@bongos/core 1.21.134 → 1.21.136

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.134",
-  "core_contract": "1.21.134",
-  "source_commit": "7f0bb837924e95ccff5e553a687b228eef70ce30",
+  "core_version": "1.21.136",
+  "core_contract": "1.21.136",
+  "source_commit": "e4b8cee4f6222b363f9b2e8aa1ceb79c6426a2eb",
   "source_ref": "HEAD",
-  "built_at": "2026-10-15T21:28:31.615Z",
+  "built_at": "2026-10-15T23:35:12.033Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 608,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3149,
+    "functional_verbatim": 3153,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3786,
-  "tree_sha256": "f5dfa49c3f439d7d10d733cc5f9c0940cf30172fa438d8757a49b7a6cd636fc8",
+  "file_count": 3790,
+  "tree_sha256": "2bb4525360079b817aa7bc06f384d604867c6896a6a2caa355d01487669160c2",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2392,7 +2392,7 @@
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "fca9878d8501b33c0258045f61365a90e60e148c2b730b00a83a6f4f89b79b8d"
+      "sha256": "3850775c198edeece6ac5497a9f5788421a8082e21edb496a4b00a3fc7a6eb3d"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2412,12 +2412,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "999f2aebe366e15d3a90e5f5eae8895d083b6bfab971ce5dae5689abf746b148"
+      "sha256": "befe58f901848724fd48c74e38ee396b31d2f523313708dbfe90138b9f86a2b2"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "c2800908ad74f7719dd80dd441bd0720733f3219a45a43aa8e3aecb939bad703"
+      "sha256": "26b2738a40324254a1222b3493eafceb00d77dbe07bfc9a5c882f576901040e0"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2927,7 +2927,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "e77d3f864bca9f90cc1dbf2cfedd61dc315a27bb37084bbc8873ed144e7afa64"
+      "sha256": "72c0a2b3d8e44eb7ae5e0b0b9c27eb4c70055f9eb8755496c9f174db024fec57"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3017,7 +3017,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "688397e5f326c13764b78b90929ed54213c683df661043d357c37cfc85b8ce35"
+      "sha256": "7fefba487e6aee704f8d23d876d4db7720c9c1231ab61e94f5903f060d96c424"
     },
     {
       "path": "docs/project-context.template.md",
@@ -4164,6 +4164,11 @@
       "mode": "0000644",
       "sha256": "550884fa117e707b65f5c56faca0e4e3850905db94d3f275cad5d520aa68db03"
     },
+    {
+      "path": "migrations/core_277_passkey_foundation.sql",
+      "mode": "0000644",
+      "sha256": "52ebc3ce9c3e006ef2dfe0d85c9a97c53896f7b0d8f8fb700a1488a24c7bcb3c"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -5927,12 +5932,12 @@
     {
       "path": "modules/hall-ui/public/goal-author-lib.js",
       "mode": "0000644",
-      "sha256": "3d962593e1d29665ba54f4bb356291123e3cccf53178a1eab79838f7e54bd09d"
+      "sha256": "cacce0bf30ff04fbd040783aab51f53393259b537df7537664aedd084412eaef"
     },
     {
       "path": "modules/hall-ui/public/goal-author.js",
       "mode": "0000644",
-      "sha256": "e4d5355eb3d2a9c894cce901c20051f769e4817f85bb3ba0ec7ebe4d67921306"
+      "sha256": "ef1c80876cf921aa03f2eefc4f04efa40d97428d8c1537e070f6b16e1d137602"
     },
     {
       "path": "modules/hall-ui/public/goal-forest-lib.js",
@@ -10522,12 +10527,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "16a65f4d7586e27be39c10448d7a39a0782725e1c050655e08ed930e3dc50ed5"
+      "sha256": "ad4055f1eef9ede69c3eda6f957baa66186ec383ac30b9f3b411302d651aae2e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f6a3dfa7fb0820113d9448f1b011a6e2edaeb3f06656d9530e2dbea160e112f0"
+      "sha256": "af3b71b069ad704356796bf041f8a2798a07e9c20aca50aaf3758c0fb311f8ca"
     },
     {
       "path": "public-docs/index.html",
@@ -10547,7 +10552,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "0a7de5fe356b571a5dcaf748c830d457a365165d17b0d733594b6bfc89ef6267"
+      "sha256": "b170ded56d5ca6cc029de29e1ceade0100ef20de335fa810f4aa0d220012fc84"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11832,7 +11837,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "d6d81c3bb8017122cb6b5a46355b637f7986ec324132bcd583f0c02d2725b6d0"
+      "sha256": "213d8e4199ab429e64d0c65f4eda42a9d0cb4c64baa1424f793e223af3e66308"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -12689,6 +12694,11 @@
       "mode": "0000644",
       "sha256": "b2f6d65e3463052609e51d135ea560370104d0457a0e7e86bf9b7120fe1cddfb"
     },
+    {
+      "path": "src/bongos/passkeys.js",
+      "mode": "0000644",
+      "sha256": "2fe8018148a70b21515352084e3bc9047da0ee4749e27df6f68c93ba29a2368a"
+    },
     {
       "path": "src/bongos/path-match.js",
       "mode": "0000644",
@@ -12902,7 +12912,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d253382a583b4d8ad6289d41cf1e5db7ebe264ed7bf54ab93b5b0b44f46b5135"
+      "sha256": "5968c611fba761d24e4118debb2aeb34772640722e0306a0c61a351bf7455f0f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14692,7 +14702,7 @@
     {
       "path": "tests/goal_author_ui.mjs",
       "mode": "0000644",
-      "sha256": "78d7caca514961f3f21a86de47bad2c76408434bbb887d302f9b688fb46387bf"
+      "sha256": "fe81fe8835244f6e98aad16fd46b304ac23bc0d755b74481b9d720f19af6c3d2"
     },
     {
       "path": "tests/goal_category.mjs",
@@ -16859,6 +16869,16 @@
       "mode": "0000644",
       "sha256": "fd69c44ebf3d246ecedf527275448389cca809e231d1c6cb34e4c12bfdc38111"
     },
+    {
+      "path": "tests/passkey_foundation_db.mjs",
+      "mode": "0000644",
+      "sha256": "5ff76c608f9f7b687e6b65af6bc667bdb42a21d520425b16bf15d36ca03848d9"
+    },
+    {
+      "path": "tests/passkey_pure.mjs",
+      "mode": "0000644",
+      "sha256": "d0466c6a46c2eadd023801640d5da2d395d68cab8c8a9a46eee9b2e88e8c5182"
+    },
     {
       "path": "tests/paste_token_api_base.mjs",
       "mode": "0000644",

