@bongos/core 1.21.47 → 1.21.48

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.47",
-  "core_contract": "1.21.47",
-  "source_commit": "7212168682e220fda8a9a99d042bfcb0ee4b24e2",
+  "core_version": "1.21.48",
+  "core_contract": "1.21.48",
+  "source_commit": "141779b1bd7ee5b97cc7882348ce1f2afeaa4e16",
   "source_ref": "HEAD",
-  "built_at": "2026-10-04T21:26:57.956Z",
+  "built_at": "2026-10-04T21:43:38.415Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 583,
+    "docs_redacted": 582,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 2929,
+    "functional_verbatim": 2927,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3541,
-  "tree_sha256": "cf7879ad23988c49b9be9919407d763a66c814bd08a94f07a09d9d3058ff180b",
+  "file_count": 3538,
+  "tree_sha256": "e81ef82d0393005076f8b6fcc7e3c950b80f6cc19496f52bb67c7908b2225e7d",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -42,7 +42,7 @@
     {
       "path": ".claude/skills/bongos-feedback/SKILL.md",
       "mode": "0000644",
-      "sha256": "d1656854500410695d234569f0529d3592936acf220e24fa74935f13aa248561"
+      "sha256": "b30912b54c07c873cc94398af0ffd6c8e364a0f7f81a866343667cc5a87da25a"
     },
     {
       "path": ".claude/skills/bug-triage/SKILL.md",
@@ -134,11 +134,6 @@
       "mode": "0000644",
       "sha256": "5a2e7a11abdc9f0ecc81fbf057978523af56dcddcb712581337059c696a139db"
     },
-    {
-      "path": ".claude/skills/feedback/SKILL.md",
-      "mode": "0000644",
-      "sha256": "184cc6f540628de549f8f6d1a745ff683759f17f1752a0ac8779f52327b57b3d"
-    },
     {
       "path": ".claude/skills/figma-design-sync/SKILL.md",
       "mode": "0000644",
@@ -857,7 +852,7 @@
     {
       "path": "docs/adr/0087-bongos-app-architecture-and-handoff-contract.md",
       "mode": "0000644",
-      "sha256": "26e76c07a9c0965ad0169a4753b6d14bb663d0770bb6f3e134f758e536100549"
+      "sha256": "7ddee60cb02906bd2c9c232236555fa451bac920f569ac6216a2ac2a7e34a33c"
     },
     {
       "path": "docs/adr/0087-compete-on-governance-not-tooling-cursor.md",
@@ -2827,7 +2822,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "699759ef62420597eb078d84da76685664dd19a952f9a19bb6e65b98be1a8527"
+      "sha256": "459d6bf111e4644831a95374e9d9c9949568a068e96d9f106fe97a882084feeb"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2837,7 +2832,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f5bbac075fc756176d069ba005ba68451829e123cac49901dfcd364a511da3f6"
+      "sha256": "f2337e4898acad10a1930753518b89c507113f918bcaeb1c31af1414a9363fbf"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2927,7 +2922,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "bcd483a16170e98f732e1f9b4b39b3dcf09ee51e692901424d651e31617d564b"
+      "sha256": "4f7125f8cac010333ee71c8a4cd1f9fd90c74542fc6ac25537383fe91ee769be"
     },
     {
       "path": "docs/project-context.template.md",
@@ -5447,7 +5442,7 @@
     {
       "path": "modules/hall-ui/public/commands-lib.js",
       "mode": "0000644",
-      "sha256": "e7d482684099e1db89de95bed19f035848829e528efead1d3b43b69b1a984af4"
+      "sha256": "06fe68a65f0be9c56f710d8f44d7accd68e4d93baa22f8ca503a692815c8c45d"
     },
     {
       "path": "modules/hall-ui/public/commands.css",
@@ -9897,12 +9892,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9c3b5080e634837249c14e6442cf69a6009f39cbe83a68a1071a7f3c6a31148d"
+      "sha256": "3046f43e1dd43ae2efccde7dfa8631efaf621494b1fe8d5ecce7faf562289faa"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cf0fb70b6b1b7fab873b9bfa9254b59b6737eecf06e13fca620cd06bc856c4c9"
+      "sha256": "39d4d63b7a6eed490ce3ffb0ee4a6336690954a4c601286dfdeffe55d91a99e5"
     },
     {
       "path": "public-docs/index.html",
@@ -9922,12 +9917,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "081ef60b83790763eff2a30b449f0957cd87973584fcae33fb0281f7fa1f6461"
-    },
-    {
-      "path": "scripts/bongos-mcp.js",
-      "mode": "0000644",
-      "sha256": "1cd62877bb9777f9715ed7a2932e8832368d1a2051c2e5a02b1786824eda6b1d"
+      "sha256": "8162b219a5b2d065551e8161d91c60888404ff890ede8d6bf15ea073d2903a8f"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -10424,11 +10414,6 @@
       "mode": "0000644",
       "sha256": "8ed7c35c0d6be3c8a11ee990b487114d7e422caeb70c67240b5060a0087cfdc4"
     },
-    {
-      "path": "scripts/gds/feedback-latest.js",
-      "mode": "0000644",
-      "sha256": "75543005eb7b91d020b00ac1bc616ecba3a7ceeb35aa53222bbe2149835abfaa"
-    },
     {
       "path": "scripts/gds/feedback-send.js",
       "mode": "0000644",
@@ -10859,6 +10844,11 @@
       "mode": "0000644",
       "sha256": "aa998dd5f0e3e9f33032ac880e5b948e88eb9bc467125ea652e8e317beada0dd"
     },
+    {
+      "path": "scripts/gds/pack-env-prefix.js",
+      "mode": "0000644",
+      "sha256": "c68f593ab10aa3773b594d781c0ab712daf5b0e9c7c52273ec6dddecccef179c"
+    },
     {
       "path": "scripts/gds/package-core.js",
       "mode": "0000644",
@@ -10967,7 +10957,7 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "ca7e46a175308c7789a530284c73ccf58b8c09eac873e07b516206e234be99ab"
+      "sha256": "8e2cf2e362b5e38832b53720a84ee0fb9003f9062cf9b7d03353a62fde936566"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
@@ -10977,12 +10967,12 @@
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "2fd3cd47bce98f32ec151557908fdde48f91d7a3d7a144f7e3e7f77638eb5165"
+      "sha256": "87e88c2f2f2aedad871b5d56d7d1528d9ee89fa568f0386eaa170843146db040"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "2bf80bfae7a2f8c0474965a6cf9f52f036e362dd0f96b8b5e12efc509f7afae9"
+      "sha256": "f58a7db598467d02e496688f71327a2c39b0e680a4b3c24fc0d7dd6346e07c8b"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -12142,12 +12132,12 @@
     {
       "path": "src/instance-config.js",
       "mode": "0000644",
-      "sha256": "2831a56dae693fd9280af8a27802573dcdec0656c8fc528b7b849ec7d9eda66b"
+      "sha256": "9f837c9d2be2b5c6cc5c6b7dba0403cebc45f00602e491a52a952ca1c689ffd7"
     },
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "89f14edf67ae146272e1a4d4d62136f67e188f7c6303de4d1839a473af22cc9d"
+      "sha256": "3e7a5fe2e6d6f4388866fa0b9db145036de2ec0fc1ef146aa21c892c48f3a708"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13564,11 +13554,6 @@
       "mode": "0000644",
       "sha256": "74f8d8852b8949dc55ac38dd6f31da85bb55aae1215a146213495db898515086"
     },
-    {
-      "path": "tests/feedback_latest.mjs",
-      "mode": "0000644",
-      "sha256": "bee534dc1d92fd9ac2031c01195dad92b941b9c820fe8e4122a135292655cfdc"
-    },
     {
       "path": "tests/figma_adapter.mjs",
       "mode": "0000644",
@@ -14922,7 +14907,7 @@
     {
       "path": "tests/instance_config.mjs",
       "mode": "0000644",
-      "sha256": "914eed9e342e6d612315f398bf2ed65b44af9037fce4293c2694e2726ca1e451"
+      "sha256": "ba3404f1fd37d33dac3e64ac17a0c71fd8d73a56f7fcef362f5ffd1423136e55"
     },
     {
       "path": "tests/instance_db_migrated_on_code_move.mjs",
@@ -14932,7 +14917,7 @@
     {
       "path": "tests/instance_feedback.mjs",
       "mode": "0000644",
-      "sha256": "470617a2fa728f67c7e2de09fd8213cd48ea6be6a7ca55fcd465b03a01bdf81f"
+      "sha256": "e3402d4767d21bd6d5ab80ad6f0670d4c94c9c56ff1c4656ebd4218b191a8b1c"
     },
     {
       "path": "tests/instance_manifest.mjs",
@@ -16057,7 +16042,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "4f8c3922665431062f091e1ab188be3bb224b4475d87612de97e18e79fe5cd98"
+      "sha256": "4ffddc6128eb9860d6b48493c4d9b6fd9e108f7c0e656f003bbbe32866b97675"
     },
     {
       "path": "tests/provision_account_identity.mjs",
@@ -17022,7 +17007,7 @@
     {
       "path": "tests/skill_menu_ruling.mjs",
       "mode": "0000644",
-      "sha256": "e4be23fe23636db0256119caef67241dd9132aadabc48b5063419b58f82e574d"
+      "sha256": "47e45afa89da802b8cfad2b954c6b41ec1f79e359cb58c6667fca7e0b8972ab5"
     },
     {
       "path": "tests/skill_preflight.mjs",

