@bongos/core 1.19.1073 → 1.19.1074

package/src/bongos/routes/me.js

@@ -74,15 +74,6 @@ function boundShipDaysToYear(rows, todayStr) {
     return o != null && o >= cutoff && o <= todayOrd;
   });
 }
-// The dev-box "has this builder ever connected a box?" signal, read through the
-// kernel seam instead of a direct `require('../boxes')` (a forbidden core→module
-// edge once dev-box moved to modules/dev-box/, ADR 0083 / BV1.R43). The dev-box
-// module provides the `box.hasEverConnected` port when enabled; resolveOptional
-// degrades to false on a box-less instance, so onboarding's box_connect step
-// simply never auto-clears there. Resolved per call (the provider registers at
-// boot, before any request).
-const boxHasEverConnected = (builderId) =>
-  seams.resolveOptional('box.hasEverConnected', async () => false)(builderId);
 // The art-pipeline "is the shared newcomer key configured?" signal, read through
 // the kernel seam (ADR 0083 / BV1.R48). The art-pipeline module provides
 // 'art.sharedKeyConfigured' when enabled; resolveOptional degrades to false on a
@@ -192,7 +183,7 @@ module.exports = function buildMeRouter() {
     const specialities = seams.resolveOptional('specialities');
     const [
       builder, activeClaims, estVsActual, unlocked, lockedWithProgress, streakInfo,
-      recentGrades, builderAvg, onboardingRow, shipCount, recentKarma, karma30d, discordLink, boxConnected, cliAuthed,
+      recentGrades, builderAvg, onboardingRow, shipCount, recentKarma, karma30d, discordLink, cliAuthed,
       behaviorPrefs, geminiKeyRow, needsRebaseTasks, foundingBuilder, helpRequestCount,
       taskRecommendationCount, boardVotesPending, socialMode, mingleIntroductionCount,
       navPermissions,
@@ -227,14 +218,8 @@ module.exports = function buildMeRouter() {
       // follow-up call. Boolean only — the discord_user_id itself is never sent
       // to the client (it's PII the UI has no need for).
       discordIsLinked(req.builder.id),
-      // #823: whether the builder's dev box has ever reported a live Claude
-      // process (first_connected_at). Auto-clears the onboarding 'box_connect'
-      // step — the monotonic "properly connected to the dev box" signal.
-      boxHasEverConnected(req.builder.id),
-      // #777: whether the builder has ever authenticated the GDS CLI (ran
-      // /builder-setup, or the box-connect bootstrap). Auto-clears the
-      // onboarding 'cli_setup' step — distinct from box_connect (#823: both
-      // steps have a place — connecting vs. signing the GDS in).
+      // #777: whether the builder has ever authenticated the CLI (ran
+      // /builder-setup). Auto-clears the onboarding 'cli_setup' step.
       db.hasCliSession(req.builder.id),
       // task 1268: the builder's behavior_prefs blob (the 'wandering' + 'render'
       // knobs), resolved against builder.rank below so /me carries the effective
@@ -431,7 +416,7 @@ module.exports = function buildMeRouter() {
       // returns a stage-1 "nothing cleared" view so the client renders the
       // checklist either way. Through the `onboarding` port (BV1.R81); null when
       // the module is off.
-      onboarding: onboarding ? onboarding.shapeForApi(onboardingRow, { shipCount, discordLinked: !!discordLink, boxConnected: !!boxConnected, cliAuthed: !!cliAuthed }) : null,
+      onboarding: onboarding ? onboarding.shapeForApi(onboardingRow, { shipCount, discordLinked: !!discordLink, cliAuthed: !!cliAuthed }) : null,
       // F7 (ADR 0033): Discord link state for the hall's Connect/Unlink UI.
       // `configured` tells the client whether the server even has Discord OAuth
       // creds — when false the hall renders nothing (the start route 503s).
@@ -570,14 +555,13 @@ module.exports = function buildMeRouter() {
       }
       // Echo the onboarding state back so the hall's path checklist can tick
       // this step off without a follow-up /me round-trip.
-      const [state, shipCount, discordLink, boxConnected, cliAuthed] = await Promise.all([
+      const [state, shipCount, discordLink, cliAuthed] = await Promise.all([
         onboardingPort ? onboardingPort.getState(pool, req.builder.id) : null,
         lc().countShippedTasksForBuilder(req.builder.id),
         discordIsLinked(req.builder.id),
-        boxHasEverConnected(req.builder.id),
         db.hasCliSession(req.builder.id),
       ]);
-      const onboarding = onboardingPort ? onboardingPort.shapeForApi(state, { shipCount, discordLinked: !!discordLink, boxConnected: !!boxConnected, cliAuthed: !!cliAuthed }) : null;
+      const onboarding = onboardingPort ? onboardingPort.shapeForApi(state, { shipCount, discordLinked: !!discordLink, cliAuthed: !!cliAuthed }) : null;
       res.json({ builder, onboarding });
     } catch (err) {
       if (err.code === 'invalid_discipline') {