package/docs/architecture.md

@@ -251,6 +251,16 @@ store_module_prices(id, module_key, price_cents, price_credits, set_by, set_at)
               -- in that currency, at least one must be set.
 ```
 
+Passkey foundation (migration `core_277`, task 1004750, [ADR 0382](adr/0382-a-hardware-card-is-a-passkey-step-up-an-archon-switches-on-per-builder.md) D1/D6 — storage only; the ceremonies and routes are their own tasks; code in `src/bongos/passkeys.js`):
+
+```
+passkey_credentials(id, credential_id UNIQUE, builder_id FK, public_key bytea, sign_count,
+              transports[], aaguid, nickname, created_at, last_used_at)
+passkey_user_handles(builder_id PK FK, user_handle UNIQUE, created_at)  -- opaque, never the email
+passkey_challenges(challenge PK, purpose, builder_id NULL, created_at, expires_at)
+              -- single-use (DELETEd on consume), TTL swept; builder_id NULL for sign-in
+```
+
 Module release channels (migration `core_276`, task 1003815, [ADR 0344](adr/0344-a-tester-is-a-project-that-opts-in-once.md) — which channel a published version is on; the data only, the tester-first publish, promotion gate and channel-aware install are their own tasks):
 
 ```

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2739 strings** across 3 surfaces · 2317 distinct pieces of copy · 2739 certain, 0 heuristic · 242 shown in more than one place.
+**2742 strings** across 3 surfaces · 2320 distinct pieces of copy · 2742 certain, 0 heuristic · 242 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 145 | 1931 |
+| `builders-hall` | `modules/hall-ui/public` | 145 | 1934 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 100 |
 | `landing` | `modules/public-landing/public` | 9 | 708 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `8226c979db4d` | 3x | Not now | modules/hall-ui/public/collab.js:668, modules/hall-ui/public/paintbrush.js:119, modules/hall-ui/public/paintbrush.js:183 |
 | … | | _202 more in the JSON registry_ | |
 
-## `builders-hall` — 1931 strings
+## `builders-hall` — 1934 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -151,10 +151,12 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `524188fe0078` | certain | Active sessions | `modules/hall-ui/public/settings.html:159` |
 | `d628b36ec58e` | certain | Activity, by role | `modules/hall-ui/public/profile.html:138` |
 | `32509514479f` | certain | Add a done-when criterion | `modules/hall-ui/public/goal-author.js:38` |
+| `83beba462b20` | certain | Add a task | `modules/hall-ui/public/goal-author.js:38` |
 | `f4c5a03f715c` | certain | Add criterion | `modules/hall-ui/public/goal-author.js:38` |
 | `2b94171ce525` | certain | Add dependency | `modules/hall-ui/public/task.js:592` |
 | `a70b72ec4dcc` | certain | Add images | `modules/hall-ui/public/page-notes.js:120` |
 | `da8659b0099b` | certain | Add something you wrote — notes, a standard, a worked example. It is indexed for recall, not pasted into every | `modules/hall-ui/public/settings-specialities.js:354` |
+| `8b51e2e70cfb` | certain | Add task | `modules/hall-ui/public/goal-author.js:38` |
 | `82a8bd77d374` | certain | Add these ranks | `modules/hall-ui/public/government.js:929` |
 | `eded707fab69` | certain | Add to what it knows | `modules/hall-ui/public/settings-specialities.js:354` |
 | `cc4125ca7cff` | certain | Added to this version after it started building — an Archon override of the scope gate. Open the goal to see w | `modules/hall-ui/public/goals-render.js:194` |
@@ -641,6 +643,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `ef224c9de7c8` | certain | Ideas — {{worldName}} | `modules/hall-ui/public/ideas.html:6` |
 | `9e9f8a44276b` | certain | Identity vouched | `modules/hall-ui/public/watch.js:396` |
 | `3c24eedc9f2d` | certain | If that page does not let you in, ask {…} to install it for you.{…} | `modules/hall-ui/public/settings-software-update.js:101` |
+| `65977bbcda48` | certain | If the goal still has a “Spec goal” task that is not done, this task waits behind it until the spec is finishe | `modules/hall-ui/public/goal-author.js:38` |
 | `7d6a7de7a69e` | certain | If the {…} has invited you, sign in with GitHub and you're in. If not, ask them for an invite — this project d | `modules/hall-ui/public/hall-render.js:292` |
 | `4ef9f2a4df3b` | certain | If you own this project, | `modules/hall-ui/public/deploy.js:424` |
 | `b6c47d4ee42c` | certain | Image key removed. | `modules/hall-ui/public/settings.js:1012` |
@@ -1365,7 +1368,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `bcdbded93d4e` | certain | The work board failed to load. Reload to try again. | `modules/hall-ui/public/work.js:1214` |
 | `996d2aa0e2f0` | certain | Then copy the project onto your machine, install its dependencies, and sign in: | `modules/hall-ui/public/hall-render.js:837` |
 | `383018c7df70` | certain | There is no transcript you can read for this session. | `modules/hall-ui/public/sessions.js:234` |
-| `9f09494abfa1` | certain | These open goals look related — use one instead? | `modules/hall-ui/public/goal-author.js:125` |
+| `9f09494abfa1` | certain | These open goals look related — use one instead? | `modules/hall-ui/public/goal-author.js:144` |
 | `d6b9826f1bd3` | certain | These words are the studio page itself. Take the page, type over them here, and submit it from the editor when | `modules/hall-ui/public/studio.html:106` |
 | `775a73b066e3` | certain | These words come from the skill’s own description, which was written for Claude to recognise rather than for y | `modules/hall-ui/public/settings-specialities.js:128` |
 | `a0140098c0e0` | certain | They already have an invitation or a join-request pending on this goal. | `modules/hall-ui/public/goals-render.js:1302` |
@@ -1970,11 +1973,11 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e31a588bb9e1` | certain | — moved {…}, and the box confirmed it. | `modules/hall-ui/public/deploy.js:400` |
 | `417adabd1a00` | certain | — no goal suggested — open the goal board and pick one — | `modules/hall-ui/public/task-detail.js:412` |
 | `1f9504667df5` | certain | — none — | `modules/hall-ui/public/goal-author.js:38` |
-| `1f9504667df5` | certain | — none — | `modules/hall-ui/public/goal-author.js:109` |
+| `1f9504667df5` | certain | — none — | `modules/hall-ui/public/goal-author.js:128` |
 | `da9962dc1729` | certain | — or open any diagram fullscreen. | `modules/hall-ui/public/diagrams.html:33` |
 | `b1ca53ebfc10` | certain | — pick a goal — | `modules/hall-ui/public/goal-author.js:38` |
-| `b1ca53ebfc10` | certain | — pick a goal — | `modules/hall-ui/public/goal-author.js:94` |
-| `825930577f01` | certain | — pick a version — | `modules/hall-ui/public/goal-author.js:106` |
+| `b1ca53ebfc10` | certain | — pick a goal — | `modules/hall-ui/public/goal-author.js:112` |
+| `825930577f01` | certain | — pick a version — | `modules/hall-ui/public/goal-author.js:125` |
 | `61ebc5d684fd` | certain | — stops the project and its nightly backups but keeps everything: its database, its backups and your repositor | `modules/hall-ui/public/project-settings.html:60` |
 | `e5c5e94152b3` | certain | — that's all the tooling you need up front. | `modules/hall-ui/public/hall-render.js:837` |
 | `85f1dd2ee732` | certain | — the whole project | `modules/hall-ui/public/goal-map.html:69` |

