@bongos/core 1.20.41 → 1.20.43

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (59) hide show
  1. package/.bongos-core.json +94 -64
  2. package/.claude/skills/backlog-review/SKILL.md +1 -0
  3. package/.claude/skills/blocker-review/SKILL.md +1 -1
  4. package/.claude/skills/bug-triage/SKILL.md +1 -0
  5. package/.claude/skills/builder-backup/SKILL.md +1 -0
  6. package/.claude/skills/builder-claim/SKILL.md +1 -1
  7. package/.claude/skills/builder-cost/SKILL.md +1 -0
  8. package/.claude/skills/builder-exit/SKILL.md +1 -0
  9. package/.claude/skills/builder-key/SKILL.md +1 -1
  10. package/.claude/skills/builder-reauth/SKILL.md +1 -1
  11. package/.claude/skills/builder-redteam/SKILL.md +1 -1
  12. package/.claude/skills/builder-sequence/SKILL.md +1 -1
  13. package/.claude/skills/builder-setup/SKILL.md +1 -1
  14. package/.claude/skills/collab-review/SKILL.md +1 -1
  15. package/.claude/skills/design/SKILL.md +1 -1
  16. package/.claude/skills/design-sync/SKILL.md +1 -0
  17. package/.claude/skills/feedback/SKILL.md +1 -1
  18. package/.claude/skills/figma-design-sync/SKILL.md +1 -0
  19. package/.claude/skills/goal-close/SKILL.md +184 -0
  20. package/.claude/skills/goal-create/SKILL.md +1 -1
  21. package/.claude/skills/goal-review/SKILL.md +5 -102
  22. package/.claude/skills/goal-uat/SKILL.md +5 -81
  23. package/.claude/skills/grade-audit/SKILL.md +6 -85
  24. package/.claude/skills/grade-recover/SKILL.md +1 -1
  25. package/.claude/skills/grade-sweep/SKILL.md +174 -0
  26. package/.claude/skills/grader-health/SKILL.md +5 -72
  27. package/.claude/skills/idea-triage/SKILL.md +1 -0
  28. package/.claude/skills/merge-mode/SKILL.md +1 -1
  29. package/.claude/skills/new-project/SKILL.md +1 -0
  30. package/.claude/skills/owner-review/SKILL.md +40 -0
  31. package/.claude/skills/planning-session/SKILL.md +1 -0
  32. package/.claude/skills/priority-session/SKILL.md +1 -0
  33. package/.claude/skills/read-session-export/SKILL.md +1 -1
  34. package/.claude/skills/recall/SKILL.md +1 -1
  35. package/.claude/skills/scan-before-install/SKILL.md +1 -1
  36. package/.claude/skills/session-handoff/SKILL.md +1 -1
  37. package/.claude/skills/worktree-clean/SKILL.md +1 -1
  38. package/docs/architecture.md +1 -1
  39. package/docs/file-map.md +12 -10
  40. package/docs/module-api-changelog.md +4 -0
  41. package/docs/onboarding/slash-commands.md +17 -11
  42. package/docs/packs/artist.md +1 -1
  43. package/docs/packs/engineer.md +4 -5
  44. package/modules/copy-desk/module.json +1 -1
  45. package/{.claude → modules/copy-desk}/skills/tweak/SKILL.md +1 -0
  46. package/modules/lifecycle/dependency-advisory.js +2 -2
  47. package/package-lock.json +2 -2
  48. package/package.json +1 -1
  49. package/release-notes.json +12 -0
  50. package/scripts/gds/fitness-ratchets.js +2 -0
  51. package/scripts/gds/module-artifact.js +1 -1
  52. package/scripts/gds/module-assess-security.js +251 -0
  53. package/scripts/gds/skill-lint.js +32 -9
  54. package/src/module-api.js +1 -1
  55. package/tests/module_assess_security.mjs +216 -0
  56. package/tests/skill_grade_audit.mjs +34 -17
  57. package/tests/skill_grader_health.mjs +28 -10
  58. package/tests/skill_lint.mjs +37 -0
  59. package/tests/skill_menu_ruling.mjs +99 -0
package/.bongos-core.json CHANGED
@@ -2,22 +2,22 @@
2
2
  "artifact": "bongos-core",
3
3
  "manifest_schema": 1,
4
4
  "generator": "scripts/gds/package-core.js",
5
- "core_version": "1.20.41",
6
- "core_contract": "1.20.41",
7
- "source_commit": "e537f265c1269c76691d50bf25c111080be455f1",
5
+ "core_version": "1.20.43",
6
+ "core_contract": "1.20.43",
7
+ "source_commit": "4d771a1a0917c29baeb888e981459cade4da163d",
8
8
  "source_ref": "HEAD",
9
- "built_at": "2026-10-01T00:59:19.394Z",
9
+ "built_at": "2026-10-01T01:43:09.317Z",
10
10
  "redaction": {
