@bongos/core 1.19.1073 → 1.19.1075

package/modules/lifecycle/github-push.js

@@ -1,18 +1,16 @@
 // GDS server-mediated branch publish (ADR 0055 / task 1025).
 //
 // WHY THIS EXISTS
-// A builder on a cloud dev box cannot publish in `ci` deploy mode: the box has
-// NO GitHub push credential by design (credential-less HTTPS origin, no gh, no
-// GH_TOKEN — infra/builder-box-cloud-init.yaml scrubs the clone token), and its
-// baked GDS session is box-scoped (deny-by-default, #919/ADR 0053). CI self-
+// A checkout with NO GitHub push credential by design (credential-less HTTPS
+// origin, no gh, no GH_TOKEN) cannot publish in `ci` deploy mode. CI self-
 // deploy (#859/ADR 0042) fixed only the LAST leg (Actions deploys main->prod);
-// the box still can't get its branch onto GitHub to open the PR.
+// such a checkout still can't get its branch onto GitHub to open the PR.
 //
-// THE FIX (owner-chosen: "the box holds nothing"). The box uploads its branch as
-// a THIN git bundle to the GDS over a RE-AUTHED (non-box) cli session; the server
+// THE FIX (owner-chosen: "the checkout holds nothing"). The checkout uploads its
+// branch as a THIN git bundle to the GDS over a RE-AUTHED cli session; the server
 // pushes the branch to GitHub + opens the PR + enables auto-merge using a SERVER-
-// side push credential. The box never holds a GitHub push credential, so the #919
-// model is preserved. The credential is scoped to a single repo (Contents:write +
+// side push credential. The checkout never holds a GitHub push credential, so the
+// #919 model is preserved. The credential is scoped to a single repo (Contents:write +
 // Pull-requests:write + Actions:read) and CANNOT push to branch-protected `main`
 // nor bypass required checks — a leaked server credential can only land code on a
 // feature branch behind the same checks every PR faces.
@@ -30,8 +28,8 @@
 // This module is the server seam: push a bundle, open/find the PR, enable auto-
 // merge, report status. All git runs through execFile arg-arrays (shell:false,
 // the #681 injection discipline); the credentialed URL is built in-process and
-// NEVER persisted to a remote nor echoed on an error path (the box-source-fetch.sh
-// "one-shot URL, scrub the credential" pattern). The GitHub API calls are raw
+// NEVER persisted to a remote nor echoed on an error path (the "one-shot URL,
+// scrub the credential" pattern). The GitHub API calls are raw
 // global fetch (no Octokit — fetch is used throughout auth.js), header shape
 // mirrors auth.js fetchGithubUser.
 
@@ -574,7 +572,7 @@ async function enableAutoMergeDetailed({ nodeId }, deps = {}) {
 }
 
 // getPublishStatus — report the PR + prod-deploy state so ship.js can poll
-// WITHOUT gh on the box. Returns:
+// WITHOUT gh on the checkout. Returns:
 //   { pr_state, merged, merge_sha, deploy_status, deploy_probe }  where
 //   pr_state ∈ open|closed|none,
 //   deploy_status ∈ pending|success|none|unconfigured|unavailable
@@ -811,7 +809,7 @@ function prReferencesTask(status, taskId) {
 
 // task 1002645 — locate a task's PR by the "task <id>: …" TITLE convention, for when
 // the reconciler cannot derive the branch. The sweep derives claude/<worktree_name>
-// (the dev-box convention), but a laptop/wave ship pushes its own branch name
+// (the conventional name), but a laptop/wave ship pushes its own branch name
 // (worktree-<worktree_name>), so the derived branch finds no PR and the sweep's whole
 // PR path — the mergeIfGreen nudge (the ONLY green-PR merger where native auto-merge
 // is repo-disallowed), conflict heal, land proof — never engages; the task strands at
@@ -972,7 +970,7 @@ function mergeBlockReason(s) {
     const bad = s.checks.filter(_BAD_CHECK);
     if (bad.length) return `failing_check:${bad[0].name}`;
     // Red, and the failing check is one of the nulled nodes: say the list is blind
-    // rather than guess "review or pending", which sent a box retrying (task 1003988).
+    // rather than guess "review or pending", which sent a ship retrying (task 1003988).
     if (s.checks_unreadable && ['FAILURE', 'ERROR'].includes(s.rollup_state)) return 'failing_check_unreadable';
     return 'blocked_required_review_or_pending_check';
   }

package/modules/lifecycle/kickoff-checklist.js

@@ -107,10 +107,6 @@ function moduleKeySteps(spec) {
     tasks.push({ title: 'Provide Discord bot token + webhooks', kind: 'infra',
       description: 'The discord module needs a bot token + webhook URLs + DISCORD_BOT_ENABLED=true. Note: outbound/link surfaces fire on credentials even if the module flag is later turned off.' });
   }
-  if (enabled.has('dev-box')) {
-    tasks.push({ title: 'Provide a DigitalOcean API token for dev boxes', kind: 'infra',
-      description: 'The dev-box module needs a DigitalOcean API token (and optionally Cloudflare) on the operator control plane before any builder box can be provisioned.' });
-  }
   return tasks;
 }
 

