@bongos/core 1.19.477 → 1.19.479

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.477",
-  "core_contract": "1.19.477",
-  "source_commit": "17d71953a32ddb4b8006ce2c0ed1d915b815ed1c",
+  "core_version": "1.19.479",
+  "core_contract": "1.19.479",
+  "source_commit": "10ddc4c5e1e7df8be68dd6dace0eb42303cbe53a",
   "source_ref": "HEAD",
-  "built_at": "2026-09-02T17:36:21.154Z",
+  "built_at": "2026-09-02T18:05:59.995Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 413,
+    "docs_redacted": 418,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1838,
+    "functional_verbatim": 1840,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2275,
-  "tree_sha256": "dc88e652d6b7674e287e406b3397118f0e2af3e0346c2f234602da8ea24ff35b",
+  "file_count": 2282,
+  "tree_sha256": "2cb64137d54513737bd860e9726a70eb9e646ab4b86b17a9ade984e4d98eb497",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -127,7 +127,7 @@
     {
       "path": ".claude/skills/design/SKILL.md",
       "mode": "0000644",
-      "sha256": "bbb135d166a4e17b6059506f794c47c27740a063a068f1ea28c62a0aee7728b0"
+      "sha256": "2b562ed7586653101b556c37a727a726abf7072e18c3f14b0eb5cb84df82bf55"
     },
     {
       "path": ".claude/skills/dev/SKILL.md",
@@ -362,12 +362,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "6ad13168a2196e29e37c2810108686b3c24f30f739691634f9085ebfcd1fc804"
+      "sha256": "bcea7262c68e2e188b824e2b7eceeac71a277ba5b41c9611a898085f0f0f3e4f"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "dfaca6bbdd87f2d32b1684bbddd7bb4454367ccf1624a9bd5b38b571dd3708db"
+      "sha256": "3ca40bc7e4a83a1ef350a48cac85f1255b8cefe7f53cca511219daf4c6c65488"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -377,17 +377,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "92bcaf81301220166e1126d65492ecc011b3b2fac94e594bf22f8049aa45aece"
+      "sha256": "50bc31cac788fe598020d06dcfeadbc321d6c1c9b54138d9fe5160eaece6ed65"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "6e1ae5c410c8796df7efcdcd9cbd0ccebe1075da8bc18d503c50196d0e7db683"
+      "sha256": "df0f38eee9419bb2981fed70d5a6810f5c0e3e5fc578ca6b1f84e1bb43524eec"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "cf02ec862ca9fcf7700ed2566c2e148c83c763d9194a450a09cb3d191ad4c90b"
+      "sha256": "f0d6c047ce222dd4c2f31bd3a488d501f6f3ca31ff006961e070461d8f52528c"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1654,20 +1654,25 @@
       "mode": "0000644",
       "sha256": "9166e49d44a97a1bb99d5604fb19579eaa1f3a491026bcf84538ecd5c0494880"
     },
+    {
+      "path": "docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md",
+      "mode": "0000644",
+      "sha256": "a9163be00fa701f69f047a1129db375b433bdcae3430f0776a184d78ead24af9"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "4a6c61e9643282e9754f845ce4afb245c9c76b1eb827fc8ad52b973e594bd950"
+      "sha256": "55ec492975735a3ba97235a67ac84e94fa993d98637badf0ead748221312bda4"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "c8a913a5ecb49f29ef05a6ee3f12725da23c777f720600847d2d8010815f2588"
+      "sha256": "415a05d22faa1125fea0bf41251e4e6cdb5e45c82da81f6e70c027e8249237b2"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "fa675542b54c8bbd96530ecaac630deaf9873cc9091714eb9fde660e5af2ad4e"
+      "sha256": "168549601bd155157cd57ecca98fedc54a827c0ca1f873d2c46ddfe4a7b2df46"
     },
     {
       "path": "docs/architecture.md",
@@ -1692,12 +1697,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "504ab0bb1e8cd0c643a0aa27ea7e018278fc86d573291ccb654cc936488eb0dc"
+      "sha256": "3aecb3448eabb9c945a3455432c80a1913bbc11004e38bed0735c6d763feb6ef"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "e8b3759291fa7f9853bb901e230dcfeb75d5f8e8f4908983f65c2a82c36ae46f"
+      "sha256": "586588197cadf5c8b7f97f3689a1f83333d1c6d21eabbac63d3239ba9d97ed70"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2137,7 +2142,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "ad3830c5ce7650d78c18dbd03c03c0544cbdc9f0dc018c4e09da1cf5bdf67d21"
+      "sha256": "1cac56ec4e482c9a14cdaef30e8dfe2d31c6c759252472e11d721bda4ee129ab"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2147,7 +2152,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d04efaed57b08373781ce55244d916cca3302daecd5c6c5c3e7fb93bfcdcf950"
+      "sha256": "21c70bd8a32361038e14920c58ededfb34aa13c2c1f4592242b0617fe4c8677a"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3502,7 +3507,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "92bcaf81301220166e1126d65492ecc011b3b2fac94e594bf22f8049aa45aece"
+      "sha256": "50bc31cac788fe598020d06dcfeadbc321d6c1c9b54138d9fe5160eaece6ed65"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -3677,7 +3682,7 @@
     {
       "path": "modules/economy/credits.js",
       "mode": "0000644",
-      "sha256": "06f1cc7080509864ea4f474627a7a35de8348fcf4f935a13fc62da38e2a67fa8"
+      "sha256": "594d0eee9447bbc4b0e5dde91e2aba58bd762cf7e046c466df0527ec6ba24138"
     },
     {
       "path": "modules/economy/migrations/economy_001_fix_gds_shipper_description.sql",
@@ -3687,7 +3692,7 @@
     {
       "path": "modules/economy/module.json",
       "mode": "0000644",
-      "sha256": "b8b3a4add551b32bc625dca0390afc2176dcd9e433b24d21128dd6e249e70623"
+      "sha256": "1916409c7cf0bf58c986eea43a89c9bf07df0ec17a65a3aa4b328ef0ee196545"
     },
     {
       "path": "modules/economy/policy.js",
@@ -3697,13 +3702,18 @@
     {
       "path": "modules/economy/reward.js",
       "mode": "0000644",
-      "sha256": "13cc932402c3cf0d2154507c6e6a462aeb98520a2214b8561ec01a6bb9245fd6"
+      "sha256": "6b13f1f0a1b9b1a56f5ed12a31008f20002cdb501da4e9f95ef2e28441eb56f9"
     },
     {
       "path": "modules/economy/routes/cost.js",
       "mode": "0000644",
       "sha256": "4113b736359f09d6869795800d52394603823b570263dd1852281b35e6bb2485"
     },
+    {
+      "path": "modules/economy/routes/credits.js",
+      "mode": "0000644",
+      "sha256": "0363555567d6b496c80eee71b686094ca5d18b6c987a15cd1ad4dca2458f2397"
+    },
     {
