@bongos/core 1.19.89 → 1.19.90

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.89",
-  "core_contract": "1.19.89",
-  "source_commit": "ed4e7542e4437ae70c78dc251b624ee4890a6050",
+  "core_version": "1.19.90",
+  "core_contract": "1.19.90",
+  "source_commit": "45d0b3918cf244fda1eb923ed5d62224bc5885cb",
   "source_ref": "HEAD",
-  "built_at": "2026-08-13T01:22:32.002Z",
+  "built_at": "2026-08-13T15:51:02.618Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 297,
+    "docs_redacted": 298,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1235,
+    "functional_verbatim": 1239,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1553,
-  "tree_sha256": "9f17eea1b4e64561bd3da49f5fd8494e53ea0ea55d4d860862a1763788507e36",
+  "file_count": 1558,
+  "tree_sha256": "7dc9f0a0062008bfdc80372316b3d7ff5ce73181237509094f584b99efe5573d",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "config/branding.neutral.json",
       "mode": "0000644",
-      "sha256": "d7e12cadd0e4cbcbe3b03e5ff0aedcd55f9ec592c754d258e6ac85e9b98c0009"
+      "sha256": "48460f6fba8d39293c091cc1cd908896bd670c5eae5bab8665f755211e0f5790"
     },
     {
       "path": "config/design-tokens.neutral.json",
@@ -1364,11 +1364,31 @@
       "mode": "0000644",
       "sha256": "90bed9a9f3859f7cfc6dd8a0e23e70adeda5854be0b10f8208d60a96c83403b3"
     },
+    {
+      "path": "docs/design/landing-page-direction.md",
+      "mode": "0000644",
+      "sha256": "445344b91eee651e2831fe74ce30d317a4fd4f6310475cb8fd924edd883f9f95"
+    },
+    {
+      "path": "docs/design/mocks/_schemes.css",
+      "mode": "0000644",
+      "sha256": "b765820040413ebe4f123f5d67f6daaf5955ccbc76d16f34eb8fc8bd65d7bb21"
+    },
     {
       "path": "docs/design/mocks/component-sheet.html",
       "mode": "0000644",
       "sha256": "c77dbf2152c6109b6ce925e2badf6dfaa74f74c2d0cb7eb76fa1101eec7b3310"
     },
+    {
+      "path": "docs/design/mocks/landing-page-mock.html",
+      "mode": "0000644",
+      "sha256": "89106dce576bc0777aa63ec6ac0dde61a68317bef53de0fb6edf47870f0cdd04"
+    },
+    {
+      "path": "docs/design/mocks/landing-palettes.html",
+      "mode": "0000644",
+      "sha256": "c277f432a0d3e23e481bae01355f5f11648ee9a6593f665a809d8f406ebbe033"
+    },
     {
       "path": "docs/design/mocks/projects-page-mock.html",
       "mode": "0000644",
@@ -2422,22 +2442,22 @@
     {
       "path": "modules/dev-box/app/assets/tray/win-alert.png",
       "mode": "0000644",
-      "sha256": "a3f2818d0d0e6ddb7a661b6fe7aba034159cb45237fc16666a29bd2040f5c71d"
+      "sha256": "ce381ff0ae4d29c684d0e864c4f05806548b24da4c17b900a4b87fb7d7b977a7"
     },
     {
       "path": "modules/dev-box/app/assets/tray/win-busy.png",
       "mode": "0000644",
-      "sha256": "2cd13825a32e2db24d333e5693976ad257b5cfb29afec6deeba618727e44e29e"
+      "sha256": "f330901daeb01ba88b60622dfb04030bce131807c0b8ec488d628c1710b16c9c"
     },
     {
       "path": "modules/dev-box/app/assets/tray/win-off.png",
       "mode": "0000644",
-      "sha256": "9280082a9a01ad3aeb217f105e3aa3bcecaa8ee8eb2172e86605c63364a5211f"
+      "sha256": "f3ad8ff1f1d31228699133d9b6fc64f5f09cad4cd3e7a69fa68643a554a50d30"
     },
     {
       "path": "modules/dev-box/app/assets/tray/win-on.png",
       "mode": "0000644",
-      "sha256": "248c66afd5eaed026443828b14cbbead2c434fa66051779521e7ef5650eeb0f0"
+      "sha256": "6611cb8cbe81102028705085ec5f093d056f7b4f82220cefe25acdab68156367"
     },
     {
