@bongos/core 1.19.1073 → 1.19.1074

package/src/bongos/db.js

@@ -26,10 +26,9 @@
 
 const { pool } = require('./pool');
 const secretBox = require('./secret-box');
-// Module seam (ADR 0083 / BV1.R43). The rank/status-change paths EMIT
-// `builder.box-reconcile-needed` AFTER COMMIT (best-effort) so the dev-box module
-// can reconcile a droplet a demotion/graduation implies — never a direct require
-// of the module.
+// Module seam (ADR 0083). The builder-exit path EMITS `builder.secrets-scrub-needed`
+// AFTER COMMIT (best-effort) so a module that stores a builder-keyed secret can
+// clear its own store — never a direct require of the module.
 const seams = require('../module-seams');
 
 // Kernel db slice (BV1.R69 / ADR 0091 §2): builder IDENTITY (getBuilderById),
@@ -123,11 +122,6 @@ async function linkAnthropicAccount(builderId, { email, userId }) {
 // setBuilderMonthlyBudget() carved into modules/economy/cost.js (BV1.R77 / ADR
 // 0093 §1-2). routes/builders.js resolves it via the `reward` kernel port.
 
-// setBuilderBoxBlocked + its box_blocked UPDATE RELOCATED to modules/dev-box/db.js
-// (BV1.R68 / ADR 0091 §3): box-blocked is cleanly dev-box-owned — the module is
-// its only writer AND reader (core never reads box_blocked) — so the query left
-// the core monolith with the doorway re-export when the slice pattern landed.
-
 // Approval-gated entry (2026-05-30). The web hall sign-in no longer auto-creates
 // an account for any GitHub user — a first-time visitor must be approved first
 // (an Archon marks their access_request 'invited'). These three small lookups
@@ -446,14 +440,6 @@ async function setBuilderRank({ builderId, newRank, actorBuilderId }) {
   const result = await withTx(async (client) => {
     return _applyRankChangeTx(client, { builderId, newRank, actorBuilderId, enforceSingleRungPromotion: true });
   });
-  // Source-access clawback (ADR 0031 §6 / #600). Post-commit, own connection,
-  // never throws — records the box reconcile this rank change implies (a demotion
-  // below the floor → deprovision; a graduation up → rescope). The CREDENTIAL
-  // layer is already cut off live on the next /box/source-access fetch; this
-  // just signals + audits the slower droplet-level reconcile.
-  await seams.emitAsync('builder.box-reconcile-needed', {
-    builderId, rank: newRank, status: result.status, actor: `rank-change:builder#${actorBuilderId}`,
-  });
   return {
     builder: result.builder,
     previous_rank: result.previous_rank,
@@ -613,20 +599,11 @@ async function deactivateBuilder({ builderId, reason, actorBuilderId }) {
     await deleteGithubToken({ builderId, p: client });
     return { updated, activeClaims };
   });
-  // Source-access clawback (ADR 0031 §6 / #600): a deactivated builder loses
-  // their box → loses source. Post-commit, own connection, never throws. The
-  // builder is now status='inactive' (rank forced to xenos above), so the
-  // reconcile resolves to 'deprovision'. Their next /box/source-access fetch is
-  // already 403'd (inactive) — this signals the droplet teardown for `box.js
-  // reconcile` / the dormant sweep.
-  await seams.emitAsync('builder.box-reconcile-needed', {
-    builderId, rank: 'xenos', status: 'inactive', actor: `builder-exit:builder#${actorBuilderId}`,
-  });
   // PRIVACY (task 1003338 / ADR 0332): teardown port for a MODULE-owned
   // builder-keyed secret (today: art-pipeline's Gemini BYOK key,
   // gemini_key_enc/last4/set_at — CRUD moved out of core under ADR 0102, so
-  // core does not touch those columns directly). Best-effort, same as
-  // box-reconcile-needed above: a module that stores such a secret listens
+  // core does not touch those columns directly). Best-effort, post-commit:
+  // a module that stores such a secret listens
   // for this event and clears its own store; on a vanilla instance (no
   // listener registered) it is a no-op.
   await seams.emitAsync('builder.secrets-scrub-needed', {