package/src/bongos/routes/modules.js

@@ -17,6 +17,12 @@
 //                               authoritative check — `bongos module submit`
 //                               is a thin CLI client of this same route).
 //   GET  /modules/submissions  list queued submissions (task 1771 reads this).
+//   POST /store/modules/:key/versions
+//                               publish one module version to the Bongos-hosted
+//                               module store (task 1004271, ADR 0338 D1) — the
+//                               server end of `bongos module publish`. Not the
+//                               upstreaming door above: submit proposes a module
+//                               INTO core; publish puts a version in the store.
 //
 // Read is open to any signed-in builder (same gate as the atlas/primer pages);
 // every write (enable/disable, submit) is metic+archon, same rank as
@@ -58,6 +64,9 @@ const modulesLib = require('../../modules');
 // server process.
 const moduleCli = require('../../../scripts/gds/module');
 const moduleSubmissions = require('../module-submissions');
+const moduleArtifact = require('../../../scripts/gds/module-artifact');
+const { stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion } = require('../module-store');
+const { KEY_RE } = require('../../module-loader/manifest-schema');
 // Named imports, not a namespace object (task 1004052 strand walk): knip cannot follow
 // property access on a CommonJS namespace, so reaching these through one made them read
 // as unused exports and tripped the dead-code ratchet that held this branch out of main.
@@ -70,6 +79,21 @@ const { listOverrides, setOverride } = require('../module-overrides');
 // cap (SECURITY_DOC_CONTENT_MAX) in routes/security.js.
 const SUBMISSION_MAX_BYTES = 5_000_000;
 
+// A published version's body is the tarball itself, never JSON (the global parser
+// only reads application/json, so it passes this through). Capped at the parser and
+// never inflated from a Content-Encoding, so the cap is the bytes on the wire.
+const TARBALL_BODY_TYPES = ['application/gzip', 'application/x-gzip', 'application/octet-stream'];
+const rawTarball = express.raw({ type: TARBALL_BODY_TYPES, limit: moduleArtifact.MAX_TARBALL_BYTES, inflate: false });
+function tarballBody(req, res, next) {
+  rawTarball(req, res, (err) => {
+    if (!err) return next();
+    if (err.type === 'entity.too.large') {
+      return res.fail('artifact_too_large', { status: 413, message: `The tarball is over the ${moduleArtifact.MAX_TARBALL_BYTES}-byte store cap.` });
+    }
+    return res.fail('bad_tarball', { status: 400, message: 'The upload could not be read.' });
+  });
+}
+
 function ownProjectName() {
   try { return require('../../branding').branding().identity.productName; } catch { return null; }
 }
@@ -264,6 +288,65 @@ module.exports = function buildModulesRouter() {
       res.json({ submissions });
     }));
 
