@bongos/core 1.24.79 → 1.24.81

package/docs/adr/0402-helm-is-the-halls-look-and-the-hall-is-dark-only.md

@@ -0,0 +1,142 @@
+# 0402 — Helm is the hall's look, and the hall is dark only
+
+- **Status:** Accepted
+- **Date:** 2026-11-11
+- **Deciders:** the owner, 2026-11-11, on the Helm mock-ups: Helm applies to the game only, which is the hall (everything after sign-in); the hall wears Helm alone, with no light theme. Claude implemented.
+- **Task:** [task 1005192](https://cloudbongos.com/builders#/task/1005192) ("Helm look 1": the tier, the shared button, the start screen and the load screen)
+- **Supersedes in part:** [ADR 0204](0204-the-apex-is-dark-only.md) Decision 3 ("Light is the builders' hall's alone"): no surface of the platform offers a light mode any more. Its method stands and is reused here: pin the mode, leave the other tier's CSS in place until a follow-up removes it.
+- **Interacts with:** [ADR 0062 §3](0062-medusa-instance-model-decoupling.md) (the pack is still thirteen colours and two faces, spliced as a plain `:root`), [ADR 0196](0196-chrome-world-token-contract-and-the-landing-sheets.md) (the token contract), [ADR 0219](0219-a-look-is-a-branding-pack-the-style-library.md) and [ADR 0358](0358-a-hall-wears-a-look-and-its-night-takes-a-tint.md) (a hall that wears a look keeps its own faces and its tinted night), [ADR 0401](0401-one-options-menu-opens-every-settings-screen-in-a-frame.md) (the options menu, restyled by a later task).
+
+## Context
+
+The game conversion (goal 1000141) turned the hall into a place you enter: a start screen, a load screen, then a world. Its controls still wore the chrome world of the landing: a black void, Manrope in lowercase, pills. The owner picked a look for the game from a round of mock-ups and named it **Helm**: the inside of a visor at night. Two decisions came with the pick.
+
+1. **Helm is the game's, not the platform's.** The public landing, the projects hub and the status page keep the chrome world. Nothing in `config/branding.neutral.json`, `modules/public-landing`, `cosmos.css`, `world.css` or the status page changes.
+2. **The hall has one look and no light theme.** Day and night will show later in the city and the sky, as art, never in the controls.
+
+Three facts shaped how it was built.
+
+- **The pack is one face pair for every surface.** `themeMarkup()` splices `--font-display` and `--font-body` as a plain `:root` at the end of `<head>` on every page, so the landing and the hall always read the same face. Helm needs the hall to read Barlow while the landing keeps Manrope, without a sixteenth pack token and without taking a face away from an instance that chose its own.
+- **The status page links the hall's shared controls** (`controls.css`) without the hall's token tier. A change to the shared button reaches it unless the change is written so that it does not.
+- **A cut corner is a `clip-path`, and a clip-path clips outlines.** The hall's focus indicator is an outline inside a halo. On a cut control both disappear.
+
+## Decision
+
+### 1. The kit
+
+Helm is three small sets of rules. Each is recorded here once and lives as tokens in the hall's tier.
+
+**Type, two voices.**
+
+| Voice | Face | How it is set | What it is for |
+|---|---|---|---|
+| The name voice | Barlow Condensed, 500 (600 when lit) | wide tracked capitals, `.16em` to `.3em` | the name of a thing: a title, a button, an eyebrow |
+| The body voice | Barlow, 400 and 500 | plain sentences | everything said to you |
+
+The mono face stays JetBrains Mono, for where the hall quotes the machine.
