@bongos/core 1.19.1033 → 1.19.1035

package/scripts/gds/ship-preflight-steps.js

@@ -68,6 +68,33 @@ function shipInputPaths(args, { cwd = process.cwd(), repoRoot = null, realpath =
   return out;
 }
 
+// The code that RUNS the ship and the grade on this machine — what step (c) of
+// preflight() refuses to run from a stale copy. PATHSPECS, not a file list (task
+// 1004273): the list used to name ship.js and grader.js alone, and two carves moved
+// the logic out from under it (task 1003205 split ship.js into ~20 ship-*.js files;
+// grader.js now delegates to grader-*.js, grader-workers/ and grade-engine.js), so a
+// branch behind main on ship-land.js or grader-score.js sailed through. A prefix
+// covers the next carve too. They reach git as argv, never through a shell, so a
+// file that exists ONLY on origin/main (a new carve file) still matches — a shell
+// would have expanded the glob against this checkout and missed exactly that one.
+// tests/ship_preflight.mjs fails if a ship*.js / grader* / grade-engine file is not covered.
+const TOOLING_PATHSPECS = Object.freeze([
+  'scripts/gds/ship*.js',           // ship.js + every ship-*.js carved out of it
+  'scripts/gds/smoke-gds.js',
+  'scripts/gds/cli-lib.js',
+  'modules/grading/grader*',        // grader.js, grader-*.js, grader-rubric.json, grader-workers/
+  'modules/grading/grade-engine.js', // grader.js requires it (task 1002839)
+]);
+
+// staleToolingFiles — the tooling files origin/main has changed since this branch's
+// merge-base. Three-dot (HEAD...origin/main) scopes to the origin/main side, so the
+// builder's OWN edits to these files (shipping a ship fix) do not count. A failed git
+// call reads as nothing stale, as it always has. `cwd` is injectable for the test.
+function staleToolingFiles({ cwd } = {}) {
+  const out = argvOut('git', ['diff', '--name-only', 'HEAD...origin/main', '--', ...TOOLING_PATHSPECS], cwd ? { cwd } : {});
+  return out ? out.split('\n').map((s) => s.trim()).filter(Boolean) : [];
+}
+
 // opts: { force, inputFiles } — inputFiles is shipInputPaths(args) from the caller;
 // omitted (the resume path has no prose flags), nothing is excluded from the
 // untracked-file warning.
@@ -123,14 +150,7 @@ function preflight(claim, opts = {}) {
   // (HEAD...origin/main) scopes to changes on the origin/main side since the
   // merge-base, so the builder's OWN edits to these files (e.g. shipping a
   // ship.js fix) do not trip it.
-  const TOOLING_PATHS = [
-    'scripts/gds/ship.js',
-    'scripts/gds/smoke-gds.js',
-    'scripts/gds/cli-lib.js',
-    'modules/grading/grader.js', // BV1.R73: grading carved to modules/grading/
-  ];
-  const staleToolingStr = gitOk(`git diff --name-only HEAD...origin/main -- ${TOOLING_PATHS.join(' ')}`);
-  const staleTooling = staleToolingStr ? staleToolingStr.trim().split('\n').filter(Boolean) : [];
+  const staleTooling = staleToolingFiles();
   if (staleTooling.length > 0) {
     if (opts.force) {
       console.log(`  preflight: ship tooling is behind origin/main (${staleTooling.join(', ')}) — proceeding due to --force`);
@@ -373,4 +393,6 @@ module.exports = {
   parseDeletedUpstreamPaths,
   preflight,
   shipInputPaths,
+  staleToolingFiles,
+  TOOLING_PATHSPECS,
 };

package/scripts/gds/ship.js

@@ -354,7 +354,7 @@ module.exports = {
   // task 1045: the gate that defers the broadcast to the server on the server-
   // mediated publish path — exported so the truth table (ci+server → true, laptop
   // / non-ci → false) is unit-tested with no gh/network (env-driven via
-  // OTB_DEPLOY_MODE + OTB_PUSH_VIA_SERVER).
+  // <PREFIX>_DEPLOY_MODE + <PREFIX>_PUSH_VIA_SERVER).
   broadcastHandledByServer,
   fatalRecoveryLines, // G04 re-export (definition in ship-honesty.js)
 };

