@bongos/core 1.19.544 → 1.19.546

package/modules/hall-ui/public/studio.js

@@ -0,0 +1,213 @@
+// modules/hall-ui/public/studio.js — the Studio (artist mode), /builders/studio.
+// R06 of goal 1000074 (the artist's loop), task 1003117.
+//
+// The criterion (artist-mode): "a place an artist wants to be, not a form. A
+// focus environment on the Cloud Bongos screen — a lofi-girl-style zen garden of
+// focus and creativity — rather than another table of rows."
+//
+// So this is NOT a queue table. It aggregates the artist's real work — the two
+// surfaces the rest of goal 1000074 built — and presents it ONE PIECE AT A TIME,
+// a stone to tend in a calm garden, with the rest waiting quietly:
+//   1. REVIEW REQUESTS (R04, cascade.js) — a copy/visual ship files a two-step
+//      artist review at `backlog`, discipline 'artist', source 'cascade'. The
+//      two steps (coach the grader, then remake/tweak) live on the task record;
+//      this room names them and opens the door.
+//   2. FLAGGED COPY (R02, copy-desk) — open flags over the words the product
+//      shows people. Best-effort: an instance without the copy-desk module has
+//      no queue, and the room degrades to reviews alone rather than erroring.
+//
+// It writes NOTHING and gates NOTHING (ADR 0162 / the goal's no-live-CMS rule):
+// "open this" routes to where the craft is actually done (the task record, the
+// copy desk), and "let it be for now" only advances the reader to the next
+// piece. The full tables it replaces stay one link away in the footer.
+
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  const { escapeHtml, $ } = window.OTB;
+
+  let viewer = null;
+  let pieces = [];   // the combined garden: [{ type:'review'|'flag', … }]
+  let idx = 0;       // which stone is in focus
+
+  // Bound the reviews read. cascade.js files a review per qualifying ship and they
+  // sit at backlog until claimed or dismissed ("dismissable rather than nagging"),
+  // so this queue grows without bound over the project's life — the unbounded-read
+  // shape modules/hall-ui/CLAUDE.md flags as a repeat bug (the Work board's backlog,
+  // Home's next-up card, the Goals rollup all had it). 50 is far more than a focus
+  // queue tends at once; the footer links to the copy desk and board are the
+  // whole-list path. listTasks orders `priority NULLS LAST, created_at`, so the cap
+  // keeps the most-prioritised waiting reviews.
+  const REVIEW_LIMIT = 50;
+
+  // ---------------------------------------------------------------------------
+  // helpers
+  // ---------------------------------------------------------------------------
+
+  function greeting() {
+    const h = new Date().getHours();
+    if (h < 5) return 'Still up';
+    if (h < 12) return 'Good morning';
+    if (h < 18) return 'Good afternoon';
+    return 'Good evening';
+  }
+
+  // The shipped task a review is ABOUT — cascade.js stamps
+  // source_ref = 'cascade-artist-review-on-ship-<taskId>'.
+  function reviewShippedId(t) {
+    const m = /-on-ship-(\d+)/.exec(t.source_ref || '');
+    return m ? m[1] : null;
+  }
+
+  // The product's own words, shown as evidence — untrusted source-tree text, so
+  // escaped, and clipped so one runaway string cannot fill the room.
+  function quote(text, max = 300) {
+    const s = String(text == null ? '' : text);
+    return escapeHtml(s.length > max ? `${s.slice(0, max)}…` : s);
+  }
+
+  // Clip a plain field (a name, a reason) so one very long value cannot stretch
+  // the card — the mirror of quote()'s clip, for text that is not the evidence.
+  // Escaping still happens at render; this only bounds length.
