@bongos/core 1.19.545 → 1.19.547

package/modules/ui-design/skills/imagegen-frontend-mobile/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: imagegen-frontend-mobile
-description: The plate-making skill for the narrow end of a web surface on ANY Cloud Bongos instance, under the owner's hero-only rule: it produces text-free portrait plates and hero objects for the 390 and 320 compositions the kit renders, the masthead above the words and the field behind them, sized for the fold and clear of the regions a phone reserves. Never a screen, never a phone mockup, never a flow of screens as images, and never code: a screen concept is the surface's states file rendered by the kit at 390, and a native app target declines to /design. Locks one material, light and camera across the family from the world's DESIGN.md, keeps the first view to one focal point, puts a scrim under any text that sits over a plate, and lands the pair convention with a sidecar beside every file. Triggers on "a plate for the mobile hero", "the masthead at 390", "the hero object for the phone collapse", "a portrait plate", or when adapt or design-taste-frontend names a narrow-width slot with no plate. Ported in-house from the taste-skill rebuild spec (tasks 1003325 and 1003328, ADR 0198) with the hero-only rewrite the upstream never had.
+description: >-
+  The plate-making skill for the narrow end of a web surface, under the owner's hero-only rule. Text-free
+  portrait plates and hero objects for the 390 and 320 compositions the kit renders, sized for the fold and
+  clear of what a phone reserves, with a sidecar beside every file. Triggers on "a plate for the mobile hero",
+  "the masthead at 390". Never a screen, a phone mockup or code.
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/imagegen-frontend-web/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: imagegen-frontend-web
-description: The plate-making skill for a web surface on ANY Cloud Bongos instance, under the owner's hero-only rule: it produces text-free hero plates, hero objects and atmosphere backdrops for the slots a composition already has, never one image per section, never a screen, never a UI comp, and it writes no page code. Commits to the plate list out loud, chooses a composition anchor per plate that is not the text-left image-right default, locks one material, one light and one camera across the family, matches every plate tonally to the instance's pack, runs the generation through the instance's art pipeline key, and lands each plate as the pair convention (a black-ground plate for dark, an alpha cutout for light) with a provenance sidecar beside every file. Triggers on "make a hero plate", "we need a hero object for", "an atmosphere backdrop for the landing", "the project orbs need a new material", or when design-taste-frontend or /design names a plate slot with no plate. Ported in-house from the taste-skill rebuild spec (tasks 1003325 and 1003328, ADR 0198) with the hero-only rewrite the upstream never had.
+description: >-
+  The plate-making skill for a web surface, under the owner's hero-only rule. Text-free hero plates, hero
+  objects and atmosphere backdrops for the slots a composition already has — never one per section, never a
+  screen, never a UI comp, and no page code. One material, light and camera across the family, landed with a
+  provenance sidecar. Triggers on "make a hero plate", "an atmosphere backdrop".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/impeccable/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: impeccable
-description: The design-craft method for ANY surface on ANY Cloud Bongos instance, invoked as one skill plus an optional sub-command and an optional target ("impeccable audit /projects", "impeccable polish the hall's ranks page", "impeccable harden the wizard"). Sixteen sub-command playbooks (shape, audit, critique, polish, harden, animate, typeset, colorize, layout, adapt, distill, clarify, onboard, optimize, document, extract) plus the two directions (bolder, quieter), exactly one loaded per request; a bare description with no sub-command is ordinary design work routed to the closest playbook; no argument prints a menu built from live project signals and never auto-runs anything. Carries the craft floor (loaded right before UI is edited, never recited to the user) and the bounded finish (build fully, one render round through the kit, one batch of fixes, at most one confirming round, stop). Triggers on "impeccable", "critique this page", "audit the UI", "polish the whole path", "make it survive long text", "animate this", "tighten the copy", "document the design system", "extract the repeated pattern". Rebuilt in-house from the impeccable rebuild spec (task 1003326, ADR 0198) with no hooks, no bypass agent, no telemetry and no live server; the live loop is the playwright plugin and the headless loop is the module's kit. Web surfaces only; a native mobile target declines to /design.
+description: >-
+  The design-craft method for any surface, invoked as one skill plus an optional sub-command and target
+  ("impeccable audit /projects"). Sixteen playbooks — shape, audit, critique, polish, harden, animate,
+  typeset, colorize, layout, adapt, distill, clarify, onboard, optimize, document, extract — one per request.
+  Triggers on "impeccable", "critique this page", "audit the UI". Web surfaces only.
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/industrial-brutalist-ui/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: industrial-brutalist-ui
-description: Raw mechanical interfaces that read like a technical document, inside the instance's world. One archetype per project (Swiss industrial print or dark tactical terminal, never mixed), massive uppercase clamped display against fixed tracked-out mono metadata, the pack's terracotta as the single hazard accent and its sea as one terminal green, strict grid anchoring with the hairline as a one-pixel grid gap, zero corner rounding, bracket and crosshair framing glyphs, and static halftone, scanline and noise degradation inside the Kill Switch. Triggers on "brutalist", "industrial", "terminal", "make it raw", "like a technical document". Rebuilt in-house from the taste-skill rebuild spec (task 1003327, ADR 0198).
+description: >-
+  Raw mechanical interfaces that read like a technical document, inside the instance's world. One archetype
+  per project (Swiss industrial print or dark tactical terminal, never mixed), massive uppercase display
+  against tracked-out mono metadata, strict grid anchoring, zero corner rounding, halftone and scanline
+  degradation inside the Kill Switch. Triggers on "brutalist", "industrial", "make it raw".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/minimalist-ui/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: minimalist-ui
-description: Quiet editorial product interfaces built out of type and white space, inside the instance's world. Macro whitespace first, a capped measure, one display job and one body job, exactly one hairline weight for every border in the sheet, washed accents measured against their own ink, flat tile cards with no shadow, box-less accordions, keycap shortcuts, one depth treatment per band, entry motion inside the Kill Switch. Triggers on "make it minimal", "clean and editorial", "quiet", "document-like", "this feels busy". Declines dense surfaces like dashboards and ledgers. Rebuilt in-house from the taste-skill rebuild spec (task 1003327, ADR 0198); the palette is the pack and the nearest library look is expedition.
