@bongos/core 1.17.1 → 1.17.2

package/migrations/instance/183_gdsv4_carryover_themed_goals.sql

@@ -1,116 +0,0 @@
--- Migration 183 — Five themed goals for the GDS-V4 carryover (BONGOS-V1)
--- ============================================================================
--- Follow-up to ADR 0103 (migration 182): the ~72 still-relevant GDS-V4 tasks
--- carried into BONGOS-V1 were left goal-less. This gives the platform debt a
--- spine — five OUTCOME goals (ADR 0086 goal tier), each with done-when criteria,
--- and reparents the tasks under them. Evergreen chores + grader/economy/misc +
--- recent non-debt work are deliberately LEFT goal-less (they are not carryover
--- outcomes). Owner-directed 2026-07-02 (with Lars).
---
--- Goals are Archon-owned (created_by = 1), scope_modules empty (grouping goals,
--- not scope-walled; tasks attach here via this migration, not the API route).
--- Criteria start satisfied=false, so each goal stays 'open' until its work lands.
---
--- REVERSIBLE: only INSERTs (goals + criteria) and task goal_id UPDATEs. To undo,
--- NULL the goal_id on the affected tasks and DELETE the 5 goals + their criteria.
--- Idempotent: goal INSERTs are title-guarded, criteria use ON CONFLICT DO NOTHING,
--- task UPDATEs only touch still-goal-less rows.
--- ============================================================================
-
-BEGIN;
-
-DO $$
-DECLARE gid bigint;
-BEGIN
-  -- ---- G1: Build-pipeline integrity --------------------------------------
-  SELECT id INTO gid FROM goals WHERE version_id='BONGOS-V1' AND title='Build-pipeline integrity' LIMIT 1;
-  IF gid IS NULL THEN
-    INSERT INTO goals (version_id, title, description, scope_modules, created_by, status)
-    VALUES ('BONGOS-V1', 'Build-pipeline integrity',
-      'GDS-V4 carryover (ADR 0103): the system that builds Cloud Bongos never fails silently or carries known integrity holes — ship/merge/deploy, CI, the nightly backup, and the SEC-863 deploy-gate.',
-      '{}', 1, 'open')
-    RETURNING id INTO gid;
-  END IF;
-  INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, goal_id, sort_order) VALUES
-    ('BONGOS-V1','gcarry-pipe-loud','Every stage of ship->merge->deploy and the nightly DB backup fails LOUDLY (surfaces in CI or journald), never silently.',gid,10),
-    ('BONGOS-V1','gcarry-pipe-sec863','The SEC-863 deploy-gate has no known bypass: audit range anchored to last-successful-deploy, sub-Metic protected-path claims blocked at claim time, and each protected-path commit tied to a task in the main audit.',gid,20),
-    ('BONGOS-V1','gcarry-pipe-smoke','A full-stack integration smoke (server + Postgres) runs as a required PR check, and the flaky unit harness is isolated so a green run is trustworthy.',gid,30)
-  ON CONFLICT (version_id, criterion_id) DO NOTHING;
-  UPDATE tasks SET goal_id=gid, updated_at=now()
-   WHERE version_id='BONGOS-V1' AND goal_id IS NULL
-     AND id IN (1426,1427,1429,1431,1432,1433,1435,1436,1462,1479,1641,1703,1219,861,862,1140,1437,1440,1461,1434,723);
-
-  -- ---- G2: Builder experience — hall, dev box, and skills ----------------
-  SELECT id INTO gid FROM goals WHERE version_id='BONGOS-V1' AND title='Builder experience — hall, dev box, and skills' LIMIT 1;
-  IF gid IS NULL THEN
-    INSERT INTO goals (version_id, title, description, scope_modules, created_by, status)
-    VALUES ('BONGOS-V1', 'Builder experience — hall, dev box, and skills',
-      'GDS-V4 carryover (ADR 0103): everything a builder directly touches — the builders hall UI, the dev box + sandbox, and the day-to-day skills — works without needing Claude for routine actions.',
-      '{}', 1, 'open')
-    RETURNING id INTO gid;
-  END IF;
-  INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, goal_id, sort_order) VALUES
-    ('BONGOS-V1','gcarry-bx-hall','Core task actions (claim, release, ship-trigger, triage) and a task board work in the builders hall WITHOUT invoking the LLM.',gid,10),
-    ('BONGOS-V1','gcarry-bx-identity','A builder can view and edit their own profile, see works-completed, and read an efficiency-aware leaderboard.',gid,20),
