@bongos/core 1.23.20 → 1.23.22

package/clients/bongos-client/bongos-client.global.js

@@ -124,6 +124,10 @@ function createClient(opts = {}) {
       // POST /agents/{name}/invoke — rank: any-builder — POST /agents/:name/invoke
       postAgentsNameInvoke: (args) => request("POST", "/agents/{name}/invoke", { hasBody: true }, args),
     },
+    "aiStudio": {
+      // GET /ai-studio/status — rank: any-builder — GET /ai-studio/status
+      getAiStudioStatus: (args) => request("GET", "/ai-studio/status", { hasBody: false }, args),
+    },
     "analytics": {
       // GET /analytics/builder/{id} — rank: any-builder — GET /analytics/builder/:id
       getAnalyticsBuilderId: (args) => request("GET", "/analytics/builder/{id}", { hasBody: false }, args),

package/clients/bongos-client/index.cjs

@@ -123,6 +123,10 @@ function createClient(opts = {}) {
       // POST /agents/{name}/invoke — rank: any-builder — POST /agents/:name/invoke
       postAgentsNameInvoke: (args) => request("POST", "/agents/{name}/invoke", { hasBody: true }, args),
     },
+    "aiStudio": {
+      // GET /ai-studio/status — rank: any-builder — GET /ai-studio/status
+      getAiStudioStatus: (args) => request("GET", "/ai-studio/status", { hasBody: false }, args),
+    },
     "analytics": {
       // GET /analytics/builder/{id} — rank: any-builder — GET /analytics/builder/:id
       getAnalyticsBuilderId: (args) => request("GET", "/analytics/builder/{id}", { hasBody: false }, args),

package/clients/bongos-client/index.d.ts

@@ -33,6 +33,7 @@ export interface GetAchievementsResponse { achievements: unknown }
 export interface GetAgentRunsIdResponse { ok: boolean; run: unknown }
 export interface GetAgentsNameResponse { ok: boolean; agent: unknown }
 export interface GetAgentsResponse { ok: boolean; agents: unknown; counts: unknown; vocabulary: unknown }
+export interface GetAiStudioStatusResponse { ok: boolean; module: unknown }
 export interface GetArtistGateResponse { ok: boolean; mode: unknown; since: unknown; holds: boolean; truncated: unknown; reviews: unknown; halt: unknown }
 export interface GetAuditLogResponse { rows: unknown; page: unknown }
 export interface GetAuthWebAdmissionStatusResponse { admitted: boolean }
@@ -685,6 +686,10 @@ export interface BongosClient {
     /** POST /agents/{name}/invoke — rank: any-builder */
     postAgentsNameInvoke(args?: RequestArgs & { body?: PostAgentsNameInvokeRequest }): Promise<PostAgentsNameInvokeResponse>;
   };
+  "aiStudio": {
+    /** GET /ai-studio/status — rank: any-builder */
+    getAiStudioStatus(args?: RequestArgs): Promise<GetAiStudioStatusResponse>;
+  };
   "analytics": {
     /** GET /analytics/builder/{id} — rank: any-builder */
     getAnalyticsBuilderId(args?: RequestArgs): Promise<ApiResponse>;

package/clients/bongos-client/index.mjs

@@ -120,6 +120,10 @@ export function createClient(opts = {}) {
       // POST /agents/{name}/invoke — rank: any-builder — POST /agents/:name/invoke
       postAgentsNameInvoke: (args) => request("POST", "/agents/{name}/invoke", { hasBody: true }, args),
     },
+    "aiStudio": {
+      // GET /ai-studio/status — rank: any-builder — GET /ai-studio/status
+      getAiStudioStatus: (args) => request("GET", "/ai-studio/status", { hasBody: false }, args),
+    },
     "analytics": {
       // GET /analytics/builder/{id} — rank: any-builder — GET /analytics/builder/:id
       getAnalyticsBuilderId: (args) => request("GET", "/analytics/builder/{id}", { hasBody: false }, args),

package/docs/adr/0385-money-lives-with-a-processor-credits-stay-a-project-meter.md

