@bongos/core 1.21.87 → 1.21.89

package/modules/hall-ui/public/genesis-home.js

@@ -33,6 +33,17 @@
     not_deciding: 'The plan is already settled.',
   };
 
+  // What saving the plan did to the government, when it was not settled in the same
+  // click. The server's charter outcome (modules/onboarding/genesis-home.js
+  // applyGovernmentChoice); in_force and none need no sentence.
+  function charterNote(c) {
+    if (!c) return '';
+    if (c.state === 'sitting') return 'Your starting government is in the Board Room for a vote.';
+    if (c.state === 'needs_council') return 'A Foundation needs a council first. Add a council rank, then choose Foundation on the Charter.';
+    if (c.state === 'not_filed') return 'The plan is saved, but the government could not be changed just now. You can change it on the Charter.';
+    return '';
+  }
+
   function projectName() {
     var b = window.__BRANDING__ || {};
     return (b.identity && b.identity.productName) || 'the project';
@@ -307,7 +318,21 @@
       var t = e.target.closest('button');
       if (!t || !host.contains(t)) return;
       if (t.hasAttribute('data-genesis-plan')) {
-        act(send('POST', '/founding/plan', planBody(host)).then(function () { window.location.reload(); }));
+        // The government picked here is filed as a charter amendment with the plan
+        // (task 1004656). When the founder's one yes decides it, saving the plan is
+        // that yes too, the same one-click fast-track the stage closes take.
+        act(send('POST', '/founding/plan', planBody(host)).then(function (out) {
+          var c = out && out.charter;
+          if (c && c.state === 'sitting' && c.one_vote_decides && c.item_id) {
+            return send('POST', '/government/board/items/' + encodeURIComponent(c.item_id) + '/votes', { direction: 'yes' })
+              .catch(function () { return null; });
+          }
+          var said = charterNote(c);
+          if (!said) return null;
+          toast(said);
+          // Give the sentence time to be read before the reload takes it away.
+          return new Promise(function (done) { setTimeout(done, 3500); });
+        }).then(function () { window.location.reload(); }));
       } else if (t.hasAttribute('data-genesis-close')) {
         // The solo fast-track (spec D4): when the founder's one yes decides the sitting
         // and nobody else is asked, the close and the confirm are one click.

package/modules/hall-ui/public/street-amend.js

@@ -50,6 +50,38 @@
     var d = constitution && constitution.decision_rules;
     return d && Array.isArray(d.rules) ? d.rules.filter(function (r) { return r && r.key; }) : [];
   }
+  // The forms of government a charter draft can pick in one tap (task 1004656), from
+  // the constitution's own charter block (modules/government/charter.js), so a name
+  // is never typed twice. A form is a franchise plus a pass rule; its seat is the
+  // franchise option's predicate. Foundation seats a council the owner names (a
+  // custom rank this page cannot know), so it is listed as needing one rather than
+  // offered; the forms that cannot be adopted yet are listed as later.
+  function formsOf(constitution) {
+    var ch = constitution && constitution.charter;
+    var forms = ch && Array.isArray(ch.forms) ? ch.forms : [];
+    var seats = {};
+    (ch && Array.isArray(ch.variables) ? ch.variables : []).forEach(function (v) {
+      if (v && v.key === 'franchise' && Array.isArray(v.options)) {
+        v.options.forEach(function (o) { if (o && o.key && o.predicate) seats[o.key] = o.predicate; });
+      }
+    });
+    var out = { pick: [], council: [], later: [] };
+    forms.forEach(function (f) {
+      if (!f || !f.key) return;
+      if (!f.available) { out.later.push(str(f.name)); return; }
+      var seat = seats[f.franchise];
+      if (!seat || !FROM_PASS[f.pass_rule]) { out.council.push(str(f.name)); return; }
+      out.pick.push({ value: f.key, words: str(f.name), decided_by: seat, rule: FROM_PASS[f.pass_rule] });
+    });
+    return out;
+  }
+  // Which form the draft's settings make, or null (the name follows the settings).
+  function formOf(d) {
+    var list = (d && d.forms && d.forms.pick) || [];
+    for (var i = 0; i < list.length; i++) if (list[i].decided_by === d.decided_by && list[i].rule === d.rule) return list[i];
+    return null;
+  }
+
   function rowOf(constitution, area) {
     var as = areasOf(constitution) || [];
     for (var i = 0; i < as.length; i++) if (as[i] && as[i].area === area) return as[i];
@@ -103,6 +135,7 @@
         ? { decided_by: board.membership, rule: FROM_PASS[board.pass_rule] || null }
         : { decided_by: row.decided_by, rule: row.decided_by === 'gate' ? null : row.rule },
       decided_by: null, rule: null, reason: '',
+      forms: charter ? formsOf(constitution) : { pick: [], council: [], later: [] },
     };
     if (charter) {
       d.decided_by = board.membership;
@@ -131,11 +164,21 @@
   }
   function copy(d) { var o = {}; for (var k in d) if (Object.prototype.hasOwnProperty.call(d, k)) o[k] = d[k]; return o; }
 
