@bongos/core 1.24.78 → 1.24.80

package/src/bongos/role-stats.js

@@ -8,11 +8,11 @@
 // WHAT IT ANSWERS. For one builder: which of the three crafts they are shown in,
 // which one leads, and each craft's own headline numbers.
 //
-//   engineer  `shipped`, works shipped (unchanged from today), and engineering credits
+//   artisan   `shipped`, works shipped (unchanged from today), and building credits
 //   artist    pages approved, "N of M tweaked" per surface, credits from pages,
 //             this week (copy-desk's studio tally, the `copy-desk.artistStats`
 //             port)
-//   ideator   thoughts filed, ignited, Full Ideas, ratified by the board, total
+//             AND (task 1005141, the ideator craft folded in) thoughts filed, ignited, Full Ideas, ratified by the board, total
 //             size across every idea stream with the historical-estimate
 //             marker, and the share still alive (the sky's own reads, the
 //             `ideas.ideatorStats` port)
@@ -40,7 +40,7 @@
 
 const seams = require('../module-seams');
 
-const CRAFTS = Object.freeze(['engineer', 'artist', 'ideator']);
+const CRAFTS = Object.freeze(['artisan', 'artist']);
 // A discipline as a craft, asked of economy (reward.craftForPreference), the
 // module that decides which craft a credit belongs to. One table, so a builder's
 // chips and their credits cannot disagree (`ui`, the design discipline, is the
@@ -76,7 +76,7 @@ function resolveMainRole({ mainDiscipline = null, preferred = [], byCraft = null
   }
   const pref = preferredCrafts(preferred);
   if (pref.length) return { main: pref[0], basis: 'preferred' };
-  return { main: 'engineer', basis: 'default' };
+  return { main: 'artisan', basis: 'default' };
 }
 
 // shownCrafts — pure. Main first, then every craft with credits, in the
@@ -97,7 +97,7 @@ function composeRoleStats({ choice = null, byCraft = null, shippedCount = 0, art
   const { main, basis } = resolveMainRole({ mainDiscipline: choice && choice.main_discipline, preferred, byCraft });
   const shown = shownCrafts({ main, preferred, byCraft });
   const credits = byCraft
-    ? { engineer: byCraft.engineer, artist: byCraft.artist, ideator: byCraft.ideator, other: byCraft.other, total: byCraft.total }
+    ? { artisan: byCraft.artisan, artist: byCraft.artist, other: byCraft.other, total: byCraft.total }
     : null;
   return {
     main,
@@ -105,16 +105,32 @@ function composeRoleStats({ choice = null, byCraft = null, shippedCount = 0, art
     shown,
     preferred: preferredCrafts(preferred),
     credits_by_craft: credits,
-    engineer: shown.includes('engineer')
-      ? { shipped: Number(shippedCount) || 0, credits: credits ? credits.engineer : null }
+    artisan: shown.includes('artisan')
+      ? { shipped: Number(shippedCount) || 0, credits: credits ? credits.artisan : null }
       : null,
-    artist: shown.includes('artist') ? (artist || emptyArtist()) : null,
-    ideator: shown.includes('ideator') ? (ideator || emptyIdeator()) : null,
+    artist: shown.includes('artist') ? artistBlock(artist, ideator, credits) : null,
   };
 }
 
 // The shapes a shown craft takes when its port could not be asked: every number
 // null, so a renderer says "unknown", never "0".
+// The artist craft holds what the artist AND the old ideator craft did (task 1005141,
+// BONGOS-V3: ideation folds into the artist). One block, two sources: the page
+// numbers from copy-desk and the idea numbers from the sky. The two share no field
+// name but `unavailable` (true only when NEITHER could be asked) and `credits`,
+// which is the craft's ledger split when there is one, since that now carries
+// both the page and the idea credit streams (economy credits-by-craft.js).
+function artistBlock(artist, ideator, credits) {
+  const pages = artist || emptyArtist();
+  const ideas = ideator || emptyIdeator();
+  return {
+    ...ideas,
+    ...pages,
+    credits: credits ? credits.artist : pages.credits,
+    unavailable: Boolean(pages.unavailable && ideas.unavailable),
+  };
+}
+
 function emptyArtist() {
   return { pages_approved: null, pages: null, surfaces_touched: null, credits: null, this_week: null, surfaces: [], unavailable: true };
 }
@@ -141,7 +157,7 @@ async function readRoleStats(builderId, { shippedCount = 0, getRoleChoice } = {}
   const shown = shownCrafts({ main, preferred, byCraft });
 
