@bongos/core 1.19.1032 → 1.19.1034

package/scripts/gds/upgrade-migrate.js

@@ -0,0 +1,67 @@
+'use strict';
+
+// scripts/gds/upgrade-migrate.js — WHICH command `bongos upgrade` migrates an instance
+// with (task 1004274, found preparing the task 1004047 catch-up pass). Kept out of
+// upgrade.js, which sits at the 1500-line cap.
+//
+// THE GAP. upgrade.js migrated with `npm run migrate`, and that only works where the
+// instance's package.json DECLARES a migrate script. A greenfield scaffold always does
+// (init.js buildInstancePackageJson writes INSTANCE_MIGRATE_SCRIPT), but the ADOPT layer
+// does not: init.js mergeCoreDependency adds the core dependency and nothing else, and
+// for a repo that had no package.json of its own it mints `{ name, private,
+// dependencies }`. So an adopted project that is not a JavaScript app has no scripts at
+// all. There `npm run migrate` answers "Missing script" — AFTER the pin has moved and
+// the new core is installed — and the upgrade rolls itself back, restarting someone's
+// live app to change nothing. mercury (a Python/Flask project; its package.json is
+// exactly name/private/dependencies) is that shape, and it is why the catch-up pass
+// could not reach it. The dry run could not warn either, because it never looked.
+//
+// THE FALLBACK IS NOT A NEW MIGRATION PATH. It is the command a scaffold's own script
+// IS, and the one the control plane ran to create that instance's database at stand-up
+// (provision-repo.js standaloneMigrateCmd): the installed core's scripts/migrate.sh,
+// run from the instance root. A declared script still wins, whatever it says — an
+// owner who wrote their own migrate step meant it — and `--skip-migrate` stays the
+// only way to run no migration at all, which on a real jump leaves the new code
+// running against the old schema.
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+// Relative to the instance root, POSIX on purpose: it is an argument to bash, and it
+// must stay byte-identical to the scaffold's script (tests/upgrade_migrate.mjs pins it
+// against init.js INSTANCE_MIGRATE_SCRIPT).
+const CORE_MIGRATE_SCRIPT = 'node_modules/@bongos/core/scripts/migrate.sh';
+
+/**
+ * How this instance is migrated: its own declared script, or the core's migrate.sh.
+ *
+ * Only a package.json we could READ, and that names no migrate script, earns the
+ * fallback. A missing or unparseable one keeps the old command, which then fails the
+ * way it always did — guessing at a file this could not parse would be worse.
+ *
+ * `env` exists only on the fallback, and only to hand migrate.sh what `npm run` would:
+ * migrate.sh finds the instance from INIT_CWD before its own cwd (task 2180), and npm
+ * sets it to the directory the script runs in. Launched directly, a stray INIT_CWD
+ * inherited from whoever started this upgrade would aim it at the wrong project.
+ *
+ * `note` is a pre-flight line, so the dry run says which command the move will run.
+ */
+function migratePlan(instanceDir, { fsImpl = fs, env = process.env } = {}) {
+  let pkg = null;
+  try { pkg = JSON.parse(fsImpl.readFileSync(path.join(instanceDir, 'package.json'), 'utf8')); } catch { /* absent or unreadable */ }
+  const scripts = pkg && typeof pkg.scripts === 'object' && pkg.scripts ? pkg.scripts : {};
+  const declared = typeof scripts.migrate === 'string' && scripts.migrate.trim() !== '';
+  if (!pkg || declared) {
+    return { via: 'npm-script', cmd: 'npm', args: ['run', 'migrate'], label: 'npm run migrate', env: null, note: null };
+  }
+  return {
+    via: 'core-script',
+    cmd: 'bash',
+    args: [CORE_MIGRATE_SCRIPT],
+    label: `bash ${CORE_MIGRATE_SCRIPT}`,
+    env: { ...env, INIT_CWD: instanceDir },
+    note: 'migrate: this project declares no migrate script (an adopted repo), so the core\'s own scripts/migrate.sh will run — the command a scaffold\'s script runs',
+  };
+}
+
+module.exports = { migratePlan, CORE_MIGRATE_SCRIPT };