+description: >-
+  Quiet editorial product interfaces built out of type and white space, inside the instance's world. Macro
+  whitespace first, a capped measure, one display job and one body job, exactly one hairline weight for every
+  border, flat tile cards with no shadow, entry motion inside the Kill Switch. Triggers on "make it minimal",
+  "clean and editorial", "this feels busy". Declines dense surfaces.
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/redesign-existing-projects/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: redesign-existing-projects
-description: Upgrades an existing site or app in place, in whatever framework and styling method it already uses, without breaking it. A fixed three-step sequence (scan the stack, diagnose against a written audit, apply targeted fixes), the seven-group audit (typography, colour and surface, layout, interaction, content, code and omissions) with the instance's world as the answer key, a catalogue of upgrade techniques marked CSS-only or not available, and a fixed impact-per-risk fix order. Triggers on "redesign this", "upgrade the existing page", "make the current X premium", "audit this UI", "this page looks generic, fix it". Rebuilt in-house from the taste-skill rebuild spec (task 1003325, ADR 0198); keeps the stack, never migrates frameworks, images are hero plates only.
+description: >-
+  Upgrades an existing site or app in place, in whatever framework and styling method it already uses, without
+  breaking it. Three fixed steps — scan the stack, diagnose against a written audit, apply targeted fixes —
+  with the instance's world as the answer key and a fixed impact-per-risk fix order. Triggers on "redesign
+  this", "upgrade the existing page", "audit this UI".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/stitch-design-taste/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: stitch-design-taste
-description: Writes a design contract document for an external screen-generating tool such as Google Stitch, in the platform's own frontmatter shape. Four dials (creativity, density, variance, motion intent) with named bands and stated defaults, then eight fixed sections (atmosphere, colour roles, typography, components, layout, responsive rules, motion intent, banned patterns) written as descriptive language paired with exact values. The thirteen colours are transcribed from the instance's pack and diffed, never invented; motion is an intent brief inside the Kill Switch; the screens that come back are a reference, not a source of truth. Triggers on "write a design brief for Stitch", "a design contract document", "a prompt-to-screen tool". Rebuilt in-house from the taste-skill rebuild spec (task 1003327, ADR 0198).
+description: >-
+  Writes a design contract document for an external screen-generating tool such as Google Stitch, in the
+  platform's own frontmatter shape. Four dials with named bands and stated defaults, then eight fixed sections
+  pairing descriptive language with exact values. The thirteen colours are transcribed from the instance's
+  pack, never invented. Triggers on "a design brief for Stitch".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/modules/ui-design/skills/style/SKILL.md

@@ -1,6 +1,10 @@
 ---
 name: style
-description: Runs a bounded session in which an owner authors their OWN look for the instance, as a branding pack inside the fifteen-token contract, and proves it clean before it lands. Four steps and no more. SEARCH reads the instance's world and the style library, renders the nearest two entries so the owner looks rather than imagines, and asks two or three questions about feel. CREATE drafts modules/ui-design/styles/<name>/ in the library's contract shape (pack.json, DESIGN.md, mock.html), never a fork of a sheet and never a sixteenth token. PROVE retunes the thirteen against contrast.js, the styles suite, check-mock and the kit's renders until every named pair is green, showing the shots each round. ADOPT hands the owner the one-step switch and files the look into the catalogue. Triggers on "/style", "make a look", "author a style", "I want our own theme", "can we have a different look", "add a style to the library".
+description: >-
+  Runs a bounded session in which an owner authors their own look for the instance, as a branding pack inside
+  the fifteen-token contract, and proves it clean before it lands. Four steps and no more — SEARCH, CREATE,
+  PROVE, ADOPT. Triggers on "/style", "make a look", "author a style", "I want our own theme", "add a style to
+  the library".
 ---
 
 <!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.545",
+  "version": "1.19.547",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.545",
+      "version": "1.19.547",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.545",
+  "version": "1.19.547",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1311,7 +1311,11 @@ function checkErrorEnvelope() {
 // truncated EVERY field, the skill matched on its body text, and nothing in CI noticed. A parse
 // error is a hard fail; description length and the listing budget are advisory (the listing is
 // resident in every session, ~1% of context, and gets truncated past ~8k chars). The check reads
-// the instance's .claude/skills/ and is a quiet pass when a checkout carries none (published core).
+// every skill Claude Code can load — the instance's .claude/skills/ AND the module-owned
+// modules/*/skills/ that claude-materialize.js copies into it (task 1003587: scanning only the
+// tracked root meant 14 ui-design skills went unlinted until the untracked copy existed, so four
+// unparseable frontmatters shipped and fitness only went red on a checkout that had materialized).
+// A quiet pass when a checkout carries none (published core).
 function checkSkillFrontmatter() {
   const violations = [];
   const warnings = [];
@@ -1329,7 +1333,10 @@ function checkSkillFrontmatter() {
   }
   if (long.length) {
     long.sort((a, b) => b.n - a.n);
-    warnings.push(`${long.length} description(s) over ${lint.DESC_WARN_CHARS} chars (longest: ${long.slice(0, 4).map((l) => `${l.file.split('/')[2]} ${l.n}`).join(', ')}) — every char is resident in every session; run node scripts/gds/skill-lint.js.`);
+    // The skill's own name is its PARENT dir — a fixed path index would read "skills"
+    // for a module-owned path (modules/<key>/skills/<name>/SKILL.md).