package/modules/lifecycle/lifecycle.js

@@ -168,12 +168,4 @@ module.exports = {
   // analytics.js (the AI-dev-curve): the builder + ecosystem analytics.
   builderAnalytics: (...a) => db.builderAnalytics(...a),
   ecosystemAnalytics: (...a) => db.ecosystemAnalytics(...a),
-  // dev-box (modules/dev-box/routes/box.js, via resolveOptional('lifecycle')): the
-  // module-key scope of a builder's active claims — the task-scoped source-access
-  // resolver (goal 1000051 / R92, ADR 0148 §2). Keys only; box-access maps them to
-  // git sparse-checkout globs through the doorway `moduleScopeMap`.
-  moduleScopeForActiveClaims: (...a) => db.moduleScopeForActiveClaims(...a),
-  // task 1002729 — the "is this builder actually working right now" signal that
-  // lets box-access tell an unscoped box from a crippled one (see db.js).
-  activeClaimCountForBuilder: (...a) => db.activeClaimCountForBuilder(...a),
 };

package/modules/lifecycle/module.json

@@ -2,6 +2,7 @@
   "key": "lifecycle",
   "title": "Lifecycle (the build state machine)",
   "description": "The build state machine \u2014 tasks \u00b7 claims \u00b7 versions \u00b7 done-when criteria \u00b7 goals \u00b7 dependencies \u00b7 the claim\u2192ship\u2192grade\u2192credit lifecycle \u00b7 override requests \u00b7 the ship/confirm/promote orchestration \u00b7 github-push + merge-lease + conflict-resolve + the publish reconciler. The LAST and most-coupled core domain carved out of the GDS core in BV1.R86 (ADR 0093 \u00a71,\u00a73, 02-module-map \u00a74 \u2014 kept whole, never split). default-on; every instance runs the lifecycle. Registers the `lifecycle` kernel PORT (createTask \u00b7 VOTABLE_TASK_STATUSES \u00b7 classifyTaskKind \u00b7 tallyPeerVotes + the work-tracking reads) that core read routes + the ideas/discord/autonomy modules resolve. As a transaction-participant it RESOLVES the `reward` + `onboarding` ports inside its claim/ship/confirm txns \u2014 but via resolveOptional (graceful, like sessions\u2192reward), so consumes is empty: a vanilla instance without those modules degrades the credit/onboarding writes to best-effort no-ops, it does not fail.",
+  "version": "1.0.0",
   "coreVersion": "^1.12.0",
   "default": true,
   "maintenance": {

package/modules/lifecycle/publish-reconciler.js

@@ -4,18 +4,18 @@
 // "strands at confirmed" failure class.
 //
 // WHY THIS EXISTS
-// A server-mediated publish (ADR 0055) is ASYNCHRONOUS: a dev box uploads its
+// A server-mediated publish (ADR 0055) is ASYNCHRONOUS: a checkout uploads its
 // branch, the server pushes + opens the PR + arms auto-merge, then GitHub runs
-// the required checks, merges, and Actions deploys to prod. The box's ship.js
+// the required checks, merges, and Actions deploys to prod. The uploader's ship.js
 // only POLLS for ~9 min (pollServerPublish) and then EXITS, printing "it flips to
 // shipped on its own". But the confirmed→shipped transition lived in exactly ONE
 // place — the GET /tasks/:id/publish-status reconcile-on-read (routes/tasks.js).
 // That flip can ONLY happen while a client keeps issuing that GET. Real CI (check
-// queue + merge queue + deploy) routinely finishes AFTER the box has stopped
+// queue + merge queue + deploy) routinely finishes AFTER the client has stopped
 // polling, so nothing ever re-checks and the task row freezes at 'confirmed'
 // forever — even though prod is live. Every prior point-fix (1025/1027/1037/1041/
 // 1045/1046/1049/1050/1052/1068) compensated for a symptom of this one gap:
-// "the box must stay alive and keep polling to finish its OWN ship."
+// "the client must stay alive and keep polling to finish its OWN ship."
 //
 // THE FIX. Move the last mile to the SERVER, where it belongs. A periodic sweep
 // (this module) finds every 'confirmed' task, derives its branch from the latest
@@ -23,7 +23,7 @@
 // succeeded?), and on a confirmed land runs the EXACT db.shipTask +
 // ship-broadcast.postShipBroadcast the publish-status route already runs. The land
 // no longer depends on the shipper's CLI being alive — it works for EVERY builder,
-// on a box, a laptop, or a desktop session, and retroactively heals strands left
+// on a laptop or a desktop session, and retroactively heals strands left
 // by a session that exited early. Idempotent: shipTask throws TASK_NOT_CONFIRMED
 // if a client poll (or a prior sweep) already flipped it, so a sweep racing the
 // route never double-ships nor double-broadcasts.
@@ -333,7 +333,7 @@ async function runSweep(deps = {}) {
 
