@bongos/core 1.17.1 → 1.17.2

package/src/bongos/auth.js

@@ -230,7 +230,20 @@ async function startDeviceFlow() {
   // device_code silently produced a broken flow / an opaque 500 (the 2026-07-08 demo
   // login failure). Mirror the token-exchange guard (data.error, above); task 2126.
   if (data.error) {
-    throw new Error(`GitHub rejected device-flow start: ${data.error}${data.error_description ? ` — ${data.error_description}` : ''}`);
+    // device_flow_disabled is self-inflicted + common: GitHub defaults Device Flow OFF on new
+    // Apps and the one-click manifest can't enable it (task 2129). Make the CLI error self-
+    // service by naming the right settings surface. We hold only client_id here (not the app
+    // slug — that lives on the control plane), so we can't build /settings/apps/<slug>; but the
+    // id PREFIX distinguishes a GitHub App (Iv*) from an OAuth App (Ov*), which picks the right
+    // listing to open.
+    let hint = '';
+    if (data.error === 'device_flow_disabled') {
+      const where = /^Iv/i.test(creds.client_id || '')
+        ? 'https://github.com/settings/apps (org-owned apps: https://github.com/organizations/<org>/settings/apps)'
+        : 'https://github.com/settings/developers';
+      hint = ` — terminal sign-in needs Device Flow enabled on the app: open ${where}, open your app, check "Enable Device Flow", and save. Web sign-in is unaffected.`;
+    }
+    throw new Error(`GitHub rejected device-flow start: ${data.error}${data.error_description ? ` — ${data.error_description}` : ''}${hint}`);
   }
   if (!data.device_code) {
     throw new Error('GitHub device/code returned no device_code (unexpected response shape).');

package/src/bongos/serve-internal.js

@@ -318,7 +318,16 @@ function mountInternalSurfaces(app) {
   // confirmation can commit-PIN (deployedCommit === mergeCommit) rather than only
   // checking liveness via /healthz. Low-sensitivity (a public commit sha).
   app.get('/version', (_req, res) => {
-    res.json(buildInfo());
+    // coreVersion — the @bongos/core doorway version this process is running
+    //   (src/module-api CORE_VERSION), read lazily to avoid a load-time cycle
+    //   (module-api requires build-info at load, so a top-level require here
+    //   would be circular). Additive: lets fleet/upgrade tooling confirm which
+    //   core an instance actually materialized after a `bongos upgrade`,
+    //   alongside the deployed git commit below. (Added in 1.17.2, task 2148 —
+    //   the throwaway `updateCanary` proof marker was removed in phase E.)
+    let coreVersion = null;
+    try { coreVersion = require('../module-api').CORE_VERSION; } catch { /* fail-soft: version unknown */ }
+    res.json({ ...buildInfo(), coreVersion });
   });
 
   // Generated typed client for classic <script> web pages (task 1996 / R09).

package/src/branding.js

@@ -42,6 +42,7 @@ const ENV_OVERRIDES = [
   ['BUILDERS_ORIGIN', ['domains', 'buildersOrigin']],
   ['STATUS_ORIGIN', ['domains', 'statusOrigin']],
   ['OAUTH_ORIGIN', ['domains', 'oauthOrigin']],
+  ['PROVISIONING_ORIGIN', ['domains', 'provisioningOrigin']],
   ['COOKIE_DOMAIN', ['domains', 'cookieDomain']],
 ];
 

package/src/module-api.js

@@ -188,8 +188,19 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         REQUIRED because 1.17.0 was already published to npm and task 2121 shipped
 //         without one, so `bongos package-core --publish` on 1.17.0 would be rejected as a
 //         re-publish. Every `^1.x` / `^1.17` module pin is satisfied by 1.17.1.
+// 1.17.2 — task 2148 (canary upgrade-proof on demo.cloudbongos.com): a controlled
+//         PATCH bump used to round-trip the real `bongos upgrade` channel on the live
+//         demo instance with an OBSERVABLE code marker (the channel shipped in 1.16.0
+//         and was proven on emersonian-circles by task 1976, but never on demo with a
+//         served marker). No doorway export is added, changed, or removed — the exported
+//         surface is byte-identical to 1.17.1. What changed: the served /version payload
+//         now carries `coreVersion` (the running doorway version — a PERMANENT additive
+//         read so upgrade/fleet tooling can confirm which core an instance materialized),
+//         plus a THROWAWAY `updateCanary` marker removed in the phase-E follow-up. A
+//         backwards-compatible additive change with no API removal is exactly semver
+//         PATCH. Every `^1.x` / `^1.17` module pin is satisfied by 1.17.2.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.17.1'; // see the changelog above — 1.17.1 republishes the artifact with the task-2121 agent-doc stub (no doorway change) (task 2124)
+const CORE_VERSION = '1.17.2'; // see the changelog above — 1.17.2 is the task-2148 canary upgrade-proof bump (adds /version coreVersion; no doorway export change)
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/module-loader/loader.js