package/scripts/gds/upgrade.js

@@ -8,7 +8,7 @@
 //   pre-flight   clean git tree + module-compat vs the TARGET core version + the artist gate (ADR 0241)
 //     → bump pin   vendor the new core .tgz, rewrite the package.json `file:` dependency
 //     → npm install  node_modules/@bongos/core becomes the new version
-//     → migrate      `npm run migrate` → the core's migrate.sh applies additive `core_*` migrations
+//     → migrate      `npm run migrate` (no such script: the core's migrate.sh itself, upgrade-migrate.js) applies additive `core_*` migrations
 //     → materialize  refresh .claude/ skills+settings+hooks from the new core (claude-materialize / W3)
 //     → restart      restart the instance's service so the new core is live
 //     → verify       installed package version == target (+ optional /healthz + ledger row)
@@ -246,7 +246,7 @@ async function resolvePinPushAuth({ instanceDir, remote = 'origin' }, deps = {},
   if (!repo) return null;
   const auth = require('./provision-repo-auth');
   const inst = await auth.lookupInstanceRow(instanceDir, deps);
-  if (!inst) return null;
+  if (!inst) { const key = pinnedDeployKey(instanceDir, run); if (key) log(auth.missingRowNote(key, remote)); return null; } // task 1004065
   const rowRepo = auth.parseTargetRef(inst.target_ref);
   const same = (a, b) => a && b && a.owner.toLowerCase() === b.owner.toLowerCase() && a.name.toLowerCase() === b.name.toLowerCase();
   if (!same(rowRepo, repo)) {
@@ -407,7 +407,7 @@ function persistPin({ instanceDir, fromVersion, toVersion, commitPin, push = tru
       const repo = remoteGithubRepo(instanceDir, remote, run);
       err(`  ! PIN NOT PUSHED — GitHub refused the push to ${remote}, so this bump is NOT durable.`);
       err(`    ${remote} authenticates with the deploy key at ${key}, which is registered READ-ONLY on the`);
-      err(`    repository (ADR 0176): it can pull, never push. No owner GitHub token is stored to push with instead.${gitSaid(pushed)}`);
+      err(`    repository (ADR 0176): it can pull, never push. No owner GitHub token was available to push with instead (none is stored, or — on a hosted project's own box — the hub's record of it is not readable from here).${gitSaid(pushed)}`);
       revert();
       err('    Fix: have the instance owner reconnect GitHub with repository access (that stores a short-lived repo token),');
       err(`    then re-run \`bongos upgrade --commit-pin\` where that token is readable — the control plane, with --instance ${q(instanceDir)};`);
@@ -415,7 +415,7 @@ function persistPin({ instanceDir, fromVersion, toVersion, commitPin, push = tru
       err(`      ${at} push ${q(`https://github.com/${repo ? `${repo.owner}/${repo.name}` : '<owner>/<repo>'}.git`)} ${q(target)}`);
       return {
         applicable: true, committed: true, pushed: false, dirty, refused: 'read-only-deploy-key',
-        error: `GitHub refused the pin push: ${remote} authenticates with the read-only deploy key at ${key}, and no owner GitHub token is stored to push with — the pin is committed locally but not on the remote`,
+        error: `GitHub refused the pin push: ${remote} authenticates with the read-only deploy key at ${key}, and no owner GitHub token was available to push with — the pin is committed locally but not on the remote`,
       };
     }
     err(`  ! commit landed locally but the push to ${remote} FAILED — this bump is still not durable.`);
@@ -538,7 +538,8 @@ function preflightDbIdentity({ instanceDir, db }, run = spawnSync) {
 }
 
 function runMigrate(instanceDir, run = spawnSync) {
-  const r = run('npm', ['run', 'migrate'], { cwd: instanceDir, stdio: 'inherit' });
+  const { cmd, args, env } = require('./upgrade-migrate').migratePlan(instanceDir); // its own migrate script, else the core's migrate.sh (task 1004274)
+  const r = run(cmd, args, { cwd: instanceDir, stdio: 'inherit', ...(env ? { env } : {}) });
   return !r || r.error ? { ok: false, reason: r && r.error ? r.error.message : 'spawn failed' } : { ok: r.status === 0, code: r.status };
 }
 
@@ -1142,6 +1143,7 @@ async function runUpgrade(opts, deps = {}) {
     if (!dbId.ok) return { ok: false, error: dbId.reason };
     if (dbId.skipped) log(`  • db identity pre-check${db ? ` (${db})` : ''}: ${dbId.skipped}`);
     else log(`  ✓ pre-flight: database${db ? ` "${db}"` : ''} reachable as the current user`);
+    const { note: migrateNote } = require('./upgrade-migrate').migratePlan(instanceDir); if (migrateNote) log(`  ✓ pre-flight: ${migrateNote}`);
   }
 
   // 1a. artist gate (ADR 0241, task 1004205): an open review holds the pin, --force too; a downgrade never waits.
@@ -1181,7 +1183,7 @@ async function runUpgrade(opts, deps = {}) {
     log(`  ${dryRun ? '[dry-run] would pin' : '✓ pinned'} ${CORE_PKG} → file:${vendorRel}${prevPin ? `  (was ${prevPin})` : ''}`);
   }
 
