@bongos/core 1.19.517 → 1.19.519

package/docs/module-api-changelog.md

@@ -1471,5 +1471,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.515 with no explicit bump. run 33798954769. (task 1002620)
   1.19.517 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.516 with no explicit bump. run 33799755382. (task 1002620)
+  1.19.518 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.517 with no explicit bump. run 33801792364. (task 1002620)
+  1.19.519 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.518 with no explicit bump. run 33802471495. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/agents/lib/validate.js

@@ -0,0 +1,306 @@
+'use strict';
+
+// modules/agents/lib/validate.js — the pure agent-definition validator (task
+// 1002487, goal 1000038 Phase 1; criterion `agents-malformed-rejected`).
+//
+// Answers one question with no I/O: "is this object a definition this instance is
+// willing to register?" Given a candidate definition and the caller's context
+// (the author's LIVE rank, the module keys in bounds), it returns a verdict plus
+// the full list of what is wrong with it.
+//
+// WHY IT IS PURE, AND WHY THAT IS THE POINT. Definitions arrive from two places —
+// a committed `.claude/agents/*.md` file reconciled at deploy (agents-sync, task
+// 1002490) and an instance-authored DB row. Both paths need the SAME answer, and
+// the answer must be checkable without a database, a model call, or a booted
+// server. So this file requires NOTHING: not the module doorway, not a sibling,
+// not even a node builtin. That also keeps it trivially inside the ADR 0083
+// boundary — `modules/**` may import only `src/module-api.js`, and importing
+// nothing clears that bar by construction.
+//
+// IT MUST NEVER THROW. The loader's contract is log-and-skip: one malformed
+// definition makes the registry smaller, never makes the boot fail. Every access
+// below is therefore defensive — a hostile getter, a circular `trigger_spec`, a
+// frozen object, `null`: all become a returned error, none become an exception
+// into the caller. The tests assert this directly (tests/agents_validate.mjs).
+//
+// FAIL CLOSED IS THE HOUSE RULE, in three specific places a future reader will be
+// tempted to relax:
+//   1. EVENT_CATALOG is the WIRED set, not the imaginable set. v1 dispatches
+//      exactly `task.shipped`. An unwired event name is refused rather than
+//      stored, because a definition carrying one looks armed in the registry and
+//      can never fire — the worst of both readings.
+//   2. An EMPTY allowed-module set means NOTHING is in scope, never everything.
+//      A caller that forgets to pass `allowedModules` gets refusals, not a
+//      wide-open agent. Same rule, same reason as goal-scope-check's `empty_scope`.
+//   3. An UNRESOLVED author rank has no authority over a protected module. A file
+//      cannot grant authority (ADR 0016), so "we could not determine the rank" is
+//      treated as "not enough rank", not as "skip the check".
+//
+// THE DB HOLDS THESE BOUNDS TOO, DELIBERATELY. Every limit here mirrors a CHECK
+// constraint in agents_001_definitions.sql. That duplication is defense in depth
+// and is meant to stay: the constraint is what stops a row that skipped this
+// validator, and this validator is what turns a would-be constraint violation
+// into a readable message naming the offending field — an insert that throws at
+// boot is precisely the crash the log-and-skip contract exists to prevent.
+
+// The WIRED event set for v1. Widening this is a deliberate act that must land
+// together with something that actually dispatches the new event.
+const EVENT_CATALOG = Object.freeze(['task.shipped']);
+
+// Mirrors agents_definitions_trigger_type_chk. 'event' consumes the catalog above;
+// 'on-demand' is the historian shape (a builder asks, the agent answers).
+const TRIGGER_TYPES = Object.freeze(['event', 'on-demand']);
+
+// Mirrors agents_definitions_model_tier_chk. No 'main' tier by design — an agent
+// is a subagent, never the main session.
+const MODEL_TIERS = Object.freeze(['default', 'routine']);
+
+// The rank ladder, low → high. Mirrors government/catalog.js RANK_ORDER and the