11
11
  "model": "docs-redacted+functional-verbatim",
12
- "docs_redacted": 563,
12
+ "docs_redacted": 566,
13
13
  "agent_docs_stubbed": 27,
14
- "functional_verbatim": 2687,
14
+ "functional_verbatim": 2690,
15
15
  "rules": 3,
16
16
  "gate_literals": 3,
17
17
  "gate": "passed"
18
18
  },
19
- "file_count": 3278,
20
- "tree_sha256": "0c3d1503ca07445b27ce4fbdd31fa8b9e6706bc6a6643335cfc75b9f0eae9425",
19
+ "file_count": 3284,
20
+ "tree_sha256": "9619017af56fd7bd25e2825f3559277af091a1bf7d9e7b01d3fd23413efac6d9",
21
21
  "files": [
22
22
  {
23
23
  "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -27,12 +27,12 @@
27
27
  {
28
28
  "path": ".claude/skills/backlog-review/SKILL.md",
29
29
  "mode": "0000644",
30
- "sha256": "0c0bc7039d61965b6e13ad2b9c8fd2984ad21e8e70c6d63b768b4e59f212f2c8"
30
+ "sha256": "d5a225efb44e75c098a23ecd24d0a8c1223fba1d8b77deb9a42cc6456ab38cc1"
31
31
  },
32
32
  {
33
33
  "path": ".claude/skills/blocker-review/SKILL.md",
34
34
  "mode": "0000644",
35
- "sha256": "7dc76bb25816ad38791063fee7d4e2be97e3edc3ff40e451598d04e1df093bc0"
35
+ "sha256": "2d8fbd0015b75ae265b3fc292c2b37a15aa7ed5fddf566895f771c49cd0eb42f"
36
36
  },
37
37
  {
38
38
  "path": ".claude/skills/blocker-solve/SKILL.md",
@@ -47,22 +47,22 @@
47
47
  {
48
48
  "path": ".claude/skills/bug-triage/SKILL.md",
49
49
  "mode": "0000644",
50
- "sha256": "37b76d98298532e53a2ae4dab41e933df6751567a228e20cb0ebd2e52f88fd8c"
50
+ "sha256": "343c6b93db554a7ca380e17b2a65fabc6a90335440fc1fa41564cada8e5a22af"
51
51
  },
52
52
  {
53
53
  "path": ".claude/skills/builder-backup/SKILL.md",
54
54
  "mode": "0000644",
55
- "sha256": "3c0195550ceedc9ceb15113c41f9d853b1437b4a034c511759027e2f0f2ee783"
55
+ "sha256": "0c3b70c48ff8a2dbd1a24de0077b7deb764078e102cbd46bde60426c03a92328"
56
56
  },
57
57
  {
58
58
  "path": ".claude/skills/builder-claim/SKILL.md",
59
59
  "mode": "0000644",
60
- "sha256": "02c7421ba3bb3a325cd556623a55e89f568feffadd71e54085b0b792f81eca35"
60
+ "sha256": "8a8ae8dfc34df81f8b9634a124190c4413f809cc5242c1528f52e8a997a548cd"
61
61
  },
62
62
  {
63
63
  "path": ".claude/skills/builder-cost/SKILL.md",
64
64
  "mode": "0000644",
65
- "sha256": "2781b91e1ba1637955e165f5eb087b48ee1dd1bb228388d54c0b87acbc19627b"
65
+ "sha256": "1076dddfa9f3c8050936992809c01029fde78229ff94ef2f0fdaf23b9cb330d7"
66
66
  },
67
67
  {
68
68
  "path": ".claude/skills/builder-end/SKILL.md",
@@ -72,22 +72,22 @@
72
72
  {
73
73
  "path": ".claude/skills/builder-exit/SKILL.md",
74
74
  "mode": "0000644",
75
- "sha256": "23d94651d0073ac51926c902cd247b00e69aa3bed936a7142d6c4e01a1322994"
75
+ "sha256": "12470a01b64825cea6e3802741bba03bc5d0f8485f17bb265bcc88cac419527c"
76
76
  },
77
77
  {
78
78
  "path": ".claude/skills/builder-key/SKILL.md",
79
79
  "mode": "0000644",
80
- "sha256": "ac78f474cbbf6e6c820b767b0daf8f0d5228d6faa969bee4ff1c31b97c86d621"
80
+ "sha256": "84d773763fdd4d8f5c8fe307943e55d22c575d3124cd3927c25842ea5d349427"
81
81
  },
82
82
  {
83
83
  "path": ".claude/skills/builder-reauth/SKILL.md",
84
84
  "mode": "0000644",
85
- "sha256": "858e43d0edbe11cc54102a732792fbd1e6cf30e3ee3002ce2c2ed28291c07e24"
85
+ "sha256": "ba3fd60016189d3779626f79608cbfe43ae5147d4f292cdee5df7eae3019dc27"
86
86
  },
87
87
  {
88
88
  "path": ".claude/skills/builder-redteam/SKILL.md",
89
89
  "mode": "0000644",
90
- "sha256": "ba83588c1e7a1ea5dc76503b0cc4b8e8f251528f256d14b61caaf6aaff86f961"
90
+ "sha256": "ccb6be59843456c0dd2f75b70b48838242d1acd9659025e3ca73530d4db622ef"
91
91
  },
92
92
  {
93
93
  "path": ".claude/skills/builder-release/SKILL.md",
@@ -97,12 +97,12 @@
97
97
  {
98
98
  "path": ".claude/skills/builder-sequence/SKILL.md",
99
99
  "mode": "0000644",
100
- "sha256": "258fae3610fcb542d48289b732fc4d912829ee7f68504ad4ee21091068242fb7"
100
+ "sha256": "f4e87604b7e514b49171afa8c8263013379f5a08016c944b7a3470409805fa6f"
