@bongos/core 1.20.2 → 1.20.4

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.2",
-  "core_contract": "1.20.2",
-  "source_commit": "ca998b1dee6c7e614139ebfb51001b16ca27c701",
+  "core_version": "1.20.4",
+  "core_contract": "1.20.4",
+  "source_commit": "cb1154ab6f5663fcf5ec4b1b2de9d59f4d53c0cf",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T02:38:33.497Z",
+  "built_at": "2026-09-30T03:24:03.992Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 554,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2608,
+    "functional_verbatim": 2611,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3188,
-  "tree_sha256": "a9967d147c252f5ba88721a5da572d6fdc732e28da2ab83987a682697d72b44f",
+  "file_count": 3191,
+  "tree_sha256": "979ab93ed2588479c67154f837a646ebb982d48e470267a63835464662744650",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -312,7 +312,7 @@
     {
       "path": "README.md",
       "mode": "0000644",
-      "sha256": "74e177ab9a2b3a6c2e2de5fdac803944053c249d9e5ad794a838e2cbc497d848"
+      "sha256": "9c9e99127efafe70d60e1d464f07815397e436e69dc0b82c2e67f41dbd8dc8d6"
     },
     {
       "path": "bin/bongos.js",
@@ -322,12 +322,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "ea74f1ba9a116b50861b1ad17c2da3697e55bc0510d7db78ef7f7dea90299a14"
+      "sha256": "aeb6b6285117097aa891b659cdcaf20755098355556a9bfa6e11557c8f980366"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "513dbe9acaf5bb1deeb9f4a21c453c51b7b02dd2cc451c551da91e96467c9fc5"
+      "sha256": "1b36ddb96f6ca78135b0628b18f53d68c04c7ce950b60bb7916d2fcb08544474"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -337,17 +337,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "c6261afa6f9a9d7d141ce8f2d1e84b8dd625fadb560e9968ba7d626d66ce4b51"
+      "sha256": "65ba46030b9c7eec610029bd6fa0e55bc660618a81d50e3af1293f795a533a1c"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "82abd5dc851a8c56d04bec16a6e332f270d03e9963cf43204a7d5f0c7e5f9b59"
+      "sha256": "922701156282c55e3d7aa4a4ed4746fe47a579a189fd76065f868b21e319045a"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "49c85f291b374c380a5f5b331da4539b88b4ef254cf417cdb6a19d95073c789c"
+      "sha256": "3b4c0ae08ee72672d580355da8fd99109d075d85c650516f8b273641ddbff3f6"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -787,7 +787,7 @@
     {
       "path": "docs/adr/0073-secrets-scan-exclude-uri-detector.md",
       "mode": "0000644",
-      "sha256": "80b3539d259105ad7e5284f622857a1aa2889182e856026d56b4138c1cf1bda8"
+      "sha256": "05107d37f497f8f5d8d1ca4d2a8d19e688fc9258352d7b9bfe1976c4ab1fee79"
     },
     {
       "path": "docs/adr/0074-memory-map-stays-light.md",
@@ -2017,7 +2017,7 @@
     {
       "path": "docs/adr/0310-a-speciality-offers-skills-and-the-adopter-chooses-them.md",
       "mode": "0000644",
-      "sha256": "7121b37dfcb39b5e2c1cdfe0be86e1ab2228003ee7b10620da15b64bfd0943d2"
+      "sha256": "7641ba652bf937b55808ef0f6e10f14654800d60ad9bfb4326cd407fc1b8adcf"
     },
     {
       "path": "docs/adr/0311-an-idea-is-a-permanent-origin-tag.md",
@@ -2227,12 +2227,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "4abe1c6b64c858bba61234c0d65b1896f6c2928dfccd5d205203485e0da8339c"
+      "sha256": "46c90700bd3b16d25e1c7b7753f270b23a7ec801fd7ca2c6c9d88125e270eca6"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "c36943540b9061c5171d815b9e547500ebec8a13cceb59151b7c309d7da208a6"
+      "sha256": "5d4be73b912ed2682fbcab207b4c83d58ca6530712de5ba350bbcb69b545079c"
     },
     {