-  if (dryRun) { log('  [dry-run] would: npm install → npm run migrate → materialize .claude → regen API docs+client → restart → verify'); return { ok: true, dryRun: true, fromVersion, toVersion: targetVersion }; }
+  if (dryRun) { log(`  [dry-run] would: npm install → ${opts.skipMigrate ? '(no migrate)' : require('./upgrade-migrate').migratePlan(instanceDir).label} → materialize .claude → regen API docs+client → restart → verify`); return { ok: true, dryRun: true, fromVersion, toVersion: targetVersion }; }
 
   // 3. npm install.
   const inst = npmInstall(instanceDir, run);
@@ -1455,7 +1457,7 @@ async function main(argv = process.argv.slice(2)) {
       '  --health-url <url>   poll after restart (~30s) until 2xx; a still-failing check fails the bump (auto-rollback). REQUIRED for a bump that restarts the service, unless --no-health-check.',
       '  --version-url <url>  read the RUNNING process\'s coreVersion back after restart and require it to equal --to (default: /version on the --health-url origin). A health check alone cannot tell a new core from an old one that never went down.',
       '  --no-health-check    explicitly skip the post-restart health confirmation (default: the check is ON — a bump that restarts the service must confirm it serves); also skips the served-version read-back',
-      '  --skip-migrate       do not run `npm run migrate`',
+      '  --skip-migrate       do not migrate (the default runs the instance\'s `migrate` script, else the core\'s scripts/migrate.sh)',
       '  --skip-materialize   do not refresh .claude/',
       '  --skip-regen-docs    do not regenerate the OpenAPI spec + typed client from the new core',
       '  --skip-pin-verify    do not verify the integrity pin (tree_sha256 + tarball.sha256) after install',

package/scripts/hall-preview/README.md

@@ -41,17 +41,18 @@ fetched live — read-only GETs — and layered over the fixtures in memory. The
 banner names whose hall you are looking at:
 
 ```
-  account: @scootermack (archon) — your own, live
+  account: @your-login (archon) — your own, live
 ```
 
 Nothing is written to `fixtures/` (that's `refresh-fixtures.js`'s job), so the
 checked-in snapshot stays the fallback. It serves whenever the live read can't
 happen — signed out, expired session, offline, or an endpoint your rank can't
 call (that one keeps its own fixture and the rest of your identity still lands).
-Every fallback says why, and says the hall is about to show you someone else:
+Every fallback says why, and says the hall is about to show you someone else — a
+stand-in, since the snapshot's people are scrubbed (see [Fixtures](#fixtures)):
 
 ```
-  account: @jaxri (metic) — NOT YOURS, the checked-in fixture: this machine has no Bongos CLI session — run /builder-setup
+  account: @builder-4 (metic) — NOT YOURS, the checked-in fixture: this machine has no Bongos CLI session — run /builder-setup
 ```
 
 **`--fixture-me` pins the snapshot.** Use it for the screenshot matrix below —
@@ -74,6 +75,22 @@ node scripts/hall-preview/refresh-fixtures.js
 
 Box/terminal endpoints are deliberately never snapshotted (connection details).
 
+**No real person is ever checked in (task 1003647).** `fixtures/` is committed, so
+`refresh-fixtures.js` runs every snapshot through [`scrub-identity.js`](scrub-identity.js)
+*before* writing it: logins, display names, avatars, GitHub ids and emails become
+stand-ins (`builder-3` / `Builder 3`, GitHub's ghost avatar), one per person across the
+run, and the snapshotting account's own credit balance, karma and spend (`me`, `me__*`)
+become fixed values. Instance-local ids and free text (task titles, descriptions) are
+left alone. Hand-edited a fixture? Run the same pass over the files on disk — no
+network, and it rewrites only the values that change:
+
+```bash
+node scripts/hall-preview/refresh-fixtures.js --scrub-only
+```
+
+`tests/hall_preview_scrub.mjs` fails while any committed fixture still carries a real
+identity.
+
 ## The evidence matrix (per page-redesign ship)
 
 Screenshot every changed page at **{light, dark} × {1280w, 390w}**, plus one

package/scripts/hall-preview/live-identity.js

@@ -4,7 +4,7 @@
 //
 // The harness answers every read from checked-in fixtures, and fixtures/me.json
 // is one particular builder's snapshot. So every preview greeted whoever ran it
-// as somebody else ("Welcome back, Jackson Rini"), with that builder's credits,
+// as somebody else ("Welcome back, <whoever was snapshotted>"), with that builder's credits,
 // achievements, goals and RANK — and because that snapshot is a metic, the
 // Archon-gated pages rendered their sealed notice, so a UI change to them could
 // not be reviewed at all. Reviewing your own UI change against someone else's

