@bongos/core 1.19.1073 → 1.19.1075

package/scripts/gds/do-api.js

@@ -1,15 +1,12 @@
 // scripts/gds/do-api.js — a thin DigitalOcean API v2 client for the control plane.
 //
-// Shared control-plane client (ADR 0111 §2, task #1943): the DO client both the
-// dev-box CLI (scripts/gds/box.js) and the instance-provisioning runner
-// (scripts/gds/provision.js) use. It lived in modules/dev-box/ historically, but
-// it is operator-CLI code (never the web tier), so it belongs in the control-plane
-// tier alongside its callers — and a module may not import a sibling module, so two
-// CLIs can only share it from here. Originally #598 (box lifecycle).
+// Control-plane client (ADR 0111 §2, task #1943): the DO client the
+// instance-provisioning runner (scripts/gds/provision.js) and its teardown
+// (provision-teardown.js) use. It is operator-CLI code (never the web tier), so it
+// lives in the control-plane tier alongside its callers. Originally #598.
 //
-// The ONLY network module in the box-lifecycle subsystem. Everything that
-// touches DO goes through here so the rest of the code (boxes.js decisions,
-// box.js orchestration) stays testable without a live account.
+// Everything that touches DO goes through here so the provisioning code stays
+// testable without a live account.
 //
 // Design:
 //   - Injectable transport (`fetchImpl`) so tests pass a fake fetch and assert
@@ -23,10 +20,8 @@
 //   - Live mode requires a token (DO_API_TOKEN); the constructor throws clearly
 //     if asked to run live without one — it never silently no-ops a real call.
 //
-// We implement only the calls the lifecycle needs:
-//   createDroplet · getDroplet · deleteDroplet · listDroplets
-//   snapshotDroplet (action) · getAction (poll) · deleteSnapshot
-//   createDropletFromSnapshot
+// We implement only the calls provisioning needs:
+//   createDroplet · getDroplet · deleteDroplet · settleDroplet (poll to active)
 
 const { JsonHttpApi, makeApiError } = require('./http-api-client');
 
@@ -54,7 +49,7 @@ class DoApi extends JsonHttpApi {
 
   // ---- droplets --------------------------------------------------------------
 
-  // image: either a base image slug (e.g. 'docker-20-04') OR a snapshot id (int).
+  // image: a base image slug (e.g. 'ubuntu-24-04-x64').
   async createDroplet({ name, region, size, image, userData, tags, sshKeys }) {
     const body = {
       name, region, size, image,
@@ -79,53 +74,9 @@ class DoApi extends JsonHttpApi {
     return this._req('DELETE', `/droplets/${dropletId}`, null, { dryRunResult: { deleted: true } });
   }
 