+  // POST /api/bongos/store/modules/:key/versions — publish one module version to
+  // the store (task 1004271, ADR 0338 D1). Body: the gzip tarball
+  // `bongos module publish` builds (scripts/gds/module-artifact.js), sent as
+  // application/gzip. The route trusts nothing but the bytes: it recomputes every
+  // hash, re-runs the publish denylist and validates module.json itself
+  // (verifyModuleArtifact), then keeps the tarball on the control plane's disk and
+  // INSERTs the version row in one transaction (module-store.js). A key's first
+  // publish makes the caller its author; after that only the author may publish,
+  // a delisted key takes nothing new, and a version is published once and never
+  // changed.
+  //
+  // rank: metic+archon — it puts code in a shared store other instances install
+  // from. Gate: requirePermission('module.submit') — the atom that already guards
+  // filing a module into a shared queue; a dedicated `module.publish` atom is a
+  // follow-up once who-may-sell is decided.
+  router.post('/store/modules/:key/versions', auth.requireBuilder, auth.requirePermission('module.submit'), tarballBody,
+    asyncHandler('POST /store/modules/:key/versions', async (req, res) => {
+      const { key } = req.params;
+      if (!KEY_RE.test(key)) {
+        return res.fail('bad_module_key', { status: 400, message: 'A module key is lowercase kebab-case.' });
+      }
+      const tgz = Buffer.isBuffer(req.body) ? req.body : null;
+      // The audit log serializes req.body; a tarball there would be megabytes of
+      // byte array. Leave it a one-line marker instead.
+      req.body = { tarball_bytes: tgz ? tgz.length : 0 };
+      if (!tgz || !tgz.length) {
+        return res.fail('empty_artifact', { status: 400, message: 'Send the tarball as the body, Content-Type: application/gzip.' });
+      }
+
+      const v = await moduleArtifact.verifyModuleArtifact(tgz, { key });
+      if (!v.ok) {
+        return res.fail(v.code, { status: v.code === 'artifact_too_large' ? 413 : 422, message: v.message });
+      }
+
+      const staged = await stageArtifact(tgz, { key, version: v.version });
+      let result;
+      try {
+        result = await publishVersion({
+          key,
+          title: v.moduleJson.title,
+          description: v.moduleJson.description,
+          version: v.version,
+          coreVersion: v.coreVersion,
+          manifest: v.manifest,
+          treeSha256: v.treeSha256,
+          tarballSha256: v.tarballSha256,
+          bytes: v.bytes,
+          artifactPath: relativeArtifactPath(staged.final),
+          builderId: req.builder.id,
+        }, { beforeCommit: () => commitArtifact(staged) });
+      } finally {
+        await removeArtifact(staged.tmp);
+      }
+      if (!result.ok) return res.fail(result.code, { status: result.status, message: result.message });
+
+      console.log(`[gds] module "${key}" ${v.version} published to the store by builder ${req.builder.id}`);
+      res.status(201).json({ ok: true, created_module: result.created, version: result.version });
+    }));
+
   return router;
 };
 

package/src/bongos/routes.js

@@ -96,6 +96,11 @@ function buildGdsRouter() {
       // encoded (4 MB decoded). Same dynamic-:id pattern as publish-branch above;
       // modules/lifecycle/routes/task-visuals.js mounts its own 8 MB parser.
       /^\/tasks\/\d+\/visual$/.test(req.path) ||
+      // task 1004358: the named-slot sibling (TW11 — the eight page-tweak renders).
+      // Same 8 MB parser in modules/lifecycle/routes/visuals.js; a full-page render
+      // is ~90-130 KB, so without this every attach 413'd here first. The route
+      // validates the slot name itself, so the pattern only needs to be one segment.
+      /^\/tasks\/\d+\/visuals\/[^/]+$/.test(req.path) ||
       // task 1003850: the grade body carries committed_files — EVERY changed path, tens of
       // KB on its own for a mass change — plus the panel's findings. A 1,141-file rename
       // (task 1003705) produced a body over the 64 KB cap, so the grade could not be

package/src/module-api.js

@@ -71,10 +71,14 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1073'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+// The body behind a retired doorway export that must stay callable until the next
+// MAJOR (see allowBoxScope below): passes the request through untouched.
+function deprecatedNoopMiddleware(_req, _res, next) { next(); }
+
+const CORE_VERSION = '1.19.1074'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
-// Usage: const log = api.logger('dev-box'); log.info('mounted');
+// Usage: const log = api.logger('discord'); log.info('mounted');
 // task 1003208 (goal 1000079): this USED TO BE `console.log(tag, ...a)`. Every
 // module that had "adopted the logger" was therefore still writing unstructured
 // text to stdout with no request correlation and no redaction — the criterion's
@@ -131,10 +135,13 @@ module.exports = {
   get requirePermission() { return require('./bongos/auth').requirePermission; },
   get rankMeetsThreshold() { return require('./bongos/auth').rankMeetsThreshold; },
   get requireBfgPrincipal() { return require('./bongos/auth').requireBfgPrincipal; },
-  // allowBoxScope — opt a route in to box-scoped (dev-box bootstrap) session
-  //     tokens. A module's own bootstrap routes flag themselves; everything else
-  //     stays closed to box tokens (the ADR 0016 trust boundary).
-  get allowBoxScope() { return require('./bongos/auth').allowBoxScope; },
+  // allowBoxScope — DEPRECATED no-op, kept so the doorway loses no export inside
+  //     1.x (removing one is a MAJOR, and every module declares ^1). It used to opt
+  //     a route in to the narrowing box-scoped session; that scope and its tokens
+  //     were retired (task 1003894), so an undeclared session source is now denied
+  //     on every route whatever a route mounts. Passing it changes nothing. Drop it
+  //     at the next MAJOR.
+  get allowBoxScope() { return deprecatedNoopMiddleware; },
   // resolveSession(req) — resolve the request to a live session row (or null)
   //     WITHOUT the 401-or-pass behaviour of requireBuilder. A module route that
   //     must make its own auth decision — e.g. a browser page that REDIRECTS to