-    ('BONGOS-V1','gcarry-bx-onramp','Newcomers never dead-end: auth/re-auth is browser-clickable and self-explanatory, and the dev box + sandbox are discoverable.',gid,30),
-    ('BONGOS-V1','gcarry-bx-box','A builder dev box + sandbox is robust: uncommitted work is not lost on reclaim, host-keys survive rebuilds, and staging is cross-platform.',gid,40)
-  ON CONFLICT (version_id, criterion_id) DO NOTHING;
-  UPDATE tasks SET goal_id=gid, updated_at=now()
-   WHERE version_id='BONGOS-V1' AND goal_id IS NULL
-     AND id IN (758,751,759,424,1466,1467,1468,1469,1471,1473,1474,1475,1476,1481,1482,594,1472,1715,1696,1650,1470,1391,1165,837,843,885,1477,1493,1430,1665);
-
-  -- ---- G3: Cloud Bongos productization and self-host ---------------------
-  SELECT id INTO gid FROM goals WHERE version_id='BONGOS-V1' AND title='Cloud Bongos productization and self-host' LIMIT 1;
-  IF gid IS NULL THEN
-    INSERT INTO goals (version_id, title, description, scope_modules, created_by, status)
-    VALUES ('BONGOS-V1', 'Cloud Bongos productization and self-host',
-      'GDS-V4 carryover (ADR 0103): someone other than the owner can run Cloud Bongos — a second instance, a real update channel, a clean vanilla boot, and hosting as a module.',
-      '{}', 1, 'open')
-    RETURNING id INTO gid;
-  END IF;
-  INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, goal_id, sort_order) VALUES
-    ('BONGOS-V1','gcarry-prod-customer2','A second instance (Mercury) runs live on a pinned Cloud Bongos core, with its own repo and GDS.',gid,10),
-    ('BONGOS-V1','gcarry-prod-upgrade','bongos upgrade is a real update-consumption channel for a two-repo consumer (not a stub).',gid,20),
-    ('BONGOS-V1','gcarry-prod-vanilla','A vanilla docker compose up boots clean: no instance/product seed data runs and no host-brand leaks, both gated in CI.',gid,30),
-    ('BONGOS-V1','gcarry-prod-hosting','Instance hosting (provision, manage, cost read-out) is available as a Cloud Bongos module.',gid,40)
-  ON CONFLICT (version_id, criterion_id) DO NOTHING;
-  UPDATE tasks SET goal_id=gid, updated_at=now()
-   WHERE version_id='BONGOS-V1' AND goal_id IS NULL
-     AND id IN (1689,1690,1326,1704,1706,1485,1619,1620,1621,1388,1439);
-
-  -- ---- G4: Findability — the grep path (ADR 0095) ------------------------
-  SELECT id INTO gid FROM goals WHERE version_id='BONGOS-V1' AND title='Findability — the grep path (ADR 0095)' LIMIT 1;
-  IF gid IS NULL THEN
-    INSERT INTO goals (version_id, title, description, scope_modules, created_by, status)
-    VALUES ('BONGOS-V1', 'Findability — the grep path (ADR 0095)',
-      'GDS-V4 carryover (ADR 0103 / ADR 0095): a repo agents navigate by literal search, with meaning written into the source rather than an embedding index.',
-      '{}', 1, 'open')
-    RETURNING id INTO gid;
-  END IF;
-  INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, goal_id, sort_order) VALUES
-    ('BONGOS-V1','gcarry-find-docstrings','The docstring / module-header convention is rolled out across the codebase and guarded by a fitness/density check so it cannot rot.',gid,10),
-    ('BONGOS-V1','gcarry-find-why','Code rationale (the why) is surfaced forward-facing, and the AST/tree-sitter repo-map upgrade is decided.',gid,20)
-  ON CONFLICT (version_id, criterion_id) DO NOTHING;
-  UPDATE tasks SET goal_id=gid, updated_at=now()
-   WHERE version_id='BONGOS-V1' AND goal_id IS NULL
-     AND id IN (1654,1655,1656,1657,1659,848);
-
-  -- ---- G5: Autonomy groundwork -------------------------------------------
-  SELECT id INTO gid FROM goals WHERE version_id='BONGOS-V1' AND title='Autonomy groundwork' LIMIT 1;
-  IF gid IS NULL THEN
-    INSERT INTO goals (version_id, title, description, scope_modules, created_by, status)
-    VALUES ('BONGOS-V1', 'Autonomy groundwork',
-      'GDS-V4 carryover (ADR 0103): safe unattended routines — guardrails first, then arm the safe set.',
-      '{}', 1, 'open')
-    RETURNING id INTO gid;
-  END IF;
-  INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, goal_id, sort_order) VALUES
-    ('BONGOS-V1','gcarry-auto-guardrails','An off-droplet spend ceiling, a scoped file-only automation token, and a hall kill-switch all exist.',gid,10),
