@bongos/core 1.17.0 → 1.17.1

package/tests/module_cli.mjs

@@ -268,6 +268,126 @@ test('cmdCheck: usage error (exit 2) when no key is given', () => {
   assert.equal(code, 2);
 });
 
+// ---------------------------------------------------------------------------
+// packageModuleForSubmission / readSignOff — the fs half of `module submit`
+// ---------------------------------------------------------------------------
+
+test('readSignOff: null when never signed off; the recorded record once it is', () => {
+  const root = tmpModulesRoot();
+  mod.scaffoldModule({ key: 'widget', modulesDir: root, core: '1.0.0' });
+  assert.equal(mod.readSignOff('widget', { modulesDir: root }), null);
+  mod.recordSignOff('widget', 'Ada Lovelace <ada@example.com>', { modulesDir: root });
+  const signOff = mod.readSignOff('widget', { modulesDir: root });
+  assert.equal(signOff.signOff.signedBy, 'Ada Lovelace <ada@example.com>');
+});
+
+test('packageModuleForSubmission: snapshots the manifest + every file (base64) + the sign-off', () => {
+  const root = tmpModulesRoot();
+  mod.scaffoldModule({ key: 'widget', modulesDir: root, core: '1.0.0' });
+  mod.recordSignOff('widget', 'Ada Lovelace <ada@example.com>', { modulesDir: root });
+
+  const pkg = mod.packageModuleForSubmission('widget', { modulesDir: root });
+  assert.equal(pkg.key, 'widget');
+  assert.equal(pkg.manifest.key, 'widget');
+  assert.equal(pkg.signOff.signOff.signedBy, 'Ada Lovelace <ada@example.com>');
+  assert.ok(pkg.totalBytes > 0);
+
+  const paths = pkg.files.map((f) => f.path).sort();
+  assert.deepEqual(paths, [...paths].sort(), 'files are sorted by path');
+  assert.ok(paths.includes('module.json'));
+  assert.ok(paths.includes('routes/widget.js'));
+  // the sign-off file itself travels in the snapshot too — it's part of the module tree
+  assert.ok(paths.includes('.upstream-signoff.json'));
+
+  const manifestFile = pkg.files.find((f) => f.path === 'module.json');
+  const roundTripped = JSON.parse(Buffer.from(manifestFile.contentBase64, 'base64').toString('utf8'));
+  assert.deepEqual(roundTripped, pkg.manifest);
+  assert.equal(manifestFile.bytes, Buffer.byteLength(JSON.stringify(pkg.manifest, null, 2) + '\n'));
+});
+
+// ---------------------------------------------------------------------------
+// bongos module submit <key> — ADR 0107 §1 (network call is always injected —
+// never hits cli-lib.js / the real API in a unit test)
+// ---------------------------------------------------------------------------
+
+test('cmdSubmit: refuses (exit 1) when the pre-check fails, without ever attempting the network call', async () => {
+  const lines = [];
+  const sink = { log: (s) => lines.push(String(s)), errlog: (s) => lines.push(String(s)) };
+  let submitCalled = false;
+  const check = () => ({ key: 'game', ok: false, findings: [{ kind: 'content', detail: 'contains denied content' }], files: [], denied: [] });
+  const submit = async () => { submitCalled = true; return { ok: true, status: 201, data: { submission: { id: 1, status: 'pending' } } }; };
+
+  const code = await mod.cmdSubmit(['game'], { ...sink, check, submit });
+  assert.equal(code, 1);
+  assert.equal(submitCalled, false, 'a failing pre-check must never reach the network');
+  assert.ok(lines.some((l) => /REFUSING/.test(l)));
+});
+
+test('cmdSubmit: refuses (exit 1) when the pre-check passes but no sign-off is on file and none was given', async () => {
+  const lines = [];
+  const sink = { log: (s) => lines.push(String(s)), errlog: (s) => lines.push(String(s)) };
+  let submitCalled = false;
+  const check = () => ({ key: 'widget', ok: true, findings: [], files: [], denied: [] });
+  const readSign = () => null;
