@bongos/core 1.24.14 → 1.24.16

package/modules/economy/project-account.js

@@ -0,0 +1,166 @@
+'use strict';
+
+// modules/economy/project-account.js — THE PROJECT ACCOUNT'S RECORD AND VIEW
+// (task 1003182, goal 1000092; ADR 0385 decision 1, ADR 0397 decision 2).
+//
+// WHY. "Where did my money go" is the question this goal exists to answer, and a
+// balance that moved for a reason nobody recorded is exactly what an owner cannot
+// audit. So every movement on the project's account is one append-only row that
+// names its cause: which payout, to which builder, for which task, under which
+// processor transfer.
+//
+// WHAT THIS IS NOT. The processor holds the money in the project's connected account
+// (ADR 0397); this module holds none, moves none and has no balance column. The
+// "recorded balance" is a sum over our own record, shown beside the processor's own
+// figure when a processor port supplies one, with the gap between them named. It
+// follows the credit_log idiom (ADR 0023/0054): insert-only, a correction is a new row.
+//
+// Amounts are integer micro-dollars (the unit ai-studio and its pricing already use).
+// The table, its direction-by-kind rule and the cause rule are enforced by Postgres
+// (migrations/economy_002_project_account.sql); the checks here only turn a refusal
+// into a plain reason before the INSERT.
+
+const KINDS = Object.freeze(['funding', 'payout', 'payout_return', 'fee', 'adjustment', 'hold', 'hold_release']);
+const FIXED_DIRECTION = Object.freeze({
+  funding: 'in', payout_return: 'in', payout: 'out', fee: 'out', hold: 'none', hold_release: 'none',
+});
+const NOTE_MAX = 300;
+
+class MovementRefusal extends Error {
+  constructor(code, message) { super(message); this.code = code; }
+}
+
+const isId = (v) => v !== undefined && v !== null && /^\d+$/.test(String(v));
+const present = (v) => typeof v === 'string' && v.trim().length > 0;
+
+// checkMovement(input) → the row to insert, or throws MovementRefusal naming what is
+// missing. Mirrors the table's CHECKs so a caller sees "a payout needs a task", not a
+// constraint name.
+function checkMovement(input) {
+  const i = input || {};
+  if (!KINDS.includes(i.kind)) throw new MovementRefusal('bad_kind', `kind must be one of ${KINDS.join(', ')}`);
+  const amount = Number(i.amountMicro);
+  if (!Number.isSafeInteger(amount) || amount <= 0) throw new MovementRefusal('bad_amount', 'amount must be a positive whole number of micro-dollars');
+  const note = String(i.note || '');
+  if (note.length > NOTE_MAX) throw new MovementRefusal('note_too_long', `note is at most ${NOTE_MAX} characters`);
+  let direction = FIXED_DIRECTION[i.kind];
+  if (i.kind === 'adjustment') {
+    direction = i.direction;
+    if (direction !== 'in' && direction !== 'out') throw new MovementRefusal('bad_direction', 'an adjustment says whether it is "in" or "out"');
+  }
+  const need = (cond, what) => { if (!cond) throw new MovementRefusal('cause_missing', `a ${i.kind} must name ${what}`); };
+  if (i.kind === 'payout') {
+    need(isId(i.builderId), 'the builder paid'); need(isId(i.taskId), 'the task it was for'); need(present(i.processorRef), 'the processor transfer');
+  } else if (i.kind === 'payout_return') {
+    need(isId(i.builderId), 'the builder it came back from'); need(present(i.processorRef), 'the processor reference');
+  } else if (i.kind === 'funding' || i.kind === 'fee') {
+    need(present(i.processorRef), 'the processor reference');
+  } else if (i.kind === 'adjustment') {
+    need(isId(i.correctsId), 'the movement it corrects'); need(isId(i.actorId), 'who made it'); need(present(note), 'why, in the note');
+  } else {
+    need(isId(i.taskId), 'the task it is held for');
+  }
+  return {
+    kind: i.kind, direction, amount_micro: amount,
+    builder_id: isId(i.builderId) ? String(i.builderId) : null,
+    task_id: isId(i.taskId) ? String(i.taskId) : null,
+    corrects_id: isId(i.correctsId) ? String(i.correctsId) : null,
+    processor_ref: present(i.processorRef) ? i.processorRef.trim() : null,
+    actor_id: isId(i.actorId) ? String(i.actorId) : null,
+    note,
+  };
+}
+
+// recordMovement(db, input) → { recorded, row }. One processor reference books one
+// movement of its kind: a second call with the same kind and reference is a no-op that
+// returns recorded:false and the row already there, so a retried payout cannot pay twice.
+async function recordMovement(db, input) {
+  const r = checkMovement(input);
+  const ins = await db.query(
+    `INSERT INTO economy_project_account_movements
