@bongos/core 1.19.1032 → 1.19.1034

package/scripts/gds/provision-repo-auth.js

@@ -140,10 +140,25 @@ async function lookupInstanceRow(instanceDir, deps = {}) {
   } catch { return null; }
 }
 
+// What upgrade.js's pin push says when lookupInstanceRow found NO row on a checkout wired
+// with a read-only deploy key (task 1004065). PURE.
+//
+// That pairing is NOT the origin path the header above describes. The key says this is a
+// hosted private project (ADR 0176), and its own database never has the provisioning row
+// (ADR 0281) — so the owner's token cannot be looked up here, and the remote the push
+// falls back to cannot write. Silence made that indistinguishable from a misconfiguration.
+// A missing row anywhere else IS the origin path and stays quiet, which is why the caller
+// only asks for this line when the key is present. Lives here rather than beside its
+// caller because upgrade.js sits exactly at the oversized-file ratchet.
+function missingRowNote(key, remote = 'origin') {
+  return `  • pin push: no provisioning row is readable from this database, so the owner's GitHub token cannot be looked up here — and ${remote} is the read-only deploy key at ${key}. A hosted project's own database never has that row (ADR 0281); the deploy door pushes the pin from the hub instead (task 1004065).`;
+}
+
 module.exports = {
   instanceRepoRemote,
   instanceRepoRemotes,
   lookupInstanceRow,
+  missingRowNote,
   parseTargetRef,
   resolveOwnerGithubToken,
 };

package/scripts/gds/provision.js

@@ -1308,7 +1308,7 @@ async function cmdRunIntents(deps) {
           await db.query(`UPDATE provisioning_intents SET state='pending', last_error=$2, updated_at=now() WHERE id=$1`, [intent.id, result.error || 'op failed']);
         }
         errors++;
-      } else { await provisioning.resolveIntent(db, intent.id, 'done', null); ok++; }
+      } else { await provisioning.resolveIntent(db, intent.id, 'done', (result && result.doneNote) || null); ok++; } // done WITH a note: it landed, and this is what it could not finish (task 1004065)
     } catch (e) {
       await provisioning.resolveIntent(db, intent.id, 'error', e.message).catch(() => {});
       // Surface the failure on the instance too, so a stuck instance is visible.

package/scripts/gds/publish-credential-check.js

@@ -16,6 +16,9 @@
 // vetoes a git-history-proven land). This tells you whether you are relying on that
 // fallback instead of a real deploy gate.
 //
+// For WHETHER each credential is set at all (names only, no network), see its sibling
+// scripts/gds/credential-presence.js and the inventory in docs/credentials.md (task 1002880).
+//
 // Exit codes: 0 = credential can read Actions (gate is real, or the workflow is
 // legitimately absent), 1 = BLIND (remediation printed), 2 = nothing to check.
 

package/scripts/gds/push-main.js

@@ -3,7 +3,7 @@
 //
 // This is the deploy step of the GRADED GDS pipeline: ship.js's auto-merge and
 // /merge-mode call it after a task has passed the grader + the Archon-only
-// confirm gate. It carries the OTB_ALLOW_MAIN_PUSH override so the SEC #863
+// confirm gate. It carries the <PREFIX>_ALLOW_MAIN_PUSH override so the SEC #863
 // pre-push hook lets the legitimate, already-gated pipeline land main while
 // still blocking an ad-hoc `git push origin main` (the Builder 25 move).
 //
@@ -22,11 +22,22 @@
 'use strict';
 
 const { execFileSync } = require('node:child_process');
+const { envPrefix } = require('../../src/instance-config');
+
+// The push's environment: the caller's, plus the override under its CANONICAL
+// spelling for this instance — <PREFIX>_ALLOW_MAIN_PUSH, BONGOS_ on a vanilla
+// instance (task 1001441). The hook reads it through resolveEnv, where the
+// canonical name is tried first; writing the legacy OTB_ spelling instead would
+// still work until the legacy prefixes retire, and would earn a deprecation
+// warning on every deploy push in the meantime.
+function pushEnv(env = process.env) {
+  return { ...env, [`${envPrefix()}_ALLOW_MAIN_PUSH`]: '1' };
+}
 
 function pushMain(extra = []) {
   execFileSync('git', ['push', 'origin', 'main', ...extra], {
     stdio: 'inherit',
-    env: { ...process.env, OTB_ALLOW_MAIN_PUSH: '1' },
+    env: pushEnv(),
     shell: false,
   });
 }
@@ -42,4 +53,4 @@ if (require.main === module) {
   }
 }
 
