@bongos/core 1.21.150 → 1.21.152

package/docs/copy-registry.json

@@ -5200,7 +5200,7 @@
       "surface": "builders-hall",
       "text": "Could not load modules.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 361,
+      "line": 373,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -5389,7 +5389,7 @@
       "surface": "builders-hall",
       "text": "Could not reach the submit endpoint.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 340,
+      "line": 352,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -9277,7 +9277,7 @@
       "surface": "builders-hall",
       "text": "No maintenance declared — nobody is on the hook for this module as the core advances.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 92,
+      "line": 104,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9655,7 +9655,7 @@
       "surface": "builders-hall",
       "text": "Not declared in module.json — this is who ships the module.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 62,
+      "line": 63,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9988,7 +9988,7 @@
       "surface": "builders-hall",
       "text": "Nothing to submit — every module here ships with the core.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 301,
+      "line": 313,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -13165,7 +13165,7 @@
       "surface": "builders-hall",
       "text": "Taken out of the store. Your copy keeps working, but it will get no more updates.",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 113,
+      "line": 125,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -16792,7 +16792,7 @@
       "surface": "builders-hall",
       "text": "built here",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 53,
+      "line": 54,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -16972,7 +16972,7 @@
       "surface": "builders-hall",
       "text": "delisted · no more updates",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 113,
+      "line": 125,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -18061,7 +18061,7 @@
       "surface": "builders-hall",
       "text": "restart it",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 129,
+      "line": 141,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -18277,7 +18277,7 @@
       "surface": "builders-hall",
       "text": "submit for review",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 175,
+      "line": 187,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -18808,7 +18808,7 @@
       "surface": "builders-hall",
       "text": "upkeep undeclared",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 92,
+      "line": 104,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -18889,7 +18889,7 @@
       "surface": "builders-hall",
       "text": "waits for a restart",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 127,
+      "line": 139,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19204,7 +19204,7 @@
       "surface": "builders-hall",
       "text": "{…} and above can enable or disable a module",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 173,
+      "line": 185,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19555,7 +19555,7 @@
       "surface": "builders-hall",
       "text": "{…} {…} — how-to",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 416,
+      "line": 428,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -19627,7 +19627,7 @@
       "surface": "builders-hall",
       "text": "{…} — how to use it",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 418,
+      "line": 430,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -19762,7 +19762,7 @@
       "surface": "builders-hall",
       "text": "· version",
       "file": "modules/hall-ui/public/modules.js",
-      "line": 421,
+      "line": 433,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -3137,5 +3137,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.148 with no explicit bump. run 39329687123. (task 1002620)
   1.21.150 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.149 with no explicit bump. run 39331860470. (task 1002620)
+  1.21.151 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.150 with no explicit bump. run 39667670641. (task 1002620)
+  1.21.152 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.151 with no explicit bump. run 39671625798. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -83,6 +83,8 @@ Every module must have a `module.json` at its root (`modules/<key>/module.json`)
                                       //   what update, rollout channels and re-assessment name (task 1003781).
   "coreVersion": "^1.4.0",           // REQUIRED. semver range of CORE_VERSION this module supports.
   "default":     false,               // OPTIONAL (default false). Fail-safe when no config names it.
+  "category":    { "parent": "communication", "sub": "team-chat" }, // OPTIONAL. Where it is browsed (ADR 0342):
+                                      //   parent is one of the eight; sub is an approved sub-category, absent while pending.
   "author":      "…",                 // OPTIONAL. Attribution (ADR 0107 §2) — portable, not a cross-Bongos FK.
   "origin":      "…",                 // OPTIONAL. Origin instance/project this module was built in.
   "license":     "AGPL-3.0",          // OPTIONAL. License this module is offered under.
@@ -120,6 +122,33 @@ Every module must have a `module.json` at its root (`modules/<key>/module.json`)
 
 An unknown key throws at validate time — typos fail loud (top-level attribution fields have no closed allowlist; only `contributes` sub-keys do).
 
+### `category` — where a module is browsed and compared ([ADR 0342](adr/0342-module-categories-are-eight-parents-with-approved-sub-categories.md))
+
+`"category": { "parent": "<key>", "sub": "<key>" }`. `parent` is one of eight fixed keys, and any
+other value fails validation:
+
+| `parent` | Shown as |
+|---|---|
+| `work` | Work & planning |
+| `people` | Team & people |
+| `quality` | Quality & review |
+| `money` | Money |
+| `communication` | Communication |
+| `pages` | Pages & design |
+| `hosting` | Hosting & deploy |
+| `knowledge` | Knowledge |
+
+`sub` is the module's one sub-category: the narrow set of modules it actually competes with, which
+is where the store's ranking and its cap of ten apply. It must be a kebab-case key. Leave it out
+while a new sub-category waits for a Metic+ approval; the module is then listed under its parent
+only. The schema checks the sub-category's shape, not whether it has been approved. The block has
+just these two keys, so a second sub-category is an error.
+
+Every bundled module declares a parent (pinned by `tests/module_manifest.mjs`), and none declares a
+sub-category yet. `GET /modules`, `bongos module list` (the CATEGORY column) and the hall Modules tab
+all read the row's `category` (`{ parent, parentTitle, sub }`, or `null`) from
+`src/module-loader/catalog.js`, and the search on both surfaces matches it.
+
 ### `spend` — "my surfaces spend real money for whoever calls them" ([ADR 0282](adr/0282-a-module-that-spends-for-its-callers-declares-a-payer-and-the-core-refuses-it-without-one.md))
 