@@ -19,11 +19,42 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { validateManifest } = require('./manifest-schema');
 const { satisfies } = require('./semver');
-const { resolveCoreRoot } = require('../instance-config');
+const { resolveCoreRoot, resolveInstanceRoot } = require('../instance-config');
 
-// ADR 0108 §1: modules/ ships WITH the core package. resolveCoreRoot() returns
-// the repo root today, so this is byte-identical for the live instance.
-const DEFAULT_ROOTS = [path.join(resolveCoreRoot(), 'modules')];
+// Collapse roots that resolve to the SAME absolute path, preserving order.
+// Normalizes via path.resolve so a cwd that arrives with a trailing '.'/'//'
+// segment still dedupes against the core root. Returns the resolved (canonical)
+// paths. (Exported for the loader tests.)
+function dedupeRoots(roots) {
+  const out = [];
+  const seen = new Set();
+  for (const r of roots) {
+    const key = path.resolve(r);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(key);
+  }
+  return out;
+}
+
+// ADR 0108 §1 + task 2133 (R89-prereq): discovery must span TWO roots — the core
+// PACKAGE's own modules/ (resolveCoreRoot()) AND the consumer/instance's own
+// modules/ (resolveInstanceRoot()). Post-split the host modules (game /
+// art-pipeline / provisioning) live at the instance root and are EXCLUDED from
+// the @bongos/core package, so a core-only scan boots a split instance with none
+// of its host modules.
+//
+// DEDUP BY RESOLVED PATH IS MANDATORY. In a single checkout resolveInstanceRoot()
+// falls back to process.cwd(), which equals resolveCoreRoot() (the repo root), so
+// the two candidates are the SAME directory. discoverModules() treats a repeated
+// module KEY as a hard ERROR (not a skip), so scanning one root twice would turn
+// every module into a "duplicate module key" error. dedupeRoots() collapses the
+// coincident roots, so a single checkout scans ONE root (byte-identical to
+// before) while a diverged split scans BOTH.
+const DEFAULT_ROOTS = dedupeRoots([
+  path.join(resolveCoreRoot(), 'modules'),
+  path.join(resolveInstanceRoot(), 'modules'),
+]);
 
 // Lazy — avoids an eval-time require cycle (modules.js → loader → module-api →
 // auth → …). By call time the graph is loaded; falls back to the known initial
@@ -263,6 +294,7 @@ module.exports = {
   stopModulePollers,
   loaderSnapshot,
   coreVersion,
+  dedupeRoots,
   DEFAULT_ROOTS,
   _reset,
 };

package/src/module-loader/manifest-schema.js

@@ -30,7 +30,11 @@
 //     },
 //     "provides":      ["reward"],      // OPTIONAL. seam PORTS this module registers a provider for.
 //     "consumes":      ["grade"],       // OPTIONAL. seam ports this module resolves (required capabilities).
-//     "prerequisites": { "modules": ["economy"] }  // OPTIONAL. other modules that must be enabled.
+//     "prerequisites": { "modules": ["economy"] },  // OPTIONAL. other modules that must be enabled.
+//     "dependencies":  { "discord.js": "^14.26.4" }  // OPTIONAL. external npm deps this module needs at
+//                                       //   runtime. Core stays lean (express+pg, ADR 0108); a bundled
+//                                       //   module that needs more declares it HERE, and the consumer
+//                                       //   composes the deps of the modules it ENABLES (ADR 0138).
 //   }
 //
 // validateManifest(obj) -> { valid, errors[], manifest } — pure, no I/O.
@@ -126,6 +130,17 @@ function validateManifest(obj) {
     }
   }
 
+  // --- optional runtime npm dependencies (ADR 0138 / task 2160) ---
+  // A bundled module's own external npm deps. @bongos/core stays lean (express+pg, ADR 0108);
+  // a module that needs more (e.g. discord.js) declares it here, and the consumer composes the
+  // deps of the modules it ENABLES (scripts/gds/init.js). Shape: { "<npm-name>": "<semver-range>" }.
+  if ('dependencies' in obj) {
+    const d = obj.dependencies;
+    if (!isObj(d) || !Object.entries(d).every(([k, v]) => isStr(k) && isStr(v))) {
+      E('dependencies: must be an object of { "<npm-name>": "<semver-range>" } string pairs');
+    }
+  }
+
   return { valid: errors.length === 0, errors, manifest: errors.length === 0 ? obj : null };
 }
 

package/tests/branding.mjs

@@ -52,6 +52,17 @@ test('env override is ignored when empty', () => {
   assert.equal(b.domains.publicOrigin, 'https://amazonprimea.com');
 });
 
