@bongos/core 1.19.714 → 1.19.724

package/modules/ui-design/skills/README.md

@@ -1,6 +1,6 @@
 # `modules/ui-design/skills/` — the vetted UI skills: the policy, the roster, and why the roster is what it is
 
-The home for third-party design skills the `ui-design` module ships to every builder on every instance where the module is on ([task 1003321](https://cloudbongos.com/builders#/task/1003321), [ADR 0198](../../../docs/adr/<redacted>.md)). A skill that lands here is **materialised** into a builder's `.claude/skills/<name>/` by `scripts/gds/claude-materialize.js` (step 1b) on `bongos init` / `bongos upgrade`, exactly like a core skill, and withdrawn when the instance disables the module.
+The home for third-party design skills the `ui-design` module ships to every builder on every instance where the module is on ([task 1003321](https://cloudbongos.com/builders#/task/1003321), [ADR 0198](../../../docs/adr/0198-third-party-skill-vendoring-policy.md)). A skill that lands here is **materialised** into a builder's `.claude/skills/<name>/` by `scripts/gds/claude-materialize.js` (step 1b) on `bongos init` / `bongos upgrade`, exactly like a core skill, and withdrawn when the instance disables the module.
 
 ## The policy (enforced by `tests/ui_design_skills.mjs`, declared in [`policy.json`](policy.json))
 
@@ -20,14 +20,14 @@ Two origins were scanned for the set scoped with the owner (impeccable; the elev
 
 | Skill (in-house name) | Upstream | Licence | Verdict | Landing |
 |---|---|---|---|---|
-| `impeccable` | `pbakaus/impeccable` @ `<redacted>` (skill v4.1.x) | Apache-2.0 | **dangerous** — floor: 3 critical (a `bypassPermissions` marker in the skill's own live copy-edit agent; an instruction-override phrase in a test fixture; a same-file credential-store + http-client co-occurrence in a test), 19 high (shipped PostToolUse + Stop hooks, credential-store references), 107 medium, 147 low; panel: hooks written into five harness configs (globally on a global install), a child agent spawned with permissions bypassed from a loopback HTTP route, an autonomy directive that tells the agent to disregard its system prompt, a live-server token embedded in page source, an unverified remote bundle download | rebuild spec → [task 1003326](https://cloudbongos.com/builders#/task/1003326) → rebuilt in-house as `impeccable/` ([ADR 0221](../../../docs/adr/<redacted>.md)) |
+| `impeccable` | `pbakaus/impeccable` @ `<redacted>` (skill v4.1.x) | Apache-2.0 | **dangerous** — floor: 3 critical (a `bypassPermissions` marker in the skill's own live copy-edit agent; an instruction-override phrase in a test fixture; a same-file credential-store + http-client co-occurrence in a test), 19 high (shipped PostToolUse + Stop hooks, credential-store references), 107 medium, 147 low; panel: hooks written into five harness configs (globally on a global install), a child agent spawned with permissions bypassed from a loopback HTTP route, an autonomy directive that tells the agent to disregard its system prompt, a live-server token embedded in page source, an unverified remote bundle download | rebuild spec → [task 1003326](https://cloudbongos.com/builders#/task/1003326) → rebuilt in-house as `impeccable/` ([ADR 0221](../../../docs/adr/0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md)) |
 | `design-taste-frontend`, `design-taste-frontend-v1`, `high-end-visual-design`, `minimalist-ui`, `industrial-brutalist-ui`, `redesign-existing-projects`, `gpt-taste`, `stitch-design-taste`, `image-to-code`, `imagegen-frontend-web`, `imagegen-frontend-mobile`, `brandkit` | `Leonxlnx/taste-skill` @ `<redacted>` | MIT | **dangerous** — floor: 1 critical (an injection-phrase hit at `skills/taste-skill/SKILL.md:892`, which the panel identifies as a filename placeholder; the floor is untouchable by design); panel: caution (1 medium: the only documented install path runs an unpinned third-party `npx` CLI; 21 low: mandated invocation of any available image-generation tool, unbounded image counts, remote assets and scripts in generated pages, an auto-loaded cross-agent instruction file) | rebuild spec → [task 1003325](https://cloudbongos.com/builders#/task/1003325) (the taste core, ADR 0220) and [task 1003328](https://cloudbongos.com/builders#/task/1003328) (the image family, ADR 0222) → rebuilt in-house |
 
 The eleven taste skills are single-file prose; the floor's one critical is a false positive in the human sense and a true positive in the scanner's — and the rule that makes the scanner worth having is that a session does not get to tell the difference. Vendoring any of them anyway is an **owner override recorded in an ADR**, not a judgement a task makes.
 
 ## The in-house rebuilds (2026-09-01)
 
-A rebuild spec becomes a **first-party skill** at `<name>/` — no `vendor/` segment, so the ratchets count it; no `PROVENANCE.md` or `LICENSE`, because an in-house skill claims no upstream; the same PLATFORM PREAMBLE first after the frontmatter, byte-identical; then a **`## Rebuilt from`** section naming the origin the *spec* was derived from (documentation only), the scan verdict, the spec task, the statement that no upstream bytes were consulted or copied, and what changed in translation ([ADR 0220](../../../docs/adr/<redacted>.md)). Declared in `module.json` like any other; `claude-materialize.js` step 1b lands it through its own-dir branch, which no sidecar gate touches. `tests/ui_design_skills.mjs` pins all of it. A rebuild whose method is a family of sub-commands ships as **one** skill dir with a `reference/<sub-command>.md` playbook beside the `SKILL.md`, exactly one loaded per request; the preamble is pinned once, in the `SKILL.md`, and governs every playbook ([ADR 0221](../../../docs/adr/<redacted>.md)). A rebuild whose upstream shipped a **look** carries a composition grammar and no colours of its own — the palette is the instance's pack and the texture is a named entry in [`../styles/`](../styles/README.md) ([ADR 0230](../../../docs/adr/<redacted>.md)).
+A rebuild spec becomes a **first-party skill** at `<name>/` — no `vendor/` segment, so the ratchets count it; no `PROVENANCE.md` or `LICENSE`, because an in-house skill claims no upstream; the same PLATFORM PREAMBLE first after the frontmatter, byte-identical; then a **`## Rebuilt from`** section naming the origin the *spec* was derived from (documentation only), the scan verdict, the spec task, the statement that no upstream bytes were consulted or copied, and what changed in translation ([ADR 0220](../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md)). Declared in `module.json` like any other; `claude-materialize.js` step 1b lands it through its own-dir branch, which no sidecar gate touches. `tests/ui_design_skills.mjs` pins all of it. A rebuild whose method is a family of sub-commands ships as **one** skill dir with a `reference/<sub-command>.md` playbook beside the `SKILL.md`, exactly one loaded per request; the preamble is pinned once, in the `SKILL.md`, and governs every playbook ([ADR 0221](../../../docs/adr/0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md)). A rebuild whose upstream shipped a **look** carries a composition grammar and no colours of its own — the palette is the instance's pack and the texture is a named entry in [`../styles/`](../styles/README.md) ([ADR 0230](../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md)).
 