   // task 1002645 — the per-branch PR path (merge nudge → conflict/stale heal →
   // publish-status), extracted so it can run TWICE for one task: first on the
-  // derived claude/<worktree_name> branch (the dev-box convention), then — when
+  // derived claude/<worktree_name> branch (the conventional name), then — when
   // that finds no PR — on the REAL branch adopted from the task's own PR
   // (findTaskPullRequest). Mutates the sweep counters via closure; returns
   // { status, prNotLanded }.
@@ -605,7 +605,7 @@ async function runSweep(deps = {}) {
       }
     }
 
-    // task 1002645 — the claude/<worktree_name> derivation is the DEV-BOX convention;
+    // task 1002645 — the claude/<worktree_name> derivation is only ONE convention;
     // a laptop/wave ship pushes its own branch name (worktree-<worktree_name>), so the
     // derived branch finds no PR and the merge nudge / conflict heal / land proof all
     // sat idle while the task stranded at 'confirmed' (wave PRs 34/35/36 — native
@@ -768,8 +768,8 @@ async function runSweep(deps = {}) {
       logFn(
         `[publish-reconciler] task ${r.task_id} (${landNote}) landed → shipped`
       );
-      // The box that published could not post the Discord broadcast (no webhook
-      // secret — ADR 0053). The server holds the secrets, so it fires it here,
+      // The checkout that published cannot post the Discord broadcast (no webhook
+      // secret). The server holds the secrets, so it fires it here,
       // exactly ONCE on the confirmed→shipped transition. Best-effort: never let
       // a broadcast hiccup turn a successful reconcile into a failure.
       try {
@@ -827,7 +827,7 @@ async function runSweep(deps = {}) {
 
 // task 1366 — server-side session-cost reconcile, piggybacked on the same 5-min
 // sweep. System 1's client cost hook silently skips the MAJORITY of sessions (a
-// cloud box / cowork VM / overnight agent runs with no GDS token, so the
+// cowork VM / overnight agent runs with no GDS token, so the
 // SessionEnd hook quiet-skips), so a server pass re-prices the model_usage we
 // ALREADY stored on session_records into a cost_log row — keyed on the SAME
 // (source, source_ref) the client would use, so logCost's ON CONFLICT DO NOTHING

package/modules/lifecycle/routes/tasks.js

@@ -624,7 +624,7 @@ module.exports = function buildTasksRouter() {
       // confirmed→shipped flip and throws TASK_NOT_CONFIRMED on a repeat, so
       // whichever entry point wins the transition is the only one that reaches
       // this line — the emit fires exactly ONCE per ship across all three
-      // paths. The server is thus the SINGLE ship broadcaster (the box/laptop
+      // paths. The server is thus the SINGLE ship broadcaster (the laptop
       // local post in scripts/gds/ship.js was removed as a duplicate, task
       // 1749). Best-effort: emitAsync isolates listener errors so a broadcast
       // hiccup can never turn a successful ship into a 500.
@@ -1108,19 +1108,18 @@ module.exports = function buildTasksRouter() {
   // ==========================================================================
   // Server-mediated branch publish (ADR 0055 / task 1025)
   // --------------------------------------------------------------------------
-  // A builder on a cloud dev box has NO GitHub push credential (#919/ADR 0053
-  // box-scope + credential-less origin), so in `ci` deploy mode ship.js cannot
-  // `git push` + `gh pr create`. Instead the box uploads its branch as a THIN
+  // A checkout with NO GitHub push credential (credential-less origin, #919)
+  // cannot `git push` + `gh pr create`, so in `ci` deploy mode ship.js uploads
+  // its branch as a THIN
   // git bundle here; the server pushes it + opens the PR + enables auto-merge
   // using its own push credential — a GitHub App installation token (preferred,
   // task 1028) or the GITHUB_PUSH_TOKEN PAT fallback; single repo, Contents:write
   // + PR:write + Actions:read — it CANNOT push to branch-protected main nor bypass
-  // required checks. The box holds NO github credential, so the #919 model is
-  // preserved.
+  // required checks. The uploading checkout holds NO GitHub credential, so the
+  // #919 model is preserved.
   //
-  // AUTH: requireBuilder + gateTaskOwnership, deliberately NOT allowBoxScope — a
-  // box-scoped session is 403'd here (it must `/builder-reauth` to a real cli
-  // session first). The grade already ran client-side against this exact HEAD
+  // AUTH: requireBuilder + gateTaskOwnership. The grade already ran client-side
+  // against this exact HEAD
   // (ship.js grades BEFORE this call), and the bundle-tip == claimed head_sha
   // check below binds the pushed code to that graded sha.
   const publishUpload = express.json({ limit: PUBLISH_BODY_LIMIT });
@@ -1256,7 +1255,7 @@ module.exports = function buildTasksRouter() {
 