+  function clip(text, max) {
+    const s = String(text == null ? '' : text);
+    return s.length > max ? `${s.slice(0, max)}…` : s;
+  }
+
+  // ---------------------------------------------------------------------------
+  // the focus card, one shape per kind of work
+  // ---------------------------------------------------------------------------
+
+  function reviewCard(p, n) {
+    const title = p.shippedId
+      ? `The copy and visuals that shipped in task #${escapeHtml(p.shippedId)}`
+      : escapeHtml(p.title || 'A review of what shipped');
+    return `
+      <p class="studio-card__eyebrow">to tend now · ${escapeHtml(n)}</p>
+      <h2 class="studio-card__title">${title}</h2>
+      <p class="studio-card__context">It shipped and it is live. Your review coaches the grader on how it judged the work, then remakes or tweaks the words or art only if they need it — it never blocks what shipped.</p>
+      <ol class="studio-steps">
+        <li class="studio-step"><span class="studio-step__n">01</span><span>Coach the grader<small>Review how it judged this work, and teach it what good looked like.</small></span></li>
+        <li class="studio-step"><span class="studio-step__n">02</span><span>Remake or tweak<small>Only if it needs it — with the AI at your side, or on your own.</small></span></li>
+      </ol>
+      <div class="studio-card__actions">
+        <a class="btn-accent" href="/builders/task/${escapeHtml(String(p.taskId))}">Open this review</a>
+        <button type="button" class="btn-ghost" data-skip>Let it be for now</button>
+      </div>`;
+  }
+
+  function flagCard(p, n) {
+    const who = p.who ? `${escapeHtml(p.who)} flagged this` : 'Someone flagged this';
+    const reason = p.reason ? ` — ${escapeHtml(p.reason)}` : '';
+    return `
+      <p class="studio-card__eyebrow">to tend now · ${escapeHtml(n)}</p>
+      <blockquote class="studio-card__quote">${quote(p.text)}</blockquote>
+      <p class="studio-card__context">${who}${reason}</p>
+      <div class="studio-card__actions">
+        <a class="btn-accent" href="/builders/copy-desk">Open in the copy desk</a>
+        <button type="button" class="btn-ghost" data-skip>Let it be for now</button>
+      </div>`;
+  }
+
+  function emptyCard(done) {
+    const heading = done ? 'You have tended everything waiting' : 'Nothing waits right now';
+    const body = done
+      ? 'That is the whole garden. Come back when work ships, or start again from the top.'
+      : 'A quiet moment — either good news or an unread queue. When work with copy or visuals ships, a review appears here for you.';
+    const restart = done
+      ? '<div class="studio-card__actions studio-empty__actions"><button type="button" class="btn-ghost" data-restart>Start over</button></div>'
+      : '';
+    return `<div class="studio-empty"><h2>${heading}</h2><p>${body}</p>${restart}</div>`;
+  }
+
+  // ---------------------------------------------------------------------------
+  // paint
+  // ---------------------------------------------------------------------------
+
+  function paintHead() {
+    const name = viewer && (viewer.display_name || viewer.github_login);
+    $('#studio-greet').textContent = name ? `${greeting()}, ${name}` : greeting();
+    const n = pieces.length;
+    $('#studio-sub').textContent = n
+      ? `${n} ${n === 1 ? 'piece' : 'pieces'} of the product's voice ${n === 1 ? 'waits' : 'wait'} for you. Tend them one at a time — or let them be.`
+      : 'Nothing waits right now. Enjoy the quiet.';
+  }
+
+  function paint() {
+    const focus = $('#studio-focus');
+    const rest = $('#studio-rest');
+
+    if (!pieces.length) { focus.innerHTML = emptyCard(false); rest.hidden = true; return; }
+    if (idx >= pieces.length) { focus.innerHTML = emptyCard(true); rest.hidden = true; return; }
+
+    const p = pieces[idx];
+    focus.innerHTML = p.type === 'review' ? reviewCard(p, `${idx + 1} of ${pieces.length}`) : flagCard(p, `${idx + 1} of ${pieces.length}`);
+
+    // The rest of the garden: one stone per remaining piece, quiet and
+    // non-interactive — the room asks the reader to tend one thing, not to scan.
+    const remaining = pieces.length - (idx + 1);
+    if (remaining > 0) {
+      const shown = Math.min(remaining, 14);
+      const stones = new Array(shown).fill('<span class="studio-stone"></span>').join('');
+      const extra = remaining > shown ? ` +${remaining - shown}` : '';
+      rest.innerHTML = `<span class="studio-stones" aria-hidden="true">${stones}</span>`
+        + `<span class="studio-rest__line">and ${remaining} more waiting${extra}</span>`;
+      rest.hidden = false;
+    } else {
+      rest.hidden = true;
+    }
+  }
+
+  // ---------------------------------------------------------------------------
+  // load
+  // ---------------------------------------------------------------------------
+
+  // The waiting review requests: backlog is where cascade.js files them and where
+  // they sit until claimed or dismissed ("dismissable rather than nagging"), so
+  // status=backlog is the bounded, correct read for what is waiting to be tended.
+  async function loadReviews() {
+    const res = await api.request('GET', `${API}/tasks?discipline=artist&status=backlog&limit=${REVIEW_LIMIT}`);
+    if (!res.ok) return [];
+    const tasks = (res.data && res.data.tasks) || [];
+    return tasks
+      .filter((t) => t.source === 'cascade' || /^artist review\b/i.test(t.title || ''))
+      .sort((a, b) => new Date(b.created_at || 0) - new Date(a.created_at || 0))
+      .map((t) => ({ type: 'review', taskId: t.id, title: t.title, shippedId: reviewShippedId(t) }));
+  }
+
+  // The open flags. Best-effort: no copy-desk module → 404 → no flags, and the
+  // room is reviews alone rather than an error.