+// agents_definitions_author_rank_chk vocabulary. Duplicated rather than imported
+// because the module boundary forbids reaching into core (ADR 0083) — and it is a
+// closed, rarely-changing vocabulary the DB constraint pins independently.
+const RANK_ORDER = Object.freeze(['xenos', 'thetes', 'metic', 'archon']);
+
+// Sub-Metic builders stay out of the permission/methodology core (ADR 0043), and
+// that applies to an agent they author just as it applies to a task they claim.
+const SCOPE_RANK_FLOOR = 'metic';
+
+// Filename / URL-segment / CLI-argument safe — the same shape a module key takes,
+// mirroring agents_definitions_name_fmt_chk.
+const NAME_RE = /^[a-z][a-z0-9-]*$/;
+const NAME_MAX = 64;
+// Mirrors agents_definitions_persona_size_chk / _trigger_spec_size_chk. A persona
+// is a prompt sent to a paid model on every fire, so an unbounded one is both a
+// cost and a blast radius.
+const PERSONA_MAX = 32768;
+const TRIGGER_SPEC_MAX = 8192;
+
+// A plain data object — not an array, not null, not a boxed primitive. Arrays are
+// excluded explicitly because `typeof [] === 'object'` would otherwise let a list
+// masquerade as a spec.
+function isPlainObject(v) {
+  return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+
+function isNonEmptyString(v) {
+  return typeof v === 'string' && v.trim().length > 0;
+}
+
+// Read one property without trusting the object. A definition can arrive as a
+// db-sourced object with an accessor on it; a throwing getter must become a
+// refusal, not an exception into the loader.
+function safeGet(obj, key) {
+  try { return obj[key]; } catch (_) { return undefined; }
+}
+
+// A scope path must stay inside the tree. Rejects absolute POSIX and Windows
+// paths, and any `..` segment on either separator — the escape a scope wall
+// exists to stop.
+function isSafeScopePath(p) {
+  if (!isNonEmptyString(p)) return false;
+  if (p.startsWith('/') || p.startsWith('\\')) return false;
+  if (/^[a-zA-Z]:/.test(p)) return false;
+  return !p.split(/[\\/]/).includes('..');
+}
+
+/**
+ * Validate one candidate agent definition. Pure, total, and never throws.
+ *
+ * @param {object} obj  the candidate definition (file frontmatter or a db row).
+ * @param {object} [opts]
+ * @param {string|null} [opts.authorRank]      the author's LIVE DB rank (ADR 0016).
+ *                                             Never read from the definition itself.
+ * @param {string[]} [opts.allowedModules]     module keys this definition may be
+ *                                             scoped to. Empty ⇒ nothing is in scope.
+ * @param {string[]} [opts.protectedModules]   the subset of those that require Metic+.
+ * @returns {{ok: boolean, errors: Array<{code: string, field: string, message: string}>, value: object|null}}
+ *          `value` is the normalized definition (defaults applied) on success, and
+ *          `null` on any failure — a rejected definition must never hand back a row
+ *          something downstream could insert.
+ */
+function validateAgentDefinition(obj, opts = {}) {
+  const errors = [];
+  const E = (code, field, message) => errors.push({ code, field, message });
+
+  if (!isPlainObject(obj)) {
+    return {
+      ok: false,
+      errors: [{
+        code: 'not_an_object',
+        field: '(root)',
+        message: `An agent definition must be an object; received ${obj === null ? 'null' : Array.isArray(obj) ? 'an array' : typeof obj}.`,
+      }],
+      value: null,
+    };
+  }
+
+  // Read through safeGet for the same reason the definition is: a caller may hand
+  // us a proxy or an accessor-bearing object, and the never-throws contract covers
+  // the whole call, not just the definition half of it.
+  const options = isPlainObject(opts) ? opts : {};
+  const authorRank = safeGet(options, 'authorRank');
+  const rawAllowed = safeGet(options, 'allowedModules');
+  const rawProtected = safeGet(options, 'protectedModules');
+  const allowedModules = Array.isArray(rawAllowed) ? rawAllowed : [];
+  const protectedModules = Array.isArray(rawProtected) ? rawProtected : [];
+
+  // --- name ----------------------------------------------------------------
