@bongos/core 1.17.0 → 1.17.2

package/modules/provisioning/tests/provisioning.mjs

@@ -0,0 +1,232 @@
+// modules/provisioning/tests/provisioning.mjs
+//
+// DB-free unit smoke for the provisioning module's domain slice (ADR 0111). Focus:
+// the P4 (#1945) Caddy on-demand-TLS ALLOW-LIST helpers — normalizeHostname (pure)
+// and isProvisionedHostname (a fake { query }) — plus a sanity check of the P1 pure
+// helpers. No DB, no network: `db` is a recording fake. Auto-discovered + run by
+// scripts/gds/run-unit-tests.js when the `provisioning` module is enabled (it is on
+// OTB). Run standalone: node modules/provisioning/tests/provisioning.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const P = require('../provisioning.js');
+const RL = require('../rate-limit.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+console.log('normalizeHostname (on-demand-TLS allow-list, P4):');
+
+t('lowercases, trims, drops a trailing dot + a :port', () => {
+  assert.equal(P.normalizeHostname('  Mercury.Example.COM. '), 'mercury.example.com');
+  assert.equal(P.normalizeHostname('mercury.example.com:443'), 'mercury.example.com');
+});
+
+t('rejects a bare TLD / empty / malformed names (fail-closed → the caller denies)', () => {
+  assert.equal(P.normalizeHostname('com'), '');
+  assert.equal(P.normalizeHostname(''), '');
+  assert.equal(P.normalizeHostname(null), '');
+  assert.equal(P.normalizeHostname('-bad.example.com'), '');
+  assert.equal(P.normalizeHostname('bad-.example.com'), '');
+  assert.equal(P.normalizeHostname('has space.example.com'), '');
+  assert.equal(P.normalizeHostname('a..b.com'), '');
+});
+
+t('accepts a normal multi-label host', () => {
+  assert.equal(P.normalizeHostname('a.b.example.com'), 'a.b.example.com');
+});
+
+console.log('\nisProvisionedHostname (the Caddy `ask` allow-list, P4):');
+
+// A fake db whose query returns the status row a lookup fn decides, keyed on $1.
+function fakeDb(statusFor) {
+  return { query: async (_sql, params) => {
+    const s = statusFor(String(params[0]));
+    return { rows: s ? [{ status: s }] : [] };
+  } };
+}
+
+await ta('true ONLY for a provisioning|active instance; false for every other state or unknown', async () => {
+  const byHost = {
+    'live.example.com': 'active',
+    'mid.example.com': 'provisioning',
+    'gone.example.com': 'torn_down',
+    'req.example.com': 'requested',
+    'err.example.com': 'error',
+    'down.example.com': 'tearing_down',
+  };
+  const db = fakeDb((h) => byHost[h] || null);
+  assert.equal(await P.isProvisionedHostname(db, 'live.example.com'), true);
+  assert.equal(await P.isProvisionedHostname(db, 'mid.example.com'), true);
+  assert.equal(await P.isProvisionedHostname(db, 'gone.example.com'), false);
+  assert.equal(await P.isProvisionedHostname(db, 'req.example.com'), false);
+  assert.equal(await P.isProvisionedHostname(db, 'err.example.com'), false);
+  assert.equal(await P.isProvisionedHostname(db, 'down.example.com'), false);
+  assert.equal(await P.isProvisionedHostname(db, 'unknown.example.com'), false);
+});
+
+await ta('normalizes the SNI before matching, and never queries a malformed host (fail-closed, no DB hit)', async () => {
+  let queried = 0;
+  const db = { query: async (_sql, params) => {
+    queried++;
+    return { rows: params[0] === 'live.example.com' ? [{ status: 'active' }] : [] };
+  } };
+  assert.equal(await P.isProvisionedHostname(db, 'LIVE.example.com.:443'), true, 'normalized SNI matches');
+  const before = queried;
+  assert.equal(await P.isProvisionedHostname(db, 'com'), false);
+  assert.equal(await P.isProvisionedHostname(db, ''), false);
+  assert.equal(queried, before, 'no query issued for a malformed host');
+});
+
+console.log('\nmakeAskRateLimiter (tls-check ask rate limit, P4 SEC review of task 1945):');
+
