@bongos/core 1.19.1072 → 1.19.1074

package/scripts/gds/feedback-latest.js

@@ -3,8 +3,8 @@
 // /feedback Claude Code slash command.
 //
 // Resolves the LATEST feedback bundle the Bongos app wrote to
-// ~/CloudBongos/feedback/ (via the shared `latest` pointer in
-// bongos-app/src/handoff.js) and prints it for a Claude Code session:
+// ~/CloudBongos/feedback/ (via the shared `latest` pointer, ADR 0087) and
+// prints it for a Claude Code session:
 //
 //   1. the full prompt.md body (the model-agnostic transcript + ask, R11), and
 //   2. the ABSOLUTE path of every attached frame, on its own line, so Claude's
@@ -20,13 +20,139 @@
 //
 // Local + read-only: it reads files under your home dir. No GDS session, no
 // network — so it works on any machine the Bongos app runs on.
+//
+// resolveLatest + feedbackBaseDir are ported here from the app's
+// bongos-app/src/handoff.js, which no longer lives in this repo (the desktop
+// apps publish off-repo, ADR 0098 — task 1004356). The contract is ADR 0087's:
+// `latest.json` is authoritative, the `latest/` symlink is a convenience that
+// may be absent, and with neither the reader self-heals by scanning for the
+// newest bundle dir holding a prompt.md.
 
 'use strict';
 
+const fs = require('node:fs/promises');
+const os = require('node:os');
 const path = require('node:path');
-const { resolveLatest, feedbackBaseDir } = require(
-  path.join(__dirname, '..', '..', 'bongos-app', 'src', 'handoff.js'),
-);
+
+const IMAGE_EXT = new Set(['.png', '.jpg', '.jpeg', '.webp', '.gif']);
+
+/** Where the Bongos app writes bundles: ~/CloudBongos/feedback. */
+function feedbackBaseDir() {
+  return path.join(os.homedir(), 'CloudBongos', 'feedback');
+}
+
+async function isBundleDir(dir) {
+  try {
+    return (await fs.stat(path.join(dir, 'prompt.md'))).isFile();
+  } catch {
+    return false;
+  }
+}
+
+// The dir `latest.json` names, or null if it is missing, unreadable or stale.
+// Accepts the pointer by `dir` (absolute) or by `id` (a child of baseDir).
+async function fromPointer(baseDir) {
+  let ptr;
+  try {
+    ptr = JSON.parse(await fs.readFile(path.join(baseDir, 'latest.json'), 'utf8'));
+  } catch {
+    return null;
+  }
+  if (!ptr || typeof ptr !== 'object') return null;
+  const candidates = [];
+  if (typeof ptr.dir === 'string' && ptr.dir) candidates.push(path.resolve(baseDir, ptr.dir));
+  if (typeof ptr.id === 'string' && ptr.id && !/[\\/]/.test(ptr.id)) candidates.push(path.join(baseDir, ptr.id));
+  for (const dir of candidates) if (await isBundleDir(dir)) return dir;
+  return null;
+}
+
+async function fromSymlink(baseDir) {
+  const link = path.join(baseDir, 'latest');
+  if (!(await isBundleDir(link))) return null;
+  try {
+    return await fs.realpath(link);
+  } catch {
+    return null;
+  }
+}
+
+// Self-heal: the newest child dir (by prompt.md mtime, then name) with a prompt.md.
+async function fromScan(baseDir) {
+  let entries;
+  try {
+    entries = await fs.readdir(baseDir, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+  let best = null;
+  for (const e of entries) {
+    if (!e.isDirectory() || e.name === 'latest') continue;
+    const dir = path.join(baseDir, e.name);
+    let st;
+    try {
+      st = await fs.stat(path.join(dir, 'prompt.md'));
+    } catch {
+      continue;
+    }
+    if (!st.isFile()) continue;
+    if (!best || st.mtimeMs > best.mtimeMs || (st.mtimeMs === best.mtimeMs && e.name > best.name)) {
+      best = { dir, name: e.name, mtimeMs: st.mtimeMs };
+    }
+  }
+  return best && best.dir;
+}
+
+// The bundle's frames as absolute paths: those prompt.md references (in the
+// order the walkthrough cites them) that exist, then any other image in the dir.
+async function collectImages(dir, promptMarkdown) {
+  const out = [];
+  const seen = new Set();
+  const add = (p) => {
+    const key = process.platform === 'win32' ? p.toLowerCase() : p;
+    if (!seen.has(key)) { seen.add(key); out.push(p); }
+  };
+  for (const m of promptMarkdown.matchAll(/!\[[^\]]*\]\(\s*<?([^)>]+?)>?\s*\)/g)) {
+    const p = path.resolve(dir, m[1]);
+    if (!IMAGE_EXT.has(path.extname(p).toLowerCase())) continue;
+    try {
+      if ((await fs.stat(p)).isFile()) add(p);
+    } catch { /* referenced but absent — skip */ }
+  }
+  const walk = async (d, depth) => {
+    let entries;
+    try {
+      entries = await fs.readdir(d, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    for (const e of entries) {
+      const p = path.join(d, e.name);
+      if (e.isDirectory() && depth > 0) await walk(p, depth - 1);
+      else if (e.isFile() && IMAGE_EXT.has(path.extname(e.name).toLowerCase())) add(p);
+    }
+  };
+  await walk(dir, 1);
+  return out;
+}
+
+/**
+ * The newest feedback bundle under baseDir, or null if there is none.
+ * @returns {Promise<null|{id:string,dir:string,promptPath:string,promptMarkdown:string,imagePaths:string[]}>}
+ */
+async function resolveLatest(baseDir = feedbackBaseDir()) {
+  const dir = (await fromPointer(baseDir)) || (await fromSymlink(baseDir)) || (await fromScan(baseDir));
+  if (!dir) return null;
+  const promptPath = path.join(dir, 'prompt.md');
+  const promptMarkdown = await fs.readFile(promptPath, 'utf8');
+  return {
+    id: path.basename(dir),
+    dir,
+    promptPath,
+    promptMarkdown,
+    imagePaths: await collectImages(dir, promptMarkdown),
+  };
+}
 