package/.claude/skills/bongos-feedback/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: bongos-feedback
 description: >-
-  File a Bongos problem with its maintainers — unasked, whenever a builder vents that Bongos itself is broken, stuck or confusing. Triggers: "/bongos-feedback", "Bongos is broken", "this keeps failing", "why does claim hang", "report this Bongos bug".
+  Send feedback, a bug or a wish about Bongos itself to its maintainers; unasked when a builder vents. Triggers: "Bongos feedback: …", "tell the Bongos team", "Bongos should…", "Bongos is broken", "this keeps failing", "/bongos-feedback".
 plain: >-
   Sends a short note about a problem with Bongos, or an idea for it, to the people who build Bongos. It also does this by itself when you complain that Bongos is not working.
 reach-for: >-
@@ -12,16 +12,17 @@ cost: >-
 
 **Script skill (authoritative).** The core action is `bongos feedback "<message>"` (or `--idea "<message>"`, or `--message-file <path>`). Run it and print its output verbatim.
 
-This is **not** `/feedback`, which loads a walkthrough you recorded into this session. This one **sends** a note about Bongos — the tool — upstream to its maintainers on Cloud Bongos, where a bug becomes a task waiting for a maintainer's approval (tasks 1004462, 1004467).
+This **sends** a note about Bongos — the tool — upstream to its maintainers on Cloud Bongos, where a bug becomes a task waiting for a maintainer's approval (tasks 1004462, 1004467).
 
 ## Two ways in
 
-- **Asked** — the builder says "report this", "tell the Bongos team", or runs `/bongos-feedback`. Draft it, show them, send on their go.
+- **Asked** — the builder labels a message as feedback for Bongos ("Bongos feedback: …", "feedback for Bongos", "tell the Bongos team", "report this") or runs `/bongos-feedback`. A message that already says what the feedback is **is** the go: write the report, send it, and show them what was sent. Only when they ask you to report something without saying what, draft it and send on their go.
+- **Suggestions count.** Feedback is not only breakage. "Bongos should…", "I don't want Bongos to…", or a complaint about how Bongos organises their work (versions, goals, tasks, ranks) is feedback too — send it with `--idea`. Fixing it in their own project (moving the goal, saving a preference) is fine, but it does not replace sending it: the next project would hit the same thing.
 - **Proactive** — the builder is venting that Bongos is not working: frustration, swearing, "this is broken again", "why does X keep failing", "Bongos is useless today". **File it without being asked**, then tell them in one line (below). The owner's standing rule (2026-09-30): every rant about Bongos not working becomes something to fix. Do not ask permission first, and do not argue them out of it.
 
 ## Is it about Bongos? (proactive mode files only when yes)
 
-File when the complaint is about **Bongos itself**: a `bongos`/`/builder-*` command, a claim, ship, grade, merge or deploy step, the hall, Settings, sign-in, credits, the upgrade, or a Bongos message that confused them.
+File when the complaint is about **Bongos itself**: how it organises their work (a goal that forced a new version, a version they did not want), a `bongos`/`/builder-*` command, a claim, ship, grade, merge or deploy step, the hall, Settings, sign-in, credits, the upgrade, or a Bongos message that confused them.
 
 Do **not** file when it is about their **own project's** code, tests or design, about Claude itself, their laptop, GitHub or another service — or when the "problem" is a rule working as designed (an `[otb-plain]` card saying `By design: Yes`). If it is genuinely unclear, fix the thing in front of you first and file only if it turns out to be Bongos.
 

package/docs/adr/0087-bongos-app-architecture-and-handoff-contract.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-06-26
 **Context:** Bongos App `BONGOS-V1` / criterion C4 (the feedback loop closes — capture lands in a coding agent), task [#1312](https://example.com/builders#/task/1312) (`BV1.R33`). Records the architecture the R01–R14 rungs built and pins the contract the three handoff paths (R12 [#1307](https://example.com/builders#/task/1307), R13 [#1308](https://example.com/builders#/task/1308), R14 [#1309](https://example.com/builders#/task/1309)) share. Builds on [ADR 0045](0045-devbox-desktop-app.md) (the Dev Box desktop app, now absorbed), [ADR 0072](0072-bongos-app-mac-signed-first-windows-deferred.md) (signing posture), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the modular core), and the [ADR 0062](0062-medusa-instance-model-decoupling.md) core↔host split.
-**Status:** Accepted.
+**Status:** Accepted. **Handoff half retired 2026-10-04 (task 1004576):** the desktop app was never built, so the `/feedback` skill, its `feedback-latest.js` engine and the `bongos-mcp.js` launcher were deleted. Builders send feedback about Bongos with `/bongos-feedback` instead.
 **Track:** `internal` (development system → the Cloud Bongos desktop app line; bongos succeeds the GDS as the primary builder surface after GDS-V4).
 
 ## Problem — feedback has nowhere to land
@@ -32,7 +32,7 @@ This ADR records (a) the app's overall shape, and (b) the one contract all the h
 **One shared `latest` pointer; three readers.** Every write of a bundle (`bundle.js writeBundle`) records it as `latest` — an atomic `latest.json` pointer plus a best-effort `latest/` symlink — in `bongos-app/src/handoff.js`. All three handoff paths resolve "the newest bundle" through that one `resolveLatest()`, so they can never drift:
 
 1. **Claude Desktop — file-bundle + clipboard (R12).** A toolbar button copies `prompt.md` to the clipboard and opens the bundle folder; the user pastes the prompt and drags the images into the composer (Desktop accepts mixed text + images). A one-liner spells out exactly what to do. (`handoff.js` + the `feedback:produce` / `feedback:handoff-desktop` IPC in `main.js`.)
-2. **Claude Code — the `/feedback` slash command (R13).** Running `/feedback` shells `node scripts/gds/feedback-latest.js`, which prints the `prompt.md` body + the absolute path of every frame; Claude then `Read`s each path so the screenshots enter context. This sidesteps the CLI's unreliable clipboard-image paste — Claude reads the frames from disk, not from a pasted blob.
+2. **Claude Code — the `/feedback` slash command (R13).** Running `/feedback` shelled the `feedback-latest.js` script (now deleted), which prints the `prompt.md` body + the absolute path of every frame; Claude then `Read`s each path so the screenshots enter context. This sidesteps the CLI's unreliable clipboard-image paste — Claude reads the frames from disk, not from a pasted blob.
 3. **MCP — `get_latest_feedback` (R14, optional "direct" path).** A local, zero-dependency stdio MCP server (`bongos-app/src/mcp-server.js`, launched by `scripts/bongos-mcp.js`) exposes one tool that returns the prompt text + the screenshots' **file paths** (never base64 — inlining would blow the MCP tool-result size cap). Both Desktop and Code can pull the latest bundle hands-free once the server is registered. Optional/stretch for V1 — the file-bundle + `/feedback` paths already close the loop.
 