package/src/bongos/module-scope-map.js

@@ -20,7 +20,7 @@
 // regex, so wildcards would never match. Every PROTECTED_GLOBS entry is likewise
 // an exact path or dir-prefix, so the overlap is exact.
 //
-// FIRST CUT, auto-tightening. We are mid-strangler (ADR 0083): only dev-box has
+// FIRST CUT, auto-tightening. We are mid-strangler (ADR 0083): some domains have
 // moved into modules/<key>/; the rest still live fused in src/bongos/. So a module's
 // globs list WHERE ITS CODE LIVES TODAY plus its modules/<key>/ home, and the
 // `protected` result reflects the current tree (most core domains are protected
@@ -30,7 +30,7 @@
 // modules + kernel from docs/design/modular-architecture/02-module-map.md §6.
 //
 // RELATION to src/modules.js: that registry tracks only the OPTIONAL feature
-// modules (game/art-pipeline/discord/dev-box) an instance toggles. This map is a
+// modules (game/art-pipeline/discord) an instance toggles. This map is a
 // SUPERSET — every module including the always-on core domains — because the goal
 // scope wall must place ALL work, not just the optional features.
 
@@ -316,7 +316,7 @@ const MODULE_GLOBS = {
   //     (files-are-source — the committed definitions ARE the input agents-sync
   //     upserts), listed alongside it on the autonomy precedent, which likewise
   //     owns its '.claude/scheduled-tasks/' definition dir. The sync CLI travels
-  //     with the domain but stays under scripts/gds/ (the dev-box/provisioning
+  //     with the domain but stays under scripts/gds/ (the provisioning
   //     precedent). Without this key the three Agents goals (1000038/39/40) could
   //     declare no wall at all (task 1002736).
   agents: [
@@ -342,7 +342,7 @@ const MODULE_GLOBS = {
   'npm-release': ['modules/npm-release/', 'tests/npm_release_*.mjs'],
   // --- instance provisioning: the web-tier REQUEST + STATE surface (module home)
   //     plus the control-plane runner CLI — a command travels with its domain (the
-  //     lifecycle/dev-box precedent). Covers the projects-surface work (goal
+  //     lifecycle precedent). Covers the projects-surface work (goal
   //     1000059); previously NO key resolved these paths, so no goal could wall
   //     them (task 1002690). ---
   provisioning: [
@@ -355,32 +355,17 @@ const MODULE_GLOBS = {
     // core/CLI-side under scripts/discord/.
     'scripts/discord/', 'modules/discord/',
   ],
-  // --- per-builder cloud dev boxes (DO droplets + Cloudflare tunnels), the sandbox
-  //     preview, server-mediated branch publish. First module carved to modules/dev-box/
-  //     (BV1.R43 — ADR 0083). Like the lifecycle/onboarding CLIs, the dev-box OPERATOR +
-  //     connect commands travel with the domain but stay under scripts/gds/: box.js (the
-  //     DO/CF provisioning control plane), box-auth-check, box-connect-lib, and the box
-  //     smoke test. Listing them here so a `dev-box`-scoped goal's wall covers the box
-  //     provisioning / bring-up work (BV1.R91, goal 1000051 C2), not just modules/dev-box/.
-  //     The box BRING-UP scripts (infra/box-*.sh — box-source-fetch, heartbeat, terminal
-  //     units) are INSTANCE-VENDORED (ADR 0144; not tracked in core), so they are not
-  //     listed here yet — they come under this key when de-vendored. (ADR 0150 /
-  //     task 1002386 made box.js RESOLVE infra/ from the instance root and fail
-  //     loudly when it is missing; de-vendoring infra/ into core is still open.)
-  'dev-box': [
-    'modules/dev-box/', 'devbox-app/',
-    'scripts/gds/box.js', 'scripts/gds/box-auth-check.js', 'scripts/gds/box-connect-lib.js',
-    'scripts/gds/smoke-box.sh',
-    'scripts/gds/box-sync.js', // task 1004024: split out of box.js, now protected
-  
-    // ADOPTED (task 1004111): the box BRING-UP surface. box.js (already here)
-    // orchestrates these five provisioning CLIs, and infra/ is the shell-script
-    // tree it resolves from the instance root — the comment above has described
-    // infra/ as dev-box's since task 1002386 without the glob saying so.
+  // --- the operator CONTROL PLANE: the provisioning CLIs that hold the DigitalOcean /
+  //     Cloudflare credentials, and an instance's host topology under infra/. Not a
+  //     module (nothing under modules/ carries it) — a scope like kernel or devsecops.
+  //     Its own key rather than provisioning's, deliberately: every path here is a
+  //     PROTECTED surface, so listing them under provisioning would make that module
+  //     derive protected:true and put its open goals (1000106) behind an Archon join —
+  //     the effect tests/government_protected_surfaces.mjs pins against. Given this key
+  //     by task 1003892 (their previous owner was retired).
+  'control-plane': [
     'scripts/gds/provision-config.js',
     'scripts/gds/provision-net.js',
-    'scripts/gds/box-infra.js',
-    'scripts/gds/cf-tunnel.js',
     'scripts/gds/do-api.js',
     'infra/',
   ],
@@ -709,7 +694,7 @@ function scopeIncludesProtected(keys) {
 //
 // WHAT THIS IS AND IS NOT FOR. This narrows ONE consumer: the ship-time module-
 // drift advisory (moduleDriftFiles below), whose question is "you said game, did
-// you touch dev-box?" — module-to-module confusion. It does NOT touch the goal
+// you touch discord?" — module-to-module confusion. It does NOT touch the goal
 // scope wall, claim collisions (touchesOverlap), or the protected-path wall.
 // Those keep counting methodology's territory as methodology's.
 //