-    ('BONGOS-V1','gcarry-auto-armed','The cloud-routine execution environment is verified and the safe routine set is armed behind the autonomy flag.',gid,20)
-  ON CONFLICT (version_id, criterion_id) DO NOTHING;
-  UPDATE tasks SET goal_id=gid, updated_at=now()
-   WHERE version_id='BONGOS-V1' AND goal_id IS NULL
-     AND id IN (1393,1394,1395,1396);
-END $$;
-
-COMMIT;

package/migrations/instance/186_bongos_v1_governance_planning_seed.sql

@@ -1,69 +0,0 @@
--- 186_bongos_v1_governance_planning_seed.sql  (migrations/instance/ — OTB scope-truth)
--- Planning session (2026-07-03): the BONGOS-V1 "Governance — configurable roles &
--- permissions" goal + its six done-when criteria.
---
--- WHY THIS LIVES IN migrations/instance/ (ADR 0105 / selfhost-boot gate):
--- versions/goals/done_when_criteria are OTB scope-truth, NOT platform-universal
--- schema. In migrations/ root they would seed a vanilla third-party self-host with
--- OTB's governance criteria (the selfhost-boot VANILLA assertion: a fresh DB seeds
--- ZERO scope-truth). Here, migrate.sh applies the file only when the OWNING instance
--- opts in (GDS_APPLY_INSTANCE_SEEDS=1); a vanilla self-host skips the whole dir.
---
--- DR-SAFE: the goal was first created via the API (a runtime row), so a from-scratch
--- owning-instance replay would have no goal to parent the criteria under. This
--- migration recreates the goal idempotently (title-guard) so replay stays whole and
--- so it is a no-op on prod (where goal 30 already exists). Mirrors migration 183.
---
--- The 25 tasks (BV1.R90-R114) + dependency graph are seeded by
--- scripts/gds/seed-governance-tasks.js after this deploys (so the slugs resolve).
-
-BEGIN;
-
-DO $do$
-DECLARE gid bigint;
-BEGIN
-  SELECT id INTO gid FROM goals
-    WHERE version_id = 'BONGOS-V1'
-      AND title = 'Governance — configurable roles & permissions'
-    LIMIT 1;
-
-  IF gid IS NULL THEN
-    INSERT INTO goals (version_id, title, description, scope_modules, created_by, status)
-    VALUES (
-      'BONGOS-V1',
-      'Governance — configurable roles & permissions',
-      $desc$A core, Discord-style roles-and-permissions system where PERMISSIONS are the atomic primitive and ranks become seeded roles. Adds first-class principals (machine identities), session-scopes (box tokens), ownership-scoped permissions, and a governance-owned protected-surface registry (policy owns / substrate enforces). Capability lives in core (modules/governance/, default:true); per-project settings split config/governance.json (over neutral) + governance_* DB tables. Ships an Archon-only Governance hall tab (assign + toggle; system permissions locked). Preserves the ADR 0016 trust boundary end-to-end. Protected-scope (kernel/lifecycle) -> Archon-mediated.$desc$,
-      '{kernel,lifecycle,hall-ui}',
-      1,
-      'open'
-    )
-    RETURNING id INTO gid;
-  END IF;
-
-  INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, goal_id, sort_order) VALUES
-  ('BONGOS-V1', 'gov-perms-atom',
-   $md$**Permissions become the atom; ranks become seeded roles — with zero day-one behavior change.** Authority stops being a fixed rank threshold and becomes a resolved set of granular permissions. Done when: a code-defined permission catalog exists (each permission flagged `system` or not, since permissions map to real routes and cannot be UI-invented); a per-request, uncached resolver returns a builder's effective permission set as the union of their roles (preserving ADR 0016); four seeded roles (`xenos`/`thetes`/`metic`/`archon`) reproduce today's thresholds exactly; a `requirePermission()` gate exists alongside `requireRank`; and a parity test proves every builder resolves to exactly today's powers (behavior-identical at ship).$md$,
-   gid, 20),
-  ('BONGOS-V1', 'gov-gates-permissioned',