   const artistPort = shown.includes('artist') ? seams.resolveOptional('copy-desk.artistStats') : null;
-  const ideatorPort = shown.includes('ideator') ? seams.resolveOptional('ideas.ideatorStats') : null;
+  const ideatorPort = shown.includes('artist') ? seams.resolveOptional('ideas.ideatorStats') : null;
   const [artist, ideator] = await Promise.all([
     typeof artistPort === 'function' ? artistPort(builderId) : null,
     typeof ideatorPort === 'function' ? ideatorPort(builderId) : null,
@@ -176,7 +192,7 @@ async function readRolesForBuilders(builderIds, { getRoleChoices } = {}) {
       main_basis: basis,
       shown: shownCrafts({ main, preferred, byCraft }),
       credits_by_craft: byCraft
-        ? { engineer: byCraft.engineer, artist: byCraft.artist, ideator: byCraft.ideator, other: byCraft.other, total: byCraft.total }
+        ? { artisan: byCraft.artisan, artist: byCraft.artist, other: byCraft.other, total: byCraft.total }
         : null,
     });
   }

package/src/bongos/routes/github.js

@@ -19,11 +19,12 @@ const express = require('express');
 const auth = require('../auth');
 const db = require('../db');
 const secretBox = require('../secret-box');
-const { listUserRepos, createUserRepo, listUserOrgs, getOrgAccess, createOrgRepo, validGithubLogin } = require('../github-repos');
+const { listUserRepos, createUserRepo, listUserOrgs, getOrgAccess, createOrgRepo, validGithubLogin, inviteRepoCollaborator, repoInviteState, REPO_INVITE_PERMISSIONS } = require('../github-repos');
 // Namespace require for the visibility helpers (task 1003045): the route tests
 // stub these on the cached module object, which a load-time destructure would
 // pin to the real implementations.
 const githubRepos = require('../github-repos');
+const repoInfo = require('../repo-info'); // namespace, so a test can stub loadRepoInfo
 const { validateOrRespond } = require('./_helpers');
 const prelaunch = require('../prelaunch-gate');
 const log = require('../logger').logger.child({ src: 'github' });
@@ -43,6 +44,28 @@ function orgNotFound(res, org) {
   return res.fail('org_not_found', { status: 404, message: `GitHub didn’t show your account an organisation called ${org}.` });
 }
 
+// The failures the two repo-invite routes share, each in the owner's words.
+async function repoInviteFailure(req, res, err, where) {
+  if (err && err.status === 401) {
+    await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});
+    return res.fail('repo_scope_required', { status: 403, message: 'Your GitHub authorization expired. Reconnect GitHub to invite people to the repository.' });
+  }
+  if (err && err.code === 'not_repo_admin') {
+    return res.fail('not_repo_admin', { status: 409, message: 'GitHub says your account can’t add people to this repository. Only its owner or an admin can: ask them, or sign in with that account.' });
+  }
+  if (err && err.code === 'repo_not_found') {
+    return res.fail('repo_not_found', { status: 404, message: 'GitHub didn’t show that repository or that username to your account. Check the spelling of the name and try again.' });
+  }
+  if (err && err.code === 'bad_permission') {
+    return res.fail('bad_permission', { status: 400, message: 'Only read-only access can be offered on the repository.' });
+  }
+  if (err && err.code === 'cannot_invite') {
+    return res.fail('cannot_invite', { status: 409, message: 'GitHub wouldn’t invite that account. It may already own the repository, or be unable to join. Check the name, or add them on GitHub yourself.' });
+  }
+  log.error(`[gds] ${where}`, err && err.message);
+  return res.fail('github_error', { status: 502, message: 'GitHub could not be reached. Try again in a moment.' });
+}
+
 // Parse + validate the owner/name ref, or send a 400 and return null.
 function parseRepoRef(raw, res) {
   const ref = String(raw || '').trim();
@@ -79,9 +102,84 @@ async function resolveRepoToken(req, res) {
   return row.token;
 }
 
-module.exports = function buildGithubRouter() {
+// The repo THIS project's code lives in, or a 409 and null. The invite routes below
+// never take a repo from the request: the owner invites people to the project's own
+// repo, so a typed name cannot point the owner's token at some other repository.
+function projectRepoRef(res) {
+  const info = repoInfo.loadRepoInfo();
+  if (!info || info.error) {
+    res.fail('no_project_repo', { status: 409, message: 'This project has no GitHub repository connected, so there is nothing to invite them to. Connect one on the project’s page on the hub, then try again.' });
+    return null;
+  }
+  return { owner: info.owner, name: info.repo };
+}
+
+// A typed GitHub name, with the leading @ allowed, or a 400 and null.
+function parseInviteLogin(raw, res) {
+  const login = String(raw || '').trim().replace(/^@/, '');
+  if (!validGithubLogin(login)) {
+    res.fail('bad_github_login', { status: 400, message: 'That does not look like a GitHub username.' });
+    return null;
+  }
+  return login;
+}
+
+// `deps` is the test seam for the two repo-invite helpers: they are imported directly
+// (so the dead-code check sees them used) and a test hands in stand-ins here, because a
+// destructured import cannot be stubbed on the module object the way the older
+// namespace-called helpers below are.
+module.exports = function buildGithubRouter(overrides = {}) {
+  const deps = { inviteRepoCollaborator, repoInviteState, ...overrides };
   const router = express.Router();
 
