@bongos/core 1.21.46 → 1.21.48

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.46",
-  "core_contract": "1.21.46",
-  "source_commit": "d5fe3818df30795db5c36ba63d5ec1caac0b9455",
+  "core_version": "1.21.48",
+  "core_contract": "1.21.48",
+  "source_commit": "141779b1bd7ee5b97cc7882348ce1f2afeaa4e16",
   "source_ref": "HEAD",
-  "built_at": "2026-10-04T21:09:04.318Z",
+  "built_at": "2026-10-04T21:43:38.415Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 583,
+    "docs_redacted": 582,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 2929,
+    "functional_verbatim": 2927,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3541,
-  "tree_sha256": "1820263a5ad1281bc3a2c31db43fabeb3f9eee2394c6ba738905f3ca348f776a",
+  "file_count": 3538,
+  "tree_sha256": "e81ef82d0393005076f8b6fcc7e3c950b80f6cc19496f52bb67c7908b2225e7d",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -42,7 +42,7 @@
     {
       "path": ".claude/skills/bongos-feedback/SKILL.md",
       "mode": "0000644",
-      "sha256": "d1656854500410695d234569f0529d3592936acf220e24fa74935f13aa248561"
+      "sha256": "b30912b54c07c873cc94398af0ffd6c8e364a0f7f81a866343667cc5a87da25a"
     },
     {
       "path": ".claude/skills/bug-triage/SKILL.md",
@@ -134,11 +134,6 @@
       "mode": "0000644",
       "sha256": "5a2e7a11abdc9f0ecc81fbf057978523af56dcddcb712581337059c696a139db"
     },
-    {
-      "path": ".claude/skills/feedback/SKILL.md",
-      "mode": "0000644",
-      "sha256": "184cc6f540628de549f8f6d1a745ff683759f17f1752a0ac8779f52327b57b3d"
-    },
     {
       "path": ".claude/skills/figma-design-sync/SKILL.md",
       "mode": "0000644",
@@ -857,7 +852,7 @@
     {
       "path": "docs/adr/0087-bongos-app-architecture-and-handoff-contract.md",
       "mode": "0000644",
-      "sha256": "26e76c07a9c0965ad0169a4753b6d14bb663d0770bb6f3e134f758e536100549"
+      "sha256": "7ddee60cb02906bd2c9c232236555fa451bac920f569ac6216a2ac2a7e34a33c"
     },
     {
       "path": "docs/adr/0087-compete-on-governance-not-tooling-cursor.md",
@@ -2827,7 +2822,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "699759ef62420597eb078d84da76685664dd19a952f9a19bb6e65b98be1a8527"
+      "sha256": "459d6bf111e4644831a95374e9d9c9949568a068e96d9f106fe97a882084feeb"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2837,7 +2832,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d3c6bece7b154458613f448f4cbf427771a30621a987887e7b924f7b4461661d"
+      "sha256": "f2337e4898acad10a1930753518b89c507113f918bcaeb1c31af1414a9363fbf"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2927,7 +2922,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "d9ff7ec46805f7c2c5733871732583f300d58afce299e1b63f8873335b4d5aa5"
+      "sha256": "4f7125f8cac010333ee71c8a4cd1f9fd90c74542fc6ac25537383fe91ee769be"
     },
     {
       "path": "docs/project-context.template.md",
@@ -5447,7 +5442,7 @@
     {
       "path": "modules/hall-ui/public/commands-lib.js",
       "mode": "0000644",
-      "sha256": "e7d482684099e1db89de95bed19f035848829e528efead1d3b43b69b1a984af4"
+      "sha256": "06fe68a65f0be9c56f710d8f44d7accd68e4d93baa22f8ca503a692815c8c45d"
     },
     {
       "path": "modules/hall-ui/public/commands.css",
@@ -6207,7 +6202,7 @@
     {
       "path": "modules/hall-ui/public/street-card.css",
       "mode": "0000644",
