@bongos/core 1.19.1073 → 1.19.1075

package/src/instance-config.js

@@ -40,7 +40,7 @@ const LEGACY_DIRS = ['otb'];
 //
 // WHY THESE MUST OUTLIVE THIS TASK: these names are set OUTSIDE the repo —
 // /etc/cloudbongos/web.env on the droplet, systemd units, CI secrets, shipped
-// Dev Box binaries, live dev boxes. Deleting a spelling here is an outage the
+// CLI binaries, builders' own machines. Deleting a spelling here is an outage the
 // next time one of those restarts. Task 1003706 (C3d) retires them deliberately,
 // after evidence — and asserts their ABSENCE, which is why the fallback needs a
 // test that it FIRES rather than one that merely tolerates it.
@@ -140,7 +140,7 @@ function configPath(name, b = safeBrand()) {
 // Lives here, not in cli-lib.js which owns the session STORE, because this module
 // is the lowest one that has to read the file (resolveApiBase below) and cli-lib
 // imports this — so this is the only place both can share. A rename APPENDS a
-// name; dropping one signs out every builder machine and every live dev box at
+// name; dropping one signs out every builder machine at
 // once. Part 4 (task 1003706) retires the tail. (task 1003704)
 const SESSION_FILENAMES = Object.freeze([
   'bongos-session.json',

package/src/module-api.js

@@ -71,10 +71,14 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1073'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+// The body behind a retired doorway export that must stay callable until the next
+// MAJOR (see allowBoxScope below): passes the request through untouched.
+function deprecatedNoopMiddleware(_req, _res, next) { next(); }
+
+const CORE_VERSION = '1.19.1075'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
-// Usage: const log = api.logger('dev-box'); log.info('mounted');
+// Usage: const log = api.logger('discord'); log.info('mounted');
 // task 1003208 (goal 1000079): this USED TO BE `console.log(tag, ...a)`. Every
 // module that had "adopted the logger" was therefore still writing unstructured
 // text to stdout with no request correlation and no redaction — the criterion's
@@ -131,10 +135,13 @@ module.exports = {
   get requirePermission() { return require('./bongos/auth').requirePermission; },
   get rankMeetsThreshold() { return require('./bongos/auth').rankMeetsThreshold; },
   get requireBfgPrincipal() { return require('./bongos/auth').requireBfgPrincipal; },
-  // allowBoxScope — opt a route in to box-scoped (dev-box bootstrap) session
-  //     tokens. A module's own bootstrap routes flag themselves; everything else
-  //     stays closed to box tokens (the ADR 0016 trust boundary).
-  get allowBoxScope() { return require('./bongos/auth').allowBoxScope; },
+  // allowBoxScope — DEPRECATED no-op, kept so the doorway loses no export inside
+  //     1.x (removing one is a MAJOR, and every module declares ^1). It used to opt
+  //     a route in to the narrowing machine-baked session scope; that scope and its
+  //     tokens were retired (goal 1000120, task 1003894), so an undeclared session source is now denied
+  //     on every route whatever a route mounts. Passing it changes nothing. Drop it
+  //     at the next MAJOR.
+  get allowBoxScope() { return deprecatedNoopMiddleware; },
   // resolveSession(req) — resolve the request to a live session row (or null)
   //     WITHOUT the 401-or-pass behaviour of requireBuilder. A module route that
   //     must make its own auth decision — e.g. a browser page that REDIRECTS to

package/src/module-loader/catalog.js

@@ -125,6 +125,9 @@ function buildCatalog({
         provenance: deriveProvenance(manifest.origin, ownProjectName),
         enabled: enabled[key] === true,
         default: manifest.default === true,
+        // The module's own version (task 1003781) — null only for a manifest
+        // that predates the field (the validator now requires it).
+        version: manifest.version || null,
         coreVersion: manifest.coreVersion || null,
         contributes: manifest.contributes || {},
         // DECLARED — exactly what module.json says (null when it says nothing).

package/src/module-loader/loader.js

@@ -7,7 +7,7 @@
 // routes.js mounts discovered module routers behind the kernel's auth/audit.
 //
 // SAFE-BY-CONSTRUCTION during the strangler migration: with no modules/ dir
-// (the state until BV1.R43 moves dev-box), discovery returns EMPTY and every
+// (the state before BV1.R43 moved the first module), discovery returns EMPTY and every
 // function below is a no-op — OTB behaves byte-identically. As built-ins move
 // out, they become discovered manifests and the closed registry shrinks.
 //
@@ -173,7 +173,7 @@ function verifyEnabledPorts(enabled) {
 }
 