-module.exports = { pushMain };
+module.exports = { pushMain, pushEnv };

package/scripts/gds/push-path-brief.js

@@ -30,7 +30,8 @@
 //   node scripts/gds/push-path-brief.js          # human-readable: which path + why
 //   node scripts/gds/push-path-brief.js --line   # ONE line or nothing; always exit 0
 //
-// Detection override (tests / forcing): OTB_PUSH_VIA_SERVER=1 (server) / =0 (local).
+// Detection override (tests / forcing): <PREFIX>_PUSH_VIA_SERVER=1 (server) / =0 (local)
+// — BONGOS_PUSH_VIA_SERVER on a vanilla instance; the legacy OTB_ spelling is still read.
 
 const { hasFlag } = require('./cli-lib');
 const { plainCardLines } = require('./plain-cards');
@@ -56,7 +57,7 @@ function briefLine(via) {
 // ---- detection ---------------------------------------------------------------
 
 // Lazy require so a broken or partial checkout degrades to silence, not a stack
-// trace injected into the session. pushVia() honors OTB_PUSH_VIA_SERVER, else
+// trace injected into the session. pushVia() honors <PREFIX>_PUSH_VIA_SERVER, else
 // probes for an authenticated gh (absent on every box → 'server' instantly).
 function detectVia() {
   return require('./ship-deploy-target.js').pushVia();

package/scripts/gds/redteam-patrol.js

@@ -5,7 +5,7 @@
 // The patrol is the third enforcement layer (prevent → gate → PATROL): checks
 // too slow, too networked, or too history-wide for the merge gate, run weekly
 // by the .claude/scheduled-tasks/redteam-weekly routine. It is ADVISORY by
-// doctrine (ADR 0162 — verdicts never self-execute): findings are FILED as
+// doctrine (ADR 0158 §2 — a verdict never self-executes): findings are FILED as
 // security reports for Archon adjudication, never turned into gates here.
 //
 // Checks (all deterministic — no model reads anything):
@@ -40,7 +40,7 @@
 // log. Instead --file preflights the session and, when there is none, follows the
 // main-audit.js --require-roster doctrine: report LOUDLY rather than green-and-
 // vacuous. The exit code says whether a finding was LOST, not whether findings
-// exist — findings are advisory (ADR 0162) and a patrol that goes red merely for
+// exist — findings are advisory (ADR 0158 §2) and a patrol that goes red merely for
 // doing its job trains everyone to ignore it:
 //
 //   ran + filed                     → 0
@@ -271,7 +271,7 @@ function buildClassReport(className, findings, notes = []) {
     target: `redteam-patrol/${className}`,
     severity: maxSeverity(findings),
     title: `[patrol] ${className}: ${findings.length} finding(s)`,
-    description: `Weekly deterministic red-team patrol (task 1003128; advisory per ADR 0162 — adjudicate, then fix via ordinary tasks).`,
+    description: `Weekly deterministic red-team patrol (task 1003128; advisory per ADR 0158 §2 — adjudicate, then fix via ordinary tasks).`,
     repro_steps_md: body,
   };
 }
@@ -289,7 +289,7 @@ function stepSummary(md) {
 // that disposition deserves. Extracted so the honest-exit contract is a table a
 // test can enumerate rather than branching buried in main().
 //
-// The load-bearing row is the last one. Findings are ADVISORY (ADR 0162), so a
+// The load-bearing row is the last one. Findings are ADVISORY (ADR 0158 §2), so a
 // run that finds three things and files them is a SUCCESS — going red merely for
 // doing its job is how a weekly lane becomes noise everyone filters. Red is
 // reserved for the single state where evidence EVAPORATES: findings exist,