-      "sha256": "9b68e5aa97e9b0619ef240fb2d9ffd6b47b7857c9996b5658e797751f00ad179"
+      "sha256": "ebca29688f443dda588fe1f351131199ba325c959f9e5c3c0a4818c0d74cbe0c"
     },
     {
       "path": "modules/hall-ui/public/street-card.js",
@@ -6222,7 +6217,7 @@
     {
       "path": "modules/hall-ui/public/street-desk.js",
       "mode": "0000644",
-      "sha256": "d2596fd8b9a76008cb907c22468eb1234dde9152001ff0aae9ce22ee1db913fb"
+      "sha256": "9d4fc788d6866b5daf6ee8b43f20aac3b552851f431743e74f617fd9335540e5"
     },
     {
       "path": "modules/hall-ui/public/street-draw.js",
@@ -6237,7 +6232,7 @@
     {
       "path": "modules/hall-ui/public/street.css",
       "mode": "0000644",
-      "sha256": "27b761f7503408b2d2d22ee9a75c09bd40c74195015eff385abbd25d3e508878"
+      "sha256": "5aa8158fc9519d86ae2ef1885636b3127f92770de6c8d0a7550e712fb11be8a2"
     },
     {
       "path": "modules/hall-ui/public/street.html",
@@ -6247,7 +6242,7 @@
     {
       "path": "modules/hall-ui/public/street.js",
       "mode": "0000644",
-      "sha256": "9c09c40c2111582d8759df4d77b0fb42f098589b38657b1454ef14e2875f0831"
+      "sha256": "7ea13e30eb760ed6411ed5cff0fe2deef3db01df0f20dea8a12472d9d8943dc9"
     },
     {
       "path": "modules/hall-ui/public/street.states.json",
@@ -6467,7 +6462,7 @@
     {
       "path": "modules/hall-ui/records/governor-street.md",
       "mode": "0000644",
-      "sha256": "9ed8b4cfa5edaae4f87b71857ccd59ab896f6f09cc0ea0b727ee0830c814147b"
+      "sha256": "9d153e28db44645a4c0856be8906748e4ebb0d43b4246e49fc28cdba366d22fc"
     },
     {
       "path": "modules/hall-ui/records/hall-navigation.md",
@@ -9897,12 +9892,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f74a31978f603402b9aa9255ae5cc5512af751960176827fb58f318d3677c7a6"
+      "sha256": "3046f43e1dd43ae2efccde7dfa8631efaf621494b1fe8d5ecce7faf562289faa"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "deed8c367083366ef02df92f4225fa01dc2a088455ad6eed330ea0881787e656"
+      "sha256": "39d4d63b7a6eed490ce3ffb0ee4a6336690954a4c601286dfdeffe55d91a99e5"
     },
     {
       "path": "public-docs/index.html",
@@ -9922,12 +9917,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "77006d750026156a72a8344e6901b23955b6ecaf5096683e20def2c39808ed7a"
-    },
-    {
-      "path": "scripts/bongos-mcp.js",
-      "mode": "0000644",
-      "sha256": "1cd62877bb9777f9715ed7a2932e8832368d1a2051c2e5a02b1786824eda6b1d"
+      "sha256": "8162b219a5b2d065551e8161d91c60888404ff890ede8d6bf15ea073d2903a8f"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -10424,11 +10414,6 @@
       "mode": "0000644",
       "sha256": "8ed7c35c0d6be3c8a11ee990b487114d7e422caeb70c67240b5060a0087cfdc4"
     },
-    {
-      "path": "scripts/gds/feedback-latest.js",
-      "mode": "0000644",
-      "sha256": "75543005eb7b91d020b00ac1bc616ecba3a7ceeb35aa53222bbe2149835abfaa"
-    },
     {
       "path": "scripts/gds/feedback-send.js",
       "mode": "0000644",
@@ -10859,6 +10844,11 @@
       "mode": "0000644",
       "sha256": "aa998dd5f0e3e9f33032ac880e5b948e88eb9bc467125ea652e8e317beada0dd"
     },
+    {
+      "path": "scripts/gds/pack-env-prefix.js",
+      "mode": "0000644",
+      "sha256": "c68f593ab10aa3773b594d781c0ab712daf5b0e9c7c52273ec6dddecccef179c"
+    },
     {
       "path": "scripts/gds/package-core.js",