@@ -0,0 +1,87 @@
+# 0385 — Money lives with a processor, credits stay a project meter, and the project sets the pay
+
+- **Status:** Accepted, except decision 4 (the signed payout rule), which is Proposed until counsel answers held item 1
+- **Date:** 2026-10-28
+- **Deciders:** The owner, who wrote the legal framework this applies and chose each point below in conversation: a licensed processor holds the money; projects set their own pay and funding rules; Cloud Bongos LLC takes 1% on top of module sales; the default credit system is Bongos's current one.
+- **Tasks:** [task 1004905](https://cloudbongos.com/builders#/task/1004905) (the legal map), [task 1003180](https://cloudbongos.com/builders#/task/1003180) (one credit, one meaning), [task 1003181](https://cloudbongos.com/builders#/task/1003181) (where the wall sits), [task 1004909](https://cloudbongos.com/builders#/task/1004909) (module revenue split). Goal 1000092.
+- **Interacts with:** [ADR 0054](0054-session-token-reward-cost-plus.md) (credit denomination), [ADR 0120](0120-pay-on-land-and-builder-owned-rebase-gate.md) (a claim-time refusal precedent).
+
+The owner's legal framework is a confidential draft. This record cites it by Article only and quotes none of it. It is a product constraint for building, not legal advice; counsel confirms the items under "Held for counsel".
+
+## Context
+
+Goal 1000092 pays real money for completed work: our own contractors first, then builders on projects and contributors to modules that sell. ADR 0054 left one credit meaning two things on one ledger, and the first design put a balance and a wallet inside Bongos. The legal framework forbids that shape: the platform may not hold user money (Art. II), nor build credits that redeem for cash, and it may not assign work or set rates (Art. IV).
+
+## Decision
+
+**1. A licensed payment processor holds all user and project money. Bongos holds none.** Bongos shows balances read from the processor, records every movement and its cause (append-only), and instructs transfers on a project's authorisation. No wallet, no netting between users, no float.
+
+**2. Credits are a project-scoped contribution meter, never money.** Credits belong to the project that issued them, are not transferable or purchasable, and are not redeemable for cash. The Bongos Standard Credit System is the default a project adopts; a project may change or replace it. Existing credit records keep their meaning and are not converted to dollars (this closes the double denomination in ADR 0054 by splitting the ledgers, not by re-denominating).
+
+**3. The project decides what its work pays and in what form.** Cash through the processor, equity granted by the project, a share of module sales, or non-monetary credit. The project also sets its funding rule: refuse claims when funds run out, hold the estimate at claim, or continue with the shortfall recorded as the project's own obligation. Bongos suggests no rate. The builder sees the pay terms before claiming.
+
+**4. Money moves under the project's signed instruction.** A person with the project's authority signs a payout rule once (caps, formula, schedule), and runs execute under it with a notice and a pause window before each. Equity grants and contracts keep one signature each. An AI never creates or widens an authorisation. The authorisations and runs sit in an append-only log. This is a proposal for counsel (item 1 below).
+
+**5. Three payment paths.** Bongos rails, self-managed (the project pays on its own systems and Bongos only records contribution), or both per pay type. Bongos shows no balance or guarantee for money it does not move.
+
+**6. Module sales carry a platform fee of the processor's cost plus 1 percent of the price** (amended by [ADR 0388](0388-a-module-sale-is-split-by-the-project-the-buyer-pays-the-platform-fee.md); first recorded here as a flat 1 percent). It is added on top of the price, paid by the buyer, collected for Cloud Bongos LLC through the processor, and is never deducted from a contributor or described as a share of pay. How a project prices and divides its modules is the project's choice. No percentage fee applies to wages, task pay or equity. Standard module licence and takedown contact must exist before the first sale.
+
+**7. Crypto stays out.** Processor-converted stablecoin payouts are reserved for a later board decision with counsel.
+
+**8. Each pay type clears its own legal gate before it can be switched on** (the table under "Pay-type gates" below). Age tiers and sanctions screening apply to every payout (Art. VII, X); a freeze notifies the person and offers an appeal.
+
+**9. Credit and model wording.** Nothing the product or an AI writes about credits or valuation models may call them an investment, a return, appreciation or passive income (Art. III). Models are calculation tools with every input visible to the people affected; they create no payment obligation and no redemption price.
+
+## Per-flow map
+
+Each flow names the processor primitive it maps to (a flow with none is redesigned, not custom-built), the legal actor, and the Article that limits it. The primitive names are generic processor terms; the processor is chosen in [task 1004906](https://cloudbongos.com/builders#/task/1004906), which confirms the exact product for each row.
+
+| Flow | Processor primitive | Legal actor | Limits |
+| --- | --- | --- | --- |
+| Project funding | Charge to the funder, settled into the project's processor-held account | The funder and the project | Art. II no custody, no float |
+| Balance view | Read of the processor-held balance | Nobody acts; display only | Art. II no wallet or internal ledger of user money |
+| User-to-user payment | Transfer between processor-held accounts on the payer's instruction | The payer | Art. II no netting; sanctions and age checks (Art. VII, X) |
+| Builder payout | Transfer from the project's account to the builder, under a signed rule | The project | Art. I signed authorisation and log; Art. IV no rate set by Bongos |
+| Contractor pay (our own) | Same transfer, Cloud Bongos acting as a project | Cloud Bongos as the project | Art. XI NDA and tax details first; Art. IV classification |
+| Cash-out | Payout from the processor-held account to the user's bank, on the user's instruction | The user | Art. II no custody; age and sanctions checks; a freeze notifies |
+| Module sale | Charge to the buyer with an application fee, then transfers to seller and contributors | Buyer, seller and project | Art. VI licence and takedown first; fee only the buyer-paid platform fee of ADR 0388 |
+
+The five gate questions (actor, custody, securities wording, control, advice) are answered per row above: the actor column is the actor test, "no custody" and "no wallet" are the custody test, decision 9 is the securities-wording test, decisions 3 and 4 are the control test, and models are tools, not advice (Art. V).
+
+## Pay-type gates
+
+A pay type becomes switchable only after its gate is cleared and recorded.
+
+| Pay type | Law that applies | Carried by | Must exist first |
+| --- | --- | --- | --- |
+| Cash for task work | Contractor classification, tax reporting, sanctions, age rules | Project; processor screens | Processor onboarding, tax details, age check, sanctions screening, signed rule |
+| Equity or profit interests | Securities law; Art. III | Project; Bongos records at a flat fee | The project's own counsel-approved structure, one signature per grant, no percentage fee, wording filter |
+| Module sales share | Marketplace venue, takedown, tax reporting | Seller and project; Cloud Bongos LLC as venue | Standard module licence, takedown contact, payee onboarding |
+| Credit-weighted pool | Cash rules plus Art. III | Project | Decision 9 in force, model inputs visible, signed rule |
+| Non-monetary tracks | Volunteer and learner rules; Art. VII | Project | Guardian consent for ages 13 to 15, no cash redemption of any credit |
+| Self-managed payout | The project's own obligations | Project alone | A label saying Bongos moves and guarantees nothing |
+| EU labour payments | EU Platform Work Directive | Project; Verro | Not enabled until the per-country analysis is complete (Art. IV) |
+
+## Held for counsel (these block building the money-moving tasks)
+
+1. Whether a standing signed payout rule satisfies the attributable-action requirement (Art. I).
+2. Whether a credit-weighted pool distribution creates stored value, a security, or a wage-style fee problem.
+3. Agent-of-payee versus full pass-through, and which processor (decided in [task 1004906](https://cloudbongos.com/builders#/task/1004906)).
+4. Which entity collects the fee and which is the payee's agent.
+5. Whether processor-converted stablecoin counts as touching crypto rails.
+6. Whether a sibling entity is needed for labour payouts.
+
+## Consequences
+
+- [task 1003182](https://cloudbongos.com/builders#/task/1003182) (the project account) becomes a processor-held account with a record of its movements; it holds nothing itself.
+- [task 1003183](https://cloudbongos.com/builders#/task/1003183) pays under a signed authorisation, once per builder and task.
+- [task 1003185](https://cloudbongos.com/builders#/task/1003185) builds the funding rule as a per-project setting, with claim-time hold as an option and no wall by default imposed by Bongos.
+- No task that moves real money ships before the processor is chosen and counsel clears items 1 to 4.
+- Decisions 4 and 8 are intent until built. The tasks that build them ([task 1004913](https://cloudbongos.com/builders#/task/1004913) and [task 1004914](https://cloudbongos.com/builders#/task/1004914)) must enforce them on the server, with the rank and ownership check in the database, not in the screen (ADR 0016).
+
+## Rejected
+
+- **A wallet inside Bongos.** Makes us the holder of user money (Art. II).
+- **Converting credits to cents.** Turns the meter into stored value.
+- **Bongos setting rates or a standard wall.** Breaks the contractor classification (Art. IV).
+- **A per-run approval click on every payout.** Safest reading, but unworkable for recurring pools; replaced by the signed rule in decision 4, pending counsel.