-  // List every droplet carrying `tag` (our fleet tag, e.g. otb-builder-box). The
-  // input to the drift reconcile (task 1289): compare these REAL droplets against
-  // the GDS box rows to find zombies (a droplet no live box claims) and ghosts (a
-  // box row whose droplet vanished). per_page=200 covers the whole fleet in one
-  // page at our scale (<100 boxes); a future larger fleet would follow
-  // links.pages.next. Returns { droplets: [...] }; dry-run returns an empty list
-  // (the reconcile builds its OWN live read client so planning still sees drift).
-  async listDroplets({ tag } = {}) {
-    const qs = tag ? `?tag_name=${encodeURIComponent(tag)}&per_page=200` : '?per_page=200';
-    return this._req('GET', `/droplets${qs}`, null, { dryRunResult: { droplets: [] } });
-  }
-
-  // ---- snapshots (via droplet actions) --------------------------------------
-
-  // Snapshot a running droplet. DO recommends powering off first for a clean
-  // snapshot; the orchestrator powers off then calls this. Returns an ACTION
-  // whose completion must be polled (getAction) before the droplet is destroyed.
-  async snapshotDroplet(dropletId, snapshotName) {
-    return this._req('POST', `/droplets/${dropletId}/actions`, { type: 'snapshot', name: snapshotName }, {
-      dryRunResult: { action: { id: `dryrun-action-${dropletId}`, status: 'completed', type: 'snapshot' } },
-    });
-  }
-
-  async powerOffDroplet(dropletId) {
-    return this._req('POST', `/droplets/${dropletId}/actions`, { type: 'power_off' }, {
-      dryRunResult: { action: { id: `dryrun-poweroff-${dropletId}`, status: 'completed' } },
-    });
-  }
-
-  async getAction(actionId) {
-    return this._req('GET', `/actions/${actionId}`, null, {
-      dryRunResult: { action: { id: actionId, status: 'completed' } },
-    });
-  }
-
-  async deleteSnapshot(snapshotId) {
-    return this._req('DELETE', `/snapshots/${snapshotId}`, null, { dryRunResult: { deleted: true } });
-  }
-
-  async createDropletFromSnapshot({ name, region, size, snapshotId, userData, tags, sshKeys }) {
-    return this.createDroplet({ name, region, size, image: snapshotId, userData, tags, sshKeys });
-  }
-
-  // Shared poll primitive behind waitForAction + settleDroplet (the box
-  // subsystem's two DO poll loops, unified per the #1092 cleanup). Calls step(i)
-  // each round; step returns { done:true, value } to stop, or a falsy value to keep
-  // polling. Returns the stopping value, or { timedOut:true } after `tries` rounds.
+  // Poll primitive behind settleDroplet (#1092). Calls step(i) each round; step
+  // returns { done:true, value } to stop, or a falsy value to keep polling.
+  // Returns the stopping value, or { timedOut:true } after `tries` rounds.
   // `sleepFn` lets tests drive the loop with no real clock.
   async _poll({ tries = 60, sleepMs = 5000, sleepFn } = {}, step) {
     const sleep = sleepFn || ((ms) => new Promise((r) => setTimeout(r, ms)));
@@ -137,26 +88,8 @@ class DoApi extends JsonHttpApi {
     return { timedOut: true };
   }
 
-  // Poll an action to completion. Returns true if 'completed', throws on 'errored'.
-  // sleepFn lets tests drive the loop deterministically (no real sleeping).
-  async waitForAction(actionId, { tries = 60, sleepMs = 5000, sleepFn } = {}) {
-    if (this.dryRun) return true;
-    const out = await this._poll({ tries, sleepMs, sleepFn }, async () => {
-      const { action } = await this.getAction(actionId);
-      if (action.status === 'completed') return { done: true, value: true };
-      if (action.status === 'errored') {
-        throw new DoApiError(`DO action ${actionId} errored`, { body: action });
-      }
-      return null;
-    });
-    if (out && out.timedOut) throw new DoApiError(`DO action ${actionId} did not complete in time`);
-    return out;
-  }
-
   // Wait until a freshly-created droplet is 'active' and return its public IPv4.
-  // Lives here (alongside waitForAction) so the box subsystem's two DO poll loops
-  // share one primitive; scripts/gds/box.js calls it as a method. dry-run returns
-  // no IP (it never created a real droplet).
+  // dry-run returns no IP (it never created a real droplet).
   async settleDroplet(dropletId, { tries = 60, sleepMs = 5000, sleepFn } = {}) {
     if (this.dryRun) return { ip: null };
     const out = await this._poll({ tries, sleepMs, sleepFn }, async () => {

package/scripts/gds/doc-cli-guard.js

@@ -41,6 +41,8 @@ const DOC_CLI_ALLOW = new Map([
     'art-stage.js ships with the art-pipeline HOST module, which publish-manifest.js excludes from core — absent from a core-only checkout by design; the skill says so inline.'],
   ['.claude/skills/otb-tile-generate/SKILL.md::scripts/gds/art-stage.js',
     'same as paint/SKILL.md — the art staging CLI travels with the excluded art-pipeline module, not the portable core.'],
+  ['docs/session-logs/2026-09-10-task-1003507-the-box-that-could-not-be-reaped.md::scripts/gds/box.js',
+    'a dated session log — the historical record, never rewritten — of work on a CLI the dev-box removal deleted (task 1003893); it describes what was run then, not what to run now.'],
 ]);
 
