@bongos/core 1.21.47 → 1.21.49

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.47",
-  "core_contract": "1.21.47",
-  "source_commit": "7212168682e220fda8a9a99d042bfcb0ee4b24e2",
+  "core_version": "1.21.49",
+  "core_contract": "1.21.49",
+  "source_commit": "8d36dbbda9b44f0f8b6c3b55aef369cc3e51fac5",
   "source_ref": "HEAD",
-  "built_at": "2026-10-04T21:26:57.956Z",
+  "built_at": "2026-10-04T21:58:55.051Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 583,
+    "docs_redacted": 582,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 2929,
+    "functional_verbatim": 2928,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3541,
-  "tree_sha256": "cf7879ad23988c49b9be9919407d763a66c814bd08a94f07a09d9d3058ff180b",
+  "file_count": 3539,
+  "tree_sha256": "839929ac0206eab9e2d553a4d4438bc00533eb9dd0f0e075f620cbc01fcf9957",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -42,7 +42,7 @@
     {
       "path": ".claude/skills/bongos-feedback/SKILL.md",
       "mode": "0000644",
-      "sha256": "d1656854500410695d234569f0529d3592936acf220e24fa74935f13aa248561"
+      "sha256": "b30912b54c07c873cc94398af0ffd6c8e364a0f7f81a866343667cc5a87da25a"
     },
     {
       "path": ".claude/skills/bug-triage/SKILL.md",
@@ -134,11 +134,6 @@
       "mode": "0000644",
       "sha256": "5a2e7a11abdc9f0ecc81fbf057978523af56dcddcb712581337059c696a139db"
     },
-    {
-      "path": ".claude/skills/feedback/SKILL.md",
-      "mode": "0000644",
-      "sha256": "184cc6f540628de549f8f6d1a745ff683759f17f1752a0ac8779f52327b57b3d"
-    },
     {
       "path": ".claude/skills/figma-design-sync/SKILL.md",
       "mode": "0000644",
@@ -311,7 +306,7 @@
     },
     {
       "path": "bin/bongos.js",
-      "mode": "0000644",
+      "mode": "0000755",
       "sha256": "7caac78124c7c13464f7f40d0d994cace8651de872a87cbb07deff24413e13cd"
     },
     {
@@ -857,7 +852,7 @@
     {
       "path": "docs/adr/0087-bongos-app-architecture-and-handoff-contract.md",
       "mode": "0000644",
-      "sha256": "26e76c07a9c0965ad0169a4753b6d14bb663d0770bb6f3e134f758e536100549"
+      "sha256": "7ddee60cb02906bd2c9c232236555fa451bac920f569ac6216a2ac2a7e34a33c"
     },
     {
       "path": "docs/adr/0087-compete-on-governance-not-tooling-cursor.md",
@@ -2322,12 +2317,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "0ae8f00ecc1b36cd1e7ee6a1e700991a3724dd08a5f80459e4b20d56bbc089ef"
+      "sha256": "ffbf40e2ea069a3c180adc538e28f6a02959a88cb36bf0d624b1a3278e3ffc18"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "f97cdedb4b13edab50c865e23cc2c1099246dbb1b568188cc2402d9f698a3507"
+      "sha256": "376be30465a0226bbb94e7a910778103a8fdf104efa0bbb6f7f34d22420cfbd8"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2827,7 +2822,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "699759ef62420597eb078d84da76685664dd19a952f9a19bb6e65b98be1a8527"
+      "sha256": "459d6bf111e4644831a95374e9d9c9949568a068e96d9f106fe97a882084feeb"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2837,7 +2832,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f5bbac075fc756176d069ba005ba68451829e123cac49901dfcd364a511da3f6"
+      "sha256": "8bec8c56cd27f99dbad99be3ab62021c4e31d69b7330d26d9a5df9f6b9072b8e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2897,7 +2892,7 @@
     {
       "path": "docs/onboarding/primer.md",
       "mode": "0000644",
-      "sha256": "0213c82ce7001b499f880765a5108f0e97bd075283fc44d8f0d57ea95c93b6d4"
+      "sha256": "f347c1355e2f1a71f3170a260a9c7cec719624c47b24ba89a6db371868caefdc"
     },
     {
       "path": "docs/onboarding/slash-commands.md",
@@ -2927,7 +2922,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "bcd483a16170e98f732e1f9b4b39b3dcf09ee51e692901424d651e31617d564b"
+      "sha256": "5285dec7148aae9249f0656f9cd05782d9e9f780be55e54c0091642334454092"
     },
     {
       "path": "docs/project-context.template.md",
@@ -5447,7 +5442,7 @@
     {
       "path": "modules/hall-ui/public/commands-lib.js",
       "mode": "0000644",
-      "sha256": "e7d482684099e1db89de95bed19f035848829e528efead1d3b43b69b1a984af4"
+      "sha256": "06fe68a65f0be9c56f710d8f44d7accd68e4d93baa22f8ca503a692815c8c45d"
     },
