@bongos/core 1.24.78 → 1.24.80

package/scripts/bongos/setup.js

@@ -4,10 +4,9 @@
 // Usage:
 //   node scripts/bongos/setup.js              run interactively, perform the auth
 //   node scripts/bongos/setup.js --force      re-auth even if a valid session exists
-//   node scripts/bongos/setup.js --skip-keys  skip the per-builder Gemini-key prompt
-//                                          (for CI / batch onboarding / builders
-//                                          who don't need the art pipeline)
-//   node scripts/bongos/setup.js --dry-run    print every step that *would* run, without
+//   node scripts/bongos/setup.js --skip-keys  accepted and ignored: setup asks for no
+//                                          API key any more (task 1005189)
+//   node scripts/bongos/setup.js --dry-run   print every step that *would* run, without
 //                                          contacting the API, writing files, or
 //                                          prompting. Useful for newcomers who want
 //                                          a preview before running it for real.
@@ -21,24 +20,18 @@
 const readline = require('readline');
 const { cliClient, errCode, saveSession, SESSION_PATH, loadSession, printOnboardingNudge, API_BASE, hallBase, surfaceAction, isTerminalSurface } = require('./cli-lib');
 
-// The instance's status dashboard, from branding — never a hardcoded host, so a
-// non-OTB instance points its builders at ITS OWN dashboard (task 1002428).
-// Falls back to the resolved API base when branding is unreadable.
-function statusOrigin() {
-  try {
-    const d = require('../../src/branding').branding().domains || {};
-    if (d.statusOrigin) return d.statusOrigin;
-  } catch (_) { /* fall through */ }
-  return API_BASE;
-}
 const onboardingConfig = require('./onboarding-config');
 const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004893)
 
 const DRY_RUN = process.argv.includes('--dry-run');
-// --skip-keys mirrors the same flag on scripts/setup-builder.sh — when set,
-// the Gemini-key prompt is skipped entirely. Used by CI / batch onboarding /
-// builders who don't intend to run the art pipeline.
-const SKIP_KEYS = process.argv.includes('--skip-keys');
+// Setup asks for NO API key (task 1005189). It used to stop every new builder,
+// on every project, at a Google AI Studio key question — including projects
+// with no art pipeline, and including agent-run setups where nobody can type
+// an answer. An optional key is noise at sign-in: a builder adds it in hall
+// Settings (#art-key) when art actually needs it, and the art pipeline's own
+// "no key found" message is the one place that says so. The server-stored key
+// still reaches this machine through fetch-art-key.js. --skip-keys is still
+// accepted (setup-builder passes it) and does nothing.
 
 // Tiny helper so the dry-run output reads as a clear plan rather than a wall
 // of identical-looking log lines.
@@ -46,77 +39,6 @@ function dryRunStep(msg) {
   console.log(`[dry-run] ${msg}`);
 }
 