+  async function loadFlags() {
+    const res = await api.request('GET', `${API}/copy-desk/queue?status=open`);
+    if (!res.ok) return [];
+    // The server already filters to open flags (?status=open); no client re-filter.
+    const flags = (res.data && res.data.flags) || [];
+    return flags.map((f) => ({
+      type: 'flag',
+      text: f.scope === 'surface' ? f.surface : (f.current ? f.current.text : f.text_at_flag),
+      reason: clip(f.reason, 240),
+      who: clip(f.flagged_by_name || f.flagged_by_login || '', 60) || null,
+    }));
+  }
+
+  // ---------------------------------------------------------------------------
+  // wire + boot
+  // ---------------------------------------------------------------------------
+
+  document.addEventListener('click', (ev) => {
+    if (ev.target.closest('[data-skip]')) { idx += 1; paint(); window.scrollTo({ top: 0 }); return; }
+    if (ev.target.closest('[data-restart]')) { idx = 0; paint(); window.scrollTo({ top: 0 }); }
+  });
+
+  (async () => {
+    const me = await api.request('GET', `${API}/me`);
+    if (me.ok) viewer = me.data.builder || me.data;
+    // Reviews first (the richer craft), then flags — each newest-first within.
+    const [reviews, flags] = await Promise.all([loadReviews(), loadFlags()]);
+    pieces = [...reviews, ...flags];
+    paintHead();
+    paint();
+  })();
+})();

package/modules/hall-ui/public/studio.states.json

@@ -0,0 +1,54 @@
+{
+  "_": "The Studio (artist mode), R06 of goal 1000074 (task 1003117). A calm room that surfaces the artist's real work — backlog review requests (cascade, R04) and open copy flags (R02) — one piece at a time, never a table. Against the kit's own stub the page renders its EMPTY state (no /tasks or /copy-desk feed), which is a state the floors must hold in; against the hall-preview harness with the studio__reviews / copy-desk__queue fixtures it renders the focus card and the garden's stones.",
+  "page": "/builders/studio",
+  "surface": "hall-ui",
+  "stub": {
+    "prefix": "/builders/"
+  },
+  "modeQuery": false,
+  "ignoreRequests": [
+    "/api/(gds|bongos)/me$",
+    "/api/(gds|bongos)/me/",
+    "/api/(gds|bongos)/tasks",
+    "/api/(gds|bongos)/copy-desk/"
+  ],
+  "ignoreConsole": [
+    "/api/(gds|bongos)/",
+    "\\b401\\b",
+    "\\b403\\b",
+    "\\b404\\b",
+    "\\b501\\b",
+    "Unauthorized",
+    "Forbidden",
+    "Not Found",
+    "load failed"
+  ],
+  "states": {
+    "focus": {
+      "auth": true,
+      "actions": [
+        [
+          "wait",
+          700
+        ]
+      ],
+      "expect": {
+        "visible": [
+          "#studio-focus"
+        ]
+      }
+    },
+    "out": {
+      "auth": false
+    }
+  },
+  "reducedMotion": {
+    "auth": true,
+    "actions": [
+      [
+        "wait",
+        600
+      ]
+    ]
+  }
+}

package/modules/hall-ui/public/style.css

@@ -658,6 +658,15 @@ main:focus { outline: none; }
 .nav-item__label { display: none; font-size: 14px; }
 .nav-icon { width: 16px; height: 16px; flex-shrink: 0; }
 
+/* task 1003117 (R06 of goal 1000074): the Studio entry is warmed for a builder
+   whose craft is artist — the "emphasized entry for artist-craft builders" half
+   of artist mode. Distinct from --active (the current page's leading accent bar):
+   this warms the GLYPH, so the emphasis reads in the collapsed icon-only rail
+   too. accent-ink is the text-safe accent in both modes. shell.js sets the class
+   from /me's preferred_disciplines; it is cosmetic (the page is open to all). */
+.nav-item--craft .nav-icon,
+.nav-item--craft .nav-item__label { color: var(--accent-ink); }
+
 .app-sidebar__foot {
   padding: 10px 0;
   border-top: 1px solid var(--glass-edge);

package/modules/ui-design/skills/brandkit/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: brandkit
-description: The identity-system method for ANY Cloud Bongos instance, under the owner's hero-only rule: infers the brand strategy before anything is made (category, audience, function, promise, cultural position, the one symbolic metaphor, what to avoid), holds the logo standard and the five concept methods, and lands the system as the instance's own materials: the mark drawn as SVG in code, the colour system as the branding pack, the type specimen as the pack's faces, the applications as the platform's real surfaces rendered by the kit, and the image direction as a text-free hero-object family with a sidecar beside every plate. The nine-panel board becomes a contact sheet composed from those parts, never a generated image with text in it. Triggers on "brand kit", "identity system", "logo system", "brand guidelines board", "the visual world for a new instance", or when cloudbongos init asks what an instance's mark and material are. Never generates a logo, a wordmark, a board with text, or a mockup with UI. Ported in-house from the taste-skill rebuild spec (tasks 1003325 and 1003328, ADR 0198) with the hero-only rewrite the upstream never had.
