@bongos/core 1.20.40 → 1.20.42

package/modules/{ui-design → design-styles}/skills/image-to-code/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. It builds the page and never generates images itself.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/imagegen-frontend-mobile/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Paid: each image is made on the project's image key. It adds the picture files to the project.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/imagegen-frontend-web/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Paid: each image is made on the project's image key. It adds the picture files to the project.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/impeccable/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. A review changes nothing; a fix changes the page.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.
@@ -65,7 +65,7 @@ The full list, grouped:
 
 The setup step is the preamble's world load, done **once per session** and not repeated: the pack, the tokens, the root `DESIGN.md`, and `docs/project-context.template.md` for product truth. The directives that come back are the world's own named rules and its Do's and Don'ts; quote them from the files, never from memory. Then, before editing anything, inspect the target **and at least one source of existing visual truth** for it: the sheet the page loads, a sibling component, the page's states file, or a plate under the instance's assets. A surface is edited only after both have been read.
 
-This skill lives at `modules/ui-design/skills/impeccable/` in the core and at `.claude/skills/impeccable/` once materialised into an instance; the playbooks are always `reference/<name>.md` relative to this file. If a harness has put the file somewhere else, resolve the playbooks relative to wherever this file was read from, and fall back to the module path.
+This skill lives at `modules/design-styles/skills/impeccable/` in the core and at `.claude/skills/impeccable/` once materialised into an instance; the playbooks are always `reference/<name>.md` relative to this file. If a harness has put the file somewhere else, resolve the playbooks relative to wherever this file was read from, and fall back to the module path.
 
 ## The three homes, and what they are here
 

package/modules/{ui-design → design-styles}/skills/industrial-brutalist-ui/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. It changes the page, and you check it on a preview.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/minimalist-ui/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. It changes the page, and you check it on a preview.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/policy.json

@@ -1,5 +1,5 @@
 {
-  "_doc": "The vendoring policy for third-party UI skills in the ui-design module (task 1003321, ADR 0198). tests/ui_design_skills.mjs enforces it; modules/ui-design/skills/README.md explains it. A skill lands under skills/vendor/<name>/ only with a PROVENANCE.md sidecar, a licence on the allowlist, a /scan-before-install verdict that is not dangerous, and the PLATFORM PREAMBLE block (PREAMBLE.md, byte-identical) at the top of its SKILL.md body. A dangerous verdict or a licence off the allowlist lands a rebuild spec, never a copy.",
+  "_doc": "The vendoring policy for third-party UI skills in the design-styles module (task 1003321, ADR 0198; moved out of ui-design by task 1004470). tests/ui_design_skills.mjs enforces it; modules/design-styles/skills/README.md explains it. A skill lands under skills/vendor/<name>/ only with a PROVENANCE.md sidecar, a licence on the allowlist, a /scan-before-install verdict that is not dangerous, and the PLATFORM PREAMBLE block (PREAMBLE.md, byte-identical) at the top of its SKILL.md body. A dangerous verdict or a licence off the allowlist lands a rebuild spec, never a copy.",
   "licenceAllowlist": ["Apache-2.0", "MIT", "BSD-2-Clause", "BSD-3-Clause", "CC-BY-4.0"],
   "verdictsThatMayLand": ["clean", "caution"],
   "sidecar": "PROVENANCE.md",

package/modules/{ui-design → design-styles}/skills/redesign-existing-projects/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. It changes the existing pages, and you check them on a preview.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/stitch-design-taste/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. It writes one brief document and changes no pages.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/{ui-design → design-styles}/skills/style/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
   Uses your session. The new look is only used once you choose to adopt it.
 ---
 