package/src/module-loader/catalog.js

@@ -125,6 +125,9 @@ function buildCatalog({
         provenance: deriveProvenance(manifest.origin, ownProjectName),
         enabled: enabled[key] === true,
         default: manifest.default === true,
+        // The module's own version (task 1003781) — null only for a manifest
+        // that predates the field (the validator now requires it).
+        version: manifest.version || null,
         coreVersion: manifest.coreVersion || null,
         contributes: manifest.contributes || {},
         // DECLARED — exactly what module.json says (null when it says nothing).

package/src/module-loader/loader.js

@@ -7,7 +7,7 @@
 // routes.js mounts discovered module routers behind the kernel's auth/audit.
 //
 // SAFE-BY-CONSTRUCTION during the strangler migration: with no modules/ dir
-// (the state until BV1.R43 moves dev-box), discovery returns EMPTY and every
+// (the state before BV1.R43 moved the first module), discovery returns EMPTY and every
 // function below is a no-op — OTB behaves byte-identically. As built-ins move
 // out, they become discovered manifests and the closed registry shrinks.
 //
@@ -173,7 +173,7 @@ function verifyEnabledPorts(enabled) {
 }
 
 // Mount each discovered + ENABLED module's route factories onto `router`. A
-// module declares contributes.routes:["box"] → factory at modules/<key>/routes/box.js
+// module declares contributes.routes:["copy-desk"] → factory at modules/<key>/routes/copy-desk.js
 // exporting a function returning an express Router. Auth model: audit is composed
 // at the kernel level in routes.js before this is called; each route self-gates at
 // its required rank via api.requireBuilder / api.requireRank (public read routes
@@ -309,8 +309,8 @@ function startModulePollers(deps = {}, { isEnabled } = {}, opts) {
         poller = require(pollerPath);
       } catch (e) {
         // No modules/<key>/pollers/<pk>.js → a DECLARATIVE-ONLY / non-web poller
-        // (e.g. dev-box's box-lifecycle sweep runs on the control plane, not in
-        // this process). Skip silently — only a web-process poller ships a file
+        // (e.g. a sweep that runs on the control plane, not in this process).
+        // Skip silently — only a web-process poller ships a file
         // here. A file that EXISTS but throws is a real error (the catch below).
         if (e && e.code === 'MODULE_NOT_FOUND' && String(e.message).includes(pollerPath)) continue;
         console.error(`[module-loader] poller ${key}/${pk} failed to load: ${e && e.message ? e.message : e}`);

