@bongos/core 1.20.40 → 1.20.42

package/scripts/gds/skill-lint.js

@@ -25,7 +25,10 @@
 // Usage:
 //   node scripts/gds/skill-lint.js                 lint every skill Claude Code can load — .claude/skills/*
 //                                                  plus the module-owned modules/*/skills/* that materialize
-//                                                  into it; exit 1 on any error
+//                                                  into it; exit 1 on any error. The listing total counts
+//                                                  only the skills RESIDENT here: a skill owned by a module
+//                                                  this checkout's config leaves off is linted, not counted
+//                                                  (task 1004470)
 //   node scripts/gds/skill-lint.js <file...>       lint specific files
 //   node scripts/gds/skill-lint.js --hook          PostToolUse mode: read the hook JSON on stdin, lint the
 //                                                  edited file if it is a SKILL.md, print findings, exit 0
@@ -146,11 +149,28 @@ function listSkillFiles(root = REPO_ROOT) {
   return [...core, ...owned];
 }
 
-// Lint a set of files; returns per-file results plus the listing total vs budget.
-function lintSkills(files) {
+// The subset of listSkillFiles() that is actually RESIDENT for an instance — what
+// claude-materialize.js would land in its .claude/skills/ (task 1004470). Linting still
+// covers every file (a defect in an opt-in module's skill must not wait for the module
+// to be switched on), but the listing cost is a per-session number, and a skill owned by
+// a module the instance leaves off is never in that session's listing. Enablement is the
+// materialiser's own rule (moduleSkillRoster: the instance's config/modules.json, else the
+// module's `default`), read from there rather than restated. Fails open to the full list
+// if the materialiser cannot load, so the number can only ever over-report.
+function residentSkillFiles(root = REPO_ROOT, { instanceDir = root, files = listSkillFiles(root) } = {}) {
+  let off;
+  try { off = require('./claude-materialize.js').disabledModuleSkills({ coreRoot: root, instanceDir }); } catch (_) { return files; }
+  return files.filter((f) => !off.has(path.basename(path.dirname(f))));
+}
+
+// Lint a set of files; returns per-file results plus the listing total vs budget. The
+// listing counts `resident` (a list of paths) when given, else every linted file.
+function lintSkills(files, { resident } = {}) {
   const results = files.map((f) => lintSkillFile(fs.readFileSync(f, 'utf8'), { file: f }));
-  const listingChars = results.reduce((a, r) => a + r.listingChars, 0);
-  return { results, listingChars, budgetChars: LISTING_BUDGET_CHARS, overBudget: listingChars > LISTING_BUDGET_CHARS };
+  const counted = resident ? new Set(resident.map((f) => path.resolve(f))) : null;
+  const listed = counted ? results.filter((r) => counted.has(path.resolve(r.file))) : results;
+  const listingChars = listed.reduce((a, r) => a + r.listingChars, 0);
+  return { results, listingChars, listedSkills: listed.length, budgetChars: LISTING_BUDGET_CHARS, overBudget: listingChars > LISTING_BUDGET_CHARS };
 }
 
 // The PostToolUse hook's gate. It must match a module-owned SKILL.md too — that is the
@@ -170,7 +190,8 @@ function format(report, { relTo = REPO_ROOT } = {}) {
   }
   const errs = report.results.reduce((a, r) => a + r.errors.length, 0);
   const warns = report.results.reduce((a, r) => a + r.warnings.length, 0);
-  out.push(`skill-lint: ${report.results.length} skill(s), ${errs} error(s), ${warns} warning(s); listing ${report.listingChars} chars (~${Math.round(report.listingChars / 4)} tokens) vs ~${report.budgetChars}-char budget${report.overBudget ? ' — OVER: entries get truncated and routing degrades' : ''}`);
+  const resident = report.listedSkills !== undefined && report.listedSkills !== report.results.length ? ` (the ${report.listedSkills} resident here; the rest belong to modules this instance leaves off)` : '';
+  out.push(`skill-lint: ${report.results.length} skill(s), ${errs} error(s), ${warns} warning(s); listing ${report.listingChars} chars${resident} (~${Math.round(report.listingChars / 4)} tokens) vs ~${report.budgetChars}-char budget${report.overBudget ? ' — OVER: entries get truncated and routing degrades' : ''}`);
   return out.join('\n');
 }
 
@@ -196,10 +217,11 @@ function main() {
     return;
   }
   const files = argv.filter((a) => !a.startsWith('--'));
-  const report = lintSkills(files.length ? files.map((f) => path.resolve(f)) : listSkillFiles());
+  const all = files.length ? null : listSkillFiles();
+  const report = all ? lintSkills(all, { resident: residentSkillFiles(REPO_ROOT, { files: all }) }) : lintSkills(files.map((f) => path.resolve(f)));
   if (json) console.log(JSON.stringify(report, null, 1)); else console.log(format(report));
   process.exitCode = report.results.some((r) => r.errors.length) ? 1 : 0;
 }
 