 // Mount each discovered + ENABLED module's route factories onto `router`. A
-// module declares contributes.routes:["box"] → factory at modules/<key>/routes/box.js
+// module declares contributes.routes:["copy-desk"] → factory at modules/<key>/routes/copy-desk.js
 // exporting a function returning an express Router. Auth model: audit is composed
 // at the kernel level in routes.js before this is called; each route self-gates at
 // its required rank via api.requireBuilder / api.requireRank (public read routes
@@ -309,8 +309,8 @@ function startModulePollers(deps = {}, { isEnabled } = {}, opts) {
         poller = require(pollerPath);
       } catch (e) {
         // No modules/<key>/pollers/<pk>.js → a DECLARATIVE-ONLY / non-web poller
-        // (e.g. dev-box's box-lifecycle sweep runs on the control plane, not in
-        // this process). Skip silently — only a web-process poller ships a file
+        // (e.g. a sweep that runs on the control plane, not in this process).
+        // Skip silently — only a web-process poller ships a file
         // here. A file that EXISTS but throws is a real error (the catch below).
         if (e && e.code === 'MODULE_NOT_FOUND' && String(e.message).includes(pollerPath)) continue;
         console.error(`[module-loader] poller ${key}/${pk} failed to load: ${e && e.message ? e.message : e}`);

package/src/module-loader/manifest-schema.js

@@ -9,9 +9,11 @@
 //
 // THE SCHEMA (module.json):
 //   {
-//     "key":          "dev-box",        // REQUIRED. ^[a-z][a-z0-9-]*$ ; must match the module's dir name.
-//     "title":        "Dev boxes",      // REQUIRED. Human label.
+//     "key":          "art-pipeline",   // REQUIRED. ^[a-z][a-z0-9-]*$ ; must match the module's dir name.
+//     "title":        "Art pipeline",   // REQUIRED. Human label.
 //     "description":  "…",              // REQUIRED. One sentence.
+//     "version":      "1.4.2",          // REQUIRED. The module's OWN exact version "X.Y.Z" (task 1003781) —
+//                                       //   what update, rollout channels and re-assessment name.
 //     "coreVersion":  "^1.0.0",         // REQUIRED. semver range of src/module-api.js CORE_VERSION it supports.
 //     "default":      false,            // OPTIONAL (default false). Enablement fail-safe when no config names it.
 //     "author":       "…",              // OPTIONAL. Attribution (ADR 0107 §2) — portable, not a cross-GDS FK.
@@ -28,12 +30,12 @@
 //                                       //   nobody does. `maintained` needs a named `maintainer`;
 //                                       //   `deprecated`/`orphaned` need a `successor` or a `note`.
 //     "contributes": {                  // REQUIRED object (may be empty). What the module mounts:
-//       "routes":      ["box"],         //   route-factory keys (mounted behind kernel-composed auth)
+//       "routes":      ["stage"],       //   route-factory keys (mounted behind kernel-composed auth)
 //       "rooms":       ["WorldRoom"],   //   Colyseus room classes (realtime seam)
-//       "pollers":     ["box-lifecycle"],// background pollers to start/stop
+//       "pollers":     ["nightly-sweep"],// background pollers to start/stop
 //       "disciplines": ["artist"],      //   disciplines this module adds
 //       "skills":      ["otb-…"],       //   slash-command skills it ships
-//       "uiSections":  ["boxes"],       //   hall/status UI sections it owns
+//       "uiSections":  ["gallery"],     //   hall/status UI sections it owns
 //       "webSurfaces": [{ "host": "status.", "dir": "public" }], // static web surfaces. Each names a Host
 //                                       //   PREFIX (BV1.R84) or, as { "apexRoot": true, "dir": "public" },
 //                                       //   the APEX ROOT — never both (ADR 0218).
@@ -46,7 +48,7 @@
 //                                       //   refuses the enablement when the join door is `open` and no
 //                                       //   payer is configured.
 //     "declarativeSeams": {             // OPTIONAL. Per-entry exemptions for the seam-wiring
-//       "pollers": ["box-lifecycle"]    //   guard (task 1003819): "this contributes entry ships no
+//       "pollers": ["nightly-sweep"]    //   guard (task 1003819): "this contributes entry ships no
 //     },                                //   artifact ON PURPOSE". Every key must be a key the module
 //                                       //   actually declares in `contributes`, and every entry must be
 //                                       //   one it actually lists there — a typo'd exemption is an error,
@@ -162,6 +164,12 @@ function validateManifest(obj) {
   if (!isStr(obj.title)) E('title: required non-empty string');
   if (!isStr(obj.description)) E('description: required non-empty string');
 
+  // The module's own version (task 1003781) — EXACT, unlike coreVersion's range:
+  // it names one published build, so update parity, rollout channels and
+  // re-assessment on publish (ADR 0338/0344) all have something to point at.
+  if (!isStr(obj.version)) E('version: required exact semver string "X.Y.Z" — the module\'s own version, e.g. "1.0.0"');
+  else if (!parseVersion(obj.version)) E(`version: "${obj.version}" must be an exact version "X.Y.Z" (not a range)`);
+
   if (!isStr(obj.coreVersion)) E('coreVersion: required non-empty semver range string (e.g. "^1.0.0")');
   else if (!isValidRange(obj.coreVersion)) E(`coreVersion: "${obj.coreVersion}" is not a valid semver range`);
 
