@bongos/core 1.20.40 → 1.20.41

package/.claude/skills/design/SKILL.md

@@ -14,7 +14,7 @@ You are running a **UI design session**. Two things make it different from the E
 
 ## Step 0 — the tools, then the mode
 
-- **The skills named below have to be ON THE MACHINE.** Claiming a `ui` task lands them as part of the claim (`scripts/gds/claim.js`, the `materializeModuleSkills` flag in `scripts/gds/discipline-modes.json`); opening `/design` without one does not. If `.claude/skills/` has no `impeccable`, run `node scripts/gds/claude-materialize.js --module-skills-only` — it copies every enabled module's `skills/` into this checkout as untracked, self-ignored dirs ([ADR 0224](../../../docs/adr/0224-module-skills-reach-the-core-checkout-as-untracked-self-ignored-copies.md)), so `git status` stays clean and `--clean` takes them away again. A scaffolded instance already received them at `bongos init`. A skill of the same name in your own `~/.claude/skills` is **not** the module's — it carries no platform preamble and was never scanned ([ADR 0220](../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md)).
+- **The skills named below have to be ON THE MACHINE.** Claiming a `ui` task lands them as part of the claim (`scripts/gds/claim.js`, the `materializeModuleSkills` flag in `scripts/gds/discipline-modes.json`); opening `/design` without one does not. If `.claude/skills/` has no `impeccable`, first check that the `design-styles` module is on — the style skills below are opt-in since task 1004470, so with it off, say in one plain sentence that the design styles are off on this project and carry on with the loop, the kit and the style library, which stay. Turning them on is the instance's choice, one line in `config/modules.json` (`"design-styles": true`). With it on, run `node scripts/gds/claude-materialize.js --module-skills-only` — it copies every enabled module's `skills/` into this checkout as untracked, self-ignored dirs ([ADR 0224](../../../docs/adr/0224-module-skills-reach-the-core-checkout-as-untracked-self-ignored-copies.md)), so `git status` stays clean and `--clean` takes them away again. A scaffolded instance already received them at `bongos init`. A skill of the same name in your own `~/.claude/skills` is **not** the module's — it carries no platform preamble and was never scanned ([ADR 0220](../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md)).
 - **Interactive** (someone is here to look and react): show, let them steer, iterate. One or two lines per step, then a screen.
 - **Autonomous** (no one will look): build inside the contract, prove it in both modes, stage or park the screens for review, and **never ship an interface change blind** — a task that cannot be verified visually gets a release with a reason, not a guess.
 
@@ -64,16 +64,17 @@ Generated code uses the `--dt-*` variables; adapters write only `src/ui/<surface
 - **Figma** (`/figma-design-sync`): push the current state so a designer never opens a stale file; land their edit back as committed code. Canvas art that won't translate becomes an asset, never forced into code.
 - Both are adapters against `modules/ui-design/docs/design-contract.md`; a third tool is a third adapter, not a new integration.
 
-## The vetted skills and the in-house rebuilds (the ui-design module's `skills/`)
+## The vetted skills and the in-house rebuilds (the `design-styles` module's `skills/`)
 
-Third-party design skills reach a builder only through the module's vendoring policy ([`modules/ui-design/skills/README.md`](../../../modules/ui-design/skills/README.md), ADR 0198): scanned with `/scan-before-install` and reduced to `clean` or `caution`, a licence on the allowlist, a `PROVENANCE.md` sidecar, and the PLATFORM PREAMBLE that reads the instance's world before any taste rule. A skill the module ships is listed here by name, one line each, whether vendored or rebuilt in-house; a name that is not listed is not the module's, whatever a builder's own `~/.claude/skills` carries.
+**These are opt-in.** They ship in the `design-styles` module, which is off by default (task 1004470): an instance turns it on with `"design-styles": true` in `config/modules.json`. When it is off, none of the skills below is on the machine — tell the person so in one plain sentence ("the design styles are switched off on this project") rather than looking for them, and work on with the loop above and the style library below, which `ui-design` keeps.
+
+Third-party design skills reach a builder only through the module's vendoring policy ([`modules/design-styles/skills/README.md`](../../../modules/design-styles/skills/README.md), ADR 0198): scanned with `/scan-before-install` and reduced to `clean` or `caution`, a licence on the allowlist, a `PROVENANCE.md` sidecar, and the PLATFORM PREAMBLE that reads the instance's world before any taste rule. A skill the module ships is listed here by name, one line each, whether vendored or rebuilt in-house; a name that is not listed is not the module's, whatever a builder's own `~/.claude/skills` carries.
 
 - *None vendored (2026-08-28).* Both origins scanned for the scoped set — `pbakaus/impeccable`, and the eleven `Leonxlnx/taste-skill` skills (`minimalist-ui`, `industrial-brutalist-ui`, `gpt-taste`, `stitch-design-taste`, `image-to-code`, `imagegen-frontend-web`, `imagegen-frontend-mobile`, `brandkit`, and the rest of the roster below) — reduced to `dangerous` at the scanner's deterministic floor and landed as rebuild specs (GDS tasks). The roster, the verdicts and the way to land one are in the README; vendoring one anyway is an owner override recorded in an ADR, not a session's call.
 
-**Rebuilt in-house from the specs** ([ADR 0220](../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md), task 1003325; [ADR 0221](../../../docs/adr/0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md), task 1003326; [ADR 0222](../../../docs/adr/0222-the-image-family-under-the-hero-only-rule.md), task 1003328; [ADR 0230](../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md), task 1003327): first-party skills at `modules/ui-design/skills/<name>/`, each opening with the same preamble, each naming its spec and what changed in translation. They run INSIDE the loop above: the world first, the style library as the palette source for a variant, images as hero plates only, every motion rule inside the Kill Switch, the kit as the pre-flight.
+**Rebuilt in-house from the specs** ([ADR 0220](../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md), task 1003325; [ADR 0221](../../../docs/adr/0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md), task 1003326; [ADR 0222](../../../docs/adr/0222-the-image-family-under-the-hero-only-rule.md), task 1003328; [ADR 0230](../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md), task 1003327): first-party skills at `modules/design-styles/skills/<name>/`, each opening with the same preamble, each naming its spec and what changed in translation. They run INSIDE the loop above: the world first, the style library as the palette source for a variant, images as hero plates only, every motion rule inside the Kill Switch, the kit as the pre-flight.
 
 - **design-taste-frontend** — the default taste skill for a landing page, a portfolio or a marketing surface: the brief read in one line, three dials from presets, one world locked for the page, hero and layout discipline, rationed decoration, a pre-flight the kit measures. Declines dashboards, tables, wizards and editors.
-- **design-taste-frontend-v1** — the earlier generation, kept distinct: a fixed baseline triple adapted in conversation, stack conventions for a served surface, the layout bans, full interaction cycles, the named vocabulary of premium patterns and the tile-grid archetypes.
 - **high-end-visual-design** — the agency-build polish pass: one texture archetype (the library's looks) and one layout archetype per project, the nested container anatomy where the world allows a container, the pill with its nested arrow disc, the spatial rhythm, choreography and scroll entry inside the Kill Switch.
 - **redesign-existing-projects** — the in-place upgrade: scan the stack, diagnose against the seven-group audit with the instance's world as the answer key, fix in impact-per-risk order, one group per commit; keeps the stack, never migrates frameworks, `probe.js` green before and after.
 - **minimalist-ui** — the quiet editorial look: macro whitespace first, a capped measure, one display job and one body job, exactly one hairline weight in the whole sheet, washed accents measured against their own ink, flat tile cards with no shadow, box-less accordions and keycap shortcuts, one depth treatment per band. Declines dense surfaces; the nearest library look is `expedition`.

package/docs/adr/0081-tool-agnostic-design-layer.md

@@ -39,7 +39,7 @@ Owner (Lars) requirements, reached in the 2026-06-21 design conversation:
 - **No lock-in.** Tools plug into the repo contract; adding or dropping one (Claude Design, Figma, a future rival) doesn't touch the core. That is the explicit insurance the owner asked for.
 - **Designers keep Figma.** Manual Figma edits are first-class for structured/design-system changes and round-trip into the repo via a normal GDS task + the same grader. The honest limit: the Figma→code round-trip is lossy for arbitrary canvas art — that work becomes a committed asset, not round-tripped code.
 - **One grader to maintain, not two.** The standalone Gemini review path is retired into the unified engine. Code doesn't auto-regen today (a failed grade = human fixes + re-ships); unifying gives every type the same generate→grade→regenerate loop.
-- **Graphics is unchanged.** World pixel art stays on the Claude Code + Gemini pipeline; Figma stays its viewer ([`otb-figma-sync`](../../.claude/skills/otb-figma-sync/SKILL.md)). This ADR adds the `ui` lane beside it, it does not disturb the art pipeline.
+- **Graphics is unchanged.** World pixel art stays on the Claude Code + Gemini pipeline; Figma stays its viewer ([`otb-figma-sync`](../../modules/pixel-art/skills/otb-figma-sync/SKILL.md)). This ADR adds the `ui` lane beside it, it does not disturb the art pipeline.
 - **Gate-review floor applies.** [#1380](https://example.com/builders#/task/1380) touches [`grader.js`](../../modules/grading/grader.js) + [`ship.js`](../../scripts/gds/ship.js) — the gate-review **hard floor** ([ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)). It needs owner Gate approval even for Archon, and the multimodal call path wants a security review.
 