-module.exports = { lintFrontmatter, lintSkillFile, lintSkills, listSkillFiles, splitFrontmatter, isSkillMd, format, DESC_WARN_CHARS, DESC_HARD_CHARS, LISTING_BUDGET_CHARS };
+module.exports = { lintFrontmatter, lintSkillFile, lintSkills, listSkillFiles, residentSkillFiles, splitFrontmatter, isSkillMd, format, DESC_WARN_CHARS, DESC_HARD_CHARS, LISTING_BUDGET_CHARS };
 if (require.main === module) main();

package/src/bongos/module-scope-map.js

@@ -269,8 +269,9 @@ const MODULE_GLOBS = {
   // than instance hosting and the web-surface precedent is one key per surface.
   'public-landing': ['modules/public-landing/'],
   // --- the design capability (task 1003324, ADR 0197): the design contract, its
-  //     adapters + sync CLIs + validator, the /design playbook, and the reserved homes
-  //     for the kit / the vendored UI skills / the style library. default-on,
+  //     adapters + sync CLIs + validator, the /design playbook, the kit and the style
+  //     library (the design-style skills are the design-styles key since task
+  //     1004470). default-on,
   //     declaration-only (three skills, no routes/port/migrations). The three
   //     scripts/gds/ shims are core-side entry points over the module's CLIs —
   //     listed for task affinity (the memory/ideas precedent: a command travels with
@@ -302,6 +303,11 @@ const MODULE_GLOBS = {
     'modules/game/', 'src/preview-server.js',
   ],
   'art-pipeline': ['modules/art-pipeline/'],
+  // --- the two opt-in SKILL modules (task 1004470): declaration-only, default-off.
+  //     Each owns only its own dir — the skills ship from modules/<key>/skills/,
+  //     not .claude/skills/, so there is no core skill dir to list. ---
+  'pixel-art': ['modules/pixel-art/'],
+  'design-styles': ['modules/design-styles/'],
   // --- the COPY half of the design contract: the artist's loop over user-facing
   //     TEXT (goal 1000074). ADR 0081 gave design TOKENS a repo-owned source of
   //     truth; text had none. R01 built the inventory (the copy-inventory

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.40'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.42'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/claude_materialize.mjs

@@ -507,10 +507,12 @@ t('moduleSkillSources: a non-slug name never reaches path.join; a vendored dir w
 t('materializeClaude: copied hooks carry NO founder origin/config-dir; a disabled-module skill is excluded', () => {
   if (!existsSync(join(ROOT, '.claude', 'hooks'))) return;
   const dir = mkdtempSync(join(tmpdir(), 'rb-e2e-'));
-  // Target instance: demo-branded, art-pipeline OFF (so its otb-* skills must be dropped).
+  // Target instance: demo-branded, pixel-art OFF (so its otb-* skills must be dropped).
+  // Since task 1004470 those skills are the pixel-art module's (they were orphans in the
+  // core's .claude/skills/ that art-pipeline, which has no manifest here, never owned).
   mkdirSync(join(dir, 'config'), { recursive: true });
   writeFileSync(join(dir, 'config', 'branding.json'), JSON.stringify({ domains: { publicOrigin: 'https://demo.cloudbongos.com', buildersOrigin: 'https://demo.cloudbongos.com', statusOrigin: 'https://demo.cloudbongos.com', oauthOrigin: 'https://demo.cloudbongos.com' }, configDir: 'cloudbongos', envPrefix: 'BONGOS' }));
-  writeFileSync(join(dir, 'config', 'modules.json'), JSON.stringify({ modules: { 'art-pipeline': false } }));
+  writeFileSync(join(dir, 'config', 'modules.json'), JSON.stringify({ modules: { 'art-pipeline': false, 'pixel-art': false } }));
   const res = m.materializeClaude({ coreRoot: ROOT, instanceDir: dir, dryRun: false });
   // Founder core → demo: a branding delta exists and rules are built. The NEUTRAL
   // core now carries its own dev-loop hooks (task 1003125), so this body runs there
@@ -531,12 +533,11 @@ t('materializeClaude: copied hooks carry NO founder origin/config-dir; a disable
   }
   assert.deepEqual(offenders, [], `founder origin/config-dir survived in: ${offenders.join(', ')}`);
 
-  // (b) art-pipeline is off → its otb-* skills are excluded; a core skill remains.
-  //     (The exclusion map, like the rebrand rules, resolves on a founder core.)
-  if (founderDelta) {
-    assert.ok(res.excludedSkills.includes('otb-tile-generate'), `art-pipeline skill excluded (got ${res.excludedSkills.join(',')})`);
-    assert.ok(!existsSync(join(dir, '.claude', 'skills', 'otb-tile-generate')), 'excluded skill not written');
-  }
+  // (b) pixel-art is off → its otb-* skills are excluded; a core skill remains. This used
+  //     to self-scope to a founder core, the only place an art-pipeline manifest existed;
+  //     the pixel-art module ships in the neutral core, so it now runs everywhere.
+  assert.ok(res.excludedSkills.includes('otb-tile-generate'), `pixel-art skill excluded (got ${res.excludedSkills.join(',')})`);
+  assert.ok(!existsSync(join(dir, '.claude', 'skills', 'otb-tile-generate')), 'excluded skill not written');
   assert.ok(existsSync(join(dir, '.claude', 'skills', 'builder-ship')), 'a core skill is still materialized');
   rmSync(dir, { recursive: true, force: true });
 });