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 2739,
-    "unique_ids": 2317,
-    "certain": 2739,
+    "strings": 2742,
+    "unique_ids": 2320,
+    "certain": 2742,
     "heuristic": 0,
     "duplicate_ids": 242
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 145,
-      "strings": 1931
+      "strings": 1934
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -2615,7 +2615,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/goal-author.js:38",
-        "modules/hall-ui/public/goal-author.js:109"
+        "modules/hall-ui/public/goal-author.js:128"
       ]
     },
     {
@@ -2625,7 +2625,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/goal-author.js:38",
-        "modules/hall-ui/public/goal-author.js:94"
+        "modules/hall-ui/public/goal-author.js:112"
       ]
     },
     {
@@ -3261,6 +3261,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "83beba462b20",
+      "surface": "builders-hall",
+      "text": "Add a task",
+      "file": "modules/hall-ui/public/goal-author.js",
+      "line": 38,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "f4c5a03f715c",
       "surface": "builders-hall",
@@ -3297,6 +3306,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "8b51e2e70cfb",
+      "surface": "builders-hall",
+      "text": "Add task",
+      "file": "modules/hall-ui/public/goal-author.js",
+      "line": 38,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "82a8bd77d374",
       "surface": "builders-hall",
@@ -7671,6 +7689,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "65977bbcda48",
+      "surface": "builders-hall",
+      "text": "If the goal still has a “Spec goal” task that is not done, this task waits behind it until the spec is finished.",
+      "file": "modules/hall-ui/public/goal-author.js",
+      "line": 38,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "7d6a7de7a69e",
       "surface": "builders-hall",
@@ -14192,7 +14219,7 @@
       "surface": "builders-hall",
       "text": "These open goals look related — use one instead?",
       "file": "modules/hall-ui/public/goal-author.js",
-      "line": 125,
+      "line": 144,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19637,7 +19664,7 @@
       "surface": "builders-hall",
       "text": "— none —",
       "file": "modules/hall-ui/public/goal-author.js",
-      "line": 109,
+      "line": 128,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19664,7 +19691,7 @@
       "surface": "builders-hall",
       "text": "— pick a goal —",
       "file": "modules/hall-ui/public/goal-author.js",
-      "line": 94,
+      "line": 112,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19673,7 +19700,7 @@
       "surface": "builders-hall",
       "text": "— pick a version —",
       "file": "modules/hall-ui/public/goal-author.js",
-      "line": 106,
+      "line": 125,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -3105,5 +3105,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.132 with no explicit bump. run 38803950047. (task 1002620)
   1.21.134 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.133 with no explicit bump. run 38810062389. (task 1002620)
+  1.21.135 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.134 with no explicit bump. run 38812449926. (task 1002620)
+  1.21.136 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.135 with no explicit bump. run 38824385358. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -1201,7 +1201,7 @@
       "surface": "builders",
       "title": "Goals",
       "states_read": ["list","filters","cards","detail","dependencies","out","uat","uat-panel","author"],
-      "files_hash": "f7f8e781b83d7c32",
+      "files_hash": "3f07bbb487b850ec",
       "reading_hash": "7aa1a6e1946dc077",
       "counts": {"lines":156,"placed":52,"shared":8,"unplaced":96},
       "omitted": {"data":268},