-  // One pick: field 'who' | 'rule' | 'reason'. A value outside the vocabulary
-  // is refused (the draft comes back unchanged).
+  // One pick: field 'form' (the charter only) | 'who' | 'rule' | 'reason'. A value
+  // outside the vocabulary is refused (the draft comes back unchanged). A form sets
+  // who and which rule together; picking either afterwards leaves the form to be
+  // read back from the settings.
   function pick(d, field, value) {
     if (!d || !d.ok) return d;
     var n = copy(d);
+    if (field === 'form') {
+      var list = (d.forms && d.forms.pick) || [], f = null;
+      for (var i = 0; i < list.length; i++) if (list[i].value === value) f = list[i];
+      if (!f || !hasValue(d.whoOptions, f.decided_by)) return d;
+      n.decided_by = f.decided_by;
+      n.rule = f.rule;
+      return settle(n);
+    }
     if (field === 'who') { if (!hasValue(d.whoOptions, value)) return d; n.decided_by = value; }
     else if (field === 'rule') { if (!hasValue(d.ruleOptions, value)) return d; n.rule = value; }
     else if (field === 'reason') { n.reason = str(value).slice(0, REASON_MAX); return n; }
@@ -190,6 +233,10 @@
     if (check(d)) return null;
     var api = (card() && card().API) || '/api/bongos';
     var why = str(d.reason).trim();
+    // A named form goes through the charter route, so the record reads
+    // "Charter: Direct Democracy" and the server builds the same constitution.
+    var form = d.charter ? formOf(d) : null;
+    if (form) return { method: 'POST', url: api + '/government/board/charter', body: { form: form.value, rationale_md: why } };
     if (d.charter) return { method: 'POST', url: api + '/government/board/items', body: { subject_type: 'constitutional_amendment', proposal: proposal(d), rationale_md: why } };
     return { method: 'POST', url: api + '/government/board/decision-rules', body: { rules: [ruleRow(d)], rationale_md: why } };
   }
@@ -205,6 +252,9 @@
     nobody_is_vacant: 'An empty building decides nothing.',
     bad_membership: 'That is not a seat this project knows.',
     bad_pass_rule: 'That is not a way the board can decide.',
+    council_needs_a_rank: 'A Foundation needs a council rank first.',
+    unknown_council_rank: 'There is no such council rank yet, so that would seat no one.',
+    form_not_available: 'That form of government is not available yet.',
   };
   function refusal(status, body) {
     var e = body && body.error ? body.error : {};
@@ -213,7 +263,7 @@
     if (e.code === 'no_change') return 'That already is how it works. Nothing was filed.';
     if (status === 401) return 'Sign in to file an amendment.';
     if (status === 403) return 'Filing an amendment is not yours to do here. The server refused it.';
-    if ((e.code === 'invalid_decision_rules' || e.code === 'invalid_proposal') && det.reason) {
+    if ((e.code === 'invalid_decision_rules' || e.code === 'invalid_proposal' || e.code === 'invalid_charter') && det.reason) {
       return REASONS[det.reason] || 'The server refused it: ' + str(det.reason).replace(/_/g, ' ') + '.';
     }
     var C = card();
@@ -224,7 +274,9 @@
   function answer(d, body) {
     var item = body && body.item;
     return {
-      toast: 'Filed. Your amendment to ' + (d && d.name ? d.name : 'this building') + ' is on the Charter for the council to vote on.',
+      toast: d && d.charter && formOf(d)
+        ? 'Filed. Changing the government to ' + formOf(d).words + ' is on the Charter for the council to vote on.'
+        : 'Filed. Your amendment to ' + (d && d.name ? d.name : 'this building') + ' is on the Charter for the council to vote on.',
       building: 'charter',
       matter: item && item.id != null ? 'board:' + item.id : null,
       kind: 'light',
@@ -234,6 +286,7 @@
   var api = {
     RANKS: RANKS, draftFor: draftFor, pick: pick, changed: changed, change: change,
     check: check, request: request, refusal: refusal, answer: answer, whoOptions: whoOptions, ruleOptions: ruleOptions,
+    formsOf: formsOf, formOf: formOf,
   };
   root.GovAmend = api;
   if (typeof module !== 'undefined' && module.exports) module.exports = api;