 | Skill | Rebuilt from (spec) | Task | What it is |
 |---|---|---|---|
@@ -45,17 +45,17 @@ A rebuild spec becomes a **first-party skill** at `<name>/` — no `vendor/` seg
 | `imagegen-frontend-mobile` | `Leonxlnx/taste-skill` @ `<redacted>` | [task 1003328](https://cloudbongos.com/builders#/task/1003328) | portrait plates for the 390 and 320 compositions, clear of the regions a phone reserves, the first view held to one focal point, a scrim under text over a plate; a screen is the states file rendered by the kit; no phone mockups, no flows of screens; native declines |
 | `brandkit` | `Leonxlnx/taste-skill` @ `<redacted>` | [task 1003328](https://cloudbongos.com/builders#/task/1003328) | the identity system with the strategy inferred first and the logo standard kept: the mark drawn as SVG, the colour system as the pack, the type specimen as the faces, the applications as the kit's renders, the image direction as a hero-object family, the board as a contact sheet; never a generated logo, board or mockup |
 
-What every rebuild does with the upstream's opinions, in the same words: the palette is the pack and a variant is a look from [`../styles/`](../styles/README.md); the design system is the instance's `DESIGN.md`; images are hero plates and hero objects by token and never a step; every motion rule lives inside the Kill Switch (springs, magnetic hover, pointer-tracked borders are named *not available*); the upstream's bans are defaults an instance's `DESIGN.md` overrides; the kit's renders are the pre-flight. The image family (task 1003328, [ADR 0222](../../../docs/adr/<redacted>.md)) carries the one rewrite the upstream never had: images are for text-free hero plates and hero objects only, so a screen is the surface itself, the mark is drawn, the board is a contact sheet, and what ships is the pair (a black-ground JPEG for dark, an alpha WebP cutout for light) with a provenance sidecar beside every file, through the instance's art pipeline key. The four looks (task 1003327, [ADR 0230](../../../docs/adr/<redacted>.md)) carry the other rewrite: a look skill ships structure, rhythm, type roles, component anatomy, motion and bans and **no colours**, so a substrate becomes an archetype that still ships both modes, a prompt-seeded roll becomes a deterministic selection derived from the route, a design document transcribes the world instead of authoring one, and the upstream's seeded placeholder photography is dropped rather than softened. The whole scoped set of thirteen is now rebuilt in-house; nothing from either origin is still waiting on a spec.
+What every rebuild does with the upstream's opinions, in the same words: the palette is the pack and a variant is a look from [`../styles/`](../styles/README.md); the design system is the instance's `DESIGN.md`; images are hero plates and hero objects by token and never a step; every motion rule lives inside the Kill Switch (springs, magnetic hover, pointer-tracked borders are named *not available*); the upstream's bans are defaults an instance's `DESIGN.md` overrides; the kit's renders are the pre-flight. The image family (task 1003328, [ADR 0222](../../../docs/adr/0222-the-image-family-under-the-hero-only-rule.md)) carries the one rewrite the upstream never had: images are for text-free hero plates and hero objects only, so a screen is the surface itself, the mark is drawn, the board is a contact sheet, and what ships is the pair (a black-ground JPEG for dark, an alpha WebP cutout for light) with a provenance sidecar beside every file, through the instance's art pipeline key. The four looks (task 1003327, [ADR 0230](../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md)) carry the other rewrite: a look skill ships structure, rhythm, type roles, component anatomy, motion and bans and **no colours**, so a substrate becomes an archetype that still ships both modes, a prompt-seeded roll becomes a deterministic selection derived from the route, a design document transcribes the world instead of authoring one, and the upstream's seeded placeholder photography is dropped rather than softened. The whole scoped set of thirteen is now rebuilt in-house; nothing from either origin is still waiting on a spec.
 
 ## First-party originals (2026-09-02)
 
-A skill the platform wrote from nothing declares the **other** origin. It lives at `<name>/` like a rebuild, opens with the same PLATFORM PREAMBLE, and carries a **`## First party`** section instead: the task that authored it, the plain statement that it has no upstream, [ADR 0231](../../../docs/adr/<redacted>.md), and **why it exists** — since it has no spec to point at, that sentence is the only provenance a reader gets. `tests/ui_design_skills.mjs` asserts a skill carries **exactly one** of the two sections and branches its pins on which; everything else (the preamble, the frontmatter, no sidecar, no licence text, the style library named, no image mandate, the switch, the kit as the pre-flight) applies to both kinds unchanged. Fabricating a `## Rebuilt from` for an original was rejected: the section exists so a reader can trace provenance, and a fabricated one destroys exactly that.
+A skill the platform wrote from nothing declares the **other** origin. It lives at `<name>/` like a rebuild, opens with the same PLATFORM PREAMBLE, and carries a **`## First party`** section instead: the task that authored it, the plain statement that it has no upstream, [ADR 0231](../../../docs/adr/0231-the-style-session-an-owner-authors-a-look-inside-the-contract.md), and **why it exists** — since it has no spec to point at, that sentence is the only provenance a reader gets. `tests/ui_design_skills.mjs` asserts a skill carries **exactly one** of the two sections and branches its pins on which; everything else (the preamble, the frontmatter, no sidecar, no licence text, the style library named, no image mandate, the switch, the kit as the pre-flight) applies to both kinds unchanged. Fabricating a `## Rebuilt from` for an original was rejected: the section exists so a reader can trace provenance, and a fabricated one destroys exactly that.
 
 | Skill | Origin | Task | What it is |
 |---|---|---|---|
 | `style` | first party (no upstream) | [task 1003475](https://cloudbongos.com/builders#/task/1003475) | the `/style` session: four bounded steps in which an owner authors their own look as a branding pack. SEARCH renders the nearest two library entries before asking two or three questions about feel; CREATE drafts the three files inside the contract, never a fork of a sheet and never a sixteenth token; PROVE retunes the thirteen against `contrast.js`, the styles suite, `check-mock.js` and the renders with a failure-to-fix table so the retune is arithmetic; ADOPT hands the owner the one-step switch, never writes `config/branding.json`, and files the catalogue rows. Its first output is [`../styles/blueprint`](../styles/README.md), the library's first cool look |
 