 Declare `"spend": { "requiresPayer": true }` when a route of yours can spend money on behalf of the

package/docs/page-readings.json

@@ -5,7 +5,7 @@
   "adr": "0341 D3",
   "reread": "node scripts/gds/page-reader.js --stale",
   "how": ["Generated by node scripts/gds/page-reader.js (BV2.TW04, task 1004315; ADR 0341 D3). Do not hand-edit.","One entry per page of docs/page-inventory.json. Lines are in page order: the default state first, and a line only another state shows sits where that state shows it, with its state named.","placement: placed = a docs/copy-registry.json row renders it (file, line, string_id); shared = shell text every page of the surface carries (top bar, sidebar, footer), with its row when the registry has one; unplaced = the registry cannot place it (a rewrite becomes an engineer task, ADR 0341 D4).","text keeps {…} where the registry row has a hole, or where a value the page read from its API was filled in. A string that is only such data is counted under omitted.data, not listed.","reading_hash is over the non-shared lines (key, section, text); files_hash is over the page's inventory files. --check compares files_hash only and never opens a browser.","Rendered through the hall-preview harness (hall) and the ui-design kit stub (landing, status), at 1280x800 with the clock pinned, so a reading is the fixture world's page."],
-  "counts": {"pages":46,"lines":5554,"placed":1701,"shared":398,"unplaced":3455,"omitted_data":3576},
+  "counts": {"pages":46,"lines":5555,"placed":1702,"shared":398,"unplaced":3455,"omitted_data":3591},
   "pages": [
     {
       "id": "builders:atlas",
@@ -1885,10 +1885,10 @@
       "surface": "builders",
       "title": "Modules",
       "states_read": ["browse","search-empty","lens","details","out"],
-      "files_hash": "cb3129f7cdb72342",
-      "reading_hash": "e37d27e205c7ba63",
-      "counts": {"lines":48,"placed":19,"shared":8,"unplaced":21},
-      "omitted": {"data":76},
+      "files_hash": "e878f38787714158",
+      "reading_hash": "819811b4ef5cfa9a",
+      "counts": {"lines":49,"placed":20,"shared":8,"unplaced":21},
+      "omitted": {"data":91},
       "notes": ["details: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood"],
       "lines": [
         {"key":"L0001","section":"skip link","text":"Skip to content","placement":"shared","file":"modules/hall-ui/public/shell.js","line":872,"string_id":"87cee78ca134"},
@@ -1912,33 +1912,34 @@
         {"key":"L0019","section":"Module catalog","text":"modules","placement":"unplaced"},
         {"key":"L0020","section":"Module catalog","text":"16 from the {…}","placement":"unplaced"},
         {"key":"L0021","section":"Module catalog","text":"of {…}","placement":"placed","file":"modules/hall-ui/public/roadmap.js","line":341,"string_id":"5e7a2220c6a9"},
-        {"key":"L0022","section":"Module catalog","text":"built here","placement":"placed","file":"modules/hall-ui/public/modules.js","line":53,"string_id":"a87a3c30b1b5","occurrences":17},
+        {"key":"L0022","section":"Module catalog","text":"built here","placement":"placed","file":"modules/hall-ui/public/modules.js","line":54,"string_id":"a87a3c30b1b5","occurrences":17},
         {"key":"L0023","section":"Module catalog","text":"can go upstream","placement":"unplaced"},
         {"key":"L0024","section":"Module catalog","text":"no upkeep","placement":"unplaced"},
         {"key":"L0025","section":"Module catalog","text":"every module owned","placement":"unplaced"},
         {"key":"L0026","section":"Module catalog","text":"Shipped with the core","placement":"placed","file":"modules/hall-ui/public/modules.html","line":59,"string_id":"b94a6b5b3d8c"},
         {"key":"L0027","section":"Module catalog","text":"No catalog module matches that {…}.","placement":"unplaced","state":"search-empty"},
         {"key":"L0028","section":"Module catalog","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","occurrences":12},
-        {"key":"L0029","section":"Module catalog","text":"by","placement":"unplaced","occurrences":17},
-        {"key":"L0030","section":"Module catalog","text":"upkeep","placement":"unplaced","occurrences":17},
-        {"key":"L0031","section":"Module catalog","text":"{…} project{…}","placement":"placed","file":"modules/hall-ui/public/fleet.js","line":39,"string_id":"771bef3d31b5","occurrences":3},
-        {"key":"L0032","section":"Module catalog","text":"from","placement":"unplaced","occurrences":2},
-        {"key":"L0033","section":"Module catalog","text":"{…}-loaded","placement":"unplaced"},
-        {"key":"L0034","section":"Module catalog","text":"{…} file{…}","placement":"placed","file":"modules/hall-ui/public/gate.js","line":151,"string_id":"3efa67dc6e07"},
-        {"key":"L0035","section":"Module catalog","text":"sessions","placement":"placed","file":"modules/hall-ui/public/task.js","line":467,"string_id":"732b4c935e36"},
-        {"key":"L0036","section":"Module catalog","text":"Built by this project","placement":"placed","file":"modules/hall-ui/public/modules.html","line":70,"string_id":"b51edc826cbe"},