-// Ask the new builder for their own Google AI Studio key — used by the
-// pixel-art pipeline (gen_api.py). V3.R11 (#91): each builder pays their own
-// Gemini bill, so spend is attributable per-builder on the public dashboard.
-//
-// Stored as gemini_api_key in ~/.config/otb/bongos-session.json (mode 600, same
-// file as the GitHub session token). gen_api.py reads this location before
-// falling back to ~/.config/otb/env or .env.local.
-//
-// Behavior:
-//   - Non-TTY shells: skip silently. Builder can edit the session file later.
-//   - --skip-keys flag: skip silently. CI/batch onboarding.
-//   - Existing key on file: show last-4, ask "overwrite? [y/N]". Default no.
-//   - Empty input: leave whatever was there. Don't blank a working key by
-//     accident.
-async function promptGeminiKey() {
-  if (SKIP_KEYS) return;
-  if (!process.stdin.isTTY) return;
-
-  const fs = require('node:fs/promises');
-  let session;
-  try {
-    session = JSON.parse(await fs.readFile(SESSION_PATH, 'utf8'));
-  } catch (_) {
-    // saveSession just wrote it; if it's not readable something's badly wrong.
-    // Better to bail than to silently lose a key the builder is about to type.
-    return;
-  }
-
-  const existing = session.gemini_api_key;
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
-  try {
-    console.log('');
-    console.log('Google AI Studio key for the pixel-art pipeline (per-builder, optional).');
-    console.log('  Get one at https://aistudio.google.com/app/apikey');
-    console.log('  (Or skip this and add it later with browser clicks: hall Settings →');
-    console.log(`   ${hallBase()}/settings#art-key — stored encrypted, ADR 0073.)`);
-    console.log('  Each builder pays their own Gemini bill so spend is attributed to them');
-    console.log(`  on ${statusOrigin()}.`);
-    let prompt;
-    if (existing && typeof existing === 'string' && existing.length >= 4) {
-      const last4 = existing.slice(-4);
-      const overwrite = (await ask(`  Key on file ending …${last4}. Overwrite? [y/N] `)).trim().toLowerCase();
-      if (!(overwrite === 'y' || overwrite === 'yes')) {
-        console.log('  Kept the existing key.');
-        return;
-      }
-      prompt = '  New GOOGLE_AI_STUDIO_KEY (press Enter to clear): ';
-    } else {
-      prompt = '  GOOGLE_AI_STUDIO_KEY (press Enter to skip): ';
-    }
-    const input = (await ask(prompt)).trim();
-    if (!input) {
-      if (existing) {
-        // The user asked to overwrite, then entered nothing → clear it.
-        delete session.gemini_api_key;
-        await fs.writeFile(SESSION_PATH, JSON.stringify(session, null, 2), { mode: 0o600 });
-        console.log('  Cleared the key.');
-      } else {
-        console.log('  Skipped — set it later by re-running setup.js or editing the session file.');
-      }
-      return;
-    }
-    session.gemini_api_key = input;
-    await fs.writeFile(SESSION_PATH, JSON.stringify(session, null, 2), { mode: 0o600 });
-    console.log(`  Saved Gemini key to ${SESSION_PATH} (mode 600).`);
-  } finally {
-    rl.close();
-  }
-}
-
 // V3.R10 (#235), criterion C3 — link the builder's Anthropic account.
 //
 // Claude Code is the trusted agent on the builder's machine: it writes its own
@@ -213,15 +135,15 @@ async function promptDisciplines() {
   try {
     console.log('');
     console.log('Which kind of work do you want surfaced first?');
-    console.log('  1) engineer  — code, gameplay mechanics, infra, the GDS itself, perf, bugs');
-    console.log('  2) artist    — pixel-art tiles, sprites, icons, avatars, the art pipeline');
-    console.log('  3) ideator   — idea capture, scoping, research, docs/briefs, narrative, lore');
-    console.log('  4) all of them');
-    console.log('  5) skip for now (you can set this later on /builders)');
-    const choice = (await ask('Choose [1-5]: ')).trim();
+    console.log('  1) artisan  — code, gameplay mechanics, infra, Bongos itself, perf, bugs');
+    console.log('  2) artist   — how the project looks and reads, and its ideas: art, copy, scoping, lore');
+    console.log('  3) both of them');
+    console.log('  4) skip for now (you can set this later on /builders)');
+    const choice = (await ask('Choose [1-4]: ')).trim();
+    // Two task crafts since task 1005141 (the ideator folded into the artist).
     const map = {
-      1: ['engineer'], 2: ['artist'], 3: ['ideator'],
-      4: ['engineer', 'artist', 'ideator'], 5: null,
+      1: ['artisan'], 2: ['artist'],
+      3: ['artisan', 'artist'], 4: null,
     };
     const disciplines = map[choice];
     if (disciplines === undefined) {
@@ -327,12 +249,9 @@ async function finishSetup(builder) {
   } catch (e) {
     console.log(`Note: could not activate git hooks (${e.message}); run: git config core.hooksPath .husky`);
   }
-  await promptGeminiKey();
   // #1281: deliver the GDS shared art key to entitled newcomers right now, so
   // a brand-new Xenos's first art task works without waiting for the next
-  // session start. Best-effort, bounded — never block setup. (Phase 2 will
-  // make the promptGeminiKey copy above rank-aware — "we cover your first art
-  // tasks; add your own key when you reach Thetes".)
+  // session start. Best-effort, bounded, silent — never block setup.
   try {
     const { spawnSync } = require('node:child_process');
     const path = require('node:path');
@@ -405,11 +324,6 @@ async function main() {
     dryRunStep('If GitHub refuses with device_flow_disabled (a one-click App whose checkbox is unticked, task 1003051): would print the web sign-in guidance (hall Settings → CLI Access) and prompt for a pasted CLI token instead of dead-ending.');
     dryRunStep('Would print the verification_uri and user_code, then poll /api/bongos/auth/device/poll every few seconds until the user approves or the code expires.');
     dryRunStep(`On approval, would write the bearer token + builder profile to ${SESSION_PATH} (chmod 600).`);
-    if (SKIP_KEYS) {
-      dryRunStep('Would skip the Gemini-key prompt (--skip-keys set).');
-    } else {
-      dryRunStep(`Would prompt for a per-builder GOOGLE_AI_STUDIO_KEY on TTY shells and store it as gemini_api_key in ${SESSION_PATH} (mode 600). Used by modules/art-pipeline/pipeline/gen_api.py for per-builder cost attribution.`);
-    }
     dryRunStep('Would read ~/.claude.json oauthAccount and, on a TTY, prompt to confirm the Anthropic email; on a match would POST /api/bongos/me/anthropic-link and store anthropic_user_id in the session (kept as cosmetic attribution; the identity pin was removed — task 1039 / idea 258). On mismatch would REFUSE to link.');
     dryRunStep('Would prompt for preferred disciplines (creative / engineering / both / skip) and PATCH /api/bongos/me/disciplines on TTY shells.');
     dryRunStep(`Would prompt for onboarding-friction consent (Y/n) and record the decision to ${onboardingConfig.CONSENT_PATH} on TTY shells.`);
@@ -531,7 +445,6 @@ async function main() {
       const { activate } = require('./install-git-hooks');
       activate();
     } catch (_) { /* hook activation is best-effort */ }
-    await promptGeminiKey();
     await promptAnthropicLink();
     await promptDisciplines();
     await promptOnboardingConsent();