+
+**Colour, one job each.**
+
+| Name | Value | Token | Its one job |
+|---|---|---|---|
+| Night | `#050d16` | `--bg`, `--bg-deep`, `--void`; lifted a step as `--bg-card` `#0a1622` and `--bg-frame` `#07111b`; at 72% over art as `--night-glass` | the ground and every panel |
+| Ice | `#c8f1f7` | `--ink-soft`; `--ink-faint` `#a9cdd4`; the hairlines `--rule` (ice at 40%) and `--rule-soft` (ice at 20%); the glass family (ice at 10%, 16%, 20%) | information you read |
+| White | `#ffffff` | `--ink` | names and numbers |
+| Moon | the pack's accent | `--accent`, with `--accent-on` as the dark ink on it | only what you can act on |
+| Dawn | none | none | the art. Never a control |
+
+The Moon is the existing accent and is never pinned (the Unpinned Accent Rule stands), so an instance with its own accent keeps it. The status vocabulary (`--ok`, `--warn`, `--danger`, `--info`) is unchanged, value for value, and still clears 4.5:1 on both night grounds (`tests/hall_tokens.mjs`).
+
+**Shape, three moves.**
+
+| Move | What it is | Where it lives |
+|---|---|---|
+| The cut corner | anything you can press: the top-left and bottom-right corners cut, 12px (8px at the row size), no pill | `--cut`, `--cut-sm`, `--cut-path`, `--cut-path-sm`; spent by `.btn` and its family in `controls.css` |
+| The segment | progress: one small bar per step, skewed 28 degrees | `--seg-w`, `--seg-h`, `--seg-gap`, `--seg-skew`; the shared rules `.segs` and `.seg` in `controls.css` |
+| The arc | the edge of the visor | not built in this task (task 1005195) |
+
+**One behaviour rule.** A control you may not use stays visible and says why. The city never hides what exists. No code in this task depends on it; it is recorded so the tasks that follow keep it.
+
+### 2. Where the values live
+
+All of it is in the token block of `modules/hall-ui/public/style.css`, which is the one place a literal may live.
+
+- The Helm **neutrals** are the hall's dark tier, written twice, byte-identical, as before (`html[data-theme="dark"]` and its `prefers-color-scheme` twin).
+- The kit's **recipes** (the name voice, the cut, the press fill and focus ring, the segment, the panel over art and its measures) sit in the bare `:root`, because none of them flips with a mode.
+- The **faces** are `--helm-display` and `--helm-body`. One rule, `html[data-faces="helm"]`, hands them to `--font-display` and `--font-body`. It is (0,1,1), so it outranks the pack's spliced `:root`.
+
+Nothing was added to the shared scale sheet (`modules/ui-design/public/tokens.css`): the landing and the status page load it, and they are out of scope.
+
+### 3. The hall is recognised at serve time, in one place
+
+`src/hall-helm.js` recognises a hall page by what makes it one: it links the hall's sheet (`/builders/style.css`). `injectBrandingGlobal` (the splice every served page already passes through, in the server, the preview harness and the design kit's stub) calls it. For a hall page it does two things; every other page comes back untouched.
+
+- It stamps `data-theme="dark"` on `<html>`. A fixed attribute selects the dark tier before first paint, with nothing to flash and nothing for the OS preference to reach.
+- For a hall whose pack still names the platform's default faces, it stamps `data-faces="helm"` and links the two Barlow families (`display=swap`; every hall page already preconnects to both font origins). A hall whose pack names faces of its own, in `config/branding.json` or through a look from the style library, is never stamped and keeps them.
+
+### 4. The hall is dark only
+
+- The light/dark switch is gone from the top bar (`shell.js`), from the governor city and from the street. `shell.js` sets `data-theme="dark"` again for a page read without the server's stamp. The `hall-theme` preference is never read or written.
+- Scripts that only read `html[data-theme]` (the sky, the atlas, Home's city, the approval queue) are unchanged and always read dark.
+- **The light tier stays for now**, as ADR 0204 left the apex's: the light values in the hall's `:root`, the light rules in page sheets and the tests that measure light pairs. Nothing in the hall renders them. Removing them is a follow-up.
+- Every hall `*.states.json` now declares `"modes": ["dark"]`, so the design kit renders each state once.
+
+### 5. The shared button takes the cut and the name voice, and the status page does not move
+
+Every Helm piece on `.btn` is a hall-tier token spent with a fallback, and the fallback is the look the sheet drew before: `clip-path: var(--cut-path, none)`, `border-radius: var(--press-radius, var(--radius-pill))`, `font-family: var(--name-face, var(--font-body))`, and so on. The status page defines none of those tokens, so its buttons are the pills they were.
