@bongos/core 1.19.460 → 1.19.462

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.460",
-  "core_contract": "1.19.460",
-  "source_commit": "c2ea4f63dfdbd929a580a033ece0bf441c3afb0f",
+  "core_version": "1.19.462",
+  "core_contract": "1.19.462",
+  "source_commit": "5a6c95f3a72c1ce7545fae6790a64a9350e51421",
   "source_ref": "HEAD",
-  "built_at": "2026-09-01T23:28:32.235Z",
+  "built_at": "2026-09-02T00:41:58.939Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 375,
+    "docs_redacted": 400,
     "agent_docs_stubbed": 24,
     "functional_verbatim": 1816,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2215,
-  "tree_sha256": "ad6bb33206bdeba3371e60aa581ad07835b015c0decaf217a57aa321c61eb294",
+  "file_count": 2240,
+  "tree_sha256": "5374e542955404a28c6fca59d1b6a97bb38c97bf041d54ee23d33fc042b2c1d8",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -127,7 +127,7 @@
     {
       "path": ".claude/skills/design/SKILL.md",
       "mode": "0000644",
-      "sha256": "456811a0542cad25489519d2b4edda6a712abba284b2dc81a61bd6aa2747e93d"
+      "sha256": "c1ed5d4eaffffde255ac3308490d86f0235b9ab66a9349684652bb3eae82ae57"
     },
     {
       "path": ".claude/skills/dev/SKILL.md",
@@ -1604,10 +1604,20 @@
       "mode": "0000644",
       "sha256": "9ae416852dc8112a2cea4837e4a25b29338dbddecee0903830bcf5132645274d"
     },
+    {
+      "path": "docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md",
+      "mode": "0000644",
+      "sha256": "8e121001f8ff3f854c5efe461aabb17dc4f81e49ca262b2cadf4717c49b11bb0"
+    },
+    {
+      "path": "docs/adr/0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md",
+      "mode": "0000644",
+      "sha256": "aed01aaa88a3deb1fbf15a1183f07954db0c7867272e7c6bd9dd0b74327c6c34"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "bfae4edac49cb9ff0d29e2e6e275efbc07ecbd668b2375fcbafcbb28f36defa6"
+      "sha256": "f27631d3aa68cf8855420f62c4de01dd0c817d3b014e738fa1579bf92bfa16a3"
     },
     {
       "path": "docs/api-reference.md",
@@ -2087,7 +2097,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "d1c5ac472fbd4cf9d4174da9ded7c63427226346cda4b44ae70276c438df909a"
+      "sha256": "dfa54c74d708e6e1375c57eb28cbe638ac5396cbbb42aad438801a47e886f72a"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2097,7 +2107,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f4daedbcf1117a2205a90a2b32d0476ca63c94142ac7c92596cc9f459be33a63"
+      "sha256": "6dcd4c63eea2f0929fb8523047a2c91ef718040f5df303e2f9fe80adae51b400"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6337,7 +6347,7 @@
     {
       "path": "modules/ui-design/module.json",
       "mode": "0000644",
-      "sha256": "1dedeb68927743a51b048b7d3f70ea939958fcfe3831b22c4120d53d78beb2f8"
+      "sha256": "1b7e099867d2ecb1f752652a8e765fd421f87786847d0fe39527f2aa320b5167"
     },
     {
       "path": "modules/ui-design/scripts/design-sync.js",
@@ -6357,18 +6367,133 @@
     {
       "path": "modules/ui-design/skills/PREAMBLE.md",
       "mode": "0000644",
-      "sha256": "aa96d856793c1e804a90f40c498cff6143f2b5fee80dd5f840422cc6f1230644"
+      "sha256": "ecb2539b28bb7dfce1554d6b2416afc91cb1d548c9aca6cd5f7e86e0cd1c7549"
     },
     {
       "path": "modules/ui-design/skills/README.md",
       "mode": "0000644",
-      "sha256": "0f7045426ad746ec98f6cf16ba0e2bf5c8ee573de9907dbc93676eac7d43d7b6"
+      "sha256": "29d570739f8b22fa030631ae623a78c2676d4dcd8f94bbf40674617b8414a7da"
+    },
+    {
+      "path": "modules/ui-design/skills/design-taste-frontend-v1/SKILL.md",
+      "mode": "0000644",
+      "sha256": "5e461056c3e6fa4775cc6734b55bf6d5c050f01e0ee7a52378a9f4ab5501da28"
+    },
+    {
+      "path": "modules/ui-design/skills/design-taste-frontend/SKILL.md",
+      "mode": "0000644",
+      "sha256": "ee07bdde8e388b2863431673390d4bff74ee1296920ebcb07b529060eb7f8959"
+    },
+    {
+      "path": "modules/ui-design/skills/high-end-visual-design/SKILL.md",
+      "mode": "0000644",
+      "sha256": "eeb33e0a2d0a227d23b67c5e6d32c5757d8d5d7249a1a6d0fe3c67d8bd95fc91"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/SKILL.md",
+      "mode": "0000644",
+      "sha256": "b82bde6df7fd759d57c11e072a427bf5e88f9558deb8ce746b89fa031d06d051"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/adapt.md",
+      "mode": "0000644",
+      "sha256": "2721796c15d32d123d8585ec544614455d7992a9d62055edc90742cf14c75c29"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/animate.md",
+      "mode": "0000644",
+      "sha256": "b4763d82dfa55abf84258f7d1e466e3e7cfed23f1062a85fbc2235dc58bd9e59"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/audit.md",
+      "mode": "0000644",
+      "sha256": "724b4e9f9763d835695a5b1249ba8cc38c4f906d8d3f8b3fc8c267549c4c6edc"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/bolder.md",
+      "mode": "0000644",
+      "sha256": "5637eb523c23e81bf609c0247c9d389c07636a8b00dc3435eca57660d5c30102"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/clarify.md",
+      "mode": "0000644",
+      "sha256": "f1e4803f60fb657e4a1113cdc2f2ca14b1d9154ef9e88d6615af81eb422a50ec"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/colorize.md",
+      "mode": "0000644",
+      "sha256": "8aebf2e3b5a03bec6a6db623a227b917679c5a497741337cdb91737766f04f35"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/critique.md",
+      "mode": "0000644",
+      "sha256": "8aa3abc015bf692e9292f31ae769faef2cc60d0f248d3d60ee829cbb41ecb596"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/distill.md",
+      "mode": "0000644",
+      "sha256": "2a9f490ead7f971537f362dc5fcd0a44886d342e90325a001525231d245c5358"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/document.md",
+      "mode": "0000644",
+      "sha256": "7d39eaefe7f3338928bd7b877ddc6408e079ccc5ba50a6ea025e81d04b195613"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/extract.md",
+      "mode": "0000644",
+      "sha256": "3792d4af2140ad75c5b97fa2cbe60efa21dd97ed13034c5ed8d648ee477bf45a"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/harden.md",
+      "mode": "0000644",
+      "sha256": "e3eb2b4fc6e1c978f6766270f14cc306d1d72364f848991b94132dae7bab1239"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/layout.md",
+      "mode": "0000644",
+      "sha256": "e8ba930c3afc9ca508b39d62c0fe2503cc7151214a3e38485172d650339eb559"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/onboard.md",
+      "mode": "0000644",
+      "sha256": "66ba79216413c9b84c08a1c78235ba8a2e4b46b99335c4b223a904682f8d98e6"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/optimize.md",
+      "mode": "0000644",
+      "sha256": "896d171ff0426ae61098c2113888af70e0530ae2851b7d26b8122afc0cbe3fff"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/polish.md",
+      "mode": "0000644",
+      "sha256": "1a2e89db89cfc6a30dcd6f7e6afa6b26cfb8237813052a60d823c55aa080457a"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/quieter.md",
+      "mode": "0000644",
+      "sha256": "7da009c09724463a2040b4cc705723ac68b00fea8699cd39a92d1aa55ef06995"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/shape.md",
+      "mode": "0000644",
+      "sha256": "e9ca1b4be020c83b1ba5721bf51104d21e82ffda21aa7979ba295e77575b8cdc"
+    },
+    {
+      "path": "modules/ui-design/skills/impeccable/reference/typeset.md",
+      "mode": "0000644",
+      "sha256": "d960ee789a1b5d44c06bab53d2a661800457960cb121cf1496ba928792fa9307"
     },
     {
       "path": "modules/ui-design/skills/policy.json",
       "mode": "0000644",
       "sha256": "f73cb4ce230ffbd940a4aa00742f5d09e736a8f70402c155d1933618e70392d7"
     },
+    {
+      "path": "modules/ui-design/skills/redesign-existing-projects/SKILL.md",
+      "mode": "0000644",
+      "sha256": "22e8f7ea0d206b3f4b2243b986a4dcd10df4ba0198aa063e76ef4d2788fec55d"
+    },
     {
       "path": "modules/ui-design/styles/README.md",
       "mode": "0000644",
@@ -6437,12 +6562,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "64e9a5505a2745343810bde445dec06d8d7f138852e27ff5d5e9f4dca1a67360"
+      "sha256": "cc48f9622b76910048e8eddee004dd0fa872e622a03e72c6e578c3aa9d3f3a01"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3aa789f1f76f1d1c7c3234afe18c9e9a9468e6dd3f3034bd21dc52cea453329e"
+      "sha256": "dd5a515d9dffdd6839d708e4d16aae0b441ddb99358a21cd665d586dc7d22552"
     },
     {
       "path": "public-docs/index.html",
@@ -6817,7 +6942,7 @@
     {
       "path": "scripts/gds/docs-entropy.js",
       "mode": "0000644",
-      "sha256": "e052ddf4d44c0d67512cb14e150cd309a9ab09414c557db8319a57fd8f0d6961"
+      "sha256": "a4357b36e7e005895021f55db27f83d40e7fded3534ed9ee3d50162945e2cea7"
     },
     {
       "path": "scripts/gds/doctor.js",
@@ -8092,7 +8217,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ba96f775c8b884d95135ad2058ae2fa5576a3c4e00835431f8c6a6e966900441"
+      "sha256": "f2fccddc6dcaed3d8e767e6937db4c9f3aa6a3f3d6114bd1a89bbc2094bffdce"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8952,7 +9077,7 @@
     {
       "path": "tests/docs_entropy.mjs",
       "mode": "0000644",
-      "sha256": "c3ef388bb7baacd4da4319fed82ceb5687e0d444cacce2ee84f9061dccbd1018"
+      "sha256": "0dda5513bb550dbcf24c8016e01db07100eefec3abe14fc65d5bc06a1e57e026"
     },
     {
       "path": "tests/docs_openapi_route.mjs",
@@ -11007,7 +11132,7 @@
     {
       "path": "tests/ui_design_skills.mjs",
       "mode": "0000644",
-      "sha256": "d43f67840668875a9829d741f661e344a27675704834cd6a5e6b9e3247164068"
+      "sha256": "391f6e8c5ff83e4c3c1e2148aed74c3346200efabc59657ac99820cfcfdac1ac"
     },
     {
       "path": "tests/ui_design_styles.mjs",