+  const submit = async () => { submitCalled = true; return { ok: true, status: 201, data: {} }; };
+
+  const code = await mod.cmdSubmit(['widget'], { ...sink, check, readSign, submit });
+  assert.equal(code, 1);
+  assert.equal(submitCalled, false);
+  assert.ok(lines.some((l) => /REFUSING/.test(l) && /sign-off/.test(l)));
+});
+
+test('cmdSubmit: --sign-off records a NEW sign-off when none is on file, then submits', async () => {
+  const lines = [];
+  const sink = { log: (s) => lines.push(String(s)), errlog: (s) => lines.push(String(s)) };
+  const check = () => ({ key: 'widget', ok: true, findings: [], files: [], denied: [] });
+  let signedCall = null;
+  const recorded = { signOff: { signedBy: 'Ada Lovelace <ada@example.com>', date: '2026-07-08T00:00:00.000Z' }, path: 'modules/widget/.upstream-signoff.json' };
+  const sign = (key, by) => { signedCall = { key, by }; return recorded; };
+  let readSignCalls = 0;
+  const readSign = () => { readSignCalls += 1; return readSignCalls === 1 ? null : recorded; };
+  let submitArgs = null;
+  const submit = async (key, body) => { submitArgs = { key, body }; return { ok: true, status: 201, data: { submission: { id: 7, status: 'pending' } } }; };
+
+  const code = await mod.cmdSubmit(['widget', '--sign-off', 'Ada Lovelace <ada@example.com>'], { ...sink, check, sign, readSign, submit });
+  assert.equal(code, 0);
+  assert.deepEqual(signedCall, { key: 'widget', by: 'Ada Lovelace <ada@example.com>' });
+  assert.deepEqual(submitArgs, { key: 'widget', body: { signed_by: 'Ada Lovelace <ada@example.com>' } });
+  assert.ok(lines.some((l) => /Filed — submission id 7/.test(l)));
+});
+
+test('cmdSubmit: an existing sign-off on file is reused — --sign-off is not required again', async () => {
+  const lines = [];
+  const sink = { log: (s) => lines.push(String(s)), errlog: (s) => lines.push(String(s)) };
+  const check = () => ({ key: 'widget', ok: true, findings: [], files: [], denied: [] });
+  let signCalled = false;
+  const sign = () => { signCalled = true; };
+  const readSign = () => ({ signOff: { signedBy: 'Ada Lovelace <ada@example.com>', date: 'now' } });
+  const submit = async () => ({ ok: true, status: 201, data: { submission: { id: 9, status: 'pending' } } });
+
+  const code = await mod.cmdSubmit(['widget'], { ...sink, check, sign, readSign, submit });
+  assert.equal(code, 0);
+  assert.equal(signCalled, false, 'an existing sign-off is never re-recorded');
+});
+
+test('cmdSubmit: surfaces a rejected submission (e.g. the server-side pre-check disagrees) as exit 1', async () => {
+  const lines = [];
+  const sink = { log: (s) => lines.push(String(s)), errlog: (s) => lines.push(String(s)) };
+  const check = () => ({ key: 'widget', ok: true, findings: [], files: [], denied: [] });
+  const readSign = () => ({ signOff: { signedBy: 'Ada Lovelace <ada@example.com>', date: 'now' } });
+  const submit = async () => ({ ok: false, status: 422, data: { error: 'precheck_failed', message: 'server disagrees' } });
+
+  const code = await mod.cmdSubmit(['widget'], { ...sink, check, readSign, submit });
+  assert.equal(code, 1);
+  assert.ok(lines.some((l) => /REFUSING/.test(l) && /server disagrees/.test(l)));
+});
+
+test('cmdSubmit: usage error (exit 2) when no key is given', async () => {
+  const lines = [];
+  const code = await mod.cmdSubmit([], { log: (s) => lines.push(s), errlog: (s) => lines.push(s) });
+  assert.equal(code, 2);
+});
+
 // ---------------------------------------------------------------------------
 // dispatch wiring (bin/bongos.js)
 // ---------------------------------------------------------------------------
@@ -283,10 +403,18 @@ test('the `module` verb dispatches to module.js, `upgrade` to upgrade.js', () =>
   assert.ok(h.includes('upgrade'));
 });
 
