@bongos/core 1.24.79 → 1.24.81

package/scripts/bongos/worktree.js

@@ -291,9 +291,21 @@ function cmdAdd(root, argv) {
     }
   }
   console.log('');
-  console.log('Next:');
-  console.log(`  cd "${wtPath}"`);
-  console.log('  node scripts/bongos/claim.js <task-id>   (worktree auto-detected)');
+  for (const line of nextStepLines(wtPath)) console.log(line);
+}
+
+// task 1005185 - feedback bug scripts: the "Next:" hint names the claim command that
+// exists in the new tree. A project that installs the core from npm has no scripts/ of
+// its own — scripts is a git-ignored link into node_modules/@bongos/core, so a fresh
+// worktree has none and `node scripts/...` dies MODULE_NOT_FOUND. There the CLI is
+// `npx bongos <verb>` (npx walks up to the main checkout's node_modules). Same check
+// claim.js's finishHintLines uses (task 1005113).
+function nextStepLines(wtPath, { installed } = {}) {
+  if (installed === undefined) {
+    try { installed = require('./fitness-lib').isInstalledCore(); } catch { installed = false; }
+  }
+  const claim = installed ? 'npx bongos claim <task-id>' : 'node scripts/bongos/claim.js <task-id>';
+  return ['Next:', `  cd "${wtPath}"`, `  ${claim}   (worktree auto-detected)`];
 }
 
 function cmdRemove(root, argv) {
@@ -445,5 +457,5 @@ if (require.main === module) main();
 
 module.exports = {
   worktreeNameFor, needsJunction, removalPlan, nodeModulesState, shadowingNodeModules, huskDisposition,
-  unlinkNodeModulesLink,
+  unlinkNodeModulesLink, nextStepLines,
 };

package/scripts/hall-preview/README.md

@@ -135,15 +135,14 @@ overlay). A concept no table holds is not drawn: never add sample data for one.
 
 ## The evidence matrix (per page-redesign ship)
 
-Screenshot every changed page at **{light, dark} × {1280w, 390w}**, plus one
+Screenshot every changed page at **{1280w, 390w}** (the hall is dark only since task 1005192, ADR 0402), plus one
 instance-pack run (`--brand config/branding.json`) proving the theming contract
 survives. Run the harness with **`--fixture-me`** for these — the pinned snapshot
 is what makes two runs comparable. With the Playwright MCP (`npx playwright install chrome` once):
 
 1. `browser_navigate` → the page. `browser_console_messages` must show **0 errors**.
 2. 1280w: `browser_resize 1280×900` → `browser_take_screenshot` (fullPage for tall pages).
-3. dark: `browser_evaluate` `() => { localStorage.setItem('hall-theme','dark'); location.reload(); }` → screenshot. (Reset with `'light'`.)
-4. 390w: `browser_resize 390×844` → light + dark screenshots.
+3. 390w: `browser_resize 390×844` → screenshot.
 
 ## Seam assertions (copy-paste `browser_evaluate` snippets)
 

package/scripts/setup-builder.js

@@ -7,7 +7,7 @@
 // bootstrap a new builder runs right after cloning:
 //
 //   node scripts/setup-builder.js
-//   node scripts/setup-builder.js --skip-keys   # don't prompt for API keys
+//   node scripts/setup-builder.js --skip-keys   # accepted and ignored (no key is asked for)
 //   node scripts/setup-builder.js --no-auth      # skip the GDS Device Flow step
 //   node scripts/setup-builder.js --help
 //
@@ -15,8 +15,8 @@
 // "already done" rather than clobbering. What it does, in order:
 //   1. Verify Node >= 22 and Python >= 3.10 (the two required toolchains).
 //   2. `npm ci` to install JS dependencies.
-//   3. Copy .env.local.example -> .env.local (if absent) + optionally prompt
-//      for the Google AI Studio key (--skip-keys / non-TTY takes placeholders).
+//   3. Copy .env.local.example -> .env.local (if absent). No API key is asked
+//      for (task 1005189): a builder adds one in hall Settings when art needs it.
 //   4. `node scripts/bongos/setup.js` — GitHub Device Flow auth (--no-auth skips).
 //   5. Print the "ready" banner pointing at /builder-start.
 //
@@ -25,7 +25,6 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const readline = require('node:readline');
 const { spawnSync } = require('node:child_process');
 
 const REPO_ROOT = path.resolve(__dirname, '..');
@@ -33,17 +32,15 @@ const IS_WIN = process.platform === 'win32';
 