package/tests/module_assess_security.mjs

@@ -0,0 +1,216 @@
+// tests/module_assess_security.mjs — the Security assessment gate (task 1003792, ADR 0343 D2).
+// No database and no network: the dependency audit is injected (and auditDependencies
+// is driven with a fake npm), the store row goes to a fake pg client, and the tarball
+// is a REAL packed + verified one. Pinned:
+//   - the outcome is only ever passed / failed / not_scored — never a number (D2 gate)
+//   - denied files, a non-registry dependency source and a high/critical advisory fail
+//   - an audit that cannot run is not_scored, never a pass (a gate that cannot run stays shut)
+//   - floating ranges and the maintenance posture are reported, never failed on
+//
+// Run:  node tests/module_assess_security.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { assessSecurity, auditDependencies, recordSecuritySignal, insertSecuritySignal, maintenancePosture, registrySpec } = require('../scripts/gds/module-assess-security.js');
+const { packModule } = require('../scripts/gds/module-artifact.js');
+const { relativeArtifactPath } = require('../src/bongos/module-store.js');
+
+const file = (p, text = '') => ({ path: p, buf: Buffer.from(text) });
+const MJ = (over = {}) => ({ key: 'weather', title: 'Weather', description: 'x', version: '1.2.0', coreVersion: '^1.0.0', contributes: {}, ...over });
+const clean = async () => ({ ok: true, findings: [] });
+const noAudit = async () => { throw new Error('the audit must not run for a module with no dependencies'); };
+
+test('no dependencies and no denied files passes, with no number and no audit', async () => {
+  const s = await assessSecurity('weather', [file('module.json'), file('index.js')], MJ(), { audit: noAudit });
+  assert.equal(s.outcome, 'passed');
+  assert.equal(s.score, null, 'the gate never carries a score (core_265: security is pass/fail only)');
+  assert.equal(s.sample_size, 0);
+});
+
+test('a credential-named file fails the gate on the publish denylist', async () => {
+  const s = await assessSecurity('weather', [file('module.json'), file('.env', 'X=1')], MJ(), { audit: noAudit });
+  assert.equal(s.outcome, 'failed');
+  assert.deepEqual(s.detail.failures.map((f) => f.check), ['denylist']);
+  assert.deepEqual(s.detail.failures[0].files, ['modules/weather/.env']);
+});
+
+test('a dependency fetched from outside the registry fails, and is never handed to npm', async () => {
+  const specs = ['git+https://example.invalid/x.git', 'https://example.invalid/x.tgz', 'github:someone/thing', 'someone/thing',
+    'npm:other@1.0.0', 'file:../../../../etc', 'link:../x', 'workspace:*', '1.0.0 || file:../x', 'git@github.com:a/b', 'rm -rf /', 'a#b'];
+  for (const spec of specs) {
+    const s = await assessSecurity('weather', [file('module.json')],
+      MJ({ dependencies: { lodash: '^4.17.21', thing: spec } }), { audit: noAudit });
+    assert.equal(s.outcome, 'failed', spec);
+    assert.equal(s.detail.failures[0].check, 'dependency_source', spec);
+    assert.deepEqual(s.detail.failures[0].dependencies.map((d) => d.package), ['thing'], spec);
+  }
+  const badName = await assessSecurity('weather', [file('module.json')], MJ({ dependencies: { '../evil': '1.0.0' } }), { audit: noAudit });
+  assert.equal(badName.outcome, 'failed');
+});
+
+test('registry specs: pinned, ranges and wildcards are allowed and told apart', () => {
+  const cases = [['1.2.3', 'pinned'], ['1.2.3-beta.1', 'pinned'], ['^14.26.4', 'floating range'], ['~1.2', 'floating range'],
+    ['>=1.0.0 <2.0.0', 'floating range'], ['1.x', 'floating range'], ['1.0.0 - 2.0.0', 'floating range'], ['^1 || ^2', 'floating range'],
+    ['*', 'wildcard'], ['latest', 'wildcard'], ['', 'wildcard']];
+  for (const [spec, kind] of cases) assert.deepEqual(registrySpec('lodash', spec), { ok: true, kind }, spec);
+  assert.equal(registrySpec('@scope/pkg', '^1.0.0').ok, true);
+});
+
+test('a wildcard is noted separately from a floating range', async () => {
+  const s = await assessSecurity('weather', [file('module.json')], MJ({ dependencies: { a: '*', b: '^1.0.0', c: '1.0.0' } }), { audit: clean });
+  assert.equal(s.outcome, 'passed');