-        {"key":"L0037","section":"Module catalog","text":"submit for review","placement":"placed","file":"modules/hall-ui/public/modules.js","line":175,"string_id":"0215b2cdca8c"},
-        {"key":"L0038","section":"Module catalog","text":"A module built here can be submitted upstream for review, so it can join the shared catalog with your name and this project credited.","placement":"placed","file":"modules/hall-ui/public/modules.html","line":74,"string_id":"2e17d7e236d9"},
-        {"key":"L0039","section":"footer","text":"Sign out","placement":"shared","file":"modules/hall-ui/public/shell.js","line":520,"string_id":"1883ad7f07fc"},
-        {"key":"L0040","section":"Module catalog","text":"Builders hall · this session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":810,"string_id":"fd1903586e8e"},
-        {"key":"L0041","section":"What are you doing now?","text":"What are you doing now?","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":811,"string_id":"60853319f290"},
-        {"key":"L0042","section":"What are you doing now?","text":"Pick one. You can switch any time from the top bar.","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":812,"string_id":"4f87d5b17b54"},
-        {"key":"L0043","section":"What are you doing now?","text":"Building","placement":"unplaced"},
-        {"key":"L0044","section":"What are you doing now?","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","occurrences":3},
-        {"key":"L0045","section":"What are you doing now?","text":"Artistry","placement":"unplaced"},
-        {"key":"L0046","section":"What are you doing now?","text":"Ideating","placement":"unplaced"},
-        {"key":"L0047","section":"What are you doing now?","text":"Turn thoughts into {…}.","placement":"unplaced"},
-        {"key":"L0048","section":"What are you doing now?","text":"Ask me again next session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":815,"string_id":"fa86bf403775"}
+        {"key":"L0029","section":"Module catalog","text":"in","placement":"placed","file":"modules/hall-ui/public/settings-specialities.js","line":130,"string_id":"4b0ca7d7171f","occurrences":15},
+        {"key":"L0030","section":"Module catalog","text":"by","placement":"unplaced","occurrences":17},
+        {"key":"L0031","section":"Module catalog","text":"upkeep","placement":"unplaced","occurrences":17},
+        {"key":"L0032","section":"Module catalog","text":"{…} project{…}","placement":"placed","file":"modules/hall-ui/public/fleet.js","line":39,"string_id":"771bef3d31b5","occurrences":3},
+        {"key":"L0033","section":"Module catalog","text":"from","placement":"unplaced","occurrences":2},
+        {"key":"L0034","section":"Module catalog","text":"{…}-loaded","placement":"unplaced"},
+        {"key":"L0035","section":"Module catalog","text":"{…} file{…}","placement":"placed","file":"modules/hall-ui/public/gate.js","line":151,"string_id":"3efa67dc6e07"},
+        {"key":"L0036","section":"Module catalog","text":"sessions","placement":"placed","file":"modules/hall-ui/public/task.js","line":467,"string_id":"732b4c935e36"},
+        {"key":"L0037","section":"Module catalog","text":"Built by this project","placement":"placed","file":"modules/hall-ui/public/modules.html","line":70,"string_id":"b51edc826cbe"},
+        {"key":"L0038","section":"Module catalog","text":"submit for review","placement":"placed","file":"modules/hall-ui/public/modules.js","line":187,"string_id":"0215b2cdca8c"},
+        {"key":"L0039","section":"Module catalog","text":"A module built here can be submitted upstream for review, so it can join the shared catalog with your name and this project credited.","placement":"placed","file":"modules/hall-ui/public/modules.html","line":74,"string_id":"2e17d7e236d9"},
+        {"key":"L0040","section":"footer","text":"Sign out","placement":"shared","file":"modules/hall-ui/public/shell.js","line":520,"string_id":"1883ad7f07fc"},
+        {"key":"L0041","section":"Module catalog","text":"Builders hall · this session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":810,"string_id":"fd1903586e8e"},
+        {"key":"L0042","section":"What are you doing now?","text":"What are you doing now?","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":811,"string_id":"60853319f290"},
+        {"key":"L0043","section":"What are you doing now?","text":"Pick one. You can switch any time from the top bar.","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":812,"string_id":"4f87d5b17b54"},
+        {"key":"L0044","section":"What are you doing now?","text":"Building","placement":"unplaced"},
+        {"key":"L0045","section":"What are you doing now?","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","occurrences":3},
+        {"key":"L0046","section":"What are you doing now?","text":"Artistry","placement":"unplaced"},
+        {"key":"L0047","section":"What are you doing now?","text":"Ideating","placement":"unplaced"},
+        {"key":"L0048","section":"What are you doing now?","text":"Turn thoughts into {…}.","placement":"unplaced"},
+        {"key":"L0049","section":"What are you doing now?","text":"Ask me again next session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":815,"string_id":"fa86bf403775"}
       ]
     },
     {