 // ---- arg parsing ----
 const argv = process.argv.slice(2);
-let SKIP_KEYS = false;
 let NO_AUTH = false;
 for (const a of argv) {
-  if (a === '--skip-keys') SKIP_KEYS = true;
+  if (a === '--skip-keys') { /* accepted for old callers; setup asks for no key (task 1005189) */ }
   else if (a === '--no-auth') NO_AUTH = true;
   else if (a === '-h' || a === '--help') {
     console.log(`setup-builder.js — one-command bootstrap for a new OTB builder.
 
 Usage:
   node scripts/setup-builder.js
-  node scripts/setup-builder.js --skip-keys     # don't prompt for API keys
   node scripts/setup-builder.js --no-auth       # skip the GDS Device Flow step
   node scripts/setup-builder.js --help
 
@@ -162,13 +159,6 @@ function npmCi() {
 // ---------------------------------------------------------------------------
 // 3. .env.local
 // ---------------------------------------------------------------------------
-function ask(question) {
-  return new Promise((resolve) => {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    rl.question(question, (answer) => { rl.close(); resolve(answer); });
-  });
-}
-
 async function envLocal() {
   step('3/5  Local environment (.env.local)');
   const example = path.join(REPO_ROOT, '.env.local.example');
@@ -186,37 +176,8 @@ async function envLocal() {
   fs.copyFileSync(example, target);
   ok('Created .env.local from .env.local.example');
 
-  // Prompt for the Google AI Studio key only with a TTY and without --skip-keys.
-  // An empty value is not fatal — the pipeline also resolves the key from
-  // ~/.config/otb/env, so it just means art-pipeline calls raise the standard
-  // "GOOGLE_AI_STUDIO_KEY not found" error until set.
-  if (SKIP_KEYS) {
-    skip('--skip-keys set; leaving GOOGLE_AI_STUDIO_KEY blank in .env.local');
-    skip('you can edit .env.local later, or set it in ~/.config/otb/env');
-    return;
-  }
-  if (!process.stdin.isTTY) {
-    skip('no TTY; leaving GOOGLE_AI_STUDIO_KEY blank in .env.local');
-    return;
-  }
-  console.log('');
-  console.log(`  ${C.dim}Google AI Studio key for the pixel-art pipeline.`);
-  console.log('  Get one at https://aistudio.google.com/app/apikey .');
-  console.log(`  Press Enter to skip — you can always edit .env.local later.${C.reset}`);
-  // Strip CR/LF so a pasted value with a stray newline can't inject extra
-  // lines into the builder's .env.local; trim handles surrounding whitespace.
-  const input = (await ask('  GOOGLE_AI_STUDIO_KEY: ')).replace(/[\r\n]+/g, '').trim();
-  if (input) {
-    const contents = fs.readFileSync(target, 'utf8');
-    // Function replacement (not a string): String.replace treats $&, $1, $$ etc.
-    // in a replacement STRING as special, which would silently corrupt a key
-    // containing a bare `$`. A function return value is spliced verbatim.
-    const next = contents.replace(/^GOOGLE_AI_STUDIO_KEY=.*$/m, () => `GOOGLE_AI_STUDIO_KEY=${input}`);
-    fs.writeFileSync(target, next);
-    ok('Saved GOOGLE_AI_STUDIO_KEY to .env.local');
-  } else {
-    skip('left GOOGLE_AI_STUDIO_KEY blank — edit .env.local when you have one');
-  }
+  // No key is asked for here (task 1005189): an optional key at sign-in is noise.
+  // The art pipeline says so itself, when art actually needs one.
 }
 
 // ---------------------------------------------------------------------------
@@ -234,7 +195,6 @@ function gdsAuth() {
   console.log('  Handing off to scripts/bongos/setup.js ...');
   console.log('');
   const setupArgs = [path.join(REPO_ROOT, 'scripts', 'bongos', 'setup.js')];
-  if (SKIP_KEYS) setupArgs.push('--skip-keys');
   const status = run(process.execPath, setupArgs); // shell defaults off
   if (status === 0) {
     ok('GDS session ready');

