@bongos/core 1.20.42 → 1.20.43

package/docs/onboarding/slash-commands.md

@@ -42,29 +42,31 @@ Every one of these talks to the build system. They're grouped by when you'd reac
 | `/builder-setup` | One-time enrolment — signs you in and registers you |
 | `/builder-reauth` | Refresh an expired session |
 | `/builder-key` | Check / set your own API key status |
-| `/builder-cost` | Log a cost entry against your claim |
-| `/builder-backup` | Check or trigger a database backup before risky work |
-| `/builder-exit` | Offboard or reactivate a builder *(Archon only)* |
+| `/builder-cost` † | Log or read project spend |
+| `/builder-backup` † | Check or trigger a database backup before risky work |
+| `/builder-exit` † | Offboard or reactivate a builder *(Archon only)* |
 
 ### Triage and planning *(Metic and above)*
 
 | Command | What it does |
 |---|---|
-| `/idea-triage` | Walk the idea inbox — promote, discard, or merge each |
+| `/owner-review` | One walk through everything waiting on a decision: backlog → bugs → ideas → priorities. Say *"triage ideas"* or *"review the backlog"* and it opens at that step |
 | `/blocker-review` · `/blocker-solve` | Walk open blockers, or drive one to done |
 | `/goal-create` | Plan and create one goal — scope wall, criteria, seed tasks |
-| `/goal-review` | Confirm criteria that are flagged met-pending-review |
-| `/planning-session` | Scope an upcoming version and seed its task list |
-| `/priority-session` | Reweight the inbox from a few plain-speech answers |
+| `/goal-close` † | Close a goal's criteria: test them on the live site and sign off, then decide the ones nothing was delivered for |
+| `/planning-session` † | Scope an upcoming version and seed its task list |
+| `/grade-sweep` † | Check the grader is healthy, then audit what shipped past it |
 | `/merge-mode` | Manual fallback when a confirmed task didn't land |
 
+The four steps of `/owner-review` still answer to their old names — `/backlog-review`, `/bug-triage`, `/idea-triage`, `/priority-session` — and so do `/goal-uat` · `/goal-review` (now the two parts of `/goal-close`) and `/grader-health` · `/grade-audit` (now the two parts of `/grade-sweep`). All of those are typed-only (†).
+
 ### Discipline modes — not slash commands any more
 
 The three core crafts no longer have a slash command. `/dev`, `/paint` and `/ideate` were **deleted** when the root instructions split into a role-neutral kernel (`CLAUDE.md`) plus one **role pack** per craft: `docs/packs/engineer.md`, `docs/packs/artist.md`, `docs/packs/ideator.md`. A claimed task's discipline routes you to your pack — the Conductor injects its path into your session on the next prompt, and `claim.js` prints a one-line reminder — and you read it. A module-contributed discipline can still ship a skill, which is how `ui` → `/design` below works.
 
 ### Design and art pipeline
 
-`/design` is the ui-discipline playbook (world-first, show-first — shipped by the `ui-design` module, ADR 0197); `/design-sync` and `/figma-design-sync` round-trip the UI design system. The `/otb-*` family — `otb-tile-generate`, `otb-design-review`, `otb-character-review`, `otb-feedback-capture`, `otb-figma-sync` — is the reference instance's pixel-art pipeline; it's only meaningful on an instance that runs that pipeline, so it ships in the `pixel-art` module, which is off unless the project turns it on. The design-style skills (`/impeccable`, `/style`, the taste and look skills) are the same: the `design-styles` module, off unless turned on — `/design` tells you which.
+`/design` is the ui-discipline playbook (world-first, show-first — shipped by the `ui-design` module, ADR 0197); `/design-sync` † and `/figma-design-sync` † round-trip the UI design system. `/tweak` † applies the next page an artist rewrote in the studio; it ships in the `copy-desk` module, where the studio lives. The `/otb-*` family — `otb-tile-generate`, `otb-design-review`, `otb-character-review`, `otb-feedback-capture`, `otb-figma-sync` — is the reference instance's pixel-art pipeline; it's only meaningful on an instance that runs that pipeline, so it ships in the `pixel-art` module, which is off unless the project turns it on. The design-style skills (`/impeccable`, `/style`, the taste and look skills) are the same: the `design-styles` module, off unless turned on — `/design` tells you which.
 
 ### Session and meta
 
@@ -73,9 +75,13 @@ The three core crafts no longer have a slash command. `/dev`, `/paint` and `/ide
 | `/session-handoff` | Emit a paste-ready prompt to start a fresh session with |
 | `/read-session-export` | Read a past session's `/export` zip |
 | `/feedback` | Pull in the latest recorded walkthrough bundle |
-| `/new-project` | Zero-to-live runbook for a brand-new instance |
+| `/new-project` † | Zero-to-live runbook for a brand-new instance |
 | `/builder-redteam` | File a security / vulnerability report |
 
+### † Typed-only commands
+
+A command marked † is **hidden from Claude's own menu but still works when you type it**. Every listed command's description sits in every session's context whether it is used or not, so the rarely-used admin ones carry `disable-model-invocation: true` in their `SKILL.md`: Claude Code leaves them out of what the model sees, and only a person typing `/name` runs them (task 1004471). The catch: plain English will not reach them, and Claude will not start one on its own — type the slash form.
+
 ## Claude Code's own commands
 
 These work in **any** repository — they have nothing to do with this project. `/help` prints the live, authoritative list for your version; the ones below are simply the ones you'll actually meet.
@@ -111,11 +117,11 @@ These are the ones that actually cause confusion.
 