+test('provisioningOrigin: optional, passes through config, env-overridable (task 2101)', () => {
+  // Not required — unset resolves to undefined, and callers fall back to publicOrigin.
+  assert.equal(resolveBranding({ neutral: NEUTRAL, instance: OTB }).domains.provisioningOrigin, undefined);
+  // Set in the instance pack, it survives the deep-merge.
+  const inst = resolveBranding({ neutral: NEUTRAL, instance: { ...OTB, domains: { ...OTB.domains, provisioningOrigin: 'https://get.cloudbongos.com' } } });
+  assert.equal(inst.domains.provisioningOrigin, 'https://get.cloudbongos.com');
+  // And <PREFIX>_PROVISIONING_ORIGIN beats config (same precedence as the other origins).
+  const env = resolveBranding({ neutral: NEUTRAL, instance: OTB, env: { OTB_PROVISIONING_ORIGIN: 'https://get.cloudbongos.com' } });
+  assert.equal(env.domains.provisioningOrigin, 'https://get.cloudbongos.com');
+});
+
 test('missing required field throws', () => {
   assert.throws(() => resolveBranding({ neutral: { identity: { productName: 'X' } } }), /missing required field/);
 });

package/tests/claim_error_surface.mjs

@@ -0,0 +1,107 @@
+// tests/claim_error_surface.mjs
+//
+// task 1476 — a failed /builder-claim must read as GUIDANCE, not a raw object
+// dump. The API returns the R01 error envelope (ADR 0116):
+//   { error: { code, message, details } }
+// so claim.js's old `r.data.error === 'CODE'` string branches all silently
+// missed (error is now an object) and the refusal printed as `[object Object]`.
+// This exercises the pure formatClaimFailure() surface DB-free, over BOTH the
+// current envelope shape and the legacy flat shape.
+//
+// Run:  node tests/claim_error_surface.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { formatClaimFailure } = require('../scripts/gds/claim.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const envelope = (code, details = {}, message = code, status = 409) => ({
+  status,
+  data: { error: { code, message, details } },
+});
+const text = (r) => r.lines.join('\n');
+
+// The regression guard: no refusal may ever render a raw object.
+t('never dumps [object Object] for any known code', () => {
+  const codes = [
+    'stage_required', 'session_already_has_active_claim', 'session_claim_check_failed',
+    'newcomer_must_ship_first', 'ALREADY_CLAIMED', 'MODULE_CONFLICT',
+    'TOUCHES_CONFLICT', 'TASK_NOT_READY', 'TASK_NOT_FOUND', 'DEPS_NOT_SHIPPED',
+    'some_unmapped_future_code',
+  ];
+  for (const c of codes) {
+    const out = text(formatClaimFailure(envelope(c, { active_task_id: 5 }, 'msg'), 12));
+    assert.ok(!out.includes('[object Object]'), `${c} produced a raw object dump`);
+    assert.ok(out.trim().length > 0, `${c} produced no output`);
+  }
+});
+
+// The core 1476 case: one-claim-per-session refusal is guidance + teaches parallel.
+t('session_already_has_active_claim: names the in-flight task and teaches parallelism', () => {
+  const out = text(formatClaimFailure(
+    envelope('session_already_has_active_claim', {
+      active_task_id: 42, active_task_title: 'Foo', what_to_do: 'ship 42 first',
+    }), 99));
+  assert.match(out, /#42/, 'should name the in-flight task id');
+  assert.match(out, /Foo/, 'should name the in-flight task title');
+  assert.match(out, /ship 42 first/, 'should relay the server what_to_do');
+  assert.match(out, /PARALLEL/i, 'should teach how to parallelize');
+  assert.match(out, /worktree|bulk-claim/i, 'should point at separate worktree or bulk-claim');
+});
+
+t('session_claim_check_failed shares the same guidance branch', () => {
+  const out = text(formatClaimFailure(envelope('session_claim_check_failed', {}), 3));
+  assert.match(out, /active claim/i);
+  assert.match(out, /PARALLEL/i);
+});
+
+// Envelope + legacy flat shape must BOTH resolve the code + fields.
+t('TASK_NOT_READY: envelope shape reads details.currentStatus + hint', () => {
+  const out = text(formatClaimFailure(
+    envelope('TASK_NOT_READY', { currentStatus: 'backlog', hint: 'promote it first' }), 7));
+  assert.match(out, /not ready/i);
+  assert.match(out, /backlog/);
+  assert.match(out, /promote it first/);
+});
+
+t('TASK_NOT_READY: legacy flat shape still resolves', () => {
+  const flat = { status: 409, data: { error: 'TASK_NOT_READY', currentStatus: 'blocked' } };
+  const out = text(formatClaimFailure(flat, 7));
+  assert.match(out, /not ready/i);
+  assert.match(out, /blocked/);
+});
+
+t('DEPS_NOT_SHIPPED: lists each blocking dependency', () => {
+  const out = text(formatClaimFailure(
+    envelope('DEPS_NOT_SHIPPED', { deps: [{ id: 10, status: 'ready', title: 'Dep A' }] }), 8));
+  assert.match(out, /#10/);
+  assert.match(out, /Dep A/);
+});
+
+t('MODULE_CONFLICT + TOUCHES_CONFLICT: list conflicting task titles', () => {
+  const mc = text(formatClaimFailure(
+    envelope('MODULE_CONFLICT', { module_key: 'economy', conflictTaskTitles: ['Bar'] }), 4));
+  assert.match(mc, /economy/);
+  assert.match(mc, /Bar/);
+  const tc = text(formatClaimFailure(
+    envelope('TOUCHES_CONFLICT', { conflictTaskTitles: ['Baz'] }), 4));
+  assert.match(tc, /Baz/);
+});
+
+t('unknown code: fallback carries code + message, exit 1', () => {
+  const r = formatClaimFailure(envelope('weird_thing', {}, 'boom', 500), 1);
+  assert.equal(r.exit, 1);
+  assert.match(text(r), /weird_thing/);
+  assert.match(text(r), /boom/);
+});
+
+console.log(`\nclaim_error_surface: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/claude_materialize.mjs