package/scripts/hall-preview/refresh-fixtures.js

@@ -7,11 +7,18 @@
 // Read-only: GETs only. Endpoints that 403/404 for the caller's rank are
 // skipped (the existing fixture, if any, is kept). Box/terminal endpoints are
 // deliberately NOT snapshotted (they carry host/connection details).
+//
+// PEOPLE ARE SCRUBBED ON WRITE (task 1003647). fixtures/ is committed, so every
+// snapshot goes through ./scrub-identity.js before it touches the disk: logins,
+// names, avatars, GitHub ids and emails become stand-ins (`builder-3` / `Builder
+// 3`), and the snapshotting account's own balance and spend become fixed values.
+// Hand-edited a fixture? Re-run the same pass over the files on disk, no network:
+//   node scripts/hall-preview/refresh-fixtures.js --scrub-only
 'use strict';
 
 const fs = require('fs');
 const path = require('path');
-const { cliClient } = require('../gds/cli-lib');
+const { createScrubber, isOwnAccountFixture, highestStandIn, rewriteScalars } = require('./scrub-identity');
 
 const FIXTURES = path.join(__dirname, 'fixtures');
 
@@ -77,20 +84,73 @@ const SNAPSHOTS = [
   ['public/versions', 'public__versions'],
 ];
 
-(async () => {
-  const api = await cliClient();
-  fs.mkdirSync(FIXTURES, { recursive: true });
+// Every existing fixture's text — read so a run can number new stand-ins above the
+// ones already in use (a hand-written fixture may carry `builder-7`).
+function readFixtureTexts(dir) {
+  try {
+    return fs.readdirSync(dir).filter((f) => f.endsWith('.json')).map((f) => fs.readFileSync(path.join(dir, f), 'utf8'));
+  } catch (e) {
+    if (e.code === 'ENOENT') return [];
+    throw e;
+  }
+}
+
+// refreshFixtures — GET each snapshot, scrub the people out of it, write it. The api,
+// directory and logger are injected so tests/hall_preview_scrub.mjs drives this exact
+// writer with no network and a temp directory.
+async function refreshFixtures({ api, dir = FIXTURES, snapshots = SNAPSHOTS, log = console.log } = {}) {
+  fs.mkdirSync(dir, { recursive: true });
+  const scrubber = createScrubber({ firstNumber: highestStandIn(readFixtureTexts(dir)) + 1 });
   let wrote = 0;
-  for (const [apiPath, name, trim] of SNAPSHOTS) {
+  for (const [apiPath, name, trim] of snapshots) {
     const res = await api.request('GET', `/${apiPath}`, {});
     if (!res.ok) {
-      console.log(`  skip ${apiPath} → ${res.status} (kept existing fixture if present)`);
+      log(`  skip ${apiPath} → ${res.status} (kept existing fixture if present)`);
       continue;
     }
-    const data = trim ? trim(res.data) : res.data;
-    fs.writeFileSync(path.join(FIXTURES, `${name}.json`), `${JSON.stringify(data, null, 2)}\n`);
+    // Scrubbed BEFORE the write, never after: fixtures/ is committed, so a copy of
+    // the live response that touched the disk would already be one `git add` away.
+    const data = scrubber.scrub(trim ? trim(res.data) : res.data, { ownAccount: isOwnAccountFixture(name) });
+    fs.writeFileSync(path.join(dir, `${name}.json`), `${JSON.stringify(data, null, 2)}\n`);
     wrote += 1;
-    console.log(`  wrote ${name}.json  (${apiPath})`);
+    log(`  wrote ${name}.json  (${apiPath})`);
   }
-  console.log(`refresh-fixtures: ${wrote}/${SNAPSHOTS.length} snapshots written to ${FIXTURES}`);
-})().catch((e) => { console.error(e.message || e); process.exit(1); });
+  log(`refresh-fixtures: ${wrote}/${snapshots.length} snapshots written to ${dir} (people replaced by stand-ins)`);
+  return wrote;
+}
+
+// scrubFixturesOnDisk — the same pass over the files already in fixtures/: the
+// hand-written ones (several copied real people in by hand) and anything written
+// before the scrub existed. Only values that change are rewritten, so a fixture
+// someone formatted by hand keeps its formatting.
+function scrubFixturesOnDisk({ dir = FIXTURES, log = console.log } = {}) {
+  const files = fs.readdirSync(dir).filter((f) => f.endsWith('.json')).sort();
+  const texts = files.map((f) => fs.readFileSync(path.join(dir, f), 'utf8'));
+  const scrubber = createScrubber({ firstNumber: highestStandIn(texts) + 1 });
+  let changed = 0;
+  files.forEach((file, idx) => {
+    const clean = scrubber.scrub(JSON.parse(texts[idx]), { ownAccount: isOwnAccountFixture(file.slice(0, -'.json'.length)) });
+    const next = rewriteScalars(texts[idx], clean);
+    if (next === texts[idx]) return;
+    fs.writeFileSync(path.join(dir, file), next);
+    changed += 1;
+    log(`  scrubbed ${file}`);
+  });
+  log(`refresh-fixtures --scrub-only: ${changed}/${files.length} fixture(s) rewritten in ${dir}`);
+  return changed;
+}
+
+module.exports = { refreshFixtures, scrubFixturesOnDisk, SNAPSHOTS };
+
+if (require.main === module) {
+  (async () => {
+    if (process.argv.includes('--scrub-only')) {
+      scrubFixturesOnDisk();
+      return;
+    }
+    // Required here, not at the top: a test that loads this file for the writer must
+    // not also load the CLI session machinery.
+    const { cliClient } = require('../gds/cli-lib');
+    await refreshFixtures({ api: await cliClient() });
+  })().catch((e) => { console.error(e.message || e); process.exit(1); });
+}