package/src/bongos/module-store.js

@@ -0,0 +1,141 @@
+// src/bongos/module-store.js — the module store's write side: keep a published
+// module version's tarball and record it in the registry (task 1004271, ADR 0338 D1).
+//
+// The route (POST /store/modules/:key/versions in routes/modules.js) verifies the
+// upload with scripts/gds/module-artifact.js first; this file only persists what has
+// already passed. Two halves, in this order:
+//
+//   1. stageArtifact — write the tarball under the store dir (a temp name first;
+//      commitArtifact moves it into place inside step 2's transaction). ADR 0338 lets the
+//      store keep tarballs on the control plane's disk while volume is small, so it
+//      does: <MODULE_STORE_DIR or var/module-store>/<key>/<key>-<version>.tgz. Outside
+//      the git tree, like var/task-visuals, so a deploy's `git reset --hard` never
+//      wipes it.
+//   2. publishVersion — one transaction over the registry tables (core_257): create
+//      the store_modules row on a key's first publish (the publisher becomes its
+//      author), refuse anyone else's key, refuse a delisted key (ADR 0338 D2: delisting
+//      stops what comes next), refuse a version that already exists or is not newer
+//      than the latest, then INSERT the version row. Rows are only ever INSERTed.
+//
+// If step 2 refuses, the route removes the temp file step 1 wrote, so a refused
+// publish leaves nothing behind.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { parseVersion, cmp } = require('../module-loader/semver');
+const { KEY_RE } = require('../module-loader/manifest-schema');
+
+
+function storeDir() {
+  return process.env.MODULE_STORE_DIR || path.join(__dirname, '..', '..', 'var', 'module-store');
+}
+
+// Where one version's tarball lives. Key and version are re-validated here so this
+// is the path-traversal defense on its own, whatever the caller checked.
+function artifactPath(key, version, { dir = storeDir() } = {}) {
+  if (!KEY_RE.test(String(key)) || !parseVersion(String(version))) {
+    throw new Error('artifactPath: a bad module key or version');
+  }
+  return path.join(dir, key, `${key}-${version}.tgz`);
+}
+
+// Write the tarball to a private temp name beside its final place and return both
+// paths. It becomes the real file only through commitArtifact, which publishVersion
+// runs just before COMMIT — so a crash anywhere leaves at most a temp file (or a
+// final file with no row, which the next publish of that version simply replaces),
+// never a row pointing at nothing and never a stray file that blocks a retry.
+// Async throughout so a multi-MB write never holds the web process's event loop.
+async function stageArtifact(buf, { key, version, dir = storeDir() } = {}) {
+  const final = artifactPath(key, version, { dir });
+  await fs.promises.mkdir(path.dirname(final), { recursive: true });
+  const tmp = `${final}.${process.pid}.${Date.now()}.${crypto.randomBytes(4).toString('hex')}.partial`;
+  await fs.promises.writeFile(tmp, buf, { flag: 'wx', mode: 0o640 });
+  return { tmp, final };
+}
+
+async function commitArtifact({ tmp, final }) {
+  await fs.promises.rename(tmp, final);
+}
+
+async function removeArtifact(file) {
+  try { await fs.promises.unlink(file); } catch { /* already gone — nothing to undo */ }
+}
+
+// The store keeps artifact_path relative to the store dir, so moving the dir (or
+// moving to object storage later) is a config change, not a data migration.
+function relativeArtifactPath(file, { dir = storeDir() } = {}) {
+  return path.relative(dir, file).split(path.sep).join('/');