+  // rank: archon (permission access_request.review, the same gate as a hall invite) —
+  // invites a person to THIS project's GitHub repository, acting as the caller's OWN
+  // GitHub account (their stored repo token), never a platform credential. GitHub
+  // decides whether the caller may add people. The access is always READ-ONLY:
+  // write ('push') and above are refused, since a builder ships through the server.
+  // It grants no Bongos rank and does not admit anyone to the hall: those are the
+  // hall invite's own record.
+  router.post('/github/repo-invite', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
+    // No act-alone gate here, on purpose: that gate decides who may admit people to the
+    // hall (the hall invite carries it). This records a read-only share on GitHub, and
+    // GitHub itself only lets an account that administers the repo do it.
+    if (validateOrRespond(req, res, {
+      github_login: { required: true, type: 'string', maxLength: 60 },
+      permission: { type: 'string', enum: REPO_INVITE_PERMISSIONS },
+    })) return;
+    const login = parseInviteLogin(req.body.github_login, res);
+    if (!login) return;
+    const ref = projectRepoRef(res);
+    if (!ref) return;
+    const token = await resolveRepoToken(req, res);
+    if (!token) return;
+    try {
+      const out = await deps.inviteRepoCollaborator(token, { ...ref, login, permission: req.body.permission || 'pull' });
+      res.status(out.state === 'invited' ? 201 : 200).json({ ok: true, repo: `${ref.owner}/${ref.name}`, github_login: login, ...out });
+    } catch (err) {
+      return repoInviteFailure(req, res, err, 'POST /github/repo-invite');
+    }
+  });
+
+  // rank: archon (permission access_request.review) — where one person stands on the
+  // project's repo: collaborator, pending (invite sent, not yet accepted) or none.
+  router.get('/github/repo-invite', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
+    // Strict, like the POST: a stray `repo=` (or anything else) is refused, never ignored.
+    if (validateOrRespond(req, res, {}, { query: { github_login: { required: true, type: 'string', maxLength: 60 } } })) return;
+    const login = parseInviteLogin(req.query.github_login, res);
+    if (!login) return;
+    const ref = projectRepoRef(res);
+    if (!ref) return;
+    const token = await resolveRepoToken(req, res);
+    if (!token) return;
+    try {
+      const out = await deps.repoInviteState(token, { ...ref, login });
+      res.json({ ok: true, repo: `${ref.owner}/${ref.name}`, github_login: login, ...out });
+    } catch (err) {
+      return repoInviteFailure(req, res, err, 'GET /github/repo-invite');
+    }
+  });
+
   // rank: any-builder — acts only on the caller's OWN GitHub identity (the token
   // they granted). No rank gate beyond being a signed-in builder.
   router.get('/github/repos', auth.requireBuilder, async (req, res) => {

package/src/bongos/routes/me.js

@@ -217,6 +217,12 @@ module.exports = function buildMeRouter() {
     const openPayoutHoldsP = (async () => {
       try { return await require('../payout-gates').openHoldsFor(req.builder.id); } catch (_) { return null; }
     })();
+    // task 1005147: the character this builder holds, or null (not picked yet — the
+    // hall then shows character creation). Fail-open to null: a core that runs
+    // before core_297 has no column, and that must never break /me.
+    const characterP = (async () => {
+      try { return await db.getBuilderCharacter(req.builder.id); } catch (_) { return null; }
+    })();
     const stuckPageTweaksP = (async () => {
       try {
         const port = seams.resolveOptional('copy-desk.stuckPageTweaksFor');
@@ -476,6 +482,9 @@ module.exports = function buildMeRouter() {
       // when lifecycle is disabled or the read failed, and the shell treats null
       // as OFF — a mode that cannot be read is not on.
       social: socialMode,
+      // task 1005147: the builder's character ('artisan' | 'artist' | 'patron'),
+      // or null until they pick one. Identity and view only; rank still gates.
+      character: await characterP,
       // task 1004422 (BV2.PS03, goal 1000121): PROJECT FOUNDING MODE. Genesis is a
       // mode the EXISTING hall wears (the blend rule, docs/design/project-startup-
       // direction.md), so it rides /me exactly like social: the shell stamps
@@ -724,6 +733,30 @@ module.exports = function buildMeRouter() {
     }
   });
 