     {
       "path": "modules/hall-ui/public/commands.css",
@@ -5777,7 +5772,7 @@
     {
       "path": "modules/hall-ui/public/hall-render.js",
       "mode": "0000644",
-      "sha256": "db27b1962917ae290c5b99cfbe6e8f86a019a83c365a12ae97c6a8ac33ea2aa2"
+      "sha256": "4dd69b2043732f35a511daf85629759a05e6d4e010f8048e17d504611763ae0f"
     },
     {
       "path": "modules/hall-ui/public/hall-visual.js",
@@ -6137,12 +6132,12 @@
     {
       "path": "modules/hall-ui/public/settings.html",
       "mode": "0000644",
-      "sha256": "86707a0d106c7897594099014be132bba08c25c46dc4f8e255b45cee661ff1d1"
+      "sha256": "a6bb1817565a3a57894bc583846d71e21ad9e3296f13d3f121662bf6b7eb7af8"
     },
     {
       "path": "modules/hall-ui/public/settings.js",
       "mode": "0000644",
-      "sha256": "bb282ae096d880185aeb8f0e954286743f49fb256f52a598302d43333e54c56c"
+      "sha256": "59d825e1b26b2800495e8f1c525ac60712925499935d231a82edb81ffa3f111e"
     },
     {
       "path": "modules/hall-ui/public/settings.states.json",
@@ -6282,7 +6277,7 @@
     {
       "path": "modules/hall-ui/public/style.css",
       "mode": "0000644",
-      "sha256": "8f479a7b91a7f1c259b523bb802117a5bdaf818414ed59a9291c14a6b03542df"
+      "sha256": "a7c88216c594d064ebbef90b00425c4375b19c69f4a10e1696dc7a261ade314e"
     },
     {
       "path": "modules/hall-ui/public/task-detail.js",
@@ -7587,7 +7582,7 @@
     {
       "path": "modules/onboarding/onboarding-state.js",
       "mode": "0000644",
-      "sha256": "790882398570e371aecc36b0dac143846c183e674070deb552d23139dc92b5dd"
+      "sha256": "489863e82dc39b60970e049933660db74abb4d9034ad201cb24fd3c093a8f785"
     },
     {
       "path": "modules/onboarding/onboarding.js",
@@ -9897,12 +9892,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9c3b5080e634837249c14e6442cf69a6009f39cbe83a68a1071a7f3c6a31148d"
+      "sha256": "14e715eb1534069c70496f3071b3e6617f814ca876194500dfb69d032e17da49"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cf0fb70b6b1b7fab873b9bfa9254b59b6737eecf06e13fca620cd06bc856c4c9"
+      "sha256": "5bb3ee4195d0daed575890097b35a2b895eaad0204953ad15a74e705008c41d7"
     },
     {
       "path": "public-docs/index.html",
@@ -9922,12 +9917,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "081ef60b83790763eff2a30b449f0957cd87973584fcae33fb0281f7fa1f6461"
-    },
-    {
-      "path": "scripts/bongos-mcp.js",
-      "mode": "0000644",
-      "sha256": "1cd62877bb9777f9715ed7a2932e8832368d1a2051c2e5a02b1786824eda6b1d"
+      "sha256": "97d08ce6648928804edd580a922f2ec9572205d5fe843b9d54fe1be13e422445"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -10232,7 +10222,7 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "0c850adc8b5fc9982638eba8ff1efa1249ea0b9223a86fde39cba21c67d64a27"
+      "sha256": "f2aa97cbecc191570a132ea93422226998708328aa755075bbca27924c5a4b75"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
@@ -10424,11 +10414,6 @@
       "mode": "0000644",
       "sha256": "8ed7c35c0d6be3c8a11ee990b487114d7e422caeb70c67240b5060a0087cfdc4"
     },
-    {
-      "path": "scripts/gds/feedback-latest.js",
-      "mode": "0000644",
-      "sha256": "75543005eb7b91d020b00ac1bc616ecba3a7ceeb35aa53222bbe2149835abfaa"
-    },
     {
       "path": "scripts/gds/feedback-send.js",
       "mode": "0000644",
@@ -10859,6 +10844,11 @@
       "mode": "0000644",
       "sha256": "aa998dd5f0e3e9f33032ac880e5b948e88eb9bc467125ea652e8e317beada0dd"
     },
+    {
+      "path": "scripts/gds/pack-env-prefix.js",
+      "mode": "0000644",
+      "sha256": "c68f593ab10aa3773b594d781c0ab712daf5b0e9c7c52273ec6dddecccef179c"
+    },
     {
       "path": "scripts/gds/package-core.js",
       "mode": "0000644",
@@ -10967,7 +10957,7 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "ca7e46a175308c7789a530284c73ccf58b8c09eac873e07b516206e234be99ab"
+      "sha256": "8e2cf2e362b5e38832b53720a84ee0fb9003f9062cf9b7d03353a62fde936566"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
@@ -10977,12 +10967,12 @@
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "2fd3cd47bce98f32ec151557908fdde48f91d7a3d7a144f7e3e7f77638eb5165"
