@bongos/core 1.19.1073 → 1.19.1075

package/scripts/gds/gen-diagrams.js

@@ -8,9 +8,9 @@
 //   05-versioning          ← live versions (id/status)
 //   03-drachmae-karma      ← per-piece backing-task status + seeded-achievement count
 //   04-architecture        ← per-piece backing-task status: the ADR 0024 memory
-//                            chain + the dev-box / box→prod ship flow, merged into
-//                            one "complete architecture" map (was 04-server-repo-
-//                            memory + 06-dev-box; consolidated under task 1059)
+//                            chain + the machine → prod ship flow, in one
+//                            "complete architecture" map (consolidated under
+//                            task 1059)
 //
 // It writes each .mmd from a template, renders the SVG (crisp, pannable) + PNG
 // (fallback) via scripts/render-diagrams.sh, and rewrites the data-driven slices
@@ -332,17 +332,18 @@ function drachmaeKarmaMmd(f) {
 }
 
 // 04-architecture. The complete picture: where a builder's work runs and how it
-// reaches production, with the per-builder memory layer (ADR 0024) folded in.
-// Merges the old 04-server-repo-memory (the three layers) + 06-dev-box (the box
-// → prod ship flow) into one map (task 1059), collapsing the SERVER they both
-// drew. Conceptual like 03: every feature-piece + flow edge is LIVE/solid iff its
-// backing Bongos task is 'shipped', dotted/PLANNED otherwise — so the map is an
-// honest snapshot that flips itself as pieces ship (or regresses if one is
+// reaches production, with the per-builder memory layer (ADR 0024) folded in
+// (task 1059). Conceptual like 03: every feature-piece + flow edge is LIVE/solid
+// iff its backing Bongos task is 'shipped', dotted/PLANNED otherwise — so the map
+// is an honest snapshot that flips itself as pieces ship (or regresses if one is
 // reopened). Pieces → live task ids:
 //   memory layer  : 273 schema · 274 sync-on-ship · 275 pull-on-start · 276 isolation
-//   dev box       : 904 desktop app · 774 browser terminal · 897 sandbox preview · 919 box token
-//   box → prod    : 1025 publish-via-server · 859 CI deploy · 1028 GitHub App push credential
-//   end-to-end    : 1027 hardware-verify (no node of its own; gates the closing note)
+//   ship flow     : 1025 publish-via-server · 1028 GitHub App push credential
+// Work runs on the builder's own machine, in a clone of the instance repo. It
+// reaches main one of two ways (ship-deploy-target.js `pushVia`): a machine
+// signed in to GitHub pushes its branch and opens the PR itself; a checkout with
+// no push credential uploads the branch as a git bundle and the SERVER pushes it
+// with its own credential (ADR 0055).
 function architectureMmd(f) {
   const c = f.conceptual;
   const { host } = brand();
@@ -370,16 +371,16 @@ function architectureMmd(f) {
     ? 'SRVMEM -->|"pull on session start"| LOCAL'
     : 'SRVMEM -.->|"pull on session start — PLANNED"| LOCAL';
 
-  // --- box → prod credential + closing note ---
+  // --- ship flow: the server's push credential + closing note ---
   const pushCred = shipped(1028)
     ? 'GitHub App, short-lived tokens'
     : 'standing push PAT (GitHub App pending — 1028)';
-  // The whole box→prod chain LIVE? (all the gated legs + the end-to-end verify.)
-  // NB the deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated
-  // GitHub-Actions CI job — so 859 (CI deploy) is intentionally NOT in this set.
-  const chainLive = [919, 897, 904, 774, 1025, 1028, 1027].every(shipped);
+  // Both ways onto main LIVE? NB the deploy leg is the standalone AUTO-PULL
+  // (ADR 0108/0129), not a task-gated GitHub-Actions CI job — so 859 (CI deploy)
+  // is intentionally NOT in this set.
+  const chainLive = [1025, 1028].every(shipped);
   const closingNote = chainLive
-    ? 'The whole box → production path is LIVE: a credential-less box uploads its branch, the server merges it, and the instance auto-pulls + redeploys — hardware-verified end-to-end (1027 · 1028).'
+    ? 'Both ways onto main work today: a machine signed in to GitHub pushes its own branch, and a checkout without a push credential uploads it for the server to push. Either way the instance auto-pulls and redeploys.'
     : `Still landing (PLANNED): the server-mediated publish (${tag(1025)} · 1025) and the GitHub App push credential (${tag(1028)} · 1028).`;
 