@@ -239,8 +247,8 @@ function validateManifest(obj) {
   // --- optional declarativeSeams (task 1003819) ---
   // The exemption list for the seam-wiring guard: "this contributes entry ships no
   // artifact on purpose". Some declarations are legitimately declarative-only —
-  // dev-box's `box-lifecycle` poller runs on the control plane, not in this process,
-  // and its `boxes` uiSection ships no hall widget — so the guard needs a way to say
+  // a poller that runs on the control plane, not in this process, or a uiSection
+  // that ships no hall widget — so the guard needs a way to say
   // so without a blanket skip that would hide the real cases it exists to catch.
   //
   // Validated HERE, against `contributes`, because this is the one place that holds

package/src/module-seams.js

@@ -179,9 +179,8 @@ function listEvents() {
 // fire-and-forget reaction; a CONTRIBUTION accumulates — zero-or-more modules
 // each add a piece to a named extension point, and the kernel hands the whole
 // set back to a core consumer that renders them together. This is how a module
-// adds its own slice to a core surface without core hardcoding it: dev-box adds
-// box fields + a box settings panel, discord adds its link state, art adds its
-// key surface — each `contribute()`s; core merges. The strangler prerequisite
+// adds its own slice to a core surface without core hardcoding it: discord adds
+// its link state, art adds its key surface — each `contribute()`s; core merges. The strangler prerequisite
 // that lets those modules leave core (the surfaces in src/bongos/routes/me.js +
 // modules/hall-ui/public/settings.js stop being hardcoded). With no module enabled the
 // registry is empty and every consumer renders exactly what it does today.

package/src/modules.js

@@ -18,8 +18,8 @@
 //
 // This is a config-flag exclusion mechanism, NOT a full plugin registry — the
 // cheaper near-term shape (ADR 0062 §4). R59 (task 1198) moves game + art-pipeline
-// in; R60 (task 1199) moves discord + dev-box in (UI sections / skills / pollers);
-// they consume the registry declared here.
+// in; R60 (task 1199) moves discord in (UI sections / skills / pollers); they
+// consume the registry declared here.
 