       "path": "docs/architecture.md",
@@ -2257,12 +2257,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "91de610122f8818fcf977c29930933ef788bdcb6a06325a980d02cdbaa00d453"
+      "sha256": "3c78ba6c1c958d024141c68f2b99e71a665a042d2bccd187cb9ae3676c00b502"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "dc7d48d5ff360e6a12ac8dd35fee27df6094ebed20421426abab236003b4c38e"
+      "sha256": "920b392dc53e07b5b290f8add28f9b1a3a50f9b2a13391c2a649250084656c5f"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2762,7 +2762,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "dd50f2deee7bba7bf96fbd437f2029e6ae0152cfef4e2a9a20d0175d7a285309"
+      "sha256": "fc86b2b7f4ff0f0825ddbef82d3d33286d642a86e5f4dcf6fb62d6ad2efe3558"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2847,12 +2847,12 @@
     {
       "path": "docs/page-inventory.json",
       "mode": "0000644",
-      "sha256": "d61b313acdf5eba903c0ce82b787369afd25be2a2e8db1c08afc590991ba05e9"
+      "sha256": "d5242323bc5db540dfa190d5b89c92af0bf6e0a36419d141705fb4d7f51ea39c"
     },
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "423073f523746f511d06bca198350db7dd8b84f36fd0a737f1117ec6fb0a3054"
+      "sha256": "5397c8af5143f2e9a16f008bae0cd172713f641e1d810c87113f01e620499172"
     },
     {
       "path": "docs/project-context.template.md",
@@ -5502,12 +5502,12 @@
     {
       "path": "modules/hall-ui/public/settings-specialities.js",
       "mode": "0000644",
-      "sha256": "cf4a1073eff2b0b0a2df47d3af9849a2a2cd9fa83089e0d494d8f0780434478d"
+      "sha256": "9bc109f2e947f1db1525b937d350f46e5231cc14a9dd5db8fa1c97a2b46fe6d1"
     },
     {
       "path": "modules/hall-ui/public/settings.css",
       "mode": "0000644",
-      "sha256": "17097f37b32a8ea2645600110fd3c412da5c8c991b1d3e4b2d3fa1ac3187f4da"
+      "sha256": "d73ab35cd887285813fe8d3f3f13ec8b0e2d179b1a9fb3cc910ea6caa7131607"
     },
     {
       "path": "modules/hall-ui/public/settings.html",
@@ -5522,7 +5522,7 @@
     {
       "path": "modules/hall-ui/public/settings.states.json",
       "mode": "0000644",
-      "sha256": "c32285cb12f598141245d3a9beba3c026f5598311ed16d39e50823e11043e995"
+      "sha256": "54f12d63deb961cfe6d13ad0d9ccd6ca1defbc3a4bce1c036e2d93ed4281951b"
     },
     {
       "path": "modules/hall-ui/public/shell.js",
@@ -5757,7 +5757,7 @@
     {
       "path": "modules/hall-ui/records/panel-family.md",
       "mode": "0000644",
-      "sha256": "10fa9985b6743101fb86ad2f96fd0272a5c6be58944c84ddc944fb7a6648c16e"
+      "sha256": "42e0d8cbb266e912c5ab034d2a88f11da310d4a4a8f61a87ce86a08b154d32d9"
     },
     {
       "path": "modules/hall-ui/records/reading-rooms.md",
@@ -8317,17 +8317,17 @@
     {
       "path": "modules/specialities/routes/specialities.js",
       "mode": "0000644",
-      "sha256": "a5f21deb5aef391799031ea3d9408c5b22eb8fcbcee84828e36021d6cf508298"
+      "sha256": "b12e3feba6f79e96f8e43ae41252d1136c37575b9a79201cbffb87d91b4f237c"
     },
     {
       "path": "modules/specialities/skills.js",
       "mode": "0000644",
-      "sha256": "4e5a98eecadbd16f361090be05118c1974aa57e12aeb80865f43c538ab996b71"
+      "sha256": "82b024a99907bee711ac83ba838430d2f253705ce4f5c083680c3b5fd909b24c"
     },
     {
       "path": "modules/specialities/specialities.js",
       "mode": "0000644",
-      "sha256": "20cf7786bb08c68675690d6b6165e7a8d2545b7ca3de3658c66e27027bed7a3f"
+      "sha256": "a27607e3760d1fb31d1f6e78d920cc8ab0a94e0add3ea7497d4989637ce3173a"
     },
     {
       "path": "modules/status-ui/CLAUDE.md",