@@ -108,6 +108,26 @@ t('materializeClaude: copies + rewrites skills into a fresh instance dir (no lef
   rmSync(dir, { recursive: true, force: true });
 });
 
+t('materializeClaude: materializes scheduled-tasks — bodies→bongos, companions keep _core-resolve (task 2138)', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'w3-rt-'));
+  const res = m.materializeClaude({ coreRoot: ROOT, instanceDir: dir, dryRun: false });
+  assert.ok(res.scheduledTasks > 0, 'at least one scheduled-task file materialized');
+  const rt = join(dir, '.claude', 'scheduled-tasks');
+  assert.ok(existsSync(rt), '.claude/scheduled-tasks created in the instance');
+  // A prose/judgment body's core invocation is bongosified so a consumer-layout model can run it.
+  const stale = readFileSync(join(rt, 'stale-claim-release', 'SKILL.md'), 'utf8');
+  assert.ok(stale.includes('bongos exec scripts/gds/pulse.js'), 'body core-invocation rewritten to bongos exec');
+  assert.ok(!stale.includes('node scripts/gds/pulse.js'), 'no bare relative node scripts/gds left in the body');
+  // A deterministic routine's `.claude/...` companion-step command is NOT a core invocation → preserved.
+  const dd = readFileSync(join(rt, 'diagram-drift', 'SKILL.md'), 'utf8');
+  assert.ok(dd.includes('node .claude/scheduled-tasks/diagram-drift/check.js'), 'companion-path step command preserved');
+  // Companion .js resolves its core require()s via the materialized _core-resolve.js sibling (task 2139 pattern).
+  const check = readFileSync(join(rt, 'diagram-drift', 'check.js'), 'utf8');
+  assert.ok(check.includes("require('../../hooks/_core-resolve.js')"), 'companion resolves core via _core-resolve');
+  assert.ok(!check.includes("require('../../../scripts/gds/"), 'no bare ../../../scripts/gds require left in the companion');
+  rmSync(dir, { recursive: true, force: true });
+});
+
 t('materializeClaude: SELF-COPY guard — target === core root is a no-op (byte-identical for the live instance)', () => {
   const res = m.materializeClaude({ coreRoot: ROOT, instanceDir: ROOT, dryRun: false });
   assert.equal(res.skipped, true, 'materializing onto the core root must skip');