package/modules/hall-ui/public/street.js

@@ -1099,6 +1099,19 @@
     } else ch.appendChild(node('p', 'inside-note', 'This is how it works today. Pick who decides, or how, to change it.'));
     box.appendChild(ch);
     var picks = node('div', 'inside-draft__picks');
+    // The Charter's draft leads with the forms of government, one tap each (task
+    // 1004656): a form sets who decides and how together, and the chip lit is the
+    // form the settings make, so a hand-picked mix lights none.
+    if (d.charter && d.forms && d.forms.pick.length) {
+      var lit = A.formOf(d);
+      picks.appendChild(draftField('government', 'insideDraftForm', draftChips('insideDraftForm', d.forms.pick, lit ? lit.value : null, function (v) {
+        dr.d = A.pick(dr.d, 'form', v); dr.error = ''; bumpDraft('insideDraftForm');
+      }), true));
+      var aside = [];
+      if (d.forms.council.length) aside.push(d.forms.council.join(', ') + ' needs a council rank first.');
+      if (d.forms.later.length) aside.push('Coming later: ' + d.forms.later.join(', ') + '.');
+      if (aside.length) picks.appendChild(node('p', 'inside-note inside-draft__later', aside.join(' ')));
+    }
     picks.appendChild(draftField('who decides', 'insideDraftWho', draftChips('insideDraftWho', d.whoOptions, d.decided_by, function (v) {
       dr.d = A.pick(dr.d, 'who', v); dr.error = ''; bumpDraft('insideDraftWho');
     }), true));

package/modules/onboarding/genesis-home.js

@@ -57,8 +57,8 @@ const MAX_DAYS = 90;
 const intIn = (v, lo, hi) => Number.isInteger(v) && v >= lo && v <= hi;
 
 // parsePlan(body) — PURE. The founder's plan, defaults filled in, or why it is refused.
-// The government is recorded, not applied: the charter stage (task 1004427) files it as
-// an amendment, so here it is only a well-formed form key.
+// Here the government is only a well-formed form key; savePlan files it as a charter
+// amendment once the plan is saved (applyGovernmentChoice, task 1004656).
 function parsePlan(body = {}) {
   const b = body && typeof body === 'object' ? body : {};
   const days = {};
@@ -281,7 +281,46 @@ async function savePlan(body, builderId, deps = {}) {
   await s.set(PLAN_KEY, JSON.stringify(parsed.plan), builderId);
   const seeded = await s.lifecycle.seedGenesis({ builderId, existing: parsed.plan.existing });
   await fm.setFoundingMode({ stage: 'scope' }, builderId, modeDeps(s));
-  return { ok: true, plan: parsed.plan, seeded: seeded && seeded.seeded };
+  const charter = await applyGovernmentChoice(parsed.plan.government, builderId, s);
+  return { ok: true, plan: parsed.plan, seeded: seeded && seeded.seeded, charter };
+}
+
+// applyGovernmentChoice — the government picked at decide becomes the one in force
+// (task 1004656). It is filed as an ordinary charter amendment under the constitution
+// in force (the government port's proposeCharter), so the board decides it like any
+// change to the rules: under the monarchy default the founder's own yes applies it,
+// and every later stage is then closed by the government they chose (spec D7).
+// Never refuses the plan — the plan is saved first, and a choice that cannot be filed
+// says why in `state`:
+//   none          no government was picked
+//   in_force      the constitution already reads as that form (Monarchy at birth)
+//   sitting       filed; `item_id`, and `one_vote_decides` when one yes carries it
+//   needs_council Foundation, which needs a council rank before it can seat anyone
+//   not_filed     anything else (`reason`), or no government module to file it with
+async function applyGovernmentChoice(form, builderId, s) {
+  if (!form) return { state: 'none' };
+  const gov = s.government;
+  if (!gov || typeof gov.proposeCharter !== 'function') return { state: 'not_filed', form, reason: 'no_government' };
+  let out;
+  try {
+    out = await gov.proposeCharter({ form, proposedBy: builderId });
+  } catch (_) {
+    return { state: 'not_filed', form, reason: 'charter_failed' };
+  }
+  if (out && out.ok) {
+    const snap = (out.item && out.item.constitution) || {};
+    return {
+      state: 'sitting',
+      form,
+      item_id: out.item ? String(out.item.id) : null,
+      one_vote_decides: snap.pass_rule === 'first_ratifier',
+      reads_as: out.reads_as ? out.reads_as.name : null,
+    };
+  }
+  const reason = (out && out.reason) || 'charter_failed';
+  if (reason === 'no_change') return { state: 'in_force', form };
+  if (reason === 'council_needs_a_rank') return { state: 'needs_council', form };
+  return { state: 'not_filed', form, reason };
 }
 