package/docs/adr/0386-the-funding-wall-is-a-per-project-rule-claim-time-hold-by-default.md

@@ -0,0 +1,37 @@
+# 0386 — The funding wall is a per-project rule, with a claim-time hold on offer
+
+- **Status:** Accepted
+- **Date:** 2026-10-28
+- **Deciders:** The owner, who first asked that a project not complete work without money in its account, was shown that a completion-only gate lands the loss on the builder, and then ruled that the rule belongs to each project: whether to halt, pay in another form, or carry on is the project's choice.
+- **Task:** [task 1003181](https://cloudbongos.com/builders#/task/1003181)
+- **Related:** [ADR 0385](0385-money-lives-with-a-processor-credits-stay-a-project-meter.md) (money lives with a processor; projects set pay), [ADR 0120](0120-pay-on-land-and-builder-owned-rebase-gate.md) (a claim-time refusal with a stated reason).
+
+## Context
+
+The owner's first design was a completion gate: a project should not be able to have work completed when it lacks the money. The concern recorded on the task is that cost is incurred during the work, so a completion-only gate lets a builder finish and only then learn the project cannot pay. A claim gate refuses before anyone has spent anything, and ADR 0120 already shows a claim refusal with a legible reason. A third shape holds the task's estimate against the balance so several simultaneous claims cannot overspend it.
+
+The owner then settled that Bongos does not impose any one of these. A project sets what its work pays and what happens when it runs short (ADR 0385), and the legal framework bars the platform from setting or capping builder rates (Art. IV).
+
+## Decision
+
+**The wall is a per-project setting with three options, and Bongos sets no wall of its own.**
+
+1. **Hold at claim.** A claim is refused, with the stated shortfall, when the project's available balance cannot cover the task's estimate. The estimate is held against the balance while the claim is open, so claims cannot over-commit it. The hold is released on ship or release.
+2. **Refuse at completion.** The task can be claimed and worked; completing it is refused while the balance is short. This is the owner's original design, kept as an option.
+3. **Carry on, record the shortfall.** Work continues and the unpaid amount is recorded as the project's own obligation. Bongos never funds it.
+
+A project that sets nothing gets option 1, because it is the only option that protects the builder before work is done. Setting it is the project's to change at any time; each builder sees the project's rule on the task before claiming.
+
+The balance the wall reads is the processor-held project balance (ADR 0385). A wall on a pay type that is not cash (equity, a share of module sales, non-monetary credit) reads the project's own terms for that pay type, not a dollar balance.
+
+## Consequences
+
+- [task 1003185](https://cloudbongos.com/builders#/task/1003185) builds the wall as this setting, with the three options and the claim-time hold. It must put the refusal at the claim route, the one place the server can stop a claim, and show the shortfall in plain words.
+- [task 1003182](https://cloudbongos.com/builders#/task/1003182) exposes the held amount alongside the balance so the owner can see what is reserved.
+- The check is server-side. A screen that hides the Claim button is not the wall (ADR 0016).
+- Option 3 creates an obligation on the project's side only. It must show as owed-but-unpaid in the outflow view ([task 1003184](https://cloudbongos.com/builders#/task/1003184)).
+
+## Rejected
+
+- **A completion gate for every project.** Leaves the loss with the builder, who cannot check beforehand.
+- **One wall chosen by Bongos.** Bongos would be setting terms of work, which the contractor classification depends on it not doing.

package/docs/adr/0387-two-ledgers-credits-measure-work-money-stays-with-the-processor.md