   // GET /tasks/:id/publish-status?branch=<branch> — poll the PR + prod-deploy
   // state for a server-mediated publish so ship.js can confirm the land WITHOUT
-  // gh on the box. Ownership-gated like the POST. Derives state live from GitHub.
+  // gh on the checkout. Ownership-gated like the POST. Derives state live from GitHub.
   // `branch` is optional (task 1003764): without it the server finds the task's own PR
   // (both publish paths title it "task <id>: …") and the answer names the `branch` it
   // used and its `branch_source`, so the check agents are sent to instead of git probes
@@ -1303,9 +1302,9 @@ module.exports = function buildTasksRouter() {
         try {
           const shipped = await db.shipTask({ taskId: id, builderId: req.builder.id, landAssurance: RECONCILE_PROOF }); // ADR 0184
           reconciled = true;
-          // task 1045: the box that published can't post the Discord broadcast —
-          // it holds no webhook secret (ADR 0053 "box holds nothing"), so a box
-          // ship was silently skipping the public announcement. The server holds
+          // task 1045: the checkout that published can't post the Discord
+          // broadcast — it holds no webhook secret, so such a ship was silently
+          // skipping the public announcement. The server holds
           // the secrets and just confirmed the deploy, so it fires the broadcast
           // here — exactly ONCE, on the confirmed→shipped transition. shipTask
           // throws TASK_NOT_CONFIRMED on a repeat poll, so this never re-posts.
@@ -1352,8 +1351,7 @@ module.exports = function buildTasksRouter() {
   // ADR-0058 gate-review BLOCKS a Metic+ author's gate-surface PR shipped from a
   // laptop and they can't self-approve their own PR (hit live on task 1162 / PR #131).
   //
-  // AUTH mirrors publish-branch EXACTLY: requireBuilder + gateTaskOwnership, and
-  // deliberately NOT allowBoxScope (a box-scoped session 403s — it must reauth). The
+  // AUTH mirrors publish-branch EXACTLY: requireBuilder + gateTaskOwnership. The
   // attestation power is bounded: gate-author-trust clears a NEEDS_TRUST surface for
   // a Metic+ author only and NEVER the hard floor (which always needs an owner
   // review), so a Metic+ vouching for their own task's head stays within their tier.

package/modules/lifecycle/ship-card.js

@@ -9,7 +9,7 @@
 //
 // ONE generator, two render paths, both PURE:
 //   renderMonospaceCard(model) — alignment-proof left-rule text. The CLIs ALWAYS
-//     print this, so headless / cron / dev-box runs and feeds without the in-feed
+//     print this, so headless / cron runs and feeds without the in-feed
 //     visualization tool still get a consistent summary.
 //   renderCardHtml(model)      — the populated, branded HTML the skills render in
 //     the chat feed via the visualization tool (show_widget). Brand tokens come

package/modules/lifecycle/task-visuals.js

@@ -181,8 +181,8 @@ function isPubliclyViewable(task) {
 // The CANONICAL prefix (src/bongos/api-prefix.js) is hard-coded rather than
 // imported: this lib is deliberately core-free so it unit-tests with a Buffer and
 // a temp dir, and the doorway does not publish the prefix. It is safe to hard-code
-// because BOTH prefixes are permanent — '/api/gds' is a forever alias for shipped
-// Dev Box binaries and the off-box status mirror — so a URL stored under either
+// because BOTH prefixes are permanent — '/api/gds' is a forever alias for older
+// CLIs and the off-box status mirror — so a URL stored under either
 // keeps resolving, and every renderer's guard accepts both.
 const SERVE_PREFIX = '/api/bongos/task-visuals';
 function urlForName(name) {

package/modules/memory/module.json

@@ -2,6 +2,7 @@
   "key": "memory",
   "title": "Memory & recall",
   "description": "Per-builder session memory, the lexical recall/search retrieval layer (ADR 0060), and durable learnings. A core-domain module carved out of the GDS core in BV1.R72 (ADR 0091); default-on because every instance needs the build system's memory.",
+  "version": "1.0.0",
   "coreVersion": "^1.5.0",
   "default": true,
   "maintenance": {

package/modules/memory/routes/memory.js

@@ -32,8 +32,8 @@
 //
 // RENDER / STORED-XSS (#575, audit 2026-06-19) — memory content is stored RAW
 // and is NEVER emitted as HTML. Every endpoint here returns it as JSON
-// (res.json — content as a string field), and the only consumers are the CLI /
-// dev-box memory sync (it writes the strings to the local filesystem) and the
+// (res.json — content as a string field), and the only consumers are the CLI
+// memory sync (it writes the strings to the local filesystem) and the
 // Archon-only forensic reads (also JSON). An audit of every web surface
 // (modules/hall-ui/public/, modules/status-ui/public/) found NO code path that interpolates
 // memory content into the DOM: there is no markdown→HTML renderer in the client