   // Product-neutral runtime label: the instance's own product name (branding),
@@ -389,30 +390,22 @@ function architectureMmd(f) {
   const appLabel = productName && productName !== 'Cloud Bongos' ? productName : 'app';
 
   // Layout: ELK engine, top-down (task 1066). ELK minimizes edge crossings far
-  // better than the default renderer — this map is edge-dense and was a tangle
-  // before. Two more declutter moves: (1) the INTRA-cluster wiring (worker→its
-  // files, api→db/rank, db→memory-store) is dropped — co-location inside a
-  // labelled subgraph already says "these belong together", and drawing it added
-  // depth + crossings; only the CROSS-cluster flow (the numbered ship steps,
-  // memory sync, claim/ship, the blocked direct-push) is drawn. (2) Three
-  // low-signal annotation edges (box-token→bootstrap, DB-is-king, memory-
-  // follows-you) are folded into node labels. (3) WATERFALL ordering (task 1073,
-  // off Lars's "put the GitHub box last"): subgraphs are declared in flow order
-  // DEVICE→BOX→SERVER→GH, and the live app (the instance's product runtime) is
-  // pulled OUT of the SERVER cluster into its own terminal node at the very
-  // bottom (annotated "same server · same Node process" so it stays honest).
-  // That makes the map one monotonic top-down spine — device→box→server→github→
-  // live app — where the deploy is the LAST forward step instead of an edge
-  // looping back UP into the server. So SERVER tucks directly under BOX and the
-  // BOX↔SERVER wires (re-auth, upload, sync, pull, claim/ship) become short hops
-  // instead of detouring the full height past a mid-stack GitHub. The deploy is
-  // the STANDALONE auto-pull (ADR 0108/0129): merge to the instance's own main →
-  // the server pulls its own repo → migrate/regenerate/restart → the live app —
-  // NOT a GitHub-Actions push-deploy (that was the reference monorepo's model).
-  // NOTE on direction: we keep TB,
-  // not a repo-on-the-left LR/RL — the flow is an ~8-deep linear chain, so a
-  // sideways layout stretches into an unreadable ~5:1 strip; top-down keeps a
-  // legible aspect.
+  // better than the default renderer. Two declutter moves: (1) the INTRA-cluster
+  // wiring (worker→its files, api→db/rank, db→memory-store) is dropped —
+  // co-location inside a labelled subgraph already says "these belong together";
+  // only the CROSS-cluster flow (the numbered ship steps, memory sync,
+  // claim/ship) is drawn. (2) Low-signal annotation edges (DB-is-king,
+  // memory-follows-you) are folded into node labels. WATERFALL ordering (task
+  // 1073, off Lars's "put the GitHub box last"): subgraphs are declared in flow
+  // order MACHINE→SERVER→GH, and the live app (the instance's product runtime)
+  // is pulled OUT of the SERVER cluster into its own terminal node at the very
+  // bottom (annotated "same server · same Node process" so it stays honest), so
+  // the deploy is the LAST forward step instead of an edge looping back UP into
+  // the server. The deploy is the STANDALONE auto-pull (ADR 0108/0129): merge to
+  // the instance's own main → the server pulls its own repo →
+  // migrate/regenerate/restart → the live app — NOT a GitHub-Actions push-deploy
+  // (that was the reference monorepo's model). NOTE on direction: we keep TB,
+  // not LR — a sideways layout stretches the chain into an unreadable strip.
   const lines = [
     '---',
     'title: The complete architecture — where your work runs and how it reaches production  (AUTO-GENERATED from live facts — do not hand-edit; see scripts/gds/gen-diagrams.js)',
@@ -420,18 +413,10 @@ function architectureMmd(f) {
     '  layout: elk',
     '---',
     'flowchart TB',
-    '    subgraph DEVICE["YOUR DEVICE — only the screen lives here"]',
-    '        APP["Claude desktop app or browser tab\\n(shows files · sends your messages · holds NO code)"]',
-    '    end',
-    '',
-    '    subgraph BOX["DEV BOX — a machine WE create on DigitalOcean (gated · revocable · audited; Metic+ may instead clone locally)"]',