@@ -0,0 +1,39 @@
+# 0387 — Two ledgers: credits measure work, money stays with the processor
+
+- **Status:** Accepted
+- **Date:** 2026-10-28
+- **Deciders:** The owner, who asked how credits can measure contribution while pay is set by each project, and chose to keep credits as a project-scoped meter and put money on a separate record held by a licensed processor.
+- **Task:** [task 1003180](https://cloudbongos.com/builders#/task/1003180)
+- **Related:** [ADR 0385](0385-money-lives-with-a-processor-credits-stay-a-project-meter.md) (the money plan), [ADR 0054](0054-session-token-reward-cost-plus.md) (the double denomination this resolves), [ADR 0146](<redacted><redacted>.md) (reward mode per instance).
+
+This applies the owner's confidential legal framework by Article only: credits are a work meter, never redeemable for cash, never bought or transferred (Art. II, III). It is a product constraint, not legal advice.
+
+## Context
+
+ADR 0054 accepted a credit meaning two things on one ledger: a unitless author estimate (the per-task path) and a dollar-scale figure from real cost plus 20 percent (the session path). It named the way out: re-denominate per-task credits in cents, or split the ledgers, and said it must be settled before money moves. Paying cash against a number that means two things makes the first dispute unanswerable.
+
+## Decision
+
+**Split the ledgers. Do not re-denominate credits into cents.**
+
+1. **Credits stay a work meter.** `credit_log` keeps measuring contribution, scoped to its project, non-transferable, non-purchasable, never redeemable. It gets no money column and no dollar conversion.
+2. **Money gets its own record, in cents, tied to the processor.** The project-account work ([task 1003182](https://cloudbongos.com/builders#/task/1003182)) adds a separate movement record: integer cents, the processor's transfer reference (the Transfer primitive in the per-flow map of [ADR 0385](0385-money-lives-with-a-processor-credits-stay-a-project-meter.md)), and the cause (who, which task or module or pool run, why). It records money held elsewhere and holds none itself. It is append-only and never edited; a correction is a new movement. The database enforces this (updates and deletes refused by a trigger or revoked privilege), not only the code that writes it.
+3. **No dollar value is ever read off a credit.** A payout reads the money record and the project's signed rule, not a credit delta. Where a project pays by contribution, the payout is a pool run: the project's pool of cents is divided by credit share, and the run is recorded on the money ledger with the shares used. Only the project's authorised person, acting under the signed rule of ADR 0385 decision 4, may start a pool run, and the server checks that authority against the database on every run; a screen that hides the button is not the check (ADR 0016).
+4. **Historic `credit_log` rows are not rewritten and not retro-classified.** They carry both old meanings and cannot be told apart by inspection, so they keep both and are used only as relative weight inside a project, never as a dollar amount. A pool run that includes them says so in the shares it shows the affected people.
+5. **A pool run says which credit rows it counts.** The default reward mode (ADR 0146, `cost-plus-and-estimate`) still writes two kinds of new rows to the same total: a per-task estimate row and a session cost-plus row. A project's model must name the row kinds it counts as weight. The default model counts the session cost-plus rows only, and a project that adds estimate rows says so in the shares it shows. Where an instance runs cost-plus-only, only the session rows exist. Estimate rows are never a basis for paying money by themselves.
+
+## Migration path
+
+None for existing rows: no rewrite, no backfill, no new column on `credit_log`. The only schema change is the new money record, which lands with [task 1003182](https://cloudbongos.com/builders#/task/1003182) and its migration. Reading historic credits as weight needs no change. If a project later wants historic work weighed differently, it changes its model parameters; it does not edit the ledger.
+
+## Consequences
+
+- A payout dispute has one answer: the money record names the cents, the processor reference and the signed rule; the credit record names the work.
+- [task 1003182](https://cloudbongos.com/builders#/task/1003182) and [task 1004907](https://cloudbongos.com/builders#/task/1004907) build against the money record and never against `credit_log`.
+- [task 1003182](https://cloudbongos.com/builders#/task/1003182) also owns the guard: a test that fails the build if any money path reads a credit delta as dollars, and one that fails if the money record accepts an update or delete.
+- [task 1003186](https://cloudbongos.com/builders#/task/1003186), the end-to-end proof, must show a pool run that counts only the row kinds its model names.
+
+## Rejected
+
+- **Re-denominate credits into cents.** Credits would carry a dollar value and become stored value (Art. II, III), and the old rows still could not be classified.
+- **A conversion rate between credits and dollars.** The same problem with a rate on it; Bongos must not publish a redemption price for a credit.

package/docs/adr/0388-a-module-sale-is-split-by-the-project-the-buyer-pays-the-platform-fee.md

@@ -0,0 +1,42 @@
+# 0388 — A module sale is split by the project's own rule, and the buyer pays the platform fee on top
+
+- **Status:** Accepted
+- **Date:** 2026-10-28
+- **Deciders:** The owner, who set the platform's take at processing cost plus 1 percent on module sales, paid on top of the price, and ruled that each project decides how its modules are monetised and how the money is shared, including a project that is paid only through module sales.
+- **Task:** [task 1004909](https://cloudbongos.com/builders#/task/1004909)
+- **Amends:** [ADR 0385](0385-money-lives-with-a-processor-credits-stay-a-project-meter.md) decision 6 and its module-sale row: the fee is the processor's cost plus 1 percent, not a flat 1 percent. ADR 0385 is updated to point here.
+- **Related:** [ADR 0385](0385-money-lives-with-a-processor-credits-stay-a-project-meter.md) (the money plan and per-flow map), [ADR 0387](0387-two-ledgers-credits-measure-work-money-stays-with-the-processor.md) (pool runs by credit share).
+
+This applies the owner's confidential legal framework by Article only (Art. IV, VI, VIII). It is a product constraint, not legal advice.
+
+## Context
+
+A module that sells earns money for the people who built it and for whoever sells it. The question was how that money is divided between the contributors, the seller and the platform. The framework allows a venue and processing fee attached to a transaction and forbids describing any fee as a share of wages (Art. IV). Working area 5 owns module pricing and listing; this goal owns only how the money is divided and paid.
+
+## Decision
+
+**1. The buyer pays the price plus a platform fee.** The platform fee is the processor's cost for that sale plus 1 percent of the price, added on top, shown as its own line before purchase, and collected for Cloud Bongos LLC through the processor's application fee. Nothing is deducted from the price the seller and contributors share. The fee is called a platform fee and nothing else. Which entity collects it stays held for counsel (ADR 0385 held item 4); Cloud Bongos LLC is the owner's intended collector, not a settled fact.
+
+**2. The project that owns the module sets the split.** Before a paid listing goes live, the project records its rule: the seller's share and the contributors' pool, as percentages of the price. Only the project's authorised person may record or change the rule, and the server checks that authority against the database on every write (ADR 0016); a change is logged like a signed payout rule (ADR 0385 decision 4). Bongos suggests no percentage and does not list a paid module that has no rule. The project can change the rule for future sales; past sales keep the rule they sold under.
+
+**3. The contributors' pool is divided by recorded contribution.** By default the weight is the credit each contributor earned on the module's own tasks, counted as ADR 0387 says (session cost-plus rows by default). A project may choose another model. Either way every input and each person's share is visible to the people it affects before money moves (Art. VIII). Only shipped, graded tasks the project placed on the module count, so a builder cannot raise their share by creating tasks for themselves, and the project sees the shares before each payout run. This default is subject to ADR 0385 held item 2 (whether a credit-weighted pool raises a legal problem).
+
+**4. Module sales can be a project's only pay.** A project may choose module revenue as the pay form for its work (ADR 0385 decision 3). Builders see that before claiming.
+
+**5. The money path is the module-sale row of ADR 0385's per-flow map.** A charge to the buyer with the application fee, then transfers from the project's processor-held account to the seller and to each contributor, under the project's signed payout rule. Bongos holds none of it.
+
+**6. Refunds reverse the same way.** A refunded or charged-back sale reverses each transfer in the same proportion it was paid, and the reversal is recorded on the money record against the original sale.
+
+**7. Nothing sells before its prerequisites exist.** The standard module licence, a registered copyright takedown agent, processor onboarding (identity and tax details) for every person who will be paid (Art. VI), and counsel's answers to ADR 0385 held items 2 and 4. No task tracks the licence or the takedown agent yet; they belong with Working area 5, and [task 1004910](https://cloudbongos.com/builders#/task/1004910) must not ship until they exist.
+
+## Consequences
+
+- [task 1004910](https://cloudbongos.com/builders#/task/1004910) builds this: the split rule on the listing, the share calculation, and the transfers. Amounts are computed on the server from the recorded rule and the processor's reported sale, never taken from the buyer's or seller's screen.
+- Working area 5 shows the platform fee line at checkout and refuses a paid listing with no split rule.
+- [task 1004906](https://cloudbongos.com/builders#/task/1004906) confirms the processor supports an application fee and transfers to several recipients from one sale.
+
+## Rejected
+
+- **A fixed 50/50 split chosen by Bongos.** Offered as a placeholder; the owner ruled the split is each project's to set.
+- **Taking the platform fee out of the price.** It would be deducted from what contributors are paid, which the framework treats as a cut of wages (Art. IV).
+- **Crypto settlement for higher margin.** Excluded by ADR 0385 decision 7; the fee is the same either way.