+       (kind, direction, amount_micro, builder_id, task_id, corrects_id, processor_ref, actor_id, note)
+     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
+     ON CONFLICT (kind, processor_ref) WHERE processor_ref IS NOT NULL DO NOTHING
+     RETURNING *`,
+    [r.kind, r.direction, r.amount_micro, r.builder_id, r.task_id, r.corrects_id, r.processor_ref, r.actor_id, r.note]);
+  if (ins.rows[0]) return { recorded: true, row: ins.rows[0] };
+  // Only the one-per-reference rule is absorbed above, so a skipped insert always has a reference.
+  const had = await db.query(
+    'SELECT * FROM economy_project_account_movements WHERE kind = $1 AND processor_ref = $2', [r.kind, r.processor_ref]);
+  return { recorded: false, row: had.rows[0] || null };
+}
+
+const TOTALS_SQL = `
+  SELECT
+    COALESCE(SUM(CASE direction WHEN 'in' THEN amount_micro WHEN 'out' THEN -amount_micro ELSE 0 END), 0) AS recorded_balance_micro,
+    COALESCE(SUM(CASE WHEN direction = 'in'  THEN amount_micro ELSE 0 END), 0) AS in_micro,
+    COALESCE(SUM(CASE WHEN direction = 'out' THEN amount_micro ELSE 0 END), 0) AS out_micro,
+    COALESCE(SUM(CASE kind WHEN 'hold' THEN amount_micro WHEN 'hold_release' THEN -amount_micro ELSE 0 END), 0) AS held_micro,
+    count(*) AS movements
+  FROM economy_project_account_movements`;
+
+const RECENT_SQL = `
+  SELECT m.id, m.kind, m.direction, m.amount_micro, m.builder_id, b.display_name AS builder_name,
+         m.task_id, t.title AS task_title, m.corrects_id, m.processor_ref, m.note, m.created_at
+    FROM economy_project_account_movements m
+    LEFT JOIN builders b ON b.id = m.builder_id
+    LEFT JOIN tasks t ON t.id = m.task_id
+   ORDER BY m.created_at DESC, m.id DESC
+   LIMIT $1 OFFSET $2`;
+
+// shapeAccount — pure. totals is the one aggregate row, processorMicro the processor's own
+// balance or null when no processor is connected. available = what the project could still
+// commit: the recorded balance less what is held. drift is only named when both figures exist.
+function shapeAccount(totals, movements, processorMicro) {
+  const n = (v) => Number(v);
+  const recorded = n(totals.recorded_balance_micro);
+  const held = n(totals.held_micro);
+  const hasProcessor = processorMicro !== null && processorMicro !== undefined;
+  return {
+    unit: 'micro_usd',
+    holds_money: false,
+    recorded_balance_micro: recorded,
+    held_micro: held,
+    available_micro: recorded - held,
+    in_micro: n(totals.in_micro),
+    out_micro: n(totals.out_micro),
+    movement_count: n(totals.movements),
+    processor_balance_micro: hasProcessor ? n(processorMicro) : null,
+    drift_micro: hasProcessor ? n(processorMicro) - recorded : null,
+    movements: movements.map((m) => ({ ...m, amount_micro: n(m.amount_micro) })),
+  };
+}
+
+// The processor read is time-boxed so a hanging processor cannot hold the owner view open; its
+// error text stays in the log and never reaches the client (it can carry account identifiers).
+const PROCESSOR_TIMEOUT_MS = 5000;
+async function readProcessor(processor, log) {
+  if (!processor || typeof processor.balanceMicro !== 'function') return { micro: null, failed: false };
+  let timer;
+  try {
+    const micro = await Promise.race([
+      processor.balanceMicro(),
+      new Promise((_, rej) => { timer = setTimeout(() => rej(new Error('processor timed out')), PROCESSOR_TIMEOUT_MS); }),
+    ]);
+    return { micro, failed: false };
+  } catch (e) {
+    if (log) log.error({ err: e.message }, 'project account: processor balance unreadable');
+    return { micro: null, failed: true };
+  } finally { clearTimeout(timer); }
+}
+
+// readAccount(db, { limit, offset, processor }) — the owner's view. processor is the
+// optional port { balanceMicro() } over the processor's connected account; a failure to
+// read it leaves the figure null (named by processor_error) and never blocks the record.
+async function readAccount(db, { limit = 50, offset = 0, processor = null, log = null } = {}) {
+  const lim = Math.min(Math.max(parseInt(limit, 10) || 50, 1), 200);
+  const off = Math.max(parseInt(offset, 10) || 0, 0);
+  const [totals, recent, read] = await Promise.all([
+    db.query(TOTALS_SQL), db.query(RECENT_SQL, [lim, off]), readProcessor(processor, log),
+  ]);
+  const out = shapeAccount(totals.rows[0], recent.rows, read.micro);
+  if (read.failed) out.processor_error = 'The processor balance could not be read just now.';
+  return out;
+}
+
+module.exports = { MovementRefusal, checkMovement, recordMovement, shapeAccount, readAccount };