package/migrations/core_277_passkey_foundation.sql

@@ -0,0 +1,53 @@
+-- core_277 passkey foundation: credentials, per-builder user handle, challenge store
+-- Applied under task 1004750 (ADR 0382 D1, D6).
+--
+-- WHY. A hardware card (a WebAuthn passkey) is a second sign-in step an Archon can
+-- switch on per builder. Before any ceremony route can exist, the server needs three
+-- things to keep: the public half of each registered card, an opaque handle that
+-- stands in for the builder inside the card (never the email), and the challenges it
+-- has issued and not yet seen answered.
+--
+-- SHAPE.
+--  * passkey_credentials  one row per registered card. credential_id is the
+--    authenticator's own id (base64url) and is UNIQUE: a card can belong to one
+--    builder. sign_count is kept so a counter that goes backwards can be caught.
+--  * passkey_user_handles one random handle per builder, minted on first use.
+--  * passkey_challenges   short-lived, single-use. A row is DELETED when consumed;
+--    expires_at lets a sweep remove the ones nobody answered. builder_id is nullable
+--    because a sign-in ceremony starts before the builder is known.
+
+CREATE TABLE IF NOT EXISTS passkey_credentials (
+  id             bigserial PRIMARY KEY,
+  credential_id  text        NOT NULL UNIQUE,
+  builder_id     bigint      NOT NULL REFERENCES builders(id) ON DELETE CASCADE,
+  public_key     bytea       NOT NULL,
+  sign_count     bigint      NOT NULL DEFAULT 0,
+  transports     text[]      NOT NULL DEFAULT '{}',
+  aaguid         text,
+  nickname       text,
+  created_at     timestamptz NOT NULL DEFAULT now(),
+  last_used_at   timestamptz
+);
+
+CREATE INDEX IF NOT EXISTS idx_passkey_credentials_builder
+  ON passkey_credentials (builder_id);
+
+CREATE TABLE IF NOT EXISTS passkey_user_handles (
+  builder_id   bigint PRIMARY KEY REFERENCES builders(id) ON DELETE CASCADE,
+  user_handle  text   NOT NULL UNIQUE,
+  created_at   timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS passkey_challenges (
+  challenge   text        PRIMARY KEY,
+  purpose     text        NOT NULL CHECK (purpose IN ('register', 'authenticate')),
+  builder_id  bigint      REFERENCES builders(id) ON DELETE CASCADE,
+  created_at  timestamptz NOT NULL DEFAULT now(),
+  expires_at  timestamptz NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_passkey_challenges_expires
+  ON passkey_challenges (expires_at);
+
+INSERT INTO schema_migrations (version) VALUES ('core_277_passkey_foundation')
+  ON CONFLICT (version) DO NOTHING;

package/modules/hall-ui/public/goal-author-lib.js

@@ -89,6 +89,29 @@
     return null;
   }
 
+  // POST /tasks body (task 1003462). The goal and its version are the whole of
+  // what places a task; the server validates goal-belongs-to-version, the open
+  // goal, the rank floor and the kind/discipline inference, so none of those are
+  // sent or pre-checked here.
+  function buildTaskBody(f) {
+    const body = {
+      version_id: clean(f.version_id),
+      goal_id: Number(f.goal_id),
+      title: clean(f.title),
+    };
+    const description = clean(f.description);
+    if (description) body.description = description;
+    return body;
+  }
+
+  function taskFormProblem(f) {
+    if (!(Number(f.goal_id) > 0)) return 'Pick the goal this task belongs to.';
+    const t = clean(f.title);
+    if (!t) return 'Give the task a name.';
+    if (t.length > TITLE_MAX) return `Keep the name under ${TITLE_MAX} characters.`;
+    return null;
+  }
+
   // The refusal, in words. The server's envelope is { error: { code, message } };
   // an older route may send { error: 'code' } or { message }. A refusal the server
   // phrased keeps its own sentence — this only supplies one where the server sent
@@ -99,6 +122,7 @@
     criterion_exists: 'A criterion with that name already exists on this version. Reword the outcome slightly.',
     reserved_criterion_slug: 'That name looks like a position (C1, C2…). Reword the outcome.',
     bad_goal_id: 'That goal is not on this version.',
+    goal_id_required: 'Pick the goal this task belongs to.',
     goal_not_yours: 'Only a goal’s owner or manager (or an Archon) can add criteria to it.',
     version_not_found: 'That version no longer exists.',
   };
@@ -124,6 +148,6 @@
 
   window.OTBGoalAuthor = {
     TITLE_MAX, criterionSlug, buildGoalBody, goalFormProblem,
-    buildCriterionRequest, criterionFormProblem, refusalText, openVersions,
+    buildCriterionRequest, criterionFormProblem, buildTaskBody, taskFormProblem, refusalText, openVersions,
   };
 })();

package/modules/hall-ui/public/goal-author.js

@@ -2,7 +2,7 @@
 // panel (task 1003463, goal 1000089; ADR 0366 D1.2/D1.3 + D3). The hall could
 // SATISFY a criterion and never AUTHOR one, and had no POST /goals call at all.
 //
-// Two forms, nothing else:
+// Three forms, nothing else (the third, a task against a goal, is task 1003462):
 //   · GOAL — a name, a one-line subtitle, an optional longer description, the
 //     version, an optional category. NO scope field: the goal is created with
 //     spec_task:true, so it arrives with a "Spec goal N" task that gates its other
@@ -75,6 +75,23 @@
           <p class="goal-author__err" id="ga-crit-err" role="alert" hidden></p>
           <button type="submit" class="btn btn--primary" id="ga-crit-go">Add criterion</button>
         </form>
+
+        <h2 class="scroll__h goal-author__h2" id="ga-task-h">Add a task</h2>
+        <form id="ga-task" class="goal-author__form" novalidate aria-labelledby="ga-task-h">
+          <label class="goal-author__field">Goal
+            <select id="ga-task-goal" required><option value="">— pick a goal —</option></select>
+          </label>
+          <label class="goal-author__field">Name
+            <input id="ga-task-title" type="text" maxlength="${lib.TITLE_MAX}" autocomplete="off" required>
+          </label>
+          <label class="goal-author__field">Description <span class="goal-author__hint">optional</span>
+            <textarea id="ga-task-desc" rows="3"></textarea>
+          </label>
+          <p class="goal-author__note">If the goal still has a “Spec goal” task that is not done, this task waits behind it until the spec is finished.</p>
+          <p class="goal-author__note" id="ga-task-ok" role="status" aria-live="polite" hidden></p>
+          <p class="goal-author__err" id="ga-task-err" role="alert" hidden></p>
+          <button type="submit" class="btn btn--primary" id="ga-task-go">Add task</button>
+        </form>
       </section>`;
 