 ## Rejected alternatives

package/docs/adr/0198-third-party-skill-vendoring-policy.md

@@ -20,8 +20,8 @@ The taste skills' one critical is a false positive in the human sense and a true
 
 1. **A scan verdict is the gate, and a session cannot override it.** A third-party skill lands under `modules/ui-design/skills/vendor/<name>/` only from a commit that `/scan-before-install` reduced to `clean` or `caution` at the `default` tier or higher. `dangerous` lands a rebuild spec (a GDS task holding the engine's script-framed `REBUILD-SPEC.md`), never a copy — not for a skill already installed on a builder's machine, not for one that ran the last round. Vendoring a `dangerous`-scanned skill is an **owner decision recorded in its own ADR**, with the scan report cited, and the test that enforces this policy (`tests/ui_design_skills.mjs`) is amended in the same change so the exception is visible in code, not just prose.
 2. **A licence allowlist:** `Apache-2.0`, `MIT`, `BSD-2-Clause`, `BSD-3-Clause`, `CC-BY-4.0`. Anything else, or unlicensed, is a rebuild spec. The upstream `LICENSE` text travels with every copy.
-3. **A provenance sidecar** — `PROVENANCE.md` beside every vendored `SKILL.md`, YAML frontmatter with `name`, `origin`, `sourcePath`, `commit` (the full sha; never a branch or tag), `licence`, `scanVerdict`, `scanTier`, `scanReport`, `scannedOn`, `vendoredOn`, then prose. The policy is data, not a README: [`modules/ui-design/skills/policy.json`](../../modules/ui-design/skills/policy.json) holds the allowlist, the landable verdicts, the sidecar's required fields and the preamble markers; the test reads it.
-4. **One preamble block, byte-identical everywhere.** [`modules/ui-design/skills/PREAMBLE.md`](../../modules/ui-design/skills/PREAMBLE.md) is inserted as the first thing after a vendored `SKILL.md`'s frontmatter, fenced by two HTML-comment markers, so an upstream refresh is a three-way merge around one block and the test can pin every copy against the source. It says, in order: load the instance's world (its pack, its tokens, its `DESIGN.md`; the neutral pack and the floors where it has none) before any taste rule; the fifteen-token contract is the only colour source; a style skill produces variants inside that world, never a second world; images are for hero plates and hero objects only; the instance's taste bans apply and win; the platform floors and the Kill Switch hold on every instance; look before you ship through the kit.
+3. **A provenance sidecar** — `PROVENANCE.md` beside every vendored `SKILL.md`, YAML frontmatter with `name`, `origin`, `sourcePath`, `commit` (the full sha; never a branch or tag), `licence`, `scanVerdict`, `scanTier`, `scanReport`, `scannedOn`, `vendoredOn`, then prose. The policy is data, not a README: [`modules/ui-design/skills/policy.json`](../../modules/design-styles/skills/policy.json) holds the allowlist, the landable verdicts, the sidecar's required fields and the preamble markers; the test reads it.
+4. **One preamble block, byte-identical everywhere.** [`modules/ui-design/skills/PREAMBLE.md`](../../modules/design-styles/skills/PREAMBLE.md) is inserted as the first thing after a vendored `SKILL.md`'s frontmatter, fenced by two HTML-comment markers, so an upstream refresh is a three-way merge around one block and the test can pin every copy against the source. It says, in order: load the instance's world (its pack, its tokens, its `DESIGN.md`; the neutral pack and the floors where it has none) before any taste rule; the fifteen-token contract is the only colour source; a style skill produces variants inside that world, never a second world; images are for hero plates and hero objects only; the instance's taste bans apply and win; the platform floors and the Kill Switch hold on every instance; look before you ship through the kit.
 5. **`vendor/` is the home, and it is exempt from the first-party budgets on purpose.** `scripts/gds/fitness-ratchets.js` already excludes any `vendor/` path segment from the line, oversize and duplication ratchets; a 150-file upstream tree is third-party code, not our debt. A skill the module *authors* lives at `skills/<name>/` and is counted.
 6. **The manifest stays the single declaration.** `module.json` `contributes.skills` names every skill the module ships, whether it lives in `.claude/skills/` or under the module; an undeclared dir is not a skill. `claude-materialize.js` gains step 1b: for every enabled module, each declared name that resolves to `modules/<key>/skills/<name>/` or `modules/<key>/skills/vendor/<name>/` (a dir with a `SKILL.md`) is copied — sidecar and licence included, the same `bongosify` + rebrand transforms — into the instance's `.claude/skills/<name>/`; a disabled module's are excluded by the rule that already existed; a name the core's own `.claude/skills/` carries keeps the core copy. `moduleSkillRoster` is the one place the enabled-or-not rule lives, shared by the old skip and the new copy, and it is walked once per materialise. **The gate holds at copy time, not only in CI:** a declared name is a path segment the materialiser writes under, so it must match `SKILL_NAME_RE` (a lowercase slug — `../x` names nothing) before any path is built; and a vendored dir lands only when `vendoredSkillGate` reads a `PROVENANCE.md` whose `licence` is on the allowlist and whose `scanVerdict` may land (the module's own `skills/policy.json` when present, the same five licences and two verdicts otherwise). A refusal is logged and reported in the summary, never a silent skip — a manual materialise outside CI cannot land an unvetted copy.
 7. **No auto-update.** A refresh is a task: re-scan the new commit, re-apply the preamble, update the sidecar. An instance may disable the module (which withdraws every vendored skill) or add its own skills under its own `.claude/skills/`; it never edits a vendored copy.

