@bongos/core 1.19.636 → 1.19.638

package/scripts/gds/role-pack-guard.js

@@ -0,0 +1,121 @@
+// scripts/gds/role-pack-guard.js
+//
+// WHAT. The fitness check behind the kernel/pack split (task 1002990, criterion
+// wa6-kernel-and-packs): every entry in the role registry that names a `pack` must
+// point at a file that exists, and every pack must stay inside a context budget.
+//
+// WHY IT IS A HARD FAIL, when claim.js's own read is fail-open. The registry
+// (scripts/gds/discipline-modes.json) is read at claim time by code that must never
+// break a granted claim, so a pack path that points at nothing degrades to silence:
+// the builder is told their craft's label and nothing else, and the playbook that
+// was supposed to carry everything the role-neutral kernel dropped never loads. That
+// failure is invisible at runtime by design. CI is therefore the only place it can
+// be caught, which is exactly the split the criterion asks for — "CI budgets each
+// pack" — and why a renamed or deleted pack must red the build rather than quietly
+// hollow out a role.
+//
+// WHY A BUDGET AT ALL. A pack is loaded in full whenever someone works that craft,
+// so it costs the same per-session tokens the root CLAUDE.md does (ADR 0061, the
+// context-rot argument). The kernel got a budget when it was the only always-loaded
+// file; the packs inherit the same discipline now that they carry half its content.
+// The ceilings are advisory-then-hard in the same shape checkClaudeMdBudget uses:
+// a target that WARNS, a ceiling that FAILS, both ratcheted down as detail relocates
+// to ADRs and recipes.
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { CORE_ROOT } = require('./fitness-lib.js');
+
+// The registry lives beside the CLI that reads it, in the CORE package — the same
+// resolution claim.js uses (path.join(__dirname, 'discipline-modes.json')), so this
+// check and the runtime always read the same file even from a scaffolded instance
+// whose repo root is somewhere else entirely (ADR 0108).
+const REGISTRY_REL = 'scripts/gds/discipline-modes.json';
+
+// ~4 chars/token for markdown prose, the estimator checkClaudeMdBudget uses.
+const estTokens = (n) => Math.round(n / 4);
+
+// Ratcheted just above the packs as authored by task 1002990 (engineer 12,223,
+// ideator 10,218, artist 6,982 chars). Lower both as pack detail relocates to
+// ADRs and recipes — the same ratchet contract ROOT_CHAR_HARD_MAX carries.
+const PACK_CHAR_HARD_MAX = 16000; // ~4K tokens — a role pack must never balloon past this.
+const PACK_CHAR_TARGET = 13000;   // ~3.25K tokens — aspirational.
+
+function checkRolePacks(fsImpl = fs) {
+  const violations = [];
+  const warnings = [];
+  const abs = path.join(CORE_ROOT, REGISTRY_REL);
+
+  let modes;
+  try {
+    modes = (JSON.parse(fsImpl.readFileSync(abs, 'utf8')) || {}).modes || {};
+  } catch (e) {
+    // Unlike claim.js this does NOT fail open. An unreadable registry is the one
+    // state that makes every other assertion here vacuous, so it is the failure.
+    return {
+      name: 'role registry packs resolve + fit their budget',
+      ok: false,
+      hardFail: true,
+      violations: [`${REGISTRY_REL} could not be read or parsed (${e && e.message}) — claim.js reads this file on every claim and fails open, so a broken registry is silent at runtime and can only be caught here.`],
+      warnings: [],
+      note: 'the role registry could not be read.',
+    };
+  }
+
+  const entries = Object.entries(modes);
+  let packCount = 0;
+  const sizes = [];
+
+  for (const [discipline, mode] of entries) {
+    if (!mode || typeof mode !== 'object') {
+      violations.push(`role registry entry '${discipline}' is not an object — every entry must carry a directive plus a pack or a skill.`);
+      continue;
+    }
+    // An entry with neither pointer routes a claim nowhere: claim.js prints the
+    // label and the session is left to guess its own playbook.
+    if (!mode.pack && !mode.skill) {
+      violations.push(`role registry entry '${discipline}' names neither a 'pack' (docs/packs/<craft>.md) nor a 'skill' — a claim of this discipline would be routed to no playbook at all.`);
+    }
+    if (!mode.pack) continue;
+
+    packCount += 1;
+    const packAbs = path.join(CORE_ROOT, mode.pack);
+    if (!fsImpl.existsSync(packAbs)) {
+      violations.push(`role registry entry '${discipline}' points at '${mode.pack}', which is not in the tree — claim.js would print the path and the session would find nothing there.`);
+      continue;
+    }
+    let text = '';
+    try {
+      text = fsImpl.readFileSync(packAbs, 'utf8');
+    } catch (e) {
+      violations.push(`role registry entry '${discipline}' points at '${mode.pack}', which exists but could not be read (${e && e.message}).`);
+      continue;
+    }
+    const chars = text.length;
+    sizes.push(`${discipline} ${chars}`);
+    if (chars > PACK_CHAR_HARD_MAX) {
+      violations.push(`${mode.pack} is ${chars} chars (~${estTokens(chars)} tokens) — over the ${PACK_CHAR_HARD_MAX}-char (~${estTokens(PACK_CHAR_HARD_MAX)}-token) hard ceiling. A pack loads in full for every session of its craft; relocate detail to an ADR or a recipe (ADR 0061).`);
+    } else if (chars > PACK_CHAR_TARGET) {
+      warnings.push(`${mode.pack} is ${chars} chars (~${estTokens(chars)} tokens) — over the ~${PACK_CHAR_TARGET}-char (~${estTokens(PACK_CHAR_TARGET)}-token) target. Trim prose, then lower PACK_CHAR_TARGET.`);
+    }
+  }
+
+  // The split's own shape, asserted so a later edit cannot quietly drop a craft
+  // back into the kernel: three core packs, and Governor deliberately absent
+  // (criterion wa6-kernel-and-packs — "three packs, not four, until the owner decides").
+  if (packCount < 3) {
+    violations.push(`only ${packCount} craft(s) name a pack — the split is one kernel plus three packs (Engineer, Artist, Ideator). A craft with no pack has nowhere to keep what the role-neutral kernel does not.`);
+  }
+
+  return {
+    name: 'role registry packs resolve + fit their budget',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings,
+    note: `${entries.length} registry entr(ies), ${packCount} with a pack (${sizes.join(', ') || 'none'} chars) — ≤ ${PACK_CHAR_HARD_MAX} chars each, target ~${PACK_CHAR_TARGET}. A pack path that resolves to nothing is silent at claim time, so CI is the only gate.`,
+  };
+}
+
+module.exports = { checkRolePacks, PACK_CHAR_HARD_MAX, PACK_CHAR_TARGET, REGISTRY_REL };