@@ -8822,12 +8822,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d6b52dacf9c31b799c163d77e05228bc3e5ba33aa8010ec5068624c625dbda6a"
+      "sha256": "a2051b26efcb3819d5b8190bff59b4695bbd0cd69efed2f95a4af8717e6a1c38"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0e422814840dfdfc9f6d1c7bebc4bf238dbc752a4161e2bd77a41ddc13b91404"
+      "sha256": "895cf915952f0155ee5d26315afd456d0630e5ab39ce65c22fa10bc0fa5aa7ae"
     },
     {
       "path": "public-docs/index.html",
@@ -8847,7 +8847,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "0f3d3decd7772ae5456206afdfb57e4a84bff73537ba566ee976e2c374fc1788"
+      "sha256": "b0f0a951c309fec69d3e8c0a4b30516bf56b1fcb4ce24490d84a89bd14ed01a0"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9197,7 +9197,7 @@
     {
       "path": "scripts/gds/control-manifest.js",
       "mode": "0000644",
-      "sha256": "270101b46772cc8e280bc5a36f66cfae578a901f07b4b5e1f959c9a566ebb5fd"
+      "sha256": "063e4e14f040bf78de4a8212222405cc361520d2475453b1d516329a7ca9f070"
     },
     {
       "path": "scripts/gds/copy-apply.js",
@@ -9319,6 +9319,11 @@
       "mode": "0000644",
       "sha256": "17d0fbc570b6dea3dfcf2425058510cd70b23f066fdf1ed751072852713284a3"
     },
+    {
+      "path": "scripts/gds/doc-control-claims.js",
+      "mode": "0000644",
+      "sha256": "94c89c10620d3d6678fa3b1a8decebc6d338c0b0b2a3799880e49311d2cd2770"
+    },
     {
       "path": "scripts/gds/docs-entropy.js",
       "mode": "0000644",
@@ -9407,7 +9412,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "d1f22a1eb3b7ae5ac51b795e2392bff5c9e0a72aea7de4c1947351752510fa89"
+      "sha256": "dee3e8db3ad7fff3c1e30a59aa58bab00972cba9710bd463e10ab8a3edc71e38"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -10522,7 +10527,7 @@
     {
       "path": "scripts/hall-preview/server.js",
       "mode": "0000644",
-      "sha256": "56912c7ce4912c938300278d9af7cc2a125ea672c0beb5298a79dd5ce8afdb0f"
+      "sha256": "4529909a899a52180c5876d926be2ef2dc42a8bffef43d84c38dd9d399f2c5d2"
     },
     {
       "path": "scripts/hall-preview/task-visual.js",
@@ -10732,7 +10737,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "322900d024e3737b18c2341d408a7832c2b0dffc9c36ff510768cbca78236098"
+      "sha256": "cc78b33cc9d0fca6d217a7c6aaf66f64de9cbe1447a352fc769eb8556207a453"
     },
     {
       "path": "src/bongos/module-store.js",
@@ -10942,7 +10947,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0f8bf5e352578ee3747750dbd3e4646481c338f118ff63dc4a9e45276064ac1c"
+      "sha256": "e3e6394ab165f0c08e998c0c43fe18d1ec92872a84490deb7a9a01712656c024"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12184,6 +12189,11 @@
       "mode": "0000644",
       "sha256": "f51d3c747fbb3201ed3388abb1386d0547c3a3be70d7ad7237b9a0f5fdd2347b"
     },
+    {
+      "path": "tests/doc_control_claims.mjs",
+      "mode": "0000644",
+      "sha256": "499d0436bc000e9d1749d99d3e1e9886cb1a4bdd4388f5a165bc099359c7132a"
+    },
     {
       "path": "tests/docs_entropy.mjs",
       "mode": "0000644",
@@ -15427,7 +15437,12 @@
     {
       "path": "tests/speciality_skills.mjs",
       "mode": "0000644",
-      "sha256": "6030911cb515c11215310fa8e3c363567ca9cfb78ce5c706858c0025eec5d071"
+      "sha256": "dddd0c7c5544dacdfd65160d720814a5a71fd74708e7e7beac5964bb59b633fc"
+    },
+    {
+      "path": "tests/speciality_walkthrough_ui.mjs",
+      "mode": "0000644",
+      "sha256": "bc83406501c682b33a19ac7a0a1fa23a07f9e52654c265e2513b5f73b3311f3c"
     },
     {
       "path": "tests/spike_task_map.mjs",

