@bongos/core 1.19.1049 → 1.19.1050

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1049",
-  "core_contract": "1.19.1049",
-  "source_commit": "9d25b951a2f85a4303027917ebf5c95d02cac06e",
+  "core_version": "1.19.1050",
+  "core_contract": "1.19.1050",
+  "source_commit": "58c76064d5864e4579213b609e0113be3685e0ac",
   "source_ref": "HEAD",
-  "built_at": "2026-09-27T13:43:34.143Z",
+  "built_at": "2026-09-27T13:58:16.724Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 543,
+    "docs_redacted": 542,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2513,
+    "functional_verbatim": 2507,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3083,
-  "tree_sha256": "a84ed2035d842841f5e0b994df4754f714dc15c3ff0f080cef771d939cd37e7b",
+  "file_count": 3076,
+  "tree_sha256": "d89a3236ad7eedff9ab8575517a3ff1e564ae1bbac3b72a37cace58ee3ac8f0a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -259,41 +259,6 @@
       "mode": "0000644",
       "sha256": "6548fe1de89c6909def02b76f022cae739c5b129d179a63538b9a1ab252e5030"
     },
-    {
-      "path": ".devcontainer/Dockerfile",
-      "mode": "0000644",
-      "sha256": "8e2a619a3d72bfcb91440fd5773622fefb773b5effea1e6c7f7d6c2e01f14817"
-    },
-    {
-      "path": ".devcontainer/README.md",
-      "mode": "0000644",
-      "sha256": "33038ae214c708ce3e5c2539c5e672e82da76b882df93d6d906a041fc22253bb"
-    },
-    {
-      "path": ".devcontainer/devcontainer-lock.json",
-      "mode": "0000644",
-      "sha256": "ef6b1d2b6d7fdaea6d1a6b0d91378fa18e2f9f49bdf8ffbf541f8659d68574dc"
-    },
-    {
-      "path": ".devcontainer/devcontainer.json",
-      "mode": "0000644",
-      "sha256": "4ea21a7f615b5f9cb3a657f6c053d3680aed99c9c33cc70cbac398068fd6c309"
-    },
-    {
-      "path": ".devcontainer/healthcheck.sh",
-      "mode": "0000644",
-      "sha256": "5b04ae8e3436e659339eb0f820623844d22ccdbd07d6e9775aa6df17f6d1dd30"
-    },
-    {
-      "path": ".devcontainer/init-firewall.sh",
-      "mode": "0000644",
-      "sha256": "bcff88c5ca2835456f43992b6d9506e62ffb1475e20d7b15819f4572f5abb5ee"
-    },
-    {
-      "path": ".devcontainer/post-create.sh",
-      "mode": "0000644",
-      "sha256": "ba1f564c1d91473e545a1e33051a4c1952db037e5e607b1d219bde97280174b7"
-    },
     {
       "path": ".dockerignore",
       "mode": "0000644",
@@ -2762,7 +2727,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "a964665831275c3ec74a9350e758958f05ad61b5a7de569c1291565e1cd84366"
+      "sha256": "64d65a849596466c7fbafba381668129c2e305e88af805dc5eed06a5b06600bb"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2772,7 +2737,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "113ce655a21853395a81cfdcf467e9de8e1e8b46e5dfe15b1dd5f4d9401e0193"
+      "sha256": "cdd113e011377d05ef9d923798dea05b1c6ee4936ca4e026fd402395ed0b1223"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8497,12 +8462,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "acb5560af98adc58a474b3aa9fd2280a803c10e58538fb31f4c7cbd6be8518e2"
+      "sha256": "d776fedff4ca4e2858592181e4d5afc71ea7cb5aef553466f831117d0dd2a435"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "dd99e950d328fee80b5a502201e1a2193d15590a5fe489645beca54695f9a774"
+      "sha256": "0bc6e929e86642d34b2a0c1655ca4926adbbb2089d7ed683bb5792c06dee5fc4"
     },
     {
       "path": "public-docs/index.html",
@@ -8522,7 +8487,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "e0a7dbc41f8706f31363a5ef24aed64d4176f23edb66c72e99911a58beee7835"
+      "sha256": "40a0e88364bef2a5e7fadeaa8f48b8ac8fa9b49a5e113e0c28ff1065fd116515"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9532,7 +9497,7 @@
     {
       "path": "scripts/gds/publish-manifest.js",
       "mode": "0000644",
-      "sha256": "dc5845faf4042a4272b2fbc72d8d62bb6f95b9f860d9501d3f5e710e47e910e3"
+      "sha256": "17cb93e59d7f05319d8245fcbe9e55d5821c559680ce65f28fef763afece3b4c"
     },
     {
       "path": "scripts/gds/publish-watch.js",
@@ -10217,7 +10182,7 @@
     {
       "path": "scripts/setup-builder.sh",
       "mode": "0000644",
-      "sha256": "5860bf9daef3dd83a5ff4d3ee5e017e3cbd465ebda0c00df4ca622d629468ec4"
+      "sha256": "f449553cc1965f6801e7a72a1dc90724ad7556eb047834c73c77ae9ab7ae2f76"
     },
     {
       "path": "scripts/status-mirror-sync.js",
@@ -10387,7 +10352,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "a5510df1cd4704db5d7c0a3c381ecdf591c9fa7b6ed6bd4fddcfd002611e288c"
+      "sha256": "8f15e21380fe09d31b1a19d98415e502c81e41e566eda2fc9ec2496d8044eae9"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -10592,7 +10557,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2be8a6906c0dd4d9d3e4af313c25e885abdeafe0f917399d1775c3692ce64c8f"
+      "sha256": "b90170c38222c5a35bb87452ad97fa2f1289ad89d30338b4843ac4daced0cecd"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/file-map.md