+    const skillName = (f) => f.split('/').slice(-2, -1)[0] || f;
+    warnings.push(`${long.length} description(s) over ${lint.DESC_WARN_CHARS} chars (longest: ${long.slice(0, 4).map((l) => `${skillName(l.file)} ${l.n}`).join(', ')}) — every char is resident in every session; run node scripts/gds/skill-lint.js.`);
   }
   if (report.overBudget) warnings.push(`the skill listing is ${report.listingChars} chars (~${estTokens(report.listingChars)} tokens) against a ~${report.budgetChars}-char budget — Claude Code truncates entries past it and routing degrades.`);
   return {
@@ -1338,7 +1345,7 @@ function checkSkillFrontmatter() {
     hardFail: violations.length > 0,
     violations,
     warnings,
-    note: `${report.results.length} SKILL.md file(s) under .claude/skills/ parse as YAML (name + description present, no ": " / " #" in a plain scalar); length + listing budget advisory.`,
+    note: `${report.results.length} SKILL.md file(s) under .claude/skills/ + modules/*/skills/ parse as YAML (name + description present, no ": " / " #" in a plain scalar); length + listing budget advisory.`,
   };
 }
 

package/scripts/gds/seed-strict-versioning-tasks.js

@@ -0,0 +1,275 @@
+#!/usr/bin/env node
+// scripts/gds/seed-strict-versioning-tasks.js — seeds goal 1000086 ("Strict
+// versioning: a goal cannot outlive its tasks") from the spec at
+// docs/specs/bongos-v1-strict-versioning.md. Idempotent on source_ref, throttled
+// against the per-IP write limiter, and self-verifying: the last step diffs the
+// criterion links that actually landed against the plan and exits non-zero on
+// any drift (task 1003076).
+
+const { execFile } = require('child_process');
+const path = require('path');
+const { expectedCriterionCounts, verifySeedCriteriaLinks } = require('./seed-verify-criteria');
+
+const VERSION = 'BONGOS-V1';
+const GOAL = 1000086;
+const PREFIX = 'strict-versioning';
+const API = path.join(__dirname, 'api.js');
+const WRITE_DELAY_MS = 4200;
+
+const C1 = 'sv-goal-set-closed';
+const C2 = 'sv-goal-outlives-nothing';
+const C3 = 'sv-killing-a-goal-is-deliberate';
+const C4 = 'sv-every-task-has-a-goal';
+const C5 = 'sv-a-version-can-close';
+const C6 = 'sv-one-train-per-project';
+const C7 = 'sv-cutover-proven-live';
+
+// TASKS — ref is the V##.R## rank suffix; deps are refs resolved to real task
+// ids after every task exists. Descriptions stay short and cross-reference by
+// ref rather than restating the spec (which is the durable context).
+const TASKS = [
+  {
+    ref: 'R01', kind: 'refactor', priority: 5, est: 90, criteria: [C2], deps: [],
+    title: 'BV1.R01 — One terminal-status vocabulary: shipped or abandoned, declared once',
+    desc: '`goal-rollup.js:37` counts shipped|confirmed|completed as done; `done-when.js:429` counts only shipped and treats abandoned as accounted-for. Two definitions of "finished" in one module is what lets a goal read closed on one surface and open on another. Declare the terminal set once and have both read it.\n\n**Done when:** a single exported constant is the only spelling of the terminal set; `goal-rollup.js` and `done-when.js` both consume it; `tests/goal_sort_staleness.mjs` (which pins the rollup against the client `goals-lib.js`) still passes, or is updated with the reason.',
+  },
+  {
+    ref: 'R02', kind: 'decision', priority: 5, est: 120, criteria: [C1], deps: [],
+    title: 'BV1.R02 — ADR: strict versioning — the version boundary is the scope gate',
+    desc: 'Write the ADR behind goal 1000086. Records the model: goals are scoped onto a `planning` version, the goal set closes when the version starts building, an Archon override admits a named goal with a reason, a goal cannot close while it holds non-terminal work, and exactly one version builds per project. Cite the measured state that motivated it (62 goals, 10 closed while holding 28 open tasks, 502 open tasks across 37 open goals, two building versions on one project).\n\n**Done when:** the ADR exists, is indexed in `docs/adr/README.md`, and is linked from goal 1000086. Take the next free ADR number immediately before pushing — concurrent agents collide on it.',
+  },
+  {
+    ref: 'R05', kind: 'feature', priority: 5, est: 90, criteria: [C4], deps: [],
+    title: 'BV1.R05 — POST /tasks and PATCH /tasks/:id read goal.status',
+    desc: '`POST /goals/:id/tasks` already refuses a non-open goal (`goal-route-authz.js:47`, 409 `goal_not_open`), but `POST /tasks` (`task-write-routes.js:167`) and `PATCH /tasks/:id` (`:392`) validate only that the goal exists and belongs to the version. A task can be created directly into an achieved or archived goal today. Close the asymmetry.\n\n**Done when:** both vectors refuse a non-open goal with the same named 409 the goal-scoped route uses; a test covers each vector.',
+  },
+  {
+    ref: 'R03', kind: 'feature', priority: 5, est: 120, criteria: [C1], deps: ['R02'],
+    title: 'BV1.R03 — POST /goals refuses a version that is not in planning',
+    desc: '`routes/goals.js:101` fetches the version row and discards it after the null check — `version.status` is never read, so a goal can be created on a shipped version. Add the gate: goals may be created on a `planning` version (that is where the next version is scoped in advance); a `building` version refuses without the R07 override.\n\n**Done when:** a pure `authorizeGoalCreate` lives beside `authorizeGoalTaskCreate` in `goal-route-authz.js` and is unit-tested DB-free; the refusal is a named 409 an agent can act on; reuse `versionAcceptsNewWork`\'s status vocabulary rather than respelling it.',
+  },
+  {
+    ref: 'R04', kind: 'feature', priority: 5, est: 90, criteria: [C1], deps: ['R02'],
+    title: 'BV1.R04 — POST /versions refuses a second planning version for a project',