+  // task 1005147 (BONGOS-V3 G2): character creation. Body: { character } —
+  // 'artisan' | 'artist' | 'patron', or null to clear it (the hall clears it and
+  // signs out: switching character is signing out and back in, spec settled point 2).
+  // Identity and view only: no claim, vote, deploy or spend gate reads it
+  // (criterion character-is-identity-not-authority). 422 invalid_character otherwise.
+  // rank: any-builder — a builder writes only their own row (req.builder.id), the
+  // /me/disciplines posture.
+  router.put('/me/character', auth.requireBuilder, async (req, res) => {
+    // Nullable by the validator's default: null is the deliberate clear.
+    if (validateOrRespond(req, res, { character: { type: 'string', maxLength: 32 } }, { strict: true })) return;
+    const body = req.body || {};
+    if (!Object.prototype.hasOwnProperty.call(body, 'character')) {
+      return res.fail('character_required', 400);
+    }
+    const raw = body.character;
+    try {
+      const character = await db.setBuilderCharacter(req.builder.id, raw);
+      res.json({ character });
+    } catch (err) {
+      if (err.code === 'invalid_character') return res.fail('invalid_character', 422);
+      throw err;
+    }
+  });
+
   // V3.R10 (#235), criterion C3 — link the authed builder's Anthropic account.
   // Body: { anthropic_email, anthropic_user_id }. Self-attestation: the builder's
   // own Claude Code reads ~/.claude.json oauthAccount during /builder-setup,

package/src/bongos/serve-internal.js

@@ -965,18 +965,35 @@ function mountInternalSurfaces(app) {
     return res.redirect(302, `${isBuildersHost(req) ? '' : '/builders'}/roster${qs}`);
   });
 
-  // task 1005045 (owner decision 2026-11-03, idea 1001310): the owner's Market Watch
-  // settings left their own page (task 1004938) for an owner-only Settings tab on
-  // /market-watch, so the sidebar says "Market Watch" once. The old URL lands on that
-  // tab; 302 for the same reason as the directory above, and no page gate: the redirect
-  // discloses nothing, /market-watch has its own, and the settings routes are the wall.
-  const RETIRED_MW_SETTINGS_RE = /^\/builders\/market-watch-settings(?:\.html)?\/?$/;
+  // THE ONE OPTIONS MENU (task 1005144, BONGOS-V3 R04, ADR 0401). Every setting is
+  // reached from Settings, which is the options menu now; the screens that were pages
+  // of their own open INSIDE it, in a frame that asks for the old address with
+  // ?embed=1. A plain visit to an old address (a bookmark, a doc, a Discord message)
+  // lands on the menu with that screen open (?open=<entry>), and the browser carries
+  // the old #anchor across the redirect because the Location names none. The framed
+  // request passes through to the page and its own page gate below. 302 and no gate,
+  // as the redirects that follow: the redirect discloses nothing, Settings has its own
+  // sign-in gate, and each screen keeps its page gate and its routes (ADR 0016).
+  // options-menu.js RETIRED is this map's twin (tests/hall_options_menu.mjs holds them
+  // equal). market-watch-settings was the owner's tab on /market-watch (task 1005045)
+  // and a page before that; it has no page left, so it never passes through.
+  const RETIRED_TO_OPTIONS = Object.freeze({
+    'my-agents': 'my-agents',
+    'project-settings': 'project-settings',
+    modules: 'modules',
+    government: 'permissions',
+    'market-watch-rules': 'market-watch-rules',
+    'market-watch-settings': 'market-watch',
+  });
+  const RETIRED_OPTIONS_RE = /^\/builders\/(my-agents|project-settings|modules|government|market-watch-rules|market-watch-settings)(?:\.html)?\/?$/;
   app.use((req, res, next) => {
     if (isModuleSurfaceHost(req)) return next();
     if (req.method !== 'GET' && req.method !== 'HEAD') return next();
-    if (!RETIRED_MW_SETTINGS_RE.test(path.posix.normalize(req.path))) return next();
-    const qs = req.url.includes('?') ? req.url.slice(req.url.indexOf('?')) : '';
-    return res.redirect(302, `${isBuildersHost(req) ? '' : '/builders'}/market-watch${qs}#settings`);
+    const m = RETIRED_OPTIONS_RE.exec(path.posix.normalize(req.path));
+    if (!m) return next();
+    const embed = new URLSearchParams(req.url.includes('?') ? req.url.slice(req.url.indexOf('?') + 1) : '').get('embed');
+    if (embed === '1' && m[1] !== 'market-watch-settings') return next();
+    return res.redirect(302, `${isBuildersHost(req) ? '' : '/builders'}/settings?open=${RETIRED_TO_OPTIONS[m[1]]}`);
   });
 