 function parseArgs(argv) {
   const out = { json: false, base: undefined };
@@ -88,7 +214,11 @@ async function main() {
   process.stdout.write(`${lines.join('\n')}\n`);
 }
 
-main().catch((err) => {
-  process.stderr.write(`feedback-latest: ${err.message}\n`);
-  process.exitCode = 1;
-});
+module.exports = { resolveLatest, feedbackBaseDir };
+
+if (require.main === module) {
+  main().catch((err) => {
+    process.stderr.write(`feedback-latest: ${err.message}\n`);
+    process.exitCode = 1;
+  });
+}

package/scripts/gds/fitness-checks-identity.js

@@ -71,10 +71,6 @@ const IDENTITY_SCAN_EXTRA_FILES = [];
 // one, and any file NOT listed must have zero hits. Getting better never fails.
 //
 // Why each is legitimate:
-//   * box.js — REAL Cloudflare/DNS zone names for the operator plane
-//     (`dev.<host>`, the terminal zone). These are infrastructure identifiers,
-//     not an instance URL; routing them through branding would be wrong. (Its
-//     two genuine API-base defaults WERE fixed in 1002428.)
 //   * publish-manifest.js — the literal FILENAMES of three real committed docs
 //     (the two decouple recipes, plus the instance's own name/trademark ADR that
 //     task 1003869 excluded: its prose redacts cleanly but the FILENAME rides in
@@ -91,8 +87,8 @@ const IDENTITY_SCAN_EXTRA_FILES = [];
 //     1002567). Each is a HOST-PINNED OPS script, not portable code: they name the
 //     live box's actual Postgres database/role and its actual /etc secrets dir, and
 //     every one of those literals is already only the DEFAULT behind an env override
-//     (GDS_BACKUP_DB, PROD_DB/STAGING_DB, PG_SOCKET). Same rationale as box.js's real
-//     DNS zones — an infrastructure identifier, not an instance URL, and the systemd
+//     (GDS_BACKUP_DB, PROD_DB/STAGING_DB, PG_SOCKET). Each is an infrastructure
+//     identifier, not an instance URL, and the systemd
 //     units on that box invoke these by path. Re-pointing an instance's backups is
 //     deployment work, not a branding read. Their COUNT is still frozen here, so a
 //     NEW literal in any of them fails exactly like one in an unlisted file.
@@ -116,7 +112,6 @@ const IDENTITY_SCAN_ALLOWED = {
   // instance it declines to run instead of destroying the wrong database.
   'scripts/gds/seed-staging.sh': 4,
   'scripts/gds/backfill-sessions.js': 2,
-  'scripts/gds/box.js': 3,
   'scripts/gds/publish-manifest.js': 3,
   'scripts/gds/seed-bongos-coreB-tranche1-tasks.js': 1,
   'scripts/gds/seed-bongos-coreB-tranche2-tasks.js': 1,

package/scripts/gds/fitness-checks-write-validation.js

@@ -46,6 +46,10 @@ const WRITE_VALIDATION_EXEMPT = new Set([
   // the route's own express.raw parser and read by docx.readUpload, which refuses
   // anything that is not a bounded, readable Word file (not_a_docx / upload_too_large).
   'POST /copy-desk/pages/:pageId/draft.docx',
+  // Not a JSON body either: the raw module tarball (task 1004271, ADR 0338 D1), capped by
+  // the route's express.raw parser and read by module-artifact.verifyModuleArtifact, which
+  // recomputes every hash and refuses anything that is not a well-formed module version.
+  'POST /store/modules/:key/versions',
 ]);
 