package/docs/adr/0392-ai-generation-runs-on-a-processor-held-balance-and-the-builders-own-keys.md

@@ -0,0 +1,33 @@
+# 0392 — AI generation runs on a processor-held balance or the builder's own key
+
+- **Status:** Accepted
+- **Date:** 2026-10-28
+- **Task:** [task 1004916](https://cloudbongos.com/builders#/task/1004916) (goal 1000136)
+- **Deciders:** the owner (prepaid balance, multiplier 1.08 final, funds secured before a run); Claude designed
+- **Related:** ADR 0016 (trust boundary), 0022 (secrets), 0054 (credits), 0073 (BYOK Gemini key), 0083 (modules), **0385 (money lives with a processor)**
+
+## Context
+
+Artists in the Studio want to submit a sketch or image set with a prompt, get a Gemini reply, and get images generated (OpenRouter) with the project's context added. Two ways to pay: our provider key (we charge the builder) or the builder's own key (we charge nothing).
+
+There is no way to take money in the code today. Credits (ADR 0054) are what builders **earn**; `credit_log` is an earnings ledger, the wrong place for money a builder **pays**. And ADR 0385 rules that Bongos holds no user money: no wallet, no internal balance, no float. A balance table of our own is therefore not allowed.
+
+Card processors also charge about 2.9% plus a fixed $0.30 per payment, so charging a card for each few-cent generation loses money unless that fee is passed on.
+
+## Decision
+
+1. **A new `ai-studio` module** owns keys, the ledger, requests and routes. `default: false` (the hub first), like `raise`.
+2. **The balance lives with the processor, never with us (ADR 0385).** A builder tops up a processor-held balance; Bongos only **reads** it and **instructs holds and captures** against it. We keep no balance column. What we do keep is the append-only ledger of every movement and its cause, which ADR 0385 requires.
+3. **Price = provider cost x `AI_PRICE_MULTIPLIER`**, one named constant in `modules/ai-studio/pricing.js`, **1.08** (owner, final: an 8% markup on the actual provider cost of every call: OpenRouter, Gemini, anything). Nothing else spells the number.
+4. **The processor's cost is added to the top-up, not eaten.** A builder who wants N dollars of balance pays `(N + fixed) / (1 - percent)`, rounded up, so what we receive after the processor's fee covers N. Fixed and percent are named constants beside the multiplier.
+5. **Hold, then capture.** Before any provider call the full estimated price is **held** on the processor-held balance. A short balance refuses cleanly and nothing runs. After the call the hold is captured at the real price (the difference released); if the provider fails the whole hold is released. A hold is exactly the guarantee the owner asked for: the funds are secured before the run and never touch a Bongos balance.
+6. **One append-only ledger.** Every movement (top-up, hold, capture, release) is a row with amount, provider cost, markup and processor fee as separate columns, so a builder sees exactly what a generation cost. Money is integer micro-dollars (millionths), never floats.
+7. **A payments port with two backends.** `fake` (test mode, deterministic, in memory, the only one built now; it stands in for the processor's held balance) and a real processor adapter, added later when the owner supplies keys in Settings. Everything else is backend-independent.
+8. **Bring your own key.** A builder's own provider key is entered **only in Settings**, encrypted with the existing secret box (ADR 0073), shown as its last four characters, **never returned to the browser or logged**. When one is set for the provider a generation needs, the generation runs on it with no hold and the ledger records a zero charge, with the real provider cost noted for the builder's information.
+9. **Project context is assembled on the server** from the project context doc, the branding pack and DESIGN.md; the browser never supplies it.
+
+## Consequences
+
+- No parallel money system and no wallet: credits stay earnings, the ledger is an audit trail, the processor holds the money.
+- The tests pin the arithmetic (cost x 1.08, top-up gross-up), hold / refuse / capture / release, and that a key never leaves the server.
+- Real processor keys stay off until the owner adds them; going live waits for the owner.