-   $md$**Every DB-resolvable authority gate reads permissions, not rank.** Rank stops being special everywhere the server decides access. Done when: the ~60 HTTP route gates migrate `requireRank(...)` -> `requirePermission(...)`; claim eligibility (`xenosClaimAllowed`/`rankAllowsTask`/per-task floor), the page-level gates, and the wandering-prefs clamp are re-expressed as permissions; the ~6 duplicated numeric rank-tier maps collapse into the single resolver; and the `route-rank-check` fitness function is updated to assert permission gates so nothing silently regresses.$md$,
-   gid, 21),
-  ('BONGOS-V1', 'gov-full-model',
-   $md$**The complete authority model is represented — not just role -> permission.** The 2026-07-03 authority sweep proved Cloud Bongos authority runs on ~7 mechanisms, not one. Done when: first-class **principals** (machine identities like the BFG memory-writer and the Discord bot, keyed on `system_role`, never UI-grantable) are modeled; **session-scopes** (box-scoped tokens, deny-by-default) are a first-class capability distinct from a builder's roles; **ownership-scoped** permissions ("act on *own* X" — own box/memory/credentials/claim) are expressible; and the **protected-surface registry** (today's `PROTECTED_GLOBS` / `EXPECTED_RANKS`) becomes governance-owned *data* while the out-of-band substrate (git hooks, CI, GitHub branch protection, SSH) stays the *enforcer* — policy owns, substrate enforces.$md$,
-   gid, 22),
-  ('BONGOS-V1', 'gov-core-project-split',
-   $md$**Capability lives in core; settings live per project.** The governance engine is portable to any Cloud Bongos instance; each project keeps its own governance data. Done when: `modules/governance/` is a `default:true` core module with its own `governance_*` additive migrations and a resolver exposed through a kernel port; role *templates/defaults* ship as `config/governance.json` resolved over a `config/governance.neutral.json` (the branding pattern); live role/permission/assignment *data* lives in the DB; and a fresh vanilla instance boots with sane neutral defaults and no OTB identity.$md$,
-   gid, 23),
-  ('BONGOS-V1', 'gov-archon-tab',
-   $md$**The Archon Governance tab — assign + toggle.** The owner can configure governance from the builders' hall, Discord-style. Done when: an Archon-only Governance tab lets you view/edit the ~12 operational permissions per role, create custom roles, and assign roles to builders; `system` permissions render **locked** (visible but not grantable); and the tab is gated in depth at the page layer (`serve-internal`), the API layer (`governance.manage`), and pinned in `route-rank-check`.$md$,
-   gid, 24),
-  ('BONGOS-V1', 'gov-boundary-proof',
-   $md$**The trust boundary provably holds — with a live proof and the docs corrected.** This criterion de-risks the whole goal: no amount of governance configuration can weaken production safety. Done when: an abuse-matrix test proves no configurable role/permission can grant a low-trust builder deploy or protected-path access; a live demonstration creates a custom role granting an operational permission (it works) while a `system` permission stays enforced by substrate; an ADR records the "permissions-as-atom + principals + session-scopes + protected-surface registry, policy-owns/substrate-enforces" decision; and the stale ADR 0043 / canonical-permissions.md branch-protection claims are fixed (GitHub branch protection is now live).$md$,
-   gid, 25)
-  ON CONFLICT (version_id, criterion_id) DO UPDATE
-    SET criterion_md = EXCLUDED.criterion_md,
-        goal_id      = EXCLUDED.goal_id,
-        sort_order   = EXCLUDED.sort_order;
-END
-$do$;
-
-COMMIT;

package/scripts/gds/art-stage.js

@@ -1,152 +0,0 @@
-#!/usr/bin/env node
-// scripts/gds/art-stage.js — after the art pipeline writes modules/art-pipeline/generated/tiles/,
-// rebuild the atlas the game client loads and surface it on the builder's own
-// sandbox live preview (ADR 0044/0052) in ONE command (#1067). Today the loop is
-// generate -> manually rebuild the atlas -> manually restart -> manually refresh;
-// this collapses the last three into one step (and #1065's auto-reload then
-// refreshes the open tab on its own).
-//
-// Internal-track tooling. It does NOT regenerate art (generation costs $ and is a
-// separate, reviewed step), does NOT touch prod, and does NOT commit anything.