+    desc: 'With R03 in place, a builder blocked from adding a goal to the building version could cut a second planning version and put it there. One planning version per project means exactly one queue for future goals and no parallel escape hatches.\n\n**Done when:** `POST /versions` returns a named 409 when a planning version already exists for the project; a test covers it.',
+  },
+  {
+    ref: 'R06', kind: 'spike', priority: 5, est: 180, criteria: [C5], deps: ['R02'],
+    title: 'BV1.R06 — Design pass: how a version closes (auto, early, roll-forward, maintenance exemption)',
+    desc: 'No route ships a version — `scripts/gds/version-close.js:290` prints that the API exposes no version status transitions, and the flip is hand-run SQL on the droplet. The `version.close` permission exists at the archon floor (`government/catalog.js:103`) and nothing references it. Design the lifecycle before building it: auto-close when the last non-maintenance goal achieves, Archon early-close with a per-goal disposition, roll-forward via `succeeds_goal_id` lineage, and the maintenance goal\'s exemption from the close count. Reuse `version-close.js:66` `suggestClose` and `getCarryOverCount` — the judgement already exists and is merely advisory.\n\n**Done when:** an ADR states the model and the sub-tasks it implies are filed. Spike — will not auto-promote; open it manually.',
+  },
+  {
+    ref: 'R07', kind: 'feature', priority: 5, est: 150, criteria: [C1], deps: ['R03'],
+    title: 'BV1.R07 — Archon override: admit one named goal to a building version, with a reason',
+    desc: 'The escape valve for R03. An Archon may admit a specific net-new goal into an in-flight version and must record why. Per-goal, never a blanket unlock.\n\n**Done when:** an override row stores the goal, the actor, the reason and the timestamp; only an Archon can create one; a goal admitted this way is created normally in every other respect.',
+  },
+  {
+    ref: 'R08', kind: 'feature', priority: 5, est: 120, criteria: [C2], deps: ['R01'],
+    title: 'BV1.R08 — achieveGoalIfComplete refuses a goal that still holds non-terminal tasks',
+    desc: '`db-goals.js:193-213` decides achievement from `done_when_criteria` alone; tasks are never queried. A goal whose criteria are all satisfied auto-achieves while holding any number of backlog or ready tasks, because those tasks are linked to no criterion. Add the second condition to the manual-satisfy path.\n\n**Done when:** the check uses R01\'s terminal set; a goal holding a ready/backlog/blocked/active/completed/confirmed task cannot reach achieved via `POST /done-when/:id/satisfy`.',
+  },
+  {
+    ref: 'R09', kind: 'feature', priority: 5, est: 120, criteria: [C2], deps: ['R01'],
+    title: 'BV1.R09 — The achievement cascade gains the same check, on the caller exec',
+    desc: 'The sibling of R08 in `done-when.js:451-460` — the cascade inside `autoSatisfyShippedCriteria`, which is the path that actually fires on every ship (`db-ship.js:434`) and every reconciler tick (`publish-reconciler.js:847`). It is a deliberate duplicate of the `db-goals.js` rule (collapsing them creates a require cycle), so both must change or neither does.\n\n**Done when:** the same predicate is a third NOT EXISTS clause on the cascade UPDATE, run on `exec` and never the module pool, so the ship transaction sees its own uncommitted flips. Shipping itself must remain unblocked — only the goal flip is gated.',
+  },
+  {
+    ref: 'R10', kind: 'feature', priority: 5, est: 120, criteria: [C3], deps: ['R01'],
+    title: 'BV1.R10 — Archive previews its open tasks and refuses without a disposition',
+    desc: '`POST /goals/:id/archive` (`routes/goals.js:1043`) refuses only if the goal is already archived — no criterion check, no task check. It is the hole that bypasses R08/R09 entirely, and how goal 1000018 was archived with all 7 tasks still open. Archiving a goal that holds open work must first return that work.\n\n**Done when:** archiving a goal with non-terminal tasks returns them and a named 409; archiving one with none stays a single call.',
+  },
+  {
+    ref: 'R11', kind: 'feature', priority: 5, est: 150, criteria: [C4], deps: ['R05'],
+    title: 'BV1.R11 — goal_id becomes required; delete the catch-all fallback',
+    desc: '`db-tasks.js:150` silently falls back to `generalGoalIdForVersion` when no goal is named, and the two resulting catch-alls hold 53 open tasks. Goal-less work is the hole through which unscoped work accumulates invisibly.\n\n**Done when:** `POST /tasks` requires `goal_id`; the fallback is deleted; every in-repo caller passes a goal. R25 drains the existing catch-alls.',
+  },
+  {
+    ref: 'R12', kind: 'feature', priority: 5, est: 180, criteria: [C5], deps: ['R06'],
+    title: 'BV1.R12 — POST /versions/:id/close, behind the version.close permission',
+    desc: 'Build what R06 designed. Archon-only, wired to the already-defined `version.close` permission. Any goal still open at close time takes an explicit decision — roll forward (R17) or abandon.\n\n**Done when:** the route exists, refuses a non-Archon, refuses an early close that leaves a goal without a disposition, and sets `shipped_at`.',
+  },
+  {
+    ref: 'R13', kind: 'verify', priority: 4, est: 150, criteria: [C2], deps: ['R08', 'R09'],
+    title: 'BV1.R13 — Goal-closure invariant suite',
+    desc: 'Pin the C2 invariant across both writers so it cannot regress the way the two vocabularies drifted apart.\n\n**Done when:** tests cover the manual-satisfy path (R08) and the cascade (R09); one test proves the cascade sees the ship transaction\'s uncommitted flip; one test proves a ship still lands while its goal is held open by a sibling backlog task; the existing `goal_achievement.mjs`, `auto_satisfy_criteria.mjs` and `criterion_progress.mjs` all still pass.',