 **`/export` vs `/read-session-export`.** Claude's `/export` *writes* a transcript zip; our `/read-session-export` *reads* one back.
 
-**`/review` reviews a GitHub PR.** The project's review commands are `/goal-review`, `/blocker-review`, and `/idea-triage` — different jobs entirely.
+**`/review` reviews a GitHub PR.** The project's review commands are `/owner-review`, `/blocker-review`, and `/goal-close` — different jobs entirely.
 
 ## Two more things worth knowing
 
-**Every command has a plain-English twin.** Each skill lists trigger phrases, so *"what can I work on"* reaches `/builder-start` and *"ship it"* reaches `/builder-ship`. You never have to memorise the slash form.
+**Every listed command has a plain-English twin.** Each skill lists trigger phrases, so *"what can I work on"* reaches `/builder-start` and *"ship it"* reaches `/builder-ship`. You never have to memorise the slash form — except for the typed-only † commands above.
 
 **Same commands, outside Claude.** The work-loop commands are also a terminal CLI: `bongos start`, `bongos claim N`, `bongos ship`. Same actions, same API — usable from any terminal, a Chromebook, or CI. Run `bongos help` for the verb list.
 

package/docs/packs/artist.md

@@ -27,7 +27,7 @@ The studio's own words (the greeting and its sub-line) are the studio page itsel
 
 Only the holder writes. A page someone else holds is read-only and names them. A draft left unsubmitted keeps its words and can be taken up again.
 
-**Between submit and approval, a session applies it.** Submitted pages wait for a builder session running `/tweak` ([the skill](../../.claude/skills/tweak/SKILL.md), Metic+). It transcribes every line, renders the page before and after, and parks it. **It never lands the page.**
+**Between submit and approval, a session applies it.** Submitted pages wait for a builder session running `/tweak` ([the skill](../../modules/copy-desk/skills/tweak/SKILL.md), Metic+). It transcribes every line, renders the page before and after, and parks it. **It never lands the page.**
 
 **The Approval queue.** Pictures of the applied page, desktop or phone, light or dark, flipped **before / after**. Beside them, the changed lines ("was:" / "becomes:"); a line the applier could not apply says why. Then:
 

package/docs/packs/engineer.md

@@ -74,7 +74,7 @@ If this is an autonomous, bypass-permissions, or scheduled run and no one will a
 
 1. **Resolve your claim** — `/builder-ship` with handoff notes and a value summary, or `/builder-release` on abandonment. Bongos records the session-log row and awards credits.
 2. **Write a session log** as its own file at `docs/session-logs/YYYY-MM-DD-<slug>.md`, using [`docs/handoff-template.md`](../handoff-template.md). Do not hand-edit the kernel's §13 index or `docs/session-log-index.md` — both regenerate from your file at ship. For a single-task session the Bongos `session_logs` row is enough and a separate file isn't needed.
-3. **Review the `idea_inbox`** via `GET /api/bongos/inbox`, or run `/idea-triage`.
+3. **Review the `idea_inbox`** via `GET /api/bongos/inbox`, or run `/owner-review ideas`.
 4. **Update the detail files** if anything changed: a new gotcha → a recipe or a captured learning; a new blocker → `POST /api/bongos/blockers`; a decision → a new ADR.
 5. **Update [`docs/architecture.md`](../architecture.md)** if the live system changed, and [`docs/file-map.md`](../file-map.md) if files or folders moved.
 
@@ -82,13 +82,12 @@ If nothing changed in a section, leave it alone — don't churn.
 
 ### Daily cadence (once per day, not per session)
 
-Three manual slash-commands keep the methodology surfaces from accumulating drift. Any session can pick them up; it only matters that they happen.
+Two manual slash-commands keep the methodology surfaces from accumulating drift. Any session can pick them up; it only matters that they happen.
 
-- **`/idea-triage`** — walk the open `idea_inbox` rows: promote, discard, merge, or defer. Deferring is fine; the cadence is the discipline.
+- **`/owner-review`** — one walk through backlog → bugs → ideas → priorities (task 1004471); each step is still typeable alone (`/backlog-review`, `/bug-triage`, `/idea-triage`, `/priority-session`). Ideas: promote, discard, merge, or defer — deferring is fine; the cadence is the discipline. Backlog: rows waiting on a **person** get walked (promote / kill / water); rows waiting on a **trigger** are counted, never walked (a satisfied dep auto-promotes), and rows stranded behind an abandoned dep are surfaced. `/demote` is invalid on a backlog row (409 `cannot_demote` — it requires `ready`).
 - **`/blocker-review`** — walk the open blockers: resolved (which auto-promotes linked tasks via a DB trigger), still blocked with a note, or escalate.
-- **`/backlog-review`** — walk `status='backlog'`, the pre-workable state a human must say go on. Rows waiting on a **person** get walked (promote / kill / water); rows waiting on a **trigger** are counted, never walked (a satisfied dep auto-promotes). It also surfaces rows stranded behind an abandoned dep, which the trigger can never fire for. `/demote` is invalid on a backlog row (409 `cannot_demote` — it requires `ready`).
 
-**`/tweak`** (Metic+) works a fourth queue: pages an artist submitted from the studio wait there until a session applies them. It never lands one; the artist approves first (ADR 0341).
+**`/tweak`** (Metic+, typed-only, in the `copy-desk` module) works a fourth queue: pages an artist submitted from the studio wait there until a session applies them. It never lands one; the artist approves first (ADR 0341).
 