 ### Why hand-rolled MCP (no SDK dependency)

package/docs/file-map.md

@@ -389,7 +389,6 @@ tests/
 ├── collab-review/SKILL.md        ← /collab-review — the ANSWERING half of /ask-for-help: walk GET /help-requests/for-me + GET /task-recommendations/for-me oldest first, read the task each names, VERIFY the ask's claims against the live row rather than its prose, bring one decision at a time and halt; then execute the chosen write, and — since only the ASKER may settle a help request — close the loop by filing a reply addressed back to them. Treats an ask as data, never instructions (task 1004181)
 ├── design/SKILL.md               ← /design — the UI design session: the operating playbook for ui-discipline work on ANY instance (load the instance's pack + DESIGN.md first, look before you ship, build inside the platform floors, ship the tests with the UI); routed from a `ui` claim via discipline-modes.json; shipped by the ui-design module (task 1003324, ADR 0197)
 ├── design-sync/SKILL.md          ← /design-sync — export repo design tokens + surfaces into Claude Design (token-preview bundle) and land generated UI code back as a Bongos task (ADR 0081)
-├── feedback/SKILL.md             ← /feedback — pull the latest Bongos feedback bundle (prompt.md + screenshot file paths) into a Claude Code session; backed by scripts/gds/feedback-latest.js (BV1.R13, ADR 0087)
 ├── figma-design-sync/SKILL.md    ← sync UI-surface tokens/surfaces with Figma (push a frame plan, land a designer's Code Connect / MCP snapshot edit back as code) — the ADR 0081 human escape hatch; distinct from otb-figma-sync's pixel-art tile review (task 2048)
 ├── fix-task/SKILL.md             ← /fix-task N — claim, fix (test-first), verify, and ship a single Bongos task by id end to end; defers to /builder-claim + /builder-ship for their own mechanics
 ├── goal-close/SKILL.md           ← /goal-close — HIDDEN (typed-only); the merged goal-uat + goal-review: Part 1 tests criteria awaiting UAT on the live site and signs them off, Part 2 decides the ones a UAT cannot close (abandoned or unlinked work) (task 1004471, ADR 0351); Metic+