       "path": "modules/economy/routes/leaderboard.js",
       "mode": "0000644",
@@ -4332,7 +4342,7 @@
     {
       "path": "modules/hall-ui/public/md-reader.js",
       "mode": "0000644",
-      "sha256": "ac9cc29bf8f480c7bd9560309a36a540e33421d65bfdbdbd2d24cd9808dc51d1"
+      "sha256": "89c3def79578cf30ad3757d3cac9c2242dfece978758d7c256c2b4b8963cb201"
     },
     {
       "path": "modules/hall-ui/public/modules.css",
@@ -4752,7 +4762,7 @@
     {
       "path": "modules/lifecycle/closeness.js",
       "mode": "0000644",
-      "sha256": "f5668020c115a6d356a74603dc4a7229ddfdb8d5015a22f871a35386a869fe58"
+      "sha256": "4ea4fe1c93ffe6d6f42af31d96dfe402d7dbccb4a5825b71c571024548a87c25"
     },
     {
       "path": "modules/lifecycle/conflict-resolve.js",
@@ -4962,7 +4972,7 @@
     {
       "path": "modules/lifecycle/routes/closeness.js",
       "mode": "0000644",
-      "sha256": "1950ba9d20f925fa1ecbe7fb37d35a5b80045c556c6f76caa90b82e213b7db88"
+      "sha256": "1ad8e353ead5c3fe39fadc1d48a2fc65725762cc298e206464ef242f7fdd292d"
     },
     {
       "path": "modules/lifecycle/routes/dependencies.js",
@@ -5312,7 +5322,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "1542edccc61a1cdb77540f5b6521a91477234af03cdde9178a1ed5516363e1fd"
+      "sha256": "c43bda216cc9c6ec1788dd5d6ef4978594c1ab6db61ad6af33ed8ce451594899"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -6437,7 +6447,7 @@
     {
       "path": "modules/ui-design/module.json",
       "mode": "0000644",
-      "sha256": "0f88b29039e01fb908e4351d3fdac8198206782a0afdbf5156da6e02ad312d26"
+      "sha256": "5a53e893524c48deef3e62fcb2765dc9b3f0a96f76309ba86c99df194abc79aa"
     },
     {
       "path": "modules/ui-design/scripts/design-sync.js",
@@ -6462,7 +6472,7 @@
     {
       "path": "modules/ui-design/skills/README.md",
       "mode": "0000644",
-      "sha256": "ddc9a2b8788d3e41f1d3ae285d56c75ecb6e7a9d4aa003a0db55f4d38ff24d4a"
+      "sha256": "8d25a88e882979a98e859974c4ced8a8d27fb2c5bd57d6bca7be709fc052ca75"
     },
     {
       "path": "modules/ui-design/skills/brandkit/SKILL.md",
@@ -6479,6 +6489,11 @@
       "mode": "0000644",
       "sha256": "ee07bdde8e388b2863431673390d4bff74ee1296920ebcb07b529060eb7f8959"
     },
+    {
+      "path": "modules/ui-design/skills/gpt-taste/SKILL.md",
+      "mode": "0000644",
+      "sha256": "3e2e4802407df6763db372c27f3deaaf8f9b6233778668ddeaff65dec147ac7c"
+    },
     {
       "path": "modules/ui-design/skills/high-end-visual-design/SKILL.md",
       "mode": "0000644",
@@ -6594,6 +6609,16 @@
       "mode": "0000644",
       "sha256": "d960ee789a1b5d44c06bab53d2a661800457960cb121cf1496ba928792fa9307"
     },
+    {
+      "path": "modules/ui-design/skills/industrial-brutalist-ui/SKILL.md",
+      "mode": "0000644",
+      "sha256": "4d781aa002138bdad572dfcae0dc6f1175fe070ee37fa8f3ef9a0f6af08e039b"
+    },
+    {
+      "path": "modules/ui-design/skills/minimalist-ui/SKILL.md",
+      "mode": "0000644",
+      "sha256": "b7b22a1ab8aa148ac4fc8573d7088c6ff207beb53f628009e7cfc363c6bbd2c2"
+    },
     {
       "path": "modules/ui-design/skills/policy.json",
       "mode": "0000644",
@@ -6604,6 +6629,11 @@
       "mode": "0000644",
       "sha256": "22e8f7ea0d206b3f4b2243b986a4dcd10df4ba0198aa063e76ef4d2788fec55d"
     },
+    {
+      "path": "modules/ui-design/skills/stitch-design-taste/SKILL.md",
+      "mode": "0000644",
+      "sha256": "f8c6c38ccb5fea529e86731005e8bbf231a9131c890010a29129c06195f48945"
+    },
     {
       "path": "modules/ui-design/styles/README.md",
       "mode": "0000644",
@@ -6692,12 +6722,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "61a5372ee6a0262a905396aa54a6a72f423e509308213dcc24dcc02e78b225c8"
+      "sha256": "9ffa26ff1d228908ca60ad5e7cd808dc8bf0544d8575047d1921035a02ea9775"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "067fc518cdcae9e18db8cfe039dacef25a81586772c0c8c0105f8325f325ad34"
+      "sha256": "769e71f6b493dd866574c9fb1633ef1dad344af65a151d19ed74cd07bc832a3e"
     },
     {
       "path": "public-docs/index.html",
@@ -8352,7 +8382,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "80d23eb49ce424e573ed6bfed618610b58498eba45cc4756ca2739cc05831106"
+      "sha256": "baddbaa3d45390694efbe255d10323466461ff51349d1720cc231a94a196a179"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8917,7 +8947,7 @@
     {
       "path": "tests/closeness.mjs",
       "mode": "0000644",
-      "sha256": "b5c4791d84aa3126714c7b3188320dc4df984e282a086196ded2394f825295d1"
+      "sha256": "be10e63b6a424914ba71537dbfa653dcb247b28b3e6a9a8caf4696268e4500cf"
     },
     {
       "path": "tests/cloud_bongos_pack.mjs",
@@ -9014,6 +9044,11 @@
       "mode": "0000644",
       "sha256": "dcb35adea926027490b7ca20a59fd596d2db097cc84ec004a372e922602098c8"
     },
+    {
+      "path": "tests/credit_ledger_read.mjs",
+      "mode": "0000644",
+      "sha256": "d7c96a67f1eda974a9387a47d12bf70d7f2125ea77c1ddb313e5a3feb47ae04f"
+    },
     {
       "path": "tests/criterion_authoring_gate.mjs",
       "mode": "0000644",
@@ -9772,7 +9807,7 @@
     {
       "path": "tests/hall_reading_world.mjs",
       "mode": "0000644",
-      "sha256": "0639e14742626f0f75400a5dd462418ff4dba9ab9f28aa517a165f63c65046c3"
+      "sha256": "f3e2a8865189646212733ee9a85d295543acc0309b4087a9eaf36d72426c4b4b"
     },
     {
       "path": "tests/hall_record_world.mjs",
@@ -10382,7 +10417,7 @@
     {
       "path": "tests/own_scope_guard.mjs",
       "mode": "0000644",
-      "sha256": "3c823f5ad58a6406ecc5b93a5f3f5271fd8400c8839ad0fa99c27bf49032c8d7"
+      "sha256": "4ddff5b21edcbc682ff54ffc13c8ed643db4b8860ed55a7196822f0b40e9611e"
     },
     {
       "path": "tests/own_session_revoke.mjs",
@@ -11307,7 +11342,7 @@
     {
       "path": "tests/ui_design_skills.mjs",
       "mode": "0000644",
-      "sha256": "155aa8b197f52ec73d3654ac8cb15134998e4de81fbbf37e8d7e423efebb94b1"
+      "sha256": "fd13a17493141b519051ad3a94104c13f79409b06904d129dc9bf13acd73fa58"
     },
     {
       "path": "tests/ui_design_styles.mjs",