package/modules/economy/routes/project-account.js

@@ -0,0 +1,40 @@
+// modules/economy/routes/project-account.js — GET /project-account: the owner's view
+// of the project's account (task 1003182, goal 1000092; ADR 0385, ADR 0397).
+//
+// → { unit, holds_money:false, recorded_balance_micro, held_micro, available_micro,
+//     in_micro, out_micro, movement_count, processor_balance_micro|null, drift_micro|null,
+//     movements:[{ kind, amount_micro, builder_name, task_id, task_title, processor_ref, … }] }
+//
+// READ ONLY. There is deliberately no write route: movements are booked by the code that
+// moves money through the processor (the payout task), in the same step, never by a
+// person typing a figure. `../project-account.js` owns the SQL; this file is the doorway.
+//
+// MODULE BOUNDARY: reaches core only through `../../../src/module-api`.
+
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { readAccount } = require('../project-account');
+
+const log = api.logger('economy');
+
+module.exports = function buildProjectAccountRouter({ processor = null } = {}) {
+  const router = express.Router();
+
+  // rank: payout.approve (archon floor) — the owner. The account's balance and who was paid what
+  // is the project's own money, so only the payout authority reads it (ADR 0016: enforced here, server-side).
+  router.get('/project-account', api.requireBuilder, api.requirePermission('payout.approve'), async (req, res) => {
+    try {
+      const { limit, offset } = api.parsePagination(req, { defaultLimit: 50, maxLimit: 200 });
+      const out = await readAccount(api.pool, { limit, offset, processor, log });
+      res.set('Cache-Control', 'no-store');
+      res.json({ ...out, page: api.pageMeta(limit, offset, out.movement_count) });
+    } catch (err) {
+      log.error({ err: err.message }, 'GET /project-account failed');
+      if (!res.headersSent) res.fail('project_account_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/hall-ui/public/ai-studio.css