+  assert.deepEqual(s.detail.notes.filter((n) => n.check.startsWith('dependency')).map((n) => [n.check, n.package]),
+    [['dependency_wildcard', 'a'], ['dependency_range', 'b']]);
+});
+
+test('a floating range is only noted', async () => {
+  const ok = await assessSecurity('weather', [file('module.json')], MJ({ dependencies: { lodash: '^4.17.21' } }), { audit: clean });
+  assert.equal(ok.outcome, 'passed');
+  assert.equal(ok.sample_size, 1);
+  assert.equal(ok.detail.notes.find((n) => n.check === 'dependency_range').package, 'lodash');
+});
+
+test('a high or critical advisory in a dependency fails the gate and names it', async () => {
+  const audit = async (deps) => {
+    assert.deepEqual(deps, { lodash: '^4.0.0' }, 'the audit sees exactly the declared dependencies');
+    return { ok: true, findings: [{ package: 'lodash', severity: 'critical', id: 'GHSA-x', summary: 'Prototype pollution', fix: 'lodash@4.17.21' }] };
+  };
+  const s = await assessSecurity('weather', [file('module.json')], MJ({ dependencies: { lodash: '^4.0.0' } }), { audit });
+  assert.equal(s.outcome, 'failed');
+  const v = s.detail.failures.find((f) => f.check === 'vulnerable_dependency');
+  assert.equal(v.advisories[0].id, 'GHSA-x');
+});
+
+test('an audit that cannot run is not_scored — never a pass', async () => {
+  const s = await assessSecurity('weather', [file('module.json')], MJ({ dependencies: { lodash: '^4.0.0' } }),
+    { audit: async () => ({ ok: false, reason: 'offline' }) });
+  assert.equal(s.outcome, 'not_scored');
+  assert.match(s.reason, /could not run/);
+});
+
+test('the maintenance posture is reported, never failed on', async () => {
+  assert.equal(maintenancePosture(MJ()), 'undeclared');
+  assert.equal(maintenancePosture(MJ({ maintenance: { status: 'orphaned' } })), 'orphaned');
+  for (const status of [undefined, 'deprecated', 'orphaned']) {
+    const mj = status ? MJ({ maintenance: { status, note: 'n' } }) : MJ();
+    const s = await assessSecurity('weather', [file('module.json')], mj, { audit: noAudit });
+    assert.equal(s.outcome, 'passed', String(status));
+    assert.equal(s.detail.notes.find((n) => n.check === 'maintenance').status, status || 'undeclared');
+  }
+  const kept = await assessSecurity('weather', [file('module.json')], MJ({ maintainer: 'a', maintenance: { status: 'maintained' } }), { audit: noAudit });
+  assert.equal(kept.detail.notes.length, 0, 'a maintained module has nothing to note');
+});
+
+// ---- auditDependencies: npm driven through a fake exec ----
+
+function fakeNpm({ lockOk = true, auditOut }) {
+  const calls = [];
+  const exec = (cmd, argv, opts, cb) => {
+    const args = cmd === 'cmd.exe' ? argv.slice(argv.indexOf('npm') + 1) : argv;
+    calls.push({ args, pkg: JSON.parse(fs.readFileSync(path.join(opts.cwd, 'package.json'), 'utf8')) });
+    if (args[0] === 'install') {
+      if (lockOk) fs.writeFileSync(path.join(opts.cwd, 'package-lock.json'), '{}');
+      return cb(lockOk ? null : new Error('E404'), '', '');
+    }
+    return cb(new Error('exit 1'), auditOut, '');
+  };
+  return { calls, exec };
+}
+
+test('the audit resolves metadata only (no install scripts) and reads npm audit\'s JSON', async () => {
+  const auditOut = JSON.stringify({ vulnerabilities: { lodash: { severity: 'high', via: [{ source: 1, title: 'Bad', severity: 'high', url: 'u' }], fixAvailable: true }, tiny: { severity: 'low', via: [] } } });
+  const npm = fakeNpm({ auditOut });
+  const a = await auditDependencies({ lodash: '^4.0.0' }, { exec: npm.exec });
+  assert.equal(a.ok, true);
+  assert.deepEqual(a.findings.map((f) => f.package), ['lodash'], 'only high and critical count');
+  const install = npm.calls[0].args;
+  assert.equal(install[0], 'install');
+  assert.ok(install.includes('--package-lock-only') && install.includes('--ignore-scripts'), 'no package code is downloaded or run');
+  assert.deepEqual(npm.calls[0].pkg.dependencies, { lodash: '^4.0.0' });
+});
+
+test('an unresolvable dependency or an unreadable audit is a failed audit run, not a clean one', async () => {
+  assert.equal((await auditDependencies({ nope: '^1.0.0' }, { exec: fakeNpm({ lockOk: false }).exec })).ok, false);
