@bongos/core 1.19.715 → 1.19.725

package/modules/onboarding/approval-broadcast.js

@@ -48,12 +48,39 @@ async function postLine(channel, line, deps = {}) {
   }
 }
 
+// Is the half that CLOSES this loop actually loaded? The line we post invites a 👍,
+// and that reaction is only ever applied by modules/discord/discord-approvals.js —
+// which lives in the `discord` module. onboarding is default-ON and discord is
+// default-OFF, and nothing gated one on the other, so a default instance posted an
+// approve/decline control with nothing listening: an Archon reacts, watches the
+// reaction land, and believes they admitted someone. Nobody is told otherwise.
+//
+// A control that cannot work is worse than no message, so the outbound half now
+// refuses to post without its inbound half. The hall queue is the source of truth
+// either way, so nothing is lost — only a false affordance is withheld.
+// Reached through the published doorway (the one core file a module may require,
+// ADR 0083), never a direct require of src/modules.js. Fails CLOSED: if enablement
+// can't be resolved we do not post, because that is the state we cannot vouch for.
+function discordHandlerLoaded(deps = {}) {
+  try {
+    const isEnabled = deps.isModuleEnabled || require('../../src/module-api').isModuleEnabled;
+    return isEnabled('discord') === true;
+  } catch (_) {
+    return false;
+  }
+}
+
 async function postMemberApprovalRequest(request, deps = {}) {
   if (!request || request.id == null) return { posted: false, skipped: 'no_request' };
+  if (!discordHandlerLoaded(deps)) {
+    (deps.log || console.log)('[gds] approval broadcast: skipped — the `discord` module is off, so no reaction handler would apply a 👍. Approve from the hall queue.');
+    return { posted: false, skipped: 'discord_module_off' };
+  }
   return postLine('member_approvals', memberApprovalLine(request), deps);
 }
 
 module.exports = {
   memberApprovalLine,
   postMemberApprovalRequest,
+  discordHandlerLoaded, // exported for unit tests — the gate is the whole fix
 };

package/modules/provisioning/provisioning.js

@@ -159,17 +159,34 @@ const RESTART_SHAPES = new Set(['co-tenant', 'standalone']);
 // which is why it is the default — DEFAULT_SETTINGS must be today's behaviour, and
 // today a public project runs whatever door its joinability runs. Composed at the
 // door by src/bongos/project-door.js; ADR 0247.
+//
+// `artist_gate` is the project's ARTIST STRICTNESS (ADR 0241, task 1003575) — the
+// owner's constraint from goal 1000074, verbatim: blocking strictness is per
+// project, not global. `off` generates no artist review tasks at all; `advisory`
+// generates them and blocks nothing; `strict` generates them and an unresolved one
+// holds the DEPLOY — the instance's pin may not move while one is open. It never
+// holds a builder's SHIP: that is the line ADR 0241 draws to keep this compatible
+// with ADR 0162, and it is why a gate that stops work can exist here at all.
+//
+// It is the only key here whose default is NOT today's behaviour. `strict` is an
+// owner ruling (ADR 0241 §4), recorded there against its author's recommendation
+// and coherent because strict holds only the pin: the worst case is a project whose
+// deploy waits on a review nobody has done, which is visible and owner-releasable,
+// never a stranded builder.
 const SETTINGS_VOCAB = Object.freeze({
   platform_visibility: ['public', 'gated'],
   joinability: ['open', 'apply', 'invite_only'],
   visibility: ['public', 'private', 'stealth'],
   join_grant: ['view', 'apply', 'full'],
+  artist_gate: ['off', 'advisory', 'strict'],
 });
 // Default = today's behavior on every axis, including the join door: ADR 0182's
 // migration gives the hub column the same `public` default, "existing rows keep
-// today's behaviour".
+// today's behaviour". The one exception is `artist_gate`, whose default is the
+// owner's ruling rather than the status quo — see the note above it.
 const DEFAULT_SETTINGS = Object.freeze({
   platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full',
+  artist_gate: 'strict',
 });
 
 // The project's PLANET (task 1003347, direction record §16): how the platform
@@ -422,9 +439,28 @@ function publicGithubApp(manifestRow) {
 // and the live push (the runner's settings-apply leg patches exactly these lines).
 function settingsEnvVars(row, prefix) {
   const s = effectiveSettings(row);
-  return Object.fromEntries(Object.keys(SETTINGS_VOCAB).map((key) => [`${prefix}_${key.toUpperCase()}`, s[key]]));
+  const vars = Object.fromEntries(Object.keys(SETTINGS_VOCAB).map((key) => [`${prefix}_${key.toUpperCase()}`, s[key]]));
+  for (const [suffix, read] of Object.entries(SETTINGS_COMPANION_ENV)) vars[`${prefix}_${suffix}`] = read(row);
+  return vars;
 }
 
+// COMPANION variables: env the instance needs to OBEY a setting, which is not
+// itself a setting anyone chooses (task 1003575). Declared as a closed table for
+// the same reason SETTINGS_VOCAB is — the drift test asserts the transport carries
+// exactly the vocabulary plus these, so a companion can be added deliberately and
+// never by accident.
+//
+// ARTIST_GATE_SINCE is the only one today: ADR 0241 §5 makes a tightening
+// non-retroactive, and an instance cannot honour that without knowing WHEN the
+// gate was raised. Always emitted — the runner patches these lines in place, and a
+// key that came and went would leave a stale line behind — with empty meaning "no
+// cutoff". src/branding.js skips an empty override, so the instance reads no
+// cutoff and every unresolved review counts, which is the right answer for a
+// project that has been strict since it stood up.
+const SETTINGS_COMPANION_ENV = Object.freeze({
+  ARTIST_GATE_SINCE: (row) => artistGateStrictSince(row) || '',
+});
+
 // The web.env block the runner writes at STANDUP (task 1003139): a comment that
 // tells the truth about where the values come from, then the settingsEnvVars
 // lines. Changing one on an ALREADY-RUNNING instance is the 'settings-apply'
@@ -496,6 +532,44 @@ function settingsPushOwed(row) {
   return stored[SETTINGS_PUSH_OWED_KEY] === true;
 }
 