package/src/bongos/auth-admission.js

@@ -149,7 +149,7 @@ async function recentShipsForRollup(builderId) {
 // preference, exactly as before. A port that cannot be asked leaves its numbers
 // null ("could not ask"), never 0. Never throws: a failed read drops its craft's
 // numbers, not the report.
-const ROLLUP_CRAFTS = Object.freeze(['engineer', 'artist', 'ideator']);
+const ROLLUP_CRAFTS = Object.freeze(['artisan', 'artist']);
 const countOrNull = (v) => (Number.isInteger(v) && v >= 0 ? v : null);
 async function readCraftRollup(builderId, { shipped = 0, preferred = [] } = {}) {
   const fallback = { counts: null, disciplines: Array.isArray(preferred) ? preferred : [] };
@@ -172,20 +172,20 @@ async function readCraftRollup(builderId, { shipped = 0, preferred = [] } = {})
     };
     const [artist, ideator] = await Promise.all([
       earned.includes('artist') ? ask('copy-desk.artistStats') : null,
-      earned.includes('ideator') ? ask('ideas.ideatorStats') : null,
+      earned.includes('artist') ? ask('ideas.ideatorStats') : null,
     ]);
     const credits = (c) => countOrNull(Math.round(Number(byCraft[c])));
     const counts = {};
-    if (earned.includes('engineer')) counts.engineer = { shipped: countOrNull(shipped), credits: credits('engineer') };
+    if (earned.includes('artisan')) counts.artisan = { shipped: countOrNull(shipped), credits: credits('artisan') };
+    // One artist block since the ideator folded in (task 1005141): the page count
+    // and the idea counts side by side, under the craft's one credit split.
     if (earned.includes('artist')) {
-      counts.artist = { pages_approved: countOrNull(artist && artist.pages_approved), credits: credits('artist') };
-    }
-    if (earned.includes('ideator')) {
-      counts.ideator = {
+      counts.artist = {
+        pages_approved: countOrNull(artist && artist.pages_approved),
         filed: countOrNull(ideator && ideator.filed),
         full_ideas: countOrNull(ideator && ideator.full_ideas),
         ratified: countOrNull(ideator && ideator.ratified),
-        credits: credits('ideator'),
+        credits: credits('artist'),
       };
     }
     return { counts, disciplines: earned };

package/src/bongos/craft-mode.js

@@ -77,6 +77,8 @@ function roleLine(mode) {
 // so this adds no prompt-injection surface to the session.
 function describeCraftMode(discipline, modes) {
   if (!discipline || !modes) return null;
+  // A row a rolled-back release wrote may still say engineer/ideator (task 1005141).
+  discipline = require('../crafts').normalizeCraft(discipline);
   const mode = modes[discipline];
   if (!mode || typeof mode !== 'object' || !mode.directive) return null;
   const parts = [`${roleLine(mode)} (the craft of the task claimed in this worktree).`, String(mode.directive).trim()];

package/src/bongos/db.js

@@ -25,6 +25,7 @@
 // grade-count SQL runs on both sides of the kernel↔module line — keep in sync.
 
 const { pool } = require('./pool');
+const { normalizeCraft: normalizeCraftName } = require('../crafts'); // task 1005147: setBuilderCharacter
 const secretBox = require('./secret-box');
 // Module seam (ADR 0083). The builder-exit path EMITS `builder.secrets-scrub-needed`
 // AFTER COMMIT (best-effort) so a module that stores a builder-keyed secret can
@@ -172,7 +173,10 @@ const UPDATE_BUILDER_DISCIPLINES_SQL =
 async function updateBuilderDisciplines(builderId, disciplines, { mainDiscipline } = {}) {
   const { enabledDisciplines } = require('../modules');
   const offered = enabledDisciplines();
-  const list = Array.isArray(disciplines) ? disciplines : [];
+  // An old spelling (engineer, ideator) is today's craft, not an invalid one (task 1005141).
+  const { normalizeCraft, normalizeCrafts } = require('../crafts');
+  const list = Array.isArray(disciplines) ? normalizeCrafts(disciplines) : [];
+  if (typeof mainDiscipline === 'string') mainDiscipline = normalizeCraft(mainDiscipline);
   const bad = list.filter((d) => !offered.includes(d));
   if (bad.length) {
     const err = new Error(`invalid discipline(s): ${bad.join(', ')}`);
@@ -207,6 +211,38 @@ async function getBuilderRoleChoice(builderId) {
   return rows[0] ?? null;
 }
 
