@bongos/core 1.19.478 → 1.19.480

package/docs/api/openapi.json

@@ -2625,6 +2625,54 @@
         ]
       }
     },
+    "/builders/{builderId}/credits": {
+      "get": {
+        "operationId": "get_builders_builderId_credits",
+        "tags": [
+          "builders"
+        ],
+        "summary": "GET /builders/:builderId/credits",
+        "description": "GET /builders/:builderId/credits — another builder's ledger. rank: metic — gated on the `builder.roster.read` ATOM, the same gate /builders/:id/active-claims carries, because this is the same act: reading another builder's record off the roster. ADR 0157 delegated that atom archon→metic. Note this exposes NO new secret — the leaderboard already publishes total_credits and /builders/:id/profile already publishes per-task awards, both unauthenticated. What this adds is the itemisation, which is precisely what makes the ledger auditable. The param is `:builderId`, not the `:id` its neighbours in src/bongos/routes/builders.js use, and deliberately: tests/own_scope_guard.mjs classifies a route as cross-owner by whether a path param NAMES a builder, and a bare `:id` reads as own-scoped. Since this file also mounts /me/credits it is held to that guard — so the explicit name is what lets the guard see this route for what it is and check that its gate is really there.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `builder.roster.read` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/economy/routes/credits.js",
+        "x-permissions": [
+          "builder.roster.read"
+        ],
+        "parameters": [
+          {
+            "name": "builderId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `builderId`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/builders/{id}/active-claims": {
       "get": {
         "operationId": "get_builders_id_active_claims",
@@ -8280,6 +8328,37 @@
         ]
       }
     },
+    "/me/credits": {
+      "get": {
+        "operationId": "get_me_credits",
+        "tags": [
+          "me"
+        ],
+        "summary": "GET /me/credits",
+        "description": "GET /me/credits — the caller's own ledger. rank: any-builder — own-scoped by construction: the builder id comes from the authenticated session and is never read off the request, so there is no parameter here to tamper with. A builder may always read their own ledger; gating this any higher would mean a Xenos cannot see what they were paid.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/economy/routes/credits.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me/cross-project": {
       "get": {
         "operationId": "get_me_cross_project",
@@ -21426,7 +21505,7 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 339,
+  "x-endpoint-count": 341,
   "x-schema-count": 374,
   "x-undocumented-bodies": 9,
   "x-response-schemas": 255,

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 339 endpoints across 54 route files.
+> **Generated from the live route files** — the route file is authoritative. 341 endpoints across 55 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -119,10 +119,11 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | GET | `/api/bongos/bug-attachments/:name` | `any-builder` | — | GET /api/bongos/bug-attachments/:name — stream one stored image. |
 
-## `builders` (10)
+## `builders` (11)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
+| GET | `/api/bongos/builders/:builderId/credits` | `metic+archon` | — | GET /builders/:builderId/credits — another builder's ledger. |
 | GET | `/api/bongos/builders/:id/active-claims` | `metic+archon` | — | GET /builders/:id/active-claims — V3.R14 (task 238). |
 | GET | `/api/bongos/builders/:id/activity` | `any-builder` | — | GET /builders/:id/activity — the profile's PER-CRAFT activity log (task 1003281, goal 1000072, criterion legibility-activity-by-role). |
 | PATCH | `/api/bongos/builders/:id/budget` | `metic+archon` | `monthly_budget_usd` | PATCH /builders/:id/budget — set or clear a builder's monthly spend ceiling (V3.R84 task 302, criterion C3). |
@@ -345,13 +346,14 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/llm-cache/lookup` | `metic+archon` | `cache_key`, `tokens_saved_est` | POST /llm-cache/lookup — hit/miss + atomic hit_count bump. |
 | POST | `/api/bongos/llm-cache/store` | `metic+archon` | `spec`, `result_stdout`, `result_cost_usd` | POST /llm-cache/store — upsert a freshly-produced result. |
 