+// The moment `artist_gate` was last RAISED to 'strict' (ADR 0241 §5, task
+// 1003575). Same reserved-key shape and rationale as SETTINGS_PUSH_OWED_KEY
+// above — platform bookkeeping, not a setting an owner declares, so it is
+// deliberately out of SETTINGS_VOCAB and can neither leak through
+// effectiveSettings nor be written by a client patch.
+//
+// WHY IT HAS TO EXIST. ADR 0241 §5: tightening applies to work that ships AFTER
+// the change, never backwards. Without a stamp, flipping advisory → strict would
+// hand the next deploy a backlog of review tasks for work nobody remembers — the
+// exact thing that makes a setting frightening to raise. The stamp is what lets
+// the gate ignore them.
+const ARTIST_GATE_STRICT_SINCE_KEY = 'artist_gate_strict_since';
+
+// Read the stamp, or null. An unparseable value reads as null (no cutoff) rather
+// than as a date nobody can name. PURE.
+function artistGateStrictSince(row) {
+  const stored = row && row.settings && typeof row.settings === 'object' && !Array.isArray(row.settings)
+    ? row.settings : {};
+  const v = stored[ARTIST_GATE_STRICT_SINCE_KEY];
+  if (typeof v !== 'string' || !v) return null;
+  return Number.isNaN(Date.parse(v)) ? null : v;
+}
+
+// The extra jsonb keys a settings save must ALSO store, given what the row holds
+// now and what is being patched onto it. Today that is exactly the strict stamp,
+// and it is written only on a RAISE — a save that leaves the gate where it was,
+// or lowers it, must not move the cutoff forward, or every unrelated settings
+// change would quietly re-date the gate and un-hold reviews it was already
+// holding. Lowering deliberately LEAVES the stamp: nothing reads it below
+// 'strict', and keeping it means a project that goes strict → advisory → strict
+// by mistake does not lose its history. PURE (row + patch + clock in, object out).
+function artistGateStamp(row, patch, now = new Date()) {
+  const next = (patch || {}).artist_gate;
+  if (next !== 'strict') return {};
+  if (effectiveSettings(row).artist_gate === 'strict') return {};
+  return { [ARTIST_GATE_STRICT_SINCE_KEY]: new Date(now).toISOString() };
+}
+
 // A description as it may be STORED: trimmed, collapsed of runaway whitespace,
 // capped, and empty-means-absent. Returns null for anything that isn't real prose,
 // because null is what leaves the project dark-matter — an empty string stored in a
@@ -1334,12 +1408,14 @@ module.exports = {
   SETTINGS_APPLY_FROM, SETTINGS_APPLY_SHAPES,
   RESTART_FROM, RESTART_SHAPES,
   TIER_MONTHLY_USD, CERT_ELIGIBLE_STATES,
-  SETTINGS_VOCAB, DEFAULT_SETTINGS, PROJECT_DETAIL_VOCAB, DESCRIPTION_MAX,
+  SETTINGS_VOCAB, DEFAULT_SETTINGS, SETTINGS_COMPANION_ENV, PROJECT_DETAIL_VOCAB, DESCRIPTION_MAX,
   PLANET_TEMPLATES, PLANET_ACCENTS, PLANET_VOCAB,
   // pure
   isValidSlug, costEstimateUsd, publicInstance, normalizeHostname,
   defaultDomainForSlug, isReservedHostname, effectiveSettings, planetChoice,
   settingsPushOwed,
+  // pure — the artist gate's non-retroactivity stamp (ADR 0241 §5, task 1003575)
+  ARTIST_GATE_STRICT_SINCE_KEY, artistGateStrictSince, artistGateStamp,
   normalizeDescription, normalizeProjectDetail, projectDetailPatch, projectDetail,
   // pure — GitHub App Manifest flow (task 2080)
   githubAppName, buildGithubAppManifest, manifestPostUrl, publicGithubApp,

package/modules/provisioning/routes/provisioning.js

@@ -908,7 +908,12 @@ module.exports = function provisioningRoutes() {
       // true: the re-send is unchanged, so it would otherwise hit "No change".
       const pushOwed = provisioning.settingsPushOwed(inst);
       const policyResent = (!!inst.error_note || pushOwed) && policyTouched;
-      const updated = changed ? await provisioning.updateInstanceSettings(pool, id, patch) : inst;
+      // Raising `artist_gate` to 'strict' also stamps WHEN (ADR 0241 §5 makes the
+      // tightening non-retroactive, and the instance cannot honour that without the
+      // date). It rides the same single UPDATE as the setting it belongs to, and is
+      // empty on every other save — see artistGateStamp.
+      const storedPatch = { ...patch, ...provisioning.artistGateStamp(inst, patch) };
+      const updated = changed ? await provisioning.updateInstanceSettings(pool, id, storedPatch) : inst;
       if (changed) {
         await provisioning.recordEvent(pool, {
           instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'settings',

package/modules/provisioning/tests/provisioning.mjs

@@ -263,27 +263,27 @@ await ta('recordDnsNote / clearErrorNote are NARROW single-column updates — no
 console.log('\nPer-project settings (task 1003040):');
 
 t('effectiveSettings: defaults for a bare/empty row = today\'s behavior; stored keys overlay; junk falls back', () => {
-  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' });
-  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' });
-  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' });
+  assert.deepEqual(P.effectiveSettings(null), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
+  assert.deepEqual(P.effectiveSettings({}), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
+  assert.deepEqual(P.effectiveSettings({ settings: {} }), { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
   assert.deepEqual(
     P.effectiveSettings({ settings: { platform_visibility: 'gated' } }),
-    { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full' },
+    { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' },
     'a stored key overlays only itself'
   );
   assert.deepEqual(
     P.effectiveSettings({ settings: { platform_visibility: 'bogus', joinability: 'invite_only', future_key: 'x', visibility: 'unlisted', join_grant: 'everything' } }),
-    { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full' },
+    { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict' },
     'off-vocabulary values fall back to the default; unknown keys never leak out'
   );
   assert.deepEqual(P.effectiveSettings({ settings: ['not', 'an', 'object'] }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' }, 'a non-object settings value reads as defaults');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' }, 'a non-object settings value reads as defaults');
   // the join door reads back like any other policy key (task 1002324)
   assert.deepEqual(P.effectiveSettings({ settings: { visibility: 'stealth' } }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full' }, 'a stored door overlays only itself');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full', artist_gate: 'strict' }, 'a stored door overlays only itself');
   // what a public join grants is a policy key like any other (task 1002331)
   assert.deepEqual(P.effectiveSettings({ settings: { join_grant: 'view' } }),
-    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'view' }, 'the grant overlays only itself');
+    { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'view', artist_gate: 'strict' }, 'the grant overlays only itself');
 });
 
 t('SETTINGS_VOCAB / DEFAULT_SETTINGS: every default is on its own vocabulary (lockstep guard)', () => {