package/modules/npm-release/module.json

@@ -2,6 +2,7 @@
   "key": "npm-release",
   "title": "npm release",
   "description": "The deploy page for a project that publishes an npm package from its GitHub repo — where every recently shipped task has got to (not merged, merged, in a version, live, released) and each version's list of work, read from the release notes the package itself carries (task 1002622) — and the same line on a task's own page (task 1004301). Built for the Bongos hall, which publishes @bongos/core; off everywhere else.",
+  "version": "1.0.0",
   "coreVersion": "^1.19.0",
   "default": false,
   "author": "Cloud Bongos",

package/modules/onboarding/module.json

@@ -2,6 +2,7 @@
   "key": "onboarding",
   "title": "Onboarding (admission · setup · newcomer floor)",
   "description": "The newcomer ADMISSION + ORIENTATION domain — the public access-request → Archon-approval gate, the server-ticked onboarding state machine (the 'Path into the City' checklist that graduates a Xenos to Thetes), the friction analyzer (feedback-without-asking on consented onboarding transcripts), and the evergreen newcomer-chore restock (a fresh first-builder task is always waiting). A core-domain module carved out of the GDS core in BV1.R81 (ADR 0093 §1); default-on because every instance onboards its own builders. The access-requests admission routes mount here; the core lifecycle (db.js claim/ship), auth callbacks, and the me/builders profile readers resolve the `onboarding` kernel PORT for the state-machine + restock surface they need — never importing the module.",
+  "version": "1.0.0",
   "coreVersion": "^1.19.532",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/onboarding/onboarding-state.js

@@ -81,8 +81,8 @@ const ALL_STAGES = [...STAGES, GRADUATED];
 
 // The pre-auth, INFORMATIONAL step that sits AHEAD of auth_complete (task 470).
 // The state machine's first ENGINE stage is auth_complete, but the genuine
-// first action a newcomer takes is "obtain the repo" — clone it locally, or open
-// the hosted dev box where it is already cloned. That step is manual/external
+// first action a newcomer takes is "obtain the repo" — clone it locally. That
+// step is manual/external
 // (there is no server event for it) and intentionally NOT a member of STAGES, so
 // it never gates graduation, never advances current_stage, and never appears in
 // shapeForApi's tracked checklist. It exists purely so the system's own model of
@@ -92,7 +92,7 @@ const ALL_STAGES = [...STAGES, GRADUATED];
 const PRE_AUTH_STEP = {
   id: 'obtain_repo',
   label: 'Obtain the repo',
-  hint: 'Clone the project to thy machine — or open thy hosted dev box, where it is already cloned. The build commands live inside the repo, so this comes first.',
+  hint: 'Clone the project to thy machine. The build commands live inside the repo, so this comes first.',
   informational: true,
 };
 
@@ -126,10 +126,10 @@ const STAGE_LABELS = {
 // onboarding model never named that step, so the hint now points at it ahead of
 // the sign-in itself. See PRE_AUTH_STEP below for the standalone representation.
 const STAGE_HINTS = {
-  auth_complete:    'First obtain the repo — clone it (or open thy hosted dev box, where it is already cloned) — then sign in via GitHub Device Flow or the web sign-in.',
+  auth_complete:    'First obtain the repo — clone it — then sign in via GitHub Device Flow or the web sign-in.',
   pick_disciplines: 'Pick the work that calls thee — engineer, artist, ideator, or any mix.',
   first_start:      'Run /builder-start to see claimable works.',
-  first_claim:      'Claim a task with /builder-claim N — then on thy dev box run /builder-sync, and thy box pulls exactly that task\'s code (naught else) within seconds.',
+  first_claim:      'Claim a task with /builder-claim N — it is thine alone until thou shippest it.',
   ship_three:       'Carry three tasks through with /builder-ship — the third makes thee a Thetes.',
   graduated:        '',
 };
@@ -147,28 +147,16 @@ function isKnownStage(stage) {
 // hall renders — a short, action-only orientation path for a brand-new Xenos.
 // Every step auto-detects (#777, per Lars: no manual ticks — "the city watches"):
 //
-//   1. box_connect      — cleared the moment the builder PROPERLY connects to
-//                         their dev box, i.e. a running `claude` process is seen
-//                         on the box. Backed by builder_boxes.first_connected_at
-//                         (stamped write-once by boxes.bumpActivity on the first
-//                         claude_active=true heartbeat); passed in as
-//                         `boxConnected` (boxes.hasEverConnected). FIRST because
-//                         nothing else can happen until the box works — its hint
-//                         points the newcomer at the welcome panel's setup steps
-//                         (#823). `source: 'box'`.
-//   2. join_discord     — cleared by a live Discord link (discord.linked). The
+//   1. join_discord     — cleared by a live Discord link (discord.linked). The
 //                         hall's "Connect Discord & join" button runs the
 //                         existing OAuth flow (auto-join + rank role); linking
 //                         clears the step. `source: 'discord'`.
-//   3. pick_disciplines — the real engine stage, cleared by the craft picker.
-//   4. cli_setup        — cleared once the builder has authenticated the GDS CLI
-//                         (ran /builder-setup, or the box-connect bootstrap — both
-//                         mint a source='cli' session). Detected via
-//                         db.hasCliSession; passed in as `cliAuthed`. Distinct
-//                         from box_connect: connecting gets Claude running on the
-//                         box; setup signs the GDS in so /builder-* works (Lars,
-//                         #823: "both have a place"). `source: 'cli'`.
-//   5. ship_three       — the real engine stage. Auto, live "N of 3" counter,
+//   2. pick_disciplines — the real engine stage, cleared by the craft picker.
+//   3. cli_setup        — cleared once the builder has authenticated the CLI
+//                         (ran /builder-setup, which mints a source='cli'
+//                         session). Detected via db.hasCliSession; passed in as
+//                         `cliAuthed`. `source: 'cli'`.
+//   4. ship_three       — the real engine stage. Auto, live "N of 3" counter,
 //                         clears at 3 ships (= the xenos->thetes promotion).
 //
 // The old 'auth_complete' (GitHub web sign-in) is intentionally NOT shown — a
@@ -181,7 +169,6 @@ function isKnownStage(stage) {
 // derive `cleared` for each step. NONE of these are members of STAGES, so none
 // affect nextStage/graduation — they are display-only.
 const DISPLAY_STEPS = [
-  { id: 'box_connect',      source: 'box' },
   { id: 'join_discord',     source: 'discord' },
   { id: 'pick_disciplines', source: 'stage' },
   { id: 'cli_setup',        source: 'cli' },
@@ -189,18 +176,16 @@ const DISPLAY_STEPS = [
 ];
 