package/.claude/skills/design/SKILL.md

@@ -55,11 +55,19 @@ Generated code uses the `--dt-*` variables; adapters write only `src/ui/<surface
 - **Figma** (`/figma-design-sync`): push the current state so a designer never opens a stale file; land their edit back as committed code. Canvas art that won't translate becomes an asset, never forced into code.
 - Both are adapters against `modules/ui-design/docs/design-contract.md`; a third tool is a third adapter, not a new integration.
 
-## The vetted skills (the ui-design module's `skills/`)
+## The vetted skills and the in-house rebuilds (the ui-design module's `skills/`)
 
-Third-party design skills reach a builder only through the module's vendoring policy ([`modules/ui-design/skills/README.md`](../../../modules/ui-design/skills/README.md), ADR 0198): scanned with `/scan-before-install` and reduced to `clean` or `caution`, a licence on the allowlist, a `PROVENANCE.md` sidecar, and the PLATFORM PREAMBLE that reads the instance's world before any taste rule. A vendored skill is listed here by name, one line each; a name that is not listed is not vendored, whatever a builder's own `~/.claude/skills` carries.
+Third-party design skills reach a builder only through the module's vendoring policy ([`modules/ui-design/skills/README.md`](../../../modules/ui-design/skills/README.md), ADR 0198): scanned with `/scan-before-install` and reduced to `clean` or `caution`, a licence on the allowlist, a `PROVENANCE.md` sidecar, and the PLATFORM PREAMBLE that reads the instance's world before any taste rule. A skill the module ships is listed here by name, one line each, whether vendored or rebuilt in-house; a name that is not listed is not the module's, whatever a builder's own `~/.claude/skills` carries.
 