package/modules/security/secret-scrub.js

@@ -132,11 +132,47 @@ function looksHighEntropySecret(tok) {
 // floor and slip the entropy net — but layers 1–4 (literal env values, PEM,
 // known shapes, key=value assignments) already cover the realistic ways such a
 // value reaches a transcript.
+const DOC_EXTS = ['.md', '.sql'];
 const ENTROPY_CANDIDATE_RE = /[A-Za-z0-9_-]{20,}/g;
-function redactHighEntropy(text) {
-  return text.replace(ENTROPY_CANDIDATE_RE, (tok) => (looksHighEntropySecret(tok) ? REDACTED : tok));
+
+// DOC-PATH EXEMPTION (task 1002460) — an ALLOWLIST, not a shape guess.
+//
+// THE FALSE POSITIVE. A long filename slug is lowercase + digits + hyphens with
+// H >= 3.7, so rule B fires and package-core collapsed every ADR and migration
+// filename to `<redacted>.md` on the publish path.
+//
+// WHY NOT A SHAPE RULE. Three were tried and each leaked. Any predicate built on
+// what a filename LOOKS like also admits a secret dressed that way, because a
+// random lowercase run is shape-identical to words — and entropy cannot separate
+// them either (real filenames measure up to H=4.35, random lowercase words 4.54).
+// scrubSecrets feeds the PUBLIC mirror (scripts/gds/mirror-redact.js,
+// scripts/public-mirror-export.js), so a shape hole is a smuggling channel.
+//
+// WHAT THIS DOES INSTEAD. The caller passes the set of filenames it is actually
+// publishing; a candidate is spared only when the token plus its extension IS one
+// of them. A secret is not a file in the tree, so it cannot be in the set.
+//
+// RECALL IS UNCHANGED BY CONSTRUCTION, and that is the point. With no set — every
+// transcript scrub, every caller that does not opt in — there is no exemption at
+// all and the verdict is byte-identical to before this task. Only the publish path,
+// which enumerates the tree anyway, supplies one.
+function redactHighEntropy(text, opts) {
+  const known = opts && opts.knownDocNames;
+  if (!known || !known.size) {
+    return text.replace(ENTROPY_CANDIDATE_RE, (tok) => (looksHighEntropySecret(tok) ? REDACTED : tok));
+  }
+  return text.replace(ENTROPY_CANDIDATE_RE, (tok, offset, whole) => {
+    if (!looksHighEntropySecret(tok)) return tok;
+    // Cheap boundary reads at a known offset — no slicing of the surrounding
+    // document, which runs over whole markdown files and whole transcripts.
+    for (const ext of DOC_EXTS) {
+      if (whole.startsWith(ext, offset + tok.length) && known.has(tok + ext)) return tok;
+    }
+    return REDACTED;
+  });
 }
 
+
 // ENV secret collection — literal secret VALUES from the process env, so they are
 // redacted wherever they appear even with no recognizable shape (Apple/MAC_* CI
 // secrets, a baked GDS_TOKEN, GITHUB_TOKEN, DO_API_TOKEN, …). Key match mirrors
@@ -164,7 +200,7 @@ function collectEnvSecrets(env = process.env) {
   return out;
 }
 
-function scrubSecrets(text, extraSecrets = []) {
+function scrubSecrets(text, extraSecrets = [], opts = undefined) {
   if (typeof text !== 'string' || text.length === 0) return text;
   let out = text;
   // Literal dynamic secrets first (longest first so a substring can't shadow a
@@ -190,7 +226,7 @@ function scrubSecrets(text, extraSecrets = []) {
   // Catch-all LAST: an unkeyed, unknown-shape, high-entropy token. The earlier
   // layers have already collapsed known secrets to "<redacted>" (no candidate),
   // so this only sweeps what survived.
-  out = redactHighEntropy(out);
+  out = redactHighEntropy(out, opts);
   return out;
 }
 

package/modules/status-ui/public/README.md

@@ -1,6 +1,6 @@
 # `modules/status-ui/public/` — the status dashboard ("The Watch")
 
-These files are the source of `status.example.com`. The surface moved here from `public-status/` in **BV1.R84** when the status dashboard became a first-class module ([ADR 0093](../../../docs/adr/<redacted>.md) §1); the loader's web-surface seam serves this `public/` dir on the `status.` host (see [`../CLAUDE.md`](../CLAUDE.md)). As of **#566 / [ADR 0029](../../../docs/adr/<redacted>.md)** they are **mirrored OFF-BOX** so the status page survives a droplet outage.
+These files are the source of `status.example.com`. The surface moved here from `public-status/` in **BV1.R84** when the status dashboard became a first-class module ([ADR 0093](../../../docs/adr/0093-tranche-2-core-carve-sequence.md) §1); the loader's web-surface seam serves this `public/` dir on the `status.` host (see [`../CLAUDE.md`](../CLAUDE.md)). As of **#566 / [ADR 0029](../../../docs/adr/0029-status-page-outage-resilience.md)** they are **mirrored OFF-BOX** so the status page survives a droplet outage.
 
 ## Why off-box
 

package/modules/ui-design/docs/design-contract.md

@@ -1,6 +1,6 @@
 # Design contract — neutral adapter interface
 
-**Status:** Accepted · authored by [task 1377](https://example.com/builders#/task/1377) · governed by [ADR 0081](../../../docs/adr/<redacted>.md) · lives in the `ui-design` module since [task 1003324](https://cloudbongos.com/builders#/task/1003324) ([ADR 0197](../../../docs/adr/<redacted>.md)) — the token files it names stay in `config/` as the host boundary
+**Status:** Accepted · authored by [task 1377](https://example.com/builders#/task/1377) · governed by [ADR 0081](../../../docs/adr/0081-tool-agnostic-design-layer.md) · lives in the `ui-design` module since [task 1003324](https://cloudbongos.com/builders#/task/1003324) ([ADR 0197](../../../docs/adr/0197-the-ui-design-module.md)) — the token files it names stay in `config/` as the host boundary
 
 The repo is the single source of truth for design. Every design tool is a swappable adapter that reads from and writes to this contract — it does not own the source. This file is the contract every adapter must conform to. The minimal validator (`modules/ui-design/scripts/validate-design.js`; `node scripts/gds/validate-design.js` is a thin shim over it) enforces the machine-checkable parts.
 
@@ -96,7 +96,7 @@ Rules:
 | Freeform canvas art | — | `assets/ui/<surface>/` | Asset |
 | Pixel-art game tiles | see `art/` pipeline | — | Art pipeline (not this contract) |
 
-Pixel-art game tiles (world tiles, characters, objects) are out of scope for this contract — they are governed by the `art/` pipeline and [ADR 0088](../../../docs/adr/<redacted>.md).
+Pixel-art game tiles (world tiles, characters, objects) are out of scope for this contract — they are governed by the `art/` pipeline and [ADR 0088](../../../docs/adr/0088-consistent-character-generative-animation.md).
 