package/.claude/skills/design/SKILL.md

@@ -59,14 +59,18 @@ Generated code uses the `--dt-*` variables; adapters write only `src/ui/<surface
 
 Third-party design skills reach a builder only through the module's vendoring policy ([`modules/ui-design/skills/README.md`](../../../modules/ui-design/skills/README.md), ADR 0198): scanned with `/scan-before-install` and reduced to `clean` or `caution`, a licence on the allowlist, a `PROVENANCE.md` sidecar, and the PLATFORM PREAMBLE that reads the instance's world before any taste rule. A skill the module ships is listed here by name, one line each, whether vendored or rebuilt in-house; a name that is not listed is not the module's, whatever a builder's own `~/.claude/skills` carries.
 
-- *None vendored (2026-08-28).* Both origins scanned for the scoped set — `pbakaus/impeccable`, and the eleven `Leonxlnx/taste-skill` skills (`minimalist-ui`, `industrial-brutalist-ui`, `gpt-taste`, `stitch-design-taste`, `image-to-code`, `imagegen-frontend-web`, `imagegen-frontend-mobile`, `brandkit`, and the four below) — reduced to `dangerous` at the scanner's deterministic floor and landed as rebuild specs (GDS tasks). The roster, the verdicts and the way to land one are in the README; vendoring one anyway is an owner override recorded in an ADR, not a session's call.
+- *None vendored (2026-08-28).* Both origins scanned for the scoped set — `pbakaus/impeccable`, and the eleven `Leonxlnx/taste-skill` skills (`minimalist-ui`, `industrial-brutalist-ui`, `gpt-taste`, `stitch-design-taste`, `image-to-code`, `imagegen-frontend-web`, `imagegen-frontend-mobile`, `brandkit`, and the rest of the roster below) — reduced to `dangerous` at the scanner's deterministic floor and landed as rebuild specs (GDS tasks). The roster, the verdicts and the way to land one are in the README; vendoring one anyway is an owner override recorded in an ADR, not a session's call.
 
