@bongos/core 1.19.1072 → 1.19.1074

package/tests/lib_sh_resolution.mjs

@@ -26,7 +26,6 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { fitnessSource } from './helpers.mjs';
@@ -35,12 +34,6 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const GDS = path.join(ROOT, 'scripts', 'gds');
 const fitness = require(path.join(GDS, 'fitness.js'));
-// The CURRENT session filename, so the expectations below follow the rename chain
-// (task 1003704 renamed the file; 1003706 retires the old names) instead of being
-// re-edited at each step. SESSION_FILENAMES[0] is what the CLI WRITES; the tail is
-// what it still accepts on read.
-const ic = require(path.join(ROOT, 'src', 'instance-config.js'));
-const SESSION_FILE = ic.SESSION_FILENAMES[0];
 
 // Every bash script that resolves a GDS token or API base.
 const SMOKES = [
@@ -159,217 +152,3 @@ test('the whole host-identity check is green on this tree', () => {
   const r = fitness.checkKernelPromptsNoHardcodedIdentity();
   assert.equal(r.ok, true, `violations:\n${r.violations.join('\n')}`);
 });
-
-// ---- 4. the SAME rule applies to the baked box scripts (task 1003252) ------
-//
-// THE SECOND BUG, same class, different file group. The sweep above fixed
-// scripts/gds/*.sh but never looked at infra/box-*.sh — the scripts baked onto a
-// dev box. Those kept reading a hardcoded ~/.config/otb/gds-session.json while
-// paste-token.js writes to ~/.config/<branding.configDir>/. On this instance
-// (configDir "cloudbongos") that meant every /builder-reauth silently stranded the
-// box: the 5-min heartbeat, the terminal/host-key/version reporters and the
-// GDS-backed git credential helper all kept presenting a DEAD token and failing
-// with a misleading "session expired — re-auth on the box", which is exactly what
-// the builder had just done. Observed live: four reporters 401ing every tick and a
-// checkout 311 commits behind origin/main.
-//
-// The fix mirrors instance-config.js's read-side fallback in bash: prefer the most
-// recently written gds-session.json across ~/.config/*/, since branding is not
-// readable from a script that must also run before any clone exists.
-
-const BOX_SCRIPTS = [
-  'box-heartbeat.sh',
-  'box-report-terminal.sh',
-  'box-report-host-keys.sh',
-  'box-report-version.sh',
-];
-
-const INFRA = path.join(ROOT, 'infra');
-const boxCode = (f) => fitness.stripCommentsForIdentity(fs.readFileSync(path.join(INFRA, f), 'utf8'), '.sh');
-
-test('every baked box script resolves the session across config dirs, not just the legacy one', () => {
-  for (const f of BOX_SCRIPTS) {
-    const src = boxCode(f);
-    for (const name of ic.SESSION_FILENAMES.slice(0, 2)) {
-      assert.ok(src.includes(`.config/*/${name}`),
-        `${f} must scan ~/.config/*/${name} — without the glob a /builder-reauth into a `
-        + 'non-"otb" configDir strands the box on a dead token, and without BOTH names '
-        + 'half the fleet is unreadable: a box provisioned before the rename has only the '
-        + 'old name, one provisioned after has only the new (task 1003704)');
-    }
-    // The legacy literal may survive ONLY as the last-resort default, never as the
-    // sole source — i.e. it must be preceded by the glob scan.
-    // The scan widens what these scripts will read, so each candidate must be owned
-    // by the box user -- otherwise a file dropped by another local account could win
-    // simply by being newest.
-    assert.match(src, /\[ -O "\$_sess" \]/,
-      `${f} must require candidate session files to be owned by the current user`);
-    const globAt = src.indexOf('.config/*/');
-    const legacyAt = src.indexOf(`.config/otb/${SESSION_FILE}`);
-    if (legacyAt !== -1) {
-      assert.ok(globAt < legacyAt,
-        `${f} reaches the legacy path before scanning ~/.config/*/ — the fallback must come first`);
-    }
-  }
-});
-
-test('every baked box script passes bash -n', (t) => {
-  const probe = bash(['-n', 'infra/box-heartbeat.sh']);
-  if (!probe) return t.skip('bash not available on this machine');
-  for (const f of BOX_SCRIPTS) {
-    const r = bash(['-n', `infra/${f}`]);
-    assert.equal(r.status, 0, `bash -n infra/${f} failed:\n${r.stderr}`);
-  }
-});
-
-// Pull the resolver straight out of the committed file so this exercises the real
-// code, not a copy that could drift away from it.