+  const name = safeGet(obj, 'name');
+  if (!isNonEmptyString(name) || !NAME_RE.test(name) || name.length > NAME_MAX) {
+    E('name_invalid', 'name',
+      `name: ${JSON.stringify(name)} must be lowercase kebab-case matching ${NAME_RE} and at most ${NAME_MAX} characters — it is used as a filename, a URL segment and a CLI argument.`);
+  }
+
+  // --- persona --------------------------------------------------------------
+  const persona = safeGet(obj, 'persona');
+  if (!isNonEmptyString(persona)) {
+    E('persona_missing', 'persona',
+      'persona: required — an agent with no role prompt has nothing to run. Give it a non-empty string saying what it observes and reports.');
+  } else if (persona.length > PERSONA_MAX) {
+    E('persona_too_long', 'persona',
+      `persona: ${persona.length} characters exceeds the ${PERSONA_MAX} limit — the persona is sent to a paid model on every fire.`);
+  }
+
+  // --- trigger type ---------------------------------------------------------
+  const triggerType = safeGet(obj, 'trigger_type');
+  const triggerTypeOk = typeof triggerType === 'string' && TRIGGER_TYPES.includes(triggerType);
+  if (!triggerTypeOk) {
+    E('trigger_type_unknown', 'trigger_type',
+      `trigger_type: ${JSON.stringify(triggerType)} is not a wired trigger type. v1 wires exactly: ${TRIGGER_TYPES.join(', ')}.`);
+  }
+
+  // --- trigger spec ---------------------------------------------------------
+  // Defaults to {} when absent, matching the column default. Present-but-wrong is
+  // a refusal; absent is a legitimate on-demand definition.
+  const rawSpec = safeGet(obj, 'trigger_spec');
+  let spec = null;
+  if (rawSpec === undefined || rawSpec === null) {
+    spec = {};
+  } else if (!isPlainObject(rawSpec)) {
+    E('trigger_spec_not_object', 'trigger_spec',
+      `trigger_spec: must be an object of parameters; received ${Array.isArray(rawSpec) ? 'an array' : typeof rawSpec}. It carries the trigger's parameters, never a payload.`);
+  } else {
+    spec = rawSpec;
+    // The size bound is over the SERIALIZED spec, exactly as the DB CHECK measures
+    // it — and JSON.stringify throws on a cycle, which is why this is guarded.
+    let serialized = null;
+    try {
+      serialized = JSON.stringify(spec);
+    } catch (err) {
+      E('trigger_spec_unserializable', 'trigger_spec',
+        `trigger_spec: could not be serialized (${(err && err.message) || 'circular structure'}) — it must be plain JSON data.`);
+      spec = null;
+    }
+    if (serialized !== null && serialized.length > TRIGGER_SPEC_MAX) {
+      E('trigger_spec_too_long', 'trigger_spec',
+        `trigger_spec: ${serialized.length} serialized characters exceeds the ${TRIGGER_SPEC_MAX} limit — it is parameters, never payload.`);
+    }
+  }
+
+  // --- the event catalog, fail-closed ---------------------------------------
+  // Checked whenever an event NAME is present, and additionally REQUIRED for an
+  // event trigger. An inert `event:` on an on-demand definition is either a
+  // typo'd trigger_type or dead config; refusing an unwired name in both places
+  // is what "fails closed on any unwired event name" actually means.
+  if (spec) {
+    const event = safeGet(spec, 'event');
+    const hasEventKey = event !== undefined && event !== null;
+    if (triggerType === 'event' && !isNonEmptyString(event)) {
+      E('trigger_event_missing', 'trigger_spec.event',
+        `trigger_spec.event: required for an 'event' trigger — a definition with no event name can never fire. Wired events: ${EVENT_CATALOG.join(', ')}.`);
+    } else if (hasEventKey && isNonEmptyString(event) && !EVENT_CATALOG.includes(event)) {
+      E('trigger_event_unwired', 'trigger_spec.event',
+        `trigger_spec.event: ${JSON.stringify(event)} is not a wired event and is refused rather than stored — nothing dispatches it, so the agent would look armed and never fire. Wired events: ${EVENT_CATALOG.join(', ')}.`);
+    } else if (hasEventKey && !isNonEmptyString(event) && triggerType !== 'event') {
+      E('trigger_event_unwired', 'trigger_spec.event',
+        `trigger_spec.event: ${JSON.stringify(event)} is not a wired event name. Wired events: ${EVENT_CATALOG.join(', ')}.`);
+    }