-## `me` (30)
+## `me` (31)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/me` | `any-builder` | — | PMS-V2 task 188: response now also carries `unlocked` (server-joined achievement metadata) + `locked_with_progress` (server-computed huma… |
 | GET | `/api/bongos/me/achievements` | `any-builder` | — | The builder's unlocked achievements (joined to achievement metadata). |
 | POST | `/api/bongos/me/anthropic-link` | `any-builder` | `anthropic_email`, `anthropic_user_id` | V3.R10 (task 235), criterion C3 — link the authed builder's Anthropic account. |
+| GET | `/api/bongos/me/credits` | `any-builder` | — | GET /me/credits — the caller's own ledger. |
 | GET | `/api/bongos/me/cross-project` | `any-builder` | — | the caller's OWN cross-project record + privacy flags (own data). |
 | PATCH | `/api/bongos/me/cross-project` | `any-builder` | `hide_stats`, `account_visibility`, `recruiter_discoverable` | flip the caller's OWN privacy flags (C2's self-serve opt-out plus the task-1002966 pair; own data, keyed on the authenticated github_id —… |
 | PATCH | `/api/bongos/me/disciplines` | `any-builder` | `preferred_disciplines` | Self-service edit of the authenticated builder's preferred disciplines (migrations 027 + 086 / V3.R80). |

package/docs/copy-inventory.md

@@ -84,11 +84,11 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 |---|---|---|---|
 | `a8813c34d20d` | certain | “Host denied” | `modules/hall-ui/public/box-panel.js:160` |
 | `a8813c34d20d` | certain | “Host denied” | `modules/hall-ui/public/box-panel.js:340` |
-| `b585019e3e1d` | certain | ' lines collapse into one | `modules/hall-ui/public/md-reader.js:163` |
-| `44e29d37ddf6` | certain | '); out = out.replace(/(^\|[^*])\*([^*]+)\*(?!\*)/g, '$1 | `modules/hall-ui/public/md-reader.js:117` |
-| `66cea7cefa4e` | certain | '; for (const row of bodyRows) { html += ' | `modules/hall-ui/public/md-reader.js:194` |
-| `53e4ac514458` | certain | '; out.push(html); continue; } // Lists (unordered '- ' or ordered '1. '); consecutive items collapse. if (/^( | `modules/hall-ui/public/md-reader.js:198` |
-| `87fa099f5068` | certain | '; } html += ' | `modules/hall-ui/public/md-reader.js:198` |
+| `b585019e3e1d` | certain | ' lines collapse into one | `modules/hall-ui/public/md-reader.js:186` |
+| `44e29d37ddf6` | certain | '); out = out.replace(/(^\|[^*])\*([^*]+)\*(?!\*)/g, '$1 | `modules/hall-ui/public/md-reader.js:140` |
+| `66cea7cefa4e` | certain | '; for (const row of bodyRows) { html += ' | `modules/hall-ui/public/md-reader.js:217` |
+| `53e4ac514458` | certain | '; out.push(html); continue; } // Lists (unordered '- ' or ordered '1. '); consecutive items collapse. if (/^( | `modules/hall-ui/public/md-reader.js:221` |
+| `87fa099f5068` | certain | '; } html += ' | `modules/hall-ui/public/md-reader.js:221` |
 | `cb327c50b079` | certain | 's dev box (state: {…}). Any uncommitted work on that box is lost. The box is destroyed; the builder can open  | `modules/hall-ui/public/harbor.js:125` |
 | `544794f1ec8f` | certain | (later in | `modules/hall-ui/public/index.html:9` |
 | `3ac2eb36ba97` | certain | (no sections) | `modules/hall-ui/public/drachmae.js:128` |
@@ -1001,7 +1001,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `3c148c7b9539` | certain | Your work runs on a dev box we host for you — there's almost nothing to install. Choose how to connect: | `modules/hall-ui/public/hall-render.js:653` |
 | `137b07b42203` | certain | Zoom in | `modules/hall-ui/public/diagram-viewer.js:98` |
 | `0d0bfa651b36` | certain | Zoom out | `modules/hall-ui/public/diagram-viewer.js:96` |
-| `cc361cc7333a` | certain | \s?/.test(raw)) { const quoteLines = []; while (i | `modules/hall-ui/public/md-reader.js:163` |
+| `cc361cc7333a` | certain | \s?/.test(raw)) { const quoteLines = []; while (i | `modules/hall-ui/public/md-reader.js:186` |
 | `44e6e402db94` | certain | account, then open | `modules/hall-ui/public/hall-render.js:653` |
 | `ae43396446ed` | certain | account. | `modules/hall-ui/public/hall-render.js:653` |
 | `9612c983451f` | certain | achieved · | `modules/hall-ui/public/roadmap.js:263` |