101
101
  },
102
102
  {
103
103
  "path": ".claude/skills/builder-setup/SKILL.md",
104
104
  "mode": "0000644",
105
- "sha256": "6f085bbdabb28e7404d6744f4f452741c4fbbec31e0f851a603d5e724a201e38"
105
+ "sha256": "8f74888a34803e7bbfc74ac27ac0bc8fbb6e445beb863199c6afbdb443b26e2b"
106
106
  },
107
107
  {
108
108
  "path": ".claude/skills/builder-ship/SKILL.md",
@@ -122,107 +122,122 @@
122
122
  {
123
123
  "path": ".claude/skills/collab-review/SKILL.md",
124
124
  "mode": "0000644",
125
- "sha256": "f3b382343ce278df3d1cb4e8478eedd9b3365c1526082d44b02e763c67082a4b"
125
+ "sha256": "f374f4d1a839154a819648f04cee927d72021366f490cf12ea51c87c889a7d0b"
126
126
  },
127
127
  {
128
128
  "path": ".claude/skills/design-sync/SKILL.md",
129
129
  "mode": "0000644",
130
- "sha256": "4c54ddedcf49596c590aac8ed5c57efbf76ddaecb729fc5be64e12ba524d4f84"
130
+ "sha256": "31b8ffdc7f802a112f6453fd71b6fc79681425b4f466d1716367ffe4b9d49f38"
131
131
  },
132
132
  {
133
133
  "path": ".claude/skills/design/SKILL.md",
134
134
  "mode": "0000644",
135
- "sha256": "1de185dce60be28a50288dffdd2fa872db378ec27bda70d00674b715edc7b1db"
135
+ "sha256": "5a2e7a11abdc9f0ecc81fbf057978523af56dcddcb712581337059c696a139db"
136
136
  },
137
137
  {
138
138
  "path": ".claude/skills/feedback/SKILL.md",
139
139
  "mode": "0000644",
140
- "sha256": "f6dae4a4780cca42ec2bd6d989021f12e57a1d604b91b283bdbfbeaed399e5c3"
140
+ "sha256": "184cc6f540628de549f8f6d1a745ff683759f17f1752a0ac8779f52327b57b3d"
141
141
  },
142
142
  {
143
143
  "path": ".claude/skills/figma-design-sync/SKILL.md",
144
144
  "mode": "0000644",
145
- "sha256": "46906dbaa51369124a652a8e115c1a2f97901517d9038a91364a50df911e63b3"
145
+ "sha256": "0dd5e87dc080344b04fafe1f871ba870dcc80fe28024c57a4dfd03adb30f147b"
146
146
  },
147
147
  {
148
148
  "path": ".claude/skills/fix-task/SKILL.md",
149
149
  "mode": "0000644",
150
150
  "sha256": "02b9c32ab0e467f9f251706670bf34da8fedf52e5cd0f2d0e0e4e777f7dcce37"
151
151
  },
152
+ {
153
+ "path": ".claude/skills/goal-close/SKILL.md",
154
+ "mode": "0000644",
155
+ "sha256": "a4e3bb14ab16e4a3dd91e5a54d4db1bcd1c32ad11e0e90c99e00dd108eb36676"
156
+ },
152
157
  {
153
158
  "path": ".claude/skills/goal-create/SKILL.md",
154
159
  "mode": "0000644",
155
- "sha256": "c33bc76ca71ac5b8f9a2bd5ed04c91a87e10a5926aa76937b8b743891f2d451b"
160
+ "sha256": "8226e410c256a4b13a38b1b6cad0d685faae5d6e1f7bd3f0d724582c1269eedf"
156
161
  },
157
162
  {
158
163
  "path": ".claude/skills/goal-review/SKILL.md",
159
164
  "mode": "0000644",
160
- "sha256": "51d66a4a18aa7677b48fb882c9a5d9f7e4d22e234cf86bce1264fd3519247652"
165
+ "sha256": "427bc66834f1bba06d323bb40bc129ae688a3753c5c4b1c8fa7d5ffc5e9cf656"
161
166
  },
162
167
  {
163
168
  "path": ".claude/skills/goal-uat/SKILL.md",
164
169
  "mode": "0000644",
165
- "sha256": "f73e4f36178ea2d03fc58726e9e418447d2070175f1275aa37076cba3791c967"
170
+ "sha256": "ce9b978762e144fb90f9b3104a5c0356232032e925adc0ff40b3cd3f6468ba2b"
166
171
  },
167
172
  {
168
173
  "path": ".claude/skills/grade-audit/SKILL.md",
169
174
  "mode": "0000644",
170
- "sha256": "4fa31ff0ec859577a08abf65d1f57dfb5cd5049f25cc3683e3f2881ad8a81d22"
175
+ "sha256": "8d881f5aec85a5730e7ac90a436d2044854dec1515ddcde1c6d3fc42cb5c9e88"
171
176
  },
172
177
  {
173
178
  "path": ".claude/skills/grade-recover/SKILL.md",
174
179
  "mode": "0000644",
175
- "sha256": "df85d188920de59ad921c6e9aeef6166b6c324798a36c1976e5e892568505514"
180
+ "sha256": "8fa4154a2be2b074a66d615987b27ec91d638b2b2f17420fcf873112c1181f40"
181
+ },
182
+ {
183
+ "path": ".claude/skills/grade-sweep/SKILL.md",
184
+ "mode": "0000644",
185
+ "sha256": "f8104462d0633e41345afd42fd2d3a6b9e6dec5b90c576295d555bd6c381adeb"
176
186
  },
177
187
  {
178
188
  "path": ".claude/skills/grader-health/SKILL.md",
179
189
  "mode": "0000644",
180