+}
+
+// One transaction. `db` is a pg Pool (anything with connect()). Returns
+// { ok: true, version: row, created: bool } or { ok: false, code, message, status }.
+async function publishVersion(input, { db, beforeCommit } = {}) {
+  const {
+    key, title, description, version, coreVersion, manifest,
+    treeSha256, tarballSha256, bytes, artifactPath: relPath, builderId,
+  } = input;
+  const pool = db || require('./pool').pool;
+  const client = await pool.connect();
+  const refuse = async (status, code, message) => {
+    await client.query('ROLLBACK');
+    return { ok: false, status, code, message };
+  };
+  try {
+    await client.query('BEGIN');
+    const { rows: [mod] } = await client.query(
+      'SELECT module_key, author_id, status FROM store_modules WHERE module_key = $1 FOR UPDATE', [key]);
+    let created = false;
+    if (!mod) {
+      await client.query(
+        'INSERT INTO store_modules (module_key, title, description, author_id) VALUES ($1, $2, $3, $4)',
+        [key, title, description || '', builderId]);
+      created = true;
+    } else {
+      if (String(mod.author_id) !== String(builderId)) {
+        return refuse(403, 'not_module_author', `"${key}" belongs to another author — only its author can publish new versions`);
+      }
+      if (mod.status === 'delisted') {
+        return refuse(409, 'module_delisted', `"${key}" is delisted — it takes no new versions (ADR 0338 D2)`);
+      }
+    }
+
+    // Every version of the key, compared in JS: semver order is numeric per part, so
+    // a text ORDER BY would rank 1.10.0 below 1.9.0. A module's version count is small.
+    const { rows: existing } = await client.query(
+      'SELECT version FROM store_module_versions WHERE module_key = $1', [key]);
+    const wanted = parseVersion(version);
+    if (existing.some((r) => r.version === version)) {
+      return refuse(409, 'version_exists', `${key} ${version} is already published — a version never changes; bump module.json's version`);
+    }
+    const newest = existing.map((r) => parseVersion(r.version)).filter(Boolean).sort(cmp).pop();
+    if (newest && cmp(wanted, newest) <= 0) {
+      return refuse(409, 'version_not_newer', `${key} ${version} is not newer than the latest published ${newest.join('.')}`);
+    }
+
+    const { rows: [row] } = await client.query(
+      `INSERT INTO store_module_versions
+         (module_key, version, core_version, manifest, tree_sha256, tarball_sha256,
+          tarball_bytes, artifact_path, published_by)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+       RETURNING id, module_key, version, core_version, tree_sha256, tarball_sha256,
+                 tarball_bytes, published_by, published_at`,
+      [key, version, coreVersion, manifest, treeSha256, tarballSha256, bytes, relPath, builderId]);
+    // Put the tarball in place while the row is still uncommitted: if this throws,
+    // the catch below rolls the row back, so the two can never disagree.
+    if (beforeCommit) await beforeCommit();
+    await client.query('COMMIT');
+    return { ok: true, created, version: row };
+  } catch (e) {
+    try { await client.query('ROLLBACK'); } catch { /* the connection may be gone */ }
+    // Two publishes of the same version racing past the check: the UNIQUE wins.
+    if (e && e.code === '23505') return { ok: false, status: 409, code: 'version_exists', message: `${key} ${version} is already published` };
+    throw e;
+  } finally {
+    client.release();
+  }
+}
+
+module.exports = {
+  stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
+};