+description: >-
+  The identity-system method for any instance, under the owner's hero-only rule. Infers the brand strategy
+  first, holds the logo standard and the five concept methods, and lands the system as the instance's own
+  materials — the mark as SVG, the colours as the pack, the type as its faces. Triggers on "brand kit",
+  "identity system", "logo system". Never generates a logo, wordmark or UI mockup.
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/design-taste-frontend/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: design-taste-frontend
-description: The default taste skill for a landing page, a portfolio, a marketing surface or a redesign of one, on ANY Cloud Bongos instance. Reads the brief and says the design read in one line, sets three dials (variance, motion, density) from named presets, locks one world for the whole page, keeps the hero and the layout disciplined, rations decoration, and ends on a pre-flight the kit measures. Triggers on "design a landing page", "make this not look templated", "taste pass", "anti-slop", "this looks like every AI site", or when /design hands off a marketing surface. Not for dashboards, data tables, wizards, code editors, native mobile or realtime collaboration (those go to /design and the hall's archetypes). Rebuilt in-house from the taste-skill rebuild spec (task 1003325, ADR 0198); the instance's world is the palette and images are hero plates only.
+description: >-
+  The default taste skill for a landing page, portfolio or marketing surface on any Cloud Bongos instance.
+  Says the design read in one line, sets three dials (variance, motion, density), locks one world for the
+  whole page, and ends on a pre-flight the kit measures. Triggers on "design a landing page", "make this not
+  look templated", "taste pass", "anti-slop". Not for dashboards or native mobile.
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/design-taste-frontend-v1/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: design-taste-frontend-v1
-description: The earlier generation of the taste skill, preserved under its own name so a task or a builder that names it gets exactly this behaviour while the default (design-taste-frontend) evolves separately. A fixed baseline triple of dials adapted in conversation, stack conventions for a served surface, typography and colour rules read against the instance's pack, the layout bans, full interaction cycles, motion rules inside the Kill Switch, performance guardrails, a named vocabulary of premium patterns and a tile-grid archetype set. Triggers on "design-taste-frontend-v1", "use the v1 taste skill", "the fixed dials", or "the pattern vocabulary". Rebuilt in-house from the taste-skill rebuild spec (task 1003325, ADR 0198); nothing here auto-updates from v2.
+description: >-
+  The earlier generation of the taste skill, kept under its own name so a task or builder that asks for it
+  gets exactly this behaviour while the default (design-taste-frontend) evolves separately. A fixed triple of
+  dials, the layout bans, full interaction cycles, and a named vocabulary of premium patterns. Triggers on
+  "design-taste-frontend-v1", "the fixed dials", "the pattern vocabulary".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/gpt-taste/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: gpt-taste
-description: Anti-default enforcement for a persuasive scrolling surface when the last attempt came out looking like every other one. A written plan block before any markup whose selection is derived deterministically from the route (a hero architecture, three component architectures, two CSS motion paradigms, checked against what sibling surfaces already used), the four-stage attention-interest-desire-action structure, an ultra-wide hero container that holds the headline to two or three lines, a dense tile grid with zero empty cells, real scroll-driven motion inside the Kill Switch, and a measured contrast sweep. Triggers on "it looks generic", "award-tier", "stop making the same page", "anti-default". Rebuilt in-house from the taste-skill rebuild spec (task 1003327, ADR 0198).
+description: >-
+  Anti-default enforcement for a persuasive scrolling surface when the last attempt came out looking like
+  every other one. A written plan block before any markup, derived deterministically from the route; the
+  four-stage attention-interest-desire-action structure; an ultra-wide hero; a dense tile grid with zero empty
+  cells. Triggers on "it looks generic", "award-tier", "anti-default".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/high-end-visual-design/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: high-end-visual-design
-description: Makes an interface read as an expensive agency build, inside the instance's world. One texture archetype and one layout archetype per project (never the same pair twice), the container anatomy (a shell and a core with a hairline ring and concentric radii, where the world allows a container at all), the pill button with its nested arrow disc, the spatial rhythm, the motion choreography inside the Kill Switch, the hover physics, the scroll entry, the mobile collapse per archetype and the performance rules, then a pre-output checklist. Triggers on "make it feel premium", "agency-grade", "this looks cheap", "expensive", "high-end", "the polish pass". Rebuilt in-house from the taste-skill rebuild spec (task 1003325, ADR 0198); the fonts are the pack's, the palette is the world's, images are hero plates only.