 ---
 

package/modules/ui-design/kit/README.md

@@ -1,6 +1,6 @@
 # `modules/ui-design/kit/` — look before you ship
 
-The stub, the renderer/auditor, the interaction probes, the mock checker and the contrast probe any builder points at any surface of any instance ([task 1003320](https://cloudbongos.com/builders#/task/1003320), [ADR 0197](../../../docs/adr/<redacted>.md)). Plain Node; the browser is the system Edge or Chrome via `playwright-core` (a devDependency — nothing is downloaded).
+The stub, the renderer/auditor, the interaction probes, the mock checker and the contrast probe any builder points at any surface of any instance ([task 1003320](https://cloudbongos.com/builders#/task/1003320), [ADR 0197](../../../docs/adr/0197-the-ui-design-module.md)). Plain Node; the browser is the system Edge or Chrome via `playwright-core` (a devDependency — nothing is downloaded).
 
 ```
 node modules/ui-design/kit/serve.js                     # the stub (SURFACE, PREFIX, AUTH=1, CHILD=1, LIVE=…, FAIL=…, STYLE=<look>, STUB_PORT)

package/modules/ui-design/kit/serve.js

@@ -188,6 +188,7 @@ const STUB_VOCAB = {
   joinability: ['open', 'apply', 'invite_only'],
   visibility: ['public', 'private', 'stealth'],
   join_grant: ['view', 'apply', 'full'],
+  artist_gate: ['off', 'advisory', 'strict'],
   planet_template: null,   // the template set is long; shape is checked, not membership
   planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
   card_backdrop: ['nebula', 'dust', 'deepfield', 'chrome'],

package/modules/ui-design/skills/README.md

@@ -1,6 +1,6 @@
 # `modules/ui-design/skills/` — the vetted UI skills: the policy, the roster, and why the roster is what it is
 
-The home for third-party design skills the `ui-design` module ships to every builder on every instance where the module is on ([task 1003321](https://cloudbongos.com/builders#/task/1003321), [ADR 0198](../../../docs/adr/<redacted>.md)). A skill that lands here is **materialised** into a builder's `.claude/skills/<name>/` by `scripts/gds/claude-materialize.js` (step 1b) on `bongos init` / `bongos upgrade`, exactly like a core skill, and withdrawn when the instance disables the module.
+The home for third-party design skills the `ui-design` module ships to every builder on every instance where the module is on ([task 1003321](https://cloudbongos.com/builders#/task/1003321), [ADR 0198](../../../docs/adr/0198-third-party-skill-vendoring-policy.md)). A skill that lands here is **materialised** into a builder's `.claude/skills/<name>/` by `scripts/gds/claude-materialize.js` (step 1b) on `bongos init` / `bongos upgrade`, exactly like a core skill, and withdrawn when the instance disables the module.
 
 ## The policy (enforced by `tests/ui_design_skills.mjs`, declared in [`policy.json`](policy.json))
 
@@ -20,14 +20,14 @@ Two origins were scanned for the set scoped with the owner (impeccable; the elev
 
 | Skill (in-house name) | Upstream | Licence | Verdict | Landing |
 |---|---|---|---|---|
-| `impeccable` | `pbakaus/impeccable` @ `<redacted>` (skill v4.1.x) | Apache-2.0 | **dangerous** — floor: 3 critical (a `bypassPermissions` marker in the skill's own live copy-edit agent; an instruction-override phrase in a test fixture; a same-file credential-store + http-client co-occurrence in a test), 19 high (shipped PostToolUse + Stop hooks, credential-store references), 107 medium, 147 low; panel: hooks written into five harness configs (globally on a global install), a child agent spawned with permissions bypassed from a loopback HTTP route, an autonomy directive that tells the agent to disregard its system prompt, a live-server token embedded in page source, an unverified remote bundle download | rebuild spec → [task 1003326](https://cloudbongos.com/builders#/task/1003326) → rebuilt in-house as `impeccable/` ([ADR 0221](../../../docs/adr/<redacted>.md)) |
+| `impeccable` | `pbakaus/impeccable` @ `<redacted>` (skill v4.1.x) | Apache-2.0 | **dangerous** — floor: 3 critical (a `bypassPermissions` marker in the skill's own live copy-edit agent; an instruction-override phrase in a test fixture; a same-file credential-store + http-client co-occurrence in a test), 19 high (shipped PostToolUse + Stop hooks, credential-store references), 107 medium, 147 low; panel: hooks written into five harness configs (globally on a global install), a child agent spawned with permissions bypassed from a loopback HTTP route, an autonomy directive that tells the agent to disregard its system prompt, a live-server token embedded in page source, an unverified remote bundle download | rebuild spec → [task 1003326](https://cloudbongos.com/builders#/task/1003326) → rebuilt in-house as `impeccable/` ([ADR 0221](../../../docs/adr/0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md)) |
 | `design-taste-frontend`, `design-taste-frontend-v1`, `high-end-visual-design`, `minimalist-ui`, `industrial-brutalist-ui`, `redesign-existing-projects`, `gpt-taste`, `stitch-design-taste`, `image-to-code`, `imagegen-frontend-web`, `imagegen-frontend-mobile`, `brandkit` | `Leonxlnx/taste-skill` @ `<redacted>` | MIT | **dangerous** — floor: 1 critical (an injection-phrase hit at `skills/taste-skill/SKILL.md:892`, which the panel identifies as a filename placeholder; the floor is untouchable by design); panel: caution (1 medium: the only documented install path runs an unpinned third-party `npx` CLI; 21 low: mandated invocation of any available image-generation tool, unbounded image counts, remote assets and scripts in generated pages, an auto-loaded cross-agent instruction file) | rebuild spec → [task 1003325](https://cloudbongos.com/builders#/task/1003325) (the taste core, ADR 0220) and [task 1003328](https://cloudbongos.com/builders#/task/1003328) (the image family, ADR 0222) → rebuilt in-house |
 
 The eleven taste skills are single-file prose; the floor's one critical is a false positive in the human sense and a true positive in the scanner's — and the rule that makes the scanner worth having is that a session does not get to tell the difference. Vendoring any of them anyway is an **owner override recorded in an ADR**, not a judgement a task makes.
 
 ## The in-house rebuilds (2026-09-01)
 
-A rebuild spec becomes a **first-party skill** at `<name>/` — no `vendor/` segment, so the ratchets count it; no `PROVENANCE.md` or `LICENSE`, because an in-house skill claims no upstream; the same PLATFORM PREAMBLE first after the frontmatter, byte-identical; then a **`## Rebuilt from`** section naming the origin the *spec* was derived from (documentation only), the scan verdict, the spec task, the statement that no upstream bytes were consulted or copied, and what changed in translation ([ADR 0220](../../../docs/adr/<redacted>.md)). Declared in `module.json` like any other; `claude-materialize.js` step 1b lands it through its own-dir branch, which no sidecar gate touches. `tests/ui_design_skills.mjs` pins all of it. A rebuild whose method is a family of sub-commands ships as **one** skill dir with a `reference/<sub-command>.md` playbook beside the `SKILL.md`, exactly one loaded per request; the preamble is pinned once, in the `SKILL.md`, and governs every playbook ([ADR 0221](../../../docs/adr/<redacted>.md)). A rebuild whose upstream shipped a **look** carries a composition grammar and no colours of its own — the palette is the instance's pack and the texture is a named entry in [`../styles/`](../styles/README.md) ([ADR 0230](../../../docs/adr/<redacted>.md)).