package/src/bongos/route-rank-check.js

@@ -221,9 +221,7 @@ const EXPECTED_RANKS = {
   //  criterion confirmation, and gate-approvals — moved to MODULE_EXPECTED_RANKS
   //  ['lifecycle'] below in BV1.R86. They live in the lifecycle module now
   //  (modules/lifecycle/routes/…), so they're verified only when that module is in
-  //  scope, not unconditionally from this core list — the pins follow the routes,
-  //  the dev-box precedent.)
-  // (dev-box fleet pins likewise live in MODULE_EXPECTED_RANKS below — BV1.R43.)
+  //  scope, not unconditionally from this core list — the pins follow the routes.)
   // security engagement docs — exploit-detail report store (task 991). Pinned
   // because a silent downgrade here leaks the attacker cookbook below the
   // trust line. (security-the-PROPERTY stays kernel — routes/security.js.)
@@ -277,10 +275,8 @@ const GOVERNMENT_PINS = {
 // when that module is in scope (its routes were discovered in this scan). So an
 // instance that doesn't ship the module — or a hermetic test isolating a
 // different module — never trips a false "vanished" alarm, while a real rank
-// downgrade or a removal IS still caught wherever the module is present. (dev-box's
-// box-fleet routes moved here from EXPECTED_RANKS in BV1.R43 / task 1412 — the pins
-// follow the routes; the intent is unchanged: closing/blocking another builder's
-// paid infra, and reading the fleet/cost roster, stay archon-only.)
+// downgrade or a removal IS still caught wherever the module is present — the pins
+// follow the routes (BV1.R43 / task 1412 moved the first set here).
 //
 // The `ideas` / `memory` / `security` blocks were added in BV1.R109b: their routes are
 // declared multi-line and so were invisible to this auditor until it learned that form
@@ -293,15 +289,6 @@ const GOVERNMENT_PINS = {
 // (metic), `security.report.adjudicate` / `idea.ratify` / `memory.read.any` (archon) —
 // so tightening these to `perm:` pins is a clean follow-up once R104-R107 have landed.
 const MODULE_EXPECTED_RANKS = {
-  'dev-box': {
-    // ADR 0157 lowered `box.fleet.manage` archon→metic (operating paid infra is admin
-    // work, not an authority grant). Re-pinned by ATOM so the guarded invariant is
-    // "these gate on the fleet permission", independent of its floor.
-    'GET /boxes': 'perm:box.fleet.manage',
-    'GET /boxes/cost-ledger': 'perm:box.fleet.manage',
-    'POST /boxes/:builderId/close': 'perm:box.fleet.manage',
-    'PATCH /boxes/:builderId/block': 'perm:box.fleet.manage',
-  },
   // The lifecycle module's privileged routes (carved BV1.R86 — the pins follow the
   // routes from EXPECTED_RANKS). Verified only when the lifecycle module is in scope.
   lifecycle: {

package/src/bongos/routes/auth.js

@@ -13,7 +13,6 @@
 //   - /auth/discord/*     LINKING an existing builder to a Discord id for role sync.
 //                         It is NOT a way to sign in — Discord sits OUTSIDE the trust
 //                         boundary (ADR 0032), so it can never mint a session.
-//   - /auth/app-pair/*    the Dev Box desktop app pairing to its builder (ADR 0045).
 //
 // TWO INVARIANTS worth keeping in view before editing:
 //   - `/auth/cli-token/issue` mints a CLI bearer from a browser COOKIE, never from a
@@ -36,7 +35,6 @@ const { reportActivityRollupForShippedTask } = require('../auth-admission.js');
 // endpoint refuses. Same composed answer the gate itself reads.
 const { effectiveJoinDoor } = require('../project-door.js');
 const db = require('../db');
-const { pairStore } = require('../app-pair');
 const { publicOrigin, parseCookie, validateOrRespond } = require('./_helpers');
 const { accountExistenceReadRateLimit } = require('../middleware/rate-limit');
 const { branding } = require('../../branding');
@@ -1162,120 +1160,6 @@ module.exports = function buildAuthRouter() {
     }
   });
 