       "path": "modules/dev-box/app/build-resources/dmg-background.png",
@@ -2452,7 +2472,7 @@
     {
       "path": "modules/dev-box/app/build-resources/icon.png",
       "mode": "0000644",
-      "sha256": "738d433ed87fb81b3397183adcccedab85599e703fb91de3519bd95bd9282780"
+      "sha256": "03edf4c2ad4d5059f28e641e37b5b932087b508aeca23f64251b00ec1eea29f0"
     },
     {
       "path": "modules/dev-box/app/electron-builder.tmpl.yml",
@@ -2492,7 +2512,7 @@
     {
       "path": "modules/dev-box/app/renderer/theme.generated.css",
       "mode": "0000644",
-      "sha256": "51d6f3172c84f223aad44cf3deecfa215c615708ce99152123564af0018b3599"
+      "sha256": "579376e7f7bccc9632a739942d20f3dfe6fb3a75e7118bf0f2503ea315faa574"
     },
     {
       "path": "modules/dev-box/app/scripts/apply-dmg-backdrop.sh",
@@ -2507,17 +2527,17 @@
     {
       "path": "modules/dev-box/app/scripts/gen-brand.js",
       "mode": "0000644",
-      "sha256": "e8b3881dbb0682a59da9d87d3e83947e3666367d53b990185a17444a69aafcc0"
+      "sha256": "37d7b4d6c3ea5e0cfa7e280353b3adb9f68b7c5e7bababfe1c1ba809706dd145"
     },
     {
       "path": "modules/dev-box/app/scripts/gen-dmg-backdrop.py",
       "mode": "0000644",
-      "sha256": "f60e668536f6ba03e5df4e81fcb5ce0a3edbb90dcafeb787c33fd794793b518a"
+      "sha256": "8493db368ac3364f559f166eea3421a4e85c11503d056e8eb3e41e70ac1198cc"
     },
     {
       "path": "modules/dev-box/app/scripts/gen-icons.js",
       "mode": "0000644",
-      "sha256": "97859dc44a5786f7cc691368d110587934e1c4e55fdc5bbdc919493d6700ab00"
+      "sha256": "b6dd666505d4c0c3d28b69082945792c88a78cc40ac79191921dec196a904d28"
     },
     {
       "path": "modules/dev-box/app/scripts/vendor-client.js",
@@ -4092,12 +4112,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "91af9550ea511beb785aeda73ead01cc94c2f10b0e6bfb63a5704190fa12fb3b"
+      "sha256": "e2360c5ef62eeb078207fc6b3e1230d4f7099a58f2c78c6b204d5de6df1a4ba2"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ad3a6daa031c56fe45c5bc5de6036e8e97621e92888135406ed1c3cf5227f3bb"
+      "sha256": "34e9ad3018b2d905c6cf60f10bb9ddc6db4b9547facf4df8ee6284f646c93201"
     },
     {
       "path": "public-docs/index.html",
@@ -4337,7 +4357,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "571c051fbd678d17a35202785ee42092886b9ffb17222e7d8dc21d97f20bf1e5"
+      "sha256": "d38bef9066bf2cc7cf2fbe493af5e9dd7a4f4b20f7f051460e72fc6c0d98012d"
     },
     {
       "path": "public-landing/buddha.png",
@@ -4347,7 +4367,7 @@
     {
       "path": "public-landing/create.html",
       "mode": "0000644",
-      "sha256": "5f8dda878cea216fad95f722c4d17e8d35629e7e6040cf547eafcae1fb86d001"
+      "sha256": "efcc1894c06d1f4755028ae554707a61f8ef6e6753d7d7554f94e3748910f155"
     },
     {
       "path": "public-landing/gate/README.md",
@@ -5732,7 +5752,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2bcad1ce4253a64c908a01fb38cf76a7543fac19a12ff949864de4a08a339861"
+      "sha256": "fb1e1a8efafde2d29df7b9dd4e9de53a985a858b7f0a26517baf1632c4227d96"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6202,7 +6222,7 @@
     {
       "path": "tests/cloud_bongos_pack.mjs",
       "mode": "0000644",
-      "sha256": "7d4277afa6566c6287d71e9ca31333ebf0f6d8532d299537bbc7fa64ab73d86d"
+      "sha256": "edfa4f2dad99e969d45b3fe37bc88aa9d0926d24d907cd8dade2ca0ee467ab11"
     },
     {
       "path": "tests/conductor.mjs",
@@ -6229,6 +6249,11 @@
       "mode": "0000644",