-<!-- BEGIN PLATFORM PREAMBLE · ui-design module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/ui-design/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
-> **Platform preamble — read before any rule below.** This skill ships with the `ui-design` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
+<!-- BEGIN PLATFORM PREAMBLE · design-styles module · one block, byte-identical in every skill the module ships (vendored or rebuilt in-house) so an upstream refresh is a three-way merge; the source is modules/design-styles/skills/PREAMBLE.md and tests/ui_design_skills.mjs fails on drift -->
+> **Platform preamble — read before any rule below.** This skill ships with the `design-styles` module (vendored from a scanned origin, or rebuilt in-house from a spec) and runs INSIDE an instance's world, which it reads first and never overrides.
 >
 > 1. **Load the world before any taste rule.** `config/branding.json` over `config/branding.neutral.json` (`theme.ui` is the fifteen tokens: <redacted> colours and two font stacks), `config/design-tokens.json` over `config/design-tokens.neutral.json`, and `DESIGN.md` at the repo root: the instance's palette and derived tiers, faces, materials, motion grammar, components, and its Do's and Don'ts. Where an instance has no `DESIGN.md`, the neutral pack is the world and the platform floors in item 6 are the whole rulebook; say so and build to them. Never invent a palette.
 > 2. **The fifteen-token contract is the only colour source.** Every colour is a `var()` or a `color-mix()` of the fifteen; the only legal literal is pure black or white with alpha as a scrim, mask or halo. No page `:root` (page tokens live on `body`), and every dark rule is written twice: `:root[data-mode="dark"]` and its `prefers-color-scheme` twin.

package/modules/pixel-art/CLAUDE.md

@@ -0,0 +1,15 @@
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
+
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
+
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
+
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
+
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/pixel-art/module.json

@@ -0,0 +1,12 @@
+{
+  "key": "pixel-art",
+  "title": "Pixel-art skills (tile generation, tile and animation review, feedback capture, the Figma tile canvas)",
+  "description": "The five pixel-art SKILLS an instance with a pixel-art world turns on: otb-tile-generate, otb-design-review, otb-character-review, otb-feedback-capture and otb-figma-sync (task 1004470, owner ruling on blocker 1000139). They were orphans in the core's .claude/skills/: docs attributed them to art-pipeline / character-anim, neither of which has a module.json (ADR 0272), and modules/art-pipeline/ never publishes because it carries copyrighted reference maps (ADR 0098). This module carries ONLY the skill text, never a reference map, a palette, a rubric or the generation pipeline — those stay with the instance's own art-pipeline host module, which the skills read at their documented paths. default: false because most instances have no pixel-art world, and every skill description is resident in every session whether it is used or not. Declaration-only: no routes, no migrations, no port, so turning it off withdraws only these skills.",
+  "version": "1.0.0",
+  "coreVersion": "^1.19.0",
+  "default": false,
+  "maintenance": { "status": "core-maintained" },
+  "contributes": { "skills": ["otb-tile-generate", "otb-design-review", "otb-character-review", "otb-feedback-capture", "otb-figma-sync"] },
+  "provides": [],
+  "consumes": []
+}

package/modules/provisioning/starter-bundles.js

@@ -124,6 +124,21 @@ const OPTIONAL_MODULES = Object.freeze([
     summary: 'A Discord server that carries your build news, and lets people send ideas and bug reports back.',
     aliases: Object.freeze(['chatroom', 'talk', 'messaging', 'community', 'announcements', 'notifications']),
   }),
+  // The two opt-in SKILL modules of task 1004470: no routes and no page, only extra
+  // commands for the AI. Off by default because every command's description costs
+  // context in every session, used or not.
+  Object.freeze({
+    key: 'design-styles',
+    label: 'Design styles',
+    summary: 'Extra ways for the AI to style your pages: ready-made looks, a polish pass, and a way to author your own look.',
+    aliases: Object.freeze(['theme', 'branding', 'visual', 'taste', 'aesthetic', 'layout']),
+  }),
+  Object.freeze({
+    key: 'pixel-art',
+    label: 'Pixel-art tools',
+    summary: 'Commands to generate game tiles and sprites, score them against your art rules, and keep a style guide.',
+    aliases: Object.freeze(['tileset', 'graphics', 'artwork', 'retro', 'drawing', 'gamedev']),
+  }),
 ]);
 