+      "sha256": "87e88c2f2f2aedad871b5d56d7d1528d9ee89fa568f0386eaa170843146db040"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "2bf80bfae7a2f8c0474965a6cf9f52f036e362dd0f96b8b5e12efc509f7afae9"
+      "sha256": "f58a7db598467d02e496688f71327a2c39b0e680a4b3c24fc0d7dd6346e07c8b"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -12012,7 +12002,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "1ecee7d2079aa23e0e22cfaea53a5283d4e6e0f5d6f53487db7fce7ac105d2bd"
+      "sha256": "39673ba55974dc86bb4aa04e68c8315dcca6144270847e396074b7e5eb4bdc6d"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -12142,12 +12132,12 @@
     {
       "path": "src/instance-config.js",
       "mode": "0000644",
-      "sha256": "2831a56dae693fd9280af8a27802573dcdec0656c8fc528b7b849ec7d9eda66b"
+      "sha256": "9f837c9d2be2b5c6cc5c6b7dba0403cebc45f00602e491a52a952ca1c689ffd7"
     },
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "89f14edf67ae146272e1a4d4d62136f67e188f7c6303de4d1839a473af22cc9d"
+      "sha256": "04b7706a20a30261e5d07b3d123b96da4f37222960996c8fdb17dbb58b1ad87d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12767,7 +12757,7 @@
     {
       "path": "tests/bongos_cli.mjs",
       "mode": "0000644",
-      "sha256": "a86cb7c277a94b24489d0f186dd38f0eef7c71dd0adc0cbbd0370a3af82b9533"
+      "sha256": "b9bfebce2f0e2a806ce02271ca0a6f45ce2b8cd3dd487ca4cccc91f7fb10a8c5"
     },
     {
       "path": "tests/bongos_dispatch.mjs",
@@ -12932,7 +12922,7 @@
     {
       "path": "tests/cli_allowlist_permissions.mjs",
       "mode": "0000644",
-      "sha256": "ec2a34e9f7151befdcc5b09e69c9ea83ca794e3d25c7de600a2f04c6291dae87"
+      "sha256": "1d490fb23fce3d6c39322dcef6cfceb8ac2a767c12deb842174b8d9e675561d2"
     },
     {
       "path": "tests/cli_dispatcher.mjs",
@@ -12967,7 +12957,7 @@
     {
       "path": "tests/cli_token_reissue.mjs",
       "mode": "0000644",
-      "sha256": "da6b45619e6848c37ebc8d53ffc9d8f9d5379df26563c9030b339a8c389e645d"
+      "sha256": "6cd3e6ef962c4fb56236784951f85bbe90e2c36dbfbe535a524a34389c917eeb"
     },
     {
       "path": "tests/client_baseurl_guard.mjs",
@@ -13564,11 +13554,6 @@
       "mode": "0000644",
       "sha256": "74f8d8852b8949dc55ac38dd6f31da85bb55aae1215a146213495db898515086"
     },
-    {
-      "path": "tests/feedback_latest.mjs",
-      "mode": "0000644",
-      "sha256": "bee534dc1d92fd9ac2031c01195dad92b941b9c820fe8e4122a135292655cfdc"
-    },
     {
       "path": "tests/figma_adapter.mjs",
       "mode": "0000644",
@@ -14459,6 +14444,11 @@
       "mode": "0000644",
       "sha256": "0d253df6ebc464b8415bc3a361fec06ea82e70737bfc9a2dcf6d3e31714b289a"
     },
+    {
+      "path": "tests/hall_onboarding_bongos_setup.mjs",
+      "mode": "0000644",
+      "sha256": "7596179cfc958e65a1b2b51703052589ed5b7f218f88fa087463d1fd486fdd0c"
+    },
     {
       "path": "tests/hall_oversight_world.mjs",
       "mode": "0000644",
@@ -14922,7 +14912,7 @@
     {
       "path": "tests/instance_config.mjs",
       "mode": "0000644",
-      "sha256": "914eed9e342e6d612315f398bf2ed65b44af9037fce4293c2694e2726ca1e451"
+      "sha256": "ba3404f1fd37d33dac3e64ac17a0c71fd8d73a56f7fcef362f5ffd1423136e55"
     },
     {
       "path": "tests/instance_db_migrated_on_code_move.mjs",
@@ -14932,7 +14922,7 @@
     {
       "path": "tests/instance_feedback.mjs",
       "mode": "0000644",
-      "sha256": "470617a2fa728f67c7e2de09fd8213cd48ea6be6a7ca55fcd465b03a01bdf81f"
+      "sha256": "e3402d4767d21bd6d5ab80ad6f0670d4c94c9c56ff1c4656ebd4218b191a8b1c"
     },
     {
       "path": "tests/instance_manifest.mjs",
@@ -16057,7 +16047,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "4f8c3922665431062f091e1ab188be3bb224b4475d87612de97e18e79fe5cd98"
+      "sha256": "4ffddc6128eb9860d6b48493c4d9b6fd9e108f7c0e656f003bbbe32866b97675"
     },
     {
       "path": "tests/provision_account_identity.mjs",
@@ -17022,7 +17012,7 @@
     {
       "path": "tests/skill_menu_ruling.mjs",
       "mode": "0000644",
-      "sha256": "e4be23fe23636db0256119caef67241dd9132aadabc48b5063419b58f82e574d"
+      "sha256": "47e45afa89da802b8cfad2b954c6b41ec1f79e359cb58c6667fca7e0b8972ab5"
     },
     {
       "path": "tests/skill_preflight.mjs",