+A rebuild spec becomes a **first-party skill** at `<name>/` — no `vendor/` segment, so the ratchets count it; no `PROVENANCE.md` or `LICENSE`, because an in-house skill claims no upstream; the same PLATFORM PREAMBLE first after the frontmatter, byte-identical; then a **`## Rebuilt from`** section naming the origin the *spec* was derived from (documentation only), the scan verdict, the spec task, the statement that no upstream bytes were consulted or copied, and what changed in translation ([ADR 0220](../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md)). Declared in `module.json` like any other; `claude-materialize.js` step 1b lands it through its own-dir branch, which no sidecar gate touches. `tests/ui_design_skills.mjs` pins all of it. A rebuild whose method is a family of sub-commands ships as **one** skill dir with a `reference/<sub-command>.md` playbook beside the `SKILL.md`, exactly one loaded per request; the preamble is pinned once, in the `SKILL.md`, and governs every playbook ([ADR 0221](../../../docs/adr/0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md)). A rebuild whose upstream shipped a **look** carries a composition grammar and no colours of its own — the palette is the instance's pack and the texture is a named entry in [`../styles/`](../styles/README.md) ([ADR 0230](../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md)).
 
 | Skill | Rebuilt from (spec) | Task | What it is |
 |---|---|---|---|
@@ -45,17 +45,17 @@ A rebuild spec becomes a **first-party skill** at `<name>/` — no `vendor/` seg
 | `imagegen-frontend-mobile` | `Leonxlnx/taste-skill` @ `<redacted>` | [task 1003328](https://cloudbongos.com/builders#/task/1003328) | portrait plates for the 390 and 320 compositions, clear of the regions a phone reserves, the first view held to one focal point, a scrim under text over a plate; a screen is the states file rendered by the kit; no phone mockups, no flows of screens; native declines |
 | `brandkit` | `Leonxlnx/taste-skill` @ `<redacted>` | [task 1003328](https://cloudbongos.com/builders#/task/1003328) | the identity system with the strategy inferred first and the logo standard kept: the mark drawn as SVG, the colour system as the pack, the type specimen as the faces, the applications as the kit's renders, the image direction as a hero-object family, the board as a contact sheet; never a generated logo, board or mockup |
 
-What every rebuild does with the upstream's opinions, in the same words: the palette is the pack and a variant is a look from [`../styles/`](../styles/README.md); the design system is the instance's `DESIGN.md`; images are hero plates and hero objects by token and never a step; every motion rule lives inside the Kill Switch (springs, magnetic hover, pointer-tracked borders are named *not available*); the upstream's bans are defaults an instance's `DESIGN.md` overrides; the kit's renders are the pre-flight. The image family (task 1003328, [ADR 0222](../../../docs/adr/<redacted>.md)) carries the one rewrite the upstream never had: images are for text-free hero plates and hero objects only, so a screen is the surface itself, the mark is drawn, the board is a contact sheet, and what ships is the pair (a black-ground JPEG for dark, an alpha WebP cutout for light) with a provenance sidecar beside every file, through the instance's art pipeline key. The four looks (task 1003327, [ADR 0230](../../../docs/adr/<redacted>.md)) carry the other rewrite: a look skill ships structure, rhythm, type roles, component anatomy, motion and bans and **no colours**, so a substrate becomes an archetype that still ships both modes, a prompt-seeded roll becomes a deterministic selection derived from the route, a design document transcribes the world instead of authoring one, and the upstream's seeded placeholder photography is dropped rather than softened. The whole scoped set of thirteen is now rebuilt in-house; nothing from either origin is still waiting on a spec.
+What every rebuild does with the upstream's opinions, in the same words: the palette is the pack and a variant is a look from [`../styles/`](../styles/README.md); the design system is the instance's `DESIGN.md`; images are hero plates and hero objects by token and never a step; every motion rule lives inside the Kill Switch (springs, magnetic hover, pointer-tracked borders are named *not available*); the upstream's bans are defaults an instance's `DESIGN.md` overrides; the kit's renders are the pre-flight. The image family (task 1003328, [ADR 0222](../../../docs/adr/0222-the-image-family-under-the-hero-only-rule.md)) carries the one rewrite the upstream never had: images are for text-free hero plates and hero objects only, so a screen is the surface itself, the mark is drawn, the board is a contact sheet, and what ships is the pair (a black-ground JPEG for dark, an alpha WebP cutout for light) with a provenance sidecar beside every file, through the instance's art pipeline key. The four looks (task 1003327, [ADR 0230](../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md)) carry the other rewrite: a look skill ships structure, rhythm, type roles, component anatomy, motion and bans and **no colours**, so a substrate becomes an archetype that still ships both modes, a prompt-seeded roll becomes a deterministic selection derived from the route, a design document transcribes the world instead of authoring one, and the upstream's seeded placeholder photography is dropped rather than softened. The whole scoped set of thirteen is now rebuilt in-house; nothing from either origin is still waiting on a spec.
 
 ## First-party originals (2026-09-02)
 
-A skill the platform wrote from nothing declares the **other** origin. It lives at `<name>/` like a rebuild, opens with the same PLATFORM PREAMBLE, and carries a **`## First party`** section instead: the task that authored it, the plain statement that it has no upstream, [ADR 0231](../../../docs/adr/<redacted>.md), and **why it exists** — since it has no spec to point at, that sentence is the only provenance a reader gets. `tests/ui_design_skills.mjs` asserts a skill carries **exactly one** of the two sections and branches its pins on which; everything else (the preamble, the frontmatter, no sidecar, no licence text, the style library named, no image mandate, the switch, the kit as the pre-flight) applies to both kinds unchanged. Fabricating a `## Rebuilt from` for an original was rejected: the section exists so a reader can trace provenance, and a fabricated one destroys exactly that.
+A skill the platform wrote from nothing declares the **other** origin. It lives at `<name>/` like a rebuild, opens with the same PLATFORM PREAMBLE, and carries a **`## First party`** section instead: the task that authored it, the plain statement that it has no upstream, [ADR 0231](../../../docs/adr/0231-the-style-session-an-owner-authors-a-look-inside-the-contract.md), and **why it exists** — since it has no spec to point at, that sentence is the only provenance a reader gets. `tests/ui_design_skills.mjs` asserts a skill carries **exactly one** of the two sections and branches its pins on which; everything else (the preamble, the frontmatter, no sidecar, no licence text, the style library named, no image mandate, the switch, the kit as the pre-flight) applies to both kinds unchanged. Fabricating a `## Rebuilt from` for an original was rejected: the section exists so a reader can trace provenance, and a fabricated one destroys exactly that.
 
 | Skill | Origin | Task | What it is |
 |---|---|---|---|
 | `style` | first party (no upstream) | [task 1003475](https://cloudbongos.com/builders#/task/1003475) | the `/style` session: four bounded steps in which an owner authors their own look as a branding pack. SEARCH renders the nearest two library entries before asking two or three questions about feel; CREATE drafts the three files inside the contract, never a fork of a sheet and never a sixteenth token; PROVE retunes the thirteen against `contrast.js`, the styles suite, `check-mock.js` and the renders with a failure-to-fix table so the retune is arithmetic; ADOPT hands the owner the one-step switch, never writes `config/branding.json`, and files the catalogue rows. Its first output is [`../styles/blueprint`](../styles/README.md), the library's first cool look |
 