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.636'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.638'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/edit_hints.mjs

@@ -25,7 +25,7 @@ test('each generator input maps to its generator; unrelated paths map to nothing
     ['modules/status-ui/public/index.html', 'copy-inventory.js'],
     ['src/bongos/auth.js', 'gen-repo-map.js'],
     ['modules/lifecycle/routes/claims.js', 'gen-api-docs.js'],
-    ['.claude/skills/dev/SKILL.md', 'gen-file-map.js'],
+    ['.claude/skills/status/SKILL.md', 'gen-file-map.js'],
     ['docs/session-logs/2026-09-03-x.md', 'gen-session-index.js'],
     ['docs/adr/0236-something.md', 'fitness.js'],
   ];

package/tests/fitness.mjs

@@ -57,6 +57,102 @@ test('CLAUDE.md char budget is ratcheted and ordered (target < ceiling, live fil
   assert.equal(r.hardFail, false, 'the live CLAUDE.md must be under the char ceiling (ratchet locked in)');
 });
 
+// --- the role packs (task 1002990 / ADR 0274) --------------------------------
+//
+// This guard is the ONLY place a broken pack path can surface: claim.js reads the
+// role registry fail-open so it can never break a granted claim, which means an
+// entry pointing at a missing file degrades to silence — the craft's label prints
+// and its playbook never loads. The ADR rests the whole hard-fail argument on that,
+// so an untested guard would undermine its own rationale. Hence both legs, the same
+// pair every sibling guard here carries: the live tree is clean, AND the check
+// actually catches the failure rather than being a no-op.
+const rolePacks = require(path.join(ROOT, 'scripts', 'gds', 'role-pack-guard.js'));
+
+test('role packs: the live registry resolves and every pack is under budget', () => {
+  const r = rolePacks.checkRolePacks();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+});
+
+test('role pack budget is ratcheted and ordered (target < ceiling)', () => {
+  assert.ok(rolePacks.PACK_CHAR_TARGET < rolePacks.PACK_CHAR_HARD_MAX, 'target must sit below the hard ceiling');
+});
+
+test('role pack guard actually CATCHES a missing pack, a pointerless entry, and a short roster (not a no-op)', () => {
+  const real = fs;
+  const withRegistry = (modes) => ({
+    readFileSync: (p, e) => (String(p).includes('discipline-modes.json') ? JSON.stringify({ modes }) : real.readFileSync(p, e)),
+    existsSync: (p) => (String(p).includes('__gone__') ? false : real.existsSync(p)),
+  });
+
+  // (1) the silent runtime failure: a pack path that resolves to nothing.
+  const missing = rolePacks.checkRolePacks(withRegistry({
+    engineer: { pack: 'docs/packs/__gone__.md', directive: 'x' },
+    artist: { pack: 'docs/packs/artist.md', directive: 'x' },
+    ideator: { pack: 'docs/packs/ideator.md', directive: 'x' },
+  }));
+  assert.equal(missing.hardFail, true, 'a pack that is not in the tree must hard-fail');
+  assert.ok(missing.violations.some((v) => /__gone__/.test(v) && /not in the tree/.test(v)), 'the violation must name the unresolvable path');
+
+  // (2) an entry routing a claim to no playbook at all.
+  const pointerless = rolePacks.checkRolePacks(withRegistry({
+    engineer: { pack: 'docs/packs/engineer.md', directive: 'x' },