- "sha256": "1dd5408844e35a0aaf1d3cb5c60fd3daa6066d9da16b45f6612ce59a8e3c26fe"
190
+ "sha256": "e4c882a9f6833422a1e9d0916a514ed82912d6b3f73ccffaafa87a8b577d232a"
181
191
  },
182
192
  {
183
193
  "path": ".claude/skills/idea-triage/SKILL.md",
184
194
  "mode": "0000644",
185
- "sha256": "242ff7ebaf370582dbe527677e81c3e6e57e3406c9ee83f36b61e8b7415a7137"
195
+ "sha256": "d475e4bf8cb1b3a21f7778e5b036277a665cf497f604630160a2ec3eb5924b65"
186
196
  },
187
197
  {
188
198
  "path": ".claude/skills/merge-mode/SKILL.md",
189
199
  "mode": "0000644",
190
- "sha256": "e4cb334c542f2577594c87a56a931e06da7e432ba71dc9b6bd893ecd0f20d8ed"
200
+ "sha256": "09cc213750119da8b1281caeee521283af33080f39897a2114f6b9c8f31b2672"
191
201
  },
192
202
  {
193
203
  "path": ".claude/skills/new-project/SKILL.md",
194
204
  "mode": "0000644",
195
- "sha256": "900daffddfa4271936f56f1e64d6bfb66c111c6f49ec5bef5b4f8efd79ffefda"
205
+ "sha256": "32468ba275eb89f62ad48bf11a41362d8190dd34e22a4c63a6c4b27ecef9d2cf"
206
+ },
207
+ {
208
+ "path": ".claude/skills/owner-review/SKILL.md",
209
+ "mode": "0000644",
210
+ "sha256": "c8d6eff7ac45766861a002f3164baf3a7216f53f6034ccc41f1004b98d593528"
196
211
  },
197
212
  {
198
213
  "path": ".claude/skills/planning-session/SKILL.md",
199
214
  "mode": "0000644",
200
- "sha256": "e51be2a6713f3ceacd6cb1ea57d06a154ecc78161824120e47b522edca868997"
215
+ "sha256": "692b9954a308f817798c8ce6c6811a61a020c588555073f7ba99f75044ab3b18"
201
216
  },
202
217
  {
203
218
  "path": ".claude/skills/priority-session/SKILL.md",
204
219
  "mode": "0000644",
205
- "sha256": "d14e3df92845bd8cea95f259c74b6ba0facab69eeac85e64da70ed5c42573d34"
220
+ "sha256": "b2bc2f4a014fd0aa4eebe61d6fdf9c93448f87a83a988eba4a506cfbcefd0f04"
206
221
  },
207
222
  {
208
223
  "path": ".claude/skills/read-session-export/SKILL.md",
209
224
  "mode": "0000644",
210
- "sha256": "1ad6d47ae5416077f5828a7627c0da579e04773753e1bfe1359770aecdac5bc5"
225
+ "sha256": "6ad72548c7e8649f3cea8595923fd5126fff7ceb5f35e55a07cd698ecc835bc1"
211
226
  },
212
227
  {
213
228
  "path": ".claude/skills/recall/SKILL.md",
214
229
  "mode": "0000644",
215
- "sha256": "fc1163edfe91cf9b111c03f687bc06fbdf77447c7b08ddbb0f9eed9c81d52ec4"
230
+ "sha256": "ecd627093d54c63142ce3f078da16e22479cfc0eef9f42a6308a4e2cc0657ead"
216
231
  },
217
232
  {
218
233
  "path": ".claude/skills/scan-before-install/SKILL.md",
219
234
  "mode": "0000644",
220
- "sha256": "bf5809a65d62af026d1b38ce40c2cc1cc58e0804f6290c7d2ac984b32a667352"
235
+ "sha256": "f00fb1262a5ada74f8c14cab08da4f198e4e9c17c633fda1c29fcb6d4f41d567"
221
236
  },
222
237
  {
223
238
  "path": ".claude/skills/session-handoff/SKILL.md",
224
239
  "mode": "0000644",
225
- "sha256": "0425097ff943b596e58e70644ed3206a5c639f39ebf4fc9a693877528af97cd8"
240
+ "sha256": "068a5377a8c649f11b17a84c406a572c14172cc4627eb5bff62c1417c68b92d7"
226
241
  },
227
242
  {
228
243
  "path": ".claude/skills/ship-check/SKILL.md",
@@ -239,15 +254,10 @@
239
254
  "mode": "0000644",
240
255
  "sha256": "1b4b21243f8890a3c63c35ef81e13474aa5d7d30061733f6130c69399f19c366"
241
256
  },
242
- {
243
- "path": ".claude/skills/tweak/SKILL.md",
244
- "mode": "0000644",
245
- "sha256": "f3f64e851ecfb1b7d2ac2e58c68be6a94a6babab0a307a0bc7e3153be38ee53b"
246
- },
247
257
  {
248
258
  "path": ".claude/skills/worktree-clean/SKILL.md",
249
259
  "mode": "0000644",
250
- "sha256": "b8446c1cff83bddba14df1ce9209808e3f0e9a556306d2d04080b338ae77a5a9"
260
+ "sha256": "5cd2012ef5645b9a8a68e08c0603bd9b071a790934c7a44b7fa520888f78dd56"
251
261
  },
252
262
  {
253
263
  "path": ".dockerignore",
@@ -2257,7 +2267,7 @@
2257
2267
  {
2258
2268
  "path": "docs/architecture.md",
2259
2269
  "mode": "0000644",
2260
- "sha256": "e73b5883090da09febf6fcbb3b23ccc6582623eb864b385b759687c061ea4cd3"
2270
+ "sha256": "345ab85b3665ae561a435cf1eccfa5ddb0464176153a12d85c84ddbc9f5cfc82"