 If a day passes without them, the queues quietly grow. Running them is the structural cure for the markdown-graveyard pattern.
 

package/modules/copy-desk/module.json

@@ -6,7 +6,7 @@
   "coreVersion": "^1.8.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },
-  "contributes": { "routes": ["copy-desk"], "migrations": true },
+  "contributes": { "routes": ["copy-desk"], "migrations": true, "skills": ["tweak"] },
   "provides": [],
   "consumes": ["lifecycle"]
 }

package/{.claude → modules/copy-desk}/skills/tweak/SKILL.md

@@ -2,6 +2,7 @@
 name: tweak
 description: >-
   Apply the next submitted page tweak: claim the round, apply every line, render the page before and after, attach the renders and ship it to wait for the artist. Metic+. Triggers: "/tweak", "apply the next page tweak", "work the tweak queue".
+disable-model-invocation: true
 plain: >-
   Applies the next set of change requests someone made to a page, and shows before and after pictures for the artist to approve.
 reach-for: >-

package/modules/lifecycle/dependency-advisory.js

@@ -17,9 +17,9 @@
 //   1. POST /tasks attaches `dependency_advisory` to its 201 body (this
 //      file's `buildDependencyAdvisory`), read by the /goal-create skill's
 //      "sibling advisory" section (.claude/skills/goal-create/SKILL.md).
-//   2. The periodic sweep: `/goal-review`'s daily walk runs
+//   2. The periodic sweep: `/goal-close`'s residue walk (was `/goal-review`) runs
 //      `node scripts/gds/audit-deps.js --min high` as one more housekeeping
-//      step (idea 1000276's half — see .claude/skills/goal-review/SKILL.md).
+//      step (idea 1000276's half — see .claude/skills/goal-close/SKILL.md, Part 2).
 //
 // HARD CONSTRAINT, same as goal-advisory.js: advisory only (a finding addressed
 // to a human never acts by itself — ADR 0158 §2). This

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.42",
+  "version": "1.20.43",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.42",
+      "version": "1.20.43",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.42",
+  "version": "1.20.43",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8361,5 +8361,11 @@
       "id": "1003792",
       "text": "The module store can now run a security check on each module version: it fails a version that ships a secret file, pulls code from outside the official package registry, or depends on a package with a known serious vulnerabili"
     }
+  ],
+  "1.20.43": [
+    {
+      "id": "1004471",
+      "text": "Claude's list of project commands is now short enough to read in full every session: the rarely used admin commands still work when you type them but no longer take up room, and one new /owner-review walks the backlog, bugs, i"
+    }
   ]
 }

package/scripts/gds/fitness-ratchets.js

@@ -423,6 +423,8 @@ function skillListingMetrics() {
     const lint = require('./skill-lint.js');
     // Resident skills only (task 1004470): a skill owned by a module this checkout leaves
     // off (pixel-art, design-styles — both default: false) is in no session's listing here.
+    // listingChars also leaves out HIDDEN skills (disable-model-invocation: true, task 1004471):
+    // Claude Code keeps their descriptions out of the model's context entirely.
     const files = lint.listSkillFiles();
     return { skill_listing_chars: lint.lintSkills(files, { resident: lint.residentSkillFiles(undefined, { files }) }).listingChars };
   } catch (e) {

package/scripts/gds/skill-lint.js

@@ -14,6 +14,12 @@
 // context window, and a description is resident in EVERY session, so long ones
 // crowd the others out and get truncated (skill routing degrades).
 //
+// A HIDDEN skill — frontmatter `disable-model-invocation: true` — is not in that
+// listing at all: Claude Code keeps its description out of the model's context and
+// loads it only when a person types /name (the model cannot invoke it). So the
+// budget counts LISTED skills only, and hidden ones are reported on their own line
+// (task 1004471, owner ruling on blocker 1000139).
+//
 // NOT A YAML PARSER, on purpose. These are targeted regex checks for the hazards that
 // actually bit us (a plain scalar carrying ": " or " #", an unclosed quote or flow
 // collection, a tab, a continuation line), so the repo gains a CI gate with no new
@@ -95,11 +101,19 @@ function lintFrontmatter(lines) {
   return { errors, warnings, fields };
 }
 