 // closeStage — put the current stage to the Board Room. The finished-tasks gate is the
@@ -335,7 +374,7 @@ async function onStagePassed(deps = {}) {
 
 module.exports = {
   PLAN_KEY, STAGE_INFO, PROPER, DEMO_PEOPLE, DEMO_HOURS, intIn, parsePlan, shapeGenesis, demoMinutes, demoPlan,
-  readGenesis, startFounding, savePlan, closeStage, comeAlive, onStagePassed,
+  readGenesis, startFounding, savePlan, applyGovernmentChoice, closeStage, comeAlive, onStagePassed,
   // the founding-mode deps this file reads the mode with, for founding-birth.js (task 1004506)
   modeDepsFor: (deps) => modeDeps(seams(deps)),
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.87",
+  "version": "1.21.89",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.87",
+      "version": "1.21.89",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.87",
+  "version": "1.21.89",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9352,5 +9352,17 @@
       "id": "1002852",
       "text": "The task list a builder sees at the start of a session now opens with the goals they have joined and how much work in each is ready, and groups the tasks under their goals, with the builder's own goals first and anything witho"
     }
+  ],
+  "1.21.88": [
+    {
+      "id": "1004482",
+      "text": "Upgrading a project now clears out commands Bongos used to ship but has since retired (the old dev-box commands, the old /dev /ideate /paint playbooks, the pixel-art commands), so the Commands page and Claude's menu only list"
+    }
+  ],
+  "1.21.89": [
+    {
+      "id": "1004656",
+      "text": "A new project now really runs under the government its founder picks. Before, the choice made while creating a project was stored and then ignored, so every project stayed under one-person rule. Now picking a government files"
+    }
   ]
 }

package/scripts/gds/claude-materialize.js

@@ -30,6 +30,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { spawnSync } = require('node:child_process');
+const crypto = require('node:crypto');
 const { VERBS } = require('../../bin/bongos.js'); // side-effect-free require (guarded main)
 const ic = require('../../src/instance-config'); // neutral configDir/envPrefix fallbacks (never a founder literal)
 const { isCorePackageName, CORE_PACKAGE_NAMES } = require('../../src/module-loader/catalog'); // one definition of "this checkout IS the core"
@@ -277,6 +278,59 @@ function moduleSkillSources(opts) {
   return out;
 }
 
+// ---- retired core skills: the tombstone list (task 1004482) -----------------
+// A skill the core USED to ship from its own .claude/skills/ and no longer does (the dev-box
+// verbs, the old /dev /ideate /paint role playbooks, the pixel-art skills that moved into a
+// default-off module). Every instance materialized before task 1004482 received them as core
+// skills, and the provenance manifest then recorded only module-declared names — so step 1c
+// could never prove it had put them there and they stayed in .claude/skills/ for the harness to
+// load and the hall's Commands page to list, forever.
+//
+// From task 1004482 on the manifest records EVERY skill a materialize lands, so a skill the core
+// drops later is withdrawn by step 1c's ordinary rule. This list closes the historical gap only,
+// and is therefore a closed set: it should not need a new entry.
+//
+// "Never touch a skill the instance authored" is held by a fingerprint, not by the name: each
+// entry lists sha256 digests (first 16 hex) of every description the core ever shipped under that
+// name, as written and as bongosify() rewrote it. A dir whose SKILL.md description matches none of
+// them is not ours and is left in place with a note — an owner who wrote their own /dev keeps it.
+const RETIRED_CORE_SKILLS_FILE = path.join(__dirname, 'retired-core-skills.json');
+
+// The `description:` value of a SKILL.md's frontmatter, whitespace-collapsed — a plain scalar,
+// a quoted one, or a block scalar (`>` / `|`) with its indented continuation lines. null when
+// the file has no frontmatter or no description. PURE + exported.
+function skillDescription(text) {
+  const m = String(text == null ? '' : text).replace(/\r\n/g, '\n').match(/^---\n([\s\S]*?)\n---(?:\n|$)/);
+  if (!m) return null;
+  const lines = m[1].split('\n');
+  const i = lines.findIndex((l) => /^description:/.test(l));
+  if (i < 0) return null;
+  const parts = [lines[i].replace(/^description:\s*/, '')];
+  if (/^[>|][+-]?$/.test(parts[0])) parts[0] = '';
+  for (let j = i + 1; j < lines.length && /^\s+\S/.test(lines[j]); j += 1) parts.push(lines[j]);
+  const value = parts.join(' ').replace(/\s+/g, ' ').trim().replace(/^(["'])([\s\S]*)\1$/, '$2').trim();
+  return value || null;
+}
+
+function descriptionDigest(desc) {
+  return crypto.createHash('sha256').update(String(desc)).digest('hex').slice(0, 16);
+}
+
+// Does this instance skill dir carry a description the core shipped under `name`? Reads the
+// tombstone's digests; an unreadable SKILL.md or a missing description answers "no" (keep it).
+function isRetiredCoreCopy(dir, digests) {
+  if (!Array.isArray(digests) || !digests.length) return false;
+  let text;
+  try { text = fs.readFileSync(path.join(dir, 'SKILL.md'), 'utf8'); } catch { return false; }
+  const desc = skillDescription(text);
+  return desc != null && digests.includes(descriptionDigest(desc));
+}
+
+function readRetiredCoreSkills(file = RETIRED_CORE_SKILLS_FILE) {
+  const j = readJsonSafe(file);
+  return j && j.skills && typeof j.skills === 'object' ? j.skills : {};
+}
+
 // ---- I/O: copy a tree, transforming text files through bongosify ----------
 