package/scripts/bongos/start.js

@@ -220,9 +220,9 @@ function roleLabel(t) {
 // that read in both light and dark. Colours the Type column so the work lane
 // reads at a glance (task 1273 follow-up: "spice up the view").
 function disciplineColor(d) {
-  if (d === 'engineer') return '#1D9E75'; // sea-teal
+  if (d === 'artisan') return '#1D9E75'; // sea-teal
   if (d === 'artist') return '#D85A30';   // terracotta
-  if (d === 'ideator') return '#639922';  // olive
+  if (d === 'artist') return '#639922';  // olive
   return '#888780';                        // unclassified — neutral gray
 }
 function whatItIs(t) {

package/scripts/bongos/task.js

@@ -7,7 +7,7 @@
 // the first-class front door.
 //
 // Usage:
-//   bongos task new --title "…" --description "…" [--kind feature] [--discipline engineer]
+//   bongos task new --title "…" --description "…" [--kind feature] [--discipline artisan]
 //                   [--priority 3] [--version <id>] [--goal <id>] [--criteria C1,C2]
 //                   [--touches a/,b/] [--est-minutes N] [--credits N] [--ready] [--json]
 //   bongos task show <id> [--json]
@@ -29,7 +29,7 @@ const { UPKEEP_KIND } = require('../../modules/lifecycle/upkeep-home');
 // Valid enums (mirrors the server's task-classifier vocab; a friendly client-side check
 // so an obvious typo fails before the round-trip — the server stays authoritative).
 const VALID_KINDS = ['feature', 'bug', 'infra', 'refactor', 'spike', 'learning-capture', 'cleanup', 'decision', 'blocker-resolution', 'verify'];
-const VALID_DISCIPLINES = ['engineer', 'artist', 'ideator', 'ui'];
+const VALID_DISCIPLINES = ['artisan', 'artist', 'ui'];
 
 function csv(v) {
   return String(v || '').split(',').map((s) => s.trim()).filter(Boolean);
@@ -46,7 +46,8 @@ function buildTaskBody(args) {
 
   const kind = arg('--kind', args) || 'feature';
   if (!VALID_KINDS.includes(kind)) errors.push(`--kind must be one of: ${VALID_KINDS.join(', ')}`);
-  const discipline = arg('--discipline', args) || 'engineer';
+  // Old spellings still work (task 1005141): engineer → artisan, ideator → artist.
+  const discipline = ({ engineer: 'artisan', ideator: 'artist' })[arg('--discipline', args)] || arg('--discipline', args) || 'artisan';
   if (!VALID_DISCIPLINES.includes(discipline)) errors.push(`--discipline must be one of: ${VALID_DISCIPLINES.join(', ')}`);
 
   const num = (flag) => { const v = arg(flag, args); return v == null ? undefined : Number(v); };
@@ -82,7 +83,7 @@ function buildTaskBody(args) {
 