 // `node scripts/gds/foo.js` … up to the end of the line/segment, so the flags that

package/scripts/gds/doctor.js

@@ -167,7 +167,7 @@ function checkToolchain() {
 // Check 3 — Git plumbing
 // --------------------------------------------------------------------------
 // Pure verdict for the hooks gate, extracted so the truth table is testable
-// (tests/doctor_hooks.mjs) — the box-auth-check `decideBoxAuth` precedent.
+// (tests/doctor_hooks.mjs).
 //
 // `.husky/` is INSTANCE topology, not shipped in the portable core (README
 // "Secrets scanning"). So its absence is not a builder error: it means ADR 0043
@@ -371,7 +371,7 @@ function checkDeployTooling() {
   }
 
   // ADR 0055 / task 1025: in ci mode there are two publish paths. A machine with
-  // no GitHub push credential (a dev box) ships SERVER-MEDIATED — it uploads its
+  // no GitHub push credential ships SERVER-MEDIATED — it uploads its
   // branch to the GDS, which pushes + opens the PR with the server's credential —
   // so gh is NOT needed here. Resolve the same path ship.js will take and skip the
   // gh requirement when it's server-mediated.
@@ -382,7 +382,7 @@ function checkDeployTooling() {
     /* keep 'local'; the gh checks below are the safe, stricter default */
   }
   if (via === 'server') {
-    ok('deploy', `Deploy mode: ci (server-mediated publish) — this machine has no GitHub push credential, so the GDS pushes your branch + opens the PR for you. gh is not required here. NOTE: on a dev box, run /builder-reauth (browser) first so your session is a real cli session, not the box-scoped one.`);
+    ok('deploy', `Deploy mode: ci (server-mediated publish) — this machine has no GitHub push credential, so the GDS pushes your branch + opens the PR for you. gh is not required here.`);
     return;
   }
 
@@ -425,7 +425,7 @@ function checkDeployTooling() {
 
 // Intent-runner drift (task 1002722): a runner on a stale core once turned a domain-attach
 // into a teardown (task 1002716). Only a host with *intent-runner* units shows this section,
-// so a builder laptop or dev box sees nothing.
+// so a builder laptop sees nothing.
 function runnerDriftRows(results) {
   return (results || []).map((r) => {
     const msg = `${r.name}: ${r.reason}`;

package/scripts/gds/feedback-latest.js

@@ -3,8 +3,8 @@
 // /feedback Claude Code slash command.
 //
 // Resolves the LATEST feedback bundle the Bongos app wrote to
-// ~/CloudBongos/feedback/ (via the shared `latest` pointer in
-// bongos-app/src/handoff.js) and prints it for a Claude Code session:
+// ~/CloudBongos/feedback/ (via the shared `latest` pointer, ADR 0087) and
+// prints it for a Claude Code session:
 //
 //   1. the full prompt.md body (the model-agnostic transcript + ask, R11), and
 //   2. the ABSOLUTE path of every attached frame, on its own line, so Claude's
@@ -20,13 +20,139 @@
 //
 // Local + read-only: it reads files under your home dir. No GDS session, no
 // network — so it works on any machine the Bongos app runs on.
+//
+// resolveLatest + feedbackBaseDir are ported here from the app's
+// bongos-app/src/handoff.js, which no longer lives in this repo (the desktop
+// apps publish off-repo, ADR 0098 — task 1004356). The contract is ADR 0087's:
+// `latest.json` is authoritative, the `latest/` symlink is a convenience that
+// may be absent, and with neither the reader self-heals by scanning for the
+// newest bundle dir holding a prompt.md.
 