+  },
+  {
+    ref: 'R14', kind: 'feature', priority: 4, est: 180, criteria: [C3], deps: ['R10'],
+    title: 'BV1.R14 — Archive applies the disposition: abandon with a reason, or move to a named goal',
+    desc: 'The second half of R10. The caller re-submits naming what happens to each open task; nothing is discarded without a decision, which was the owner\'s explicit constraint.\n\n**Done when:** each task is either abandoned (stamped with the archive reason) or moved to a named surviving goal; the disposition is recorded per task; the goal ends archived holding zero non-terminal tasks.',
+  },
+  {
+    ref: 'R15', kind: 'feature', priority: 4, est: 120, criteria: [C1], deps: ['R07'],
+    title: 'BV1.R15 — Overrides are countable and visible on the version',
+    desc: 'An override nobody can count is indistinguishable from no gate at all. Surface them so abuse is measurable.\n\n**Done when:** the version rollup exposes the override count; the hall shows which goals were admitted mid-version, by whom, and why.',
+  },
+  {
+    ref: 'R16', kind: 'feature', priority: 4, est: 150, criteria: [C5], deps: ['R12', 'R08', 'R09'],
+    title: 'BV1.R16 — A version closes itself when its last non-maintenance goal achieves',
+    desc: 'The automatic finish line. Fires from the goal-achievement path (R08/R09), skipping the maintenance goal (R18) — without that exemption a version can never auto-close, because the maintenance goal is open by design.\n\n**Done when:** achieving the last non-exempt goal flips the version to closed; a version whose only open goal is the maintenance goal closes; the auto-promotion of the next version (R20) fires from the same event.',
+  },
+  {
+    ref: 'R17', kind: 'feature', priority: 4, est: 150, criteria: [C5], deps: ['R12'],
+    title: 'BV1.R17 — Roll-forward: an unfinished goal becomes a successor goal in the next version',
+    desc: 'The sanctioned exit for a goal that is not done when its version closes. `POST /goals` already accepts `succeeds_goal_id` and stamps the predecessor\'s `succeeded_by_goal_id` (`routes/goals.js:108,130`) — reuse it rather than inventing a second lineage.\n\n**Done when:** rolling a goal forward creates the successor in the target version with its open tasks, sets both lineage pointers, and archives the predecessor; the chain is queryable across versions.',
+  },
+  {
+    ref: 'R18', kind: 'feature', priority: 4, est: 180, criteria: [C6], deps: ['R06', 'R12'],
+    title: 'BV1.R18 — The maintenance goal: auto-created per version, exempt from close, carries bugs forward',
+    desc: 'Where a defect against already-shipped work lands. Auto-created with each version, flagged exempt so it never blocks the auto-close count, and on close its unfinished bugs move to the successor version\'s maintenance goal. The one goal that legitimately spans versions.\n\n**Done when:** creating a version creates its maintenance goal; the exempt flag is read by R16; close carries the open bugs forward; the goal is otherwise an ordinary goal.',
+  },
+  {
+    ref: 'R19', kind: 'feature', priority: 4, est: 90, criteria: [C6], deps: ['R04'],
+    title: 'BV1.R19 — Refuse a second building version for a project',
+    desc: 'BONGOS-V1 and CB-V1 are both building on the same project today, which is why "the current version" has no meaning and R03\'s gate would have two answers. This is the invariant every other rule depends on.\n\n**Done when:** the server refuses to put a second version into `building` for a project; a named 409; a test covers it. R27 resolves the existing violation.',
+  },
+  {
+    ref: 'R20', kind: 'feature', priority: 4, est: 120, criteria: [C6], deps: ['R12', 'R19'],
+    title: 'BV1.R20 — The planning version promotes itself when the building version closes',
+    desc: 'Keeps the "exactly one building version" invariant machine-maintained and leaves no window where the project has no live train and nothing is claimable.\n\n**Done when:** closing the building version flips the single planning version to building in the same transaction; with no planning version, close still succeeds and the project is simply idle.',
+  },
+  {
+    ref: 'R21', kind: 'feature', priority: 4, est: 90, criteria: [C6], deps: ['R04'],
+    title: 'BV1.R21 — Raise version.create back to the Archon floor',
+    desc: 'ADR 0157 delegated `version.create` to Metic. Once the version boundary gates all scope (R03), the power to cut a version is the power to bypass every gate in this design.\n\n**Done when:** the catalog floor is archon; an ADR records the partial reversal of ADR 0157 and its reason; `/planning-session` and `/goal-create` docs reflect the new floor.',
+  },
+  {
+    ref: 'R22', kind: 'feature', priority: 4, est: 120, criteria: [C4], deps: ['R11'],
+    title: 'BV1.R22 — Capture and idea-routing vectors name a goal',
+    desc: 'With R11 landed, any vector that creates a task without a goal simply breaks. `routeIdeaToGoal` (`modules/ideas/inbox.js:328`) already requires an open goal on a building version; `capture.js` and the other creation paths need the same discipline.\n\n**Done when:** every in-repo task-creation vector names a goal or fails loudly with an actionable message; no path silently produces an orphan.',
+  },
+  {
+    ref: 'R23', kind: 'cleanup', priority: 4, est: 60, criteria: [C5], deps: ['R12'],
+    title: 'BV1.R23 — version-close.js drives the route instead of printing that the API cannot',
+    desc: '`scripts/gds/version-close.js:290` tells the operator the API exposes no version status transitions and to run SQL on the droplet. After R12 that text is false and the SQL path is the bypass.\n\n**Done when:** the script calls `POST /versions/:id/close`; the droplet-SQL instruction is deleted; the advisory `suggestClose` output is kept.',