-test('`bongos module check` is documented in help / dispatches to module.js check subcommand', () => {
+test('`bongos module check` is documented in help / dispatches to module.js check subcommand', async () => {
   const lines = [];
   mod.printHelp((s) => lines.push(s));
   assert.ok(lines.some((l) => /module check/.test(l)));
   // module.js itself dispatches the "check" subcommand (bongos.js forwards args[1:] verbatim to module.js)
-  assert.equal(mod.main(['node', 'module.js', 'check']), 2, 'no key => usage error');
+  // main() is async (bongos module submit makes a network call) — every subcommand's exit code resolves via the same Promise.
+  assert.equal(await mod.main(['node', 'module.js', 'check']), 2, 'no key => usage error');
+});
+
+test('`bongos module submit` is documented in help / dispatches to module.js submit subcommand', async () => {
+  const lines = [];
+  mod.printHelp((s) => lines.push(s));
+  assert.ok(lines.some((l) => /module submit/.test(l)));
+  assert.equal(await mod.main(['node', 'module.js', 'submit']), 2, 'no key => usage error');
 });

package/tests/module_submissions.mjs

@@ -0,0 +1,135 @@
+// tests/module_submissions.mjs
+//
+// Unit smoke for the ADR 0107 §1 upstreaming review queue (task 1770,
+// migration core_191_module_submissions). Proves, with NO live Postgres:
+//
+//   DB helpers (against a stubbed pool seam):
+//     - createModuleSubmission() INSERTs, jsonb-casting + JSON.stringify'ing
+//       manifest/files/sign_off, parameterized
+//     - listModuleSubmissions() SELECTs metadata only (no `files` — the file
+//       snapshot can run to hundreds of KB and no list consumer needs it),
+//       newest-first, optionally filtered by status and/or module_key
+//
+// We stub the pool by pre-seeding the require cache for src/bongos/pool.js
+// BEFORE requiring src/bongos/module-submissions.js — the same monkeypatch
+// seam tests/security_docs.mjs uses.
+//
+// Run:  node tests/module_submissions.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(__dirname, '..');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  return Promise.resolve()
+    .then(fn)
+    .then(() => { passed++; console.log(`  ok  ${name}`); })
+    .catch((e) => { failed++; console.error(`  FAIL ${name}\n        ${e.message}`); });
+}
+
+const calls = [];
+let nextRows = [];
+const fakePool = {
+  query: async (text, params) => {
+    calls.push({ text, params });
+    return { rows: nextRows };
+  },
+};
+const poolPath = require.resolve(path.join(ROOT, 'src', 'bongos', 'pool.js'));
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: fakePool, instanceDbName: () => undefined } };
+
+const moduleSubmissions = require(path.join(ROOT, 'src', 'bongos', 'module-submissions.js'));
+
+function lastCall() { return calls[calls.length - 1]; }
+
+console.log('module_submissions — DB helpers (stubbed pool):');
+
+await test('createModuleSubmission() INSERTs, jsonb-casts manifest/files/sign_off, parameterized', async () => {
+  calls.length = 0;
+  const manifest = { key: 'widget', title: 'Widget', license: 'AGPL-3.0' };
+  const files = [{ path: 'module.json', contentBase64: 'e30=', bytes: 2 }];
+  const signOff = { module: 'widget', signOff: { signedBy: 'Ada Lovelace <ada@example.com>', date: '2026-07-08T00:00:00.000Z' } };
+  const precheckPassedAt = new Date('2026-07-08T00:00:00.000Z');
+  nextRows = [{
+    id: 1, module_key: 'widget', submitted_by: 42, manifest, sign_off: signOff,
+    precheck_passed_at: precheckPassedAt, source_repo: 'lars589/amazonprimea',
+    status: 'pending', reviewed_by: null, reviewed_at: null, review_notes: null,
+    submitted_at: '2026-07-08T00:00:01.000Z',
+  }];
+
+  const row = await moduleSubmissions.createModuleSubmission({
+    moduleKey: 'widget', submittedBy: 42, manifest, files, signOff, precheckPassedAt,
+    sourceRepo: 'lars589/amazonprimea',
+  });
+
+  const { text, params } = lastCall();
+  assert.ok(/INSERT INTO module_submissions/i.test(text));
+  assert.ok(/RETURNING/i.test(text), 'must return the inserted row');
+  // files IS written (params[3] below) but is NOT in the RETURNING list — the
+  // write path never echoes the (possibly large) snapshot back.
+  const returningClause = text.slice(text.search(/RETURNING/i));
+  assert.ok(!/\bfiles\b/i.test(returningClause), 'RETURNING must not include files');
+
+  assert.equal(params[0], 'widget');
+  assert.equal(params[1], 42);
+  assert.equal(params[2], JSON.stringify(manifest));
+  assert.equal(params[3], JSON.stringify(files));
+  assert.equal(params[4], JSON.stringify(signOff));
+  assert.equal(params[5], precheckPassedAt);
+  assert.equal(params[6], 'lars589/amazonprimea');
+
+  assert.equal(row.id, 1);
+  assert.equal(row.status, 'pending');
+});
+
+await test('createModuleSubmission() defaults a missing sourceRepo to null (parameterized, not the string "undefined")', async () => {
+  calls.length = 0;
+  nextRows = [{ id: 2, module_key: 'widget', status: 'pending' }];
+  await moduleSubmissions.createModuleSubmission({
+    moduleKey: 'widget', submittedBy: 1, manifest: {}, files: [], signOff: {}, precheckPassedAt: new Date(),
+  });
+  const { params } = lastCall();
+  assert.equal(params[6], null);
+});
+
+await test('listModuleSubmissions(): no filters => SELECT with no WHERE, newest-first, no files column', async () => {
+  calls.length = 0;
+  nextRows = [{ id: 2, module_key: 'b', status: 'pending' }, { id: 1, module_key: 'a', status: 'pending' }];
+  const rows = await moduleSubmissions.listModuleSubmissions();
+  const { text, params } = lastCall();
+  assert.ok(/SELECT/i.test(text));
+  assert.ok(!/WHERE/i.test(text));
+  assert.ok(/ORDER BY\s+submitted_at\s+DESC/i.test(text));
+  const selectClause = text.slice(0, text.search(/FROM/i));
+  assert.ok(!/\bfiles\b/i.test(selectClause), 'list SELECT must not include the files column');
+  assert.deepEqual(params, []);
+  assert.deepEqual(rows, nextRows);
+});
+
+await test('listModuleSubmissions({status}): filters by status, parameterized', async () => {
+  calls.length = 0;
+  nextRows = [];
+  await moduleSubmissions.listModuleSubmissions({ status: 'pending' });
+  const { text, params } = lastCall();
+  assert.ok(/WHERE\s+status\s*=\s*\$1/i.test(text));
+  assert.deepEqual(params, ['pending']);
+});
+
+await test('listModuleSubmissions({status, moduleKey}): both filters AND together, parameterized in order', async () => {
+  calls.length = 0;
+  nextRows = [];
+  await moduleSubmissions.listModuleSubmissions({ status: 'accepted', moduleKey: 'widget' });
+  const { text, params } = lastCall();
+  assert.ok(/WHERE\s+status\s*=\s*\$1\s+AND\s+module_key\s*=\s*\$2/i.test(text));
+  assert.deepEqual(params, ['accepted', 'widget']);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/npmrc.mjs