package/scripts/gds/release-notes.js

@@ -0,0 +1,271 @@
+'use strict';
+
+// scripts/gds/release-notes.js — what each core release brought in, as the summaries its
+// ships wrote, generated when the core is PACKED and shipped inside the package as
+// release-notes.json (task 1004218).
+//
+// WHY INSIDE THE PACKAGE. The Deploy page's "what this brings in" list used to be read out
+// of a core git checkout on the machine asking (task 1004173), and no tenant box will ever
+// have one: every project the wizard creates is a checkout of its OWN repo with the core
+// vendored in at node_modules. The one machine that always has the full history is the one
+// that builds the package — publish.yml checks out at fetch-depth 0 because package-core
+// archives from git — so that is where the notes are written down, once, and every project
+// that can download a core version can read what it carries.
+//
+// THREE PARTS, NO I/O OF ITS OWN. The PARSER (parseChangeRecords, moved here from
+// provision-core-upgrade.js so there is exactly one), the GENERATOR (package-core.js hands
+// it the ref's history), and the RANGE READER (the upgrade runner asks it for from→to).
+// Git is injected, never required, so loading this costs package-core nothing.
+//
+// THE SHAPE. `{ "<version>": [ { id?, text }, … ] }`, ascending by version, one key per
+// release — including a release whose merges were all housekeeping, which keeps an EMPTY
+// list. That is the difference between "nothing landed" and "not covered": a range is
+// answerable only when its target is a key, so a missing key can never be read as silence.
+
+const CHANGE_TEXT_MAX = 400;
+
+// The file's name at the package root, beside package.json.
+const RELEASE_NOTES_FILE = 'release-notes.json';
+
+// THE BOUND. The whole history to 1.19.1029 is ~400 KB pretty-printed (1,033 releases,
+// 1,399 summaries, measured 2026-09-25), growing roughly 200 KB a month at 20–30 releases a
+// day. Nothing needs trimming today; the bound exists so the file cannot grow unwatched.
+// Past it, the OLDEST releases are dropped — the ranges an owner asks about are recent ones
+// — and the reader then says those older ranges are not covered, rather than guessing.
+const RELEASE_NOTES_MAX_BYTES = 1024 * 1024;
+
+// A release commit's subject — the lane's own carrier AND a human release both begin this
+// way. The same marker findCoreCheckout's probe uses to recognise core history.
+const RELEASE_SUBJECT_RE = /^release: core (\d+\.\d+\.\d+) /;
+const CORE_VERSION_RE = /^[0-9]+\.[0-9]+\.[0-9]+$/;
+
+// One record per commit: sha, parents, subject, body. `--topo-order` is load-bearing — see
+// buildReleaseNotes for why the order releases are visited in must be topological.
+const LOG_ARGS = ['log', '--topo-order', '--format=%H%x1f%P%x1f%s%x1f%b%x1e'];
+
+/**
+ * The merge summaries in a `git log --merges --format=%s%x1f%b%x1e` dump. PURE.
+ *
+ * TWO MERGE SHAPES CARRY A SUMMARY AND THE SECOND IS THE COMMON ONE. A hand-landed ship
+ * writes `Merge <branch>: <summary>`; the CI auto-merge writes `Merge pull request #N
+ * from <owner>/<branch>` with `task <id>: <summary>` in the BODY. Measured over
+ * 1.19.881→1.19.972: 114 usable summaries, of which 98 were the second shape. A parser
+ * that read subjects only would have found eleven of them and quietly called that the
+ * release.
+ *
+ * EVERYTHING ELSE IS DROPPED, and the drops are the majority: `Merge origin/main into
+ * <branch> (pre-stage freshness…)`, `Merge remote-tracking branch…`, a regen chore. Those
+ * are the mechanics of landing work, not the work, and listing them would bury the
+ * eleven sentences the owner actually wants under a hundred they do not.
+ */
+function parseChangeRecords(stdout) {
+  const out = [];
+  const seen = new Set();
+  for (const rec of String(stdout || '').split('\x1e')) {
+    const r = rec.trim();
+    if (!r) continue;
+    const i = r.indexOf('\x1f');
+    const subject = (i < 0 ? r : r.slice(0, i)).trim();
+    const body = i < 0 ? '' : r.slice(i + 1);
+    let text = null;
+    let id = null;
+    // The negative lookahead is what keeps the two housekeeping shapes out: both begin
+    // "Merge " and both would otherwise match a `<token>:` somewhere later in the line.
+    let m = /^Merge\s+(?!pull request\b|remote-tracking\b)([^\s:]+):\s*(\S.*)$/.exec(subject);
+    if (m) {
