@bongos/core 1.19.1072 → 1.19.1074

package/scripts/gds/ship-regen.js

@@ -8,7 +8,6 @@
 
 'use strict';
 
-const fs = require('node:fs');
 const path = require('node:path');
 const { gitOk, shellOk } = require('./ship-git.js');
 const { pushVia } = require('./ship-deploy-target.js');
@@ -130,27 +129,17 @@ function regenerateApiDocs() {
 }
 
 // Refresh the generated typed client (clients/bongos-client) FROM the just-regenerated
-// spec, then keep the devbox vendored CJS copy in lockstep (task 2051). Runs right
-// after regenerateApiDocs so the client reflects the same route tree. Automatic here
+// spec (task 2051). Runs right after regenerateApiDocs so the client reflects the
+// same route tree. Automatic here
 // (not fail-if-forgotten): before this, ship regenerated the spec but not the client,
 // so a route change left the client stale until the api_client test caught it in CI.
 // Non-fatal + safe on every ship path; the api_client freshness test backstops main.
 
-// Where the devbox Electron app vendors the CJS client (ADR 0045). It lives inside the
-// dev-box MODULE (ADR 0145) — an instance that ships without that module has no copy.
-const VENDORED_CLIENT_REL = 'modules/dev-box/app/src/vendor/bongos-client.cjs';
-
-// The git pathspec for the regenerated client. Pure + exported so the rule is unit-tested
-// with no git/fs (task 1002417). `git status` tolerates an unmatched pathspec (exit 0) but
-// `git add` aborts the ENTIRE staging step (exit 128), which leaves the regenerated client
-// unstaged and the worktree dirty — and a dirty worktree makes the ship's auto-merge bail,
-// stranding the task at `confirmed` with no PR. So the vendored copy is named ONLY when it
-// is actually on disk.
-function apiClientPathspec({ worktreeRoot, existsSync = fs.existsSync } = {}) {
-  const paths = ['clients/bongos-client'];
-  if (existsSync(path.join(worktreeRoot, VENDORED_CLIENT_REL))) paths.push(VENDORED_CLIENT_REL);
-  return paths;
-}
+// The regenerated client's git pathspec. It used to carry a second, conditional path —
+// a vendored copy inside a desktop app, named only when on disk because `git add` of an
+// unmatched pathspec aborts the whole stage (task 1002417). The app is gone (task
+// 1003891), so the pathspec is the one directory the generator writes.
+const API_CLIENT_PATHSPEC = 'clients/bongos-client';
 
 function regenerateApiClient() {
   console.log('  regenerating typed API client (clients/bongos-client) from the OpenAPI spec...');
@@ -158,31 +147,13 @@ function regenerateApiClient() {
     console.log('  api-client regen failed (non-fatal) — CI api_client freshness test backstops staleness');
     return 'regen-failed';
   }
-  // The devbox Electron app can't require() clients/ at runtime, so it vendors the CJS
-  // build (ADR 0045); keep the copy byte-identical (the api_client test asserts it).
-  // Present only where the dev-box module ships — an instance without it has no vendored
-  // copy, so both the vendor step and the git pathspec below drop out (task 1002417: the
-  // app moved from top-level devbox-app/ to modules/dev-box/app/ per ADR 0145, and these
-  // paths were not updated, so the guard below silently never fired).
-  // Resolve it WORKTREE-LOCALLY (like the generator above, __dirname=scripts/gds), NOT
-  // via REPO_ROOT: on a ship from a linked worktree REPO_ROOT is the MAIN checkout, so a
-  // REPO_ROOT path would vendor the main tree while gen-api-client just wrote THIS tree,
-  // leaving this worktree's vendored copy stale → the api_client byte-identity test reds
-  // the PR (task 2060 fix). __dirname keeps the generator, the vendored file, and the
-  // git add all on the same tree.
-  const worktreeRoot = path.join(__dirname, '..', '..');
-  const vendorScript = path.join(worktreeRoot, 'modules', 'dev-box', 'app', 'scripts', 'vendor-client.js');
-  if (fs.existsSync(vendorScript)) {
-    shellOk(`"${process.execPath}" ${JSON.stringify(vendorScript)}`);
-  }
-  const clientPathspec = apiClientPathspec({ worktreeRoot }).join(' ');
-  const dirty = gitOk(`git status --porcelain ${clientPathspec}`);
+  const dirty = gitOk(`git status --porcelain ${API_CLIENT_PATHSPEC}`);
   if (!dirty) {
     console.log('  API client already current — nothing to commit');
     return 'current';
   }
-  shellOk(`git add ${clientPathspec}`);
-  if (shellOk('git commit -m "chore(api-client): auto-regenerate typed client + devbox vendor (task 2051)"')) {
+  shellOk(`git add ${API_CLIENT_PATHSPEC}`);
+  if (shellOk('git commit -m "chore(api-client): auto-regenerate typed client (task 2051)"')) {
     console.log('  committed auto-regenerated API client');
     return 'committed';
   }
@@ -333,8 +304,6 @@ function mainWorktreeBusy() {
 //                   (uncommitted work / wrong branch / empty touches[]); refuse.
 