-function resolverBlock(f) {
-  const src = fs.readFileSync(path.join(INFRA, f), 'utf8');
-  const start = src.indexOf('if [ -z "${GDS_SESSION:-}" ]; then');
-  // Matched by PREFIX, up to the closing quote — never by the full line including the
-  // filename. The filename is the one thing a rename changes, so spelling it here made
-  // this test fail with "could not locate the resolver block" on a perfectly good
-  // rename, and on Windows (where it already failed for its own reason) that looked
-  // like no new failure at all (task 1003704).
-  const endPrefix = 'GDS_SESSION="${GDS_SESSION:-$HOME/.config/otb/';
-  const at = src.indexOf(endPrefix, start);
-  const close = at === -1 ? -1 : src.indexOf('"', at + endPrefix.length);
-  assert.ok(start !== -1 && at !== -1 && close !== -1,
-    `could not locate the resolver block in ${f}`);
-  return src.slice(start, close + 1);
-}
-
-// These two assert on the PATH STRING the shell resolver prints. Everything above
-// checks content and syntax and runs everywhere; only these two compare spellings,
-// and Git Bash answers in its own mount namespace — a Win32 HOME comes back as
-// '/tmp/boxsess-…', which maps to a Git-install mount this side cannot reconstruct
-// without reading Git's mount table (task 1003529). The box scripts these cover run
-// on the Linux dev box, so the claim is verified where it is true rather than
-// left permanently red here — a red nobody can act on is how a suite stops being read.
-const SHELL_PATH_SPELLING_SKIP =
-  'shell path spellings: Git Bash resolves HOME into its own mount namespace (these scripts run on the Linux box)';
-
-test('the resolver prefers the most recently written session across config dirs', (t) => {
-  if (process.platform === 'win32') return t.skip(SHELL_PATH_SPELLING_SKIP);
-  const probe = bash(['-n', 'infra/box-report-version.sh']);
-  if (!probe) return t.skip('bash not available on this machine');
-
-  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'boxsess-'));
-  const legacy = path.join(home, '.config', 'otb');
-  const configured = path.join(home, '.config', 'cloudbongos');
-  fs.mkdirSync(legacy, { recursive: true });
-  fs.mkdirSync(configured, { recursive: true });
-  fs.writeFileSync(path.join(legacy, 'gds-session.json'), '{"token":"stale"}');
-  fs.writeFileSync(path.join(configured, 'gds-session.json'), '{"token":"fresh"}');
-  // Make the legacy copy unambiguously older than the freshly re-authed one.
-  const old = new Date(Date.now() - 60_000);
-  fs.utimesSync(path.join(legacy, 'gds-session.json'), old, old);
-
-  const block = resolverBlock('box-report-version.sh');
-  const run = (env) => spawnSync('bash', ['-c', `set -uo pipefail\n${block}\nprintf '%s' "$GDS_SESSION"`],
-    { encoding: 'utf8', env: { PATH: process.env.PATH, HOME: home, ...env } });
-
-  // 1. the freshly written session wins over the stale legacy one
-  assert.equal(run({}).stdout, path.join(configured, 'gds-session.json'));
-
-  // 2. an explicit override still beats the scan
-  assert.equal(run({ GDS_SESSION: '/explicit/path.json' }).stdout, '/explicit/path.json');
-
-  // 3. with nothing on disk it falls back to the historical path, so the caller's
-  //    "no session at ..." message still names somewhere sensible
-  const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'boxsess-empty-'));
-  const r3 = spawnSync('bash', ['-c', `set -uo pipefail\n${block}\nprintf '%s' "$GDS_SESSION"`],
-    { encoding: 'utf8', env: { PATH: process.env.PATH, HOME: empty } });
-  assert.equal(r3.stdout, path.join(empty, '.config', 'otb', SESSION_FILE));
-
-  fs.rmSync(home, { recursive: true, force: true });
-  fs.rmSync(empty, { recursive: true, force: true });
-});
-
-// box-heartbeat.sh is the odd one out: its override variable (OTB_GDS_SESSION) is
-// NOT the variable it resolves into (SF). A first cut of the fix guarded on the
-// override but assigned to SF, so a caller that SET the override had it silently
-// dropped and fell through to the legacy default — the exact bug being fixed,
-// reintroduced through the back door. Pin all three branches.
-// box-heartbeat.sh's resolver, pulled straight out of the committed file. Shared by the
-// two tests below so there is a single extraction to fix when the names next move.
-function heartbeatSfBlock() {
