@bongos/core 1.19.1073 → 1.19.1075

package/src/bongos/platform-visibility-gate.js

@@ -65,7 +65,7 @@ const API = `(?:${ALL_API_PREFIXES.map(escRe).join('|')})`;
 //                        Caddy's on-demand-TLS `ask` and the provisioning probe —
 //                        server-to-server, cookie-less, and on a control plane a
 //                        refused ask means no project ever gets a certificate.
-//   /downloads/*         the installer script and the Dev Box updater — a
+//   /downloads/*         the installer script and the release downloads — a
 //                        cookie-less `curl … | sh`, and release redirects carry
 //                        no project data.
 //   /__prelaunch         the pre-launch gate's own submit, when both gates are on.

package/src/bongos/route-rank-check.js

@@ -221,9 +221,7 @@ const EXPECTED_RANKS = {
   //  criterion confirmation, and gate-approvals — moved to MODULE_EXPECTED_RANKS
   //  ['lifecycle'] below in BV1.R86. They live in the lifecycle module now
   //  (modules/lifecycle/routes/…), so they're verified only when that module is in
-  //  scope, not unconditionally from this core list — the pins follow the routes,
-  //  the dev-box precedent.)
-  // (dev-box fleet pins likewise live in MODULE_EXPECTED_RANKS below — BV1.R43.)
+  //  scope, not unconditionally from this core list — the pins follow the routes.)
   // security engagement docs — exploit-detail report store (task 991). Pinned
   // because a silent downgrade here leaks the attacker cookbook below the
   // trust line. (security-the-PROPERTY stays kernel — routes/security.js.)
@@ -277,10 +275,8 @@ const GOVERNMENT_PINS = {
 // when that module is in scope (its routes were discovered in this scan). So an
 // instance that doesn't ship the module — or a hermetic test isolating a
 // different module — never trips a false "vanished" alarm, while a real rank
-// downgrade or a removal IS still caught wherever the module is present. (dev-box's
-// box-fleet routes moved here from EXPECTED_RANKS in BV1.R43 / task 1412 — the pins
-// follow the routes; the intent is unchanged: closing/blocking another builder's
-// paid infra, and reading the fleet/cost roster, stay archon-only.)
+// downgrade or a removal IS still caught wherever the module is present — the pins
+// follow the routes (BV1.R43 / task 1412 moved the first set here).
 //
 // The `ideas` / `memory` / `security` blocks were added in BV1.R109b: their routes are
 // declared multi-line and so were invisible to this auditor until it learned that form
@@ -293,15 +289,6 @@ const GOVERNMENT_PINS = {
 // (metic), `security.report.adjudicate` / `idea.ratify` / `memory.read.any` (archon) —
 // so tightening these to `perm:` pins is a clean follow-up once R104-R107 have landed.
 const MODULE_EXPECTED_RANKS = {
-  'dev-box': {
-    // ADR 0157 lowered `box.fleet.manage` archon→metic (operating paid infra is admin
-    // work, not an authority grant). Re-pinned by ATOM so the guarded invariant is
-    // "these gate on the fleet permission", independent of its floor.
-    'GET /boxes': 'perm:box.fleet.manage',
-    'GET /boxes/cost-ledger': 'perm:box.fleet.manage',
-    'POST /boxes/:builderId/close': 'perm:box.fleet.manage',
-    'PATCH /boxes/:builderId/block': 'perm:box.fleet.manage',
-  },
   // The lifecycle module's privileged routes (carved BV1.R86 — the pins follow the
   // routes from EXPECTED_RANKS). Verified only when the lifecycle module is in scope.
   lifecycle: {

package/src/bongos/routes/auth.js

@@ -13,7 +13,6 @@
 //   - /auth/discord/*     LINKING an existing builder to a Discord id for role sync.
 //                         It is NOT a way to sign in — Discord sits OUTSIDE the trust
 //                         boundary (ADR 0032), so it can never mint a session.
-//   - /auth/app-pair/*    the Dev Box desktop app pairing to its builder (ADR 0045).
 //
 // TWO INVARIANTS worth keeping in view before editing:
 //   - `/auth/cli-token/issue` mints a CLI bearer from a browser COOKIE, never from a
@@ -36,7 +35,6 @@ const { reportActivityRollupForShippedTask } = require('../auth-admission.js');
 // endpoint refuses. Same composed answer the gate itself reads.
 const { effectiveJoinDoor } = require('../project-door.js');
 const db = require('../db');
-const { pairStore } = require('../app-pair');
 const { publicOrigin, parseCookie, validateOrRespond } = require('./_helpers');
 const { accountExistenceReadRateLimit } = require('../middleware/rate-limit');
 const { branding } = require('../../branding');
@@ -1162,120 +1160,6 @@ module.exports = function buildAuthRouter() {
     }
   });
 