package/scripts/gds/upgrade.js

@@ -246,7 +246,7 @@ async function resolvePinPushAuth({ instanceDir, remote = 'origin' }, deps = {},
   if (!repo) return null;
   const auth = require('./provision-repo-auth');
   const inst = await auth.lookupInstanceRow(instanceDir, deps);
-  if (!inst) return null;
+  if (!inst) { const key = pinnedDeployKey(instanceDir, run); if (key) log(auth.missingRowNote(key, remote)); return null; } // task 1004065
   const rowRepo = auth.parseTargetRef(inst.target_ref);
   const same = (a, b) => a && b && a.owner.toLowerCase() === b.owner.toLowerCase() && a.name.toLowerCase() === b.name.toLowerCase();
   if (!same(rowRepo, repo)) {
@@ -407,7 +407,7 @@ function persistPin({ instanceDir, fromVersion, toVersion, commitPin, push = tru
       const repo = remoteGithubRepo(instanceDir, remote, run);
       err(`  ! PIN NOT PUSHED — GitHub refused the push to ${remote}, so this bump is NOT durable.`);
       err(`    ${remote} authenticates with the deploy key at ${key}, which is registered READ-ONLY on the`);
-      err(`    repository (ADR 0176): it can pull, never push. No owner GitHub token is stored to push with instead.${gitSaid(pushed)}`);
+      err(`    repository (ADR 0176): it can pull, never push. No owner GitHub token was available to push with instead (none is stored, or — on a hosted project's own box — the hub's record of it is not readable from here).${gitSaid(pushed)}`);
       revert();
       err('    Fix: have the instance owner reconnect GitHub with repository access (that stores a short-lived repo token),');
       err(`    then re-run \`bongos upgrade --commit-pin\` where that token is readable — the control plane, with --instance ${q(instanceDir)};`);
@@ -415,7 +415,7 @@ function persistPin({ instanceDir, fromVersion, toVersion, commitPin, push = tru
       err(`      ${at} push ${q(`https://github.com/${repo ? `${repo.owner}/${repo.name}` : '<owner>/<repo>'}.git`)} ${q(target)}`);
       return {
         applicable: true, committed: true, pushed: false, dirty, refused: 'read-only-deploy-key',
-        error: `GitHub refused the pin push: ${remote} authenticates with the read-only deploy key at ${key}, and no owner GitHub token is stored to push with — the pin is committed locally but not on the remote`,
+        error: `GitHub refused the pin push: ${remote} authenticates with the read-only deploy key at ${key}, and no owner GitHub token was available to push with — the pin is committed locally but not on the remote`,
       };
     }
     err(`  ! commit landed locally but the push to ${remote} FAILED — this bump is still not durable.`);

package/scripts/hall-preview/README.md

@@ -41,17 +41,18 @@ fetched live — read-only GETs — and layered over the fixtures in memory. The
 banner names whose hall you are looking at:
 
 ```
-  account: @scootermack (archon) — your own, live
+  account: @your-login (archon) — your own, live
 ```
 
 Nothing is written to `fixtures/` (that's `refresh-fixtures.js`'s job), so the
 checked-in snapshot stays the fallback. It serves whenever the live read can't
 happen — signed out, expired session, offline, or an endpoint your rank can't
 call (that one keeps its own fixture and the rest of your identity still lands).
-Every fallback says why, and says the hall is about to show you someone else:
+Every fallback says why, and says the hall is about to show you someone else — a
+stand-in, since the snapshot's people are scrubbed (see [Fixtures](#fixtures)):
 
 ```
-  account: @jaxri (metic) — NOT YOURS, the checked-in fixture: this machine has no Bongos CLI session — run /builder-setup
+  account: @builder-4 (metic) — NOT YOURS, the checked-in fixture: this machine has no Bongos CLI session — run /builder-setup
 ```
 
 **`--fixture-me` pins the snapshot.** Use it for the screenshot matrix below —
@@ -74,6 +75,22 @@ node scripts/hall-preview/refresh-fixtures.js
 
 Box/terminal endpoints are deliberately never snapshotted (connection details).
 
