description":"...","scope_modules":["<key>"]}
+#   goal.json: {"version_id":"<ver>","title":"...","description":"...","scope_modules":["<key>"],"category_id":<id>}
+#   category_id comes from GET /api/gds/work-categories (task 1003277); omitting it is
+#   legal — the 201 body then carries a category_advisory, never a refusal.
 #   carry-forward: add "succeeds_goal_id":<prior_goal_id>
 node scripts/gds/api.js POST /api/gds/goals --body-file <path-to-goal.json>
 # → 201 {ok, goal, succeeds_goal_id}. CAPTURE goal.id.

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 318 operations across 52 resource groups
+- 320 operations across 52 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -501,6 +501,10 @@ function createClient(opts = {}) {
       patchMeModelAllocation: (args) => request("PATCH", "/me/model-allocation", { hasBody: true }, args),
       // PATCH /me/profile — rank: any-builder — PATCH /me/profile
       patchMeProfile: (args) => request("PATCH", "/me/profile", { hasBody: true }, args),
+      // GET /me/profile-nudge — rank: any-builder — GET /me/profile-nudge
+      getMeProfileNudge: (args) => request("GET", "/me/profile-nudge", { hasBody: false }, args),
+      // PATCH /me/profile-nudge — rank: any-builder — PATCH /me/profile-nudge
+      patchMeProfileNudge: (args) => request("PATCH", "/me/profile-nudge", { hasBody: true }, args),
       // GET /me/recent-ships — rank: any-builder — GET /me/recent-ships
       getMeRecentShips: (args) => request("GET", "/me/recent-ships", { hasBody: false }, args),
       // GET /me/render — rank: any-builder — GET /me/render

package/clients/bongos-client/index.cjs

@@ -500,6 +500,10 @@ function createClient(opts = {}) {
       patchMeModelAllocation: (args) => request("PATCH", "/me/model-allocation", { hasBody: true }, args),
       // PATCH /me/profile — rank: any-builder — PATCH /me/profile
       patchMeProfile: (args) => request("PATCH", "/me/profile", { hasBody: true }, args),
+      // GET /me/profile-nudge — rank: any-builder — GET /me/profile-nudge
+      getMeProfileNudge: (args) => request("GET", "/me/profile-nudge", { hasBody: false }, args),
+      // PATCH /me/profile-nudge — rank: any-builder — PATCH /me/profile-nudge
+      patchMeProfileNudge: (args) => request("PATCH", "/me/profile-nudge", { hasBody: true }, args),
       // GET /me/recent-ships — rank: any-builder — GET /me/recent-ships
       getMeRecentShips: (args) => request("GET", "/me/recent-ships", { hasBody: false }, args),
       // GET /me/render — rank: any-builder — GET /me/render

package/clients/bongos-client/index.d.ts

@@ -252,7 +252,7 @@ export interface PostGoalsIdTransferResponse { ok: boolean; goal: unknown; chang
 export interface PostGoalsReorderRequest { version_id: string; ordered_ids: number[] }
 export interface PostGoalsReorderResponse { ok: boolean; goals: unknown }
 export interface PostGoalsRequest { version_id: string; title: string; subtitle?: string; description?: string; scope_modules?: string[]; succeeds_goal_id?: number; category_id?: number }
-export interface PostGoalsResponse { ok: boolean; goal: unknown; succeeds_goal_id: unknown }
+export interface PostGoalsResponse { ok: boolean; goal: unknown; succeeds_goal_id: unknown; category_advisory: unknown }
 export interface PostGovernmentAssignmentsRequest { builder_id: number; rank_key: string }
 export interface PostGovernmentBoardItemsItemIdVotesRequest { direction: string; reason_md?: string; section_key?: string }
 export interface PostGovernmentBoardItemsRequest { subject_type: string; proposal: Record<string, unknown>; rationale_md?: string; acknowledge_self_removal?: boolean }
@@ -787,6 +787,10 @@ export interface BongosClient {
     patchMeModelAllocation(args?: RequestArgs): Promise<ApiResponse>;
     /** PATCH /me/profile — rank: any-builder */
     patchMeProfile(args?: RequestArgs & { body?: PatchMeProfileRequest }): Promise<PatchMeProfileResponse>;
+    /** GET /me/profile-nudge — rank: any-builder */
+    getMeProfileNudge(args?: RequestArgs): Promise<ApiResponse>;
+    /** PATCH /me/profile-nudge — rank: any-builder */
+    patchMeProfileNudge(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /me/recent-ships — rank: any-builder */
     getMeRecentShips(args?: RequestArgs): Promise<GetMeRecentShipsResponse>;
     /** GET /me/render — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -497,6 +497,10 @@ export function createClient(opts = {}) {
       patchMeModelAllocation: (args) => request("PATCH", "/me/model-allocation", { hasBody: true }, args),
       // PATCH /me/profile — rank: any-builder — PATCH /me/profile
       patchMeProfile: (args) => request("PATCH", "/me/profile", { hasBody: true }, args),
+      // GET /me/profile-nudge — rank: any-builder — GET /me/profile-nudge
+      getMeProfileNudge: (args) => request("GET", "/me/profile-nudge", { hasBody: false }, args),
+      // PATCH /me/profile-nudge — rank: any-builder — PATCH /me/profile-nudge
+      patchMeProfileNudge: (args) => request("PATCH", "/me/profile-nudge", { hasBody: true }, args),
       // GET /me/recent-ships — rank: any-builder — GET /me/recent-ships
       getMeRecentShips: (args) => request("GET", "/me/recent-ships", { hasBody: false }, args),
       // GET /me/render — rank: any-builder — GET /me/render