     const $q = (id) => root.querySelector(`#${id}`);
@@ -88,12 +105,14 @@
     }
 
     function fillGoalChoices() {
-      const sel = $q('ga-crit-goal');
-      const keep = sel.value;
       const goals = (getGoals() || []).filter((g) => g && g.status === 'open');
-      sel.innerHTML = '<option value="">— pick a goal —</option>' + goals.map((g) =>
-        `<option value="${escapeHtml(String(g.id))}" data-version="${escapeHtml(String(g.version_id || ''))}">${escapeHtml(`${g.version_id || ''} · ${g.title}`)}</option>`).join('');
-      sel.value = keep;
+      for (const id of ['ga-crit-goal', 'ga-task-goal']) {
+        const sel = $q(id);
+        const keep = sel.value;
+        sel.innerHTML = '<option value="">— pick a goal —</option>' + goals.map((g) =>
+          `<option value="${escapeHtml(String(g.id))}" data-version="${escapeHtml(String(g.version_id || ''))}">${escapeHtml(`${g.version_id || ''} · ${g.title}`)}</option>`).join('');
+        sel.value = keep;
+      }
     }
 
     async function loadChoices() {
@@ -191,6 +210,36 @@
         showErr('ga-crit-err', 'Could not reach the server. Try again in a moment.');
       } finally { btn.disabled = false; }
     });
+
+    // task 1003462 — a task against a goal. Sends what was typed to POST /tasks and
+    // lets the server's refusals (floor, goal/version, closed goal) speak.
+    $q('ga-task').addEventListener('submit', async (e) => {
+      e.preventDefault();
+      showErr('ga-task-err', '');
+      const ok = $q('ga-task-ok');
+      ok.hidden = true;
+      const sel = $q('ga-task-goal');
+      const opt = sel.options[sel.selectedIndex];
+      const fields = {
+        goal_id: sel.value, version_id: opt ? opt.getAttribute('data-version') : '',
+        title: $q('ga-task-title').value, description: $q('ga-task-desc').value,
+      };
+      const problem = lib.taskFormProblem(fields);
+      if (problem) return showErr('ga-task-err', problem);
+      const btn = $q('ga-task-go');
+      btn.disabled = true;
+      try {
+        const res = await api.request('POST', `${API}/tasks`, { body: lib.buildTaskBody(fields) });
+        if (!res.ok) return showErr('ga-task-err', lib.refusalText(res.status, res.data));
+        const task = (res.data && res.data.task) || {};
+        $q('ga-task-title').value = '';
+        $q('ga-task-desc').value = '';
+        ok.textContent = task.id != null ? `Task ${task.id} added to the goal. It waits behind the goal’s spec task if that is not done yet.` : 'Task added.';
+        ok.hidden = false;
+      } catch (_) {
+        showErr('ga-task-err', 'Could not reach the server. Try again in a moment.');
+      } finally { btn.disabled = false; }
+    });
   }
 
   window.OTBGoalAuthorUI = { mount };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.134",
+  "version": "1.21.136",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.134",
+      "version": "1.21.136",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.134",
+  "version": "1.21.136",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9806,5 +9806,17 @@
       "id": "1004676",
       "text": "Researched adding a tap-your-security-card check to Bongos. Plan written up and follow-up build work filed."
     }
+  ],
+  "1.21.135": [
+    {
+      "id": "1003462",
+      "text": "Adds an Add-a-task form to the Goals page: pick an open goal, name the task, optional description. Sends POST /tasks unchanged; the server's rank floor, goal/version and closed-goal refusals render as sentences. States that a"
+    }
+  ],
+  "1.21.136": [
+    {
+      "id": "1004750",
+      "text": "Groundwork for hardware-card sign-in: the database tables and storage code that remember registered cards and the short-lived one-time challenges. Nothing is visible to builders yet."
+    }
   ]
 }

package/scripts/gds/run-unit-tests.js

@@ -232,6 +232,9 @@ const INTEGRATION = new Set([
   // admission reads' statements run on Postgres, and the hub's notice restamp and
   // listing. The DB-free sibling (application_lifecycle) interprets the same WHEREs.
   'invite_expiry_db',
+  // task 1004750 (ADR 0382 D6): passkey tables from the real migration — single-use
+  // challenges, TTL sweep, unique credential id, sign-count regression.
+  'passkey_foundation_db',
   // task 1004408: migration platform_identity_028 deletes the old hub invite's
   // pending rows before a cutoff it reads from the core_upgrades ledger. Only a real
   // engine runs the DO block, the numeric version compare and the one-shot guard.