-  // /auth/app-pair — browser-clicks-only sign-in for the Dev Box desktop app
-  // (#904, ADR 0045). The app starts a pairing, opens the browser at
-  // /builders/pair?code=…, the signed-in builder clicks ONE Approve button,
-  // and the app collects a freshly-minted source='cli' session over its own
-  // secret poll channel. Design + threat model in src/bongos/app-pair.js.
-  //
-  // Route order note: the two PUBLIC routes here sit so no requireBuilder/
-  // requireRank from a NEIGHBORING declaration falls inside route-rank-check's
-  // 20-line look-ahead — the deterministic auditor must classify them from
-  // their own `rank:` annotations, not a false middleware hit.
-
-  // rank: public — starts a pairing; returns opaque codes only, no identity.
-  router.post('/auth/app-pair/start', (req, res) => {
-    if (validateOrRespond(req, res, {
-      device_name: { type: 'string', maxLength: 80 },
-      platform: { type: 'string', maxLength: 20 },
-    })) return;
-    const body = req.body || {};
-    const out = pairStore.start({ deviceName: body.device_name, platform: body.platform });
-    if (out.error === 'busy') {
-      return res.fail('pairing_busy', { status: 429, message: 'Too many pairings in flight. Try again in a few minutes.' });
-    }
-    // The approve-page URL is PINNED to the canonical public origin (same
-    // posture as the OAuth redirect_uris above) — never derived from the
-    // request host, so a spoofed Host header can't point the app's browser
-    // hand-off at a look-alike approve page.
-    const verifyPath = `/builders/pair?code=${out.pairCode}`;
-    res.status(201).json({
-      pair_code: out.pairCode,
-      poll_token: out.pollToken,
-      verify_path: verifyPath,
-      verify_url: `${WEB_REDIRECT_ORIGIN}${verifyPath}`,
-      expires_in: out.expiresIn,
-      interval: out.interval,
-    });
-  });
-
-  // rank: any-builder — read-only: what the approve page shows BEFORE the
-  // click (device name/platform for the given code). Unknown and expired are
-  // indistinguishable (404) so the code space can't be probed for liveness.
-  router.get('/auth/app-pair/info', auth.requireBuilder, (req, res) => {
-    const info = pairStore.info(req.query.code);
-    if (!info) return res.fail('unknown_or_expired', 404);
-    res.json({
-      pair_code: info.pairCode,
-      device_name: info.deviceName,
-      platform: info.platform,
-      status: info.status,
-    });
-  });
-
-  // rank: any-builder (own identity only) — approving signs the app in AS THE
-  // APPROVER. Cookie-gated exactly like /auth/cli-token/issue above: a leaked
-  // CLI bearer must not be able to approve pairings and mint itself siblings;
-  // only the httpOnly browser cookie — the click in the hall — can.
-  router.post('/auth/app-pair/approve', auth.requireBuilder, async (req, res) => {
-    const cookieToken = sessionCookieToken(req);
-    if (!cookieToken) {
-      return res.fail('cookie_required', { status: 403, message: 'Pairings are approved from an authenticated browser session in the builders’ hall, not from a bearer token.' });
-    }
-    if (validateOrRespond(req, res, {
-      pair_code: { required: true, type: 'string', maxLength: 32 },
-    })) return;
-    try {
-      const token = crypto.randomBytes(32).toString('hex');
-      const row = await db.createSession({
-        builderId: req.builder.id,
-        token,
-        source: 'cli', // 003_pms.sql CHECK; the app is a CLI-class bearer client
-        userAgent: `devbox-app pair (${req.headers['user-agent'] ?? 'unknown'})`,
-        expiresAt: null, // no expiry — a CLI bearer lasts until revoked (ADR 0294)
-      });
-      const out = pairStore.approve((req.body || {}).pair_code, {
-        token,
-        expires_at: row.expires_at,
-        builder: {
-          id: req.builder.id,
-          github_login: req.builder.github_login,
-          display_name: req.builder.display_name,
-          rank: req.builder.rank,
-        },
-      });
-      if (!out.ok) {
-        // The pairing was gone or already approved — revoke the session we
-        // just minted so an orphaned token never outlives this branch.
-        await db.revokeSession(token);
-        return out.error === 'already_approved'
-          ? res.fail('already_approved', 409)
-          : res.fail('unknown_or_expired', 404);
-      }
-      res.json({ ok: true });
-    } catch (err) {
-      log.error('[gds] POST /auth/app-pair/approve', err);
-      res.fail('approve_failed', { status: 500, message: 'internal error' });
-    }
-  });
-
-  // rank: public — poll with the secret poll_token; the token IS the bearer
-  // (mirrors /auth/device/poll, where the device_code is the bearer). Kept
-  // LAST in this router so route-rank-check's look-ahead window stays clear
-  // of any neighboring gated declaration (see the block comment above).
-  router.post('/auth/app-pair/poll', (req, res) => {
-    if (validateOrRespond(req, res, {
-      poll_token: { required: true, type: 'string', maxLength: 128 },
-    })) return;
-    const out = pairStore.poll((req.body || {}).poll_token);
-    if (out.status === 'approved') {
-      return res.json({ status: 'approved', ...out.grant });
-    }
-    res.json(out.status === 'pending'
-      ? { status: 'pending', interval: out.interval }
-      : { status: 'expired' });
-  });
-
   return router;
 };
 