 const TEXT_EXT = new Set(['.md', '.txt', '.sh']); // command-bearing text we rewrite (skills are SKILL.md)
@@ -759,10 +813,38 @@ function materializeClaude({ coreRoot, instanceDir, dryRun = false, overwrite =
   // exists to fix. Deliberately asked of the CORE source tree rather than the roster, so a
   // name no enabled module declares any more is still recognised as legitimately sourced.
   const coreShipsNow = (name) => fs.existsSync(path.join(skillsSrc, name)) && !skipSkills.has(name);
+  // Every CORE skill step 1 landed is recorded too (task 1004482), so a skill the core stops
+  // shipping in a later release is withdrawn by the rule below instead of lingering forever.
+  // When the core's .claude/skills/ could not be read at all, nothing was landed from it and
+  // nothing may be withdrawn on that account: the previous core entries are carried forward.
+  const coreTreeRead = skillsRes.present;
+  if (coreTreeRead) {
+    for (const name of fs.readdirSync(skillsSrc)) {
+      if (landedNow[name] || !SKILL_NAME_RE.test(name) || skillSkip(name)) continue;
+      if (!fs.statSync(path.join(skillsSrc, name)).isDirectory()) continue;
+      if (!dryRun && !fs.existsSync(path.join(skillsDest, name))) continue;
+      landedNow[name] = { source: `.claude/skills/${name}`, coreShipped: true };
+    }
+  } else {
+    for (const [name, rec] of Object.entries(landedPreviously)) if (rec && rec.coreShipped && !rec.module && !landedNow[name]) landedNow[name] = rec;
+  }
   const withdrawable = Object.keys(landedPreviously).filter((n) => SKILL_NAME_RE.test(n) && !landedNow[n] && !coreShipsNow(n));
+  // The historical half (task 1004482): a skill the core retired BEFORE the manifest recorded
+  // core skills is withdrawn when its dir still carries a description the core shipped under
+  // that name. Anything else under a retired name is the instance's own and stays.
+  const retired = readRetiredCoreSkills();
+  const keptAsOwn = [];
+  for (const [name, entry] of Object.entries(retired)) {
+    if (!SKILL_NAME_RE.test(name) || landedNow[name] || coreShipsNow(name) || withdrawable.includes(name)) continue;
+    const dir = path.join(skillsDest, name);
+    if (!fs.existsSync(dir)) continue;
+    if (isRetiredCoreCopy(dir, entry && entry.descriptionDigests)) withdrawable.push(name);
+    else keptAsOwn.push(name);
+  }
+  if (keptAsOwn.length) summary.notes.push(`${keptAsOwn.length} skill dir(s) share a name the core once shipped but are not the core's copy (their description is not one it shipped), so they were left in place as the instance's own: ${keptAsOwn.sort().join(', ')}.`);
   if (!overwrite) {
     // adopt mode never clobbers what the owner already has; withdrawing is a clobber.
-    if (withdrawable.length) summary.notes.push(`${withdrawable.length} skill(s) of a now-disabled module were left in place (adopt mode does not withdraw): ${withdrawable.sort().join(', ')}.`);
+    if (withdrawable.length) summary.notes.push(`${withdrawable.length} skill(s) the core no longer lands here were left in place (adopt mode does not withdraw): ${withdrawable.sort().join(', ')}.`);
   } else {
     for (const name of withdrawable.sort()) {
       const dir = path.join(skillsDest, name);
@@ -774,7 +856,7 @@ function materializeClaude({ coreRoot, instanceDir, dryRun = false, overwrite =
       if (!dryRun) fs.rmSync(dir, { recursive: true, force: true });
       summary.withdrawnSkills.push(name);
     }
-    if (summary.withdrawnSkills.length) log(`  ${dryRun ? '[dry-run] would withdraw' : '✓ withdrew'} ${summary.withdrawnSkills.length} stale skill dir(s) whose module is no longer enabled: ${summary.withdrawnSkills.join(', ')}`);
+    if (summary.withdrawnSkills.length) log(`  ${dryRun ? '[dry-run] would withdraw' : '✓ withdrew'} ${summary.withdrawnSkills.length} stale skill dir(s) the core no longer ships here (retired, or its module is off): ${summary.withdrawnSkills.join(', ')}`);
   }
   if (!Object.keys(landedPreviously).length && summary.excludedSkills.length) {
     summary.notes.push('no .instance-skills.json provenance in .claude/skills/ yet, so nothing was withdrawn — this run records it; a later run can withdraw the skills of a module that has since been disabled.');
@@ -788,7 +870,7 @@ function materializeClaude({ coreRoot, instanceDir, dryRun = false, overwrite =
   // the pre-flight halts on and the real run then rewrites anyway.
   if (overwrite) {
     const names = Object.keys(landedNow).sort();
-    const manifest = { _doc: 'GENERATED by scripts/gds/claude-materialize.js (task 1003632): the module-declared skills a materialize landed in this instance. It is the provenance record that lets a later run WITHDRAW a skill whose module has since been disabled — a name absent from here is never deleted, so a hand-written skill is safe. Commit it; do not hand-edit.', skills: Object.fromEntries(names.map((n) => [n, landedNow[n]])) };
+    const manifest = { _doc: 'GENERATED by scripts/gds/claude-materialize.js (tasks 1003632, 1004482): every skill a materialize landed in this instance, core and module alike. It is the provenance record that lets a later run WITHDRAW a skill the core stopped shipping or whose module has since been disabled — a name absent from here is never deleted on that account, so a hand-written skill is safe. Commit it; do not hand-edit.', skills: Object.fromEntries(names.map((n) => [n, landedNow[n]])) };
     if (!dryRun) {
       fs.mkdirSync(skillsDest, { recursive: true });
       fs.writeFileSync(path.join(skillsDest, INSTANCE_SKILLS_MANIFEST), JSON.stringify(manifest, null, 2) + '\n');
@@ -1112,4 +1194,4 @@ if (require.main === module) {
   process.exit(s.refused.length ? 1 : 0);
 }
 