-    '        WORKER["Claude Code WORKER\\n(opens files · runs commands · runs the /builder-* skills)"]',
-    `        CODE["the code — git clone + per-builder worktrees (.claude/worktrees/*)\\nfor sub-Metic builders it lives ONLY here · CLAUDE.md is DESCRIPTIVE only"]`,
+    '    subgraph MACHINE["YOUR MACHINE — a clone of the instance repo"]',
+    '        WORKER["Claude Code — the desktop app or the terminal\\n(opens files · runs commands · runs the /builder-* skills)"]',
+    '        CODE["the code — git clone + per-task worktrees (.claude/worktrees/*)\\nCLAUDE.md is DESCRIPTIVE only"]',
     '        LOCAL["local ~/.claude memory\\nMAP = MEMORY.md — a one-line index loaded EVERY session\\n(a guard + auto-tidy keep it light; ADR 0074)\\n+ drawer of full notes, loaded only on demand"]',
-    '        ORIGIN["credential-less git origin\\n(NO GitHub push secret on the box — by design)"]',
-    `        BOXTOK["box-scoped Bongos token\\n(deny-by-default: bootstrap endpoints only;\\nrejected for branch upload → re-auth first — ${tag(919)})"]`,
-    `        PREVIEW["sandbox preview server on :3000\\n→ a per-builder sandbox URL (${tag(897)})"]`,
-    `        SWITCH["on / off + browser terminal\\n(desktop app ${tag(904)} · ttyd-over-tunnel ${tag(774)})"]`,
     '    end',
     '',
     `    subgraph SERVER["THE INSTANCE SERVER — ${host} (the authority AND production)"]`,
@@ -440,7 +425,7 @@ function architectureMmd(f) {
     '        DB["Postgres — tasks · claims · versions · builders.rank\\ncredit_log · grades · idea_inbox · builder_memory\\n(KING for work-state + permissions; CLAUDE.md only describes it)"]',
     '        RANK["auth.requireRank — checked per request, NO caching\\n(ADR 0016: a demotion takes effect on the next request)"]',
     `        SRVMEM["server-side builder_memory store\\n${memLead}: per-builder · isolated · forensic read at Metic+ (ADR 0157)\\nyour memory follows you across machines & worktrees\\n/recall fetches only the relevant subset (ADR 0060)\\n(${memStatus})"]`,
-    `        PUSHTOK["server-held push credential\\n(${pushCred} — the box never holds it)"]`,
+    `        PUSHTOK["server-held push credential\\n(${pushCred} — for a checkout that has none of its own)"]`,
     '        DEPLOY["auto-pull deploy (ADR 0129)\\na timer pulls THIS instance repo every ~2 min →\\nnpm ci if the pin changed → migrate → regenerate docs → restart → healthz"]',
     '    end',
     '',
@@ -450,17 +435,14 @@ function architectureMmd(f) {
     '',
     `    LIVEAPP["the live ${appLabel} — ${host}\\n(same server · same Node process as /api/bongos/*)"]`,
     '',
-    '    APP -->|"1 · toggle box on / open terminal"| SWITCH',
-    '    SWITCH --> WORKER',
-    '    WORKER -->|"2 · edit + commit"| CODE',
-    '    WORKER -->|"3 · re-auth in browser"| API',
-    flow('WORKER', 1025, '4 · upload branch as a git bundle', 'API'),
-    flow('API', 1025, `5 · push + open PR + auto-merge (${tag(1025)})`, 'MAIN'),
-    '    MAIN -->|"6 · the instance auto-pulls its own main"| DEPLOY',
-    '    DEPLOY -->|"7 · migrate · regenerate docs · restart"| LIVEAPP',
+    '    WORKER -->|"1 · edit + commit"| CODE',
+    '    WORKER -->|"2 · push the branch + open a PR (a machine signed in to GitHub)"| MAIN',
+    flow('WORKER', 1025, '2 · or upload the branch as a git bundle (no push credential here)', 'API'),
+    flow('API', 1025, `3 · the server pushes it + opens the PR (${tag(1025)})`, 'MAIN'),
+    '    MAIN -->|"4 · the instance auto-pulls its own main"| DEPLOY',
+    '    DEPLOY -->|"5 · migrate · regenerate docs · restart"| LIVEAPP',
     '    CORE --- API',
     '    PUSHTOK -.-> API',
-    '    ORIGIN -. "direct push blocked" .-> MAIN',
     '    API -. "claim / ship / cost" .-> WORKER',
     `    ${pushEdge}`,
     `    ${pullEdge}`,
@@ -500,20 +482,16 @@ function rebuildAssertions(prev, f) {
       pending_tasks: ids.filter((id) => !shipped(id)).map(entry),
     });
 