package/src/bongos/routes/builders.js

@@ -82,14 +82,6 @@ function staleHoursFor(req, res) {
 // kernel PORT (lc()). The rank/identity mutations (setBuilderRank/deactivate/
 // reactivate) stay core db (this domain is builder identity, not the lifecycle).
 const lc = () => seams.resolveOptional('lifecycle');
-// Dev-box "has this builder ever connected a box?" read through the kernel seam
-// instead of a direct `require('../boxes')` (a forbidden core→module edge once
-// dev-box moved to modules/dev-box/, ADR 0083 / BV1.R43). The dev-box module
-// provides the `box.hasEverConnected` port when enabled; degrades to false on a
-// box-less instance (the box_connect onboarding step just never auto-clears).
-const boxHasEverConnected = (builderId) =>
-  seams.resolveOptional('box.hasEverConnected', async () => false)(builderId);
-
 // The discord "has this builder linked their Discord account?" signal, read
 // through the kernel seam instead of a direct `db.getDiscordLink` (a forbidden
 // core→module edge once discord moved to modules/discord/, ADR 0083 / BV1.R47).
@@ -470,22 +462,20 @@ module.exports = function buildBuildersRouter() {
       // never a direct require of a module. Default-on (present in prod); degrades
       // to a null state row (shapeForApi synthesizes the "nothing cleared" view).
       const onboarding = seams.resolveOptional('onboarding');
-      const [state, shipCount, discordLink, boxConnected, cliAuthed] = await Promise.all([
+      const [state, shipCount, discordLink, cliAuthed] = await Promise.all([
         onboarding ? onboarding.getState(pool, targetId) : null,
         lc().countShippedTasksForBuilder(targetId),
         discordIsLinked(targetId),
-        boxHasEverConnected(targetId),
         db.hasCliSession(targetId),
       ]);
       // shipCount drives the terminal 'ship_three' stage's "N of 3" counter.
-      // The box/discord/cli steps clear from LIVE signals (not the onboarding_state
+      // The discord/cli steps clear from LIVE signals (not the onboarding_state
       // row), so they must be passed in exactly as GET /me does — otherwise they
-      // default to false and this route renders box_connect/join_discord/cli_setup
+      // default to false and this route renders join_discord/cli_setup
       // perpetually unchecked even after the builder cleared them (task 1444).
       const shaped = onboarding ? onboarding.shapeForApi(state, {
         shipCount,
         discordLinked: !!discordLink,
-        boxConnected: !!boxConnected,
         cliAuthed: !!cliAuthed,
       }) : null;
       // Light cache — onboarding state changes a few times per builder, ever.
@@ -510,7 +500,7 @@ module.exports = function buildBuildersRouter() {
   // shareable without a sign-in wall (that IS the feature). It deliberately
   // WHITELISTS the public column subset off the full builder row — the private
   // columns getBuilderById also returns (anthropic_email / anthropic_user_id /
-  // monthly_budget_usd / system_role / box_blocked*) are NEVER spread into the
+  // monthly_budget_usd / system_role) are NEVER spread into the
   // JSON. A leak-prevention unit test (tests/profile_route.mjs) asserts their
   // absence + the 404-on-unknown-id behaviour.
   // THROTTLED since task 1002804. The global limiter meters WRITES only
@@ -554,7 +544,7 @@ module.exports = function buildBuildersRouter() {
       ]);
       // WHITELIST — only the leaderboard-equivalent public field set. Never spread
       // the raw row: it carries anthropic_email / anthropic_user_id /
-      // monthly_budget_usd / system_role / box_blocked* / deactivated_reason,
+      // monthly_budget_usd / system_role / deactivated_reason,
       // none of which are public.
       const builder = {
         id: b.id,