-- *None vendored (2026-08-28).* Both origins scanned for the scoped set — `pbakaus/impeccable`, and the eleven `Leonxlnx/taste-skill` skills (`design-taste-frontend`, `design-taste-frontend-v1`, `high-end-visual-design`, `minimalist-ui`, `industrial-brutalist-ui`, `redesign-existing-projects`, `gpt-taste`, `stitch-design-taste`, `image-to-code`, `imagegen-frontend-web`, `imagegen-frontend-mobile`, `brandkit`) — reduced to `dangerous` at the scanner's deterministic floor and landed as rebuild specs (GDS tasks). The roster, the verdicts and the way to land one are in the README; vendoring one anyway is an owner override recorded in an ADR, not a session's call.
+- *None vendored (2026-08-28).* Both origins scanned for the scoped set — `pbakaus/impeccable`, and the eleven `Leonxlnx/taste-skill` skills (`minimalist-ui`, `industrial-brutalist-ui`, `gpt-taste`, `stitch-design-taste`, `image-to-code`, `imagegen-frontend-web`, `imagegen-frontend-mobile`, `brandkit`, and the four below) — reduced to `dangerous` at the scanner's deterministic floor and landed as rebuild specs (GDS tasks). The roster, the verdicts and the way to land one are in the README; vendoring one anyway is an owner override recorded in an ADR, not a session's call.
+
+**Rebuilt in-house from the specs** ([ADR 0220](../../../docs/adr/<redacted>.md), task 1003325; [ADR 0221](../../../docs/adr/<redacted>.md), task 1003326): first-party skills at `modules/ui-design/skills/<name>/`, each opening with the same preamble, each naming its spec and what changed in translation. They run INSIDE the loop above: the world first, the style library as the palette source for a variant, images as hero plates only, every motion rule inside the Kill Switch, the kit as the pre-flight.
+
+- **design-taste-frontend** — the default taste skill for a landing page, a portfolio or a marketing surface: the brief read in one line, three dials from presets, one world locked for the page, hero and layout discipline, rationed decoration, a pre-flight the kit measures. Declines dashboards, tables, wizards and editors.
+- **design-taste-frontend-v1** — the earlier generation, kept distinct: a fixed baseline triple adapted in conversation, stack conventions for a served surface, the layout bans, full interaction cycles, the named vocabulary of premium patterns and the tile-grid archetypes.
+- **high-end-visual-design** — the agency-build polish pass: one texture archetype (the library's looks) and one layout archetype per project, the nested container anatomy where the world allows a container, the pill with its nested arrow disc, the spatial rhythm, choreography and scroll entry inside the Kill Switch.
+- **redesign-existing-projects** — the in-place upgrade: scan the stack, diagnose against the seven-group audit with the instance's world as the answer key, fix in impact-per-risk order, one group per commit; keeps the stack, never migrates frameworks, `probe.js` green before and after.
+- **impeccable** — the design-craft method as one skill with sub-commands: `impeccable <sub-command> <target>` loads exactly one of eighteen playbooks (shape, critique, audit, polish, harden, onboard, animate, colorize, typeset, layout, adapt, distill, clarify, optimize, document, extract, bolder, quieter); no argument prints a menu from live project signals and never auto-runs; a bare description is routed to the closest playbook; carries the craft floor (loaded right before UI is edited, never recited) and the bounded finish (build, one kit round, one batch of fixes, at most one confirming round, stop; a read-only reviewer that answers with one of four words). No hooks, no bypass agent, no telemetry, no live server: the live loop is the playwright plugin below and the headless loop is the kit; the detector is task 1003329; native mobile declines to this loop.
 
 **Prerequisite, not vendored:** the **playwright plugin** (`claude plugin install playwright@claude-plugins-official`) is the LIVE browser-driving loop, where the kit in Step 2 is the headless one. Install it on the machine that runs a design session; the module never installs anything.
 

package/docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md

@@ -0,0 +1,46 @@
+# ADR 0220 — An in-house rebuilt skill is a first-party skill: it lands at `skills/<name>/`, opens with the same preamble, carries a "Rebuilt from" section instead of a sidecar, and is counted
+
+- **Status:** Accepted (2026-09-01)
+- **Task:** [task 1003325](https://cloudbongos.com/builders#/task/1003325) (goal 1000083 — the ui-design module as a platform capability; the first of the rebuild-spec tasks [ADR 0198](<redacted>.md) filed)
+- **Owner intent (2026-08-28):** every builder, on every instance, can produce good-looking, functional UIs in line with that instance's world. The taste skills that produced Cloud Bongos's world were to become part of the module; the scan said they could not be copied, so they are rebuilt.
+
+## Context
+
+ADR 0198 landed both scanned origins as rebuild specs and left the roster empty. Task 1003325 is the first rebuild: the **taste core** — `design-taste-frontend` (the default), `design-taste-frontend-v1` (the preserved earlier generation), `high-end-visual-design` and `redesign-existing-projects` — from the REBUILD-SPEC in the task body, which was derived from the origin's documentation only. Three things the policy did not say:
+
+1. **Where a rebuild lives and what it carries.** ADR 0198 §5 said a skill the module *authors* lives at `skills/<name>/` and is counted; it did not say what replaces the `PROVENANCE.md` sidecar (a rebuild has no pinned commit of its own bytes, no upstream licence text, and no scan verdict that applies to it), nor how the materialiser treats a dir with no sidecar.
+2. **Whether the preamble fits.** `PREAMBLE.md` was written for vendored copies: it said "this skill is vendored" and "the rules below are the upstream skill's, unchanged", both false for a rebuild. The test pins every copy byte-identical to the source, so the fix had to be in the source.
+3. **Whether five byte-identical copies are debt.** `docs-entropy.js` counts a paragraph of 120+ characters that appears verbatim in two or more tracked files, and `fitness-ratchets.js` fails the build when that count exceeds its baseline (6). The preamble is one paragraph, intentionally identical in every skill and in `PREAMBLE.md`; four rebuilds would have tripped the ratchet on the policy working as designed.
+
+And a fourth, which is the substance: what "inside the world" means when a taste skill written for any site is rebuilt for a platform whose surfaces read only the fifteen-token contract, whose motion must die under a media query, and whose owner confines image generation to hero plates.
+
+## Decision
+
+1. **Home, declaration, materialisation.** A rebuilt skill is `modules/ui-design/skills/<name>/SKILL.md`, declared in `module.json` `contributes.skills`, and reaches a builder through `claude-materialize.js` step 1b exactly as a vendored one does: `moduleSkillSources` resolves the own dir first and applies `vendoredSkillGate` only to `vendor/`, so a rebuild needs no sidecar to land and cannot be refused by one. It is **first-party code**: no `vendor/` segment, so the line, duplication and doc ratchets count it. A `rebuilt/` segment exempt like `vendor/` was rejected because the whole point is that these are ours.
+2. **One preamble, worded for both origins; provenance in a section, not a sidecar.** `PREAMBLE.md` now says the skill "ships with the module (vendored from a scanned origin, or rebuilt in-house from a spec)" and closes with "a vendored copy carries a `PROVENANCE.md` … an in-house rebuild names its rebuild spec and its ADR in the section right after this block". The block stays byte-identical everywhere (`tests/ui_design_skills.mjs` pins every own and vendored copy against the source). A rebuild's provenance is its **`## Rebuilt from`** section, first after the block: the origin repository and commit the *spec* was derived from (documentation only), the licence, the scan verdict and date, the spec task, the statement that **no upstream bytes were consulted or copied**, this ADR, and **what changed in translation** — so a reader can see where the rebuild deliberately departs from the documented behaviour. No `PROVENANCE.md`, no `LICENSE`: an in-house skill claims no upstream, and the test refuses both on an own dir.
+3. **The translation rules** (what every rebuilt taste skill does with the upstream's opinions):
+   - The palette is the pack; **variants come from the style library** (`modules/ui-design/styles/`, ADR 0219), rendered with `--style <name>` on the kit; a look is adopted by the owner through `config/branding.json`, never by a page.
+   - The "foundation" or "design system" is the instance's `DESIGN.md`; a third-party design system named in a brief becomes an approximation labelled as such in a comment, and this skill installs nothing — a dependency is a task decision.
+   - **Imagery is hero plates and hero objects by token, and never a step.** The upstream's "generate assets first, placeholder photography second, labelled empty slots last" becomes "a slot with no plate is not a slot"; a screenshot faked from divs stays banned.
+   - **Every motion rule lives inside the Kill Switch.** Springs, magnetic hover, shared-element transitions and pointer-tracked borders need script and are named **not available** rather than kept; staggers come from an `--i` custom property in the markup; scroll entry prefers `animation-timeline` behind `@supports` and otherwise one observer-added class over a rest frame that is complete without it.
+   - The upstream's bans (the long dash, decorative labels, three equal cards, the purple-blue gradient) are **defaults an instance's `DESIGN.md` overrides**; where the world calls for something the audit would flag (the chrome world's pure-black dark, its flat hairline bands), **the world is the answer key** and the row is not a defect.
+   - Stack conventions are restated for a served platform surface (static markup, one sheet, `createElement` DOM, script only for live data), and the kit's renders are every skill's pre-flight.
+4. **`docs-entropy.js` skips a paragraph that opens with the preamble's BEGIN marker**, beside the generated-block skip it already had, for the same reason: the duplication is the policy, not drift. The skip is narrow (the marker string) and calibrated in `tests/docs_entropy.mjs` against a duplicated plain paragraph that is still flagged.
+5. **v1 is a distinct skill, not a version stamp.** The spec preserves the earlier generation "under its own install name so projects pinned to its exact behaviour keep working". Rebuilt, that means two files that differ in content — v1 carries the fixed baseline triple, the stack conventions, the pattern vocabulary and the tile-grid archetypes; v2 carries the brief read, the presets and the pre-flight — and a task that names neither gets the default.
+6. **The pins** (`tests/ui_design_skills.mjs`): every own skill's frontmatter names its dir and carries a description; the preamble is first after the frontmatter, byte-identical, exactly once; the `## Rebuilt from` section names a task, ADR 0198 and "no upstream bytes"; the body names the style library and "hero plates" and contains no image mandate; no sidecar or licence text; `/design`, the skills README and the module `CLAUDE.md` list every own skill; the four skills of this task exist and are declared.
+
+## Consequences
+
+- **The roster is no longer empty.** Four in-house skills ship with the module and land in every instance's `.claude/skills/` where it is on. The core checkout itself still does not see module-owned skills (the materialiser's self-copy guard); task 1003330 is that step.
+- **A builder whose `~/.claude/skills` carries the upstream under the same names** has a collision by design: the module's names are the roster's, and the materialised project-level copy is the one an instance ships. The upstream copies are that builder's own and are not read by any task here.
+- **The scan verdict stands.** Nothing here vendors, overrides or re-scans; the rebuild specs for the impeccable method (task 1003326), the image family (1003328), the detector (1003329) and the four looks (1003327) follow this shape.
+- **The doc ratchet now has a second intentional-duplication marker.** A third would be a sign to generalise the skip; two is not.
+
+## Rejected
+
+- **A `PROVENANCE.md` on a rebuild** with the spec's origin as its commit: the sidecar's fields assert a copy of those bytes under that licence and verdict, which is exactly what a rebuild is not; `vendoredSkillGate` would also have to learn a third verdict.
+- **A second preamble for rebuilds.** Two blocks means two things to keep byte-identical and a test that has to know which is which; one block worded for both is one pin.
+- **A `rebuilt/` dir segment exempt from the ratchets like `vendor/`.** These are our lines; counting them is the point.
+- **Vendoring the four anyway** (ADR 0198 "what the owner can decide next"): an owner override recorded in an ADR, not a session's call, and not taken.
+- **Folding v1 into v2 with a "v1 mode" flag.** The spec's reason for v1 is that it does not move when v2 does.
+- **Raising `doc_duplicate_prose`'s baseline** to absorb the preamble copies: raising a baseline to pass CI is out of policy, and the duplication is not debt.