2261
2271
  },
2262
2272
  {
2263
2273
  "path": "docs/branding-contract.md",
@@ -2777,7 +2787,7 @@
2777
2787
  {
2778
2788
  "path": "docs/file-map.md",
2779
2789
  "mode": "0000644",
2780
- "sha256": "20f34df6ef22410dbf60305489c5121dae16729e03e0d0c5123f4f89cef71dbf"
2790
+ "sha256": "3dddf8d3efb086aa0a9809c094d4e4541813e3a696230d42850e5141174648ab"
2781
2791
  },
2782
2792
  {
2783
2793
  "path": "docs/handoff-template.md",
@@ -2787,7 +2797,7 @@
2787
2797
  {
2788
2798
  "path": "docs/module-api-changelog.md",
2789
2799
  "mode": "0000644",
2790
- "sha256": "08ec9b35f24c0267ab6b9f3f39c7eb3cefbb5e62b96ada2505e24f8928438881"
2800
+ "sha256": "1d0dd6bacd73b8a4eceb9d7fbf6fd89fdfa0d8e6b1576605ef50a438f69a69be"
2791
2801
  },
2792
2802
  {
2793
2803
  "path": "docs/modules-contract.md",
@@ -2852,17 +2862,17 @@
2852
2862
  {
2853
2863
  "path": "docs/onboarding/slash-commands.md",
2854
2864
  "mode": "0000644",
2855
- "sha256": "4bc5a11bf6e36b2ecd4534cc36a4221bf9dda6c2b6b9ea9b3b8c5ed1f149ad01"
2865
+ "sha256": "89b308ea5b11b14ad497ae47eaffc7c230dc0d2b5f6fc355417b760cba695063"
2856
2866
  },
2857
2867
  {
2858
2868
  "path": "docs/packs/artist.md",
2859
2869
  "mode": "0000644",
2860
- "sha256": "d9a0b37fb3e03ab2e0f874abf3db40fed123cae5c0f6443a0e176adcdfc30b1b"
2870
+ "sha256": "20b677d110536857eb07c7bf65a777332488bfcd992b3498c67f1e843f65e9cc"
2861
2871
  },
2862
2872
  {
2863
2873
  "path": "docs/packs/engineer.md",
2864
2874
  "mode": "0000644",
2865
- "sha256": "30e4d2363f1fea52cb347ba8a642277fe5046249f77858e947b4434150ff5746"
2875
+ "sha256": "b638f2361ee0b555683248421814e0eaba29026b94737009c77be6519565de28"
2866
2876
  },
2867
2877
  {
2868
2878
  "path": "docs/packs/ideator.md",
@@ -4222,7 +4232,7 @@
4222
4232
  {
4223
4233
  "path": "modules/copy-desk/module.json",
4224
4234
  "mode": "0000644",
4225
- "sha256": "ab2abbd1eb4cb025c3222d7be1ba314b9822de9af8022badbff7804cda2bb3fc"
4235
+ "sha256": "2375fb0cfa929963d11cc135ad3a3bbb592c5e2474942229c1eecc5b839e19f3"
4226
4236
  },
4227
4237
  {
4228
4238
  "path": "modules/copy-desk/page-data.js",
@@ -4259,6 +4269,11 @@
4259
4269
  "mode": "0000644",
4260
4270
  "sha256": "66cd7509e186e980b6d00e5ced844d66689e3e10fa1bb30068f3e2355fe8fcb7"
4261
4271
  },
4272
+ {
4273
+ "path": "modules/copy-desk/skills/tweak/SKILL.md",
4274
+ "mode": "0000644",
4275
+ "sha256": "21c1447d883837a53caf2b0cd34fda2f557422b97d91464832fa279b95ca8ed1"
4276
+ },
4262
4277
  {
4263
4278
  "path": "modules/copy-desk/tests/copy_docx.mjs",
4264
4279
  "mode": "0000644",
@@ -6387,7 +6402,7 @@
6387
6402
  {
6388
6403
  "path": "modules/lifecycle/dependency-advisory.js",
6389
6404
  "mode": "0000644",
6390
- "sha256": "852a531666451cff96f86c75e0981873c8446b8538fdc98aad419fa7e43265e2"
6405
+ "sha256": "dd56e866a75789d67d4315bf28f6835938e756424374f862c35b4535add577cb"
6391
6406
  },
6392
6407
  {
6393
6408
  "path": "modules/lifecycle/done-when.js",
@@ -9037,12 +9052,12 @@
9037
9052
  {
9038
9053
  "path": "package-lock.json",
9039
9054
  "mode": "0000644",
9040
- "sha256": "afc9f33e08cf7b0347f62d5ce0bc85b4368dbb0d90df1f1ef1c815a82b61521f"
9055
+ "sha256": "61fb420fbe1a74df0fdc837237a1625c3c9e361f4473b66ea06b0a088eb52945"
9041
9056
  },
9042
9057
  {
9043
9058
  "path": "package.json",
9044
9059
  "mode": "0000644",
9045
- "sha256": "ac656023e65736d012cfa9f7dbbad627dbb4d42758ba832ffd3167a8b30a5b03"
9060
+ "sha256": "7dc8116ba9b3b0c97b8c1ad59f3f0679d21580a21b79175074d3be21d279023d"
9046
9061
  },
9047
9062
  {
9048
9063
  "path": "public-docs/index.html",
@@ -9062,7 +9077,7 @@
9062
9077
  {
9063
9078
  "path": "release-notes.json",
9064
9079
  "mode": "0000644",
9065
- "sha256": "9eb3a2a173030074171bb3b7187b16296ad7198b79050772a690e319dd9c7d06"
9080
+ "sha256": "8ec55f2c1db4d0116b89d222385131b63500893aa9f860e7eb563de7173ce02a"