package/docs/file-map.md

@@ -99,7 +99,7 @@
 ├── modules/                    ← self-contained optional feature modules (ADR 0083 / docs/modules-contract.md). Each `modules/<key>/` is a full vertical slice — routes, migrations, skills, seam registrations — reached only through src/module-api.js. The loader discovers them at boot; no core file changes to add one.
 │   ├── game/                   ← the playable Example world — Phaser client, Colyseus rooms (WorldRoom/QueueRoom), world/terrain model, game DB tables, static assets. Moved BV1.R49 (task 1418). CLAUDE.md, module.json, routes/game.js, rooms/, world/, public/, migrations/.
 │   ├── discord/                ← outbound ship broadcast + inbound #ideas/#bugs bot + role-sync + channel management + account-link state + the Board Room mirror. Mirror only, never authority (ADR 0033). CLAUDE.md, module.json, routes/discord.js, routes/bug-attachments.js, discord-bot.js, discord-lib.js, board-broadcast.js (announce a window / edit the outcome onto it — R21/R22 of goal 1000069), migrations/discord_001_board_messages.sql.
-│   ├── art-pipeline/           ← self-improving pixel-art generation pipeline + the four otb-* art skills + the artist discipline. CLAUDE.md, module.json, routes/art-key.js, art/ (lives under art/ at repo root; module owns the route and discipline entry).
+│   ├── art-pipeline/           ← self-improving pixel-art generation pipeline (its otb-* skills are the pixel-art module's since task 1004470; artist is a core discipline since ADR 0272). CLAUDE.md, module.json, routes/art-key.js, art/ (lives under art/ at repo root; module owns the route and discipline entry).
 │   ├── memory/                 ← CORE-DOMAIN carve (BV1.R72, default-on): per-builder session memory + the recall/search retrieval layer (ADR 0060) + learnings. CLAUDE.md, module.json, routes/{memory,search,learnings}.js, memory.js, search.js, search-chunker.js, learnings.js.
 │   ├── grading/                ← CORE-DOMAIN carve (BV1.R73, default-on): the grade-a-diff adversarial worker panel + deterministic pre-passes + rubric; registers the `grade` kernel port. CLAUDE.md, module.json, routes/grade.js, grader.js, grader-rubric.json.
 │   ├── economy/                ← CORE-DOMAIN carve (BV1.R77, default-on): credit allocation + cost ledger + streaks + achievements + leaderboard; registers the `reward` kernel port. CLAUDE.md, module.json, routes/{cost,leaderboard,reward}.js, credits.js, cost.js, cost-classify.js, cost-summary-shape.js, streak.js, achievements.js, reward.js.
@@ -116,8 +116,10 @@
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a Bongos task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/gds/copy-apply.js lands it as a real diff under a claim. BV2.TW05 (task 1004316, ADR 0341 D8) added Tweak Mode's three derived READS — GET /copy-desk/pages, /copy-desk/pages/:pageId, /copy-desk/tally: page status and count, changelog, drift, "N of M tweaked" per surface, and the artist's tally — over the page-tweak tasks (lifecycle port), docs/page-inventory.json and docs/page-readings.json (both now in the publish manifest), with no status table. BV2.TW06 (task 1004317, ADR 0341 D2, D5, D6) added its first two page WRITES: POST /copy-desk/pages/:pageId/claim (an artist-craft builder opens or takes the page's tweak round as a web-claimed task, through the lifecycle port's webClaimPageTweak, under an advisory lock on the page) and POST /copy-desk/pages/:pageId/asks (anyone files a page ask, a copy_desk_flags row with scope 'page', added by copy_desk_002_page_asks.sql). CLAUDE.md, module.json, registry.js, flags.js, proposals.js, pages.js (the page-tweak block format), page-status.js (the pure derivation), page-data.js (the page artifacts' read side), routes/copy-desk.js, migrations/copy_desk_001_flags.sql, migrations/copy_desk_002_page_asks.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals,copy_page_status}.mjs + tests/fixtures/page-tweak.cjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
 │   ├── npm-release/             ← the deploy page for a project that publishes an npm package from GitHub (task 1002622, default-OFF — on only in the Bongos hall, which publishes @bongos/core). "Where the work is": every task finished in the last 14 days, placed in the stage it has actually reached (not merged · merged, no version yet · published, not running here · running here, not released · released · in no version), plus the version history — each version's tasks. The version↔task join reads the release-notes.json the package itself carries (scripts/gds/release-notes.js writes it at pack time), streamed out of the NEWEST version's npm tarball in-process (no child process, no sync call) when the running core's own copy stops short. module.json, work.js (the reading + the stage placement — the packument, tarball stream and tar reader it uses are the core's src/bongos/package-registry.js, reached through the doorway's readPackageRegistry since task 1004296), routes/work.js (GET /npm-release/work, gated core.pin.move like the page), public/work.{js,css} (the two sections /deploy lends it: #nr-work, #nr-versions). Task 1004301 added the same line on a task's own page: routes/task-where.js (GET /npm-release/task/:id, any signed-in builder — it shows nothing not already public) + public/task-widget.js, injected into task.html by the loader's uiSections seam (hallWidgetScripts file task-widget.js) to fill #task-contrib on otb:task-shown. Tests sit at the repo root — tests/npm_release_{work,page}.mjs — because a default-off module's own tests/ is skipped by the unit runner.
 │   ├── render-deploy/           ← the deploy page for a project whose app deploys through Render (task 1004270, default-OFF). The service's Render deploys, each tied to its commit and the Bongos tasks in it, what is live now, and deploy + roll back behind a two-step confirm the server also holds. The owner's Render key is never stored: it rides each request in a header. Uses the one Render client, scripts/gds/render-api.js, and its ownerId guard. `deploys.js` (shaping + ledger), `render.js` (key + client), `routes/` (app, history, act), `public/deploy.js` (the page, mounted in /deploy), `migrations/` (one two-id table)
-│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), design-taste-frontend-v1 (the earlier generation, kept distinct), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. minimalist-ui/, industrial-brutalist-ui/, gpt-taste/, stitch-design-taste/ (task 1003327 / ADR 0230) are the four looks, composition grammars with no colours of their own: the palette is the instance's pack and the texture is a named entry in styles/; a substrate is an archetype that still ships both modes, gpt-taste's selection is derived from the route rather than rolled, and stitch-design-taste writes a DESIGN.md-shaped contract document whose thirteen are transcribed from the pack. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's styles/grove/assets/ is the worked example. style/ (task 1003475 / ADR 0231) is the module's first FIRST-PARTY skill (no upstream, so a `## First party` section instead of `## Rebuilt from`): the /style session in which an owner authors their own look in four bounded steps, rendering the nearest library entries before asking, drafting inside the contract, retuning by measurement, and handing over the one-step adoption without ever writing config/branding.json. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
-│   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest, the otb-character-review skill. CLAUDE.md, module.json.
+│   ├── ui-design/               ← CORE-DOMAIN module (task 1003324 / ADR 0197, default-on): the design capability every builder on every instance gets — ships METHOD, never a world. Absorbs ADR 0081's layer: adapters/{claude-design,figma}/index.js (moved from src/ui/adapters/), scripts/{design-sync,figma-design-sync,validate-design}.js (moved from scripts/gds/, which keeps thin shims), docs/design-contract.md (moved from docs/). Declaration-only: contributes.skills design (the /design playbook, new) + design-sync + figma-design-sync; no routes/port/migrations, so disabling it touches no served surface. CLAUDE.md separates the platform FLOORS (the Fifteen Rule, the dark twins, no page :root, the 24px floor, AA in both modes, the kill switch) from the instance's WORLD (its packs + DESIGN.md). kit/ (task 1003320) is the look-before-you-ship kit: lib.js (the floors, the states/probes contracts, the action + expectation vocabularies, the WCAG maths, the stub spawner), serve.js (any surface through the doorway's real transforms + fixtures/), render.js (states × 1440/390/320 × dark/light, audited), probe.js (PASS/FAIL contracts), check-mock.js (platform rules + the instance's DESIGN.md taste bans, then the detector), tells.js (task 1003329 / ADR 0223: the anti-pattern detector as two tiers — floors FAIL, craft tells WARN, kit-ignore waivers per file; the rendered twins live in lib.js factsInPage), contrast.js + png.js; a page's <page>.states.json / <page>.probes.json sit BESIDE the surface (modules/public-landing/public/, modules/hall-ui/public/). Recipe: docs/recipes/ui-look-before-you-ship.md. The thirteen design-style skills that lived in skills/ are the opt-in design-styles module since task 1004470 (below); design-taste-frontend-v1 was deleted. styles/ (task 1003323 / ADR 0219) is the style library: <name>/pack.json (the theme.ui overlay, exactly the fifteen) + DESIGN.md (the look's derived recipes, thirteen in lockstep with the pack) + mock.html (the specimen); chrome-world (pinned to the neutral pack), expedition, grove, blueprint (the first cool look, authored through /style at task 1003475); STYLE=<name> on the kit lays a look over the instance's pack through GDS_BRANDING_FILE; tests/ui_design_styles.mjs runs the world/cosmos/hall token suites once per alternate (UI_DESIGN_PACK). config/design-tokens.* + design-sources.json STAY in config/ as the host boundary; public-landing keeps its own key (first customer, not owner).
+│   ├── design-styles/           ← the opt-in design-style skills (task 1004470, default-OFF): split out of ui-design so the thirteen descriptions are not resident on an instance that never designs a page; an instance turns it on with "design-styles": true in config/modules.json, and /design says plainly when it is off. Declaration-only: module.json, CLAUDE.md, skills/. skills/ (task 1003321 / ADR 0198) is the vendoring policy: policy.json (licence allowlist, verdicts that may land, sidecar fields, preamble markers), PREAMBLE.md (the platform preamble every vendored SKILL.md opens with), README.md (the roster — both origins scanned dangerous on 2026-08-28, landed as rebuild specs; nothing vendored — and the landing recipe); a landable copy goes under skills/vendor/<name>/ with PROVENANCE.md + LICENSE and is materialised into an instance's .claude/skills/ by claude-materialize.js step 1b. skills/<name>/ (task 1003325 / ADR 0220) are the in-house rebuilds from the specs, first-party and counted: design-taste-frontend (the default taste skill), high-end-visual-design (the polish pass), redesign-existing-projects (the in-place upgrade); each opens with the same preamble and carries a "Rebuilt from" section instead of a sidecar. impeccable/ (task 1003326 / ADR 0221) is the design-craft method as ONE skill with sub-commands: SKILL.md (the router, the menu, the craft floor, the bounded finish) + reference/<sub-command>.md (eighteen playbooks, one loaded per request); no hooks, no bypass agent, no telemetry, no live server. minimalist-ui/, industrial-brutalist-ui/, gpt-taste/, stitch-design-taste/ (task 1003327 / ADR 0230) are the four looks, composition grammars with no colours of their own: the palette is the instance's pack and the texture is a named entry in modules/ui-design/styles/; a substrate is an archetype that still ships both modes, gpt-taste's selection is derived from the route rather than rolled, and stitch-design-taste writes a DESIGN.md-shaped contract document whose thirteen are transcribed from the pack. image-to-code/, imagegen-frontend-web/, imagegen-frontend-mobile/, brandkit/ (task 1003328 / ADR 0222) are the image family under the hero-only rule: plates and hero objects only, the pair (JPEG dark plate + WebP alpha cutout) with a <file>.json sidecar beside each, through the instance's art pipeline key; the grove specimen's modules/ui-design/styles/grove/assets/ is the worked example. style/ (task 1003475 / ADR 0231) is the first FIRST-PARTY skill (no upstream, so a `## First party` section instead of `## Rebuilt from`): the /style session in which an owner authors their own look in four bounded steps, rendering the nearest library entries before asking, drafting inside the contract, retuning by measurement, and handing over the one-step adoption without ever writing config/branding.json.