package/docs/copy-registry.json

@@ -1631,7 +1631,7 @@
       "surface": "builders-hall",
       "text": "' lines collapse into one",
       "file": "modules/hall-ui/public/md-reader.js",
-      "line": 163,
+      "line": 186,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -1640,7 +1640,7 @@
       "surface": "builders-hall",
       "text": "'); out = out.replace(/(^|[^*])\\*([^*]+)\\*(?!\\*)/g, '$1",
       "file": "modules/hall-ui/public/md-reader.js",
-      "line": 117,
+      "line": 140,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -1649,7 +1649,7 @@
       "surface": "builders-hall",
       "text": "'; for (const row of bodyRows) { html += '",
       "file": "modules/hall-ui/public/md-reader.js",
-      "line": 194,
+      "line": 217,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -1658,7 +1658,7 @@
       "surface": "builders-hall",
       "text": "'; out.push(html); continue; } // Lists (unordered '- ' or ordered '1. '); consecutive items collapse. if (/^(-|\\d+\\.)\\s+/.test(raw)) { const ordered = /^\\d+\\.\\s+/.test(raw); const items = []; while (i",
       "file": "modules/hall-ui/public/md-reader.js",
-      "line": 198,
+      "line": 221,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -1667,7 +1667,7 @@
       "surface": "builders-hall",
       "text": "'; } html += '",
       "file": "modules/hall-ui/public/md-reader.js",
-      "line": 198,
+      "line": 221,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9884,7 +9884,7 @@
       "surface": "builders-hall",
       "text": "\\s?/.test(raw)) { const quoteLines = []; while (i",
       "file": "modules/hall-ui/public/md-reader.js",
-      "line": 163,
+      "line": 186,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/file-map.md

@@ -133,7 +133,7 @@
 │   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,harbor,gate,pair,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav. Three ARCHETYPE sheets sit beside the per-page ones: `record.css` (the task + idea records, task 1003305), `room.css` (the READING ROOMS — the primer + the diagrams index, task 1003306: the reading measure and rhythm, the table of contents, the progress hairline and the framed figure diagram-viewer.js upgrades on both pages) and `oversight.css` (the OVERSIGHT family — government, watch, harbor, gate, task 1003469: the row, the figure band inside a panel, the group head, the inline form, the grant toggle and the shared confirm modal; named oversight because the vocabulary wall bans "governance" on the government surface). A page sheet then holds only what one page has and the others do not — `primer.css` the acknowledge gate, `diagrams.css` the legend strip, `gate.css` the hold reasons and file chips, `watch.css` the severities, the report reader and the grade trend, `people.css` the directory's identity cell (task 1003470 made the legacy door `/scouting` ship the same body and script as `/people`; task 1003440 then deleted the door — `scouting.html` and `scouting.states.json` are gone and the URL 301s to `/people`).
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. CLAUDE.md, module.json, registry.js, flags.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
-│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's styles/grove/assets/ is the worked example. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove; STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
+│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. minimalist-ui/, industrial-brutalist-ui/, gpt-taste/, stitch-design-taste/ (task 1003327 / ADR 0230) are the four looks, composition grammars with no colours of their own: the palette is the instance's pack and the texture is a named entry in styles/; a substrate is an archetype that still ships both modes, gpt-taste's selection is derived from the route rather than rolled, and stitch-design-taste writes a DESIGN.md-shaped contract document whose thirteen are transcribed from the pack. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's styles/grove/assets/ is the worked example. style/ (task 1003475 / ADR 0231) is the module's first FIRST-PARTY skill (no upstream, so a `## First party` section instead of `## Rebuilt from`): the /style session in which an owner authors their own look in four bounded steps, rendering the nearest library entries before asking, drafting inside the contract, retuning by measurement, and handing over the one-step adoption without ever writing config/branding.json. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest, the otb-character-review skill. CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.
 │   └── demo/                    ← BV1.R52 acceptance-proof module: one rank-gated write route + one namespaced migration proving the loader mounts a scaffolded module with zero core edits. CLAUDE.md, module.json.