package/modules/agents/module.json

@@ -4,6 +4,7 @@
   "description": "Declarative agent definitions (.claude/agents/*.md) reconciled at deploy into a DB-backed registry (agents_definitions) plus a per-fire ledger (agents_runs) — BONGOS-V1 goal 1000038, Phase 1. Files-are-source: agents-sync upserts file-sourced definitions and never clobbers an instance-authored db row, and stamps author_rank from the author's LIVE DB rank because a committed file cannot grant authority (ADR 0016). Spawns consume the EXISTING `grade` port (runSubagentCached), which is fixed read-only, so v1 agents are observe-and-report only — no write principals — and every fire bills through the shared LLM cost cache. default:false: shipped is not enabled, and an instance opts in per ADR 0083. spend.requiresPayer (task 1003884): a fire spends real money for whoever called it (~$0.90, and POST /agents/:name/invoke answers 202 without waiting), so the core refuses to ENABLE this module on an instance whose join door is `open` with no payer configured — an account created seconds ago would otherwise spend the instance's money with nobody to bill. Every run then records its payer beside cost_usd (agents_002_payer.sql) and a per-payer monthly ceiling fails closed when it is exhausted OR unreadable (lib/spend-ceiling.js) — distinct from lib/fire-budget.js, which stays a rate ceiling.",
   "version": "1.0.0",
   "coreVersion": "^1.19.0",
+  "category": { "parent": "work" },
   "default": false,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["agents"], "pollers": ["event-router"], "migrations": true },

package/modules/autonomy/module.json

@@ -4,6 +4,7 @@
   "description": "The Multi-Agent System's autonomy surfaces (ADR 0024): the $0 deterministic autonomy gate (System 3 — a precheck route + the gate CLI, inert until OTB_AUTONOMY_ENABLED=1), the conductor mid-flight dispatch CLI (Phase 4), the Architect bounded first-principles --scope audit CLI (Phase 5), and the in-process routine timers (System 4 / ADR 0078 amendment — the weekly peer-vote-tally poller). A core-domain module carved out of the GDS core in BV1.R83 (ADR 0093 §1); default-on because the autonomy machinery + the durable routine timer ship to every instance (both are inert/no-op until armed or the pool is reachable). Cross-cutting: it OBSERVES lifecycle events. The routine timer reaches the lifecycle `tallyPeerVotes` capability through the published doorway (a tracked lifecycle leak until R86), never a core require; the precheck route + the gate/conductor/architect CLIs travel with this domain (the CLIs stay under scripts/, outside the kernel boundary, so they may still read the ideas/economy/lifecycle signals + the grader directly). Registers no port — core never calls back in.",
   "version": "1.0.0",
   "coreVersion": "^1.11.0",
+  "category": { "parent": "work" },
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": {

package/modules/builder-settings/module.json

@@ -4,6 +4,7 @@
   "description": "The per-builder PREFERENCE domain — the wandering knob (how readily the agent opens off-task threads, rank-clamped), per-skill model ceilings, per-sound + per-event-sound on/off, and the render-widgets toggle — plus builder-needs (the 'the system needs an input from you' list). A core-domain module carved out of the GDS core in BV1.R80 (ADR 0093 §1); default-on because every instance configures its own builders. The `/me/*-prefs` routes mount here; the `GET /me` aggregator stays a thin core facade that resolves the `builder-settings` kernel PORT for its wandering/render/needs slices (02-module-map §2).",
   "version": "1.0.0",
   "coreVersion": "^1.8.0",
+  "category": { "parent": "people" },
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["settings"] },

package/modules/copy-desk/module.json

@@ -4,6 +4,7 @@
   "description": "The COPY half of the design contract (goal 1000074, the artist's loop). Named for the editorial desk copy passes over before it is published — which is exactly the job, and which keeps the module key off the generic word 'copy' that the branding contract already owns (branding.copy.tagline/hallName/notFound). ADR 0081 made the repo the source of truth for design TOKENS and component surfaces; there was no equivalent for user-facing TEXT. This module owns that half: the FLAG — anyone, in any role, marks a string or a whole surface as needing an artist's attention, with a required reason — and the QUEUE an artist reads it from. The inventory a flag points at is the committed registry docs/copy-registry.json, generated by scripts/gds/copy-inventory.js (R01); this module reads it and never writes it. R03 (task 1003114) added the PROPOSAL: an artist writes the replacement wording and it becomes a GDS task carrying a patch, which scripts/gds/copy-apply.js lands as a real diff under a claim — the design half's adapter.export() contract (ADR 0081) applied to text. NO LIVE CMS is the goal's hard non-goal: nothing here can change a rendered string. A flag is a work request; a proposal is a work request with a suggested fix; the fix ships as a claimed, graded GDS task like every other change. default-on — every instance shows a person words, so every instance can flag them.",
   "version": "1.0.0",
   "coreVersion": "^1.8.0",
+  "category": { "parent": "quality" },
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["copy-desk", "copy-desk-artist"], "migrations": true, "skills": ["tweak"] },

package/modules/design-styles/module.json

@@ -4,6 +4,7 @@
   "description": "The thirteen design-STYLE skills split out of ui-design (task 1004470, owner ruling on blocker 1000139): the taste core (design-taste-frontend, high-end-visual-design, redesign-existing-projects), the impeccable craft method, the /style session, the four looks (minimalist-ui, industrial-brutalist-ui, gpt-taste, stitch-design-taste) and the image family (image-to-code, imagegen-frontend-web, imagegen-frontend-mobile, brandkit). Every one is an in-house rebuild or a first-party original (ADR 0220, ADR 0231), carrying the PLATFORM PREAMBLE from skills/PREAMBLE.md and governed by the vendoring policy in skills/policy.json (ADR 0198). ui-design keeps the method every instance needs — /design, the two sync skills, the contract, the kit and the style library (modules/ui-design/styles/, which these skills name as their palette source) — and stays default-on; these are opt-in because their descriptions alone are ~5,000 chars resident in every session. /design names them when this module is on and says plainly that they are off when it is not. Declaration-only: no routes, no migrations, no port.",
   "version": "1.0.0",
   "coreVersion": "^1.19.0",
+  "category": { "parent": "pages" },
   "default": false,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "skills": ["design-taste-frontend", "high-end-visual-design", "redesign-existing-projects", "impeccable", "style", "minimalist-ui", "industrial-brutalist-ui", "gpt-taste", "stitch-design-taste", "image-to-code", "imagegen-frontend-web", "imagegen-frontend-mobile", "brandkit"] },