+function fakeRes() {
+  return {
+    _status: 200, _json: null, _headers: {},
+    set(k, v) { this._headers[k] = v; return this; },
+    status(c) { this._status = c; return this; },
+    json(b) { this._json = b; return this; },
+  };
+}
+function call(mw, ip) {
+  let nexted = false;
+  const res = fakeRes();
+  mw({ ip }, res, () => { nexted = true; });
+  return { nexted, res };
+}
+
+t('allows up to `max` per window, then 429s with Retry-After', () => {
+  let clock = 1_000_000;
+  const mw = RL.makeAskRateLimiter({ windowMs: 60_000, max: 3, now: () => clock });
+  for (let i = 0; i < 3; i++) {
+    const { nexted, res } = call(mw, '1.2.3.4');
+    assert.equal(nexted, true, `request ${i + 1} within cap passes`);
+    assert.equal(res._status, 200);
+  }
+  const over = call(mw, '1.2.3.4');
+  assert.equal(over.nexted, false, 'over-cap request is blocked (next not called)');
+  assert.equal(over.res._status, 429);
+  assert.ok(Number(over.res._headers['Retry-After']) >= 1, 'sets Retry-After');
+  assert.equal(over.res._json.error, 'rate_limited');
+});
+
+t('the window slides — after windowMs elapses, requests flow again', () => {
+  let clock = 0;
+  const mw = RL.makeAskRateLimiter({ windowMs: 1_000, max: 1, now: () => clock });
+  assert.equal(call(mw, 'a').nexted, true);
+  assert.equal(call(mw, 'a').nexted, false, 'second within the window is blocked');
+  clock += 1_001; // step past the window
+  assert.equal(call(mw, 'a').nexted, true, 'allowed again after the window slides');
+});
+
+t('per-IP buckets are independent', () => {
+  let clock = 5;
+  const mw = RL.makeAskRateLimiter({ windowMs: 60_000, max: 1, now: () => clock });
+  assert.equal(call(mw, 'ip-a').nexted, true);
+  assert.equal(call(mw, 'ip-a').nexted, false, 'ip-a is capped');
+  assert.equal(call(mw, 'ip-b').nexted, true, 'ip-b has its own bucket');
+});
+
+console.log('\nP1 pure helpers (sanity):');
+
+t('isValidSlug basic contract', () => {
+  assert.equal(P.isValidSlug('mercury'), true);
+  assert.equal(P.isValidSlug('a'), false);      // too short
+  assert.equal(P.isValidSlug('-x'), false);     // leading dash
+  assert.equal(P.isValidSlug('a--b'), false);   // double dash
+});
+
+console.log('\nGitHub App Manifest — pure builders (task 2080, ADR 0133):');
+
+t('githubAppName prefers the DOMAIN (unique + reads on the consent screen)', () => {
+  // The domain is globally unique, so "demo" never collides once named after its host.
+  assert.equal(P.githubAppName({ domain: 'demo.cloudbongos.com', brand: 'Cloud Bongos', project: 'demo' }), 'demo.cloudbongos.com');
+  assert.equal(P.githubAppName({ domain: 'Mercury.Example.com.:443', brand: 'X', project: 'mercury' }), 'mercury.example.com'); // normalized (case/port/dot)
+});
+
+t('githubAppName falls back to brand-qualified project when there is no usable domain', () => {
+  // no domain → "<brand> - <project>", still collision-resistant vs a bare slug
+  assert.equal(P.githubAppName({ brand: 'Cloud Bongos', project: 'demo' }), 'Cloud Bongos - demo');
+  // a domain over GitHub's 34-char limit → fall back to brand-qualified project
+  assert.equal(P.githubAppName({ domain: 'a-really-long-subdomain.enterprise.example.com', brand: 'Cloud Bongos', project: 'demo' }), 'Cloud Bongos - demo');
+  assert.equal(P.githubAppName({ brand: '', project: 'mercury' }), 'mercury');           // no brand → project
+  assert.equal(P.githubAppName({ brand: 'Cloud Bongos', project: '' }), 'Cloud Bongos');  // no project → brand
+  assert.equal(P.githubAppName({}), 'Cloud Bongos');                                      // last-resort default
+  const long = P.githubAppName({ brand: 'Cloud Bongos', project: 'x'.repeat(50) });
+  assert.ok(long.length <= 34 && long.startsWith('Cloud Bongos - '), `capped + brand kept: ${long}`);
+});
+