 module.exports = {
-  VENDORED_CLIENT_REL,
-  apiClientPathspec,
   currentBranch,
   describeMainWorktreeBusy,
   mainWorktreeBusy,

package/scripts/gds/ship.js

@@ -46,10 +46,10 @@
 //                                                       # Archon). The cheap default after fixing grader
 //                                                       # findings — closes the task-595-regrade-gap (#678).
 //   node scripts/gds/ship.js <task-id> --skip-stage    # skip the sandbox-first review gate (#927,
-//                                                       # ADR 0046). On a dev box, game-surface diffs are
-//                                                       # otherwise staged to the builder's own live
-//                                                       # preview (sandbox-<login>, ADR 0044) for a
-//                                                       # browser review BEFORE the claim resolves.
+//                                                       # ADR 0046). On a clone with the game preview,
+//                                                       # game-surface diffs are otherwise staged to
+//                                                       # the builder's own local preview (ADR 0044) for
+//                                                       # a browser review BEFORE the claim resolves.
 //   node scripts/gds/ship.js <task-id> --approved      # record your sandbox sign-off (#1048): re-run with
 //                                                       # this AFTER reviewing the staged change at the
 //                                                       # sandbox URL. Persists a sandbox_review row on the
@@ -77,21 +77,6 @@
 
 'use strict';
 
-// TREE PREFLIGHT (task 1003098). A task-scoped dev box carries scripts/ and
-// src/bongos/ but not every modules/ directory, so the requires below can fail —
-// and Node's loader names only the FIRST missing one, which turned recovery into
-// guess-read-fix-repeat. This enumerates every missing requirement in one message
-// and exits before the first such require runs. It must stay ABOVE them.
-//
-// A PRE-REQUEST hard exit, like the usage banner and worktree guard: nothing has
-// been sent yet, so there is no in-flight request for cliExit to drain.
-const { action: _surfaceAction } = require('./surface.js');
-const { checkTree: _checkTree } = require('./tree-preflight.js');
-{
-  const _fault = _checkTree(__filename, { command: _surfaceAction("ship") });
-  if (_fault) { console.error(_fault); process.exit(1); }
-}
-
 const { buildMergeArgv, gitArgvOk, sanitizeGitHubRefs } = require('./ship-git.js');
 const { apiErrorLine, normalizeApiError, postLandShipOutcome } = require('./ship-io.js');
 const { deriveTagsFromPaths } = require('./ship-surprise.js');
@@ -137,8 +122,6 @@ const {
   strandNextStep,
 } = require('./ship-land.js');
 const {
-  VENDORED_CLIENT_REL,
-  apiClientPathspec,
   regenerateDiagrams,
   regenerateFileMap,
   regenerateRepoMap,
@@ -192,9 +175,6 @@ module.exports = {
   // resolveTranscriptPath itself runs path.resolve, which can't carry a Windows
   // path through a Linux CI run.
   encodeProjectPath,
-  // task 1002417: the regenerated-client pathspec rule, exported pure so the
-  // "never name a path git add cannot match" invariant is tested without git/fs.
-  apiClientPathspec, VENDORED_CLIENT_REL,
   // task 1003: transcript-grade scrubber internals, exported pure so the planted-
   // secret corpus test (tests/scrubber_corpus.mjs) can exercise each layer + tune.
   shannonEntropy, looksHighEntropySecret, redactHighEntropy, collectEnvSecrets,

package/scripts/gds/start.js

@@ -52,21 +52,6 @@
 //
 // Returns JSON if --json is passed (for the slash command to parse cleanly).
 