@@ -17,14 +17,6 @@
 ├── CODEOWNERS                   ← owner review on the merge-gate surfaces (real since task 1002611, ADR 0159); inert until branch protection is on (scripts/gds/gating.js) — keep aligned with gate-review.js HARD_FLOOR_GLOBS
 ├── server.js                    ← game boot: Express + Colyseus + the shared internal surface (mountInternalSurfaces), binds 127.0.0.1:3000
 │
-├── .devcontainer/               ← the Example Dev Box, defined as code (ADR 0031 §3) — builds identically on a DO box + a laptop
-│   ├── devcontainer.json        ← box spec: features (Node 22, gh, Claude Code), NET_ADMIN caps, persisted volumes, lifecycle hooks
-│   ├── Dockerfile               ← Ubuntu 24.04 base + Python 3.12 venv + firewall/art system deps + build-time integrity assert
-│   ├── init-firewall.sh         ← postStart default-deny outbound firewall, tight allow-list (ADR 0031 §6)
-│   ├── post-create.sh           ← first-run: folds in setup-builder.sh --no-auth + art deps + full-stack verify
-│   ├── healthcheck.sh           ← image-level toolchain integrity check (the image half of doctor-as-health-check)
-│   └── README.md                ← box docs, ADR mapping, deliberate reconciliations, out-of-scope tasks
-│
 ├── limitations/                 ← versioning-methodology artifacts
 │   ├── README.md
 │   ├── v1-shipped.md            ← V1 game archive (shipped 2026-05-12)
@@ -150,7 +142,7 @@
 │   ├── migrate.sh               ← idempotent migration runner; applies core `migrations/*.sql` always + `modules/<key>/migrations/*.sql` only when the module is enabled (ADR 0083 §module-owned-migrations); stem-keyed so relocating a migration between dirs never re-runs it on prod
 │   ├── verify-gds-only-schema.sh ← task 1191: throwaway-DB proof that a Bongos-only migration run yields the build-system schema with NO game tables (needs local Postgres; not the DB-free unit gate)
 │   ├── setup-builder.js         ← one-command new-builder bootstrap (toolchain + npm ci + .env.local + Bongos auth); cross-platform node entry (#673)
-│   ├── setup-builder.sh         ← thin bash shim → setup-builder.js (Mac/Linux convenience + devcontainer/README refs)
+│   ├── setup-builder.sh         ← thin bash shim → setup-builder.js (Mac/Linux convenience + README refs)
 │   ├── deploy/                  ← deploy scripts that run ON the droplet
 │   │   ├── deploy-prod.sh       ← #1026/ADR 0056: version-controlled MIRROR of the droplet's hand-maintained ~/deploy.sh (byte-faithful). NOT auto-installed — the ci deploy key is forced-command-locked (ADR 0042/0043); reinstall by hand on change. Localhost /healthz retried 15×@1s so a slow bind no longer false-fails a deploy.
 │   │   ├── deploy-staging.sh    ← #261: staging analogue of ~/deploy.sh; scp'd to ~/deploy-staging.sh + run by deploy-staging.yml on push to `staging` (same healthz retry)

package/docs/module-api-changelog.md

@@ -2585,5 +2585,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1047 with no explicit bump. run 36285856717. (task 1002620)
   1.19.1049 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1048 with no explicit bump. run 36323359891. (task 1002620)
+  1.19.1050 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1049 with no explicit bump. run 36324195800. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1049",
+  "version": "1.19.1050",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1049",
+      "version": "1.19.1050",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1049",
+  "version": "1.19.1050",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7595,5 +7595,11 @@
       "id": "1003969",
       "text": "cloudbongos.com now checks for a new version every 15 minutes instead of once a day, so merged work goes live within about a quarter of an hour."
     }
+  ],
+  "1.19.1050": [
+    {
+      "id": "1003896",
+      "text": "Removed the leftover dev-box container setup and the automated check that built it, so nothing in the project still describes or builds the retired dev box environment."
+    }
   ]
 }

package/scripts/gds/publish-manifest.js

@@ -144,7 +144,6 @@ const PUBLISH_ALLOWLIST = [
   'docker-compose.yml',
   'docker-entrypoint.sh',
   '.dockerignore',
-  '.devcontainer/',
   '.env.local.example',
   '.gitignore',
   '.gitattributes',

package/scripts/setup-builder.sh

@@ -3,9 +3,9 @@
 #
 # The bootstrap logic now lives in scripts/setup-builder.js (Node), so it runs
 # on Windows/macOS/Linux alike. This shim stays so existing references keep
-# working on Mac/Linux — README, the onboarding primer, and the devcontainer's
-# post-create.sh all invoke `./scripts/setup-builder.sh` / `bash scripts/
-# setup-builder.sh ...`. It simply forwards all arguments to the Node script.
+# working on Mac/Linux — README and the onboarding primer invoke
+# `./scripts/setup-builder.sh` / `bash scripts/setup-builder.sh ...`. It simply
+# forwards all arguments to the Node script.
 #
 # On Windows (no Git Bash), run the Node entry directly instead:
 #   node scripts/setup-builder.js [--skip-keys] [--no-auth] [--help]

package/src/bongos/module-scope-map.js

@@ -404,27 +404,14 @@ const MODULE_GLOBS = {
     // The SELF-HOST IMAGE (V4.R63, task 1202, ADR 0062): `docker compose up` brings
     // up Postgres + a vanilla, neutral-branded instance with every feature module
     // off. Assigned here by task 1004146 — same class as the .github/ and .husky/
-    // entries above and the .devcontainer/ one below: repo-root build config that
-    // defines WHAT RUNS. Not
+    // entries above: repo-root build config that defines WHAT RUNS. Not
     // `provisioning`, which owns the control plane that stands up instances, not an
-    // image a stranger runs. They are not dev-box artifacts either, despite most
-    // inbound references coming from .devcontainer/ and the devcontainer workflow.
+    // image a stranger runs.
     'Dockerfile', 'docker-compose.yml', 'docker-entrypoint.sh', '.dockerignore',
     // Repo-level dotfiles, the class .gitattributes and .npmrc already sit in.
     // .env.local.example is the local-secrets template, next to the .gitleaks.toml
     // scanner config above (task 1004146).
     '.gitignore', '.env.local.example',
-    // .devcontainer/ is the same class as the entries above it — repo-level
-    // developer-environment config, not a feature's territory (task 1004029).
-    // It belonged to NO module and was not in SHARED_GLOBS, so isCovered() said
-    // false for it under EVERY possible scope_modules value: no goal could
-    // authorize a task that touched it, which is what stalled task 1003896
-    // (delete .devcontainer/). Given to devsecops rather than added to
-    // SHARED_GLOBS because it has a real owner — SHARED_GLOBS is for roots owned
-    // by nobody, and every addition there widens the wall for every goal at once.
-    // devsecops is PROTECTED, so this path is now Archon-only to scope; that is
-    // the correct floor for a file that defines what a builder's environment runs.
-    '.devcontainer/',
     'package.json', 'package-lock.json',
     'scripts/gds/fitness.js', 'scripts/gds/docs-entropy.js',
     'scripts/gds/redteam-patrol.js', 'scripts/gds/audit-gate.js',

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1049'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1050'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/.devcontainer/Dockerfile