package/scripts/hall-preview/scrub-identity.js

@@ -0,0 +1,296 @@
+'use strict';
+// scripts/hall-preview/scrub-identity.js — replace the real people in a hall-preview
+// fixture with stand-ins before the file is written (task 1003647).
+//
+// WHY. refresh-fixtures.js snapshots LIVE API responses into fixtures/, and fixtures/
+// is committed. So every refresh published the GitHub login, display name, avatar and
+// GitHub id of everyone the snapshot could see — and, in me.json, the snapshotting
+// account's own credit balance and month-to-date spend — into the repo and every clone
+// of it. A leak like that is fixed in the WRITER: cleaning the output once re-leaks on
+// the next refresh. So refresh-fixtures.js passes every snapshot through here, and its
+// --scrub-only mode runs the same pass over files already on disk (hand-written ones
+// included, which copied real people in by hand).
+//
+// THE SCHEME.
+//   • A person becomes `builder-<n>` (login-shaped fields) / `Builder <n>` (names), one
+//     n per person for the whole run, so a builder reads the same on every page. The
+//     person is keyed by login; a name travels with the login beside it.
+//   • An avatar becomes GitHub's own "ghost" avatar — the account GitHub shows for
+//     deleted users. It is a real image, so pages still render, and it is nobody.
+//   • A GitHub id becomes the stand-in's n; an email, `builder-<n>@example.com`.
+//   • Private account figures (month-to-date spend, budgets) become fixed values
+//     wherever they appear. In the snapshotting account's OWN files (me, me__*), so do
+//     its credit balance and karma — the "caller's credits" this task was filed about.
+//     Other builders' balances are kept: with their names gone they describe "Builder
+//     3", not a person, and flattening them would flatten the leaderboard and roster
+//     previews the harness exists for.
+//   • null stays null and "" stays "". Pages branch on absence (initials when there is
+//     no avatar, the login when there is no display name) and tests pin those states.
+//
+// NOT TOUCHED. Instance-local numeric ids (builder, task, goal) — the harness routes on
+// them (analytics/builder/:id, /profile?id=…) and they name nobody outside that one
+// instance. Free text (task titles, descriptions) — project content, not a person's
+// record. The repo's own coordinates (instance.repo.owner is where the code lives).
+//
+// FIXED POINT. Every stand-in is recognised on the way back in (`builder-3` is person
+// 3), so scrubbing an already-scrubbed fixture changes nothing. tests/hall_preview_scrub.mjs
+// leans on exactly that: each committed fixture must already be a fixed point, which is
+// the same as saying no real identity is committed.
+
+// GitHub's "ghost" user (id 10137): the placeholder GitHub itself substitutes for a
+// deleted account. An https URL on the host the real avatars use, because the hall
+// renders avatars only through an http(s) check (roster.js / collab-lib.js httpUrl).
+const GHOST_AVATAR_URL = 'https://avatars.githubusercontent.com/u/10137?v=4';
+
+// The fixed values that replace private figures. Round, obviously fake, stable.
+const OWN_CREDITS = 1000;
+const OWN_KARMA = 10;
+const PRIVATE_FIGURES = { spend_mtd_usd: 42, budget_mtd_usd: 100, monthly_budget_usd: 100 };
+const PLACEHOLDER_TEXT = {
+  device_name: 'Preview device',
+  anthropic_user_id: 'anthropic-user-preview',
+  bio: 'A builder bio, replaced for the preview.',
+};
+
+const STAND_IN_LOGIN = /^builder-(\d+)$/i;
+const STAND_IN_NAME = /^Builder (\d+)$/;
+const STAND_IN_EMAIL = /^builder-(\d+)@example\.com$/i;
+
+const isLoginKey = (k) => k === 'github_login' || k === 'login' || k === 'handle' || /_login$/.test(k);
+const isAvatarKey = (k) => k === 'avatar_url' || /_avatar_url$/.test(k);
+const isGithubIdKey = (k) => k === 'github_id' || /_github_id$/.test(k);
+const isEmailKey = (k) => k === 'email' || /_email$/.test(k);
+// `by` / `*_by` holds a builder ID almost everywhere (created_by, shipped_by); only a
+// non-numeric value is a login (sandbox_review.by, who approved a staged change).
+const isByKey = (k) => k === 'by' || /_by$/.test(k);
+const looksLikeLogin = (v) => /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(v) && !/^\d+$/.test(v);
+
+// The login a name-shaped key belongs to, or undefined when the key is not a person's
+// name. `display_name` pairs with the object's own login; `<who>_name` and
+// `<who>_display_name` pair with `<who>_login` beside them — which is what keeps
+// `worktree_name` (no `worktree_login`) out.
+function nameOwnerKey(key, obj) {
+  if (key === 'display_name') return ['github_login', 'login', 'handle'].find((k) => k in obj) || null;
+  const m = /^(.+?)(?:_display)?_name$/.exec(key);