   // Pages folded into another page; 302 and no gate, as above. Task 1005047: Fleet costs is

package/src/crafts.js

@@ -0,0 +1,66 @@
+'use strict';
+// src/crafts.js — the craft vocabulary, in one place (task 1005141, BONGOS-V3 C1).
+//
+// The game conversion (docs/specs/bongos-v3-game-conversion.md, "Task outline / G1",
+// settled point 6) names the three characters a builder holds:
+//
+//   artisan — builds: code, infra, Bongos itself           (was 'engineer')
+//   artist  — how the project looks and reads, AND its ideas (was 'artist' + 'ideator')
+//   patron  — watches, proposes, and (with a seat) governs   (was the 'governing' craft mode)
+//
+// 'ui' stays a module-contributed discipline (ADR 0272); it is not a character.
+//
+// THE OLD SPELLINGS STILL ARRIVE. A rolled-back release, a co-tenant instance on an
+// older core (federated craft rollups), an old CLI, a bookmarked ?discipline=engineer
+// and a help request's historical 'builder' all still say the old word. Every input
+// boundary runs a value through normalizeCraft() so the old word lands as the new one;
+// nothing downstream should ever compare against 'engineer' or 'ideator' again. The
+// database keeps ACCEPTING the old words too (core_296's CHECKs are a superset) because
+// `bongos upgrade` rolls code back without rolling the database back — a contraction
+// that drops them is a later, separate migration.
+//
+// The crafts a TASK can carry are artisan and artist. Patron is a character, not a
+// kind of work: a task is built (artisan) or made/imagined (artist), and governing
+// work is a vote, not a task.
+//
+// ONLY THE TWO FUNCTIONS ARE EXPORTED. A list of the crafts, display labels and a
+// label helper were exported here once and nothing read them, which the dead-code
+// ratchet (knip) counts as a regression. Add one back when a caller needs it.
+
+// Old spelling → new spelling. 'builder' is the help-request spelling of the
+// engineering craft (ADR 0174); 'building'/'artistry'/'ideating'/'governing' are the
+// hall's old craft-mode ids (modules/hall-ui/public/craft-mode.js).
+const LEGACY = Object.freeze({
+  engineer: 'artisan',
+  engineering: 'artisan',
+  builder: 'artisan',
+  building: 'artisan',
+  ideator: 'artist',
+  ideating: 'artist',
+  artistry: 'artist',
+  governing: 'patron',
+  governor: 'patron',
+  ruler: 'patron',
+});
+
+// Any spelling → today's. Non-strings pass through untouched (callers validate);
+// an unknown word passes through too, so a module-contributed craft is never eaten.
+function normalizeCraft(value) {
+  if (typeof value !== 'string') return value;
+  const v = value.trim().toLowerCase();
+  return Object.prototype.hasOwnProperty.call(LEGACY, v) ? LEGACY[v] : v;
+}
+
+// A list of crafts → today's spellings, deduped in first-seen order. The fold matters:
+// ['artist', 'ideator'] is one craft now, not two.
+function normalizeCrafts(list) {
+  if (!Array.isArray(list)) return list;
+  const out = [];
+  for (const item of list) {
+    const c = normalizeCraft(item);
+    if (!out.includes(c)) out.push(c);
+  }
+  return out;
+}
+
+module.exports = { normalizeCraft, normalizeCrafts };

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.78'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.80'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -134,6 +134,11 @@ module.exports = {
   // sleep(ms) — the one server-side "wait N milliseconds" (a Promise over setTimeout).
   //     The browser twin is window.OTB.sleep; fitness fails on a third copy (task 1004893).
   sleep,
+  // crafts — the craft vocabulary (artisan · artist · patron, plus module 'ui') and
+  //     normalizeCraft/normalizeCrafts, which turn an old spelling ('artisan',
+  //     'artist', 'builder') into today's. Every craft read from outside goes through
+  //     it (task 1005141, src/crafts.js).
+  get crafts() { return require('./crafts'); },
 
   // --- auth & rank (ADR 0016) — the gates the loader composes around a module's
   //     routes; a module declares the rank it needs and never wires auth itself.