+      text = m[2];
+    } else {
+      const first = body.split('\n').map((l) => l.trim()).find(Boolean) || '';
+      m = /^task\s+(\d+):\s*(\S.*)$/.exec(first);
+      if (m) { id = m[1]; text = m[2]; }
+    }
+    if (!text) continue;
+    // It reaches a DOM, and a ship summary is occasionally a paragraph.
+    text = boundText(text);
+    if (seen.has(text)) continue;   // a branch merged twice says its sentence once
+    seen.add(text);
+    out.push(id ? { id, text } : { text });
+  }
+  return out;
+}
+
+function boundText(text) {
+  return text.length > CHANGE_TEXT_MAX ? `${text.slice(0, CHANGE_TEXT_MAX - 1)}…` : text;
+}
+
+/** Order two three-number core versions. PURE; both must already match CORE_VERSION_RE. */
+function compareCoreVersions(a, b) {
+  const x = String(a).split('.').map(Number);
+  const y = String(b).split('.').map(Number);
+  for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] - y[i];
+  return 0;
+}
+
+/** Split a LOG_ARGS dump into `{ sha, parents, subject, body }` records, in log order. PURE. */
+function parseLogRecords(stdout) {
+  const out = [];
+  for (const rec of String(stdout || '').split('\x1e')) {
+    const r = rec.replace(/^\n+/, '');   // git terminates each record with a newline
+    if (!r.trim()) continue;
+    const [sha, parents, subject, ...body] = r.split('\x1f');
+    out.push({
+      sha: sha.trim(),
+      parents: String(parents || '').split(' ').filter(Boolean),
+      subject: subject || '',
+      body: body.join('\x1f'),
+    });
+  }
+  return out;
+}
+
+function uniqueByText(entries) {
+  const seen = new Set();
+  return entries.filter((e) => (seen.has(e.text) ? false : seen.add(e.text)));
+}
+
+/**
+ * What each release brought in, from a whole history. PURE.
+ *
+ * `commits` is every commit the packed ref reaches, NEWEST FIRST in topological order (what
+ * LOG_ARGS asks git for). Returns `{ notes, releases, tail }`.
+ *
+ * EXACTLY `git log --merges <previous release>..<release>`, FOR EVERY RELEASE AT ONCE — the
+ * range the checkout-based reader asks for one pair at a time. Splitting the log wherever a
+ * release subject appears would be simpler and is wrong: a PR branch's commits are not
+ * ordered against main's by the log, so a merge made on a branch before one release but
+ * landed after it would be credited to the earlier release. So each release, oldest first,
+ * claims everything it can reach that no earlier release reached. The visiting order has to
+ * be topological for that to be the previous-release range — hence `--topo-order`.
+ *
+ * THE UNRELEASED TAIL — commits the ref reaches that no release commit does — belongs to the
+ * version being packed when that version has no release commit of its own yet (a pack of a
+ * hand-declared version), and to nobody otherwise: on a work merge the tail is the NEXT
+ * release's, whose number does not exist yet.
+ */
+function buildReleaseNotes(commits, { version = null } = {}) {
+  const bySha = new Map(commits.map((c) => [c.sha, c]));
+  const position = new Map(commits.map((c, i) => [c.sha, i]));
+  const claimed = new Set();
+  const claim = (tip) => {
+    const mine = [];
+    const stack = [tip];
+    while (stack.length) {
+      const sha = stack.pop();
+      if (claimed.has(sha) || !bySha.has(sha)) continue;
+      claimed.add(sha);
+      const c = bySha.get(sha);
+      mine.push(c);
+      for (const p of c.parents) if (!claimed.has(p)) stack.push(p);
+    }
+    return mine;
+  };
+  // Newest first within a release, as `git log` itself would list them.
+  const summarize = (segment) => parseChangeRecords(segment
+    .filter((c) => c.parents.length > 1)
+    .sort((a, b) => position.get(a.sha) - position.get(b.sha))
+    .map((c) => `${c.subject}\x1f${c.body}\x1e`)
+    .join(''));
+
+  const byVersion = new Map();
+  let releases = 0;
+  for (let i = commits.length - 1; i >= 0; i--) {
+    const m = RELEASE_SUBJECT_RE.exec(commits[i].subject);
+    if (!m) continue;
+    releases++;
+    // A version released twice keeps both halves; the second claims only what the first
+    // could not reach.
+    byVersion.set(m[1], uniqueByText([...(byVersion.get(m[1]) || []), ...summarize(claim(commits[i].sha))]));
+  }
+  const tail = commits.filter((c) => !claimed.has(c.sha));
+  if (version && CORE_VERSION_RE.test(version) && !byVersion.has(version)