-// TREE PREFLIGHT (task 1003098). A task-scoped dev box carries scripts/ and
-// src/bongos/ but not every modules/ directory, so the requires below can fail —
-// and Node's loader names only the FIRST missing one, which turned recovery into
-// guess-read-fix-repeat. This enumerates every missing requirement in one message
-// and exits before the first such require runs. It must stay ABOVE them.
-//
-// A PRE-REQUEST hard exit, like the usage banner and worktree guard: nothing has
-// been sent yet, so there is no in-flight request for cliExit to drain.
-const { action: _surfaceAction } = require('./surface.js');
-const { checkTree: _checkTree } = require('./tree-preflight.js');
-{
-  const _fault = _checkTree(__filename, { command: _surfaceAction("start") });
-  if (_fault) { console.error(_fault); process.exit(1); }
-}
-
 const { cliClient, errCode, errDetails, requireSession, fmtUsd, printOnboardingNudge, printCostWarning, printNeedsNudge, hallBase, API_BASE, rewardPolicy, costPlusOnlyNote, isDispatcherIncompatError, cardFlagsFromMe } = require('./cli-lib');
 const { plainCardLines } = require('./plain-cards');
 const { contextPack, formatContextPackCompact } = require('./context-pack');

package/scripts/hall-preview/README.md

@@ -1,6 +1,6 @@
 # Hall preview harness
 
-The dev-box sandbox previews the **game only** — `/builders` 404s there (idea 490) — so
+`/builder-stage` previews the **game only** — `/builders` 404s there (idea 490) — so
 hall-ui changes are reviewed here: a DB-less fixture server that serves the **real**
 `modules/hall-ui/public` files through the **real** serving seams (boot-time `?v=`
 content-hash stamping, `{{token}}` replacement, `window.__BRANDING__`/`__MODULES__`
@@ -19,7 +19,7 @@ node scripts/hall-preview/server.js                 # neutral pack, port 4600
 |---|---|
 | `--port 4600` | listen port |
 | `--brand config/branding.json` | serve the instance pack (default: `config/branding.neutral.json`, the vanilla skin) |
-| `--modules-off dev-box,provisioning` | report those modules disabled in `window.__MODULES__` — verifies `moduleOn()` gating (Harbor nav item, Instances/Start-a-project widgets must vanish) |
+| `--modules-off discord,provisioning` | report those modules disabled in `window.__MODULES__` — verifies `moduleOn()` gating (the Discord links, Instances/Start-a-project widgets must vanish) |
 | `--empty` | drain every array in every fixture — the empty-state screenshot pass |
 | `--fixture-me` | don't read your own account live — serve the checked-in `me.json` snapshot (see below) |
 
@@ -32,7 +32,7 @@ A GET with no fixture answers 404 and logs
 The fixtures are one particular builder's snapshot, so the harness used to greet
 everyone as that builder — their name, credits, achievements, goals and **rank**.
 A metic snapshot also sealed the Archon-gated pages, so a UI change to Watch /
-Harbor / Gate / Permissions could not be reviewed at all.
+Gate / Permissions could not be reviewed at all.
 