 // The opt-in keys alone, for the membership tests the normalizer runs. Derived,

package/modules/ui-design/kit/serve.js

@@ -130,6 +130,8 @@ const STARTER_BUNDLES_FIXTURE = {
   optional: [
     { key: 'agents', label: 'Extra agents', summary: 'More AI agents alongside the ones every project gets, for reading, research and review.', aliases: ['bots', 'assistants', 'automation', 'llm', 'helpers'] },
     { key: 'discord', label: 'Discord', summary: 'A Discord server that carries your build news, and lets people send ideas and bug reports back.', aliases: ['chatroom', 'talk', 'messaging', 'community', 'announcements', 'notifications'] },
+    { key: 'design-styles', label: 'Design styles', summary: 'Extra ways for the AI to style your pages: ready-made looks, a polish pass, and a way to author your own look.', aliases: ['theme', 'branding', 'visual', 'taste', 'aesthetic', 'layout'] },
+    { key: 'pixel-art', label: 'Pixel-art tools', summary: 'Commands to generate game tiles and sprites, score them against your art rules, and keep a style guide.', aliases: ['tileset', 'graphics', 'artwork', 'retro', 'drawing', 'gamedev'] },
   ],
 };
 

package/modules/ui-design/module.json

@@ -1,12 +1,12 @@
 {
   "key": "ui-design",
-  "title": "UI design (the design contract, its adapters and sync, the /design playbook, the kit, the skills, the styles)",
-  "description": "The platform capability that lets any builder on any instance create and design good-looking, functional UIs in line with that instance's world (scoped with the owner 2026-08-28; task 1003324, ADR 0197). It ships METHOD and never a world: the neutral design contract of ADR 0081 with its tool adapters (Claude Design, Figma), their sync CLIs and the validator; the /design playbook for ui-discipline work; and the reserved homes for the look-before-you-ship kit (kit/), the vetted UI skills (skills/) and the style library (styles/) the sibling tasks land. The instance's world — its branding pack, config/design-tokens.*, config/design-sources.json and its DESIGN.md — stays in config/ and at the repo root as the host boundary this module reads and never owns (ADR 0062 §7). Cloud Bongos's own front door is this module's first customer, not its owner. default-on because every instance has a face. No routes, no migrations, no port: declaration-only like character-anim, so disabling it withdraws only the skills it contributes and touches no served surface.",
+  "title": "UI design (the design contract, its adapters and sync, the /design playbook, the kit, the styles)",
+  "description": "The platform capability that lets any builder on any instance create and design good-looking, functional UIs in line with that instance's world (scoped with the owner 2026-08-28; task 1003324, ADR 0197). It ships METHOD and never a world: the neutral design contract of ADR 0081 with its tool adapters (Claude Design, Figma), their sync CLIs and the validator; the /design playbook for ui-discipline work; the look-before-you-ship kit (kit/) and the style library (styles/). The thirteen design-style skills that lived in skills/ are the opt-in design-styles module since task 1004470; /design reaches them when that module is on. The instance's world — its branding pack, config/design-tokens.*, config/design-sources.json and its DESIGN.md — stays in config/ and at the repo root as the host boundary this module reads and never owns (ADR 0062 §7). Cloud Bongos's own front door is this module's first customer, not its owner. default-on because every instance has a face. No routes, no migrations, no port: declaration-only like character-anim, so disabling it withdraws only the skills it contributes and touches no served surface.",
   "version": "1.0.0",
   "coreVersion": "^1.19.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "skills": ["design", "design-sync", "figma-design-sync", "design-taste-frontend", "design-taste-frontend-v1", "high-end-visual-design", "redesign-existing-projects", "impeccable", "style", "minimalist-ui", "industrial-brutalist-ui", "gpt-taste", "stitch-design-taste", "image-to-code", "imagegen-frontend-web", "imagegen-frontend-mobile", "brandkit"], "disciplines": ["ui"] },
+  "contributes": { "skills": ["design", "design-sync", "figma-design-sync"], "disciplines": ["ui"] },
   "declarativeSeams": { "skills": ["design", "design-sync", "figma-design-sync"] },
   "provides": [],
   "consumes": []