-  const src = fs.readFileSync(path.join(INFRA, 'box-heartbeat.sh'), 'utf8');
-  const start = src.indexOf('SF="${OTB_GDS_SESSION:-}"');
-  // Prefix, not the whole line — see resolverBlock above.
-  const endPrefix = 'SF="${SF:-$HOME/.config/otb/';
-  const at = src.indexOf(endPrefix, start);
-  const close = at === -1 ? -1 : src.indexOf('"', at + endPrefix.length);
-  assert.ok(start !== -1 && at !== -1 && close !== -1,
-    'could not locate the SF resolver in box-heartbeat.sh');
-  return src.slice(start, close + 1);
-}
-
-test('box-heartbeat.sh honors OTB_GDS_SESSION, scans, then falls back', (t) => {
-  if (process.platform === 'win32') return t.skip(SHELL_PATH_SPELLING_SKIP);
-  const probe = bash(['-n', 'infra/box-heartbeat.sh']);
-  if (!probe) return t.skip('bash not available on this machine');
-
-  const block = heartbeatSfBlock();
-
-  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-'));
-  const configured = path.join(home, '.config', 'cloudbongos');
-  fs.mkdirSync(configured, { recursive: true });
-  fs.writeFileSync(path.join(configured, 'gds-session.json'), '{"token":"fresh"}');
-
-  const run = (env, h = home) => spawnSync('bash',
-    ['-c', `set -euo pipefail\n${block}\nprintf '%s' "$SF"`],
-    { encoding: 'utf8', env: { PATH: process.env.PATH, HOME: h, ...env } }).stdout;
-
-  assert.equal(run({ OTB_GDS_SESSION: '/explicit/override.json' }), '/explicit/override.json',
-    'the OTB_GDS_SESSION override must win — guarding on it but assigning elsewhere drops it');
-  assert.equal(run({}), path.join(configured, 'gds-session.json'));
-
-  const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-empty-'));
-  assert.equal(run({}, empty), path.join(empty, '.config', 'otb', SESSION_FILE));
-
-  fs.rmSync(home, { recursive: true, force: true });
-  fs.rmSync(empty, { recursive: true, force: true });
-});
-
-// The rename leaves the fleet in FOUR states at once, and the two tests above only cover
-// the pre-rename half (their fixtures write the old name). These are the other two, and
-// they are the ones a rename actually breaks (task 1003704). Same extracted resolver — one
-// harness for this block, deliberately, so part 4 (task 1003706) has one place to change.
-test('the box resolver handles a post-rename box and a migrated one', (t) => {
-  const probe = bash(['-n', 'infra/box-heartbeat.sh']);
-  if (!probe) return t.skip('bash not available on this machine');
-
-  const block = heartbeatSfBlock();
-  const run = (h) => spawnSync('bash', ['-c', `set -euo pipefail\n${block}\nprintf '%s' "$SF"`],
-    { encoding: 'utf8', env: { PATH: process.env.PATH, HOME: h } }).stdout;
-
-  // A box provisioned AFTER the rename has ONLY the new name. Before the glob was widened
-  // this fell through to the historical default, which does not exist, so every heartbeat
-  // tick failed with a misleading "no session".
-  const fresh = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-new-'));
-  const freshCfg = path.join(fresh, '.config', 'cloudbongos');
-  fs.mkdirSync(freshCfg, { recursive: true });
-  fs.writeFileSync(path.join(freshCfg, SESSION_FILE), '{"token":"fresh"}');
-  const tail = (p) => p.replace(/\\/g, '/').split('/').slice(-2).join('/');
-  assert.equal(tail(run(fresh)), `cloudbongos/${SESSION_FILE}`,
-    'a box provisioned after the rename must resolve the new name');
-
-  // A MIGRATED box carries both, the new one written later by the CLI's migrate-on-read.
-  // Newest-wins must take the new one; taking the older would read a stale token and report
-  // the misleading "session expired" of task 1003252.
-  const both = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-both-'));
-  const bothCfg = path.join(both, '.config', 'cloudbongos');
-  fs.mkdirSync(bothCfg, { recursive: true });
-  const legacyName = ic.SESSION_FILENAMES[1];
-  fs.writeFileSync(path.join(bothCfg, legacyName), '{"token":"stale"}');
-  fs.writeFileSync(path.join(bothCfg, SESSION_FILE), '{"token":"fresh"}');
-  const older = new Date(Date.now() - 60_000);
-  fs.utimesSync(path.join(bothCfg, legacyName), older, older);
-  assert.equal(tail(run(both)), `cloudbongos/${SESSION_FILE}`,
-    'a migrated box must prefer the newly written file, not the superseded one');
-
-  fs.rmSync(fresh, { recursive: true, force: true });
-  fs.rmSync(both, { recursive: true, force: true });
-});