+  },
+  {
+    ref: 'R24', kind: 'feature', priority: 3, est: 150, criteria: [C3], deps: ['R14'],
+    title: 'BV1.R24 — Hall surface: the archive two-step, and why a goal is held open',
+    desc: 'The gates are only usable if a builder can see what is holding a goal open before they try to close it, and can walk the archive disposition without curl.\n\n**Done when:** a goal page shows the non-terminal tasks blocking its closure; the archive flow presents the preview and collects the disposition; both follow the hall\'s existing row idioms.',
+  },
+  {
+    ref: 'R25', kind: 'cleanup', priority: 4, est: 180, criteria: [C4], deps: ['R11', 'R14'],
+    title: 'BV1.R25 — Rehome the 53 catch-all tasks; drain and archive both catch-alls',
+    desc: 'Goal 1000003 ("Work with no goal yet") holds 37 open tasks and CB-V1\'s general goal holds 16. Under R11 no new ones can appear; these are the existing population.\n\n**Done when:** every one of the 53 is moved to a real goal or abandoned with a reason via R14\'s flow; both catch-alls hold zero tasks and are archived; a query proving zero catch-all tasks is captured in the notes.',
+  },
+  {
+    ref: 'R26', kind: 'cleanup', priority: 4, est: 180, criteria: [C7], deps: ['R14'],
+    title: 'BV1.R26 — Disposition the 10 closed goals that still hold 28 open tasks',
+    desc: 'The existing violations of C2, measured 2026-09-04: goals 1000018 (archived, all 7 tasks open), 1000072 (achieved, 7), 1000051 (4), 1000041 (3), 1000060 (2), 1000031, 1000034, 1000056, 1000061, 1000071 (1 each). Walk each through R14\'s preview-and-dispose flow so the new rule starts from a true state.\n\n**Done when:** all 28 are moved or abandoned with a reason; a query returns zero closed goals holding non-terminal tasks.',
+  },
+  {
+    ref: 'R27', kind: 'infra', priority: 4, est: 180, criteria: [C7], deps: ['R12', 'R17'],
+    title: 'BV1.R27 — Fold CB-V1 into BONGOS-V1 and close CB-V1',
+    desc: 'CB-V1 is the same project as BONGOS-V1 ("CB" is Cloud Bongos), and both are building — the violation R19 forbids. Its 4 open goals (1000043, 1000066, 1000084 and its general catch-all) move to BONGOS-V1; its 2 achieved goals stay with the closed version.\n\n**Done when:** the open goals are in BONGOS-V1 with lineage intact; CB-V1 is closed via R12; its 98 non-terminal tasks are all accounted for under a real goal; exactly one version is building.',
+  },
+  {
+    ref: 'R28', kind: 'decision', priority: 4, est: 120, criteria: [C7], deps: ['R27', 'R26'],
+    title: 'BV1.R28 — Owner names the goals that ARE BONGOS-V1; everything else moves to V2',
+    desc: 'Measured during the planning session: a 14-day activity window keeps 28 of 37 open goals and 454 of 502 open tasks in V1 — nothing is stale because the instance is busy, so no mechanical rule produces a finish line. The owner names the handful of goals that define what V1 means (target ~5-8); every other open goal is targeted at BONGOS-V2 regardless of activity.\n\n**Done when:** the list is recorded in the task notes with each goal\'s open-task count; every open goal is labelled stay or move. Needs the owner — file a blocker if it stalls.',
+  },
+  {
+    ref: 'R29', kind: 'feature', priority: 4, est: 180, criteria: [C7], deps: ['R28', 'R03'],
+    title: 'BV1.R29 — Scope BONGOS-V2 in planning, with its goal set and criteria',
+    desc: 'The first version created under the new rules, and the proof that scoping-before-building works. Created in `planning` so its goals can be authored (R03), holding every goal R28 marked move.\n\n**Done when:** BONGOS-V2 exists in `planning`; the moved goals are on it as successors with lineage; every goal on it has at least one done-when criterion; it is the only planning version.',
+  },
+  {
+    ref: 'R30', kind: 'verify', priority: 4, est: 120, criteria: [C7], deps: ['R29', 'R25', 'R20', 'R13'],
+    title: 'BV1.R30 — Proof: the four invariants hold on the live instance',
+    desc: 'The single live demonstration that goal 1000086 is met. Run each query against live and capture its output verbatim in the task notes:\n1. zero goals in achieved/archived holding a task that is not shipped or abandoned;\n2. zero tasks in a catch-all goal, and zero tasks with a null goal;\n3. exactly one version in `building` for the project, and at most one in `planning`;\n4. BONGOS-V2 exists in `planning` with criteria on every goal.\nThen attempt one refusal of each gate (add a goal to the building version; close a goal holding a backlog task; archive without a disposition) and record the 409s.\n\n**Done when:** all four queries return the expected result and all three refusals fire, with transcripts in the notes.',
+  },
+];
+
+function api(method, route, body) {
+  return new Promise((resolve, reject) => {
+    const args = [API, method, route];
+    if (body) args.push('--body', JSON.stringify(body));
+    execFile('node', args, { maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
+      const raw = String(stdout || '');
+      const start = raw.indexOf('{');
+      let json = null;
+      if (start >= 0) { try { json = JSON.parse(raw.slice(start)); } catch { /* non-JSON body */ } }
+      const status = Number((String(stderr || '') + raw).match(/→ (\d{3})/)?.[1] || 0);
+      if (err && !json) return reject(new Error(`${method} ${route} failed: ${err.message}\n${stderr}`));
+      resolve({ ok: status >= 200 && status < 300, status, json });
+    });
+  });
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// throttledWrite — the per-IP limiter kills a long seed halfway unless each
+// write is paced and a 429 backs off on the server's own retry_after.