package/src/module-loader/manifest-schema.js

@@ -9,9 +9,11 @@
 //
 // THE SCHEMA (module.json):
 //   {
-//     "key":          "dev-box",        // REQUIRED. ^[a-z][a-z0-9-]*$ ; must match the module's dir name.
+//     "key":          "art-pipeline",   // REQUIRED. ^[a-z][a-z0-9-]*$ ; must match the module's dir name.
 //     "title":        "Dev boxes",      // REQUIRED. Human label.
 //     "description":  "…",              // REQUIRED. One sentence.
+//     "version":      "1.4.2",          // REQUIRED. The module's OWN exact version "X.Y.Z" (task 1003781) —
+//                                       //   what update, rollout channels and re-assessment name.
 //     "coreVersion":  "^1.0.0",         // REQUIRED. semver range of src/module-api.js CORE_VERSION it supports.
 //     "default":      false,            // OPTIONAL (default false). Enablement fail-safe when no config names it.
 //     "author":       "…",              // OPTIONAL. Attribution (ADR 0107 §2) — portable, not a cross-GDS FK.
@@ -28,12 +30,12 @@
 //                                       //   nobody does. `maintained` needs a named `maintainer`;
 //                                       //   `deprecated`/`orphaned` need a `successor` or a `note`.
 //     "contributes": {                  // REQUIRED object (may be empty). What the module mounts:
-//       "routes":      ["box"],         //   route-factory keys (mounted behind kernel-composed auth)
+//       "routes":      ["stage"],       //   route-factory keys (mounted behind kernel-composed auth)
 //       "rooms":       ["WorldRoom"],   //   Colyseus room classes (realtime seam)
-//       "pollers":     ["box-lifecycle"],// background pollers to start/stop
+//       "pollers":     ["nightly-sweep"],// background pollers to start/stop
 //       "disciplines": ["artist"],      //   disciplines this module adds
 //       "skills":      ["otb-…"],       //   slash-command skills it ships
-//       "uiSections":  ["boxes"],       //   hall/status UI sections it owns
+//       "uiSections":  ["gallery"],     //   hall/status UI sections it owns
 //       "webSurfaces": [{ "host": "status.", "dir": "public" }], // static web surfaces. Each names a Host
 //                                       //   PREFIX (BV1.R84) or, as { "apexRoot": true, "dir": "public" },
 //                                       //   the APEX ROOT — never both (ADR 0218).
@@ -46,7 +48,7 @@
 //                                       //   refuses the enablement when the join door is `open` and no
 //                                       //   payer is configured.
 //     "declarativeSeams": {             // OPTIONAL. Per-entry exemptions for the seam-wiring
-//       "pollers": ["box-lifecycle"]    //   guard (task 1003819): "this contributes entry ships no
+//       "pollers": ["nightly-sweep"]    //   guard (task 1003819): "this contributes entry ships no
 //     },                                //   artifact ON PURPOSE". Every key must be a key the module
 //                                       //   actually declares in `contributes`, and every entry must be
 //                                       //   one it actually lists there — a typo'd exemption is an error,
@@ -162,6 +164,12 @@ function validateManifest(obj) {
   if (!isStr(obj.title)) E('title: required non-empty string');
   if (!isStr(obj.description)) E('description: required non-empty string');
 
+  // The module's own version (task 1003781) — EXACT, unlike coreVersion's range:
+  // it names one published build, so update parity, rollout channels and
+  // re-assessment on publish (ADR 0338/0344) all have something to point at.
+  if (!isStr(obj.version)) E('version: required exact semver string "X.Y.Z" — the module\'s own version, e.g. "1.0.0"');
+  else if (!parseVersion(obj.version)) E(`version: "${obj.version}" must be an exact version "X.Y.Z" (not a range)`);
+
   if (!isStr(obj.coreVersion)) E('coreVersion: required non-empty semver range string (e.g. "^1.0.0")');
   else if (!isValidRange(obj.coreVersion)) E(`coreVersion: "${obj.coreVersion}" is not a valid semver range`);
 
@@ -239,8 +247,8 @@ function validateManifest(obj) {
   // --- optional declarativeSeams (task 1003819) ---
   // The exemption list for the seam-wiring guard: "this contributes entry ships no
   // artifact on purpose". Some declarations are legitimately declarative-only —
-  // dev-box's `box-lifecycle` poller runs on the control plane, not in this process,
-  // and its `boxes` uiSection ships no hall widget — so the guard needs a way to say
+  // a poller that runs on the control plane, not in this process, or a uiSection
+  // that ships no hall widget — so the guard needs a way to say
   // so without a blanket skip that would hide the real cases it exists to catch.
   //
   // Validated HERE, against `contributes`, because this is the one place that holds

package/src/module-seams.js

@@ -179,9 +179,8 @@ function listEvents() {
 // fire-and-forget reaction; a CONTRIBUTION accumulates — zero-or-more modules
 // each add a piece to a named extension point, and the kernel hands the whole
 // set back to a core consumer that renders them together. This is how a module
-// adds its own slice to a core surface without core hardcoding it: dev-box adds
-// box fields + a box settings panel, discord adds its link state, art adds its
-// key surface — each `contribute()`s; core merges. The strangler prerequisite
+// adds its own slice to a core surface without core hardcoding it: discord adds
+// its link state, art adds its key surface — each `contribute()`s; core merges. The strangler prerequisite
 // that lets those modules leave core (the surfaces in src/bongos/routes/me.js +
 // modules/hall-ui/public/settings.js stop being hardcoded). With no module enabled the
 // registry is empty and every consumer renders exactly what it does today.

package/src/modules.js

@@ -18,8 +18,8 @@
 //
 // This is a config-flag exclusion mechanism, NOT a full plugin registry — the
 // cheaper near-term shape (ADR 0062 §4). R59 (task 1198) moves game + art-pipeline
-// in; R60 (task 1199) moves discord + dev-box in (UI sections / skills / pollers);
-// they consume the registry declared here.
+// in; R60 (task 1199) moves discord in (UI sections / skills / pollers); they
+// consume the registry declared here.
 