+  assert.equal((await auditDependencies({ a: '^1.0.0' }, { exec: fakeNpm({ auditOut: 'not json' }).exec })).ok, false);
+  assert.equal((await auditDependencies({ a: '^1.0.0' }, { exec: fakeNpm({ auditOut: JSON.stringify({ error: { code: 'ENOAUDIT' } }) }).exec })).ok, false);
+});
+
+// ---- recordSecuritySignal: tarball in, one appended row out ----
+
+function fakeDb(versionRow) {
+  const inserts = [];
+  return {
+    inserts,
+    async query(sql, params) {
+      if (/FROM store_module_versions/.test(sql)) return { rows: versionRow ? [versionRow] : [] };
+      if (/INSERT INTO module_assessment_signals/.test(sql)) {
+        assert.match(sql, /'security'/);
+        assert.doesNotMatch(sql, /UPDATE/i);
+        inserts.push(params);
+        return { rows: [{ id: 3, version_id: params[0], part: 'security', outcome: params[1] }] };
+      }
+      throw new Error(`unexpected query: ${sql}`);
+    },
+  };
+}
+
+function published(mj = MJ()) {
+  const src = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-sec-src-'));
+  fs.mkdirSync(path.join(src, 'weather'), { recursive: true });
+  fs.writeFileSync(path.join(src, 'weather', 'module.json'), JSON.stringify(mj));
+  fs.writeFileSync(path.join(src, 'weather', 'index.js'), 'module.exports = {};\n');
+  const { tgz } = packModule('weather', { modulesDir: src, now: () => new Date('2026-09-30T00:00:00Z'), modeOf: () => '644' });
+  const storeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-sec-store-'));
+  const final = path.join(storeDir, 'weather', 'weather-1.2.0.tgz');
+  fs.mkdirSync(path.dirname(final), { recursive: true });
+  fs.writeFileSync(final, tgz);
+  return { storeDir, final, row: { id: 42, module_key: 'weather', version: '1.2.0', artifact_path: relativeArtifactPath(final, { dir: storeDir }) } };
+}
+
+test('a published version is checked from its tarball and one security row is appended', async () => {
+  const { storeDir, row } = published(MJ({ dependencies: { lodash: '^4.17.21' } }));
+  const db = fakeDb(row);
+  let audited = null;
+  const res = await recordSecuritySignal(42, { db, storeDir, audit: async (d) => { audited = d; return { ok: true, findings: [] }; } });
+  assert.equal(res.ok, true);
+  assert.deepEqual(audited, { lodash: '^4.17.21' }, 'the dependencies come from the published module.json');
+  const [versionId, outcome, score, sample] = db.inserts[0];
+  assert.deepEqual([versionId, outcome, score, sample], [42, 'passed', null, 1]);
+});
+
+test('a missing or tampered tarball is not_scored, and an unknown version writes nothing', async () => {
+  const { storeDir, final, row } = published();
+  fs.writeFileSync(final, 'junk');
+  const db = fakeDb(row);
+  await recordSecuritySignal(42, { db, storeDir, audit: noAudit });
+  assert.equal(db.inserts[0][1], 'not_scored');
+  assert.doesNotMatch(db.inserts[0][4], /[\\/]/, 'no local path in the stored reason');
+
+  const none = fakeDb(null);
+  const res = await recordSecuritySignal(9, { db: none, audit: noAudit });
+  assert.equal(res.code, 'version_not_found');
+  assert.equal(none.inserts.length, 0);
+});
+
+test('insertSecuritySignal writes the security part with no score', async () => {
+  const seen = [];
+  await insertSecuritySignal(5, { outcome: 'failed', score: null, sample_size: 2, reason: 'r', detail: { failures: [] } },
+    { db: { async query(sql, params) { seen.push(params); return { rows: [{}] }; } } });
+  assert.deepEqual(seen[0], [5, 'failed', null, 2, 'r', '{"failures":[]}']);
+});
+
+test('a core script never requires a module file (the one-way rule)', () => {
+  const src = fs.readFileSync(new URL('../scripts/gds/module-assess-security.js', import.meta.url), 'utf8').replace(/\/\/.*$/gm, '');
+  assert.doesNotMatch(src, /require\([^)]*modules\//);
+});
+
+test('the gate never runs the module\'s own code', () => {
+  const src = fs.readFileSync(new URL('../scripts/gds/module-assess-security.js', import.meta.url), 'utf8').replace(/\/\/.*$/gm, '');
+  assert.doesNotMatch(src, /process\.execPath|require\(\s*path\.join|import\(/, 'no node process or require over module files');
+});