package/docs/module-api-changelog.md

@@ -1393,5 +1393,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.476 with no explicit bump. run 33662059275. (task 1002620)
   1.19.478 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.477 with no explicit bump. run 33664027105. (task 1002620)
+  1.19.479 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.478 with no explicit bump. run 33665076054. (task 1002620)
+  1.19.480 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.479 with no explicit bump. run 33668172411. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -220,6 +220,8 @@ function createClient(opts = {}) {
       getBugAttachmentsName: (args) => request("GET", "/bug-attachments/{name}", { hasBody: false }, args),
     },
     "builders": {
+      // GET /builders/{builderId}/credits — rank: metic+archon — GET /builders/:builderId/credits
+      getBuildersBuilderIdCredits: (args) => request("GET", "/builders/{builderId}/credits", { hasBody: false }, args),
       // GET /builders/{id}/active-claims — rank: metic+archon — GET /builders/:id/active-claims
       getBuildersIdActiveClaims: (args) => request("GET", "/builders/{id}/active-claims", { hasBody: false }, args),
       // GET /builders/{id}/activity — rank: any-builder — GET /builders/:id/activity
@@ -502,6 +504,8 @@ function createClient(opts = {}) {
       getMeAchievements: (args) => request("GET", "/me/achievements", { hasBody: false }, args),
       // POST /me/anthropic-link — rank: any-builder — POST /me/anthropic-link
       postMeAnthropicLink: (args) => request("POST", "/me/anthropic-link", { hasBody: true }, args),
+      // GET /me/credits — rank: any-builder — GET /me/credits
+      getMeCredits: (args) => request("GET", "/me/credits", { hasBody: false }, args),
       // GET /me/cross-project — rank: any-builder — GET /me/cross-project
       getMeCrossProject: (args) => request("GET", "/me/cross-project", { hasBody: false }, args),
       // PATCH /me/cross-project — rank: any-builder — PATCH /me/cross-project

package/modules/economy/credits.js

@@ -921,6 +921,81 @@ async function sumCreditsForTasks(builderId, taskIds) {
   return rows[0] ? rows[0].total : 0;
 }
 