package/tests/consumer_layout_boot.mjs

@@ -0,0 +1,302 @@
+// tests/consumer_layout_boot.mjs
+//
+// R89-prereq CI proof (task 2142): boot @bongos/core from a REAL consumer layout —
+// the packaged .tgz installed into node_modules, with the instance's OWN content
+// (config / modules / .claude) sitting at a DIFFERENT root — and prove the two-root
+// module loader (task 2133) discovers modules from BOTH roots.
+//
+// WHY THIS EXISTS. Every existing gate runs the SOURCE tree with all deps present:
+//   - tests/platform_boot.mjs imports src/platform-server.js straight from the repo;
+//   - tests/fitness_two_root.mjs diverges resolveInstanceRoot() to a temp dir but
+//     keeps cwd/core = the real repo (resolveCoreRoot() is still __dirname/..).
+// NONE installs the packaged core into a tree whose instance root is elsewhere —
+// which is exactly why the pre-2133 single-root loader gap was invisible: a
+// core-only scan boots a split instance with none of its host modules, and no test
+// ever exercised that shape. This harness closes the blind spot end to end.
+//
+// WHAT IT PROVES (the two-root checks all go RED against the pre-2133 loader):
+//   1. package  — scripts/gds/package-core.js builds an installable .tgz.
+//   2. install  — `npm install <tgz>` lands it at node_modules/@bongos/core.
+//   3. roots    — resolveCoreRoot() is UNDER node_modules/@bongos/core while
+//                 resolveInstanceRoot() is the consumer tree: two DIFFERENT dirs, so
+//                 a green result can never be a same-directory coincidence.
+//   4. boot     — `node node_modules/@bongos/core/src/platform-server.js` serves
+//                 /healthz 200 (the game-less core boots from the package).
+//   5. two-root — discoverModules() loads a module resolved from the CORE modules
+//                 dir AND the consumer-probe module resolved from the INSTANCE
+//                 modules dir, with zero errors. A single-root loader physically
+//                 cannot find consumer-probe → this IS the task-2133 done-when.
+//   6. fitness  — the packaged fitness.js discoveredModuleKeys() spans both roots.
+//   7. gen-file-map — reads the INSTANCE root (lists the consumer's .claude/skills).
+//   8. gen-repo-map — maps CORE code (scripts/gds/fitness.js) from node_modules.
+//
+// This is an INTEGRATION harness (a package build + `npm install` + a live boot), so
+// it is EXCLUDED from the DB-free unit gate (scripts/gds/run-unit-tests.js INTEGRATION
+// set) and driven by .github/workflows/consumer-layout-boot.yml. It needs NO Postgres
+// (/healthz, the loader, fitness, and the generators are all DB-free). Re-runnable:
+//   node tests/consumer_layout_boot.mjs                                  # builds a fresh core .tgz
+//   CORE_TGZ=/abs/path/bongos-core-x.y.z.tgz node tests/consumer_layout_boot.mjs   # reuse a prebuilt one
+
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import net from 'node:net';
+import { spawn, spawnSync } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync, realpathSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const NPM_BIN = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+const CORE_VERSION_RANGE = '^1.0.0'; // consumer-probe's coreVersion — satisfied by any 1.x core.
+
+let passed = 0;
+let failed = 0;
+function check(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e && e.message ? e.message : e}`); }
+}
+
+// Run a node snippet in `cwd` and parse its stdout as JSON. Used to introspect the
+// INSTALLED core (its loader / fitness / generators) exactly as a consumer process
+// would resolve them — absolute paths are injected so the snippet never depends on
+// the snippet file's own location (mirrors tests/fitness_two_root.mjs).
+function runNodeJSON(snippet, cwd) {
+  const r = spawnSync(process.execPath, ['-e', snippet], { cwd, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+  if (r.status !== 0) {
+    throw new Error(`node snippet exited ${r.status}\n--- stdout ---\n${r.stdout}\n--- stderr ---\n${r.stderr}`);
+  }
+  try { return JSON.parse(r.stdout); }
+  catch { throw new Error(`snippet stdout was not JSON:\n${r.stdout}\n--- stderr ---\n${r.stderr}`); }
+}
+
+function freePort() {
+  return new Promise((resolve, reject) => {
+    const srv = net.createServer();
+    srv.on('error', reject);
+    srv.listen(0, '127.0.0.1', () => {
+      const { port } = srv.address();
+      srv.close(() => resolve(port));
+    });