+**No real person is ever checked in (task 1003647).** `fixtures/` is committed, so
+`refresh-fixtures.js` runs every snapshot through [`scrub-identity.js`](scrub-identity.js)
+*before* writing it: logins, display names, avatars, GitHub ids and emails become
+stand-ins (`builder-3` / `Builder 3`, GitHub's ghost avatar), one per person across the
+run, and the snapshotting account's own credit balance, karma and spend (`me`, `me__*`)
+become fixed values. Instance-local ids and free text (task titles, descriptions) are
+left alone. Hand-edited a fixture? Run the same pass over the files on disk — no
+network, and it rewrites only the values that change:
+
+```bash
+node scripts/hall-preview/refresh-fixtures.js --scrub-only
+```
+
+`tests/hall_preview_scrub.mjs` fails while any committed fixture still carries a real
+identity.
+
 ## The evidence matrix (per page-redesign ship)
 
 Screenshot every changed page at **{light, dark} × {1280w, 390w}**, plus one

package/scripts/hall-preview/live-identity.js

@@ -4,7 +4,7 @@
 //
 // The harness answers every read from checked-in fixtures, and fixtures/me.json
 // is one particular builder's snapshot. So every preview greeted whoever ran it
-// as somebody else ("Welcome back, Jackson Rini"), with that builder's credits,
+// as somebody else ("Welcome back, <whoever was snapshotted>"), with that builder's credits,
 // achievements, goals and RANK — and because that snapshot is a metic, the
 // Archon-gated pages rendered their sealed notice, so a UI change to them could
 // not be reviewed at all. Reviewing your own UI change against someone else's

package/scripts/hall-preview/refresh-fixtures.js

@@ -7,11 +7,18 @@
 // Read-only: GETs only. Endpoints that 403/404 for the caller's rank are
 // skipped (the existing fixture, if any, is kept). Box/terminal endpoints are
 // deliberately NOT snapshotted (they carry host/connection details).
+//
+// PEOPLE ARE SCRUBBED ON WRITE (task 1003647). fixtures/ is committed, so every
+// snapshot goes through ./scrub-identity.js before it touches the disk: logins,
+// names, avatars, GitHub ids and emails become stand-ins (`builder-3` / `Builder
+// 3`), and the snapshotting account's own balance and spend become fixed values.
+// Hand-edited a fixture? Re-run the same pass over the files on disk, no network:
+//   node scripts/hall-preview/refresh-fixtures.js --scrub-only
 'use strict';
 
 const fs = require('fs');
 const path = require('path');
-const { cliClient } = require('../gds/cli-lib');
+const { createScrubber, isOwnAccountFixture, highestStandIn, rewriteScalars } = require('./scrub-identity');
 
 const FIXTURES = path.join(__dirname, 'fixtures');
 
@@ -77,20 +84,73 @@ const SNAPSHOTS = [
   ['public/versions', 'public__versions'],
 ];
 