+
+- **Focus.** A cut control hands the shell's `:focus-visible` rule an inset ring (`--press-focus`): 2px of the focus colour on the edge, then a 2px band of the ground inside it. One of the two reads on any fill: measured on the accent 8.93:1, on the ghost fill 7.20:1, on the danger fill 7.06:1.
+- **The ghost.** A cut removes the hairline at the two cut corners, so the ghost button takes a fill (`--press-fill`) and reads as a shape, not as a broken outline.
+- **The text button** is a link in a sentence: no cut, no capitals.
+- Fields, status pills, chips and the view toggle keep their shapes in this task.
+
+### 6. The start screen and the load screen
+
+Restyled to the mock-up with the tokens above; the sheet types in no colour, size, corner, shadow or breakpoint. Behaviour, keys, words and the welcome painting are unchanged.
+
+- **Start:** one full-height night panel (`--night-glass`) 400px wide, standing off the left edge on a desk and filling the width on a phone (`--helm-inset`, a `clamp`, so there is no breakpoint). The mark and the project's name in the name voice; Start as a full-width accent bar that names its key; the other choices as quiet rows on ice hairlines; one tip at the foot.
+- **Load:** the same panel, centred: the week in the name voice, one segment per week of the city's history, the city, the tip.
+
+## Measured
+
+Contrast, from the tier's own values (4.5:1 body, 3:1 large and non-text):
+
+| Pair | Ratio |
+|---|---|
+| White on Night / on the lifted Night | 19.52 / 18.25 |
+| Ice on Night / on the lifted Night | 16.16 / 15.10 |
+| Faint ice on Night / on the lifted Night | 11.50 / 10.75 |
+| The accent as text on Night / on the lifted Night | 8.93 / 8.35 |
+| `--accent-on` on the accent | 8.05 |
+| The strong hairline (ice at 40%) on Night | 3.34 |
+| Ice / White on the start panel over a pure white part of a painting | 6.67 / 8.05 |
+
+## Consequences
+
+- A builder whose OS prefers light, or who had chosen light in the hall, sees the dark hall.
+- Every hall page changes at once in its neutrals, its faces and its buttons, because they all spend the tier. Pages were not restyled one by one; a page with hand-drawn pills, 16px panels or lowercase labels keeps those until its own task.
+- The city and the street draw their night faces only, until day and night return as art.
+- The public design reference (`/brand`) reads the hall's tier, so its dark values now show the Helm neutrals. It was regenerated.
+
+## Known limits
+
+- **A hall that wears a look keeps its tinted night** (ADR 0358): the tint is laid over the dark tier after the sheet, so that hall's grounds are its accent mixed into black, with Helm's inks, hairlines and shapes on top. Rebasing the tint on the Night is a separate decision.
+- **"Has not chosen faces" is judged by the font stacks alone**: a pack whose two stacks equal the neutral pack's takes Helm. A custom look (one accent over the chrome world) therefore takes the Helm faces, which is intended; an instance that wants Manrope in its hall has to name a different stack.
+- **The sign-in screens** link the hall's sheet but are built outside this seam, and they are before sign-in. They are not pinned dark and keep the pack's faces. Under a dark OS they now show the Helm neutrals.
+- **The reading measure** (`--measure: 48ch`) was measured for Manrope. Barlow is narrower, so a line holds a few more characters. Not re-measured here.
+- **The diagonal of a cut has no hairline.** The edge is a clipped border, as in the mock-up.
+
+## Follow-ups
+
+- Remove the hall's light tier (the light values, the light-only rules, the light-pair tests).
+- The options menu and character select: task 1005194.
+- The visor, with the arc: task 1005195.
+- The city in the clouds and the day cycle: task 1005196.
+
+## Rejected
+
+- **A Helm branding pack** (a look in the style library). A pack reaches every surface, and the owner scoped Helm to the hall.
+- **Setting the Helm faces inside the dark tier.** It would outrank every instance's own faces for good.
+- **A pre-paint script, or the attribute typed into 33 pages.** One serve-time stamp covers every page and every page added later.