+      && [...byVersion.keys()].every((v) => compareCoreVersions(v, version) < 0)) {
+    byVersion.set(version, summarize(tail));
+  }
+  const notes = {};
+  for (const v of [...byVersion.keys()].sort(compareCoreVersions)) notes[v] = byVersion.get(v);
+  return { notes, releases, tail: tail.length };
+}
+
+/**
+ * Read a ref's history through an injected `git(args) → stdout` and build its notes.
+ * Returns `{ notes, releases, tail }`, or `{ skipped }` saying why there are none — never
+ * a partial answer presented as a whole one.
+ */
+function generateReleaseNotes({ git, ref, version }) {
+  let shallow;
+  try { shallow = String(git(['rev-parse', '--is-shallow-repository'])).trim() === 'true'; }
+  catch (e) { return { skipped: `could not ask git about this clone (${firstLine(e)})` }; }
+  // A depth-limited clone reaches a handful of commits, and notes built from it would
+  // credit the newest release with everything the clone happens to hold.
+  if (shallow) return { skipped: 'this is a shallow clone, so it carries no release history' };
+  let out;
+  try { out = git([...LOG_ARGS, ref]); }
+  catch (e) { return { skipped: `could not read the history of ${ref} (${firstLine(e)})` }; }
+  const built = buildReleaseNotes(parseLogRecords(out), { version });
+  if (!built.releases) return { skipped: 'this history holds no release commits' };
+  return built;
+}
+
+function firstLine(e) {
+  return String((e && e.message) || e || '').trim().split('\n')[0].slice(0, 160);
+}
+
+/** The file's bytes: the same pretty-printed JSON the package's other generated files use. */
+function serializeReleaseNotes(notes) {
+  return Buffer.from(`${JSON.stringify(notes, null, 2)}\n`, 'utf8');
+}
+
+/**
+ * Hold the file under `maxBytes` by dropping the OLDEST releases. PURE.
+ * Returns `{ notes, dropped }`; the newest release is always kept.
+ */
+function boundReleaseNotes(notes, maxBytes = RELEASE_NOTES_MAX_BYTES) {
+  const versions = Object.keys(notes);
+  const keep = (from) => Object.fromEntries(versions.slice(from).map((v) => [v, notes[v]]));
+  const fits = (from) => serializeReleaseNotes(keep(from)).length <= maxBytes;
+  if (versions.length <= 1 || fits(0)) return { notes, dropped: [] };
+  // The fewest drops that fit, by bisection — the size only shrinks as more are dropped.
+  let lo = 1;
+  let hi = versions.length - 1;
+  while (lo < hi) {
+    const mid = (lo + hi) >> 1;
+    if (fits(mid)) hi = mid; else lo = mid + 1;
+  }
+  return { notes: keep(lo), dropped: versions.slice(0, lo) };
+}
+
+/**
+ * The entries for every release in `(from, to]`, newest release first. PURE.
+ *
+ * Returns `{ entries }` or `{ uncovered }` — a phrase saying why these notes cannot answer,
+ * worded to follow "the release notes …". NEVER an empty list for a range the notes do not
+ * reach: an empty list reads as "nothing changed", which is exactly what a restart must not
+ * be sold as. They reach a range when they list its target and begin at or before its
+ * start: the oldest release they hold is where their knowledge begins.
+ *
+ * The file may have come off the network, so every entry is re-checked here, not trusted.
+ */
+function notesBetween(notes, from, to) {
+  if (!notes || typeof notes !== 'object' || Array.isArray(notes)) return { uncovered: 'are not a list of releases' };
+  const versions = Object.keys(notes)
+    .filter((v) => CORE_VERSION_RE.test(v) && Array.isArray(notes[v]))
+    .sort(compareCoreVersions);
+  if (!versions.includes(to)) return { uncovered: `do not list core ${to}` };
+  if (compareCoreVersions(versions[0], from) > 0) return { uncovered: `begin at core ${versions[0]}, after ${from}` };
+  const inRange = versions.filter((v) => compareCoreVersions(v, from) > 0 && compareCoreVersions(v, to) <= 0);
+  const entries = [];
+  for (const v of inRange.reverse()) {
+    for (const e of notes[v]) {
+      if (!e || typeof e.text !== 'string' || !e.text.trim()) continue;
+      const text = boundText(e.text.trim());
+      entries.push(/^\d+$/.test(String(e.id || '')) ? { id: String(e.id), text } : { text });
+    }
+  }
+  return { entries: uniqueByText(entries) };
+}
+
+module.exports = {
+  RELEASE_NOTES_FILE, RELEASE_NOTES_MAX_BYTES,
+  parseChangeRecords, parseLogRecords, buildReleaseNotes,
+  generateReleaseNotes, serializeReleaseNotes, boundReleaseNotes, notesBetween,
+};