+│   ├── pixel-art/               ← the opt-in pixel-art skills (task 1004470, default-OFF): otb-tile-generate, otb-design-review, otb-character-review, otb-feedback-capture, otb-figma-sync under skills/<name>/SKILL.md — moved out of .claude/skills/, where they were orphans no manifest owned. Skill TEXT only: the pipeline, palette, rubric and the copyrighted reference maps stay in the instance's never-published art-pipeline (ADR 0098). module.json, CLAUDE.md, skills/.
+│   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest (its otb-character-review skill is the pixel-art module's since task 1004470). CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.
 │   ├── government/              ← CORE-DOMAIN module (ADR 0151 / BV1 goal 1000030, renamed governance→government by ADR 0174, default-on): Discord-style configurable ranks + permissions. The PERMISSION is the atomic authority unit and the four ranks (xenos/thetes/metic/archon) are the positions in the government; the module owns the code-defined permission catalog — each key flagged `system` (trust-boundary), `substrate` (enforced out of band) or operational (delegable) — plus the compatibility seed that reproduces the old rank thresholds exactly. ADR 0016 is preserved: authority is still resolved server-side, per request, uncached. The word `role` is deliberately absent — it is reserved for the crafts. CLAUDE.md, module.json, catalog.js, ranks.js, resolver.js, config.js, db.js, board.js + board-membership.js + membership-predicate.js, session-scopes.{js,json}, protected-surfaces.{js,json}, routes/ (government + rank-sync), pollers/ (board-expiry), migrations/.
 │   ├── specialities/            ← CORE-DOMAIN module (task 1003855 / ADR 0296, default-on): role SUB-SPECIALITIES — a named bundle of knowledge, skills and an interaction contract sitting UNDER a craft. A craft says HOW you work (engineer/ideator/artist/ui); a speciality says WHAT you work on, and how a subject-matter expert wants to be engaged inside it. Deliberately thin over three surfaces that already exist — discipline-modes.json for craft→playbook, behavior_prefs.interaction for the per-session contract (a speciality contract rides the SAME GET /me → Conductor path rather than adding a second one), and the ADR 0083 manifest for declared skills; the only new machinery is the knowledge bundle. Training is two-fold: documents the builder supplied, plus learnings captured from sessions worked in the speciality (pointing at existing `learnings` rows, never a second corpus). Owned per-builder OR per-project, each carrying its owner's sharing decision (private/project/public) and a sellable flag that records INTENT only — ADR 0107 defers the marketplace, so there is nothing to list on. CLAUDE.md, module.json, specialities.js, db.js, routes/, migrations/.
@@ -361,57 +363,52 @@ tests/
 <!-- BEGIN GENERATED FILE-MAP .claude/skills/ (scripts/gds/gen-file-map.js — do not hand-edit; notes live in docs/file-map.notes.json) -->
 ```
 .claude/skills/
-├── ask-for-help/SKILL.md          ← /ask-for-help — turn 'ask <builder> to help with task N' into a filed collab help request (POST /help-requests): resolve the name to a builder id, one addressee (person XOR craft) and one context (task XOR goal), a what_is_stuck answerable without this session, then settle it; routes the near-neighbours (recommendation vs blocker) and states that the addressed read is a pull, not a push (task 1003826)
-├── backlog-review/SKILL.md        ← /backlog-review — daily walk of status=backlog, the pre-workable state a human must say go on: splits rows waiting on a PERSON (promote / kill / water) from rows waiting on a live dep TRIGGER (counted, never walked, migration 163) and surfaces rows stranded behind an abandoned dep; runs scripts/gds/backlog-review.js (task 1003746); Metic+
-├── blocker-review/SKILL.md        ← /blocker-review — daily review of open Bongos blockers (resolve / escalate / note); Metic+
-├── blocker-solve/SKILL.md         ← /blocker-solve N — drive ONE blocker to done: do the doable parts, hand back owner-only steps, verify, auto-resolve (auto-promotes waiters); Metic+
-├── bongos-feedback/SKILL.md       ← /bongos-feedback — send feedback about Bongos itself upstream to the Cloud Bongos maintainers via `bongos feedback` (a bug lands as a backlog task in the maintenance goal, an idea in the hub inbox); backed by scripts/gds/feedback-send.js (task 1004462)
-├── bug-triage/SKILL.md            ← /bug-triage — daily walk through open kind=bug tasks (batch-cluster near-dups, merge / won't-fix); the idea-triage counterpart built on the new tasks.merge primitive (task 1001478); Metic+
-├── builder-backup/SKILL.md        ← /builder-backup — check DB backup status or trigger a fresh local dump before risky changes (migrations, destructive SQL); no SSH required
-├── builder-claim/SKILL.md         ← /builder-claim N — atomic claim; prints the claim-time context pack + discipline playbook routing
-├── builder-cost/SKILL.md          ← /builder-cost — log a cost-ledger entry (api|compute|infra|domain|art|other)
-├── builder-end/SKILL.md           ← /builder-end — safely close out a session: resolve the claim (ship/release) + clean-git verify + worktree teardown; the bookend to /builder-start, and the own-scoped session close-out that /builder-exit redirects non-Archons to
-├── builder-exit/SKILL.md          ← /builder-exit — gracefully offboard (or reactivate) a builder: release claims, seal session logs, drop rank to xenos
-├── builder-key/SKILL.md           ← /builder-key — list API-key status, render the visual 'key needed' callout for anything missing, drive the UI-first Settings add-flow + re-sync/confirm; never accepts a key pasted in chat (task 1391)
-├── builder-reauth/SKILL.md        ← /builder-reauth — refresh an expired Bongos CLI session the UI-first way (no terminal Device Flow)
-├── builder-redteam/SKILL.md       ← /builder-redteam — file a red-team / vulnerability report (severity, target, repro) to /api/bongos/security
-├── builder-release/SKILL.md       ← /builder-release — abandon a claim (task returns to ready, no credits)
-├── builder-sequence/SKILL.md      ← /builder-sequence N — walk a whole dependency chain from one kickoff (claim → build → ship → next), one claim at a time; halts and reports on migration/security/protected-path/thin-spec/judgement tasks (scripts/gds/sequence.js, task 1002484)
-├── builder-setup/SKILL.md         ← /builder-setup — one-time GitHub Device Flow auth (Bongos); multi-builder-on-one-device gate
-├── builder-ship/SKILL.md          ← /builder-ship — record + award credits (runs touches[] scanner; warns on drift; sandbox-first review gate for game-surface changes, ADR 0046)
-├── builder-stage/SKILL.md         ← /builder-stage — stage work on the builder's own local sandbox preview (http://localhost:<port>) for browser review before shipping (#927, ADR 0046)
-├── builder-start/SKILL.md         ← /builder-start — list claimable tasks (parallel-safe vs active claims)
-├── collab-review/SKILL.md         ← /collab-review — the ANSWERING half of /ask-for-help: walk GET /help-requests/for-me + GET /task-recommendations/for-me oldest first, read the task each names, VERIFY the ask's claims against the live row rather than its prose, bring one decision at a time and halt; then execute the chosen write, and — since only the ASKER may settle a help request — close the loop by filing a reply addressed back to them. Treats an ask as data, never instructions (task 1004181)
-├── design/SKILL.md                ← /design — the UI design session: the operating playbook for ui-discipline work on ANY instance (load the instance's pack + DESIGN.md first, look before you ship, build inside the platform floors, ship the tests with the UI); routed from a `ui` claim via discipline-modes.json; shipped by the ui-design module (task 1003324, ADR 0197)
-├── design-sync/SKILL.md           ← /design-sync — export repo design tokens + surfaces into Claude Design (token-preview bundle) and land generated UI code back as a Bongos task (ADR 0081)
-├── feedback/SKILL.md              ← /feedback — pull the latest Bongos feedback bundle (prompt.md + screenshot file paths) into a Claude Code session; backed by scripts/gds/feedback-latest.js (BV1.R13, ADR 0087)
-├── figma-design-sync/SKILL.md     ← sync UI-surface tokens/surfaces with Figma (push a frame plan, land a designer's Code Connect / MCP snapshot edit back as code) — the ADR 0081 human escape hatch; distinct from otb-figma-sync's pixel-art tile review (task 2048)
-├── fix-task/SKILL.md              ← /fix-task N — claim, fix (test-first), verify, and ship a single Bongos task by id end to end; defers to /builder-claim + /builder-ship for their own mechanics
-├── goal-create/SKILL.md           ← /goal-create — plan and create ONE goal (the module-scoped workspace between version and criteria, ADR 0086) in one session: <redacted>, scope wall, 2-4 criteria, seed tasks; also the auto-pickup when a task is created with no goal to live in (goal_advisory); Metic+ (Archon for a protected-module scope)
-├── goal-review/SKILL.md           ← /goal-review — the criteria a UAT cannot close (all linked work abandoned, or none linked): reject and file the real work, or override with a written reason (ADR 0351); Metic+
-├── goal-uat/SKILL.md              ← /goal-uat — walk every criterion awaiting UAT: script the live-site test from the criterion's words, record it, and sign it off (the signer must not have shipped the work); closing a goal's last criterion achieves it (ADR 0351, task 1004392); Metic+
-├── grade-audit/SKILL.md           ← /grade-audit — manual-cadence accountability sweep: override ledger (shipped-despite-fail, infra vs real, un-requested confirms named), dropped blocker/major findings on passes queued via capture.js with the advisory-Narc filter, runtime-blindness false-pass spot-check, outage roll-up → /grader-health; describes and queues only, never confirms (ADR 0158 §2, task 1002657)
-├── grade-recover/SKILL.md         ← /grade-recover N — the 'my grade failed, now what' loop: diagnose outage vs fabricated fail vs genuine fail from the persisted grade, then run the right recovery (--regrade or the auditable override-request); adds no ship-path gate (ADR 0162, task 1002655)
-├── grader-health/SKILL.md         ← /grader-health — read-only grader health check: outage runs (n_unavailable streaks, outage-vs-rejection confirmation), pass-rate drift vs baseline, per-grade cost anomalies, stale model pins; emits exact --regrade remediation lines; optional --probe live calibration (Metic+, paid) (task 1002656)
-├── idea-triage/SKILL.md           ← /idea-triage — daily walk through the Bongos idea_inbox (promote / discard / merge); Metic+
-├── merge-mode/SKILL.md            ← /merge-mode — manual fallback for the auto-merge: land every confirmed task (merge + smoke + deploy)
-├── new-project/SKILL.md           ← /new-project — the canonical zero-to-live onboarding runbook for a new STANDALONE instance (name+address → init → scaffold → provision → OAuth+verified-secret+sign-in → verify → brand); the CLI + hall wizard are forms over it ([#1981](https://example.com/builders#/task/1981))
-├── otb-character-review/SKILL.md  ← /otb-character-review — score a painterly character ANIMATION (same character / anatomy / pose / smooth motion) — the animation sibling of otb-design-review (ADR 0088)
-├── otb-design-review/SKILL.md     ← /otb-design-review — score a tile against the Example rubric
-├── otb-feedback-capture/SKILL.md  ← /otb-feedback-capture — verbal design feedback → a durable style_guide.md rule
-├── otb-figma-sync/SKILL.md        ← /otb-figma-sync — push tiles into the Example Figma file as a review canvas
-├── otb-tile-generate/SKILL.md     ← /otb-tile-generate — run the pixel-art pipeline (generate world tiles/sprites)
-├── planning-session/SKILL.md      ← /planning-session — run a structured planning session for an upcoming version (set criteria, brainstorm, rank, seed Bongos); Metic+
-├── priority-session/SKILL.md      ← /priority-session — a trusted builder answers plain-speech questions; the answers reweight the idea_inbox + suggest what to build next
-├── read-session-export/SKILL.md   ← /read-session-export — read a Claude Code /export zip fast (prompts + thinking + tool calls → stdout); reads the existing export, doesn't make one. Backed by scripts/gds/read-session-export.js
-├── recall/SKILL.md                ← /recall — one-call project-knowledge search across repo docs + DB prose (tasks, learnings, session logs)
-├── scan-before-install/SKILL.md   ← /scan-before-install — quarantine-fetch a third-party repo/plugin, deterministic floor + tiered subagent panel over the scrubbed mirror, arithmetic verdict + honest-limits report to the builder's own config dir; prints install commands (pinned SHA only), never installs (goal 1000055)