+// Whether a skill is HIDDEN from the model's listing: `disable-model-invocation: true`
+// (Claude Code: "description not in context"; typeable as /name, never model-invoked).
+// Anything but a literal true — absent, false, a typo — leaves it listed, so a mistake
+// can only ever over-count the budget, never hide a skill nobody meant to hide.
+function isHidden(fields) {
+  return String((fields && fields['disable-model-invocation']) || '').trim().toLowerCase() === 'true';
+}
+
 // Lint one SKILL.md file's text. `file` is used for the name check and messages.
 function lintSkillFile(text, { file = 'SKILL.md' } = {}) {
   const dirName = path.basename(path.dirname(file));
   const fm = splitFrontmatter(text);
-  const res = { file, errors: [], warnings: [], name: null, description: '', listingChars: 0 };
+  const res = { file, errors: [], warnings: [], name: null, description: '', listingChars: 0, hidden: false };
   if (!fm) { res.errors.push('no YAML frontmatter (the file must start with --- and carry name + description)'); return res; }
   const { errors, warnings, fields } = lintFrontmatter(fm.lines);
   res.errors.push(...errors); res.warnings.push(...warnings);
@@ -107,8 +121,10 @@ function lintSkillFile(text, { file = 'SKILL.md' } = {}) {
   if (!name) res.errors.push('missing "name"');
   else if (name !== dirName && dirName !== 'SKILL.md') res.warnings.push(`name "${name}" differs from its folder "${dirName}" — the folder name wins in listings`);
   if (!desc) res.errors.push('missing or empty "description" — the skill would match on its body text');
+  res.hidden = isHidden(fields);
   if (desc.length > DESC_HARD_CHARS) res.errors.push(`description is ${desc.length} chars — over Claude Code's ${DESC_HARD_CHARS}-char cap`);
-  else if (desc.length > DESC_WARN_CHARS) res.warnings.push(`description is ${desc.length} chars — over the ~${DESC_WARN_CHARS} we aim for; every char is resident in every session`);
+  else if (desc.length > DESC_WARN_CHARS && !res.hidden) res.warnings.push(`description is ${desc.length} chars — over the ~${DESC_WARN_CHARS} we aim for; every char is resident in every session`);
+  // listingChars is what the entry WOULD cost if listed; lintSkills leaves hidden ones out of the total.
   res.name = name || dirName; res.description = desc; res.listingChars = res.name.length + desc.length;
   return res;
 }
@@ -164,13 +180,18 @@ function residentSkillFiles(root = REPO_ROOT, { instanceDir = root, files = list
 }
 
 // Lint a set of files; returns per-file results plus the listing total vs budget. The
-// listing counts `resident` (a list of paths) when given, else every linted file.
+// listing counts `resident` (a list of paths) when given, else every linted file — and of
+// those, only the LISTED ones: a hidden skill (isHidden) is resident but costs the model
+// nothing, so it is tallied separately as hiddenSkills / hiddenChars (task 1004471).
 function lintSkills(files, { resident } = {}) {
   const results = files.map((f) => lintSkillFile(fs.readFileSync(f, 'utf8'), { file: f }));
   const counted = resident ? new Set(resident.map((f) => path.resolve(f))) : null;
-  const listed = counted ? results.filter((r) => counted.has(path.resolve(r.file))) : results;
+  const here = counted ? results.filter((r) => counted.has(path.resolve(r.file))) : results;
+  const listed = here.filter((r) => !r.hidden);
+  const hidden = here.filter((r) => r.hidden);
   const listingChars = listed.reduce((a, r) => a + r.listingChars, 0);
-  return { results, listingChars, listedSkills: listed.length, budgetChars: LISTING_BUDGET_CHARS, overBudget: listingChars > LISTING_BUDGET_CHARS };
+  const hiddenChars = hidden.reduce((a, r) => a + r.listingChars, 0);
+  return { results, listingChars, listedSkills: listed.length, residentSkills: here.length, hiddenSkills: hidden.length, hiddenChars, hiddenNames: hidden.map((r) => r.name), budgetChars: LISTING_BUDGET_CHARS, overBudget: listingChars > LISTING_BUDGET_CHARS };
 }
 
 // The PostToolUse hook's gate. It must match a module-owned SKILL.md too — that is the
@@ -190,8 +211,10 @@ function format(report, { relTo = REPO_ROOT } = {}) {
   }
   const errs = report.results.reduce((a, r) => a + r.errors.length, 0);
   const warns = report.results.reduce((a, r) => a + r.warnings.length, 0);
-  const resident = report.listedSkills !== undefined && report.listedSkills !== report.results.length ? ` (the ${report.listedSkills} resident here; the rest belong to modules this instance leaves off)` : '';
-  out.push(`skill-lint: ${report.results.length} skill(s), ${errs} error(s), ${warns} warning(s); listing ${report.listingChars} chars${resident} (~${Math.round(report.listingChars / 4)} tokens) vs ~${report.budgetChars}-char budget${report.overBudget ? ' — OVER: entries get truncated and routing degrades' : ''}`);
+  const residentN = report.residentSkills !== undefined ? report.residentSkills : report.listedSkills;
+  const resident = residentN !== undefined && residentN !== report.results.length ? ` ${residentN} resident here (the rest belong to modules this instance leaves off);` : '';
+  out.push(`skill-lint: ${report.results.length} skill(s), ${errs} error(s), ${warns} warning(s);${resident} listing ${report.listingChars} chars over ${report.listedSkills} listed skill(s) (~${Math.round(report.listingChars / 4)} tokens) vs ~${report.budgetChars}-char budget${report.overBudget ? ' — OVER: entries get truncated and routing degrades' : ''}`);
+  if (report.hiddenSkills) out.push(`skill-lint: ${report.hiddenSkills} hidden skill(s) (disable-model-invocation — typeable as /name, not in the model's listing, not counted): ${report.hiddenChars} chars — ${report.hiddenNames.join(', ')}`);
   return out.join('\n');
 }
 
@@ -210,7 +233,7 @@ function main() {
         if (!isSkillMd(fp) || !fs.existsSync(fp)) return;
         const report = lintSkills([fp]);
         const r = report.results[0];
-        if (r.errors.length || r.warnings.length) console.log('[skill-lint] ' + format(report).split('\n').slice(0, -1).join('\n[skill-lint] '));
+        if (r.errors.length || r.warnings.length) console.log('[skill-lint] ' + format(report).split('\n').filter((l) => !l.startsWith('skill-lint:')).join('\n[skill-lint] '));
       } catch (_) { /* a hook never breaks the edit */ }
       process.exitCode = 0;
     });
@@ -223,5 +246,5 @@ function main() {
   process.exitCode = report.results.some((r) => r.errors.length) ? 1 : 0;
 }
 