@@ -1,69 +0,0 @@
-# Example Dev Box — the OTB builder environment as code (ADR 0031 §3).
-# Base Ubuntu 24.04 ships Python 3.12 (matches CI's art-pipeline cert) + a non-root
-# `vscode` sudo user. Node 22 / gh / Claude Code arrive as version-pinned features
-# (devcontainer.json); this Dockerfile covers the OS bits features don't: firewall
-# tooling + the art pipeline's system/Python deps. Builds identically on a DO box
-# and a laptop (x64/arm64). Full design + reconciliations: ./README.md.
-
-# Pinned to the multi-arch (amd64+arm64) image-index digest, not just the mutable
-# tag, so an upstream tag mutation / supply-chain swap can't silently replace the
-# box foundation. devcontainer-lock.json pins the features; this pins the base.
-# Bump the digest deliberately when intentionally moving to a newer base.
-FROM mcr.microsoft.com/devcontainers/base:ubuntu-24.04@sha256:d94c97dd9cacf183d0a6fd12a8e87b526e9e928307674ae9c94139139c0c6eae
-
-ARG TZ="Etc/UTC"
-ENV TZ="${TZ}"
-ENV DEVCONTAINER=true
-# Persisted shell history (see the volume mount in devcontainer.json).
-ENV HISTFILE=/commandhistory/.bash_history
-
-# --- OS packages --------------------------------------------------------------
-# Firewall tooling (iptables/ipset/iproute2 + dnsutils for `dig`), jq for the
-# GitHub-meta parse, the Python 3.12 toolchain, and the sharp from-source net.
-RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
-  && apt-get install -y --no-install-recommends \
-     iptables ipset iproute2 dnsutils \
-     jq curl ca-certificates \
-     python3 python3-pip python3-venv python3-dev \
-     build-essential pkg-config \
-  && apt-get clean && rm -rf /var/lib/apt/lists/*
-
-# --- Python venv for the art pipeline (PEP 668 safe) --------------------------
-# Ubuntu 24.04 marks the system Python "externally managed", so a global
-# `pip install` is refused. A dedicated venv on PATH gives the art pipeline a
-# clean, writable 3.12 interpreter where `python3` "just works" — matching the
-# isolated interpreter CI gets from actions/setup-python. Deps themselves are
-# installed from the repo's pinned art/pipeline/requirements.txt at first-run
-# (post-create.sh), so the set stays manifest-driven and reproducible.
-ENV OTB_VENV=/opt/otb-venv
-RUN python3 -m venv "${OTB_VENV}" \
-  && "${OTB_VENV}/bin/pip" install --no-cache-dir --upgrade pip \
-  && chown -R vscode:vscode "${OTB_VENV}"
-# Prepend the venv to PATH for every shell + lifecycle command.
-ENV PATH="${OTB_VENV}/bin:${PATH}"
-
-# --- Firewall + health scripts ------------------------------------------------
-# NB the install path: the Claude Code feature ALSO ships its own
-# /usr/local/bin/init-firewall.sh, and features install AFTER this Dockerfile —
-# so installing ours at that path would be silently overwritten by the feature's
-# (which lacks our GDS/Gemini/PyPI allow-list). We install ours as
-# otb-init-firewall.sh and point postStart at it; the feature's copy sits unused.
-COPY init-firewall.sh /usr/local/bin/otb-init-firewall.sh
-COPY healthcheck.sh   /usr/local/bin/healthcheck.sh
-RUN chmod +x /usr/local/bin/otb-init-firewall.sh /usr/local/bin/healthcheck.sh
-
-# Persisted-history dir owned by the runtime user.
-RUN mkdir -p /commandhistory && chown -R vscode:vscode /commandhistory
-
-# --- Build-time integrity assertion -------------------------------------------
-# Fail the BUILD (not some later mystery at runtime) if the toolchain the box
-# promises isn't actually present. This is half of "doctor.js as health check":
-# the image-level half, asserting the box was built right. The builder-level
-# half (session/auth/git) runs as scripts/gds/doctor.js at attach time.
-RUN /usr/local/bin/healthcheck.sh --build || \
-    (echo "BUILD FAILED: toolchain integrity check did not pass" && exit 1)
-
-# Runtime health check for the DO-box-as-service case (#598): a parked/recreated
-# box can be probed for "is the toolchain intact" without a GDS session.
-HEALTHCHECK --interval=1m --timeout=15s --start-period=30s --retries=3 \
-  CMD /usr/local/bin/healthcheck.sh || exit 1