package/scripts/gds/run-routine.js

@@ -15,7 +15,7 @@
 //
 // Each step routes its stdout by `sink: discord|gds|none`. A failed step exits
 // non-zero after a best-effort #ops alert. Runs the steps with
-// OTB_COST_CRON_ROUTINE set so System 1 tags any (hybrid) model spend as
+// <PREFIX>_COST_CRON_ROUTINE set so System 1 tags any (hybrid) model spend as
 // cron:<routine>. Usage: node scripts/gds/run-routine.js <routine-name> [--dry-run]
 
 'use strict';
@@ -23,7 +23,7 @@
 const fs = require('fs');
 const path = require('path');
 const { execFileSync } = require('child_process');
-const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-config');
+const { resolveCoreRoot, resolveInstanceRoot, resolveEnv, envPrefix } = require('../../src/instance-config');
 
 // TWO roots (ADR 0108 configurable-root; task 2138). run-routine.js is a CORE script, so it
 // ships alongside src/, scripts/gds/*, scripts/discord/*, and modules/ — all under
@@ -39,7 +39,20 @@ const TASKS_DIR = path.join(INSTANCE_ROOT, '.claude', 'scheduled-tasks');
 const DISCORD_POST = path.join(CORE_ROOT, 'scripts', 'discord', 'post.js');
 const VALID_MODES = new Set(['deterministic', 'hybrid', 'judgment']);
 const VALID_SINKS = new Set(['discord', 'gds', 'none']);
-const ALERT_CHANNEL = process.env.OTB_ROUTINE_ALERT_CHANNEL || 'ship_feed';
+// The #ops channel a failed step alerts: <PREFIX>_ROUTINE_ALERT_CHANNEL (BONGOS_ on
+// a vanilla instance; the legacy OTB_ spelling is still read), else ship_feed.
+function alertChannel(env = process.env) {
+  return resolveEnv('ROUTINE_ALERT_CHANNEL', { env }) || 'ship_feed';
+}
+const ALERT_CHANNEL = alertChannel();
+
+// The environment a routine step runs with: the caller's, plus the routine's name
+// under the canonical <PREFIX>_COST_CRON_ROUTINE so System 1 tags any model spend
+// as cron:<routine>. session-cost.js reads it back through resolveEnv, which tries
+// the canonical spelling first (task 1001441).
+function stepEnv(routineName, env = process.env) {
+  return { ...env, [`${envPrefix()}_COST_CRON_ROUTINE`]: routineName };
+}
 
 function unquote(s) {
   const t = String(s == null ? '' : s).trim();
@@ -177,7 +190,7 @@ function runStep(step, routineName, { dryRun }) {
   const out = execFileSync(argv[0], argv.slice(1), {
     cwd: INSTANCE_ROOT, // routines run in the instance repo (companions + git-touching steps)
     encoding: 'utf8',
-    env: { ...process.env, OTB_COST_CRON_ROUTINE: routineName },
+    env: stepEnv(routineName),
   });
   routeOutput(step.sink, out, routineName);
   return out;
@@ -241,4 +254,4 @@ if (require.main === module) {
   main();
 }
 
-module.exports = { parseRoutineFrontmatter, tokenize, resolveStepArgv, isNodeExec, VALID_MODES, VALID_SINKS };
+module.exports = { parseRoutineFrontmatter, tokenize, resolveStepArgv, isNodeExec, VALID_MODES, VALID_SINKS, alertChannel, stepEnv };

package/scripts/gds/run-unit-tests.js

@@ -95,8 +95,11 @@ const INTEGRATION = new Set([
   'asset_version', 'auth_flow_slice1', 'backfill_sessions', 'bfg', 'bfg_write',
   'box_connect_e2e', 'box_onboard', 'boxes', 'cf_tunnel', 'cli_token_reissue',
   // consumer_layout_boot builds the core .tgz, `npm install`s it, and boots a live
-  // platform-server — network + package build + a spawned server, run by its own
-  // .github/workflows/consumer-layout-boot.yml, not this DB-free gate (task 2142).
+  // platform-server (task 2142), then installs the package from its own shipped lockfile,
+  // migrates brand-new EMPTY databases and serves a database-backed route from one (task
+  // 1002863) — network + package build + spawned servers + Postgres. It runs in the
+  // integration job of .github/workflows/integration.yml like the rest of this set; there
+  // never was a dedicated consumer-layout-boot workflow, whatever older notes say.
   'consumer_layout_boot',
   'claim_gate_open_blocker', 'claim_gate_rebase',
   // task 1002709: core_221's re-keyed backstop index against a real Postgres.
@@ -408,11 +411,19 @@ function discoverModuleTests({ modulesDir = MODULES_DIR, isEnabled = isModuleEna
 // scripts/gds/smoke-box.sh still invokes all three by path — deleting the files
 // turned that script into an immediate MODULE_NOT_FOUND. They come out when the
 // module does, in the change that removes it.
+//
+// consumer_layout_boot LEFT THIS LIST under task 1002863. Its "missing core tarball" was
+// package-core's fail-closed leak gate reading the lane's throwaway database password (the
+// word postgres, present in hundreds of core files) as a leaked credential and refusing to
+// build. The harness now withholds database settings from the packager, and it is the only
+// test that proves the PUBLISHED package installs, migrates an empty database and serves
+// from it — parking it again re-opens that gap, which tests/integration_parked_ratchet.mjs
+// now says out loud.
 const INTEGRATION_PARKED = new Set([
   'acclaim_feed_evidence_db',
   'bfg', 'bfg_write', 'box_connect_e2e', 'box_onboard', 'boxes',
   'claim_gate_open_blocker', 'claim_gate_rebase',
-  'clawback_confirmed_backlog', 'consumer_layout_boot', 'copy_desk_flags_db',
+  'clawback_confirmed_backlog', 'copy_desk_flags_db',
   'government_board_membership_db', 'handle_machinery', 'hub_profile_leak',
   'idea_credit_streams_db', 'memory_isolation', 'memory_pull', 'needs_rebase',
   'profile_fields', 'project_visibility_db', 'reward_mode_cost_plus_only',