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.40",
+  "version": "1.20.42",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.40",
+      "version": "1.20.42",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.40",
+  "version": "1.20.42",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8349,5 +8349,17 @@
       "id": "1004466",
       "text": "Stop the version preview from overwriting the live hall's cookies, and make leaving a preview reliably clear it."
     }
+  ],
+  "1.20.41": [
+    {
+      "id": "1004470",
+      "text": "Projects that don't do pixel art or design styling no longer carry 18 unused AI commands in every session (about a third less to load); projects that want them turn them on with one setting."
+    }
+  ],
+  "1.20.42": [
+    {
+      "id": "1003792",
+      "text": "The module store can now run a security check on each module version: it fails a version that ships a secret file, pulls code from outside the official package registry, or depends on a package with a known serious vulnerabili"
+    }
   ]
 }

package/scripts/gds/doc-cli-guard.js

@@ -39,7 +39,7 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 const DOC_CLI_ALLOW = new Map([
   ['.claude/skills/paint/SKILL.md::scripts/gds/art-stage.js',
     'art-stage.js ships with the art-pipeline HOST module, which publish-manifest.js excludes from core — absent from a core-only checkout by design; the skill says so inline.'],
-  ['.claude/skills/otb-tile-generate/SKILL.md::scripts/gds/art-stage.js',
+  ['modules/pixel-art/skills/otb-tile-generate/SKILL.md::scripts/gds/art-stage.js',
     'same as paint/SKILL.md — the art staging CLI travels with the excluded art-pipeline module, not the portable core.'],
   ['docs/session-logs/2026-09-10-task-1003507-the-box-that-could-not-be-reaped.md::scripts/gds/box.js',
     'a dated session log — the historical record, never rewritten — of work on a CLI the dev-box removal deleted (task 1003893); it describes what was run then, not what to run now.'],

package/scripts/gds/fitness-ratchets.js

@@ -421,7 +421,10 @@ function apiAliasCallerMetrics() {
 function skillListingMetrics() {
   try {
     const lint = require('./skill-lint.js');
-    return { skill_listing_chars: lint.lintSkills(lint.listSkillFiles()).listingChars };
+    // Resident skills only (task 1004470): a skill owned by a module this checkout leaves
+    // off (pixel-art, design-styles — both default: false) is in no session's listing here.
+    const files = lint.listSkillFiles();
+    return { skill_listing_chars: lint.lintSkills(files, { resident: lint.residentSkillFiles(undefined, { files }) }).listingChars };
   } catch (e) {
     // Fail open, but never SILENTLY: an unenforced ratchet that says nothing is
     // indistinguishable from a passing one, which is how a budget stops being a

package/scripts/gds/fitness.js

@@ -1198,7 +1198,8 @@ function checkSkillFrontmatter() {
     return { name: 'skill frontmatter parses (task 1003548)', ok: true, hardFail: false, violations, warnings: [`skill-lint unavailable: ${e.message}`], note: 'linter missing — check skipped.' };
   }
   const files = lint.listSkillFiles(INSTANCE_ROOT);
-  const report = lint.lintSkills(files);
+  // Lint every file; count the listing over the skills RESIDENT here (task 1004470).
+  const report = lint.lintSkills(files, { resident: lint.residentSkillFiles(INSTANCE_ROOT, { files }) });
   const rel = (f) => path.relative(INSTANCE_ROOT, f).replace(/\\/g, '/');
   const long = [];
   for (const r of report.results) {

package/scripts/gds/module-artifact.js

@@ -216,4 +216,4 @@ async function verifyModuleArtifact(tgz, { key, maxBytes = MAX_TARBALL_BYTES, in
   return out;
 }
 