package/modules/discord/module.json

@@ -4,6 +4,7 @@
   "description": "Outbound ship broadcast + the inbound #ideas/#bugs bot + the #support answerer + role-sync + channel management + account-link state. Mirror only, never authority (ADR 0033).",
   "version": "1.0.0",
   "coreVersion": "^1.4.0",
+  "category": { "parent": "communication" },
   "default": false,
   "maintenance": { "status": "core-maintained" },
   "contributes": {

package/modules/economy/module.json

@@ -4,6 +4,7 @@
   "description": "Credit allocation (the cost-plus + kind-multiplier reward model), the cost ledger + dashboard rollups, builder streaks, achievements/gamification, and the leaderboard. A core-domain module carved out of the GDS core in BV1.R77 (ADR 0093 §1-2); default-on because every instance rewards its own builders. Registers the `reward` kernel PORT the lifecycle resolves at confirm/ship/claim time.",
   "version": "1.0.0",
   "coreVersion": "^1.7.0",
+  "category": { "parent": "money" },
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["cost", "credits", "earnings", "leaderboard", "reward"] },

package/modules/government/module.json

@@ -4,6 +4,7 @@
   "description": "Discord-style configurable ranks and permissions (ADR 0151, BONGOS-V1 goal 1000030; renamed governance\u2192government by ADR 0174). Permissions are the atomic authority unit and the four ranks (xenos/thetes/metic/archon) are the positions in the government; this module owns the code-defined permission catalog (each key flagged `system` = trust-boundary, `substrate` = enforced out of band, or operational = delegable) plus the compatibility seed that reproduces the rank thresholds exactly. A core-domain module, default-on: a Cloud Bongos instance ships configurable ranks the way it ships its status page. The word `role` is deliberately absent here \u2014 it is reserved for the three crafts (Artist, Ideator, Builder). Preserves ADR 0016 (authority resolved server-side, per request, uncached).",
   "version": "1.0.0",
   "coreVersion": "^1.18.0",
+  "category": { "parent": "people" },
   "default": true,
   "maintenance": {
     "status": "core-maintained"

package/modules/grading/module.json

@@ -4,6 +4,7 @@
   "description": "The grade-a-diff adversarial worker panel (Narc/Quality/Hacker/Efficiency) + deterministic route-rank/permission-path pre-passes + the scoring rubric. A core-domain module carved out of the GDS core in BV1.R73 (ADR 0091); default-on because every instance grades its own ships. Registers the `grade` kernel PORT the lifecycle resolves at confirm/ship time.",
   "version": "1.0.0",
   "coreVersion": "^1.6.0",
+  "category": { "parent": "quality" },
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": {

package/modules/hall-ui/module.json

@@ -4,6 +4,7 @@
   "description": "The authenticated builders' hall served at builders.<apex> (builders.example.com) — the roster, work board, standing/karma, leaderboard, achievements, primer, system maps, settings, and the Archon-only watch/gate pages, all polling /api/bongos/* and the read-only /api/bongos/public/* surface. The largest WEB-SURFACE core-domain module (~13k LOC), carved out of the GDS core in BV1.R85 (ADR 0093 §1; 02-module-map §6). default-on: a Cloud Bongos instance ships its hall like it ships its status page. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir). Unlike the generic status surface, the hall keeps its dedicated serving block in serve-internal.js (the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection) — the webSurfaces declaration is the discovery + scope-map + window.__MODULES__ record; serve-internal serves it from this module's public/ dir with that richer machinery. The me/public/leaderboard read endpoints it renders stay SHARED core in routes/{me,public,builders}.js (the status surface + the off-box mirror read them too).",
   "version": "1.0.0",
   "coreVersion": "^1.11.0",
+  "category": { "parent": "pages" },
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": {

package/modules/hall-ui/public/modules.js

@@ -3,8 +3,9 @@
 // ADR 0107 §9 (task 1776) + §2/§3 the browsable catalog (task 1001772);
 // redesigned onto the oversight family's row in task 1003472. Jobs:
 //   1. BROWSE the catalog — every module the core ships that this instance can
-//      enable, each with its author + origin credit, filterable by one search
-//      over name/author/origin/licence and a state lens. Split from the
+//      enable, each with its author + origin credit and its category (ADR 0342),
+//      filterable by one search over name/author/origin/licence/category and a
+//      state lens. Split from the
 //      instance's OWN modules by `source` (which TREE it ships from — the core
 //      package or this repo), which GET /api/bongos/modules reads structurally
 //      off the loader's discovery roots. That is a different axis from
@@ -73,7 +74,8 @@
   function matchesQuery(m, q) {
     if (!q) return true;
     const credit = m.credit || {};
-    return [m.key, m.title, m.description, credit.author, credit.origin, m.license]
+    const cat = m.category || {};
+    return [m.key, m.title, m.description, credit.author, credit.origin, m.license, cat.parentTitle, cat.sub]
       .some((f) => f && String(f).toLowerCase().includes(q));
   }
   function matchesLens(m) {
@@ -82,6 +84,16 @@
     return true;
   }
 