package/tests/local_preview.mjs

@@ -41,18 +41,6 @@ t('hasGameEntry: keyed on the preview entry file', () => {
   assert.equal(lib.hasGameEntry({ fs: { existsSync: () => false } }), false);
 });
 
-t('onBox: any box marker ⇒ true; none ⇒ false (keeps the localhost path off a box, task 1443)', () => {
-  const only = (target) => ({ fs: { existsSync: (p) => p === target } });
-  assert.equal(lib.onBox(only('/etc/otb/box.env')), true, 'box.env');
-  assert.equal(lib.onBox(only('/usr/local/bin/box-preview')), true, 'box-preview wrapper');
-  assert.equal(lib.onBox(only('/etc/systemd/system/box-game-preview.service')), true, 'box-game-preview unit');
-  assert.equal(lib.onBox({ fs: { existsSync: () => false } }), false, 'a laptop has none of them');
-  // honors the dep names sandbox-stage.js injects, and a throwing existsSync is swallowed → false
-  assert.equal(lib.onBox({ boxEnvPath: '/custom/box.env', fs: { existsSync: (p) => p === '/custom/box.env' } }), true);
-  assert.equal(lib.onBox({ previewWrapper: '/custom/box-preview', fs: { existsSync: (p) => p === '/custom/box-preview' } }), true);
-  assert.equal(lib.onBox({ fs: { existsSync: () => { throw new Error('EACCES'); } } }), false, 'throwing existsSync → false, not a crash');
-});
-
 t('readPid: parses a pidfile; null on garbage/missing', () => {
   assert.equal(lib.readPid({ fs: { readFileSync: () => '12345\n' } }), 12345);
   assert.equal(lib.readPid({ fs: { readFileSync: () => 'garbage' } }), null);

package/tests/module-scope-map.mjs

@@ -22,7 +22,7 @@ test('roster covers the decided ~16 modules + kernel, each with non-empty globs'
   // the decided roster from docs/design/modular-architecture/02-module-map.md §6 + kernel
   for (const k of ['kernel', 'lifecycle', 'economy', 'grading', 'memory', 'onboarding',
     'ideas', 'builder-settings', 'sessions', 'autonomy', 'security', 'hall-ui',
-    'status-ui', 'game', 'art-pipeline', 'discord', 'dev-box']) {
+    'status-ui', 'game', 'art-pipeline', 'discord', 'control-plane']) {
     assert.ok(keys.includes(k), `roster missing module "${k}"`);
     const e = scope.scopeForModule(k);
     assert.ok(e && Array.isArray(e.globs) && e.globs.length > 0, `module "${k}" has no globs`);
@@ -97,7 +97,7 @@ test('`protected` is DERIVED from the imported PROTECTED_GLOBS, never hand-set',
 // inside a module, which is the core->module edge ADR 0083 rule 1 forbids.
 const PROTECTED_MODULES = [
   'agents',
-  'dev-box',
+  'control-plane',
   'devsecops',
   'government',
   'grading',
@@ -119,7 +119,7 @@ test('the seven trust-core modules can never leave the protected set', () => {
   // with the rest: their territory IS the trust / ship / authz core, so an edit
   // that unprotects one is a security regression rather than a roster change.
   // ADR 0314 narrows which MODULES derive protected; it must never reach these.
-  for (const k of ['kernel', 'lifecycle', 'government', 'grading', 'dev-box', 'devsecops', 'methodology']) {
+  for (const k of ['kernel', 'lifecycle', 'government', 'grading', 'control-plane', 'devsecops', 'methodology']) {
     assert.equal(scope.scopeForModule(k).protected, true, `${k} must stay protected`);
   }
 });
@@ -524,10 +524,10 @@ test('a cross-cutting module owns its paths everywhere EXCEPT the drift advisory
 });
 
 test('real cross-module contact is still flagged — the signal the advisory exists for', () => {
-  // "You said lifecycle, you touched dev-box."
+  // "You said lifecycle, you touched discord."
   assert.deepEqual(
-    scope.moduleDriftFiles('lifecycle', ['modules/dev-box/app/src/box-controller.js']),
-    ['modules/dev-box/app/src/box-controller.js'],
+    scope.moduleDriftFiles('lifecycle', ['modules/discord/discord-bot.js']),
+    ['modules/discord/discord-bot.js'],
   );
   // Its own territory, and territory no module owns, both stay quiet.
   assert.deepEqual(scope.moduleDriftFiles('lifecycle', ['modules/lifecycle/rot.js']), []);
@@ -557,11 +557,11 @@ test('devsecops is deliberately NOT cross-cutting (task 1003770)', () => {
 