package/docs/adr/README.md

@@ -503,3 +503,8 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0382 | [**A hardware card is a passkey step-up check, switched on per builder by an Archon** ([task 1004676](https://cloudbongos.com/builders#/task/1004676), proposed). No WebAuthn exists today; sign-in is GitHub OAuth or the hub IdP. **D1:** WebAuthn via a vetted library. **D2:** the card is a second factor, a server-recorded step-up, never the first. **D3:** register first; the requirement needs a registered card. **D4:** an Archon switches it on per builder, default off. **D5:** guards rank changes, deploy, session revoke, payouts. No PC/SC reader needed. Rejected: PC/SC middleware, card as sole login.](0382-a-hardware-card-is-a-passkey-step-up-an-archon-switches-on-per-builder.md) | auth / security |
 | 0383 | [**Sessions end after ten idle days, CLI included** ([task 1004830](https://cloudbongos.com/builders#/task/1004830)). Supersedes ADR 0294. Any session unused for 10 days stops authenticating and drops off the Active sessions list; measured on last_used_at, so it is an idle limit, not a ceiling. Rejected: hiding old sessions while they stay live; browser-only.](0383-sessions-end-after-ten-idle-days.md) | auth / security |
 | 0384 | [**The /raise investor page is a hub module that builders edit in place** ([task 1004847](https://cloudbongos.com/builders#/task/1004847)). A `raise` module, enabled only on the hub: every write is an audited `/api/bongos/raise/*` route, the page itself a GET-only `raise.web` port core mounts at /raise; team editing rides the ordinary builder session (any active builder, owner 2026-10-25); investors get a hashed-token session; /raise is exempt from the pre-launch gate. Everything, copy included, publishes with the core (owner's call); only the password hash stays in env.](0384-the-raise-page-is-a-hub-module-builders-edit-in-place.md) | modules / pages |
+| 0385 | [**Money lives with a licensed processor, credits stay a project-scoped meter, and each project sets its own pay** ([task 1004905](https://cloudbongos.com/builders#/task/1004905) · goal 1000092; also records tasks 1003180, 1003181 and 1004909). Bongos holds no user money and never redeems credits for cash; projects choose pay form and funding rule; payouts run under a project-signed rule; module sales carry a buyer-paid platform fee (processing cost plus 1 percent, per ADR 0392); crypto stays out. Six legal items are held for counsel and block the money-moving tasks.](0385-money-lives-with-a-processor-credits-stay-a-project-meter.md) | economy / legal |
+| 0386 | [**The funding wall is a per-project rule: hold at claim, refuse at completion, or carry on and record the shortfall** ([task 1003181](https://cloudbongos.com/builders#/task/1003181) · goal 1000092). Bongos sets no wall of its own; a project that sets nothing gets the claim-time hold, which refuses before any work is spent and holds the estimate so claims cannot over-commit the balance.](0386-the-funding-wall-is-a-per-project-rule-claim-time-hold-by-default.md) | economy |
+| 0387 | [**Two ledgers: credits measure work, money stays with the processor** ([task 1003180](https://cloudbongos.com/builders#/task/1003180) · goal 1000092). Resolves ADR 0054's double denomination by splitting, not by re-denominating credits into cents: `credit_log` stays a work meter with no money column, money gets its own cents record tied to the processor, no dollar value is read off a credit, and historic rows are neither rewritten nor classified.](0387-two-ledgers-credits-measure-work-money-stays-with-the-processor.md) | economy |
+| 0388 | [**A module sale is split by the project's own rule, and the buyer pays the platform fee on top** ([task 1004909](https://cloudbongos.com/builders#/task/1004909) · goal 1000092). The platform fee is the processor's cost plus 1 percent of the price, collected for Cloud Bongos LLC and never deducted from contributors; the project sets the seller share and contributor pool, the pool is divided by recorded contribution, and no paid module lists without a split rule.](0388-a-module-sale-is-split-by-the-project-the-buyer-pays-the-platform-fee.md) | economy / marketplace |
+| 0392 | [**AI generation runs on a processor-held balance or the builder's own key** ([task 1004916](https://cloudbongos.com/builders#/task/1004916)). A new `ai-studio` module: price = provider cost x one named multiplier (1.08), the processor's fee added at top-up, the full price held on the processor-held balance before any run and released on failure (Bongos keeps no balance, ADR 0385), every movement in one append-only ledger in micro-dollars; the builder's own key is entered only in Settings, encrypted, never returned or logged, and runs at no charge.](0392-ai-generation-runs-on-a-processor-held-balance-and-the-builders-own-keys.md) |

package/docs/api/openapi.json

@@ -37,6 +37,10 @@
       "name": "agents",
       "description": "Endpoints under `/api/bongos/agents`."
     },
+    {
+      "name": "ai-studio",
+      "description": "Endpoints under `/api/bongos/ai-studio`."
+    },
     {
       "name": "analytics",
       "description": "Endpoints under `/api/bongos/analytics`."
@@ -1114,6 +1118,44 @@
         ]
       }
     },
+    "/ai-studio/status": {
+      "get": {
+        "operationId": "get_ai_studio_status",
+        "tags": [
+          "ai-studio"
+        ],
+        "summary": "GET /ai-studio/status",
+        "description": "**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/ai-studio/routes/ai-studio.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetAiStudioStatusResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/analytics/builder/{id}": {
       "get": {
         "operationId": "get_analytics_builder_id",
@@ -9880,7 +9922,7 @@
           "government"
         ],
         "summary": "POST /government/rank-sets/apply",
-        "description": "government.manage — add a RECOMMENDED RANK SET (task 1004400): the custom ranks recommendations.js names for a project type and size, each with its grants. It is the create form and the grant toggle run in a loop, under the same checks: a rank that already exists is LEFT ALONE (never re-granted, never relabelled — an owner may have edited it), and every grant is re-checked with catalog.isGrantableTo, so a set can never write what the toggle would refuse. Re-applying is safe; the reply says what was added.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
+        "description": "government.manage — add a RECOMMENDED RANK SET (task 1004400): the custom ranks recommendations.js names for a project type and size, each with its grants. It does what the create form and the grant toggle do, for every rank in the set, under the same checks: a rank that already exists is LEFT ALONE (never re-granted, never relabelled — an owner may have edited it), and every grant is re-checked with catalog.isGrantableTo, so a set can never write what the toggle would refuse. Re-applying is safe; the reply says what was added. task 1004929: the whole set is written by db.applyRankSet in ONE transaction and three statements, instead of a read + insert + one insert per grant for every rank. A rank this route creates is always a CUSTOM rank (is_system false, no seeded_rank — what createRank returns), so each grant is screened against that shape before the write, exactly as the toggle would screen it. A failure now writes nothing, so a 500 reports empty created/skipped lists.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `government.manage` (all required).",
         "x-rank": "archon",
         "x-source": "modules/government/routes/government.js",
         "x-permissions": [
@@ -27878,6 +27920,19 @@
           "vocabulary"
         ]
       },
+      "GetAiStudioStatusResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "module": {}
+        },
+        "required": [
+          "ok",
+          "module"
+        ]
+      },
       "GetArtistGateResponse": {
         "type": "object",
         "properties": {
@@ -37446,9 +37501,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 587,
-  "x-schema-count": 628,
+  "x-endpoint-count": 588,
+  "x-schema-count": 629,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 406,
+  "x-response-schemas": 407,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 587 endpoints across 98 route files.
+> **Generated from the live route files** — the route file is authoritative. 588 endpoints across 99 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -43,6 +43,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/agents/:name/enable` | `metic+archon` | — | POST /agents/:name/enable — THE OPERATOR ACT. |
 | POST | `/api/bongos/agents/:name/invoke` | `any-builder` | `input` | POST /agents/:name/invoke — fire an on-demand agent. |
 