+// The character a builder holds (task 1005147, core_297): 'artisan' | 'artist' |
+// 'patron', or null while they have not picked one. Identity and view only — no
+// gate reads it (criterion character-is-identity-not-authority). Its own read, not a
+// column on getBuilderById, so the kernel's hot identity read never depends on a
+// migration that may not have run yet.
+const CHARACTERS = Object.freeze(['artisan', 'artist', 'patron']);
+async function getBuilderCharacter(builderId) {
+  const { rows } = await pool.query(
+    `SELECT game_character FROM builders WHERE id = $1`,
+    [builderId]
+  );
+  return rows[0] ? rows[0].game_character : null;
+}
+// Set (a CHARACTERS word, old spellings normalized) or clear (null) the builder's own
+// character. Throws { code: 'invalid_character' } for anything else.
+async function setBuilderCharacter(builderId, character) {
+  let value = null;
+  if (character !== null) {
+    value = normalizeCraftName(character);
+    if (!CHARACTERS.includes(value)) {
+      const err = new Error(`invalid character: ${character}`);
+      err.code = 'invalid_character';
+      throw err;
+    }
+  }
+  const { rows } = await pool.query(
+    `UPDATE builders SET game_character = $2 WHERE id = $1 RETURNING game_character`,
+    [builderId, value]
+  );
+  return rows[0] ? rows[0].game_character : null;
+}
+
 // The same two facts for a whole list of builders, in ONE statement (task
 // 1004437): the public leaderboard names every row's roles. Map<idString, row>.
 async function getBuilderRoleChoices(builderIds) {
@@ -1142,6 +1178,8 @@ module.exports = {
   UPDATE_BUILDER_DISCIPLINES_SQL,
   getBuilderRoleChoice,
   getBuilderRoleChoices,
+  getBuilderCharacter,
+  setBuilderCharacter,
   RANKS,
   setBuilderRank,
   setBuilderTester,

package/src/bongos/github-repos.js

@@ -378,7 +378,85 @@ async function deleteDeployKey(token, { owner, name, keyId, fetchImpl = fetch }
   throw new GithubApiError(`GitHub deploy-key delete failed (${res.status})`, { status: res.status, code: 'github_error' });
 }
 