 test('moduleDriftFiles degrades safely on junk input', () => {
   // ship-flow calls this with whatever the claim carries; it must never throw.
-  assert.deepEqual(scope.moduleDriftFiles('not-a-module', ['modules/dev-box/app.js']), [],
+  assert.deepEqual(scope.moduleDriftFiles('not-a-module', ['modules/discord/app.js']), [],
     'an unknown key has no declared scope to stray from');
   assert.deepEqual(scope.moduleDriftFiles('lifecycle', []), []);
   assert.deepEqual(scope.moduleDriftFiles('lifecycle', null), []);
-  assert.deepEqual(scope.moduleDriftFiles(null, ['modules/dev-box/app.js']), []);
+  assert.deepEqual(scope.moduleDriftFiles(null, ['modules/discord/app.js']), []);
 });
 
 // EVERY PROTECTED PATH HAS AN OWNING MODULE (task 1004111).
@@ -642,7 +642,7 @@ test('adopting the unowned paths did NOT change which modules are protected', ()
   // The property that made assignment safe rather than a re-coupling: every
   // receiving module was ALREADY protected, so no goal became Archon-only that
   // was not before. If this fails, an adoption widened the trust boundary.
-  for (const k of ['kernel', 'lifecycle', 'dev-box', 'devsecops', 'methodology']) {
+  for (const k of ['kernel', 'lifecycle', 'control-plane', 'devsecops', 'methodology']) {
     assert.equal(scope.scopeForModule(k).protected, true, `${k} was already protected and must stay so`);
   }
   // and the adoption changed no COUNT either. Pinned against PROTECTED_MODULES

package/tests/module_catalog.mjs

@@ -25,7 +25,7 @@ const CORE = path.join(path.sep, 'srv', 'app', 'node_modules', '@bongos', 'core'
 const INST = path.join(path.sep, 'srv', 'app');
 
 const manifest = (over = {}) => ({
-  key: 'x', title: 'X', description: 'a module', coreVersion: '^1.0.0', contributes: {}, ...over,
+  key: 'x', title: 'X', description: 'a module', version: '1.0.0', coreVersion: '^1.0.0', contributes: {}, ...over,
 });
 const loadedIn = (root, key, over = {}) => ({
   key, dir: path.join(root, 'modules', key), manifest: manifest({ key, title: key, ...over }),

package/tests/module_cli.mjs

@@ -102,8 +102,8 @@ test('evaluateUpgrade: all enabled modules satisfied → ok', () => {
   const v = mod.evaluateUpgrade({
     core: '1.0.0',
     rows: [
-      { key: 'a', coreVersion: '^1.0.0', enabled: true, satisfied: true },
-      { key: 'b', coreVersion: '^1.0.0', enabled: false, satisfied: true },
+      { key: 'a', version: '1.0.0', coreVersion: '^1.0.0', enabled: true, satisfied: true },
+      { key: 'b', version: '1.0.0', coreVersion: '^1.0.0', enabled: false, satisfied: true },
     ],
   });
   assert.equal(v.ok, true);
@@ -114,8 +114,8 @@ test('evaluateUpgrade: an ENABLED mismatch refuses; a DISABLED mismatch only war
   const v = mod.evaluateUpgrade({
     core: '1.0.0',
     rows: [
-      { key: 'future', coreVersion: '^2.0.0', enabled: true, satisfied: false },
-      { key: 'old-wip', coreVersion: '^2.0.0', enabled: false, satisfied: false },
+      { key: 'future', version: '1.0.0', coreVersion: '^2.0.0', enabled: true, satisfied: false },
+      { key: 'old-wip', version: '1.0.0', coreVersion: '^2.0.0', enabled: false, satisfied: false },
     ],
   });
   assert.equal(v.ok, false, 'an enabled mismatch must block (fail-closed)');
@@ -165,7 +165,7 @@ test('cmdUpgrade: exit 0 with no modules, exit 1 when an enabled module is incom
 