       "mode": "0000644",
@@ -10967,7 +10957,7 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "ca7e46a175308c7789a530284c73ccf58b8c09eac873e07b516206e234be99ab"
+      "sha256": "8e2cf2e362b5e38832b53720a84ee0fb9003f9062cf9b7d03353a62fde936566"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
@@ -10977,12 +10967,12 @@
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "2fd3cd47bce98f32ec151557908fdde48f91d7a3d7a144f7e3e7f77638eb5165"
+      "sha256": "87e88c2f2f2aedad871b5d56d7d1528d9ee89fa568f0386eaa170843146db040"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "2bf80bfae7a2f8c0474965a6cf9f52f036e362dd0f96b8b5e12efc509f7afae9"
+      "sha256": "f58a7db598467d02e496688f71327a2c39b0e680a4b3c24fc0d7dd6346e07c8b"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -12142,12 +12132,12 @@
     {
       "path": "src/instance-config.js",
       "mode": "0000644",
-      "sha256": "2831a56dae693fd9280af8a27802573dcdec0656c8fc528b7b849ec7d9eda66b"
+      "sha256": "9f837c9d2be2b5c6cc5c6b7dba0403cebc45f00602e491a52a952ca1c689ffd7"
     },
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0e89dac0b78c7fd098761592206972b983092211a652e6ad62f0cebabddc330b"
+      "sha256": "3e7a5fe2e6d6f4388866fa0b9db145036de2ec0fc1ef146aa21c892c48f3a708"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13564,11 +13554,6 @@
       "mode": "0000644",
       "sha256": "74f8d8852b8949dc55ac38dd6f31da85bb55aae1215a146213495db898515086"
     },
-    {
-      "path": "tests/feedback_latest.mjs",
-      "mode": "0000644",
-      "sha256": "bee534dc1d92fd9ac2031c01195dad92b941b9c820fe8e4122a135292655cfdc"
-    },
     {
       "path": "tests/figma_adapter.mjs",
       "mode": "0000644",
@@ -14552,7 +14537,7 @@
     {
       "path": "tests/hall_street_desk.mjs",
       "mode": "0000644",
-      "sha256": "d2b3177198022b06fac1b22a2e7b0db93770567cf80ed03b5e7fe3f0715a1f38"
+      "sha256": "d74ae74a52f6a11ce6842c224edb64b349c0bbd235a192a92d6587112259698f"
     },
     {
       "path": "tests/hall_street_inside.mjs",
@@ -14922,7 +14907,7 @@
     {
       "path": "tests/instance_config.mjs",
       "mode": "0000644",
-      "sha256": "914eed9e342e6d612315f398bf2ed65b44af9037fce4293c2694e2726ca1e451"
+      "sha256": "ba3404f1fd37d33dac3e64ac17a0c71fd8d73a56f7fcef362f5ffd1423136e55"
     },
     {
       "path": "tests/instance_db_migrated_on_code_move.mjs",
@@ -14932,7 +14917,7 @@
     {
       "path": "tests/instance_feedback.mjs",
       "mode": "0000644",
-      "sha256": "470617a2fa728f67c7e2de09fd8213cd48ea6be6a7ca55fcd465b03a01bdf81f"
+      "sha256": "e3402d4767d21bd6d5ab80ad6f0670d4c94c9c56ff1c4656ebd4218b191a8b1c"
     },
     {
       "path": "tests/instance_manifest.mjs",
@@ -16057,7 +16042,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "4f8c3922665431062f091e1ab188be3bb224b4475d87612de97e18e79fe5cd98"
+      "sha256": "4ffddc6128eb9860d6b48493c4d9b6fd9e108f7c0e656f003bbbe32866b97675"
     },
     {
       "path": "tests/provision_account_identity.mjs",
@@ -17022,7 +17007,7 @@
     {
       "path": "tests/skill_menu_ruling.mjs",
       "mode": "0000644",
-      "sha256": "e4be23fe23636db0256119caef67241dd9132aadabc48b5063419b58f82e574d"
+      "sha256": "47e45afa89da802b8cfad2b954c6b41ec1f79e359cb58c6667fca7e0b8972ab5"
     },
     {
       "path": "tests/skill_preflight.mjs",