package/docs/module-api-changelog.md

@@ -2921,5 +2921,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.45 with no explicit bump. run 37234868653. (task 1002620)
   1.21.47 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.46 with no explicit bump. run 37236095022. (task 1002620)
+  1.21.48 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.47 with no explicit bump. run 37237206637. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -5,7 +5,7 @@
   "adr": "0341 D3",
   "reread": "node scripts/gds/page-reader.js --stale",
   "how": ["Generated by node scripts/gds/page-reader.js (BV2.TW04, task 1004315; ADR 0341 D3). Do not hand-edit.","One entry per page of docs/page-inventory.json. Lines are in page order: the default state first, and a line only another state shows sits where that state shows it, with its state named.","placement: placed = a docs/copy-registry.json row renders it (file, line, string_id); shared = shell text every page of the surface carries (top bar, sidebar, footer), with its row when the registry has one; unplaced = the registry cannot place it (a rewrite becomes an engineer task, ADR 0341 D4).","text keeps {…} where the registry row has a hole, or where a value the page read from its API was filled in. A string that is only such data is counted under omitted.data, not listed.","reading_hash is over the non-shared lines (key, section, text); files_hash is over the page's inventory files. --check compares files_hash only and never opens a browser.","Rendered through the hall-preview harness (hall) and the ui-design kit stub (landing, status), at 1280x800 with the clock pinned, so a reading is the fixture world's page."],
-  "counts": {"pages":42,"lines":4920,"placed":1554,"shared":382,"unplaced":2984,"omitted_data":2442},
+  "counts": {"pages":42,"lines":4921,"placed":1555,"shared":382,"unplaced":2984,"omitted_data":2442},
   "pages": [
     {
       "id": "builders:atlas",
@@ -306,16 +306,16 @@
       "surface": "builders",
       "title": "Commands",
       "states_read": ["in","out"],
-      "files_hash": "6b8357d0bcf75d33",
-      "reading_hash": "df2af0b2b6174701",
-      "counts": {"lines":86,"placed":60,"shared":9,"unplaced":17},
+      "files_hash": "4e1fc3fc2c0399d7",
+      "reading_hash": "78d3343283bfe6a2",
+      "counts": {"lines":87,"placed":61,"shared":9,"unplaced":17},
       "omitted": {"data":141},
       "notes": [],
       "lines": [
         {"key":"L0001","section":"skip link","text":"Skip to content","placement":"shared","file":"modules/hall-ui/public/shell.js","line":811,"string_id":"87cee78ca134"},
         {"key":"L0002","section":"top bar","text":"Commands","placement":"shared"},
         {"key":"L0003","section":"top bar","text":"Jump to…","placement":"shared","file":"modules/hall-ui/public/shell.js","line":495,"string_id":"eba610d25523"},
-        {"key":"L0004","section":"top bar","text":"Ctrl K","placement":"shared"},
+        {"key":"L0004","section":"top bar","text":"⌘K","placement":"shared"},
         {"key":"L0005","section":"top bar","text":"Building","placement":"shared"},
         {"key":"L0006","section":"top bar","text":"Artistry","placement":"shared"},
         {"key":"L0007","section":"top bar","text":"Ideating","placement":"shared"},
@@ -341,16 +341,16 @@
         {"key":"L0027","section":"Your daily loop 9","text":"{…} of {…}","placement":"placed","file":"modules/hall-ui/public/sky-panel.js","line":120,"string_id":"73c1372b43d9","occurrences":2},
         {"key":"L0028","section":"Your daily loop 9","text":"Shown to Claude","placement":"placed","file":"modules/hall-ui/public/commands.html","line":36,"string_id":"b20cd8a4fa21","occurrences":9},
         {"key":"L0029","section":"Your daily loop 9","text":"{…} project{…}","placement":"placed","file":"modules/hall-ui/public/fleet.js","line":39,"string_id":"771bef3d31b5","occurrences":4},
-        {"key":"L0030","section":"{…} and {…}","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","occurrences":29},
-        {"key":"L0031","section":"{…} and {…}","text":"{…} project{…}","placement":"placed","file":"modules/hall-ui/public/fleet.js","line":39,"string_id":"771bef3d31b5","occurrences":30},
+        {"key":"L0030","section":"{…} and {…}","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","occurrences":28},
+        {"key":"L0031","section":"{…} and {…}","text":"{…} project{…}","placement":"placed","file":"modules/hall-ui/public/fleet.js","line":39,"string_id":"771bef3d31b5","occurrences":29},
         {"key":"L0032","section":"{…} and {…}","text":"Command","placement":"unplaced","occurrences":3},
         {"key":"L0033","section":"{…} and {…}","text":"What it does","placement":"placed","file":"modules/hall-ui/public/commands-lib.js","line":100,"string_id":"0efa2f18bb6c","occurrences":3},
         {"key":"L0034","section":"{…} and {…}","text":"When to reach for it","placement":"placed","file":"modules/hall-ui/public/commands-lib.js","line":100,"string_id":"a6e102816e92","occurrences":3},
         {"key":"L0035","section":"{…} and {…}","text":"What it costs","placement":"placed","file":"modules/hall-ui/public/commands-lib.js","line":100,"string_id":"65fd1339e2f2","occurrences":3},
         {"key":"L0036","section":"{…} and {…}","text":"How you start it","placement":"placed","file":"modules/hall-ui/public/commands-lib.js","line":100,"string_id":"3438c73d4f3d","occurrences":3},
-        {"key":"L0037","section":"{…} and {…}","text":"Shown to Claude","placement":"placed","file":"modules/hall-ui/public/commands.html","line":36,"string_id":"b20cd8a4fa21","occurrences":32},