   const bad = mod.cmdUpgrade([], {
     ...sink,
-    gather: () => ({ core: '1.0.0', errors: [], rows: [{ key: 'future', coreVersion: '^2.0.0', enabled: true, satisfied: false }] }),
+    gather: () => ({ core: '1.0.0', errors: [], rows: [{ key: 'future', version: '1.0.0', coreVersion: '^2.0.0', enabled: true, satisfied: false }] }),
   });
   assert.equal(bad, 1);
   assert.ok(lines.some((l) => /REFUSING/.test(l)), 'refusal is reported');
@@ -204,7 +204,7 @@ test('checkModulePublishability: fails a module containing denied content (game
   const dir = path.join(root, 'game');
   fs.mkdirSync(path.join(dir, 'public', 'assets'), { recursive: true });
   fs.writeFileSync(path.join(dir, 'module.json'), JSON.stringify({
-    key: 'game', title: 'Game', description: 'x', coreVersion: '^1.0.0', license: 'AGPL-3.0', contributes: {},
+    key: 'game', title: 'Game', description: 'x', version: '1.0.0', coreVersion: '^1.0.0', license: 'AGPL-3.0', contributes: {},
   }, null, 2));
   fs.writeFileSync(path.join(dir, 'public', 'assets', 'reference-map.png'), 'not-a-real-png');
   const r = mod.checkModulePublishability('game', { modulesDir: root });
@@ -427,10 +427,10 @@ test('evaluateUpgrade: sorts self-declared deprecations, and flags the ones the
   const v = mod.evaluateUpgrade({
     core: '1.13.0',
     rows: [
-      { key: 'healthy', coreVersion: '^1.0.0', enabled: true, satisfied: true, maintenance: { status: 'core-maintained' } },
-      { key: 'sunset', coreVersion: '^1.0.0', enabled: false, satisfied: true, maintenance: { status: 'deprecated', successor: 'newer', removeAfter: '1.12.0' } },
-      { key: 'sunset-later', coreVersion: '^1.0.0', enabled: false, satisfied: true, maintenance: { status: 'deprecated', note: 'going', removeAfter: '1.20.0' } },
-      { key: 'nobody', coreVersion: '^1.0.0', enabled: false, satisfied: true, maintenance: { status: 'orphaned', note: 'unowned' } },
+      { key: 'healthy', version: '1.0.0', coreVersion: '^1.0.0', enabled: true, satisfied: true, maintenance: { status: 'core-maintained' } },
+      { key: 'sunset', version: '1.0.0', coreVersion: '^1.0.0', enabled: false, satisfied: true, maintenance: { status: 'deprecated', successor: 'newer', removeAfter: '1.12.0' } },
+      { key: 'sunset-later', version: '1.0.0', coreVersion: '^1.0.0', enabled: false, satisfied: true, maintenance: { status: 'deprecated', note: 'going', removeAfter: '1.20.0' } },
+      { key: 'nobody', version: '1.0.0', coreVersion: '^1.0.0', enabled: false, satisfied: true, maintenance: { status: 'orphaned', note: 'unowned' } },
     ],
   });
   assert.equal(v.ok, true, 'a deprecation is not a compatibility failure — it must not block a bump');
@@ -443,8 +443,8 @@ test('evaluateUpgrade: a module with no maintenance block is reported as undecla
   const v = mod.evaluateUpgrade({
     core: '1.0.0',
     rows: [
-      { key: 'owned', coreVersion: '^1.0.0', enabled: true, satisfied: true, maintenance: { status: 'core-maintained' } },
-      { key: 'orphan-risk', coreVersion: '^1.0.0', enabled: false, satisfied: true },
+      { key: 'owned', version: '1.0.0', coreVersion: '^1.0.0', enabled: true, satisfied: true, maintenance: { status: 'core-maintained' } },
+      { key: 'orphan-risk', version: '1.0.0', coreVersion: '^1.0.0', enabled: false, satisfied: true },
     ],
   });
   assert.deepEqual(v.undeclared.map((r) => r.key), ['orphan-risk']);
@@ -486,7 +486,7 @@ test('cmdUpgrade: a DISABLED incompatible module is reported with its owner, not
       core: '2.0.0',
       errors: [],
       rows: [{
-        key: 'stale-catalog-entry', coreVersion: '^1.0.0', enabled: false, satisfied: false,
+        key: 'stale-catalog-entry', version: '1.0.0', coreVersion: '^1.0.0', enabled: false, satisfied: false,
         maintainer: 'Ada <ada@example.com>', maintenance: { status: 'maintained' },
       }],
     }),
@@ -507,8 +507,8 @@ test('cmdUpgrade: reports an expired deprecation and modules with no declared up
       core: '1.13.0',
       errors: [],
       rows: [
-        { key: 'sunset', coreVersion: '^1.0.0', enabled: false, satisfied: true, maintenance: { status: 'deprecated', successor: 'newer', removeAfter: '1.12.0' } },
-        { key: 'unowned', coreVersion: '^1.0.0', enabled: false, satisfied: true },
+        { key: 'sunset', version: '1.0.0', coreVersion: '^1.0.0', enabled: false, satisfied: true, maintenance: { status: 'deprecated', successor: 'newer', removeAfter: '1.12.0' } },
+        { key: 'unowned', version: '1.0.0', coreVersion: '^1.0.0', enabled: false, satisfied: true },
       ],
     }),
   });