package/.claude/skills/bongos-feedback/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: bongos-feedback
 description: >-
-  File a Bongos problem with its maintainers — unasked, whenever a builder vents that Bongos itself is broken, stuck or confusing. Triggers: "/bongos-feedback", "Bongos is broken", "this keeps failing", "why does claim hang", "report this Bongos bug".
+  Send feedback, a bug or a wish about Bongos itself to its maintainers; unasked when a builder vents. Triggers: "Bongos feedback: …", "tell the Bongos team", "Bongos should…", "Bongos is broken", "this keeps failing", "/bongos-feedback".
 plain: >-
   Sends a short note about a problem with Bongos, or an idea for it, to the people who build Bongos. It also does this by itself when you complain that Bongos is not working.
 reach-for: >-
@@ -12,16 +12,17 @@ cost: >-
 
 **Script skill (authoritative).** The core action is `bongos feedback "<message>"` (or `--idea "<message>"`, or `--message-file <path>`). Run it and print its output verbatim.
 
-This is **not** `/feedback`, which loads a walkthrough you recorded into this session. This one **sends** a note about Bongos — the tool — upstream to its maintainers on Cloud Bongos, where a bug becomes a task waiting for a maintainer's approval (tasks 1004462, 1004467).
+This **sends** a note about Bongos — the tool — upstream to its maintainers on Cloud Bongos, where a bug becomes a task waiting for a maintainer's approval (tasks 1004462, 1004467).
 
 ## Two ways in
 
-- **Asked** — the builder says "report this", "tell the Bongos team", or runs `/bongos-feedback`. Draft it, show them, send on their go.
+- **Asked** — the builder labels a message as feedback for Bongos ("Bongos feedback: …", "feedback for Bongos", "tell the Bongos team", "report this") or runs `/bongos-feedback`. A message that already says what the feedback is **is** the go: write the report, send it, and show them what was sent. Only when they ask you to report something without saying what, draft it and send on their go.
+- **Suggestions count.** Feedback is not only breakage. "Bongos should…", "I don't want Bongos to…", or a complaint about how Bongos organises their work (versions, goals, tasks, ranks) is feedback too — send it with `--idea`. Fixing it in their own project (moving the goal, saving a preference) is fine, but it does not replace sending it: the next project would hit the same thing.
 - **Proactive** — the builder is venting that Bongos is not working: frustration, swearing, "this is broken again", "why does X keep failing", "Bongos is useless today". **File it without being asked**, then tell them in one line (below). The owner's standing rule (2026-09-30): every rant about Bongos not working becomes something to fix. Do not ask permission first, and do not argue them out of it.
 
 ## Is it about Bongos? (proactive mode files only when yes)
 
-File when the complaint is about **Bongos itself**: a `bongos`/`/builder-*` command, a claim, ship, grade, merge or deploy step, the hall, Settings, sign-in, credits, the upgrade, or a Bongos message that confused them.
+File when the complaint is about **Bongos itself**: how it organises their work (a goal that forced a new version, a version they did not want), a `bongos`/`/builder-*` command, a claim, ship, grade, merge or deploy step, the hall, Settings, sign-in, credits, the upgrade, or a Bongos message that confused them.
 
 Do **not** file when it is about their **own project's** code, tests or design, about Claude itself, their laptop, GitHub or another service — or when the "problem" is a rule working as designed (an `[otb-plain]` card saying `By design: Yes`). If it is genuinely unclear, fix the thing in front of you first and file only if it turns out to be Bongos.
 

package/docs/adr/0087-bongos-app-architecture-and-handoff-contract.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-06-26
 **Context:** Bongos App `BONGOS-V1` / criterion C4 (the feedback loop closes — capture lands in a coding agent), task [#1312](https://example.com/builders#/task/1312) (`BV1.R33`). Records the architecture the R01–R14 rungs built and pins the contract the three handoff paths (R12 [#1307](https://example.com/builders#/task/1307), R13 [#1308](https://example.com/builders#/task/1308), R14 [#1309](https://example.com/builders#/task/1309)) share. Builds on [ADR 0045](0045-devbox-desktop-app.md) (the Dev Box desktop app, now absorbed), [ADR 0072](0072-bongos-app-mac-signed-first-windows-deferred.md) (signing posture), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the modular core), and the [ADR 0062](0062-medusa-instance-model-decoupling.md) core↔host split.
-**Status:** Accepted.
+**Status:** Accepted. **Handoff half retired 2026-10-04 (task 1004576):** the desktop app was never built, so the `/feedback` skill, its `feedback-latest.js` engine and the `bongos-mcp.js` launcher were deleted. Builders send feedback about Bongos with `/bongos-feedback` instead.
 **Track:** `internal` (development system → the Cloud Bongos desktop app line; bongos succeeds the GDS as the primary builder surface after GDS-V4).
 