package/tests/module_loader.mjs

@@ -276,7 +276,7 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'npm-release', 'onboarding', 'platform-identity', 'provisioning', 'public-landing', 'render-deploy', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
+  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'design-styles', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'npm-release', 'onboarding', 'pixel-art', 'platform-identity', 'provisioning', 'public-landing', 'render-deploy', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();

package/tests/opt_in_skill_modules.mjs

@@ -0,0 +1,165 @@
+// tests/opt_in_skill_modules.mjs — the two opt-in skill modules of task 1004470 (owner
+// ruling on blocker 1000139), pinned on the REAL tree rather than a fixture core:
+//
+//   pixel-art      (default: false) — the five otb-* skills, orphans in .claude/skills/
+//                   until now, carrying skill text only and never a copyrighted asset;
+//   design-styles  (default: false) — the thirteen design-style skills split out of
+//                   ui-design, which keeps /design + the sync skills and stays default-on.
+//
+// Both shapes the task names: a default-config instance materialises NEITHER module's
+// skills, and an instance that turns both on materialises all eighteen with nothing
+// refused by the vendoring gate. Plus the reason the split exists — skill-lint's resident
+// listing for the default shape is ~6,800 chars smaller — and the publish allowlist that
+// lets a released core carry the modules at all. DB-free.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const materialize = require(path.join(ROOT, 'scripts', 'gds', 'claude-materialize.js'));
+const lint = require(path.join(ROOT, 'scripts', 'gds', 'skill-lint.js'));
+const publish = require(path.join(ROOT, 'scripts', 'gds', 'publish-manifest.js'));
+const readJson = (p) => JSON.parse(fs.readFileSync(p, 'utf8'));
+
+const PIXEL_ART = ['otb-tile-generate', 'otb-design-review', 'otb-character-review', 'otb-feedback-capture', 'otb-figma-sync'];
+const DESIGN_STYLES = ['design-taste-frontend', 'high-end-visual-design', 'redesign-existing-projects', 'impeccable', 'style', 'minimalist-ui', 'industrial-brutalist-ui', 'gpt-taste', 'stitch-design-taste', 'image-to-code', 'imagegen-frontend-web', 'imagegen-frontend-mobile', 'brandkit'];
+const ALL = [...PIXEL_ART, ...DESIGN_STYLES];
+const UI_DESIGN_KEEPS = ['design', 'design-sync', 'figma-design-sync'];
+
+function instance(modules) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'opt-in-skills-'));
+  if (modules) {
+    fs.mkdirSync(path.join(dir, 'config'), { recursive: true });
+    fs.writeFileSync(path.join(dir, 'config', 'modules.json'), JSON.stringify({ modules }));
+  }
+  return dir;
+}
+
+test('the two manifests: default off, each declares exactly its skills, and ui-design keeps only its three', () => {
+  const pa = readJson(path.join(ROOT, 'modules', 'pixel-art', 'module.json'));
+  const ds = readJson(path.join(ROOT, 'modules', 'design-styles', 'module.json'));
+  const ui = readJson(path.join(ROOT, 'modules', 'ui-design', 'module.json'));
+  assert.equal(pa.key, 'pixel-art');
+  assert.equal(pa.default, false, 'pixel-art is opt-in');
+  assert.deepEqual([...pa.contributes.skills].sort(), [...PIXEL_ART].sort());
+  assert.equal(ds.key, 'design-styles');
+  assert.equal(ds.default, false, 'design-styles is opt-in');
+  assert.deepEqual([...ds.contributes.skills].sort(), [...DESIGN_STYLES].sort());
+  assert.equal(ui.default, true, 'ui-design stays default-on');
+  assert.deepEqual([...ui.contributes.skills].sort(), [...UI_DESIGN_KEEPS].sort(), 'ui-design keeps /design and the two sync skills, nothing else');
+  for (const m of [pa, ds]) {
+    for (const k of ['routes', 'pollers', 'migrations', 'uiSections']) assert.ok(!(k in m.contributes), `${m.key}: declaration-only, contributes no ${k}`);
+  }
+});
+
+test('design-taste-frontend-v1 is gone everywhere a skill can live', () => {
+  for (const dir of [path.join(ROOT, '.claude', 'skills'), ...fs.readdirSync(path.join(ROOT, 'modules')).map((m) => path.join(ROOT, 'modules', m, 'skills'))]) {
+    assert.ok(!fs.existsSync(path.join(dir, 'design-taste-frontend-v1')), `${path.relative(ROOT, dir)}: no design-taste-frontend-v1`);
+  }
+  const declared = fs.readdirSync(path.join(ROOT, 'modules')).flatMap((m) => {
+    const p = path.join(ROOT, 'modules', m, 'module.json');
+    return fs.existsSync(p) ? ((readJson(p).contributes || {}).skills || []) : [];
+  });
+  assert.ok(!declared.includes('design-taste-frontend-v1'), 'no module declares it');
+});
+
+test('the eighteen skills left the core .claude/skills/ and live only in their module', () => {
+  for (const name of PIXEL_ART) {
+    assert.ok(!execTracked(name), `${name}: not a tracked core skill any more`);
+    assert.ok(fs.existsSync(path.join(ROOT, 'modules', 'pixel-art', 'skills', name, 'SKILL.md')), `${name}: modules/pixel-art/skills/${name}/SKILL.md`);
+  }
+  for (const name of DESIGN_STYLES) {
+    assert.ok(fs.existsSync(path.join(ROOT, 'modules', 'design-styles', 'skills', name, 'SKILL.md')), `${name}: modules/design-styles/skills/${name}/SKILL.md`);
+    assert.ok(!fs.existsSync(path.join(ROOT, 'modules', 'ui-design', 'skills', name)), `${name}: no copy left under ui-design`);
+  }
+  for (const f of ['policy.json', 'PREAMBLE.md', 'README.md']) assert.ok(fs.existsSync(path.join(ROOT, 'modules', 'design-styles', 'skills', f)), `design-styles carries skills/${f}`);
+});
+
+// A copy materialised into the core checkout (--module-skills-only) is untracked and
+// self-ignored; only a TRACKED .claude/skills/<name> would mean the move did not happen.
+function execTracked(name) {
+  const { spawnSync } = require('node:child_process');
+  return spawnSync('git', ['-C', ROOT, 'ls-files', '--error-unmatch', '--', `.claude/skills/${name}/SKILL.md`], { encoding: 'utf8' }).status === 0;
+}
+
+test('pixel-art carries skill text only — never a reference map, a palette, a rubric or generated art', () => {
+  const files = [];