 const fs = require('node:fs');
 const path = require('node:path');
@@ -45,9 +45,9 @@ const INSTANCE_PATH = path.join(resolveInstanceRoot(), 'config', 'modules.json')
 // CORE (always on, never a module): auth, builders, tasks, claims, versions,
 // done-when, credits/cost, inbox, blockers, leaderboard, analytics,
 // audit-log, security, access-requests, sessions, gate-approvals, healthz,
-// public. These mount unconditionally. The four optional feature modules AND the
-// first TWO carved CORE-domain modules have graduated to modules/<key>/ (dev-box
-// BV1.R43, discord BV1.R47, art-pipeline BV1.R48, game BV1.R49, memory BV1.R72 —
+// public. These mount unconditionally. The optional feature modules AND the
+// first TWO carved CORE-domain modules have graduated to modules/<key>/ (discord
+// BV1.R47, art-pipeline BV1.R48, game BV1.R49, memory BV1.R72 —
 // memory/recall/search/learnings, ADR 0091 §2 — and grading BV1.R73 — the
 // adversarial grade panel + rubric, behind the `grade` kernel port, ADR 0091 §4).
 // A core-domain module like memory or grading is `default: true` (it ships to
@@ -166,6 +166,27 @@ function spendRefusals(resolved, registry, { joinDoorOpen = false, payer = null
 // something they explicitly asked for, so it has to say what to do about it.
 // `log` is injectable for the same reason instance-config's legacy-env warning
 // injects it: a test asserts the warning fired, not only that the value resolved.
+// RETIRED MODULE KEYS (goal 1000120, task 1003892). A module deleted from the core
+// outright, which an instance's committed config/modules.json — written while the
+// module still shipped — may still switch ON. fromConfig below throws on enabling
+// an unknown module (the task-1824 typo guard), so without this a core upgrade
+// would become a boot failure on every instance that ever enabled one:
+// cloudbongos.com's own config still said `"dev-box": true` when the module went.
+// A retired key is DROPPED with a one-line warning instead of thrown on. Keep the
+// list short and say why each key left — an entry is a promise about someone
+// else's config file, not a way to silence a typo.
+const RETIRED_MODULE_KEYS = Object.freeze({
+  'dev-box': 'cloud dev boxes were removed from the core (goal 1000120)',
+});
+
+function warnRetiredModule(key, source, log = console) {
+  log.warn(
+    `[bongos] module "${key}" is switched on in the ${source} config, but it was retired: `
+    + `${RETIRED_MODULE_KEYS[key]}. It is ignored — remove the key from that config to `
+    + 'silence this line.',
+  );
+}
+
 function warnSpendRefusal(key, envPrefix, log = console) {
   log.warn(
     `[bongos] module "${key}" is enabled in config but was REFUSED: it spends money on behalf of `
@@ -185,7 +206,7 @@ function resolveModules({
   // caller that does not know about spend resolves exactly as before; loadModules
   // is the one that reads the real posture, and the one that fails closed when it
   // cannot.
-  spendGuard = NO_SPEND_RISK, warn = warnSpendRefusal,
+  spendGuard = NO_SPEND_RISK, warn = warnSpendRefusal, warnRetired = warnRetiredModule,
   // THE DB OVERRIDE LAYER (task 1002857) — a { <moduleKey>: boolean } snapshot of
   // module_enablement_overrides for this scope, injected rather than read, so this
   // resolver stays pure and synchronous. Defaulted to {} so every existing caller
@@ -207,13 +228,19 @@ function resolveModules({
     for (const [k, v] of Object.entries(m)) {
       if (known.includes(k)) { out[k] = v; continue; }
       // Unknown key. A config may name a module this build hasn't installed: a stripped
-      // CORE has no game/art-pipeline/discord/dev-box, yet config/modules.neutral.json
-      // (which ships WITH the core) names them so the SAME file is valid in the full repo
-      // too. Tolerate an unknown module ONLY when it is DISABLED — a disabled-and-absent
-      // module is a no-op. ENABLING an absent module is a real error (the feature you asked
-      // for isn't here) and still throws, which also keeps the typo guard for the dangerous
-      // direction. (task 1824: this is what lets the vanilla core boot instead of crashing
-      // on `unknown module "game"`.)
+      // CORE has no game/art-pipeline/discord, yet config/modules.neutral.json (which
+      // ships WITH the core) names them so the SAME file is valid in the full repo too.
+      // Tolerate an unknown module ONLY when it is DISABLED — a disabled-and-absent
+      // module is a no-op. ENABLING an absent module is a real error (the feature you
+      // asked for isn't here) and still throws, which also keeps the typo guard for the
+      // dangerous direction. (task 1824: this is what lets the vanilla core boot instead
+      // of crashing on `unknown module "game"`.) The one exception is a RETIRED key
+      // (RETIRED_MODULE_KEYS above): it can never be installed again, so enabling it is
+      // a stale config line, not a request — warn and drop it.
+      if (coerceBool(v) === true && Object.prototype.hasOwnProperty.call(RETIRED_MODULE_KEYS, k)) {
+        warnRetired(k, source);
+        continue;
+      }
       if (coerceBool(v) === true) {
         throw new Error(`modules: cannot enable unknown module "${k}" in ${source} config — it is not installed (known: ${known.join(', ') || '(none)'}).`);
       }
@@ -257,7 +284,7 @@ function resolveModules({
   const merged = Object.assign({}, ...layers.map(([, m]) => m));
 