package/README.md

@@ -48,28 +48,19 @@ When it finishes, open Claude Code and run `/builder-start` to see what tasks ar
 
 ## Secrets scanning
 
-We keep secrets (`.env` files, API keys, private keys) out of the repo with two layers. Both are **instance topology** — the git hooks (`.husky/`) and CI (`.github/`) are excluded from the published core artifact, and a secrets pre-commit hook is an instance addition (nothing provisions one automatically). This repo tracks `.husky/pre-push` — the ADR 0043 permission gate, a separate wall from secrets scanning. The pattern below is the recommended posture:
+We keep secrets (`.env` files, API keys, private keys) out of the repo with three layers. The CI and patrol layers are **instance topology**: `.github/` is excluded from the published core artifact, so an instance that wants them carries its own copies.
 
-- **Pre-commit hook** (`.husky/pre-commit`) — scans your *staged* changes before each commit and aborts if it finds a secret. On an instance that ships `.husky/`, activate it **once per clone**:
+- **Prevent — the secret-gate hook** (`.claude/hooks/secret-gate.js`, wired in `.claude/settings.json`). A Claude Code PreToolUse hook that refuses to write secret-shaped content (provider-prefixed tokens, PEM blocks) into the working tree or a shell. It is the cooperative layer: it fails open on any error, so the two gates below are what actually hold.
+- **Gate — the CI secret scan** (the `Secret scan` step in `.github/workflows/unit.yml`). Every PR runs a pinned, checksum-verified gitleaks over the checked-out tree against `.gitleaks.toml`. This must pass before merge. It scans current files, not history.
+- **Patrol — the weekly history scan** (`scripts/gds/redteam-patrol.js`, run by `.github/workflows/redteam-patrol.yml`). Scans the full git history with the same config, which is how a secret committed and later deleted is still caught.
 
-  ```sh
-  node scripts/gds/install-git-hooks.js
-  ```
+A local pre-commit hook is optional and an instance addition: this repo tracks `.husky/pre-push` (the ADR 0043 permission gate, a separate wall) but no secrets pre-commit hook. If your instance adds hooks under `.husky/`, activate them once per clone with `node scripts/gds/install-git-hooks.js` (it no-ops on a checkout without a `.husky/`; `node scripts/gds/doctor.js` reports which case you're in).
 
-  Prefer that over setting `core.hooksPath` by hand: it no-ops cleanly on a checkout without a `.husky/` (e.g. a scaffolded instance that hasn't added hooks), whereas pointing `core.hooksPath` at a directory that isn't there leaves git with a dangling hooks path and no gate. `node scripts/gds/doctor.js` reports which case you're in.
+### If a scan blocks you, here's how to investigate
 