+t('buildGithubAppManifest points redirect at the MOTHERSHIP, callbacks at the INSTANCE, minimal perms, domain-named', () => {
+  const m = P.buildGithubAppManifest({
+    instanceName: 'mercury', slug: 'mercury', brand: 'Cloud Bongos',
+    instanceDomain: 'mercury.example.com', mothershipOrigin: 'https://cloudbongos.com',
+  });
+  assert.equal(m.name, 'mercury.example.com'); // the App is named after its own domain
+  assert.equal(m.url, 'https://mercury.example.com');
+  // redirect_url = the control-plane callback (where GitHub returns the code)
+  assert.equal(m.redirect_url, 'https://cloudbongos.com/api/bongos/provisioning/github-app/callback');
+  // callback_urls = the INSTANCE's own sign-in callback, BOTH prefixes for robustness
+  assert.deepEqual(m.callback_urls, [
+    'https://mercury.example.com/api/gds/auth/web/callback',
+    'https://mercury.example.com/api/bongos/auth/web/callback',
+  ]);
+  // sign-in needs no repo/account permissions; no active webhook; not public
+  assert.deepEqual(m.default_permissions, {});
+  assert.equal(m.hook_attributes.active, false);
+  assert.equal(m.public, false);
+});
+
+t('buildGithubAppManifest tolerates a trailing slash on the mothership origin', () => {
+  const m = P.buildGithubAppManifest({ instanceName: 'M', slug: 'm', instanceDomain: 'm.example.com', mothershipOrigin: 'https://cloudbongos.com/' });
+  assert.equal(m.redirect_url, 'https://cloudbongos.com/api/bongos/provisioning/github-app/callback');
+});
+
+t('manifestPostUrl: personal vs org, state url-encoded', () => {
+  assert.equal(P.manifestPostUrl({ account: 'personal', state: 'abc' }), 'https://github.com/settings/apps/new?state=abc');
+  assert.equal(P.manifestPostUrl({ account: 'org', orgLogin: 'acme', state: 'a b' }), 'https://github.com/organizations/acme/settings/apps/new?state=a%20b');
+  // org requested but no org login → falls back to personal (never a broken URL)
+  assert.equal(P.manifestPostUrl({ account: 'org', state: 'x' }), 'https://github.com/settings/apps/new?state=x');
+});
+
+console.log('\nGitHub App Manifest — data access (fake { query }):');
+
+await ta('attachManifestCode is single-use + TTL-guarded (only a pending, un-expired row advances)', async () => {
+  const seen = [];
+  const db = { query: async (sql, params) => {
+    seen.push({ sql, params });
+    // Emulate the guarded UPDATE ... WHERE status='pending' AND expires_at > now():
+    // the fake returns a row only when the caller's id is the "fresh" one.
+    if (/UPDATE provisioning_oauth_manifests/.test(sql) && /status = 'code_received'/.test(sql)) {
+      return { rows: params[0] === 1 ? [{ id: 1, status: 'code_received', github_code: params[1] }] : [] };
+    }
+    return { rows: [] };
+  } };
+  const fresh = await P.attachManifestCode(db, 1, 'CODE123');
+  assert.ok(fresh && fresh.status === 'code_received' && fresh.github_code === 'CODE123');
+  const stale = await P.attachManifestCode(db, 2, 'CODE456'); // wrong/expired → no row
+  assert.equal(stale, null);
+  // the guard (status + expiry) lives in the SQL, not JS — assert it's actually there
+  assert.match(seen[0].sql, /status = 'pending' AND expires_at > now\(\)/);
+});
+
+await ta('claimNextOAuthManifest flips code_received→converting, gated on an ACTIVE instance, SKIP LOCKED', async () => {
+  let sql = '';
+  const db = { query: async (q) => { sql = q; return { rows: [{ id: 7, status: 'converting' }] }; } };
+  const row = await P.claimNextOAuthManifest(db);
+  assert.equal(row.id, 7);
+  assert.match(sql, /SET status = 'converting'/);
+  assert.match(sql, /FOR UPDATE OF m SKIP LOCKED/);
+  assert.match(sql, /m\.status = 'code_received' AND i\.status = 'active'/);
+});
+
+console.log(`\nprovisioning module: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/modules/security/CLAUDE.md