       "sha256": "55bd70efd8067e39d6220d14f78c743ce80d8a8ff37988acf00136b5108dc004"
     },
+    {
+      "path": "tests/cosmos_token_contrast.mjs",
+      "mode": "0000644",
+      "sha256": "f295115dbefe49aef1ac4cb9b34404952fb92c858d45f00af2caacee580ec9ce"
+    },
     {
       "path": "tests/cost.mjs",
       "mode": "0000644",

package/config/branding.neutral.json

@@ -35,9 +35,9 @@
     "ui": {
       "colors": {
         "bg": "#fff7ed", "bgCard": "#ffffff", "bgDeep": "#ffedd5", "bgFrame": "#fde4c8",
-        "ink": "#2a1f17", "inkSoft": "#6b5d52", "inkFaint": "#857567",
+        "ink": "#2a1f17", "inkSoft": "#6b5d52", "inkFaint": "#756a60",
         "rule": "#fdba74", "ruleSoft": "#fed7aa",
-        "accent": "#f97316", "accentDeep": "#ea580c", "sea": "#38bdf8", "terracotta": "#fb7185"
+        "accent": "#ce4806", "accentDeep": "#9e3406", "sea": "#38bdf8", "terracotta": "#fb7185"
       },
       "fonts": {
         "display": "\"Baloo 2\", \"Quicksand\", system-ui, sans-serif",

package/docs/design/landing-page-direction.md

@@ -0,0 +1,176 @@
+# The Landing Page — Direction
+
+> **Task 1002747** (goal 1000061 "Apex UI pass") · decided with the owner 2026-08-13.
+> The mock this approves: [`mocks/landing-page-mock.html`](mocks/landing-page-mock.html).
+> Palette comparison sheet: [`mocks/landing-palettes.html`](mocks/landing-palettes.html) ·
+> candidate tokens: <redacted>
+
+Scope: the **look and content spine** of the page that answers `cloudbongos.com/`. Structure was
+already settled by [`front-door-and-hub-direction.md`](front-door-and-hub-direction.md), whose §7
+deferred the visual design to this pass and told it to take the structure as given. This document
+does not reopen structure. It also does **not** cover the hub — that is the next surface.
+
+---
+
+## 1. Decisions (owner, 2026-08-13)
+
+1. **The hero is the bongo pair, not the buddha.** Animated, pulsing on a beat.
+2. **The palette is `ember marigold`** — the existing sunrise with the milk taken out.
+3. **One file, with a server-side apex conditional.** `public-landing/index.html` renders two
+   shapes rather than the platform getting its own landing file.
+4. **`landingPage()` gains server-side head injection** — `og:`/`twitter:`/`canonical` are stamped
+   from the server-side `branding()`, in this pass. This closes idea 1000715.
+
+## 2. The hero — why the drums beat the buddha
+
+The mascot was the obvious hero and is not the right one.
+
+- **The bongo pair is already the brand mark.** `config/branding.neutral.json`'s favicon is two
+  circles, big and small, with lighter heads. The hero is that mark made dimensional, so the tab
+  icon and the hero are the same object rather than two unrelated illustrations.
+- **It re-themes.** It is inline SVG whose every fill is a token, so it follows the palette. The
+  buddha is a fixed raster and would have pinned one instance's art onto every instance's landing
+  page — the same portability problem as the social tags.
+- **It is ~3KB against 1.3MB.** The buddha hero is 44 webp frames above the fold.
+- **It animates the tagline.** "Building software is laying down a beat" is a claim about rhythm;
+  a drum being played states it, a seated figure only implies it.
+
+The beat is a 1.6s loop: the big drum on 0.0 and 0.8, the small one syncopating at 0.4, 1.0 and
+1.25, with ripples crossing each head, a shell bob, and a matching pulse in the glow and shadow. It
+holds a static pose under `prefers-reduced-motion`.