+  }
+
+  // --- model tier -----------------------------------------------------------
+  const rawTier = safeGet(obj, 'model_tier');
+  const modelTier = rawTier === undefined || rawTier === null ? 'default' : rawTier;
+  if (!MODEL_TIERS.includes(modelTier)) {
+    E('model_tier_unknown', 'model_tier',
+      `model_tier: ${JSON.stringify(rawTier)} is not a known tier (${MODEL_TIERS.join(', ')}). The tier is stored and resolved to a concrete model at fire time; there is deliberately no 'main' tier.`);
+  }
+
+  // --- scope: shape ---------------------------------------------------------
+  const rawScopeModules = safeGet(obj, 'scope_modules');
+  let scopeModules = null;
+  if (rawScopeModules === undefined || rawScopeModules === null) {
+    scopeModules = [];
+  } else if (!Array.isArray(rawScopeModules) || !rawScopeModules.every(isNonEmptyString)) {
+    E('scope_modules_invalid', 'scope_modules',
+      'scope_modules: must be an array of non-empty module-key strings.');
+  } else {
+    scopeModules = rawScopeModules;
+  }
+
+  const rawScopePaths = safeGet(obj, 'scope_paths');
+  let scopePaths = null;
+  if (rawScopePaths === undefined || rawScopePaths === null) {
+    scopePaths = [];
+  } else if (!Array.isArray(rawScopePaths) || !rawScopePaths.every(isNonEmptyString)) {
+    E('scope_paths_invalid', 'scope_paths',
+      'scope_paths: must be an array of non-empty repo-relative path strings.');
+  } else {
+    const escaping = rawScopePaths.filter((p) => !isSafeScopePath(p));
+    if (escaping.length > 0) {
+      E('scope_paths_invalid', 'scope_paths',
+        `scope_paths: ${escaping.map((p) => JSON.stringify(p)).join(', ')} escape the repository tree — a scope path must be relative and contain no '..' segment.`);
+    } else {
+      scopePaths = rawScopePaths;
+    }
+  }
+
+  // --- scope: the wall ------------------------------------------------------
+  // Note the empty-allowlist behaviour: with nothing allowed, every declared
+  // module is out of bounds. That is the fail-closed default, not an oversight.
+  if (scopeModules && scopeModules.length > 0) {
+    const outOfBounds = scopeModules.filter((m) => !allowedModules.includes(m));
+    if (outOfBounds.length > 0) {
+      E('scope_out_of_bounds', 'scope_modules',
+        `scope_modules: ${outOfBounds.map((m) => JSON.stringify(m)).join(', ')} ${outOfBounds.length === 1 ? 'is' : 'are'} outside the allowed module set (${allowedModules.length ? allowedModules.join(', ') : 'none — no allowed modules were supplied, so nothing is in scope'}).`);
+    }
+
+    // The rank wall, over whatever scope survived the bounds check. An unresolved
+    // rank is treated as insufficient, never as a reason to skip the check.
+    const protectedHits = scopeModules.filter((m) => protectedModules.includes(m));
+    if (protectedHits.length > 0) {
+      const rankIdx = typeof authorRank === 'string' ? RANK_ORDER.indexOf(authorRank) : -1;
+      if (rankIdx < RANK_ORDER.indexOf(SCOPE_RANK_FLOOR)) {
+        E('scope_protected_rank', 'scope_modules',
+          `scope_modules: ${protectedHits.map((m) => JSON.stringify(m)).join(', ')} ${protectedHits.length === 1 ? 'is a protected module' : 'are protected modules'} and require a ${SCOPE_RANK_FLOOR}+ author; the author's resolved rank is ${JSON.stringify(authorRank ?? null)} (ADR 0016 / ADR 0043). Authority comes from the author's live rank, never from the definition.`);
+      }
+    }
+  }
+
+  if (errors.length > 0) return { ok: false, errors, value: null };
+
+  // The normalized row, built fresh — the caller's object is never mutated, and
+  // arrays are copied so a later mutation of the input cannot reach the registry.
+  return {
+    ok: true,
+    errors: [],
+    value: {
+      name,
+      title: isNonEmptyString(safeGet(obj, 'title')) ? safeGet(obj, 'title') : null,
+      persona,
+      trigger_type: triggerType,
+      trigger_spec: { ...spec },
+      model_tier: modelTier,
+      scope_modules: [...scopeModules],
+      scope_paths: [...scopePaths],
+    },
+  };
+}
+
+module.exports = {
+  validateAgentDefinition,
+  EVENT_CATALOG,
+  TRIGGER_TYPES,
+  MODEL_TIERS,
+  RANK_ORDER,
+  SCOPE_RANK_FLOOR,
+};