 // KNOWN GAPS, NOT EXEMPTIONS (task 1002551 / BV1.R109b → tracked by task 1002552).

package/scripts/gds/fitness-ratchets.js

@@ -284,9 +284,9 @@ function knipIssueCount() {
 // baseline map leaves every `floor === undefined`, and compareToBaselines classifies
 // an absent floor as a WARNING — so a checkout with no config/ reported the ratchet
 // as PASSED. Measured: with the baselines gone, a planted 5,000-line and 94-cycle
-// regression produced 0 violations. That is not a hypothetical checkout — `config/`
-// is absent from every dev box's sparse slice, so the builders who most needed the
-// gate were the ones silently exempt from it, learning from red CI instead.
+// regression produced 0 violations. That was not a hypothetical checkout — a sparse
+// checkout without `config/` once left the builders who most needed the gate
+// silently exempt from it, learning from red CI instead.
 //
 // Distinguish the two absences, because they are not the same fact:
 //   - the FILE is missing/malformed  -> cannot verify anything -> hard fail (here);
@@ -315,7 +315,7 @@ function readBaselines(baselinePath = BASELINE_PATH) {
       metrics: {},
       error: missing
         ? `config/fitness-baselines.json is MISSING — the quality ratchet cannot verify anything, so it fails CLOSED rather than reporting a pass it did not check. `
-          + `If this is a dev box, config/ was historically outside the sparse checkout (task 1003227); re-sync the box (\`node scripts/gds/box-sync.js\`). `
+          + `If this is a sparse or partial checkout, take the whole tree (\`git sparse-checkout disable\`). `
           + `To bootstrap a fresh baseline deliberately: node scripts/gds/fitness-ratchets.js --update-baselines`
         : `config/fitness-baselines.json is unreadable (${e && e.message}) — failing CLOSED.`,
     };

package/scripts/gds/fitness.js

@@ -343,11 +343,11 @@ function checkDeterministicRoutines() {
 // published doorway); the core NEVER imports a module; a module NEVER imports a
 // sibling module. These two checks enforce it.
 //
-// Both were GREEN through the strangler: dev-box + art-pipeline (the M07/M08
-// moves) import only the doorway, and the core imports neither. The boundary
+// Both were GREEN through the strangler: the first two moved modules (M07/M08)
+// imported only the doorway, and the core imported neither. The boundary
 // shipped in WARN mode so a half-moved module mid-migration couldn't red the
 // build; BV1.R45 (task 1414) flips it to ENFORCING now that the first move
-// (dev-box, M07) proved clean — the monotonic ratchet (ADR 0062 §9 / design
+// (M07) proved clean — the monotonic ratchet (ADR 0062 §9 / design
 // 04§3). A NEW cross-boundary import is now a red build; warn-mode is gone.
 let MODULE_BOUNDARY_ENFORCING = true;
 const MODULE_API_REL = 'src/module-api.js';
@@ -497,7 +497,7 @@ function checkScopeMapImportsProtected() {
 // module-AGNOSTIC: it discovers, validates, and mounts modules uniformly and may
 // never special-case one by name. The import checks (Check 7/8) stop a module's
 // CODE from being reached by `require`; this stops a module's IDENTITY from being
-// hardcoded into the kernel (`if (key === 'dev-box') …`, a copied module helper,
+// hardcoded into the kernel (`if (key === 'art-pipeline') …`, a copied module helper,
 // a registry entry that should have moved out). "No module-specific code" is
 // operationalized as the one drift-free signal — the kernel names no discovered
 // module KEY (the canonical id from modules/<key>/module.json). Domain terms are
@@ -606,14 +606,14 @@ const KERNEL_FILES = [
 // Kernel files exempt from the no-module-keys scan (Check 10) because naming a
 // module is, for them, the JOB — they stay in KERNEL_FILES for the import check
 // (Check 12), which guards dependency *direction* (a much stronger guarantee than
-// "never write the string 'dev-box'"). Two legitimate reasons a kernel file names
+// "never write the string 'art-pipeline'"). Two legitimate reasons a kernel file names
 // a module:
 //   • the REGISTRY — module-scope-map.js IS the module→path map (and
 //     checkScopeMapImportsProtected already guards how it derives `protected`).
 //   • the TRUST BOUNDARY — auth.js carries the Discord OAuth account-LINK flow
 //     (core by design — see modules/discord/CLAUDE.md "NOT in this module"); and
 //     permission-path-check.js / route-rank-check.js MUST name module path
-//     subtrees ('modules/dev-box/', …) to protect + rank-gate them. Forbidding
+//     subtrees ('modules/grading/', …) to protect + rank-gate them. Forbidding
 //     these the string would force the trust layer to stop protecting module
 //     surfaces — exactly backwards. The generic machinery + data + config files
 //     (module-api, the loader, db-kernel, secret-box, pool, _helpers, branding,
@@ -683,8 +683,8 @@ function moduleDir(key) {
   return path.join(CORE_ROOT, 'modules', key);
 }
 