-**Rebuilt in-house from the specs** ([ADR 0220](../../../docs/adr/<redacted>.md), task 1003325; [ADR 0221](../../../docs/adr/<redacted>.md), task 1003326; [ADR 0222](../../../docs/adr/<redacted>.md), task 1003328): first-party skills at `modules/ui-design/skills/<name>/`, each opening with the same preamble, each naming its spec and what changed in translation. They run INSIDE the loop above: the world first, the style library as the palette source for a variant, images as hero plates only, every motion rule inside the Kill Switch, the kit as the pre-flight.
+**Rebuilt in-house from the specs** ([ADR 0220](../../../docs/adr/<redacted>.md), task 1003325; [ADR 0221](../../../docs/adr/<redacted>.md), task 1003326; [ADR 0222](../../../docs/adr/<redacted>.md), task 1003328; [ADR 0230](../../../docs/adr/<redacted>.md), task 1003327): first-party skills at `modules/ui-design/skills/<name>/`, each opening with the same preamble, each naming its spec and what changed in translation. They run INSIDE the loop above: the world first, the style library as the palette source for a variant, images as hero plates only, every motion rule inside the Kill Switch, the kit as the pre-flight.
 
 - **design-taste-frontend** — the default taste skill for a landing page, a portfolio or a marketing surface: the brief read in one line, three dials from presets, one world locked for the page, hero and layout discipline, rationed decoration, a pre-flight the kit measures. Declines dashboards, tables, wizards and editors.
 - **design-taste-frontend-v1** — the earlier generation, kept distinct: a fixed baseline triple adapted in conversation, stack conventions for a served surface, the layout bans, full interaction cycles, the named vocabulary of premium patterns and the tile-grid archetypes.
 - **high-end-visual-design** — the agency-build polish pass: one texture archetype (the library's looks) and one layout archetype per project, the nested container anatomy where the world allows a container, the pill with its nested arrow disc, the spatial rhythm, choreography and scroll entry inside the Kill Switch.
 - **redesign-existing-projects** — the in-place upgrade: scan the stack, diagnose against the seven-group audit with the instance's world as the answer key, fix in impact-per-risk order, one group per commit; keeps the stack, never migrates frameworks, `probe.js` green before and after.
+- **minimalist-ui** — the quiet editorial look: macro whitespace first, a capped measure, one display job and one body job, exactly one hairline weight in the whole sheet, washed accents measured against their own ink, flat tile cards with no shadow, box-less accordions and keycap shortcuts, one depth treatment per band. Declines dense surfaces; the nearest library look is `expedition`.
+- **industrial-brutalist-ui** — the technical-document look: one archetype per project (Swiss industrial print or dark tactical terminal, never mixed) with the other mode still complete and measured, massive clamped uppercase display against fixed tracked-out mono metadata, the pack's terracotta as the one hazard accent and its sea as one terminal green, the hairline as a one-pixel grid gap, zero corner rounding, static halftone and scanline degradation.
+- **gpt-taste** — the anti-default pass for a surface that came out looking like every other one: a written plan block before any markup whose selection is derived from the route and bumped against sibling surfaces, the four-stage structure, an ultra-wide hero held to two or three lines, a dense tile grid with zero empty cells, real scroll-driven motion in CSS. Pack-agnostic; it runs over whatever look is on.
+- **stitch-design-taste** — the design contract document for an external screen-generating tool: four dials, eight fixed sections, descriptive language paired with exact values, the thirteen transcribed from the instance's pack and diffed rather than invented, and motion written as an intent brief for whoever codes the screens afterwards.
 - **impeccable** — the design-craft method as one skill with sub-commands: `impeccable <sub-command> <target>` loads exactly one of eighteen playbooks (shape, critique, audit, polish, harden, onboard, animate, colorize, typeset, layout, adapt, distill, clarify, optimize, document, extract, bolder, quieter); no argument prints a menu from live project signals and never auto-runs; a bare description is routed to the closest playbook; carries the craft floor (loaded right before UI is edited, never recited) and the bounded finish (build, one kit round, one batch of fixes, at most one confirming round, stop; a read-only reviewer that answers with one of four words). No hooks, no bypass agent, no telemetry, no live server: the live loop is the playwright plugin below and the headless loop is the kit; the detector is task 1003329; native mobile declines to this loop.
 - **imagegen-frontend-web** — the plate-making skill under the hero-only rule: text-free hero plates, hero objects, backdrops and orbs for the slots a composition already has (the count is the slot count, committed out loud), a composition anchor per plate that is not text-left image-right, one material / light / lens across the family, the pack as the palette lock, the instance's art pipeline key, and the pair-and-sidecar output contract (a black-ground JPEG for dark, an alpha WebP cutout for light, a `<file>.json` beside each). Never a section image, a comp or a screen; writes no page code.
 - **imagegen-frontend-mobile** — the same, for the 390 and 320 compositions: portrait mastheads and fields clear of the regions a phone reserves, the first view held to one focal point, a scrim under any text over a plate. A screen is the surface's states file rendered by the kit; no phone mockups, no flows of screens; a native app target declines to this loop.

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 339 operations across 53 resource groups
+- 341 operations across 53 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -221,6 +221,8 @@ function createClient(opts = {}) {
       getBugAttachmentsName: (args) => request("GET", "/bug-attachments/{name}", { hasBody: false }, args),
     },
     "builders": {
+      // GET /builders/{builderId}/credits — rank: metic+archon — GET /builders/:builderId/credits
+      getBuildersBuilderIdCredits: (args) => request("GET", "/builders/{builderId}/credits", { hasBody: false }, args),
       // GET /builders/{id}/active-claims — rank: metic+archon — GET /builders/:id/active-claims
       getBuildersIdActiveClaims: (args) => request("GET", "/builders/{id}/active-claims", { hasBody: false }, args),
       // GET /builders/{id}/activity — rank: any-builder — GET /builders/:id/activity
@@ -503,6 +505,8 @@ function createClient(opts = {}) {
       getMeAchievements: (args) => request("GET", "/me/achievements", { hasBody: false }, args),
       // POST /me/anthropic-link — rank: any-builder — POST /me/anthropic-link
       postMeAnthropicLink: (args) => request("POST", "/me/anthropic-link", { hasBody: true }, args),
+      // GET /me/credits — rank: any-builder — GET /me/credits
+      getMeCredits: (args) => request("GET", "/me/credits", { hasBody: false }, args),
       // GET /me/cross-project — rank: any-builder — GET /me/cross-project
       getMeCrossProject: (args) => request("GET", "/me/cross-project", { hasBody: false }, args),
       // PATCH /me/cross-project — rank: any-builder — PATCH /me/cross-project