-(async () => {
-  const api = await cliClient();
-  fs.mkdirSync(FIXTURES, { recursive: true });
+// Every existing fixture's text — read so a run can number new stand-ins above the
+// ones already in use (a hand-written fixture may carry `builder-7`).
+function readFixtureTexts(dir) {
+  try {
+    return fs.readdirSync(dir).filter((f) => f.endsWith('.json')).map((f) => fs.readFileSync(path.join(dir, f), 'utf8'));
+  } catch (e) {
+    if (e.code === 'ENOENT') return [];
+    throw e;
+  }
+}
+
+// refreshFixtures — GET each snapshot, scrub the people out of it, write it. The api,
+// directory and logger are injected so tests/hall_preview_scrub.mjs drives this exact
+// writer with no network and a temp directory.
+async function refreshFixtures({ api, dir = FIXTURES, snapshots = SNAPSHOTS, log = console.log } = {}) {
+  fs.mkdirSync(dir, { recursive: true });
+  const scrubber = createScrubber({ firstNumber: highestStandIn(readFixtureTexts(dir)) + 1 });
   let wrote = 0;
-  for (const [apiPath, name, trim] of SNAPSHOTS) {
+  for (const [apiPath, name, trim] of snapshots) {
     const res = await api.request('GET', `/${apiPath}`, {});
     if (!res.ok) {
-      console.log(`  skip ${apiPath} → ${res.status} (kept existing fixture if present)`);
+      log(`  skip ${apiPath} → ${res.status} (kept existing fixture if present)`);
       continue;
     }
-    const data = trim ? trim(res.data) : res.data;
-    fs.writeFileSync(path.join(FIXTURES, `${name}.json`), `${JSON.stringify(data, null, 2)}\n`);
+    // Scrubbed BEFORE the write, never after: fixtures/ is committed, so a copy of
+    // the live response that touched the disk would already be one `git add` away.
+    const data = scrubber.scrub(trim ? trim(res.data) : res.data, { ownAccount: isOwnAccountFixture(name) });
+    fs.writeFileSync(path.join(dir, `${name}.json`), `${JSON.stringify(data, null, 2)}\n`);
     wrote += 1;
-    console.log(`  wrote ${name}.json  (${apiPath})`);
+    log(`  wrote ${name}.json  (${apiPath})`);
   }
-  console.log(`refresh-fixtures: ${wrote}/${SNAPSHOTS.length} snapshots written to ${FIXTURES}`);
-})().catch((e) => { console.error(e.message || e); process.exit(1); });
+  log(`refresh-fixtures: ${wrote}/${snapshots.length} snapshots written to ${dir} (people replaced by stand-ins)`);
+  return wrote;
+}
+
+// scrubFixturesOnDisk — the same pass over the files already in fixtures/: the
+// hand-written ones (several copied real people in by hand) and anything written
+// before the scrub existed. Only values that change are rewritten, so a fixture
+// someone formatted by hand keeps its formatting.
+function scrubFixturesOnDisk({ dir = FIXTURES, log = console.log } = {}) {
+  const files = fs.readdirSync(dir).filter((f) => f.endsWith('.json')).sort();
+  const texts = files.map((f) => fs.readFileSync(path.join(dir, f), 'utf8'));
+  const scrubber = createScrubber({ firstNumber: highestStandIn(texts) + 1 });
+  let changed = 0;
+  files.forEach((file, idx) => {
+    const clean = scrubber.scrub(JSON.parse(texts[idx]), { ownAccount: isOwnAccountFixture(file.slice(0, -'.json'.length)) });
+    const next = rewriteScalars(texts[idx], clean);
+    if (next === texts[idx]) return;
+    fs.writeFileSync(path.join(dir, file), next);
+    changed += 1;
+    log(`  scrubbed ${file}`);
+  });
+  log(`refresh-fixtures --scrub-only: ${changed}/${files.length} fixture(s) rewritten in ${dir}`);
+  return changed;
+}
+
+module.exports = { refreshFixtures, scrubFixturesOnDisk, SNAPSHOTS };
+
+if (require.main === module) {
+  (async () => {
+    if (process.argv.includes('--scrub-only')) {
+      scrubFixturesOnDisk();
+      return;
+    }
+    // Required here, not at the top: a test that loads this file for the writer must
+    // not also load the CLI session machinery.
+    const { cliClient } = require('../gds/cli-lib');
+    await refreshFixtures({ api: await cliClient() });
+  })().catch((e) => { console.error(e.message || e); process.exit(1); });
+}