-module.exports = { scriptToVerb, bongosify, PROJECT_CLI, topUpNpxAllowTwins, transformSettings, readSettingsTransform, renderStarterSettings, STARTER_ALLOW, copyTreeTransformed, materializeClaude, materializeWillRewrite, materializeModuleSkillsIntoCore, isCoreCheckoutRoot, readModuleSkillsManifest, MODULE_SKILLS_MANIFEST, readInstanceSkillsManifest, INSTANCE_SKILLS_MANIFEST, GDS_INVOCATION_RE, buildRebrandRules, rebrandText, disabledModuleSkills, moduleSkillRoster, moduleSkillSources, vendoredSkillGate, SKILL_NAME_RE, VENDOR_DEFAULT_POLICY };
+module.exports = { skillDescription, descriptionDigest, isRetiredCoreCopy, readRetiredCoreSkills, RETIRED_CORE_SKILLS_FILE, scriptToVerb, bongosify, PROJECT_CLI, topUpNpxAllowTwins, transformSettings, readSettingsTransform, renderStarterSettings, STARTER_ALLOW, copyTreeTransformed, materializeClaude, materializeWillRewrite, materializeModuleSkillsIntoCore, isCoreCheckoutRoot, readModuleSkillsManifest, MODULE_SKILLS_MANIFEST, readInstanceSkillsManifest, INSTANCE_SKILLS_MANIFEST, GDS_INVOCATION_RE, buildRebrandRules, rebrandText, disabledModuleSkills, moduleSkillRoster, moduleSkillSources, vendoredSkillGate, SKILL_NAME_RE, VENDOR_DEFAULT_POLICY };