package/docs/adr/0161-publish-on-merge.md

@@ -22,7 +22,7 @@ The consumption side (ADR 0136's subscription) was never the problem; supply was
 
 1. **Every merge to `main` publishes.** A `publish` workflow fires on the `unit` check succeeding on a main push (never on a red suite), builds via `package-core` — the fail-closed no-leak gate and `--self-verify` pin check run inside the build — publishes (restricted), and tags `core-v<version>`.
 2. **CI bumps PATCH only.** When a merge lands without a human bump, `scripts/gds/bump-version.js` bumps the patch and writes the changelog line (shape-preserving; pinned by `tests/bump_version.mjs`). A **minor or major stays a deliberate in-task human edit** — it is a statement about the doorway surface, and it decides what patch-channel subscribers receive unattended (ADR 0136). CI is not allowed to make that call.
-3. **Token custody reverses, knowingly.** A standing npm **write** Automation token (`NPM_TOKEN`) and a fine-grained **contents:write** PAT (`RELEASE_PUSH_TOKEN`, for the bump commit — the default `GITHUB_TOKEN` cannot push past the required `unit` check) live as GitHub Actions secrets. This is exactly the surface 0137 declined; the owner accepted it with the incidents as evidence. Mitigations: the lane is **default-inert** behind the repo variable `PUBLISH_ON_MERGE=1` (an owner kill-switch symmetrical to `gating.js`), packages publish `restricted`, and the no-leak gate structurally cannot upload a leaking artifact.
+3. **Token custody reverses, knowingly.** A standing npm **write** Automation token (`NPM_TOKEN`) and a fine-grained **contents:write** PAT (`RELEASE_PUSH_TOKEN`, for the bump commit — the default `GITHUB_TOKEN` cannot push past the required `unit` check) live as GitHub Actions secrets. This is exactly the surface 0137 declined; the owner accepted it with the incidents as evidence. **Superseded for the npm half at task 1003202 (2026-08-25):** the write token is gone — the lane publishes via OIDC trusted publishing (ADR 0180), so no long-lived npm credential exists to steal. `RELEASE_PUSH_TOKEN` remains, as the bump commit still needs contents:write. Mitigations: the lane is **default-inert** behind the repo variable `PUBLISH_ON_MERGE=1` (an owner kill-switch symmetrical to `gating.js`), packages publish `restricted`, and the no-leak gate structurally cannot upload a leaking artifact.
 4. **Idempotent by version-compare.** The bump commit re-triggers `unit` → `publish`, which then finds HEAD's version already on npm and no-ops. npm's duplicate-version rejection is the backstop; concurrent merges queue behind a no-cancel concurrency group.
 
 ## Consequences

package/docs/adr/0180-dependency-intake-and-drift-policy.md

@@ -31,6 +31,12 @@ The consensus post-Shai-Hulud control is a **release-age cooldown** (don't insta
 
 The publish-on-merge lane (ADR 0161) authenticates with a long-lived `NPM_TOKEN` repository secret — exactly the credential class the Sept-2025 attacks monetized, and why GitHub revoked classic tokens and capped granular ones at 90 days. Decision: **adopt npm trusted publishing (OIDC)** — no long-lived secret, provenance for free. It needs a one-time owner action on npmjs.com (register the repo+workflow as a trusted publisher for `@bongos/core`), filed as a blocker. **Until then** the granular `NPM_TOKEN` remains a *documented exception*: 90-day expiry, publish-only scope, rotated on expiry.
 