package/tests/module_contributions.mjs

@@ -54,10 +54,10 @@ test('collectContributions: ABSENT → empty; REGISTERED → each invoked with c
   assert.deepEqual(await seams.collectContributions('profile.fields', { builderId: 7 }), []);
   // registered — both function-contributors get the ctx and return their slice
   const seen = [];
-  seams.contribute('profile.fields', (ctx) => { seen.push(ctx.builderId); return { box: { x: 1 } }; });
+  seams.contribute('profile.fields', (ctx) => { seen.push(ctx.builderId); return { gallery: { x: 1 } }; });
   seams.contribute('profile.fields', async (ctx) => { seen.push(ctx.builderId); return { discord: { linked: true } }; });
   const out = await seams.collectContributions('profile.fields', { builderId: 7 });
-  assert.deepEqual(out, [{ box: { x: 1 } }, { discord: { linked: true } }]);
+  assert.deepEqual(out, [{ gallery: { x: 1 } }, { discord: { linked: true } }]);
   assert.deepEqual(seen, [7, 7]);
   seams._reset();
 });
@@ -86,13 +86,13 @@ test('collectContributions: a non-function contribution is returned as-is', asyn
 test('mergeContributions: adds new keys, refuses to overwrite a core key', () => {
   const base = { builder: { id: 1 }, discord: { linked: false } };
   const { base: merged, collisions } = seams.mergeContributions(base, [
-    { box: { connected: true } },         // new key → added
+    { gallery: { connected: true } },     // new key → added
     { discord: { linked: true } },        // collides with a core key → ignored
     null,                                 // ignored
     { art: { keySet: false } },           // new key → added
   ]);
   assert.equal(merged, base); // mutates + returns the same object
-  assert.deepEqual(merged.box, { connected: true });
+  assert.deepEqual(merged.gallery, { connected: true });
   assert.deepEqual(merged.art, { keySet: false });
   assert.deepEqual(merged.discord, { linked: false }); // core value preserved
   assert.deepEqual(collisions, ['discord']);
@@ -139,9 +139,9 @@ test('settings-panel seam: ABSENT → empty; REGISTERED → present, sorted by o
   assert.deepEqual(OTB.settingsPanels(), []);
   // registered — registration order is by `order`, not insertion order
   OTB.contributeSettingsPanel({ id: 'discord', title: 'Connections', order: 30, mount() {} });
-  OTB.contributeSettingsPanel({ id: 'dev-box', title: 'Dev box', order: 10, mount() {} });
+  OTB.contributeSettingsPanel({ id: 'art', title: 'Art keys', order: 10, mount() {} });
   const ids = OTB.settingsPanels().map((p) => p.id);
-  assert.deepEqual(ids, ['dev-box', 'discord']);
+  assert.deepEqual(ids, ['art', 'discord']);
   // a panel without id or mount() is rejected loudly
   assert.throws(() => OTB.contributeSettingsPanel({ title: 'no id' }), /requires id \+ mount/);
   assert.throws(() => OTB.contributeSettingsPanel({ id: 'x' }), /requires id \+ mount/);

package/tests/module_loader.mjs

@@ -33,17 +33,17 @@ function fixtureRoot(spec) {
 }
 
 const validManifest = (key, extra = {}) => ({
-  key, title: key, description: 'd', coreVersion: '^1.0.0', contributes: {}, ...extra,
+  key, title: key, description: 'd', version: '1.0.0', coreVersion: '^1.0.0', contributes: {}, ...extra,
 });
 
 test('discoverModules: loads a valid module, ignores a dir without module.json', () => {
   const root = fixtureRoot({
-    'dev-box': { manifest: validManifest('dev-box', { contributes: { routes: ['box'] } }) },
+    'art-pipeline': { manifest: validManifest('art-pipeline', { contributes: { routes: ['stage'] } }) },
     'not-a-module': { files: { 'readme.txt': 'hi' } },
   });
   const { loaded, errors, skipped } = loader.discoverModules({ roots: [root], core: '1.0.0' });
   assert.equal(loaded.length, 1);
-  assert.equal(loaded[0].key, 'dev-box');
+  assert.equal(loaded[0].key, 'art-pipeline');
   assert.deepEqual(errors, []);
   assert.deepEqual(skipped, []);
 });
@@ -71,7 +71,7 @@ test('discoverModules: key must match the directory name', () => {
 });
 