+        {"key":"L0037","section":"{…} and {…}","text":"Shown to Claude","placement":"placed","file":"modules/hall-ui/public/commands.html","line":36,"string_id":"b20cd8a4fa21","occurrences":31},
         {"key":"L0038","section":"{…} and {…}","text":"{…} of {…}","placement":"placed","file":"modules/hall-ui/public/sky-panel.js","line":120,"string_id":"73c1372b43d9","occurrences":5},
-        {"key":"L0039","section":"{…} and {…}","text":"{…} file{…}","placement":"placed","file":"modules/hall-ui/public/gate.js","line":151,"string_id":"3efa67dc6e07","occurrences":4},
+        {"key":"L0039","section":"{…} and {…}","text":"{…} file{…}","placement":"placed","file":"modules/hall-ui/public/gate.js","line":151,"string_id":"3efa67dc6e07","occurrences":3},
         {"key":"L0040","section":"{…} routines 13","text":"{…} routines","placement":"unplaced"},
         {"key":"L0041","section":"{…} routines 13","text":"{…} project{…}","placement":"placed","file":"modules/hall-ui/public/fleet.js","line":39,"string_id":"771bef3d31b5","occurrences":5},
         {"key":"L0042","section":"{…} routines 13","text":"Command","placement":"unplaced"},
@@ -371,33 +371,34 @@
         {"key":"L0057","section":"{…} project{…}","text":"How you start it","placement":"placed","file":"modules/hall-ui/public/commands-lib.js","line":100,"string_id":"3438c73d4f3d"},
         {"key":"L0058","section":"{…} project{…}","text":"Shown to Claude","placement":"placed","file":"modules/hall-ui/public/commands.html","line":36,"string_id":"b20cd8a4fa21","occurrences":5},
         {"key":"L0059","section":"{…} project{…}","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","occurrences":3},
-        {"key":"L0060","section":"Everything else 5","text":"Everything else","placement":"unplaced"},
-        {"key":"L0061","section":"Everything else 5","text":"{…} project{…}","placement":"placed","file":"modules/hall-ui/public/fleet.js","line":39,"string_id":"771bef3d31b5","occurrences":7},
-        {"key":"L0062","section":"Everything else 5","text":"Command","placement":"unplaced"},
-        {"key":"L0063","section":"Everything else 5","text":"What it does","placement":"placed","file":"modules/hall-ui/public/commands-lib.js","line":100,"string_id":"0efa2f18bb6c"},
-        {"key":"L0064","section":"Everything else 5","text":"When to reach for it","placement":"placed","file":"modules/hall-ui/public/commands-lib.js","line":100,"string_id":"a6e102816e92"},
-        {"key":"L0065","section":"Everything else 5","text":"What it costs","placement":"placed","file":"modules/hall-ui/public/commands-lib.js","line":100,"string_id":"65fd1339e2f2"},
-        {"key":"L0066","section":"Everything else 5","text":"How you start it","placement":"placed","file":"modules/hall-ui/public/commands-lib.js","line":100,"string_id":"3438c73d4f3d"},
-        {"key":"L0067","section":"Everything else 5","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","occurrences":2},
-        {"key":"L0068","section":"Everything else 5","text":"Shown to Claude","placement":"placed","file":"modules/hall-ui/public/commands.html","line":36,"string_id":"b20cd8a4fa21","occurrences":5},
-        {"key":"L0069","section":"Everything else 5","text":"{…} of {…}","placement":"placed","file":"modules/hall-ui/public/sky-panel.js","line":120,"string_id":"73c1372b43d9","occurrences":2},
-        {"key":"L0070","section":"Everything else 5","text":"Having a command does not give you permission to use it: some refuse below a certain rank, and that is checked every time it runs.","placement":"placed","file":"modules/hall-ui/public/commands.html","line":40,"string_id":"5fb6c11ea890"},
-        {"key":"L0071","section":"Terminal commands (bongos)","text":"Terminal commands (bongos)","placement":"placed","file":"modules/hall-ui/public/commands.html","line":44,"string_id":"1e4285bdfaef"},
-        {"key":"L0072","section":"Terminal commands (bongos)","text":"The same work from any terminal, outside Claude Code. Run","placement":"placed","file":"modules/hall-ui/public/commands.html","line":45,"string_id":"ec849c59d583"},
-        {"key":"L0073","section":"Terminal commands (bongos)","text":"bongos help","placement":"placed","file":"modules/hall-ui/public/commands.html","line":45,"string_id":"e81d92078af1"},
-        {"key":"L0074","section":"Terminal commands (bongos)","text":"to see this list there.","placement":"placed","file":"modules/hall-ui/public/commands.html","line":45,"string_id":"3c9ba5dc851d"},
-        {"key":"L0075","section":"Terminal commands (bongos)","text":"{…} project{…}","placement":"placed","file":"modules/hall-ui/public/fleet.js","line":39,"string_id":"771bef3d31b5"},
-        {"key":"L0076","section":"footer","text":"Sign out","placement":"shared","file":"modules/hall-ui/public/shell.js","line":471,"string_id":"1883ad7f07fc"},
-        {"key":"L0077","section":"Terminal commands (bongos)","text":"Builders hall · this session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":346,"string_id":"fd1903586e8e"},
-        {"key":"L0078","section":"What are you doing now?","text":"What are you doing now?","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":347,"string_id":"60853319f290"},
-        {"key":"L0079","section":"What are you doing now?","text":"Pick one. You can switch any time from the top bar.","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":348,"string_id":"4f87d5b17b54"},
-        {"key":"L0080","section":"What are you doing now?","text":"Building","placement":"unplaced"},