+description: >-
+  Makes an interface read as an expensive agency build, inside the instance's world. One texture archetype and
+  one layout archetype per project, the container anatomy, the pill button, the spatial rhythm, the motion
+  choreography inside the Kill Switch, the mobile collapse, then a pre-output checklist. Triggers on "make it
+  feel premium", "agency-grade", "this looks cheap", "the polish pass".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/image-to-code/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: image-to-code
-description: The analyse-then-implement loop for visually important web work on ANY Cloud Bongos instance, under the owner's hero-only rule: the design source of truth for the UI is the owner's reference images and the instance's world, read with a structured per-image analysis and extracted into a full spec before a line is written; the only image this skill generates is the hero plate the composition has a slot for, and the sections are built from the world's templates. Implements as a faithful translation rather than an interpretation, names design drift as the failure mode, holds the hero and clutter rules, and ends on a clarity checklist the kit measures. Triggers on "build this from the reference", "recreate these images in code", "implement the mock faithfully", "the owner sent screenshots to build from", or when a claimed ui task carries reference images. Never generates a section, a comp or a screen. Ported in-house from the taste-skill rebuild spec (tasks 1003325 and 1003328, ADR 0198) with the hero-only rewrite the upstream never had.
+description: >-
+  The analyse-then-implement loop for visually important web work, under the owner's hero-only rule. The
+  design source of truth is the owner's reference images and the instance's world, read per image and
+  extracted into a full spec before a line is written. Triggers on "build this from the reference", "implement
+  the mock faithfully". Never generates a section, comp or screen.
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/imagegen-frontend-mobile/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: imagegen-frontend-mobile
-description: The plate-making skill for the narrow end of a web surface on ANY Cloud Bongos instance, under the owner's hero-only rule: it produces text-free portrait plates and hero objects for the 390 and 320 compositions the kit renders, the masthead above the words and the field behind them, sized for the fold and clear of the regions a phone reserves. Never a screen, never a phone mockup, never a flow of screens as images, and never code: a screen concept is the surface's states file rendered by the kit at 390, and a native app target declines to /design. Locks one material, light and camera across the family from the world's DESIGN.md, keeps the first view to one focal point, puts a scrim under any text that sits over a plate, and lands the pair convention with a sidecar beside every file. Triggers on "a plate for the mobile hero", "the masthead at 390", "the hero object for the phone collapse", "a portrait plate", or when adapt or design-taste-frontend names a narrow-width slot with no plate. Ported in-house from the taste-skill rebuild spec (tasks 1003325 and 1003328, ADR 0198) with the hero-only rewrite the upstream never had.
+description: >-
+  The plate-making skill for the narrow end of a web surface, under the owner's hero-only rule. Text-free
+  portrait plates and hero objects for the 390 and 320 compositions the kit renders, sized for the fold and
+  clear of what a phone reserves, with a sidecar beside every file. Triggers on "a plate for the mobile hero",
+  "the masthead at 390". Never a screen, a phone mockup or code.
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/imagegen-frontend-web/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: imagegen-frontend-web
-description: The plate-making skill for a web surface on ANY Cloud Bongos instance, under the owner's hero-only rule: it produces text-free hero plates, hero objects and atmosphere backdrops for the slots a composition already has, never one image per section, never a screen, never a UI comp, and it writes no page code. Commits to the plate list out loud, chooses a composition anchor per plate that is not the text-left image-right default, locks one material, one light and one camera across the family, matches every plate tonally to the instance's pack, runs the generation through the instance's art pipeline key, and lands each plate as the pair convention (a black-ground plate for dark, an alpha cutout for light) with a provenance sidecar beside every file. Triggers on "make a hero plate", "we need a hero object for", "an atmosphere backdrop for the landing", "the project orbs need a new material", or when design-taste-frontend or /design names a plate slot with no plate. Ported in-house from the taste-skill rebuild spec (tasks 1003325 and 1003328, ADR 0198) with the hero-only rewrite the upstream never had.