package/src/module-loader/manifest-schema.js

@@ -16,6 +16,9 @@
 //                                       //   what update, rollout channels and re-assessment name.
 //     "coreVersion":  "^1.0.0",         // REQUIRED. semver range of src/module-api.js CORE_VERSION it supports.
 //     "default":      false,            // OPTIONAL (default false). Enablement fail-safe when no config names it.
+//     "language":     "javascript",     // OPTIONAL (default "javascript", task 1004794). What the module's code is
+//                                       //   written in — one of MODULE_LANGUAGES. A closed list: only languages
+//                                       //   the core can actually run are on it.
 //     "author":       "…",              // OPTIONAL. Attribution (ADR 0107 §2) — portable, not a cross-GDS FK.
 //     "origin":       "…",              // OPTIONAL. Origin instance/project this module was built in.
 //     "license":      "…",              // OPTIONAL. e.g. "AGPL-3.0" — the license this module is offered under.
@@ -138,6 +141,14 @@ function isClaudeArtifactUrl(v) {
   return u.protocol === 'https:' && !u.username && !u.password && (host === 'claude.ai' || host.endsWith('.claude.ai'));
 }
 
+// The languages a module may declare (task 1004794). Closed on purpose: a value is on
+// this list only once the core can RUN a module written in it, so a manifest that says
+// "python" today fails loudly at validation instead of being loaded as JavaScript and
+// failing somewhere far from the cause. How a separate-program module runs beside
+// Bongos is decided in its own ADR (task 1004797); that work adds its languages here.
+const MODULE_LANGUAGES = Object.freeze(['javascript']);
+const DEFAULT_MODULE_LANGUAGE = 'javascript';
+
 const MAINTENANCE_STATUSES = ['core-maintained', 'maintained', 'deprecated', 'orphaned'];
 const MAINTENANCE_KEYS = ['status', 'since', 'removeAfter', 'successor', 'note'];
 // Statuses that describe a module on its way out — these owe a deprecation path.
@@ -213,6 +224,11 @@ function validateManifest(obj) {
   // --- optional default ---
   if ('default' in obj && typeof obj.default !== 'boolean') E('default: must be a boolean when present');
 
+  // --- optional language (task 1004794) — absent means "javascript" ---
+  if ('language' in obj && !MODULE_LANGUAGES.includes(obj.language)) {
+    E(`language: ${JSON.stringify(obj.language)} is not a supported module language (allowed: ${MODULE_LANGUAGES.join(', ')}; omit it for "${DEFAULT_MODULE_LANGUAGE}")`);
+  }
+
   // --- optional attribution (ADR 0107 §2 — portable credit, not a cross-GDS FK) ---
   for (const k of ATTRIBUTION_KEYS) {
     if (k in obj && !isStr(obj[k])) E(`${k}: must be a non-empty string when present`);

package/src/modules.js

@@ -86,7 +86,7 @@ const MODULE_REGISTRY = {};
 // shipping a pixel-art pipeline. Making it core aligns the one outlier list with
 // the DB CHECK and keeps the copyright exclusion untouched. Order mirrors the
 // migration 176 enum (engineer | artist | ideator | ui).
-const CORE_DISCIPLINES = ['engineer', 'artist', 'ideator'];
+const CORE_DISCIPLINES = ['artisan', 'artist'];
 
 const KNOWN_MODULES = Object.keys(MODULE_REGISTRY);
 
@@ -475,7 +475,7 @@ function isModuleEnabled(name, set = modules()) {
 const enabledModules = (set = modules()) => knownModules().filter((k) => set[k] === true);
 
 // Disciplines this instance offers = core + every enabled module's declared
-// disciplines, deduped, stable order. Vanilla = ['engineer','ideator'].
+// disciplines, deduped, stable order. Vanilla = ['artisan','artist'].
 function enabledDisciplines(set = modules()) {
   const reg = effectiveRegistry();
   const out = [...CORE_DISCIPLINES];

package/src/role-responsibilities.js

@@ -29,15 +29,16 @@
 'use strict';
 
 // discipline key (tasks.discipline / builders.preferred_disciplines) → the owner's
-// sentence. Keys mirror CORE_DISCIPLINES order (engineer | artist | ideator), the
-// migration 176 enum order. A module-contributed discipline (ui-design → 'ui') has
+// sentence. Keys mirror CORE_DISCIPLINES order (artisan | artist), the
+// core_296 order. A module-contributed discipline (ui-design → 'ui') has
 // no statement here on purpose: a craft a module brings is that module's to
 // describe, and inventing one for it would be exactly the paraphrase this file
 // forbids. Consumers must therefore treat "no statement" as normal, not as an error.
 const ROLE_RESPONSIBILITIES = Object.freeze({
-  engineer: 'Running and optimizing the running of Claude nonstop, and ensuring Ideators and Artists can continue to interface with that system effectively.',
-  artist: 'No slop in the appearance and text of the project; the story, emotion and ideology of the project are communicated effectively; project purpose and gravitas are upheld.',
-  ideator: 'Make good ideas; be a philosopher / thought leader for the project; enable Engineers to scope and Artists to create with maximum efficiency — a baseline for creating scopes of work.',
+  artisan: 'Running and optimizing the running of Claude nonstop, and ensuring Artists can continue to interface with that system effectively.',
+  // The artist holds both of the owner's sentences since the ideator folded in
+  // (task 1005141, BONGOS-V3): the craft names changed, the words did not.
+  artist: 'No slop in the appearance and text of the project; the story, emotion and ideology of the project are communicated effectively; project purpose and gravitas are upheld. Make good ideas; be a philosopher / thought leader for the project; enable Artisans to scope and Artists to create with maximum efficiency — a baseline for creating scopes of work.',
 });
 