@@ -45,6 +45,9 @@
   display: inline-flex; align-items: center; min-height: 24px; min-width: 24px; padding: 0; border: 0; background: none;
   font: inherit; color: var(--st-link); text-decoration: underline; text-underline-offset: 3px; cursor: pointer;
 }
+.ais-cam { display: flex; flex-direction: column; gap: 12px; }
+.ais-cam[hidden] { display: none; }
+.ais-cam__view { width: 100%; max-height: 360px; border-radius: 18px; background: var(--st-track); object-fit: cover; }
 .ais-rows { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 8px; }
 .ais-row {
   display: flex; align-items: center; gap: 14px; min-height: 48px; padding: 0 18px; box-sizing: border-box;

package/modules/hall-ui/public/ai-studio.html

@@ -76,6 +76,7 @@
           <p class="ais-quiet">Opening…</p>
         </div>
         <input type="file" id="ais-file" class="ais-file" multiple accept="image/png,image/jpeg,image/gif,image/webp,application/pdf" tabindex="-1" aria-hidden="true">
+        <input type="file" id="ais-camera-file" class="ais-file" accept="image/*" capture="environment" tabindex="-1" aria-hidden="true">
       </main>
 
       <footer class="app-foot" id="app-foot"></footer>
@@ -88,7 +89,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/tweak-editor-lib.js?v=2026-09-28-tw23"></script>
 <script src="/builders/studio-lib.js?v=2026-10-09-day"></script>

package/modules/hall-ui/public/ai-studio.js

@@ -54,6 +54,7 @@
   const page = document.getElementById('ais-page');
   const main = document.getElementById('hall-main');
   const fileInput = document.getElementById('ais-file');
+  const cameraInput = document.getElementById('ais-camera-file');
 
   const state = {
     signedIn: false,
@@ -105,6 +106,7 @@
 
   async function render({ focus = false } = {}) {
     stopTimers();
+    closeCamera(); // leaving the pick step by any route turns the camera off
     main.removeAttribute('data-making');
     state.route = lib.routeOf(location.search);
     main.setAttribute('data-view', state.route.view === 'step' ? state.route.step : state.route.view);
@@ -165,6 +167,7 @@
   }
 
   function paintPick() {
+    closeCamera(); // a repaint drops the panel, so its stream must go too
     const files = state.draft.files;
     const rows = files.map((f, i) => {
       const right = f.status === 'uploading' ? '<span class="ais-dim">uploading…</span>'
@@ -177,15 +180,25 @@
     page.innerHTML = `${stepHead('pick')}
       <h1 class="ais-ask" data-head tabindex="-1">What are you starting from?</h1>
       <div class="ais-drop" id="ais-drop">
-        <span>Drop sketches, pictures or a PDF here, or <button type="button" class="ais-link" id="ais-choose">choose files</button></span>
+        <span>Drop sketches, pictures or a PDF here, paste a picture, <button type="button" class="ais-link" id="ais-choose">choose files</button> or <button type="button" class="ais-link" id="ais-camera">take a photo</button></span>
         <span class="ais-dim">Up to ${lib.MAX_FILES}. Pictures up to 4 MB, PDFs up to 8 MB.</span>
       </div>
+      <div class="ais-cam" id="ais-cam" hidden>
+        <video class="ais-cam__view" id="ais-cam-view" autoplay playsinline muted></video>
+        <div class="ais-go">
+          <button type="button" class="ais-btn" id="ais-snap">Take it</button>
+          <button type="button" class="ais-ghost" id="ais-cam-close">Cancel</button>
+        </div>
+      </div>
       ${rows ? `<ul class="ais-rows">${rows}</ul>` : ''}
       <div class="ais-go">
         <button type="button" class="ais-btn" id="ais-next" ${ready && !uploading ? '' : 'disabled'}>Next</button>
         <span class="ais-faint">${ready ? `${ready} ${ready === 1 ? 'file' : 'files'} ready` : ''}</span>
       </div>`;
     page.querySelector('#ais-choose').addEventListener('click', () => fileInput.click());
+    page.querySelector('#ais-camera').addEventListener('click', openCamera);
+    page.querySelector('#ais-snap').addEventListener('click', snapPhoto);
+    page.querySelector('#ais-cam-close').addEventListener('click', closeCamera);
     const drop = page.querySelector('#ais-drop');
     drop.addEventListener('dragover', (ev) => { ev.preventDefault(); drop.classList.add('ais-drop--over'); });
     drop.addEventListener('dragleave', () => drop.classList.remove('ais-drop--over'));
@@ -202,6 +215,54 @@
     page.querySelector('#ais-next').addEventListener('click', () => go('step=describe'));
   }
 