-    // 04-architecture — the ADR 0024 memory chain + the dev-box / box→prod ship
-    // flow, merged (task 1059). A piece is LIVE iff its backing task is shipped.
-    const arch = split([273, 274, 275, 276, 904, 774, 897, 919, 1025, 1027, 1028]);
+    // 04-architecture — the ADR 0024 memory chain + the machine → prod ship
+    // flow (task 1059). A piece is LIVE iff its backing task is shipped.
+    const arch = split([273, 274, 275, 276, 1025, 1028]);
     next.architecture = {
       diagram: '04-architecture',
       _comment:
-        "Pieces of 04-architecture gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/gds/gen-diagrams.js in lockstep with the diagram, so this is the drift checker's backstop. The device/box/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. DEV BOX + box→prod: 904/774 (on-off + browser terminal), 897 (sandbox preview), 919 (scoped box token), 1025 (server-mediated publish), 1028 (GitHub App push credential), 1027 (end-to-end hardware-verify). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent. Supersedes the old server_repo_memory + dev_box slices.",
+        "Pieces of 04-architecture gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/gds/gen-diagrams.js in lockstep with the diagram, so this is the drift checker's backstop. The machine/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. Ship flow: 1025 (server-mediated publish, for a checkout with no push credential), 1028 (GitHub App push credential). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent.",
       live_tasks: arch.live_tasks,
       pending_tasks: arch.pending_tasks,
     };
-    // Drop the two slices this diagram replaced so the file (and drift checker)
-    // never carry stale keys after the 04+06 consolidation.
-    delete next.server_repo_memory;
-    delete next.dev_box;
 
     // 03-drachmae-karma — bounty + karma pieces (D_SHIP/D_ACH have no task gate).
     const dk = split([284, 286, 282, 245, 248, 246]);

package/scripts/gds/gen-repo-map.js

@@ -11,7 +11,7 @@
 //       interpretive prose stays put while the file list / signatures can't silently drift.
 //
 // Zero-dependency on purpose: the codebase is CommonJS JS, and a portable-core capability must
-// regenerate in CI and on every dev box with no native build / no node-gyp / no WASM grammar to
+// regenerate in CI and on any checkout with no native build / no node-gyp / no WASM grammar to
 // fetch (the whole point of Paths B+C is keeping every instance navigable cheaply). A line+regex
 // extractor is accurate enough for an *advisory* navigation aid (it is not a compiler input). A
 // richer tree-sitter/WASM backend can slot in behind extractFile() later for polyglot instances
@@ -25,9 +25,9 @@
 //   node scripts/gds/gen-repo-map.js --check-block # exit 2 only if a TRACKED nested block would change (the CI gate)
 //   node scripts/gds/gen-repo-map.js --check-whole # exit 2 only if docs/repo-map.md would change
 //   node scripts/gds/gen-repo-map.js --whole-only  # WRITE docs/repo-map.md only; never touch the
-//                                                  # tracked nested blocks (what a SPARSE dev-box
+//                                                  # tracked nested blocks (what a SPARSE
 //                                                  # checkout must use — task 1002962)
-// docs/repo-map.md is GITIGNORED + regenerated at deploy/box-fetch since ADR 0110 (task 1926);
+// docs/repo-map.md is GITIGNORED + regenerated at deploy since ADR 0110 (task 1926);
 // only the nested-doc symbol blocks stay tracked, so CI gates the block bucket, not the whole file.
 //   node scripts/gds/gen-repo-map.js --json       # print the extracted model as JSON (debug)
 