-**In the core checkout itself**, where these skills are written, Claude Code reads only `.claude/skills/` at the repo root and the materialiser's self-copy guard leaves it empty of module skills. `node scripts/gds/claude-materialize.js --module-skills-only` lands every enabled module's skills there as untracked, self-ignored copies (a generated `.claude/skills/.module-skills.json` manifest and a `.gitignore` beside them; `--clean` removes them; the file map skips them by the manifest) so a builder can invoke them here too ([task 1003330](https://cloudbongos.com/builders#/task/1003330), [ADR 0224](../../../docs/adr/<redacted>.md)). Edit the module's `skills/<name>/`, never the copy, and re-run to refresh.
+**In the core checkout itself**, where these skills are written, Claude Code reads only `.claude/skills/` at the repo root and the materialiser's self-copy guard leaves it empty of module skills. `node scripts/gds/claude-materialize.js --module-skills-only` lands every enabled module's skills there as untracked, self-ignored copies (a generated `.claude/skills/.module-skills.json` manifest and a `.gitignore` beside them; `--clean` removes them; the file map skips them by the manifest) so a builder can invoke them here too ([task 1003330](https://cloudbongos.com/builders#/task/1003330), [ADR 0224](../../../docs/adr/0224-module-skills-reach-the-core-checkout-as-untracked-self-ignored-copies.md)). Edit the module's `skills/<name>/`, never the copy, and re-run to refresh.
 
 **The playwright plugin** (`claude-plugins-official`, an MCP plugin) is the LIVE browser-driving loop, where the kit is the headless one. It is a prerequisite, documented — `claude plugin install playwright@claude-plugins-official` — never vendored.
 

package/modules/ui-design/skills/brandkit/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `brandkit` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the `[brandkit]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `brandkit` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the `[brandkit]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/0222-the-image-family-under-the-hero-only-rule.md).
 
 What changed in translation, on purpose: the upstream delivered **brand identity imagery**: logo systems, nine-panel guideline boards, identity decks and visual-world presentations, all as generated images carrying a brand name, a tagline, labels and interface chips. Under the owner's rule an image with letters in it is not a hero plate, and a mockup of an interface is a screenshot of a screen. So here every panel of the board lands as the thing it depicted: the **mark is drawn** (an inline SVG, the world's one mark, a code asset with a construction comment), the **colour system is the pack** (`config/branding.json`, the fifteen), the **type specimen is the pack's two faces** on a real page, the **applications are the platform's own surfaces** (the front door, the hall, a look's specimen) rendered by the kit, and the **image direction is a hero-object family**: one object in the world's materials, text-free, in pairs with sidecars. The board itself is a **contact sheet** assembled from the kit's shots and the plates, a review artifact rather than a generation. The strategy inference, the logo standard, the five concept methods, the rhythm, the colour discipline and the reference rule survive unchanged.
 

package/modules/ui-design/skills/design-taste-frontend/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `taste-skill` entry, "design-taste-frontend v2"), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**, and the landing shape (the in-house `skills/<name>/` home, this section in place of a `PROVENANCE.md`) is [ADR 0220](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `taste-skill` entry, "design-taste-frontend v2"), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**, and the landing shape (the in-house `skills/<name>/` home, this section in place of a `PROVENANCE.md`) is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md).
 
 What changed in translation, on purpose: the upstream skill mandated image generation as a first step and accepted seeded placeholder photography; here **imagery is hero plates and hero objects only, by token, and never a step**. Its "foundation" step installed a vendor's design-system package; here **the foundation is the instance's world** (`DESIGN.md` and its pack), and the style library is where variants come from. Its motion rules assumed a script-driven animation stack; here **every rule lives inside the Kill Switch** and nothing moves in JavaScript. Its bans (the long dash, decorative labels) are kept as defaults that an instance's own `DESIGN.md` bans override.
 

package/modules/ui-design/skills/design-taste-frontend-v1/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `taste-skill-v1` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**; the landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `taste-skill-v1` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**; the landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md).
 
 What changed in translation, on purpose: the upstream generation was written for a component framework with a motion library; a platform surface here is static markup, one sheet and the instance's transforms, so the stack conventions are restated for that and **every motion rule lives inside the Kill Switch** (the spring, the magnetic hover and the shared-element transition, which need script, are named as not available rather than quietly kept). The typography and colour rules are read **against the instance's pack**: the pack's faces are the faces and the pack's accent is the accent, whatever this skill would have preferred. Imagery follows the owner's rule (hero plates and hero objects only).
 

package/modules/ui-design/skills/gpt-taste/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `gpt-tasteskill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325) — the `[gpt-taste]` requirement group — and this file is its port under [task 1003327](https://cloudbongos.com/builders#/task/1003327); it implements those requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md); what a *look* skill is allowed to be is [ADR 0230](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `gpt-tasteskill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325) — the `[gpt-taste]` requirement group — and this file is its port under [task 1003327](https://cloudbongos.com/builders#/task/1003327); it implements those requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); what a *look* skill is allowed to be is [ADR 0230](../../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md).
 
 What changed in translation, on purpose: the upstream asked the agent to **simulate a random number generator** seeded from the prompt and let the roll pick the design. A roll nobody can reproduce is not a decision, and the same roll on a sibling surface is a coincidence rather than a system — so the selection here is **deterministic and written down**: derived from the surface's own route, recorded in the plan block, and checked against what its siblings already used. Its "type stack" selection is gone; the pack carries two stacks and this skill does not add a face. Its ambient graded backgrounds are `color-mix()` radials of the fifteen, never a new colour. Its **filtered seeded placeholder photography is dropped entirely** — the only rasters this skill may ask for are text-free hero plates under the owner's rule, and a surface with no plate ships without one. Its scroll-motion paradigms survive only as CSS scroll-driven animation inside the Kill Switch: pinned titles, scrubbed reveals and stacking cards are available that way; pointer-tracked physics and shared-element transitions are named *not available* rather than faked in script.
 