package/clients/bongos-client/index.cjs

@@ -220,6 +220,8 @@ function createClient(opts = {}) {
       getBugAttachmentsName: (args) => request("GET", "/bug-attachments/{name}", { hasBody: false }, args),
     },
     "builders": {
+      // GET /builders/{builderId}/credits — rank: metic+archon — GET /builders/:builderId/credits
+      getBuildersBuilderIdCredits: (args) => request("GET", "/builders/{builderId}/credits", { hasBody: false }, args),
       // GET /builders/{id}/active-claims — rank: metic+archon — GET /builders/:id/active-claims
       getBuildersIdActiveClaims: (args) => request("GET", "/builders/{id}/active-claims", { hasBody: false }, args),
       // GET /builders/{id}/activity — rank: any-builder — GET /builders/:id/activity
@@ -502,6 +504,8 @@ function createClient(opts = {}) {
       getMeAchievements: (args) => request("GET", "/me/achievements", { hasBody: false }, args),
       // POST /me/anthropic-link — rank: any-builder — POST /me/anthropic-link
       postMeAnthropicLink: (args) => request("POST", "/me/anthropic-link", { hasBody: true }, args),
+      // GET /me/credits — rank: any-builder — GET /me/credits
+      getMeCredits: (args) => request("GET", "/me/credits", { hasBody: false }, args),
       // GET /me/cross-project — rank: any-builder — GET /me/cross-project
       getMeCrossProject: (args) => request("GET", "/me/cross-project", { hasBody: false }, args),
       // PATCH /me/cross-project — rank: any-builder — PATCH /me/cross-project

package/clients/bongos-client/index.d.ts

@@ -37,7 +37,7 @@ export interface GetBuildersIdOnboardingResponse { builder_id: unknown; onboardi
 export interface GetBuildersIdProfileResponse { builder: unknown; shipped_count: unknown; recent_ships: unknown; achievements: unknown; cross_project?: unknown; handle?: unknown }
 export interface GetBuildersMePendingRankChangeResponse { change: unknown; greeting?: unknown }
 export interface GetBuildersRosterResponse { builders: unknown; stale_hours: unknown; stale_hours_source: unknown }
-export interface GetClosenessForMeResponse { closeness: unknown; count: unknown }
+export interface GetClosenessForMeResponse { closeness: unknown; count: unknown; returned: unknown }
 export interface GetClosenessWeightsResponse { weights: unknown; window_days: unknown; note: unknown }
 export interface GetClosenessWithBuilderIdResponse { closeness: unknown; why: unknown }
 export interface GetConnectionsDegreeHandleResponse { handle: unknown; degree: unknown; mutuals: unknown; mutual_count: unknown; truncated: unknown }
@@ -528,6 +528,8 @@ export interface BongosClient {
     getBugAttachmentsName(args?: RequestArgs): Promise<ApiResponse>;
   };
   "builders": {
+    /** GET /builders/{builderId}/credits — rank: metic+archon */
+    getBuildersBuilderIdCredits(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /builders/{id}/active-claims — rank: metic+archon */
     getBuildersIdActiveClaims(args?: RequestArgs): Promise<GetBuildersIdActiveClaimsResponse>;
     /** GET /builders/{id}/activity — rank: any-builder */
@@ -810,6 +812,8 @@ export interface BongosClient {
     getMeAchievements(args?: RequestArgs): Promise<GetMeAchievementsResponse>;
     /** POST /me/anthropic-link — rank: any-builder */
     postMeAnthropicLink(args: RequestArgs & { body: PostMeAnthropicLinkRequest }): Promise<PostMeAnthropicLinkResponse>;
+    /** GET /me/credits — rank: any-builder */
+    getMeCredits(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /me/cross-project — rank: any-builder */
     getMeCrossProject(args?: RequestArgs): Promise<GetMeCrossProjectResponse>;
     /** PATCH /me/cross-project — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -217,6 +217,8 @@ export function createClient(opts = {}) {
       getBugAttachmentsName: (args) => request("GET", "/bug-attachments/{name}", { hasBody: false }, args),
     },
     "builders": {
+      // GET /builders/{builderId}/credits — rank: metic+archon — GET /builders/:builderId/credits
+      getBuildersBuilderIdCredits: (args) => request("GET", "/builders/{builderId}/credits", { hasBody: false }, args),
       // GET /builders/{id}/active-claims — rank: metic+archon — GET /builders/:id/active-claims
       getBuildersIdActiveClaims: (args) => request("GET", "/builders/{id}/active-claims", { hasBody: false }, args),
       // GET /builders/{id}/activity — rank: any-builder — GET /builders/:id/activity
@@ -499,6 +501,8 @@ export function createClient(opts = {}) {
       getMeAchievements: (args) => request("GET", "/me/achievements", { hasBody: false }, args),
       // POST /me/anthropic-link — rank: any-builder — POST /me/anthropic-link
       postMeAnthropicLink: (args) => request("POST", "/me/anthropic-link", { hasBody: true }, args),
+      // GET /me/credits — rank: any-builder — GET /me/credits
+      getMeCredits: (args) => request("GET", "/me/credits", { hasBody: false }, args),
       // GET /me/cross-project — rank: any-builder — GET /me/cross-project
       getMeCrossProject: (args) => request("GET", "/me/cross-project", { hasBody: false }, args),
       // PATCH /me/cross-project — rank: any-builder — PATCH /me/cross-project