+    artist: { pack: 'docs/packs/artist.md', directive: 'x' },
+    ideator: { pack: 'docs/packs/ideator.md', directive: 'x' },
+    ui: { directive: 'x' },
+  }));
+  assert.equal(pointerless.hardFail, true, 'an entry with neither pack nor skill must hard-fail');
+  assert.ok(pointerless.violations.some((v) => /'ui'/.test(v) && /neither/.test(v)));
+
+  // (3) a craft quietly dropped back into the kernel — the split's own shape.
+  const short = rolePacks.checkRolePacks(withRegistry({
+    engineer: { pack: 'docs/packs/engineer.md', directive: 'x' },
+    artist: { pack: 'docs/packs/artist.md', directive: 'x' },
+    ideator: { skill: 'ideate', directive: 'x' },
+  }));
+  assert.equal(short.hardFail, true, 'fewer than three packs must hard-fail');
+  assert.ok(short.violations.some((v) => /only 2 craft/.test(v)));
+
+  // (4) an over-budget pack — the "CI budgets each pack" half of the criterion.
+  const fat = rolePacks.checkRolePacks({
+    readFileSync: (p, e) => {
+      if (String(p).includes('discipline-modes.json')) {
+        return JSON.stringify({ modes: {
+          engineer: { pack: 'docs/packs/engineer.md', directive: 'x' },
+          artist: { pack: 'docs/packs/artist.md', directive: 'x' },
+          ideator: { pack: 'docs/packs/ideator.md', directive: 'x' },
+        } });
+      }
+      return 'x'.repeat(rolePacks.PACK_CHAR_HARD_MAX + 1);
+    },
+    existsSync: () => true,
+  });
+  assert.equal(fat.hardFail, true, 'a pack over the char ceiling must hard-fail');
+  assert.ok(fat.violations.some((v) => /hard ceiling/.test(v)));
+
+  // …and the guard is not simply always-red: the real tree passes (leg 1 above),
+  // and an unreadable registry is itself the failure rather than a free pass.
+  const unreadable = rolePacks.checkRolePacks({
+    readFileSync: () => { throw new Error('boom'); },
+    existsSync: () => true,
+  });
+  assert.equal(unreadable.hardFail, true, 'an unreadable registry must fail, not fail open like claim.js');
+});
+
+// The ship card mirrors the registry by hand — it cannot require a core script
+// across the module boundary, which is why claim.js and ship-card.js have always
+// carried the map twice (task 1003487 was that duplication drifting). A test is the
+// shared source they cannot have: rename a pack and this fails instead of the hall
+// shipping a button that opens nothing.
+test('ship-card routing agrees with the role registry, entry for entry', () => {
+  const registry = JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'discipline-modes.json'), 'utf8')).modes;
+  const card = require(path.join(ROOT, 'modules', 'lifecycle', 'ship-card.js'));
+  for (const [discipline, mode] of Object.entries(registry)) {
+    const cmd = card.buildCardModel({ stage: 'claimed', taskId: 1, discipline, brand: { currency: 'credits' } }).action.cmd;
+    if (mode.pack) assert.ok(cmd.includes(mode.pack), `${discipline}: card says "${cmd}" but the registry names ${mode.pack}`);
+    else if (mode.skill) assert.equal(cmd, `/${mode.skill}`, `${discipline}: card and registry disagree on the skill`);
+  }
+});
+
 test('nested CLAUDE.md present for every high-traffic dir', () => {
   const r = fitness.checkNestedDocsPresent();
   assert.equal(r.hardFail, false, r.violations.join('\n'));