package/docs/adr/0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md

@@ -0,0 +1,36 @@
+# ADR 0221 — The impeccable method is one skill with sub-command playbooks: one preamble, one playbook per request, the three homes are the instance's own files, and the origin's mechanisms are dropped rather than disabled
+
+- **Status:** Accepted (2026-09-01)
+- **Task:** [task 1003326](https://cloudbongos.com/builders#/task/1003326) (goal 1000083 — the ui-design module as a platform capability; the second rebuild-spec task after [ADR 0220](<redacted>.md))
+- **Owner intent (2026-08-28):** every builder, on every instance, can produce good-looking, functional UIs in line with that instance's world. The impeccable skill was the operating skill the hub round ran under; the scan said it could not be copied, so its method is rebuilt.
+
+## Context
+
+`/scan-before-install` reduced `pbakaus/impeccable` @ `<redacted>` to `dangerous` at the default tier: three critical findings at the deterministic floor, and a panel that upheld PostToolUse and Stop hooks written into five harness configs, a child agent spawned with its permissions bypassed from a loopback HTTP route with the parent environment forwarded, a setup directive that overrode the harness's own instructions, a live-server credential embedded in page source, an unverified remote bundle, and default-on telemetry ([ADR 0198](<redacted>.md); the roster in `modules/ui-design/skills/README.md`). The REBUILD-SPEC in the task body lists a hundred and forty requirements derived from the origin's documentation only, across twelve areas: entry, world, commands, craft floor, detector, live, finish, native, hooks, assets, docs.
+
+ADR 0220 fixed where a rebuild lives and what it carries. It did not say how a method that is a *family of sub-commands* lands (the taste core was four independent skills), what the origin's three persisted homes (product truth, the visual system, per-surface briefs) become on a platform whose world is already the instance's files, or what to do with the six areas of the spec whose whole substance is the mechanism the panel condemned.
+
+## Decision
+
+1. **One skill, one playbook per request.** The method is `modules/ui-design/skills/impeccable/SKILL.md` (the frontmatter, the preamble, the `## Rebuilt from` section, invocation, the menu, the session setup, the three homes, the routing table, the craft floor, the finish, and what is not here) plus `reference/<sub-command>.md`, one file per playbook, eighteen in all: the sixteen the task body names (`shape`, `audit`, `critique`, `polish`, `harden`, `animate`, `typeset`, `colorize`, `layout`, `adapt`, `distill`, `clarify`, `onboard`, `optimize`, `document`, `extract`) and the two directions the spec lists beside them (`bolder`, `quieter`). A request loads exactly one playbook, which is the spec's own entry rule and the reason the playbooks are not inlined: a single file would load every playbook on every request. The preamble is pinned **once**, in `SKILL.md`, and governs every playbook; a playbook that carried a copy would be a second pin. The materialiser's own-dir branch already copies the tree recursively, so `reference/` ships with the skill and nothing in `claude-materialize.js` changes.
+2. **The three homes are the instance's files, and the skill creates none of them.** Product truth is `docs/project-context.template.md` and the branding pack's identity strings; the visual system is the root `DESIGN.md` (and a look's `DESIGN.md` under `modules/ui-design/styles/`); the per-surface brief is the claimed task's body and its ship notes, in a fixed brief block (scope, mode, audience, primary action, proof, constraints, direction, memorable moment, open decisions). The spec's read-and-write brief helper, its versioned product-doc schema and its sidecar file become that block and the existing files. `shape` proposes edits to product truth as a diff for the owner; `document` drafts the visual system on the claim's branch, never overwrites an existing one without the explicit refresh / overwrite / merge choice, and never runs in the same pass as `shape`. The module reads the world and never owns it (ADR 0197); a skill that wrote `DESIGN.md` on its own authority would be the inversion the module exists to prevent.
+3. **Dropped, not disabled, and each drop has a named destination.** Hooks: none, in any harness config; the platform's ship gate is the sweep and the pre-flight is the kit. The bypass agent: none; the finish's separate reviewer is an ordinary subagent through the harness's own Agent tool with its ordinary permissions and no build context. Telemetry, the remote bundle, the live-server credential: none. The live loop (a helper server, an injected control bar, a session journal, CSP patching, in-page text editing, accept / discard / normalise): the playwright plugin as a documented prerequisite driving the kit's stub, with variants as states in the states file, accept as a commit and discard as a checkout, and nothing to sweep because nothing was injected. The detector: task 1003329, as rules in `kit/check-mock.js` and `kit/lib.js`; until then `check-mock.js`, `render.js`'s floors and `contrast.js` are the deterministic floor, run once per review round and treated as a floor, never as proof. The asset producer: the owner's hero-plates-only rule and task 1003328. The native playbooks: not rebuilt; every surface here is a served web page, so a native target declines to `/design` with one line. `init`, `doctor`, `pin`, `unpin` and the installer existed to write and repair the origin's own config and harness entries; the materialiser is the install and there is no stored artifact of the skill's own to drift.
+4. **The finish is the kit in bounded rounds, and the reviewer speaks four words.** Build fully; one batched inspection (`render.js` every state at 1440 / 390 / 320 in the modes the states file names, `probe.js` for the contract); fix everything in one batch; at most one confirming round; stop, with shots, checks, micro-edits and rebuilds all counted against the same budget. The reviewer takes an explicit packet, runs an evidence check first (`recapture` on missing, blank, mismatched or implausibly sized captures), inventories the approved mock itself, treats an uncited deviation as a defect, and returns one of `clean`, `recapture`, `defects`, `contradicted`, reported unchanged and at its true scope; a second pass scores each fix resolved / partial / unresolved from new captures only. The platform's ship-time grader is the second independent reviewer and reads the real diff.
+5. **The craft floor is mechanics, loaded late, never recited.** It sits in `SKILL.md` after direction is settled and before UI is edited, is skipped by the read-only playbooks, and is translated for a world that may be hairlines by rule: where the world has shadows they carry offset and blur, where it has none the absence is the floor; a kicker above a heading is refused where the world bans one; the pack's faces are the display voice. With every check green the remaining effort goes to the committed world.
+6. **The pins** (`tests/ui_design_skills.mjs`): `impeccable` exists and is declared; each of the sixteen named sub-commands has a playbook and each playbook on disk is routed from `SKILL.md` (no orphan); no playbook carries the preamble marker; every playbook is longer than a stub; nothing in the tree directs a permission bypass, a hook written into a harness config, a settings-file edit, telemetry, a remote download, a live-server credential or an instruction override (naming a ban is fine, directing it is not, the same shape as ADR 0220's image-mandate pin); `SKILL.md` names the playwright plugin, `kit/render.js` and task 1003329. The ADR 0220 own-skill pins apply unchanged.
+
+## Consequences
+
+- **Five in-house skills ship with the module.** The roster in `/design`, the README, the module `CLAUDE.md` and `docs/file-map.md` names all five. The core checkout still does not see them (task 1003330).
+- **A builder with the upstream `impeccable` under `~/.claude/skills`** has a collision by design, the ADR 0220 shape: the module's copy is the one an instance ships, and none of the upstream files were opened by this task.
+- **The DONE WHEN's "one page rendered through the kit after each of three sub-commands"** is met with the three review playbooks (`audit`, `critique`, `harden` as a review of the states) against the front door, rendered ALL CLEAN after each; the playbooks that edit are proven by the pins and by the kit they point at, not by a change to a shipped surface inside a skill-authoring task.
+- **A future harness that supports skill sub-commands natively** changes only the routing paragraph; the playbooks are already one file each.
+
+## Rejected
+
+- **Eighteen skills, one per sub-command.** Eighteen preamble copies, eighteen descriptions competing for the harness's routing, and the spec's own entry rule (one name, an optional sub-command) contradicted.
+- **One `SKILL.md` carrying every playbook inline.** Loads the whole method on every request; the spec's "load exactly one playbook" exists to prevent exactly that.
+- **A hooks-lite variant** (a documented opt-in hook the builder writes themselves). A hook written into a harness config is the finding, with or without consent; the pre-flight is the kit and the ship gate is the sweep.
+- **A reviewer with elevated permissions** to "match the origin's autonomy". The reviewer is read-only by definition; it needs nothing the Agent tool does not give it.
+- **A `doctor`** to repair drift between the skill's artifacts and its version. The skill has no artifacts of its own; the kit's report is regenerated every run.
+- **Rebuilding the native playbooks** for a platform that serves web surfaces. Scope with no customer; the one principle worth keeping is stated in one line in the skill.