 // Provenance, carried with the text so every rendering can say where it came from

package/tests/acclaim_feed_evidence_db.mjs

@@ -111,7 +111,7 @@ try {
   ]) {
     await q(
       `INSERT INTO tasks (id, version_id, title, status, shipped_by, shipped_at, discipline, kind)
-       VALUES ($1, $2, $3, 'shipped', $4, now(), 'engineer', 'feature')`,
+       VALUES ($1, $2, $3, 'shipped', $4, now(), 'artisan', 'feature')`,
       [id, VER, title, SHIPPER],
     );
   }

package/tests/activity_rollup_as_of.mjs

@@ -57,7 +57,7 @@ const pin = (rel, exports) => {
 await t('reportActivityRollup sends Bongos-Report-As-Of, stamped before the totals were read', async () => {
   const senderPool = mockPool((sql) => {
     if (/FROM builders WHERE id/.test(sql)) {
-      return { rows: [{ github_id: 42, total_credits: 7, karma: 1, rank: 'metic', preferred_disciplines: ['engineer'] }] };
+      return { rows: [{ github_id: 42, total_credits: 7, karma: 1, rank: 'metic', preferred_disciplines: ['artisan'] }] };
     }
     if (/count\(\*\)/.test(sql)) return { rows: [{ n: 3 }] };
     return { rows: [] };

package/tests/api_alias_caller_ratchet.mjs

@@ -89,7 +89,7 @@ test('the exclusions are real and each one is reachable', () => {
     'docs/architecture.md',
     'docs/canonical-permissions.md',
     'docs/recipes/parallel-goal-waves.md',
-    'docs/packs/engineer.md',
+    'docs/packs/artisan.md',
     'docs/onboarding/drachmae-and-karma.md',
   ]) {
     assert.equal(scan.isExcludedPath(p), false, `${p} must NOT be excluded`);
@@ -112,11 +112,11 @@ test('docs/ is SPLIT: the frozen record stays out, live instruction is now count
     'docs/governance/rank-map-2026-08-06.md': 'GET /api/gds/tasks\n',
     'docs/recipes/failed-ship-recovery-proof.md': 'POST /api/gds/claims/1/resolve\n',
     'docs/recipes/how-to-do-a-thing.md': 'node scripts/bongos/api.js GET /api/gds/tasks/1\n',
-    'docs/packs/engineer.md': 'create a task via POST /api/gds/tasks\n',
+    'docs/packs/artisan.md': 'create a task via POST /api/gds/tasks\n',
   }));
   assert.deepEqual(
     Object.keys(r.byFile).sort(),
-    ['docs/packs/engineer.md', 'docs/recipes/how-to-do-a-thing.md'],
+    ['docs/packs/artisan.md', 'docs/recipes/how-to-do-a-thing.md'],
     'only the instructional docs count — and they MUST count, or the narrowing did nothing',
   );
   assert.equal(r.total, 2);

package/tests/application_lifecycle.mjs

@@ -661,7 +661,7 @@ test('list-pending: the real vouch writer’s row resolves its profile and guild
 
 test('list-pending: a vouched TAKEOVER resolves the vouched applicant, not whoever filed first', async () => {
   reset();
-  hubViews['8001'] = { profile: { view: 'sliver', sliver: { disciplines: ['engineer'] } }, guild: null };
+  hubViews['8001'] = { profile: { view: 'sliver', sliver: { disciplines: ['artisan'] } }, guild: null };
   await applyAs('ada', { [VOUCH_HEADER]: vouchFor('ada', { githubId: 8001, handle: 'ada-h' }) });
   const r = await call('GET', '/api/gds/access-requests');
   const ada = r.json.requests.find((x) => x.github_login === 'ada');

package/tests/artist_review.mjs

@@ -214,7 +214,7 @@ test('the panel names a public page as site:<first path segment>, and its ideas
 