+// ---- repo collaborators: inviting a person to the repo itself ----
+// A GitHub invite is a SEPARATE door from a Bongos invite. Bongos admission is a row
+// in the project's own database; this puts the person on the repo's collaborator list
+// so they can see (and, only when asked, push to) the code on their own GitHub.
+// ONE permission is offered: 'pull' (read). A builder ships through the server's own
+// publish and needs no write access, so Bongos never grants it (owner decision,
+// 2026-11-04): 'push', 'admin', 'maintain' and 'triage' are all refused. An owner who
+// wants someone to have write access gives it on GitHub directly.
+const REPO_INVITE_PERMISSIONS = Object.freeze(['pull']);
+
+function repoPath(owner, name) {
+  return `${GH_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}`;
+}
+
+// PUT /collaborators/{login}. 201 = a pending invitation was created, 204 = they
+// already have access. Returns { state: 'invited' | 'already_collaborator', ... }.
+async function inviteRepoCollaborator(token, { owner, name, login, permission = 'pull', fetchImpl = fetch } = {}) {
+  if (!REPO_INVITE_PERMISSIONS.includes(permission)) {
+    throw new GithubApiError('Only read-only access can be offered', { status: 400, code: 'bad_permission' });
+  }
+  const res = await fetchImpl(`${repoPath(owner, name)}/collaborators/${encodeURIComponent(login)}`, {
+    method: 'PUT',
+    headers: ghHeaders(token, { 'Content-Type': 'application/json' }),
+    body: JSON.stringify({ permission }),
+  });
+  if (res.status === 201) {
+    const inv = await res.json().catch(() => ({}));
+    return { state: 'invited', invitation_id: inv.id || null, permission };
+  }
+  if (res.status === 204) return { state: 'already_collaborator', permission };
+  if (res.status === 401) {
+    throw new GithubApiError('GitHub rejected the stored token', { status: 401, code: 'github_unauthorized' });
+  }
+  if (res.status === 403) {
+    throw new GithubApiError('GitHub refused — adding people needs repository admin', { status: 403, code: 'not_repo_admin' });
+  }
+  if (res.status === 404) {
+    throw new GithubApiError('GitHub answered 404 for that repository or user', { status: 404, code: 'repo_not_found' });
+  }
+  if (res.status === 422) {
+    throw new GithubApiError('GitHub would not invite that account', { status: 422, code: 'cannot_invite' });
+  }
+  throw new GithubApiError(`GitHub collaborator invite failed (${res.status})`, { status: res.status, code: 'github_error' });
+}
+
+// Where one person stands on the repo: 'collaborator' (accepted), 'pending' (the
+// invitation is out and not yet accepted), or 'none' (never invited, declined or
+// expired). Two reads: the collaborator check, then the open invitations.
+async function repoInviteState(token, { owner, name, login, fetchImpl = fetch } = {}) {
+  const who = encodeURIComponent(login);
+  const c = await fetchImpl(`${repoPath(owner, name)}/collaborators/${who}`, { headers: ghHeaders(token) });
+  if (c.status === 204) return { state: 'collaborator' };
+  if (c.status === 401) {
+    throw new GithubApiError('GitHub rejected the stored token', { status: 401, code: 'github_unauthorized' });
+  }
+  if (c.status === 403) {
+    throw new GithubApiError('GitHub refused — reading collaborators needs repository admin', { status: 403, code: 'not_repo_admin' });
+  }
+  if (c.status !== 404) {
+    throw new GithubApiError(`GitHub collaborator read failed (${c.status})`, { status: c.status, code: 'github_error' });
+  }
+  const i = await fetchImpl(`${repoPath(owner, name)}/invitations?per_page=${PER_PAGE}`, { headers: ghHeaders(token) });
+  if (i.status === 404) {
+    throw new GithubApiError('GitHub answered 404 for that repository', { status: 404, code: 'repo_not_found' });
+  }
+  if (!i.ok) {
+    throw new GithubApiError(`GitHub invitations read failed (${i.status})`, { status: i.status, code: 'github_error' });
+  }
+  const rows = await i.json();
+  const mine = (Array.isArray(rows) ? rows : []).find(
+    (r) => r && r.invitee && String(r.invitee.login || '').toLowerCase() === String(login).toLowerCase(),
+  );
+  return mine
+    ? { state: 'pending', invitation_id: mine.id, permission: mine.permissions || null }
+    : { state: 'none' };
+}
+
 module.exports = {
+  inviteRepoCollaborator, repoInviteState, REPO_INVITE_PERMISSIONS,
   listUserRepos, createUserRepo, getUserRepo, makeRepoPublic, makeRepoPrivate,
   listUserOrgs, getOrgAccess, createOrgRepo, validGithubLogin,
   listDeployKeys, addDeployKey, deleteDeployKey,

package/src/bongos/module-scope-map.js

@@ -366,6 +366,28 @@ const MODULE_GLOBS = {
   agents: [
     'modules/agents/', '.claude/agents/', 'scripts/bongos/agents-sync.js',
   ],
+  // --- the MODULE STORE (ADR 0338, task 1004793): publishing, listing, entitlements,
+  //     testing channel, promotion, usage reports, payouts and the assessment CLIs.
+  //     It is core code — it lives in src/bongos/, not modules/ — so it has no
+  //     module.json and this key is a scope like kernel or devsecops. Before this
+  //     key NO key resolved these files, so no goal could own a change to the store
+  //     (the 1002690 / 1002736 precedent). Its HTTP surface, src/bongos/routes/modules.js,
+  //     stays kernel's with the rest of routes/. module-scope-map.js is kernel's too:
+  //     the name prefix is shared, the job is not. ---
+  'module-store': [
+    'src/bongos/module-store.js', 'src/bongos/module-listing.js',
+    'src/bongos/module-entitlements.js', 'src/bongos/module-overrides.js',
+    'src/bongos/module-payouts.js', 'src/bongos/module-promotion.js',
+    'src/bongos/module-rechecks.js', 'src/bongos/module-subcategories.js',
+    'src/bongos/module-submissions.js', 'src/bongos/module-testing.js',
+    'src/bongos/module-usage-reports.js',
+    'scripts/bongos/module-store-cli.js', 'scripts/bongos/module-artifact.js',
+    'scripts/bongos/module-assess-docs.js', 'scripts/bongos/module-assess-installs.js',
+    'scripts/bongos/module-assess-score.js', 'scripts/bongos/module-assess-security.js',
+    'scripts/bongos/module-assess-tests.js', 'scripts/bongos/module-assess-version.js',
+    'scripts/bongos/module-error-report.js', 'scripts/bongos/module-remove.js',
+    'scripts/bongos/module-test-runner.js',
+  ],
   // --- the hub identity provider + the PROJECTS CATALOG it owns (ADR 0141): platform
   //     accounts, the SSO client registry, project memberships/invites, and the
   //     platform_identity_projects rows the Explore feed reads. Carved already, so the