package/docs/adr/README.md

@@ -306,5 +306,7 @@ This keeps the decision history honest and traceable.
 | 0217 | [**Rank gates INVITING, not VIEWING: the owner’s answers to the account-security review’s five blockers** ([task 1003358](https://cloudbongos.com/builders#/task/1003358) · goal 1000045; answers blockers 1000121/1000122/1000123/1000124/1000126). The 2026-08-29 account-security batch shipped fourteen tasks and deliberately refused five audience/consent questions. Four turned out to be the same question, and one answer reframed the rest. Decisions: **D1** the governing line — *rank gates the ability to INVITE; it does not gate the ability to VIEW*. Seeing what someone built across projects is not privileged (the T&C already promises that data is public by consent, to search engines included); reaching out to them costs them something, and that is where a floor belongs. So `membership_kind` is **NOT** widened — `membershipKind()` stays FIRST_ADMIN-only, the federated wire contract is unchanged, the My Projects owned/building split keeps its meaning, the cross-version window never opens, and task 1003350 is **abandoned**. A **per-project INVITE rank floor defaulting to archon** replaces it (task 1003362), set by that project’s own archons — strictly better than a founder requesting a platform-side `project.curate` grant per teammate. Viewing gains no gate, on a new cross-project achievements page that per the owner **lives on cloudbongos.com, not the hall variant** (task 1003363) — so `public-landing/` inside the apex-only region, not `modules/hall-ui/`. The risk to hold as it is built: public consented profile data and a PRIVATE account’s recruiter sliver are different material, and the sliver must not ride along — not as a row, a facet count, or a search-result absence that reveals presence. **D2** the sliver keeps its **archon floor** (blocker 1000126), and ADR 0215 D4’s defensive hold becomes a positive agreement: the invite floor also defaults to archon, and the C5 tension dissolves because C5 was about browsing. Whoever builds 1003362 must check whether it IS the console wave’s `project.recruit` atom before shipping a rival knob. **D3** the consent pair — `/terms` said acceptance is recorded “by signing in here” but the stamp is reachable only via `/sso/authorize`, which a CHILD PROJECT reaches, so a hub-only builder was never stamped and (NULL `terms_accepted_at` → `isAccountActive` false) was invisible everywhere, permanently, under no-backfill. Owner took **both halves**: correct the sentence now (task 1003353) and **capture at the hub’s own sign-in** next (task 1003361), through the `platform-identity.hub` seam so child instances see no change. On grandfathering the owner chose **B — grandfather** (task 1003360) against the recommendation, having been shown that it records a consent which did not happen; the ledger does not absorb that silently, so a grandfathered acceptance is **marked** (queryably distinct from a sign-in, via a recorded source not a magic timestamp) and `/terms` **says so**. ADR 0213’s honest property is not “every acceptance was a sign-in” but **the record never claims more than what happened**, and that survives. **D4** `/access-requests/status` **collapses** to `admitted` + one `status` of `member`|`invited`|`not_admitted` (task 1003359, the fix ADR 0209 already named). It does **not** close the oracle and must not claim to — `admitted:true` still means member-or-invited; the 1003339 limiter is what reduces enumeration, and collapsing narrows what leaks about **applicants**. The cost is paid in the same change: `login.js` is the ONLY place telling a declined applicant they were declined, so its 30-minute timeout copy is rewritten to be honest rather than promising an approval that is never coming. ⚠ Also: report 1000027 (the live SSO check-in identity hole) marked **fixed**, held open until now so the ledger would not claim a fix while the hole still served; `verifyHubAssertion`’s purpose-confusion weakness filed as report **1000028** (medium, latent — zero call sites, becomes an admission bypass the moment ADR 0201 D2.1’s vouch is minted, so the fix must land BEFORE the feature that arms it). **New invariant:** any gate added to a viewing surface, or any recruiting/invite surface below the archon floor, contradicts this ADR and needs one that supersedes it.](<redacted>.md) | platform identity / privacy / permissions |
 | 0218 | [**The apex-root web surface: a module may own the front door, and says so with a flag, not an empty prefix** ([task 1003322](https://cloudbongos.com/builders#/task/1003322) · goal 1000080 — the last of the five tasks scoped with the owner on 2026-08-28). Carves the repo-root `public-landing/` into `modules/public-landing/`, the THIRD web-surface module after status-UI (BV1.R84) and hall-UI (BV1.R85) and the first that is not a subdomain. The obstacle: `moduleWebSurfaces()`'s whole routing vocabulary was a Host-header PREFIX, and the apex root is not a prefix of anything — it is whatever is left once the subdomains are taken. So a surface now names where it answers in exactly one of two ways, `{ host: "status.", dir }` or `{ apexRoot: true, dir }`, never both and never neither. **`host: ""` is rejected on purpose:** the routers match with `host.startsWith(s.host)` and every string starts with `""`, so an empty prefix would answer on `builders.`/`status.` too AND make `isModuleSurfaceHost()` true for every request — the predicate eleven `/builders` guards use to step aside — silently un-serving the hall. A boolean cannot be mistaken for a prefix. The landing keeps its DEDICATED serving block (the hall precedent): the apex-only strip, the branding stamp, the `?v=` content stamp and the six routes are untouched; only `LANDING_DIR` changes, from a hardcoded path to a lookup through the loader, resolved by the `apexRoot` PREDICATE so neither `platform-server.js` nor `serve-internal.js` names a module key (ADR 0083 §Decision #4). Disabling the module removes the front door outright and the apex answers the game-less 404 tail — the module contract's "disable without breaking anything" in its most literal form. At most one apex-root surface: the first discovered wins and a second is logged. Also: the BV1.R76 host-identity gate learned that an **apex-only region is exempt** — the server deletes it on every non-hub instance, so it cannot make a child render the hub's brand, which is the failure that gate names. Evidence: the five apex pages hashed as served, before and after, differ by exactly the same 22 bytes — `"public-landing":true,`, the module's own `window.__MODULES__` entry — and are otherwise identical; the 106 moved files hash identically on disk.](<redacted>.md) |