package/scripts/hall-preview/scrub-identity.js

@@ -0,0 +1,296 @@
+'use strict';
+// scripts/hall-preview/scrub-identity.js — replace the real people in a hall-preview
+// fixture with stand-ins before the file is written (task 1003647).
+//
+// WHY. refresh-fixtures.js snapshots LIVE API responses into fixtures/, and fixtures/
+// is committed. So every refresh published the GitHub login, display name, avatar and
+// GitHub id of everyone the snapshot could see — and, in me.json, the snapshotting
+// account's own credit balance and month-to-date spend — into the repo and every clone
+// of it. A leak like that is fixed in the WRITER: cleaning the output once re-leaks on
+// the next refresh. So refresh-fixtures.js passes every snapshot through here, and its
+// --scrub-only mode runs the same pass over files already on disk (hand-written ones
+// included, which copied real people in by hand).
+//
+// THE SCHEME.
+//   • A person becomes `builder-<n>` (login-shaped fields) / `Builder <n>` (names), one
+//     n per person for the whole run, so a builder reads the same on every page. The
+//     person is keyed by login; a name travels with the login beside it.
+//   • An avatar becomes GitHub's own "ghost" avatar — the account GitHub shows for
+//     deleted users. It is a real image, so pages still render, and it is nobody.
+//   • A GitHub id becomes the stand-in's n; an email, `builder-<n>@example.com`.
+//   • Private account figures (month-to-date spend, budgets) become fixed values
+//     wherever they appear. In the snapshotting account's OWN files (me, me__*), so do
+//     its credit balance and karma — the "caller's credits" this task was filed about.
+//     Other builders' balances are kept: with their names gone they describe "Builder
+//     3", not a person, and flattening them would flatten the leaderboard and roster
+//     previews the harness exists for.
+//   • null stays null and "" stays "". Pages branch on absence (initials when there is
+//     no avatar, the login when there is no display name) and tests pin those states.
+//
+// NOT TOUCHED. Instance-local numeric ids (builder, task, goal) — the harness routes on
+// them (analytics/builder/:id, /profile?id=…) and they name nobody outside that one
+// instance. Free text (task titles, descriptions) — project content, not a person's
+// record. The repo's own coordinates (instance.repo.owner is where the code lives).
+//
+// FIXED POINT. Every stand-in is recognised on the way back in (`builder-3` is person
+// 3), so scrubbing an already-scrubbed fixture changes nothing. tests/hall_preview_scrub.mjs
+// leans on exactly that: each committed fixture must already be a fixed point, which is
+// the same as saying no real identity is committed.
+
+// GitHub's "ghost" user (id 10137): the placeholder GitHub itself substitutes for a
+// deleted account. An https URL on the host the real avatars use, because the hall
+// renders avatars only through an http(s) check (roster.js / collab-lib.js httpUrl).
+const GHOST_AVATAR_URL = 'https://avatars.githubusercontent.com/u/10137?v=4';
+
+// The fixed values that replace private figures. Round, obviously fake, stable.
+const OWN_CREDITS = 1000;
+const OWN_KARMA = 10;
+const PRIVATE_FIGURES = { spend_mtd_usd: 42, budget_mtd_usd: 100, monthly_budget_usd: 100 };
+const PLACEHOLDER_TEXT = {
+  device_name: 'Preview device',
+  anthropic_user_id: 'anthropic-user-preview',
+  bio: 'A builder bio, replaced for the preview.',
+};
+
+const STAND_IN_LOGIN = /^builder-(\d+)$/i;
+const STAND_IN_NAME = /^Builder (\d+)$/;
+const STAND_IN_EMAIL = /^builder-(\d+)@example\.com$/i;
+
+const isLoginKey = (k) => k === 'github_login' || k === 'login' || k === 'handle' || /_login$/.test(k);
+const isAvatarKey = (k) => k === 'avatar_url' || /_avatar_url$/.test(k);
+const isGithubIdKey = (k) => k === 'github_id' || /_github_id$/.test(k);
+const isEmailKey = (k) => k === 'email' || /_email$/.test(k);
+// `by` / `*_by` holds a builder ID almost everywhere (created_by, shipped_by); only a
+// non-numeric value is a login (sandbox_review.by, who approved a staged change).
+const isByKey = (k) => k === 'by' || /_by$/.test(k);
+const looksLikeLogin = (v) => /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(v) && !/^\d+$/.test(v);
+
+// The login a name-shaped key belongs to, or undefined when the key is not a person's
+// name. `display_name` pairs with the object's own login; `<who>_name` and
+// `<who>_display_name` pair with `<who>_login` beside them — which is what keeps
+// `worktree_name` (no `worktree_login`) out.
+function nameOwnerKey(key, obj) {
+  if (key === 'display_name') return ['github_login', 'login', 'handle'].find((k) => k in obj) || null;
+  const m = /^(.+?)(?:_display)?_name$/.exec(key);