package/tests/government_protected_surfaces.mjs

@@ -172,14 +172,36 @@ test('every glob added since R101 carries a documented reason', () => {
   }
 });
 
-test('every surface floors at metic — the ADR 0043 floor, unchanged by the move', () => {
+// Metic is a FLOOR, not a fixed value (task 1003191). Pinning every surface to
+// exactly 'metic' made the registry's own contract untestable and, worse,
+// illegal: governance owns this data and raising one surface to 'archon' is a
+// policy edit the enforcers are supposed to honour. What must never happen is a
+// surface dropping BELOW Metic — that is ADR 0043 being weakened by a data edit.
+// So: no surface under Metic, and the derived minimum stays exactly Metic.
+test('no surface floors below Metic — the ADR 0043 floor (a raise above it is legal policy)', () => {
   for (const s of registry.SURFACES) {
-    assert.equal(s.floor, 'metic', `${s.glob} must keep the Metic floor`);
+    assert.ok(ppc.RANK_TIER[s.floor] >= ppc.RANK_TIER.metic,
+      `${s.glob} floors at '${s.floor}', below the Metic floor ADR 0043 sets. Governance may RAISE a floor; it may never lower one under Metic.`);
   }
-  assert.equal(registry.FLOOR, 'metic');
+  assert.equal(registry.FLOOR, 'metic', 'the lowest declared floor is the Metic floor itself');
   assert.equal(ppc.MIN_TIER, ppc.RANK_TIER.metic, 'the kernel floor must DERIVE to metic');
 });
 
+test('a floor raise flows through to the enforcers, not just the registry', () => {
+  // The registry promises a re-mapped floor reaches the substrate. Each layer
+  // must read the hit's OWN floor: the cooperative ones through
+  // checkPermissionPaths, the authoritative post-push audit through its per-hit
+  // comparison (task 1003191 — it used to test the global minimum and silently
+  // downgraded every raise).
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'main-audit.js'), 'utf8');
+  assert.ok(!/\bppc\.isBelowFloor\s*\(/.test(src),
+    'main-audit.js must not decide floors with isBelowFloor — that tests the registry '
+    + 'GLOBAL MINIMUM, so a governance floor raise is silently downgraded in the one '
+    + 'layer that catches a raw `git push origin main` (task 1003191).');
+  assert.ok(/RANK_TIER\[h\.floor\]/.test(src),
+    'main-audit.js must compare each hit against its own registry floor');
+});
+
 // ---------- the system-permission mapping flows from the registry ----------
 
 test('every entry maps to a permission the catalog defines as system:true', () => {