   // Env overrides: <PREFIX>_MODULE_<KEY> where KEY is upper-snake of the module
-  // name (dev-box -> DEV_BOX). Highest precedence.
+  // name (art-pipeline -> ART_PIPELINE). Highest precedence.
   for (const key of known) {
     const suffix = `MODULE_${key.toUpperCase().replace(/-/g, '_')}`;
     const envName = `${envPrefix}_${suffix}`;
@@ -489,6 +516,7 @@ module.exports = {
   metersSpend,
   spendRefusals,
   warnSpendRefusal,
+  RETIRED_MODULE_KEYS,
   resolveModules,
   resolveInstancePackPath,
   moduleScopeKey,

package/tests/agents_spend_guard.mjs

@@ -122,7 +122,7 @@ test('spendRefusals never names a module that was already off', () => {
 });
 
 test('the manifest declaration is a CLOSED key set — a typo must not read as "no spend"', () => {
-  const base = { key: 'x', title: 't', description: 'd', coreVersion: '^1.0.0', contributes: {} };
+  const base = { key: 'x', title: 't', description: 'd', version: '1.0.0', coreVersion: '^1.0.0', contributes: {} };
   assert.equal(validateManifest({ ...base, spend: { requiresPayer: true } }).valid, true);
   assert.equal(validateManifest({ ...base, spend: { requirespayer: true } }).valid, false,
     'a misspelled key silently declaring NO spend is the direction that costs money');

package/tests/api_client.mjs

@@ -128,21 +128,6 @@ test('every method the README example names actually exists on the client', () =
   assert.ok(count >= 3, 'README example should exercise several methods');
 });
 
-test('devbox vendored client is byte-identical to the canonical CJS build (run devbox-app vendor if stale)', () => {
-  // The devbox Electron app can't require() clients/ at runtime (packaged
-  // separately, ADR 0045), so scripts/vendor-client.js copies index.cjs into
-  // devbox-app/src/vendor/. Guard that the vendored copy never drifts from the
-  // canonical build — CI catches a forgotten `npm run vendor` after a spec change.
-  // devbox-app/ is instance content the neutral core does not carry (task 1002470).
-  // Absent APP => nothing to vendor into; absent VENDORED FILE inside a present app
-  // is the real "forgot to run vendor" drift this guards, and still fails.
-  if (!fs.existsSync(path.join(ROOT, 'devbox-app'))) return;
-  const vendored = path.join(ROOT, 'devbox-app/src/vendor/bongos-client.cjs');
-  if (!fs.existsSync(vendored)) throw new assert.AssertionError({ message: 'devbox-app/src/vendor/bongos-client.cjs missing — run `npm run vendor` in devbox-app/' });
-  const canonical = fs.readFileSync(path.join(ROOT, 'clients/bongos-client/index.cjs'), 'utf8');
-  assert.equal(fs.readFileSync(vendored, 'utf8'), canonical, 'devbox vendored client is STALE — run `npm run vendor` in devbox-app/');
-});
-
 test('baseUrl:"" is honored (absolute-path passthrough for the hall fetch wrappers)', async () => {
   const rec = {};
   const api = createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false, fetch: fakeFetch(rec, { ok: true, status: 200, body: { x: 1 } }) });

package/tests/auth_page_gate.mjs

@@ -99,18 +99,18 @@ await t('session lookup error → fails CLOSED (redirect, next() NOT called)', a
     'must redirect to sign-in on a lookup error (fail closed)');
 });
 