-// Match a module key as a DELIMITED token so `dev-box` hits in `'dev-box'` /
-// `mount('dev-box')` but never inside `dev-boxes` or `xdev-box`. Hyphens are
+// Match a module key as a DELIMITED token so `art-pipeline` hits in `'art-pipeline'` /
+// `mount('art-pipeline')` but never inside `art-pipelines` or `xart-pipeline`. Hyphens are
 // non-word chars, so the boundary guards against word-chars AND hyphens on both
 // sides (no lookbehind — portable on every node the unit gate runs).
 function keyTokenRe(key) {
@@ -816,7 +816,7 @@ function checkKernelImportsNoDomain() {
 //     migrations," never "drop its tables" (ADR 0083 §Module-owned migrations);
 //     there is no down path, so a DROP/TRUNCATE can only be an accident.
 //   • NAMESPACED — every object it CREATEs lives under the <key>_ prefix
-//     (dev-box → dev_box_), and it may only ALTER its own namespaced tables;
+//     (art-pipeline → art_pipeline_), and it may only ALTER its own namespaced tables;
 //     core/sibling state is reached through the doorway/seams, never raw DDL.
 //
 // LEGACY_NAMESPACED: tables that predate the <key>_-prefix convention (created before the module
@@ -848,7 +848,7 @@ const CREATE_OBJ_RE = /\bcreate\s+(?:or\s+replace\s+)?(?:unique\s+)?(?:materiali
 const CREATE_INDEX_RE = /\bcreate\s+(?:unique\s+)?index\s+(?:concurrently\s+)?(?:if\s+not\s+exists\s+)?(?:"?[\w.]+"?)\s+on\s+(?:only\s+)?("?[\w.]+"?)/gi;
 const ALTER_TABLE_RE = /\balter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?("?[\w.]+"?)/gi;
 
-// SQL object-namespace prefix for a module key: dev-box → dev_box (SQL-safe).
+// SQL object-namespace prefix for a module key: art-pipeline → art_pipeline (SQL-safe).
 function moduleNamespace(key) { return key.replace(/-/g, '_'); }
 
 // strip SQL comments so a commented-out statement is never scanned

package/scripts/gds/gen-diagrams.js

@@ -8,9 +8,9 @@
 //   05-versioning          ← live versions (id/status)
 //   03-drachmae-karma      ← per-piece backing-task status + seeded-achievement count
 //   04-architecture        ← per-piece backing-task status: the ADR 0024 memory
-//                            chain + the dev-box / box→prod ship flow, merged into
-//                            one "complete architecture" map (was 04-server-repo-
-//                            memory + 06-dev-box; consolidated under task 1059)
+//                            chain + the machine → prod ship flow, in one
+//                            "complete architecture" map (consolidated under
+//                            task 1059)
 //
 // It writes each .mmd from a template, renders the SVG (crisp, pannable) + PNG
 // (fallback) via scripts/render-diagrams.sh, and rewrites the data-driven slices
@@ -332,17 +332,18 @@ function drachmaeKarmaMmd(f) {
 }
 