 'use strict';
 
+const fs = require('node:fs/promises');
+const os = require('node:os');
 const path = require('node:path');
-const { resolveLatest, feedbackBaseDir } = require(
-  path.join(__dirname, '..', '..', 'bongos-app', 'src', 'handoff.js'),
-);
+
+const IMAGE_EXT = new Set(['.png', '.jpg', '.jpeg', '.webp', '.gif']);
+
+/** Where the Bongos app writes bundles: ~/CloudBongos/feedback. */
+function feedbackBaseDir() {
+  return path.join(os.homedir(), 'CloudBongos', 'feedback');
+}
+
+async function isBundleDir(dir) {
+  try {
+    return (await fs.stat(path.join(dir, 'prompt.md'))).isFile();
+  } catch {
+    return false;
+  }
+}
+
+// The dir `latest.json` names, or null if it is missing, unreadable or stale.
+// Accepts the pointer by `dir` (absolute) or by `id` (a child of baseDir).
+async function fromPointer(baseDir) {
+  let ptr;
+  try {
+    ptr = JSON.parse(await fs.readFile(path.join(baseDir, 'latest.json'), 'utf8'));
+  } catch {
+    return null;
+  }
+  if (!ptr || typeof ptr !== 'object') return null;
+  const candidates = [];
+  if (typeof ptr.dir === 'string' && ptr.dir) candidates.push(path.resolve(baseDir, ptr.dir));
+  if (typeof ptr.id === 'string' && ptr.id && !/[\\/]/.test(ptr.id)) candidates.push(path.join(baseDir, ptr.id));
+  for (const dir of candidates) if (await isBundleDir(dir)) return dir;
+  return null;
+}
+
+async function fromSymlink(baseDir) {
+  const link = path.join(baseDir, 'latest');
+  if (!(await isBundleDir(link))) return null;
+  try {
+    return await fs.realpath(link);
+  } catch {
+    return null;
+  }
+}
+
+// Self-heal: the newest child dir (by prompt.md mtime, then name) with a prompt.md.
+async function fromScan(baseDir) {
+  let entries;
+  try {
+    entries = await fs.readdir(baseDir, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+  let best = null;
+  for (const e of entries) {
+    if (!e.isDirectory() || e.name === 'latest') continue;
+    const dir = path.join(baseDir, e.name);
+    let st;
+    try {
+      st = await fs.stat(path.join(dir, 'prompt.md'));
+    } catch {
+      continue;
+    }
+    if (!st.isFile()) continue;
+    if (!best || st.mtimeMs > best.mtimeMs || (st.mtimeMs === best.mtimeMs && e.name > best.name)) {
+      best = { dir, name: e.name, mtimeMs: st.mtimeMs };
+    }
+  }
+  return best && best.dir;
+}
+
+// The bundle's frames as absolute paths: those prompt.md references (in the
+// order the walkthrough cites them) that exist, then any other image in the dir.
+async function collectImages(dir, promptMarkdown) {
+  const out = [];
+  const seen = new Set();
+  const add = (p) => {
+    const key = process.platform === 'win32' ? p.toLowerCase() : p;
+    if (!seen.has(key)) { seen.add(key); out.push(p); }
+  };
+  for (const m of promptMarkdown.matchAll(/!\[[^\]]*\]\(\s*<?([^)>]+?)>?\s*\)/g)) {
+    const p = path.resolve(dir, m[1]);
+    if (!IMAGE_EXT.has(path.extname(p).toLowerCase())) continue;
+    try {
+      if ((await fs.stat(p)).isFile()) add(p);
+    } catch { /* referenced but absent — skip */ }
+  }
+  const walk = async (d, depth) => {
+    let entries;
+    try {
+      entries = await fs.readdir(d, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    for (const e of entries) {
+      const p = path.join(d, e.name);
+      if (e.isDirectory() && depth > 0) await walk(p, depth - 1);
+      else if (e.isFile() && IMAGE_EXT.has(path.extname(e.name).toLowerCase())) add(p);
+    }
+  };
+  await walk(dir, 1);
+  return out;
+}
+
+/**
+ * The newest feedback bundle under baseDir, or null if there is none.
+ * @returns {Promise<null|{id:string,dir:string,promptPath:string,promptMarkdown:string,imagePaths:string[]}>}
+ */
+async function resolveLatest(baseDir = feedbackBaseDir()) {
+  const dir = (await fromPointer(baseDir)) || (await fromSymlink(baseDir)) || (await fromScan(baseDir));
+  if (!dir) return null;
+  const promptPath = path.join(dir, 'prompt.md');
+  const promptMarkdown = await fs.readFile(promptPath, 'utf8');
+  return {
+    id: path.basename(dir),
+    dir,
+    promptPath,
+    promptMarkdown,
+    imagePaths: await collectImages(dir, promptMarkdown),
+  };
+}
 