package/src/bongos/routes/instance.js

@@ -9,14 +9,12 @@
 //   * modules + disciplines  — the R54 feature-module flags
 //   * rank ladder            — the canonical live tiers + the instance's labels
 //   * repo binding           — the GitHub owner/repo for `--local` clones
-//   * auth methods           — how a stranger signs in (device-flow / web / app-pair)
+//   * auth methods           — how a stranger signs in (device-flow / web)
 //   * admission policy        — invite-only vs open self-enrollment
-//   * dev-box availability    — whether the managed cloud-box backend is on
 //
 // WHY THIS EXISTS: GET /healthz returns only { ok, auth_configured } — too thin
-// for a CLI to brand + feature-gate itself (e.g. hide the `box` verb on an
-// instance that runs no dev-box module). This is the richer public descriptor
-// that gap calls for.
+// for a CLI to brand + feature-gate itself against an instance's modules. This is
+// the richer public descriptor that gap calls for.
 //
 // SECURITY (no secrets / no topology): the manifest is assembled ONLY from
 // already-client-safe projections — clientBranding() (the documented allow-list
@@ -35,7 +33,7 @@
 const express = require('express');
 const { corsPublicGet, asyncHandler } = require('./_helpers');
 const { clientBranding } = require('../../branding');
-const { clientModules, isModuleEnabled } = require('../../modules');
+const { clientModules } = require('../../modules');
 const { loadRepoInfo } = require('../repo-info');
 const { authConfigured, openEnrollmentEnabled, loadIdpConfig, resolveSession } = require('../auth');
 const { RANK_TIER } = require('../permission-path-check');
@@ -49,15 +47,14 @@ const MANIFEST_SCHEMA = 'instance-manifest/v1';
 
 // Supported sign-in methods. All require GitHub auth to be configured (the
 // server holds the OAuth client creds): device-flow = the CLI Device Flow;
-// web = the browsers' hall sign-in (completeWebFlow); app-pair = the Dev Box
-// desktop app's browser-clicks-only pairing (/auth/app-pair/*). All three mount
-// unconditionally in routes/auth.js, so configured-ness is the only gate.
-const AUTH_METHODS = ['device-flow', 'web', 'app-pair'];
+// web = the browsers' hall sign-in (completeWebFlow). Both mount unconditionally
+// in routes/auth.js, so configured-ness is the only gate.
+const AUTH_METHODS = ['device-flow', 'web'];
 
 // buildInstanceManifest — PURE assembler. Every input is injected so this is
 // unit-testable without disk, DB, or git. Inputs are the CLIENT-SAFE projections
 // (branding = clientBranding() output, modules = clientModules() output), the
-// canonical rank-tier map, loadRepoInfo()'s result, and three booleans. Returns
+// canonical rank-tier map, loadRepoInfo()'s result, and two booleans. Returns
 // the JSON body verbatim.
 function buildInstanceManifest({
   branding,
@@ -66,7 +63,6 @@ function buildInstanceManifest({
   repo,
   authConfigured: authOk,
   openEnrollment,
-  devBoxEnabled,
   idp = null,
 } = {}) {
   const b = branding || {};
@@ -109,7 +105,6 @@ function buildInstanceManifest({
       idp: idp || null,
     },
     admission: { policy: openEnrollment ? 'open' : 'invite-only' },
-    devBox: { available: !!devBoxEnabled },
   };
 }
 
@@ -144,7 +139,6 @@ function currentManifest() {
     // what the gate will do — and 'invite-only' already covers every non-open
     // door, so narrowing it names no state (ADR 0247 D3).
     openEnrollment: openEnrollmentEnabled(),
-    devBoxEnabled: isModuleEnabled('dev-box'),
     // Project OUT the client secret — the manifest is public; only origin +
     // client_id (both public) advertise federation.
     idp: idpCfg ? { origin: idpCfg.origin, client_id: idpCfg.clientId } : null,