9066
9081
  },
9067
9082
  {
9068
9083
  "path": "scripts/bongos-mcp.js",
@@ -9632,7 +9647,7 @@
9632
9647
  {
9633
9648
  "path": "scripts/gds/fitness-ratchets.js",
9634
9649
  "mode": "0000644",
9635
- "sha256": "57eb2d11cf8e52dfef86110b102de24a9996b561231fc990738ba529bc06f236"
9650
+ "sha256": "7b1a001278531bd7f21ec909224683b61709eab92bd960dc1d2bb03bc014864d"
9636
9651
  },
9637
9652
  {
9638
9653
  "path": "scripts/gds/fitness.js",
@@ -9907,7 +9922,12 @@
9907
9922
  {
9908
9923
  "path": "scripts/gds/module-artifact.js",
9909
9924
  "mode": "0000644",
9910
- "sha256": "09211dcd5bae4b935b5f80a2c021a1c10a376236b1c7ea7ebc1f53b84d1ead40"
9925
+ "sha256": "a16e9cee3135bcd14ae99f58dfbd17657610c2fc5b5c126ed052ccca49297428"
9926
+ },
9927
+ {
9928
+ "path": "scripts/gds/module-assess-security.js",
9929
+ "mode": "0000644",
9930
+ "sha256": "0dad366dcabf453ae276e074aafa6bd71223853a31cfe005dac6f3d713e12e4a"
9911
9931
  },
9912
9932
  {
9913
9933
  "path": "scripts/gds/module-assess-tests.js",
@@ -10577,7 +10597,7 @@
10577
10597
  {
10578
10598
  "path": "scripts/gds/skill-lint.js",
10579
10599
  "mode": "0000644",
10580
- "sha256": "46fa91ead4f7863043fd917e3b0f6c9011fc1735ecccefb32b415d51c87a306e"
10600
+ "sha256": "de0537556ade0d0a2c548af7a1f68d23d69eafe120f611bb64d5005eef229555"
10581
10601
  },
10582
10602
  {
10583
10603
  "path": "scripts/gds/skill-preflight.js",
@@ -11217,7 +11237,7 @@
11217
11237
  {
11218
11238
  "path": "src/module-api.js",
11219
11239
  "mode": "0000644",
11220
- "sha256": "b1e5fefed87830633778aef9a1076002ee2e0067b8868789a2411be6b453c366"
11240
+ "sha256": "b0af63fbad35e7a1006c0e8326238add2ab9a6d9d0eaad89d08a0fe7286c7443"
11221
11241
  },
11222
11242
  {
11223
11243
  "path": "src/module-loader/catalog.js",
@@ -14194,6 +14214,11 @@
14194
14214
  "mode": "0000644",
14195
14215
  "sha256": "9183d78e4d195428afbee8c71746e12db2455f8529ac1223d690a7b8f7ded538"
14196
14216
  },
14217
+ {
14218
+ "path": "tests/module_assess_security.mjs",
14219
+ "mode": "0000644",
14220
+ "sha256": "6868f5c8ba6fbef96eab63b0726f8d3d2261aa146a0a4566c1c1929e6134a245"
14221
+ },
14197
14222
  {
14198
14223
  "path": "tests/module_assess_tests.mjs",
14199
14224
  "mode": "0000644",
@@ -15737,7 +15762,7 @@
15737
15762
  {
15738
15763
  "path": "tests/skill_grade_audit.mjs",
15739
15764
  "mode": "0000644",
15740
- "sha256": "7deff847f2caa66d6956bc759c1e2dc59dc4169e2d25ced1cb4273237397e84a"
15765
+ "sha256": "cde8c3bd8e91f98c51d5d0bacd3de7208208e89fc80a34286fbaec56ae652a47"
15741
15766
  },
15742
15767
  {
15743
15768
  "path": "tests/skill_grade_recover.mjs",
@@ -15747,12 +15772,17 @@
15747
15772
  {
15748
15773
  "path": "tests/skill_grader_health.mjs",
15749
15774
  "mode": "0000644",
15750
- "sha256": "37d75d31bc14671b2a9a974b941997f624dd4668a4d9d76472915436b2ef567e"
15775
+ "sha256": "fc839f0c130ad64b5563afdb5e6a4f305f7f109a5b4ae83057aff0165c20c997"
15751
15776
  },
15752
15777
  {
15753
15778
  "path": "tests/skill_lint.mjs",
15754
15779
  "mode": "0000644",
15755
- "sha256": "d0fe9827f2eac08e7645bdccc61567ced1d2c3120f0d7e4c6df5f4b0723b7dcf"
15780
+ "sha256": "c4b3cd3f78cafab7bc50b6f4480e660a3a24ebbba94978eededeb4bd66554179"
15781
+ },
15782
+ {
15783
+ "path": "tests/skill_menu_ruling.mjs",
15784
+ "mode": "0000644",
15785
+ "sha256": "e4be23fe23636db0256119caef67241dd9132aadabc48b5063419b58f82e574d"
15756
15786
  },
15757
15787
  {
15758
15788
  "path": "tests/skill_preflight.mjs",
@@ -2,6 +2,7 @@
2
2
  name: backlog-review
3
3
  description: >-
4
4
  Daily walk of status='backlog', the state a human must say go on. Separates rows waiting on a PERSON from rows waiting on a TRIGGER, and surfaces those stranded behind an abandoned dependency. Metic+ only. Triggers: "/backlog-review", "review the backlog", "what needs a nod", "walk the backlog".