package/modules/builder-settings/builder-needs.js

@@ -191,7 +191,33 @@ function boardVotesNeed(ctx) {
   };
 }
 
-const NEEDS = [artKeyNeed, helpRequestsNeed, taskRecommendationsNeed, boardVotesNeed];
+// task 1003178 (C08, goal 1000075): an open mingle INTRODUCTION waiting on you.
+// Third sibling of the two collab needs above, here for the same reason and with
+// the same posture — an introduction nobody surfaces is merely stored, and the
+// needs roster is how a collab feature reaches the whole hall instead of sitting
+// on a page of its own (which is the thing C08's criterion refuses).
+//
+// 'info' and NEVER a demand, and the wording carries that: mingle is declinable
+// without penalty (C07, ADR 0187 §5), so copy that pressured the reader would BE
+// the penalty the decision forbids. The same argument the recommendation need
+// makes, applied to a social invitation, where it matters more.
+function mingleIntroductionsNeed(ctx) {
+  const n = Number(ctx.openMingleIntroductions) || 0;
+  if (n <= 0) return null;
+  const subject = n === 1 ? 'An introduction is' : `${n} introductions are`;
+  return {
+    id: 'mingle_introductions',
+    title: n === 1 ? 'Someone from another craft was introduced to you' : 'You have introductions waiting',
+    what: 'Mingle pairs builders across crafts — you opted in, and a pairing is waiting on your answer.',
+    state: 'action_needed',
+    severity: 'info',
+    message: `${subject} waiting on you. Saying no costs nothing at all — no rank, no karma, no streak, `
+      + 'and it does not change how often you are paired again.',
+    action: { label: n === 1 ? 'See the introduction' : 'See the introductions', href: '/#/collab' },
+  };
+}
+
+const NEEDS = [artKeyNeed, helpRequestsNeed, taskRecommendationsNeed, boardVotesNeed, mingleIntroductionsNeed];
 
 // ---- founding grace (task 1002739 / direction §5.6, idea 1000701) -----------
 //
@@ -269,7 +295,7 @@ module.exports = {
   computeNeeds,
   // exported for tests / direct reuse
   artKeyNeed,
-  helpRequestsNeed, taskRecommendationsNeed, boardVotesNeed,
+  helpRequestsNeed, taskRecommendationsNeed, boardVotesNeed, mingleIntroductionsNeed,
   foundingGraceActive,
   FOUNDING_GRACE_DAYS,
   SETTINGS_PATH,