+// The three ideator streams (ADR 0172) each book under a reason key that EMBEDS
+// the idea (and, for stream 1, the task) — that string IS the idempotency
+// predicate, which is why it can't be a bare constant:
+//
+//   stream 1 (trailing)    idea.credit.task_ship:<ideaId>:<taskId>
+//   stream 2 (grade)       idea.credit.full_pass:<ideaId>
+//   stream 3 (board room)  idea.credit.governance_pass:<ideaId>
+//
+// So "show me everything stream 2 ever paid me" is a PREFIX question, never an
+// equality one — an exact-match filter over `reason` can only ever return the
+// single row for one idea. These are the prefixes `reasonPrefix` is meant to be
+// given; exported so a reader never hand-builds the string and drifts from the
+// writers above.
+const IDEA_STREAM_REASON_PREFIXES = {
+  task_ship: 'idea.credit.task_ship:',
+  full_pass: 'idea.credit.full_pass:',
+  governance_pass: 'idea.credit.governance_pass:',
+};
+
+// creditLedger — the per-row read over credit_log for ONE builder. The ledger is
+// append-only and builders.total_credits is only its cache, so this is the
+// authoritative answer to "what was I actually paid, and for what".
+//
+// It exists because until now credit_log had NO read surface anywhere in the API
+// (blocker 1000127): every other reader in the tree is an internal aggregate or
+// an existence probe, so the ideator lane could not be audited without direct
+// database access, and the hall had no surface that could show an author what an
+// idea earned them.
+//
+// Filters are AND-ed. `reason` is exact — right for the unparameterized keys
+// (task.shipped, session.token_reward, idea_promotion_bonus); `reasonPrefix` is a
+// literal prefix match for the parameterized ones above. LIKE wildcards in the
+// caller's input are escaped, so a `%` in a query string matches a literal `%`
+// and cannot widen the scan. Newest-first; `total` is the UNPAGINATED count, so a
+// caller can tell whether more rows exist.
+async function creditLedger(builderId, { reason = null, reasonPrefix = null, taskId = null, since = null, limit = 50, offset = 0 } = {}) {
+  const id = Number(builderId);
+  if (!Number.isInteger(id) || id <= 0) return { rows: [], total: 0 };
+
+  const where = ['builder_id = $1'];
+  const params = [id];
+  if (reason) {
+    params.push(reason);
+    where.push(`reason = $${params.length}`);
+  }
+  if (reasonPrefix) {
+    params.push(reasonPrefix.replace(/([\\%_])/g, '\\$1') + '%');
+    where.push(`reason LIKE $${params.length} ESCAPE '\\'`);
+  }
+  if (taskId != null) {
+    params.push(Number(taskId));
+    where.push(`task_id = $${params.length}`);
+  }
+  if (since) {
+    params.push(since);
+    where.push(`recorded_at >= $${params.length}::timestamptz`);
+  }
+  const whereSql = where.join(' AND ');
+
+  // Count and page in one round trip. reward_basis is deliberately NOT selected:
+  // it is session top-up bookkeeping (core_196), not a ledger fact a reader needs,
+  // and exposing it would invite its being read as money.
+  const { rows } = await pool.query(
+    `SELECT id, delta, reason, description, task_id, session_id, recorded_at,
+            COUNT(*) OVER ()::int AS total_count
+       FROM credit_log
+      WHERE ${whereSql}
+      ORDER BY recorded_at DESC, id DESC
+      LIMIT $${params.length + 1} OFFSET $${params.length + 2}`,
+    [...params, limit, offset]
+  );
+  const total = rows.length > 0 ? Number(rows[0].total_count) : 0;
+  return { rows: rows.map(({ total_count, ...r }) => r), total };
+}
+
 module.exports = {
   leaderboard,
   KIND_MULTIPLIERS,
@@ -953,4 +1028,7 @@ module.exports = {
   netNegativeBonusAmount,
   awardNetNegativeBonus,
   sumCreditsForTasks,
+  // the ledger read surface (task 1003484, blocker 1000127)
+  creditLedger,
+  IDEA_STREAM_REASON_PREFIXES,
 };

package/modules/economy/module.json

@@ -5,7 +5,7 @@
   "coreVersion": "^1.7.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "routes": ["cost", "leaderboard", "reward"] },
+  "contributes": { "routes": ["cost", "credits", "leaderboard", "reward"] },
   "provides": ["reward"],
   "consumes": []
 }