5
+ disable-model-invocation: true
5
6
  plain: >-
6
7
  Walks you through the work that is waiting for a person to say go, and separates it from work that is only waiting for something else to finish first.
7
8
  reach-for: >-
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: blocker-review
3
3
  description: >-
4
- Daily review of open blockers — resolve, escalate, or note continued blockage. Resolving auto-promotes linked tasks to ready. Metic+ only. Triggers: "/blocker-review", "review blockers", "what's stuck on me", "what's stuck on Lars", "check blockers", or a scheduled daily run.
4
+ Daily review of open blockers: resolve, escalate or note; resolving auto-promotes linked tasks. Metic+. Triggers: "/blocker-review", "review blockers", "what's stuck on me", "what's stuck on Lars", "check blockers", a scheduled daily run.
5
5
  plain: >-
6
6
  Goes through everything the project is stuck on, one item at a time, so each can be cleared, passed up, or noted as still stuck.
7
7
  reach-for: >-
@@ -2,6 +2,7 @@
2
2
  name: bug-triage
3
3
  description: >-
4
4
  Daily walk of open kind=bug tasks, which land with no triage gate and accumulate near-duplicates. Batch-verdict the dups, then merge or won't-fix the rest. Metic+ only. Triggers: "/bug-triage", "triage bugs", "walk the bug queue", "dedupe bugs".
5
+ disable-model-invocation: true
5
6
  plain: >-
6
7
  Goes through the reported bugs, groups the near-duplicates, and decides what happens to each: merge it, keep it, or close it.
7
8
  reach-for: >-
@@ -2,6 +2,7 @@
2
2
  name: builder-backup
3
3
  description: >-
4
4
  Check database backup status or trigger a fresh one. Use before migrations, destructive SQL or large refactors. Triggers: "/builder-backup", "take a backup", "check backup status", "trigger a backup", "backup before migrating".
5
+ disable-model-invocation: true
5
6
  plain: >-
6
7
  Checks when the project's database was last backed up, and can take a fresh backup.
7
8
  reach-for: >-
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: builder-claim
3
3
  description: >-
4
- Atomically claim a task by id for exclusive control. Refuses if already claimed, not ready, or holding unshipped dependencies; a touches[] overlap only warns. Triggers: "/builder-claim N", "claim task N", "I'll work on N", or picking one after /builder-start.
4
+ Atomically claim a task by id. Refuses if already claimed, not ready, or holding unshipped dependencies; a touches[] overlap only warns. Triggers: "/builder-claim N", "claim task N", "I'll work on N", or picking one after /builder-start.
5
5
  plain: >-
6
6
  Reserves a task for you, so nobody else works on the same thing at the same time.
7
7
  reach-for: >-
@@ -2,6 +2,7 @@
2
2
  name: builder-cost
3
3
  description: >-
4
4
  Log or read project spend — api, compute, infra, domain, art or other. Triggers: "/builder-cost", "log cost", "what have we spent", "I just spent X on Y".
5
+ disable-model-invocation: true
5
6
  plain: >-
6
7
  Records money spent on the project, or shows what has been spent so far.
7
8
  reach-for: >-
@@ -2,6 +2,7 @@
2
2
  name: builder-exit
3
3
  description: >-
4
4
  Offboard or reactivate a builder: release claims, seal each with a session log, drop rank to sandboxed Xenos, archive local memory — keeping attribution and credits. Archon-only; for your own session use /builder-end. Triggers: "/builder-exit N", "offboard builder N", "builder X is leaving", "reactivate builder N".
5
+ disable-model-invocation: true
5
6
  plain: >-
6
7
  Takes a person off the project, or brings them back, while keeping the credit for everything they did.
7
8
  reach-for: >-
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: builder-key
3
3
  description: >-
4
- List which API keys are set or unset and drive the UI-first add flow. HARD RULE: never accept a key pasted in chat — always redirect to Settings. Triggers: "/builder-key", "/api-key", "what keys do I have set", "do I have a Gemini key", "add my art key", "my key isn't working", "No image-generation key found".
4
+ Show which API keys are set; add one via Settings. HARD RULE: never accept a key pasted in chat. Triggers: "/builder-key", "/api-key", "what keys do I have set", "add my art key", "my key isn't working", "No image-generation key found".
5
5
  plain: >-
6
6
  Shows which of your service keys, such as the one for making images, are set up, and walks you to the settings page to add one.
7
7
  reach-for: >-
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: builder-reauth
3
3
  description: >-
4
- Refresh an expired Bongos CLI session the UI-first way — Settings, copy the re-issue one-liner, this runs it. Triggers: "/builder-reauth", "re-auth", "refresh my session", "my Bongos session expired", "re-issue my CLI token", or any /builder-* failing with "Bongos CLI session is no longer valid".