-**In the core checkout itself**, where these skills are written, Claude Code reads only `.claude/skills/` at the repo root and the materialiser's self-copy guard leaves it empty of module skills. `node scripts/gds/claude-materialize.js --module-skills-only` lands every enabled module's skills there as untracked, self-ignored copies (a generated `.claude/skills/.module-skills.json` manifest and a `.gitignore` beside them; `--clean` removes them; the file map skips them by the manifest) so a builder can invoke them here too ([task 1003330](https://cloudbongos.com/builders#/task/1003330), [ADR 0224](../../../docs/adr/<redacted>.md)). Edit the module's `skills/<name>/`, never the copy, and re-run to refresh.
+**In the core checkout itself**, where these skills are written, Claude Code reads only `.claude/skills/` at the repo root and the materialiser's self-copy guard leaves it empty of module skills. `node scripts/gds/claude-materialize.js --module-skills-only` lands every enabled module's skills there as untracked, self-ignored copies (a generated `.claude/skills/.module-skills.json` manifest and a `.gitignore` beside them; `--clean` removes them; the file map skips them by the manifest) so a builder can invoke them here too ([task 1003330](https://cloudbongos.com/builders#/task/1003330), [ADR 0224](../../../docs/adr/0224-module-skills-reach-the-core-checkout-as-untracked-self-ignored-copies.md)). Edit the module's `skills/<name>/`, never the copy, and re-run to refresh.
 
 **The playwright plugin** (`claude-plugins-official`, an MCP plugin) is the LIVE browser-driving loop, where the kit is the headless one. It is a prerequisite, documented — `claude plugin install playwright@claude-plugins-official` — never vendored.
 

package/modules/ui-design/skills/brandkit/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `brandkit` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the `[brandkit]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `brandkit` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the `[brandkit]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/0222-the-image-family-under-the-hero-only-rule.md).
 
 What changed in translation, on purpose: the upstream delivered **brand identity imagery**: logo systems, nine-panel guideline boards, identity decks and visual-world presentations, all as generated images carrying a brand name, a tagline, labels and interface chips. Under the owner's rule an image with letters in it is not a hero plate, and a mockup of an interface is a screenshot of a screen. So here every panel of the board lands as the thing it depicted: the **mark is drawn** (an inline SVG, the world's one mark, a code asset with a construction comment), the **colour system is the pack** (`config/branding.json`, the fifteen), the **type specimen is the pack's two faces** on a real page, the **applications are the platform's own surfaces** (the front door, the hall, a look's specimen) rendered by the kit, and the **image direction is a hero-object family**: one object in the world's materials, text-free, in pairs with sidecars. The board itself is a **contact sheet** assembled from the kit's shots and the plates, a review artifact rather than a generation. The strategy inference, the logo standard, the five concept methods, the rhythm, the colour discipline and the reference rule survive unchanged.
 

package/modules/ui-design/skills/design-taste-frontend/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `taste-skill` entry, "design-taste-frontend v2"), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**, and the landing shape (the in-house `skills/<name>/` home, this section in place of a `PROVENANCE.md`) is [ADR 0220](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `taste-skill` entry, "design-taste-frontend v2"), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**, and the landing shape (the in-house `skills/<name>/` home, this section in place of a `PROVENANCE.md`) is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md).
 
 What changed in translation, on purpose: the upstream skill mandated image generation as a first step and accepted seeded placeholder photography; here **imagery is hero plates and hero objects only, by token, and never a step**. Its "foundation" step installed a vendor's design-system package; here **the foundation is the instance's world** (`DESIGN.md` and its pack), and the style library is where variants come from. Its motion rules assumed a script-driven animation stack; here **every rule lives inside the Kill Switch** and nothing moves in JavaScript. Its bans (the long dash, decorative labels) are kept as defaults that an instance's own `DESIGN.md` bans override.
 

package/modules/ui-design/skills/design-taste-frontend-v1/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `taste-skill-v1` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**; the landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `taste-skill-v1` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**; the landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md).
 
 What changed in translation, on purpose: the upstream generation was written for a component framework with a motion library; a platform surface here is static markup, one sheet and the instance's transforms, so the stack conventions are restated for that and **every motion rule lives inside the Kill Switch** (the spring, the magnetic hover and the shared-element transition, which need script, are named as not available rather than quietly kept). The typography and colour rules are read **against the instance's pack**: the pack's faces are the faces and the pack's accent is the accent, whatever this skill would have preferred. Imagery follows the owner's rule (hero plates and hero objects only).
 

package/modules/ui-design/skills/gpt-taste/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `gpt-tasteskill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325) — the `[gpt-taste]` requirement group — and this file is its port under [task 1003327](https://cloudbongos.com/builders#/task/1003327); it implements those requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md); what a *look* skill is allowed to be is [ADR 0230](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `gpt-tasteskill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325) — the `[gpt-taste]` requirement group — and this file is its port under [task 1003327](https://cloudbongos.com/builders#/task/1003327); it implements those requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); what a *look* skill is allowed to be is [ADR 0230](../../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md).
 
 What changed in translation, on purpose: the upstream asked the agent to **simulate a random number generator** seeded from the prompt and let the roll pick the design. A roll nobody can reproduce is not a decision, and the same roll on a sibling surface is a coincidence rather than a system — so the selection here is **deterministic and written down**: derived from the surface's own route, recorded in the plan block, and checked against what its siblings already used. Its "type stack" selection is gone; the pack carries two stacks and this skill does not add a face. Its ambient graded backgrounds are `color-mix()` radials of the fifteen, never a new colour. Its **filtered seeded placeholder photography is dropped entirely** — the only rasters this skill may ask for are text-free hero plates under the owner's rule, and a surface with no plate ships without one. Its scroll-motion paradigms survive only as CSS scroll-driven animation inside the Kill Switch: pinned titles, scrubbed reveals and stacking cards are available that way; pointer-tracked physics and shared-element transitions are named *not available* rather than faked in script.
 

package/modules/ui-design/skills/high-end-visual-design/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `soft-skill` entry, "high-end-visual-design"), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**; the landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `soft-skill` entry, "high-end-visual-design"), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**; the landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md).
 
 What changed in translation, on purpose: the upstream skill specified **the** fonts and shadows that make a site feel expensive; here the fonts are the pack's two stacks and a shadow exists only where the instance's world has one (the chrome world has exactly one, and it belongs to the sculpture). Its texture archetypes become the looks in the style library; its layout archetypes stay free. Its motion (a hamburger morph, a blurred full-screen menu, an 800ms blurred fade-up on scroll) is kept as CSS inside the Kill Switch, and the scroll entry is honest about what a static page can do. Imagery follows the owner's rule: hero plates and hero objects by token, never a step.
 

package/modules/ui-design/skills/image-to-code/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `image-to-code` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the `[image-to-code]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `image-to-code` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the `[image-to-code]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/0222-the-image-family-under-the-hero-only-rule.md).
 