 So at boot the harness reads **your** account: if this machine holds a GDS CLI
 session, the me-scoped endpoints (`/me`, `/me/*`, `/builders/<you>/…`,
@@ -136,8 +136,8 @@ The hard seams every redesign must keep. Run on each changed page:
 // after connect): watch the network panel, or count via a fixture hit log line.
 ```
 
-Module gating: rerun the page with `--modules-off dev-box,provisioning` — the
-Harbor nav item and the Instances/Start-a-project widgets must be absent, with
+Module gating: rerun the page with `--modules-off discord,provisioning` — the
+Discord links and the Instances/Start-a-project widgets must be absent, with
 zero console errors.
 
 ## Gotchas

package/scripts/hall-preview/server.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // scripts/hall-preview/server.js — the hall preview harness (task 2167).
 //
-// The dev-box sandbox previews the GAME only (/builders 404s there, idea 490),
+// /builder-stage previews the GAME only (/builders 404s there, idea 490),
 // so hall-ui changes are reviewed HERE: a tiny express app that serves the real
 // modules/hall-ui/public files through the REAL serving seams (boot-time ?v=
 // stamping, {{token}} replacement, __BRANDING__/__MODULES__ injection, theme
@@ -10,7 +10,7 @@
 // finally checked in.
 //
 //   node scripts/hall-preview/server.js [--port 4600] [--brand <file>]
-//        [--modules-off dev-box,provisioning] [--empty]
+//        [--modules-off discord,provisioning] [--empty]
 //
 //   --port         listen port (default 4600)
 //   --brand        branding pack file — default config/branding.neutral.json
@@ -20,7 +20,7 @@
 //   --empty        serve every fixture with its arrays emptied — the
 //                  empty-state screenshot pass
 //   --rank archon  override the served /me builder.rank (live or fixture) so the
-//                  Archon-gated pages (watch, harbor, gate) render in preview
+//                  Archon-gated pages (watch, gate) render in preview
 //   --fixture-me   do NOT read your own account live; serve the checked-in
 //                  fixtures/me.json snapshot (deterministic screenshot passes,
 //                  and the offline/signed-out path) — task 1003315
@@ -50,15 +50,15 @@ function arg(name) {
 const PORT = Number(arg('--port')) || 4600;
 const EMPTY = process.argv.includes('--empty');
 // --rank: view the hall as a different rank — the served /me builder.rank is
-// overridden in the response, so the Archon-gated pages (watch, harbor, gate)
+// overridden in the response, so the Archon-gated pages (watch, gate)
 // render their real content instead of the sealed notice. Since task 1003315 the
 // served /me is normally your OWN account, so this is now only needed to view
 // the hall as a rank you are not. Preview-only theatre:
 // the real pages are server-gated (requireGovernmentPage / ADR 0016).
 const RANK_OVERRIDE = arg('--rank');
 const MODULES_OFF = String(arg('--modules-off') || '').split(',').map((s) => s.trim()).filter(Boolean);
-// --modules-on: force-report modules as enabled — a dev box's local config
-// often lacks prod's instance modules (provisioning, dev-box), and their
+// --modules-on: force-report modules as enabled — a local checkout's config
+// often lacks prod's instance modules (provisioning, discord), and their
 // widgets can't be reviewed without it (task 2169).
 const MODULES_ON = String(arg('--modules-on') || '').split(',').map((s) => s.trim()).filter(Boolean);
 // --fixture-me: pin the checked-in /me snapshot instead of reading the caller's

package/scripts/render-diagrams.sh

@@ -19,7 +19,7 @@
 # already-installed browser and forbids the download when it finds one; it only
 # falls back to puppeteer's own download where nothing is installed (a dev
 # laptop, where that fetch works fine). This is what makes render-at-deploy
-# viable (deploy-prod.sh + infra/box-source-fetch.sh call this).
+# viable (deploy-prod.sh calls this).
 set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

package/src/bongos/api-errors.js

@@ -61,7 +61,7 @@ const OVERRIDES = Object.freeze({
   unauthenticated: 'unauthenticated',
   cookie_required: 'unauthenticated',
   unknown_or_expired: 'unauthenticated',
-  box_scope: 'forbidden',
+  session_scope: 'forbidden',
 
   // --- forbidden: 403 (rank/ownership, not "missing" or "bad input") ---
   forbidden: 'forbidden',

package/src/bongos/auth-github.js

@@ -253,9 +253,8 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
   // Approval gate (2026-05-30): the web hall sign-in no longer admits anyone