+description: >-
+  The plate-making skill for a web surface, under the owner's hero-only rule. Text-free hero plates, hero
+  objects and atmosphere backdrops for the slots a composition already has — never one per section, never a
+  screen, never a UI comp, and no page code. One material, light and camera across the family, landed with a
+  provenance sidecar. Triggers on "make a hero plate", "an atmosphere backdrop".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/impeccable/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: impeccable
-description: The design-craft method for ANY surface on ANY Cloud Bongos instance, invoked as one skill plus an optional sub-command and an optional target ("impeccable audit /projects", "impeccable polish the hall's ranks page", "impeccable harden the wizard"). Sixteen sub-command playbooks (shape, audit, critique, polish, harden, animate, typeset, colorize, layout, adapt, distill, clarify, onboard, optimize, document, extract) plus the two directions (bolder, quieter), exactly one loaded per request; a bare description with no sub-command is ordinary design work routed to the closest playbook; no argument prints a menu built from live project signals and never auto-runs anything. Carries the craft floor (loaded right before UI is edited, never recited to the user) and the bounded finish (build fully, one render round through the kit, one batch of fixes, at most one confirming round, stop). Triggers on "impeccable", "critique this page", "audit the UI", "polish the whole path", "make it survive long text", "animate this", "tighten the copy", "document the design system", "extract the repeated pattern". Rebuilt in-house from the impeccable rebuild spec (task 1003326, ADR 0198) with no hooks, no bypass agent, no telemetry and no live server; the live loop is the playwright plugin and the headless loop is the module's kit. Web surfaces only; a native mobile target declines to /design.
+description: >-
+  The design-craft method for any surface, invoked as one skill plus an optional sub-command and target
+  ("impeccable audit /projects"). Sixteen playbooks — shape, audit, critique, polish, harden, animate,
+  typeset, colorize, layout, adapt, distill, clarify, onboard, optimize, document, extract — one per request.
+  Triggers on "impeccable", "critique this page", "audit the UI". Web surfaces only.
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/industrial-brutalist-ui/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: industrial-brutalist-ui
-description: Raw mechanical interfaces that read like a technical document, inside the instance's world. One archetype per project (Swiss industrial print or dark tactical terminal, never mixed), massive uppercase clamped display against fixed tracked-out mono metadata, the pack's terracotta as the single hazard accent and its sea as one terminal green, strict grid anchoring with the hairline as a one-pixel grid gap, zero corner rounding, bracket and crosshair framing glyphs, and static halftone, scanline and noise degradation inside the Kill Switch. Triggers on "brutalist", "industrial", "terminal", "make it raw", "like a technical document". Rebuilt in-house from the taste-skill rebuild spec (task 1003327, ADR 0198).
+description: >-
+  Raw mechanical interfaces that read like a technical document, inside the instance's world. One archetype
+  per project (Swiss industrial print or dark tactical terminal, never mixed), massive uppercase display
+  against tracked-out mono metadata, strict grid anchoring, zero corner rounding, halftone and scanline
+  degradation inside the Kill Switch. Triggers on "brutalist", "industrial", "make it raw".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/minimalist-ui/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: minimalist-ui
-description: Quiet editorial product interfaces built out of type and white space, inside the instance's world. Macro whitespace first, a capped measure, one display job and one body job, exactly one hairline weight for every border in the sheet, washed accents measured against their own ink, flat tile cards with no shadow, box-less accordions, keycap shortcuts, one depth treatment per band, entry motion inside the Kill Switch. Triggers on "make it minimal", "clean and editorial", "quiet", "document-like", "this feels busy". Declines dense surfaces like dashboards and ledgers. Rebuilt in-house from the taste-skill rebuild spec (task 1003327, ADR 0198); the palette is the pack and the nearest library look is expedition.
+description: >-
+  Quiet editorial product interfaces built out of type and white space, inside the instance's world. Macro
+  whitespace first, a capped measure, one display job and one body job, exactly one hairline weight for every
+  border, flat tile cards with no shadow, entry motion inside the Kill Switch. Triggers on "make it minimal",
+  "clean and editorial", "this feels busy". Declines dense surfaces.
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/redesign-existing-projects/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: redesign-existing-projects
-description: Upgrades an existing site or app in place, in whatever framework and styling method it already uses, without breaking it. A fixed three-step sequence (scan the stack, diagnose against a written audit, apply targeted fixes), the seven-group audit (typography, colour and surface, layout, interaction, content, code and omissions) with the instance's world as the answer key, a catalogue of upgrade techniques marked CSS-only or not available, and a fixed impact-per-risk fix order. Triggers on "redesign this", "upgrade the existing page", "make the current X premium", "audit this UI", "this page looks generic, fix it". Rebuilt in-house from the taste-skill rebuild spec (task 1003325, ADR 0198); keeps the stack, never migrates frameworks, images are hero plates only.