+  if (!m) return undefined;
+  const loginKey = `${m[1]}_login`;
+  return loginKey in obj ? loginKey : undefined;
+}
+
+// createScrubber — one registry of people for one run, so a builder gets the same n in
+// every file the run touches. `firstNumber` lets a run start above stand-ins already on
+// disk, so a new person never collides with one a hand-written fixture already uses.
+function createScrubber({ firstNumber = 1 } = {}) {
+  const people = new Map(); // 'login:<lower>' | 'name:<text>' | 'id:<github id>' | 'email:<lower>' → n
+  let next = Math.max(1, Number(firstNumber) || 1);
+
+  function numberFor(keys) {
+    for (const k of keys) if (k && people.has(k)) return remember(keys, people.get(k));
+    return remember(keys, next++);
+  }
+  function remember(keys, n) {
+    for (const k of keys) if (k) people.set(k, n);
+    if (n >= next) next = n + 1;
+    return n;
+  }
+
+  // The person an object describes, from whichever identity fields it carries. A
+  // stand-in keeps its own number; a real value gets the registry's.
+  function personOf(obj, loginKey, nameKey) {
+    const login = loginKey && typeof obj[loginKey] === 'string' ? obj[loginKey] : '';
+    const name = nameKey && typeof obj[nameKey] === 'string' ? obj[nameKey] : '';
+    const standIn = STAND_IN_LOGIN.exec(login) || STAND_IN_NAME.exec(name);
+    if (standIn) return remember([], Number(standIn[1]));
+    return numberFor([login && `login:${login.toLowerCase()}`, name && `name:${name}`]);
+  }
+
+  function scrubObject(obj, ctx) {
+    const out = {};
+    // The object's own person, resolved once so its login, name, avatar, GitHub id and
+    // email all land on the same n.
+    const ownLoginKey = ['github_login', 'login', 'handle'].find((k) => typeof obj[k] === 'string' && obj[k]);
+    const ownNameKey = typeof obj.display_name === 'string' && obj.display_name ? 'display_name' : null;
+    let selfN = null;
+    const self = () => {
+      if (selfN == null) selfN = (ownLoginKey || ownNameKey) ? personOf(obj, ownLoginKey, ownNameKey) : null;
+      return selfN;
+    };
+    const isPersonRecord = Boolean(ownLoginKey || ownNameKey);
+
+    for (const [key, value] of Object.entries(obj)) {
+      out[key] = scrubValue(key, value, obj, ctx, self, isPersonRecord);
+    }
+    return out;
+  }
+
+  function scrubArray(arr, ctx) {
+    return arr.map((v) => (Array.isArray(v) ? scrubArray(v, ctx) : v && typeof v === 'object' ? scrubObject(v, ctx) : v));
+  }
+
+  function scrubValue(key, value, obj, ctx, self, isPersonRecord) {
+    if (value && typeof value === 'object') {
+      if (key === 'links' && isPersonRecord) return scrubLinks(value);
+      const inner = Array.isArray(value) ? scrubArray(value, ctx) : scrubObject(value, ctx);
+      // An OWN-account file's roll-up totals are the account's own credits too.
+      if (ctx.ownAccount && key === 'totals' && !Array.isArray(inner)) {
+        if (typeof inner.credits === 'number') inner.credits = OWN_CREDITS;
+        if (typeof inner.karma === 'number') inner.karma = OWN_KARMA;
+      }
+      return inner;
+    }
+    if (value == null || value === '') return value; // absence is a state the pages render
+    if (key in PRIVATE_FIGURES) return typeof value === 'string' ? String(PRIVATE_FIGURES[key]) : PRIVATE_FIGURES[key];
+
+    if (typeof value === 'string') {
+      if (isLoginKey(key)) {
+        if (STAND_IN_LOGIN.test(value)) return value;
+        const n = ['github_login', 'login', 'handle'].includes(key) ? self() : personOf(obj, key, siblingNameKey(key, obj));
+        return `builder-${n}`;
+      }
+      const owner = nameOwnerKey(key, obj);
+      if (owner !== undefined) {
+        if (STAND_IN_NAME.test(value)) return value;
+        const n = key === 'display_name' ? self() : personOf(obj, owner, key);
+        return `Builder ${n}`;
+      }
+      if (isAvatarKey(key)) return GHOST_AVATAR_URL;
+      if (isEmailKey(key)) {
+        if (STAND_IN_EMAIL.test(value)) return value;
+        const n = isPersonRecord ? self() : numberFor([`email:${value.toLowerCase()}`]);
+        return `builder-${n}@example.com`;
+      }
+      if (isByKey(key) && looksLikeLogin(value)) {
+        if (STAND_IN_LOGIN.test(value)) return value;
+        return `builder-${numberFor([`login:${value.toLowerCase()}`])}`;
+      }
+      // A PR / commit author is a GitHub login; elsewhere `author` credits an
+      // organisation (a module's author), which is nobody's personal record.
+      if (key === 'author' && 'head_sha' in obj && looksLikeLogin(value)) {
+        if (STAND_IN_LOGIN.test(value)) return value;
+        return `builder-${numberFor([`login:${value.toLowerCase()}`])}`;
+      }
+      if (key in PLACEHOLDER_TEXT) return PLACEHOLDER_TEXT[key];