 What changed in translation, on purpose: the upstream's mandatory order was **generate the design images, analyse them, implement**, with the generated image as the source of truth, one large render per section, and a ban on freeform coding whenever a generator was available. The owner's rule is the opposite for UI: image generation is for text-free hero plates and hero objects only, and an image model re-rendering a template costs credits and drifts, so **the owner's reference images and the instance's world are the source of truth**, the sections are rebuilt from the world's templates, and the one generated image is the hero plate the composition has a slot for (through `imagegen-frontend-web`). The analysis discipline, the extraction spec, the faithful-copy rule, the drift bans, the hero rules, the clutter bans and the clarity checklist all survive; they now read the references instead of a generated set. The eagerness mandate and the image-count rule are gone.
 

package/modules/ui-design/skills/imagegen-frontend-mobile/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `imagegen-frontend-mobile` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the `[imagegen-frontend-mobile]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `imagegen-frontend-mobile` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the `[imagegen-frontend-mobile]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/0222-the-image-family-under-the-hero-only-rule.md).
 
 What changed in translation, on purpose, and it is the largest change in the family: the upstream produced **premium mobile app screen images**, one per screen, inside a phone mockup, as an ordered flow with an internal design bible. A screen image is a screenshot of a screen, which the preamble bans on every instance, and a phone mockup is a frame around one. So here the **screen is the surface itself**, rendered by the kit at 390 and 320 from its states file; the **flow** is the states file's order; the **design bible** is the instance's `DESIGN.md` and its pack; and what this skill generates is only what the narrow composition has a slot for: a portrait masthead, a field behind the fold, a small object in a row. The platform-mode choice (one mobile operating system or the other) becomes a decline: every surface here is a served web page, and a native app target routes to `/design`. The first-screen rule, the mobile realities, the scrim rule and the slop bans survive, applied to plates.
 

package/modules/ui-design/skills/imagegen-frontend-web/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `imagegen-frontend-web` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the `[imagegen-frontend-web]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `imagegen-frontend-web` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the `[imagegen-frontend-web]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/0222-the-image-family-under-the-hero-only-rule.md).
 
 What changed in translation, on purpose: the upstream produced **one horizontal design-reference image per section**, scaled the image count with the section count, refused to stop early, and treated imagery as a material several sections had to carry. The owner's rule (2026-08-26, reaffirmed 2026-08-27) is that image generation is for **text-free hero plates and hero objects only**; UI is rebuilt from templates and the instance's world, never painted. So here the count is the number of plate slots the composition already has (usually one to three), a plate never carries a section, a headline, a control or a screen, and the panel's eagerness mandate, its image-count mandate and its must-invoke-any-tool directive are gone. The composition-variety rules, the palette lock and the cross-frame consistency survive and now govern a family of plates rather than a set of frames. The palette lock is the pack; the key is the instance's art pipeline; the output contract is DESIGN.md's pair-and-sidecar convention.
 

package/modules/ui-design/skills/impeccable/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `pbakaus/impeccable` @ `<redacted>` (Apache-2.0; skill v4.1.x), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28: three critical findings at the deterministic floor and a panel that upheld PostToolUse and Stop hooks written into five harness configs, a child agent spawned with its permissions bypassed from a loopback HTTP route, a setup directive that overrode the harness's own instructions, a live-server credential embedded in page source, an unverified remote bundle, and default-on telemetry. Under [ADR 0198](../../../../docs/adr/<redacted>.md) that verdict lands a REBUILD-SPEC, never a copy. The spec is the body of [task 1003326](https://cloudbongos.com/builders#/task/1003326), derived from the origin's documentation only; this file and the playbooks under `reference/` implement its requirements from scratch, **no upstream bytes consulted or copied**. The landing shape (the in-house `skills/<name>/` home, this section in place of a `PROVENANCE.md`) is [ADR 0220](../../../../docs/adr/<redacted>.md); the sub-command shape (one skill, one playbook per sub-command, what was kept and what was dropped) is [ADR 0221](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `pbakaus/impeccable` @ `<redacted>` (Apache-2.0; skill v4.1.x), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28: three critical findings at the deterministic floor and a panel that upheld PostToolUse and Stop hooks written into five harness configs, a child agent spawned with its permissions bypassed from a loopback HTTP route, a setup directive that overrode the harness's own instructions, a live-server credential embedded in page source, an unverified remote bundle, and default-on telemetry. Under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) that verdict lands a REBUILD-SPEC, never a copy. The spec is the body of [task 1003326](https://cloudbongos.com/builders#/task/1003326), derived from the origin's documentation only; this file and the playbooks under `reference/` implement its requirements from scratch, **no upstream bytes consulted or copied**. The landing shape (the in-house `skills/<name>/` home, this section in place of a `PROVENANCE.md`) is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); the sub-command shape (one skill, one playbook per sub-command, what was kept and what was dropped) is [ADR 0221](../../../../docs/adr/0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md).
 
 What changed in translation, on purpose. The method's **three persisted homes** (product truth, the visual system, per-surface briefs) are the instance's own files here: product truth is `docs/project-context.template.md` and the identity block of the branding pack, the visual system is the root `DESIGN.md` (and a look's `DESIGN.md` under `modules/ui-design/styles/`), and a surface's brief is the claimed task's body and ship notes. This skill creates none of them and writes the root `DESIGN.md` only through the `document` playbook, as a draft on the claim's branch the owner reviews. Everything the panel flagged is **gone, not disabled**: no hook is written anywhere, no child agent runs with permissions bypassed (a reviewer is an ordinary subagent through the harness's own Agent tool), nothing is reported home, nothing is downloaded, and there is no live helper server. The **live loop** is the playwright plugin (a documented prerequisite) driving the module's stub; the **headless loop** is `kit/render.js` and `kit/probe.js`. The **anti-pattern detector** is not shipped here: task 1003329 lands it as rules in `kit/check-mock.js` and `kit/lib.js`, and until then the floor is what the kit already measures. The **native playbooks** (the two mobile platforms) are not rebuilt: every surface on this platform is a served web page, so a native target declines to `/design` with one line. The `init`, `doctor`, `pin`, `unpin` and installer operations, which existed to write and repair the origin's own config and harness entries, have no counterpart: the materialiser is the install. Imagery follows the owner's rule (hero plates only, task 1003328 for the image family); the palette is the pack and a variant is a look from the style library; every motion rule lives inside the Kill Switch.
 

package/modules/ui-design/skills/industrial-brutalist-ui/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `brutalist-skill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325) — the `[industrial-brutalist-ui]` requirement group — and this file is its port under [task 1003327](https://cloudbongos.com/builders#/task/1003327); it implements those requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md); what a *look* skill is allowed to be is [ADR 0230](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `brutalist-skill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325) — the `[industrial-brutalist-ui]` requirement group — and this file is its port under [task 1003327](https://cloudbongos.com/builders#/task/1003327); it implements those requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); what a *look* skill is allowed to be is [ADR 0230](../../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md).
 