-module.exports = { MAX_TARBALL_BYTES, packModule, verifyModuleArtifact };
+module.exports = { MAX_TARBALL_BYTES, packModule, verifyModuleArtifact, deniedFiles };

package/scripts/gds/module-assess-security.js

@@ -0,0 +1,251 @@
+#!/usr/bin/env node
+// scripts/gds/module-assess-security.js — the Security part of a module's
+// assessment: a pass/fail GATE over one published store version, recorded as a
+// module_assessment_signals row (task 1003792; ADR 0343 D2; table from core_265).
+//
+// WHY a gate and not a score. ADR 0343 D2: a version that fails the security
+// check is not listed, whatever else it scores, and security is never averaged
+// in — so a module cannot buy back a vulnerability with good tests. The outcome
+// is therefore only ever passed / failed, or not_scored when the check could not
+// be completed (which is NOT a pass: a gate that cannot run must not open).
+//
+// The check reuses what the project already enforces rather than re-typing it:
+//   1. the publish denylist — module-artifact.js deniedFiles (the repo-wide
+//      matchesDeny list + credential-named files; ADR 0107 §4). Publish already
+//      refuses these; re-checking here means a rule added later still reaches
+//      versions published before it.
+//   2. dependency SOURCES — every entry in module.json `dependencies` (ADR 0138)
+//      must be a plain registry package name with a plain semver range or dist-
+//      tag. That is an ALLOWLIST (registrySpec below), deliberately stricter than
+//      a list of bad protocols: a git/http/file, aliased or GitHub-shorthand spec
+//      — or anything else unrecognised — installs code from somewhere nobody
+//      vetted, and fails the gate. (It mirrors the artifact-scan floor's grading,
+//      but a core script may not require a module's files, so it is its own
+//      small rule.) Floating ranges and wildcards are only noted.
+//   3. KNOWN VULNERABILITIES in those dependencies — only when every spec passed
+//      check 2, so nothing a module names is ever fetched from a place of its
+//      choosing and no `file:` path is ever resolved on this host. npm resolves the ranges in a
+//      throwaway directory (--package-lock-only --ignore-scripts: registry
+//      metadata only, no package code downloaded or run), then `npm audit`; any
+//      high or critical advisory fails the gate (the threshold scripts/security/
+//      dep-audit.js uses for the core, whose parser this reuses).
+// And one input that is reported, never failed on: the `maintenance` posture
+// (ADR 0166). "Undeclared", "deprecated" or "orphaned" is something a buyer
+// should see, but it is upkeep, not a vulnerability — that call is recorded in
+// the row's detail so the hall (task 1003799) can surface it.
+//
+// Nothing here executes the module's own code, so unlike module-assess-tests.js
+// this is safe to run on the control plane.
+//
+//   node scripts/gds/module-assess-security.js <store_module_versions.id>   run + record
+//   node scripts/gds/module-assess-security.js --dir modules/<key>          dry run (prints; no DB)
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFile } = require('node:child_process');
+const { deniedFiles, verifyModuleArtifact } = require('./module-artifact');
+const { extractNpmFindings } = require('../security/dep-audit');
+
+const AUDIT_TIMEOUT_MS = 120_000;
+// npm is a .cmd shim on Windows, which execFile cannot start without a shell; go
+// through cmd.exe explicitly rather than shell:true (the args are fixed constants).
+const npmCommand = (args) => (process.platform === 'win32'
+  ? ['cmd.exe', ['/d', '/s', '/c', 'npm', ...args]]
+  : ['npm', args]);
+
+// Run one npm command in `cwd`; resolve { ok, stdout, stderr, error }. Never rejects.
+function npmRun(args, cwd, { exec = execFile, timeoutMs = AUDIT_TIMEOUT_MS } = {}) {
+  return new Promise((resolve) => {
+    const [cmd, argv] = npmCommand(args);
+    exec(cmd, argv, { cwd, timeout: timeoutMs, maxBuffer: 32 * 1024 * 1024, windowsHide: true },
+      (err, stdout, stderr) => resolve({ err, stdout: String(stdout || ''), stderr: String(stderr || '') }));
+  });
+}
+
+// Audit a dependency map { name: range } for known high/critical advisories.
+// Resolves { ok: true, findings } or { ok: false, reason } when npm could not
+// resolve or audit (offline, unknown package, npm missing) — the caller treats
+// that as not_scored, never as a pass.
+async function auditDependencies(deps, { exec, timeoutMs } = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'module-assess-security-'));
+  try {