-├── session-handoff/SKILL.md       ← /session-handoff — compose a clean, paste-ready next-steps prompt to START a fresh session with (keeps context light by curating what carries forward); read-only, distinct from /builder-ship's ledger notes and /builder-end's close-out
-├── ship-check/SKILL.md            ← /ship-check — run every freshness + fitness check ship.js will run (repo-map/session-index/file-map/api-docs/copy-registry --check, linkify, skill-lint, fitness; --tests adds the DB-free lane; an ADVISORY render-fit row renders the changed pages via scripts/gds/render-check.js, ADR 0329) in ONE command before shipping, with the healing command per stale artifact (task 1003548; script scripts/gds/ship-check.js)
-├── status/SKILL.md                ← /status — what's the status of X / what's left for criterion Cn (read-only rollup)
-├── strand-fix/SKILL.md            ← /strand-fix N — walk ONE stranded confirmed task (strand:no_branch_no_tip / land_not_proven — the shape the reconciler gave up on) to shipped: find the work (main commit / unpushed branch / conflicting PR / nowhere), do the one sanctioned move, verify the flip; also clears a 409 REBASE_REQUIRED claim gate (task 1003365)
-├── tweak/SKILL.md                 ← /tweak — apply the next SUBMITTED page tweak (Tweak Mode, ADR 0341): claim the round, copy-apply.js --batch every line (refusals named, never skipped), tweak-renders.js before/after desktop+phone light+dark into named task-visual slots, ship so the passed grade waits at completed for the artist (task 1004322)
-└── worktree-clean/SKILL.md        ← /worktree-clean — list the per-claim worktrees whose branch already landed on main (scripts/gds/stale-worktrees.js) and remove each through the junction-safe worktree.js remove; never raw git worktree remove (task 1003365)
+├── ask-for-help/SKILL.md         ← /ask-for-help — turn 'ask <builder> to help with task N' into a filed collab help request (POST /help-requests): resolve the name to a builder id, one addressee (person XOR craft) and one context (task XOR goal), a what_is_stuck answerable without this session, then settle it; routes the near-neighbours (recommendation vs blocker) and states that the addressed read is a pull, not a push (task 1003826)
+├── backlog-review/SKILL.md       ← /backlog-review — daily walk of status=backlog, the pre-workable state a human must say go on: splits rows waiting on a PERSON (promote / kill / water) from rows waiting on a live dep TRIGGER (counted, never walked, migration 163) and surfaces rows stranded behind an abandoned dep; runs scripts/gds/backlog-review.js (task 1003746); Metic+
+├── blocker-review/SKILL.md       ← /blocker-review — daily review of open Bongos blockers (resolve / escalate / note); Metic+
+├── blocker-solve/SKILL.md        ← /blocker-solve N — drive ONE blocker to done: do the doable parts, hand back owner-only steps, verify, auto-resolve (auto-promotes waiters); Metic+
+├── bongos-feedback/SKILL.md      ← /bongos-feedback — send feedback about Bongos itself upstream to the Cloud Bongos maintainers via `bongos feedback` (a bug lands as a backlog task in the maintenance goal, an idea in the hub inbox); backed by scripts/gds/feedback-send.js (task 1004462)
+├── bug-triage/SKILL.md           ← /bug-triage — daily walk through open kind=bug tasks (batch-cluster near-dups, merge / won't-fix); the idea-triage counterpart built on the new tasks.merge primitive (task 1001478); Metic+
+├── builder-backup/SKILL.md       ← /builder-backup — check DB backup status or trigger a fresh local dump before risky changes (migrations, destructive SQL); no SSH required
+├── builder-claim/SKILL.md        ← /builder-claim N — atomic claim; prints the claim-time context pack + discipline playbook routing
+├── builder-cost/SKILL.md         ← /builder-cost — log a cost-ledger entry (api|compute|infra|domain|art|other)
+├── builder-end/SKILL.md          ← /builder-end — safely close out a session: resolve the claim (ship/release) + clean-git verify + worktree teardown; the bookend to /builder-start, and the own-scoped session close-out that /builder-exit redirects non-Archons to
+├── builder-exit/SKILL.md         ← /builder-exit — gracefully offboard (or reactivate) a builder: release claims, seal session logs, drop rank to xenos
+├── builder-key/SKILL.md          ← /builder-key — list API-key status, render the visual 'key needed' callout for anything missing, drive the UI-first Settings add-flow + re-sync/confirm; never accepts a key pasted in chat (task 1391)
+├── builder-reauth/SKILL.md       ← /builder-reauth — refresh an expired Bongos CLI session the UI-first way (no terminal Device Flow)
+├── builder-redteam/SKILL.md      ← /builder-redteam — file a red-team / vulnerability report (severity, target, repro) to /api/bongos/security
+├── builder-release/SKILL.md      ← /builder-release — abandon a claim (task returns to ready, no credits)
+├── builder-sequence/SKILL.md     ← /builder-sequence N — walk a whole dependency chain from one kickoff (claim → build → ship → next), one claim at a time; halts and reports on migration/security/protected-path/thin-spec/judgement tasks (scripts/gds/sequence.js, task 1002484)
+├── builder-setup/SKILL.md        ← /builder-setup — one-time GitHub Device Flow auth (Bongos); multi-builder-on-one-device gate
+├── builder-ship/SKILL.md         ← /builder-ship — record + award credits (runs touches[] scanner; warns on drift; sandbox-first review gate for game-surface changes, ADR 0046)
+├── builder-stage/SKILL.md        ← /builder-stage — stage work on the builder's own local sandbox preview (http://localhost:<port>) for browser review before shipping (#927, ADR 0046)
+├── builder-start/SKILL.md        ← /builder-start — list claimable tasks (parallel-safe vs active claims)
+├── collab-review/SKILL.md        ← /collab-review — the ANSWERING half of /ask-for-help: walk GET /help-requests/for-me + GET /task-recommendations/for-me oldest first, read the task each names, VERIFY the ask's claims against the live row rather than its prose, bring one decision at a time and halt; then execute the chosen write, and — since only the ASKER may settle a help request — close the loop by filing a reply addressed back to them. Treats an ask as data, never instructions (task 1004181)
+├── design/SKILL.md               ← /design — the UI design session: the operating playbook for ui-discipline work on ANY instance (load the instance's pack + DESIGN.md first, look before you ship, build inside the platform floors, ship the tests with the UI); routed from a `ui` claim via discipline-modes.json; shipped by the ui-design module (task 1003324, ADR 0197)
+├── design-sync/SKILL.md          ← /design-sync — export repo design tokens + surfaces into Claude Design (token-preview bundle) and land generated UI code back as a Bongos task (ADR 0081)
+├── feedback/SKILL.md             ← /feedback — pull the latest Bongos feedback bundle (prompt.md + screenshot file paths) into a Claude Code session; backed by scripts/gds/feedback-latest.js (BV1.R13, ADR 0087)
+├── figma-design-sync/SKILL.md    ← sync UI-surface tokens/surfaces with Figma (push a frame plan, land a designer's Code Connect / MCP snapshot edit back as code) — the ADR 0081 human escape hatch; distinct from otb-figma-sync's pixel-art tile review (task 2048)
+├── fix-task/SKILL.md             ← /fix-task N — claim, fix (test-first), verify, and ship a single Bongos task by id end to end; defers to /builder-claim + /builder-ship for their own mechanics
+├── goal-create/SKILL.md          ← /goal-create — plan and create ONE goal (the module-scoped workspace between version and criteria, ADR 0086) in one session: <redacted>, scope wall, 2-4 criteria, seed tasks; also the auto-pickup when a task is created with no goal to live in (goal_advisory); Metic+ (Archon for a protected-module scope)
+├── goal-review/SKILL.md          ← /goal-review — the criteria a UAT cannot close (all linked work abandoned, or none linked): reject and file the real work, or override with a written reason (ADR 0351); Metic+
+├── goal-uat/SKILL.md             ← /goal-uat — walk every criterion awaiting UAT: script the live-site test from the criterion's words, record it, and sign it off (the signer must not have shipped the work); closing a goal's last criterion achieves it (ADR 0351, task 1004392); Metic+
+├── grade-audit/SKILL.md          ← /grade-audit — manual-cadence accountability sweep: override ledger (shipped-despite-fail, infra vs real, un-requested confirms named), dropped blocker/major findings on passes queued via capture.js with the advisory-Narc filter, runtime-blindness false-pass spot-check, outage roll-up → /grader-health; describes and queues only, never confirms (ADR 0158 §2, task 1002657)
+├── grade-recover/SKILL.md        ← /grade-recover N — the 'my grade failed, now what' loop: diagnose outage vs fabricated fail vs genuine fail from the persisted grade, then run the right recovery (--regrade or the auditable override-request); adds no ship-path gate (ADR 0162, task 1002655)
+├── grader-health/SKILL.md        ← /grader-health — read-only grader health check: outage runs (n_unavailable streaks, outage-vs-rejection confirmation), pass-rate drift vs baseline, per-grade cost anomalies, stale model pins; emits exact --regrade remediation lines; optional --probe live calibration (Metic+, paid) (task 1002656)
+├── idea-triage/SKILL.md          ← /idea-triage — daily walk through the Bongos idea_inbox (promote / discard / merge); Metic+
+├── merge-mode/SKILL.md           ← /merge-mode — manual fallback for the auto-merge: land every confirmed task (merge + smoke + deploy)
+├── new-project/SKILL.md          ← /new-project — the canonical zero-to-live onboarding runbook for a new STANDALONE instance (name+address → init → scaffold → provision → OAuth+verified-secret+sign-in → verify → brand); the CLI + hall wizard are forms over it ([#1981](https://example.com/builders#/task/1981))
+├── planning-session/SKILL.md     ← /planning-session — run a structured planning session for an upcoming version (set criteria, brainstorm, rank, seed Bongos); Metic+
+├── priority-session/SKILL.md     ← /priority-session — a trusted builder answers plain-speech questions; the answers reweight the idea_inbox + suggest what to build next
+├── read-session-export/SKILL.md  ← /read-session-export — read a Claude Code /export zip fast (prompts + thinking + tool calls → stdout); reads the existing export, doesn't make one. Backed by scripts/gds/read-session-export.js
+├── recall/SKILL.md               ← /recall — one-call project-knowledge search across repo docs + DB prose (tasks, learnings, session logs)
+├── scan-before-install/SKILL.md  ← /scan-before-install — quarantine-fetch a third-party repo/plugin, deterministic floor + tiered subagent panel over the scrubbed mirror, arithmetic verdict + honest-limits report to the builder's own config dir; prints install commands (pinned SHA only), never installs (goal 1000055)
+├── session-handoff/SKILL.md      ← /session-handoff — compose a clean, paste-ready next-steps prompt to START a fresh session with (keeps context light by curating what carries forward); read-only, distinct from /builder-ship's ledger notes and /builder-end's close-out
+├── ship-check/SKILL.md           ← /ship-check — run every freshness + fitness check ship.js will run (repo-map/session-index/file-map/api-docs/copy-registry --check, linkify, skill-lint, fitness; --tests adds the DB-free lane; an ADVISORY render-fit row renders the changed pages via scripts/gds/render-check.js, ADR 0329) in ONE command before shipping, with the healing command per stale artifact (task 1003548; script scripts/gds/ship-check.js)
+├── status/SKILL.md               ← /status — what's the status of X / what's left for criterion Cn (read-only rollup)
+├── strand-fix/SKILL.md           ← /strand-fix N — walk ONE stranded confirmed task (strand:no_branch_no_tip / land_not_proven — the shape the reconciler gave up on) to shipped: find the work (main commit / unpushed branch / conflicting PR / nowhere), do the one sanctioned move, verify the flip; also clears a 409 REBASE_REQUIRED claim gate (task 1003365)
+├── tweak/SKILL.md                ← /tweak — apply the next SUBMITTED page tweak (Tweak Mode, ADR 0341): claim the round, copy-apply.js --batch every line (refusals named, never skipped), tweak-renders.js before/after desktop+phone light+dark into named task-visual slots, ship so the passed grade waits at completed for the artist (task 1004322)
+└── worktree-clean/SKILL.md       ← /worktree-clean — list the per-claim worktrees whose branch already landed on main (scripts/gds/stale-worktrees.js) and remove each through the junction-safe worktree.js remove; never raw git worktree remove (task 1003365)
 ```
 <!-- END GENERATED FILE-MAP .claude/skills/ -->
 