 | 0219 | [**A look is a branding pack: the style library ships looks as `theme.ui` overlays, never as sheets** ([task 1003323](https://cloudbongos.com/builders#/task/1003323) · goal 1000083). The owner scoped "varying ui styles" for the ui-design module; the shape was decided by three facts: every served sheet already reads only the contract and is measured by a suite that resolves its own expressions under the pack (ADR 0196), the pack is one-mode (light values; dark is each sheet's black tier), and the world round's candidate token layers were sheets, not packs. Decisions: **D1** a look is `modules/ui-design/styles/<name>/` = `pack.json` (the `theme.ui` overlay, exactly the thirteen colours + the two font stacks and their links) + `DESIGN.md` (the derived recipes in the root DESIGN.md's frontmatter shape, thirteen in lockstep with the pack) + `mock.html` (a specimen with no `:root`, served through the stub with the pack spliced in), never a fork of a sheet; a sixteenth token is a contract change. **D2** `chrome-world` is canonical and pinned byte-for-byte to the neutral pack; its DESIGN.md points at the root one. **D3** the alternates `expedition` (natgeo-editorial) and `grove` (organic-cards) are ported by retuning the thirteen against the three sheets' own pair lists in both modes until every pair clears AA (the grove's sage lifted and its inks deepened for the hub's status vocabulary and the hall's chips); dark under both is the sheets' black. **D4** the picker rides `GDS_BRANDING_FILE`, the fixed knob `src/branding.js` already has: `STYLE=<name>` on the stub, `--style` on render/probe, `--pack <name>` on contrast/check-mock; no core change. **D5** the three token suites take `UI_DESIGN_PACK` and their drift tests keep measuring against the neutral pack; `tests/ui_design_styles.mjs` runs them once per alternate and proves the knob live with a pack that must fail. **D6** an instance adopts a look by copying `theme` into `config/branding.json`; what stays the platform's whichever look is on: the dark ground, the hall's verification vocabulary, every sheet's derived tier, the floors. Rejected: sheets per look beside world.css; a dark tier in the contract; a picker that writes the host boundary.](<redacted>.md) | ui-design / branding contract |
+| 0220 | [**An in-house rebuilt skill is a first-party skill: it lands at `skills/<name>/`, opens with the same preamble, carries a "Rebuilt from" section instead of a sidecar, and is counted** ([task 1003325](https://cloudbongos.com/builders#/task/1003325) · goal 1000083). ADR 0198 landed both scanned origins as rebuild specs and left the roster empty; this is the first rebuild — the taste core: `design-taste-frontend`, `design-taste-frontend-v1`, `high-end-visual-design`, `redesign-existing-projects` — and the policy had not said where a rebuild lives, what replaces `PROVENANCE.md`, whether a preamble written for vendored copies still fits, or whether five byte-identical copies of it trip the doc-entropy ratchet (they would have: baseline 6). Decisions: **D1** a rebuild is `modules/ui-design/skills/<name>/SKILL.md`, declared in `module.json`, materialised by step 1b's own-dir branch (no sidecar gate), first-party and counted by every ratchet — no `rebuilt/` exemption like `vendor/`, because these are our lines. **D2** one preamble worded for both origins ("vendored from a scanned origin, or rebuilt in-house from a spec"), still byte-identical everywhere; a rebuild's provenance is its `## Rebuilt from` section first after the block: the origin the SPEC was derived from (documentation only), the verdict, the spec task, "no upstream bytes consulted or copied", this ADR, and what changed in translation; no `PROVENANCE.md`, no `LICENSE`. **D3** the translation rules for every rebuilt taste skill: the palette is the pack and variants come from the style library (ADR 0219); the design system is the instance's `DESIGN.md`; imagery is hero plates and hero objects by token and never a step; every motion rule lives inside the Kill Switch (springs, magnetic hover, pointer-tracked borders are named *not available*); the upstream's bans are defaults an instance's `DESIGN.md` overrides, and where the world calls for what an audit would flag, the world is the answer key. **D4** `docs-entropy.js` skips a paragraph opening with the preamble marker beside its generated-block skip, calibrated against a plain duplicate that is still flagged. **D5** v1 is a distinct skill differing in content (the fixed triple, the stack conventions, the pattern vocabulary, the tile-grid archetypes), not a version stamp. **D6** the pins in `tests/ui_design_skills.mjs`: frontmatter name = dir, preamble first and once, the section's task link + ADR 0198 + "no upstream bytes", the style library and "hero plates" named, no image mandate, no sidecar, every door lists the four. Rejected: a sidecar with the spec's commit; a second preamble; a `rebuilt/` segment; vendoring anyway (an owner override, not taken); folding v1 into v2; raising the doc baseline.](<redacted>.md) | ui-design / skills |
+| 0221 | [**The impeccable method is one skill with sub-command playbooks: one preamble, one playbook per request, the three homes are the instance's own files, and the origin's mechanisms are dropped rather than disabled** ([task 1003326](https://cloudbongos.com/builders#/task/1003326) · goal 1000083). `pbakaus/impeccable` scanned `dangerous` (ADR 0198: hooks written into five harness configs, a child agent with permissions bypassed, an instruction override, a live-server credential in page source, an unverified remote bundle, default-on telemetry), so its method is rebuilt from the spec. ADR 0220 fixed where a rebuild lives; it had not said how a family of sub-commands lands, what the origin's three persisted homes become, or what to do with the six spec areas whose substance is the condemned mechanism. Decisions: **D1** one skill at `skills/impeccable/`: `SKILL.md` (invocation, the menu from live signals, session setup, the three homes, the routing table, the craft floor, the bounded finish, what is not here) plus `reference/<sub-command>.md`, eighteen playbooks, exactly one loaded per request (the spec's own entry rule); the preamble pinned once in `SKILL.md` and governing every playbook; the materialiser's tree copy ships `reference/` unchanged. **D2** the three homes are the instance's files (product truth = `docs/project-context.template.md` + the pack's identity; the visual system = the root `DESIGN.md` and a look's; the brief = the task's body + a fixed brief block in the ship notes); the skill creates none, `shape` proposes diffs, `document` drafts on the claim's branch with the refresh / overwrite / merge choice. **D3** dropped, not disabled, each with a destination: hooks → none (the ship gate is the sweep, the pre-flight is the kit); the bypass agent → an ordinary read-only subagent via the Agent tool; telemetry, the remote bundle, the credential → none; the live loop → the playwright plugin driving the kit's stub, variants as states, accept = commit, discard = checkout, nothing injected; the detector → task 1003329; the asset producer → the hero-plates rule and task 1003328; native → declines to `/design`; `init`/`doctor`/`pin`/installer → the materialiser is the install. **D4** the finish is the kit in bounded rounds (build, one batched inspection, one batch of fixes, at most one confirming round, stop, one budget) and the reviewer answers with one of `clean` / `recapture` / `defects` / `contradicted` after an evidence check and its own mock inventory. **D5** the craft floor is mechanics loaded late and never recited, translated for a world that may be hairlines by rule. **D6** the pins: sixteen routed playbooks, no orphan, no preamble copy in a playbook, and nothing in the tree directing a bypass, a hook write, a settings edit, telemetry, a remote download, a credential or an override. Rejected: eighteen skills; one inline file; a hooks-lite opt-in; an elevated reviewer; a `doctor`; the native playbooks.](<redacted>.md) | ui-design / skills |
 