 function usage() {
   console.error('usage:');
-  console.error('  bongos task new --title "…" --description "…" [--kind feature] [--discipline engineer]');
+  console.error('  bongos task new --title "…" --description "…" [--kind feature] [--discipline artisan]');
   console.error('                  [--priority 3] [--version <id>] [--goal <id>] [--criteria C1,C2]');
   console.error('                  [--touches a/,b/] [--est-minutes N] [--credits N] [--ready] [--json]');
   console.error('  bongos task show <id> [--json]');

package/scripts/bongos/triage.js

@@ -282,7 +282,7 @@ async function createTask({ versionId, title, description, priority, sourceRef,
     // promotion they just decided on. So resolve it here with the SAME function the
     // server uses, and name a fallback rather than letting the loop break — the
     // identical trade modules/ideas/inbox.js makes for capture.
-    discipline: resolveWriteDiscipline({ title, description }).discipline || 'engineer',
+    discipline: resolveWriteDiscipline({ title, description }).discipline || 'artisan',
   };
   if (goalId == null) {
     throw new Error('createTask: goal_id is required — every task belongs to a goal (task 1003598 deleted the catch-all fallback).');

package/scripts/bongos/worktree.js

@@ -291,9 +291,21 @@ function cmdAdd(root, argv) {
     }
   }
   console.log('');
-  console.log('Next:');
-  console.log(`  cd "${wtPath}"`);
-  console.log('  node scripts/bongos/claim.js <task-id>   (worktree auto-detected)');
+  for (const line of nextStepLines(wtPath)) console.log(line);
+}
+
+// task 1005185 - feedback bug scripts: the "Next:" hint names the claim command that
+// exists in the new tree. A project that installs the core from npm has no scripts/ of
+// its own — scripts is a git-ignored link into node_modules/@bongos/core, so a fresh
+// worktree has none and `node scripts/...` dies MODULE_NOT_FOUND. There the CLI is
+// `npx bongos <verb>` (npx walks up to the main checkout's node_modules). Same check
+// claim.js's finishHintLines uses (task 1005113).
+function nextStepLines(wtPath, { installed } = {}) {
+  if (installed === undefined) {
+    try { installed = require('./fitness-lib').isInstalledCore(); } catch { installed = false; }
+  }
+  const claim = installed ? 'npx bongos claim <task-id>' : 'node scripts/bongos/claim.js <task-id>';
+  return ['Next:', `  cd "${wtPath}"`, `  ${claim}   (worktree auto-detected)`];
 }
 
 function cmdRemove(root, argv) {
@@ -445,5 +457,5 @@ if (require.main === module) main();
 
 module.exports = {
   worktreeNameFor, needsJunction, removalPlan, nodeModulesState, shadowingNodeModules, huskDisposition,
-  unlinkNodeModulesLink,
+  unlinkNodeModulesLink, nextStepLines,
 };

package/scripts/setup-builder.js

@@ -7,7 +7,7 @@
 // bootstrap a new builder runs right after cloning:
 //
 //   node scripts/setup-builder.js
-//   node scripts/setup-builder.js --skip-keys   # don't prompt for API keys
+//   node scripts/setup-builder.js --skip-keys   # accepted and ignored (no key is asked for)
 //   node scripts/setup-builder.js --no-auth      # skip the GDS Device Flow step
 //   node scripts/setup-builder.js --help
 //
@@ -15,8 +15,8 @@
 // "already done" rather than clobbering. What it does, in order:
 //   1. Verify Node >= 22 and Python >= 3.10 (the two required toolchains).
 //   2. `npm ci` to install JS dependencies.
-//   3. Copy .env.local.example -> .env.local (if absent) + optionally prompt
-//      for the Google AI Studio key (--skip-keys / non-TTY takes placeholders).
+//   3. Copy .env.local.example -> .env.local (if absent). No API key is asked
+//      for (task 1005189): a builder adds one in hall Settings when art needs it.
 //   4. `node scripts/bongos/setup.js` — GitHub Device Flow auth (--no-auth skips).
 //   5. Print the "ready" banner pointing at /builder-start.
 //
@@ -25,7 +25,6 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const readline = require('node:readline');
 const { spawnSync } = require('node:child_process');
 
 const REPO_ROOT = path.resolve(__dirname, '..');
@@ -33,17 +32,15 @@ const IS_WIN = process.platform === 'win32';
 
 // ---- arg parsing ----
 const argv = process.argv.slice(2);
-let SKIP_KEYS = false;
 let NO_AUTH = false;
 for (const a of argv) {
-  if (a === '--skip-keys') SKIP_KEYS = true;
+  if (a === '--skip-keys') { /* accepted for old callers; setup asks for no key (task 1005189) */ }
   else if (a === '--no-auth') NO_AUTH = true;
   else if (a === '-h' || a === '--help') {
     console.log(`setup-builder.js — one-command bootstrap for a new OTB builder.
 