@@ -1,44 +1,15 @@
-# `security` module — red-team reports + bounty + the `security` kernel port
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
 
-> The **fifth CORE-domain** carved into a module (BV1.R79, [ADR 0093](../../docs/adr/<redacted>.md) §1) — after memory (R72), grading (R73), economy (R77), and ideas (R78). This is **<redacted>**, not <redacted> ([02-module-map §5](../../docs/design/modular-architecture/02-module-map.md)): the optional, rank-gated red-team-reports + bounty surface. A clean slice — its SQL already lived in a dedicated `security.js` (not the `db.js` monolith), so the carve is a git-move + a route split + a doorway re-point, OTB byte-identical. `default: true` in `module.json` — every instance can take red-team reports.
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
 
-Owns the **red-team / vulnerability-report** lifecycle (file → adjudicate → pay) and the **bounty payout table**: the `/builder-redteam` skill POSTs a report (Metic+), the Archon dashboard reads + adjudicates it (confirm / dispute / fix / link-fix), and the env-aware per-severity drachmae schedule (the bounty table) is the single source of truth for "how much for a confirmed report."
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
 
-## The boundary (the one rule)
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
 
-This module reaches core **only** through the published doorway [`../../src/module-api.js`](../../src/module-api.js) (`coreVersion ^1.8.0`). It must **never** `require()` a core internal directly, and never another module. Core, in turn, must never `require()` a file in here — it reaches the bounty schedule only through the `security` port (below). Both directions are enforced by the BV1.R44/R45 fitness checks.
-
-## <redacted> stays KERNEL (the headline boundary call)
-
-[02-module-map §5](../../docs/design/modular-architecture/02-module-map.md) splits "security" in two, and only one half is here:
-
-- **PROPERTY → kernel (NOT moved):** the authz / trust-boundary machinery — `permission-path-check.js`, `route-rank-check.js`, `requireRank`/`requireBuilder` (`auth.js`). Imported everywhere, enforced by composition + fitness functions, never "called." Untouched by this carve.
-- **PROPERTY → kernel (NOT moved, the subtle part):** the **threat-model + engagement-doc plane** also stayed in core `src/bongos/routes/security.js`: `GET /security/adr` (reads the real ADR 0020 threat model off the droplet, Metic+) and `GET/POST /security/docs` (the Archon-only exploit-detail engagement-report store, backed by the core `db.js` `security_docs` queries). These document **defenses + exploits** — security-the-property's operational surface, not the bounty feature. They keep their `EXPECTED_RANKS` pins in `route-rank-check.js`.
-- **FEATURE → this module:** red-team / vulnerability **reports** + **bounty** (`/security/reports*`) and the payout table. Self-contained, optional, rank-gated.
-
-The core `src/bongos/routes/security.js` therefore did **not** disappear — it was *split*: the report/bounty routes moved here; the adr/docs (property) routes stayed.
-
-## The `security` kernel PORT
-
-- **Provides — port `security`** → `{ bountyTableDetailed, bountyTable }`. Registered in `routes/reports.js`'s factory (the loader runs it at boot, and again whenever a test rebuilds the GDS router — `hasProvider`-guarded so re-instantiation never trips the single-provider guard). Mirrors `modules/economy/routes/reward.js`.
-- **Why:** the **one** core consumer of the security feature is `src/bongos/routes/public.js`'s `GET /public/bounty-table` (the public payout schedule the hall renders). Core can't `require()` a module, so it resolves `seams.resolveOptional('security').bountyTableDetailed()` — the economy `reward`-port precedent for a core read route reaching module data.
-
-## Files
-
-| File | What |
-|---|---|
-| `security.js` | the bounty payout table (`bountyTable`/`bountyTableDetailed`, env-overridable per severity via `GDS_BOUNTY_*`) + the `vulnerability_reports` domain: `createVulnerabilityReport` (the `/builder-redteam` writer), `listVulnerabilityReports({scope})`, and the Archon adjudication transitions (`confirm`/`dispute`/`markFixed`/`linkFix`). Reaches the shared pool through the doorway. |
-| `routes/reports.js` | `POST /security/reports` (Metic+ file), `GET /security/reports` (Archon list), `POST /security/reports/:id/{confirm,dispute,fix,link-fix}` (Archon adjudicate). Its factory **registers the `security` port**. |
-
-## NOT in this module (deliberately left in core)
-
-- **The threat-model + engagement-doc routes** — `src/bongos/routes/security.js` keeps `GET /security/adr` + `GET/POST /security/docs` (security-the-property; see the boundary call above). They use the core `db.js` `security_docs` queries and `auth`/`_helpers` directly — core code, not this module.
-- **The `/builder-redteam` skill** — `.claude/skills/builder-redteam/` travels with the feature but stays under `.claude/skills/` (it just POSTs to `/api/gds/security/reports`, which this module now mounts).
-
-## Tables
-
-None owned. `vulnerability_reports` (migration 030) and `security_docs` (the property-side store) were created before the module system and stay in core `migrations/` (the `schema_migrations` stem-key makes a later relocation a no-op). This module owns the *report/bounty queries*; any **new** security-feature migration belongs in `modules/security/migrations/` namespaced `security_*` (the additive rule).
-
-## Tests
-
-`tests/security_reports.mjs` exercises the report/bounty domain (the `security.js` helpers + the bounty table). The route-rank fitness check (`tests/module_route_rank.mjs`) asserts every write route in `routes/reports.js` is rank-gated. The doorway/boundary checks (`tests/fitness.mjs`, `tests/module_loader.mjs`) discover `security` as a module. See [ADR 0093](../../docs/adr/<redacted>.md).
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/security/secret-scrub.js