   // with a GitHub account. A first-time visitor must have been approved by an
   // Archon (their access_request marked 'invited') before a builder row is
-  // created. This Archon approval is the ONLY gate — newcomers build on hosted
-  // dev boxes, so there is no GitHub repo-access / collaborator check anywhere
-  // (2026-06-07). Established builders (a row already exists for this github_id)
+  // created. This Archon approval is the ONLY gate sign-in applies — there is
+  // no GitHub repo-access / collaborator check in it (2026-06-07). Established builders (a row already exists for this github_id)
   // always pass — this only blocks NEW first-time entries.
   //
   // SR-19 / task #1000 (2026-06-13): the CLI device flow (pollDeviceFlow,

package/src/bongos/auth.js

@@ -128,47 +128,35 @@ async function resolveSession(req) {
   return resolved;
 }
 
-// ── SESSION-SCOPES — capability attached to the TOKEN (BV1.R99, ADR 0151 §3) ──
-//
-// A session's SCOPE is orthogonal to its builder's roles: a dev-box session
-// (source='box') is baked onto a machine OUTSIDE the ADR 0016 trust boundary
-// (#919/SR#2, ADR 0053), so it must stay limited even when its builder is an
-// Archon. Before R99 that was an ad-hoc boolean (`req.allowBoxScope`) plus a
-// hardcoded `source === 'box'` test; it is now an explicit, declared model.
-//
-// A SESSION-SCOPE CAN ONLY EVER NARROW. Effective authority is (what the builder's
-// roles confer) ∩ (what this session's scope allows), with the allow-list
-// DENY-BY-DEFAULT. The governance resolver COMPOSES that intersection
-// (resolveSessionPermissions), but nothing on the request path reads it — it is
-// exported on the `government` port and exercised by
-// tests/government_session_scope.mjs, and that is the whole of its live use. The
-// ENFORCEMENT is the kernel's own route-reachability projection below: "is this
-// route inside the session's scope at all", run by requireBuilder and by
-// runPageGate. This comment used to say the permission gates read the resolver's
-// composed answer; they never have, and the next reviewer should not lose an hour
-// to that ghost (task 1003197 (B)). The projection is deliberately the ROLE-FREE
-// half — folding the builder's roles in here would change who can reach the
-// bootstrap routes (a builder on a rank with no seeded governance role resolves to
-// zero permissions by design — see tests/government_parity.mjs Part D), and R99 is
-// a behaviour-identical remodelling of the #919 gate, not a re-gating of it.
-//
-// GOVERNANCE OWNS THE POLICY, THE KERNEL STAYS THE ENFORCER. The declaration is
-// governance-owned data in modules/government/session-scopes.json, validated
-// against the permission catalog at load by modules/government/session-scopes.js.
-// Core reads it as DATA with fs — never `require` (ADR 0083's one-way rule: a
-// module's code and enable/disable state must never be something the kernel
-// depends on). The sibling trust primitive permission-path-check.js reads the
-// protected-surface registry exactly this way (R101). Reading it statically rather
-// than through the `governance` kernel port is the deliberate call: a request must
-// not need a module to be mounted to stay deny-by-default, and the alternative
-// fails badly in both directions — denying on an absent port would take every
-// cli/web session down, admitting would hand a box token full authority.
+// ── SESSION SOURCES — which kinds of token may authenticate at all (BV1.R99) ──
+//
+// Every builder_sessions row carries a `source` saying where it was minted. The
+// session-scope registry (modules/government/session-scopes.json) DECLARES the
+// sources this instance accepts; a session whose source it does not declare is
+// DENIED — by requireBuilder on every route and by runPageGate on every page —
+// rather than defaulting to its builder's full authority. A null/absent source is
+// a DECLARED row (sessions minted before migration 090 added the column), not an
+// implicit default.
+//
+// Every declared source is UNSCOPED: it carries its builder's full rank authority.
+// The registry used to be able to declare a NARROWING scope too — a
+// deny-by-default allow-list for a token living outside the ADR 0016 trust
+// boundary — and its only user was a machine-baked token (ADR 0053) that goal
+// 1000120 retired. With no other narrowing scope the allow-list machinery went
+// with it (task 1003894). The parser therefore REFUSES a row that declares an