package/docs/module-api-changelog.md

@@ -2737,5 +2737,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.38 with no explicit bump. run 36796243918. (task 1002620)
   1.20.40 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.39 with no explicit bump. run 36797045221. (task 1002620)
+  1.20.41 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.40 with no explicit bump. run 36798842066. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -19,7 +19,7 @@ Two fitness checks enforce it on every build — a violation is a red CI gate, n
 ## The cut: core vs modules
 
 - **Core** is the trust kernel + the lifecycle state machine + the domains not yet carved: auth/identity/audit/rank (the kernel, [ADR 0091](adr/0091-bounding-the-kernel-and-db-carve.md) §1), the lifecycle (tasks, claims, versions, done-when, ship — never split), and the still-core domains (autonomy/MAS, the two web UIs) plus always-on infra (analytics, audit-log, gate-approvals, healthz, public). The remaining tranche-2 domains carve out per [ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1; the lifecycle stays core. (Sessions/BFG — the `session_records` corpus + data plane + the BFG scorer + session-pulse — carved to `modules/sessions/` at R82; like `memory` it registers no port and core never calls back in. The per-claim `session_logs` ship LOG + `builder_sessions` auth tokens stay core.)
-- **Modules** are optional features an instance turns on via `config/modules.json` or env (the feature modules `game`, `discord`, `art-pipeline`, `character-anim`), plus the **core-domain modules** that are `default: true` (always on unless disabled): `memory` (R72), `grading` (R73), `economy` — credits/cost/streaks/achievements/leaderboard (R77), `ideas` — inbox/capture/triage/blockers (R78), `security` — red-team reports + bounty (R79), `builder-settings` — wandering/skill/sound/render prefs + builder-needs (R80), `onboarding` — admission/onboarding-state/newcomer-restock (R81), and `sessions` — session_records corpus + BFG + session-pulse (R82). Each is a self-contained directory under `modules/<key>/`.
+- **Modules** are optional features an instance turns on via `config/modules.json` or env (the feature modules `game`, `discord`, `art-pipeline`, `character-anim`, and the opt-in skill modules `pixel-art` + `design-styles` of task 1004470), plus the **core-domain modules** that are `default: true` (always on unless disabled): `memory` (R72), `grading` (R73), `economy` — credits/cost/streaks/achievements/leaderboard (R77), `ideas` — inbox/capture/triage/blockers (R78), `security` — red-team reports + bounty (R79), `builder-settings` — wandering/skill/sound/render prefs + builder-needs (R80), `onboarding` — admission/onboarding-state/newcomer-restock (R81), and `sessions` — session_records corpus + BFG + session-pulse (R82). Each is a self-contained directory under `modules/<key>/`.
 
 ---
 
@@ -265,8 +265,9 @@ Rules (enforced by the `BV1.R45` fitness check):
 |---|---|---|---|
 | **`game`** | routes: `game`; rooms: `WorldRoom`/`QueueRoom` | provides `game.staticRoot`, `game.registerRooms`, `game.precreateWorldRoom` | `^1.4.0` |
 | **`discord`** | routes: `discord`, `bug-attachments`; pollers: `discord-bot` | provides `discord.isLinked`; consumes `ideas.capture` | `^1.4.0` |
-| **`art-pipeline`** | routes: `art-key`; disciplines: `artist`; skills: `otb-tile-generate` etc.; uiSections: `art` | provides `art.sharedKeyConfigured` | `^1.3.0` |
-| **`character-anim`** | skills: `otb-character-review` (prerequisite: `art-pipeline`) | — (declaration-only JS; runtime is the Python pipeline under `art/`) | `^1.4.0` |
+| **`art-pipeline`** *(host module — no `module.json` in the core, never published: ADR 0098, ADR 0272)* | routes: `art-key`; uiSections: `art` (on an instance that carries it). Its skills are **not** its own any more — they are `pixel-art`'s, below; `artist` is a core discipline since ADR 0272 | provides `art.sharedKeyConfigured` | `^1.3.0` |
+| **`character-anim`** *(host module — no `module.json` in the core)* | — its `otb-character-review` skill is `pixel-art`'s since task 1004470 | — (runtime is the Python pipeline under `art/`) | `^1.4.0` |
+| **`pixel-art`** *(default-off; task 1004470)* | skills: `otb-tile-generate`, `otb-design-review`, `otb-character-review`, `otb-feedback-capture`, `otb-figma-sync` — skill text only, never a reference map, palette or generated art | — (declaration-only: NO port, NO routes; turning it on lands the five skills, the pipeline they drive is the instance's own `art-pipeline`) | `^1.19.0` |
 | **`memory`** *(core-domain, default-on; R72)* | routes: `memory`, `search`, `learnings` | — | `^1.5.0` |
 | **`grading`** *(core-domain, default-on; R73)* | routes: `grade` | provides `grade` | `^1.6.0` |
 | **`economy`** *(core-domain, default-on; R77)* | routes: `cost`, `leaderboard`, `reward` | provides `reward` | `^1.7.0` |
@@ -281,13 +282,14 @@ Rules (enforced by the `BV1.R45` fitness check):
 | **`public-landing`** *(core-domain web surface, default-on; task 1003322 / ADR 0218)* | webSurfaces: `{ apexRoot: true, dir: "public" }` (the front door at the apex root: `/`, `/projects`, `/create`, `/privacy`, `/terms`, `/contact`) | — (registers NO port; the first surface that is not a subdomain, and like `hall-ui` it keeps a DEDICATED serving block — in `platform-server.js`) | `^1.19.0` |
 | **`lifecycle`** *(core-domain, default-on; R86)* | routes: `tasks`, `claims`, `versions`, `done-when`, `goals`, `dependencies`, `gate-approvals`, `analytics` | provides `lifecycle` (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads); resolves `reward`, `onboarding` | `^1.12.0` |
 | **`provisioning`** *(default-off; [ADR 0111](adr/0111-instance-hosting-provisioning-module.md))* | routes: `provisioning` (own+Archon rank-gated) | provides `provisioning.instanceState` | `^1.14.0` |
-| **`ui-design`** *(core-domain, default-on; [ADR 0197](adr/0197-the-ui-design-module.md))* | skills: `design`, `design-sync`, `figma-design-sync` (the /design playbook + the two tool round-trips); the ADR 0081 adapters, sync CLIs and validator live in the module dir | — (registers NO port, NO routes; declaration-only — disabling it withdraws the skills and touches no served surface) | `^1.19.0` |
+| **`ui-design`** *(core-domain, default-on; [ADR 0197](adr/0197-the-ui-design-module.md))* | skills: `design`, `design-sync`, `figma-design-sync` (the /design playbook + the two tool round-trips) and nothing else since task 1004470; the ADR 0081 adapters, sync CLIs, validator, kit and style library live in the module dir | — (registers NO port, NO routes; declaration-only — disabling it withdraws the skills and touches no served surface) | `^1.19.0` |
+| **`design-styles`** *(default-off; task 1004470)* | skills: the thirteen design-style skills split out of `ui-design` — `design-taste-frontend`, `high-end-visual-design`, `redesign-existing-projects`, `impeccable`, `style`, `minimalist-ui`, `industrial-brutalist-ui`, `gpt-taste`, `stitch-design-taste`, `image-to-code`, `imagegen-frontend-web`, `imagegen-frontend-mobile`, `brandkit` — with `skills/policy.json` + `PREAMBLE.md` (ADR 0198) | — (declaration-only; `/design` names them when it is on and says they are off when it is not) | `^1.19.0` |
 
 Each module's `modules/<key>/CLAUDE.md` is the authoritative per-module reference (files, seams, tests, what is NOT in the module).
 