@@ -146,10 +146,19 @@ function redactHighEntropy(text) {
 const ENV_SECRET_KEY_RE =
   /(?:api[_-]?key|secret|token|password|passwd|pwd|passphrase|access[_-]?key|private[_-]?key|client[_-]?secret|credential|cookie)/i;
 const ENV_SECRET_PREFIX_RE = /^(?:gds_|pms_|mac_|apple|anthropic|stripe|cf_|cloudflare|do_token|digitalocean)/i;
+// Benign shell/runtime vars whose NAME trips a secret-word substring but whose VALUE is
+// never a credential. PWD and OLDPWD contain "pwd" (the password alternative in
+// ENV_SECRET_KEY_RE), yet hold a working-directory PATH — so without this exclusion a
+// legitimate publish fails closed whenever that path appears verbatim in a functional file
+// (e.g. a /Users/<name> anti-pattern comment), passing or failing purely on the operator's
+// last `cd` (task 2130). Exact-match only, so real password vars (MYSQL_PWD, DB_PWD, …)
+// still match below.
+const ENV_BENIGN_KEY_RE = /^(?:PWD|OLDPWD)$/;
 function collectEnvSecrets(env = process.env) {
   const out = [];
   for (const [k, v] of Object.entries(env || {})) {
     if (typeof v !== 'string' || v.length < 8) continue;
+    if (ENV_BENIGN_KEY_RE.test(k)) continue;
     if (ENV_SECRET_KEY_RE.test(k) || ENV_SECRET_PREFIX_RE.test(k)) out.push(v);
   }
   return out;
@@ -196,6 +205,7 @@ module.exports = {
   redactHighEntropy,
   ENV_SECRET_KEY_RE,
   ENV_SECRET_PREFIX_RE,
+  ENV_BENIGN_KEY_RE,
   collectEnvSecrets,
   scrubSecrets,
 };

package/modules/sessions/CLAUDE.md

@@ -1,39 +1,15 @@
-# `sessions` module — session-records corpus, BFG, session-pulse
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
 
-> A CORE-domain carve (BV1.R82, [ADR 0093](../../docs/adr/<redacted>.md) §1) — the seventh tranche-2 domain extracted from the GDS core, after onboarding (R81). `default: true` — every instance records its builders' sessions for the BFG, so it mounts unconditionally unless an instance disables it.
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
 