+  // Where the module is browsed (ADR 0342): the parent's label, and the
+  // sub-category once one is approved. The label comes from the server's row
+  // (catalog.js), so the hall keeps no copy of the parent list.
+  function categoryFact(m) {
+    const c = m.category;
+    if (!c || !c.parentTitle) return '';
+    const sub = c.sub ? ` · ${escapeHtml(c.sub)}` : '';
+    return `<span class="ov-fact">in <b>${escapeHtml(c.parentTitle)}</b>${sub}</span>`;
+  }
+
   // Upkeep posture (ADR 0107 §7 / ADR 0166) — who keeps this module true as the
   // core advances. Colour marks the EXCEPTION: an unowned entry is the thing the
   // policy exists to catch, so it is the warn pill; a maintained one is a plain
@@ -185,7 +197,7 @@
         <div class="ov-row__main">
           <span class="ov-row__title">${escapeHtml(m.title || m.key)}<span class="ov-mono">${escapeHtml(m.key)}</span></span>
           ${desc ? `<p class="ov-row__sub mod-row__desc">${escapeHtml(desc)}</p>` : ''}
-          <div class="ov-row__facts">${provenancePill(m)}${attributionFacts(m)}${upkeepFact(m)}${howtoFact(m)}${delistedFact(m)}${restartFact(m)}</div>
+          <div class="ov-row__facts">${provenancePill(m)}${categoryFact(m)}${attributionFacts(m)}${upkeepFact(m)}${howtoFact(m)}${delistedFact(m)}${restartFact(m)}</div>
           ${lines ? `<details class="mod-more"${openKeys.has(m.key) ? ' open' : ''}><summary aria-label="Details for ${escapeHtml(m.title || m.key)}"></summary>${lines}</details>` : ''}
         </div>
         <div class="ov-row__right mod-row__right">${rightHtml(m)}</div>

package/modules/ideas/module.json

@@ -4,6 +4,7 @@
   "description": "The idea inbox (capture, triage, criterion-proposal ratification) and the blockers queue — the methodology surfaces that feed the backlog. A core-domain module carved out of the GDS core in BV1.R78 (ADR 0093 §1); default-on because every instance captures ideas and tracks what's stuck on its owner. Registers the `ideas.capture` kernel PORT the discord #ideas inbound resolves (ADR 0093 §5 — retiring the temporary `captureIdea` doorway leak).",
   "version": "1.0.0",
   "coreVersion": "^1.8.0",
+  "category": { "parent": "work" },
   "default": true,
   "maintenance": {
     "status": "core-maintained"

package/modules/lifecycle/module.json

@@ -4,6 +4,7 @@
   "description": "The build state machine \u2014 tasks \u00b7 claims \u00b7 versions \u00b7 done-when criteria \u00b7 goals \u00b7 dependencies \u00b7 the claim\u2192ship\u2192grade\u2192credit lifecycle \u00b7 override requests \u00b7 the ship/confirm/promote orchestration \u00b7 github-push + merge-lease + conflict-resolve + the publish reconciler. The LAST and most-coupled core domain carved out of the GDS core in BV1.R86 (ADR 0093 \u00a71,\u00a73, 02-module-map \u00a74 \u2014 kept whole, never split). default-on; every instance runs the lifecycle. Registers the `lifecycle` kernel PORT (createTask \u00b7 VOTABLE_TASK_STATUSES \u00b7 classifyTaskKind \u00b7 tallyPeerVotes + the work-tracking reads) that core read routes + the ideas/discord/autonomy modules resolve. As a transaction-participant it RESOLVES the `reward` + `onboarding` ports inside its claim/ship/confirm txns \u2014 but via resolveOptional (graceful, like sessions\u2192reward), so consumes is empty: a vanilla instance without those modules degrades the credit/onboarding writes to best-effort no-ops, it does not fail.",
   "version": "1.0.0",
   "coreVersion": "^1.12.0",
+  "category": { "parent": "work" },
   "default": true,
   "maintenance": {
     "status": "core-maintained"

package/modules/memory/module.json

@@ -4,6 +4,7 @@
   "description": "Per-builder session memory, the lexical recall/search retrieval layer (ADR 0060), and durable learnings. A core-domain module carved out of the GDS core in BV1.R72 (ADR 0091); default-on because every instance needs the build system's memory.",
   "version": "1.0.0",
   "coreVersion": "^1.5.0",
+  "category": { "parent": "knowledge" },
   "default": true,
   "maintenance": {
     "status": "core-maintained"

package/modules/npm-release/module.json

@@ -4,6 +4,7 @@
   "description": "The deploy page for a project that publishes an npm package from its GitHub repo — where every recently shipped task has got to (not merged, merged, in a version, live, released) and each version's list of work, read from the release notes the package itself carries (task 1002622) — and the same line on a task's own page (task 1004301). Built for the Bongos hall, which publishes @bongos/core; off everywhere else.",
   "version": "1.0.0",
   "coreVersion": "^1.19.0",
+  "category": { "parent": "hosting" },
   "default": false,
   "author": "Cloud Bongos",
   "origin": "Cloud Bongos core",