package/.devcontainer/README.md

@@ -1,73 +0,0 @@
-# The Example Dev Box (`.devcontainer/`)
-
-This folder is **the box defined as code** — [ADR 0031 §3](../docs/adr/0031-cloud-dev-environments-for-builders.md). It is the single environment every OTB builder runs Claude Code's *worker* in, whether they reach it from Claude Desktop → SSH, from the web → Remote Control, or locally via Docker Desktop. The same spec builds and runs identically on a DigitalOcean box and on a laptop.
-
-> Recall the mental model ([ADR 0031 "mental model"](../docs/adr/0031-cloud-dev-environments-for-builders.md), and [the onboarding primer](../docs/onboarding/primer.md)): the **screen** is your device, the **brain** is Anthropic's servers, and this is the **worker** — where the repo lives and the work happens.
-
-## What's here
-
-| File | Role |
-|---|---|
-| `devcontainer.json` | The box spec: base build, version-pinned features (Node 22, GitHub CLI, Claude Code), firewall capabilities, persisted volumes, lifecycle hooks. |
-| `Dockerfile` | Ubuntu 24.04 base + the OS-level bits features don't cover: firewall tooling, the art-pipeline system deps, and a PEP-668-safe Python venv. |
-| `init-firewall.sh` | The **default-deny outbound firewall** (ADR 0031 §6). Runs at every container start. Allow-lists only the hosts the toolchain needs. |
-| `post-create.sh` | First-run provisioning: folds in `setup-builder.sh`, installs art deps, verifies the stack. |
-| `healthcheck.sh` | Image-level toolchain integrity check — the "is the box built right?" half of doctor-as-health-check. |
-
-## The toolchain it guarantees
-
-- **Node 22** (`package.json` requires `>=22`) — via the `node` devcontainer feature.
-- **Python 3.12** — native to the Ubuntu 24.04 base, installed into a venv at `/opt/otb-venv`.
-- **sharp ^0.34** — the game/art native dep; prebuilt binaries on linux x64 **and** arm64, so no compile.
-- **The five art-pipeline libs** — Pillow, numpy, scipy, scikit-learn, certifi (from the pinned `art/pipeline/requirements.txt`).
-- **Claude Code + GitHub CLI + git** — via features.
-
-## Lifecycle
-
-1. **build** — Dockerfile lays down the OS deps + venv, then asserts the toolchain (`healthcheck.sh --build`) so a broken box fails the build, not a later mystery.
-2. **postCreate** (once) — `post-create.sh`: brings up the **firewall first** (so the dependency installs below run behind default-deny — no open-egress window during provisioning), then `setup-builder.sh --no-auth --skip-keys` (toolchain check + `npm ci` + `.env.local`), then `pip install` the art deps into the venv, then verify sharp + the art libs load.
-3. **postStart** (every start) — `sudo otb-init-firewall.sh` re-applies the default-deny egress firewall (iptables state resets each container start).
-4. **postAttach** (every attach) — `node scripts/gds/doctor.js` runs the *builder* health check (session/auth/git/env). Non-fatal, so a fresh, not-yet-authed box still attaches.
-
-On first connect you finish two runtime steps the box can't do for you: authenticate the GDS CLI (`node scripts/gds/setup.js` or `/builder-setup`) and, if you run the art pipeline, drop a Google AI Studio key in `~/.config/otb/env` (a persisted volume — survives rebuilds).
-
-## The firewall allow-list
-
-Default-deny outbound. Only these egress targets are permitted (keep it tight — every addition is attack surface):
-
-| Target | Why |
-|---|---|
-| Anthropic API + telemetry | the brain (tokens), Claude Code |
-| GitHub (published meta ranges) | `git` push/pull, `gh` |
-| npm registry | `npm ci` |
-| `example.com` + `staging.` | the GDS API (`/api/gds/*` CLI) |
-| `generativelanguage.googleapis.com` | the pixel-art pipeline (Gemini) |
-| `pypi.org` + `files.pythonhosted.org` | `pip install` the art deps |
-
-The firewall comes up **before the dependency installs** (in postCreate) and is **re-applied on every start** (postStart), so there is no open-egress window during provisioning — `npm ci` and `pip` run behind the allow-list (npm/PyPI/GitHub are on it). It **fails closed** by default: if it can't apply rules or verification fails, container start fails. The one documented escape hatch is `FIREWALL_OPTIONAL=1`, for a laptop Docker host that won't grant `NET_ADMIN` — there the builder is already root of their own machine, so egress lockdown is advisory (ADR 0031 §6 "honest limit"). Using it emits a loud, greppable `SECURITY AUDIT` line in the container logs. The DO box (#598) leaves it enforcing.
-
-## Running it
-
-- **Laptop (Docker Desktop):** open the repo in VS Code → "Reopen in Container", or `devcontainer up --workspace-folder .`. Apple-silicon (arm64) and Intel (x64) both work — sharp ships prebuilt binaries for each, and `node_modules` is a container-isolated volume so the host's macOS binaries never collide with the container's Linux ones.
-- **DigitalOcean box:** the per-builder provisioning (#598) builds this same spec on the box and exposes it over SSH / `claude rc`. Nothing in this folder is DO-specific — that's the portability the ADR commits to.
-
-### Known macOS-laptop caveat (does not affect the DO box)
-
-On a macOS Docker Desktop bind mount, VirtioFS can intermittently return `EDEADLK` ("Resource deadlock avoided") when reading repo files, especially while the host is heavily accessing the same folder. The symptom seen in testing was the postCreate **art-deps `pip install` failing** to read `art/pipeline/requirements.txt` (the box otherwise built fine — Node, Python, `sharp`, the firewall, and the runtime health check all passed). post-create.sh retries and is non-fatal, so the box still provisions. If art deps don't install: rebuild the container, or switch **Docker Desktop → Settings → General → file sharing to "gRPC FUSE"**. The DO box uses a native filesystem (a real clone, no bind mount), so this never occurs there.
-
-## Deliberate reconciliations (where this differs from a naïve reading of the ADR)
-
-- **Python 3.12, not "3.10".** ADR 0031 §3 says "Python 3.10"; that's a floor. CI (`portability-smoke.yml`) certifies the art pipeline on **3.12**, so the box uses 3.12 to *reproduce* CI rather than approximate it. 3.12 satisfies the `>=3.10` requirement in `setup-builder.sh`.
-- **`sharp` "build deps" without system libvips.** The ADR says "sharp build deps." sharp ^0.34 uses prebuilt binaries with libvips **bundled**, so no compile happens on x64/arm64. We install `build-essential` + `pkg-config` as the from-source safety net the ADR intends, but deliberately do **not** install system `libvips-dev` — a mismatched system libvips is a known footgun; sharp prefers its own.
-- **Allow-list is wider than the ADR's "Anthropic, GitHub, npm".** That parenthetical describes the *Anthropic feature's* defaults. Our box legitimately needs the GDS API + Gemini + PyPI or the CLI and art pipeline break behind the firewall. The list stays minimal and each entry is justified above.
-- **Base = Ubuntu 24.04 devcontainers image** (not Anthropic's reference `node:20`) — for the Node 22 + Python 3.12 parity above and a ready-made non-root `vscode` sudo user. The Claude Code *feature* is still Anthropic's, satisfying "the Anthropic Claude Code container feature."
-
-## Out of scope (separate ADR-0031 tasks)
-
-This task is the **foundation only**. It does not provision boxes, lock builders to one box, gate by rank, or wire billing:
-
-- **#597** — move prod deploy to GitHub Actions (no builder box holds the droplet key).
-- **#598** — per-builder DO box provisioning + auto-suspend (depends on this).
-- **#599** — Desktop managed-settings + the always-on `claude rc` service.
-- **#600** — rank-gated source access via the box.
-- **#602** — cost passthrough (org-funded starter → self-fund).

package/.devcontainer/devcontainer-lock.json

@@ -1,19 +0,0 @@
-{
-  "features": {
-    "ghcr.io/anthropics/devcontainer-features/claude-code:1.0": {
-      "version": "1.0.5",
-      "resolved": "ghcr.io/anthropics/devcontainer-features/claude-code@sha256:cfc2e7d3e9fd3b9b01f8d5cb158508a884c8c0ede2e23ed10f32dea5d4ffe69a",
-      "integrity": "sha256:cfc2e7d3e9fd3b9b01f8d5cb158508a884c8c0ede2e23ed10f32dea5d4ffe69a"
-    },
-    "ghcr.io/devcontainers/features/github-cli:1": {
-      "version": "1.1.0",
-      "resolved": "ghcr.io/devcontainers/features/github-cli@sha256:d22f50b70ed75339b4eed1ba9ecde3a1791f90e88d37936517e3bace0bbad671",
-      "integrity": "sha256:d22f50b70ed75339b4eed1ba9ecde3a1791f90e88d37936517e3bace0bbad671"
-    },
-    "ghcr.io/devcontainers/features/node:1": {
-      "version": "1.7.1",
-      "resolved": "ghcr.io/devcontainers/features/node@sha256:8c0de46939b61958041700ee89e3493f3b2e4131a06dc46b4d9423427d06e5f6",
-      "integrity": "sha256:8c0de46939b61958041700ee89e3493f3b2e4131a06dc46b4d9423427d06e5f6"
-    }
-  }
-}