-  // /auth/app-pair — browser-clicks-only sign-in for the Dev Box desktop app
-  // (#904, ADR 0045). The app starts a pairing, opens the browser at
-  // /builders/pair?code=…, the signed-in builder clicks ONE Approve button,
-  // and the app collects a freshly-minted source='cli' session over its own
-  // secret poll channel. Design + threat model in src/bongos/app-pair.js.
-  //
-  // Route order note: the two PUBLIC routes here sit so no requireBuilder/
-  // requireRank from a NEIGHBORING declaration falls inside route-rank-check's
-  // 20-line look-ahead — the deterministic auditor must classify them from
-  // their own `rank:` annotations, not a false middleware hit.
-
-  // rank: public — starts a pairing; returns opaque codes only, no identity.
-  router.post('/auth/app-pair/start', (req, res) => {
-    if (validateOrRespond(req, res, {
-      device_name: { type: 'string', maxLength: 80 },
-      platform: { type: 'string', maxLength: 20 },
-    })) return;
-    const body = req.body || {};
-    const out = pairStore.start({ deviceName: body.device_name, platform: body.platform });
-    if (out.error === 'busy') {
-      return res.fail('pairing_busy', { status: 429, message: 'Too many pairings in flight. Try again in a few minutes.' });
-    }
-    // The approve-page URL is PINNED to the canonical public origin (same
-    // posture as the OAuth redirect_uris above) — never derived from the
-    // request host, so a spoofed Host header can't point the app's browser
-    // hand-off at a look-alike approve page.
-    const verifyPath = `/builders/pair?code=${out.pairCode}`;
-    res.status(201).json({
-      pair_code: out.pairCode,
-      poll_token: out.pollToken,
-      verify_path: verifyPath,
-      verify_url: `${WEB_REDIRECT_ORIGIN}${verifyPath}`,
-      expires_in: out.expiresIn,
-      interval: out.interval,
-    });
-  });
-
-  // rank: any-builder — read-only: what the approve page shows BEFORE the
-  // click (device name/platform for the given code). Unknown and expired are
-  // indistinguishable (404) so the code space can't be probed for liveness.
-  router.get('/auth/app-pair/info', auth.requireBuilder, (req, res) => {
-    const info = pairStore.info(req.query.code);
-    if (!info) return res.fail('unknown_or_expired', 404);
-    res.json({
-      pair_code: info.pairCode,
-      device_name: info.deviceName,
-      platform: info.platform,
-      status: info.status,
-    });
-  });
-
-  // rank: any-builder (own identity only) — approving signs the app in AS THE
-  // APPROVER. Cookie-gated exactly like /auth/cli-token/issue above: a leaked
-  // CLI bearer must not be able to approve pairings and mint itself siblings;
-  // only the httpOnly browser cookie — the click in the hall — can.
-  router.post('/auth/app-pair/approve', auth.requireBuilder, async (req, res) => {
-    const cookieToken = sessionCookieToken(req);
-    if (!cookieToken) {
-      return res.fail('cookie_required', { status: 403, message: 'Pairings are approved from an authenticated browser session in the builders’ hall, not from a bearer token.' });
-    }
-    if (validateOrRespond(req, res, {
-      pair_code: { required: true, type: 'string', maxLength: 32 },
-    })) return;
-    try {
-      const token = crypto.randomBytes(32).toString('hex');
-      const row = await db.createSession({
-        builderId: req.builder.id,
-        token,
-        source: 'cli', // 003_pms.sql CHECK; the app is a CLI-class bearer client
-        userAgent: `devbox-app pair (${req.headers['user-agent'] ?? 'unknown'})`,
-        expiresAt: null, // no expiry — a CLI bearer lasts until revoked (ADR 0294)
-      });
-      const out = pairStore.approve((req.body || {}).pair_code, {
-        token,
-        expires_at: row.expires_at,
-        builder: {
-          id: req.builder.id,
-          github_login: req.builder.github_login,
-          display_name: req.builder.display_name,
-          rank: req.builder.rank,
-        },
-      });
-      if (!out.ok) {
-        // The pairing was gone or already approved — revoke the session we
-        // just minted so an orphaned token never outlives this branch.
-        await db.revokeSession(token);
-        return out.error === 'already_approved'
-          ? res.fail('already_approved', 409)
-          : res.fail('unknown_or_expired', 404);
-      }
-      res.json({ ok: true });
-    } catch (err) {
-      log.error('[gds] POST /auth/app-pair/approve', err);
-      res.fail('approve_failed', { status: 500, message: 'internal error' });
-    }
-  });
-
-  // rank: public — poll with the secret poll_token; the token IS the bearer
-  // (mirrors /auth/device/poll, where the device_code is the bearer). Kept
-  // LAST in this router so route-rank-check's look-ahead window stays clear
-  // of any neighboring gated declaration (see the block comment above).
-  router.post('/auth/app-pair/poll', (req, res) => {
-    if (validateOrRespond(req, res, {
-      poll_token: { required: true, type: 'string', maxLength: 128 },
-    })) return;
-    const out = pairStore.poll((req.body || {}).poll_token);
-    if (out.status === 'approved') {
-      return res.json({ status: 'approved', ...out.grant });
-    }
-    res.json(out.status === 'pending'
-      ? { status: 'pending', interval: out.interval }
-      : { status: 'expired' });
-  });
-
   return router;
 };
 