+  if (!m) return undefined;
+  const loginKey = `${m[1]}_login`;
+  return loginKey in obj ? loginKey : undefined;
+}
+
+// createScrubber — one registry of people for one run, so a builder gets the same n in
+// every file the run touches. `firstNumber` lets a run start above stand-ins already on
+// disk, so a new person never collides with one a hand-written fixture already uses.
+function createScrubber({ firstNumber = 1 } = {}) {
+  const people = new Map(); // 'login:<lower>' | 'name:<text>' | 'id:<github id>' | 'email:<lower>' → n
+  let next = Math.max(1, Number(firstNumber) || 1);
+
+  function numberFor(keys) {
+    for (const k of keys) if (k && people.has(k)) return remember(keys, people.get(k));
+    return remember(keys, next++);
+  }
+  function remember(keys, n) {
+    for (const k of keys) if (k) people.set(k, n);
+    if (n >= next) next = n + 1;
+    return n;
+  }
+
+  // The person an object describes, from whichever identity fields it carries. A
+  // stand-in keeps its own number; a real value gets the registry's.
+  function personOf(obj, loginKey, nameKey) {
+    const login = loginKey && typeof obj[loginKey] === 'string' ? obj[loginKey] : '';
+    const name = nameKey && typeof obj[nameKey] === 'string' ? obj[nameKey] : '';
+    const standIn = STAND_IN_LOGIN.exec(login) || STAND_IN_NAME.exec(name);
+    if (standIn) return remember([], Number(standIn[1]));
+    return numberFor([login && `login:${login.toLowerCase()}`, name && `name:${name}`]);
+  }
+
+  function scrubObject(obj, ctx) {
+    const out = {};
+    // The object's own person, resolved once so its login, name, avatar, GitHub id and
+    // email all land on the same n.
+    const ownLoginKey = ['github_login', 'login', 'handle'].find((k) => typeof obj[k] === 'string' && obj[k]);
+    const ownNameKey = typeof obj.display_name === 'string' && obj.display_name ? 'display_name' : null;
+    let selfN = null;
+    const self = () => {
+      if (selfN == null) selfN = (ownLoginKey || ownNameKey) ? personOf(obj, ownLoginKey, ownNameKey) : null;
+      return selfN;
+    };
+    const isPersonRecord = Boolean(ownLoginKey || ownNameKey);
+
+    for (const [key, value] of Object.entries(obj)) {
+      out[key] = scrubValue(key, value, obj, ctx, self, isPersonRecord);
+    }
+    return out;
+  }
+
+  function scrubArray(arr, ctx) {
+    return arr.map((v) => (Array.isArray(v) ? scrubArray(v, ctx) : v && typeof v === 'object' ? scrubObject(v, ctx) : v));
+  }
+
+  function scrubValue(key, value, obj, ctx, self, isPersonRecord) {
+    if (value && typeof value === 'object') {
+      if (key === 'links' && isPersonRecord) return scrubLinks(value);
+      const inner = Array.isArray(value) ? scrubArray(value, ctx) : scrubObject(value, ctx);
+      // An OWN-account file's roll-up totals are the account's own credits too.
+      if (ctx.ownAccount && key === 'totals' && !Array.isArray(inner)) {
+        if (typeof inner.credits === 'number') inner.credits = OWN_CREDITS;
+        if (typeof inner.karma === 'number') inner.karma = OWN_KARMA;
+      }
+      return inner;
+    }
+    if (value == null || value === '') return value; // absence is a state the pages render
+    if (key in PRIVATE_FIGURES) return typeof value === 'string' ? String(PRIVATE_FIGURES[key]) : PRIVATE_FIGURES[key];
+
+    if (typeof value === 'string') {
+      if (isLoginKey(key)) {
+        if (STAND_IN_LOGIN.test(value)) return value;
+        const n = ['github_login', 'login', 'handle'].includes(key) ? self() : personOf(obj, key, siblingNameKey(key, obj));
+        return `builder-${n}`;
+      }
+      const owner = nameOwnerKey(key, obj);
+      if (owner !== undefined) {
+        if (STAND_IN_NAME.test(value)) return value;
+        const n = key === 'display_name' ? self() : personOf(obj, owner, key);
+        return `Builder ${n}`;
+      }
+      if (isAvatarKey(key)) return GHOST_AVATAR_URL;
+      if (isEmailKey(key)) {
+        if (STAND_IN_EMAIL.test(value)) return value;
+        const n = isPersonRecord ? self() : numberFor([`email:${value.toLowerCase()}`]);
+        return `builder-${n}@example.com`;
+      }
+      if (isByKey(key) && looksLikeLogin(value)) {
+        if (STAND_IN_LOGIN.test(value)) return value;
+        return `builder-${numberFor([`login:${value.toLowerCase()}`])}`;
+      }
+      // A PR / commit author is a GitHub login; elsewhere `author` credits an
+      // organisation (a module's author), which is nobody's personal record.
+      if (key === 'author' && 'head_sha' in obj && looksLikeLogin(value)) {
+        if (STAND_IN_LOGIN.test(value)) return value;
+        return `builder-${numberFor([`login:${value.toLowerCase()}`])}`;
+      }
+      if (key in PLACEHOLDER_TEXT) return PLACEHOLDER_TEXT[key];