package/.devcontainer/devcontainer.json

@@ -1,93 +0,0 @@
-{
-  // Example Dev Box — the OTB builder environment as code (ADR 0031 §3).
-  //
-  // This is the single box spec every builder runs, reached via Claude Desktop
-  // → SSH or the web → Remote Control (ADR 0031 §1). It builds identically on a
-  // DigitalOcean box and on a laptop via Docker Desktop. The pre-distributed
-  // Desktop "managed settings" that lock a non-technical builder to exactly this
-  // box are a separate task (#599); this file is the box itself.
-  "name": "Example Dev Box",
-
-  "build": {
-    "dockerfile": "Dockerfile",
-    // Context is this .devcontainer/ folder (the default). The Dockerfile only
-    // COPYs the two scripts that live here; nothing from the repo root is needed
-    // at build time (npm ci / pip install run at postCreate against the mounted
-    // workspace), so the COPY paths stay relative to this folder.
-    "context": ".",
-    "args": {
-      // Honor the host timezone when set, else UTC.
-      "TZ": "${localEnv:TZ:Etc/UTC}"
-    }
-  },
-
-  // Node 22, the GitHub CLI, and Claude Code arrive as version-pinned features
-  // rather than hand-rolled in the Dockerfile (the idiomatic, reproducible path).
-  // The Claude Code feature also installs Anthropic's default-deny egress posture
-  // tooling; our init-firewall.sh (postStart) is the OTB-tuned allow-list on top.
-  "features": {
-    "ghcr.io/devcontainers/features/node:1": { "version": "22" },
-    "ghcr.io/devcontainers/features/github-cli:1": {},
-    "ghcr.io/anthropics/devcontainer-features/claude-code:1.0": {}
-  },
-
-  // NET_ADMIN + NET_RAW let the postStart firewall manage iptables/ipset. Without
-  // these the firewall fails closed (or warns if FIREWALL_OPTIONAL=1) — see
-  // init-firewall.sh. Docker Desktop and a DO Docker host both honor cap-add.
-  "runArgs": ["--cap-add=NET_ADMIN", "--cap-add=NET_RAW"],
-
-  // The devcontainers Ubuntu base ships a non-root `vscode` user with passwordless
-  // sudo (needed for the postStart firewall). Run as that user, not root.
-  "remoteUser": "vscode",
-
-  "containerEnv": {
-    "DEVCONTAINER": "true",
-    // Where the art-pipeline Python venv lives (the Dockerfile prepends its bin
-    // to PATH); post-create.sh and healthcheck.sh reference it.
-    "OTB_VENV": "/opt/otb-venv",
-    // A modest Node heap headroom for the dev server + art pipeline.
-    "NODE_OPTIONS": "--max-old-space-size=4096"
-  },
-
-  // Standardize the in-container repo path (matches Anthropic's reference) so
-  // docs/scripts can assume /workspace regardless of the host folder name.
-  "workspaceFolder": "/workspace",
-  "workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=delegated",
-
-  // Named volumes (NOT binds — nothing secret lands in the repo or image, per
-  // ADR 0022):
-  //   - node_modules: a container-ISOLATED volume so the host's native binaries
-  //     (e.g. a macOS-built `sharp`) never leak into this linux box, and vice
-  //     versa. This is what makes "runs identically on a laptop" true — without
-  //     it, bind-mounting the repo from macOS breaks sharp in the container.
-  //   - the Claude Code login/config (so a rebuild doesn't force re-login),
-  //   - shell history (quality-of-life),
-  //   - ~/.config/otb (the per-builder Gemini key + GDS session survive rebuilds).
-  "mounts": [
-    "source=otb-node-modules-${devcontainerId},target=/workspace/node_modules,type=volume",
-    "source=otb-claude-config-${devcontainerId},target=/home/vscode/.claude,type=volume",
-    "source=otb-bashhistory-${devcontainerId},target=/commandhistory,type=volume",
-    "source=otb-config-${devcontainerId},target=/home/vscode/.config/otb,type=volume"
-  ],
-
-  // Lifecycle:
-  //   postCreate — once, after the repo is mounted: fold in setup-builder.sh,
-  //                install art deps, verify the stack (post-create.sh).
-  //   postStart  — every start: bring up the default-deny firewall.
-  //   postAttach — every attach: run the BUILDER health check (session/auth/git).
-  //                Non-fatal (|| true) so a not-yet-authed fresh box still attaches.
-  "postCreateCommand": "bash .devcontainer/post-create.sh",
-  "postStartCommand": "sudo /usr/local/bin/otb-init-firewall.sh",
-  "postAttachCommand": "node scripts/gds/doctor.js || true",
-  "waitFor": "postCreateCommand",
-
-  "customizations": {
-    "vscode": {
-      "extensions": [
-        "anthropic.claude-code",
-        "dbaeumer.vscode-eslint",
-        "esbenp.prettier-vscode"
-      ]
-    }
-  }
-}

package/.devcontainer/healthcheck.sh

@@ -1,84 +0,0 @@
-#!/usr/bin/env bash
-# healthcheck.sh — image-level toolchain integrity check for the Example
-# Dev Box (ADR 0031 §3).
-#
-# This is the IMAGE half of "doctor.js as the health check": it answers "was the
-# box built correctly?" using only what the image itself provides — no GDS
-# session, no repo checkout, no network. The BUILDER half ("is *this builder*
-# authed, hooked, and clean?") is scripts/gds/doctor.js, run at attach time.
-#
-# Two modes:
-#   --build   run as the final Dockerfile RUN step (fail the build on a bad box).
-#   (default) the runtime HEALTHCHECK / a recreated-box probe (#598).
-#
-# Both check the same stable, image-level toolchain. Repo-level facts (sharp in
-# node_modules, the art libs in the venv) are installed at first-run by
-# post-create.sh and verified there — they are intentionally NOT gated here so
-# the container never flaps "unhealthy" during provisioning.
-#
-# NOTE on ordering: Node, the GitHub CLI, and Claude Code are installed by
-# devcontainer *features*, which run AFTER the Dockerfile is built. So the
-# --build assertion can't see Node — it checks only what the Dockerfile itself
-# provides (the Python venv + firewall tooling). The Node check runs at runtime,
-# where features are present.
-
-set -uo pipefail
-
-MODE="${1:-runtime}"
-fails=0
-
-ok()   { echo "  ok   $*"; }
-bad()  { echo "  FAIL $*"; fails=$((fails + 1)); }
-
-# Node >= 22 — runtime only (feature-installed after the Dockerfile build).
-if [ "$MODE" != "--build" ]; then
-  if command -v node >/dev/null 2>&1; then
-    nver="$(node --version 2>/dev/null)"
-    nmaj="$(echo "$nver" | sed 's/^v//' | cut -d. -f1)"
-    if [[ "$nmaj" =~ ^[0-9]+$ ]] && [ "$nmaj" -ge 22 ]; then
-      ok "node $nver (>= 22)"
-    else
-      bad "node $nver found, need >= 22"
-    fi
-  else
-    bad "node not on PATH"
-  fi
-else
-  echo "  --   node check deferred to runtime (feature-installed after the Dockerfile)"
-fi
-
-# Python >= 3.12 (the venv interpreter — must be first on PATH)
-if command -v python3 >/dev/null 2>&1; then
-  pyver="$(python3 -c 'import sys; print("%d.%d" % sys.version_info[:2])' 2>/dev/null || echo "?")"
-  pymaj="${pyver%%.*}"; pymin="${pyver#*.}"
-  if [[ "$pymaj" =~ ^[0-9]+$ ]] && [[ "$pymin" =~ ^[0-9]+$ ]] \
-     && { [ "$pymaj" -gt 3 ] || { [ "$pymaj" -eq 3 ] && [ "$pymin" -ge 12 ]; }; }; then
-    ok "python ${pyver} (>= 3.12) [$(command -v python3)]"
-  else
-    bad "python ${pyver} found, need >= 3.12"
-  fi
-  # The venv must be the active interpreter so the art pipeline's deps resolve.
-  if [ -n "${OTB_VENV:-}" ] && [ "$(command -v python3)" = "${OTB_VENV}/bin/python3" ]; then
-    ok "art-pipeline venv active (${OTB_VENV})"
-  else
-    bad "expected venv python at ${OTB_VENV:-<unset>}/bin/python3, got $(command -v python3)"
-  fi
-else
-  bad "python3 not on PATH"
-fi
-
-# Firewall tooling present (the default-deny boundary depends on it).
-for tool in iptables ipset dig jq; do
-  if command -v "$tool" >/dev/null 2>&1; then
-    ok "$tool present"
-  else
-    bad "$tool missing (firewall/init would fail)"
-  fi
-done
-
-if [ "$fails" -eq 0 ]; then
-  [ "$MODE" = "--build" ] && echo "toolchain integrity: OK (build)"
-  exit 0
-fi
-echo "toolchain integrity: ${fails} problem(s)"
-exit 1