package/src/bongos/routes/builders.js

@@ -82,14 +82,6 @@ function staleHoursFor(req, res) {
 // kernel PORT (lc()). The rank/identity mutations (setBuilderRank/deactivate/
 // reactivate) stay core db (this domain is builder identity, not the lifecycle).
 const lc = () => seams.resolveOptional('lifecycle');
-// Dev-box "has this builder ever connected a box?" read through the kernel seam
-// instead of a direct `require('../boxes')` (a forbidden core→module edge once
-// dev-box moved to modules/dev-box/, ADR 0083 / BV1.R43). The dev-box module
-// provides the `box.hasEverConnected` port when enabled; degrades to false on a
-// box-less instance (the box_connect onboarding step just never auto-clears).
-const boxHasEverConnected = (builderId) =>
-  seams.resolveOptional('box.hasEverConnected', async () => false)(builderId);
-
 // The discord "has this builder linked their Discord account?" signal, read
 // through the kernel seam instead of a direct `db.getDiscordLink` (a forbidden
 // core→module edge once discord moved to modules/discord/, ADR 0083 / BV1.R47).
@@ -470,22 +462,20 @@ module.exports = function buildBuildersRouter() {
       // never a direct require of a module. Default-on (present in prod); degrades
       // to a null state row (shapeForApi synthesizes the "nothing cleared" view).
       const onboarding = seams.resolveOptional('onboarding');
-      const [state, shipCount, discordLink, boxConnected, cliAuthed] = await Promise.all([
+      const [state, shipCount, discordLink, cliAuthed] = await Promise.all([
         onboarding ? onboarding.getState(pool, targetId) : null,
         lc().countShippedTasksForBuilder(targetId),
         discordIsLinked(targetId),
-        boxHasEverConnected(targetId),
         db.hasCliSession(targetId),
       ]);
       // shipCount drives the terminal 'ship_three' stage's "N of 3" counter.
-      // The box/discord/cli steps clear from LIVE signals (not the onboarding_state
+      // The discord/cli steps clear from LIVE signals (not the onboarding_state
       // row), so they must be passed in exactly as GET /me does — otherwise they
-      // default to false and this route renders box_connect/join_discord/cli_setup
+      // default to false and this route renders join_discord/cli_setup
       // perpetually unchecked even after the builder cleared them (task 1444).
       const shaped = onboarding ? onboarding.shapeForApi(state, {
         shipCount,
         discordLinked: !!discordLink,
-        boxConnected: !!boxConnected,
         cliAuthed: !!cliAuthed,
       }) : null;
       // Light cache — onboarding state changes a few times per builder, ever.
@@ -510,7 +500,7 @@ module.exports = function buildBuildersRouter() {
   // shareable without a sign-in wall (that IS the feature). It deliberately
   // WHITELISTS the public column subset off the full builder row — the private
   // columns getBuilderById also returns (anthropic_email / anthropic_user_id /
-  // monthly_budget_usd / system_role / box_blocked*) are NEVER spread into the
+  // monthly_budget_usd / system_role) are NEVER spread into the
   // JSON. A leak-prevention unit test (tests/profile_route.mjs) asserts their
   // absence + the 404-on-unknown-id behaviour.
   // THROTTLED since task 1002804. The global limiter meters WRITES only
@@ -554,7 +544,7 @@ module.exports = function buildBuildersRouter() {
       ]);
       // WHITELIST — only the leaderboard-equivalent public field set. Never spread
       // the raw row: it carries anthropic_email / anthropic_user_id /
-      // monthly_budget_usd / system_role / box_blocked* / deactivated_reason,
+      // monthly_budget_usd / system_role / deactivated_reason,
       // none of which are public.
       const builder = {
         id: b.id,