+## `ai-studio` (1)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/ai-studio/status` | `any-builder` | — |  |
+
 ## `analytics` (1)
 
 | Method | Path | Rank | Body | Description |

package/docs/file-map.md

@@ -116,6 +116,7 @@
 │   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/bongos/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. R03 (task 1003114, ADR 0233) added the PROPOSAL: an artist writes the replacement wording and it becomes a Bongos task carrying a fenced copy-proposal patch — no row, NO second migration (a proposals table is the forbidden column with extra steps), and scripts/bongos/copy-apply.js lands it as a real diff under a claim. BV2.TW05 (task 1004316, ADR 0341 D8) added Tweak Mode's three derived READS — GET /copy-desk/pages, /copy-desk/pages/:pageId, /copy-desk/tally: page status and count, changelog, drift, "N of M tweaked" per surface, and the artist's tally — over the page-tweak tasks (lifecycle port), docs/page-inventory.json and docs/page-readings.json (both now in the publish manifest), with no status table. BV2.TW06 (task 1004317, ADR 0341 D2, D5, D6) added its first two page WRITES: POST /copy-desk/pages/:pageId/claim (an artist-craft builder opens or takes the page's tweak round as a web-claimed task, through the lifecycle port's webClaimPageTweak, under an advisory lock on the page) and POST /copy-desk/pages/:pageId/asks (anyone files a page ask, a copy_desk_flags row with scope 'page', added by copy_desk_002_page_asks.sql). CLAUDE.md, module.json, registry.js, flags.js, proposals.js, pages.js (the page-tweak block format), page-status.js (the pure derivation), page-data.js (the page artifacts' read side), routes/copy-desk.js, migrations/copy_desk_001_flags.sql, migrations/copy_desk_002_page_asks.sql, tests/{copy_flags,copy_queue,copy_no_cms,copy_proposals,copy_page_status}.mjs + tests/fixtures/page-tweak.cjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent. skills/tweak/SKILL.md is the /tweak skill (contributes.skills; moved out of .claude/skills/ in task 1004471, hidden from the model listing, typed as /tweak).
 │   ├── page-notes/              ← the artist's page feedback docs (task 1004496, default-on): the Artistry palette button's store. A doc about one hall page, with up to eight reference images (stored in the DB, images only), turned into ideas by an AI split on submit and kept as the page's reference (?note=N). Apart from copy-desk, which may hold no wording. module.json, CLAUDE.md, notes.js (pure), split.js, db.js, routes/, migrations/.
+│   ├── ai-studio/               ← AI generation for artists (task 1004916, ADR 0392, default-off; hub first): a sketch or image set plus a prompt gets a Gemini reply and generated images on our key (processor-held balance, one named price multiplier, funds held first, released on failure) or the builder's own key (no charge). Keys entered only in Settings, never leave the server. module.json, CLAUDE.md, routes/.
 │   ├── raise/                   ← the /raise investor page (task 1004847, ADR 0384, default-off; hub only): password-gated for investors (signing in accepts the NDA, non-binding interest), edited in place by any active builder with every change logged. The copy in content/ is the owner's words — never reword it in code. module.json, CLAUDE.md, raise.js (pure), page.js, web.js (the GET-only raise.web port core mounts at /raise), db.js, routes/ (every write), migrations/, content/, views/, public/.
 │   ├── npm-release/             ← the deploy page for a project that publishes an npm package from GitHub (task 1002622, default-OFF — on only in the Bongos hall, which publishes @bongos/core). "Where the work is": every task finished in the last 14 days, placed in the stage it has actually reached (not merged · merged, no version yet · published, not running here · running here, not released · released · in no version), plus the version history — each version's tasks. The version↔task join reads the release-notes.json the package itself carries (scripts/bongos/release-notes.js writes it at pack time), streamed out of the NEWEST version's npm tarball in-process (no child process, no sync call) when the running core's own copy stops short. module.json, work.js (the reading + the stage placement — the packument, tarball stream and tar reader it uses are the core's src/bongos/package-registry.js, reached through the doorway's readPackageRegistry since task 1004296), routes/work.js (GET /npm-release/work, gated core.pin.move like the page), public/work.{js,css} (the two sections /deploy lends it: #nr-work, #nr-versions). Task 1004301 added the same line on a task's own page: routes/task-where.js (GET /npm-release/task/:id, any signed-in builder — it shows nothing not already public) + public/task-widget.js, injected into task.html by the loader's uiSections seam (hallWidgetScripts file task-widget.js) to fill #task-contrib on otb:task-shown. Tests sit at the repo root — tests/npm_release_{work,page}.mjs — because a default-off module's own tests/ is skipped by the unit runner.
 │   ├── render-deploy/           ← the deploy page for a project whose app deploys through Render (task 1004270, default-OFF). The service's Render deploys, each tied to its commit and the Bongos tasks in it, what is live now, and deploy + roll back behind a two-step confirm the server also holds. The owner's Render key is never stored: it rides each request in a header. Uses the one Render client, scripts/bongos/render-api.js, and its ownerId guard. `deploys.js` (shaping + ledger), `render.js` (key + client), `routes/` (app, history, act), `public/deploy.js` (the page, mounted in /deploy), `migrations/` (one two-id table)
@@ -471,10 +472,12 @@ To install on a new machine, symlink each routine's directory under `~/.claude/s
 ├── rank-change-greeting.js   ← promotion/demotion greeting (V3.R28 #249); spawned by session-start.js, also runnable standalone
 ├── pull-memory.js            ← memory pull-on-session-start (V3.R56 #275); spawned by session-start.js (kill-switches: OTB_MEMORY_PULL_OFF / OTB_SUBAGENT)
 ├── recall-hints.js           ← SessionStart: when the session opens holding a claim, surface the top project-knowledge hits for that task via POST /api/bongos/search (#963/V4.R25, ADR 0060)
+├── module-skills.js          ← SessionStart: for an artist-craft builder, copy the enabled modules' skills (`/tweak`) into .claude/skills/ as untracked copies (task 1004915, ADR 0224); kill-switch OTB_MODULE_SKILLS_OFF
 ├── conductor.js              ← UserPromptSubmit: MAS Conductor advisory + dispatch directive (#427/#439); self-gates on OTB_CONDUCTOR_OFF / OTB_SUBAGENT; also delivers the how-to step for the moment and marks it read (task 1004635)
 ├── session-cards.js          ← UserPromptSubmit: deterministic delivery of READ-ONLY in-session cards (builder-start, status) — pre-renders the card + injects a one-step render directive (task 1288)
 ├── lifecycle-card.js         ← PostToolUse (Bash|PowerShell): deterministic delivery of MUTATING lifecycle cards (claim/ship/release) — the write-side mirror of session-cards.js (task 1288)
 ├── stuck-detector.js         ← PostToolUse + PostToolUseFailure (Bash|PowerShell): the third time one session hits the same wall — the same `[otb-plain]` card for the same task id, or the same red check — it injects ONE instruction: stop retrying, diagnose (path named), or /ask-for-help. Never blocks; silent with no card; kill-switch BONGOS_STUCK_DETECTOR_OFF=1 (task 1003990)
+├── shell-hooks.js            ← PreToolUse + PostToolUse (Bash|PowerShell): runs the per-shell-call hooks named on its settings command line (secret-gate, git-guard, allow-rule-guard / lifecycle-card, stuck-detector) in ONE node process via each hook's exported run(), merging blocks, permission answers and context exactly as separate processes would — 2 hook processes per shell call instead of 4-5 (task 1004931)
 ├── shell-tools.js            ← shared helper, not a hook: the ONE list of tool names that carry a shell command (`Bash`, `PowerShell`) + the `matcher` string the settings entries must use. git-guard, secret-gate, lifecycle-card and stuck-detector all test through it; four private copies of `Bash` had left every Windows session unguarded, silently (task 1003999, pinned by tests/hook_shell_tools.mjs)
 ├── stuck-strikes.js          ← shared helper, not a hook: the per-session strike counter (hashed signatures in os.tmpdir()) + the static instruction text; stuck-detector.js, git-guard.js and worktree-guard.js all count through it (task 1003990)
 ├── pre-compact.js            ← PreCompact: thin reader around eviction-policy.js — emits an eviction directive (blocks to drop + one-line recovery stubs) at the compaction seam (task 1349)