package/src/bongos/role-stats.js

@@ -8,11 +8,11 @@
 // WHAT IT ANSWERS. For one builder: which of the three crafts they are shown in,
 // which one leads, and each craft's own headline numbers.
 //
-//   engineer  `shipped`, works shipped (unchanged from today), and engineering credits
+//   artisan   `shipped`, works shipped (unchanged from today), and building credits
 //   artist    pages approved, "N of M tweaked" per surface, credits from pages,
 //             this week (copy-desk's studio tally, the `copy-desk.artistStats`
 //             port)
-//   ideator   thoughts filed, ignited, Full Ideas, ratified by the board, total
+//             AND (task 1005141, the ideator craft folded in) thoughts filed, ignited, Full Ideas, ratified by the board, total
 //             size across every idea stream with the historical-estimate
 //             marker, and the share still alive (the sky's own reads, the
 //             `ideas.ideatorStats` port)
@@ -40,7 +40,7 @@
 
 const seams = require('../module-seams');
 
-const CRAFTS = Object.freeze(['engineer', 'artist', 'ideator']);
+const CRAFTS = Object.freeze(['artisan', 'artist']);
 // A discipline as a craft, asked of economy (reward.craftForPreference), the
 // module that decides which craft a credit belongs to. One table, so a builder's
 // chips and their credits cannot disagree (`ui`, the design discipline, is the
@@ -76,7 +76,7 @@ function resolveMainRole({ mainDiscipline = null, preferred = [], byCraft = null
   }
   const pref = preferredCrafts(preferred);
   if (pref.length) return { main: pref[0], basis: 'preferred' };
-  return { main: 'engineer', basis: 'default' };
+  return { main: 'artisan', basis: 'default' };
 }
 
 // shownCrafts — pure. Main first, then every craft with credits, in the
@@ -97,7 +97,7 @@ function composeRoleStats({ choice = null, byCraft = null, shippedCount = 0, art
   const { main, basis } = resolveMainRole({ mainDiscipline: choice && choice.main_discipline, preferred, byCraft });
   const shown = shownCrafts({ main, preferred, byCraft });
   const credits = byCraft
-    ? { engineer: byCraft.engineer, artist: byCraft.artist, ideator: byCraft.ideator, other: byCraft.other, total: byCraft.total }
+    ? { artisan: byCraft.artisan, artist: byCraft.artist, other: byCraft.other, total: byCraft.total }
     : null;
   return {
     main,
@@ -105,16 +105,32 @@ function composeRoleStats({ choice = null, byCraft = null, shippedCount = 0, art
     shown,
     preferred: preferredCrafts(preferred),
     credits_by_craft: credits,
-    engineer: shown.includes('engineer')
-      ? { shipped: Number(shippedCount) || 0, credits: credits ? credits.engineer : null }
+    artisan: shown.includes('artisan')
+      ? { shipped: Number(shippedCount) || 0, credits: credits ? credits.artisan : null }
       : null,
-    artist: shown.includes('artist') ? (artist || emptyArtist()) : null,
-    ideator: shown.includes('ideator') ? (ideator || emptyIdeator()) : null,
+    artist: shown.includes('artist') ? artistBlock(artist, ideator, credits) : null,
   };
 }
 
 // The shapes a shown craft takes when its port could not be asked: every number
 // null, so a renderer says "unknown", never "0".
+// The artist craft holds what the artist AND the old ideator craft did (task 1005141,
+// BONGOS-V3: ideation folds into the artist). One block, two sources: the page
+// numbers from copy-desk and the idea numbers from the sky. The two share no field
+// name but `unavailable` (true only when NEITHER could be asked) and `credits`,
+// which is the craft's ledger split when there is one, since that now carries
+// both the page and the idea credit streams (economy credits-by-craft.js).
+function artistBlock(artist, ideator, credits) {
+  const pages = artist || emptyArtist();
+  const ideas = ideator || emptyIdeator();
+  return {
+    ...ideas,
+    ...pages,
+    credits: credits ? credits.artist : pages.credits,
+    unavailable: Boolean(pages.unavailable && ideas.unavailable),
+  };
+}
+
 function emptyArtist() {
   return { pages_approved: null, pages: null, surfaces_touched: null, credits: null, this_week: null, surfaces: [], unavailable: true };
 }
@@ -141,7 +157,7 @@ async function readRoleStats(builderId, { shippedCount = 0, getRoleChoice } = {}
   const shown = shownCrafts({ main, preferred, byCraft });
 