-        {"key":"L0081","section":"What are you doing now?","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","occurrences":3},
-        {"key":"L0082","section":"What are you doing now?","text":"Artistry","placement":"unplaced"},
-        {"key":"L0083","section":"What are you doing now?","text":"Ideating","placement":"unplaced"},
-        {"key":"L0084","section":"What are you doing now?","text":"Turn thoughts into ideas.","placement":"unplaced"},
-        {"key":"L0085","section":"What are you doing now?","text":"Governing","placement":"unplaced"},
-        {"key":"L0086","section":"What are you doing now?","text":"Ask me again next session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":351,"string_id":"fa86bf403775"}
+        {"key":"L0060","section":"Everything else 6","text":"Everything else","placement":"unplaced"},
+        {"key":"L0061","section":"Everything else 6","text":"{…} project{…}","placement":"placed","file":"modules/hall-ui/public/fleet.js","line":39,"string_id":"771bef3d31b5","occurrences":8},
+        {"key":"L0062","section":"Everything else 6","text":"Command","placement":"unplaced"},
+        {"key":"L0063","section":"Everything else 6","text":"What it does","placement":"placed","file":"modules/hall-ui/public/commands-lib.js","line":100,"string_id":"0efa2f18bb6c"},
+        {"key":"L0064","section":"Everything else 6","text":"When to reach for it","placement":"placed","file":"modules/hall-ui/public/commands-lib.js","line":100,"string_id":"a6e102816e92"},
+        {"key":"L0065","section":"Everything else 6","text":"What it costs","placement":"placed","file":"modules/hall-ui/public/commands-lib.js","line":100,"string_id":"65fd1339e2f2"},
+        {"key":"L0066","section":"Everything else 6","text":"How you start it","placement":"placed","file":"modules/hall-ui/public/commands-lib.js","line":100,"string_id":"3438c73d4f3d"},
+        {"key":"L0067","section":"Everything else 6","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","occurrences":3},
+        {"key":"L0068","section":"Everything else 6","text":"{…} file{…}","placement":"placed","file":"modules/hall-ui/public/gate.js","line":151,"string_id":"3efa67dc6e07"},
+        {"key":"L0069","section":"Everything else 6","text":"Shown to Claude","placement":"placed","file":"modules/hall-ui/public/commands.html","line":36,"string_id":"b20cd8a4fa21","occurrences":6},
+        {"key":"L0070","section":"Everything else 6","text":"{…} of {…}","placement":"placed","file":"modules/hall-ui/public/sky-panel.js","line":120,"string_id":"73c1372b43d9","occurrences":2},
+        {"key":"L0071","section":"Everything else 6","text":"Having a command does not give you permission to use it: some refuse below a certain rank, and that is checked every time it runs.","placement":"placed","file":"modules/hall-ui/public/commands.html","line":40,"string_id":"5fb6c11ea890"},
+        {"key":"L0072","section":"Terminal commands (bongos)","text":"Terminal commands (bongos)","placement":"placed","file":"modules/hall-ui/public/commands.html","line":44,"string_id":"1e4285bdfaef"},
+        {"key":"L0073","section":"Terminal commands (bongos)","text":"The same work from any terminal, outside Claude Code. Run","placement":"placed","file":"modules/hall-ui/public/commands.html","line":45,"string_id":"ec849c59d583"},
+        {"key":"L0074","section":"Terminal commands (bongos)","text":"bongos help","placement":"placed","file":"modules/hall-ui/public/commands.html","line":45,"string_id":"e81d92078af1"},
+        {"key":"L0075","section":"Terminal commands (bongos)","text":"to see this list there.","placement":"placed","file":"modules/hall-ui/public/commands.html","line":45,"string_id":"3c9ba5dc851d"},
+        {"key":"L0076","section":"Terminal commands (bongos)","text":"{…} project{…}","placement":"placed","file":"modules/hall-ui/public/fleet.js","line":39,"string_id":"771bef3d31b5"},
+        {"key":"L0077","section":"footer","text":"Sign out","placement":"shared","file":"modules/hall-ui/public/shell.js","line":471,"string_id":"1883ad7f07fc"},
+        {"key":"L0078","section":"Terminal commands (bongos)","text":"Builders hall · this session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":346,"string_id":"fd1903586e8e"},
+        {"key":"L0079","section":"What are you doing now?","text":"What are you doing now?","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":347,"string_id":"60853319f290"},
+        {"key":"L0080","section":"What are you doing now?","text":"Pick one. You can switch any time from the top bar.","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":348,"string_id":"4f87d5b17b54"},
+        {"key":"L0081","section":"What are you doing now?","text":"Building","placement":"unplaced"},
+        {"key":"L0082","section":"What are you doing now?","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","occurrences":3},
+        {"key":"L0083","section":"What are you doing now?","text":"Artistry","placement":"unplaced"},
+        {"key":"L0084","section":"What are you doing now?","text":"Ideating","placement":"unplaced"},
+        {"key":"L0085","section":"What are you doing now?","text":"Turn thoughts into ideas.","placement":"unplaced"},
+        {"key":"L0086","section":"What are you doing now?","text":"Governing","placement":"unplaced"},
+        {"key":"L0087","section":"What are you doing now?","text":"Ask me again next session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":351,"string_id":"fa86bf403775"}
       ]
     },
     {