+- **Deleting the light tier in this task.** A second, larger diff under a look the owner has not yet reviewed on every page.
+- **A second button sheet for the status page.** One sheet with fallbacks keeps the hall and the status page on the same rules.

package/docs/adr/README.md

@@ -514,3 +514,7 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0395 | [**A task says what it needs, and each person's lists show only what they can do** ([task 1004950](https://cloudbongos.com/builders#/task/1004950)). `tasks.needs` ⊆ {owner, server} is its own set, not an `automation_tag` value (that one says whether work runs unattended). Capabilities are read fresh like rank: `owner` from the owner seat (founding builder fallback, the UAT reading), `server` from `builders.capability_grants`, set only by the owner. The recommend lists (claimable feed, optimizer, autonomous runner) show only tasks whose needs the viewer holds; the runner never holds owner. The claim refuses only `server` (`NEEDS_SERVER_ACCESS`, all three surfaces). Visibility elsewhere is unchanged; the board filters by need.](0395-a-task-says-what-it-needs-and-lists-show-only-what-you-can-do.md) | lifecycle / work tracking |
 | 0397 | [**The payment rail is Stripe Connect, one connected account per project; J.P. Morgan Payments is the fallback** ([task 1004906](https://cloudbongos.com/builders#/task/1004906), goal 1000092). The owner chose Stripe on 2026-10-30. Each project holds its money in its own connected account and each payee has one, so Cloud Bongos holds nothing (ADR 0385). Every flow in the ADR 0385 map is named against a Stripe primitive; a processor adapter module is the only place that names Stripe, so the fallback replaces one adapter. The processor is the party that monitors the money it holds. Test mode first; no live key is created, and counsel items 1 to 4 still gate real money.](0397-the-payment-rail-is-stripe-connect-with-one-connected-account-per-project.md) | economy / payments |
 | 0398 | [**Every hosted project takes its own update, and nobody asks for one** ([task 1005128](https://cloudbongos.com/builders#/task/1005128)). "Ask for this upgrade" is gone from every hall. A hosted hall with no upgrade address still names its hub door, by its own web address (`/deploy?host=`), which the hub resolves among the visitor's own projects; every core move writes the missing address into the project's settings. A self-hosted instance keeps the `bongos upgrade` instruction.](0398-every-hosted-project-takes-its-own-update-and-nobody-asks-for-one.md) | upgrades / hosting |
+| 0399 | [**The visor is glass over the scene, owns no camera, and spends Escape in a fixed order** ([task 1005146](https://cloudbongos.com/builders#/task/1005146), goal 1000142). The first-person HUD is one DOM overlay (`visor.js`, game mode only) over the sky, the Governor City and Home's city. It passes pointers through, never draws inside a scene and never changes the stage's size. It writes no camera: it calls the scene's own `fitAll`/`flyTo`, which the scene registers. Stacking: scene → ambient glass → the scene's pop-ups → the visor's open sheet → modals. One Escape closes one layer, top first: dialog, picker, palette, visor sheet (capture listener, `stopPropagation`), the scene's pop-up (bubble listener, `preventDefault`), then the options menu in game mode or the shell outside it. Found: the city card's Escape does not call `preventDefault`, so it also drops the bars.](0399-the-visor-is-glass-over-the-scene-and-owns-no-camera.md) | hall / game frame |
+| 0401 | [**One options menu opens every settings screen in a frame** ([task 1005144](https://cloudbongos.com/builders#/task/1005144), goal 1000141). `/settings` is the options menu: a search box over a grouped list. Settings' own panels stay native; My agents, Project settings, Modules, Permissions and Market Watch's settings and rules open inside it in an `<iframe>` of the old address with `?embed=1`, which `shell-game.js` reads only inside a frame to drop the page's chrome, send an unused Escape to the menu and open links to other pages in the whole window. A plain visit to an old address 302s to `/settings?open=<entry>` (the old #anchor rides along); the framed request keeps its own page gate and routes. In game mode the last Escape opens the menu and closes it again. Rejected: merging seven pages' scripts into one, a second /options page, links out of the menu.](0401-one-options-menu-opens-every-settings-screen-in-a-frame.md) | hall / game frame |