-  It always runs a built-in guard (blocks `.env`, `*.pem`, credential files, obvious key patterns). If [TruffleHog](https://github.com/trufflesecurity/trufflehog) is installed (`brew install trufflehog` on macOS; `scoop install trufflehog` / `choco install trufflehog` or the GitHub release on Windows) it also runs a deep scan; if not, it warns and lets the commit through — CI is the real gate.
-
-  > **Windows:** git runs the `.husky/pre-commit` hook through the Git-Bash `sh` bundled with Git for Windows, so the hook works if you installed Git for Windows (the usual case). If you don't have a `sh` available, the local hook silently no-ops — CI's full-history TruffleHog scan is then your only gate (and it always runs regardless of platform).
-
-- **CI scan** (`.github/workflows/secrets-scan.yml`) — every PR to `main` runs TruffleHog over the **full git history**. This must pass before merge.
-
-### If a commit is blocked, here's how to investigate
-
-1. **Read the output.** The hook prints the offending file(s) and why.
-2. **Is it a real secret?** Then it must never be committed. Remove it from the commit (`git restore --staged <file>`), and move the value out of the repo — local secrets go in `.env.local` (gitignored; run `/builder-setup`); production secrets live in your instance's secret store, never in the tree. If it was *already committed in an earlier commit*, the history scan will keep failing until the history is scrubbed — flag this to the owner, since rewriting shared history needs care.
-3. **Is it a false positive?** (e.g. an example key in docs, a test fixture, a Stripe `pk_test_` publishable key.) Add a path regex — one per line — to `.husky/secrets-allowlist.txt` (created on first use). Both the hook and CI read that allowlist. Keep entries narrow and only add them after confirming the match is genuinely not a secret.
-4. **Genuine emergency commit** (you're sure it's clean and need to move now): `git commit --no-verify` skips the local hook — but CI will still scan the PR, so this only defers the check, it doesn't bypass it.
+1. **Read the output.** The hook and gitleaks both name the offending file and the rule that matched.
+2. **Is it a real secret?** Then it must never be committed. Remove it from the commit (`git restore --staged <file>`), and move the value out of the repo — local secrets go in `.env.local` (gitignored; run `/builder-setup`); production secrets live in your instance's secret store, never in the tree. If it was *already committed in an earlier commit*, the weekly history patrol will keep reporting it until the history is scrubbed — flag this to the owner, since rewriting shared history needs care.
+3. **Is it a false positive?** (e.g. an example key in docs, a test fixture, a Stripe `pk_test_` publishable key.) Add a narrow path to the `[allowlist]` in `.gitleaks.toml`, and the matching entry to the `ALLOWLIST` in `.claude/hooks/secret-gate.js` — the two lists are kept in step. Only add one after confirming the match is genuinely not a secret.
 
 ## If your CLI starts 401'ing
 

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 454 operations across 69 resource groups
+- 455 operations across 69 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -979,6 +979,8 @@ function createClient(opts = {}) {
       deleteSpecialitiesIdDocumentsDocId: (args) => request("DELETE", "/specialities/{id}/documents/{docId}", { hasBody: false }, args),
       // POST /specialities/{id}/offer — rank: metic+archon — POST /specialities/:id/offer
       postSpecialitiesIdOffer: (args) => request("POST", "/specialities/{id}/offer", { hasBody: true }, args),
+      // GET /specialities/{id}/skills — rank: any-builder — GET /specialities/:id/skills
+      getSpecialitiesIdSkills: (args) => request("GET", "/specialities/{id}/skills", { hasBody: false }, args),
       // PUT /specialities/{id}/skills — rank: any-builder — PUT /specialities/:id/skills
       putSpecialitiesIdSkills: (args) => request("PUT", "/specialities/{id}/skills", { hasBody: true }, args),
       // POST /specialities/{id}/unoffer — rank: metic+archon — POST /specialities/:id/unoffer

package/clients/bongos-client/index.cjs

@@ -978,6 +978,8 @@ function createClient(opts = {}) {
       deleteSpecialitiesIdDocumentsDocId: (args) => request("DELETE", "/specialities/{id}/documents/{docId}", { hasBody: false }, args),
       // POST /specialities/{id}/offer — rank: metic+archon — POST /specialities/:id/offer
       postSpecialitiesIdOffer: (args) => request("POST", "/specialities/{id}/offer", { hasBody: true }, args),
+      // GET /specialities/{id}/skills — rank: any-builder — GET /specialities/:id/skills
+      getSpecialitiesIdSkills: (args) => request("GET", "/specialities/{id}/skills", { hasBody: false }, args),
       // PUT /specialities/{id}/skills — rank: any-builder — PUT /specialities/:id/skills
       putSpecialitiesIdSkills: (args) => request("PUT", "/specialities/{id}/skills", { hasBody: true }, args),
       // POST /specialities/{id}/unoffer — rank: metic+archon — POST /specialities/:id/unoffer