package/tests/idea_ideate_full.mjs

@@ -1,9 +1,15 @@
 // tests/idea_ideate_full.mjs
 //
-// task 1002931 (BV1.R155, goal 1000062) — /ideate authors a Full Idea
-// conversationally.
+// task 1002931 (BV1.R155, goal 1000062) — the ideator's playbook authors a Full
+// Idea conversationally.
 //
-// A skill is a prompt, so the thing to pin is the PROMPT'S CONTRACT. Two
+// WHERE THAT PLAYBOOK LIVES (task 1002990). It used to be the /ideate skill. The
+// kernel/pack split moved it into the Ideator role pack and deleted the skill, so
+// this suite now reads docs/packs/ideator.md. Every contract below is unchanged —
+// the file moved, the promises did not — and pointing the suite at the new home is
+// what stops the split from silently dropping the guard with the skill.
+//
+// A pack is a prompt, so the thing to pin is the PROMPT'S CONTRACT. Two
 // done-when clauses, and both are checkable:
 //
 //   1. "indistinguishable in the database from one authored in the hall" — so the
@@ -30,7 +36,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const SKILL = fs.readFileSync(path.join(ROOT, '.claude/skills/ideate/SKILL.md'), 'utf8');
+const SKILL = fs.readFileSync(path.join(ROOT, 'docs/packs/ideator.md'), 'utf8');
 // Prose assertions run against a WHITESPACE-NORMALISED copy. Markdown is hard-
 // wrapped, so any phrase long enough to be worth asserting will eventually
 // straddle a newline — and a regex that does not allow for that fails on a

package/tests/main_audit.mjs

@@ -134,6 +134,101 @@ t('#863-followup (finding #6): a sub-Metic author NAME still resolves and BLOCKS
   assert.equal(r.findings[0].rank, 'thetes');
 });
 