package/src/bongos/routes/me.js

@@ -74,15 +74,6 @@ function boundShipDaysToYear(rows, todayStr) {
     return o != null && o >= cutoff && o <= todayOrd;
   });
 }
-// The dev-box "has this builder ever connected a box?" signal, read through the
-// kernel seam instead of a direct `require('../boxes')` (a forbidden core→module
-// edge once dev-box moved to modules/dev-box/, ADR 0083 / BV1.R43). The dev-box
-// module provides the `box.hasEverConnected` port when enabled; resolveOptional
-// degrades to false on a box-less instance, so onboarding's box_connect step
-// simply never auto-clears there. Resolved per call (the provider registers at
-// boot, before any request).
-const boxHasEverConnected = (builderId) =>
-  seams.resolveOptional('box.hasEverConnected', async () => false)(builderId);
 // The art-pipeline "is the shared newcomer key configured?" signal, read through
 // the kernel seam (ADR 0083 / BV1.R48). The art-pipeline module provides
 // 'art.sharedKeyConfigured' when enabled; resolveOptional degrades to false on a
@@ -192,7 +183,7 @@ module.exports = function buildMeRouter() {
     const specialities = seams.resolveOptional('specialities');
     const [
       builder, activeClaims, estVsActual, unlocked, lockedWithProgress, streakInfo,
-      recentGrades, builderAvg, onboardingRow, shipCount, recentKarma, karma30d, discordLink, boxConnected, cliAuthed,
+      recentGrades, builderAvg, onboardingRow, shipCount, recentKarma, karma30d, discordLink, cliAuthed,
       behaviorPrefs, geminiKeyRow, needsRebaseTasks, foundingBuilder, helpRequestCount,
       taskRecommendationCount, boardVotesPending, socialMode, mingleIntroductionCount,
       navPermissions,
@@ -227,14 +218,8 @@ module.exports = function buildMeRouter() {
       // follow-up call. Boolean only — the discord_user_id itself is never sent
       // to the client (it's PII the UI has no need for).
       discordIsLinked(req.builder.id),
-      // #823: whether the builder's dev box has ever reported a live Claude
-      // process (first_connected_at). Auto-clears the onboarding 'box_connect'
-      // step — the monotonic "properly connected to the dev box" signal.
-      boxHasEverConnected(req.builder.id),
-      // #777: whether the builder has ever authenticated the GDS CLI (ran
-      // /builder-setup, or the box-connect bootstrap). Auto-clears the
-      // onboarding 'cli_setup' step — distinct from box_connect (#823: both
-      // steps have a place — connecting vs. signing the GDS in).
+      // #777: whether the builder has ever authenticated the CLI (ran
+      // /builder-setup). Auto-clears the onboarding 'cli_setup' step.
       db.hasCliSession(req.builder.id),
       // task 1268: the builder's behavior_prefs blob (the 'wandering' + 'render'
       // knobs), resolved against builder.rank below so /me carries the effective
@@ -431,7 +416,7 @@ module.exports = function buildMeRouter() {
       // returns a stage-1 "nothing cleared" view so the client renders the
       // checklist either way. Through the `onboarding` port (BV1.R81); null when
       // the module is off.
-      onboarding: onboarding ? onboarding.shapeForApi(onboardingRow, { shipCount, discordLinked: !!discordLink, boxConnected: !!boxConnected, cliAuthed: !!cliAuthed }) : null,
+      onboarding: onboarding ? onboarding.shapeForApi(onboardingRow, { shipCount, discordLinked: !!discordLink, cliAuthed: !!cliAuthed }) : null,
       // F7 (ADR 0033): Discord link state for the hall's Connect/Unlink UI.
       // `configured` tells the client whether the server even has Discord OAuth
       // creds — when false the hall renders nothing (the start route 503s).
@@ -525,7 +510,7 @@ module.exports = function buildMeRouter() {
     };
     // Module→core contribution seam (BV1.R42, ADR 0083). Let each enabled module
     // add its own profile slice instead of core hardcoding it — the strangler
-    // prerequisite that lets dev-box/discord/art leave this route. ADD-ONLY (core
+    // prerequisite that lets discord/art leave this route. ADD-ONLY (core
     // keys win); a collision means a move task took over a core key without
     // dropping the core copy. Empty until a module registers → byte-identical today.
     const slices = await seams.collectContributions('profile.fields', {
@@ -570,14 +555,13 @@ module.exports = function buildMeRouter() {
       }
       // Echo the onboarding state back so the hall's path checklist can tick
       // this step off without a follow-up /me round-trip.
-      const [state, shipCount, discordLink, boxConnected, cliAuthed] = await Promise.all([
+      const [state, shipCount, discordLink, cliAuthed] = await Promise.all([
         onboardingPort ? onboardingPort.getState(pool, req.builder.id) : null,
         lc().countShippedTasksForBuilder(req.builder.id),
         discordIsLinked(req.builder.id),
-        boxHasEverConnected(req.builder.id),
         db.hasCliSession(req.builder.id),
       ]);
-      const onboarding = onboardingPort ? onboardingPort.shapeForApi(state, { shipCount, discordLinked: !!discordLink, boxConnected: !!boxConnected, cliAuthed: !!cliAuthed }) : null;
+      const onboarding = onboardingPort ? onboardingPort.shapeForApi(state, { shipCount, discordLinked: !!discordLink, cliAuthed: !!cliAuthed }) : null;
       res.json({ builder, onboarding });
     } catch (err) {
       if (err.code === 'invalid_discipline') {