-// ---- SESSION-SCOPE on the page path (task 1003197 (A)) ----------------------
+// ---- SESSION SOURCE on the page path (task 1003197 (A)) ---------------------
 //
 // resolveSession accepts a Bearer token with no source filter, so before this the
-// page gate never asked the question requireBuilder asks: is a page inside this
-// SESSION's scope at all? A box-baked token (which lives on the box, outside the
-// ADR 0016 trust boundary) could therefore fetch a gated page SHELL whenever its
-// builder's rank held the page permission. The stub above resolves the permission
-// for EVERY builder, which is what makes these assertions about scope alone.
+// page gate never asked the question requireBuilder asks: does the session-source
+// registry declare this session's source at all? Without it, a token of an
+// undeclared source could fetch a gated page SHELL whenever its builder's rank held
+// the page permission. The stub above resolves the permission for EVERY builder,
+// which is what makes these assertions about the source alone.
 
 console.log('\nrequireBuilderPage — session scope:');
 
-await t('box-scoped session → 302 to sign-in even though its builder holds the permission', async () => {
+await t('a leftover dev-box session (source box, now undeclared) → 302 to sign-in even though its builder holds the permission', async () => {
   nextSession = { builder_id: 3, github_login: 'boxbot', rank: 'archon', status: 'active', source: 'box' };
   lookupThrows = false;
   const req = { headers: { authorization: 'Bearer boxtoken' } }; // a page route declares no scope
@@ -145,9 +145,9 @@ await t('cli and web sessions are untouched by the scope check', async () => {
 });
 
 await t('a legacy session with no source field still reaches the page', async () => {
-  // The same invariant tests/box_scope_session.mjs pins for requireBuilder: absent
-  // source resolves to the UNSCOPED scope, so this gate can never lock out a real
-  // browser session minted before `source` was recorded.
+  // The same invariant tests/government_session_scope.mjs pins for requireBuilder:
+  // an absent source is the declared legacy row, so this gate can never lock out a
+  // real browser session minted before `source` was recorded.
   nextSession = { builder_id: 2, github_login: 'legacy', rank: 'metic', status: 'active' };
   const req = { headers: { cookie: 'gds_session=validtoken' } };
   const res = fakeRes();

package/tests/canonical_profile_url.mjs

@@ -288,8 +288,6 @@ const BUILDER = {
   anthropic_user_id: 'SENTINEL-anthropic-user',
   monthly_budget_usd: 999,
   system_role: 'SENTINEL-system-role',
-  box_blocked: true,
-  box_blocked_reason: 'SENTINEL-box-blocked',
   deactivated_reason: 'SENTINEL-deactivated',
 };
 
@@ -380,7 +378,7 @@ test('widening the response did not widen the leak: no private column appears an
   // The raw serialized text, not the parsed keys — a private value smuggled
   // under a different key still fails.
   assert.doesNotMatch(r.text, /SENTINEL-/, 'a private builder column reached the public profile body');
-  assert.doesNotMatch(r.text, /monthly_budget_usd|anthropic_|system_role|box_blocked|deactivated_reason/);
+  assert.doesNotMatch(r.text, /monthly_budget_usd|anthropic_|system_role|deactivated_reason/);
   assert.deepEqual(Object.keys(r.data.builder).sort(), [
     'avatar_url', 'created_at', 'display_name', 'github_login', 'id', 'karma',
     'preferred_disciplines', 'rank', 'total_credits',

package/tests/claim_action.mjs

@@ -242,7 +242,10 @@ await test('NOBODY posts to /claims except through the shared action', () => {
   // own claim POST, this fails — which is what "a new claim surface needs no new
   // refusal handling" has to mean in practice.
   const offenders = [];
-  for (const f of ['work.js', 'goals-page.js', 'goals-render.js', 'task.js']) {
+  // task 1003459 added two more claim surfaces (task.js's Claim it button,
+  // builders.js/hall-render.js's Home Next-up row) — both belong in this scan
+  // or a future hand-rolled POST on either trips nothing.
+  for (const f of ['work.js', 'goals-page.js', 'goals-render.js', 'task.js', 'builders.js', 'hall-render.js']) {
     const src = read('modules', 'hall-ui', 'public', f);
     if (/postJSON\(\s*`\$\{API\}\/claims/.test(src)) offenders.push(f);
   }