-//
-//   node scripts/gds/art-stage.js                 # rebuild atlas + surface on the sandbox
-//   node scripts/gds/art-stage.js --no-build      # skip the atlas rebuild, just restart + print
-//   node scripts/gds/art-stage.js --tiles "a b c" # label the affected tiles explicitly
-//
-// On a BOX the preview serves /workspace (box-game-preview.service), but a Claude
-// session edits a git worktree, so we copy the rebuilt public/assets/tiles into
-// /workspace before restarting (self-contained; does not depend on the #1068 ship
-// gate's worktree sync). It deliberately does NOT write the sandbox-stage REVIEW
-// marker — surfacing art for a look is not the same as recording a ship sign-off.
-
-const path = require('node:path');
-const fs = require('node:fs');
-const { execFileSync } = require('node:child_process');
-const sandbox = require('./sandbox-stage');
-
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-const BOX_SERVED_ROOT = '/workspace';
-const PY = process.env.PYTHON || 'python3';
-const HEALTH_TIMEOUT_MS = 90_000;
-const HEALTH_POLL_MS = 2_000;
-
-// Rebuild public/assets/tiles + the content-hashed atlas from modules/art-pipeline/generated/tiles/.
-// build_tilesheet.py copies the per-tile PNGs and calls build_atlas at its tail.
-function rebuildAtlas(deps = {}) {
-  const run = deps.execFileSync || execFileSync;
-  run(PY, [path.join(REPO_ROOT, 'modules/art-pipeline/pipeline/build_tilesheet.py')], { cwd: REPO_ROOT, stdio: 'inherit' });
-}
-
-// On a box, the preview serves /workspace/public, not the session worktree. Copy
-// the rebuilt tiles tree across so the sandbox shows the new art. No-op when the
-// session checkout IS the served root (running directly in /workspace, or a
-// laptop where the local preview serves the worktree). Best-effort: returns
-// { copied, reason? }.
-function copyAtlasToServed(deps = {}) {
-  const f = deps.fs || fs;
-  const servedRoot = deps.servedRoot || BOX_SERVED_ROOT;
-  const repoRoot = deps.repoRoot || REPO_ROOT;
-  if (path.resolve(repoRoot) === path.resolve(servedRoot)) return { copied: false, reason: 'session checkout is the served checkout' };
-  const from = path.join(repoRoot, 'public/assets/tiles');
-  const to = path.join(servedRoot, 'public/assets/tiles');
-  if (!f.existsSync(from) || !f.existsSync(servedRoot)) return { copied: false, reason: 'no served checkout / no tiles to copy' };
-  try {
-    f.cpSync(from, to, { recursive: true });
-    return { copied: true, to };
-  } catch (e) {
-    return { copied: false, reason: e.message };
-  }
-}
-
-// The tiles this run touched: an explicit --tiles list (the orchestrator knows
-// the family members) or a git diff of public/assets/tiles (standalone runs).
-function affectedTiles(explicit, deps = {}) {
-  if (explicit && explicit.trim()) return explicit.trim().split(/\s+/);
-  const run = deps.execFileSync || execFileSync;
-  try {
-    const out = run('git', ['status', '--porcelain', '--', 'public/assets/tiles'], { cwd: deps.repoRoot || REPO_ROOT, encoding: 'utf8' });
-    return out.split('\n').map((l) => l.slice(3).trim()).filter(Boolean);
-  } catch {
-    return [];
-  }
-}
-
-async function waitHealthy(healthUrl, deps = {}) {
-  const fetchImpl = deps.fetchImpl || fetch;
-  const deadline = Date.now() + (deps.timeoutMs || HEALTH_TIMEOUT_MS);
-  while (Date.now() < deadline) {
-    try {
-      const res = await fetchImpl(healthUrl, { signal: AbortSignal.timeout(5_000) });
-      if (res.status < 500) return true;
-    } catch { /* keep polling */ }
-    await new Promise((r) => setTimeout(r, deps.pollMs || HEALTH_POLL_MS));
-  }
-  return false;
-}
-
-function printSurfacedBlock(url, tiles, log = console.log) {
-  const bar = '─'.repeat(64);
-  log('');
-  log(bar);
-  log('  🎨 NEW ART IS LIVE ON YOUR SANDBOX');
-  log('');
-  log(`      ${url}`);
-  log('');
-  if (tiles.length) log(`  Affected: ${tiles.join(', ')}`);
-  log('  Open the link to see it in-game. (With the auto-reload from task 1065,');