 // 04-architecture. The complete picture: where a builder's work runs and how it
-// reaches production, with the per-builder memory layer (ADR 0024) folded in.
-// Merges the old 04-server-repo-memory (the three layers) + 06-dev-box (the box
-// → prod ship flow) into one map (task 1059), collapsing the SERVER they both
-// drew. Conceptual like 03: every feature-piece + flow edge is LIVE/solid iff its
-// backing Bongos task is 'shipped', dotted/PLANNED otherwise — so the map is an
-// honest snapshot that flips itself as pieces ship (or regresses if one is
+// reaches production, with the per-builder memory layer (ADR 0024) folded in
+// (task 1059). Conceptual like 03: every feature-piece + flow edge is LIVE/solid
+// iff its backing Bongos task is 'shipped', dotted/PLANNED otherwise — so the map
+// is an honest snapshot that flips itself as pieces ship (or regresses if one is
 // reopened). Pieces → live task ids:
 //   memory layer  : 273 schema · 274 sync-on-ship · 275 pull-on-start · 276 isolation
-//   dev box       : 904 desktop app · 774 browser terminal · 897 sandbox preview · 919 box token
-//   box → prod    : 1025 publish-via-server · 859 CI deploy · 1028 GitHub App push credential
-//   end-to-end    : 1027 hardware-verify (no node of its own; gates the closing note)
+//   ship flow     : 1025 publish-via-server · 1028 GitHub App push credential
+// Work runs on the builder's own machine, in a clone of the instance repo. It
+// reaches main one of two ways (ship-deploy-target.js `pushVia`): a machine
+// signed in to GitHub pushes its branch and opens the PR itself; a checkout with
+// no push credential uploads the branch as a git bundle and the SERVER pushes it
+// with its own credential (ADR 0055).
 function architectureMmd(f) {
   const c = f.conceptual;
   const { host } = brand();
@@ -370,16 +371,16 @@ function architectureMmd(f) {
     ? 'SRVMEM -->|"pull on session start"| LOCAL'
     : 'SRVMEM -.->|"pull on session start — PLANNED"| LOCAL';
 
-  // --- box → prod credential + closing note ---
+  // --- ship flow: the server's push credential + closing note ---
   const pushCred = shipped(1028)
     ? 'GitHub App, short-lived tokens'
     : 'standing push PAT (GitHub App pending — 1028)';
-  // The whole box→prod chain LIVE? (all the gated legs + the end-to-end verify.)
-  // NB the deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated
-  // GitHub-Actions CI job — so 859 (CI deploy) is intentionally NOT in this set.
-  const chainLive = [919, 897, 904, 774, 1025, 1028, 1027].every(shipped);
+  // Both ways onto main LIVE? NB the deploy leg is the standalone AUTO-PULL
+  // (ADR 0108/0129), not a task-gated GitHub-Actions CI job — so 859 (CI deploy)
+  // is intentionally NOT in this set.
+  const chainLive = [1025, 1028].every(shipped);
   const closingNote = chainLive
-    ? 'The whole box → production path is LIVE: a credential-less box uploads its branch, the server merges it, and the instance auto-pulls + redeploys — hardware-verified end-to-end (1027 · 1028).'
+    ? 'Both ways onto main work today: a machine signed in to GitHub pushes its own branch, and a checkout without a push credential uploads it for the server to push. Either way the instance auto-pulls and redeploys.'
     : `Still landing (PLANNED): the server-mediated publish (${tag(1025)} · 1025) and the GitHub App push credential (${tag(1028)} · 1028).`;
 
   // Product-neutral runtime label: the instance's own product name (branding),
@@ -389,30 +390,22 @@ function architectureMmd(f) {
   const appLabel = productName && productName !== 'Cloud Bongos' ? productName : 'app';
 