 Usage:
   node scripts/setup-builder.js
-  node scripts/setup-builder.js --skip-keys     # don't prompt for API keys
   node scripts/setup-builder.js --no-auth       # skip the GDS Device Flow step
   node scripts/setup-builder.js --help
 
@@ -162,13 +159,6 @@ function npmCi() {
 // ---------------------------------------------------------------------------
 // 3. .env.local
 // ---------------------------------------------------------------------------
-function ask(question) {
-  return new Promise((resolve) => {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    rl.question(question, (answer) => { rl.close(); resolve(answer); });
-  });
-}
-
 async function envLocal() {
   step('3/5  Local environment (.env.local)');
   const example = path.join(REPO_ROOT, '.env.local.example');
@@ -186,37 +176,8 @@ async function envLocal() {
   fs.copyFileSync(example, target);
   ok('Created .env.local from .env.local.example');
 
-  // Prompt for the Google AI Studio key only with a TTY and without --skip-keys.
-  // An empty value is not fatal — the pipeline also resolves the key from
-  // ~/.config/otb/env, so it just means art-pipeline calls raise the standard
-  // "GOOGLE_AI_STUDIO_KEY not found" error until set.
-  if (SKIP_KEYS) {
-    skip('--skip-keys set; leaving GOOGLE_AI_STUDIO_KEY blank in .env.local');
-    skip('you can edit .env.local later, or set it in ~/.config/otb/env');
-    return;
-  }
-  if (!process.stdin.isTTY) {
-    skip('no TTY; leaving GOOGLE_AI_STUDIO_KEY blank in .env.local');
-    return;
-  }
-  console.log('');
-  console.log(`  ${C.dim}Google AI Studio key for the pixel-art pipeline.`);
-  console.log('  Get one at https://aistudio.google.com/app/apikey .');
-  console.log(`  Press Enter to skip — you can always edit .env.local later.${C.reset}`);
-  // Strip CR/LF so a pasted value with a stray newline can't inject extra
-  // lines into the builder's .env.local; trim handles surrounding whitespace.
-  const input = (await ask('  GOOGLE_AI_STUDIO_KEY: ')).replace(/[\r\n]+/g, '').trim();
-  if (input) {
-    const contents = fs.readFileSync(target, 'utf8');
-    // Function replacement (not a string): String.replace treats $&, $1, $$ etc.
-    // in a replacement STRING as special, which would silently corrupt a key
-    // containing a bare `$`. A function return value is spliced verbatim.
-    const next = contents.replace(/^GOOGLE_AI_STUDIO_KEY=.*$/m, () => `GOOGLE_AI_STUDIO_KEY=${input}`);
-    fs.writeFileSync(target, next);
-    ok('Saved GOOGLE_AI_STUDIO_KEY to .env.local');
-  } else {
-    skip('left GOOGLE_AI_STUDIO_KEY blank — edit .env.local when you have one');
-  }
+  // No key is asked for here (task 1005189): an optional key at sign-in is noise.
+  // The art pipeline says so itself, when art actually needs one.
 }
 
 // ---------------------------------------------------------------------------
@@ -234,7 +195,6 @@ function gdsAuth() {
   console.log('  Handing off to scripts/bongos/setup.js ...');
   console.log('');
   const setupArgs = [path.join(REPO_ROOT, 'scripts', 'bongos', 'setup.js')];
-  if (SKIP_KEYS) setupArgs.push('--skip-keys');
   const status = run(process.execPath, setupArgs); // shell defaults off
   if (status === 0) {
     ok('GDS session ready');