+description: >-
+  Upgrades an existing site or app in place, in whatever framework and styling method it already uses, without
+  breaking it. Three fixed steps — scan the stack, diagnose against a written audit, apply targeted fixes —
+  with the instance's world as the answer key and a fixed impact-per-risk fix order. Triggers on "redesign
+  this", "upgrade the existing page", "audit this UI".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/stitch-design-taste/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: stitch-design-taste
-description: Writes a design contract document for an external screen-generating tool such as Google Stitch, in the platform's own frontmatter shape. Four dials (creativity, density, variance, motion intent) with named bands and stated defaults, then eight fixed sections (atmosphere, colour roles, typography, components, layout, responsive rules, motion intent, banned patterns) written as descriptive language paired with exact values. The thirteen colours are transcribed from the instance's pack and diffed, never invented; motion is an intent brief inside the Kill Switch; the screens that come back are a reference, not a source of truth. Triggers on "write a design brief for Stitch", "a design contract document", "a prompt-to-screen tool". Rebuilt in-house from the taste-skill rebuild spec (task 1003327, ADR 0198).
+description: >-
+  Writes a design contract document for an external screen-generating tool such as Google Stitch, in the
+  platform's own frontmatter shape. Four dials with named bands and stated defaults, then eight fixed sections
+  pairing descriptive language with exact values. The thirteen colours are transcribed from the instance's
+  pack, never invented. Triggers on "a design brief for Stitch".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/style/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: style
-description: Runs a bounded session in which an owner authors their OWN look for the instance, as a branding pack inside the fifteen-token contract, and proves it clean before it lands. Four steps and no more. SEARCH reads the instance's world and the style library, renders the nearest two entries so the owner looks rather than imagines, and asks two or three questions about feel. CREATE drafts modules/ui-design/styles/<name>/ in the library's contract shape (pack.json, DESIGN.md, mock.html), never a fork of a sheet and never a sixteenth token. PROVE retunes the thirteen against contrast.js, the styles suite, check-mock and the kit's renders until every named pair is green, showing the shots each round. ADOPT hands the owner the one-step switch and files the look into the catalogue. Triggers on "/style", "make a look", "author a style", "I want our own theme", "can we have a different look", "add a style to the library".
+description: >-
+  Runs a bounded session in which an owner authors their own look for the instance, as a branding pack inside
+  the fifteen-token contract, and proves it clean before it lands. Four steps and no more — SEARCH, CREATE,
+  PROVE, ADOPT. Triggers on "/style", "make a look", "author a style", "I want our own theme", "add a style to
+  the library".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.544",
+  "version": "1.19.546",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.544",
+      "version": "1.19.546",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.544",
+  "version": "1.19.546",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1311,7 +1311,11 @@ function checkErrorEnvelope() {
 // truncated EVERY field, the skill matched on its body text, and nothing in CI noticed. A parse
 // error is a hard fail; description length and the listing budget are advisory (the listing is
 // resident in every session, ~1% of context, and gets truncated past ~8k chars). The check reads
-// the instance's .claude/skills/ and is a quiet pass when a checkout carries none (published core).
+// every skill Claude Code can load — the instance's .claude/skills/ AND the module-owned
+// modules/*/skills/ that claude-materialize.js copies into it (task 1003587: scanning only the
+// tracked root meant 14 ui-design skills went unlinted until the untracked copy existed, so four
+// unparseable frontmatters shipped and fitness only went red on a checkout that had materialized).
+// A quiet pass when a checkout carries none (published core).
 function checkSkillFrontmatter() {
   const violations = [];
   const warnings = [];
@@ -1329,7 +1333,10 @@ function checkSkillFrontmatter() {
   }
   if (long.length) {
     long.sort((a, b) => b.n - a.n);
-    warnings.push(`${long.length} description(s) over ${lint.DESC_WARN_CHARS} chars (longest: ${long.slice(0, 4).map((l) => `${l.file.split('/')[2]} ${l.n}`).join(', ')}) — every char is resident in every session; run node scripts/gds/skill-lint.js.`);
+    // The skill's own name is its PARENT dir — a fixed path index would read "skills"
+    // for a module-owned path (modules/<key>/skills/<name>/SKILL.md).
+    const skillName = (f) => f.split('/').slice(-2, -1)[0] || f;
+    warnings.push(`${long.length} description(s) over ${lint.DESC_WARN_CHARS} chars (longest: ${long.slice(0, 4).map((l) => `${skillName(l.file)} ${l.n}`).join(', ')}) — every char is resident in every session; run node scripts/gds/skill-lint.js.`);
   }
   if (report.overBudget) warnings.push(`the skill listing is ${report.listingChars} chars (~${estTokens(report.listingChars)} tokens) against a ~${report.budgetChars}-char budget — Claude Code truncates entries past it and routing degrades.`);
   return {
@@ -1338,7 +1345,7 @@ function checkSkillFrontmatter() {
     hardFail: violations.length > 0,
     violations,
     warnings,
-    note: `${report.results.length} SKILL.md file(s) under .claude/skills/ parse as YAML (name + description present, no ": " / " #" in a plain scalar); length + listing budget advisory.`,
+    note: `${report.results.length} SKILL.md file(s) under .claude/skills/ + modules/*/skills/ parse as YAML (name + description present, no ": " / " #" in a plain scalar); length + listing budget advisory.`,
   };
 }
 

package/scripts/gds/skill-lint.js

@@ -23,7 +23,9 @@
 // verdict as authoritative over this one.