   // Layout: ELK engine, top-down (task 1066). ELK minimizes edge crossings far
-  // better than the default renderer — this map is edge-dense and was a tangle
-  // before. Two more declutter moves: (1) the INTRA-cluster wiring (worker→its
-  // files, api→db/rank, db→memory-store) is dropped — co-location inside a
-  // labelled subgraph already says "these belong together", and drawing it added
-  // depth + crossings; only the CROSS-cluster flow (the numbered ship steps,
-  // memory sync, claim/ship, the blocked direct-push) is drawn. (2) Three
-  // low-signal annotation edges (box-token→bootstrap, DB-is-king, memory-
-  // follows-you) are folded into node labels. (3) WATERFALL ordering (task 1073,
-  // off Lars's "put the GitHub box last"): subgraphs are declared in flow order
-  // DEVICE→BOX→SERVER→GH, and the live app (the instance's product runtime) is
-  // pulled OUT of the SERVER cluster into its own terminal node at the very
-  // bottom (annotated "same server · same Node process" so it stays honest).
-  // That makes the map one monotonic top-down spine — device→box→server→github→
-  // live app — where the deploy is the LAST forward step instead of an edge
-  // looping back UP into the server. So SERVER tucks directly under BOX and the
-  // BOX↔SERVER wires (re-auth, upload, sync, pull, claim/ship) become short hops
-  // instead of detouring the full height past a mid-stack GitHub. The deploy is
-  // the STANDALONE auto-pull (ADR 0108/0129): merge to the instance's own main →
-  // the server pulls its own repo → migrate/regenerate/restart → the live app —
-  // NOT a GitHub-Actions push-deploy (that was the reference monorepo's model).
-  // NOTE on direction: we keep TB,
-  // not a repo-on-the-left LR/RL — the flow is an ~8-deep linear chain, so a
-  // sideways layout stretches into an unreadable ~5:1 strip; top-down keeps a
-  // legible aspect.
+  // better than the default renderer. Two declutter moves: (1) the INTRA-cluster
+  // wiring (worker→its files, api→db/rank, db→memory-store) is dropped —
+  // co-location inside a labelled subgraph already says "these belong together";
+  // only the CROSS-cluster flow (the numbered ship steps, memory sync,
+  // claim/ship) is drawn. (2) Low-signal annotation edges (DB-is-king,
+  // memory-follows-you) are folded into node labels. WATERFALL ordering (task
+  // 1073, off Lars's "put the GitHub box last"): subgraphs are declared in flow
+  // order MACHINE→SERVER→GH, and the live app (the instance's product runtime)
+  // is pulled OUT of the SERVER cluster into its own terminal node at the very
+  // bottom (annotated "same server · same Node process" so it stays honest), so
+  // the deploy is the LAST forward step instead of an edge looping back UP into
+  // the server. The deploy is the STANDALONE auto-pull (ADR 0108/0129): merge to
+  // the instance's own main → the server pulls its own repo →
+  // migrate/regenerate/restart → the live app — NOT a GitHub-Actions push-deploy
+  // (that was the reference monorepo's model). NOTE on direction: we keep TB,
+  // not LR — a sideways layout stretches the chain into an unreadable strip.
   const lines = [
     '---',
     'title: The complete architecture — where your work runs and how it reaches production  (AUTO-GENERATED from live facts — do not hand-edit; see scripts/gds/gen-diagrams.js)',
@@ -420,18 +413,10 @@ function architectureMmd(f) {
     '  layout: elk',
     '---',
     'flowchart TB',
-    '    subgraph DEVICE["YOUR DEVICE — only the screen lives here"]',
-    '        APP["Claude desktop app or browser tab\\n(shows files · sends your messages · holds NO code)"]',
-    '    end',
-    '',
-    '    subgraph BOX["DEV BOX — a machine WE create on DigitalOcean (gated · revocable · audited; Metic+ may instead clone locally)"]',
-    '        WORKER["Claude Code WORKER\\n(opens files · runs commands · runs the /builder-* skills)"]',
-    `        CODE["the code — git clone + per-builder worktrees (.claude/worktrees/*)\\nfor sub-Metic builders it lives ONLY here · CLAUDE.md is DESCRIPTIVE only"]`,
+    '    subgraph MACHINE["YOUR MACHINE — a clone of the instance repo"]',
+    '        WORKER["Claude Code — the desktop app or the terminal\\n(opens files · runs commands · runs the /builder-* skills)"]',
+    '        CODE["the code — git clone + per-task worktrees (.claude/worktrees/*)\\nCLAUDE.md is DESCRIPTIVE only"]',
     '        LOCAL["local ~/.claude memory\\nMAP = MEMORY.md — a one-line index loaded EVERY session\\n(a guard + auto-tidy keep it light; ADR 0074)\\n+ drawer of full notes, loaded only on demand"]',
-    '        ORIGIN["credential-less git origin\\n(NO GitHub push secret on the box — by design)"]',
-    `        BOXTOK["box-scoped Bongos token\\n(deny-by-default: bootstrap endpoints only;\\nrejected for branch upload → re-auth first — ${tag(919)})"]`,
-    `        PREVIEW["sandbox preview server on :3000\\n→ a per-builder sandbox URL (${tag(897)})"]`,
-    `        SWITCH["on / off + browser terminal\\n(desktop app ${tag(904)} · ttyd-over-tunnel ${tag(774)})"]`,
     '    end',
     '',
     `    subgraph SERVER["THE INSTANCE SERVER — ${host} (the authority AND production)"]`,
@@ -440,7 +425,7 @@ function architectureMmd(f) {
     '        DB["Postgres — tasks · claims · versions · builders.rank\\ncredit_log · grades · idea_inbox · builder_memory\\n(KING for work-state + permissions; CLAUDE.md only describes it)"]',
     '        RANK["auth.requireRank — checked per request, NO caching\\n(ADR 0016: a demotion takes effect on the next request)"]',
     `        SRVMEM["server-side builder_memory store\\n${memLead}: per-builder · isolated · forensic read at Metic+ (ADR 0157)\\nyour memory follows you across machines & worktrees\\n/recall fetches only the relevant subset (ADR 0060)\\n(${memStatus})"]`,
-    `        PUSHTOK["server-held push credential\\n(${pushCred} — the box never holds it)"]`,
+    `        PUSHTOK["server-held push credential\\n(${pushCred} — for a checkout that has none of its own)"]`,
     '        DEPLOY["auto-pull deploy (ADR 0129)\\na timer pulls THIS instance repo every ~2 min →\\nnpm ci if the pin changed → migrate → regenerate docs → restart → healthz"]',
     '    end',
     '',
@@ -450,17 +435,14 @@ function architectureMmd(f) {
     '',
     `    LIVEAPP["the live ${appLabel} — ${host}\\n(same server · same Node process as /api/bongos/*)"]`,
     '',
-    '    APP -->|"1 · toggle box on / open terminal"| SWITCH',
-    '    SWITCH --> WORKER',
-    '    WORKER -->|"2 · edit + commit"| CODE',
-    '    WORKER -->|"3 · re-auth in browser"| API',
-    flow('WORKER', 1025, '4 · upload branch as a git bundle', 'API'),
-    flow('API', 1025, `5 · push + open PR + auto-merge (${tag(1025)})`, 'MAIN'),
-    '    MAIN -->|"6 · the instance auto-pulls its own main"| DEPLOY',
-    '    DEPLOY -->|"7 · migrate · regenerate docs · restart"| LIVEAPP',
+    '    WORKER -->|"1 · edit + commit"| CODE',
+    '    WORKER -->|"2 · push the branch + open a PR (a machine signed in to GitHub)"| MAIN',
+    flow('WORKER', 1025, '2 · or upload the branch as a git bundle (no push credential here)', 'API'),
+    flow('API', 1025, `3 · the server pushes it + opens the PR (${tag(1025)})`, 'MAIN'),
+    '    MAIN -->|"4 · the instance auto-pulls its own main"| DEPLOY',
+    '    DEPLOY -->|"5 · migrate · regenerate docs · restart"| LIVEAPP',
     '    CORE --- API',
     '    PUSHTOK -.-> API',
-    '    ORIGIN -. "direct push blocked" .-> MAIN',
     '    API -. "claim / ship / cost" .-> WORKER',
     `    ${pushEdge}`,
     `    ${pullEdge}`,
@@ -500,20 +482,16 @@ function rebuildAssertions(prev, f) {
       pending_tasks: ids.filter((id) => !shipped(id)).map(entry),
     });
 