 function parseArgs(argv) {
   const out = { json: false, base: undefined };
@@ -88,7 +214,11 @@ async function main() {
   process.stdout.write(`${lines.join('\n')}\n`);
 }
 
-main().catch((err) => {
-  process.stderr.write(`feedback-latest: ${err.message}\n`);
-  process.exitCode = 1;
-});
+module.exports = { resolveLatest, feedbackBaseDir };
+
+if (require.main === module) {
+  main().catch((err) => {
+    process.stderr.write(`feedback-latest: ${err.message}\n`);
+    process.exitCode = 1;
+  });
+}

package/scripts/gds/fitness-checks-identity.js

@@ -71,10 +71,6 @@ const IDENTITY_SCAN_EXTRA_FILES = [];
 // one, and any file NOT listed must have zero hits. Getting better never fails.
 //
 // Why each is legitimate:
-//   * box.js — REAL Cloudflare/DNS zone names for the operator plane
-//     (`dev.<host>`, the terminal zone). These are infrastructure identifiers,
-//     not an instance URL; routing them through branding would be wrong. (Its
-//     two genuine API-base defaults WERE fixed in 1002428.)
 //   * publish-manifest.js — the literal FILENAMES of three real committed docs
 //     (the two decouple recipes, plus the instance's own name/trademark ADR that
 //     task 1003869 excluded: its prose redacts cleanly but the FILENAME rides in
@@ -91,8 +87,8 @@ const IDENTITY_SCAN_EXTRA_FILES = [];
 //     1002567). Each is a HOST-PINNED OPS script, not portable code: they name the
 //     live box's actual Postgres database/role and its actual /etc secrets dir, and
 //     every one of those literals is already only the DEFAULT behind an env override
-//     (GDS_BACKUP_DB, PROD_DB/STAGING_DB, PG_SOCKET). Same rationale as box.js's real
-//     DNS zones — an infrastructure identifier, not an instance URL, and the systemd
+//     (GDS_BACKUP_DB, PROD_DB/STAGING_DB, PG_SOCKET). Each is an infrastructure
+//     identifier, not an instance URL, and the systemd
 //     units on that box invoke these by path. Re-pointing an instance's backups is
 //     deployment work, not a branding read. Their COUNT is still frozen here, so a
 //     NEW literal in any of them fails exactly like one in an unlisted file.
@@ -116,7 +112,6 @@ const IDENTITY_SCAN_ALLOWED = {
   // instance it declines to run instead of destroying the wrong database.
   'scripts/gds/seed-staging.sh': 4,
   'scripts/gds/backfill-sessions.js': 2,
-  'scripts/gds/box.js': 3,
   'scripts/gds/publish-manifest.js': 3,
   'scripts/gds/seed-bongos-coreB-tranche1-tasks.js': 1,
   'scripts/gds/seed-bongos-coreB-tranche2-tasks.js': 1,