package/modules/economy/reward.js

@@ -73,6 +73,10 @@ module.exports = {
   getBuilderAchievements: (...a) => achievements.getBuilderAchievements(...a),
   getLockedAchievementsProgress: (...a) => achievements.getLockedAchievementsProgress(...a),
   sumCreditsForTasks: (...a) => credits.sumCreditsForTasks(...a),
+  // The per-row ledger read (task 1003484). On the port because the surface core
+  // most wants it for is a HALL view — "what did this idea earn me" — and a core
+  // route must reach economy through here, never by importing the module.
+  creditLedger: (...a) => credits.creditLedger(...a),
   computeStreak: (...a) => streak.computeStreak(...a),
   wouldExtendStreak: (...a) => streak.wouldExtendStreak(...a),
 };

package/modules/economy/routes/credits.js

@@ -0,0 +1,151 @@
+// modules/economy/routes/credits.js — GET /me/credits + GET /builders/:builderId/credits:
+// the credit ledger, readable at last (task 1003484, blocker 1000127).
+//
+// WHY. `credit_log` is the append-only record of every drachma this instance has
+// ever paid, and `builders.total_credits` is only its cache — yet until this file
+// there was NO read surface for it anywhere in the API. Every other reader in the
+// tree is an internal aggregate or an existence probe. The consequences were not
+// abstract: nobody could answer "was this ideator actually paid, and under which
+// stream" without direct database access, the three ideator streams (ADR 0172)
+// could not be audited from outside at all, and the builders' hall had no surface
+// that could ever show an author what one of their ideas earned them.
+//
+// A balance you cannot itemise is a number you have to take on faith. This route
+// is what turns it back into a ledger.
+//
+// The route is only the doorway; `../credits.js` owns `creditLedger` and every
+// other credit_log query. Keep it that way — this file must never grow SQL.
+//
+// MODULE BOUNDARY: reaches core only through the published doorway
+// `../../../src/module-api`; `../credits` is an intra-module sibling.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const credits = require('../credits');
+
+// Cap the page. The ledger is unbounded and grows forever, so an uncapped read is
+// a slow query waiting to happen on the oldest, busiest builder.
+const DEFAULT_LIMIT = 50;
+const MAX_LIMIT = 200;
+const MAX_REASON_LEN = 200;
+
+// Pull the shared filter/paging shape out of the query string. Returns
+// { opts } on success or { error } with a res.fail code — both routes read the
+// SAME filters, and a filter that behaves differently depending on whose ledger
+// you are reading is exactly the drift this shared parser exists to prevent.
+function parseLedgerQuery(req) {
+  const q = req.query || {};
+  const { limit, offset } = api.parsePagination(req, { defaultLimit: DEFAULT_LIMIT, maxLimit: MAX_LIMIT });
+
+  for (const key of ['reason', 'reason_prefix']) {
+    const v = q[key];
+    if (v !== undefined && (typeof v !== 'string' || v.length > MAX_REASON_LEN)) {
+      return { error: 'bad_reason_filter' };
+    }
+  }
+
+  let taskId = null;
+  if (q.task_id !== undefined) {
+    const n = Number(q.task_id);
+    if (!Number.isInteger(n) || n <= 0) return { error: 'bad_task_id' };
+    taskId = n;
+  }
+
+  let since = null;
+  if (q.since !== undefined) {
+    // Validate here rather than letting Postgres raise: an unparseable timestamp
+    // would otherwise surface as a 500 on what is a plain bad request.
+    if (typeof q.since !== 'string' || Number.isNaN(Date.parse(q.since))) {
+      return { error: 'bad_since' };
+    }
+    since = q.since;
+  }
+
+  return {
+    opts: {
+      reason: q.reason || null,
+      reasonPrefix: q.reason_prefix || null,
+      taskId,
+      since,
+      limit,
+      offset,
+    },
+  };
+}
+
+// Shared responder — one shape for both routes, so a client (or the hall) can