package/scripts/gds/retired-core-skills.json

@@ -0,0 +1,101 @@
+{
+  "_doc": "Tombstone list (task 1004482): skills the core once shipped from its own .claude/skills/ and no longer does, from before materialize recorded core skills in an instance's .instance-skills.json. Each lists sha256 digests (first 16 hex) of every description the core ever shipped under that name, as written and as bongosify() rewrote it; claude-materialize.js withdraws an instance dir under one of these names ONLY when its SKILL.md description matches, so a skill the instance wrote itself is never touched. A closed historical set: a skill the core drops from now on is withdrawn through the manifest, with no entry here.",
+  "skills": {
+    "builder-box": {
+      "descriptionDigests": [
+        "14913228d8aefa2a",
+        "3a8458946af072fb",
+        "7695811a3bb4fa8a",
+        "d77e96d673b77f5b"
+      ]
+    },
+    "builder-connect": {
+      "descriptionDigests": [
+        "27137471966e6a98",
+        "2bc0f02001bf7311",
+        "5bfb4795ceb3e77a",
+        "a9442b55f9588a06",
+        "d661c46a8076a1ea"
+      ]
+    },
+    "builder-sync": {
+      "descriptionDigests": [
+        "3fad042c07a1d8e7",
+        "50c1a8505aead99b"
+      ]
+    },
+    "close-box": {
+      "descriptionDigests": [
+        "03d839f2e5909448",
+        "4f30758956f46d88",
+        "66aef8299b4c39af",
+        "b3f6743fdb4a07fe",
+        "d119bb63ffaba1e8"
+      ]
+    },
+    "dev": {
+      "descriptionDigests": [
+        "7836b393796e9ee0",
+        "8cf08a65be57d5f1"
+      ]
+    },
+    "feedback": {
+      "descriptionDigests": [
+        "211c55ddd59ef937",
+        "2f58da0a75816b09",
+        "3b48dc4cf9e43692",
+        "7bca081fc8092577",
+        "85bb6d1200234a28",
+        "a309ad6d9ea56a5f",
+        "ab21803079a7530c",
+        "e090c86c838c0f97"
+      ]
+    },
+    "ideate": {
+      "descriptionDigests": [
+        "466396868c0d2d37"
+      ]
+    },
+    "otb-character-review": {
+      "descriptionDigests": [
+        "518356210d594d2e",
+        "af216311f26edffd",
+        "eb529abb98348cd1"
+      ]
+    },
+    "otb-design-review": {
+      "descriptionDigests": [
+        "1b1375bc9ea12faa",
+        "9f97a32f15c805bc"
+      ]
+    },
+    "otb-feedback-capture": {
+      "descriptionDigests": [
+        "6ba86ab812dd9495",
+        "c915f0de7ab1e8fd"
+      ]
+    },
+    "otb-figma-sync": {
+      "descriptionDigests": [
+        "281987db3241a779",
+        "61132c40a0388319"
+      ]
+    },
+    "otb-tile-generate": {
+      "descriptionDigests": [
+        "57981088137a89ee",
+        "b1db07959665a454"
+      ]
+    },
+    "paint": {
+      "descriptionDigests": [
+        "944ae7795b04d726"
+      ]
+    },
+    "tweak": {
+      "descriptionDigests": [
+        "a8d84a40f2e3d8a2"
+      ]
+    }
+  }
+}

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.87'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.89'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/claude_materialize.mjs

@@ -19,6 +19,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, readdirSync, rmSync } from 'node:fs';
 import { tmpdir, homedir } from 'node:os';
+import { execFileSync } from 'node:child_process';
 import { join, dirname, relative, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -420,6 +421,87 @@ t('materializeClaude: --dry-run reports the withdrawal without performing it; ad
   for (const d of [core, inst]) rmSync(d, { recursive: true, force: true });
 });
 