+| 0400 | [**A chain reserves work; each sub-quest is still claimed on its own** ([task 1005158](https://cloudbongos.com/builders#/task/1005158), spike V3G.R18, goal 1000144). C5 of the game conversion: work is claimed as a chain, not picked from a flat table. Owner ruling (interview answer 3): a chain RESERVES, tasks are still claimed one at a time. **Decision:** three new tables (`chains` inside one goal, `chain_tasks` with a task in at most one open chain, `chain_party`), none of them a claim — no `claims` row, no session binding, no worktree — so `gateOneActiveClaimPerSession` (ADR 0097) and its unique index never see a chain. **Order is derived, never stored** (ADR 0153's rejection holds): the topological order of `task_dependencies` over the chain's members, ties by priority/estimate/id — `sequence.js`'s `topoOrder`, moved into one shared module. Every sub-quest claims through the unchanged `POST /claims` ladder. **The one addition** is a narrowing-only `CHAIN_RESERVED` check placed AFTER the last existing rung on both insert sites + the dry run + the feed: an outsider can't claim a reserved chain's sub-quest, while every existing refusal keeps its code, message and precedence. Party size (raid quorum vs routine) is refused at the chain's own join door, never in the claim ladder; character counts seats and is never read by a claim rung. A reservation lapses after days with no claim or ship, reported before it acts (ADR 0226). Rejected: a chain as N claims, loosening the session guard, chain = goal, a stored order, an early-ladder check (would mask rank/deps refusals), a feed-only reservation.](0400-a-chain-reserves-work-and-each-sub-quest-is-still-claimed-alone.md) | lifecycle / claims / game conversion |
+| 0402 | [**Helm is the hall's look, and the hall is dark only** ([task 1005192](https://cloudbongos.com/builders#/task/1005192)). The game (the hall, everything after sign-in) wears Helm; the landing, the hub and the status page keep the chrome world. The kit: two voices (Barlow Condensed in wide capitals names a thing, Barlow says everything else), four colours with one job each (Night the ground, Ice what you read, White names and numbers, the accent only what you can act on), three shapes (the cut corner for anything pressable, the segment for progress, the arc for the visor). The values live in the hall's token block; `src/hall-helm.js` recognises a hall page by the sheet it links, pins it dark and hands it the Helm faces unless its pack chose its own. The light/dark switch is gone; the light tier stays until its own removal. The shared button spends every Helm token with the old pill as the fallback, so the status page does not move.](0402-helm-is-the-halls-look-and-the-hall-is-dark-only.md) | design system / hall |

package/docs/api/openapi.json

@@ -7615,6 +7615,37 @@
         ]
       }
     },
+    "/founding/skip": {
+      "post": {
+        "operationId": "post_founding_skip",
+        "tags": [
+          "founding"
+        ],
+        "summary": "POST /founding/skip",
+        "description": "Skip genesis: the owner opens the full hall from any stage, no sitting, no gate.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/onboarding/routes/onboarding.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/founding/stages/{stage}/close": {
       "post": {
         "operationId": "post_founding_stages_stage_close",
@@ -7812,6 +7843,83 @@
         ]
       }
     },
+    "/github/repo-invite": {
+      "get": {
+        "operationId": "get_github_repo_invite",
+        "tags": [
+          "github"
+        ],
+        "summary": "GET /github/repo-invite",
+        "description": "(permission access_request.review) — where one person stands on the project's repo: collaborator, pending (invite sent, not yet accepted) or none.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `access_request.review` (all required).",
+        "x-rank": "archon",
+        "x-source": "src/bongos/routes/github.js",
+        "x-permissions": [
+          "access_request.review"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "post": {
+        "operationId": "post_github_repo_invite",
+        "tags": [
+          "github"
+        ],
+        "summary": "POST /github/repo-invite",
+        "description": "(permission access_request.review, the same gate as a hall invite) — invites a person to THIS project's GitHub repository, acting as the caller's OWN GitHub account (their stored repo token), never a platform credential. GitHub decides whether the caller may add people. The access is always READ-ONLY: write ('push') and above are refused, since a builder ships through the server. It grants no Bongos rank and does not admit anyone to the hall: those are the hall invite's own record.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `access_request.review` (all required).",