-Owns the **session_records corpus** + its data plane (the `/sessions` upload + the Archon-gated cross-builder search/deep-dive), the **BFG** cross-builder "read-the-room" scorer ([ADR 0026](../../docs/adr/<redacted>.md) §6B), and the **session-pulse / stale-claim** heartbeat helpers.
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
 
-## The boundary (the one rule)
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
 
-This module reaches core **only** through the published doorway `../../src/module-api.js` (`coreVersion ^1.10.0`). It must **never** `require()` a core internal (`../../src/bongos/db`, `../../src/bongos/auth`, `../../src/bongos/pool`, …) directly, and **never** another module. Core, in turn, must never `require()` a file in here — the route mount left `src/bongos/routes.js`; `moduleLoader.mountModuleRoutes` discovers + mounts it now. Both directions are enforced by the BV1.R44/R45 fitness checks.
-
-## No port (the memory shape, not the economy shape)
-
-Unlike economy / security / builder-settings / onboarding, sessions registers **no kernel port** (`provides: []`) — exactly like `memory`. **Core never calls back into sessions:** the ship-time session-digest write is an **HTTP POST** to this module's own `/sessions` route (`scripts/gds/ship.js` → `POST /api/gds/sessions`), not a `require`. So there is nothing for a port to expose. The session-records db slice moved here cleanly with its sole consumer (the route).
-
-The **one outward edge** is the economy **`reward`** kernel port this module *consumes* (resolves, never imports): `upsertSessionRecordWithReward` (in `db.js`) and `POST /sessions` (in `routes/sessions.js`) both `seams.resolveOptional('reward')` — to award the cost-plus session token reward inside the upsert transaction (passing the tx `client`) and to sum the drachmae credited for the owned task(s). That is the kernel-mediated module↔module seam (ADR 0083 / 0093 §2).
-
-## Files
-
-| File | What |
-|---|---|
-| `db.js` | the `session_records` db slice — `upsertSessionRecord[WithReward]` (the token-reward txn resolves the `reward` port), `searchSessions` / `summarizeSessions` / `getSessionById` / `listSessionsByBuilder`, `filterTaskIdsClaimedBy`, the ORDER-BY whitelist + limit/offset clamps + the shared filter clause. Reaches Postgres via the doorway `pool` + `withTx`. |
-| `bfg.js` | the BFG's PURE scorers (`scoreInteractionQuality` / `scoreMemoryQuality`) + extractors + the thin `gatherInteractionSignals` DB gatherer (ADR 0026 §6B). Reads via the doorway (`pool`, `getBuilderById`, `builderRollingAvgGrade`). |
-| `pulse.js` | session-pulse + stale-claim heartbeat helpers (`recordPulse` / `sweepStaleClaims` / `getStaleClaimsForBuilder`). The CLI shell stays at `scripts/gds/pulse.js` and requires this lib directly. |
-| `routes/sessions.js` | `/sessions` (upload — carries its own 4 MB `express.json`; core `routes.js` still skips the global parser for that path), `/sessions/search` + `/sessions/:id` (Archon-gated cross-builder, fail-closed audited), `/sessions/mine`. |
-
-## Tables (owned, not moved)
-
-`session_records` (+ its migrations) was created before the module system and stays in core `migrations/` (the schema-migrations stem-key makes a later relocation a no-op). The module owns the *queries*; any **new** session migration belongs in `modules/sessions/migrations/` namespaced `sessions_*` (the additive rule). The `session_pulses` table (migration 006) is likewise shared-schema; pulse.js owns its queries.
-
-## NOT in this module
-
-- **`session_logs`** — the per-claim session LOG (the ship-time handoff record, `sealSessionLog`) stays in core `db.js` (lifecycle): it's written inside the claim/ship transaction and read by `routes/claims.js`/`builders.js`. Distinct from `session_records` (the BFG transcript corpus).
-- **`builder_sessions`** — the AUTH token table (`createSession`/`lookupSession`/…) is kernel (auth), not this domain.
-- **cost / reconcileSessionCosts** — the cost ledger + the session-cost reconciler graduated to [`modules/economy/`](../economy/CLAUDE.md) at BV1.R77. `scripts/gds/session-cost.js` (the SessionEnd cost hook) stays a CLI and posts to `/cost`.
-- **the session-domain CLIs** — `session.js`, `session-eval.js` (the 6D evaluator), `session-digest.js`, `session-cost.js`, `backfill-sessions.js`, `bfg-principal-token.js`, `repo-metrics.js`, `pulse.js` travel with the domain but stay under `scripts/` (a command travels with its domain — design 02§1). They're outside the kernel boundary, so `session-eval.js`'s sibling read of `modules/builder-settings/wandering-prefs` is fine (not a cross-module import — fitness scans `src/` + `modules/`, not `scripts/`).
-
-## Tests
-
-`tests/session_search.mjs` (ORDER-BY/clamp guards), `tests/session_caps.mjs` (SR-17 disk-fill bounds — route + db, with the `reward` port registered), `tests/session_eval.mjs` + `tests/session_506_regression.mjs` (the evaluator), `tests/session_digest.mjs` + `tests/session_records.mjs` (the ship-time digest), `tests/bfg*.mjs` (the scorers), `tests/backfill_sessions.mjs` import from `modules/sessions/…` or exercise it. `bfg`/`bfg_write`/`session_records`/`backfill_sessions` are DB-dependent (the `INTEGRATION` set in `run-unit-tests.js`).
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/modules/status-ui/CLAUDE.md