package/docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md

@@ -0,0 +1,36 @@
+# ADR 0230 — A look skill is a composition grammar; the palette is the pack and the texture is a library entry
+
+- **Status:** accepted
+- **Date:** 2026-09-02
+- **Task:** [task 1003327](https://cloudbongos.com/builders#/task/1003327) (goal 1000083 — the ui-design module as a platform capability; criterion `uidesign-skills-in-house`)
+- **Relates to:** [ADR 0198](<redacted>.md) (a dangerous verdict lands a spec, never a copy), [ADR 0219](<redacted>.md) (a look is a branding pack), [ADR 0220](<redacted>.md) (the landing shape of a rebuild), [ADR 0222](<redacted>.md) (the owner's imagery rule), [ADR 0223](0223-the-detector-is-two-tiers-in-the-kit.md) (the tells the pre-flights point at), [ADR 0196](<redacted>.md) (the token contract)
+
+## Context
+
+The taste-skill rebuild spec ([task 1003325](https://cloudbongos.com/builders#/task/1003325)) carries four requirement groups that are unlike the other seven. `design-taste-frontend`, `high-end-visual-design` and `redesign-existing-projects` are **methods** — they tell an agent how to work. `minimalist-ui`, `industrial-brutalist-ui`, `gpt-taste` and `stitch-design-taste` are **looks**: upstream, each one shipped a palette, a set of faces, and in two cases an explicit instruction to install one.
+
+That is exactly what this platform's contract forbids. A pack carries fifteen tokens and a page reads only those (ADR 0196); a look that wants a sixteenth is a contract change and an ADR (ADR 0219). Four skills that each hand an agent a warm bone canvas, an off-white document paper, a hazard red and a graded ambient background would be four silent forks of the world, indistinguishable in a diff from a page that simply broke the rules — and they would fight the style library, which already ships looks as packs an instance adopts through `config/branding.json`.
+
+Three further collisions had to be settled rather than papered over:
+
+1. **One substrate per project** (brutalist) against **both modes on every page** (the platform floor, and the preamble's dark twins).
+2. **A random selection seeded from the prompt** (gpt-taste) against a repository where two sibling surfaces must be reconcilable a year later by reading the files.
+3. **An authored palette for a downstream tool** (stitch) against a world the instance already owns — a document that invents colours describes a different product than the one that will be built.
+
+## Decision
+
+1. **A look skill ships a composition grammar and no colours.** Its rules are structure, rhythm, type roles, component anatomy, motion and bans. Every colour it names is a `var()` or a `color-mix()` of the fifteen. The palette is the instance's pack; a variant is a **library entry** at `modules/ui-design/styles/`, and each look skill names the entry it was tuned against (`minimalist-ui` → `expedition`, `industrial-brutalist-ui` → `chrome-world` for the terminal archetype and `expedition` for the print one, `gpt-taste` → pack-agnostic, `stitch-design-taste` → whichever the document transcribes). A skill never adds a face: the pack's two stacks are the type system, and a face the look wants is a pack change.
+2. **A substrate becomes an archetype, and the other mode still ships.** `industrial-brutalist-ui` commits to one archetype per project — the archetype decides which mode the surface is *composed for*, and the other mode is the same composition on the other tier, complete, measured, and given its own shots. The upstream's "never both" survives as "never mixed in one interface", which is the part that was actually about craft.
+3. **The selection is deterministic and written down, not rolled.** `gpt-taste`'s plan block derives its hero architecture, its three component architectures and its two motion paradigms from the surface's own route, then bumps the index where a sibling surface already used that architecture, and records both. The upstream's anti-repetition goal is kept; its unreproducible mechanism is not. The block is written before any markup and carries the hero arithmetic, the grid-density proof and the measured contrast pairs.
+4. **A design document transcribes the world, it does not author one.** `stitch-design-taste` writes in the platform's own `DESIGN.md` frontmatter shape — the shape every library look already carries, so a document produced here reads back as a style — and its colour contract is the instance's thirteen with their real hex values and the instance's own roles, **diffed against the pack rather than retyped**. Its universal bans (no pure black, no serif in a dashboard) are defaults that the instance's `DESIGN.md` overrules, and the document says so in its own closing clause so the external tool is not told a different product exists.
+5. **The imagery rule survives the port intact.** The upstream's seeded placeholder photography (minimalist, gpt-taste) and its filtered stock imagery are **dropped, not softened**: the only raster a look skill may ask for is a text-free hero plate or hero object with its provenance sidecar (ADR 0222). `stitch-design-taste`'s signature inline headline image is a hero object under that same rule.
+6. **Every motion rule lives inside the Kill Switch, and what cannot live there is named unavailable.** Scroll-driven motion is CSS (`animation-timeline: view()` / `scroll()`) behind `@supports`, with at most one `IntersectionObserver` adding a single class as the fallback; spring physics, pointer-tracked hover and shared-element transitions are named *not available* rather than approximated in script. Brutalist degradation (halftone, scanlines, noise) is static by construction, built from the one legal literal.
+7. **The pre-flight is the kit, and the detector is the mechanical half of it.** Each skill closes with a checklist read off `kit/render.js` shots and `kit/contrast.js` pairs, and points at `kit/tells.js` (via `check-mock.js`) for the rules a machine can decide, so a look skill adds no reviewer of its own.
+
+## Consequences
+
+- The module now ships **thirteen** in-house skills and the criterion `uidesign-skills-in-house` has its full set of style skills. A builder on any instance can ask for a minimal, a brutalist or an anti-default surface and get a grammar that composes in *that instance's* colours, not in the grammar author's.
+- The four looks are directly comparable, because they differ only in structure: rendering the same page under the same pack with two different look skills shows the grammar, which is what a builder is actually choosing between.
+- `tests/ui_design_skills.mjs` gains a `LOOKS` group that pins what a look skill may not do: name a hex literal of its own outside the legal black/white-with-alpha carve-out, add a face, or mandate an image. The generic in-house pins (the preamble, the `Rebuilt from` section, the style library named, no image mandate, the switch, the kit) already applied and still do.
+- Rejected: shipping each look as a **pack** in the style library instead of a skill (a look skill's content is composition, and three of the four have no palette worth carrying — `gpt-taste` is pack-agnostic and `stitch-design-taste` writes a document); allowing a look skill to declare a sixteenth token for its substrate (a contract change touching every sheet and every drift test, for four skills that do not need it once a radius is understood as a derived tier); and keeping the upstream's random selection behind a fixed seed (still unreadable in a diff, and it would have made the sibling check impossible).
+- Open: `radius: 0` on a brutalist surface is a derived-tier decision written in that sheet's header comment. If a third look wants a systemic derived-tier override, the right answer is a **derived tier in the library's pack shape**, not a third comment convention — that would be its own ADR.