@@ -458,7 +458,7 @@ function injectBlock(existing, block) {
 function main() {
   // Two artifact BUCKETS, gated separately since ADR 0110 (task 1926):
   //   • 'whole' — docs/repo-map.md, which is now GITIGNORED and regenerated at
-  //     deploy / box-source-fetch (the gen-atlas.js model), so it carries no
+  //     deploy (the gen-atlas.js model), so it carries no
   //     committed copy and two parallel branches can never collide on it.
   //   • 'block' — the generated symbol BLOCK inside each nested CLAUDE.md, which
   //     stays hand-written prose + a tracked block, so it MUST stay fresh in git.
@@ -472,16 +472,15 @@ function main() {
   // 1002962). --whole-only regenerates the GITIGNORED docs/repo-map.md and leaves
   // the TRACKED nested blocks alone.
   //
-  // WHY a caller ever needs this: a dev box is a SPARSE checkout (box-access.js
-  // materializes only the claim's module cone). The block ordering is
-  // `b.refs - a.refs || name`, and `refs` counts references across the VISIBLE
-  // corpus — so a box with 7 of 20 modules computes different counts and emits a
-  // legitimately different block. Written into a tracked file that dirties the
-  // working tree, and box-source-fetch.sh's NEXT `git pull` aborts with "local
-  // changes would be overwritten" — a silent, permanent sync deadlock (one box sat
-  // 257 commits behind for three days). A box CONSUMES these blocks; they arrive
-  // correct with the pull, generated by CI from the whole tree. Only a full
-  // checkout may produce them.
+  // WHY a caller ever needs this: a SPARSE checkout materializes only part of the
+  // tree. The block ordering is `b.refs - a.refs || name`, and `refs` counts
+  // references across the VISIBLE corpus — so a checkout with 7 of 20 modules
+  // computes different counts and emits a legitimately different block. Written
+  // into a tracked file that dirties the working tree, and the NEXT `git pull`
+  // aborts with "local changes would be overwritten" — a silent, permanent sync
+  // deadlock (one checkout sat 257 commits behind for three days). A sparse
+  // checkout CONSUMES these blocks; they arrive correct with the pull, generated
+  // by CI from the whole tree. Only a full checkout may produce them.
   const wholeOnly = process.argv.includes('--whole-only');
   const model = buildModel();
 

package/scripts/gds/gen-session-index.js

@@ -26,8 +26,8 @@
 //   node scripts/gds/gen-session-index.js --check-block # exit 2 only if the tracked CLAUDE.md §13 snippet drifts (CI gate)
 //   node scripts/gds/gen-session-index.js --check-whole # exit 2 only if docs/session-log-index.md drifts
 //   node scripts/gds/gen-session-index.js --whole-only  # WRITE the index only; never touch the tracked
-//                                                       # CLAUDE.md snippet (sparse dev-box use; task 1002962)
-// docs/session-log-index.md is GITIGNORED + regenerated at deploy/box-fetch since ADR 0110 (task 1926).
+//                                                       # CLAUDE.md snippet (sparse-checkout use; task 1002962)
+// docs/session-log-index.md is GITIGNORED + regenerated at deploy since ADR 0110 (task 1926).
 //   node scripts/gds/gen-session-index.js --json       # print the parsed entries as JSON (debug)
 
 const fs = require('node:fs');
@@ -164,7 +164,7 @@ function computeWrites() {
   const writes = [];
 
   // Two buckets (ADR 0110, task 1926): 'whole' = docs/session-log-index.md, now
-  // GITIGNORED + regenerated at deploy/box-fetch (no committed copy → no branch
+  // GITIGNORED + regenerated at deploy (no committed copy → no branch
   // collisions); 'block' = the bounded CLAUDE.md §13 snippet, still tracked, so it
   // stays a HARD CI gate. main() gates them separately (--check-block vs --check-whole).
   const idxNext = renderIndex(entries);
@@ -197,11 +197,11 @@ function main() {
     return;
   }
   // WRITE-side bucket selection — the sibling of the --check-* flags (task 1002962,
-  // the gen-repo-map --whole-only twin). A dev box is a SPARSE checkout, so writing
-  // the TRACKED bucket there dirties the tree and the next `git pull` in
-  // box-source-fetch.sh aborts on "local changes would be overwritten" — a silent,
-  // permanent sync deadlock. A box regenerates only the gitignored artifact; the
-  // tracked CLAUDE.md §13 snippet arrives with the pull, generated from the whole tree.
+  // the gen-repo-map --whole-only twin). On a SPARSE checkout, writing the TRACKED
+  // bucket dirties the tree and the next `git pull` aborts on "local changes would
+  // be overwritten" — a silent, permanent sync deadlock. A sparse checkout
+  // regenerates only the gitignored artifact; the tracked CLAUDE.md §13 snippet
+  // arrives with the pull, generated from the whole tree.
   const wholeOnly = process.argv.includes('--whole-only');
   const all = computeWrites().writes;
   const writes = wholeOnly ? all.filter((w) => w.bucket === 'whole') : all;