package/modules/hall-ui/public/collab.html

@@ -46,6 +46,25 @@
           </div>
         </section>
 
+        <!-- SOCIAL MODE ONLY (task 1003178 / C08). Not a page and not a nav item:
+             this panel is part of Collab, and it appears because the hall is in
+             social mode — the shell stamps data-social="on" on the document root
+             from /me, and collab.js reveals this section from that. With social
+             off the page is exactly what it was, which is the point: the hall
+             changes, it does not gain a destination. -->
+        <section class="scroll" id="cb-mingle-section" aria-labelledby="cb-mingle-h" hidden>
+          <h2 class="scroll__h" id="cb-mingle-h">Introductions</h2>
+          <p class="scroll__lede" id="cb-mingle-note">
+            Mingle pairs you with someone from a different craft. Saying no costs nothing
+            at all — no rank, no karma, no streak, and it does not change how often you
+            are paired again.
+          </p>
+          <ul class="ov-rows" id="cb-mingle"></ul>
+          <div class="empty-state" id="cb-mingle-empty" hidden>
+            <p>No introductions right now. You will see one here when a pairing round runs.</p>
+          </div>
+        </section>
+
         <section class="scroll" aria-labelledby="cb-mine-h">
           <h2 class="scroll__h" id="cb-mine-h">Your asks</h2>
           <p class="scroll__lede">

package/modules/hall-ui/public/collab.js

@@ -143,6 +143,78 @@
         ? `Matching your craft: ${crafts.join(', ')}.`
         : 'You have not set a craft, so only requests addressed to you by name reach you.';
     }
+
+    // The social half. Best-effort and LAST: an introductions read that fails
+    // must never take the help requests down with it — those are the page.
+    try { await loadMingle(); } catch (_) { /* the panel stays as it was */ }
+  }
+
+  // ---- social mode: introductions (task 1003178 / C08) ----------------------
+  //
+  // READ THE MODE OFF THE DOCUMENT, never re-derive it. The shell stamps
+  // data-social="on" from /me's resolved pair of switches (C07: the project
+  // enabled mingle AND this builder opted in). Asking the server again here would
+  // be a second answer to one question, and a page that decided for itself
+  // whether social was on could disagree with the rest of the hall.
+  const socialOn = () => document.documentElement.dataset.social === 'on';
+
+  // The other person in the pair — the row is written from the VIEWER's side, so
+  // it names who they were introduced to rather than echoing both ids back.
+  function otherOf(pair, meId) {
+    const lo = String(pair.builder_lo), hi = String(pair.builder_hi);
+    return String(meId) === lo
+      ? { id: hi, login: pair.hi_login, name: pair.hi_name, craft: pair.craft_hi, myCraft: pair.craft_lo }
+      : { id: lo, login: pair.lo_login, name: pair.lo_name, craft: pair.craft_lo, myCraft: pair.craft_hi };
+  }
+
+  function mingleRow(pair, meId) {
+    const o = otherOf(pair, meId);
+    const who = escapeHtml(o.name || o.login || `builder ${o.id}`);
+    return `<li class="ov-row">
+      <div class="ov-row__main">
+        <a class="ov-row__title" href="/builders/profile?id=${escapeHtml(String(o.id))}">${who}</a>
+        <p class="ov-row__sub">A ${escapeHtml(String(o.craft))} — you are a ${escapeHtml(String(o.myCraft))}. Mingle pairs across crafts.</p>
+      </div>
+      <div class="ov-row__right">
+        <div class="ov-row__actions">
+          <button class="btn-accent" data-mingle="accepted" data-id="${escapeHtml(String(pair.id))}">Say yes</button>
+          <button class="btn-ghost" data-mingle="declined" data-id="${escapeHtml(String(pair.id))}">Not now</button>
+        </div>
+      </div>
+    </li>`;
+  }
+
+  async function loadMingle() {
+    const section = $('#cb-mingle-section');
+    if (!section) return;
+    // Off is off: the section stays hidden and nothing is fetched. A page that
+    // fetched anyway would make "social is off" cost a request on every load.
+    if (!socialOn()) { section.hidden = true; return; }
+    section.hidden = false;
+
+    const r = await api.request('GET', '/mingle');
+    const pairs = (r.ok && r.data && r.data.open_pairs) || [];
+    const meId = (r.ok && r.data && r.data.you) || null;
+    paint('#cb-mingle', '#cb-mingle-empty', pairs.map((p) => mingleRow(p, meId)).join(''), pairs.length);
+  }
+
+  async function decideMingle(id, decision) {
+    if (settling) return;
+    settling = true;
+    try {
+      const r = await api.request('POST', `/mingle/pairs/${id}/decide`, { decision });
+      if (!r.ok) {
+        toast(window.OTB.errMessage ? window.OTB.errMessage(r.data) : 'Could not answer that introduction.');
+        return;
+      }
+      // Neutral either way. "Declined" must not read as a failure — declining is
+      // free, and a toast that sounded disappointed would be the penalty C07's
+      // decision forbids, delivered by the UI instead of the schema.
+      toast(decision === 'accepted' ? 'Said yes — say hello.' : 'Not now. Nothing changes for you.');
+      await load();
+    } finally {
+      settling = false;
+    }
   }
 