@@ -0,0 +1,105 @@
+// tests/npmrc.mjs
+//
+// Unit tests for scripts/gds/npmrc.js (ADR 0134, task 2090) — the single source of the
+// env-fed `.npmrc` used to install the PRIVATE @bongos/core from the npm registry, plus
+// the opt-in / token gates that keep the vendored-tarball path the default/fallback.
+//
+// Run:  node tests/npmrc.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { mkdtempSync, writeFileSync, readFileSync, existsSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const n = require('../scripts/gds/npmrc.js');
+
+let passed = 0, failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+// ---- npmrcContent ----------------------------------------------------------
+test('npmrcContent: scopes @bongos to the registry + auth token EXPANDS from the env (literal ${NPM_TOKEN})', () => {
+  const body = n.npmrcContent();
+  assert.match(body, /@bongos:registry=https:\/\/registry\.npmjs\.org\//);
+  assert.match(body, /\/\/registry\.npmjs\.org\/:_authToken=\$\{NPM_TOKEN\}/);
+});
+
+test('npmrcContent: carries NO real secret — only the ${NPM_TOKEN} placeholder', () => {
+  const body = n.npmrcContent();
+  // the only _authToken= assignment must be the env placeholder, never a concrete value
+  const tokenLines = body.split('\n').filter((l) => /_authToken=/.test(l));
+  assert.equal(tokenLines.length, 1);
+  assert.equal(tokenLines[0].trim(), '//registry.npmjs.org/:_authToken=${NPM_TOKEN}');
+});
+
+test('npmrcContent: comment lines use the ini `;` comment char', () => {
+  const comments = n.npmrcContent().split('\n').filter((l) => l.startsWith(';'));
+  assert.ok(comments.length >= 3, 'has explanatory comments');
+});
+
+test('npmrcContent: honors custom scope/host/tokenEnv', () => {
+  const body = n.npmrcContent({ scope: '@acme', host: 'npm.acme.dev', tokenEnv: 'ACME_TOKEN' });
+  assert.match(body, /@acme:registry=https:\/\/npm\.acme\.dev\//);
+  assert.match(body, /\/\/npm\.acme\.dev\/:_authToken=\$\{ACME_TOKEN\}/);
+});
+
+// ---- gates -----------------------------------------------------------------
+test('hasNpmToken: true only when NPM_TOKEN is a non-empty string', () => {
+  assert.equal(n.hasNpmToken({ NPM_TOKEN: 'npm_abc' }), true);
+  assert.equal(n.hasNpmToken({ NPM_TOKEN: '' }), false);
+  assert.equal(n.hasNpmToken({ NPM_TOKEN: '   ' }), false);
+  assert.equal(n.hasNpmToken({}), false);
+});
+
+test('registryCoreRequested: 1/true/yes/on → true; everything else → false', () => {
+  for (const v of ['1', 'true', 'TRUE', 'yes', 'on']) assert.equal(n.registryCoreRequested({ PROVISION_CORE_FROM_REGISTRY: v }), true, v);
+  for (const v of ['0', 'false', 'no', '', 'off', 'garbage']) assert.equal(n.registryCoreRequested({ PROVISION_CORE_FROM_REGISTRY: v }), false, v);
+  assert.equal(n.registryCoreRequested({}), false, 'unset');
+});
+
+// ---- writeNpmrc ------------------------------------------------------------
+test('writeNpmrc: writes the env-fed .npmrc + returns its path', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'npmrc-'));
+  try {
+    const p = n.writeNpmrc(dir, { log: () => {} });
+    assert.equal(p, join(dir, '.npmrc'));
+    assert.equal(readFileSync(p, 'utf8'), n.npmrcContent());
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('writeNpmrc: dry-run writes nothing but returns the intended path', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'npmrc-'));
+  try {
+    const p = n.writeNpmrc(dir, { dryRun: true, log: () => {} });
+    assert.equal(p, join(dir, '.npmrc'));
+    assert.equal(existsSync(join(dir, '.npmrc')), false, 'dry-run must not write');
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('writeNpmrc: overwrite:false leaves a pre-existing .npmrc untouched (returns null)', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'npmrc-'));
+  try {
+    const existing = '@other:registry=https://npm.other.dev/\n';
+    writeFileSync(join(dir, '.npmrc'), existing);
+    const p = n.writeNpmrc(dir, { overwrite: false, log: () => {} });
+    assert.equal(p, null, 'skipped');
+    assert.equal(readFileSync(join(dir, '.npmrc'), 'utf8'), existing, 'existing content preserved');
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('writeNpmrc: overwrite:true (default) replaces an existing .npmrc', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'npmrc-'));
+  try {
+    writeFileSync(join(dir, '.npmrc'), 'stale\n');
+    n.writeNpmrc(dir, { log: () => {} });
+    assert.equal(readFileSync(join(dir, '.npmrc'), 'utf8'), n.npmrcContent());
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+console.log('');
+console.log(`npmrc tests: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/onboard.mjs