+  const walk = (d) => { for (const e of fs.readdirSync(d, { withFileTypes: true })) { const p = path.join(d, e.name); if (e.isDirectory()) walk(p); else files.push(path.relative(path.join(ROOT, 'modules', 'pixel-art'), p).split(path.sep).join('/')); } };
+  walk(path.join(ROOT, 'modules', 'pixel-art'));
+  const allowed = new Set(['module.json', 'CLAUDE.md', ...PIXEL_ART.map((n) => `skills/${n}/SKILL.md`)]);
+  assert.deepEqual(files.filter((f) => !allowed.has(f)), [], 'nothing but the manifest, its CLAUDE.md and the five SKILL.md files (ADR 0098: the art assets stay in the never-published art-pipeline)');
+});
+
+test('DEFAULT config: a fresh instance materialises neither module\'s skills, and still gets /design', () => {
+  const dir = instance(null);
+  const res = materialize.materializeClaude({ coreRoot: ROOT, instanceDir: dir, dryRun: false });
+  for (const name of ALL) {
+    assert.ok(!fs.existsSync(path.join(dir, '.claude', 'skills', name)), `${name}: not materialised by default`);
+    assert.ok(res.excludedSkills.includes(name), `${name}: reported as excluded (module off)`);
+  }
+  for (const name of UI_DESIGN_KEEPS) assert.ok(fs.existsSync(path.join(dir, '.claude', 'skills', name, 'SKILL.md')), `${name}: ui-design's own skill still lands`);
+  assert.ok(fs.existsSync(path.join(dir, '.claude', 'skills', 'builder-ship', 'SKILL.md')), 'a core skill still lands');
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+test('ENABLED config: pixel-art + design-styles on → all eighteen materialise, none refused by the vendoring gate', () => {
+  const dir = instance({ 'pixel-art': true, 'design-styles': true });
+  const res = materialize.materializeClaude({ coreRoot: ROOT, instanceDir: dir, dryRun: false });
+  assert.deepEqual(res.notes.filter((n) => n.includes('refused')), [], 'the vendoring gate refused nothing');
+  for (const name of ALL) {
+    assert.ok(fs.existsSync(path.join(dir, '.claude', 'skills', name, 'SKILL.md')), `${name}: materialised`);
+    assert.ok(!res.excludedSkills.includes(name), `${name}: not excluded`);
+  }
+  assert.ok(fs.existsSync(path.join(dir, '.claude', 'skills', 'impeccable', 'reference', 'audit.md')), 'impeccable lands as a tree, its playbooks included');
+  // the gate itself, applied to each source the materialiser resolved for the two modules
+  const roster = materialize.moduleSkillRoster({ coreRoot: ROOT, instanceDir: dir });
+  const sources = materialize.moduleSkillSources({ roster });
+  assert.deepEqual(sources.refused.filter((r) => ['pixel-art', 'design-styles'].includes(r.module)), []);
+  const mine = sources.filter((s) => ['pixel-art', 'design-styles'].includes(s.module));
+  assert.deepEqual(mine.map((s) => s.name).sort(), [...ALL].sort(), 'the materialiser resolves exactly the eighteen');
+  const policy = readJson(path.join(ROOT, 'modules', 'design-styles', 'skills', 'policy.json'));
+  for (const s of mine) if (s.vendored) assert.ok(materialize.vendoredSkillGate(s.dir, policy).ok, `${s.name}: a vendored copy passes the gate`);
+  // and the instance's provenance record names each with its module, so switching one off later withdraws it
+  const record = readJson(path.join(dir, '.claude', 'skills', materialize.INSTANCE_SKILLS_MANIFEST)).skills;
+  for (const name of PIXEL_ART) assert.equal(record[name].module, 'pixel-art', `${name}: recorded under pixel-art`);
+  for (const name of DESIGN_STYLES) assert.equal(record[name].module, 'design-styles', `${name}: recorded under design-styles`);
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+test('switching the modules back off withdraws what an earlier run landed', () => {
+  const dir = instance({ 'pixel-art': true, 'design-styles': true });
+  materialize.materializeClaude({ coreRoot: ROOT, instanceDir: dir, dryRun: false });
+  fs.writeFileSync(path.join(dir, 'config', 'modules.json'), JSON.stringify({ modules: { 'pixel-art': false, 'design-styles': false } }));
+  const res = materialize.materializeClaude({ coreRoot: ROOT, instanceDir: dir, dryRun: false, overwrite: true });
+  for (const name of ALL) assert.ok(!fs.existsSync(path.join(dir, '.claude', 'skills', name)), `${name}: withdrawn`);
+  assert.ok(res.withdrawnSkills.length >= ALL.length, 'every one is reported withdrawn');
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+test('skill-lint lints all eighteen but counts only the resident ones: the default shape is ~6,800 chars smaller', () => {
+  const files = lint.listSkillFiles(ROOT);
+  const names = files.map((f) => path.basename(path.dirname(f)));
+  for (const n of ALL) assert.ok(names.includes(n), `${n}: still linted though its module is off`);
+  const off = instance(null);
+  const on = instance({ 'pixel-art': true, 'design-styles': true });
+  const def = lint.lintSkills(files, { resident: lint.residentSkillFiles(ROOT, { instanceDir: off, files }) });
+  const all = lint.lintSkills(files, { resident: lint.residentSkillFiles(ROOT, { instanceDir: on, files }) });
+  const delta = all.listingChars - def.listingChars;
+  assert.ok(delta >= 6000, `the two modules take ~6,800 chars out of a default listing (measured ${delta})`);
+  assert.equal(all.listedSkills - def.listedSkills, ALL.length, 'exactly the eighteen leave the default listing');
+  assert.equal(lint.lintSkills(files).listingChars, all.listingChars, 'with no resident list, every linted file is counted (the old behaviour)');
+  for (const d of [off, on]) fs.rmSync(d, { recursive: true, force: true });
+});
+
+test('a released core carries both modules (shipped is not enabled), and art-pipeline stays excluded', () => {
+  assert.ok(publish.isPublishable('modules/pixel-art/module.json'), 'pixel-art publishes');
+  assert.ok(publish.isPublishable('modules/pixel-art/skills/otb-tile-generate/SKILL.md'), 'its skills publish');
+  assert.ok(publish.isPublishable('modules/design-styles/module.json'), 'design-styles publishes');
+  assert.ok(publish.isPublishable('modules/design-styles/skills/impeccable/reference/audit.md'), 'its skill trees publish');
+  assert.ok(!publish.isPublishable('modules/art-pipeline/references/x.png'), 'the copyrighted reference maps never publish (ADR 0098)');
+});