+// read either without branching. `streams` echoes the ideator-stream reason
+// PREFIXES: the stream keys embed the idea id, so a caller that hand-built
+// 'idea.credit.full_pass:' would silently drift from the writer. Serving them
+// beside the rows means the audit filter is discoverable from the response.
+async function respondWithLedger(res, builderId, opts) {
+  const { rows, total } = await credits.creditLedger(builderId, opts);
+  // A builder's own balance, and cheap to recompute — never cached.
+  res.set('Cache-Control', 'no-store');
+  res.json({
+    builder_id: builderId,
+    rows,
+    page: api.pageMeta(opts.limit, opts.offset, total),
+    streams: credits.IDEA_STREAM_REASON_PREFIXES,
+  });
+}
+
+module.exports = function buildCreditsRouter() {
+  const router = express.Router();
+
+  // Route ORDER is deliberate, and the same rule modules/dev-box/routes/box.js
+  // documents: the route-rank auditor classifies from a lookahead window that
+  // checks requireRank/requirePermission before requireBuilder, so the
+  // PRIVILEGED route is declared FIRST. Below the own-scoped one, its gate
+  // would bleed upward and mislabel that route as privileged.
+
+  // GET /builders/:builderId/credits — another builder's ledger.
+  //
+  // rank: metic — gated on the `builder.roster.read` ATOM, the same gate
+  // /builders/:id/active-claims carries, because this is the same act: reading
+  // another builder's record off the roster. ADR 0157 delegated that atom
+  // archon→metic. Note this exposes NO new secret — the leaderboard already
+  // publishes total_credits and /builders/:id/profile already publishes per-task
+  // awards, both unauthenticated. What this adds is the itemisation, which is
+  // precisely what makes the ledger auditable.
+  //
+  // The param is `:builderId`, not the `:id` its neighbours in
+  // src/bongos/routes/builders.js use, and deliberately: tests/own_scope_guard.mjs
+  // classifies a route as cross-owner by whether a path param NAMES a builder, and
+  // a bare `:id` reads as own-scoped. Since this file also mounts /me/credits it is
+  // held to that guard — so the explicit name is what lets the guard see this route
+  // for what it is and check that its gate is really there.
+  router.get('/builders/:builderId/credits', api.requireBuilder, api.requirePermission('builder.roster.read'), async (req, res) => {
+    const targetId = api.parseId(req, res, { param: 'builderId', code: 'bad_builder_id', positiveInt: true });
+    if (targetId === null) return;
+    const { opts, error } = parseLedgerQuery(req);
+    if (error) return res.fail(error, 400);
+    try {
+      const b = await api.getBuilderById(targetId);
+      if (!b) return res.fail('builder_not_found', 404);
+      await respondWithLedger(res, targetId, opts);
+    } catch (err) {
+      console.error('[gds] GET /builders/:builderId/credits', err);
+      res.fail('credit_ledger_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // GET /me/credits — the caller's own ledger.
+  //
+  // rank: any-builder — own-scoped by construction: the builder id comes from the
+  // authenticated session and is never read off the request, so there is no
+  // parameter here to tamper with. A builder may always read their own ledger;
+  // gating this any higher would mean a Xenos cannot see what they were paid.
+  router.get('/me/credits', api.requireBuilder, async (req, res) => {
+    const { opts, error } = parseLedgerQuery(req);
+    if (error) return res.fail(error, 400);
+    try {
+      await respondWithLedger(res, Number(req.builder.id), opts);
+    } catch (err) {
+      console.error('[gds] GET /me/credits', err);
+      res.fail('credit_ledger_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/hall-ui/public/md-reader.js

@@ -56,9 +56,28 @@
     return out.join('/') + (p.endsWith('/') ? '/' : '');
   }
 