package/clients/bongos-client/index.d.ts

@@ -157,6 +157,7 @@ export interface GetSessionsSearchResponse { sessions: unknown; count: unknown;
 export interface GetSoftwareUpdateResponse { ok: boolean; update: unknown; door: unknown; can_update: unknown }
 export interface GetSpecialitiesIdDocumentsResponse { documents: unknown }
 export interface GetSpecialitiesIdResponse { speciality: unknown }
+export interface GetSpecialitiesIdSkillsResponse { speciality: unknown; adopted: boolean; enabled: unknown; skills: unknown }
 export interface GetSpecialitiesOfferedResponse { suggestions: unknown }
 export interface GetSpecialitiesResponse { specialities: unknown }
 export interface GetSsoPubkeyResponse { alg: unknown; format: unknown; public_key_b64: unknown }
@@ -1398,6 +1399,8 @@ export interface BongosClient {
     deleteSpecialitiesIdDocumentsDocId(args?: RequestArgs): Promise<DeleteSpecialitiesIdDocumentsDocIdResponse>;
     /** POST /specialities/{id}/offer — rank: metic+archon */
     postSpecialitiesIdOffer(args?: RequestArgs): Promise<PostSpecialitiesIdOfferResponse>;
+    /** GET /specialities/{id}/skills — rank: any-builder */
+    getSpecialitiesIdSkills(args?: RequestArgs): Promise<GetSpecialitiesIdSkillsResponse>;
     /** PUT /specialities/{id}/skills — rank: any-builder */
     putSpecialitiesIdSkills(args: RequestArgs & { body: PutSpecialitiesIdSkillsRequest }): Promise<PutSpecialitiesIdSkillsResponse>;
     /** POST /specialities/{id}/unoffer — rank: metic+archon */

package/clients/bongos-client/index.mjs

@@ -975,6 +975,8 @@ export function createClient(opts = {}) {
       deleteSpecialitiesIdDocumentsDocId: (args) => request("DELETE", "/specialities/{id}/documents/{docId}", { hasBody: false }, args),
       // POST /specialities/{id}/offer — rank: metic+archon — POST /specialities/:id/offer
       postSpecialitiesIdOffer: (args) => request("POST", "/specialities/{id}/offer", { hasBody: true }, args),
+      // GET /specialities/{id}/skills — rank: any-builder — GET /specialities/:id/skills
+      getSpecialitiesIdSkills: (args) => request("GET", "/specialities/{id}/skills", { hasBody: false }, args),
       // PUT /specialities/{id}/skills — rank: any-builder — PUT /specialities/:id/skills
       putSpecialitiesIdSkills: (args) => request("PUT", "/specialities/{id}/skills", { hasBody: true }, args),
       // POST /specialities/{id}/unoffer — rank: metic+archon — POST /specialities/:id/unoffer

package/docs/adr/0073-secrets-scan-exclude-uri-detector.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-06-20
 **Context:** Secrets-scanning gate (`.github/workflows/secrets-scan.yml` + the `.husky/pre-commit` early-catch). Tasks [#1318](https://example.com/builders#/task/1318) and [#1320](https://example.com/builders#/task/1320). Relates to [ADR 0022](0022-secrets-policy.md) (secrets policy) and [ADR 0071](0071-box-confirm-before-destroyed-and-drift-reconcile.md) (dev-box teardown — the trigger).
-**Status:** Accepted.
+**Status:** Superseded — the TruffleHog gate this ADR tunes did not survive the core extraction; the live CI secret scan is gitleaks in the unit workflow against `.gitleaks.toml` (task 1003126, ADR 0022). Kept as the record of why the URI detector was excluded. Marked by task 1003418.
 **Track:** `internal` (development system / CI gates).
 
 ## Problem — a noisy detector turned a green gate red repo-wide

package/docs/adr/0310-a-speciality-offers-skills-and-the-adopter-chooses-them.md

@@ -75,7 +75,7 @@ Already shipped in `specialities_catalog`: `owner_kind` (`builder` | `project`),
 Deliberately separate tasks, because the middle one is where the ruling lives and it should not be a sub-bullet of a schema change:
 