 const DISPLAY_LABELS = {
-  box_connect:      'Connect to thy dev box',
   join_discord:     'Join the Discord server',
   pick_disciplines: 'Choose thy craft — engineer, artist, or ideator',
-  cli_setup:        'Run /builder-setup on thy dev box',
+  cli_setup:        'Run /builder-setup',
   ship_three:       'Ship three works — and rise to Thetes',
 };
 
 const DISPLAY_HINTS = {
-  box_connect:      'Follow the steps in the welcome scroll above to get Claude running on thy dev box — this ticks itself the moment thou art connected.',
   join_discord:     'Connect Discord — thou art auto-joined to the city\'s server and given thy rank.',
   pick_disciplines: 'Pick the work that calls thee — engineer, artist, ideator, or any mix.',
-  cli_setup:        'Sign the GDS in on thy dev box with /builder-setup — this ticks itself once thou art signed in.',
+  cli_setup:        'Sign the CLI in with /builder-setup — this ticks itself once thou art signed in.',
   ship_three:       'Carry three tasks through with /builder-ship — the third makes thee a Thetes.',
 };
 
@@ -454,25 +439,21 @@ function stageDetail(stageId, shipCount) {
 //                      → the counter isn't rendered.
 // opts.discordLinked — whether the builder has a live Discord link. Clears the
 //                      'join_discord' step (the OAuth flow sets the link).
-// opts.boxConnected  — whether the builder's dev box has ever reported a live
-//                      Claude process (boxes.hasEverConnected → first_connected_at).
-//                      Clears the 'box_connect' step (#823).
 // opts.cliAuthed     — whether the builder has ever authenticated the GDS CLI
 //                      (db.hasCliSession). Clears the 'cli_setup' step.
-function shapeForApi(state, { shipCount = null, discordLinked = false, boxConnected = false, cliAuthed = false } = {}) {
+function shapeForApi(state, { shipCount = null, discordLinked = false, cliAuthed = false } = {}) {
   const completed   = new Set((state && state.completed_stages) || []);
   const currentReal = (state && state.current_stage) || STAGES[0];
   const graduated   = currentReal === GRADUATED;
 
   // Per-step cleared resolution, by `source`. 'stage' mirrors hasCleared (in
-  // completed_stages, OR the engine advanced past it). 'discord'/'box'/'cli'
-  // derive from live signals passed by the route. A graduated builder has cleared
+  // completed_stages, OR the engine advanced past it). 'discord'/'cli' derive
+  // from live signals passed by the route. A graduated builder has cleared
   // everything by definition (keeps the displayed list coherent even though the
   // panel hides on graduation — a roster/profile read could still surface this).
   const stepCleared = (step) => {
     if (graduated) return true;
     if (step.source === 'discord') return !!discordLinked;
-    if (step.source === 'box') return !!boxConnected;
     if (step.source === 'cli') return !!cliAuthed;
     // 'stage'
     if (completed.has(step.id)) return true;