-    // 04-architecture — the ADR 0024 memory chain + the dev-box / box→prod ship
-    // flow, merged (task 1059). A piece is LIVE iff its backing task is shipped.
-    const arch = split([273, 274, 275, 276, 904, 774, 897, 919, 1025, 1027, 1028]);
+    // 04-architecture — the ADR 0024 memory chain + the machine → prod ship
+    // flow (task 1059). A piece is LIVE iff its backing task is shipped.
+    const arch = split([273, 274, 275, 276, 1025, 1028]);
     next.architecture = {
       diagram: '04-architecture',
       _comment:
-        "Pieces of 04-architecture gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/gds/gen-diagrams.js in lockstep with the diagram, so this is the drift checker's backstop. The device/box/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. DEV BOX + box→prod: 904/774 (on-off + browser terminal), 897 (sandbox preview), 919 (scoped box token), 1025 (server-mediated publish), 1028 (GitHub App push credential), 1027 (end-to-end hardware-verify). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent. Supersedes the old server_repo_memory + dev_box slices.",
+        "Pieces of 04-architecture gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/gds/gen-diagrams.js in lockstep with the diagram, so this is the drift checker's backstop. The machine/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. Ship flow: 1025 (server-mediated publish, for a checkout with no push credential), 1028 (GitHub App push credential). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent.",
       live_tasks: arch.live_tasks,
       pending_tasks: arch.pending_tasks,
     };
-    // Drop the two slices this diagram replaced so the file (and drift checker)
-    // never carry stale keys after the 04+06 consolidation.
-    delete next.server_repo_memory;
-    delete next.dev_box;
 