package/src/bongos/auth-admission.js

@@ -149,7 +149,7 @@ async function recentShipsForRollup(builderId) {
 // preference, exactly as before. A port that cannot be asked leaves its numbers
 // null ("could not ask"), never 0. Never throws: a failed read drops its craft's
 // numbers, not the report.
-const ROLLUP_CRAFTS = Object.freeze(['engineer', 'artist', 'ideator']);
+const ROLLUP_CRAFTS = Object.freeze(['artisan', 'artist']);
 const countOrNull = (v) => (Number.isInteger(v) && v >= 0 ? v : null);
 async function readCraftRollup(builderId, { shipped = 0, preferred = [] } = {}) {
   const fallback = { counts: null, disciplines: Array.isArray(preferred) ? preferred : [] };
@@ -172,20 +172,20 @@ async function readCraftRollup(builderId, { shipped = 0, preferred = [] } = {})
     };
     const [artist, ideator] = await Promise.all([
       earned.includes('artist') ? ask('copy-desk.artistStats') : null,
-      earned.includes('ideator') ? ask('ideas.ideatorStats') : null,
+      earned.includes('artist') ? ask('ideas.ideatorStats') : null,
     ]);
     const credits = (c) => countOrNull(Math.round(Number(byCraft[c])));
     const counts = {};
-    if (earned.includes('engineer')) counts.engineer = { shipped: countOrNull(shipped), credits: credits('engineer') };
+    if (earned.includes('artisan')) counts.artisan = { shipped: countOrNull(shipped), credits: credits('artisan') };
+    // One artist block since the ideator folded in (task 1005141): the page count
+    // and the idea counts side by side, under the craft's one credit split.
     if (earned.includes('artist')) {
-      counts.artist = { pages_approved: countOrNull(artist && artist.pages_approved), credits: credits('artist') };
-    }
-    if (earned.includes('ideator')) {
-      counts.ideator = {
+      counts.artist = {
+        pages_approved: countOrNull(artist && artist.pages_approved),
         filed: countOrNull(ideator && ideator.filed),
         full_ideas: countOrNull(ideator && ideator.full_ideas),
         ratified: countOrNull(ideator && ideator.ratified),
-        credits: credits('ideator'),
+        credits: credits('artist'),
       };
     }
     return { counts, disciplines: earned };

package/src/bongos/craft-mode.js

@@ -77,6 +77,8 @@ function roleLine(mode) {
 // so this adds no prompt-injection surface to the session.
 function describeCraftMode(discipline, modes) {
   if (!discipline || !modes) return null;
+  // A row a rolled-back release wrote may still say engineer/ideator (task 1005141).
+  discipline = require('../crafts').normalizeCraft(discipline);
   const mode = modes[discipline];
   if (!mode || typeof mode !== 'object' || !mode.directive) return null;
   const parts = [`${roleLine(mode)} (the craft of the task claimed in this worktree).`, String(mode.directive).trim()];

package/src/bongos/db.js

@@ -25,6 +25,7 @@
 // grade-count SQL runs on both sides of the kernel↔module line — keep in sync.
 
 const { pool } = require('./pool');
+const { normalizeCraft: normalizeCraftName } = require('../crafts'); // task 1005147: setBuilderCharacter
 const secretBox = require('./secret-box');
 // Module seam (ADR 0083). The builder-exit path EMITS `builder.secrets-scrub-needed`
 // AFTER COMMIT (best-effort) so a module that stores a builder-keyed secret can
@@ -172,7 +173,10 @@ const UPDATE_BUILDER_DISCIPLINES_SQL =
 async function updateBuilderDisciplines(builderId, disciplines, { mainDiscipline } = {}) {
   const { enabledDisciplines } = require('../modules');
   const offered = enabledDisciplines();
-  const list = Array.isArray(disciplines) ? disciplines : [];
+  // An old spelling (engineer, ideator) is today's craft, not an invalid one (task 1005141).
+  const { normalizeCraft, normalizeCrafts } = require('../crafts');
+  const list = Array.isArray(disciplines) ? normalizeCrafts(disciplines) : [];
+  if (typeof mainDiscipline === 'string') mainDiscipline = normalizeCraft(mainDiscipline);
   const bad = list.filter((d) => !offered.includes(d));
   if (bad.length) {
     const err = new Error(`invalid discipline(s): ${bad.join(', ')}`);
@@ -207,6 +211,38 @@ async function getBuilderRoleChoice(builderId) {
   return rows[0] ?? null;
 }
 