package/modules/hall-ui/public/commands-lib.js

@@ -24,7 +24,7 @@
     {
       key: 'find', label: 'Finding things out and working with others',
       blurb: 'Looking up what the project already knows, asking for help, and passing work on.',
-      names: ['status', 'recall', 'ask-for-help', 'collab-review', 'session-handoff', 'read-session-export', 'feedback'],
+      names: ['status', 'recall', 'ask-for-help', 'collab-review', 'session-handoff', 'read-session-export'],
     },
     {
       key: 'owner', label: 'Owner routines',

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.47",
+  "version": "1.21.48",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.47",
+      "version": "1.21.48",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.47",
+  "version": "1.21.48",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9046,5 +9046,15 @@
       "id": "1004562",
       "text": "Walked every building and floor desk of the Governor City in light, dark and on a phone, and fixed what did not match the design: number tiles now say what they count, a cleared floor no longer shows a stale count, counts read"
     }
+  ],
+  "1.21.48": [
+    {
+      "id": "1004576",
+      "text": "Saying \"Bongos feedback: …\" or suggesting how Bongos should behave now reliably sends it to the Bongos team; an unused leftover skill that confused this was removed."
+    },
+    {
+      "id": "1004573",
+      "text": "A project brought in from an existing repo now always picks up the sign-in and settings the platform gives it, instead of silently ignoring them."
+    }
   ]
 }