   async function settle(id, status) {
@@ -162,6 +234,12 @@
   }
 
   document.addEventListener('click', (ev) => {
+    const mingleBtn = ev.target && ev.target.closest ? ev.target.closest('[data-mingle]') : null;
+    if (mingleBtn) {
+      ev.preventDefault();
+      decideMingle(Number(mingleBtn.getAttribute('data-id')), mingleBtn.getAttribute('data-mingle'));
+      return;
+    }
     const btn = ev.target && ev.target.closest ? ev.target.closest('[data-settle]') : null;
     if (!btn) return;
     ev.preventDefault();

package/modules/hall-ui/public/hall-render.js

@@ -205,6 +205,12 @@
       rank: normalizeRank(builder?.rank),
       graduated,
       showWork: shipStepCurrent,
+      // task 1003178 (C08): the index owns its own /me, so it passes the social
+      // mode through too — otherwise the hall's busiest page would be the one
+      // page the mode never reached. Read off ctx.lastMeState (the live getter),
+      // not a local: renderNav takes (builder, onboarding) and is called from
+      // five sites, so there is no `me` in scope here.
+      social: (ctx.lastMeState && ctx.lastMeState.social) || null,
       builder,
     });
 

package/modules/hall-ui/public/shell.js

@@ -522,7 +522,32 @@
     }
   }
 
-  // applyAccess({ authed, rank, graduated, showWork }) — settle nav visibility.
+  // SOCIAL MODE (task 1003178 / C08, goal 1000075). The owner's directive is that
+  // social is "scoped into the ENTIRE builders hall, not a single social tab", and
+  // the criterion says outright that a /social route with the same hall around it
+  // does NOT satisfy it. So social is a MODE stamped on the document root, beside
+  // data-theme and for the same reason: every hall page loads this shell, so one
+  // attribute lets any surface — a stylesheet, a page script, a widget — read the
+  // mode without a route, a nav item, or a second fetch.
+  //
+  // OFF is the default and the fallback. `/me.social` is null when lifecycle is
+  // disabled or the read failed, and null is OFF: a mode that cannot be read is
+  // not on. It is only ON when BOTH of C07's switches are (the project enabled
+  // mingle AND this builder opted in) — the server resolves that pair, this never
+  // re-derives it.
+  //
+  // Written as an attribute rather than kept in `access` on purpose: CSS can hit
+  // it (`:root[data-social="on"] …`), which is what lets a surface change how it
+  // READS without every page script learning about social.
+  function applySocial(social) {
+    var on = !!(social && social.enabled === true);
+    var root = document.documentElement;
+    if (on) root.dataset.social = 'on';
+    else delete root.dataset.social;
+  }
+
+  // applyAccess({ authed, rank, graduated, showWork, social }) — settle nav
+  // visibility and the social mode.
   // Called by builders.js on the index (it owns /me there) and by the shell's own
   // probe elsewhere. Cosmetic only; the server enforces (ADR 0016).
   function applyAccess(state) {
@@ -531,6 +556,7 @@
       if ('rank' in state) access.rank = state.rank ? String(state.rank).toLowerCase() : null;
       if ('graduated' in state) access.graduated = !!state.graduated;
       if ('showWork' in state) access.showWork = !!state.showWork;
+      if ('social' in state) applySocial(state.social);
       if (state.builder) renderUser(state.builder);
     }
     document.querySelectorAll('#app-sidebar [data-gate]').forEach(function (el) {
@@ -744,6 +770,9 @@
         rank: me.builder.rank,
         graduated: !!(me.onboarding && me.onboarding.graduated),
         showWork: showWork,
+        // task 1003178 (C08): the mode rides the identity every page already
+        // fetches, so no surface needs a route or a second call to know.
+        social: me.social || null,
         builder: me.builder,
       });
     }).catch(function () { /* cosmetic only */ });