+// The character a builder holds (task 1005147, core_297): 'artisan' | 'artist' |
+// 'patron', or null while they have not picked one. Identity and view only — no
+// gate reads it (criterion character-is-identity-not-authority). Its own read, not a
+// column on getBuilderById, so the kernel's hot identity read never depends on a
+// migration that may not have run yet.
+const CHARACTERS = Object.freeze(['artisan', 'artist', 'patron']);
+async function getBuilderCharacter(builderId) {
+  const { rows } = await pool.query(
+    `SELECT game_character FROM builders WHERE id = $1`,
+    [builderId]
+  );
+  return rows[0] ? rows[0].game_character : null;
+}
+// Set (a CHARACTERS word, old spellings normalized) or clear (null) the builder's own
+// character. Throws { code: 'invalid_character' } for anything else.
+async function setBuilderCharacter(builderId, character) {
+  let value = null;
+  if (character !== null) {
+    value = normalizeCraftName(character);
+    if (!CHARACTERS.includes(value)) {
+      const err = new Error(`invalid character: ${character}`);
+      err.code = 'invalid_character';
+      throw err;
+    }
+  }
+  const { rows } = await pool.query(
+    `UPDATE builders SET game_character = $2 WHERE id = $1 RETURNING game_character`,
+    [builderId, value]
+  );
+  return rows[0] ? rows[0].game_character : null;
+}
+
 // The same two facts for a whole list of builders, in ONE statement (task
 // 1004437): the public leaderboard names every row's roles. Map<idString, row>.
 async function getBuilderRoleChoices(builderIds) {
@@ -1142,6 +1178,8 @@ module.exports = {
   UPDATE_BUILDER_DISCIPLINES_SQL,
   getBuilderRoleChoice,
   getBuilderRoleChoices,
+  getBuilderCharacter,
+  setBuilderCharacter,
   RANKS,
   setBuilderRank,
   setBuilderTester,

package/src/bongos/github-repos.js

@@ -378,7 +378,85 @@ async function deleteDeployKey(token, { owner, name, keyId, fetchImpl = fetch }
   throw new GithubApiError(`GitHub deploy-key delete failed (${res.status})`, { status: res.status, code: 'github_error' });
 }
 
+// ---- repo collaborators: inviting a person to the repo itself ----
+// A GitHub invite is a SEPARATE door from a Bongos invite. Bongos admission is a row
+// in the project's own database; this puts the person on the repo's collaborator list
+// so they can see (and, only when asked, push to) the code on their own GitHub.
+// ONE permission is offered: 'pull' (read). A builder ships through the server's own
+// publish and needs no write access, so Bongos never grants it (owner decision,
+// 2026-11-04): 'push', 'admin', 'maintain' and 'triage' are all refused. An owner who
+// wants someone to have write access gives it on GitHub directly.
+const REPO_INVITE_PERMISSIONS = Object.freeze(['pull']);
+
+function repoPath(owner, name) {
+  return `${GH_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}`;
+}
+
+// PUT /collaborators/{login}. 201 = a pending invitation was created, 204 = they
+// already have access. Returns { state: 'invited' | 'already_collaborator', ... }.
+async function inviteRepoCollaborator(token, { owner, name, login, permission = 'pull', fetchImpl = fetch } = {}) {
+  if (!REPO_INVITE_PERMISSIONS.includes(permission)) {
+    throw new GithubApiError('Only read-only access can be offered', { status: 400, code: 'bad_permission' });
+  }
+  const res = await fetchImpl(`${repoPath(owner, name)}/collaborators/${encodeURIComponent(login)}`, {
+    method: 'PUT',
+    headers: ghHeaders(token, { 'Content-Type': 'application/json' }),
+    body: JSON.stringify({ permission }),
+  });
+  if (res.status === 201) {
+    const inv = await res.json().catch(() => ({}));
+    return { state: 'invited', invitation_id: inv.id || null, permission };
+  }
+  if (res.status === 204) return { state: 'already_collaborator', permission };
+  if (res.status === 401) {
+    throw new GithubApiError('GitHub rejected the stored token', { status: 401, code: 'github_unauthorized' });
+  }
+  if (res.status === 403) {
+    throw new GithubApiError('GitHub refused — adding people needs repository admin', { status: 403, code: 'not_repo_admin' });
+  }
+  if (res.status === 404) {
+    throw new GithubApiError('GitHub answered 404 for that repository or user', { status: 404, code: 'repo_not_found' });
+  }
+  if (res.status === 422) {
+    throw new GithubApiError('GitHub would not invite that account', { status: 422, code: 'cannot_invite' });
+  }
+  throw new GithubApiError(`GitHub collaborator invite failed (${res.status})`, { status: res.status, code: 'github_error' });
+}
+
+// Where one person stands on the repo: 'collaborator' (accepted), 'pending' (the
+// invitation is out and not yet accepted), or 'none' (never invited, declined or
+// expired). Two reads: the collaborator check, then the open invitations.
+async function repoInviteState(token, { owner, name, login, fetchImpl = fetch } = {}) {
+  const who = encodeURIComponent(login);
+  const c = await fetchImpl(`${repoPath(owner, name)}/collaborators/${who}`, { headers: ghHeaders(token) });
+  if (c.status === 204) return { state: 'collaborator' };
+  if (c.status === 401) {
+    throw new GithubApiError('GitHub rejected the stored token', { status: 401, code: 'github_unauthorized' });
+  }
+  if (c.status === 403) {
+    throw new GithubApiError('GitHub refused — reading collaborators needs repository admin', { status: 403, code: 'not_repo_admin' });
+  }
+  if (c.status !== 404) {
+    throw new GithubApiError(`GitHub collaborator read failed (${c.status})`, { status: c.status, code: 'github_error' });
+  }
+  const i = await fetchImpl(`${repoPath(owner, name)}/invitations?per_page=${PER_PAGE}`, { headers: ghHeaders(token) });
+  if (i.status === 404) {
+    throw new GithubApiError('GitHub answered 404 for that repository', { status: 404, code: 'repo_not_found' });
+  }
+  if (!i.ok) {
+    throw new GithubApiError(`GitHub invitations read failed (${i.status})`, { status: i.status, code: 'github_error' });
+  }
+  const rows = await i.json();
+  const mine = (Array.isArray(rows) ? rows : []).find(
+    (r) => r && r.invitee && String(r.invitee.login || '').toLowerCase() === String(login).toLowerCase(),
+  );
+  return mine
+    ? { state: 'pending', invitation_id: mine.id, permission: mine.permissions || null }
+    : { state: 'none' };
+}
+
 module.exports = {
+  inviteRepoCollaborator, repoInviteState, REPO_INVITE_PERMISSIONS,
   listUserRepos, createUserRepo, getUserRepo, makeRepoPublic, makeRepoPrivate,
   listUserOrgs, getOrgAccess, createOrgRepo, validGithubLogin,
   listDeployKeys, addDeployKey, deleteDeployKey,