package/scripts/gds/http-api-client.js

@@ -1,24 +1,18 @@
-// scripts/gds/http-api-client.js — the shared skeleton behind the control plane's
-// two JSON-over-HTTP clients: scripts/gds/do-api.js (DoApi, DigitalOcean) and
-// scripts/gds/cf-tunnel.js (CfTunnelApi, Cloudflare). Both are thin, injectable-
-// transport, dry-run-by-default wrappers with a byte-identical request skeleton
-// (do-api.js's design note: the box subsystem keeps "ONE shape for every external
-// API"). This base IS that one shape.
+// scripts/gds/http-api-client.js — the request skeleton behind the control
+// plane's JSON-over-HTTP client, scripts/gds/do-api.js (DoApi, DigitalOcean): a
+// thin, injectable-transport, dry-run-by-default wrapper. It is kept apart from
+// do-api.js so the ONE request shape stays reusable by any future client.
 //
-// The genuine per-API differences stay in the subclasses via three small hooks:
-//   - the constructor's OWN live-mode validation (the "missing X" messages and the
-//     order they fire in differ, and tests assert both);
-//   - requestInit() — extra fetch options (Cloudflare pins an IPv4 dispatcher,
-//     #771; DigitalOcean sends none);
+// Per-API differences go in a subclass via three small hooks:
+//   - the constructor's OWN live-mode validation (its "missing X" messages);
+//   - requestInit() — extra fetch options (DigitalOcean sends none);
 //   - detectError() — what counts as a failure + how the message is extracted
-//     (DigitalOcean = non-2xx → message/id; Cloudflare also fails the {success:false}
-//     envelope and joins errors[]).
+//     (DigitalOcean = non-2xx → message/id).
 //
-// Behaviour-neutral extraction: pinned by tests/boxes.mjs (DoApi) and
-// tests/cf_tunnel.mjs (CfTunnelApi).
+// Pinned by tests/do_api.mjs.
 
 // Build a distinct, named API-error class. Each client makes its own so the
-// `instanceof` checks the tests rely on (DoApiError vs CfApiError) stay meaningful
+// `instanceof` checks the tests rely on (DoApiError) stay meaningful
 // and the `.name` / `.code` carried on every thrown error survive unchanged.
 function makeApiError(name, code) {
   return class ApiError extends Error {
@@ -46,13 +40,12 @@ class JsonHttpApi {
     this._ErrorClass = ErrorClass;
   }
 
-  // Extra fetch init merged into every LIVE request. Base sends none; CfTunnelApi
-  // overrides to pin the IPv4 dispatcher (its token is IP-locked, #771).
+  // Extra fetch init merged into every LIVE request. Base sends none.
   requestInit() { return {}; }
 
   // Inspect a completed response. Return an error MESSAGE string to throw, or null
   // to accept. Base fails on a non-2xx HTTP status (DigitalOcean surfaces
-  // message/id); CfTunnelApi also fails the Cloudflare {success:false} envelope.
+  // message/id).
   detectError(res, json) {
     if (!res.ok) return (json && (json.message || json.id)) || `HTTP ${res.status}`;
     return null;

package/scripts/gds/init.js

@@ -79,7 +79,7 @@ const { detectStack, formatStackSummary } = require('./adopt-detect'); // ADR 01
 const { resolveBacklogTasks, DEFAULT_MAX: BACKLOG_MAX } = require('./adopt-import'); // ADR 0121 §Decision 3 (task 2044): import an existing backlog
 const { preflightAdopt, formatPreflight } = require('./adopt-preflight'); // ADR 0121 §Decision 5 (task 2045): the accept-gated conflict pre-flight
 
-const KNOWN_MODULES = ['game', 'art-pipeline', 'discord', 'dev-box'];
+const KNOWN_MODULES = ['game', 'art-pipeline', 'discord'];
 
 // The provisioning hosting shapes — a small mirror of modules/provisioning's
 // HOSTING_SHAPES. init deliberately does NOT import the (optional) provisioning

package/scripts/gds/leak-scan-allowlist.js

@@ -167,7 +167,7 @@ const FILE_ALLOWLIST = [
     path: 'tests/lib_sh_resolution.mjs',
     classes: ['token'],
     reason:
-      'Carries the host-identity scan pattern it runs over the baked box scripts — a detector '
+      'Carries the host-identity scan pattern it runs over the bash smoke scripts — a detector '
       + 'pattern, the same case as fitness-checks-identity.js.',
   },
   {