+// -- per-hit registry floors (task 1003191) --------------------------------
+//
+// The authoritative layer used to decide floors with ppc.isBelowFloor(rank),
+// which tests the registry's GLOBAL MINIMUM floor. Every live surface floors at
+// 'metic', so that was indistinguishable from a per-hit comparison — until
+// governance RAISES one surface, at which point layer 3 silently downgraded the
+// raise back to the minimum while the pre-push hook and the grader (both on
+// checkPermissionPaths, which compares per-hit) still blocked it. Layer 3 is the
+// only one that catches a raw `git push origin main`, so the authoritative net
+// was the loosest of the three.
+//
+// A uniform-floor fixture cannot tell the two implementations apart. This is the
+// shape that can: one surface raised above the minimum, one left at it.
+const ppc = require('../src/bongos/permission-path-check.js');
+
+function mixedFloorRegistry() {
+  const SURFACES = [
+    { glob: 'infra/', floor: 'archon' },     // RAISED above the global minimum
+    { glob: 'src/bongos/db.js', floor: 'metic' }, // still at the minimum
+  ];
+  return {
+    RANK_TIER: ppc.RANK_TIER,
+    tierOf: (rank) => ppc.RANK_TIER[rank] ?? null,
+    matchProtected: (files) => (files || [])
+      .map((f) => {
+        const s = SURFACES.find((x) => (x.glob.endsWith('/') ? f.startsWith(x.glob) : f === x.glob));
+        return s ? { file: f, glob: s.glob, floor: s.floor, permission: 'path.protected.modify' } : null;
+      })
+      .filter(Boolean),
+  };
+}
+
+t('a RAISED surface floor is enforced: Metic touching an archon-floored path → BLOCKER', () => {
+  const r = analyzeCommits([{
+    sha: 'r01', subject: 'touch the substrate', authorName: 'SomeMetic', authorEmail: 'm@x',
+    isMerge: false, files: ['infra/deploy.sh'],
+  }], RANKS, { registry: mixedFloorRegistry() });
+  assert.equal(r.hardFail, true, 'a governance floor raise must reach the authoritative layer');
+  assert.equal(r.findings.length, 1);
+  assert.deepEqual(r.findings[0].floors, ['archon']);
+  assert.match(r.findings[0].summary, /Archon\+ builder/);
+});
+
+t('the finding reports only the paths the author actually fails to clear', () => {
+  // db.js floors at the minimum this Metic DOES clear; infra/ does not. A
+  // per-hit comparison names the second and stays silent about the first.
+  const r = analyzeCommits([{
+    sha: 'r02', subject: 'mixed', authorName: 'SomeMetic', authorEmail: 'm@x',
+    isMerge: false, files: ['src/bongos/db.js', 'infra/deploy.sh'],
+  }], RANKS, { registry: mixedFloorRegistry() });
+  assert.equal(r.hardFail, true);
+  assert.deepEqual(r.findings[0].files, ['infra/deploy.sh']);
+  assert.equal(r.findings[0].summary.includes('src/bongos/db.js'), false,
+    'a path the author clears must not be reported as a violation');
+});
+
+t('a raised floor does not over-block: Archon touching the same path → no finding', () => {
+  const r = analyzeCommits([{
+    sha: 'r03', subject: 'x', authorName: 'somearchon', authorEmail: 'l@x',
+    isMerge: false, files: ['infra/deploy.sh'],
+  }], RANKS, { registry: mixedFloorRegistry() });
+  assert.equal(r.hardFail, false);
+  assert.equal(r.findings.length, 0);
+});
+
+t('a Metic still clears a surface left at the minimum floor', () => {
+  const r = analyzeCommits([{
+    sha: 'r04', subject: 'x', authorName: 'SomeMetic', authorEmail: 'm@x',
+    isMerge: false, files: ['src/bongos/db.js'],
+  }], RANKS, { registry: mixedFloorRegistry() });
+  assert.equal(r.hardFail, false);
+  assert.equal(r.findings.length, 0);
+});
+
+t('an unresolved author is told the floor that actually governs, not a hardcoded Metic', () => {
+  const r = analyzeCommits([{
+    sha: 'r05', subject: 'x', authorName: 'Nobody Known', authorEmail: 'n@x',
+    isMerge: false, files: ['infra/deploy.sh'],
+  }], RANKS, { registry: mixedFloorRegistry() });
+  assert.equal(r.findings.length, 1);
+  assert.equal(r.findings[0].severity, 'review');
+  assert.match(r.findings[0].summary, /Archon\+ work/);
+});
+
+t('the default registry is the real one — no injection needed in production', () => {
+  // The seam must not change what the CLI does: infra/ floors at metic today,
+  // so a Metic touching it is legal on the live registry.
+  const r = analyzeCommits([{
+    sha: 'r06', subject: 'x', authorName: 'SomeMetic', authorEmail: 'm@x',
+    isMerge: false, files: ['infra/deploy.sh'],
+  }], RANKS);
+  assert.equal(r.hardFail, false);
+  assert.equal(ppc.floorFor('infra/deploy.sh'), 'metic');
+});
+
 // -- the default range window (task 1002566) -------------------------------
 //
 // Everything above tests the pure ANALYZER. Nothing tested what FEEDS it, which

package/tests/module-scope-map.mjs

@@ -231,9 +231,10 @@ test('methodology joined the roster (task 1002989) — the instruction surfaces
   const covers = (touch) => gsc.scopeSubset(['methodology'], [touch]).ok;
   for (const touch of [
     'CLAUDE.md',                              // the kernel half of the split (1002990)
-    '.claude/skills/dev/SKILL.md',            // one of the three discipline skills it deletes
-    '.claude/skills/ideate/SKILL.md',
-    '.claude/skills/paint/SKILL.md',
+    'docs/packs/engineer.md',                 // the three role packs the split authored (1002990)
+    'docs/packs/artist.md',
+    'docs/packs/ideator.md',
+    '.claude/skills/status/SKILL.md',         // the skills floor no module claims
     '.claude/rules/content-charter.md',       // pre-carved for task 1003687
     'docs/adr/0264-the-ten-working-areas.md', // the ADR library
     'docs/handoff-template.md',