 const fs = require('node:fs');
 const path = require('node:path');
@@ -45,9 +45,9 @@ const INSTANCE_PATH = path.join(resolveInstanceRoot(), 'config', 'modules.json')
 // CORE (always on, never a module): auth, builders, tasks, claims, versions,
 // done-when, credits/cost, inbox, blockers, leaderboard, analytics,
 // audit-log, security, access-requests, sessions, gate-approvals, healthz,
-// public. These mount unconditionally. The four optional feature modules AND the
-// first TWO carved CORE-domain modules have graduated to modules/<key>/ (dev-box
-// BV1.R43, discord BV1.R47, art-pipeline BV1.R48, game BV1.R49, memory BV1.R72 —
+// public. These mount unconditionally. The optional feature modules AND the
+// first TWO carved CORE-domain modules have graduated to modules/<key>/ (discord
+// BV1.R47, art-pipeline BV1.R48, game BV1.R49, memory BV1.R72 —
 // memory/recall/search/learnings, ADR 0091 §2 — and grading BV1.R73 — the
 // adversarial grade panel + rubric, behind the `grade` kernel port, ADR 0091 §4).
 // A core-domain module like memory or grading is `default: true` (it ships to
@@ -166,6 +166,27 @@ function spendRefusals(resolved, registry, { joinDoorOpen = false, payer = null
 // something they explicitly asked for, so it has to say what to do about it.
 // `log` is injectable for the same reason instance-config's legacy-env warning
 // injects it: a test asserts the warning fired, not only that the value resolved.
+// RETIRED MODULE KEYS (goal 1000120, task 1003892). A module deleted from the core
+// outright, which an instance's committed config/modules.json — written while the
+// module still shipped — may still switch ON. fromConfig below throws on enabling
+// an unknown module (the task-1824 typo guard), so without this a core upgrade
+// would become a boot failure on every instance that ever enabled one:
+// cloudbongos.com's own config still said `"dev-box": true` when the module went.
+// A retired key is DROPPED with a one-line warning instead of thrown on. Keep the
+// list short and say why each key left — an entry is a promise about someone
+// else's config file, not a way to silence a typo.
+const RETIRED_MODULE_KEYS = Object.freeze({
+  'dev-box': 'cloud dev boxes were removed from the core (goal 1000120)',
+});
+
+function warnRetiredModule(key, source, log = console) {
+  log.warn(
+    `[bongos] module "${key}" is switched on in the ${source} config, but it was retired: `
+    + `${RETIRED_MODULE_KEYS[key]}. It is ignored — remove the key from that config to `
+    + 'silence this line.',
+  );
+}
+
 function warnSpendRefusal(key, envPrefix, log = console) {
   log.warn(
     `[bongos] module "${key}" is enabled in config but was REFUSED: it spends money on behalf of `
@@ -185,7 +206,7 @@ function resolveModules({
   // caller that does not know about spend resolves exactly as before; loadModules
   // is the one that reads the real posture, and the one that fails closed when it
   // cannot.
-  spendGuard = NO_SPEND_RISK, warn = warnSpendRefusal,
+  spendGuard = NO_SPEND_RISK, warn = warnSpendRefusal, warnRetired = warnRetiredModule,
   // THE DB OVERRIDE LAYER (task 1002857) — a { <moduleKey>: boolean } snapshot of
   // module_enablement_overrides for this scope, injected rather than read, so this
   // resolver stays pure and synchronous. Defaulted to {} so every existing caller
@@ -207,13 +228,19 @@ function resolveModules({
     for (const [k, v] of Object.entries(m)) {
       if (known.includes(k)) { out[k] = v; continue; }
       // Unknown key. A config may name a module this build hasn't installed: a stripped
-      // CORE has no game/art-pipeline/discord/dev-box, yet config/modules.neutral.json
-      // (which ships WITH the core) names them so the SAME file is valid in the full repo
-      // too. Tolerate an unknown module ONLY when it is DISABLED — a disabled-and-absent
-      // module is a no-op. ENABLING an absent module is a real error (the feature you asked
-      // for isn't here) and still throws, which also keeps the typo guard for the dangerous
-      // direction. (task 1824: this is what lets the vanilla core boot instead of crashing
-      // on `unknown module "game"`.)
+      // CORE has no game/art-pipeline/discord, yet config/modules.neutral.json (which
+      // ships WITH the core) names them so the SAME file is valid in the full repo too.
+      // Tolerate an unknown module ONLY when it is DISABLED — a disabled-and-absent
+      // module is a no-op. ENABLING an absent module is a real error (the feature you
+      // asked for isn't here) and still throws, which also keeps the typo guard for the
+      // dangerous direction. (task 1824: this is what lets the vanilla core boot instead
+      // of crashing on `unknown module "game"`.) The one exception is a RETIRED key
+      // (RETIRED_MODULE_KEYS above): it can never be installed again, so enabling it is
+      // a stale config line, not a request — warn and drop it.
+      if (coerceBool(v) === true && Object.prototype.hasOwnProperty.call(RETIRED_MODULE_KEYS, k)) {
+        warnRetired(k, source);
+        continue;
+      }
       if (coerceBool(v) === true) {
         throw new Error(`modules: cannot enable unknown module "${k}" in ${source} config — it is not installed (known: ${known.join(', ') || '(none)'}).`);
       }
@@ -257,7 +284,7 @@ function resolveModules({
   const merged = Object.assign({}, ...layers.map(([, m]) => m));
 
   // Env overrides: <PREFIX>_MODULE_<KEY> where KEY is upper-snake of the module
-  // name (dev-box -> DEV_BOX). Highest precedence.
+  // name (art-pipeline -> ART_PIPELINE). Highest precedence.
   for (const key of known) {
     const suffix = `MODULE_${key.toUpperCase().replace(/-/g, '_')}`;
     const envName = `${envPrefix}_${suffix}`;
@@ -489,6 +516,7 @@ module.exports = {
   metersSpend,
   spendRefusals,
   warnSpendRefusal,
+  RETIRED_MODULE_KEYS,
   resolveModules,
   resolveInstancePackPath,
   moduleScopeKey,

package/tests/agents_spend_guard.mjs

@@ -122,7 +122,7 @@ test('spendRefusals never names a module that was already off', () => {
 });
 
 test('the manifest declaration is a CLOSED key set — a typo must not read as "no spend"', () => {
-  const base = { key: 'x', title: 't', description: 'd', coreVersion: '^1.0.0', contributes: {} };
+  const base = { key: 'x', title: 't', description: 'd', version: '1.0.0', coreVersion: '^1.0.0', contributes: {} };
   assert.equal(validateManifest({ ...base, spend: { requiresPayer: true } }).valid, true);
   assert.equal(validateManifest({ ...base, spend: { requirespayer: true } }).valid, false,
     'a misspelled key silently declaring NO spend is the direction that costs money');

package/tests/api_alias_caller_ratchet.mjs

@@ -66,7 +66,7 @@ test('the exclusions are real and each one is reachable', () => {
     'scripts/gds/fitness-ratchets.js',
     'scripts/gds/api-alias-caller-scan.js',
     'tests/api_alias_exceptions.mjs',      // 5 tests
-    'modules/dev-box/app/test/thing.mjs',
+    'modules/agents/app/test/thing.mjs',
     'docs/adr/0016-permissions.md',        // 6 the FROZEN RECORD under docs/ (narrowed, task 1004113)
     'docs/session-logs/2026-09-16-x.md',
     'docs/audits/2026-08-01-x.md',