+// ---- withdrawing skills the CORE stopped shipping (task 1004482) ----------------
+// The bug: the manifest recorded only module-declared skills, so a skill the core shipped
+// from its own .claude/skills/ and later dropped (the dev-box verbs, /dev /ideate /paint,
+// the pixel-art skills) stayed in every upgraded instance, loaded by the harness and listed
+// on the hall's Commands page. Two halves: the manifest now records core skills (future
+// retirements), and a tombstone list fingerprinted by description covers the past ones.
+
+// The /ideate description the core shipped until 2026-09-09, verbatim — a block scalar.
+const IDEATE_SHIPPED = '---\nname: ideate\ndescription: >-\n  The ideation session — the operating playbook for ideator-discipline work. Triggers when the user says "/ideate", "let\'s ideate", "I want to brainstorm", "help me think through an idea", "start an ideation session", or when a claimed task\'s discipline routes here (claim.js prints a directive to invoke /ideate for ideator tasks). Inverts the usual dynamic: the human ideator drives, Claude is the sounding board. Open to any rank for FILING ideas (Xenos+ can capture; only Metic+ can triage).\n---\nbody\n';
+
+function coreSkillFixture() {
+  const core = mkdtempSync(join(tmpdir(), 'rt-core-'));
+  const inst = mkdtempSync(join(tmpdir(), 'rt-inst-'));
+  for (const n of ['keep', 'gamma']) {
+    mkdirSync(join(core, '.claude', 'skills', n), { recursive: true });
+    writeFileSync(join(core, '.claude', 'skills', n, 'SKILL.md'), `---\nname: ${n}\ndescription: ${n} skill\n---\nbody\n`);
+  }
+  return { core, inst };
+}
+
+t('skillDescription: reads plain, quoted and block-scalar descriptions; null without one', () => {
+  assert.equal(m.skillDescription('---\nname: a\ndescription: one line\n---\n'), 'one line');
+  assert.equal(m.skillDescription('---\r\nname: a\r\ndescription: "quoted"\r\n---\r\n'), 'quoted');
+  assert.equal(m.skillDescription('---\ndescription: >-\n  folded\n  over two\nname: a\n---\n'), 'folded over two');
+  assert.equal(m.skillDescription('---\nname: a\n---\n'), null);
+  assert.equal(m.skillDescription('no frontmatter'), null);
+});
+
+t('materializeClaude: a core skill the core STOPPED shipping is withdrawn on the next upgrade (task 1004482)', () => {
+  const { core, inst } = coreSkillFixture();
+  m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  const mani = m.readInstanceSkillsManifest(join(inst, '.claude', 'skills'));
+  assert.ok(mani.skills.gamma && mani.skills.gamma.coreShipped, 'core skills are recorded as landed now');
+  rmSync(join(core, '.claude', 'skills', 'gamma'), { recursive: true, force: true });
+  const res = m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  assert.deepEqual(res.withdrawnSkills, ['gamma']);
+  assert.ok(!existsSync(join(inst, '.claude', 'skills', 'gamma')), 'the retired core skill is gone');
+  assert.ok(existsSync(join(inst, '.claude', 'skills', 'keep')), 'a skill the core still ships stays');
+  assert.ok(res.writtenPaths.includes('.claude/skills/gamma/SKILL.md'), 'the deletion is reported so the pin commit carries it');
+  for (const d of [core, inst]) rmSync(d, { recursive: true, force: true });
+});
+
+t('materializeClaude: a core with no readable .claude/skills/ withdraws no core skill (task 1004482)', () => {
+  const { core, inst } = coreSkillFixture();
+  m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  rmSync(join(core, '.claude', 'skills'), { recursive: true, force: true });
+  const res = m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  assert.deepEqual(res.withdrawnSkills, [], 'nothing landed from the core, so nothing is withdrawn on that account');
+  assert.ok(existsSync(join(inst, '.claude', 'skills', 'gamma')));
+  assert.ok(m.readInstanceSkillsManifest(join(inst, '.claude', 'skills')).skills.gamma, 'and the provenance is carried forward');
+  for (const d of [core, inst]) rmSync(d, { recursive: true, force: true });
+});
+
+t('materializeClaude: a RETIRED core skill with the description the core shipped is withdrawn; one the instance wrote under that name is kept (task 1004482)', () => {
+  const { core, inst } = coreSkillFixture();
+  const skills = join(inst, '.claude', 'skills');
+  // an instance materialized before core skills were recorded: no manifest names either dir
+  mkdirSync(join(skills, 'ideate'), { recursive: true });
+  writeFileSync(join(skills, 'ideate', 'SKILL.md'), IDEATE_SHIPPED);
+  mkdirSync(join(skills, 'dev'), { recursive: true });
+  writeFileSync(join(skills, 'dev', 'SKILL.md'), '---\nname: dev\ndescription: our own dev loop\n---\nMINE\n');
+  const res = m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
+  assert.deepEqual(res.withdrawnSkills, ['ideate'], 'the core\'s old /ideate goes');
+  assert.ok(!existsSync(join(skills, 'ideate')));
+  assert.equal(readFileSync(join(skills, 'dev', 'SKILL.md'), 'utf8'), '---\nname: dev\ndescription: our own dev loop\n---\nMINE\n', 'the owner\'s /dev is untouched');
+  assert.ok(res.notes.some((n) => /left in place as the instance's own: dev/.test(n)), 'and the run says why it kept it');
+  for (const d of [core, inst]) rmSync(d, { recursive: true, force: true });
+});
+
+t('retired-core-skills.json: names the dev-box verbs, the old role playbooks and the pixel-art skills, none of which the core ships now', () => {
+  const retired = m.readRetiredCoreSkills();
+  for (const n of ['builder-box', 'builder-connect', 'builder-sync', 'close-box', 'dev', 'ideate', 'paint', 'otb-tile-generate', 'otb-design-review']) {
+    assert.ok(retired[n] && retired[n].descriptionDigests.length, `${n} is tombstoned with at least one digest`);
+  }
+  // A tombstone on a name the core still ships would be inert (step 1 lands it), but it would
+  // also mean the list was built wrong — tracked files only, since a checkout holds untracked
+  // module-skill copies (ADR 0224) under the same directory.
+  const tracked = execFileSync('git', ['-C', ROOT, 'ls-files', '.claude/skills'], { encoding: 'utf8' });
+  for (const n of Object.keys(retired)) assert.ok(!tracked.includes(`.claude/skills/${n}/`), `${n} is not a skill the core ships from .claude/skills/`);
+});
+
 // ---- module-owned skills (task 1003321 / ADR 0198) ---------------------------
 // A module ships a skill from modules/<key>/skills/<name>/ (its own) or
 // modules/<key>/skills/vendor/<name>/ (third-party + PROVENANCE.md); only a DECLARED