+// allow-list: without the enforcement behind it, such a row would read as a
+// restriction while granting full authority. A session row still carrying a
+// retired source simply fails the "declared?" test and is denied.
+//
+// GOVERNANCE OWNS THE LIST, THE KERNEL STAYS THE ENFORCER. Core reads the registry
+// as DATA with fs — never `require` (ADR 0083's one-way rule: a module's code and
+// enable/disable state must never be something the kernel depends on), exactly as
+// permission-path-check.js reads the protected-surface registry (R101). A request
+// must not need a module mounted to stay fail-closed: denying on an absent port
+// would take every cli/web session down.
 //
 // FAIL-CLOSED both ways: an unreadable or malformed registry THROWS (it never
-// degrades to "every session is unscoped"), and a session whose `source` the
-// registry does not declare is DENIED rather than defaulting to full authority. A
-// null/absent source is a DECLARED row (rows minted before migration 090 added the
-// column, which predate the 'box' source existing), not an implicit default.
+// degrades to "every source is accepted"), and an undeclared source is denied.
 const SESSION_SCOPE_REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules', 'government', 'session-scopes.json');
 
 // Pure: validate + normalize the parsed registry. Split from the file read so the
@@ -177,31 +165,21 @@ const SESSION_SCOPE_REGISTRY_PATH = path.join(__dirname, '..', '..', 'modules',
 function parseSessionScopes(raw, label = 'session-scope registry') {
   const rows = Array.isArray(raw && raw.scopes) ? raw.scopes : null;
   if (!rows || rows.length === 0) {
-    throw new Error(`${label} declares no session scopes. Refusing to run with no session-scope model (ADR 0053/0151).`);
+    throw new Error(`${label} declares no session sources. Refusing to run with no session-source model (ADR 0151).`);
   }
   const bySource = new Map();
   for (const row of rows) {
     const source = row && row.source !== undefined ? row.source : null;
     if (source !== null && (typeof source !== 'string' || !source)) {
-      throw new Error(`${label}: every scope needs a non-empty session source string, or null for the legacy sourceless row`);
+      throw new Error(`${label}: every row needs a non-empty session source string, or null for the legacy sourceless row`);
     }
     if (bySource.has(source)) throw new Error(`${label}: duplicate session source "${source}"`);
-    const unscoped = !!(row && row.unscoped === true);
-    const permissions = row && Array.isArray(row.permissions) ? [...row.permissions] : [];
-    // unscoped XOR an allow-list. Both would be ambiguous (does it narrow?);
-    // neither would be a scope that can never admit anything — an authoring slip
-    // either way, and both must fail loud rather than pick a default.
-    if (unscoped === (permissions.length > 0)) {
-      throw new Error(`${label}: "${source}" must declare EITHER unscoped:true OR a non-empty permissions allow-list, never both/neither`);
-    }
-    if (permissions.some((key) => typeof key !== 'string' || !key)) {
-      throw new Error(`${label}: "${source}" lists a non-string permission key`);
+    if (row && (row.permissions !== undefined || row.unscoped !== undefined)) {
+      throw new Error(`${label}: "${source}" declares a scope (permissions/unscoped). Narrowing session scopes were removed (task 1003894); a row may only declare a source that carries its builder's full authority.`);
     }
     bySource.set(source, Object.freeze({
       source,
       label: row && typeof row.label === 'string' ? row.label : null,
-      unscoped,
-      permissions: Object.freeze(permissions),
     }));
   }
   return bySource;
@@ -212,7 +190,7 @@ function loadSessionScopes(file) {
   try {
     raw = JSON.parse(fs.readFileSync(file, 'utf8'));
   } catch (e) {
-    throw new Error(`session-scope registry unreadable at ${file}: ${e.message}. Refusing to run with no session-scope model (ADR 0053/0151).`);
+    throw new Error(`session-scope registry unreadable at ${file}: ${e.message}. Refusing to run with no session-source model (ADR 0151).`);
   }
   return parseSessionScopes(raw, `session-scope registry ${file}`);
 }
@@ -220,7 +198,7 @@ function loadSessionScopes(file) {
 const _sessionScopes = loadSessionScopes(SESSION_SCOPE_REGISTRY_PATH);
 const SESSION_SCOPES = Object.freeze([..._sessionScopes.values()]);
 
-// The scope a session's `source` declares, or null when the registry does not