package/src/bongos/routes/modules.js

@@ -17,6 +17,12 @@
 //                               authoritative check — `bongos module submit`
 //                               is a thin CLI client of this same route).
 //   GET  /modules/submissions  list queued submissions (task 1771 reads this).
+//   POST /store/modules/:key/versions
+//                               publish one module version to the Bongos-hosted
+//                               module store (task 1004271, ADR 0338 D1) — the
+//                               server end of `bongos module publish`. Not the
+//                               upstreaming door above: submit proposes a module
+//                               INTO core; publish puts a version in the store.
 //
 // Read is open to any signed-in builder (same gate as the atlas/primer pages);
 // every write (enable/disable, submit) is metic+archon, same rank as
@@ -58,6 +64,9 @@ const modulesLib = require('../../modules');
 // server process.
 const moduleCli = require('../../../scripts/gds/module');
 const moduleSubmissions = require('../module-submissions');
+const moduleArtifact = require('../../../scripts/gds/module-artifact');
+const { stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion } = require('../module-store');
+const { KEY_RE } = require('../../module-loader/manifest-schema');
 // Named imports, not a namespace object (task 1004052 strand walk): knip cannot follow
 // property access on a CommonJS namespace, so reaching these through one made them read
 // as unused exports and tripped the dead-code ratchet that held this branch out of main.
@@ -70,6 +79,21 @@ const { listOverrides, setOverride } = require('../module-overrides');
 // cap (SECURITY_DOC_CONTENT_MAX) in routes/security.js.
 const SUBMISSION_MAX_BYTES = 5_000_000;
 
+// A published version's body is the tarball itself, never JSON (the global parser
+// only reads application/json, so it passes this through). Capped at the parser and
+// never inflated from a Content-Encoding, so the cap is the bytes on the wire.
+const TARBALL_BODY_TYPES = ['application/gzip', 'application/x-gzip', 'application/octet-stream'];
+const rawTarball = express.raw({ type: TARBALL_BODY_TYPES, limit: moduleArtifact.MAX_TARBALL_BYTES, inflate: false });
+function tarballBody(req, res, next) {
+  rawTarball(req, res, (err) => {
+    if (!err) return next();
+    if (err.type === 'entity.too.large') {
+      return res.fail('artifact_too_large', { status: 413, message: `The tarball is over the ${moduleArtifact.MAX_TARBALL_BYTES}-byte store cap.` });
+    }
+    return res.fail('bad_tarball', { status: 400, message: 'The upload could not be read.' });
+  });
+}
+
 function ownProjectName() {
   try { return require('../../branding').branding().identity.productName; } catch { return null; }
 }
@@ -264,6 +288,65 @@ module.exports = function buildModulesRouter() {
       res.json({ submissions });
     }));
 
+  // POST /api/bongos/store/modules/:key/versions — publish one module version to
+  // the store (task 1004271, ADR 0338 D1). Body: the gzip tarball
+  // `bongos module publish` builds (scripts/gds/module-artifact.js), sent as
+  // application/gzip. The route trusts nothing but the bytes: it recomputes every
+  // hash, re-runs the publish denylist and validates module.json itself
+  // (verifyModuleArtifact), then keeps the tarball on the control plane's disk and
+  // INSERTs the version row in one transaction (module-store.js). A key's first
+  // publish makes the caller its author; after that only the author may publish,
+  // a delisted key takes nothing new, and a version is published once and never
+  // changed.
+  //
+  // rank: metic+archon — it puts code in a shared store other instances install
+  // from. Gate: requirePermission('module.submit') — the atom that already guards
+  // filing a module into a shared queue; a dedicated `module.publish` atom is a
+  // follow-up once who-may-sell is decided.
+  router.post('/store/modules/:key/versions', auth.requireBuilder, auth.requirePermission('module.submit'), tarballBody,
+    asyncHandler('POST /store/modules/:key/versions', async (req, res) => {
+      const { key } = req.params;
+      if (!KEY_RE.test(key)) {
+        return res.fail('bad_module_key', { status: 400, message: 'A module key is lowercase kebab-case.' });
+      }
+      const tgz = Buffer.isBuffer(req.body) ? req.body : null;
+      // The audit log serializes req.body; a tarball there would be megabytes of
+      // byte array. Leave it a one-line marker instead.
+      req.body = { tarball_bytes: tgz ? tgz.length : 0 };
+      if (!tgz || !tgz.length) {
+        return res.fail('empty_artifact', { status: 400, message: 'Send the tarball as the body, Content-Type: application/gzip.' });
+      }
+
+      const v = await moduleArtifact.verifyModuleArtifact(tgz, { key });
+      if (!v.ok) {
+        return res.fail(v.code, { status: v.code === 'artifact_too_large' ? 413 : 422, message: v.message });
+      }
+
+      const staged = await stageArtifact(tgz, { key, version: v.version });
+      let result;
+      try {
+        result = await publishVersion({
+          key,
+          title: v.moduleJson.title,
+          description: v.moduleJson.description,
+          version: v.version,
+          coreVersion: v.coreVersion,
+          manifest: v.manifest,
+          treeSha256: v.treeSha256,
+          tarballSha256: v.tarballSha256,
+          bytes: v.bytes,
+          artifactPath: relativeArtifactPath(staged.final),
+          builderId: req.builder.id,
+        }, { beforeCommit: () => commitArtifact(staged) });
+      } finally {
+        await removeArtifact(staged.tmp);
+      }
+      if (!result.ok) return res.fail(result.code, { status: result.status, message: result.message });
+
+      console.log(`[gds] module "${key}" ${v.version} published to the store by builder ${req.builder.id}`);
+      res.status(201).json({ ok: true, created_module: result.created, version: result.version });
+    }));
+
   return router;
 };
 