+async function throttledWrite(method, route, body) {
+  for (let attempt = 0; attempt < 5; attempt++) {
+    const r = await api(method, route, body);
+    if (r.status === 429) {
+      // The limiter answers res.fail('rate_limited', 429, {scope, retry_after_seconds}),
+      // and the error envelope nests that payload under error.details — same path
+      // seed-bongos-v1-idea-routing-tasks.js reads. Any other spelling silently
+      // falls back to the default and ignores the server's computed wait.
+      const wait = (Number(r.json?.error?.details?.retry_after_seconds) || 30) * 1000 + 1000;
+      console.log(`  429 — backing off ${wait}ms`);
+      await sleep(wait);
+      continue;
+    }
+    await sleep(WRITE_DELAY_MS);
+    return r;
+  }
+  throw new Error(`${method} ${route} still rate-limited after 5 attempts`);
+}
+
+// The meta planning task (1003586) was created before this seed ran and links
+// to C1. It is a real link on the goal, so the plan must count it or the
+// verification below reports a false mismatch.
+const PRE_EXISTING_LINKS = [[C1]];
+
+async function main() {
+  const ids = {};
+  const planned = [...PRE_EXISTING_LINKS];
+
+  console.log(`Seeding ${TASKS.length} tasks into goal ${GOAL} (${VERSION})\n`);
+
+  for (const t of TASKS) {
+    const body = {
+      version_id: VERSION,
+      goal_id: GOAL,
+      title: t.title,
+      description: t.desc,
+      kind: t.kind,
+      discipline: 'engineer',
+      priority: t.priority,
+      est_minutes: t.est,
+      source: 'planning-session',
+      source_ref: `${PREFIX}-${t.ref}`,
+      criterion_ids: t.criteria,
+    };
+    const r = await throttledWrite('POST', '/api/gds/tasks', body);
+    const id = r.json?.task?.id;
+    if (!id) throw new Error(`No task id back for ${t.ref} (status ${r.status}): ${JSON.stringify(r.json)}`);
+    ids[t.ref] = id;
+    planned.push(t.criteria);
+    console.log(`  ${t.ref} -> task ${id} [${t.criteria.join(',')}] ${r.status}`);
+  }
+
+  console.log('\nWiring dependencies...');
+  for (const t of TASKS) {
+    for (const dep of t.deps) {
+      if (!ids[dep]) throw new Error(`${t.ref} depends on unknown ref ${dep}`);
+      const r = await throttledWrite('POST', `/api/gds/tasks/${ids[t.ref]}/dependencies`, { depends_on_task_id: ids[dep] });
+      console.log(`  ${t.ref} depends on ${dep} (${ids[dep]}) ${r.status}`);
+    }
+  }
+
+  console.log('\nVerifying criterion links landed as planned...');
+  await verifySeedCriteriaLinks({
+    goalId: GOAL,
+    expectedCounts: expectedCriterionCounts(planned),
+    fetchGoal: (goalId) => api('GET', `/api/gds/goals/${goalId}`),
+  });
+
+  console.log('\nSeed complete. Task ids:');
+  for (const t of TASKS) console.log(`  ${t.ref} = ${ids[t.ref]}`);
+}
+
+main().catch((e) => { console.error(e.message); process.exit(1); });

package/scripts/gds/skill-lint.js

@@ -23,7 +23,9 @@
 // verdict as authoritative over this one.
 //
 // Usage:
-//   node scripts/gds/skill-lint.js                 lint every .claude/skills/*/SKILL.md; exit 1 on any error
+//   node scripts/gds/skill-lint.js                 lint every skill Claude Code can load — .claude/skills/*
+//                                                  plus the module-owned modules/*/skills/* that materialize
+//                                                  into it; exit 1 on any error
 //   node scripts/gds/skill-lint.js <file...>       lint specific files
 //   node scripts/gds/skill-lint.js --hook          PostToolUse mode: read the hook JSON on stdin, lint the
 //                                                  edited file if it is a SKILL.md, print findings, exit 0
@@ -108,14 +110,40 @@ function lintSkillFile(text, { file = 'SKILL.md' } = {}) {
   return res;
 }
 
-// Every SKILL.md under .claude/skills/ (one level deep).
-function listSkillFiles(root = REPO_ROOT) {
-  const dir = path.join(root, '.claude', 'skills');
+// Every SKILL.md in one skills root (one level deep, plus a `vendor/` tier).
+function skillsIn(dir) {
   if (!fs.existsSync(dir)) return [];
-  return fs.readdirSync(dir, { withFileTypes: true })
-    .filter((d) => d.isDirectory())
-    .map((d) => path.join(dir, d.name, 'SKILL.md'))
-    .filter((f) => fs.existsSync(f));
+  const out = [];
+  for (const d of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (!d.isDirectory()) continue;
+    const own = path.join(dir, d.name, 'SKILL.md');
+    if (fs.existsSync(own)) { out.push(own); continue; }
+    if (d.name === 'vendor') out.push(...skillsIn(path.join(dir, d.name)));
+  }
+  return out;
+}
+
+// Every skill Claude Code can end up loading — the tracked `.claude/skills/` PLUS the
+// module-owned `modules/<key>/skills/`, because claude-materialize.js copies those into
+// `.claude/skills/` as untracked copies (task 1003330) and a defect in one only shows up
+// after materialization. Scanning only the tracked root left 14 ui-design skills unlinted
+// until the copy existed, which is exactly how four unparseable frontmatters shipped
+// (task 1003587). A name already present in `.claude/skills/` wins and its module copy is
+// skipped — the same precedence the materializer applies — so nothing is counted twice.