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.

package/docs/file-map.md

@@ -130,7 +130,7 @@
 │   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,harbor,gate,pair,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Three ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages) and `oversight.css` (the OVERSIGHT family — government, watch, harbor, gate, task 1003469: the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend.
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. CLAUDE.md, module.json, registry.js, flags.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
-│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove; STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
+│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove; STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest, the otb-character-review skill. CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.
 │   └── demo/                    ← BV1.R52 acceptance-proof module: one rank-gated write route + one namespaced migration proving the loader mounts a scaffolded module with zero core edits. CLAUDE.md, module.json.

package/docs/module-api-changelog.md

@@ -1357,5 +1357,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.458 with no explicit bump. run 33568609735. (task 1002620)
   1.19.460 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.459 with no explicit bump. run 33571137958. (task 1002620)
+  1.19.461 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.460 with no explicit bump. run 33571982271. (task 1002620)
+  1.19.462 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.461 with no explicit bump. run 33576366095. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/ui-design/module.json

@@ -5,7 +5,7 @@
   "coreVersion": "^1.19.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "skills": ["design", "design-sync", "figma-design-sync"] },
+  "contributes": { "skills": ["design", "design-sync", "figma-design-sync", "design-taste-frontend", "design-taste-frontend-v1", "high-end-visual-design", "redesign-existing-projects", "impeccable"] },
   "provides": [],
   "consumes": []
 }

package/modules/ui-design/skills/PREAMBLE.md

@@ -1,5 +1,5 @@
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every vendored skill so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill is vendored by the `ui-design` module and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.
@@ -9,5 +9,5 @@
 > 6. **The platform floors hold on every instance** and a `DESIGN.md` may tighten them, never loosen them: every control clears 24px on both sides (primary pills 46–48px); AA in both modes (4.5:1 body text, 3:1 large text and non-text) measured from the real stylesheet; and the Kill Switch, `@media (prefers-reduced-motion: reduce)` at the foot of the token layer killing every animation and transition, no motion authored in JavaScript, and a rest frame that is a complete composition on its own.
 > 7. **Look before you ship.** Render the real surface through the module's kit before and after (`/design` Step 2 and `docs/recipes/ui-look-before-you-ship.md`: every state at 1440 / 390 / 320 in dark and light, audited against the floors); a page with no states file gets one first, and new interactive code ships with a pin in the page's own test file.
 >
-> The rules below are the upstream skill's, unchanged. `PROVENANCE.md` beside this file names the origin, the pinned commit, the licence and the scan verdict it was vendored under.
+> The rules below are the skill's own. A vendored copy carries a `PROVENANCE.md` beside this file naming the origin, the pinned commit, the licence and the scan verdict it was vendored under; an in-house rebuild names its rebuild spec and its ADR in the section right after this block.
 <!-- END PLATFORM PREAMBLE -->