+
+> **Gotcha worth keeping.** The drum head is *skin*, not a card. An early version had it inherit
+> `--bg-card` and it turned black in dark mode. The head carries its own `--skin-hi/mid/lo` tokens
+> that stay a light parchment in both modes.
+
+The buddha is **not retired** — it stays the brand's character, and the interactive widget
+(task 1001523, still gated on two unshipped art shoots) has a home in goal 1000031. It is simply
+not what answers `/`.
+
+## 3. The palette — `ember marigold`
+
+Six palettes were designed against distinct moods and ranked by a brand critique; the sheet and all
+six token sets are preserved in `mocks/`. Marigold won on the thing the light mode most needed:
+
+- **A genuinely pigmented backdrop.** Today's light mode has page, sky and cards all within a few
+  points of white, so nothing has a figure/ground relationship and the page reads as fog. Marigold
+  keeps the backdrop golden all the way to the footer and makes the cards the only near-white
+  surfaces, so every panel lifts.
+- **A fired accent.** `#ce4806` instead of `#f97316` — unmistakably the same bongo orange, but with
+  heat behind it, and it clears contrast (see §4) where the current one does not.
+- **Dark mode is not an inversion.** Cards are `#2c1710`, a deep saturated umber, and the accent
+  pair flips direction — the hover/link tone goes *brighter* (`#ffab63`), which is how warm schemes
+  actually behave on a dark ground.
+
+**Its risk, recorded so the build can watch for it:** the palette is almost entirely warm and
+almost entirely orange. The ivory cards and the lagoon `--sea` (`#0f7a96`) are the only relief
+valves. If either gets crowded out the page tips into a single amber wash. If that happens in the
+build, the fix already identified is to borrow adobe clay's move and give the scheme a real second
+hue rather than to desaturate the first.
+
+## 4. The contrast defect this pass found — fix it in the build
+
+Every candidate palette was checked with a WCAG contrast calculator across twelve pairs, and the
+calculator was pointed at the **current** tokens too. The palette shipping today fails AA:
+
+| Pair | Ratio | Required | |
+|---|---|---|---|
+| white on `--accent` `#f97316` | **2.80:1** | 4.5 | **fail** |
+| white on `--accent-deep` `#ea580c` | **3.56:1** | 4.5 | **fail** |
+| `--accent-deep` as link text on a card | **3.56:1** | 4.5 | **fail** |
+
+This is **not** limited to the landing page — `--accent` is the fill of every primary `.btn` and
+`--accent-deep` is the link color on `/create` and `/projects` right now. Marigold's `#ce4806`
+(4.61:1) and `#9e3406` (6.86:1) clear it. Tracked as its own task so the fix is not buried inside a
+landing-page commit.
+
+**`--chrome-accent` must follow `--accent` in the same change.** It is hardcoded `#f97316`/`#fb923c`
+in `cosmos.css`, so a re-themed instance gets an orange wordmark and orange glass borders beside its
+own accent. Marigold is orange enough that this is subtle, but it is wrong for every other pack and
+it is a one-line fix per mode.
+
+## 5. The content spine
+
+Ordered. **Portable** = true on every instance; **apex-only** = true of Cloud Bongos the platform.
+Press `S` in the mock to outline the apex-only blocks, `C` to see the child-instance shape.
+
+| | Section | Portable? |
+|---|---|---|
+| S0 | Head metadata — title, description, canonical, `og:`, `twitter:` | server-stamped |
+| S1 | Header — wordmark, Projects, Hall, mode toggle, identity chip | portable |
+| S2 | Hero — self-typing eyebrow, tagline, sub, two CTAs, the drums | portable (2nd CTA apex-only) |
+| S3 | The mechanism — the ledger · the gates · the grade | portable |
+| S4 | The lifecycle — claim → build → grade → ship → credit | portable |
+| S5 | Living proof — the real project catalog | **apex-only**, self-hides on empty |
+| S6 | What you own — AGPL, capture-resistant | **apex-only** |
+| S7 | Two doors — build a project · join as a builder | portable |
+| S8 | Footer | split (see below) |
+
+Copy notes:
+- The sub is verbatim from `space.js:34` and the §S6 paragraph verbatim from `create.html:391` —
+  both already public-facing and owner-approved. Not newly invented.