package/src/bongos/passkeys.js

@@ -0,0 +1,143 @@
+// src/bongos/passkeys.js — passkey (WebAuthn) storage: credentials, the opaque user
+// handle, and the single-use challenge store (task 1004750, ADR 0382 D1/D6).
+//
+// This file is the foundation only: it keeps and hands back state. The registration
+// and sign-in ceremonies, and the routes that drive them, are their own tasks and
+// build on these functions with @simplewebauthn/server.
+//
+// A challenge is single-use: consumeChallenge DELETEs the row and returns it, so a
+// replay finds nothing. A challenge past its TTL is refused even before the sweep
+// has removed it.
+'use strict';
+
+const crypto = require('node:crypto');
+
+const CHALLENGE_TTL_SECONDS = 300;
+const MAX_CHALLENGE_TTL_SECONDS = 600;
+const PURPOSES = Object.freeze(['register', 'authenticate']);
+
+function defaultPool() { return require('./pool').pool; }
+
+function randomToken(bytes) { return crypto.randomBytes(bytes).toString('base64url'); }
+
+// A TTL is a positive whole number of seconds no longer than the ceiling, so a caller
+// forwarding an untrusted value cannot mint a long-lived (or already-dead) challenge.
+function clampTtlSeconds(ttl) {
+  const n = Math.floor(Number(ttl));
+  if (!Number.isFinite(n) || n <= 0) return CHALLENGE_TTL_SECONDS;
+  return Math.min(n, MAX_CHALLENGE_TTL_SECONDS);
+}
+
+// The clone check. A counter that does not advance is suspect, unless the card
+// does not keep one at all (stored and reported both zero).
+function counterAdvances(stored, reported) {
+  if (stored === 0 && reported === 0) return true;
+  return reported > stored;
+}
+
+// Mint and store a challenge. Returns { challenge, expiresAt }.
+async function createChallenge({ purpose, builderId = null, ttlSeconds = CHALLENGE_TTL_SECONDS, pool = defaultPool() } = {}) {
+  if (!PURPOSES.includes(purpose)) throw new Error(`passkeys: bad challenge purpose ${JSON.stringify(purpose)}`);
+  const challenge = randomToken(32);
+  // Housekeeping rides on issuing: expired rows are removed here, so the table is
+  // swept by use and needs no separate scheduler.
+  await sweepExpiredChallenges({ pool });
+  const { rows } = await pool.query(
+    `INSERT INTO passkey_challenges (challenge, purpose, builder_id, expires_at)
+     VALUES ($1, $2, $3, now() + make_interval(secs => $4::int))
+     RETURNING expires_at`,
+    [challenge, purpose, builderId, String(clampTtlSeconds(ttlSeconds))],
+  );
+  return { challenge, expiresAt: rows[0].expires_at };
+}
+
+// Take a challenge: delete it and return { purpose, builderId } if it was live, else
+// null. Pass expectPurpose (and expectBuilderId for a signed-in registration) and a
+// challenge issued for something else is refused. It is still spent: a wrong-purpose
+// presentation burns it rather than leaving it to be tried again.
+async function consumeChallenge(challenge, { expectPurpose = null, expectBuilderId = null, pool = defaultPool() } = {}) {
+  if (typeof challenge !== 'string' || !challenge) return null;
+  const { rows } = await pool.query(
+    `DELETE FROM passkey_challenges WHERE challenge = $1
+     RETURNING purpose, builder_id, (expires_at > now()) AS live`,
+    [challenge],
+  );
+  const r = rows[0];
+  if (!r || !r.live) return null;
+  if (expectPurpose != null && r.purpose !== expectPurpose) return null;
+  if (expectBuilderId != null && String(r.builder_id) !== String(expectBuilderId)) return null;
+  return { purpose: r.purpose, builderId: r.builder_id == null ? null : String(r.builder_id) };
+}
+
+// Remove every challenge past its TTL. Returns the number removed.
+async function sweepExpiredChallenges({ pool = defaultPool() } = {}) {
+  const r = await pool.query('DELETE FROM passkey_challenges WHERE expires_at <= now()');
+  return r.rowCount;
+}
+
+// The builder's opaque WebAuthn user handle, minted on first use. Never the email.
+async function getOrCreateUserHandle(builderId, { pool = defaultPool() } = {}) {
+  const { rows } = await pool.query(
+    `INSERT INTO passkey_user_handles (builder_id, user_handle) VALUES ($1, $2)
+     ON CONFLICT (builder_id) DO UPDATE SET builder_id = EXCLUDED.builder_id
+     RETURNING user_handle`,
+    [builderId, randomToken(32)],
+  );
+  return rows[0].user_handle;
+}
+
+async function addCredential({ builderId, credentialId, publicKey, signCount = 0, transports = [], aaguid = null, nickname = null }, { pool = defaultPool() } = {}) {
+  const { rows } = await pool.query(
+    `INSERT INTO passkey_credentials (credential_id, builder_id, public_key, sign_count, transports, aaguid, nickname)
+     VALUES ($1, $2, $3, $4, $5, $6, $7) RETURNING id, created_at`,
+    [credentialId, builderId, Buffer.from(publicKey), signCount, transports, aaguid, nickname],
+  );
+  return rows[0];
+}
+
+async function getCredentialById(credentialId, { pool = defaultPool() } = {}) {
+  const { rows } = await pool.query(
+    `SELECT id, credential_id, builder_id, public_key, sign_count, transports, aaguid, nickname, created_at, last_used_at
+       FROM passkey_credentials WHERE credential_id = $1`,
+    [credentialId],
+  );
+  return rows[0] || null;
+}
+
+async function listCredentials(builderId, { pool = defaultPool() } = {}) {
+  const { rows } = await pool.query(
+    `SELECT id, credential_id, transports, aaguid, nickname, created_at, last_used_at
+       FROM passkey_credentials WHERE builder_id = $1 ORDER BY created_at, id`,
+    [builderId],
+  );
+  return rows;
+}
+
+// Record a successful use. One guarded UPDATE both checks and writes, so two
+// concurrent assertions carrying the same counter cannot both pass and the stored
+// counter can never be lowered. A counter that does not advance (unless the card keeps
+// none) is a possible clone: nothing is written and the reason says why.
+async function recordUse(credentialId, newSignCount, { pool = defaultPool() } = {}) {
+  const r = await pool.query(
+    `UPDATE passkey_credentials SET sign_count = $2, last_used_at = now()
+      WHERE credential_id = $1 AND (($2 = 0 AND sign_count = 0) OR $2 > sign_count)`,
+    [credentialId, newSignCount],
+  );
+  if (r.rowCount > 0) return { ok: true };
+  const cred = await getCredentialById(credentialId, { pool });
+  return { ok: false, reason: cred ? 'sign_count_regressed' : 'unknown_credential' };
+}
+
+async function removeCredential(builderId, credentialId, { pool = defaultPool() } = {}) {
+  const r = await pool.query(
+    'DELETE FROM passkey_credentials WHERE builder_id = $1 AND credential_id = $2',
+    [builderId, credentialId],
+  );
+  return r.rowCount > 0;
+}
+
+module.exports = {
+  CHALLENGE_TTL_SECONDS, MAX_CHALLENGE_TTL_SECONDS, PURPOSES, clampTtlSeconds, counterAdvances,
+  createChallenge, consumeChallenge, sweepExpiredChallenges,
+  getOrCreateUserHandle, addCredential, getCredentialById, listCredentials, recordUse, removeCredential,
+};