package/scripts/gds/fitness-checks-packaging.js

@@ -24,7 +24,7 @@ const { CORE_ROOT, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
 // ============================================================================
 //
 // A vanilla self-host boot ships only the PUBLISHABLE tree (publish-manifest.js). An
-// instance-only config (config/devbox-app.json, config/bongos-cli.json, config/branding.json,
+// instance-only config (config/bongos-cli.json, config/branding.json,
 // config/modules.json, …) is boundary-EXCLUDED, so a bare `require('../../config/<excluded>.json')`
 // in core code throws MODULE_NOT_FOUND and CRASHES the boot on a fresh instance — the exact
 // class that shipped in R88 (two hard-requires in src/bongos/serve-internal.js; task 1824). The
@@ -81,9 +81,9 @@ function checkCoreRequiresExcludedConfig() {
 // require()s a boundary-EXCLUDED module (modules/game, modules/art-pipeline,
 // modules/character-anim, …) throws MODULE_NOT_FOUND once that module lives in the
 // consumer's instance repo rather than the core package (R89 split). The cure is
-// either to reclassify the module INTO core (if it belongs there — e.g. provisioning,
-// sibling of dev-box) or to exclude the requiring file with the feature it serves
-// (art tooling). Catches BOTH require forms: a direct literal
+// either to reclassify the module INTO core (if it belongs there — e.g. provisioning)
+// or to exclude the requiring file with the feature it serves (art tooling).
+// Catches BOTH require forms: a direct literal
 // require('../modules/<key>/…') AND a require(path.join(<root>, 'modules/<key>/…')).
 // Only an EXCLUDED module required from a PUBLISHABLE file is a violation; requiring a
 // publishable (core) module is fine, and the loader's DYNAMIC dispatch

package/scripts/gds/fitness-checks-write-validation.js

@@ -46,6 +46,10 @@ const WRITE_VALIDATION_EXEMPT = new Set([
   // the route's own express.raw parser and read by docx.readUpload, which refuses
   // anything that is not a bounded, readable Word file (not_a_docx / upload_too_large).
   'POST /copy-desk/pages/:pageId/draft.docx',
+  // Not a JSON body either: the raw module tarball (task 1004271, ADR 0338 D1), capped by
+  // the route's express.raw parser and read by module-artifact.verifyModuleArtifact, which
+  // recomputes every hash and refuses anything that is not a well-formed module version.
+  'POST /store/modules/:key/versions',
 ]);
 
 // KNOWN GAPS, NOT EXEMPTIONS (task 1002551 / BV1.R109b → tracked by task 1002552).

package/scripts/gds/fitness-ratchets.js

@@ -284,9 +284,9 @@ function knipIssueCount() {
 // baseline map leaves every `floor === undefined`, and compareToBaselines classifies
 // an absent floor as a WARNING — so a checkout with no config/ reported the ratchet
 // as PASSED. Measured: with the baselines gone, a planted 5,000-line and 94-cycle
-// regression produced 0 violations. That is not a hypothetical checkout — `config/`
-// is absent from every dev box's sparse slice, so the builders who most needed the
-// gate were the ones silently exempt from it, learning from red CI instead.
+// regression produced 0 violations. That was not a hypothetical checkout — a sparse
+// checkout without `config/` once left the builders who most needed the gate
+// silently exempt from it, learning from red CI instead.
 //
 // Distinguish the two absences, because they are not the same fact:
 //   - the FILE is missing/malformed  -> cannot verify anything -> hard fail (here);
@@ -315,7 +315,7 @@ function readBaselines(baselinePath = BASELINE_PATH) {
       metrics: {},
       error: missing
         ? `config/fitness-baselines.json is MISSING — the quality ratchet cannot verify anything, so it fails CLOSED rather than reporting a pass it did not check. `
-          + `If this is a dev box, config/ was historically outside the sparse checkout (task 1003227); re-sync the box (\`node scripts/gds/box-sync.js\`). `
+          + `If this is a sparse or partial checkout, take the whole tree (\`git sparse-checkout disable\`). `
           + `To bootstrap a fresh baseline deliberately: node scripts/gds/fitness-ratchets.js --update-baselines`
         : `config/fitness-baselines.json is unreadable (${e && e.message}) — failing CLOSED.`,
     };
@@ -350,7 +350,7 @@ const METRIC_HINTS = {
   legacy_api_gds_callers:
     ' — a NEW in-repo caller was written against the permanent `/api/gds` alias (task 1004064, '
     + 'idea 1001030). Ask for `/api/bongos` instead: the alias exists for callers we CANNOT update '
-    + '(shipped Dev Box binaries, live dev boxes), not for code in this repo. Run '
+    + '(shipped binaries, live instances), not for code in this repo. Run '
     + '`node scripts/gds/api-alias-caller-scan.js --files` to see every counted line. The alias '
     + 'contract, the pinned OAuth callbacks, the uptime poller + smoke, the rename guardrails, '
     + 'tests/, docs/, migrations/ and captured fixtures are excluded by construction — and so is '