@@ -37,12 +37,30 @@ test('onboardPlan(adopt): same sequence + human steps, but the scaffold-leg labe
   assert.doesNotMatch(label(green, 'init'), /--adopt/);
 });
 
+test('onboardPlan lists seed-first-version as an explicit AUTO step right after provision (task 2119 anti-drift)', () => {
+  // The first-version seed used to be an unlisted afterthought bolted to the local
+  // `bongos init` leg (run --no-seed in every hosted flow, so it never fired). Making
+  // it a named step in the ONE canonical sequence is what stops it silently drifting.
+  const plan = ob.onboardPlan();
+  const keys = plan.map((s) => s.key);
+  const seed = plan.find((s) => s.key === 'seed-version');
+  assert.ok(seed, 'the plan carries a seed-version step');
+  assert.equal(seed.kind, 'auto', 'seeding is automated (the runner does it, no owner action)');
+  assert.equal(keys.indexOf('seed-version'), keys.indexOf('provision') + 1, 'seed immediately follows provision (the DB now exists)');
+  assert.ok(keys.indexOf('seed-version') < keys.indexOf('first-sign-in'), 'a version exists before the owner ever signs in');
+  // present in BOTH modes (not a greenfield/adopt branch).
+  assert.ok(ob.onboardPlan('adopt').some((s) => s.key === 'seed-version'), 'adopt gets it too');
+});
+
 test('oauthAppInstructions pins the apex callback + homepage and points at ACCOUNT Developer settings', () => {
   const oa = ob.oauthAppInstructions('mercury.example.com');
   assert.equal(oa.homepageUrl, 'https://mercury.example.com');
   assert.equal(oa.callbackUrl, 'https://mercury.example.com/api/gds/auth/web/callback');
   assert.match(oa.location, /ACCOUNT/);
   assert.match(oa.location, /Developer settings/);
+  // task 2127 — must tell the owner to enable Device Flow (off by default; the CLI login
+  // uses it). Its absence was the 2026-07-08 demo login-500 root cause.
+  assert.match(oa.enableDeviceFlow, /Device Flow/i);
 });
 
 test('buildInitSpec maps answers to a STANDALONE init spec (domain → origin + provisioning shape)', () => {
@@ -68,3 +86,34 @@ test('buildInitSpec without a domain still defaults a standalone provisioning sh
 test('healthzUrl', () => {
   assert.equal(ob.healthzUrl('mercury.example.com'), 'https://mercury.example.com/healthz');
 });
+
+// ── task 2085: ONE source for the onboarding sequence (anti-drift) ────────────
+
+test('onboardPlan is the SAME function the provisioning module owns (single source, not a copy)', () => {
+  // The CLI must CONSUME modules/provisioning/onboard-plan.js, not carry its own copy —
+  // that is the whole point of task 2085. A re-declared duplicate would pass every other
+  // test yet silently drift; identity of the function reference proves there is one source.
+  const canonical = require('../modules/provisioning/onboard-plan.js').onboardPlan;
+  assert.equal(ob.onboardPlan, canonical, 'scripts/gds/onboard.js must re-export the module’s onboardPlan');
+});
+
+test('the web forms (/create + hall wizard) declare EXACTLY the canonical human steps — drift guard', () => {
+  // goal 35 / criterion 165: "the canonical step sequence is the source of truth;
+  // skill/CLI/hall are forms over it." Each web form tags its human-step <li>s with
+  // data-onboard-step="<key>"; this asserts that set equals the plan's human-step keys,
+  // so adding/removing/renaming a human step in the single source fails CI until every
+  // form is updated (and vice-versa) — the sequence can no longer drift between forms.
+  const { readFileSync } = require('node:fs');
+  const path = require('node:path');
+  const humanKeys = ob.onboardPlan().filter((s) => s.kind === 'human').map((s) => s.key).sort();
+  const surfaces = {
+    '/create landing page': 'public-landing/create.html',
+    'hall new-project wizard': 'modules/hall-ui/public/new-project-wizard.js',
+  };
+  for (const [name, rel] of Object.entries(surfaces)) {
+    const src = readFileSync(path.join(import.meta.dirname, '..', rel), 'utf8');
+    const found = [...src.matchAll(/data-onboard-step="([^"]+)"/g)].map((m) => m[1]);
+    const uniq = [...new Set(found)].sort();
+    assert.deepEqual(uniq, humanKeys, `${name} (${rel}) must tag exactly the canonical human steps [${humanKeys}], found [${uniq}]`);
+  }
+});