 test('the public button and the hall palette wear one name', () => {
   const craft = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/craft-mode.js'), 'utf8');
-  const tool = /id: 'palette', icon: 'artistry', short: '([^']+)', label: '([^']+)'/.exec(craft);
+  const tool = /id: 'palette', icon: '[^']+', short: '([^']+)', label: '([^']+)'/.exec(craft);
   assert.ok(tool, 'the palette tool');
   assert.ok(LOADER.includes("var SHORT = '" + tool[1] + "';"), 'the short name');
   assert.ok(LOADER.includes("var LABEL = '" + tool[2] + "';"), 'the full name');

package/tests/artist_review_goal.mjs

@@ -100,7 +100,7 @@ await test('createTask with artistReview lands in the goal; without one the catc
   await createTask({ versionId: 'BONGOS-V3', title: 'Tweak: Home (builders:home)', discipline: 'artist', artistReview: true }, { client: c });
   assert.equal(c.state.tasks[0].goal_id, 91, 'the studio task names the artist review goal');
   await assert.rejects(
-    () => createTask({ versionId: 'BONGOS-V3', title: 'plain', discipline: 'engineer' }, { client: fakeClient() }),
+    () => createTask({ versionId: 'BONGOS-V3', title: 'plain', discipline: 'artisan' }, { client: fakeClient() }),
     /goalId is required/, 'an ordinary goal-less create still throws');
 });
 

package/tests/autobongos_host.mjs

@@ -221,6 +221,21 @@ test('the supervisor runs under the runner\'s own config root, and keeps a gauge
   assert.equal(host.supervisorEnv({ AUTOBONGOS_GAUGE_FILE: '/set/by/hand' }, paths).AUTOBONGOS_GAUGE_FILE, '/set/by/hand');
 });
 
+test('AUTOBONGOS_HOME moves the runner\'s copy, logs and lock, and never the login', () => {
+  // The login must stay where the read-deny rule looks for it (task 1005186): a
+  // device someone customised is the last one that should fall outside the rule.
+  const home = path.join(tmp, 'fixed-login-home');
+  const standard = host.hostPaths({}, home);
+  const custom = host.hostPaths({ AUTOBONGOS_HOME: path.join(tmp, 'somewhere-else') }, home);
+  assert.equal(standard.configRoot, path.join(home, '.cloudbongos-runner', 'config'));
+  assert.equal(custom.configRoot, standard.configRoot, 'the same folder under the person\'s home, whatever the variable says');
+  assert.equal(custom.root, path.join(tmp, 'somewhere-else'));
+  assert.equal(custom.log, path.join(tmp, 'somewhere-else', 'logs', 'autobongos.log'));
+  assert.equal(custom.lock, path.join(tmp, 'somewhere-else', 'host.json'));
+  // And that is the folder the supervisor and its workers are pointed at.
+  assert.equal(host.supervisorEnv({ AUTOBONGOS_HOME: path.join(tmp, 'somewhere-else') }, custom).BONGOS_CONFIG_ROOT, standard.configRoot);
+});
+
 test('under BONGOS_CONFIG_ROOT every session path moves, and the builder\'s own session is not a fallback', () => {
   const root = fresh('cfgroot');
   const probe = `
@@ -636,7 +651,10 @@ test('the digest is read from the RUNNER’s run log: bare, the digest CLI looks
   assert.deepEqual(argv.slice(1), ['--all', '--json'], 'whatever the person passed is handed through');
 
   // Through the device program: the runner's night.
-  const viaHost = spawnSync(process.execPath, [HOST_JS, 'digest', '--all', '--json'], { encoding: 'utf8', env: { ...process.env, AUTOBONGOS_HOME: home, AUTOBONGOS_LOG_FILE: '' } });
+  // The login folder is always under the person's home (task 1005186), so the
+  // child is given this test's stand-in home: HOME on a Mac or Linux, USERPROFILE
+  // on Windows. Otherwise it would read the real one.
+  const viaHost = spawnSync(process.execPath, [HOST_JS, 'digest', '--all', '--json'], { encoding: 'utf8', env: { ...process.env, HOME: home, USERPROFILE: home, AUTOBONGOS_HOME: home, AUTOBONGOS_LOG_FILE: '' } });
   assert.equal(viaHost.status, 0, viaHost.stderr);
   assert.ok(viaHost.stdout.includes('424242'), 'the task the runner built is in it');
 

package/tests/blocker_hall_live_proof.mjs

@@ -183,7 +183,7 @@ async function seed() {
   // since core_247 (task 1002988); every real create path resolves one.
   await q(
     `INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline)
-     VALUES ($1,$2,'bhlp fixture task','ready',10,'feature','engineer')`,
+     VALUES ($1,$2,'bhlp fixture task','ready',10,'feature','artisan')`,
     [TASK, VER],
   );
 }