package/modules/onboarding/module.json

@@ -4,6 +4,7 @@
   "description": "The newcomer ADMISSION + ORIENTATION domain — the public access-request → Archon-approval gate, the server-ticked onboarding state machine (the 'Path into the City' checklist that graduates a Xenos to Thetes), the friction analyzer (feedback-without-asking on consented onboarding transcripts), and the evergreen newcomer-chore restock (a fresh first-builder task is always waiting). A core-domain module carved out of the GDS core in BV1.R81 (ADR 0093 §1); default-on because every instance onboards its own builders. The access-requests admission routes mount here; the core lifecycle (db.js claim/ship), auth callbacks, and the me/builders profile readers resolve the `onboarding` kernel PORT for the state-machine + restock surface they need — never importing the module.",
   "version": "1.0.0",
   "coreVersion": "^1.19.532",
+  "category": { "parent": "people" },
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["onboarding"], "migrations": true },

package/modules/page-notes/module.json

@@ -4,6 +4,7 @@
   "description": "An artist's feedback doc on one hall page (task 1004496, goal 1000095 WA6). In Artistry mode the palette button opens a doc for the page you are on: as long as it needs to be, with uploaded reference images (PNG, JPG, GIF, WebP, up to 4 MB, eight per doc). On submit an AI splits it into separate ideas in the idea inbox, each attributed to the artist and linking back to the doc, and the doc stays as the page's design reference, readable from the page (?note=N) and from every idea it became. Owner decisions 2026-10-04: an AI splits it; images only. Kept apart from the copy desk on purpose: that module may hold no wording, and a feedback doc is wording about a page (not of it). default-on, like the copy desk: every instance has pages an artist can comment on.",
   "version": "1.0.0",
   "coreVersion": "^1.19.0",
+  "category": { "parent": "pages" },
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "migrations": true,

package/modules/pixel-art/module.json

@@ -4,6 +4,7 @@
   "description": "The five pixel-art SKILLS an instance with a pixel-art world turns on: otb-tile-generate, otb-design-review, otb-character-review, otb-feedback-capture and otb-figma-sync (task 1004470, owner ruling on blocker 1000139). They were orphans in the core's .claude/skills/: docs attributed them to art-pipeline / character-anim, neither of which has a module.json (ADR 0272), and modules/art-pipeline/ never publishes because it carries copyrighted reference maps (ADR 0098). This module carries ONLY the skill text, never a reference map, a palette, a rubric or the generation pipeline — those stay with the instance's own art-pipeline host module, which the skills read at their documented paths. default: false because most instances have no pixel-art world, and every skill description is resident in every session whether it is used or not. Declaration-only: no routes, no migrations, no port, so turning it off withdraws only these skills.",
   "version": "1.0.0",
   "coreVersion": "^1.19.0",
+  "category": { "parent": "pages" },
   "default": false,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "skills": ["otb-tile-generate", "otb-design-review", "otb-character-review", "otb-feedback-capture", "otb-figma-sync"] },

package/modules/platform-identity/module.json

@@ -4,6 +4,7 @@
   "description": "The Cloud Bongos hub identity-provider surface (ADR 0141): platform accounts, an SSO client registry, and an OAuth authorization-code login handoff so one platform account reaches any hosted project's builders hall with no second GitHub sign-in. Identity ONLY — the hub never mints or carries rank/credits/admission (the ADR 0016 trust boundary). Enabled ONLY on the hub instance (cloudbongos.com); ordinary hosted + self-hosted instances leave it off, so it adds zero attack surface for the common case.",
   "version": "1.0.0",
   "coreVersion": "^1.14.0",
+  "category": { "parent": "people" },
   "default": false,
   "author": "Cloud Bongos",
   "origin": "Cloud Bongos platform (cloudbongos.com)",

package/modules/provisioning/module.json

@@ -4,6 +4,7 @@
   "description": "Stand up + operate a Cloud Bongos instance's own infrastructure (server, database, domain, DNS, TLS) via the API, so an owner does not manage infra by hand (ADR 0111). Owns the web-tier REQUEST + STATE surface only: it enqueues provisioning intents + reads instance state — it holds NO cloud-provider tokens and calls NO cloud API. A separate control-plane runner (scripts/gds/provision.js, task P3) is the sole token-holder that drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute WORKLOADS.",
   "version": "1.0.0",
   "coreVersion": "^1.14.0",
+  "category": { "parent": "hosting" },
   "default": false,
   "author": "Cloud Bongos",
   "origin": "Cloud Bongos core",

package/modules/public-landing/module.json

@@ -4,6 +4,7 @@
   "description": "The instance's public front door served at the APEX ROOT — the landing page (/), the projects hub (/projects, and the /create redirect into its ?view=new wizard), the three footer doors (/privacy, /terms, /contact) and every asset behind them. The third WEB-SURFACE core-domain module after status-ui (BV1.R84) and hall-ui (BV1.R85), carved in task 1003322 (ADR 0218; named in ADR 0197 §8 — the front door keeps its own key, because a customer of the ui-design capability is not part of it). default-on: an instance ships its front door like it ships its hall. Registers no port and contributes no routes — it declares a webSurface, and where hall-ui and status-ui name a Host PREFIX this one declares apexRoot:true, since the apex is whatever host is left once the subdomains are taken (ADR 0218 §2; host:\"\" is rejected, because every host string startsWith \"\"). Like the hall, the declaration is the discovery + scope-map + window.__MODULES__ record: the bytes are served by platform-server.js's dedicated landing block, which keeps the apex-only sentinel strip, the branding-token stamp and the ?v= content stamp and only re-points its root at this module's public/ dir. Disabling the module removes the front door outright — the apex then answers the game-less 404 tail. The world it renders (DESIGN.md, the token contract, the direction records) is the INSTANCE's; the method for building one stays in modules/ui-design/.",
   "version": "1.0.0",
   "coreVersion": "^1.19.0",
+  "category": { "parent": "pages" },
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": {