   const artistPort = shown.includes('artist') ? seams.resolveOptional('copy-desk.artistStats') : null;
-  const ideatorPort = shown.includes('ideator') ? seams.resolveOptional('ideas.ideatorStats') : null;
+  const ideatorPort = shown.includes('artist') ? seams.resolveOptional('ideas.ideatorStats') : null;
   const [artist, ideator] = await Promise.all([
     typeof artistPort === 'function' ? artistPort(builderId) : null,
     typeof ideatorPort === 'function' ? ideatorPort(builderId) : null,
@@ -176,7 +192,7 @@ async function readRolesForBuilders(builderIds, { getRoleChoices } = {}) {
       main_basis: basis,
       shown: shownCrafts({ main, preferred, byCraft }),
       credits_by_craft: byCraft
-        ? { engineer: byCraft.engineer, artist: byCraft.artist, ideator: byCraft.ideator, other: byCraft.other, total: byCraft.total }
+        ? { artisan: byCraft.artisan, artist: byCraft.artist, other: byCraft.other, total: byCraft.total }
         : null,
     });
   }

package/src/bongos/routes/github.js

@@ -19,11 +19,12 @@ const express = require('express');
 const auth = require('../auth');
 const db = require('../db');
 const secretBox = require('../secret-box');
-const { listUserRepos, createUserRepo, listUserOrgs, getOrgAccess, createOrgRepo, validGithubLogin } = require('../github-repos');
+const { listUserRepos, createUserRepo, listUserOrgs, getOrgAccess, createOrgRepo, validGithubLogin, inviteRepoCollaborator, repoInviteState, REPO_INVITE_PERMISSIONS } = require('../github-repos');
 // Namespace require for the visibility helpers (task 1003045): the route tests
 // stub these on the cached module object, which a load-time destructure would
 // pin to the real implementations.
 const githubRepos = require('../github-repos');
+const repoInfo = require('../repo-info'); // namespace, so a test can stub loadRepoInfo
 const { validateOrRespond } = require('./_helpers');
 const prelaunch = require('../prelaunch-gate');
 const log = require('../logger').logger.child({ src: 'github' });
@@ -43,6 +44,28 @@ function orgNotFound(res, org) {
   return res.fail('org_not_found', { status: 404, message: `GitHub didn’t show your account an organisation called ${org}.` });
 }
 
+// The failures the two repo-invite routes share, each in the owner's words.
+async function repoInviteFailure(req, res, err, where) {
+  if (err && err.status === 401) {
+    await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});
+    return res.fail('repo_scope_required', { status: 403, message: 'Your GitHub authorization expired. Reconnect GitHub to invite people to the repository.' });
+  }
+  if (err && err.code === 'not_repo_admin') {
+    return res.fail('not_repo_admin', { status: 409, message: 'GitHub says your account can’t add people to this repository. Only its owner or an admin can: ask them, or sign in with that account.' });
+  }
+  if (err && err.code === 'repo_not_found') {
+    return res.fail('repo_not_found', { status: 404, message: 'GitHub didn’t show that repository or that username to your account. Check the spelling of the name and try again.' });
+  }
+  if (err && err.code === 'bad_permission') {
+    return res.fail('bad_permission', { status: 400, message: 'Only read-only access can be offered on the repository.' });
+  }
+  if (err && err.code === 'cannot_invite') {
+    return res.fail('cannot_invite', { status: 409, message: 'GitHub wouldn’t invite that account. It may already own the repository, or be unable to join. Check the name, or add them on GitHub yourself.' });
+  }
+  log.error(`[gds] ${where}`, err && err.message);
+  return res.fail('github_error', { status: 502, message: 'GitHub could not be reached. Try again in a moment.' });
+}
+
 // Parse + validate the owner/name ref, or send a 400 and return null.
 function parseRepoRef(raw, res) {
   const ref = String(raw || '').trim();
@@ -79,9 +102,84 @@ async function resolveRepoToken(req, res) {
   return row.token;
 }
 