package/scripts/gds/seed-board-room-tasks.js

@@ -43,7 +43,7 @@ const TASKS = [
   // ---- Phase A — decide + foundation (P5) ----
   { ref:'R01', kind:'decision', disc:'engineer', prio:5, est:150, crit:[C1,C3,C4], deps:[],
     title:'R01 · ADR: the Board Room government model',
-    desc:`Record the government model as one decision so the schema has something to encode.\n\nMUST STATE: the board's TWO subjects (a Full Idea, and a change to the constitution itself) and why nothing else is votable; membership as a configured predicate resolved per request and uncached; the timed SITTING (absent votes are nulled, not blocking) and why that replaces quorum — the clock IS the deadlock exit; CONSENT rather than majority, with silence as consent and one reasoned objection returning the idea; a zero-vote close PASSING; the OPEN ballot; Discord as an outbound notification mirror that casts nothing; and the amendment rule — a constitutional change is decided under whatever rule the CURRENT constitution names, so flipping out of monarchy is a legal monarchy act.\n\nAlso record the two owner decisions taken against recommendation with their trade-offs intact: vote-karma (yes-clicking bias, accepted because item volume is too low to farm) and automatic window-open on grade pass (author loses timing control; concurrent windows become normal).\n\nGrounding: idea 1000738, idea 1000754, the Six Variables of Governance synthesis, ADR 0151 (permissions-as-atoms), ADR 0157, ADR 0162 (verdicts advisory), ADR 0174 (government/ranks/roles). ${SPEC}` },
+    desc:`Record the government model as one decision so the schema has something to encode.\n\nMUST STATE: the board's TWO subjects (a Full Idea, and a change to the constitution itself) and why nothing else is votable; membership as a configured predicate resolved per request and uncached; the timed SITTING (absent votes are nulled, not blocking) and why that replaces quorum — the clock IS the deadlock exit; CONSENT rather than majority, with silence as consent and one reasoned objection returning the idea; a zero-vote close PASSING; the OPEN ballot; Discord as an outbound notification mirror that casts nothing; and the amendment rule — a constitutional change is decided under whatever rule the CURRENT constitution names, so flipping out of monarchy is a legal monarchy act.\n\nAlso record the two owner decisions taken against recommendation with their trade-offs intact: vote-karma (yes-clicking bias, accepted because item volume is too low to farm) and automatic window-open on grade pass (author loses timing control; concurrent windows become normal).\n\nGrounding: idea 1000738, idea 1000754, the Six Variables of Governance synthesis, ADR 0151 (permissions-as-atoms), ADR 0157, ADR 0158 §2 (verdicts advisory), ADR 0162 (no human approval in the land path), ADR 0174 (government/ranks/roles). ${SPEC}` },
 
   { ref:'R02', kind:'decision', disc:'engineer', prio:5, est:90, crit:[C1], deps:['R01'],
     title:'R02 · The pass-event contract the ideator credit lane consumes',

package/scripts/gds/session-cost.js

@@ -27,6 +27,7 @@ const os = require('os');
 const path = require('path');
 const { cliClient, loadSession, arg } = require('./cli-lib');
 const { priceUsage } = require('../../src/bongos/llm-pricing');
+const { resolveEnv } = require('../../src/instance-config');
 
 
 // Claude Code encodes a project transcript dir by replacing every non-alnum
@@ -256,9 +257,16 @@ function priceSubagents(sessionDir) {
 // into TWO call-site-tagged rows — source='<base>:interactive' (source_ref =
 // sessionId) and '<base>:subagent' (source_ref = sessionId+':sub'), distinct on
 // the (source,source_ref) idempotency index — each carrying its tier split. A
-// cron-launched session sets OTB_COST_CRON_ROUTINE=<name> so base='cron:<name>'
+// cron-launched session sets <PREFIX>_COST_CRON_ROUTINE=<name> so base='cron:<name>'
 // instead of 'session'. The rows' amounts reconcile to the prior single-row
 // figure (priorSingle vs rowsTotal, equal within independent-rounding epsilon).
+// The routine a cron-launched session belongs to, or ''. run-routine.js writes
+// the canonical <PREFIX>_COST_CRON_ROUTINE (stepEnv); a legacy OTB_ spelling set
+// by an older runner is still read, with a deprecation warning (task 1001441).
+function cronRoutineFromEnv(env = process.env) {
+  return (resolveEnv('COST_CRON_ROUTINE', { env }) || '').trim();
+}
+
 function buildCostRows({ sessionId, inter, sub, cronRoutine }) {
   const base = cronRoutine ? `cron:${cronRoutine}` : 'session';
   const id8 = String(sessionId).slice(0, 8);
@@ -350,8 +358,8 @@ async function main() {
     if (!(total > 0)) return;
 