+- **The footer line splits.** `index.html:104` currently ships *"A non-profit, capture-resistant
+  commons"* to every instance, including ones that are neither. That half is apex-only; *"Built by
+  agents, on Cloud Bongos"* is the portable attribution.
+- **S3 is the differentiator, not "AI writes code."** That claim is crowded. What is actually
+  enforced — a complete ledger, a server-checked rank ladder, an adversarial grade — is not.
+- **No CLI download block.** `/downloads/bongos/*` only mounts when `config/bongos-cli.json` exists.
+  It does not, and the live URL 404s. Do not design copy around it.
+
+## 6. The design system
+
+The page **links `cosmos.css`** and adds a page-local sheet. It does not fork it and does not start
+a fourth design system. The lifecycle rail is literally `.strip`, the catalog chips are the same
+`.chip` verification vocabulary the hub uses — the marketing page and the working page share
+components rather than resembling each other.
+
+`cosmos.css` was built for `/create` and `/projects` and is missing things a marketing page needs.
+The build should add these to the shared layer, not to the page: a `.wrap` container, a type scale
+below `h1`, a spacing scale, one grid primitive, and a mid (~900px) breakpoint. The mock authors all
+five page-locally; they are marked in its stylesheet.
+
+## 7. Constraints the build must respect
+
+- **C1 · One `:root`.** `injectBrandingGlobal` splices the pack's theme `<style>` at the end of
+  `<head>`; a page-local `:root` block silently outranks it and defeats re-branding. Page-local
+  custom properties stay scoped to their component.
+- **C2 · Dark changes are made twice.** `:root[data-mode="dark"]` and the
+  `prefers-color-scheme` twin are byte-identical duplicates in `cosmos.css`. Both, every time.
+- **C3 · The page must ship a `.sky` element.** The pack's `theme.backdrop` emits a
+  `body{background:…}` that overrides `--page-bg` in both modes; `.sky` is the opaque fixed layer
+  that paints over it.
+- **C4 · `id="who"` is required.** `tests/platform_boot.mjs:120` asserts `/id="who"/` on the apex
+  landing, and that test must leave `KNOWN_FAILING` in the same change that makes it pass — the
+  ratchet fails the suite otherwise (idea 1000716).
+- **C5 · Nothing about cloudbongos.com is hardcoded.** `public-landing/` ships wholesale to every
+  instance.
+- **C6 · Outbound links cannot be client-filled.** `clientBranding()` does not project `domains`, so
+  `[data-link-hall]` never re-points and every child instance currently sends visitors to
+  `builders.cloudbongos.com`. The §1.4 server-side injection is the fix that respects the branding
+  contract's decision to keep origins server-side.
+- **C7 · Real markup, not JS-built.** The page must read correctly to a crawler and with JavaScript
+  off — the failure the gate shipped with and task 1002746 had to repair.
+
+## 8. Follow-on tasks this direction produced
+
+| Task | Goal | What it does |
+|---|---|---|
+| **task 1002748** | 1000061 | **The build carrier.** Builds this direction into `public-landing/index.html`: the content spine, the bongo hero, the apex conditional, and the server-stamped head tags. This document plus the mock are its contract. |
+| **task 1002749** | 1000059 | **The WCAG defect** found in §4. Filed separately from the build because it is a live fault on `/create` and `/projects`, not a landing-page issue, and should not be buried inside a landing-page commit. |
+
+Both are promoted and claimable. Neither is started.
+
+Already existing, and gated on the build: **task 1002743** part 3 is the apex flip — it does not run
+until the landing page carries a door into the hub, which §5's header now does, *and* the hub itself
+exists.
+
+## 9. What is deliberately still open
+
+- **The hub is not designed.** `/projects` is the next surface and gets its own mock and direction.
+- **The apex flip does not happen here.** `/` keeps redirecting until the hub exists; the flip is
+  task 1002743 part 3 and is paired with an operator Caddy edit.
+- **Whether the catalog band survives at three projects.** It reads thin today. The band self-hides
+  on an empty feed, so shipping it is safe, but if the catalog stays this small the honest options
+  are a threshold or cutting S5 and letting the hub carry the showcase.
+- **The proof band's effect is weaker in dark mode.** In light it reads as a window into the hub; in
+  dark the whole page is already dark and it separates only by tint.