4
+ Refresh an expired Bongos CLI session the UI-first way. Triggers: "/builder-reauth", "re-auth", "refresh my session", "my Bongos session expired", "re-issue my CLI token", or any /builder-* failing with "Bongos CLI session is no longer valid".
5
5
  plain: >-
6
6
  Signs your assistant back in when its sign-in to the project has expired.
7
7
  reach-for: >-
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: builder-redteam
3
3
  description: >-
4
- File a red-team or vulnerability report — severity, target, repro, expected vs actual — for the Archon view. Metic+ only; Xenos get a polite refusal. Triggers: "/builder-redteam", "I found a security issue", "redteam report", "file a vuln", or describing a flaw in the system's own walls.
4
+ File a red-team or vulnerability report (severity, repro, expected vs actual) for the Archon. Metic+ only. Triggers: "/builder-redteam", "I found a security issue", "redteam report", "file a vuln", or describing a flaw in the system's own walls.
5
5
  plain: >-
6
6
  Files a private report about a security weakness you found, for the project's leads to see.
7
7
  reach-for: >-
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: builder-sequence
3
3
  description: >-
4
- Walk a dependency chain from one kickoff — claim, build, ship, repeat; --goal N scopes it to one goal. One claim at a time, always fully shipped before the next. Triggers: "/builder-sequence N", "work the chain from task N", "continue goal N", "let's tackle goal N", "run goal N end to end".
4
+ Work a dependency chain from one kickoff: claim, build, ship, repeat; --goal N scopes it. Triggers: "/builder-sequence N", "work the chain from task N", "continue goal N", "let's tackle goal N", "run goal N end to end".
5
5
  plain: >-
6
6
  Works through a chain of related tasks in order, finishing each one completely before starting the next.
7
7
  reach-for: >-
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: builder-setup
3
3
  description: >-
4
- One-time builder setup: authenticates against GitHub and stores a CLI session token. If a session exists for another account, asks which to use. Triggers: "/builder-setup", "set up builder", "register me", "set up Bongos", or any /builder-* failing with "no Bongos session".
4
+ One-time builder setup: GitHub sign-in and a stored CLI session token; asks which account if another is signed in. Triggers: "/builder-setup", "set up builder", "register me", "set up Bongos", or any /builder-* failing with "no Bongos session".
5
5
  plain: >-
6
6
  Connects your assistant to the project for the first time, using your GitHub account to sign in.
7
7
  reach-for: >-
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: collab-review
3
3
  description: >-
4
- Walk the help requests and task recommendations addressed to YOU, verifying each against the live record, one decision at a time. The answering half of /ask-for-help. Triggers: "/collab-review", "what have people asked me", "answer my asks", "work my collab queue", or a pasted "Copy for Session Start" prompt.
4
+ Walk the help requests and task recommendations addressed to YOU, one decision at a time. Triggers: "/collab-review", "what have people asked me", "answer my asks", "work my collab queue", a pasted "Copy for Session Start" prompt.
5
5
  plain: >-
6
6
  Goes through the requests other people have sent you, such as asks for help or suggested tasks, and brings you one decision at a time.
7
7
  reach-for: >-
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: design
3
3
  description: >-
4
- The UI design session — the playbook for ui-discipline work: layouts, pages, components, design systems, the hall, status and landing surfaces. World-first: the branding pack and DESIGN.md come before any taste rule. Triggers: "/design", "design this page", "let's work on the UI", or a claimed ui task.
4
+ The UI design playbook: layouts, pages, components, design systems, the hall, status and landing. World-first: the branding pack and DESIGN.md before any taste rule. Triggers: "/design", "design this page", "let's work on the UI", a claimed ui task.
5
5
  plain: >-
6
6
  The guided way to design or change how a page or screen looks, starting from the project's own style.
7
7
  reach-for: >-
@@ -2,6 +2,7 @@
2
2
  name: design-sync
3
3
  description: >-
4
4
  Export the repo design system into Claude Design, then land its generated UI code back as a task. Triggers: "/design-sync", "sync design", "export tokens to Claude Design", "import to Claude Design", "push design system".
5
+ disable-model-invocation: true
5
6
  plain: >-
6
7
  Sends the project's design style to Claude Design, then brings the screens designed there back into the project as a task.
7
8
  reach-for: >-
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: feedback
3
3
  description: >-
4
- Pull the latest Bongos feedback bundle into this session — the walkthrough transcript and screenshots, by absolute path. Local and read-only. Triggers: "/feedback", "pull in my latest feedback", "load my bongos feedback", "I just recorded a walkthrough", "grab the latest feedback bundle", "act on my screen recording".
4
+ Pull the latest Bongos feedback bundle (walkthrough transcript, screenshots) into this session; read-only. Triggers: "/feedback", "pull in my latest feedback", "load my bongos feedback", "I just recorded a walkthrough", "act on my screen recording".
5
5
  plain: >-
6
6
  Loads your most recent recorded walkthrough, what you said and the screenshots, into this conversation.
7
7
  reach-for: >-
@@ -2,6 +2,7 @@
2
2
  name: figma-design-sync
3
3
  description: >-
4
4
  Round-trip the UI design system with Figma — push tokens and surfaces, then land a designer's edit back as code. Not otb-figma-sync, which is pixel-art tiles only. Triggers: "sync design to Figma", "push tokens to Figma", "pull my Figma edit into code", "figma round-trip".
5
+ disable-model-invocation: true
5
6
  plain: >-
6
7
  Keeps the project's design style and a Figma file in step: sends the style to Figma, and turns a designer's edit there back into the project.
7
8
  reach-for: >-