 What changed in translation, on purpose: the upstream's central rule was **one substrate per project** — off-white document paper *or* near-black terminal, never both. A platform surface here ships **both modes on every page** (the preamble's dark twins), so the substrate choice becomes an **archetype** that decides which mode the surface is *composed for* while the other mode is still complete and still measured. Its hazard red and optional terminal green are not new colours: red is the pack's `terracotta`, green is the pack's `sea`, and neither may appear a third time. Its "zero corner rounding" is legal because a radius is a **derived tier**, not one of the fifteen — a brutalist sheet sets its own radii to 0 and says so in the header comment; where the instance's `DESIGN.md` names a radius as a signature, the instance wins. Its degradation effects (halftone, dithering, scanlines, noise) survive as CSS built from the one legal literal, pure black or white with alpha, and every one of them is static: a scanline that crawls is an animation, and it dies under the Kill Switch with everything else. Its "high-contrast serif after heavy degradation" is dropped unless the pack already carries a serif; this skill does not add a face.
 

package/modules/ui-design/skills/minimalist-ui/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `minimalist-skill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325) — the `[minimalist-ui]` requirement group — and this file is its port under [task 1003327](https://cloudbongos.com/builders#/task/1003327); it implements those requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md); what a *look* skill is allowed to be is [ADR 0230](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `minimalist-skill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325) — the `[minimalist-ui]` requirement group — and this file is its port under [task 1003327](https://cloudbongos.com/builders#/task/1003327); it implements those requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); what a *look* skill is allowed to be is [ADR 0230](../../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md).
 
 What changed in translation, on purpose: the upstream shipped a **palette** (white or warm bone canvas, near-white cards, washed-out pastel accents each with its own darker text tone). Here that palette is a **look in the library** — `modules/ui-design/styles/expedition` is the warm-paper entry this skill was tuned against — and the canvas is whatever `bg` / `bg-card` the instance's pack carries. The upstream's editorial serif for hero headings becomes the pack's `display` stack; a face this skill wants and the pack does not have is a pack change, not a page's `@font-face`. Its pastels become `color-mix()` of the pack's `accent`, `sea` and `terracotta` against `bg-card`, each paired with the contract's own ink for that field, so a badge is measured rather than guessed. Its imagery clause is gone: **seeded placeholder photography does not exist here**, and the only rasters this skill may ask for are text-free hero plates under the owner's rule. Its ban on pill shapes for primary buttons is a default an instance's `DESIGN.md` overrules — Cloud Bongos's own door pill is that world's signature and wins. Its entry motion survives only inside the Kill Switch.
 

package/modules/ui-design/skills/redesign-existing-projects/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `redesign-skill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**; the landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `redesign-skill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**; the landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md).
 
 What changed in translation, on purpose: the upstream audit carried its own opinions (pure black backgrounds are a defect, flat sections are unfinished); here **the instance's world is the answer key**, so an audit row is a defect only where the world does not call for it (the chrome world's dark ground is pure black by the owner's decision, and its bands are flat by design). The upgrade catalogue marks each technique **CSS-only or not available** on a platform where nothing moves in script. Imagery follows the owner's rule.
 

package/modules/ui-design/skills/stitch-design-taste/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `stitch-skill` entry and its `DESIGN.md`), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325) — the `[stitch-design-taste]` requirement group — and this file is its port under [task 1003327](https://cloudbongos.com/builders#/task/1003327); it implements those requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md); what a *look* skill is allowed to be is [ADR 0230](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `stitch-skill` entry and its `DESIGN.md`), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325) — the `[stitch-design-taste]` requirement group — and this file is its port under [task 1003327](https://cloudbongos.com/builders#/task/1003327); it implements those requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); what a *look* skill is allowed to be is [ADR 0230](../../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md).
 
 What changed in translation, on purpose: the upstream **authored a palette** for the downstream tool — a descriptive name, a hex and a role per token, invented to taste. Here the colour contract is **transcribed, not invented**: it is the instance's thirteen with their real hex values and the roles the instance's `DESIGN.md` already gives them, so the external tool and the built surface cannot diverge. The document it writes uses the platform's own frontmatter shape — the one every look in `modules/ui-design/styles/` carries — rather than a shape of its own, so a document produced here can be read back as a style. Its universal bans (no pure black, no serif in a dashboard, the default UI sans banned) become **defaults the instance's `DESIGN.md` overrules**: Cloud Bongos's own world is a black void, and a document that told the tool otherwise would describe a different product. Its "signature move" of small contextual images set inline between headline words survives as a **hero object** under the owner's rule: a text-free cutout with its provenance sidecar, never a photograph of a screen. Its motion section stays what it always was, an intent brief for whoever writes the code afterwards, and every parameter in it is written to live inside the Kill Switch.
 

package/modules/ui-design/skills/style/SKILL.md

@@ -23,9 +23,9 @@ description: >-
 
 ## First party
 
-This skill has **no upstream**. It was authored for the platform by [task 1003475](https://cloudbongos.com/builders#/task/1003475) from the owner's idea on the style-library sheet: the library ships looks an instance can adopt, and the next step is letting an owner *make* one with Claude beside them. It is not a rebuild, carries no vendored bytes and claims no origin; the two-origin rule for the module's skills is [ADR 0231](../../../../docs/adr/<redacted>.md).
+This skill has **no upstream**. It was authored for the platform by [task 1003475](https://cloudbongos.com/builders#/task/1003475) from the owner's idea on the style-library sheet: the library ships looks an instance can adopt, and the next step is letting an owner *make* one with Claude beside them. It is not a rebuild, carries no vendored bytes and claims no origin; the two-origin rule for the module's skills is [ADR 0231](../../../../docs/adr/0231-the-style-session-an-owner-authors-a-look-inside-the-contract.md).
 
-Why it exists: a look in this library is a **branding pack** ([ADR 0219](../../../../docs/adr/<redacted>.md)) — thirteen colours, two font stacks, a `DESIGN.md` of derived recipes and one specimen. That is a small enough object for an owner to have opinions about and a strict enough one that a wrong guess fails a measurement rather than shipping. What was missing was the loop between the two: the search that shows what already exists, the draft that stays inside the contract, the retune that is arithmetic rather than taste, and the one-line adoption at the end. This skill is that loop, bounded.
+Why it exists: a look in this library is a **branding pack** ([ADR 0219](../../../../docs/adr/0219-a-look-is-a-branding-pack-the-style-library.md)) — thirteen colours, two font stacks, a `DESIGN.md` of derived recipes and one specimen. That is a small enough object for an owner to have opinions about and a strict enough one that a wrong guess fails a measurement rather than shipping. What was missing was the loop between the two: the search that shows what already exists, the draft that stays inside the contract, the retune that is arithmetic rather than taste, and the one-line adoption at the end. This skill is that loop, bounded.
 