package/tests/publish_manifest.mjs

@@ -77,7 +77,8 @@ const PUBLISH = [
   'docs/handoff-template.md',              // portable session-handoff format
   'docs/project-context.template.md',      // the neutral scaffold (NOT the OTB-filled one)
   'config/design-tokens.schema.json',      // generic contract schema
-  '.claude/skills/dev/SKILL.md',
+  '.claude/skills/status/SKILL.md',
+  'docs/packs/engineer.md',                // the role packs the kernel/pack split moved the methodology into (task 1002990)
   'package.json',
   'Dockerfile',
   '.env.local.example',

package/tests/ship_card.mjs

@@ -201,14 +201,28 @@ test('claimed: neutral tone, scope rows, discipline action, brief in dropdown',
   assert.equal(row(m, 'Estimate'), '~2h');
   assert.equal(row(m, 'Touches'), '4 files');
   assert.equal(row(m, 'Value'), undefined); // no value summary pre-work
-  assert.equal(m.action.cmd, '/dev');
+  assert.equal(m.action.cmd, 'Read docs/packs/engineer.md and start the work');
   const html = card.renderCardHtml(m);
   assert.match(html, /Extend the card to every stage\./); // brief in dropdown
 });
 
-test('claimed action routes by discipline', () => {
-  assert.equal(card.buildCardModel({ stage: 'claimed', taskId: 1, discipline: 'artist', brand: BRAND }).action.cmd, '/paint');
-  assert.equal(card.buildCardModel({ stage: 'claimed', taskId: 1, discipline: 'ideator', brand: BRAND }).action.cmd, '/ideate');
+// The card must open the SAME playbook the claim just named, or it reintroduces the
+// 1003487 divergence. Since task 1002990 the three core crafts have no slash command
+// left to open — /dev, /paint and /ideate were deleted with the kernel/pack split —
+// so the card points at the pack file; a module-contributed discipline still routes
+// to its skill. A '/' prefix on a core craft here means a dead command in the hall.
+test('claimed action routes by discipline — core crafts to their pack, modules to their skill', () => {
+  const cmdFor = (discipline) => card.buildCardModel({ stage: 'claimed', taskId: 1, discipline, brand: BRAND }).action.cmd;
+  assert.equal(cmdFor('artist'), 'Read docs/packs/artist.md and start the work');
+  assert.equal(cmdFor('ideator'), 'Read docs/packs/ideator.md and start the work');
+  assert.equal(cmdFor('ui'), '/design');
+  // An unknown or unset discipline falls back to the Engineer pack, exactly as it
+  // used to fall back to /dev — engineering is the project's default loop.
+  assert.equal(cmdFor('unclassified'), 'Read docs/packs/engineer.md and start the work');
+  assert.equal(cmdFor(undefined), 'Read docs/packs/engineer.md and start the work');
+  for (const d of ['engineer', 'artist', 'ideator']) {
+    assert.ok(!cmdFor(d).startsWith('/'), `${d} must not be routed to a slash command — /dev, /paint and /ideate no longer exist`);
+  }
 });
 