+        "x-rank": "archon",
+        "x-source": "src/bongos/routes/github.js",
+        "x-permissions": [
+          "access_request.review"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostGithubRepoInviteRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/github/repo/visibility": {
       "post": {
         "operationId": "post_github_repo_visibility",
@@ -15422,6 +15530,55 @@
         ]
       }
     },
+    "/me/character": {
+      "put": {
+        "operationId": "put_me_character",
+        "tags": [
+          "me"
+        ],
+        "summary": "PUT /me/character",
+        "description": "task 1005147 (BONGOS-V3 G2): character creation. Body: { character } — 'artisan' | 'artist' | 'patron', or null to clear it (the hall clears it and signs out: switching character is signing out and back in, spec settled point 2). Identity and view only: no claim, vote, deploy or spend gate reads it (criterion character-is-identity-not-authority). 422 invalid_character otherwise. rank: any-builder — a builder writes only their own row (req.builder.id), the /me/disciplines posture.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/me.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PutMeCharacterRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PutMeCharacterResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me/checkout-freshness": {
       "patch": {
         "operationId": "patch_me_checkout_freshness",
@@ -37483,6 +37640,22 @@
         },
         "additionalProperties": false
       },
+      "PostGithubRepoInviteRequest": {
+        "type": "object",
+        "properties": {
+          "github_login": {
+            "type": "string",
+            "maxLength": 60
+          },
+          "permission": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "github_login"
+        ],
+        "additionalProperties": false
+      },
       "PostGithubRepoVisibilityRequest": {
         "type": "object",
         "properties": {
@@ -42942,6 +43115,25 @@
         ],
         "additionalProperties": false
       },
+      "PutMeCharacterRequest": {
+        "type": "object",
+        "properties": {
+          "character": {
+            "type": "string",
+            "maxLength": 32
+          }
+        },
+        "additionalProperties": false
+      },
+      "PutMeCharacterResponse": {
+        "type": "object",
+        "properties": {
+          "character": {}
+        },
+        "required": [
+          "character"
+        ]
+      },
       "PutMingleOptInRequest": {
         "type": "object",
         "properties": {
@@ -43265,9 +43457,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 690,
-  "x-schema-count": 726,
+  "x-endpoint-count": 694,
+  "x-schema-count": 729,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 461,
+  "x-response-schemas": 462,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 690 endpoints across 117 route files.
+> **Generated from the live route files** — the route file is authoritative. 694 endpoints across 117 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -313,7 +313,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/feedback/receipt` | `any-builder` | `sha256`, `kind` | signed-in builder — a receipt only says "this builder sent this text"; it grants nothing here, and the hub files every report behind a nod. |
 | GET | `/api/bongos/feedback/receipt/:id` | `public` | — | the hub redeems a receipt with no session of its own. |
 
-## `founding` (6)
+## `founding` (7)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -321,16 +321,19 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/founding/builders` | `any-builder` | — | The founding mark (task 1004424): who joined while the project was founding, in join order, with the stage each joined at. |
 | GET | `/api/bongos/founding/genesis` | `any-builder` | — | A project born through the startup flow enters genesis on its first founding read (founding-birth.js, task 1004506) — here and on GET /me… |
 | POST | `/api/bongos/founding/plan` | `any-builder` | `days`, `passes`, `advisors`, `government`, `expected_builders`, `existing` | The plan's ranges and vocabularies are genesis-home.js parsePlan's (one source); this schema only names the fields so an unknown one is r… |
+| POST | `/api/bongos/founding/skip` | `any-builder` | — | Skip genesis: the owner opens the full hall from any stage, no sitting, no gate. |
 | POST | `/api/bongos/founding/stages/:stage/close` | `any-builder` | — | task 1005121: one call. |