@@ -1,47 +1,15 @@
-# `status-ui` module — the public status dashboard ("The Watch")
+# @bongos/core — installed platform dependency (not your project's CLAUDE.md)
 
-> A CORE-domain carve (BV1.R84, [ADR 0093](../../docs/adr/<redacted>.md) §1) — the **first WEB-SURFACE module** ([02-module-map §6](../../docs/design/modular-architecture/02-module-map.md): "a web surface is first-class"). `default: true` — a Cloud Bongos instance ships its status page like it ships its hall, so it mounts unconditionally unless an instance disables it.
+This file is a placeholder shipped inside the **@bongos/core** package. The core's own
+internal agent notes are intentionally omitted from the published artifact so they cannot
+load into your instance's context.
 
-Owns the public build-status dashboard served at **`status.<apex>`** (`status.example.com`) — the live up/down banner, version-progress rollups, cost summary, recent ships, the leaderboard, and the kinds-of-work ecosystem fingerprint. A no-framework page (`status.js`) that polls the read-only `/api/gds/public/*` surface every 60s.
+**It does not govern this repository.** Your own root `CLAUDE.md`, your `.claude/`
+directory, and the live Bongos database are the source of truth for how work happens here
+and who may do what.
 
-## The shape: a static surface, not a backend domain
+You are seeing this only because an agent opened a file under `node_modules/@bongos/core/`.
+Nothing in here needs to be read to use the platform — run `bongos help` for commands.
 