package/modules/render-deploy/module.json

@@ -4,6 +4,7 @@
   "description": "The deploy page for a project whose app deploys through Render: the service's Render deploys, each tied to its commit and the Bongos tasks it carried, what is live now, and deploy and roll back behind a two-step confirm (task 1004270). Off in every hall until its owner turns it on.",
   "version": "1.0.0",
   "coreVersion": "^1.19.0",
+  "category": { "parent": "hosting" },
   "default": false,
   "author": "Cloud Bongos",
   "origin": "Cloud Bongos core",

package/modules/security/module.json

@@ -4,6 +4,7 @@
   "description": "The red-team / vulnerability-report intake and the bounty payout system (rank-gated Metic+): the /builder-redteam skill files a report, the Archon dashboard adjudicates (confirm/dispute/fix/link-fix), and the env-aware bounty table sets the per-severity drachmae payout. A core-domain module carved out of the GDS core in BV1.R79 (ADR 0093 §1; 02-module-map §5 — security-the-FEATURE, NOT security-the-property, which stays kernel). default-on because every instance can take red-team reports. Registers the `security` kernel PORT the core /public/bounty-table resolves for the payout schedule. Also owns the scan-before-install surface (goal 1000055): the artifact-scan engine (quarantine/manifest/mirror) and the security_tool_scans record — POST Metic+, GET every rank.",
   "version": "1.0.0",
   "coreVersion": "^1.8.0",
+  "category": { "parent": "quality" },
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["reports", "scans"], "migrations": true },

package/modules/sessions/module.json

@@ -4,6 +4,7 @@
   "description": "The session-records corpus + its data plane (POST /sessions upload, the Archon-gated cross-builder /sessions/search + /sessions/:id deep-dive + /sessions/upload-health, the server-side signal that a builder's session uploads have silently stopped), the BFG 'read-the-room' cross-builder scorer (ADR 0026 §6B), and the session-pulse / stale-claim heartbeat helpers. A core-domain module carved out of the GDS core in BV1.R82 (ADR 0093 §1); default-on because every instance records its builders' sessions for the BFG. Like the memory module, sessions registers no port — core never calls back into it: the ship-time digest write is an HTTP POST to the module's own /sessions route, and the only outward dependency is the economy `reward` kernel PORT it resolves (session token reward + sumCreditsForTasks) at upload time.",
   "version": "1.0.0",
   "coreVersion": "^1.10.0",
+  "category": { "parent": "knowledge" },
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": { "routes": ["sessions"], "pollers": ["session-reward-reconcile", "session-upload-health"] },

package/modules/specialities/module.json

@@ -4,6 +4,7 @@
   "description": "Role SUB-SPECIALITIES — a named bundle of knowledge, skills and an interaction contract that sits UNDER a craft (task 1003855; ADR 0296). A craft says how you work (engineer / ideator / artist / ui); a speciality says what you work ON and how a subject-matter expert wants to be engaged inside it. Deliberately a thin layer over three surfaces that already exist — discipline-modes.json for craft->playbook, behavior_prefs.interaction for the per-session contract (a speciality contract rides that SAME GET /me -> Conductor path rather than adding a second one), and the ADR 0083 manifest for declared skills; the only new machinery is the knowledge bundle. Training is two-fold per the owner's 2026-09-17 ruling: documents the builder supplied, plus learnings captured from sessions worked in the speciality (pointing at existing `learnings` rows, never a second corpus). Owned per-builder OR per-project, each carrying its owner's sharing decision (private / project / public) and an explicit sellable flag — the flag records intent only, because ADR 0107 defers the marketplace and there is nothing to list on. default-on: a speciality is how an instance's expertise enters the platform, so it ships like the hall and the status page.",
   "version": "1.0.0",
   "coreVersion": "^1.19.0",
+  "category": { "parent": "people" },
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "migrations": true,

package/modules/status-ui/module.json

@@ -4,6 +4,7 @@
   "description": "The public build-status dashboard served at status.<apex> (status.example.com) — the live up/down banner, version-progress rollups, cost summary, recent ships, leaderboard, and the ecosystem fingerprint, all polling the read-only /api/bongos/public/* surface every 60s. A WEB-SURFACE core-domain module carved out of the GDS core in BV1.R84 (ADR 0093 §1; 02-module-map §6 — a web surface is first-class). default-on: a Cloud Bongos instance ships its status page like it ships its hall. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir) the loader hands serve-internal, which serves the module's public/ dir on the matching host exactly as it served public-status/ before. The public read endpoints it renders stay SHARED core in routes/public.js (the hall + the off-box mirror read them too).",
   "version": "1.0.0",
   "coreVersion": "^1.11.0",
+  "category": { "parent": "pages" },
   "default": true,
   "maintenance": { "status": "core-maintained" },
   "contributes": {