+      if (isGithubIdKey(key)) return String(githubIdFor(obj, value, self, isPersonRecord));
+      return value;
+    }
+
+    if (typeof value === 'number') {
+      if (isGithubIdKey(key)) return githubIdFor(obj, value, self, isPersonRecord);
+      if (ctx.ownAccount && isPersonRecord) {
+        if (key === 'total_credits') return OWN_CREDITS;
+        if (key === 'karma' || key === 'total_karma') return OWN_KARMA;
+      }
+    }
+    return value;
+  }
+
+  // A GitHub id names an account anywhere on GitHub, so it follows its person's n.
+  function githubIdFor(obj, value, self, isPersonRecord) {
+    if (isPersonRecord) return self();
+    const n = Number(value);
+    // A standalone small id is already a stand-in (real GitHub ids of any account a
+    // builder holds today are seven-plus digits).
+    if (Number.isInteger(n) && n > 0 && n < 100000) return n;
+    return numberFor([`id:${value}`]);
+  }
+
+  // The login key that sits beside a `<who>_name` key, for pairing the two.
+  function siblingNameKey(loginKey, obj) {
+    const who = loginKey.replace(/_login$/, '');
+    return [`${who}_name`, `${who}_display_name`].find((k) => typeof obj[k] === 'string' && obj[k]) || null;
+  }
+
+  // A profile's links are the person's own sites. Keep the shape, lose the addresses.
+  function scrubLinks(value) {
+    if (Array.isArray(value)) return value.map((v) => (typeof v === 'string' ? 'https://example.com/' : (v && typeof v === 'object' ? scrubLinks(v) : v)));
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = typeof v === 'string' && v ? 'https://example.com/' : (v && typeof v === 'object' ? scrubLinks(v) : v);
+    return out;
+  }
+
+  // scrub(data, { ownAccount }) — a scrubbed deep copy; the input is not mutated.
+  // ownAccount: the fixture IS the snapshotting account (me, me__*), so its own
+  // credit balance and karma are replaced too.
+  function scrub(data, { ownAccount = false } = {}) {
+    const ctx = { ownAccount };
+    if (Array.isArray(data)) return scrubArray(data, ctx);
+    return data && typeof data === 'object' ? scrubObject(data, ctx) : data;
+  }
+
+  return { scrub };
+}
+
+// A fixture named `me` or `me__…` is the snapshotting account's own record.
+const isOwnAccountFixture = (name) => name === 'me' || String(name).startsWith('me__');
+
+// The highest stand-in number already used in some fixture texts, so a new run can
+// start above it (createScrubber's firstNumber).
+function highestStandIn(texts) {
+  let max = 0;
+  for (const t of texts) {
+    for (const m of String(t).matchAll(/"builder-(\d+)(?:@example\.com)?"|"Builder (\d+)"/gi)) {
+      max = Math.max(max, Number(m[1] || m[2]));
+    }
+  }
+  return max;
+}
+
+// rewriteScalars(text, next) — the JSON text of a hand-written fixture with ONLY the
+// changed scalar values replaced, byte-for-byte everywhere else. A plain
+// JSON.stringify would also reformat every compact array and inline object a person
+// wrote by hand, burying a handful of identity edits in a whole-file rewrite.
+function rewriteScalars(text, next) {
+  const splices = [];
+  let i = 0;
+  const ws = () => { while (i < text.length && /\s/.test(text[i])) i++; };
+  const readString = () => {
+    const start = i++;
+    while (text[i] !== '"') i += text[i] === '\\' ? 2 : 1;
+    i++;
+    return { start, end: i, value: JSON.parse(text.slice(start, i)) };
+  };
+  const readScalar = () => {
+    if (text[i] === '"') return readString();
+    const start = i;
+    while (i < text.length && !/[\s,\]}]/.test(text[i])) i++;
+    return { start, end: i, value: JSON.parse(text.slice(start, i)) };
+  };
+  const visit = (after) => {
+    ws();
+    if (text[i] === '{') {
+      i++; ws();
+      if (text[i] === '}') { i++; return; }
+      for (;;) {
+        ws(); const { value: key } = readString(); ws(); i++; // the ':'
+        visit(after == null ? undefined : after[key]);
+        ws();
+        if (text[i] === ',') { i++; continue; }
+        i++; return; // the '}'
+      }
+    }
+    if (text[i] === '[') {
+      i++; ws();
+      if (text[i] === ']') { i++; return; }
+      for (let idx = 0; ; idx++) {
+        visit(after == null ? undefined : after[idx]);
+        ws();
+        if (text[i] === ',') { i++; continue; }
+        i++; return; // the ']'
+      }
+    }
+    const tok = readScalar();
+    if (after !== undefined && after !== tok.value) splices.push([tok.start, tok.end, JSON.stringify(after)]);
+  };
+  visit(next);
+  let out = text;
+  for (const [start, end, repl] of splices.reverse()) out = out.slice(0, start) + repl + out.slice(end);
+  return out;
+}
+
+module.exports = {
+  createScrubber,
+  isOwnAccountFixture,
+  highestStandIn,
+  rewriteScalars,
+  GHOST_AVATAR_URL,
+};