package/tests/api_alias_exceptions.mjs

@@ -27,7 +27,7 @@ const ALIAS = '/api/gds';
 test('the alias is still mounted — everything below depends on it', () => {
   const { API_PREFIX, LEGACY_API_PREFIXES, ALL_API_PREFIXES } = require(path.join(ROOT, 'src', 'bongos', 'api-prefix.js'));
   assert.equal(API_PREFIX, '/api/bongos', 'the canonical prefix is what in-repo callers now ask for');
-  assert.ok(LEGACY_API_PREFIXES.includes(ALIAS), 'shipped Dev Box binaries and live dev boxes call the alias');
+  assert.ok(LEGACY_API_PREFIXES.includes(ALIAS), 'shipped binaries and live instances call the alias');
   assert.ok(ALL_API_PREFIXES.includes(ALIAS), 'and the router still mounts it');
 });
 

package/tests/api_client.mjs

@@ -128,21 +128,6 @@ test('every method the README example names actually exists on the client', () =
   assert.ok(count >= 3, 'README example should exercise several methods');
 });
 
-test('devbox vendored client is byte-identical to the canonical CJS build (run devbox-app vendor if stale)', () => {
-  // The devbox Electron app can't require() clients/ at runtime (packaged
-  // separately, ADR 0045), so scripts/vendor-client.js copies index.cjs into
-  // devbox-app/src/vendor/. Guard that the vendored copy never drifts from the
-  // canonical build — CI catches a forgotten `npm run vendor` after a spec change.
-  // devbox-app/ is instance content the neutral core does not carry (task 1002470).
-  // Absent APP => nothing to vendor into; absent VENDORED FILE inside a present app
-  // is the real "forgot to run vendor" drift this guards, and still fails.
-  if (!fs.existsSync(path.join(ROOT, 'devbox-app'))) return;
-  const vendored = path.join(ROOT, 'devbox-app/src/vendor/bongos-client.cjs');
-  if (!fs.existsSync(vendored)) throw new assert.AssertionError({ message: 'devbox-app/src/vendor/bongos-client.cjs missing — run `npm run vendor` in devbox-app/' });
-  const canonical = fs.readFileSync(path.join(ROOT, 'clients/bongos-client/index.cjs'), 'utf8');
-  assert.equal(fs.readFileSync(vendored, 'utf8'), canonical, 'devbox vendored client is STALE — run `npm run vendor` in devbox-app/');
-});
-
 test('baseUrl:"" is honored (absolute-path passthrough for the hall fetch wrappers)', async () => {
   const rec = {};
   const api = createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false, fetch: fakeFetch(rec, { ok: true, status: 200, body: { x: 1 } }) });
@@ -223,7 +208,7 @@ test('generated .d.ts types success responses (task 2061)', () => {
 });
 
 // The CJS + browser-global builds are pure transforms of the ESM source (task
-// 1996 / R09). devbox (require) and classic <script> web pages consume them, so
+// 1996 / R09). CommonJS callers (require) and classic <script> web pages consume them, so
 // guard that they load and shape requests IDENTICALLY to the ESM build.
 test('CJS build behaves identically to the ESM build', async () => {
   const cjs = require('../clients/bongos-client/index.cjs');

package/tests/api_path_404.mjs

@@ -38,7 +38,7 @@ t('API-shaped: /api/*, /gds/*, and bare GDS roots (/tasks, /me, …) match', ()
 
 t('NOT API-shaped: game/hall/static paths fall through to HTML/static', () => {
   for (const p of ['/', '/index.html', '/builders', '/builders/work', '/atlas-ab12.png',
-                   '/vendor/phaser.min.js', '/downloads/devbox/mac', '/game', '/healthz', '/version']) {
+                   '/vendor/phaser.min.js', '/downloads/bongos/latest.json', '/game', '/healthz', '/version']) {
     assert.equal(isApiShapedPath(p), false, `${p} should NOT be API-shaped`);
   }
 });

package/tests/auth_page_gate.mjs

@@ -99,18 +99,18 @@ await t('session lookup error → fails CLOSED (redirect, next() NOT called)', a
     'must redirect to sign-in on a lookup error (fail closed)');
 });
 