package/tests/package_core.mjs

@@ -25,6 +25,8 @@ const {
   ARTIFACT_NAME, MANIFEST_SCHEMA, TAR_ROOT,
   // task 1824 — the consumer-core file-classification layer
   isDocPath, functionalSecretLeaks, processCoreFile,
+  // task 2121 — agent-doc (CLAUDE.md/AGENTS.md) stub
+  isAgentDoc, CORE_AGENT_DOC_STUB,
   // task 1882 (ADR 0108 §2) — the real installable npm package
   CORE_DEP_NAMES, buildPackageJson, resolveLockDep, lockfileClosure, prunePackageLock,
   // task 2089 (ADR 0134) — private-by-default npm publish
@@ -141,27 +143,27 @@ t('withTarballInfo adds the exact-bytes coordinate for the side-car pin', () =>
     version: '1.13.0', coreContract: '1.13.0', sourceCommit: 'abc', sourceRef: 'HEAD',
     builtAtIso: '2026-07-01T00:00:00.000Z', files: [], treeHash: 'x', redaction: null,
   });
-  const side = withTarballInfo(inner, { name: 'cloudbongos-core-1.13.0.tgz', sha256: 'cafe', bytes: 42 });
+  const side = withTarballInfo(inner, { name: 'bongos-core-1.13.0.tgz', sha256: 'cafe', bytes: 42 });
   assert.equal(side.tarball.sha256, 'cafe');
   assert.equal(side.tarball.bytes, 42);
   assert.equal(inner.tarball, undefined); // withTarballInfo does not mutate the inner
 });
 
 t('artifact filenames', () => {
-  assert.equal(tarballName('1.13.0'), 'cloudbongos-core-1.13.0.tgz');
-  assert.equal(manifestName('1.13.0'), 'cloudbongos-core-1.13.0.manifest.json');
-  assert.equal(stageDirName('1.13.0'), 'cloudbongos-core-1.13.0');
+  assert.equal(tarballName('1.13.0'), 'bongos-core-1.13.0.tgz');
+  assert.equal(manifestName('1.13.0'), 'bongos-core-1.13.0.manifest.json');
+  assert.equal(stageDirName('1.13.0'), 'bongos-core-1.13.0');
 });
 
 // ── ustar name/prefix split ──────────────────────────────────────────────────────────
 t('splitUstarName: short path → name only', () => {
-  const r = splitUstarName('cloudbongos-core/a.js');
+  const r = splitUstarName('bongos-core/a.js');
   assert.equal(r.prefix, '');
-  assert.equal(r.name, 'cloudbongos-core/a.js');
+  assert.equal(r.name, 'bongos-core/a.js');
 });
 
 t('splitUstarName: long path splits at a / into name<=100 + prefix<=155', () => {
-  const long = 'cloudbongos-core/' + 'dir/'.repeat(20) + 'file.js'; // > 100 bytes
+  const long = 'bongos-core/' + 'dir/'.repeat(24) + 'file.js'; // > 100 bytes → forces a name/prefix split
   const r = splitUstarName(long);
   assert.ok(r, 'expected a split');
   assert.ok(Buffer.byteLength(r.name) <= 100);
@@ -177,18 +179,18 @@ t('splitUstarName: unsplittable (>100-byte tail) → null (longlink fallback)',
 // ── buildTar — produces a real, readable, deterministic archive ──────────────────────
 t('buildTar round-trips a small set (content + mode preserved)', () => {
   const entries = [
-    { name: 'cloudbongos-core/a.txt', mode: 0o644, buf: Buffer.from('hello\n') },
-    { name: 'cloudbongos-core/bin/run.sh', mode: 0o755, buf: Buffer.from('#!/bin/sh\necho hi\n') },
+    { name: 'bongos-core/a.txt', mode: 0o644, buf: Buffer.from('hello\n') },
+    { name: 'bongos-core/bin/run.sh', mode: 0o755, buf: Buffer.from('#!/bin/sh\necho hi\n') },
   ];
   const files = readTar(buildTar(entries));
-  assert.equal(files.get('cloudbongos-core/a.txt').content.toString(), 'hello\n');
-  assert.equal(files.get('cloudbongos-core/bin/run.sh').content.toString(), '#!/bin/sh\necho hi\n');
-  assert.equal(files.get('cloudbongos-core/bin/run.sh').mode & 0o777, 0o755);
-  assert.equal(files.get('cloudbongos-core/a.txt').mode & 0o777, 0o644);
+  assert.equal(files.get('bongos-core/a.txt').content.toString(), 'hello\n');
+  assert.equal(files.get('bongos-core/bin/run.sh').content.toString(), '#!/bin/sh\necho hi\n');
+  assert.equal(files.get('bongos-core/bin/run.sh').mode & 0o777, 0o755);
+  assert.equal(files.get('bongos-core/a.txt').mode & 0o777, 0o644);
 });
 