package/src/bongos/routes/security.js

@@ -113,9 +113,9 @@ module.exports = function buildSecurityRouter() {
   //
   // The DATED security engagement reports (exploit detail — full repro,
   // evidence, the attacker cookbook) are served from the DB, NOT committed to
-  // the git clone: the repo is cloned in full onto every Metic+ dev box
-  // (threat-model §6.3 / ADR 0020), so a committed exploit report is an
-  // attacker cookbook on every box. The SAFE conceptual docs (threat-model.md,
+  // the git clone: the repo is cloned in full onto every Metic+ builder's
+  // machine (threat-model §6.3 / ADR 0020), so a committed exploit report is an
+  // attacker cookbook on every machine. The SAFE conceptual docs (threat-model.md,
   // the README) stay in docs/security/; only the dated reports live here, and
   // ALL three routes gate on requirePermission('security.report.adjudicate')
   // — an archon-floored atom (BV1.R104; was requireRank('archon') and admits

package/src/bongos/routes.js

@@ -96,6 +96,11 @@ function buildGdsRouter() {
       // encoded (4 MB decoded). Same dynamic-:id pattern as publish-branch above;
       // modules/lifecycle/routes/task-visuals.js mounts its own 8 MB parser.
       /^\/tasks\/\d+\/visual$/.test(req.path) ||
+      // task 1004358: the named-slot sibling (TW11 — the eight page-tweak renders).
+      // Same 8 MB parser in modules/lifecycle/routes/visuals.js; a full-page render
+      // is ~90-130 KB, so without this every attach 413'd here first. The route
+      // validates the slot name itself, so the pattern only needs to be one segment.
+      /^\/tasks\/\d+\/visuals\/[^/]+$/.test(req.path) ||
       // task 1003850: the grade body carries committed_files — EVERY changed path, tens of
       // KB on its own for a mass change — plus the panel's findings. A 1,141-file rename
       // (task 1003705) produced a body over the 64 KB cap, so the grade could not be
@@ -162,8 +167,8 @@ function buildGdsRouter() {
   // core to every instance, not an OTB feature.
   router.use(buildLiveRouter());
   // Feature-module-gated mounts (R54, task 1193, ADR 0062 §4). Off on a vanilla
-  // instance; ON for OTB via config/modules.json so prod is unchanged. dev-box,
-  // art-pipeline, and discord (with its bug-attachments route) have all graduated
+  // instance; ON for OTB via config/modules.json so prod is unchanged. art-pipeline
+  // and discord (with its bug-attachments route) have both graduated
   // into real modules (modules/<key>/) — they are discovered + mounted by
   // moduleLoader.mountModuleRoutes below, not here (BV1.R43 / R48 / R47 / R72).
   // gate-approvals likewise moved to the lifecycle module (BV1.R86).