 > **Only <redacted> is the `security` module** ([ADR 0093](adr/0093-tranche-2-core-carve-sequence.md) §1, [02-module-map §5](design/modular-architecture/02-module-map.md)): the red-team / vulnerability reports + bounty (rank-gated Metic+). <redacted> — the `permission-path-check`/`route-rank-check` authz machinery AND the `/security/adr` threat-model reader + Archon-only `/security/docs` exploit-detail store (`src/bongos/routes/security.js`, backed by the core `db.js` `security_docs` queries) — stays kernel.
 
-> **`character-anim` is a declaration-only module** ([ADR 0088](adr/0088-consistent-character-generative-animation.md)): consistent-character generative animation. Its manifest contributes the `otb-character-review` skill and declares the `art-pipeline` prerequisite; it has no routes/seams/migrations. The runtime — the contract entry point `art/pipeline/character_anim_module.py` (`animate(model-sheet + action-spec) → graded registered frame set + manifest`), with a config-driven rubric (a `character_anim` family) and a pluggable generator backend — lives under `art/` like the rest of the art pipeline, the same way `art-pipeline` keeps `art/` at the repo root.
+> **`character-anim` is a host-side declaration** ([ADR 0088](adr/0088-consistent-character-generative-animation.md)): consistent-character generative animation. It has no `module.json` in the core and no routes/seams/migrations; the `otb-character-review` skill it was documented as contributing is the `pixel-art` module's since task 1004470, which is what an instance turns on to get it. The runtime — the contract entry point `art/pipeline/character_anim_module.py` (`animate(model-sheet + action-spec) → graded registered frame set + manifest`), with a config-driven rubric (a `character_anim` family) and a pluggable generator backend — lives under `art/` like the rest of the art pipeline, the same way `art-pipeline` keeps `art/` at the repo root.
 
 ---
 

package/docs/onboarding/slash-commands.md

@@ -64,7 +64,7 @@ The three core crafts no longer have a slash command. `/dev`, `/paint` and `/ide
 
 ### Design and art pipeline
 
-`/design` is the ui-discipline playbook (world-first, show-first — shipped by the `ui-design` module, ADR 0197); `/design-sync` and `/figma-design-sync` round-trip the UI design system. The `/otb-*` family — `otb-tile-generate`, `otb-design-review`, `otb-character-review`, `otb-feedback-capture`, `otb-figma-sync` — is the reference instance's pixel-art pipeline; it's only meaningful on an instance that runs that pipeline.
+`/design` is the ui-discipline playbook (world-first, show-first — shipped by the `ui-design` module, ADR 0197); `/design-sync` and `/figma-design-sync` round-trip the UI design system. The `/otb-*` family — `otb-tile-generate`, `otb-design-review`, `otb-character-review`, `otb-feedback-capture`, `otb-figma-sync` — is the reference instance's pixel-art pipeline; it's only meaningful on an instance that runs that pipeline, so it ships in the `pixel-art` module, which is off unless the project turns it on. The design-style skills (`/impeccable`, `/style`, the taste and look skills) are the same: the `design-styles` module, off unless turned on — `/design` tells you which.
 
 ### Session and meta
 

package/modules/design-styles/CLAUDE.md

@@ -0,0 +1,15 @@
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
+
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
+
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
+
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
+
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/design-styles/module.json

@@ -0,0 +1,12 @@
+{
+  "key": "design-styles",
+  "title": "Design styles (the in-house taste, look, image-family and craft skills)",
+  "description": "The thirteen design-STYLE skills split out of ui-design (task 1004470, owner ruling on blocker 1000139): the taste core (design-taste-frontend, high-end-visual-design, redesign-existing-projects), the impeccable craft method, the /style session, the four looks (minimalist-ui, industrial-brutalist-ui, gpt-taste, stitch-design-taste) and the image family (image-to-code, imagegen-frontend-web, imagegen-frontend-mobile, brandkit). Every one is an in-house rebuild or a first-party original (ADR 0220, ADR 0231), carrying the PLATFORM PREAMBLE from skills/PREAMBLE.md and governed by the vendoring policy in skills/policy.json (ADR 0198). ui-design keeps the method every instance needs — /design, the two sync skills, the contract, the kit and the style library (modules/ui-design/styles/, which these skills name as their palette source) — and stays default-on; these are opt-in because their descriptions alone are ~5,000 chars resident in every session. /design names them when this module is on and says plainly that they are off when it is not. Declaration-only: no routes, no migrations, no port.",
+  "version": "1.0.0",
+  "coreVersion": "^1.19.0",
+  "default": false,
+  "maintenance": { "status": "core-maintained" },
+  "contributes": { "skills": ["design-taste-frontend", "high-end-visual-design", "redesign-existing-projects", "impeccable", "style", "minimalist-ui", "industrial-brutalist-ui", "gpt-taste", "stitch-design-taste", "image-to-code", "imagegen-frontend-web", "imagegen-frontend-mobile", "brandkit"] },
+  "provides": [],
+  "consumes": []
+}

package/modules/{ui-design → design-styles}/skills/PREAMBLE.md

@@ -1,5 +1,5 @@
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/README.md

@@ -1,6 +1,6 @@
-# `modules/ui-design/skills/` — the vetted UI skills: the policy, the roster, and why the roster is what it is
+# `modules/design-styles/skills/` — the vetted UI skills: the policy, the roster, and why the roster is what it is
 
-The home for third-party design skills the `ui-design` module ships to every builder on every instance where the module is on ([task 1003321](https://cloudbongos.com/builders#/task/1003321), [ADR 0198](../../../docs/adr/0198-third-party-skill-vendoring-policy.md)). A skill that lands here is **materialised** into a builder's `.claude/skills/<name>/` by `scripts/gds/claude-materialize.js` (step 1b) on `bongos init` / `bongos upgrade`, exactly like a core skill, and withdrawn when the instance disables the module.
+The home for the design-style skills the `design-styles` module ships to every builder on every instance that turns the module on. They lived in `modules/ui-design/skills/` until task 1004470 split them out: `ui-design` stays default-on with `/design`, the sync skills, the kit and the style library, and this module is **off by default** — an instance opts in with `"design-styles": true` in `config/modules.json`, because thirteen descriptions are resident in every session whether a project designs pages or not. The policy below is unchanged by the move ([task 1003321](https://cloudbongos.com/builders#/task/1003321), [ADR 0198](../../../docs/adr/0198-third-party-skill-vendoring-policy.md)). A skill that lands here is **materialised** into a builder's `.claude/skills/<name>/` by `scripts/gds/claude-materialize.js` (step 1b) on `bongos init` / `bongos upgrade`, exactly like a core skill, and withdrawn when the instance disables the module.
 
 ## The policy (enforced by `tests/ui_design_skills.mjs`, declared in [`policy.json`](policy.json))
 
@@ -27,12 +27,12 @@ The eleven taste skills are single-file prose; the floor's one critical is a fal
 
 ## The in-house rebuilds (2026-09-01)
 
-A rebuild spec becomes a **first-party skill** at `<name>/` — no `vendor/` segment, so the ratchets count it; no `PROVENANCE.md` or `LICENSE`, because an in-house skill claims no upstream; the same PLATFORM PREAMBLE first after the frontmatter, byte-identical; then a **`## Rebuilt from`** section naming the origin the *spec* was derived from (documentation only), the scan verdict, the spec task, the statement that no upstream bytes were consulted or copied, and what changed in translation ([ADR 0220](../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md)). Declared in `module.json` like any other; `claude-materialize.js` step 1b lands it through its own-dir branch, which no sidecar gate touches. `tests/ui_design_skills.mjs` pins all of it. A rebuild whose method is a family of sub-commands ships as **one** skill dir with a `reference/<sub-command>.md` playbook beside the `SKILL.md`, exactly one loaded per request; the preamble is pinned once, in the `SKILL.md`, and governs every playbook ([ADR 0221](../../../docs/adr/0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md)). A rebuild whose upstream shipped a **look** carries a composition grammar and no colours of its own — the palette is the instance's pack and the texture is a named entry in [`../styles/`](../styles/README.md) ([ADR 0230](../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md)).
+A rebuild spec becomes a **first-party skill** at `<name>/` — no `vendor/` segment, so the ratchets count it; no `PROVENANCE.md` or `LICENSE`, because an in-house skill claims no upstream; the same PLATFORM PREAMBLE first after the frontmatter, byte-identical; then a **`## Rebuilt from`** section naming the origin the *spec* was derived from (documentation only), the scan verdict, the spec task, the statement that no upstream bytes were consulted or copied, and what changed in translation ([ADR 0220](../../../docs/adr/0220-an-in-house-rebuilt-skill-is-a-first-party-skill.md)). Declared in `module.json` like any other; `claude-materialize.js` step 1b lands it through its own-dir branch, which no sidecar gate touches. `tests/ui_design_skills.mjs` pins all of it. A rebuild whose method is a family of sub-commands ships as **one** skill dir with a `reference/<sub-command>.md` playbook beside the `SKILL.md`, exactly one loaded per request; the preamble is pinned once, in the `SKILL.md`, and governs every playbook ([ADR 0221](../../../docs/adr/0221-the-impeccable-method-is-one-skill-with-sub-command-playbooks.md)). A rebuild whose upstream shipped a **look** carries a composition grammar and no colours of its own — the palette is the instance's pack and the texture is a named entry in [`modules/ui-design/styles/`](../../ui-design/styles/README.md) ([ADR 0230](../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md)).
 