+  // The camera. A phone opens its own camera app through the capture input;
+  // a computer shows its webcam here, and falls back to the same input if the
+  // browser has no camera access or the person says no.
+  let camStream = null;
+  function openCamera() {
+    const touch = window.matchMedia && window.matchMedia('(pointer: coarse)').matches;
+    const media = navigator.mediaDevices && navigator.mediaDevices.getUserMedia;
+    if (touch || !media) { if (cameraInput) cameraInput.click(); return; }
+    navigator.mediaDevices.getUserMedia({ video: { facingMode: 'environment' }, audio: false }).then((stream) => {
+      closeCamera();
+      camStream = stream;
+      const panel = page.querySelector('#ais-cam');
+      const view = page.querySelector('#ais-cam-view');
+      if (!panel || !view) { closeCamera(); return; }
+      view.srcObject = stream;
+      panel.hidden = false;
+    }).catch(() => { if (cameraInput) cameraInput.click(); });
+  }
+
+  function closeCamera() {
+    if (camStream) camStream.getTracks().forEach((t) => t.stop());
+    camStream = null;
+    const panel = page.querySelector('#ais-cam');
+    if (panel) panel.hidden = true;
+  }
+
+  function snapPhoto() {
+    const view = page.querySelector('#ais-cam-view');
+    if (!view || !view.videoWidth) return;
+    const canvas = document.createElement('canvas');
+    canvas.width = view.videoWidth;
+    canvas.height = view.videoHeight;
+    canvas.getContext('2d').drawImage(view, 0, 0);
+    closeCamera();
+    canvas.toBlob((blob) => {
+      if (blob) addFiles([new File([blob], `photo-${Date.now()}.jpg`, { type: 'image/jpeg' })]);
+    }, 'image/jpeg', 0.9);
+  }
+
+  // A pasted picture (a screenshot, an image copied from anywhere) joins the
+  // files on the pick step; pasting words anywhere else is left alone.
+  function pastedFiles(ev) {
+    const items = Array.from((ev.clipboardData && ev.clipboardData.items) || []);
+    return items.filter((it) => it.kind === 'file').map((it) => it.getAsFile()).filter(Boolean)
+      .map((f, i) => (f.name && f.name !== 'image.png' ? f
+        : new File([f], `pasted-${Date.now()}-${i + 1}.${(f.type.split('/')[1] || 'png').replace('jpeg', 'jpg')}`, { type: f.type })));
+  }
+
   function readBase64(blob) {
     return new Promise((resolve, reject) => {
       const r = new FileReader();
@@ -241,6 +302,7 @@
       <h1 class="ais-ask"><label for="ais-prompt" data-head tabindex="-1">What should it make?</label></h1>
       <textarea class="ais-field ais-field--tall" id="ais-prompt" maxlength="4000" placeholder="Say what you want, in your own words."></textarea>
       <p class="ais-faint">Your project's look and words are added for you, so you don't need to describe them.</p>
+      ${state.terms ? `<p class="ais-faint">${esc(state.terms)}</p>` : ''}
       <div class="ais-go">
         <button type="button" class="ais-btn" id="ais-next">Next</button>
         <button type="button" class="ais-ghost" id="ais-back">Back</button>
@@ -540,6 +602,14 @@
   }
 
   fileInput.addEventListener('change', () => { addFiles(fileInput.files); fileInput.value = ''; });
+  if (cameraInput) cameraInput.addEventListener('change', () => { addFiles(cameraInput.files); cameraInput.value = ''; });
+  window.addEventListener('paste', (ev) => {
+    if (!state.route || state.route.view !== 'step' || state.route.step !== 'pick') return;
+    const pasted = pastedFiles(ev);
+    if (!pasted.length) return;
+    ev.preventDefault();
+    addFiles(pasted);
+  });
   window.addEventListener('popstate', () => render({ focus: true }));
 