package/scripts/gds/lint-infra-exec.js

@@ -3,7 +3,7 @@
 // lint-infra-exec.js — task 2137 (ADR 0108 configurable-root). The dry-run/lint that proves every
 // host systemd unit running a CORE script still resolves AFTER the R89 split.
 //
-// The units (box-*, cohost-*, provision-*, search-index-db) keep living in the instance repo
+// The units (cohost-*, provision-*, search-index-db) keep living in the instance repo
 // (infra/ is host topology) while scripts/gds/ moves into node_modules/@bongos/core, so each
 // ExecStart runs through infra/core-node.sh, which resolves the script under the instance root OR
 // its node_modules/@bongos/core (both layouts). "Resolves in a consumer layout" is provable from

package/scripts/gds/local-preview-lib.js

@@ -1,15 +1,13 @@
 // scripts/gds/local-preview-lib.js — core of the LOCAL sandbox launcher (task 1056).
 //
-// Gives a builder working on a LOCAL full clone (laptop) the same private game
-// preview a dev box gets at sandbox-<login>.example.com (ADR 0044/0046/0052)
-// — but served at http://localhost:<port> on their OWN machine: no Cloudflare
-// tunnel, no public URL, $0. It runs the ADR 0052 game-only entry
-// (src/preview-server.js), which serves ONLY the playable game (no /api/bongos, no
-// BuildersHall), degraded-DB exactly like the box sandbox.
+// Gives a builder working on a LOCAL full clone a private game preview (ADR
+// 0044/0046/0052) served at http://localhost:<port> on their OWN machine: no
+// public URL, $0. It runs the ADR 0052 game-only entry (src/preview-server.js),
+// which serves ONLY the playable game (no /api/bongos, no BuildersHall),
+// degraded-DB.
 //
-// The preview is a long-running DETACHED background process (the laptop analogue
-// of the box's box-game-preview.service systemd unit). The edit loop mirrors the
-// box: edit -> restart -> refresh the browser tab.
+// The preview is a long-running DETACHED background process. The edit loop is:
+// edit -> restart -> refresh the browser tab.
 //
 // Everything is pure + injectable (deps.fs / deps.spawn / deps.kill /
 // deps.fetchImpl / deps.env / deps.*Path) so tests/local_preview.mjs can exercise
@@ -25,18 +23,6 @@ const path = require('node:path');
 const DEFAULT_PORT = 3100;
 const HOST = '127.0.0.1';
 
-// Box-only markers (ADR 0031/0044). ANY one ⇒ this is a provisioned dev box, NOT
-// a laptop. Deliberately broader than /etc/otb/box.env alone: a box whose box.env
-// was lost or is unreadable must still be recognized as a box, never mistaken for
-// a laptop — because the laptop path hands back a http://localhost preview URL,
-// which is unreachable from the builder's own browser when the server is on a
-// remote box (the task-1443 footgun: "the link is giving me localhost"). box.env
-// is the canonical marker; box-preview (the preview control command) and the
-// box-game-preview.service unit are written on every box and survive an
-// unreadable/empty box.env, so they're the resilient backstops.
-const BOX_ENV_PATH = '/etc/otb/box.env';
-const BOX_PREVIEW_WRAPPER = '/usr/local/bin/box-preview';
-const BOX_SERVICE_UNIT = '/etc/systemd/system/box-game-preview.service';
 // scripts/gds/ -> repo root. Absolute + cwd-independent so staging works no
 // matter where ship.js is invoked from.
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
@@ -62,22 +48,6 @@ function hasGameEntry(deps = {}) {
   return f.existsSync(previewEntry(deps));
 }
 
-// Is this a provisioned dev box (ADR 0031/0044), i.e. NOT a laptop? True if any
-// box-only marker is present. Pure + injectable (deps.fs + per-marker path
-// overrides) like everything else here, and honors the dep names sandbox-stage.js
-// already injects (deps.boxEnvPath / deps.previewWrapper) so a single call site
-// drives both. Used to keep the localhost local-preview path from EVER being
-// chosen on a box — see the BOX_* marker note above (task 1443).
-function onBox(deps = {}) {
-  const f = deps.fs || fs;
-  const markers = [
-    deps.boxEnvPath || BOX_ENV_PATH,
-    deps.previewWrapper || BOX_PREVIEW_WRAPPER,
-    deps.boxServiceUnit || BOX_SERVICE_UNIT,
-  ];
-  return markers.some((p) => { try { return f.existsSync(p); } catch { return false; } });
-}
-
 function readPid(deps = {}) {
   const f = deps.fs || fs;
   try {
@@ -152,8 +122,7 @@ async function health(deps = {}) {
 