 1. **Schema + validation** — the offered set on the catalog, the enabled set on the adoption, `validateDraft`, the routes. Refuses a skill the instance does not have. *Built in task 1004072 (`skills` / `enabled_skills`, specialities_003, `modules/specialities/skills.js`).*
-2. **The walkthrough** — the adoption flow that presents each skill and takes a decision. The ruling's real deliverable.
+2. **The walkthrough** — the adoption flow that presents each skill and takes a decision. The ruling's real deliverable. *Built in task 1004073 (`GET /specialities/:id/skills`, `skills.explainSkill`, the hall settings panel). The consequence above came true: skill descriptions are model-facing, so a SKILL.md may now carry optional people-facing `plain:` / `reach-for:` / `cost:` lines, and the walkthrough says so when it had to derive the words instead.*
 3. **Injection** — the enabled set reaches the session through the contract the Conductor already injects; a line naming the skills this builder leans on, per [ADR 0296](0296-a-role-speciality-is-data-over-three-existing-surfaces.md)'s pattern of using surfaces that exist.
 
 Nothing is built by this ADR. It is the decision task 1003978 asked to be made first.

package/docs/api/openapi.json

@@ -17998,6 +17998,56 @@
       }
     },
     "/specialities/{id}/skills": {
+      "get": {
+        "operationId": "get_specialities_id_skills",
+        "tags": [
+          "specialities"
+        ],
+        "summary": "GET /specialities/:id/skills",
+        "description": "GET /specialities/:id/skills — what the adoption WALKTHROUGH shows (task 1004073, ADR 0310 §3): each skill the speciality offers, explained for the person deciding (what it does, when to reach for it, what it costs, what it needs), plus the caller's own enabled set and whether they hold it at all. Same visibility as GET /specialities/:id — 404 for a row you cannot see. An offered skill this instance no longer has comes back `installed: false`, so the walkthrough can say so instead of offering something that would 404. Read-only; rank: any builder who may see the speciality.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/specialities/routes/specialities.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetSpecialitiesIdSkillsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
       "put": {
         "operationId": "put_specialities_id_skills",
         "tags": [
@@ -23284,6 +23334,23 @@
           "speciality"
         ]
       },
+      "GetSpecialitiesIdSkillsResponse": {
+        "type": "object",
+        "properties": {
+          "speciality": {},
+          "adopted": {
+            "type": "boolean"
+          },
+          "enabled": {},
+          "skills": {}
+        },
+        "required": [
+          "speciality",
+          "adopted",
+          "enabled",
+          "skills"
+        ]
+      },
       "GetSpecialitiesOfferedResponse": {
         "type": "object",
         "properties": {
@@ -29027,9 +29094,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 454,
-  "x-schema-count": 486,
+  "x-endpoint-count": 455,
+  "x-schema-count": 487,
   "x-undocumented-bodies": 11,
-  "x-response-schemas": 330,
+  "x-response-schemas": 331,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 454 endpoints across 81 route files.
+> **Generated from the live route files** — the route file is authoritative. 455 endpoints across 81 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -688,7 +688,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 |---|---|---|---|---|
 | GET | `/api/bongos/software-update` | `any-builder` | — | GET /software-update — Settings → Software update (task 1004296): this project's core, the newest release its channel allows, what the ve… |
 
-## `specialities` (13)
+## `specialities` (14)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -702,6 +702,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/specialities/:id/documents` | `any-builder` | `title`, `body_md`, `source` | ── training (a): the owner's own documents ─────────────────────────────── |
 | DELETE | `/api/bongos/specialities/:id/documents/:docId` | `any-builder` | — |  |
 | POST | `/api/bongos/specialities/:id/offer` | `metic+archon` | — | ── offering: a project puts its name behind a speciality ───────────────── OFFERING IS CURATION, NOT OWNERSHIP, so it is gated differentl… |
+| GET | `/api/bongos/specialities/:id/skills` | `any-builder` | — | GET /specialities/:id/skills — what the adoption WALKTHROUGH shows (task 1004073, ADR 0310 §3): each skill the speciality offers, explain… |
 | PUT | `/api/bongos/specialities/:id/skills` | `any-builder` | `enabled_skills` | PUT /specialities/:id/skills — the caller's ENABLED set for a speciality they hold (task 1004072, ADR 0310 §2). |
 | POST | `/api/bongos/specialities/:id/unoffer` | `metic+archon` | — |  |
 | GET | `/api/bongos/specialities/offered` | `any-builder` | — | GET /specialities/offered — the suggestions for THIS builder. |