+> **Landed 2026-08-25 — task 1003202, blocker 1000115 resolved.** The owner registered the trusted publisher; `publish.yml` now carries `id-token: write` and publishes with no secret. Three things this needed that the decision above did not anticipate, each of which fails SILENTLY if missed:
+>
+> - **npm ≥ 11.5.1.** Node 22 ships npm 10.x, which ignores the OIDC token and publishes unauthenticated. The lane now installs a pinned npm and refuses to continue below that version.
+> - **Provenance had to be turned OFF.** Trusted publishing enables it by default and npm *refuses* to generate provenance from a **private source repository** — so the "provenance for free" clause above does not apply to this repo, and leaving the default would have failed every publish.
+> - **The registry could no longer answer "is this version taken?".** `@bongos/core` is private, so an unauthenticated `npm view` is a flat `E404` rather than a "no", and OIDC authenticates `npm publish` and nothing else. Keeping that check would have skipped the auto-bump on every run and collided on the published version — **breaking after exactly one release**. The lane now reads its own `release: core X.Y.Z` commits (`laneReleasedVersions`), which need no auth and are the source the cascade terminator already trusts.
+
 ## What this deliberately does not cover
 
 New-dependency *intake vetting* (registry existence/age/download checks — the slopsquatting defense) lives in the weekly patrol (task 1003128), and one-off vulnerability *fixes* (sharp ≥ 0.35 for the libvips CVEs, the colyseus chain for nanoid) are ordinary tasks that shrink the baseline — filed in the idea inbox at adoption time.

package/docs/api/openapi.json

@@ -8204,6 +8204,79 @@
         ]
       }
     },
+    "/me/profile-nudge": {
+      "get": {
+        "operationId": "get_me_profile_nudge",
+        "tags": [
+          "me"
+        ],
+        "summary": "GET /me/profile-nudge",
+        "description": "The \"Complete your profile\" nudge dismissal (task 1002802 / P06). The nudge itself is a DISMISSIBLE line item in the hall's needs-attention inbox — the replacement for the profile-setup wizard Decision 2 rejected. These two routes own only the dismissal FLAG; whether anything is actually missing is composed by the caller, which already holds both inputs (preferred_disciplines from GET /me, bio from GET /me/cross-project — bio lives on the platform identity account, and this module must never reach across to that one). rank: any-builder — own profile config; same posture as /me/render.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/builder-settings/routes/settings.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "patch": {
+        "operationId": "patch_me_profile_nudge",
+        "tags": [
+          "me"
+        ],
+        "summary": "PATCH /me/profile-nudge",
+        "description": "PATCH the dismissal. Body: { dismissed: <bool> | null } — null clears the override so the nudge can come back (the undismiss path). Sibling behavior keys are preserved by applyPatch.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/builder-settings/routes/settings.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "additionalProperties": true
+              }
+            }
+          },
+          "x-validated": false,
+          "x-body-undocumented": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me/recent-ships": {
       "get": {
         "operationId": "get_me_recent_ships",
@@ -18019,12 +18092,14 @@
             "type": "boolean"
           },
           "goal": {},
-          "succeeds_goal_id": {}
+          "succeeds_goal_id": {},
+          "category_advisory": {}
         },
         "required": [
           "ok",
           "goal",
-          "succeeds_goal_id"
+          "succeeds_goal_id",
+          "category_advisory"
         ]
       },
       "PostGovernmentAssignmentsRequest": {
@@ -20077,9 +20152,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 318,
+  "x-endpoint-count": 320,
   "x-schema-count": 353,
-  "x-undocumented-bodies": 8,
+  "x-undocumented-bodies": 9,
   "x-response-schemas": 237,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 318 endpoints across 52 route files.
+> **Generated from the live route files** — the route file is authoritative. 320 endpoints across 52 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -327,7 +327,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/llm-cache/lookup` | `metic+archon` | `cache_key`, `tokens_saved_est` | POST /llm-cache/lookup — hit/miss + atomic hit_count bump. |
 | POST | `/api/bongos/llm-cache/store` | `metic+archon` | `spec`, `result_stdout`, `result_cost_usd` | POST /llm-cache/store — upsert a freshly-produced result. |
 