package/.devcontainer/init-firewall.sh

@@ -1,234 +0,0 @@
-#!/usr/bin/env bash
-# init-firewall.sh — default-deny outbound firewall for the Example Dev Box.
-#
-# ADR 0031 §3 + §6: the box is an org-controlled, egress-restricted surface. This
-# script flips the container to default-DROP and then allow-lists ONLY the hosts
-# the OTB toolchain legitimately needs. Everything else is blocked, so a builder
-# session (or a compromised dependency) cannot quietly exfiltrate to an arbitrary
-# host.
-#
-# Mechanism (mirrors Anthropic's reference init-firewall.sh):
-#   1. Resolve every allow-listed host to IPs WHILE egress is still open.
-#   2. Stuff them into an `ipset` (hash:net so GitHub's CIDR ranges fit).
-#   3. Flip INPUT/OUTPUT/FORWARD to DROP, then re-allow loopback, established
-#      connections, DNS, SSH, and OUTPUT to the ipset.
-#   4. Verify: a blocked host must fail; an allow-listed host must succeed.
-#
-# Allow-list (and WHY each is here — keep this tight, every addition is egress):
-#   - GitHub  (api.github.com/meta ranges) ......... git push/pull, `gh`
-#   - npm registry (registry.npmjs.org) ............ `npm ci`
-#   - Anthropic API (api.anthropic.com + telemetry)  the brain (tokens), Claude Code
-#   - THIS instance's own API host(s) .............. the GDS API (/api/gds/* CLI)
-#     (resolved from config/branding.json at runtime — task 1002757; a hardcoded
-#      founder host allow-listed someone else's server and BLOCKED the builder's own)
-#   - generativelanguage.googleapis.com ............ the pixel-art pipeline (Gemini) [OTB]
-#   - pypi.org + files.pythonhosted.org ............ `pip install` art deps          [OTB]
-#
-# Runs as root via `sudo` from the devcontainer postStartCommand. Needs the
-# NET_ADMIN + NET_RAW capabilities (granted by runArgs in devcontainer.json).
-#
-# Fail posture: FAIL-CLOSED by default. If the rules cannot be applied or the
-# verification fails, the script exits non-zero. Set FIREWALL_OPTIONAL=1 to
-# downgrade a cap/permission failure to a loud warning that still lets the
-# container boot — intended ONLY for a laptop Docker host that won't grant
-# NET_ADMIN (where the builder is already root of their own machine, so egress
-# lockdown is advisory anyway — see ADR 0031 §6 "honest limit"). The DO box
-# (#598) sets FIREWALL_OPTIONAL unset, so it always enforces.
-
-set -euo pipefail
-IFS=$'\n\t'
-
-OPTIONAL="${FIREWALL_OPTIONAL:-0}"
-
-# Hosts to allow-list by name (resolved via dig at runtime). GitHub is handled
-# separately via its published meta ranges. Keep this list minimal.
-ALLOWED_HOSTS=(
-  "registry.npmjs.org"
-  "api.anthropic.com"
-  "statsig.anthropic.com"
-  "sentry.io"
-  "generativelanguage.googleapis.com"
-  "pypi.org"
-  "files.pythonhosted.org"
-  # THIS instance's own hosts are appended below from its branding pack.
-)
-
-# Append the instance's OWN API hosts, read from config/branding.json at runtime
-# (task 1002757). Was two hardcoded founder hosts, which allow-listed someone
-# else's server and left the builder's own GDS API blocked — the devcontainer
-# then failed every /builder-* call for a reason nothing in the log explained.
-# GDS_ALLOW_HOSTS (space/comma separated) overrides for a non-standard setup.
-REPO_ROOT_FW="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-INSTANCE_HOSTS="${GDS_ALLOW_HOSTS:-}"
-if [ -z "$INSTANCE_HOSTS" ]; then
-  INSTANCE_HOSTS="$(node -e '
-    const d = (require(process.argv[1]).branding().domains) || {};
-    const hosts = new Set();
-    // Only *_ORIGIN-shaped values yield a host, and only a real public FQDN
-    // counts: the neutral starter pack carries localhost:3000 and bare subdomain
-    // PREFIXES ("sandbox-", "term-"), none of which is an allow-listable host.
-    for (const v of Object.values(d)) {
-      if (typeof v !== "string" || !v.trim()) continue;
-      let host = null;
-      try { host = new URL(v).hostname; } catch { host = v.trim(); }
-      if (!host) continue;
-      if (!/^(?=.{1,253}$)[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i.test(host)) continue;
-      if (/^localhost$/i.test(host)) continue;
-      hosts.add(host.toLowerCase());
-    }
-    process.stdout.write([...hosts].join(" "));
-  ' "$REPO_ROOT_FW/src/branding" 2>/dev/null || true)"
-fi
-for h in ${INSTANCE_HOSTS//,/ }; do
-  [ -n "$h" ] && ALLOWED_HOSTS+=("$h")
-done
-
-log()  { echo "[firewall] $*"; }
-die() {
-  # Honor the documented escape hatch: a cap/permission failure on a laptop
-  # host downgrades to a warning instead of bricking container startup.
-  # The bypass is env-driven, so it can't be access-controlled from inside the
-  # script — the mitigation is a LOUD, greppable audit line so any use is
-  # visible in container logs / log aggregation. On the org DO box this must
-  # never be set; if this banner appears there, investigate.
-  if [ "$OPTIONAL" = "1" ]; then
-    log "==================== SECURITY AUDIT ===================="
-    log "egress firewall DISABLED via FIREWALL_OPTIONAL=1"
-    log "  reason: $*"
-    log "  the box is running WITHOUT default-deny egress (laptop-only escape hatch)"
-    log "======================================================="
-    exit 0
-  fi
-  log "ERROR: $*"
-  log "If this host genuinely cannot grant NET_ADMIN (e.g. a restricted laptop Docker),"
-  log "re-run with FIREWALL_OPTIONAL=1 to boot without egress lockdown."
-  exit 1
-}
-
-# Pre-flight: we must be root and have the iptables/ipset tooling + caps.