 | POST | `/api/bongos/founding/start` | `any-builder` | — |  |
 
-## `github` (6)
+## `github` (8)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/github/orgs` | `any-builder` | — | the caller's OWN GitHub organisations (task 1004651), for the project page's "on an organisation" choice. |
 | GET | `/api/bongos/github/orgs/:org` | `any-builder` | — | checks ONE organisation name the caller typed, as their own GitHub credential sees it (task 1004651). |
 | GET | `/api/bongos/github/repo` | `any-builder` | — | reads one repo AS the caller's own GitHub credential sees it (the manage page's repo-visibility read, task 1003045). |
+| GET | `/api/bongos/github/repo-invite` | `archon` | — | (permission access_request.review) — where one person stands on the project's repo: collaborator, pending (invite sent, not yet accepted)… |
+| POST | `/api/bongos/github/repo-invite` | `archon` | `github_login`, `permission` | (permission access_request.review, the same gate as a hall invite) — invites a person to THIS project's GitHub repository, acting as the … |
 | POST | `/api/bongos/github/repo/visibility` | `any-builder` | `repo`, `visibility` | flips one of the caller's repos PUBLIC, with their own credential. |
 | GET | `/api/bongos/github/repos` | `any-builder` | — | acts only on the caller's OWN GitHub identity (the token they granted). |
 | POST | `/api/bongos/github/repos` | `any-builder` | `name`, `org` | creates a repo in the caller's OWN account, or (task 1004651) under an organisation they name in `org`. |
@@ -564,7 +567,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | PUT | `/api/bongos/market-watch/settings/key` | `metic+archon` | `key` |  |
 | DELETE | `/api/bongos/market-watch/settings/key` | `metic+archon` | — |  |
 
-## `me` (60)
+## `me` (61)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -575,6 +578,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/me/cash-outs` | `any-builder` | `amount_cents`, `instruction_id` | POST /api/bongos/me/cash-outs — ask to take amount_cents of my balance to my bank. |
 | POST | `/api/bongos/me/cash-outs/:id/cancel` | `any-builder` | — | POST /api/bongos/me/cash-outs/:id/cancel — withdraw one of my requests that has not been sent. |
 | POST | `/api/bongos/me/cash-outs/:id/retry` | `any-builder` | — | POST /api/bongos/me/cash-outs/:id/retry — try one of my unfinished withdrawals again. |
+| PUT | `/api/bongos/me/character` | `any-builder` | `character` | task 1005147 (BONGOS-V3 G2): character creation. |
 | PATCH | `/api/bongos/me/checkout-freshness` | `any-builder` | `behind`, `branch`, `reason` | How far behind this builder's local project folder is (task 1005021, checkout-freshness.js). |
 | PATCH | `/api/bongos/me/core-move-seen` | `any-builder` | `id` | The core move this builder has been told about (task 1004731, core-move-seen.js): closing the hall's "Upgraded to core X" notice stores t… |
 | GET | `/api/bongos/me/credits` | `any-builder` | — | GET /me/credits — the caller's own ledger. |

package/docs/architecture.md

@@ -163,11 +163,15 @@ tasks  + kind text NOT NULL DEFAULT 'unclassified'  CHECK IN (feature|bug|infra|
                                               -- claim and is deliberately not counted (task 1003964)
        + scoping_confidence integer  CHECK (1..5)
        + discipline text NOT NULL DEFAULT 'unclassified' (mig 014; renamed mig 086)
-                                              CHECK IN (engineer|artist|ideator|unclassified)
+                                              CHECK IN (artisan|artist|ui|engineer|ideator)
+                                              -- (core_296, task 1005141: engineer/ideator still
+                                              -- accepted for rollback, read as artisan/artist;
+                                              -- unclassified dropped by core_247)
                                               -- orthogonal to kind; classifies builder
-                                              -- interest area (engineer = code/infra/mechanics/bugs,
+                                              -- interest area (artisan = code/infra/mechanics/bugs,
                                               -- artist = pixel art/sprites/pipeline,
-                                              -- ideator = scoping/research/docs/narrative/lore)
+                                              -- ideas = scoping/research/docs/narrative/lore,
+                                              -- the artist's since the ideator folded in)
 claims + head_sha text                              -- captured at claim time for incidental-work scanner
 builders + timezone text NOT NULL DEFAULT 'America/New_York'