 t('buildTar round-trips a >100-byte path via the GNU longlink path', () => {
-  const longName = 'cloudbongos-core/' + 'deep/'.repeat(25) + 'leaf.js'; // ~150 bytes, but splittable
+  const longName = 'bongos-core/' + 'deep/'.repeat(25) + 'leaf.js'; // ~150 bytes, but splittable
   const unsplittable = 'z'.repeat(130); // forces the longlink branch (no valid split)
   const entries = [
     { name: longName, mode: 0o644, buf: Buffer.from('deep\n') },
@@ -201,15 +203,15 @@ t('buildTar round-trips a >100-byte path via the GNU longlink path', () => {
 
 t('buildTar is byte-deterministic (same input → identical bytes; entry order irrelevant)', () => {
   const e1 = [
-    { name: 'cloudbongos-core/b.txt', mode: 0o644, buf: Buffer.from('B') },
-    { name: 'cloudbongos-core/a.txt', mode: 0o644, buf: Buffer.from('A') },
+    { name: 'bongos-core/b.txt', mode: 0o644, buf: Buffer.from('B') },
+    { name: 'bongos-core/a.txt', mode: 0o644, buf: Buffer.from('A') },
   ];
   const e2 = [...e1].reverse();
   assert.equal(sha256hex(buildTar(e1)), sha256hex(buildTar(e2)));
 });
 
 t('buildTar output gunzips and ends with two zero blocks', () => {
-  const gz = buildTar([{ name: 'cloudbongos-core/a', mode: 0o644, buf: Buffer.from('x') }]);
+  const gz = buildTar([{ name: 'bongos-core/a', mode: 0o644, buf: Buffer.from('x') }]);
   const tar = zlib.gunzipSync(gz);
   assert.equal(tar.length % 512, 0);
   const tail = tar.subarray(tar.length - 1024);
@@ -298,6 +300,50 @@ t('DOCS are genericized: instance brand/owner redacted, output is clean', () =>
   assert.equal(r.leaks.length, 0);        // clean after redaction → no abort
 });
 
+// ── task 2121 — CLAUDE.md/AGENTS.md ship as a brand-free stub (demo-audit fix) ──────
+t('isAgentDoc: matches CLAUDE.md/AGENTS.md at root + any depth, nothing else', () => {
+  assert.equal(isAgentDoc('CLAUDE.md'), true);
+  assert.equal(isAgentDoc('scripts/gds/CLAUDE.md'), true);
+  assert.equal(isAgentDoc('src/bongos/routes/CLAUDE.md'), true);
+  assert.equal(isAgentDoc('modules/lifecycle/CLAUDE.md'), true);
+  assert.equal(isAgentDoc('AGENTS.md'), true);
+  assert.equal(isAgentDoc('docs/CLAUDE.md'), true);
+  // NOT an agent doc: other markdown, or a filename that merely contains the word
+  assert.equal(isAgentDoc('README.md'), false);
+  assert.equal(isAgentDoc('docs/adr/0100.md'), false);
+  assert.equal(isAgentDoc('docs/CLAUDE-notes.md'), false);
+  assert.equal(isAgentDoc('src/claude.js'), false);
+});
+
+t('processCoreFile STUBS a CLAUDE.md — the core memory never ships (no auto-load pollution)', () => {
+  // A realistic core CLAUDE.md: the wrong project title + instance brand + a long body.
+  const coreClaude = '# Off the Boats — Project Memory\n' +
+    'Visit https://acme.example (world Xanadu), owner zoltan. ' + 'lorem ipsum '.repeat(200);
+  const r = proc('CLAUDE.md', coreClaude);
+  assert.equal(r.kind, 'stub');                               // classified as a stub, not a doc
+  assert.equal(r.leaks.length, 0);                            // brand-free by construction → never a leak
+  const out = r.buf.toString();
+  assert.equal(out, CORE_AGENT_DOC_STUB);                     // exactly the stub, verbatim
+  assert.ok(!/Off the Boats/i.test(out), 'wrong project title gone');
+  assert.ok(!/acme/i.test(out) && !/zoltan/i.test(out) && !/Xanadu/i.test(out), 'no instance brand');
+  assert.ok(!/lorem ipsum/.test(out), 'original 200-line body gone');
+  assert.ok(out.length < coreClaude.length, 'stub is far shorter than the real memory');
+});
+
+t('processCoreFile STUBS nested + module CLAUDE.md too (all auto-load sites)', () => {
+  for (const p of ['scripts/gds/CLAUDE.md', 'src/bongos/CLAUDE.md', 'modules/economy/CLAUDE.md']) {
+    const r = proc(p, '# nested map\nsecret https://acme.example detail');
+    assert.equal(r.kind, 'stub', `${p} stubbed`);
+    assert.equal(r.buf.toString(), CORE_AGENT_DOC_STUB, `${p} → stub body`);
+  }
+});
+
+t('the stub itself carries no instance brand and states it does not govern', () => {
+  assert.ok(!/acme|zoltan|Xanadu|Off the Boats/i.test(CORE_AGENT_DOC_STUB));
+  assert.ok(/does not govern/i.test(CORE_AGENT_DOC_STUB));
+  assert.ok(/@bongos\/core/.test(CORE_AGENT_DOC_STUB));
+});
+
 // ── task 1882 (ADR 0108 §2) — the real installable npm package ─────────────────────
 t('TAR_ROOT is the npm-required "package/" (not the ARTIFACT_NAME dir)', () => {
   assert.equal(TAR_ROOT, 'package/');
@@ -309,7 +355,7 @@ t('buildPackageJson: prunes to express+pg, keeps the source ranges + the undici
     sourceDeps: { express: '^4.21.2', pg: '^8.20.0', phaser: '^3.87.0', 'discord.js': '^14.26.4' },
     sourceOverrides: { undici: '^6.27.0' },
   });
-  assert.equal(pkg.name, '@cloudbongos/core');
+  assert.equal(pkg.name, '@bongos/core');
   assert.equal(pkg.version, '1.14.0');
   assert.deepEqual(pkg.dependencies, { express: '^4.21.2', pg: '^8.20.0' });
   assert.equal(pkg.dependencies.phaser, undefined);
@@ -325,7 +371,7 @@ t('buildPackageJson: prunes to express+pg, keeps the source ranges + the undici
 });
 