-if [ "$(id -u)" -ne 0 ]; then
-  die "must run as root (expected: sudo $0)"
-fi
-command -v iptables >/dev/null 2>&1 || die "iptables not installed"
-command -v ipset    >/dev/null 2>&1 || die "ipset not installed"
-command -v dig      >/dev/null 2>&1 || die "dig (dnsutils) not installed"
-
-# A NET_ADMIN probe: try a harmless list. If the kernel refuses, we lack the cap.
-if ! iptables -L >/dev/null 2>&1; then
-  die "cannot manage iptables (NET_ADMIN capability missing?)"
-fi
-
-log "resolving allow-list while egress is still open…"
-
-# Fresh ipset. hash:net so we can store both single IPs and CIDR ranges.
-# create -exist + flush (not destroy+create): on a manual re-run an iptables
-# OUTPUT rule may still reference the set, which makes `destroy` fail. Flushing
-# empties it in place while keeping the object valid.
-ipset create allowed-domains hash:net -exist
-ipset flush allowed-domains
-
-add_ip() {
-  # Validate it looks like an IPv4 (or CIDR) before adding, so a bad DNS answer
-  # can't inject garbage into the set.
-  local ip="$1"
-  if [[ "$ip" =~ ^[0-9]{1,3}(\.[0-9]{1,3}){3}(/[0-9]{1,2})?$ ]]; then
-    ipset add allowed-domains "$ip" 2>/dev/null || true
-  fi
-}
-
-# --- GitHub: use the published meta ranges (covers github.com, api, git, web) -
-log "  + GitHub meta ranges"
-gh_meta="$(curl -fsS --max-time 20 https://api.github.com/meta || true)"
-if [ -n "$gh_meta" ] && command -v jq >/dev/null 2>&1; then
-  # .web + .api + .git are the egress-relevant range groups.
-  while read -r cidr; do
-    [ -n "$cidr" ] && add_ip "$cidr"
-  done < <(echo "$gh_meta" | jq -r '(.web // []) + (.api // []) + (.git // []) | .[]' 2>/dev/null | grep -E '^[0-9]+\.' || true)
-else
-  # Fallback: resolve the hostnames directly if the meta API is unavailable.
-  log "    (meta API unavailable — falling back to direct resolution)"
-  for h in github.com api.github.com codeload.github.com objects.githubusercontent.com; do
-    while read -r ip; do add_ip "$ip"; done < <(dig +short +noall +answer A "$h" 2>/dev/null | grep -E '^[0-9]+\.' || true)
-  done
-fi
-
-# --- Everything else: resolve by name -----------------------------------------
-for host in "${ALLOWED_HOSTS[@]}"; do
-  log "  + $host"
-  while read -r ip; do
-    add_ip "$ip"
-  done < <(dig +short +noall +answer A "$host" 2>/dev/null | grep -E '^[0-9]+\.' || true)
-done
-
-# --- Host networking: keep the container reachable from / to its Docker host --
-# Allow the host gateway + the container's own /24 so SSH in, the dev server,
-# and DNS-to-the-Docker-resolver keep working after we flip to DROP.
-host_ip="$(ip route | awk '/default/ {print $3; exit}')"
-if [ -n "${host_ip:-}" ]; then
-  host_net="$(echo "$host_ip" | sed 's/\.[0-9]*$/.0\/24/')"
-  log "  + host network ${host_net}"
-  add_ip "$host_net"
-fi
-
-n="$(ipset list allowed-domains | grep -cE '^[0-9]+\.' || true)"
-log "allow-list built: ${n} entries"
-[ "$n" -gt 0 ] || die "allow-list is empty — refusing to flip to default-DROP (would sever everything)"
-
-log "applying default-deny policy…"
-
-# Flush prior rules so re-runs are idempotent.
-iptables -F
-iptables -X 2>/dev/null || true
-
-# Loopback — always.
-iptables -A INPUT  -i lo -j ACCEPT
-iptables -A OUTPUT -o lo -j ACCEPT
-
-# Established/related return traffic.
-iptables -A INPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
-iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-
-# DNS — keep resolution working at runtime (long-running procs re-resolve).
-iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
-iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
-
-# SSH — the Desktop/Remote-Control on-ramp (ADR 0031 §1).
-iptables -A INPUT  -p tcp --dport 22 -j ACCEPT
-iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
-
-# The actual allow-list: outbound only to resolved, vetted IPs.
-iptables -A OUTPUT -m set --match-set allowed-domains dst -j ACCEPT
-
-# Default DROP for everything not explicitly allowed above.
-iptables -P INPUT   DROP
-iptables -P FORWARD DROP
-iptables -P OUTPUT  DROP
-
-log "verifying…"
-
-# A blocked host MUST fail (proves the deny is real).
-if curl -fsS --max-time 6 https://example.com >/dev/null 2>&1; then
-  die "verification FAILED: example.com is reachable but should be blocked"
-fi
-log "  ✓ blocked host (example.com) is unreachable"
-
-# An allow-listed host MUST succeed (proves we didn't sever everything).
-if ! curl -fsS --max-time 10 https://api.github.com/zen >/dev/null 2>&1; then
-  die "verification FAILED: api.github.com is unreachable but should be allowed"
-fi
-log "  ✓ allow-listed host (api.github.com) is reachable"
-
-# Our own GDS API must be reachable (the CLI depends on it). Non-fatal warn:
-# the host may be mid-deploy; the firewall correctness is already proven above.
-# The instance's OWN first API host (task 1002757 — was a founder literal, so this
-# probe reported a stranger's health as the container's connectivity).
-GDS_PROBE_HOST="$(printf '%s\n' ${INSTANCE_HOSTS//,/ } | head -n 1)"
-if [ -z "$GDS_PROBE_HOST" ]; then
-  log "  · no instance API host resolved from the branding pack — skipping the GDS reachability probe"
-elif curl -fsS --max-time 10 "https://$GDS_PROBE_HOST/healthz" 2>/dev/null | grep -q '^ok$'; then
-  log "  ✓ GDS API ($GDS_PROBE_HOST) is reachable"
-else
-  log "  ! GDS API healthz did not return ok (host may be redeploying) — allow rule is in place"
-fi
-
-log "default-deny firewall active."