+// The declared row for a session's `source`, or null when the registry does not
 // declare it (⇒ deny; never "full").
 function sessionScopeFor(source) {
   const key = source === undefined ? null : source;
@@ -228,39 +206,6 @@ function sessionScopeFor(source) {
   return _sessionScopes.get(key) || null;
 }
 
-// Route reachability, deny-by-default. An unscoped session reaches everything its
-// builder's gates admit; a SCOPED session reaches only a route that declared
-// capability its allow-list names — so a route that declares nothing (every route
-// that has not opted in, including any added later) is out of reach.
-function scopeCovers(scope, declared) {
-  if (!scope) return false; // unrecognised source
-  if (scope.unscoped) return true;
-  const needs = Array.isArray(declared) ? declared : [];
-  return needs.length > 0 && needs.every((key) => scope.permissions.includes(key));
-}
-function sessionScopeAdmits(source, declared) {
-  return scopeCovers(sessionScopeFor(source), declared);
-}
-
-// The route-side DECLARATION: "reaching this route needs these capabilities from
-// the session's scope." Mount it BEFORE requireBuilder. Inert for an unscoped
-// session — requireBuilder compares the declaration only against a narrowing scope.
-function sessionScope(...keys) {
-  const needs = Object.freeze([...keys]);
-  return function declareSessionScope(req, _res, next) {
-    req.sessionScopeNeeds = needs;
-    next();
-  };
-}
-
-// The dev-box bootstrap declaration (#919) — the name modules/dev-box mounts
-// through the plugin API (docs/modules-contract.md 1.2.0), kept as the module-
-// facing spelling. It is no longer a bare boolean: it declares the box scope's OWN
-// allow-list, read from the registry, so the declaration cannot drift from the
-// scope it declares. If the registry stopped declaring a box scope it would
-// declare nothing and every box session would be denied — fail closed.
-const allowBoxScope = sessionScope(...((sessionScopeFor('box') || { permissions: [] }).permissions));
-
 async function requireBuilder(req, res, next) {
   let session;
   try {
@@ -295,24 +240,13 @@ async function requireBuilder(req, res, next) {
     res.fail('builder_inactive', 403);
     return;
   }
-  // SECURITY (#919, SR#2): SESSION-SCOPE, deny-by-default. The dev-box provisioner
-  // (scripts/gds/box.js) bakes a session into cloud-init so the box can bootstrap
-  // (#818 — box-source-fetch clones the rank-scoped repo before /builder-setup
-  // exists). That token lives ON the box, which is OUTSIDE the ADR 0016 trust
-  // boundary, so it must NOT carry the builder's full authority. Since R99 the rule
-  // is DATA (the session-scope registry above), not a hardcoded source test: a
-  // narrowing session reaches ONLY a route that declared capability its allow-list
-  // names, so EVERY other route (all of /tasks, /me, the rest of /box …) fails
-  // closed here, including any route added later; and a source the registry does not
-  // declare at all is denied rather than treated as unscoped. A builder who wants to
-  // do real work FROM the box runs /builder-reauth, minting a normal cli/web session.
-  const scope = sessionScopeFor(session.source);
-  if (!scopeCovers(scope, req.sessionScopeNeeds)) {
-    res.fail('box_scope', {
+  // SECURITY: an UNDECLARED session source is denied (see the registry notes
+  // above). This is what keeps a token of a retired source out of every route, and
+  // any source added later out until the registry declares it.
+  if (!sessionScopeFor(session.source)) {
+    res.fail('session_scope', {
       status: 403,
-      message: scope
-        ? 'This is a box-scoped session; it may only call dev-box bootstrap endpoints.'
-        : 'This session carries an unrecognised scope and may not call authenticated endpoints.',
+      message: 'This session carries an unrecognised source and may not call authenticated endpoints. Sign in again to mint a normal session.',
     });
     return;
   }
@@ -382,9 +316,9 @@ function signInWithReturn(req) {
 //   1. IDENTITY  — is there a live session? (token from the gds_session cookie /
 //      legacy pms_session / Bearer, looked up fresh against builder_sessions).
 //      No → 302 into the web sign-in flow.
-//   2. SCOPE     — is a page inside this SESSION's scope at all? A narrowing scope
-//      (a box-baked token) reaches no page, whatever its builder's rank, exactly as
-//      requireBuilder denies it every route that declared nothing (task 1003197).