 ## Problem — feedback has nowhere to land
@@ -32,7 +32,7 @@ This ADR records (a) the app's overall shape, and (b) the one contract all the h
 **One shared `latest` pointer; three readers.** Every write of a bundle (`bundle.js writeBundle`) records it as `latest` — an atomic `latest.json` pointer plus a best-effort `latest/` symlink — in `bongos-app/src/handoff.js`. All three handoff paths resolve "the newest bundle" through that one `resolveLatest()`, so they can never drift:
 
 1. **Claude Desktop — file-bundle + clipboard (R12).** A toolbar button copies `prompt.md` to the clipboard and opens the bundle folder; the user pastes the prompt and drags the images into the composer (Desktop accepts mixed text + images). A one-liner spells out exactly what to do. (`handoff.js` + the `feedback:produce` / `feedback:handoff-desktop` IPC in `main.js`.)
-2. **Claude Code — the `/feedback` slash command (R13).** Running `/feedback` shells `node scripts/gds/feedback-latest.js`, which prints the `prompt.md` body + the absolute path of every frame; Claude then `Read`s each path so the screenshots enter context. This sidesteps the CLI's unreliable clipboard-image paste — Claude reads the frames from disk, not from a pasted blob.
+2. **Claude Code — the `/feedback` slash command (R13).** Running `/feedback` shelled the `feedback-latest.js` script (now deleted), which prints the `prompt.md` body + the absolute path of every frame; Claude then `Read`s each path so the screenshots enter context. This sidesteps the CLI's unreliable clipboard-image paste — Claude reads the frames from disk, not from a pasted blob.
 3. **MCP — `get_latest_feedback` (R14, optional "direct" path).** A local, zero-dependency stdio MCP server (`bongos-app/src/mcp-server.js`, launched by `scripts/bongos-mcp.js`) exposes one tool that returns the prompt text + the screenshots' **file paths** (never base64 — inlining would blow the MCP tool-result size cap). Both Desktop and Code can pull the latest bundle hands-free once the server is registered. Optional/stretch for V1 — the file-bundle + `/feedback` paths already close the loop.
 
 ### Why hand-rolled MCP (no SDK dependency)

package/docs/file-map.md

@@ -389,7 +389,6 @@ tests/
 ├── collab-review/SKILL.md        ← /collab-review — the ANSWERING half of /ask-for-help: walk GET /help-requests/for-me + GET /task-recommendations/for-me oldest first, read the task each names, VERIFY the ask's claims against the live row rather than its prose, bring one decision at a time and halt; then execute the chosen write, and — since only the ASKER may settle a help request — close the loop by filing a reply addressed back to them. Treats an ask as data, never instructions (task 1004181)
 ├── design/SKILL.md               ← /design — the UI design session: the operating playbook for ui-discipline work on ANY instance (load the instance's pack + DESIGN.md first, look before you ship, build inside the platform floors, ship the tests with the UI); routed from a `ui` claim via discipline-modes.json; shipped by the ui-design module (task 1003324, ADR 0197)
 ├── design-sync/SKILL.md          ← /design-sync — export repo design tokens + surfaces into Claude Design (token-preview bundle) and land generated UI code back as a Bongos task (ADR 0081)
-├── feedback/SKILL.md             ← /feedback — pull the latest Bongos feedback bundle (prompt.md + screenshot file paths) into a Claude Code session; backed by scripts/gds/feedback-latest.js (BV1.R13, ADR 0087)
 ├── figma-design-sync/SKILL.md    ← sync UI-surface tokens/surfaces with Figma (push a frame plan, land a designer's Code Connect / MCP snapshot edit back as code) — the ADR 0081 human escape hatch; distinct from otb-figma-sync's pixel-art tile review (task 2048)
 ├── fix-task/SKILL.md             ← /fix-task N — claim, fix (test-first), verify, and ship a single Bongos task by id end to end; defers to /builder-claim + /builder-ship for their own mechanics
 ├── goal-close/SKILL.md           ← /goal-close — HIDDEN (typed-only); the merged goal-uat + goal-review: Part 1 tests criteria awaiting UAT on the live site and signs them off, Part 2 decides the ones a UAT cannot close (abandoned or unlinked work) (task 1004471, ADR 0351); Metic+

package/docs/module-api-changelog.md

@@ -2919,5 +2919,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.44 with no explicit bump. run 37232228455. (task 1002620)
   1.21.46 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.45 with no explicit bump. run 37234868653. (task 1002620)
+  1.21.47 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.46 with no explicit bump. run 37236095022. (task 1002620)
+  1.21.48 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.47 with no explicit bump. run 37237206637. (task 1002620)
 ---------------------------------------------------------------------------
 ```