+  // Which link targets the reader will write into an href (task 1003482).
+  // escapeHtml stops markup, not URI schemes: a `javascript:` target would run
+  // on click. Vouched for: http(s), mailto, tel, an in-page #fragment, and a
+  // repo-relative path (which the resolver rewrites onto the repo bases).
+  // Everything else — javascript:, data:, vbscript:, file:, any unlisted
+  // scheme, a protocol-relative //host — renders as text. Tab/newline and
+  // leading controls are dropped before the scheme is read, because a
+  // browser's URL parser drops them too (`java\tscript:` runs).
+  const ALLOWED_SCHEMES = ['http', 'https', 'mailto', 'tel'];
+  function isAllowedLinkHref(href) {
+    if (href == null) return false;
+    const probe = String(href).replace(/[\t\n\r]/g, '').replace(/^[\x00-\x20]+/, '');
+    if (probe.startsWith('#')) return true;
+    if (/^[\/\\]{2}/.test(probe)) return false;
+    const scheme = probe.match(/^([a-z][a-z0-9+.-]*):/i);
+    return !scheme || ALLOWED_SCHEMES.includes(scheme[1].toLowerCase());
+  }
+
   // Build a link resolver bound to where THIS doc lives in the repo. Relative
   // repo paths (../adr/…, diagrams/…) are rewritten to something that resolves
   // in the browser instead of 404-ing under /builders/*:
+  //   - a target the allowlist refuses        → null (renderInline drops the <a>)
   //   - http(s):// or #anchor or mailto:/tel:  → unchanged
   //   - the diagrams dir                        → the in-hall diagrams route
   //   - everything else                         → GitHub blob/tree (bases fetched
@@ -72,6 +91,7 @@
     const diagramsHref = (opts && opts.diagramsHref) || '/builders/diagrams';
     return function resolveLinkHref(href) {
       if (!href) return href;
+      if (!isAllowedLinkHref(href)) return null;
       if (/^https?:\/\//i.test(href)) return href;
       if (href.startsWith('#')) return href;
       if (href.startsWith('mailto:') || href.startsWith('tel:')) return href;
@@ -108,6 +128,9 @@
     out = out.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_m, text, url) => {
       const safeUrl = url.replace(/&amp;/g, '&').replace(/&#39;/g, "'");
       const resolved = resolve(safeUrl);
+      // The reader never writes an href it did not vouch for — checked on the
+      // RESOLVED value, so a page's own resolver cannot reopen the door.
+      if (resolved == null || !isAllowedLinkHref(resolved)) return text;
       let linkHost = '';
       try { linkHost = new URL(resolved, location.href).hostname; } catch (_) { /* relative */ }
       const instApex = location.hostname.split('.').slice(-2).join('.');
@@ -236,5 +259,5 @@
     return { html: out.join('\n'), headings };
   }
 
-  window.OTBMdReader = { escapeHtml, slugify, normalizePath, makeResolveLinkHref, renderInline, splitTableRow, parseMarkdown };
+  window.OTBMdReader = { escapeHtml, slugify, normalizePath, isAllowedLinkHref, makeResolveLinkHref, renderInline, splitTableRow, parseMarkdown };
 })();

package/modules/ui-design/module.json

@@ -5,7 +5,7 @@
   "coreVersion": "^1.19.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "skills": ["design", "design-sync", "figma-design-sync", "design-taste-frontend", "design-taste-frontend-v1", "high-end-visual-design", "redesign-existing-projects", "impeccable", "image-to-code", "imagegen-frontend-web", "imagegen-frontend-mobile", "brandkit"] },
+  "contributes": { "skills": ["design", "design-sync", "figma-design-sync", "design-taste-frontend", "design-taste-frontend-v1", "high-end-visual-design", "redesign-existing-projects", "impeccable", "style", "minimalist-ui", "industrial-brutalist-ui", "gpt-taste", "stitch-design-taste", "image-to-code", "imagegen-frontend-web", "imagegen-frontend-mobile", "brandkit"] },
   "provides": [],
   "consumes": []
 }