+    fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ name: 'module-assess-audit', private: true, version: '0.0.0', dependencies: deps }));
+    const lock = await npmRun(['install', '--package-lock-only', '--ignore-scripts', '--no-audit', '--no-fund'], dir, { exec, timeoutMs });
+    if (lock.err || !fs.existsSync(path.join(dir, 'package-lock.json'))) {
+      return { ok: false, reason: 'npm could not resolve the declared dependencies' };
+    }
+    // npm audit exits 1 when it finds anything; the JSON on stdout is the answer either way.
+    const audit = await npmRun(['audit', '--json'], dir, { exec, timeoutMs });
+    let parsed;
+    try { parsed = JSON.parse(audit.stdout || ''); } catch { return { ok: false, reason: 'npm audit produced no readable report' }; }
+    if (parsed && parsed.error) return { ok: false, reason: 'npm audit could not reach the advisory database' };
+    return { ok: true, findings: extractNpmFindings(parsed) };
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+// npm's package-name rule (scoped or not, lowercase, no path segments).
+const NPM_NAME_RE = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+// A semver range: versions, x/* wildcards, ^ ~ comparators, hyphen and || unions,
+// prerelease/build suffixes. No ':' '/' '#' '@' — so no protocol, path, alias or ref.
+const RANGE_RE = /^[0-9A-Za-z.*^~<>=|\s+-]+$/;
+const DIST_TAGS = new Set(['latest', 'next']);
+
+// Grade one declared dependency. { ok: false } means it would install from
+// somewhere other than the public registry (or cannot be read as a registry
+// spec): the gate fails and it is never handed to npm. { ok: true, kind } is a
+// registry spec; kind names how much the registry decides at install time.
+function registrySpec(name, spec) {
+  const s = String(spec).trim();
+  if (!NPM_NAME_RE.test(name)) return { ok: false, kind: 'invalid package name' };
+  if (DIST_TAGS.has(s) || s === '*' || s === '' || /^[xX]$/.test(s)) return { ok: true, kind: 'wildcard' };
+  if (/^[a-z+]+:/i.test(s)) return { ok: false, kind: 'non-registry source' };
+  // Every whitespace/||-separated token must start with a comparator or a digit/x.
+  const tokens = s.split(/\s*\|\|\s*|\s+/).filter(Boolean);
+  if (!RANGE_RE.test(s) || !tokens.every((t) => t === '-' || /^(?:[\^~]|[<>]=?|=)?\s*[0-9xX*]/.test(t))) {
+    return { ok: false, kind: 'not a registry range' };
+  }
+  if (/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(s)) return { ok: true, kind: 'pinned' };
+  return { ok: true, kind: 'floating range' };
+}
+
+// The maintenance posture as a buyer would read it (ADR 0166).
+function maintenancePosture(moduleJson) {
+  const m = moduleJson && moduleJson.maintenance;
+  return m && typeof m.status === 'string' ? m.status : 'undeclared';
+}
+
+// The gate over one version's files ([{ path, buf }], module-relative) and its
+// parsed module.json. Returns the signal fields { outcome, score, sample_size,
+// reason, detail }. `audit` is injectable so tests need no network.
+async function assessSecurity(key, files, moduleJson, { audit = auditDependencies } = {}) {
+  const failures = [];
+  const notes = [];
+
+  const denied = deniedFiles(key, files.map((f) => f.path));
+  if (denied.length) failures.push({ check: 'denylist', files: denied });
+
+  const deps = (moduleJson && moduleJson.dependencies) || {};
+  const names = Object.keys(deps).sort();
+  const sources = [];
+  for (const name of names) {
+    const graded = registrySpec(name, deps[name]);
+    const entry = { package: name.slice(0, 214), spec: String(deps[name]).slice(0, 200), kind: graded.kind };
+    if (!graded.ok) sources.push(entry);
+    else if (graded.kind === 'wildcard') notes.push({ check: 'dependency_wildcard', ...entry });
+    else if (graded.kind === 'floating range') notes.push({ check: 'dependency_range', ...entry });
+  }
+  if (sources.length) failures.push({ check: 'dependency_source', dependencies: sources });
+
+  // Audit only an all-registry list: a failed source already fails the gate, and
+  // handing it to npm would make this host fetch (or resolve a file: path) of the
+  // module's choosing.
+  let advisories = [];
+  if (names.length && !sources.length) {
+    const a = await audit(deps);
+    if (!a.ok) {
+      return {
+        outcome: 'not_scored', score: null, sample_size: names.length,
+        reason: `the dependency audit could not run: ${a.reason}`,
+        detail: { failures, notes, maintenance: maintenancePosture(moduleJson) },
+      };
+    }
+    advisories = a.findings.map((f) => ({ package: f.package, severity: f.severity, id: f.id, summary: f.summary, fix: f.fix }));