package/.claude/skills/bongos-feedback/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: bongos-feedback
 description: >-
-  File a Bongos problem with its maintainers — unasked, whenever a builder vents that Bongos itself is broken, stuck or confusing. Triggers: "/bongos-feedback", "Bongos is broken", "this keeps failing", "why does claim hang", "report this Bongos bug".
+  Send feedback, a bug or a wish about Bongos itself to its maintainers; unasked when a builder vents. Triggers: "Bongos feedback: …", "tell the Bongos team", "Bongos should…", "Bongos is broken", "this keeps failing", "/bongos-feedback".
 plain: >-
   Sends a short note about a problem with Bongos, or an idea for it, to the people who build Bongos. It also does this by itself when you complain that Bongos is not working.
 reach-for: >-
@@ -12,16 +12,17 @@ cost: >-
 
 **Script skill (authoritative).** The core action is `bongos feedback "<message>"` (or `--idea "<message>"`, or `--message-file <path>`). Run it and print its output verbatim.
 
-This is **not** `/feedback`, which loads a walkthrough you recorded into this session. This one **sends** a note about Bongos — the tool — upstream to its maintainers on Cloud Bongos, where a bug becomes a task waiting for a maintainer's approval (tasks 1004462, 1004467).
+This **sends** a note about Bongos — the tool — upstream to its maintainers on Cloud Bongos, where a bug becomes a task waiting for a maintainer's approval (tasks 1004462, 1004467).
 
 ## Two ways in
 
-- **Asked** — the builder says "report this", "tell the Bongos team", or runs `/bongos-feedback`. Draft it, show them, send on their go.
+- **Asked** — the builder labels a message as feedback for Bongos ("Bongos feedback: …", "feedback for Bongos", "tell the Bongos team", "report this") or runs `/bongos-feedback`. A message that already says what the feedback is **is** the go: write the report, send it, and show them what was sent. Only when they ask you to report something without saying what, draft it and send on their go.
+- **Suggestions count.** Feedback is not only breakage. "Bongos should…", "I don't want Bongos to…", or a complaint about how Bongos organises their work (versions, goals, tasks, ranks) is feedback too — send it with `--idea`. Fixing it in their own project (moving the goal, saving a preference) is fine, but it does not replace sending it: the next project would hit the same thing.
 - **Proactive** — the builder is venting that Bongos is not working: frustration, swearing, "this is broken again", "why does X keep failing", "Bongos is useless today". **File it without being asked**, then tell them in one line (below). The owner's standing rule (2026-09-30): every rant about Bongos not working becomes something to fix. Do not ask permission first, and do not argue them out of it.
 