 //
 // Usage:
-//   node scripts/gds/skill-lint.js                 lint every .claude/skills/*/SKILL.md; exit 1 on any error
+//   node scripts/gds/skill-lint.js                 lint every skill Claude Code can load — .claude/skills/*
+//                                                  plus the module-owned modules/*/skills/* that materialize
+//                                                  into it; exit 1 on any error
 //   node scripts/gds/skill-lint.js <file...>       lint specific files
 //   node scripts/gds/skill-lint.js --hook          PostToolUse mode: read the hook JSON on stdin, lint the
 //                                                  edited file if it is a SKILL.md, print findings, exit 0
@@ -108,14 +110,40 @@ function lintSkillFile(text, { file = 'SKILL.md' } = {}) {
   return res;
 }
 
-// Every SKILL.md under .claude/skills/ (one level deep).
-function listSkillFiles(root = REPO_ROOT) {
-  const dir = path.join(root, '.claude', 'skills');
+// Every SKILL.md in one skills root (one level deep, plus a `vendor/` tier).
+function skillsIn(dir) {
   if (!fs.existsSync(dir)) return [];
-  return fs.readdirSync(dir, { withFileTypes: true })
-    .filter((d) => d.isDirectory())
-    .map((d) => path.join(dir, d.name, 'SKILL.md'))
-    .filter((f) => fs.existsSync(f));
+  const out = [];
+  for (const d of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (!d.isDirectory()) continue;
+    const own = path.join(dir, d.name, 'SKILL.md');
+    if (fs.existsSync(own)) { out.push(own); continue; }
+    if (d.name === 'vendor') out.push(...skillsIn(path.join(dir, d.name)));
+  }
+  return out;
+}
+
+// Every skill Claude Code can end up loading — the tracked `.claude/skills/` PLUS the
+// module-owned `modules/<key>/skills/`, because claude-materialize.js copies those into
+// `.claude/skills/` as untracked copies (task 1003330) and a defect in one only shows up
+// after materialization. Scanning only the tracked root left 14 ui-design skills unlinted
+// until the copy existed, which is exactly how four unparseable frontmatters shipped
+// (task 1003587). A name already present in `.claude/skills/` wins and its module copy is
+// skipped — the same precedence the materializer applies — so nothing is counted twice.
+function listSkillFiles(root = REPO_ROOT) {
+  const core = skillsIn(path.join(root, '.claude', 'skills'));
+  const seen = new Set(core.map((f) => path.basename(path.dirname(f))));
+  const modulesDir = path.join(root, 'modules');
+  const owned = [];
+  if (fs.existsSync(modulesDir)) {
+    for (const d of fs.readdirSync(modulesDir, { withFileTypes: true })) {
+      if (!d.isDirectory()) continue;
+      for (const f of skillsIn(path.join(modulesDir, d.name, 'skills'))) {
+        if (!seen.has(path.basename(path.dirname(f)))) owned.push(f);
+      }
+    }
+  }
+  return [...core, ...owned];
 }
 
 // Lint a set of files; returns per-file results plus the listing total vs budget.
@@ -125,7 +153,13 @@ function lintSkills(files) {
   return { results, listingChars, budgetChars: LISTING_BUDGET_CHARS, overBudget: listingChars > LISTING_BUDGET_CHARS };
 }
 
-function isSkillMd(p) { return /[\\/]\.claude[\\/]skills[\\/][^\\/]+[\\/]SKILL\.md$/.test(String(p || '')); }
+// The PostToolUse hook's gate. It must match a module-owned SKILL.md too — that is the
+// file a builder actually edits; the `.claude/skills/` copy is generated (task 1003587).
+function isSkillMd(p) {
+  const s = String(p || '');
+  return /[\\/]\.claude[\\/]skills[\\/](?:vendor[\\/])?[^\\/]+[\\/]SKILL\.md$/.test(s)
+    || /[\\/]modules[\\/][^\\/]+[\\/]skills[\\/](?:vendor[\\/])?[^\\/]+[\\/]SKILL\.md$/.test(s);
+}
 
 function format(report, { relTo = REPO_ROOT } = {}) {
   const out = [];