package/modules/lifecycle/lifecycle.js

@@ -22,6 +22,7 @@ const goalSuggest = require('./goal-suggest');
 const helpRequests = require('./help-requests');
 const taskRecommendations = require('./task-recommendations');
 const activity = require('./activity');
+const mingle = require('./mingle');
 
 module.exports = {
   // --- retired doorway leaks (ADR 0093 §3) ---------------------------------
@@ -52,6 +53,13 @@ module.exports = {
   // builder, exposed the same way and for the same reason — a recommendation
   // nobody surfaces is merely stored.
   openTaskRecommendationsFor: (...a) => taskRecommendations.countOpenForRecipient(...a),
+  // task 1003178 (C08): social MODE, and the count of open introductions. The
+  // mode is the pair of switches C07 resolved (project enabled AND this builder
+  // opted in) — the kernel's /me carries it so every hall surface can read the
+  // mode WITHOUT importing this module, which is what makes social a mode rather
+  // than a page. The count feeds the needs roster, the same slot C01 and C03 use.
+  socialModeFor: (...a) => mingle.mingleStateFor(...a),
+  openMingleIntroductionsFor: (...a) => mingle.countOpenPairsFor(...a),
   getTask: (...a) => db.getTask(...a),
   // findTaskBySourceRef: the create-vector idempotency read (task 1003114 / R03
   // of goal 1000074). copy-desk turns an artist's copy proposal into a task and

package/modules/lifecycle/mingle.js

@@ -306,6 +306,22 @@ async function openPairsFor(builderId, deps = {}) {
   return rows;
 }
 
+// How many open introductions are waiting on this builder — the count the hall's
+// needs roster renders (task 1003178 / C08). A COUNT rather than the rows,
+// because /me is the session-open hot path and the roster only needs a number;
+// the rows are `openPairsFor`, read by the surface that shows them.
+async function countOpenPairsFor(builderId, deps = {}) {
+  const activePool = deps.pool || pool;
+  const { rows } = await activePool.query(
+    `SELECT count(*)::int AS n
+       FROM lifecycle_mingle_pairs
+      WHERE status = 'proposed'
+        AND (builder_lo = $1 OR builder_hi = $1)`,
+    [builderId]
+  );
+  return rows[0] ? rows[0].n : 0;
+}
+
 // Accept or decline an introduction you are part of.
 //
 // ONE ROW, ONE TABLE. There is nothing else to write, and that absence IS the
@@ -333,5 +349,5 @@ module.exports = {
   parseEnabled, projectEnabled, setProjectEnabled,
   optInState, setOptIn, mingleStateFor,
   eligibleBuilders, isCrossCraft, planPairs, pairKey, openPairKeys,
-  runMingleRound, openPairsFor, decidePair,
+  runMingleRound, openPairsFor, countOpenPairsFor, decidePair,
 };

package/modules/lifecycle/routes/mingle.js

@@ -55,6 +55,11 @@ module.exports = function buildMingleRouter() {
     return res.json({
       mingle: state,
       open_pairs: pairs,
+      // task 1003178 (C08): WHICH SIDE OF THE PAIR THE CALLER IS. A pair row
+      // carries builder_lo/builder_hi with no marker for "you", so a surface
+      // rendering it from the viewer's side would otherwise need a second /me
+      // fetch just to find out which id to name. The route already knows.
+      you: String(req.builder.id),
       // Served VERBATIM from the module. The criterion asks for cross-craft to be
       // chosen deliberately and RECORDED; this is where it is read, and a
       // restatement here could drift from the matcher that actually runs.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.517",
+  "version": "1.19.519",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.517",
+      "version": "1.19.519",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.517",
+  "version": "1.19.519",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",