+      if (isGithubIdKey(key)) return String(githubIdFor(obj, value, self, isPersonRecord));
+      return value;
+    }
+
+    if (typeof value === 'number') {
+      if (isGithubIdKey(key)) return githubIdFor(obj, value, self, isPersonRecord);
+      if (ctx.ownAccount && isPersonRecord) {
+        if (key === 'total_credits') return OWN_CREDITS;
+        if (key === 'karma' || key === 'total_karma') return OWN_KARMA;
+      }
+    }
+    return value;
+  }
+
+  // A GitHub id names an account anywhere on GitHub, so it follows its person's n.
+  function githubIdFor(obj, value, self, isPersonRecord) {
+    if (isPersonRecord) return self();
+    const n = Number(value);
+    // A standalone small id is already a stand-in (real GitHub ids of any account a
+    // builder holds today are seven-plus digits).
+    if (Number.isInteger(n) && n > 0 && n < 100000) return n;
+    return numberFor([`id:${value}`]);
+  }
+
+  // The login key that sits beside a `<who>_name` key, for pairing the two.
+  function siblingNameKey(loginKey, obj) {
+    const who = loginKey.replace(/_login$/, '');
+    return [`${who}_name`, `${who}_display_name`].find((k) => typeof obj[k] === 'string' && obj[k]) || null;
+  }
+
+  // A profile's links are the person's own sites. Keep the shape, lose the addresses.
+  function scrubLinks(value) {
+    if (Array.isArray(value)) return value.map((v) => (typeof v === 'string' ? 'https://example.com/' : (v && typeof v === 'object' ? scrubLinks(v) : v)));
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = typeof v === 'string' && v ? 'https://example.com/' : (v && typeof v === 'object' ? scrubLinks(v) : v);
+    return out;
+  }
+
+  // scrub(data, { ownAccount }) — a scrubbed deep copy; the input is not mutated.
+  // ownAccount: the fixture IS the snapshotting account (me, me__*), so its own
+  // credit balance and karma are replaced too.
+  function scrub(data, { ownAccount = false } = {}) {
+    const ctx = { ownAccount };
+    if (Array.isArray(data)) return scrubArray(data, ctx);
+    return data && typeof data === 'object' ? scrubObject(data, ctx) : data;
+  }
+
+  return { scrub };
+}
+
+// A fixture named `me` or `me__…` is the snapshotting account's own record.
+const isOwnAccountFixture = (name) => name === 'me' || String(name).startsWith('me__');
+
+// The highest stand-in number already used in some fixture texts, so a new run can
+// start above it (createScrubber's firstNumber).
+function highestStandIn(texts) {
+  let max = 0;
+  for (const t of texts) {
+    for (const m of String(t).matchAll(/"builder-(\d+)(?:@example\.com)?"|"Builder (\d+)"/gi)) {
+      max = Math.max(max, Number(m[1] || m[2]));
+    }
+  }
+  return max;
+}
+
+// rewriteScalars(text, next) — the JSON text of a hand-written fixture with ONLY the
+// changed scalar values replaced, byte-for-byte everywhere else. A plain
+// JSON.stringify would also reformat every compact array and inline object a person
+// wrote by hand, burying a handful of identity edits in a whole-file rewrite.
+function rewriteScalars(text, next) {
+  const splices = [];
+  let i = 0;
+  const ws = () => { while (i < text.length && /\s/.test(text[i])) i++; };
+  const readString = () => {
+    const start = i++;
+    while (text[i] !== '"') i += text[i] === '\\' ? 2 : 1;
+    i++;
+    return { start, end: i, value: JSON.parse(text.slice(start, i)) };
+  };
+  const readScalar = () => {
+    if (text[i] === '"') return readString();
+    const start = i;
+    while (i < text.length && !/[\s,\]}]/.test(text[i])) i++;
+    return { start, end: i, value: JSON.parse(text.slice(start, i)) };
+  };
+  const visit = (after) => {
+    ws();
+    if (text[i] === '{') {
+      i++; ws();
+      if (text[i] === '}') { i++; return; }
+      for (;;) {
+        ws(); const { value: key } = readString(); ws(); i++; // the ':'
+        visit(after == null ? undefined : after[key]);
+        ws();
+        if (text[i] === ',') { i++; continue; }
+        i++; return; // the '}'
+      }
+    }
+    if (text[i] === '[') {
+      i++; ws();
+      if (text[i] === ']') { i++; return; }
+      for (let idx = 0; ; idx++) {
+        visit(after == null ? undefined : after[idx]);
+        ws();
+        if (text[i] === ',') { i++; continue; }
+        i++; return; // the ']'
+      }
+    }
+    const tok = readScalar();
+    if (after !== undefined && after !== tok.value) splices.push([tok.start, tok.end, JSON.stringify(after)]);
+  };
+  visit(next);
+  let out = text;
+  for (const [start, end, repl] of splices.reverse()) out = out.slice(0, start) + repl + out.slice(end);
+  return out;
+}
+
+module.exports = {
+  createScrubber,
+  isOwnAccountFixture,
+  highestStandIn,
+  rewriteScalars,
+  GHOST_AVATAR_URL,
+};