   (async () => {
@@ -550,6 +620,7 @@
     if (state.signedIn) {
       const status = await api.request('GET', `${API}/ai-studio/status`);
       state.off = !status.ok;
+      state.terms = (status.data && status.data.terms) || '';
     }
     await render();
   })();

package/modules/hall-ui/public/atlas.html

@@ -92,7 +92,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/atlas.js?v=2026-09-02-index" defer></script>

package/modules/hall-ui/public/blockers.html

@@ -61,7 +61,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the branding pack's currency label, loaded BEFORE blockers.js. -->

package/modules/hall-ui/public/board-room.html

@@ -61,7 +61,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/city.html

@@ -108,7 +108,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab" defer></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch" defer></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages" defer></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip" defer></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/gov-living.js?v=2026-10-09-positions1" defer></script>
 <script src="/builders/gov-feeds.js?v=2026-10-09-living3" defer></script>

package/modules/hall-ui/public/collab.html

@@ -162,7 +162,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/collab-lib.js?v=2026-09-24-archive"></script>
 <script src="/builders/collab.js?v=2026-09-24-archive"></script>

package/modules/hall-ui/public/commands.html

@@ -54,7 +54,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/copy-desk.html

@@ -180,7 +180,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/copy-desk.js?v=2026-09-01-redesign"></script>

package/modules/hall-ui/public/deploy.html

@@ -79,7 +79,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>
 <!-- the shared ask card the move is drawn with (task 1004829) -->

package/modules/hall-ui/public/diagrams.html

@@ -97,7 +97,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/diagram-viewer.js?v=2026-06-14-diagviewer-1" defer></script>

package/modules/hall-ui/public/drachmae.html

@@ -97,7 +97,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/md-reader.js?v=2026-09-02-mdreader-2"></script>

package/modules/hall-ui/public/fleet.html

@@ -58,7 +58,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/fleet-costs.js"></script>

package/modules/hall-ui/public/gate.html

@@ -65,7 +65,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/github-chip.js