-  log('  an already-open tab refreshes itself.)');
-  log(bar);
-  log('');
-}
-
-async function main(argv = process.argv.slice(2), deps = {}) {
-  const noBuild = argv.includes('--no-build');
-  const tilesArg = (() => { const i = argv.indexOf('--tiles'); return i >= 0 ? argv[i + 1] : ''; })();
-  const log = deps.log || console.log;
-
-  if (!noBuild) {
-    log('Rebuilding the atlas from modules/art-pipeline/generated/tiles/ ...');
-    rebuildAtlas(deps);
-  }
-
-  const ctx = (deps.resolvePreviewContext || sandbox.resolvePreviewContext)(deps);
-  if (!ctx) {
-    log('Atlas rebuilt into public/assets/tiles/. No sandbox here to surface it on');
-    log('(not a dev box, and this clone has no local game preview).');
-    return { ok: true, surfaced: false, reason: 'no sandbox' };
-  }
-  if (!ctx.url) {
-    log('Atlas rebuilt. This box is on the quick tunnel (no preview hostname) — no sandbox URL to open (ADR 0044).');
-    return { ok: true, surfaced: false, reason: 'no preview URL' };
-  }
-
-  if (ctx.kind === 'box') {
-    const c = copyAtlasToServed(deps);
-    if (c.copied) log(`  copied the rebuilt tiles into ${deps.servedRoot || BOX_SERVED_ROOT} so the sandbox serves them`);
-    else log(`  (atlas copy skipped: ${c.reason})`);
-  }
-
-  log(`Restarting the ${ctx.kind} preview to pick up the new atlas...`);
-  try {
-    ctx.restart(deps);
-  } catch (e) {
-    log(`  could not restart the preview (${e.message}); the atlas is rebuilt — restart manually to see it.`);
-    return { ok: false, surfaced: false, reason: e.message };
-  }
-  const healthy = await waitHealthy(ctx.healthUrl, deps);
-  if (!healthy) {
-    log('  preview did not come back healthy in time — check its logs; the atlas is rebuilt.');
-    return { ok: false, surfaced: false, reason: 'preview unhealthy' };
-  }
-  printSurfacedBlock(ctx.url, affectedTiles(tilesArg, deps), log);
-  return { ok: true, surfaced: true, url: ctx.url };
-}
-
-module.exports = { rebuildAtlas, copyAtlasToServed, affectedTiles, waitHealthy, main };
-
-if (require.main === module) {
-  main().then((r) => process.exit(r && r.ok === false ? 1 : 0)).catch((e) => {
-    console.error('art-stage error:', e.message);
-    process.exit(1);
-  });
-}

package/server.js

@@ -1,212 +0,0 @@
-const http = require('http');
-const path = require('path');
-const express = require('express');
-const { Server, matchMaker } = require('colyseus');
-const { WebSocketTransport } = require('@colyseus/ws-transport');
-const { isApiShapedPath, apiNotFoundBody } = require('./src/bongos/api-path-404');
-const uptimePoller = require('./src/bongos/uptime-poller');
-const moduleLoader = require('./src/module-loader/loader');
-const { mountInternalSurfaces, isStatusHost } = require('./src/bongos/serve-internal');
-const { isModuleEnabled } = require('./src/modules');
-const seams = require('./src/module-seams');
-
-const PORT = Number(process.env.PORT) || 3000;
-const HOST = process.env.HOST || '127.0.0.1';
-
-const app = express();
-app.disable('x-powered-by');
-// Behind Cloudflare → Caddy → Node. Trust the immediate proxy so
-// req.secure / x-forwarded-proto reflect reality for OAuth callbacks.
-app.set('trust proxy', 1);
-
-// All non-game surfaces — /healthz, /version, /api/gds, the Dev Box download
-// redirects, and the status + builders hosts — are served by the shared internal
-// surface module (ADR 0062 R51, task 1190). This also calls mountModuleRoutes,
-// which runs each enabled module's route factory — including the game module's,
-// which registers the game.staticRoot / game.registerRooms / game.precreateWorldRoom
-// seam ports before the code below resolves them (ADR 0083 / BV1.R49).
-// Mounted before the game tail below so /builders/* + the status host
-// short-circuit ahead of the game static middleware.
-mountInternalSurfaces(app);
-
-app.use((req, res, next) => {
-  // From here down: only the game host. Skip if request was for the status
-  // host (it should already be handled, but defense in depth).