 t('publishArgs: private (restricted) publish, dry-run unless live (task 2089 / ADR 0134)', () => {
-  const tgz = 'dist/cloudbongos-core-1.14.0.tgz';
+  const tgz = 'dist/bongos-core-1.14.0.tgz';
   // Default: dry-run, restricted (never public, never a real upload).
   assert.deepEqual(publishArgs(tgz, false), ['publish', tgz, '--access', 'restricted', '--dry-run']);
   // Live: still restricted (private) — the permanent publish is never public here.
@@ -408,8 +454,8 @@ t('lockfileClosure: matches the real repo lockfile — express+pg close over the
 });
 
 t('prunePackageLock: emits a self-consistent pruned lockfile (root ranges + only the kept packages)', () => {
-  const pruned = prunePackageLock(FIXTURE_LOCK, { name: '@cloudbongos/core', version: '1.14.0', rootRanges: { a: '^1.0.0' }, rootDepNames: ['a'] });
-  assert.equal(pruned.name, '@cloudbongos/core');
+  const pruned = prunePackageLock(FIXTURE_LOCK, { name: '@bongos/core', version: '1.14.0', rootRanges: { a: '^1.0.0' }, rootDepNames: ['a'] });
+  assert.equal(pruned.name, '@bongos/core');
   assert.equal(pruned.version, '1.14.0');
   assert.equal(pruned.lockfileVersion, 3);
   assert.equal(pruned.requires, true);
@@ -423,7 +469,7 @@ t('prunePackageLock: emits a self-consistent pruned lockfile (root ranges + only
 t('prunePackageLock: on the real repo lockfile, drops the vast majority of packages', () => {
   const realLock = require('../package-lock.json');
   const pruned = prunePackageLock(realLock, {
-    name: '@cloudbongos/core', version: '1.14.0', rootRanges: { express: '^4.21.2', pg: '^8.20.0' },
+    name: '@bongos/core', version: '1.14.0', rootRanges: { express: '^4.21.2', pg: '^8.20.0' },
   });
   const keptCount = Object.keys(pruned.packages).length - 1; // exclude the root '' entry
   const sourceCount = Object.keys(realLock.packages).length - 1;

package/tests/platform_boot.mjs

@@ -107,8 +107,11 @@ test('the apex host serves the landing page — not the game — on a game-less
   // it IS the landing, with the branding pack injected (look + identity from config)
   assert.match(res.body, /window\.__BRANDING__=/);
   assert.match(res.body, /Enter the Hall/);
-  // the platform-level create door (goal 35, task 2084) — gated by sign-in client-side
-  assert.match(res.body, /Create a project/);
+  // the per-project landing carries the top-right identity chip + hall entry
+  // (goal 35, task 2094). "Create a project" is an ORG-level action that lives
+  // only on the gate now — it must NOT appear on a project's own landing.
+  assert.match(res.body, /id="who"/);
+  assert.doesNotMatch(res.body, /Create a project/);
 });
 
 test('the apex host serves the branded /create page (goal 35, task 2081)', async () => {