package/modules/ui-design/skills/README.md

@@ -20,11 +20,25 @@ Two origins were scanned for the set scoped with the owner (impeccable; the elev
 
 | Skill (in-house name) | Upstream | Licence | Verdict | Landing |
 |---|---|---|---|---|
-| `impeccable` | `pbakaus/impeccable` @ `<redacted>` (skill v4.1.x) | Apache-2.0 | **dangerous** — floor: 3 critical (a `bypassPermissions` marker in the skill's own live copy-edit agent; an instruction-override phrase in a test fixture; a same-file credential-store + http-client co-occurrence in a test), 19 high (shipped PostToolUse + Stop hooks, credential-store references), 107 medium, 147 low; panel: hooks written into five harness configs (globally on a global install), a child agent spawned with permissions bypassed from a loopback HTTP route, an autonomy directive that tells the agent to disregard its system prompt, a live-server token embedded in page source, an unverified remote bundle download | rebuild spec → GDS task |
+| `impeccable` | `pbakaus/impeccable` @ `<redacted>` (skill v4.1.x) | Apache-2.0 | **dangerous** — floor: 3 critical (a `bypassPermissions` marker in the skill's own live copy-edit agent; an instruction-override phrase in a test fixture; a same-file credential-store + http-client co-occurrence in a test), 19 high (shipped PostToolUse + Stop hooks, credential-store references), 107 medium, 147 low; panel: hooks written into five harness configs (globally on a global install), a child agent spawned with permissions bypassed from a loopback HTTP route, an autonomy directive that tells the agent to disregard its system prompt, a live-server token embedded in page source, an unverified remote bundle download | rebuild spec → [task 1003326](https://cloudbongos.com/builders#/task/1003326) → rebuilt in-house as `impeccable/` ([ADR 0221](../../../docs/adr/<redacted>.md)) |
 | `design-taste-frontend`, `design-taste-frontend-v1`, `high-end-visual-design`, `minimalist-ui`, `industrial-brutalist-ui`, `redesign-existing-projects`, `gpt-taste`, `stitch-design-taste`, `image-to-code`, `imagegen-frontend-web`, `imagegen-frontend-mobile`, `brandkit` | `Leonxlnx/taste-skill` @ `<redacted>` | MIT | **dangerous** — floor: 1 critical (an injection-phrase hit at `skills/taste-skill/SKILL.md:892`, which the panel identifies as a filename placeholder; the floor is untouchable by design); panel: caution (1 medium: the only documented install path runs an unpinned third-party `npx` CLI; 21 low: mandated invocation of any available image-generation tool, unbounded image counts, remote assets and scripts in generated pages, an auto-loaded cross-agent instruction file) | rebuild spec → GDS task |
 
 The eleven taste skills are single-file prose; the floor's one critical is a false positive in the human sense and a true positive in the scanner's — and the rule that makes the scanner worth having is that a session does not get to tell the difference. Vendoring any of them anyway is an **owner override recorded in an ADR**, not a judgement a task makes.
 
+## The in-house rebuilds (2026-09-01)
+
+A rebuild spec becomes a **first-party skill** at `<name>/` — no `vendor/` segment, so the ratchets count it; no `PROVENANCE.md` or `LICENSE`, because an in-house skill claims no upstream; the same PLATFORM PREAMBLE first after the frontmatter, byte-identical; then a **`## Rebuilt from`** section naming the origin the *spec* was derived from (documentation only), the scan verdict, the spec task, the statement that no upstream bytes were consulted or copied, and what changed in translation ([ADR 0220](../../../docs/adr/<redacted>.md)). Declared in `module.json` like any other; `claude-materialize.js` step 1b lands it through its own-dir branch, which no sidecar gate touches. `tests/ui_design_skills.mjs` pins all of it. A rebuild whose method is a family of sub-commands ships as **one** skill dir with a `reference/<sub-command>.md` playbook beside the `SKILL.md`, exactly one loaded per request; the preamble is pinned once, in the `SKILL.md`, and governs every playbook ([ADR 0221](../../../docs/adr/<redacted>.md)).
+
+| Skill | Rebuilt from (spec) | Task | What it is |
+|---|---|---|---|
+| `design-taste-frontend` | `Leonxlnx/taste-skill` `taste-skill` (v2) | [task 1003325](https://cloudbongos.com/builders#/task/1003325) | the default taste skill: the brief read in one line, three dials from presets, one world locked, hero and layout discipline, rationed decoration, a pre-flight the kit measures; declines dashboards, tables, wizards, editors |
+| `design-taste-frontend-v1` | `Leonxlnx/taste-skill` `taste-skill-v1` | [task 1003325](https://cloudbongos.com/builders#/task/1003325) | the earlier generation, kept distinct: a fixed baseline triple adapted in conversation, stack conventions for a served surface, the layout bans, full interaction cycles, the pattern vocabulary, the tile-grid archetypes |
+| `high-end-visual-design` | `Leonxlnx/taste-skill` `soft-skill` | [task 1003325](https://cloudbongos.com/builders#/task/1003325) | the agency-build polish pass: one texture archetype (the style library's looks) and one layout archetype per project, the nested container anatomy where the world allows a container, the pill with its nested arrow disc, rhythm, choreography and scroll entry inside the Kill Switch |
+| `redesign-existing-projects` | `Leonxlnx/taste-skill` `redesign-skill` | [task 1003325](https://cloudbongos.com/builders#/task/1003325) | the in-place upgrade: scan the stack, diagnose against the seven-group audit with the instance's world as the answer key, fix in impact-per-risk order, one group per commit; keeps the stack, never migrates frameworks |
+| `impeccable` | `pbakaus/impeccable` @ `<redacted>` (skill v4.1.x) | [task 1003326](https://cloudbongos.com/builders#/task/1003326) | the design-craft method as one skill with sub-commands, one playbook loaded per request from `impeccable/reference/`: shape, critique, audit, polish, harden, onboard, animate, colorize, typeset, layout, adapt, distill, clarify, optimize, document, extract, bolder, quieter; the craft floor and the bounded finish live in its `SKILL.md`; the three persisted homes are the instance's own files; no hooks, no bypass agent, no telemetry, no live server (the playwright plugin and the kit are the loops) |
+
+What every rebuild does with the upstream's opinions, in the same words: the palette is the pack and a variant is a look from [`../styles/`](../styles/README.md); the design system is the instance's `DESIGN.md`; images are hero plates and hero objects by token and never a step; every motion rule lives inside the Kill Switch (springs, magnetic hover, pointer-tracked borders are named *not available*); the upstream's bans are defaults an instance's `DESIGN.md` overrides; the kit's renders are the pre-flight. Still specs, not skills: the image family (task 1003328), the detector (1003329), the four looks (1003327).
+
 **The playwright plugin** (`claude-plugins-official`, an MCP plugin) is the LIVE browser-driving loop, where the kit is the headless one. It is a prerequisite, documented — `claude plugin install playwright@claude-plugins-official` — never vendored.
 
 ## How to land one (when a scan says it may)