-module.exports = { lintFrontmatter, lintSkillFile, lintSkills, listSkillFiles, residentSkillFiles, splitFrontmatter, isSkillMd, format, DESC_WARN_CHARS, DESC_HARD_CHARS, LISTING_BUDGET_CHARS };
+module.exports = { lintFrontmatter, lintSkillFile, lintSkills, listSkillFiles, residentSkillFiles, splitFrontmatter, isSkillMd, isHidden, format, DESC_WARN_CHARS, DESC_HARD_CHARS, LISTING_BUDGET_CHARS };
 if (require.main === module) main();

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.42'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.43'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/skill_grade_audit.mjs

@@ -1,9 +1,10 @@
-// tests/skill_grade_audit.mjs — the /grade-audit skill exists and covers the
-// accountability sweep from the grader-hardening evaluation §6 (task 1002657):
-// the override ledger, dropped blocker/major findings on passing grades (with
-// the advisory-Narc attribution filter), the false-pass spot-check, and the
-// outage roll-up handoff — describing and queueing ONLY (ADR 0158 §2: it
-// never confirms a task or flips status; ADR 0162: it adds no approval step to a ship).
+// tests/skill_grade_audit.mjs — the grade AUDIT (once /grade-audit, now Part B of the
+// merged /grade-sweep — task 1004471) covers the accountability sweep from the
+// grader-hardening evaluation §6 (task 1002657): the override ledger, dropped
+// blocker/major findings on passing grades (with the advisory-Narc attribution
+// filter), the false-pass spot-check, and the outage roll-up handoff — describing and
+// queueing ONLY (ADR 0158 §2: it never confirms a task or flips status; ADR 0162: it
+// adds no approval step to a ship). /grade-audit stays typeable as a hidden alias.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { readFileSync, existsSync } from 'node:fs';
@@ -11,16 +12,22 @@ import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const SKILL = path.join(ROOT, '.claude', 'skills', 'grade-audit', 'SKILL.md');
+const SKILL = path.join(ROOT, '.claude', 'skills', 'grade-sweep', 'SKILL.md');
+const ALIAS = path.join(ROOT, '.claude', 'skills', 'grade-audit', 'SKILL.md');
 
 // .claude/skills is INSTANCE-materialized; a neutral core checkout carries none
 // (task 1002470) — skip there, same guard shape as file_map.mjs.
 const skillsDirExists = existsSync(path.join(ROOT, '.claude', 'skills'));
 
-test('/grade-audit exists, covers the sweep legs, and stays describe-and-queue only', (t) => {
+// Part B of the merged file: from its heading to the shared report section.
+const partB = (md) => md.slice(md.indexOf('## Part B'), md.indexOf('## Report shape'));
+
+test('the grade audit (grade-sweep Part B) covers the sweep legs, and stays describe-and-queue only', (t) => {
   if (!skillsDirExists) return t.skip('.claude/skills not materialized in this checkout');
-  assert.ok(existsSync(SKILL), '.claude/skills/grade-audit/SKILL.md must exist (task 1002657)');
-  const md = readFileSync(SKILL, 'utf8');
+  assert.ok(existsSync(SKILL), '.claude/skills/grade-sweep/SKILL.md must exist (task 1004471, was grade-audit — task 1002657)');
+  const whole = readFileSync(SKILL, 'utf8');
+  const md = partB(whole);
+  assert.ok(md.length > 1000, 'Part B is present');
 
   // Data surfaces.
   assert.match(md, /\/api\/bongos\/public\/recent-shipped/, 'sweeps the recent-shipped window');
@@ -35,16 +42,26 @@ test('/grade-audit exists, covers the sweep legs, and stays describe-and-queue o
   assert.match(md, /blocker|major/, 'targets blocker/major findings on passing grades');
   assert.match(md, /Narc/i, 'carries the advisory-Narc attribution filter');
   assert.match(md, /capture\.js/, 'queues findings via capture.js');
-  assert.match(md, /\[grade-audit\]/, 'uses the deterministic title marker for idempotency');
+  assert.match(md, /\[grade-audit\]/, 'keeps the deterministic title marker for idempotency (old rows carry it)');
 
   // Leg 3 — false-pass spot-check (the 2/8 runtime-blindness classes).
   assert.match(md, /runtime/i, 'spot-checks for runtime-behavior blindness');
 
-  // Leg 4 — outage roll-up handoff.
-  assert.match(md, /\/grader-health/, 'hands outage windows to /grader-health');
+  // Leg 4 — outage roll-up hands a streak to the health half, now in the same file.
+  assert.match(md, /Part A/, 'hands outage streaks to Part A (was /grader-health)');
+
+  // The hard constraint — stated once for the whole merged skill.
+  assert.match(whole, /never confirm/i, 'states it never confirms');
+  assert.match(whole, /ADR 0162/, 'anchors the no-approval-step-on-a-ship constraint');
+  assert.ok(!/curl[^\n]*\/confirm/.test(whole), 'carries no ready-to-paste confirm curl');
+});
 