     // task 1344: split into call-site-tagged, tier-carrying rows; cron sessions
-    // are tagged via OTB_COST_CRON_ROUTINE.
-    const cronRoutine = (process.env.OTB_COST_CRON_ROUTINE || '').trim();
+    // are tagged via <PREFIX>_COST_CRON_ROUTINE (see cronRoutineFromEnv).
+    const cronRoutine = cronRoutineFromEnv();
     const built = buildCostRows({ sessionId, inter, sub, cronRoutine });
     const id8 = sessionId.slice(0, 8);
 
@@ -414,6 +422,7 @@ module.exports = {
   newestTranscriptFor,
   // task 1344 — pure tier-split + row-building helpers (unit-tested)
   buildCostRows,
+  cronRoutineFromEnv,
   emptyTiers,
   addComponents,
   addTiers,

package/scripts/gds/ship-deploy-target.js

@@ -12,13 +12,17 @@ const { spawnSync } = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');
 const { loadSessionSync } = require('./cli-lib');
+// The two env overrides below resolve through the branded prefix — <PREFIX>_DEPLOY_MODE /
+// <PREFIX>_PUSH_VIA_SERVER (BONGOS_ on a vanilla instance) — with the legacy OTB_ spelling
+// still honoured and warned about (task 1001441, R61 follow-up).
+const { resolveEnv } = require('../../src/instance-config');
 const { argvOk, argvOut } = require('./ship-git.js');
 const { REPO_ROOT } = require('./ship-state.js');
 
 // ---------- CI deploy mode (#679, ADR 0042) ----------
 //
 // Two ways the confirmed→shipped land can run, chosen by a SINGLE committed
-// switch (config/deploy.json `mode`, env OTB_DEPLOY_MODE overrides):
+// switch (config/deploy.json `mode`, env <PREFIX>_DEPLOY_MODE overrides):
 //
 //   'laptop' (default) — the operator's machine merges to main locally and, IFF a
 //      deploy target is configured (config/deploy.json "sshTarget" or
@@ -63,7 +67,7 @@ function parseDeployMode(envVal, configRaw) {
 // it must ship via the 'ci' server-mediated publish path instead
 // (pushVia()==='server', ADR 0055), which lets the GDS server push with its own
 // credential. So when the parsed mode is 'laptop' but the machine can't push
-// locally AND the mode was NOT pinned by an explicit OTB_DEPLOY_MODE, fall back to
+// locally AND the mode was NOT pinned by an explicit <PREFIX>_DEPLOY_MODE, fall back to
 // 'ci' rather than strand every ship at merge. This is the scootermack 2026-06-22
 // case: a checkout left at the pre-cutover 'laptop' default that can't pull
 // forward to 'ci', so it kept attempting a push it had no credential for. An
@@ -109,9 +113,10 @@ function mainIsProtected() {
 
 function resolveDeployMode() {
   const configRaw = readDeployConfigRaw();
-  const mode = parseDeployMode(process.env.OTB_DEPLOY_MODE, configRaw);
+  const envMode = resolveEnv('DEPLOY_MODE');
+  const mode = parseDeployMode(envMode, configRaw);
   const envForced = ['ci', 'laptop'].includes(
-    String(process.env.OTB_DEPLOY_MODE || '').trim().toLowerCase()
+    String(envMode || '').trim().toLowerCase()
   );
   // Probe `gh` ONLY when it can change the answer (resolved 'laptop', no env
   // override) — the happy 'ci' path and an env-pinned mode spawn no extra gh,
@@ -313,7 +318,7 @@ function fetchDeployedVersion(url = deployedVersionUrl()) {
 //              credential-less origin). ship uploads a thin branch bundle to the
 //              GDS, which pushes + opens the PR + auto-merges with the SERVER's
 //              credential. The box holds nothing (#919 model preserved).
-// Override with OTB_PUSH_VIA_SERVER=1 (force server) / =0 (force local) for tests.
+// Override with <PREFIX>_PUSH_VIA_SERVER=1 (force server) / =0 (force local) for tests.
 function ghAvailableAndAuthed() {
   try {
     const a = spawnSync('gh', ['auth', 'status'], {
@@ -329,7 +334,7 @@ function ghAvailableAndAuthed() {
 }
 
 function pushVia() {
-  const o = String(process.env.OTB_PUSH_VIA_SERVER || '').trim();
+  const o = String(resolveEnv('PUSH_VIA_SERVER') || '').trim();
   if (o === '1') return 'server';
   if (o === '0') return 'local';
   // No explicit override: a machine that can run an authenticated gh (laptop)