     // 03-drachmae-karma — bounty + karma pieces (D_SHIP/D_ACH have no task gate).
     const dk = split([284, 286, 282, 245, 248, 246]);

package/scripts/gds/http-api-client.js

@@ -1,24 +1,18 @@
-// scripts/gds/http-api-client.js — the shared skeleton behind the control plane's
-// two JSON-over-HTTP clients: scripts/gds/do-api.js (DoApi, DigitalOcean) and
-// scripts/gds/cf-tunnel.js (CfTunnelApi, Cloudflare). Both are thin, injectable-
-// transport, dry-run-by-default wrappers with a byte-identical request skeleton
-// (do-api.js's design note: the box subsystem keeps "ONE shape for every external
-// API"). This base IS that one shape.
+// scripts/gds/http-api-client.js — the request skeleton behind the control
+// plane's JSON-over-HTTP client, scripts/gds/do-api.js (DoApi, DigitalOcean): a
+// thin, injectable-transport, dry-run-by-default wrapper. It is kept apart from
+// do-api.js so the ONE request shape stays reusable by any future client.
 //
-// The genuine per-API differences stay in the subclasses via three small hooks:
-//   - the constructor's OWN live-mode validation (the "missing X" messages and the
-//     order they fire in differ, and tests assert both);
-//   - requestInit() — extra fetch options (Cloudflare pins an IPv4 dispatcher,
-//     #771; DigitalOcean sends none);
+// Per-API differences go in a subclass via three small hooks:
+//   - the constructor's OWN live-mode validation (its "missing X" messages);
+//   - requestInit() — extra fetch options (DigitalOcean sends none);
 //   - detectError() — what counts as a failure + how the message is extracted
-//     (DigitalOcean = non-2xx → message/id; Cloudflare also fails the {success:false}
-//     envelope and joins errors[]).
+//     (DigitalOcean = non-2xx → message/id).
 //
-// Behaviour-neutral extraction: pinned by tests/boxes.mjs (DoApi) and
-// tests/cf_tunnel.mjs (CfTunnelApi).
+// Pinned by tests/do_api.mjs.
 
 // Build a distinct, named API-error class. Each client makes its own so the
-// `instanceof` checks the tests rely on (DoApiError vs CfApiError) stay meaningful
+// `instanceof` checks the tests rely on (DoApiError) stay meaningful
 // and the `.name` / `.code` carried on every thrown error survive unchanged.
 function makeApiError(name, code) {
   return class ApiError extends Error {
@@ -46,13 +40,12 @@ class JsonHttpApi {
     this._ErrorClass = ErrorClass;
   }
 
-  // Extra fetch init merged into every LIVE request. Base sends none; CfTunnelApi
-  // overrides to pin the IPv4 dispatcher (its token is IP-locked, #771).
+  // Extra fetch init merged into every LIVE request. Base sends none.
   requestInit() { return {}; }
 
   // Inspect a completed response. Return an error MESSAGE string to throw, or null
   // to accept. Base fails on a non-2xx HTTP status (DigitalOcean surfaces
-  // message/id); CfTunnelApi also fails the Cloudflare {success:false} envelope.
+  // message/id).
   detectError(res, json) {
     if (!res.ok) return (json && (json.message || json.id)) || `HTTP ${res.status}`;
     return null;

package/scripts/gds/init.js

@@ -79,7 +79,7 @@ const { detectStack, formatStackSummary } = require('./adopt-detect'); // ADR 01
 const { resolveBacklogTasks, DEFAULT_MAX: BACKLOG_MAX } = require('./adopt-import'); // ADR 0121 §Decision 3 (task 2044): import an existing backlog
 const { preflightAdopt, formatPreflight } = require('./adopt-preflight'); // ADR 0121 §Decision 5 (task 2045): the accept-gated conflict pre-flight
 
-const KNOWN_MODULES = ['game', 'art-pipeline', 'discord', 'dev-box'];
+const KNOWN_MODULES = ['game', 'art-pipeline', 'discord'];
 
 // The provisioning hosting shapes — a small mirror of modules/provisioning's
 // HOSTING_SHAPES. init deliberately does NOT import the (optional) provisioning

package/scripts/gds/lint-infra-exec.js

@@ -3,7 +3,7 @@
 // lint-infra-exec.js — task 2137 (ADR 0108 configurable-root). The dry-run/lint that proves every
 // host systemd unit running a CORE script still resolves AFTER the R89 split.
 //
-// The units (box-*, cohost-*, provision-*, search-index-db) keep living in the instance repo
+// The units (cohost-*, provision-*, search-index-db) keep living in the instance repo
 // (infra/ is host topology) while scripts/gds/ moves into node_modules/@bongos/core, so each
 // ExecStart runs through infra/core-node.sh, which resolves the script under the instance root OR
 // its node_modules/@bongos/core (both layouts). "Resolves in a consumer layout" is provable from