package/.devcontainer/post-create.sh

@@ -1,149 +0,0 @@
-#!/usr/bin/env bash
-# post-create.sh — first-run provisioning for the Example Dev Box.
-#
-# Runs once, as the `vscode` user, after the container is created and the repo is
-# mounted at /workspace (devcontainer.json: postCreateCommand). This is where
-# ADR 0031 §3's "fold setup-builder.sh into the container's first-run step"
-# actually happens:
-#
-#   1. scripts/setup-builder.sh --no-auth --skip-keys
-#        → verifies the toolchain, runs `npm ci`, seeds .env.local from the
-#          (secret-free) example. The --no-auth flag skips the interactive
-#          GitHub Device Flow, which can't run in a non-interactive postCreate —
-#          the builder authenticates on first attach instead (see the banner).
-#   2. pip install the pinned art-pipeline deps INTO the venv the image created.
-#        → setup-builder.sh doesn't touch Python deps; the container layer owns
-#          that, installing from the repo's manifest so it stays reproducible.
-#   3. A full-stack verification (sharp loads, art libs import) so a green
-#        first-run means the box is genuinely ready, not just "built".
-#
-# No secrets are written here (ADR 0022): .env.local is copied from the example
-# with blank placeholders; the per-builder Gemini key and GDS session arrive at
-# runtime via the mounted ~/.config/otb volume and /builder-setup.
-
-set -uo pipefail
-
-cd /workspace 2>/dev/null || cd "$(git rev-parse --show-toplevel 2>/dev/null || echo .)"
-
-bold=$'\033[1m'; green=$'\033[32m'; yellow=$'\033[33m'; dim=$'\033[2m'; reset=$'\033[0m'
-say()  { echo "${bold}$*${reset}"; }
-
-say "Example Dev Box — first-run provisioning"
-echo
-
-# git trusts the mounted workspace even though its owner differs from the
-# container user (avoids "detected dubious ownership" on every git command).
-git config --global --add safe.directory /workspace 2>/dev/null || true
-
-# node_modules is a container-isolated named volume (see devcontainer.json). A
-# fresh volume mounts root-owned, so hand it to the runtime user before the
-# npm ci inside setup-builder.sh tries to populate it.
-if [ -d node_modules ]; then
-  sudo chown vscode:vscode node_modules 2>/dev/null || true
-fi
-
-# --- 1. Bring up the firewall BEFORE installing dependencies ------------------
-# postStartCommand also runs the firewall on every start, but that's AFTER this
-# postCreate step — which would leave `npm ci` + `pip install` below running with
-# unrestricted egress on first create, a window a malicious (post)install script
-# could exfiltrate through. Apply default-deny up front so dependency installs
-# happen behind the allow-list (npm + PyPI + GitHub are allow-listed, so they
-# still work). Non-fatal: if it can't apply (e.g. a laptop without NET_ADMIN),
-# postStart will report it; we don't block provisioning here.
-say "1/4  Securing egress (default-deny firewall, before dependency installs)"
-if sudo /usr/local/bin/otb-init-firewall.sh; then
-  echo "  ${green}ok${reset}  firewall active — installs run behind the allow-list"
-else
-  echo "  ${yellow}!!${reset} firewall did not apply (see above); dependency installs will run with open egress this once"
-fi
-echo
-
-# --- 2. Fold in setup-builder.sh (toolchain + npm ci + .env.local) ------------
-say "2/4  Toolchain + dependencies (scripts/setup-builder.sh --no-auth)"
-if [ -x scripts/setup-builder.sh ]; then
-  if bash scripts/setup-builder.sh --no-auth --skip-keys; then
-    echo "  ${green}ok${reset}  setup-builder.sh completed"
-  else
-    echo "  ${yellow}!!${reset} setup-builder.sh reported a problem — review the output above"
-  fi
-else
-  echo "  ${yellow}!!${reset} scripts/setup-builder.sh not found/executable — running npm ci directly"
-  npm ci --no-audit --no-fund || echo "  ${yellow}!!${reset} npm ci failed"
-fi
-echo
-
-# --- 2. Art pipeline Python deps into the venv --------------------------------
-# Non-fatal: a box without art deps is still fully usable for game/GDS work.
-# Retry a few times — on a macOS Docker Desktop bind mount, VirtioFS can
-# transiently return EDEADLK ("Resource deadlock avoided") reading repo files;
-# a retry (and a fresh container) usually clears it. The DO box (#598) has no
-# bind mount, so this never bites there.
-say "3/4  Art-pipeline Python deps (into ${OTB_VENV:-venv})"
-if [ -f modules/art-pipeline/pipeline/requirements.txt ]; then
-  art_ok=0
-  for attempt in 1 2 3; do
-    if pip install --no-cache-dir -r modules/art-pipeline/pipeline/requirements.txt; then
-      echo "  ${green}ok${reset}  art deps installed"
-      art_ok=1
-      break
-    fi
-    echo "  ${dim}--${reset}  attempt ${attempt} failed; retrying…"
-  done
-  if [ "$art_ok" -eq 0 ]; then
-    echo "  ${yellow}!!${reset} pip install failed after retries — the art pipeline won't run until resolved."
-    echo "     On a macOS laptop this is usually Docker Desktop's VirtioFS (EDEADLK):"
-    echo "     rebuild the container, or switch Docker Desktop → Settings → General →"
-    echo "     file sharing to 'gRPC FUSE'. (The box is otherwise ready.)"
-  fi
-else
-  echo "  ${dim}--${reset}  no modules/art-pipeline/pipeline/requirements.txt; skipping"
-fi
-echo
-
-# --- 3. Full-stack verification -----------------------------------------------
-say "4/4  Verifying the box is ready"
-# sharp was verified here as "the native image dep". Task 1003207 removed it: its
-# only consumers were the game-era snapshot renderers and an art-pipeline test,
-# all of which left this core with the game. Nothing native remains to prove.
-# The five art libs must import in the venv.
-if python3 -c "import PIL, numpy, scipy, sklearn, certifi" >/dev/null 2>&1; then
-  echo "  ${green}ok${reset}  art libs import (Pillow, numpy, scipy, scikit-learn, certifi)"
-else
-  echo "  ${yellow}!!${reset} one or more art libs failed to import"
-fi
-echo
-
-# --- Claude Code default permission mode (task 1251) --------------------------
-# Match the host (infra/box-source-fetch.sh): default this container's interactive
-# Claude Code to bypassPermissions so `claude` never stops for a prompt on the
-# (isolated, often unattended) dev box. USER-level (~/.claude/settings.json — the
-# persisted otb-claude-config volume), NEVER the repo's project .claude/settings.json,
-# so laptops / local clones are unaffected; it merges with the project settings
-# (which set no defaultMode). Idempotent — only sets the one key, preserving the rest.
-say "Defaulting Claude Code to bypassPermissions (box-only ~/.claude/settings.json)"
-if mkdir -p "$HOME/.claude" 2>/dev/null && node -e '
-  const fs = require("fs"), p = process.argv[1];
-  let s = {}; try { s = JSON.parse(fs.readFileSync(p, "utf8")) || {}; } catch (e) {}
-  if (typeof s !== "object" || s === null || Array.isArray(s)) s = {};
-  s.permissions = (s.permissions && typeof s.permissions === "object") ? s.permissions : {};
-  s.permissions.defaultMode = "bypassPermissions";
-  fs.writeFileSync(p, JSON.stringify(s, null, 2) + "\n");
-' "$HOME/.claude/settings.json" 2>/dev/null; then
-  echo "  ${green}ok${reset}  defaultMode=bypassPermissions written"
-else
-  echo "  ${yellow}!!${reset} could not write ~/.claude/settings.json (claude will prompt normally)"
-fi
-echo
-
-say "${green}Box provisioned.${reset}"
-cat <<'BANNER'
-
-  Next, on first connect:
-    1. Authenticate the GDS CLI:   node scripts/gds/setup.js   (or /builder-setup)
-    2. See what you can claim:      /builder-start
-
-  The pixel-art pipeline needs a Google AI Studio key in ~/.config/otb/env
-  (that path is a persisted volume, so it survives box rebuilds). Skip if you
-  are not running the art pipeline.
-
-BANNER