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.134'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.136'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/goal_author_ui.mjs

@@ -208,3 +208,30 @@ test('wall: both routes still sit behind their permission atoms', () => {
   assert.match(g, /router\.post\('\/goals', auth\.requireBuilder, auth\.requirePermission\('goal\.create'\)/);
   assert.match(d, /router\.post\('\/versions\/:id\/done-when', auth\.requireBuilder, auth\.requirePermission\('criterion\.create'\)/);
 });
+
+// ── 4. creating a task against a goal (task 1003462) ─────────────────────────
+
+test('the task body names the goal and its version and nothing the server owns', () => {
+  const body = lib.buildTaskBody({
+    version_id: ' V9 ', goal_id: '12', title: '  Write it down ', description: ' more ',
+    status: 'ready', requires_rank: 'xenos', credits_reward: 5, created_by: 'x',
+  });
+  assert.deepEqual(plain(body), { version_id: 'V9', goal_id: 12, title: 'Write it down', description: 'more' });
+});
+
+test('an empty description is omitted; the form asks only for goal and name', () => {
+  assert.deepEqual(plain(lib.buildTaskBody({ version_id: 'V9', goal_id: 3, title: 'x', description: '  ' })), { version_id: 'V9', goal_id: 3, title: 'x' });
+  assert.match(lib.taskFormProblem({ goal_id: '', title: 'x' }), /goal/i);
+  assert.match(lib.taskFormProblem({ goal_id: '3', title: ' ' }), /name/i);
+  assert.match(lib.taskFormProblem({ goal_id: '3', title: 'x'.repeat(lib.TITLE_MAX + 1) }), /under/);
+  assert.equal(lib.taskFormProblem({ goal_id: '3', title: 'x' }), null);
+});
+
+test('the task form is wired, reuses the suggester, and states the spec-task wait', () => {
+  const src = read('goal-author.js');
+  assert.match(src, /ga-task/);
+  assert.match(src, /buildTaskBody/);
+  assert.match(src, /\$\{API\}\/tasks`/);
+  assert.match(src, /waits behind/i);
+  assert.ok(!/requires_rank|task\.create/.test(src), 'no client-side authority pre-filter');
+});