-  // The hard constraint.
-  assert.match(md, /never confirm/i, 'states it never confirms');
-  assert.match(md, /ADR 0162/, 'anchors the no-approval-step-on-a-ship constraint');
-  assert.ok(!/curl[^\n]*\/confirm/.test(md), 'carries no ready-to-paste confirm curl');
+test('/grade-audit still works when typed: a hidden alias that runs grade-sweep Part B (task 1004471)', (t) => {
+  if (!skillsDirExists) return t.skip('.claude/skills not materialized in this checkout');
+  const md = readFileSync(ALIAS, 'utf8');
+  assert.match(md, /^name: grade-audit$/m);
+  assert.match(md, /^disable-model-invocation: true$/m, 'hidden from the model\'s listing, typeable as /grade-audit');
+  assert.match(md, /grade-sweep\/SKILL\.md/, 'points at the merged skill by path');
+  assert.match(md, /Part B/, 'runs the audit half only');
+  assert.match(readFileSync(SKILL, 'utf8'), /^disable-model-invocation: true$/m, 'the merged grade skill is hidden too (owner ruling)');
 });

package/tests/skill_grader_health.mjs

@@ -1,8 +1,10 @@
-// tests/skill_grader_health.mjs — the /grader-health skill exists and covers
-// the four health axes from the grader-hardening evaluation §6 (task 1002656):
-// outage runs, pass-rate drift, cost anomalies, and stale model pins — reading
-// LIVE data surfaces, emitting exact --regrade remediation lines, and staying
-// read-only (describe, never confirm/flip — ADR 0158 §2; no approval step on anyone's ship — ADR 0162).
+// tests/skill_grader_health.mjs — the grader HEALTH check (once /grader-health, now
+// Part A of the merged /grade-sweep — task 1004471) covers the four health axes from
+// the grader-hardening evaluation §6 (task 1002656): outage runs, pass-rate drift,
+// cost anomalies, and stale model pins — reading LIVE data surfaces, emitting exact
+// --regrade remediation lines, and staying read-only (describe, never confirm/flip —
+// ADR 0158 §2; no approval step on anyone's ship — ADR 0162). /grader-health stays
+// typeable as a hidden alias.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { readFileSync, existsSync } from 'node:fs';
@@ -10,16 +12,22 @@ import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const SKILL = path.join(ROOT, '.claude', 'skills', 'grader-health', 'SKILL.md');
+const SKILL = path.join(ROOT, '.claude', 'skills', 'grade-sweep', 'SKILL.md');
+const ALIAS = path.join(ROOT, '.claude', 'skills', 'grader-health', 'SKILL.md');
 
 // .claude/skills is INSTANCE-materialized; a neutral core checkout carries none
 // (task 1002470) — skip there, same guard shape as file_map.mjs.
 const skillsDirExists = existsSync(path.join(ROOT, '.claude', 'skills'));
 
-test('/grader-health exists and covers the four health axes on live data', (t) => {
+// Part A of the merged file: from its heading to Part B.
+const partA = (md) => md.slice(md.indexOf('## Part A'), md.indexOf('## Part B'));
+
+test('the grader health check (grade-sweep Part A) covers the four health axes on live data', (t) => {
   if (!skillsDirExists) return t.skip('.claude/skills not materialized in this checkout');
-  assert.ok(existsSync(SKILL), '.claude/skills/grader-health/SKILL.md must exist (task 1002656)');
-  const md = readFileSync(SKILL, 'utf8');
+  assert.ok(existsSync(SKILL), '.claude/skills/grade-sweep/SKILL.md must exist (task 1004471, was grader-health — task 1002656)');
+  const whole = readFileSync(SKILL, 'utf8');
+  const md = partA(whole);
+  assert.ok(md.length > 1000, 'Part A is present');
 
   // Live data surfaces, named concretely.
   assert.match(md, /\/api\/bongos\/public\/grades/, 'reads the public grade trend');
@@ -44,5 +52,15 @@ test('/grader-health exists and covers the four health axes on live data', (t) =
   assert.match(md, /--probe/, 'offers the optional live calibration probe');
   assert.match(md, /grade-smoke\.js/, 'names the probe script');
   assert.match(md, /read-only/i, 'states the read-only contract');
-  assert.match(md, /ADR 0162/, 'anchors the no-approval-step-on-a-ship constraint');
+  assert.match(whole, /ADR 0162/, 'anchors the no-approval-step-on-a-ship constraint');
+});
+
+test('/grader-health still works when typed: a hidden alias that runs grade-sweep Part A (task 1004471)', (t) => {
+  if (!skillsDirExists) return t.skip('.claude/skills not materialized in this checkout');
+  const md = readFileSync(ALIAS, 'utf8');
+  assert.match(md, /^name: grader-health$/m);
+  assert.match(md, /^disable-model-invocation: true$/m, 'hidden from the model\'s listing, typeable as /grader-health');
+  assert.match(md, /grade-sweep\/SKILL\.md/, 'points at the merged skill by path');
+  assert.match(md, /Part A/, 'runs the health half only');
+  assert.match(md, /--probe/, 'passes --probe through');
 });

package/tests/skill_lint.mjs

@@ -138,6 +138,43 @@ test('the listing counts only RESIDENT skills: an off module\'s skill is linted
   fs.rmSync(root, { recursive: true, force: true });
 });
 