package/scripts/gds/fitness.js

@@ -343,11 +343,11 @@ function checkDeterministicRoutines() {
 // published doorway); the core NEVER imports a module; a module NEVER imports a
 // sibling module. These two checks enforce it.
 //
-// Both were GREEN through the strangler: dev-box + art-pipeline (the M07/M08
-// moves) import only the doorway, and the core imports neither. The boundary
+// Both were GREEN through the strangler: the first two moved modules (M07/M08)
+// imported only the doorway, and the core imported neither. The boundary
 // shipped in WARN mode so a half-moved module mid-migration couldn't red the
 // build; BV1.R45 (task 1414) flips it to ENFORCING now that the first move
-// (dev-box, M07) proved clean — the monotonic ratchet (ADR 0062 §9 / design
+// (M07) proved clean — the monotonic ratchet (ADR 0062 §9 / design
 // 04§3). A NEW cross-boundary import is now a red build; warn-mode is gone.
 let MODULE_BOUNDARY_ENFORCING = true;
 const MODULE_API_REL = 'src/module-api.js';
@@ -497,7 +497,7 @@ function checkScopeMapImportsProtected() {
 // module-AGNOSTIC: it discovers, validates, and mounts modules uniformly and may
 // never special-case one by name. The import checks (Check 7/8) stop a module's
 // CODE from being reached by `require`; this stops a module's IDENTITY from being
-// hardcoded into the kernel (`if (key === 'dev-box') …`, a copied module helper,
+// hardcoded into the kernel (`if (key === 'art-pipeline') …`, a copied module helper,
 // a registry entry that should have moved out). "No module-specific code" is
 // operationalized as the one drift-free signal — the kernel names no discovered
 // module KEY (the canonical id from modules/<key>/module.json). Domain terms are
@@ -606,14 +606,14 @@ const KERNEL_FILES = [
 // Kernel files exempt from the no-module-keys scan (Check 10) because naming a
 // module is, for them, the JOB — they stay in KERNEL_FILES for the import check
 // (Check 12), which guards dependency *direction* (a much stronger guarantee than
-// "never write the string 'dev-box'"). Two legitimate reasons a kernel file names
+// "never write the string 'art-pipeline'"). Two legitimate reasons a kernel file names
 // a module:
 //   • the REGISTRY — module-scope-map.js IS the module→path map (and
 //     checkScopeMapImportsProtected already guards how it derives `protected`).
 //   • the TRUST BOUNDARY — auth.js carries the Discord OAuth account-LINK flow
 //     (core by design — see modules/discord/CLAUDE.md "NOT in this module"); and
 //     permission-path-check.js / route-rank-check.js MUST name module path
-//     subtrees ('modules/dev-box/', …) to protect + rank-gate them. Forbidding
+//     subtrees ('modules/grading/', …) to protect + rank-gate them. Forbidding
 //     these the string would force the trust layer to stop protecting module
 //     surfaces — exactly backwards. The generic machinery + data + config files
 //     (module-api, the loader, db-kernel, secret-box, pool, _helpers, branding,
@@ -683,8 +683,8 @@ function moduleDir(key) {
   return path.join(CORE_ROOT, 'modules', key);
 }
 