-Unlike every prior tranche-2 carve (economy/ideas/security/…), this module has **no `.js`, no `db.js` slice, no kernel port, and no routes**. It is purely:
-- `public/` — the static dashboard (HTML/CSS/JS/cursors/snapshots), moved verbatim from the old repo-root `public-status/`.
-- `module.json` — declares one **`contributes.webSurfaces`** entry `{ host: "status.", dir: "public" }`.
-
-## The serving seam (how a web surface reaches its host with no core edit)
-
-The loader exposes `moduleWebSurfaces({ isEnabled })` ([`src/module-loader/loader.js`](../../src/module-loader/loader.js)) — the Host-routed twin of `hallWidgetScripts`/`mountModuleRoutes`. It returns `[{ key, host, dir(abs) }]` for each enabled module that declares `webSurfaces` **and** ships the directory on disk. `src/bongos/serve-internal.js` iterates that set and serves each surface on its `Host:` prefix with the **same** machinery the status page always used:
-- the in-memory **content-hash-stamped** index (`buildStampedHtml`, #521 — defeats Cloudflare's 4h TTL),
-- the per-instance **branding/theme injection** (`injectBrandingInto`),
-- fall-through to `express.static` for assets.
-
-`serve-internal.js` names **no module key** (kernel stays module-agnostic, [ADR 0083](../../docs/adr/<redacted>.md) §Decision #4); it routes purely off the manifest-declared `host` prefix. The `isStatusHost` export stays the literal `status.` predicate the entrypoints (`server.js`/`src/platform-server.js`) use to keep their apex tail off the status host; **inside** `mountInternalSurfaces` the generic `isModuleSurfaceHost` (any enabled web-surface host) is used, so the next carved surface (hall-UI, R85) needs no new guard.
-
-## The boundary
-
-This module reaches **nothing** in core (no doorway require — it has no JS). Core, in turn, must never `require()` a file in here — `serve-internal.js` resolves the surface through `loader.moduleWebSurfaces`, never an import of `modules/status-ui/*`. Both directions are enforced by the BV1.R44/R45 fitness checks.
-
-## The data it renders STAYS shared core (the judgment call)
-
-The `/api/gds/public/*` read endpoints the dashboard polls (`/public/uptime`, `/public/progress`, `/public/cost-summary`, `/public/grades`, `/public/recent-shipped`, `/public/leaderboard`, `/public/analytics/ecosystem`, `/public/tasks|ideas|blockers/:id`, plus `/versions/:id/done-when`) **did not move** — they live in `src/bongos/routes/public.js` and are consumed by the hall and the **off-box GitHub-Pages mirror** too, not just this surface. A public read shared by multiple surfaces is correctly core/shared, not status-exclusive (the same call the economy/ideas carves made for `routes/public.js`'s inline reads). So the carve moves the *surface*, not the reads it happens to render.
-
-## Off-box mirror (operational)
-
-The LIVE page is served **off the droplet** for outage resilience ([ADR 0029](../../docs/adr/<redacted>.md)) — GitHub Pages from `example-owner/example-status`, fed by `scripts/status-mirror-sync.js`. That script (status-UI domain tooling that travels with its domain but stays a CLI under `scripts/`, the sessions/autonomy precedent) was re-pointed at `modules/status-ui/public/`. **Follow-up:** `.github/workflows/sync-status-mirror.yml` still triggers on `public-status/**` and must be re-pointed at `modules/status-ui/public/**` by an owner/Archon (the GitHub App can't push workflow files — learning 107).
-
-## Files & tooling
-
-| Path | What |
-|---|---|
-| `public/index.html` · `public/status.js` · `public/style.css` | the dashboard (no build step, no framework) |
-| `public/cursors/` · `public/snapshots/` | bronze cursors + the world-render snapshots the page shows |
-| `public/README.md` | the surface's own notes (off-box mirror, asset cache-busting) |
-| `module.json` | `contributes.webSurfaces: [{ host: "status.", dir: "public" }]`; no port, no routes |
-
-Generators that WRITE into this surface live under `scripts/` and were re-pointed: `scripts/art/gen-cursors.py` (cursors), `scripts/snapshots/render-*.mjs` (snapshots), `scripts/status-mirror-sync.js` (off-box publish).
-
-## Tests
-
-The loader seam is covered in `tests/module_loader.mjs` (`moduleWebSurfaces` — enabled lists, disabled vanishes, declared-but-not-shipped skipped, plus the live status-ui surface); the manifest `webSurfaces` validation in `tests/module_manifest.mjs`; the carve discovery-key membership in `tests/fitness.mjs` / `tests/module_loader.mjs` / `tests/modules.mjs`; and the carve proof in `scripts/gds/coreB-carve-proof.sh` (leg 4h).
+_To work ON the platform core itself, use the standalone @bongos/core source repository,
+not this vendored copy._

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.17.0",
+  "version": "1.17.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.17.0",
+      "version": "1.17.2",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.17.0",
+  "version": "1.17.2",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",
@@ -10,7 +10,12 @@
   "exports": {
     ".": "./src/platform-server.js",
     "./serve-internal": "./src/bongos/serve-internal.js",
-    "./module-api": "./src/module-api.js"
+    "./module-api": "./src/module-api.js",
+    "./bongos/api-path-404": "./src/bongos/api-path-404.js",
+    "./bongos/uptime-poller": "./src/bongos/uptime-poller.js",
+    "./module-loader/loader": "./src/module-loader/loader.js",
+    "./modules": "./src/modules.js",
+    "./module-seams": "./src/module-seams.js"
   },
   "engines": {
     "node": ">=22"