 test('discoverModules: a coreVersion mismatch is SKIPPED (not loaded, not an error)', () => {
-  const root = fixtureRoot({ future: { manifest: validManifest('future', { coreVersion: '^2.0.0' }) } });
+  const root = fixtureRoot({ future: { manifest: validManifest('future', { version: '1.0.0', coreVersion: '^2.0.0' }) } });
   const { loaded, skipped, errors } = loader.discoverModules({ roots: [root], core: '1.0.0' });
   assert.equal(loaded.length, 0);
   assert.equal(errors.length, 0);
@@ -226,7 +226,7 @@ test('task 1003820: mountModuleRoutes refuses two enabled providers of one port'
 });
 
 test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49/R72)', () => {
-  // dev-box graduated first (modules/dev-box/, BV1.R43), art-pipeline next
+  // the first module graduated in BV1.R43 (since retired), art-pipeline next
   // (BV1.R48 / task 1417), discord next (BV1.R47 / task 1416), game next
   // (BV1.R49 / c9cb5ea1 — public/ + src/world|rooms → modules/game/), then the
   // declaration-only character-anim module (ADR 0088 / task 1558), then memory —
@@ -276,7 +276,7 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'dev-box', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'npm-release', 'onboarding', 'platform-identity', 'provisioning', 'public-landing', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
+  assert.deepEqual(snap.loaded, ['agents', 'autonomy', 'builder-settings', 'copy-desk', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'npm-release', 'onboarding', 'platform-identity', 'provisioning', 'public-landing', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();

package/tests/module_manifest.mjs

@@ -15,7 +15,7 @@ const baseManifest = () => ({
   key: 'dev-box',
   title: 'Dev boxes',
   description: 'Per-builder cloud dev environments.',
-  coreVersion: '^1.0.0',
+  version: '1.0.0', coreVersion: '^1.0.0',
   contributes: { routes: ['box'], pollers: ['box-lifecycle'], uiSections: ['boxes'] },
 });
 
@@ -62,7 +62,7 @@ test('isValidRange', () => {
 // --- manifest validation ---
 
 test('a minimal valid manifest passes', () => {
-  const r = validateManifest({ key: 'x', title: 'X', description: 'd', coreVersion: '^1.0.0', contributes: {} });
+  const r = validateManifest({ key: 'x', title: 'X', description: 'd', version: '1.0.0', coreVersion: '^1.0.0', contributes: {} });
   assert.equal(r.valid, true, r.errors.join('; '));
 });
 
@@ -81,7 +81,7 @@ test('a full valid manifest passes (provides/consumes/prerequisites/migrations)'
 });
 
 test('missing required fields each produce an error', () => {
-  for (const field of ['key', 'title', 'description', 'coreVersion']) {
+  for (const field of ['key', 'title', 'description', 'version', 'coreVersion']) {
     const m = baseManifest();
     delete m[field];
     const r = validateManifest(m);
@@ -97,11 +97,20 @@ test('bad key format is rejected', () => {
 });
 
 test('invalid coreVersion range is rejected', () => {
-  const r = validateManifest({ ...baseManifest(), coreVersion: 'whenever' });
+  const r = validateManifest({ ...baseManifest(), version: '1.0.0', coreVersion: 'whenever' });
   assert.equal(r.valid, false);
   assert.ok(r.errors.some((e) => e.startsWith('coreVersion')));
 });
 
+test('version must be an exact X.Y.Z — a range or junk is rejected (task 1003781)', () => {
+  for (const bad of ['^1.0.0', '1.0', 'v1.0.0', '1.0.0-beta', '']) {
+    const r = validateManifest({ ...baseManifest(), version: bad });
+    assert.equal(r.valid, false, `"${bad}" should be rejected`);
+    assert.ok(r.errors.some((e) => e.startsWith('version')));
+  }
+  assert.equal(validateManifest({ ...baseManifest(), version: '2.10.3' }).valid, true);
+});
+
 test('unknown contributes key is rejected (typo guard)', () => {
   const r = validateManifest({ ...baseManifest(), contributes: { routs: ['box'] } });
   assert.equal(r.valid, false);