 ## What this session is, and is not
 

package/modules/ui-design/styles/README.md

@@ -1,6 +1,6 @@
 # `modules/ui-design/styles/` — the style library: looks as branding packs
 
-A **look** is something a builder or an instance owner picks for a new surface or a whole instance. The library ships looks as **branding packs** ([task 1003323](https://cloudbongos.com/builders#/task/1003323), [ADR 0219](../../../docs/adr/<redacted>.md)): the thirteen colours and the two font stacks of `theme.ui` (the fifteen host-overridable tokens, [ADR 0062 §3](../../../docs/adr/<redacted>.md) / [ADR 0196](../../../docs/adr/<redacted>.md)), a `DESIGN.md` of the look's derived recipes in the frontmatter shape the chrome world uses, and one specimen mock. **Never a fork of a sheet.** The drift tests already prove every served sheet reads only the contract, so a look that needs a sixteenth token is a contract change and an ADR, not a style.
+A **look** is something a builder or an instance owner picks for a new surface or a whole instance. The library ships looks as **branding packs** ([task 1003323](https://cloudbongos.com/builders#/task/1003323), [ADR 0219](../../../docs/adr/0219-a-look-is-a-branding-pack-the-style-library.md)): the thirteen colours and the two font stacks of `theme.ui` (the fifteen host-overridable tokens, [ADR 0062 §3](../../../docs/adr/0062-medusa-instance-model-decoupling.md) / [ADR 0196](../../../docs/adr/0196-chrome-world-token-contract-and-the-landing-sheets.md)), a `DESIGN.md` of the look's derived recipes in the frontmatter shape the chrome world uses, and one specimen mock. **Never a fork of a sheet.** The drift tests already prove every served sheet reads only the contract, so a look that needs a sixteenth token is a contract change and an ADR, not a style.
 
 ## The catalogue
 
@@ -8,7 +8,7 @@ A **look** is something a builder or an instance owner picks for a new surface o
 |---|---|---|---|
 | `chrome-world` | the neutral pack, byte for byte | The canonical entry: one iridescent chrome sculpture in a black void, pale grey paper in light, one warm salmon that lights only the pressable and the live. Its recipes are the repo-root [`DESIGN.md`](../../../DESIGN.md); [`chrome-world/DESIGN.md`](chrome-world/DESIGN.md) points there. | the world round's pick (task 1003296 → 1003298) |
 | `expedition` | warm paper, lamp yellow, Archivo | A printed field journal: a halftone screen over the paper, hairline frames instead of a grid, big heavy uppercase headlines, the yellow as a fill only. [`expedition/DESIGN.md`](expedition/DESIGN.md) | `docs/design/mocks/world/natgeo-editorial` (kept in round 1) |
-| `blueprint` | cool grey-blue paper, cyanotype blue, slate green, IBM Plex Sans | A drafting table under north light: a faint graph lattice on the ground, compartments registered to the board with a crosshair tick at a 2px cut edge, the display voice in sentence case, every figure mono and tabular, one cyanotype blue on what is pressable, a slate green for what was measured and a rust pencil for what went wrong. The library's first cool look. [`blueprint/DESIGN.md`](blueprint/DESIGN.md) | authored through the `/style` session ([task 1003475](https://cloudbongos.com/builders#/task/1003475), [ADR 0231](../../../docs/adr/<redacted>.md)) |
+| `blueprint` | cool grey-blue paper, cyanotype blue, slate green, IBM Plex Sans | A drafting table under north light: a faint graph lattice on the ground, compartments registered to the board with a crosshair tick at a 2px cut edge, the display voice in sentence case, every figure mono and tabular, one cyanotype blue on what is pressable, a slate green for what was measured and a rust pencil for what went wrong. The library's first cool look. [`blueprint/DESIGN.md`](blueprint/DESIGN.md) | authored through the `/style` session ([task 1003475](https://cloudbongos.com/builders#/task/1003475), [ADR 0231](../../../docs/adr/0231-the-style-session-an-owner-authors-a-look-inside-the-contract.md)) |
 | `grove` | pale sage, tan, sea green, Nunito | A sculpted paper garden: soft corners on everything that holds content, tinted shadows, the sea as a slab a whole band sits on, the tan as the one lit thing. [`grove/DESIGN.md`](grove/DESIGN.md) | `docs/design/mocks/world/organic-cards` (kept in round 1) |
 
 The owner looked at both alternates on the sheet on 2026-09-01 and kept them ("styles look good for a start"). Both alternates were **retuned against the contract**, which is a measurement and not a taste: a pack's thirteen are laid through three sheets that already exist (the landing's `world.css`, the hub's `cosmos.css`, the hall's `style.css`) and every pair those sheets paint must clear AA under it. The grove's sage ground lifted and its inks deepened until the hub's fixed status vocabulary and the hall's chips cleared; the expedition's `ink-faint` deepened one step. What a pack cannot carry is **dark**: the contract is light values only, and every sheet's dark tier is its own black, which a look reaches through its accent and its faces. So the grove's green dark ground stays in the world round's mock and does not travel.
@@ -51,7 +51,7 @@ SURFACE=modules/ui-design/styles/expedition STYLE=expedition node modules/ui-des
 
 ## Adding a look
 
-The steps below are the manual path. The **`/style` session** ([task 1003475](https://cloudbongos.com/builders#/task/1003475), [ADR 0231](../../../docs/adr/<redacted>.md)) walks them with an owner instead: it renders the nearest entries before it asks anything, drafts inside the contract, retunes against the same measurements below with a failure-to-fix table, and hands over the one-step adoption without taking it. `blueprint` was authored that way.
+The steps below are the manual path. The **`/style` session** ([task 1003475](https://cloudbongos.com/builders#/task/1003475), [ADR 0231](../../../docs/adr/0231-the-style-session-an-owner-authors-a-look-inside-the-contract.md)) walks them with an owner instead: it renders the nearest entries before it asks anything, drafts inside the contract, retunes against the same measurements below with a failure-to-fix table, and hands over the one-step adoption without taking it. `blueprint` was authored that way.
 