+function listSkillFiles(root = REPO_ROOT) {
+  const core = skillsIn(path.join(root, '.claude', 'skills'));
+  const seen = new Set(core.map((f) => path.basename(path.dirname(f))));
+  const modulesDir = path.join(root, 'modules');
+  const owned = [];
+  if (fs.existsSync(modulesDir)) {
+    for (const d of fs.readdirSync(modulesDir, { withFileTypes: true })) {
+      if (!d.isDirectory()) continue;
+      for (const f of skillsIn(path.join(modulesDir, d.name, 'skills'))) {
+        if (!seen.has(path.basename(path.dirname(f)))) owned.push(f);
+      }
+    }
+  }
+  return [...core, ...owned];
 }
 
 // Lint a set of files; returns per-file results plus the listing total vs budget.
@@ -125,7 +153,13 @@ function lintSkills(files) {
   return { results, listingChars, budgetChars: LISTING_BUDGET_CHARS, overBudget: listingChars > LISTING_BUDGET_CHARS };
 }
 
-function isSkillMd(p) { return /[\\/]\.claude[\\/]skills[\\/][^\\/]+[\\/]SKILL\.md$/.test(String(p || '')); }
+// The PostToolUse hook's gate. It must match a module-owned SKILL.md too — that is the
+// file a builder actually edits; the `.claude/skills/` copy is generated (task 1003587).
+function isSkillMd(p) {
+  const s = String(p || '');
+  return /[\\/]\.claude[\\/]skills[\\/](?:vendor[\\/])?[^\\/]+[\\/]SKILL\.md$/.test(s)
+    || /[\\/]modules[\\/][^\\/]+[\\/]skills[\\/](?:vendor[\\/])?[^\\/]+[\\/]SKILL\.md$/.test(s);
+}
 
 function format(report, { relTo = REPO_ROOT } = {}) {
   const out = [];

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.545'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.547'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_kit_charts.mjs

@@ -623,3 +623,62 @@ test('CAL: the grid gets its own horizontal strip — it never widens the docume
   const html = kit.calendarGridHtml([{ local_date: '2026-09-03', count: 1 }], { today: '2026-09-03' });
   assert.match(html, /kit-cal__scroll/, 'the wide grid scrolls inside its own strip');
 });
+
+// --- task 1003583: the summary and the caption must describe the DRAWN window ------
+
+test('CAL: a narrowed window is described as weeks, not as "the last year"', () => {
+  // The bug: the default aria summary hardcoded "over the last year" whatever
+  // opts.weeks said, so a caller asking for six weeks was handed a label describing
+  // fifty-three.
+  const html = kit.calendarGridHtml([{ local_date: '2026-09-03', count: 2 }], { today: '2026-09-03', weeks: 6 });
+  assert.match(html, /over the last 6 weeks/, 'the aria summary still claims a year');
+  assert.doesNotMatch(html, /over the last year/);
+});
+
+test('CAL: a one-week window says "week", and the full window still says "the last year"', () => {
+  const one = kit.calendarGridHtml([{ local_date: '2026-09-03', count: 1 }], { today: '2026-09-03', weeks: 1 });
+  assert.match(one, /over the last 1 week:/, 'singular grammar');
+  const full = kit.calendarGridHtml([{ local_date: '2026-09-03', count: 1 }], { today: '2026-09-03', weeks: 53 });
+  assert.match(full, /over the last year/, 'the 53-week window is a year and should read like one');
+});
+
+test('CAL: the summary counts only the days the grid actually draws', () => {
+  // 2026-09-03 is a Thursday, so a 2-week grid starts at Sunday 2026-08-23. A ship on
+  // 2026-08-01 is real history the caller supplied, but it is off this picture, and it
+  // used to be counted in this picture's summary anyway.
+  const days = [
+    { local_date: '2026-08-01', count: 4 },   // before the first column
+    { local_date: '2026-08-30', count: 2 },   // inside
+    { local_date: '2026-09-03', count: 1 },   // inside
+  ];
+  const html = kit.calendarGridHtml(days, { today: '2026-09-03', weeks: 2 });
+  assert.match(html, /3 ships across 2 days/, 'the out-of-window day leaked into the summary');
+});
+
+test('CAL: calendarWindow is the one source of truth the caller reads too', () => {
+  // profile-charts.js used to recompute "N days shipped" with its own filter over the
+  // whole array; it now reads activeDays from here, so the caption and the picture
+  // cannot disagree.
+  const days = [
+    { local_date: '2026-08-01', count: 4 },
+    { local_date: '2026-08-30', count: 2 },
+    { local_date: '2026-09-03', count: 1 },
+  ];
+  const opts = { today: '2026-09-03', weeks: 2 };
+  const win = kit.calendarWindow(days, opts);
+  assert.equal(win.activeDays, 2);
+  assert.equal(win.totalShips, 3);
+  assert.equal(win.weeks, 2);
+  // The window's own bounds are what the grid iterates, so the naive filter the caller
+  // used to run disagrees with it — which is exactly the bug.
+  assert.notEqual(days.filter((d) => d.count > 0).length, win.activeDays);
+  const html = kit.calendarGridHtml(days, opts);
+  assert.match(html, new RegExp(`across ${win.activeDays} days`), 'grid and window disagree');
+});
+
+test('CAL: calendarWindow returns null on nothing to draw, matching the grid empty state', () => {
+  assert.equal(kit.calendarWindow([], {}), null);
+  assert.equal(kit.calendarWindow(null, {}), null);
+  assert.equal(kit.calendarWindow([{ local_date: '2026-09-03', count: 0 }], {}), null,
+    'a zero-count day is not a ship day');
+});