package/src/bongos/routes/security.js

@@ -21,7 +21,7 @@ const fs = require('node:fs/promises');
 const auth = require('../auth');
 const db = require('../db');
 const { validateOrRespond } = require('./_helpers');
-const { resolveEnv } = require('../../instance-config');
+const { resolveEnv, envPrefix } = require('../../instance-config');
 
 // Slug shape for security_docs (task 991): lowercase kebab, 1–128 chars. Used to
 // validate POST /security/docs and to safely interpolate :slug into the GET.
@@ -102,8 +102,8 @@ module.exports = function buildSecurityRouter() {
       }
       const hint =
         result.reason === 'env_not_set'
-          ? 'GDS_SECURITY_ADR_PATH is unset on the server; an Archon must provision the file and the env var.'
-          : 'GDS_SECURITY_ADR_PATH is set but the file is unreadable (missing, wrong perms, or wrong path).';
+          ? `${envPrefix()}_SECURITY_ADR_PATH is unset on the server; an Archon must provision the file and the env var.`
+          : `${envPrefix()}_SECURITY_ADR_PATH (or its legacy GDS_ spelling) is set but the file is unreadable (missing, wrong perms, or wrong path).`;
       return res.fail('security_adr_not_provisioned', 404, { reason: result.reason, hint });
     }
   );

package/src/build-info.js

@@ -8,13 +8,15 @@
 // deployedCommit === mergeCommit before flipping a task to shipped.
 //
 // Resolution order (resolveCommit is pure + exported for the test):
-//   1. env OTB_GIT_SHA  — set by ~/deploy.sh at restart if/when it chooses to;
+//   1. env <PREFIX>_GIT_SHA (BONGOS_GIT_SHA on a vanilla instance; the legacy
+//      OTB_GIT_SHA is still read) — set by ~/deploy.sh at restart if/when it chooses to;
 //      authoritative + cheap, and survives a checkout with no usable .git.
 //   2. `git rev-parse HEAD` in the checkout — accurate after deploy.sh's
 //      `git reset --hard origin/main`.
 //   3. null — unknown (callers must degrade gracefully, never hard-fail).
 
 const { execSync } = require('node:child_process');
+const { resolveEnv } = require('./instance-config');
 
 const SHA_RE = /^[0-9a-f]{7,40}$/i;
 
@@ -62,7 +64,7 @@ let _cache = null;
 // restarts the service), so caching is correct and keeps /version allocation-free.
 function buildInfo() {
   if (_cache) return _cache;
-  const fromEnv = resolveCommit({ envSha: process.env.OTB_GIT_SHA });
+  const fromEnv = resolveCommit({ envSha: resolveEnv('GIT_SHA') });
   const commit = fromEnv || resolveCommit({ gitSha: readGitSha() });
   _cache = {
     commit,