 1. Make the dir with the three files; start from the alternate nearest to it.
 2. `node modules/ui-design/kit/contrast.js --pack <name>` until the floor is clean; then `node --test tests/ui_design_styles.mjs`, which runs the world / cosmos / hall suites under the pack and tells you the exact pair that fails. Tune the thirteen, never the sheets.

package/modules/ui-design/styles/blueprint/DESIGN.md

@@ -75,7 +75,7 @@ components:
 
 # Style: The Blueprint
 
-**Origin.** Authored through the `/style` session ([task 1003475](https://cloudbongos.com/builders#/task/1003475), [ADR 0231](../../../../docs/adr/<redacted>.md)) from a two-line brief: *"a drafting table under north light, cool paper and graphite; one cyanotype blue on what is pressable, a rust pencil for what went wrong."* The library's three existing looks are all warm and all carry a warm accent (salmon, lamp yellow, tan), so the search step found no near neighbour and the session drafted rather than adapted. The retune against the contract took one pass: the pack floor and all three token suites cleared on the first measurement, which is what a cool ground and a deep graphite ink buy you. The candidate's own dark ground does not travel, as with every look: a pack carries light values only.
+**Origin.** Authored through the `/style` session ([task 1003475](https://cloudbongos.com/builders#/task/1003475), [ADR 0231](../../../../docs/adr/0231-the-style-session-an-owner-authors-a-look-inside-the-contract.md)) from a two-line brief: *"a drafting table under north light, cool paper and graphite; one cyanotype blue on what is pressable, a rust pencil for what went wrong."* The library's three existing looks are all warm and all carry a warm accent (salmon, lamp yellow, tan), so the search step found no near neighbour and the session drafted rather than adapted. The retune against the contract took one pass: the pack floor and all three token suites cleared on the first measurement, which is what a cool ground and a deep graphite ink buy you. The candidate's own dark ground does not travel, as with every look: a pack carries light values only.
 
 ## Overview
 

package/modules/ui-design/styles/chrome-world/DESIGN.md

@@ -30,7 +30,7 @@ rounded:
 
 # Style: The Chrome World (the canonical look)
 
-This is the look Cloud Bongos itself runs on and the **first entry** of the style library ([task 1003323](https://cloudbongos.com/builders#/task/1003323)). It is the canonical one in a precise sense: its `pack.json` is byte-for-byte the `theme.ui` block of [`config/branding.neutral.json`](../../../../config/branding.neutral.json), the neutral pack every instance resolves over, and its recipes are **not restated here**. The world's derived tiers, faces, materials, motion grammar, components, Do's and Don'ts and accessibility floors are the repo-root [`DESIGN.md`](../../../../DESIGN.md), recorded from the built landing ([ADR 0196](../../../../docs/adr/<redacted>.md)). Read that file; this one only holds the thirteen so the catalogue's lockstep test has something to hold.
+This is the look Cloud Bongos itself runs on and the **first entry** of the style library ([task 1003323](https://cloudbongos.com/builders#/task/1003323)). It is the canonical one in a precise sense: its `pack.json` is byte-for-byte the `theme.ui` block of [`config/branding.neutral.json`](../../../../config/branding.neutral.json), the neutral pack every instance resolves over, and its recipes are **not restated here**. The world's derived tiers, faces, materials, motion grammar, components, Do's and Don'ts and accessibility floors are the repo-root [`DESIGN.md`](../../../../DESIGN.md), recorded from the built landing ([ADR 0196](../../../../docs/adr/0196-chrome-world-token-contract-and-the-landing-sheets.md)). Read that file; this one only holds the thirteen so the catalogue's lockstep test has something to hold.
 
 ## What this entry is for
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.714",
+  "version": "1.19.724",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.714",
+      "version": "1.19.724",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.714",
+  "version": "1.19.724",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/audit-rank-roles.js