-// ---- SESSION-SCOPE on the page path (task 1003197 (A)) ----------------------
+// ---- SESSION SOURCE on the page path (task 1003197 (A)) ---------------------
 //
 // resolveSession accepts a Bearer token with no source filter, so before this the
-// page gate never asked the question requireBuilder asks: is a page inside this
-// SESSION's scope at all? A box-baked token (which lives on the box, outside the
-// ADR 0016 trust boundary) could therefore fetch a gated page SHELL whenever its
-// builder's rank held the page permission. The stub above resolves the permission
-// for EVERY builder, which is what makes these assertions about scope alone.
+// page gate never asked the question requireBuilder asks: does the session-source
+// registry declare this session's source at all? Without it, a token of an
+// undeclared source could fetch a gated page SHELL whenever its builder's rank held
+// the page permission. The stub above resolves the permission for EVERY builder,
+// which is what makes these assertions about the source alone.
 
 console.log('\nrequireBuilderPage — session scope:');
 
-await t('box-scoped session → 302 to sign-in even though its builder holds the permission', async () => {
+await t('a leftover dev-box session (source box, now undeclared) → 302 to sign-in even though its builder holds the permission', async () => {
   nextSession = { builder_id: 3, github_login: 'boxbot', rank: 'archon', status: 'active', source: 'box' };
   lookupThrows = false;
   const req = { headers: { authorization: 'Bearer boxtoken' } }; // a page route declares no scope
@@ -145,9 +145,9 @@ await t('cli and web sessions are untouched by the scope check', async () => {
 });
 
 await t('a legacy session with no source field still reaches the page', async () => {
-  // The same invariant tests/box_scope_session.mjs pins for requireBuilder: absent
-  // source resolves to the UNSCOPED scope, so this gate can never lock out a real
-  // browser session minted before `source` was recorded.
+  // The same invariant tests/government_session_scope.mjs pins for requireBuilder:
+  // an absent source is the declared legacy row, so this gate can never lock out a
+  // real browser session minted before `source` was recorded.
   nextSession = { builder_id: 2, github_login: 'legacy', rank: 'metic', status: 'active' };
   const req = { headers: { cookie: 'gds_session=validtoken' } };
   const res = fakeRes();

package/tests/backfill_task_rewards.mjs

@@ -77,7 +77,7 @@ await test('computeTaskReward: 0 raw → 0 effective (a 0-mapping pays nothing)'
 
 await test('netForBuilder: would-be minus already-paid', () => {
   assert.equal(netForBuilder(100, 30), 70);
-  assert.equal(netForBuilder(100, 0), 100); // cost-plus paid nothing (dev-box/CI case)
+  assert.equal(netForBuilder(100, 0), 100); // cost-plus paid nothing (the CI case)
 });
 
 await test('netForBuilder: cost-plus over-paid → floored at 0 (never claws back)', () => {

package/tests/canonical_profile_url.mjs

@@ -288,8 +288,6 @@ const BUILDER = {
   anthropic_user_id: 'SENTINEL-anthropic-user',
   monthly_budget_usd: 999,
   system_role: 'SENTINEL-system-role',
-  box_blocked: true,
-  box_blocked_reason: 'SENTINEL-box-blocked',
   deactivated_reason: 'SENTINEL-deactivated',
 };
 
@@ -380,7 +378,7 @@ test('widening the response did not widen the leak: no private column appears an
   // The raw serialized text, not the parsed keys — a private value smuggled
   // under a different key still fails.
   assert.doesNotMatch(r.text, /SENTINEL-/, 'a private builder column reached the public profile body');
-  assert.doesNotMatch(r.text, /monthly_budget_usd|anthropic_|system_role|box_blocked|deactivated_reason/);
+  assert.doesNotMatch(r.text, /monthly_budget_usd|anthropic_|system_role|deactivated_reason/);
   assert.deepEqual(Object.keys(r.data.builder).sort(), [
     'avatar_url', 'created_at', 'display_name', 'github_login', 'id', 'karma',
     'preferred_disciplines', 'rank', 'total_credits',

package/tests/claim_action.mjs

@@ -242,7 +242,10 @@ await test('NOBODY posts to /claims except through the shared action', () => {
   // own claim POST, this fails — which is what "a new claim surface needs no new
   // refusal handling" has to mean in practice.
   const offenders = [];
-  for (const f of ['work.js', 'goals-page.js', 'goals-render.js', 'task.js']) {
+  // task 1003459 added two more claim surfaces (task.js's Claim it button,
+  // builders.js/hall-render.js's Home Next-up row) — both belong in this scan
+  // or a future hand-rolled POST on either trips nothing.
+  for (const f of ['work.js', 'goals-page.js', 'goals-render.js', 'task.js', 'builders.js', 'hall-render.js']) {
     const src = read('modules', 'hall-ui', 'public', f);
     if (/postJSON\(\s*`\$\{API\}\/claims/.test(src)) offenders.push(f);
   }