 | Skill | Rebuilt from (spec) | Task | What it is |
 |---|---|---|---|
 | `design-taste-frontend` | `Leonxlnx/taste-skill` `taste-skill` (v2) | [task 1003325](https://cloudbongos.com/builders#/task/1003325) | the default taste skill: the brief read in one line, three dials from presets, one world locked, hero and layout discipline, rationed decoration, a pre-flight the kit measures; declines dashboards, tables, wizards, editors |
-| `design-taste-frontend-v1` | `Leonxlnx/taste-skill` `taste-skill-v1` | [task 1003325](https://cloudbongos.com/builders#/task/1003325) | the earlier generation, kept distinct: a fixed baseline triple adapted in conversation, stack conventions for a served surface, the layout bans, full interaction cycles, the pattern vocabulary, the tile-grid archetypes |
+| ~~`design-taste-frontend-v1`~~ (deleted by task 1004470, owner: "v1 can go") | `Leonxlnx/taste-skill` `taste-skill-v1` | [task 1003325](https://cloudbongos.com/builders#/task/1003325) | the earlier generation, kept distinct: a fixed baseline triple adapted in conversation, stack conventions for a served surface, the layout bans, full interaction cycles, the pattern vocabulary, the tile-grid archetypes |
 | `high-end-visual-design` | `Leonxlnx/taste-skill` `soft-skill` | [task 1003325](https://cloudbongos.com/builders#/task/1003325) | the agency-build polish pass: one texture archetype (the style library's looks) and one layout archetype per project, the nested container anatomy where the world allows a container, the pill with its nested arrow disc, rhythm, choreography and scroll entry inside the Kill Switch |
 | `redesign-existing-projects` | `Leonxlnx/taste-skill` `redesign-skill` | [task 1003325](https://cloudbongos.com/builders#/task/1003325) | the in-place upgrade: scan the stack, diagnose against the seven-group audit with the instance's world as the answer key, fix in impact-per-risk order, one group per commit; keeps the stack, never migrates frameworks |
 | `minimalist-ui` | `Leonxlnx/taste-skill` `minimalist-skill` | [task 1003327](https://cloudbongos.com/builders#/task/1003327) | the quiet editorial look as a grammar and no colours: macro whitespace first, a capped measure, one display job and one body job, exactly one hairline weight in the sheet, washed accents measured against their own ink, flat tile cards, box-less accordions, keycaps, one depth treatment per band; declines dense surfaces |
@@ -45,7 +45,7 @@ A rebuild spec becomes a **first-party skill** at `<name>/` — no `vendor/` seg
 | `imagegen-frontend-mobile` | `Leonxlnx/taste-skill` @ `<redacted>` | [task 1003328](https://cloudbongos.com/builders#/task/1003328) | portrait plates for the 390 and 320 compositions, clear of the regions a phone reserves, the first view held to one focal point, a scrim under text over a plate; a screen is the states file rendered by the kit; no phone mockups, no flows of screens; native declines |
 | `brandkit` | `Leonxlnx/taste-skill` @ `<redacted>` | [task 1003328](https://cloudbongos.com/builders#/task/1003328) | the identity system with the strategy inferred first and the logo standard kept: the mark drawn as SVG, the colour system as the pack, the type specimen as the faces, the applications as the kit's renders, the image direction as a hero-object family, the board as a contact sheet; never a generated logo, board or mockup |
 
-What every rebuild does with the upstream's opinions, in the same words: the palette is the pack and a variant is a look from [`../styles/`](../styles/README.md); the design system is the instance's `DESIGN.md`; images are hero plates and hero objects by token and never a step; every motion rule lives inside the Kill Switch (springs, magnetic hover, pointer-tracked borders are named *not available*); the upstream's bans are defaults an instance's `DESIGN.md` overrides; the kit's renders are the pre-flight. The image family (task 1003328, [ADR 0222](../../../docs/adr/0222-the-image-family-under-the-hero-only-rule.md)) carries the one rewrite the upstream never had: images are for text-free hero plates and hero objects only, so a screen is the surface itself, the mark is drawn, the board is a contact sheet, and what ships is the pair (a black-ground JPEG for dark, an alpha WebP cutout for light) with a provenance sidecar beside every file, through the instance's art pipeline key. The four looks (task 1003327, [ADR 0230](../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md)) carry the other rewrite: a look skill ships structure, rhythm, type roles, component anatomy, motion and bans and **no colours**, so a substrate becomes an archetype that still ships both modes, a prompt-seeded roll becomes a deterministic selection derived from the route, a design document transcribes the world instead of authoring one, and the upstream's seeded placeholder photography is dropped rather than softened. The whole scoped set of thirteen is now rebuilt in-house; nothing from either origin is still waiting on a spec.
+What every rebuild does with the upstream's opinions, in the same words: the palette is the pack and a variant is a look from [`modules/ui-design/styles/`](../../ui-design/styles/README.md); the design system is the instance's `DESIGN.md`; images are hero plates and hero objects by token and never a step; every motion rule lives inside the Kill Switch (springs, magnetic hover, pointer-tracked borders are named *not available*); the upstream's bans are defaults an instance's `DESIGN.md` overrides; the kit's renders are the pre-flight. The image family (task 1003328, [ADR 0222](../../../docs/adr/0222-the-image-family-under-the-hero-only-rule.md)) carries the one rewrite the upstream never had: images are for text-free hero plates and hero objects only, so a screen is the surface itself, the mark is drawn, the board is a contact sheet, and what ships is the pair (a black-ground JPEG for dark, an alpha WebP cutout for light) with a provenance sidecar beside every file, through the instance's art pipeline key. The four looks (task 1003327, [ADR 0230](../../../docs/adr/0230-a-look-skill-is-a-composition-grammar-the-palette-is-the-pack.md)) carry the other rewrite: a look skill ships structure, rhythm, type roles, component anatomy, motion and bans and **no colours**, so a substrate becomes an archetype that still ships both modes, a prompt-seeded roll becomes a deterministic selection derived from the route, a design document transcribes the world instead of authoring one, and the upstream's seeded placeholder photography is dropped rather than softened. The whole scoped set of thirteen is now rebuilt in-house; nothing from either origin is still waiting on a spec.
 
 ## First-party originals (2026-09-02)
 
@@ -53,7 +53,7 @@ A skill the platform wrote from nothing declares the **other** origin. It lives
 
 | Skill | Origin | Task | What it is |
 |---|---|---|---|
-| `style` | first party (no upstream) | [task 1003475](https://cloudbongos.com/builders#/task/1003475) | the `/style` session: four bounded steps in which an owner authors their own look as a branding pack. SEARCH renders the nearest two library entries before asking two or three questions about feel; CREATE drafts the three files inside the contract, never a fork of a sheet and never a sixteenth token; PROVE retunes the thirteen against `contrast.js`, the styles suite, `check-mock.js` and the renders with a failure-to-fix table so the retune is arithmetic; ADOPT hands the owner the one-step switch, never writes `config/branding.json`, and files the catalogue rows. Its first output is [`../styles/blueprint`](../styles/README.md), the library's first cool look |
+| `style` | first party (no upstream) | [task 1003475](https://cloudbongos.com/builders#/task/1003475) | the `/style` session: four bounded steps in which an owner authors their own look as a branding pack. SEARCH renders the nearest two library entries before asking two or three questions about feel; CREATE drafts the three files inside the contract, never a fork of a sheet and never a sixteenth token; PROVE retunes the thirteen against `contrast.js`, the styles suite, `check-mock.js` and the renders with a failure-to-fix table so the retune is arithmetic; ADOPT hands the owner the one-step switch, never writes `config/branding.json`, and files the catalogue rows. Its first output is [`../styles/blueprint`](../../ui-design/styles/README.md), the library's first cool look |
 
 **In the core checkout itself**, where these skills are written, Claude Code reads only `.claude/skills/` at the repo root and the materialiser's self-copy guard leaves it empty of module skills. `node scripts/gds/claude-materialize.js --module-skills-only` lands every enabled module's skills there as untracked, self-ignored copies (a generated `.claude/skills/.module-skills.json` manifest and a `.gitignore` beside them; `--clean` removes them; the file map skips them by the manifest) so a builder can invoke them here too ([task 1003330](https://cloudbongos.com/builders#/task/1003330), [ADR 0224](../../../docs/adr/0224-module-skills-reach-the-core-checkout-as-untracked-self-ignored-copies.md)). Edit the module's `skills/<name>/`, never the copy, and re-run to refresh.
 

package/modules/{ui-design → design-styles}/skills/brandkit/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. It adds brand files to the project and never generates a logo image.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/design-taste-frontend/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. It changes the page, and you check it on a preview.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/gpt-taste/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. It changes the page, and you check it on a preview.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/high-end-visual-design/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. It changes the page, and you check it on a preview.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/image-to-code/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. It builds the page and never generates images itself.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.