@@ -0,0 +1,85 @@
+// github-chip.js — the Link GitHub chip in the hall's top bar (task 1004996,
+// goal 1000095 WA6; owner ask 2026-10-29).
+//
+// Someone who signed in with Google and has no GitHub account linked sees a
+// very small chip, carrying the engineer's icon (craft-mode.js ICONS.building),
+// so it reads as "needed for coding". A press starts the link on the hub
+// (GET /auth/link/github/start, ADR 0396), whose answer lands on the hub's
+// account page. Anyone with GitHub linked sees nothing. It never nags: no
+// pop-up, no banner, nothing in the way of ideating or art — one quiet link.
+//
+// Who has GitHub: a builder row carries the stand-in login `~<handle>` until
+// GitHub is linked, and linking writes the real login over it (auth-link.js
+// linkToSession) — so a login without the `~` needs no read at all, which is
+// the common case. Only a `~` login asks GET /me/sign-in-methods, the answer
+// where the hall can read it; a hall that cannot (a project's own hall) goes by
+// the stand-in. Unlinking GitHub later keeps the real login, so that rare person
+// finds Link GitHub on the account page rather than here. No hub origin (a
+// vanilla instance) means no linking, so no chip. Cosmetic only (ADR 0016).
+//
+// shell.js loads this once a signed-in builder is known and calls mount().
+(function (root) {
+  'use strict';
+  var START = '/api/bongos/auth/link/github/start';
+  var LABEL = 'Link GitHub';
+  var TITLE = 'Link GitHub — needed for coding work';
+  var ICON = 'M2 13.5h12M3.5 13.5V8.5h4v5M7.5 13.5V4.5h5v9';
+  var SVG_NS = 'http://www.w3.org/2000/svg';
+
+  function standIn(builder) {
+    var login = builder && builder.github_login;
+    return typeof login === 'string' && login.charAt(0) === '~';
+  }
+  // methods: the sign-in-methods list, or null when it could not be read.
+  function needsGithub(methods, builder) {
+    if (!standIn(builder)) return false;
+    if (Array.isArray(methods)) return !methods.some(function (m) { return m && m.provider === 'github'; });
+    return true;
+  }
+  // A bare https origin only (OTB.hubOrigin's rule, held again here): never a path,
+  // a query or another scheme spliced in front of the start route.
+  function chipHref(hub) { return typeof hub === 'string' && /^https:\/\/[A-Za-z0-9.-]+(:\d+)?$/.test(hub) ? hub + START : null; }
+
+  function draw(href) {
+    var a = document.createElement('a');
+    a.className = 'gh-chip';
+    a.id = 'gh-chip';
+    a.href = href;
+    a.title = TITLE;
+    a.setAttribute('aria-label', TITLE);
+    var svg = document.createElementNS(SVG_NS, 'svg');
+    [['viewBox', '0 0 16 16'], ['fill', 'none'], ['stroke', 'currentColor'], ['stroke-width', '1.4'], ['stroke-linecap', 'round'], ['stroke-linejoin', 'round'], ['aria-hidden', 'true']]
+      .forEach(function (p) { svg.setAttribute(p[0], p[1]); });
+    var path = document.createElementNS(SVG_NS, 'path');
+    path.setAttribute('d', ICON);
+    svg.appendChild(path);
+    var label = document.createElement('span');
+    label.className = 'gh-chip__label';
+    label.textContent = LABEL;
+    a.appendChild(svg);
+    a.appendChild(label);
+    return a;
+  }
+
+  // mount({ api, builder, hub }): reads the ways in, then draws or removes the chip.
+  function mount(opts) {
+    var side = document.querySelector('#app-topbar .topbar-side');
+    var href = chipHref(opts && opts.hub);
+    if (!side || !href || !opts.api || !standIn(opts.builder)) return Promise.resolve(false);
+    return opts.api.request('GET', '/api/bongos/me/sign-in-methods').then(function (res) {
+      return res && res.ok && res.data && Array.isArray(res.data.methods) ? res.data.methods : null;
+    }, function () { return null; }).then(function (methods) {
+      var old = document.getElementById('gh-chip');
+      var show = needsGithub(methods, opts.builder);
+      if (!show) { if (old) old.remove(); return false; }
+      if (old) return true;
+      // first in the row: before the page note and the jump slot, after the title
+      side.insertBefore(draw(href), side.firstChild);
+      return true;
+    });
+  }
+
+  var api = { mount: mount, needsGithub: needsGithub, chipHref: chipHref, START: START, LABEL: LABEL, ICON: ICON };
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  if (root) root.OTBGithubChip = api;
+})(typeof window !== 'undefined' ? window : null);

package/modules/hall-ui/public/goal-map.html

@@ -140,7 +140,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/goals.html

@@ -244,7 +244,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- task 1004727: the ONE karma vote control every task/idea list renders -->

package/modules/hall-ui/public/government.html

@@ -155,7 +155,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/hall-kit.js"></script>

package/modules/hall-ui/public/idea.html

@@ -53,7 +53,7 @@
 <script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-10-30-market-watch-pages"></script>
+<script src="/builders/shell.js?v=2026-10-30-github-chip"></script>
 <script src="/builders/palette.js" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N overlay, so a ref
      written inside an idea's own prose keeps resolving from this page. -->