+test('a HIDDEN skill (disable-model-invocation: true) is linted but not counted toward the listing budget, and is reported on its own (task 1004471)', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'skill-lint-hidden-'));
+  const put = (rel, text) => { const p = path.join(root, rel); fs.mkdirSync(path.dirname(p), { recursive: true }); fs.writeFileSync(p, text); };
+  const skill = (n, extra = '') => `---\nname: ${n}\ndescription: >-\n  ${'y'.repeat(100)}\n${extra}---\nbody\n`;
+  put('.claude/skills/shown/SKILL.md', skill('shown'));
+  put('.claude/skills/tucked/SKILL.md', skill('tucked', 'disable-model-invocation: true\n'));
+  put('.claude/skills/false-flag/SKILL.md', skill('false-flag', 'disable-model-invocation: false\n'));
+  const files = lint.listSkillFiles(root);
+  const report = lint.lintSkills(files, { resident: lint.residentSkillFiles(root, { files }) });
+  assert.equal(report.results.length, 3, 'all three are linted');
+  assert.equal(report.listedSkills, 2, 'only a literal true hides — false stays listed');
+  assert.equal(report.listingChars, ('shown'.length + 100) + ('false-flag'.length + 100));
+  assert.equal(report.hiddenSkills, 1);
+  assert.equal(report.hiddenChars, 'tucked'.length + 100);
+  assert.deepEqual(report.hiddenNames, ['tucked']);
+  const out = lint.format(report, { relTo: root });
+  assert.match(out, /listing 215 chars over 2 listed skill/);
+  assert.match(out, /1 hidden skill\(s\).*not counted\): 106 chars — tucked/);
+  fs.rmSync(root, { recursive: true, force: true });
+});
+
+test('a hidden skill is exempt from the long-description warning (it costs no listing) but not from the hard cap', () => {
+  const long = 'z'.repeat(lint.DESC_WARN_CHARS + 10);
+  assert.equal(run(fm(long, 'disable-model-invocation: true\n')).warnings.length, 0);
+  assert.equal(run(fm(long)).warnings.length, 1, 'the same text listed still warns');
+  assert.equal(run(fm('z'.repeat(lint.DESC_HARD_CHARS + 1), 'disable-model-invocation: true\n')).errors.length, 1);
+  assert.equal(lint.isHidden({ 'disable-model-invocation': 'TRUE ' }), true);
+  assert.equal(lint.isHidden({ 'disable-model-invocation': 'yes' }), false, 'anything but true leaves it listed');
+});
+
+test('the real default listing is under the ~8,000-char budget once hidden skills drop out (task 1004471)', () => {
+  const files = lint.listSkillFiles(ROOT);
+  const report = lint.lintSkills(files, { resident: lint.residentSkillFiles(ROOT, { files }) });
+  assert.equal(report.overBudget, false, `listing is ${report.listingChars} chars over ${report.listedSkills} listed skills`);
+  assert.ok(report.hiddenSkills >= 12, `the owner's hide list is in effect (${report.hiddenSkills} hidden)`);
+});
+
 test('every committed skill parses (the ten that did not on 2026-09-03 must stay fixed)', () => {
   const report = lint.lintSkills(lint.listSkillFiles(ROOT));
   const broken = report.results.filter((r) => r.errors.length).map((r) => path.relative(ROOT, r.file) + ': ' + r.errors.join('; '));