package/modules/onboarding/routes/access-requests.js

@@ -1,9 +1,9 @@
 // src/bongos/routes/access-requests.js — onboarding cold-start (2026-05-30).
 //
 // The hall is gated: a brand-new person can't enter until an Archon admits
-// them. Admission is the ONLY gate — newcomers build on hosted dev boxes, so
-// they need no GitHub repo access / collaborator invite (2026-06-07). 'invited'
-// just means "Archon-approved for the hall"; the web sign-in (auth.js) checks
+// them. Admission is the ONLY gate sign-in applies — there is no GitHub repo-
+// access / collaborator check in it (2026-06-07). 'invited' just means
+// "Archon-approved for the hall"; the web sign-in (auth.js) checks
 // exactly that one flag. This router is how they ask and how the Archon
 // answers:
 //

package/modules/platform-identity/module.json

@@ -2,6 +2,7 @@
   "key": "platform-identity",
   "title": "Platform identity (hub IdP)",
   "description": "The Cloud Bongos hub identity-provider surface (ADR 0141): platform accounts, an SSO client registry, and an OAuth authorization-code login handoff so one platform account reaches any hosted project's builders hall with no second GitHub sign-in. Identity ONLY — the hub never mints or carries rank/credits/admission (the ADR 0016 trust boundary). Enabled ONLY on the hub instance (cloudbongos.com); ordinary hosted + self-hosted instances leave it off, so it adds zero attack surface for the common case.",
+  "version": "1.0.0",
   "coreVersion": "^1.14.0",
   "default": false,
   "author": "Cloud Bongos",

package/modules/platform-identity/platform-identity.js

@@ -87,14 +87,21 @@ function clientSecretValid(client, presentedSecret) {
 // Decide whether a RESOLVED hub session may complete the SSO handoff. resolveSession
 // (the raw resolver the browser leg uses so it can redirect-to-sign-in rather than
 // 401) does NOT apply the deny gates requireBuilder does (src/bongos/auth.js) — so
-// this replicates them: a deactivated account (status 'inactive'), a dev-box-scoped
-// token (source 'box', which lives OUTSIDE the ADR 0016 trust boundary), and any
-// non-human service principal (system_role set) must NOT federate. Pure + exported
-// so the gate is unit-tested directly. Returns { ok, reason }.
+// this replicates them: a deactivated account (status 'inactive'), a session whose
+// source the kernel's session-source registry does not declare, and any non-human
+// service principal (system_role set) must NOT federate. Pure + exported so the
+// gate is unit-tested directly. Returns { ok, reason }.
+//
+// FEDERATION_SOURCES mirrors modules/government/session-scopes.json — a module may
+// not read another module's files, and the doorway exports no lookup for it — and
+// tests/platform-identity.mjs pins the two lists equal, so a source declared or
+// retired there without the same edit here fails the build instead of drifting.
+const FEDERATION_SOURCES = Object.freeze(['cli', 'web', null]);
 function sessionUsableForFederation(session) {
   if (!session) return { ok: false, reason: 'no_session' };
   if (session.status === 'inactive') return { ok: false, reason: 'inactive' };
-  if (session.source === 'box') return { ok: false, reason: 'box_scope' };
+  const source = session.source === undefined ? null : session.source;
+  if (!FEDERATION_SOURCES.includes(source)) return { ok: false, reason: 'session_scope' };
   if (session.system_role) return { ok: false, reason: 'service_principal' };
   return { ok: true, reason: null };
 }
@@ -1395,6 +1402,7 @@ module.exports = {
   clientSecretValid,
   redirectUriAllowed,
   sessionUsableForFederation,
+  FEDERATION_SOURCES,
   safeAvatarUrl,
   // accounts
   upsertAccount,

package/modules/platform-identity/routes/sso.js

@@ -249,8 +249,9 @@ module.exports = function ssoRoutes() {
     //
     // resolveSession is the RAW resolver (so we can redirect rather than 401), so it
     // does NOT apply requireBuilder's deny gates — we must. sessionUsableForFederation
-    // rejects a deactivated account, a dev-box-scoped token (outside the ADR 0016
-    // trust boundary), and service principals: none may mint a federated identity code.
+    // rejects a deactivated account, a session of an undeclared source (outside
+    // the ADR 0016 trust boundary), and service principals: none may mint a
+    // federated identity code.
     let session;
     try {
       session = await resolveSession(req);
@@ -265,8 +266,8 @@ module.exports = function ssoRoutes() {
       }
       const msg = usable.reason === 'inactive'
         ? 'This account is no longer active. Ask an Archon on the hub if you believe this is an error.'
-        : usable.reason === 'box_scope'
-          ? 'A dev-box session cannot be used for cross-project sign-in. Sign in from a browser or run /builder-reauth.'
+        : usable.reason === 'session_scope'
+          ? 'This kind of session cannot be used for cross-project sign-in. Sign in from a browser or run /builder-reauth.'
           : 'This session type cannot be used for cross-project sign-in.';
       return res.status(403).type('text/html').send(errorPage(msg));
     }

package/modules/platform-identity/tests/platform-identity.mjs

@@ -119,9 +119,23 @@ t('a deactivated account may NOT federate (mirrors requireBuilder status gate)',
   assert.deepEqual(r, { ok: false, reason: 'inactive' });
 });
 