@@ -0,0 +1,172 @@
+#!/usr/bin/env node
+// scripts/gds/audit-rank-roles.js — does the live builder roster hold ONLY the
+// four live ranks? (task 1002873)
+//
+// WHY. `migrations/023`'s CHECK on `builders.rank` still admits twelve legacy
+// values beyond the four live ranks. `governance_002_seed_and_backfill.sql`
+// backfills roles with an INNER JOIN from `builders.rank` to the four seeded
+// `governance_roles`, so a builder sitting on a legacy rank gets NO role row and
+// resolves to ZERO permissions: admitted by threshold under `requireRank`, locked
+// out of everything under the resolver. They are not told why, and nothing about
+// their account looks wrong.
+//
+// That divergence is deliberate — ADR 0151 chose fail-closed, and
+// `tests/governance_parity.mjs` asserts it is strictly a tightening. What was
+// missing is the VERIFICATION. governance_002's comment says "none exist today —
+// verified", a point-in-time manual check that nothing re-runs; the parity test
+// is DB-free by necessity (the unit gate has no Postgres) and says so in the
+// repo; and R114's live proof ran on a scratch DB holding only the four seeded
+// rank-roles, so the production roster was never queried.
+//
+// THIS IS THE RE-RUNNABLE HALF, and it is deliberately NOT fatal at boot. Idea
+// 1000622 records that trap: an assertion that throws on startup turns a data
+// problem on one instance into an outage. This is a standalone read-only script
+// for a nightly/deploy-time caller — it exits 1 so a caller can act, and nothing
+// in the server's boot path requires it.
+//
+// It reports rather than repairs, and that is a decision, not an omission:
+// rewriting somebody's rank is an authority change, and it belongs to an operator
+// who can see who the account is — not to a sweep.
+//
+//   node scripts/gds/audit-rank-roles.js [--json] [--file-idea]
+//
+// Exit codes:
+//   0  every builder holds a live rank
+//   1  at least one builder holds a rank the governance backfill cannot match
+//   2  could not read the roster (no session / network / route absent)
+//
+// `--file-idea` is what makes this a SURFACE rather than another thing nobody
+// runs — the same shape diagram-drift/check.js uses, spawning capture.js so idea
+// filing has one implementation. Without it a nightly deterministic run that exits
+// 1 reports into a log nobody reads, which is the exact criticism this task makes
+// of the status quo.
+
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const { cliClient, requireSession, cliExit } = require('./cli-lib');
+const { LIVE_RANK_LADDER } = require('../../src/bongos/db-kernel.js');
+
+// findRanksWithoutRoles — the PURE half. Given roster rows and the live ladder,
+// which builders hold a rank that `governance_002`'s INNER JOIN cannot match?
+//
+// Pure + exported because this is the only altitude the repo can test: the unit
+// gate has no Postgres, which is exactly why the gap this script closes went
+// unverified for so long. A DB-free test of the decision is not a consolation
+// prize here — it is the thing that can actually run in CI.
+//
+// A row with NO rank at all counts: NULL fails the INNER JOIN the same way a
+// legacy value does, and reads as "fine" in every UI that renders a blank.
+function findRanksWithoutRoles(rows, liveRanks = LIVE_RANK_LADDER) {
+  const live = new Set(liveRanks);
+  return (Array.isArray(rows) ? rows : [])
+    .filter((b) => b && !live.has(b.rank))
+    .map((b) => ({
+      id: b.id != null ? String(b.id) : null,
+      // The login is what an operator needs to act; it is already visible to any
+      // caller authorised to read the roster, so this adds no exposure.
+      github_login: b.github_login || null,
+      rank: b.rank === undefined ? null : b.rank,
+      status: b.status || null,
+    }));
+}
+
+// summarize — the rank histogram, so a CLEAN run still says what it looked at.
+// A green check that prints nothing is indistinguishable from one that read
+// nothing, which is the failure mode this whole task is about.
+function summarize(rows) {
+  const counts = new Map();
+  for (const b of Array.isArray(rows) ? rows : []) {
+    const key = b && b.rank ? b.rank : '(none)';
+    counts.set(key, (counts.get(key) || 0) + 1);
+  }
+  return [...counts.entries()].sort((a, b) => b[1] - a[1]);
+}
+
+// Spawn capture.js rather than POSTing here, so idea filing keeps one
+// implementation (the diagram-drift/check.js precedent). Best-effort: a failure to
+// file must not turn a successful audit into a crash — the exit code and stdout
+// still carry the finding.
+function fileIdea(offenders) {
+  const body = [
+    `${offenders.length} builder(s) hold a rank with no matching governance_roles row.`,
+    '',
+    'They resolve to ZERO permissions — admitted by rank threshold under requireRank,',
+    'refused by the permission resolver, and given no reason (ADR 0151 fail-closed).',
+    '',
+    ...offenders.map((o) => `- builder ${o.id}${o.github_login ? ` (${o.github_login})` : ''} rank=${o.rank === null ? '(none)' : o.rank} status=${o.status || '?'}`),
+    '',
+    'Fix: move each to a live rank through the normal rank-change path, which rotates',
+    'the governance role in the same transaction. Not auto-repaired: changing a rank is',
+    'an authority decision, and a sweep is the wrong actor for it.',
+    '',
+    'Filed by scripts/gds/audit-rank-roles.js (task 1002873).',
+  ].join('\n');
+  const tmp = path.join(os.tmpdir(), `rank-roles-audit-${process.pid}.md`);
+  try {
+    fs.writeFileSync(tmp, body, 'utf8');
+    const r = spawnSync(
+      process.execPath,
+      [path.join(__dirname, 'capture.js'),
+        `[rank-roles] ${offenders.length} builder(s) on a rank with no governance role`,
+        '--kind', 'bug', '--body-file', tmp],
+      { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 }
+    );
+    if (r.status !== 0) console.error('audit-rank-roles: capture.js failed to file the idea — the exit code above still carries the finding.');
+  } catch (e) {
+    console.error(`audit-rank-roles: could not file the idea (${(e && e.message) || e}) — the exit code above still carries the finding.`);
+  } finally {
+    try { fs.rmSync(tmp, { force: true }); } catch (_) { /* best-effort */ }
+  }
+}
+
+async function main() {
+  const json = process.argv.includes('--json');
+  await requireSession();
+  const api = await cliClient();
+  const r = await api.request('GET', '/builders/roster');
+  if (!r.ok) {
+    console.error(`audit-rank-roles: could not read the roster (HTTP ${r.status}).`);
+    console.error('  Needs a session with builder.roster.read. Nothing was checked — do NOT read this as a pass.');
+    return cliExit(2);
+  }
+  // The roster query has no WHERE on `builders`, so this covers every row,
+  // INACTIVE ONES INCLUDED. That matters: a deactivated builder on a legacy rank
+  // is exactly the row a future CHECK-narrowing migration would fail to apply over.
+  const rows = (r.data && (r.data.builders || r.data.roster || r.data)) || [];
+  const offenders = findRanksWithoutRoles(rows);
+  const histogram = summarize(rows);
+
+  if (json) {
+    console.log(JSON.stringify({ checked: rows.length, live_ranks: LIVE_RANK_LADDER, histogram, offenders }, null, 2));
+    return cliExit(offenders.length ? 1 : 0);
+  }
+
+  console.log(`audit-rank-roles: ${rows.length} builder row(s) checked against the live ladder [${LIVE_RANK_LADDER.join(', ')}]`);
+  for (const [rank, n] of histogram) console.log(`  ${String(rank).padEnd(12)} ${n}`);
+  if (!offenders.length) {
+    console.log('\n✓ every builder holds a live rank — the governance backfill can match all of them.');
+    return cliExit(0);
+  }
+  console.log(`\n✗ ${offenders.length} builder(s) hold a rank with no matching governance role.`);
+  console.log('  They resolve to ZERO permissions: admitted by rank threshold, refused by the resolver,');
+  console.log('  and nothing tells them why (ADR 0151 fail-closed).');
+  for (const o of offenders) {
+    console.log(`  - builder ${o.id}${o.github_login ? ` (${o.github_login})` : ''} rank=${o.rank === null ? '(none)' : o.rank} status=${o.status || '?'}`);
+  }
+  console.log('\n  This is a BUILDER NEED, not an outage: move each to a live rank with the normal');
+  console.log('  rank-change path so the governance role rotates in the same transaction.');
+  console.log('  Deliberately not repaired here — changing a rank is an authority decision.');
+  if (process.argv.includes('--file-idea')) fileIdea(offenders);
+  return cliExit(1);
+}
+
+if (require.main === module) {
+  main().catch((err) => {
+    console.error('audit-rank-roles:', (err && err.message) || err);
+    cliExit(2);
+  });
+}
+
+module.exports = { findRanksWithoutRoles, summarize };

package/scripts/gds/backfill-task-rewards.js

@@ -295,10 +295,15 @@ async function applyPlan(pool, plans) {
           [p.builderId, r.taskId, delta, BACKFILL_REASON,
             `${r.description} (net-capped ${delta} of ${r.effective}; builder cost-plus already paid ${p.costPlusAlreadyPaid})`]
         );
-        await client.query(
-          `UPDATE builders SET total_credits = total_credits + $1 WHERE id = $2`,
-          [delta, p.builderId]
-        );
+        // NO `UPDATE builders SET total_credits = ...` HERE, DELIBERATELY.
+        // trg_credit_log_apply applies the delta (migrations/003_pms.sql:169 —
+        // pms_apply_credit, AFTER INSERT ON credit_log, total_credits += NEW.delta),
+        // so the INSERT above has ALREADY moved the balance. This function used to
+        // add it a second time, doubling every credit it minted — a real
+        // financial-ledger bug (task 1003641). Every other credit_log writer in the
+        // repo relies on the trigger alone; backfill-subagent-rewards.js is the
+        // sibling exemplar. If you are adding a balance update here, the trigger is
+        // the thing to change, once, not this call site.
         remaining -= delta;
         mintedRows++;
         mintedDrachmae += delta;

package/scripts/gds/build-cli-package.js

@@ -64,6 +64,7 @@ const FILES = [
   'scripts/gds/recall.js',
   'scripts/gds/cost.js',
   'scripts/gds/release.js',
+  'scripts/gds/worktree-claim-guard.js', // release.js warns through it; pure, zero requires
 
   // Get onto a real environment without installing one: the cloud dev box.
   'scripts/gds/shell.js',