package/docs/adr/README.md

@@ -315,6 +315,7 @@ This keeps the decision history honest and traceable.
 | 0227 | [**A task network map is refused; the goal graph is the map, and search answers findability** ([task 1003282](https://cloudbongos.com/builders#/task/1003282) · goal 1000072, criterion `legibility-project-map`, which gates itself on this spike). Measured across a swept density range (p=2%–40% of tasks carrying a dependency): a node-link view of ~1,357 tasks is confetti, not structure, and densifying it draws forty goals badly while claiming to show a thousand tasks — a confident picture of nothing is the opposite of the legibility this goal serves. Decision: NO whole-corpus task map at any density; the readable surface is the ~40-node GOAL graph as the entry point with a per-goal DEPENDENCY FOREST as the drill-down, queried when a goal is opened rather than zoomed out of a global map. Every edge a map could draw already exists in the DB and none needs a new table — `task_dependencies` (020), `tasks.parent_task_id`, `tasks.goal_id`, `task_criteria`→`done_when_criteria`, `idea_inbox.promoted_to_task_id`, `idea_inbox.merged_into_idea_id` (`core_195`), `tasks.version_id` (membership, never an edge). **Findability (goal 1000027) answers the owner’s question more cheaply than a map**: the ask splits into “find what I was brainstorming”, which `/recall` (ADR 0060) plus the two lineage columns already answers end to end and which wants a text LINEAGE TRAIL — one thing and its ancestry — not a picture; and “see the shape of the portfolio”, the only half a graph earns, which is about ~40 goals and not about tasks. So the trail outranks the map and is sequenced first. Accessibility: the TABLE is the primary surface and the graph the enhancement (not an `aria-label` on an SVG blob, not a toggle hiding the accessible path), no sideways scroll on the page (the graph scrolls inside its own container), and category is text as well as colour since the ADR 0192 set is not colour-distinguishable at forty nodes. Ranked list: (1) measure the real density against the live DB — it GATES and may cancel the rest, (2) the lineage trail, (3) the goal graph, (4) the per-goal forest. Rejected: view A (every task); view D (densified); a prototype as the output (the criterion forbade it — `spike-task-map.js` is a measuring instrument under `docs/research/`, wired to no route); and building before measuring. Honest limit: the corpus is SYNTHETIC (the live DB was unreachable), so the verdict is robust across the sweep but the specific numbers are model output — which is why item 1 is a measurement against the real DB.](<redacted>.md) | GDS / legibility + hall |
 | 0228 | [**The reading room owes a reference its content rules, not a second archetype** ([task 1003473](https://cloudbongos.com/builders#/task/1003473) · goal 1000081). The archetype task 1003306 built for the primer — a linear read with a gate — now serves drachmae, a REFERENCE people open to answer one question about how they get paid. Decision: the same room with ONE body modifier, `room--reference`, switching on content rules in `room.css` §8 rather than a second sheet or a `.page-head--reference` voice: the linear-read instruments are off (no progress hairline, no section counters, no read time; `primer.css`, which holds only the acknowledge gate, is no longer loaded), the outline goes to h3 depth read from the rendered DOM and lights the entry and its part, every h2/h3/h4 is an always-visible address (`.room-anchor`) that copies its link, a deep link is landed by the page after the document, the live section and the fonts (a swap moved the browser's own landing 300px, and `:target` had resolved against nothing), the collapsed phone outline rides under the top bar naming the part, and the live bounty table is a section ahead of the closing links rather than an appendix after them. Found by rendering before touching anything and fixed in the shared reader: `md-reader.js` stopped at `###`, so the doc's six earning sources rendered as paragraphs with a literal `####`; the bold rule refused an inner `*`; a linked heading slugged its target's path into the address. Rejected: a second archetype sheet, hover-only anchors (a phone has no hover), an accordion outline (the sub-questions are what a reader scans for), placing the live table inside the prose (it would lose its outline entry), and teaching the kit stub to serve markdown (the ui-design module's). Pinned by `tests/hall_reference_world.mjs`, four of whose tests run the reader in a vm.](<redacted>.md) | hall / design |
 | 0229 | [**The title is the door into a task record, and the record exits to where it was opened from** ([task 1003468](https://cloudbongos.com/builders#/task/1003468) · goal 1000081). The owner, working the live hall: a to-do card "just gets selected", and a record opened from a goal "only offers the tasks page". Both were shipped behaviour: tasks 1759/1869 made multi-select the primary card interaction and left a 26px `--ink-faint` ⤢ glyph as the only way from a claimable card into the record, and `task.js` hardcoded `Open the work board` in three renders with `task.html`'s crumb a fourth. Decision: `.task__title` carries a real link (`.task__link`) on both surfaces that render the card — the convention `.gr-title` and the ledger rows already use — bought up to the 24px floor with the inline-block + padding + equal-negative-margin recipe so the card does not re-space; the card body still toggles selection and bulk claim is untouched; the glyph goes (a second door to the same room, one the owner never found). The link carries WHERE it was opened from as `?from=<path+query+hash>` (`OTBTaskDetail.href`), a query param because the origin must survive a reload and a copied link and because a referrer drops the `#/goal/N` fragment; `task.js` resolves the exit once — `?from=` → same-origin referrer → the work board — points the crumb before the fetch so the way back exists in every state, and labels it the way the sidebar does. A value is honoured only as a path on this host: one leading slash, no backslash, no whitespace, never `/api/`, never this same record. Rejected: opening on the card body (deletes bulk claim), keeping the glyph beside the link, in-memory origin, referrer-first, `history.back()`. Pinned by seven vm tests in `tests/hall_record_world.mjs` §10 and four in `tests/hall_board_world.mjs` §7.](<redacted>.md) | hall / design |