-module.exports = function buildGithubRouter() {
+// The repo THIS project's code lives in, or a 409 and null. The invite routes below
+// never take a repo from the request: the owner invites people to the project's own
+// repo, so a typed name cannot point the owner's token at some other repository.
+function projectRepoRef(res) {
+  const info = repoInfo.loadRepoInfo();
+  if (!info || info.error) {
+    res.fail('no_project_repo', { status: 409, message: 'This project has no GitHub repository connected, so there is nothing to invite them to. Connect one on the project’s page on the hub, then try again.' });
+    return null;
+  }
+  return { owner: info.owner, name: info.repo };
+}
+
+// A typed GitHub name, with the leading @ allowed, or a 400 and null.
+function parseInviteLogin(raw, res) {
+  const login = String(raw || '').trim().replace(/^@/, '');
+  if (!validGithubLogin(login)) {
+    res.fail('bad_github_login', { status: 400, message: 'That does not look like a GitHub username.' });
+    return null;
+  }
+  return login;
+}
+
+// `deps` is the test seam for the two repo-invite helpers: they are imported directly
+// (so the dead-code check sees them used) and a test hands in stand-ins here, because a
+// destructured import cannot be stubbed on the module object the way the older
+// namespace-called helpers below are.
+module.exports = function buildGithubRouter(overrides = {}) {
+  const deps = { inviteRepoCollaborator, repoInviteState, ...overrides };
   const router = express.Router();
 
+  // rank: archon (permission access_request.review, the same gate as a hall invite) —
+  // invites a person to THIS project's GitHub repository, acting as the caller's OWN
+  // GitHub account (their stored repo token), never a platform credential. GitHub
+  // decides whether the caller may add people. The access is always READ-ONLY:
+  // write ('push') and above are refused, since a builder ships through the server.
+  // It grants no Bongos rank and does not admit anyone to the hall: those are the
+  // hall invite's own record.
+  router.post('/github/repo-invite', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
+    // No act-alone gate here, on purpose: that gate decides who may admit people to the
+    // hall (the hall invite carries it). This records a read-only share on GitHub, and
+    // GitHub itself only lets an account that administers the repo do it.
+    if (validateOrRespond(req, res, {
+      github_login: { required: true, type: 'string', maxLength: 60 },
+      permission: { type: 'string', enum: REPO_INVITE_PERMISSIONS },
+    })) return;
+    const login = parseInviteLogin(req.body.github_login, res);
+    if (!login) return;
+    const ref = projectRepoRef(res);
+    if (!ref) return;
+    const token = await resolveRepoToken(req, res);
+    if (!token) return;
+    try {
+      const out = await deps.inviteRepoCollaborator(token, { ...ref, login, permission: req.body.permission || 'pull' });
+      res.status(out.state === 'invited' ? 201 : 200).json({ ok: true, repo: `${ref.owner}/${ref.name}`, github_login: login, ...out });
+    } catch (err) {
+      return repoInviteFailure(req, res, err, 'POST /github/repo-invite');
+    }
+  });
+
+  // rank: archon (permission access_request.review) — where one person stands on the
+  // project's repo: collaborator, pending (invite sent, not yet accepted) or none.
+  router.get('/github/repo-invite', auth.requireBuilder, auth.requirePermission('access_request.review'), async (req, res) => {
+    // Strict, like the POST: a stray `repo=` (or anything else) is refused, never ignored.
+    if (validateOrRespond(req, res, {}, { query: { github_login: { required: true, type: 'string', maxLength: 60 } } })) return;
+    const login = parseInviteLogin(req.query.github_login, res);
+    if (!login) return;
+    const ref = projectRepoRef(res);
+    if (!ref) return;
+    const token = await resolveRepoToken(req, res);
+    if (!token) return;
+    try {
+      const out = await deps.repoInviteState(token, { ...ref, login });
+      res.json({ ok: true, repo: `${ref.owner}/${ref.name}`, github_login: login, ...out });
+    } catch (err) {
+      return repoInviteFailure(req, res, err, 'GET /github/repo-invite');
+    }
+  });
+
   // rank: any-builder — acts only on the caller's OWN GitHub identity (the token
   // they granted). No rank gate beyond being a signed-in builder.
   router.get('/github/repos', auth.requireBuilder, async (req, res) => {