package/scripts/gds/pack-env-prefix.js

@@ -0,0 +1,73 @@
+'use strict';
+
+// scripts/gds/pack-env-prefix.js — which env-var names a hosted project reads, and
+// whether its own pack agrees with what the provisioning runner writes (task 1004573).
+//
+// WHY. The runner writes every hosted project's /etc/<slug>/web.env under ONE prefix
+// (provisionedEnvPrefix). A project ADOPTED from an existing repo brings its own
+// config/branding.json, and mercury's said envPrefix CLOUDBONGOS while web.env carried
+// BONGOS_* — so the project read none of its sign-in credentials, its address or any
+// setting, and the only symptom anyone saw was "did not report sign-in ready".
+//
+// Its own file because both provision-units.js (web.env) and provision-repo.js (the
+// adopt scaffold) need it, and provision-units already requires provision-repo — a
+// helper living in either would make a require cycle. Requires only provision-config.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { REPO_ROOT } = require('./provision-config.js');
+
+// The pack whose envPrefix a provisioned instance inherits unless its own pack says
+// otherwise (see the long note on ENV_PREFIX_PACK's history in provision-units.js).
+const ENV_PREFIX_PACK = 'config/branding.neutral.json';
+
+// The env-var prefix a provisioned instance actually RESOLVES — i.e. the envPrefix
+// of the pack it loads (ENV_PREFIX_PACK). src/instance-config.resolveEnv
+// reads <envPrefix>_<SUFFIX>, and src/branding.resolveBranding applies
+// <envPrefix>_{PUBLIC,BUILDERS,…}_ORIGIN overrides — so a web.env var only takes
+// effect under THIS prefix. Read from the pack (fail-soft to the vanilla default)
+// so it stays in lockstep instead of a magic string. (The prior slug-based prefix
+// was a latent bug: it never matched the neutral pack's CLOUDBONGOS envPrefix, so
+// the OAuth creds were silently unreadable — task 1972.)
+function provisionedEnvPrefix() {
+  const { FALLBACK_ENV_PREFIX } = require('../../src/instance-config'); // eslint-disable-line global-require
+  try {
+    const pack = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, ENV_PREFIX_PACK), 'utf8'));
+    return pack.envPrefix || FALLBACK_ENV_PREFIX;
+  } catch { return FALLBACK_ENV_PREFIX; }
+}
+
+// The envPrefix a pack's text names, or null (no pack, not JSON, no envPrefix).
+function packEnvPrefix(packText) {
+  try {
+    const pack = JSON.parse(String(packText || ''));
+    return pack && typeof pack.envPrefix === 'string' ? pack.envPrefix : null;
+  } catch { return null; }
+}
+
+// Does the instance's OWN pack read the names this runner writes? PURE: give it the
+// pack's text (or null when it could not be read) and the prefix written; it returns
+// a sentence naming the mismatch, or null when the names agree or the pack says nothing.
+function envPrefixMismatch(packText, written = provisionedEnvPrefix()) {
+  const own = packEnvPrefix(packText);
+  if (!own || own === written) return null;
+  return `the project's config/branding.json reads settings named ${own}_*, but the platform wrote ${written}_* — set its envPrefix to "${written}"`;
+}
+
+// The adopt scaffold's half of the fix: rewrite ONLY the envPrefix value in an adopted
+// repo's config/branding.json so the project reads the names this runner writes,
+// leaving every other byte of the owner's file as they wrote it (a JSON round-trip
+// would reflow it). PURE. Returns { text, from } when it changed something, or null
+// when the names already agree, the pack names no prefix, or it is not JSON.
+function normalizePackEnvPrefix(packText, written = provisionedEnvPrefix()) {
+  const raw = String(packText || '');
+  const own = packEnvPrefix(raw);
+  if (!own || own === written) return null;
+  const re = /("envPrefix"\s*:\s*)"[^"]*"/;
+  if (!re.test(raw)) return null;
+  const text = raw.replace(re, (_m, key) => `${key}"${written}"`);
+  if (packEnvPrefix(text) !== written) return null;
+  return { text, from: own };
+}
+
+module.exports = { ENV_PREFIX_PACK, provisionedEnvPrefix, envPrefixMismatch, normalizePackEnvPrefix };

package/scripts/gds/provision-repo.js

@@ -19,6 +19,7 @@ const { CONFIG, REPO_ROOT, coreVersionSafe, provisionerBotEmail, provisionerBotN
 // upgrade.js can reach these three without pulling provision*.js into the merge
 // resolver's executed closure; re-exported below so every existing caller is unchanged.
 const { instanceRepoRemote, parseTargetRef, resolveOwnerGithubToken } = require('./provision-repo-auth.js');
+const { normalizePackEnvPrefix } = require('./pack-env-prefix.js');   // an adopted pack's envPrefix (task 1004573)
 const { CORE_PKG, compareSemver, isStable } = require('./update-channel.js');
 
 function dbName(inst) { return inst.db_name || inst.slug; }
@@ -832,6 +833,18 @@ async function scaffoldStandaloneRepo(inst, deps) {
     } else {
       writeFile(giPath, INSTANCE_GITIGNORE);
     }
+    // Adopt layers config only where ABSENT, so an owner's existing config/branding.json
+    // keeps whatever envPrefix it carried — and web.env is written under the platform's.
+    // Mercury's said CLOUDBONGOS: it read none of its credentials or settings (task 1004573).
+    // Rewrite just that one value, in this same commit, so the repo and web.env agree.
+    const packPath = path.join(root, 'config', 'branding.json');
+    if (mode === 'adopt' && fs.existsSync(packPath)) {
+      const fixed = normalizePackEnvPrefix(fs.readFileSync(packPath, 'utf8'));
+      if (fixed) {
+        writeFile(packPath, fixed.text);
+        log(`  [scaffold] config/branding.json envPrefix ${fixed.from} → the platform's, so the project reads the settings it is given`);
+      }
+    }
     exec(`git -C ${root} config user.name "${provisionerBotName()}"`);
     exec(`git -C ${root} config user.email "${provisionerBotEmail()}"`);
     exec(`git -C ${root} add -A`);