package/src/bongos/routes/instance.js

@@ -9,14 +9,12 @@
 //   * modules + disciplines  — the R54 feature-module flags
 //   * rank ladder            — the canonical live tiers + the instance's labels
 //   * repo binding           — the GitHub owner/repo for `--local` clones
-//   * auth methods           — how a stranger signs in (device-flow / web / app-pair)
+//   * auth methods           — how a stranger signs in (device-flow / web)
 //   * admission policy        — invite-only vs open self-enrollment
-//   * dev-box availability    — whether the managed cloud-box backend is on
 //
 // WHY THIS EXISTS: GET /healthz returns only { ok, auth_configured } — too thin
-// for a CLI to brand + feature-gate itself (e.g. hide the `box` verb on an
-// instance that runs no dev-box module). This is the richer public descriptor
-// that gap calls for.
+// for a CLI to brand + feature-gate itself against an instance's modules. This is
+// the richer public descriptor that gap calls for.
 //
 // SECURITY (no secrets / no topology): the manifest is assembled ONLY from
 // already-client-safe projections — clientBranding() (the documented allow-list
@@ -35,7 +33,7 @@
 const express = require('express');
 const { corsPublicGet, asyncHandler } = require('./_helpers');
 const { clientBranding } = require('../../branding');
-const { clientModules, isModuleEnabled } = require('../../modules');
+const { clientModules } = require('../../modules');
 const { loadRepoInfo } = require('../repo-info');
 const { authConfigured, openEnrollmentEnabled, loadIdpConfig, resolveSession } = require('../auth');
 const { RANK_TIER } = require('../permission-path-check');
@@ -49,15 +47,14 @@ const MANIFEST_SCHEMA = 'instance-manifest/v1';
 
 // Supported sign-in methods. All require GitHub auth to be configured (the
 // server holds the OAuth client creds): device-flow = the CLI Device Flow;
-// web = the browsers' hall sign-in (completeWebFlow); app-pair = the Dev Box
-// desktop app's browser-clicks-only pairing (/auth/app-pair/*). All three mount
-// unconditionally in routes/auth.js, so configured-ness is the only gate.
-const AUTH_METHODS = ['device-flow', 'web', 'app-pair'];
+// web = the browsers' hall sign-in (completeWebFlow). Both mount unconditionally
+// in routes/auth.js, so configured-ness is the only gate.
+const AUTH_METHODS = ['device-flow', 'web'];
 
 // buildInstanceManifest — PURE assembler. Every input is injected so this is
 // unit-testable without disk, DB, or git. Inputs are the CLIENT-SAFE projections
 // (branding = clientBranding() output, modules = clientModules() output), the
-// canonical rank-tier map, loadRepoInfo()'s result, and three booleans. Returns
+// canonical rank-tier map, loadRepoInfo()'s result, and two booleans. Returns
 // the JSON body verbatim.
 function buildInstanceManifest({
   branding,
@@ -66,7 +63,6 @@ function buildInstanceManifest({
   repo,
   authConfigured: authOk,
   openEnrollment,
-  devBoxEnabled,
   idp = null,
 } = {}) {
   const b = branding || {};
@@ -109,7 +105,6 @@ function buildInstanceManifest({
       idp: idp || null,
     },
     admission: { policy: openEnrollment ? 'open' : 'invite-only' },
-    devBox: { available: !!devBoxEnabled },
   };
 }
 
@@ -144,7 +139,6 @@ function currentManifest() {
     // what the gate will do — and 'invite-only' already covers every non-open
     // door, so narrowing it names no state (ADR 0247 D3).
     openEnrollment: openEnrollmentEnabled(),
-    devBoxEnabled: isModuleEnabled('dev-box'),
     // Project OUT the client secret — the manifest is public; only origin +
     // client_id (both public) advertise federation.
     idp: idpCfg ? { origin: idpCfg.origin, client_id: idpCfg.clientId } : null,