 module.exports = {
   DEFAULT_PORT, HOST, REPO_ROOT,
-  BOX_ENV_PATH, BOX_PREVIEW_WRAPPER, BOX_SERVICE_UNIT,
   previewPort, localUrl, healthUrl, previewEntry, pidPath, logPath,
-  hasGameEntry, onBox, readPid, pidAlive, isRunning,
+  hasGameEntry, readPid, pidAlive, isRunning,
   start, stop, restart, health,
 };

package/scripts/gds/local-preview.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // scripts/gds/local-preview.js — the builder's control for the LOCAL game
-// preview (task 1056), the laptop analogue of `box-preview` (ADR 0044) on a dev
-// box. Runs the ADR 0052 game-only entry privately at http://localhost:<port>.
+// preview (task 1056, ADR 0044). Runs the ADR 0052 game-only entry privately at
+// http://localhost:<port>.
 //
 //   npm run preview                          # start it (then open the URL)
 //   node scripts/gds/local-preview.js status   is it up + the URL          (default)
@@ -27,21 +27,8 @@ async function pollHealthy(ms = 20_000) {
 
 const HINT = `Open ${lib.localUrl()} — your PRIVATE copy of the game (degraded DB, nothing shipped).`;
 
-// This launcher is the LAPTOP analogue of box-preview. On a dev box it's the
-// wrong tool: it binds http://localhost, which the builder's browser can't reach
-// when the server is on a remote box — the "the link is giving me localhost"
-// footgun (task 1443). Warn loudly and point at the box's HOSTED sandbox; warn,
-// don't hard-fail, so an operator who really wants a box-local loopback still can.
-function warnIfOnBox() {
-  if (!lib.onBox()) return;
-  console.error('⚠ You appear to be on a dev box. This LOCAL preview binds http://localhost —');
-  console.error('  your browser cannot reach the box\'s localhost. Your sandbox is the HOSTED url:');
-  console.error('  run  /builder-stage  (or  box-preview status )  to get https://sandbox-<login>.<host> and refresh that tab.');
-}
-
 (async () => {
   const cmd = process.argv[2] || 'status';
-  if (cmd === 'start' || cmd === 'restart' || cmd === 'status' || cmd === 'url') warnIfOnBox();
   switch (cmd) {
     case 'start': {
       const r = lib.start();

package/scripts/gds/migration-namespace.js

@@ -14,7 +14,7 @@
 // DISCIPLINE. Every migration SOURCE owns a distinct filename namespace, so stems can
 // never collide across sources and each source's allocator counts only its own numbers:
 //   • CORE      (the @bongos/core package's  migrations/*.sql)        → core_NNN_slug.sql
-//   • MODULE    (modules/<key>/migrations/*.sql)                           → <key>_NNN_slug.sql   (key: dev-box → dev_box_)
+//   • MODULE    (modules/<key>/migrations/*.sql)                           → <key>_NNN_slug.sql   (key: art-pipeline → art_pipeline_)
 //   • INSTANCE  (the host repo's                   migrations/instance/*.sql) → NNN_slug.sql        (BARE — the instance owns the bare namespace)
 //
 // The core prefix ALONE is enough to break stem-equality with a bare instance file
@@ -42,7 +42,7 @@ const INSTANCE_NS = 'instance';
 // Reserved namespace words a module key may not be (they name the core/instance sources).
 const RESERVED_NS = new Set([CORE_NS, INSTANCE_NS]);
 
-// SQL/filename-safe namespace prefix for a module key: dev-box → dev_box (matches
+// SQL/filename-safe namespace prefix for a module key: art-pipeline → art_pipeline (matches
 // fitness.js moduleNamespace + the existing economy_/lifecycle_ files).
 function sqlNamespace(moduleKey) {
   return String(moduleKey == null ? '' : moduleKey).replace(/-/g, '_');
@@ -70,7 +70,7 @@ const RENAMED_MODULE_PREFIXES = { government: new Set(['governance']) };
 
 const BARE_RE = /^(\d{3,})_(.+)\.sql$/;
 // A prefix is a lowercase word (letters/digits/underscores) starting with a letter,
-// then `_NNN_`. Lazy so `dev_box_003_x` splits as prefix=dev_box, num=003 (not dev/box).
+// then `_NNN_`. Lazy so `art_pipeline_003_x` splits as prefix=art_pipeline, num=003 (not art/pipeline).
 const PREFIXED_RE = /^([a-z][a-z0-9_]*?)_(\d{3,})_(.+)\.sql$/;
 
 // Parse a migration basename into { prefix, number, slug, bare, ok }. A non-migration