package/tests/claim_from_task_and_home.mjs

@@ -0,0 +1,127 @@
+// tests/claim_from_task_and_home.mjs
+//
+// Task 1003459 — the two surfaces that say "ready to claim" gain the ability to
+// claim: the task's own /task/:id page, and Home's "Next up" rows. Both wire
+// onto the extracted claim action (task 1003458, claim-action.js) rather than
+// hand-rolling a third POST /claims + refusal switch — claim_action.mjs already
+// proves the switch itself is complete; this file proves these two call sites
+// actually use it.
+//
+// Static-source assertions, matching claim_action.mjs's own idiom for these
+// files: task.js and builders.js are browser IIFEs that reach for `window` at
+// eval time, so they are read as text rather than executed in Node.
+//
+// Run:  node tests/claim_from_task_and_home.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { makeRunner } from './helpers.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = join(__dirname, '..');
+const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
+const { test, summary } = makeRunner();
+
+const taskJs = read('modules', 'hall-ui', 'public', 'task.js');
+const buildersJs = read('modules', 'hall-ui', 'public', 'builders.js');
+const hallRenderJs = read('modules', 'hall-ui', 'public', 'hall-render.js');
+const taskHtml = read('modules', 'hall-ui', 'public', 'task.html');
+const indexHtml = read('modules', 'hall-ui', 'public', 'index.html');
+
+// == /task/:id ================================================================
+
+await test('task.js constructs the shared claim action', () => {
+  assert.match(taskJs, /makeClaimAction\(\{/, 'task.js must build the action, not hand-roll one');
+  assert.match(taskJs, /window\.OTBClaimAction/);
+});
+
+await test('task.js renders a Claim button only when the task is ready', () => {
+  const m = taskJs.match(/if \(t\.status === 'ready'\) \{\s*lifecycle = `([^`]*)`/);
+  assert.ok(m, 'no ready-status branch found in the lifecycle chain');
+  assert.match(m[1], /id="claim-btn"/);
+});
+
+await test('the Claim button click routes through claimAction.claim, not a raw POST', () => {
+  const m = taskJs.match(/const claimBtn = \$\('#claim-btn'\);[\s\S]*?\n {4}\}/);
+  assert.ok(m, 'claim-btn wiring block not found');
+  assert.match(m[0], /claimAction\.claim\(t\.id\)/);
+});
+
+await test('task.js does not hand-roll a POST to /claims', () => {
+  assert.doesNotMatch(taskJs, /postJSON\(\s*`\$\{API\}\/claims/);
+});
+
+await test('task.html loads claim-action.js before task.js', () => {
+  const shared = taskHtml.indexOf('claim-action.js');
+  const after = taskHtml.indexOf('task.js?v=');
+  assert.ok(shared > -1, 'task.html must load claim-action.js');
+  assert.ok(after > shared, 'task.js must load AFTER claim-action.js');
+});
+
+await test('task.html\'s cache-bust moved for task.js', () => {
+  assert.doesNotMatch(taskHtml, /task\.js\?v=2026-09-26-taskwhere/, 'the old bust is still there');
+  assert.match(taskHtml, /task\.js\?v=2026-09-28-taskclaim/);
+});
+
+// == Home's "Next up" rows ====================================================
+
+await test('hall-render.js constructs the shared claim action for Home\'s Next-up row', () => {
+  // Lives in hall-render.js, not builders.js: builders.js sits at the
+  // 1,500-line fitness ratchet (hall-ui/CLAUDE.md — growth goes in the
+  // lib/renderer, not the page).
+  assert.match(hallRenderJs, /function wireNextUpClaim\(\)/);
+  assert.match(hallRenderJs, /makeClaimAction\(\{/);
+  assert.match(hallRenderJs, /window\.OTBClaimAction/);
+});
+
+await test('the shared postJSON carries { status, data } — the contract claim-action.js reads', () => {
+  const m = buildersJs.match(/async function postJSON\(path, body\) \{[\s\S]*?\n {2}\}/);
+  assert.ok(m, 'postJSON not found');
+  assert.match(m[0], /err\.data\s*=/, 'postJSON must set err.data or every refusal here falls through to the generic line');
+});
+
+await test('each Next-up row renders a Claim button carrying its task id', () => {
+  const m = buildersJs.match(/list\.innerHTML = rows\.map\(\(t\) => \{[\s\S]*?\n {6}\}\)\.join\(''\);/);
+  assert.ok(m, 'loadNextUp row template not found');
+  assert.match(m[0], /class="[^"]*next-up__claim[^"]*"/);
+  assert.match(m[0], /data-task-id="\$\{escapeHtml\(String\(t\.id\)\)\}"/);
+});
+
+await test('the Next-up Claim button routes through claimAction.claim, not a raw POST', () => {
+  const m = hallRenderJs.match(/function wireNextUpClaim\(\) \{[\s\S]*?\n {2}\}/);
+  assert.ok(m, 'wireNextUpClaim not found');
+  assert.match(m[0], /\$\('#home-next-list'\)\?\.addEventListener\('click'/);
+  assert.match(m[0], /claimAction\.claim\(taskId\)/);
+});
+
+await test('builders.js wires the Next-up claim action rather than hand-rolling it', () => {
+  assert.doesNotMatch(buildersJs, /postJSON\(\s*`\$\{API\}\/claims/);
+  assert.match(buildersJs, /wireNextUpClaim\(\)/, 'builders.js must call the renderer\'s wiring');
+});
+
+await test('the claim wiring landed in the renderer, not back over the 1,500-line ratchet', () => {
+  // Not a second copy of fitness.js's own gate (scripts/gds/fitness-ratchets.js)
+  // — this is the reason wireNextUpClaim moved to hall-render.js in the first
+  // place (see its own comment): a regression here explains WHY that file grew,
+  // not just THAT some file grew.
+  for (const [name, src] of [['builders.js', buildersJs], ['hall-render.js', hallRenderJs]]) {
+    const lines = src.split('\n').length;
+    assert.ok(lines <= 1500, `${name} is ${lines} lines — over the fitness ratchet`);
+  }
+});
+
+await test('index.html loads claim-action.js before builders.js', () => {
+  const shared = indexHtml.indexOf('claim-action.js');
+  const after = indexHtml.indexOf('builders.js?v=');
+  assert.ok(shared > -1, 'index.html must load claim-action.js');
+  assert.ok(after > shared, 'builders.js must load AFTER claim-action.js');
+});
+
+await test('index.html\'s cache-bust moved for builders.js', () => {
+  assert.doesNotMatch(indexHtml, /builders\.js\?v=2026-06-27-r75/, 'the old bust is still there');
+  assert.match(indexHtml, /builders\.js\?v=2026-09-28-nextupclaim/);
+});
+
+summary();