 ## Is it about Bongos? (proactive mode files only when yes)
 
-File when the complaint is about **Bongos itself**: a `bongos`/`/builder-*` command, a claim, ship, grade, merge or deploy step, the hall, Settings, sign-in, credits, the upgrade, or a Bongos message that confused them.
+File when the complaint is about **Bongos itself**: how it organises their work (a goal that forced a new version, a version they did not want), a `bongos`/`/builder-*` command, a claim, ship, grade, merge or deploy step, the hall, Settings, sign-in, credits, the upgrade, or a Bongos message that confused them.
 
 Do **not** file when it is about their **own project's** code, tests or design, about Claude itself, their laptop, GitHub or another service — or when the "problem" is a rule working as designed (an `[otb-plain]` card saying `By design: Yes`). If it is genuinely unclear, fix the thing in front of you first and file only if it turns out to be Bongos.
 

package/docs/adr/0087-bongos-app-architecture-and-handoff-contract.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-06-26
 **Context:** Bongos App `BONGOS-V1` / criterion C4 (the feedback loop closes — capture lands in a coding agent), task [#1312](https://example.com/builders#/task/1312) (`BV1.R33`). Records the architecture the R01–R14 rungs built and pins the contract the three handoff paths (R12 [#1307](https://example.com/builders#/task/1307), R13 [#1308](https://example.com/builders#/task/1308), R14 [#1309](https://example.com/builders#/task/1309)) share. Builds on [ADR 0045](0045-devbox-desktop-app.md) (the Dev Box desktop app, now absorbed), [ADR 0072](0072-bongos-app-mac-signed-first-windows-deferred.md) (signing posture), [ADR 0083](0083-modular-architecture-strangler-build-plan.md) (the modular core), and the [ADR 0062](0062-medusa-instance-model-decoupling.md) core↔host split.
-**Status:** Accepted.
+**Status:** Accepted. **Handoff half retired 2026-10-04 (task 1004576):** the desktop app was never built, so the `/feedback` skill, its `feedback-latest.js` engine and the `bongos-mcp.js` launcher were deleted. Builders send feedback about Bongos with `/bongos-feedback` instead.
 **Track:** `internal` (development system → the Cloud Bongos desktop app line; bongos succeeds the GDS as the primary builder surface after GDS-V4).
 
 ## Problem — feedback has nowhere to land
@@ -32,7 +32,7 @@ This ADR records (a) the app's overall shape, and (b) the one contract all the h
 **One shared `latest` pointer; three readers.** Every write of a bundle (`bundle.js writeBundle`) records it as `latest` — an atomic `latest.json` pointer plus a best-effort `latest/` symlink — in `bongos-app/src/handoff.js`. All three handoff paths resolve "the newest bundle" through that one `resolveLatest()`, so they can never drift:
 
 1. **Claude Desktop — file-bundle + clipboard (R12).** A toolbar button copies `prompt.md` to the clipboard and opens the bundle folder; the user pastes the prompt and drags the images into the composer (Desktop accepts mixed text + images). A one-liner spells out exactly what to do. (`handoff.js` + the `feedback:produce` / `feedback:handoff-desktop` IPC in `main.js`.)
-2. **Claude Code — the `/feedback` slash command (R13).** Running `/feedback` shells `node scripts/gds/feedback-latest.js`, which prints the `prompt.md` body + the absolute path of every frame; Claude then `Read`s each path so the screenshots enter context. This sidesteps the CLI's unreliable clipboard-image paste — Claude reads the frames from disk, not from a pasted blob.
+2. **Claude Code — the `/feedback` slash command (R13).** Running `/feedback` shelled the `feedback-latest.js` script (now deleted), which prints the `prompt.md` body + the absolute path of every frame; Claude then `Read`s each path so the screenshots enter context. This sidesteps the CLI's unreliable clipboard-image paste — Claude reads the frames from disk, not from a pasted blob.
 3. **MCP — `get_latest_feedback` (R14, optional "direct" path).** A local, zero-dependency stdio MCP server (`bongos-app/src/mcp-server.js`, launched by `scripts/bongos-mcp.js`) exposes one tool that returns the prompt text + the screenshots' **file paths** (never base64 — inlining would blow the MCP tool-result size cap). Both Desktop and Code can pull the latest bundle hands-free once the server is registered. Optional/stretch for V1 — the file-bundle + `/feedback` paths already close the loop.
 
 ### Why hand-rolled MCP (no SDK dependency)