+//   2. SOURCE    — does the session-scope registry declare this session's source?
+//      An undeclared one reaches no page, whatever its builder's rank, exactly as
+//      requireBuilder denies it every route (task 1003197).
 //      No → 302 into the web sign-in flow: the remedy is a different session.
 //   3. AUTHORITY — does the builder HOLD the page's catalog permission, resolved
 //      per request through the `governance` port exactly as requirePermission
@@ -557,21 +491,15 @@ async function runPageGate(name, req, res, next) {
     res.redirect(302, signInWithReturn(req));
     return;
   }
-  // SECURITY (task 1003197 (A)): SESSION-SCOPE, the same deny-by-default check
-  // requireBuilder runs above — the two auth paths must not diverge. resolveSession
-  // accepts a Bearer token with NO source filter, so before this a box-baked token
-  // could fetch a gated page SHELL (/builders, /watch, the tab shells) whenever its
-  // builder's rank held the page's permission. Every data endpoint underneath
-  // re-gates through requireBuilder and 403s box_scope, so the exposure was shells
-  // only — but a shell is still a surface a token living outside the ADR 0016 trust
-  // boundary was never meant to reach. Page routes declare no capability, so
-  // scopeCovers refuses EVERY narrowing scope here (and an unrecognised source with
-  // it), while an unscoped cli/web session passes untouched.
+  // SECURITY (task 1003197 (A)): the same undeclared-source check requireBuilder
+  // runs above — the two auth paths must not diverge. resolveSession accepts a
+  // Bearer token with NO source filter, so without this a token of an undeclared
+  // source could fetch a gated page SHELL whenever its builder's rank held the
+  // page's permission.
   //
   // Sign-in, not `deniedTo`: unlike the authority branch below, the remedy is a
-  // DIFFERENT SESSION — /builder-reauth mints a normal one — not a different page,
-  // and a box session has no browser cookie to loop the sign-in flow with.
-  if (!scopeCovers(sessionScopeFor(session.source), req.sessionScopeNeeds)) {
+  // DIFFERENT SESSION, not a different page.
+  if (!sessionScopeFor(session.source)) {
     res.redirect(302, signInWithReturn(req));
     return;
   }
@@ -598,14 +526,14 @@ async function runPageGate(name, req, res, next) {
 }
 
 // The authenticated /builders HTML surface — the Work Board, Roadmap, Goals, the
-// task-detail page, the Repo Atlas, the Dev Box pair page and Settings. A Xenos IS
+// task-detail page, the Repo Atlas and Settings. A Xenos IS
 // allowed (page.view.public floors at xenos); an unauthenticated visitor is bounced
 // into sign-in rather than served the page shell.
 async function requireBuilderPage(req, res, next) {
   return runPageGate('requireBuilderPage', req, res, next);
 }
 
-// The /watch monitoring surface, the /harbor dev-box page and the /gate page
+// The /watch monitoring surface and the /gate page
 // (#726, idea 257, task 1179) — Metic and up, per `page.view.government`'s catalog
 // floor. Named `requireArchonPage` until ADR 0157 lowered that floor archon→metic
 // (older ADRs still use the old name; this line is the trail). Defense-in-depth:
@@ -917,10 +845,7 @@ module.exports = {
   extractTokens,
   SESSION_COOKIE_NAMES,
   resolveSession,
-  allowBoxScope,
-  sessionScope,
   sessionScopeFor,
-  sessionScopeAdmits,
   parseSessionScopes,
   SESSION_SCOPES,
   requireBuilder,

package/src/bongos/db-kernel.js

@@ -45,7 +45,7 @@ async function withTx(fn, { pool: p = pool } = {}) {
 }
 
 // getBuilderById — the canonical builder-identity read (id, rank, status, the
-// economy counters, box-block state). The kernel's identity primitive; auth and
+// economy counters). The kernel's identity primitive; auth and
 // every rank gate ultimately resolve a builder through this shape.
 async function getBuilderById(id) {
   // karma was added in migration 040 (V3.R24 / #244) as a separate
@@ -55,8 +55,7 @@ async function getBuilderById(id) {
   const { rows } = await pool.query(
     `SELECT id, github_id, github_login, display_name, avatar_url, total_credits, karma, created_at, rank,
             status, deactivated_at, reactivated_at, deactivated_reason, preferred_disciplines, system_role,
-            anthropic_email, anthropic_user_id, monthly_budget_usd,
-            box_blocked, box_blocked_reason, box_blocked_at, box_blocked_by
+            anthropic_email, anthropic_user_id, monthly_budget_usd
        FROM builders WHERE id = $1`,
     [id]
   );