 // ---- review ----

package/.claude/skills/dev/SKILL.md

@@ -1,49 +0,0 @@
----
-name: dev
-description: The engineering session — the operating playbook for engineer-discipline work (code, infra, Bongos itself, bugs, performance). Triggers when the user says "/dev", "let's build this", "work on this bug/feature", "start a dev session", or when a claimed task's discipline routes here (claim.js prints a directive to invoke /dev for engineer tasks). This is the project's DEFAULT build loop, written down — the baseline the other discipline modes (/ideate, /paint) invert from.
----
-
-You are running an **engineering session** for Example. Unlike `/ideate` (which flips *who drives*) and `/paint` (which flips *the medium*), this skill introduces no new dynamic — engineering **is** the default text-and-code loop. Its job is to make the standard explicit and keep you on it. Read it before working; lean on it most when you're new here or running autonomously.
-
-## The loop: understand → scoped change → verify → ship
-
-1. **You hold a claim — keep the work inside it.** Everything you change should serve the claimed task. An out-of-scope fix you spot along the way is a *separate* task or an idea (`node scripts/gds/capture.js`), not a quiet addition to this diff. Scope creep is the most common way an engineering session goes wrong.
-
-2. **Understand before you edit.** Read the code you're about to change and the layer around it first:
-   - The nested `CLAUDE.md` in the directory you're working in (loads on demand — it has the gotchas).
-   - `docs/repo-map.md` (the symbol skeleton) to navigate without reading every file — it's gitignored + regenerated at deploy/box-fetch (ADR 0110), so if it's absent in your tree run `node scripts/gds/gen-repo-map.js`. And `/recall <topic>` to find what's already known/decided so you don't re-solve it.
-   - Match the surrounding code: its naming, its idioms, its comment density. Code you write should read like the code already there.
-
-3. **Make the smallest correct change.** Prefer the change that solves the task and nothing more. Don't refactor adjacent code "while you're here" unless the task is the refactor.
-
-4. **Verify it — never report done on faith.** This is the step engineers most often skip:
-   - Run the smoke tests (`/builder-ship` runs them, but run them yourself while iterating).
-   - If the change is observable in the running app, use the **preview / verification workflow** (preview_start → reload → check console/snapshot → screenshot proof) rather than asking a human to check manually. Verify, then share the proof.
-   - If it's not browser-observable (a different runtime, types, tooling), say so and verify the way that *does* exercise it.
-
-5. **Ship with a real handoff.** `/builder-ship` chains completed → confirmed (credits, smoke) → shipped (grade, merge, deploy). Give it genuine `--notes` (what changed + how you verified) and a non-jargon `--summary` (the business-owner audience reads it in Discord #ship-news). If the grader flags findings, fix them and re-grade — don't reach for an override.
-
-## Supporting discipline (the things that keep the ledger honest)
-
-- **Every change is backed by the claimed task** — no admin/tiny-fix/scaffolding loophole (CLAUDE.md §8). Direct DB writes are work too.
-- **Non-obvious decision → an ADR** in `docs/adr/`, linked from the shipping task's notes.
-- **A discovery that took >10 min to diagnose → a learning** (`node scripts/gds/learning-capture.js`); a multi-page how-to → a recipe under `docs/recipes/`.
-- **Blocked on something only Lars can decide/provide → a blocker** (`POST /api/gds/blockers`), attached to the task.
-- **Touched anything the onboarding diagrams / repo-map describe** → they regenerate on deploy; never hand-edit generated artifacts — edit the source/template and run the generator (`gen-diagrams.js`, `gen-repo-map.js`).
-- **Trust boundary:** a sub-Metic builder (Xenos/Thetes) stays out of the permission/pipeline core (rank/authz machinery, the ship/grade/deploy pipeline, `migrations/`, `infra/`, trust-boundary docs) and never runs raw `git push origin main` / `ssh` / `~/deploy.sh` — landing code is Bongos's job (`/builder-ship`). Metic+ is unaffected.
-
-## Step 0 — detect the mode
-
-**Is a human present?**
-
-- **Interactive** (someone is here to decide): work collaboratively — propose the approach for anything non-obvious, let the human steer the design calls, then execute. You can think out loud; engineers are fine with text.
-- **Autonomous / bypass-permissions** (no human will answer): tighten up.
-  - Be **conservative** — the smallest correct change, the lowest-risk path. No human is here to catch a wandering edit.
-  - **Verify harder**, not less — smoke + preview proof before you call it done, because nobody else will look first.
-  - **Don't invent scope or wander** into adjacent work, refactors, or "improvements" the task didn't ask for. If you spot them, capture them as ideas/tasks and move on.
-  - If the task is **ambiguous or you hit a real blocker**, leave a clear note (blocker / release with a reason) rather than guessing at something large and irreversible.
-
-## How sessions reach this skill
-
-- **Standalone:** invoke `/dev` directly when you want the engineering checklist in front of you.
-- **From a claim:** when a builder claims an `engineer`-discipline task, `claim.js` reads `scripts/gds/discipline-modes.json` and notes that `/dev` is this task's playbook. Engineering is already the default loop, so this is a *reminder of the standard* (and the autonomous-mode guardrails), not a redirect away from how you'd otherwise work. All three disciplines route uniformly through the same map.