package/src/bongos/core-update.js

@@ -144,4 +144,26 @@ async function readCoreUpdate({ running, channel, get, ...deps } = {}) {
   return coreUpdateVerdict({ running, available: r.ok ? r.versions : [], channel });
 }
 
-module.exports = { readCoreUpdate };
+// readCoreUpgrades — the instance's own core-upgrade ledger, newest first: when the
+// core pin last moved, from which version to which, and who or what moved it (task
+// 1002669). `core_upgrades` is written by `bongos upgrade` on every successful move and
+// rollback (scripts/gds/upgrade.js), including the unattended patch sweep's, and no
+// route read it — so "when did the pin last move" needed an SSH session. The pool is
+// injectable so the test runs with no database; the default is the instance's own.
+async function readCoreUpgrades({ limit = 20, pool = null } = {}) {
+  const db = pool || require('./pool').pool;
+  const { rows } = await db.query(
+    `SELECT id, from_version, to_version, source_commit, note, applied_at, source, requested_by_builder_id
+       FROM core_upgrades
+      ORDER BY applied_at DESC, id DESC
+      LIMIT $1`,
+    [limit]
+  );
+  return rows.map((r) => ({
+    ...r,
+    id: String(r.id),
+    requested_by_builder_id: r.requested_by_builder_id == null ? null : String(r.requested_by_builder_id),
+  }));
+}
+
+module.exports = { readCoreUpdate, readCoreUpgrades };

package/src/bongos/routes/core-update.js

@@ -21,9 +21,16 @@
 const express = require('express');
 const { asyncHandler } = require('./_helpers');
 const auth = require('../auth');
-const { readCoreUpdate } = require('../core-update');
+const { readCoreUpdate, readCoreUpgrades } = require('../core-update');
 
-module.exports = function buildCoreUpdateRouter() {
+// ?limit for GET /core-upgrades: an integer 1..100, else 20.
+function upgradesLimit(raw) {
+  const n = Number.parseInt(String(raw ?? ''), 10);
+  if (!Number.isFinite(n)) return 20;
+  return Math.min(100, Math.max(1, n));
+}
+
+module.exports = function buildCoreUpdateRouter({ upgrades = readCoreUpgrades } = {}) {
   const router = express.Router();
 
   router.get(
@@ -45,5 +52,23 @@ module.exports = function buildCoreUpdateRouter() {
     }, { errorCode: 'core_update_failed', message: false }),
   );
 
+  // GET /core-upgrades — the instance's own core-upgrade ledger, newest first: when
+  // the pin last moved, from and to which version, and whether a person or the
+  // unattended sweep moved it (task 1002669). READ-ONLY. Gated on the SAME atom as
+  // /core-update above and the deploy door, for the same first reason: it names the
+  // exact core this box has run and when, which is a vulnerability-window disclosure
+  // (ADR 0043). No new atom, so no migration. ?limit=1..100 (default 20).
+  router.get(
+    '/core-upgrades',
+    auth.requireBuilder,
+    auth.requirePermission('core.pin.move'),
+    asyncHandler('GET /core-upgrades', async (req, res) => {
+      let running = null;
+      try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
+      const limit = upgradesLimit(req.query.limit);
+      res.json({ ok: true, running, limit, upgrades: await upgrades({ limit }) });
+    }, { errorCode: 'core_upgrades_unreadable', message: false }),
+  );
+
   return router;
 };

package/src/bongos/routes/security.js

@@ -21,7 +21,7 @@ const fs = require('node:fs/promises');
 const auth = require('../auth');
 const db = require('../db');
 const { validateOrRespond } = require('./_helpers');
-const { resolveEnv } = require('../../instance-config');
+const { resolveEnv, envPrefix } = require('../../instance-config');
 
 // Slug shape for security_docs (task 991): lowercase kebab, 1–128 chars. Used to
 // validate POST /security/docs and to safely interpolate :slug into the GET.
@@ -102,8 +102,8 @@ module.exports = function buildSecurityRouter() {
       }
       const hint =
         result.reason === 'env_not_set'
-          ? 'GDS_SECURITY_ADR_PATH is unset on the server; an Archon must provision the file and the env var.'
-          : 'GDS_SECURITY_ADR_PATH is set but the file is unreadable (missing, wrong perms, or wrong path).';
+          ? `${envPrefix()}_SECURITY_ADR_PATH is unset on the server; an Archon must provision the file and the env var.`
+          : `${envPrefix()}_SECURITY_ADR_PATH (or its legacy GDS_ spelling) is set but the file is unreadable (missing, wrong perms, or wrong path).`;
       return res.fail('security_adr_not_provisioned', 404, { reason: result.reason, hint });
     }
   );