package/modules/ui-design/skills/high-end-visual-design/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `soft-skill` entry, "high-end-visual-design"), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**; the landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `soft-skill` entry, "high-end-visual-design"), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**; the landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md).
 
 What changed in translation, on purpose: the upstream skill specified **the** fonts and shadows that make a site feel expensive; here the fonts are the pack's two stacks and a shadow exists only where the instance's world has one (the chrome world has exactly one, and it belongs to the sculpture). Its texture archetypes become the looks in the style library; its layout archetypes stay free. Its motion (a hamburger morph, a blurred full-screen menu, an 800ms blurred fade-up on scroll) is kept as CSS inside the Kill Switch, and the scroll entry is honest about what a static page can do. Imagery follows the owner's rule: hero plates and hero objects by token, never a step.
 

package/modules/ui-design/skills/image-to-code/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `image-to-code` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the `[image-to-code]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `image-to-code` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the `[image-to-code]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/0222-the-image-family-under-the-hero-only-rule.md).
 
 What changed in translation, on purpose: the upstream's mandatory order was **generate the design images, analyse them, implement**, with the generated image as the source of truth, one large render per section, and a ban on freeform coding whenever a generator was available. The owner's rule is the opposite for UI: image generation is for text-free hero plates and hero objects only, and an image model re-rendering a template costs credits and drifts, so **the owner's reference images and the instance's world are the source of truth**, the sections are rebuilt from the world's templates, and the one generated image is the hero plate the composition has a slot for (through `imagegen-frontend-web`). The analysis discipline, the extraction spec, the faithful-copy rule, the drift bans, the hero rules, the clutter bans and the clarity checklist all survive; they now read the references instead of a generated set. The eagerness mandate and the image-count rule are gone.
 

package/modules/ui-design/skills/imagegen-frontend-mobile/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `imagegen-frontend-mobile` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the `[imagegen-frontend-mobile]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `imagegen-frontend-mobile` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the `[imagegen-frontend-mobile]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/0222-the-image-family-under-the-hero-only-rule.md).
 
 What changed in translation, on purpose, and it is the largest change in the family: the upstream produced **premium mobile app screen images**, one per screen, inside a phone mockup, as an ordered flow with an internal design bible. A screen image is a screenshot of a screen, which the preamble bans on every instance, and a phone mockup is a frame around one. So here the **screen is the surface itself**, rendered by the kit at 390 and 320 from its states file; the **flow** is the states file's order; the **design bible** is the instance's `DESIGN.md` and its pack; and what this skill generates is only what the narrow composition has a slot for: a portrait masthead, a field behind the fold, a small object in a row. The platform-mode choice (one mobile operating system or the other) becomes a decline: every surface here is a served web page, and a native app target routes to `/design`. The first-screen rule, the mobile realities, the scrim rule and the slop bans survive, applied to plates.
 

package/modules/ui-design/skills/imagegen-frontend-web/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `imagegen-frontend-web` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the `[imagegen-frontend-web]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `imagegen-frontend-web` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the `[imagegen-frontend-web]` group in the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); the port is [task 1003328](https://cloudbongos.com/builders#/task/1003328); this file implements the requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); the hero-only rewrite this family carries is [ADR 0222](../../../../docs/adr/0222-the-image-family-under-the-hero-only-rule.md).
 
 What changed in translation, on purpose: the upstream produced **one horizontal design-reference image per section**, scaled the image count with the section count, refused to stop early, and treated imagery as a material several sections had to carry. The owner's rule (2026-08-26, reaffirmed 2026-08-27) is that image generation is for **text-free hero plates and hero objects only**; UI is rebuilt from templates and the instance's world, never painted. So here the count is the number of plate slots the composition already has (usually one to three), a plate never carries a section, a headline, a control or a screen, and the panel's eagerness mandate, its image-count mandate and its must-invoke-any-tool directive are gone. The composition-variety rules, the palette lock and the cross-frame consistency survive and now govern a family of plates rather than a set of frames. The palette lock is the pack; the key is the instance's art pipeline; the output contract is DESIGN.md's pair-and-sidecar convention.
 

package/modules/ui-design/skills/impeccable/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `pbakaus/impeccable` @ `<redacted>` (Apache-2.0; skill v4.1.x), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28: three critical findings at the deterministic floor and a panel that upheld PostToolUse and Stop hooks written into five harness configs, a child agent spawned with its permissions bypassed from a loopback HTTP route, a setup directive that overrode the harness's own instructions, a live-server credential embedded in page source, an unverified remote bundle, and default-on telemetry. Under [ADR 0198](../../../../docs/adr/<redacted>.md) that verdict lands a REBUILD-SPEC, never a copy. The spec is the body of [task 1003326](https://cloudbongos.com/builders#/task/1003326), derived from the origin's documentation only; this file and the playbooks under `reference/` implement its requirements from scratch, **no upstream bytes consulted or copied**. The landing shape (the in-house `skills/<name>/` home, this section in place of a `PROVENANCE.md`) is [ADR 0220](../../../../docs/adr/<redacted>.md); the sub-command shape (one skill, one playbook per sub-command, what was kept and what was dropped) is [ADR 0221](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `pbakaus/impeccable` @ `<redacted>` (Apache-2.0; skill v4.1.x), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28: three critical findings at the deterministic floor and a panel that upheld PostToolUse and Stop hooks written into five harness configs, a child agent spawned with its permissions bypassed from a loopback HTTP route, a setup directive that overrode the harness's own instructions, a live-server credential embedded in page source, an unverified remote bundle, and default-on telemetry. Under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) that verdict lands a REBUILD-SPEC, never a copy. The spec is the body of [task 1003326](https://cloudbongos.com/builders#/task/1003326), derived from the origin's documentation only; this file and the playbooks under `reference/` implement its requirements from scratch, **no upstream bytes consulted or copied**. The landing shape (the in-house `skills/<name>/` home, this section in place of a `PROVENANCE.md`) is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); the sub-command shape (one skill, one playbook per sub-command, what was kept and what was dropped) is [ADR 0221](../../../../docs/adr/0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md).
 