-t('a dev-box-scoped token may NOT federate (outside the trust boundary)', () => {
-  const r = P.sessionUsableForFederation({ github_id: 1, status: 'active', source: 'box' });
-  assert.deepEqual(r, { ok: false, reason: 'box_scope' });
+t('a session of an undeclared source (a leftover dev-box token) may NOT federate', () => {
+  for (const source of ['box', 'not-a-source']) {
+    const r = P.sessionUsableForFederation({ github_id: 1, status: 'active', source });
+    assert.deepEqual(r, { ok: false, reason: 'session_scope' }, source);
+  }
+  // cli, web and the legacy sourceless row still federate.
+  for (const source of ['cli', 'web', null, undefined]) {
+    assert.equal(P.sessionUsableForFederation({ github_id: 1, status: 'active', source }).ok, true, String(source));
+  }
+});
+
+t('FEDERATION_SOURCES is exactly the kernel session-source registry', () => {
+  // platform-identity may not read the government module, so it mirrors the list;
+  // this pin is what stops the copy drifting from modules/government/session-scopes.json.
+  const reg = JSON.parse(readFileSync(new URL('../../government/session-scopes.json', import.meta.url), 'utf8'));
+  const declared = reg.scopes.map((r) => (r.source === undefined ? null : r.source));
+  assert.deepEqual([...P.FEDERATION_SOURCES].sort(), declared.sort());
 });
 
 t('a service principal (system_role set) may NOT federate', () => {

package/modules/provisioning/capacity.js

@@ -137,7 +137,7 @@ async function countPlaced(db, shapes, { excludeId = null } = {}) {
 }
 
 // readLocalMeminfo — THIS host's /proc/meminfo, for the surfaces that run on the
-// control plane itself. Null (not a throw) where it does not exist, e.g. a dev box
+// control plane itself. Null (not a throw) where it does not exist, e.g. a laptop
 // that is not Linux — the summary then reads 'default' and says so.
 function readLocalMeminfo() {
   try { return fs.readFileSync('/proc/meminfo', 'utf8'); } catch { return null; }

package/modules/provisioning/module.json

@@ -2,6 +2,7 @@
   "key": "provisioning",
   "title": "Instance provisioning",
   "description": "Stand up + operate a Cloud Bongos instance's own infrastructure (server, database, domain, DNS, TLS) via the API, so an owner does not manage infra by hand (ADR 0111). Owns the web-tier REQUEST + STATE surface only: it enqueues provisioning intents + reads instance state \u2014 it holds NO cloud-provider tokens and calls NO cloud API. A separate control-plane runner (scripts/gds/provision.js, task P3) is the sole token-holder that drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute WORKLOADS.",
+  "version": "1.0.0",
   "coreVersion": "^1.14.0",
   "default": false,
   "author": "Cloud Bongos",

package/modules/provisioning/provisioning.js

@@ -7,8 +7,8 @@
 // intents. The control-plane runner (scripts/gds/provision.js, task P3) is the sole
 // token-holder that drains provisioning_intents and does the real infra work.
 //
-// `db` is dependency-INJECTED (passed in as the first arg), exactly like
-// modules/dev-box/boxes.js — so this file has NO core require and is trivially
+// `db` is dependency-INJECTED (passed in as the first arg), so this file has NO
+// core require and is trivially
 // unit-testable with a fake `{ query }`. The route factory passes the doorway pool.
 'use strict';
 
@@ -351,8 +351,9 @@ function defaultDomainForSlug(slug, apex) {
 }
 
 // Labels the platform itself occupies (or has planned) directly under the instance
-// apex, plus the dev-box hostname prefixes. The runner's DNS write is an UPSERT,
-// so a project claiming one of these would overwrite platform records — refuse at
+// apex, plus the `term-` / `sandbox-` hostname prefixes older per-builder machines
+// took. The runner's DNS write is an UPSERT, so a project claiming one of these
+// would overwrite platform records — refuse at
 // the API layer instead (task 1002704; the guard applies to auto-assigned AND
 // bring-your-own hostnames, on create and on attach). Anything deeper than one
 // label under the apex is also refused: it breaks the wildcard-cert rule (one
@@ -1133,7 +1134,7 @@ async function setInstanceStatus(db, id, status, patch = {}) {
 
 // Enqueue a provision/teardown intent. Idempotent: the partial unique index
 // ux_provisioning_intents_open makes a second open enqueue collide (23505); we
-// then return the already-open intent with created:false (mirrors boxes.enqueueIntent).
+// then return the already-open intent with created:false.
 async function enqueueIntent(db, instanceId, action, requestedBy, targetVersion = null) {
   await require('./control-plane-guard').assertIntentAllowed(db, instanceId, action); // ADR 0293 D2; required HERE because this file is at the size ratchet
   try {