+    if (advisories.length) failures.push({ check: 'vulnerable_dependency', advisories });
+  }
+
+  const maintenance = maintenancePosture(moduleJson);
+  if (maintenance !== 'maintained' && maintenance !== 'core-maintained') {
+    notes.push({ check: 'maintenance', status: maintenance });
+  }
+
+  const detail = { failures, notes, maintenance, dependencies_checked: names.length };
+  if (failures.length) {
+    return { outcome: 'failed', score: null, sample_size: names.length, reason: `failed: ${failures.map((f) => f.check).join(', ')}`, detail };
+  }
+  return {
+    outcome: 'passed', score: null, sample_size: names.length,
+    reason: names.length ? `passed: ${names.length} dependency(ies) from the registry, no high or critical advisory` : 'passed: no denied files and no dependencies',
+    detail,
+  };
+}
+
+// Append one Security row. Never UPDATEs (core_265 is append-only).
+async function insertSecuritySignal(versionId, s, { db }) {
+  const { rows: [row] } = await db.query(
+    `INSERT INTO module_assessment_signals (version_id, part, outcome, score, sample_size, reason, detail)
+     VALUES ($1, 'security', $2, $3, $4, $5, $6)
+     RETURNING id, version_id, part, outcome, score, sample_size, reason, measured_at`,
+    [versionId, s.outcome, s.score, s.sample_size, s.reason, JSON.stringify(s.detail || {})]);
+  return row;
+}
+
+// Read and verify one published version, run the gate, record the result. A
+// tarball that is missing or fails verification is not_scored — the gate could
+// not be run, so it stays closed.
+async function recordSecuritySignal(versionId, { db, storeDir, audit } = {}) {
+  const pool = db || require('../../src/bongos/pool').pool;
+  const { versionArtifactFile } = require('../../src/bongos/module-store');
+  const { rows: [ver] } = await pool.query(
+    'SELECT id, module_key, version, artifact_path FROM store_module_versions WHERE id = $1', [versionId]);
+  if (!ver) return { ok: false, code: 'version_not_found', message: `no store_module_versions row ${versionId}` };
+
+  let signal;
+  try {
+    const tgz = await fs.promises.readFile(versionArtifactFile(ver, storeDir ? { dir: storeDir } : {}));
+    const v = await verifyModuleArtifact(tgz, { key: ver.module_key, includeFiles: true });
+    if (v.ok) {
+      signal = await assessSecurity(ver.module_key, v.files, v.moduleJson, { audit });
+    } else if (v.code === 'denied_content') {
+      signal = { outcome: 'failed', score: null, sample_size: null, reason: 'failed: denylist', detail: { failures: [{ check: 'denylist' }] } };
+    } else {
+      signal = { outcome: 'not_scored', score: null, sample_size: null, reason: `the tarball failed verification (${v.code})`, detail: {} };
+    }
+  } catch (e) {
+    signal = { outcome: 'not_scored', score: null, sample_size: null, reason: `the check could not run (${e.code || 'error'})`, detail: {} };
+  }
+  const row = await insertSecuritySignal(ver.id, signal, { db: pool });
+  return { ok: true, version: ver, signal: row };
+}
+
+function readModuleDir(dir) {
+  const out = [];
+  const walk = (rel) => {
+    for (const e of fs.readdirSync(path.join(dir, rel), { withFileTypes: true })) {
+      if (e.name === 'node_modules' || e.name === '.git') continue;
+      const r = rel ? `${rel}/${e.name}` : e.name;
+      if (e.isDirectory()) walk(r);
+      else if (e.isFile()) out.push({ path: r, buf: fs.readFileSync(path.join(dir, r)) });
+    }
+  };
+  walk('');
+  return out;
+}
+
+async function main(argv) {
+  const i = argv.indexOf('--dir');
+  if (i !== -1) {
+    const dir = path.resolve(argv[i + 1] || '');
+    const moduleJson = JSON.parse(fs.readFileSync(path.join(dir, 'module.json'), 'utf8'));
+    console.log(JSON.stringify(await assessSecurity(moduleJson.key, readModuleDir(dir), moduleJson), null, 2));
+    return 0;
+  }
+  const id = argv[0];
+  if (!/^\d+$/.test(String(id || ''))) {
+    console.error('usage: node scripts/gds/module-assess-security.js <store_module_versions.id> | --dir modules/<key>');
+    return 2;
+  }
+  const res = await recordSecuritySignal(id);
+  if (!res.ok) { console.error(res.message); return 1; }
+  const s = res.signal;
+  console.log(`${res.version.module_key} ${res.version.version}: security ${s.outcome} — ${s.reason} (signal ${s.id})`);
+  return 0;
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2)).then((code) => process.exit(code), (e) => { console.error(e.stack || e.message); process.exit(1); });
+}
+
+module.exports = { assessSecurity, auditDependencies, recordSecuritySignal, insertSecuritySignal, maintenancePosture, registrySpec };