package/tests/passkey_foundation_db.mjs

@@ -0,0 +1,90 @@
+// tests/passkey_foundation_db.mjs — task 1004750 (ADR 0382 D1, D6). Real DB.
+// The passkey tables built from the real migration in a throwaway schema, and the
+// store's rules: single-use challenges, TTL, sweep, unique credential ids, sign-count.
+// Self-skips without a reachable Postgres.
+// Run:  DATABASE_URL=... node tests/passkey_foundation_db.mjs
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+const here = dirname(fileURLToPath(import.meta.url));
+
+const pgPool = new Pool({ connectionString: process.env.DATABASE_URL || undefined, max: 1 });
+let client;
+try { client = await pgPool.connect(); } catch (e) {
+  console.log(`passkey_foundation_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pgPool.end().catch(() => {});
+  process.exit(0);
+}
+const SCHEMA = `t1004750_${process.pid}`;
+let pass = 0;
+const ok = (c, m) => { assert.ok(c, m); pass++; console.log(`  ok - ${m}`); };
+
+try {
+  await client.query(`CREATE SCHEMA ${SCHEMA}`);
+  await client.query(`SET search_path TO ${SCHEMA}`);
+  await client.query('CREATE TABLE builders (id bigserial PRIMARY KEY)');
+  await client.query('CREATE TABLE schema_migrations (version text PRIMARY KEY)');
+  await client.query(readFileSync(join(here, '..', 'migrations', 'core_277_passkey_foundation.sql'), 'utf8'));
+  await client.query('INSERT INTO builders DEFAULT VALUES');
+  await client.query('INSERT INTO builders DEFAULT VALUES');
+
+  const pk = require('../src/bongos/passkeys.js');
+  const o = { pool: client };
+
+  const c = await pk.createChallenge({ purpose: 'register', builderId: 1, ...o });
+  ok(typeof c.challenge === 'string' && c.challenge.length >= 40, 'challenge is long random base64url');
+  const got = await pk.consumeChallenge(c.challenge, o);
+  ok(got && got.purpose === 'register' && got.builderId === '1', 'a live challenge is consumed once');
+  ok((await pk.consumeChallenge(c.challenge, o)) === null, 'a second consume (replay) finds nothing');
+
+  const expire = (ch) => client.query("UPDATE passkey_challenges SET expires_at = now() - interval '1 second' WHERE challenge = $1", [ch]);
+  const old = await pk.createChallenge({ purpose: 'authenticate', ...o });
+  await expire(old.challenge);
+  ok((await pk.consumeChallenge(old.challenge, o)) === null, 'an expired challenge is refused');
+  const stale = await pk.createChallenge({ purpose: 'authenticate', ...o });
+  await expire(stale.challenge);
+  const live = await pk.createChallenge({ purpose: 'authenticate', ...o });
+  ok((await client.query('SELECT 1 FROM passkey_challenges WHERE challenge = $1', [stale.challenge])).rowCount === 0, 'issuing a challenge sweeps expired rows');
+  const stale2 = await pk.createChallenge({ purpose: 'authenticate', ...o });
+  await expire(stale2.challenge);
+  ok((await pk.sweepExpiredChallenges(o)) === 1, 'sweep removes only expired challenges');
+  ok((await pk.consumeChallenge(live.challenge, o)) !== null, 'sweep left the live one');
+  await assert.rejects(pk.createChallenge({ purpose: 'nope', ...o }));
+  pass++; console.log('  ok - unknown purpose rejected');
+  await assert.rejects(client.query("INSERT INTO passkey_challenges (challenge, purpose, expires_at) VALUES ('x','bogus', now())"));
+  pass++; console.log('  ok - the table itself refuses an unknown purpose');
+
+  const wrong = await pk.createChallenge({ purpose: 'register', builderId: 1, ...o });
+  ok((await pk.consumeChallenge(wrong.challenge, { ...o, expectPurpose: 'authenticate' })) === null, 'a challenge for another purpose is refused');
+  ok((await pk.consumeChallenge(wrong.challenge, o)) === null, 'and it is spent by the wrong presentation');
+  const b1 = await pk.createChallenge({ purpose: 'register', builderId: 1, ...o });
+  ok((await pk.consumeChallenge(b1.challenge, { ...o, expectBuilderId: 2 })) === null, 'a challenge for another builder is refused');
+  const b2 = await pk.createChallenge({ purpose: 'register', builderId: 1, ...o });
+  ok((await pk.consumeChallenge(b2.challenge, { ...o, expectPurpose: 'register', expectBuilderId: 1 })) !== null, 'matching purpose and builder pass');
+
+  const h1 = await pk.getOrCreateUserHandle(1, o);
+  ok(h1 === await pk.getOrCreateUserHandle(1, o) && h1 !== await pk.getOrCreateUserHandle(2, o), 'user handle is stable per builder and distinct');
+
+  await pk.addCredential({ builderId: 1, credentialId: 'cred-a', publicKey: Buffer.from([1, 2, 3]), transports: ['usb'], nickname: 'card' }, o);
+  await assert.rejects(pk.addCredential({ builderId: 2, credentialId: 'cred-a', publicKey: Buffer.from([9]) }, o));
+  pass++; console.log('  ok - a credential id belongs to one builder');
+  ok((await pk.listCredentials(1, o)).length === 1 && (await pk.listCredentials(2, o)).length === 0, 'credentials listed per builder');
+
+  ok((await pk.recordUse('cred-a', 5, o)).ok, 'sign count advances');
+  ok((await pk.recordUse('cred-a', 5, o)).reason === 'sign_count_regressed', 'a non-advancing counter is refused');
+  ok((await pk.recordUse('cred-a', 3, o)).reason === 'sign_count_regressed' && Number((await pk.getCredentialById('cred-a', o)).sign_count) === 5, 'a lower counter never overwrites the stored one');
+  ok((await pk.recordUse('nope', 1, o)).reason === 'unknown_credential', 'unknown credential reported');
+  ok((await pk.getCredentialById('cred-a', o)).last_used_at != null, 'last_used_at is stamped');
+  ok(!(await pk.removeCredential(2, 'cred-a', o)), 'another builder cannot remove it');
+  ok(await pk.removeCredential(1, 'cred-a', o), 'owner removes it');
+  console.log(`passkey_foundation_db.mjs: ${pass} passed`);
+} finally {
+  await client.query('SET search_path TO public').catch(() => {});
+  await client.query(`DROP SCHEMA IF EXISTS ${SCHEMA} CASCADE`).catch(() => {});
+  client.release();
+  await pgPool.end();
+}

package/tests/passkey_pure.mjs

@@ -0,0 +1,24 @@
+// tests/passkey_pure.mjs — task 1004750 (ADR 0382 D6). DB-free: the pure rules of
+// src/bongos/passkeys.js that the required unit lane can run. The real-SQL half is
+// tests/passkey_foundation_db.mjs.
+import { createRequire } from 'node:module';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const pk = require('../src/bongos/passkeys.js');
+
+let pass = 0;
+const ok = (c, m) => { assert.ok(c, m); pass++; console.log(`  ok - ${m}`); };
+
+ok(pk.PURPOSES.includes('register') && pk.PURPOSES.includes('authenticate') && pk.PURPOSES.length === 2, 'two ceremony purposes');
+ok(pk.clampTtlSeconds(60) === 60, 'a sane TTL passes through');
+ok(pk.clampTtlSeconds(-5) === pk.CHALLENGE_TTL_SECONDS, 'a negative TTL falls back to the default');
+ok(pk.clampTtlSeconds('abc') === pk.CHALLENGE_TTL_SECONDS, 'a non-number falls back to the default');
+ok(pk.clampTtlSeconds(86400) === pk.MAX_CHALLENGE_TTL_SECONDS, 'a huge TTL is capped');
+ok(pk.counterAdvances(0, 0), 'a card with no counter is accepted');
+ok(pk.counterAdvances(5, 6), 'an advancing counter is accepted');
+ok(!pk.counterAdvances(5, 5), 'a repeated counter is refused');
+ok(!pk.counterAdvances(5, 3), 'a lower counter is refused');
+ok(!pk.counterAdvances(5, 0), 'a counter reset to zero is refused');
+await assert.rejects(pk.createChallenge({ purpose: 'bogus', pool: { query: async () => { throw new Error('should not query'); } } }));
+pass++; console.log('  ok - an unknown purpose is rejected before any query');
+console.log(`passkey_pure.mjs: ${pass} passed`);