package/tests/{box_ship_permissions.mjs → cli_allowlist_permissions.mjs}

@@ -1,7 +1,7 @@
-// tests/box_ship_permissions.mjs
+// tests/cli_allowlist_permissions.mjs
 //
 // task 1051 (D): the blessed methodology CLI scripts must stay pre-allowed in the
-// project .claude/settings.json so a dev-box Claude session (auto permission mode)
+// project .claude/settings.json so a Claude session in auto permission mode
 // does not hard-DENY the very command it exists to run. The #1027 nightmare
 // dead-ended on `node scripts/gds/ship.js` at the auto classifier; this guards
 // against that allow-rule being silently dropped.
@@ -12,7 +12,7 @@
 // on every routine read. The list of tools is `.claude/hooks/shell-tools.js`, the same
 // one the guards read: a rule may only exist for a tool git-guard and secret-gate see.
 //
-// Run:  node tests/box_ship_permissions.mjs
+// Run:  node tests/cli_allowlist_permissions.mjs
 
 import { strict as assert } from 'node:assert';
 import fs from 'node:fs';
@@ -62,7 +62,7 @@ perTool('permissions.allow pre-allows the generic GDS API channel api.js (auto-m
   // idea-triage promote, create-task, blocker-resolve, criterion ratify, goal
   // create, cost-via-API, security reports — rides the generic caller
   // `node scripts/gds/api.js <METHOD> /api/gds/...`. If it is not pre-allowed, a
-  // dev-box (or laptop) session in AUTO permission mode has the classifier
+  // session in AUTO permission mode has the classifier
   // hard-DENY those writes as "[External System Writes] ... beyond the user's
   // request" — mistaking a sanctioned idea-triage session for scope creep. The
   // GDS server enforces builders.rank on every request (ADR 0016), so this rule
@@ -309,5 +309,5 @@ test('the instance starter mirrors this list in verb form (claude-materialize.js
 });
 
 console.log('');
-console.log(`box_ship_permissions: ${passed} passed, ${failed} failed`);
+console.log(`cli_allowlist_permissions: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/cli_sessions.mjs

@@ -201,7 +201,7 @@ test('signing into a second instance PRESERVES the first — including one writt
 });
 
 test('the ACTIVE pointer still lands exactly where every existing reader looks', () => {
-  // In-repo skills, hooks and the dev box all read the active session file in the configured dir. The
+  // In-repo skills and hooks all read the active session file in the configured dir. The
   // store is additive; if this moved, every one of them would silently stop finding a session.
   const { out } = inSandbox(`
     await lib.saveSession({ token:'T', api_base:'https://a.example.com', builder:{github_login:'x'} });

package/tests/consumer_layout_boot.mjs

@@ -351,6 +351,8 @@ async function main() {
       key: 'consumer-probe',
       title: 'Consumer Probe',
       description: 'A host module that ships only in the instance repo, never in @bongos/core.',
+      // Required since task 1003781: a module names its own exact version.
+      version: '1.0.0',
       coreVersion: CORE_VERSION_RANGE,
       contributes: {},
     }, null, 2)}\n`);