+  });
+}
+
+function getHealthz(port) {
+  return new Promise((resolve) => {
+    const req = http.get({ host: '127.0.0.1', port, path: '/healthz', timeout: 2000 }, (res) => {
+      let body = '';
+      res.on('data', (c) => (body += c));
+      res.on('end', () => resolve({ status: res.statusCode, body }));
+    });
+    req.on('error', () => resolve(null));
+    req.on('timeout', () => { req.destroy(); resolve(null); });
+  });
+}
+
+async function waitForHealthz(port, timeoutMs = 20000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const res = await getHealthz(port);
+    if (res) return res;
+    await new Promise((r) => setTimeout(r, 300));
+  }
+  return null;
+}
+
+async function main() {
+  console.log('=== consumer-layout boot proof (task 2142): install @bongos/core, boot it, assert two-root module load ===');
+
+  const workRoot = mkdtempSync(join(tmpdir(), 'consumer-layout-'));
+  const consumer = join(workRoot, 'consumer');
+  let child = null;
+
+  try {
+    // --- 1. package -----------------------------------------------------------
+    // Build the installable core .tgz from HEAD (the committed tree — so on a PR the
+    // job packages exactly the code under review). Reuse a prebuilt one via CORE_TGZ.
+    let tgz = process.env.CORE_TGZ || '';
+    check('package: scripts/gds/package-core.js builds an installable .tgz', () => {
+      if (tgz) { assert.ok(existsSync(tgz), `CORE_TGZ does not exist: ${tgz}`); return; }
+      const outDir = join(workRoot, 'dist');
+      const r = spawnSync(process.execPath, [join(REPO_ROOT, 'scripts/gds/package-core.js'), '--out-dir', outDir],
+        { cwd: REPO_ROOT, encoding: 'utf8', maxBuffer: 256 * 1024 * 1024 });
+      assert.equal(r.status, 0, `package-core exited ${r.status}\n${r.stderr}`);
+      const pinLine = r.stdout.trim().split('\n').filter(Boolean).pop();
+      const pin = JSON.parse(pinLine);
+      tgz = join(outDir, pin.tarball.name);
+      assert.ok(existsSync(tgz), `packaged tarball missing: ${tgz}`);
+    });
+    if (!tgz || !existsSync(tgz)) { throw new Error('cannot continue without a core tarball'); }
+
+    // --- build the consumer tree: instance content at its OWN root -------------
+    // A minimal-but-real Cloud Bongos consumer: a bongos.config.json pointing the
+    // instance root at itself, a HOST module (consumer-probe) that is NOT part of
+    // @bongos/core, and an instance-owned .claude/skills dir. The host module is the
+    // crux: it can only be discovered via resolveInstanceRoot(), so finding it proves
+    // the second root is scanned.
+    mkdirSync(consumer, { recursive: true });
+    writeFileSync(join(consumer, 'package.json'), `${JSON.stringify({
+      name: 'consumer-layout-probe',
+      version: '0.0.0',
+      private: true,
+      description: 'Ephemeral @bongos/core consumer used by the R89 two-root CI proof (task 2142).',
+      dependencies: { '@bongos/core': `file:${tgz}` },
+    }, null, 2)}\n`);
+    writeFileSync(join(consumer, 'bongos.config.json'), `${JSON.stringify({ instanceRoot: '.' }, null, 2)}\n`);
+    // A tiny instance CLAUDE.md (the charter heading keeps fitness's budget check happy
+    // if anything reads it) — makes the tree a realistic instance, not load-bearing here.
+    writeFileSync(join(consumer, 'CLAUDE.md'),
+      '# Consumer probe instance\n\n## Working with this file (content charter)\n\nEphemeral fixture for the task-2142 two-root CI proof.\n');
+    mkdirSync(join(consumer, 'config'), { recursive: true });
+    writeFileSync(join(consumer, 'config', 'branding.json'), `${JSON.stringify({
+      configDir: 'cloudbongos', envPrefix: 'CLOUDBONGOS',
+      identity: { productName: 'Consumer Probe' },
+    }, null, 2)}\n`);
+    // The host module — a valid manifest, key === dir name, coreVersion any 1.x.
+    mkdirSync(join(consumer, 'modules', 'consumer-probe'), { recursive: true });
+    writeFileSync(join(consumer, 'modules', 'consumer-probe', 'module.json'), `${JSON.stringify({
+      key: 'consumer-probe',
+      title: 'Consumer Probe',
+      description: 'A host module that ships only in the instance repo, never in @bongos/core.',
+      coreVersion: CORE_VERSION_RANGE,
+      contributes: {},
+    }, null, 2)}\n`);
+    // Instance-owned .claude/skills (gen-file-map lists the instance root's skills).
+    mkdirSync(join(consumer, '.claude', 'skills', 'consumer-probe-skill'), { recursive: true });