package/tests/skill_lint.mjs

@@ -106,14 +106,38 @@ test('the lister reaches module-owned skills, and a core copy of the same name w
 });
 
 test('every module-owned skill this repo ships parses too — the 14 that did not on 2026-09-04 (task 1003587)', () => {
-  const dir = path.join(ROOT, 'modules', 'ui-design', 'skills');
+  // Those skills moved to the opt-in design-styles module (task 1004470, which also deleted
+  // design-taste-frontend-v1, leaving 13); an OFF module's skills are still linted.
+  const dir = path.join(ROOT, 'modules', 'design-styles', 'skills');
   const files = lint.listSkillFiles(ROOT).filter((f) => f.startsWith(dir) || fs.existsSync(path.join(dir, path.basename(path.dirname(f)), 'SKILL.md')));
-  assert.ok(files.length >= 14, `the ui-design module ships 14+ skills; found ${files.length}`);
+  assert.ok(files.length >= 13, `the design-styles module ships 13+ skills; found ${files.length}`);
   const report = lint.lintSkills(files);
   const broken = report.results.filter((r) => r.errors.length).map((r) => path.relative(ROOT, r.file) + ': ' + r.errors.join('; '));
   assert.deepEqual(broken, [], broken.join('\n'));
 });
 
+test('the listing counts only RESIDENT skills: an off module\'s skill is linted but not counted, an on one is both (task 1004470)', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'skill-lint-resident-'));
+  const skill = (n) => `---\nname: ${n}\ndescription: ${'x'.repeat(100)}\n---\nbody\n`;
+  const put = (rel, text) => { const p = path.join(root, rel); fs.mkdirSync(path.dirname(p), { recursive: true }); fs.writeFileSync(p, text); };
+  put('.claude/skills/core-one/SKILL.md', skill('core-one'));
+  put('modules/offmod/module.json', JSON.stringify({ key: 'offmod', default: false, contributes: { skills: ['off-one'] } }));
+  put('modules/offmod/skills/off-one/SKILL.md', skill('off-one'));
+  put('modules/onmod/module.json', JSON.stringify({ key: 'onmod', default: true, contributes: { skills: ['on-one'] } }));
+  put('modules/onmod/skills/on-one/SKILL.md', skill('on-one'));
+  const files = lint.listSkillFiles(root);
+  assert.equal(files.length, 3, 'all three are linted');
+  const resident = lint.residentSkillFiles(root, { files }).map((f) => path.basename(path.dirname(f))).sort();
+  assert.deepEqual(resident, ['core-one', 'on-one'], 'the default-off module\'s skill is not resident');
+  const report = lint.lintSkills(files, { resident: lint.residentSkillFiles(root, { files }) });
+  assert.equal(report.results.length, 3);
+  assert.equal(report.listedSkills, 2);
+  assert.equal(report.listingChars, ('core-one'.length + 100) + ('on-one'.length + 100), 'the listing is the two resident entries');
+  put('config/modules.json', JSON.stringify({ modules: { offmod: true, onmod: false } }));
+  assert.deepEqual(lint.residentSkillFiles(root, { files }).map((f) => path.basename(path.dirname(f))).sort(), ['core-one', 'off-one'], 'the instance\'s config/modules.json wins over each module\'s default');
+  fs.rmSync(root, { recursive: true, force: true });
+});
+
 test('every committed skill parses (the ten that did not on 2026-09-03 must stay fixed)', () => {
   const report = lint.lintSkills(lint.listSkillFiles(ROOT));
   const broken = report.results.filter((r) => r.errors.length).map((r) => path.relative(ROOT, r.file) + ': ' + r.errors.join('; '));