-// Match a module key as a DELIMITED token so `dev-box` hits in `'dev-box'` /
-// `mount('dev-box')` but never inside `dev-boxes` or `xdev-box`. Hyphens are
+// Match a module key as a DELIMITED token so `art-pipeline` hits in `'art-pipeline'` /
+// `mount('art-pipeline')` but never inside `art-pipelines` or `xart-pipeline`. Hyphens are
 // non-word chars, so the boundary guards against word-chars AND hyphens on both
 // sides (no lookbehind — portable on every node the unit gate runs).
 function keyTokenRe(key) {
@@ -816,7 +816,7 @@ function checkKernelImportsNoDomain() {
 //     migrations," never "drop its tables" (ADR 0083 §Module-owned migrations);
 //     there is no down path, so a DROP/TRUNCATE can only be an accident.
 //   • NAMESPACED — every object it CREATEs lives under the <key>_ prefix
-//     (dev-box → dev_box_), and it may only ALTER its own namespaced tables;
+//     (art-pipeline → art_pipeline_), and it may only ALTER its own namespaced tables;
 //     core/sibling state is reached through the doorway/seams, never raw DDL.
 //
 // LEGACY_NAMESPACED: tables that predate the <key>_-prefix convention (created before the module
@@ -848,7 +848,7 @@ const CREATE_OBJ_RE = /\bcreate\s+(?:or\s+replace\s+)?(?:unique\s+)?(?:materiali
 const CREATE_INDEX_RE = /\bcreate\s+(?:unique\s+)?index\s+(?:concurrently\s+)?(?:if\s+not\s+exists\s+)?(?:"?[\w.]+"?)\s+on\s+(?:only\s+)?("?[\w.]+"?)/gi;
 const ALTER_TABLE_RE = /\balter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?("?[\w.]+"?)/gi;
 
-// SQL object-namespace prefix for a module key: dev-box → dev_box (SQL-safe).
+// SQL object-namespace prefix for a module key: art-pipeline → art_pipeline (SQL-safe).
 function moduleNamespace(key) { return key.replace(/-/g, '_'); }
 
 // strip SQL comments so a commented-out statement is never scanned

package/scripts/gds/gen-api-client.js

@@ -208,8 +208,8 @@ function stripEsmExports(esm) {
     .replace(/^export default createClient;\n?/m, '');
 }
 
-// index.cjs — for Node consumers that use require() (e.g. the devbox Electron
-// app, which is a zero-dep CJS subproject and vendors this file at package time).
+// index.cjs — for Node consumers that use require() (e.g. a zero-dep CJS subproject
+// that vendors this file at package time).
 function renderClientCjs(esm) {
   const header =
     '// @bongos/client (CommonJS build) — GENERATED from index.mjs by\n' +
@@ -394,8 +394,8 @@ function renderPackageJson(spec) {
     // updated while the API it is generated FROM moved 500+ core versions. It had zero consumers
     // the whole time: nothing across the core or any instance repo ever declared it as a
     // dependency — every consumer VENDORS a copy instead. That was two places when this was
-    // written; task 1003891 deleted the Dev Box Electron app and ADR 0324 retired
-    // @cloudbongos/cli, so there is now no vendoring consumer left at all. The
+    // written; both have since been deleted or retired (ADR 0324 retired
+    // @cloudbongos/cli), so there is now no vendoring consumer left at all. The
     // owner removed it from the registry on 2026-09-09.
     //
     // The manifest itself stays: `main`/`types`/`exports` are what make the vendored copy and a

package/scripts/gds/gen-api-docs.js

@@ -837,7 +837,7 @@ function buildOpenapi(model) {
       license: { name: 'AGPL-3.0-or-later', url: 'https://www.gnu.org/licenses/agpl-3.0.html' },
       description: [
         `The Bongos API — the build-methodology backend`,
-        `(builders, tasks, claims, credits, grading, memory, dev boxes).`,
+        `(builders, tasks, claims, credits, grading, memory).`,
         ``,
         `**API version:** \`${API_VERSION}\` — served at \`${VERSIONED_API_PREFIX}\`. The`,
         `unversioned \`${API_PREFIX}\` and legacy \`/api/gds\` are permanent aliases`,