+    writeFileSync(join(consumer, '.claude', 'skills', 'consumer-probe-skill', 'SKILL.md'),
+      '# consumer-probe-skill\n\nInstance-owned skill fixture for the task-2142 proof.\n');
+    mkdirSync(join(consumer, '.claude', 'scheduled-tasks'), { recursive: true });
+
+    // --- 2. install -----------------------------------------------------------
+    const coreDir = join(consumer, 'node_modules', '@bongos', 'core');
+    check('install: npm install lands the core at node_modules/@bongos/core', () => {
+      const r = spawnSync(NPM_BIN, ['install', '--no-audit', '--no-fund', '--loglevel=error'],
+        { cwd: consumer, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+      assert.equal(r.status, 0, `npm install exited ${r.status}\n${r.stderr}`);
+      assert.ok(existsSync(join(coreDir, 'package.json')), 'node_modules/@bongos/core/package.json missing');
+      assert.ok(existsSync(join(coreDir, 'src', 'platform-server.js')), 'installed core has no src/platform-server.js');
+      assert.ok(existsSync(join(coreDir, 'modules')), 'installed core ships no modules/ dir');
+    });
+    if (!existsSync(coreDir)) { throw new Error('cannot continue without an installed core'); }
+
+    const A = (p) => JSON.stringify(join(coreDir, p)); // absolute path into the installed core, JSON-quoted
+
+    // --- 3. roots diverge -----------------------------------------------------
+    // The whole proof is meaningless if the two roots secretly coincide, so pin that
+    // down first: core resolves UNDER node_modules/@bongos/core, instance is the
+    // consumer tree, and they are different directories.
+    check('roots: resolveCoreRoot() (node_modules) and resolveInstanceRoot() (consumer) are distinct', () => {
+      const r = runNodeJSON(`
+        const ic = require(${A('src/instance-config.js')});
+        process.stdout.write(JSON.stringify({ core: ic.resolveCoreRoot(), inst: ic.resolveInstanceRoot() }));
+      `, consumer);
+      // Compare realpaths — the child's process.cwd() resolves symlinks (e.g. macOS
+      // /var → /private/var), so match that rather than the raw tmp path we created.
+      assert.ok(r.core.includes(join('node_modules', '@bongos', 'core')), `core root not under node_modules: ${r.core}`);
+      assert.equal(r.inst, realpathSync(consumer), `instance root should be the consumer tree, got ${r.inst}`);
+      assert.notEqual(r.core, r.inst, 'core root and instance root must be different directories');
+    });
+
+    // --- 4. boot + /healthz ---------------------------------------------------
+    const port = await freePort();
+    child = spawn(process.execPath, [join(coreDir, 'src', 'platform-server.js')], {
+      cwd: consumer,
+      env: { ...process.env, PORT: String(port), HOST: '127.0.0.1' },
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let childErr = '';
+    child.stderr.on('data', (c) => { childErr += c; });
+    child.stdout.on('data', () => {});
+    const health = await waitForHealthz(port);
+    check('boot: node node_modules/@bongos/core/src/platform-server.js serves /healthz 200', () => {
+      assert.ok(health, `/healthz never came up on port ${port}\n--- server stderr ---\n${childErr.slice(-2000)}`);
+      assert.equal(health.status, 200, `/healthz status ${health.status}`);
+      assert.equal(health.body.trim(), 'ok', `/healthz body was "${health.body}"`);
+    });
+
+    // --- 5. two-root module load (the task-2133 done-when) --------------------
+    // The real default scan (DEFAULT_ROOTS) PLUS an explicit single-root scan that
+    // reproduces the pre-2133 loader shape — so the job doesn't just PASS today, it
+    // proves it would go RED if the loader regressed to one root ("done when: green
+    // AND would RED against the pre-B1 loader").
+    const disc = runNodeJSON(`
+      const path = require('node:path');
+      const loader = require(${A('src/module-loader/loader.js')});
+      const ic = require(${A('src/instance-config.js')});
+      const coreModulesDir = path.join(ic.resolveCoreRoot(), 'modules');
+      const instModulesDir = path.join(ic.resolveInstanceRoot(), 'modules');
+      const dflt = loader.discoverModules();                                      // real DEFAULT_ROOTS
+      const single = loader.discoverModules({ roots: [coreModulesDir] });         // pre-2133: core root only
+      const two = loader.discoverModules({ roots: [coreModulesDir, instModulesDir] });