 What changed in translation, on purpose. The method's **three persisted homes** (product truth, the visual system, per-surface briefs) are the instance's own files here: product truth is `docs/project-context.template.md` and the identity block of the branding pack, the visual system is the root `DESIGN.md` (and a look's `DESIGN.md` under `modules/ui-design/styles/`), and a surface's brief is the claimed task's body and ship notes. This skill creates none of them and writes the root `DESIGN.md` only through the `document` playbook, as a draft on the claim's branch the owner reviews. Everything the panel flagged is **gone, not disabled**: no hook is written anywhere, no child agent runs with permissions bypassed (a reviewer is an ordinary subagent through the harness's own Agent tool), nothing is reported home, nothing is downloaded, and there is no live helper server. The **live loop** is the playwright plugin (a documented prerequisite) driving the module's stub; the **headless loop** is `kit/render.js` and `kit/probe.js`. The **anti-pattern detector** is not shipped here: task 1003329 lands it as rules in `kit/check-mock.js` and `kit/lib.js`, and until then the floor is what the kit already measures. The **native playbooks** (the two mobile platforms) are not rebuilt: every surface on this platform is a served web page, so a native target declines to `/design` with one line. The `init`, `doctor`, `pin`, `unpin` and installer operations, which existed to write and repair the origin's own config and harness entries, have no counterpart: the materialiser is the install. Imagery follows the owner's rule (hero plates only, task 1003328 for the image family); the palette is the pack and a variant is a look from the style library; every motion rule lives inside the Kill Switch.
 

package/modules/ui-design/skills/industrial-brutalist-ui/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `brutalist-skill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325) — the `[industrial-brutalist-ui]` requirement group — and this file is its port under [task 1003327](https://cloudbongos.com/builders#/task/1003327); it implements those requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md); what a *look* skill is allowed to be is [ADR 0230](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `brutalist-skill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325) — the `[industrial-brutalist-ui]` requirement group — and this file is its port under [task 1003327](https://cloudbongos.com/builders#/task/1003327); it implements those requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); what a *look* skill is allowed to be is [ADR 0230](../../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md).
 
 What changed in translation, on purpose: the upstream's central rule was **one substrate per project** — off-white document paper *or* near-black terminal, never both. A platform surface here ships **both modes on every page** (the preamble's dark twins), so the substrate choice becomes an **archetype** that decides which mode the surface is *composed for* while the other mode is still complete and still measured. Its hazard red and optional terminal green are not new colours: red is the pack's `terracotta`, green is the pack's `sea`, and neither may appear a third time. Its "zero corner rounding" is legal because a radius is a **derived tier**, not one of the fifteen — a brutalist sheet sets its own radii to 0 and says so in the header comment; where the instance's `DESIGN.md` names a radius as a signature, the instance wins. Its degradation effects (halftone, dithering, scanlines, noise) survive as CSS built from the one legal literal, pure black or white with alpha, and every one of them is static: a scanline that crawls is an animation, and it dies under the Kill Switch with everything else. Its "high-contrast serif after heavy degradation" is dropped unless the pack already carries a serif; this skill does not add a face.
 

package/modules/ui-design/skills/minimalist-ui/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `minimalist-skill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325) — the `[minimalist-ui]` requirement group — and this file is its port under [task 1003327](https://cloudbongos.com/builders#/task/1003327); it implements those requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md); what a *look* skill is allowed to be is [ADR 0230](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `minimalist-skill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325) — the `[minimalist-ui]` requirement group — and this file is its port under [task 1003327](https://cloudbongos.com/builders#/task/1003327); it implements those requirements from scratch, **no upstream bytes consulted or copied**. The landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md); what a *look* skill is allowed to be is [ADR 0230](../../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md).
 
 What changed in translation, on purpose: the upstream shipped a **palette** (white or warm bone canvas, near-white cards, washed-out pastel accents each with its own darker text tone). Here that palette is a **look in the library** — `modules/ui-design/styles/expedition` is the warm-paper entry this skill was tuned against — and the canvas is whatever `bg` / `bg-card` the instance's pack carries. The upstream's editorial serif for hero headings becomes the pack's `display` stack; a face this skill wants and the pack does not have is a pack change, not a page's `@font-face`. Its pastels become `color-mix()` of the pack's `accent`, `sea` and `terracotta` against `bg-card`, each paired with the contract's own ink for that field, so a badge is measured rather than guessed. Its imagery clause is gone: **seeded placeholder photography does not exist here**, and the only rasters this skill may ask for are text-free hero plates under the owner's rule. Its ban on pill shapes for primary buttons is a default an instance's `DESIGN.md` overrules — Cloud Bongos's own door pill is that world's signature and wins. Its entry motion survives only inside the Kill Switch.
 

package/modules/ui-design/skills/redesign-existing-projects/SKILL.md

@@ -23,7 +23,7 @@ description: >-
 
 ## Rebuilt from
 
-This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `redesign-skill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/<redacted>.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**; the landing shape is [ADR 0220](../../../../docs/adr/<redacted>.md).
+This skill is an **in-house rebuild**, not a vendored copy. Its documented functionality comes from `Leonxlnx/taste-skill` @ `<redacted>` (MIT; the `redesign-skill` entry), which `/scan-before-install` reduced to `dangerous` at the default tier on 2026-08-28, so under [ADR 0198](../../../../docs/adr/0198-third-party-skill-vendoring-policy.md) it could land only as a REBUILD-SPEC. The spec is the body of [task 1003325](https://cloudbongos.com/builders#/task/1003325); this file implements its requirements from scratch, **no upstream bytes consulted or copied**; the landing shape is [ADR 0220](../../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md).
 
 What changed in translation, on purpose: the upstream audit carried its own opinions (pure black backgrounds are a defect, flat sections are unfinished); here **the instance's world is the answer key**, so an audit row is a defect only where the world does not call for it (the chrome world's dark ground is pure black by the owner's decision, and its bands are flat by design). The upgrade catalogue marks each technique **CSS-only or not available** on a platform where nothing moves in script. Imagery follows the owner's rule.