package/tests/skill_menu_ruling.mjs

@@ -0,0 +1,99 @@
+// tests/skill_menu_ruling.mjs — the owner's skill-menu ruling (task 1004471, blocker
+// 1000139) holds: which skills the model is shown, which are hidden but still typeable
+// as /name, and the three merges (/owner-review, /goal-close, /grade-sweep) with every
+// old command still answering. Pinned skill by skill, so a later edit that re-lists a
+// hidden skill, hides a safety net, or breaks an old /name fails here by name.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const lint = require('../scripts/gds/skill-lint.js');
+
+const byName = new Map(lint.listSkillFiles(ROOT).map((f) => [path.basename(path.dirname(f)), f]));
+const read = (n) => fs.readFileSync(byName.get(n), 'utf8');
+const info = (n) => lint.lintSkillFile(read(n), { file: byName.get(n) });
+
+// The ruling, as written into the task.
+const LISTED_TRIMMED = ['grade-recover', 'collab-review', 'session-handoff', 'builder-claim', 'builder-sequence', 'blocker-solve', 'design', 'goal-create', 'blocker-review', 'builder-reauth', 'read-session-export', 'recall', 'worktree-clean', 'merge-mode', 'builder-setup', 'builder-key', 'bongos-feedback', 'feedback', 'builder-redteam', 'scan-before-install', 'owner-review'];
+const LISTED_AS_IS = ['strand-fix', 'builder-ship', 'builder-start', 'fix-task', 'ask-for-help', 'ship-check', 'status', 'builder-end', 'builder-release', 'builder-stage'];
+const HIDDEN = ['planning-session', 'goal-close', 'grade-sweep', 'builder-exit', 'builder-backup', 'builder-cost', 'new-project', 'design-sync', 'figma-design-sync', 'tweak'];
+const ALIASES = ['backlog-review', 'bug-triage', 'idea-triage', 'priority-session', 'goal-uat', 'goal-review', 'grade-audit', 'grader-health'];
+
+test('every skill the ruling keeps listed is present, listed, and (where trimmed) at most 250 chars', () => {
+  for (const n of [...LISTED_TRIMMED, ...LISTED_AS_IS]) {
+    assert.ok(byName.has(n), `${n} exists`);
+    const r = info(n);
+    assert.equal(r.hidden, false, `${n} must stay in the model's listing`);
+    assert.deepEqual(r.errors, [], `${n} parses`);
+  }
+  const over = LISTED_TRIMMED.filter((n) => info(n).description.length > 250).map((n) => `${n} ${info(n).description.length}`);
+  assert.deepEqual(over, [], 'trimmed descriptions are <= 250 chars');
+});
+
+test('every skill the ruling hides — and every old name a merge replaced — is hidden but still a typeable skill', () => {
+  for (const n of [...HIDDEN, ...ALIASES]) {
+    assert.ok(byName.has(n), `/${n} still exists, so typing it still works`);
+    assert.equal(info(n).hidden, true, `${n} carries disable-model-invocation: true`);
+  }
+});
+
+test('the safety nets and owner-pinned triggers survive the trim', () => {
+  const d = (n) => info(n).description;
+  assert.match(d('builder-redteam'), /"I found a security issue"/);
+  assert.match(d('scan-before-install'), /"is this plugin safe to install"/);
+  assert.match(d('builder-reauth'), /"Bongos CLI session is no longer valid"/, 'fires on the CLI\'s own error string');
+  assert.match(d('builder-setup'), /"no Bongos session"/, 'fires on the CLI\'s own error string');
+  assert.match(d('builder-key'), /never accept a key pasted in chat/, 'keeps the hard rule in the listing');
+  assert.match(d('bongos-feedback'), /unasked/, 'keeps its unprompted trigger');
+  for (const n of [...LISTED_TRIMMED, ...LISTED_AS_IS, ...HIDDEN, ...ALIASES]) {
+    const fm = read(n).split('\n---')[0];
+    for (const k of ['plain', 'reach-for', 'cost']) assert.match(fm, new RegExp(`^${k}:`, 'm'), `${n} keeps its ${k}: line (the hall Commands page reads it)`);
+  }
+});
+
+test('/owner-review is the listed front door to backlog -> bugs -> ideas -> priorities, and plain words open each step', () => {
+  const md = read('owner-review');
+  const desc = info('owner-review').description;
+  for (const phrase of ['"review the backlog"', '"triage bugs"', '"triage ideas"', '"review the inbox"']) assert.ok(desc.includes(phrase), `listing routes ${phrase}`);
+  const order = ['backlog-review', 'bug-triage', 'idea-triage', 'priority-session'].map((s) => md.indexOf(`.claude/skills/${s}/SKILL.md`));
+  assert.ok(order.every((i) => i > 0), 'each step names its playbook by path');
+  assert.deepEqual([...order].sort((a, b) => a - b), order, 'in the ruling\'s order');
+  for (const step of ['backlog', 'bugs', 'ideas', 'priorities']) assert.match(md, new RegExp('`' + step + '`'), `/owner-review ${step} opens one step`);
+  assert.match(md, /Read that step's `SKILL\.md` with the Read tool/, 'the model reads a hidden step by path — the Skill tool cannot load it');
+  for (const s of ['backlog-review', 'bug-triage', 'idea-triage', 'priority-session']) assert.match(md, new RegExp('`/' + s + '`'), `/${s} is named as still typeable`);
+});
+
+test('the nightly idea-triage routine still finds the playbook it reads by path', () => {
+  const nightly = fs.readFileSync(path.join(ROOT, '.claude/scheduled-tasks/idea-triage-nightly/SKILL.md'), 'utf8');
+  assert.match(nightly, /\.claude\/skills\/idea-triage\/SKILL\.md/);
+  assert.ok(fs.existsSync(path.join(ROOT, '.claude/skills/idea-triage/SKILL.md')));
+  assert.ok(read('idea-triage').length > 5000, 'the full playbook, not an alias stub');
+});
+
+test('/goal-close carries both halves; /goal-uat and /goal-review run one each', () => {
+  const md = read('goal-close');
+  const p1 = md.indexOf('## Part 1'), p2 = md.indexOf('## Part 2');
+  assert.ok(p1 > 0 && p2 > p1, 'UAT part, then residue part');
+  assert.match(md.slice(p1, p2), /uat\.js --queue/, 'Part 1 reads the UAT queue');
+  assert.match(md.slice(p1, p2), /--recording/, 'Part 1 signs off with a recording');
+  assert.match(md.slice(p2), /done-when\/pending-review/, 'Part 2 reads the review queue');
+  assert.match(md.slice(p2), /override_reason/, 'Part 2 overrides only with a written reason');
+  assert.match(md, /xenos/, 'one Metic+ gate at the top');
+  assert.match(read('goal-uat'), /goal-close\/SKILL\.md[\s\S]*Part 1/);
+  assert.match(read('goal-review'), /goal-close\/SKILL\.md[\s\S]*Part 2/);
+});
+
+test('/tweak lives in the copy-desk module, which contributes it (default-on, so it stays installed)', () => {
+  assert.ok(fs.existsSync(path.join(ROOT, 'modules/copy-desk/skills/tweak/SKILL.md')));
+  assert.ok(!fs.existsSync(path.join(ROOT, '.claude/skills/tweak/SKILL.md')) || !require('node:child_process').execFileSync('git', ['ls-files', '.claude/skills/tweak'], { cwd: ROOT, encoding: 'utf8' }).trim(), 'no tracked core copy (an untracked materialised one is fine)');
+  const mj = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules/copy-desk/module.json'), 'utf8'));
+  assert.deepEqual(mj.contributes.skills, ['tweak']);
+  assert.equal(mj.default, true);
+  const files = lint.listSkillFiles(ROOT);
+  assert.ok(lint.residentSkillFiles(ROOT, { files }).some((f) => path.basename(path.dirname(f)) === 'tweak'), 'resident on a default instance');
+});