package/src/bongos/module-scope-map.js

@@ -366,6 +366,28 @@ const MODULE_GLOBS = {
   agents: [
     'modules/agents/', '.claude/agents/', 'scripts/bongos/agents-sync.js',
   ],
+  // --- the MODULE STORE (ADR 0338, task 1004793): publishing, listing, entitlements,
+  //     testing channel, promotion, usage reports, payouts and the assessment CLIs.
+  //     It is core code — it lives in src/bongos/, not modules/ — so it has no
+  //     module.json and this key is a scope like kernel or devsecops. Before this
+  //     key NO key resolved these files, so no goal could own a change to the store
+  //     (the 1002690 / 1002736 precedent). Its HTTP surface, src/bongos/routes/modules.js,
+  //     stays kernel's with the rest of routes/. module-scope-map.js is kernel's too:
+  //     the name prefix is shared, the job is not. ---
+  'module-store': [
+    'src/bongos/module-store.js', 'src/bongos/module-listing.js',
+    'src/bongos/module-entitlements.js', 'src/bongos/module-overrides.js',
+    'src/bongos/module-payouts.js', 'src/bongos/module-promotion.js',
+    'src/bongos/module-rechecks.js', 'src/bongos/module-subcategories.js',
+    'src/bongos/module-submissions.js', 'src/bongos/module-testing.js',
+    'src/bongos/module-usage-reports.js',
+    'scripts/bongos/module-store-cli.js', 'scripts/bongos/module-artifact.js',
+    'scripts/bongos/module-assess-docs.js', 'scripts/bongos/module-assess-installs.js',
+    'scripts/bongos/module-assess-score.js', 'scripts/bongos/module-assess-security.js',
+    'scripts/bongos/module-assess-tests.js', 'scripts/bongos/module-assess-version.js',
+    'scripts/bongos/module-error-report.js', 'scripts/bongos/module-remove.js',
+    'scripts/bongos/module-test-runner.js',
+  ],
   // --- the hub identity provider + the PROJECTS CATALOG it owns (ADR 0141): platform
   //     accounts, the SSO client registry, project memberships/invites, and the
   //     platform_identity_projects rows the Explore feed reads. Carved already, so the