-  if (isStatusHost(req)) return res.status(404).type('text/plain').send('not found');
-  next();
-});
-
-app.use(
-  '/vendor/phaser.min.js',
-  express.static(path.join(__dirname, 'node_modules/phaser/dist/phaser.min.js'), {
-    maxAge: '1d',
-  })
-);
-
-app.use(
-  '/vendor/colyseus.js',
-  express.static(path.join(__dirname, 'node_modules/colyseus.js/dist/colyseus.js'), {
-    maxAge: '1d',
-  })
-);
-
-// Game static files — served from the game module's public/ dir (modules/game/public/).
-// The path is provided by the game module via the game.staticRoot seam port, registered
-// by modules/game/routes/game.js when the loader runs mountModuleRoutes above.
-// If the game module is disabled (vanilla Cloud Bongos boot) these blocks are simply
-// skipped — no game assets served, no 404.html, no client JS. The platform API still
-// works via mountInternalSurfaces above.
-const _gameStaticRoot = seams.resolveOptional('game.staticRoot');
-if (_gameStaticRoot) {
-  const gamePublic = _gameStaticRoot();
-
-  // Tile-asset cache strategy (task #55 + #160 + #176).
-  //
-  // Three buckets:
-  //   1. Content-hashed atlas (atlas-<sha8>.png + atlas-<sha8>.json if any)
-  //      Filename changes with content → safe to cache forever. Marked
-  //      immutable so browsers / CF skip revalidation entirely.
-  //   2. Stable-URL files paired with bucket 1 (atlas-index.json, manifest.json,
-  //      atlas.json). URLs don't change across deploys but contents do, so
-  //      they get a short TTL — a deploy is visible within ~1 minute. atlas.json
-  //      lives here because tilePalette.js still hardcodes its URL; until the
-  //      build hashes it (idea_inbox follow-up), the short TTL is what prevents
-  //      the post-deploy "new PNG + stale frame coords" mismatch window.
-  //   3. Legacy unhashed per-tile PNGs + everything else under /assets/tiles
-  //      Short TTL (5 min) until they migrate to content-hashed names. The
-  //      old 1-day TTL is what caused the 2026-05-10 stale-atlas incident.
-  app.use(
-    '/assets/tiles',
-    express.static(path.join(gamePublic, 'assets/tiles'), {
-      setHeaders: (res, filePath) => {
-        const name = path.basename(filePath);
-        if (/^atlas-[a-f0-9]{8,}\.(png|json)$/.test(name)) {
-          res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
-        } else if (
-          name === 'atlas-index.json' ||
-          name === 'manifest.json' ||
-          name === 'atlas.json'
-        ) {
-          res.setHeader('Cache-Control', 'public, max-age=60');
-        } else {
-          res.setHeader('Cache-Control', 'public, max-age=300');
-        }
-      },
-    })
-  );
-
-  // HTML + game JS — short TTL so deploys are visible quickly. .js files in
-  // game/ are not content-hashed today (V1 shortcut), so a long TTL would
-  // compound the stale-art class of bugs into stale-code bugs.
-  app.use(
-    express.static(gamePublic, {
-      extensions: ['html'],
-      setHeaders: (res, filePath) => {
-        if (/\.(html|js|json)$/.test(filePath)) {
-          res.setHeader('Cache-Control', 'public, max-age=60');
-        } else {
-          res.setHeader('Cache-Control', 'public, max-age=300');
-        }
-      },
-    })
-  );
-}
-
-// Themed 404 for the game host. Anything that didn't resolve to an API route,
-// the status/builders hosts, or a static file lands here.
-// The status host has its own plain-text 404 above; we don't poach it.
-// API-SHAPED paths get a JSON 404 with a corrective hint — never the HTML island
-// page — so a caller that missed the /api/gds mount (curl /tasks, /gds/*, an
-// /api/* typo) gets a self-describing error instead of HTML that JSON.parse-faults
-// on the client (V4.R14 / #952). The match is broader than the old `/api/` test:
-// it also catches the bare GDS resource roots a human hits without the prefix.