package/docs/module-api-changelog.md

@@ -3255,5 +3255,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.23.18 with no explicit bump. run 40613099968. (task 1002620)
   1.23.20 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.23.19 with no explicit bump. run 40709473534. (task 1002620)
+  1.23.21 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.23.20 with no explicit bump. run 40804017640. (task 1002620)
+  1.23.22 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.23.21 with no explicit bump. run 40815670165. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -150,7 +150,7 @@
       "surface": "builders",
       "title": "The city",
       "states_read": ["city","fullscreen","switched","focus","pins","living","card","card-ask"],
-      "files_hash": "6f33201eed0847f6",
+      "files_hash": "8737e91e618041fe",
       "reading_hash": "77470c4eb3047a05",
       "counts": {"lines":43,"placed":10,"shared":8,"unplaced":25},
       "omitted": {"data":17},

package/modules/ai-studio/CLAUDE.md

@@ -0,0 +1,15 @@
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
+
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
+
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
+
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
+
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/ai-studio/module.json

@@ -0,0 +1,26 @@
+{
+  "key": "ai-studio",
+  "title": "AI studio (artists' generation)",
+  "description": "An artist submits a sketch or image set with a prompt in the Studio and gets a Gemini reply plus generated images, with project context added on the server (task 1004916, goal 1000136, ADR 0392). Runs on our provider key against a processor-held balance (provider cost times one named multiplier, funds held before the run, released on failure) or on the builder's own key at no charge. Keys are entered only in Settings and never leave the server. default:false: enabled where billing is wanted, the hub first.",
+  "version": "1.0.0",
+  "coreVersion": "^1.19.0",
+  "category": {
+    "parent": "money"
+  },
+  "author": "Cloud Bongos LLC",
+  "origin": "Cloud Bongos (cloudbongos.com)",
+  "license": "AGPL-3.0",
+  "maintainer": "Cloud Bongos maintainers",
+  "default": false,
+  "maintenance": {
+    "status": "maintained"
+  },
+  "migrations": true,
+  "contributes": {
+    "routes": [
+      "ai-studio"
+    ]
+  },
+  "provides": [],
+  "consumes": []
+}

package/modules/ai-studio/routes/ai-studio.js

@@ -0,0 +1,22 @@
+// modules/ai-studio/routes/ai-studio.js — the AI studio's HTTP surface (task
+// 1004916, goal 1000136, ADR 0392). A skeleton for now: later tasks add the
+// provider-key, balance, submit and result routes beside this one.
+//
+//   GET /ai-studio/status   is the module on, and is a provider key stored
+//
+// rank: builder — every route needs a signed-in builder.
+
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+
+module.exports = function buildAiStudioRouter() {
+  const router = express.Router();
+
+  router.get('/ai-studio/status', api.requireBuilder, api.asyncHandler('GET /ai-studio/status', async (req, res) => {
+    res.json({ ok: true, module: 'ai-studio' });
+  }));
+
+  return router;
+};