-## `me` (25)
+## `me` (27)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -347,6 +347,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/me/model-allocation` | `any-builder` | — |  |
 | PATCH | `/api/bongos/me/model-allocation` | `any-builder` | _undocumented_ | PATCH the model allocation. |
 | PATCH | `/api/bongos/me/profile` | `any-builder` | `display_name`, `bio`, `links` | the caller's OWN profile fields (P02, task 1002798; spec Decision 4): bio, typed links, account display name. |
+| GET | `/api/bongos/me/profile-nudge` | `any-builder` | — | The "Complete your profile" nudge dismissal (task 1002802 / P06). |
+| PATCH | `/api/bongos/me/profile-nudge` | `any-builder` | _undocumented_ | PATCH the dismissal. |
 | GET | `/api/bongos/me/recent-ships` | `any-builder` | — | Tasks this builder has shipped, most recent first. |
 | GET | `/api/bongos/me/render` | `any-builder` | — | Per-builder "render widgets" knob (task 1279, shares the behavior_prefs jsonb / migration 119). |
 | PATCH | `/api/bongos/me/render` | `any-builder` | _undocumented_ | PATCH the render knob. |
@@ -587,5 +589,5 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 ---
 
-> 8 write endpoint(s) take a JSON body with no declared validator schema — their fields are not yet machine-documented. Adding a `validateOrRespond` schema (`src/bongos/routes/_helpers.js`) surfaces them here automatically.
+> 9 write endpoint(s) take a JSON body with no declared validator schema — their fields are not yet machine-documented. Adding a `validateOrRespond` schema (`src/bongos/routes/_helpers.js`) surfaces them here automatically.
 

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**1400 strings** across 3 surfaces · 1241 distinct pieces of copy · 1400 certain, 0 heuristic · 129 shown in more than one place.
+**1403 strings** across 3 surfaces · 1244 distinct pieces of copy · 1403 certain, 0 heuristic · 129 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 70 | 1110 |
+| `builders-hall` | `modules/hall-ui/public` | 71 | 1113 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 98 |
 | `landing` | `public-landing` | 2 | 192 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `3837f6d586a3` | 2x | Copy the task prompt to your clipboard | modules/hall-ui/public/goals-render.js:266, modules/hall-ui/public/work.js:362 |
 | … | | _89 more in the JSON registry_ | |
 
-## `builders-hall` — 1110 strings
+## `builders-hall` — 1113 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -136,6 +136,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1136` |
 | `6ca31dd5eb91` | certain | Acknowledge the primer | `modules/hall-ui/public/primer.html:65` |
 | `4461b13f95c2` | certain | Actions apply at once. Closing stops and deletes the box; you can start a fresh one anytime. | `modules/hall-ui/public/settings.html:162` |
+| `62eded408097` | certain | Add {…} | `modules/hall-ui/public/profile-nudge.js:68` |
 | `7cf0163d4cde` | certain | Aggregate totals across every recorded work session. | `modules/hall-ui/public/sessions.html:35` |
 | `8b736e365191` | certain | All builders | `modules/hall-ui/public/hall-render.js:998` |
 | `b5e03617b319` | certain | All goals | `modules/hall-ui/public/goals.html:41` |
@@ -238,6 +239,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `530d83153e17` | certain | Codebase detail | `modules/hall-ui/public/atlas.html:41` |
 | `c72c97dc33fe` | certain | Collab — {{worldName}} | `modules/hall-ui/public/collab.html:6` |
 | `c72c97dc33fe` | certain | Collab — {{worldName}} | `modules/hall-ui/public/collab.html:6` |
+| `cfc287c42263` | certain | Complete your profile | `modules/hall-ui/public/profile-nudge.js:62` |
 | `2867c85d196d` | certain | Confirm that verification for #{…} actually passed? | `modules/hall-ui/public/task.js:327` |
 | `9b16a22bf24c` | certain | Connect Discord & join the server | `modules/hall-ui/public/hall-render.js:814` |
 | `9b16a22bf24c` | certain | Connect Discord & join the server | `modules/hall-ui/public/settings.js:826` |
@@ -770,6 +772,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `14d32a35c15f` | certain | Show my cross-project record | `modules/hall-ui/public/settings.js:579` |
 | `dc0f9fe50a65` | certain | Show the setup guide again | `modules/hall-ui/public/index.html:55` |
 | `2af4c0f2b4b9` | certain | Showing {…} of {…}. | `modules/hall-ui/public/ideas.js:369` |
+| `838b17fa8d93` | certain | Shown on your public profile — it helps others know what you work on. | `modules/hall-ui/public/profile-nudge.js:69` |
 | `2f12d46f96ca` | certain | Sign in from the app. | `modules/hall-ui/public/hall-render.js:609` |
 | `19ab56cc3932` | certain | Sign in to filter to your goals | `modules/hall-ui/public/goals-page.js:821` |
 | `b057dfbf49c5` | certain | Sign in when Claude prompts you. | `modules/hall-ui/public/hall-render.js:609` |