package/scripts/gds/publish-manifest.js

@@ -65,6 +65,8 @@ const PUBLISH_ALLOWLIST = [
   'modules/specialities/',  // role sub-specialities (task 1003855, ADR 0296). default:true, so it MUST be here, and the copy-desk asymmetry above applies verbatim: the settings panel ships regardless because modules/hall-ui/ is allowlisted as one subtree, so omitting this line would put a "Your specialities" section in every instance's settings page whose every call 404s.
   'modules/copy-desk/',      // the artist's loop over user-facing TEXT (goal 1000074, ADR 0178). default:true, so it MUST be here — and note the ASYMMETRY that makes omitting it worse than useless: its hall surface ships regardless, because modules/hall-ui/ is allowlisted as one subtree. A released core carrying the page and the nav entry but not the routes behind them puts a tab in every instance's hall whose every call 404s. The module and its page are only ever added or removed together; tests/publish_manifest.mjs holds that pair.
   'modules/ui-design/',      // the design contract + its adapters/CLIs + the /design playbook (task 1003324, ADR 0197). default:true, so it MUST be here: a released core without it would materialize skills (design, design-sync, figma-design-sync) whose CLIs and adapters do not exist.
+  'modules/design-styles/',  // the thirteen opt-in design-style skills split out of ui-design (task 1004470). default:false, but MUST be here: shipped is not enabled, and a released core without it hands an instance that turns it on an "unknown module" with nothing to materialize. Skill text only.
+  'modules/pixel-art/',      // the five opt-in pixel-art skills (task 1004470), which shipped from .claude/skills/ before this. default:false. SKILL.md text only — never a reference map, a palette or generated art: those are modules/art-pipeline/, which CONTENT_EXCLUDE keeps out below for the copyright reason (ADR 0098).
   'modules/hall-ui/',
   'modules/status-ui/',
   'modules/public-landing/', // the front door (task 1003322, ADR 0218) — the repo-root public-landing/ entry this replaces was always here, and for the same reason: default:true, and it is the only thing an instance serves at its apex root. Omit it and a released core answers the game-less 404 tail on its own home page.