+| 0230 | [**A look skill is a composition grammar; the palette is the pack and the texture is a library entry** ([task 1003327](https://cloudbongos.com/builders#/task/1003327) · goal 1000083, criterion `uidesign-skills-in-house`). Four groups of the taste-skill rebuild spec ship a *look*, not a method, and upstream each one shipped a palette and a set of faces — which is the one thing the fifteen-token contract forbids (ADR 0196, 0219). Decisions: (1) a look skill ships **structure, rhythm, type roles, component anatomy, motion and bans, and no colours** — every colour a `var()` or `color-mix()` of the fifteen, the palette the instance's pack, the texture a named entry in `modules/ui-design/styles/`, and no skill adds a face. (2) The brutalist "one substrate per project" becomes an **archetype** deciding which mode the surface is composed *for*, while the other mode ships complete and measured; "never mixed in one interface" is the part that was about craft. (3) `gpt-taste`'s prompt-seeded **random** selection becomes a deterministic one derived from the route and bumped against sibling surfaces, written into a plan block before any markup with the hero arithmetic, the grid-density proof and the measured contrast pairs — a roll nobody can reproduce is not a decision. (4) `stitch-design-taste` **transcribes** the world instead of authoring one: the platform's own `DESIGN.md` frontmatter shape, the thirteen diffed from the pack rather than retyped, and its universal bans stated as defaults the instance overrules. (5) The upstream's seeded placeholder photography is **dropped, not softened** (ADR 0222); (6) motion is CSS inside the Kill Switch and what cannot live there is named *not available*; (7) the pre-flight is the kit and `tells.js` is its mechanical half, so a look skill adds no reviewer of its own. Rejected: shipping each look as a pack, a sixteenth token for a substrate, a fixed seed behind the same roll.](<redacted>.md) | ui-design / skills |
 | 0226 | [**One stale-claim timer; reporting degrades where enforcement refuses** ([task 1003476](https://cloudbongos.com/builders#/task/1003476), goal 1000072, criterion `legibility-sort-and-staleness`). "How long may a claim go silent" had FOUR answers and none of them was the project's: the sweeper that actually releases a claim read `GDS_STALE_CLAIM_HOURS` (else 6h); `GET /builders/roster` and `GET /builders/:id/active-claims` each hardcoded 24h in byte-identical blocks; and the two `session_pulses` helpers defaulted to 30 minutes. The 6-vs-24 pair is the harm: the roster is the screen an Archon opens to decide whether to intervene, and for **eighteen hours** after the sweeper had released a claim, stamped its session log `[auto-released:stale]` and returned the task to `ready`, that screen still showed it healthy — while the roster's own comment claimed to "mirror" the sweeper, true of the definition and false of the number. Decision: ONE resolver, `src/stale-timer.js` (a KERNEL file, the `instance-config.js`/`branding.js` category — host config a module reads, never hardcodes), reached by modules through the doorway and by core routes and the CLI directly. Precedence: explicit override (`--threshold-hours`, `?stale_hours=` — a LENS, labelled `query`, never a reconfiguration) → `<PREFIX>_STALE_CLAIM_HOURS` via `instance-config.resolveEnv`, whose legacy prefix chain still honours the live `GDS_STALE_CLAIM_HOURS` so **nothing in a running deployment has to change** (and which is the channel ADR 0190's runner already patches into `web.env`) → **6**, the SWEEP's historical number and deliberately not the roster's 24, because the sweep is the surface that acts and unifying on 24 would have made every project three times more patient with a dead claim under cover of a refactor. Bound 1..720h — the range `/builders/roster` has published since V3.R14; one timer, one bound. Every surface that prints the timer prints its PROVENANCE (`stale_hours_source`, the sweep header, the auto-release note): a number without it is exactly what let 6 and 24 coexist unnoticed. **The fail posture is asymmetric and that is the decision**: the resolver reports an unusable value rather than throwing, then a surface that only READS degrades to the default and names the bad var (500-ing the roster an Archon opened to find the problem would hide the problem), while the SWEEP refuses to run at all (it releases other people's claims and stamps their logs; no reload undoes that) — a surface that only reads may guess and say so, a surface that acts may not guess. Both routes now share one `staleHoursFor(req, res)`; two copies of a literal is how the drift happened twice inside one file. Rejected: a new `config/stale.json` tier (the env route already IS the per-project channel); making 24 the shared default; throwing from the resolver (forces a second reader — the original bug); folding in the boards' 14/30/60-DAY task buckets (a different question — days, about a task, a browsing lens with no enforcement behind it); a DB row + settings UI (a reasonable next step, but the defect was four numbers, not a missing knob — a row added before the readers agreed would have been a fifth).](<redacted>.md) | GDS / claims + ops |
 
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.