-app.use((req, res) => {
-  if (isStatusHost(req)) return res.status(404).type('text/plain').send('not found');
-  res.status(404);
-  if (isApiShapedPath(req.path)) {
-    return res.json(apiNotFoundBody(req.path));
-  }
-  if (req.method === 'GET' && req.accepts('html')) {
-    res.setHeader('Cache-Control', 'public, max-age=60');
-    const gameStaticRoot = seams.resolveOptional('game.staticRoot');
-    if (gameStaticRoot) {
-      return res.sendFile(path.join(gameStaticRoot(), '404.html'));
-    }
-    return res.type('text/plain').send('404 — not found');
-  }
-  return res.type('text/plain').send('404 — you have washed ashore on the wrong island');
-});
-
-const httpServer = http.createServer(app);
-
-const gameServer = new Server({
-  transport: new WebSocketTransport({ server: httpServer }),
-});
-
-// The PRODUCT/game rooms (world + queue) — registered via the game module's seam
-// port (game.registerRooms), wired by modules/game/routes/game.js at loader mount
-// time. Only called when the game module is enabled (OTB does; vanilla skips).
-// The game-less platform entrypoint (src/platform-server.js) never constructs a
-// Colyseus server at all. The builders' hall live channel is NOT a Colyseus room —
-// it rides the SSE endpoint (src/bongos/routes/live.js, ADR 0069).
-const _registerRooms = seams.resolveOptional('game.registerRooms');
-if (_registerRooms) {
-  _registerRooms(gameServer);
-} else {
-  console.log('[game] game module disabled — no Colyseus rooms registered');
-}
-
-uptimePoller.start();
-
-// task 1134 — the server-owned publish reconciler (drives 'confirmed' tasks whose
-// branch has merged + deployed to 'shipped' on a timer, ADR 0055). CARVED into the
-// lifecycle module at BV1.R86 (ADR 0093 §1): it now starts via the loader's
-// startModulePollers (a declared poller — modules/lifecycle/pollers/publish-
-// reconciler.js), in the listen callback below alongside the Discord bot + routine
-// timers — so server.js no longer reaches into the lifecycle module to start it.
-// No-op without a push credential (local dev/tests); kill-switch via
-// PUBLISH_RECONCILER_DISABLED. Unref'd timers, best-effort — never takes the
-// game/API down.
-
-// task 1382 (ADR 0078 amendment) — server-internal routine timers (peer-vote-tally,
-// weekly, in-process; no model, no external cron). CARVED into the autonomy module
-// at BV1.R83 (ADR 0093 §1): it now starts via the loader's startModulePollers (a
-// declared poller — modules/autonomy/pollers/routine-timers.js), in the listen
-// callback below alongside the Discord bot poller. server.js is still the only
-// startModulePollers caller (not the game-less platform entrypoint), so a second
-// always-on instance can't double-run. Kill-switch ROUTINE_TIMERS_DISABLED stays.
-
-httpServer.listen(PORT, HOST, async () => {
-  console.log(`Amazonprimea listening on ${HOST}:${PORT}`);
-  // Pre-create the singleton WorldRoom so clients can use
-  // `client.join('world')` (existing-only, no auto-create on overflow). The
-  // precreate function is provided by the game module via the seam port
-  // game.precreateWorldRoom; idempotent + failure-tolerant.
-  const _precreate = seams.resolveOptional('game.precreateWorldRoom');
-  if (_precreate) {
-    await _precreate(matchMaker);
-  }
-
-  // Start each ENABLED module's web-process background pollers through the loader
-  // — module-agnostic: it requires modules/<key>/pollers/<name>.js and fires
-  // start(). The Discord bot (ADR 0033) is one such poller; a vanilla instance
-  // with discord off simply has no poller to start, and never reads a webhook/bot
-  // token. Non-blocking + failure-isolated by the loader (a poller problem must
-  // never take the game/API down) — the module-agnostic successor to the
-  // hardcoded discordBot.start() block (ADR 0083 / BV1.R47, task 1416).
-  moduleLoader.startModulePollers({}, { isEnabled: isModuleEnabled });
-});
-
-// Graceful shutdown — stop the in-process pollers, then stop each module poller
-// (e.g. close the Discord gateway socket cleanly on a systemd restart / Ctrl-C so
-// we don't leave a zombie session for Discord to reap). stopModulePollers awaits
-// each stop and isolates errors, so a stuck poller never blocks the exit (BV1.R47).
-for (const sig of ['SIGTERM', 'SIGINT']) {
-  process.on(sig, () => {
-    // The publish reconciler + routine timers now stop via
-    // moduleLoader.stopModulePollers() — the lifecycle module's publish-reconciler
-    // poller (carved BV1.R86) + the autonomy module's routine-timers poller
-    // (carved BV1.R83 / ADR 0093 §1).
-    moduleLoader.stopModulePollers().finally(() => process.exit(0));
-  });
-}