package/src/bongos/serve-internal.js

@@ -622,8 +622,8 @@ function mountInternalSurfaces(app) {
   //
   // Dual-mount (task 1919): the router + this discovery index are mounted at the
   // canonical API_PREFIX (/api/bongos) AND every LEGACY_API_PREFIXES entry
-  // (/api/gds) — the legacy alias stays FOREVER so shipped Dev Box binaries, the
-  // cached status mirror, and live boxes keep working (src/bongos/api-prefix.js). The
+  // (/api/gds) — the legacy alias stays FOREVER so older CLI releases and the
+  // cached status mirror keep working (src/bongos/api-prefix.js). The
   // SAME router instance is mounted at each path. Each discovery GET is registered
   // BEFORE its router mount so the exact base-path GET wins; every other
   // method/subpath falls through to the router.
@@ -670,7 +670,7 @@ function mountInternalSurfaces(app) {
   // below only prefixes non-/api paths, so without this placement /downloads/*
   // would be rewritten to /builders/downloads/* and 404). The installer scripts are served with the
   // server's PINNED origin substituted for __GDS_API_BASE__ — never a request
-  // header, so a spoofed Host can't redirect a `curl | sh` (the box-connect.sh rule).
+  // header, so a spoofed Host can't redirect a `curl | sh`.
   const bongosCfg = tryLoadInstanceConfig('bongos-cli.json');
   if (bongosCfg) {
     const bongosDownloads = buildBongosDownloads(bongosCfg);
@@ -894,8 +894,7 @@ function mountInternalSurfaces(app) {
   // them to the hall, and an unauthenticated visitor into sign-in). The subdomain
   // shim above has already rewritten the bare /watch + /gate onto /builders/*.
   // (Defense in depth: every data endpoint these pages call carries its own
-  // server-side gate.) /harbor sat here too until task 1003890 removed the dev
-  // box: its page is gone, and a gate in front of nothing is a dead guard.
+  // server-side gate.)
   const WATCH_PAGE_RE = /^\/builders\/watch(?:\.html)?\/?$/;
   const GATE_PAGE_RE = /^\/builders\/gate(?:\.html)?\/?$/;
   // /sessions (the session-log ledger) belongs to that same Governance group and
@@ -1144,7 +1143,7 @@ function mountInternalSurfaces(app) {
   // the landing card + GitHub button render for a stranger.
   //
   // ONE tier of gate: ANY SIGNED-IN BUILDER — the Work Board, Roadmap, the Goals
-  // page, the task-detail page, the Repo Atlas, the Dev Box pair page, Settings
+  // page, the task-detail page, the Repo Atlas, Settings
   // (#748, #904, task 1293, task 1757, task 751) and, since task 1002710, the
   // orientation reading rooms (primer, diagrams). A Xenos IS allowed; an
   // unauthenticated visitor is bounced into sign-in rather than served the shell.

package/src/bongos-downloads.js

@@ -4,8 +4,7 @@
 // The compiled per-platform binaries can't ride the git-based deploy (private
 // repo, no LFS, GitHub's 100MB cap), so CI publishes them as release assets on a
 // PUBLIC releases repo (config/bongos-cli.json — the same off-repo pattern as the
-// Dev Box app, src/devbox-downloads.js, and the ADR 0029 status mirror). This
-// module turns that committed config into:
+// ADR 0029 status mirror). This module turns that committed config into:
 //
 //   GET /downloads/bongos/latest.json   → { version, assets: { target: {file,url} } }
 //   GET /downloads/bongos/version       → { version, assets: { target: url } }
@@ -14,10 +13,6 @@
 // so every URL a user sees or the installer fetches stays on the instance apex,
 // and a release bump is a one-file config change that rides the normal ship flow.
 // Pure (config in, urls out) so tests need no server.
-//
-// (A near-twin of src/devbox-downloads.js by design — same off-repo release
-// pattern, different artifact. Kept as its own module for a clear name + its own
-// config pointer; the two are independent instance features.)
 
 function buildBongosDownloads(cfg) {
   if (!cfg || typeof cfg !== 'object') throw new Error('bongos-downloads: missing config');

package/src/branding.js

@@ -1,9 +1,9 @@
 // src/branding.js — the branding contract (ADR 0062 §3, task 1192 / V4.R53).
 //
 // The single source for every instance-identity string the platform renders:
-// product/world name, company, domains/origins, cookie + OAuth + dev-box
+// product/world name, company, domains/origins, cookie + OAuth
 // hosts, currency label, the track set, theme, and the project name injected
-// into LLM prompts. Generalizes devbox-app/src/brand.js to the whole platform.
+// into LLM prompts.
 //
 // Resolution precedence (highest wins):
 //   env override  ->  instance config (config/branding.json)  ->  neutral

package/src/build-info.js

@@ -41,12 +41,10 @@ function readGitSha() {
   }
 }
 
-// The deployed commit's date (ISO 8601), for the dev-box staleness comparison
-// (boxes.computeCodeStaleness, idea 332). A box reports its own HEAD commit date;
-// if it's > 2 days behind THIS, the box is flagged stale. Best-effort: after a
-// `git reset --hard origin/main` deploy, HEAD is the deployed commit, so its
-// committer date is the right reference. Null when git is unavailable (then the
-// "behind" check is skipped and only never-reported boxes flag).
+// The deployed commit's date (ISO 8601), served on /version beside the commit.
+// Best-effort: after a `git reset --hard origin/main` deploy, HEAD is the
+// deployed commit, so its committer date is the right reference. Null when git
+// is unavailable.
 function readGitCommitDate() {
   try {
     return execSync('git show -s --format=%cI HEAD', {