+      const hasProbe = (r) => r.loaded.some((m) => m.key === 'consumer-probe');
+      process.stdout.write(JSON.stringify({
+        coreModulesDir, instModulesDir,
+        loaded: dflt.loaded.map((m) => ({ key: m.key, dir: m.dir })),
+        errors: dflt.errors,
+        singleRootHasProbe: hasProbe(single),
+        twoRootHasProbe: hasProbe(two),
+      }));
+    `, consumer);
+    check('two-root: discoverModules() loads modules from BOTH the core AND the instance root, zero errors', () => {
+      assert.deepEqual(disc.errors, [], `loader reported errors: ${JSON.stringify(disc.errors)}`);
+      const fromCore = disc.loaded.filter((m) => m.dir.startsWith(disc.coreModulesDir));
+      const fromInstance = disc.loaded.filter((m) => m.dir.startsWith(disc.instModulesDir));
+      assert.ok(fromCore.length > 0,
+        `no module resolved from the CORE root (${disc.coreModulesDir}) — the package shipped no modules?`);
+      const probe = fromInstance.find((m) => m.key === 'consumer-probe');
+      assert.ok(probe,
+        `consumer-probe was NOT loaded from the INSTANCE root (${disc.instModulesDir}) — a single-root (pre-2133) loader would miss it. loaded=${JSON.stringify(disc.loaded.map((m) => m.key))}`);
+    });
+    check('counterfactual: a single-root (pre-2133) scan MISSES consumer-probe — proves this job reds on regression', () => {
+      assert.equal(disc.twoRootHasProbe, true, 'two-root scan must find consumer-probe (sanity)');
+      assert.equal(disc.singleRootHasProbe, false,
+        'a core-only scan found consumer-probe — the instance module must be invisible to a single root, or this job could not RED against the pre-B1 loader');
+    });
+
+    // --- 6. fitness spans both roots -----------------------------------------
+    check('fitness: discoveredModuleKeys() unions the core + instance module roots', () => {
+      const r = runNodeJSON(`
+        const f = require(${A('scripts/gds/fitness.js')});
+        process.stdout.write(JSON.stringify({ keys: f.discoveredModuleKeys() }));
+      `, consumer);
+      assert.ok(r.keys.includes('consumer-probe'),
+        `fitness.discoveredModuleKeys() missing the instance module 'consumer-probe': ${JSON.stringify(r.keys)}`);
+      // At least one KNOWN core module must also be present (core root scanned too).
+      const coreKeys = disc.loaded.filter((m) => m.dir.startsWith(disc.coreModulesDir)).map((m) => m.key);
+      assert.ok(coreKeys.some((k) => r.keys.includes(k)),
+        `fitness keys carry no core module (expected some of ${JSON.stringify(coreKeys)}): ${JSON.stringify(r.keys)}`);
+    });
+
+    // --- 7. gen-file-map reads the INSTANCE root ------------------------------
+    check('gen-file-map: buildModel() lists the INSTANCE root .claude/skills (consumer-probe-skill)', () => {
+      const model = runNodeJSON(`
+        const g = require(${A('scripts/gds/gen-file-map.js')});
+        process.stdout.write(JSON.stringify(g.buildModel()));
+      `, consumer);
+      const skills = model.find((s) => s.id === 'skills');
+      assert.ok(skills, 'gen-file-map produced no skills section');
+      const names = skills.entries.map((e) => e.name);
+      assert.deepEqual(names, ['consumer-probe-skill'],
+        `gen-file-map read the wrong .claude/skills (expected only the consumer's): ${JSON.stringify(names)}`);
+    });
+
+    // --- 8. gen-repo-map reads the CORE root ----------------------------------
+    check('gen-repo-map: buildModel() maps CORE code (scripts/gds/fitness.js) from node_modules', () => {
+      const model = runNodeJSON(`
+        const g = require(${A('scripts/gds/gen-repo-map.js')});
+        const m = g.buildModel();
+        process.stdout.write(JSON.stringify({ files: m.files.length, hasFitness: m.byFile.some((f) => f.rel === 'scripts/gds/fitness.js') }));
+      `, consumer);
+      assert.ok(model.files > 50, `core scan found too few files (${model.files}) — core root not resolved to the package?`);
+      assert.equal(model.hasFitness, true, 'gen-repo-map did not map the core file scripts/gds/fitness.js');
+    });
+  } finally {
+    if (child && child.exitCode === null) { try { child.kill('SIGTERM'); } catch { /* already gone */ } }
+    try { rmSync(workRoot, { recursive: true, force: true }); } catch { /* best-effort */ }
+  }
+
+  console.log(`\nconsumer_layout_boot: ${passed} passed, ${failed} failed`);
+  process.exit(failed ? 1 : 0);
+}
+
+main().catch((e) => { console.error(e); process.exit(1); });