@bongos/core 1.19.1073 → 1.19.1075

package/tests/hall_record_world.mjs

@@ -286,6 +286,11 @@ const TASK_SRC = read('task.js');
 // task.html loads md-reader.js ahead of task.js (task 1003465), so the sandbox
 // does the same: the description renders through it.
 const MD_SRC = read('md-reader.js');
+// task 1003459: task.js now destructures window.OTBClaimAction at eval time
+// (its Claim it button) — task.html loads claim-action.js ahead of task.js,
+// so the sandbox does too. Real file, not a stub: it is dependency-free and
+// DOM-free, so running it is exactly as cheap as stubbing it.
+const CLAIM_ACTION_SRC = read('claim-action.js');
 
 // grade / sessionLogs / claims (task 1003437): left undefined, the stub answers
 // like a client that never asked (the key is absent); null or an array answers
@@ -400,6 +405,7 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   if (withReader) vm.runInContext(MD_SRC, sandbox, { filename: 'md-reader.js' });
+  vm.runInContext(CLAIM_ACTION_SRC, sandbox, { filename: 'claim-action.js' });
   vm.runInContext(TASK_SRC, sandbox, { filename: 'task.js' });
   assert.ok(onReady, 'task.js registers its DOMContentLoaded boot');
   return {

package/tests/hall_tweak_editor.mjs

@@ -326,6 +326,57 @@ try {
     assert.match(html, /no longer match the page/);
     assert.match(html, /hero: “<b>new<\/b> line” \(added\)/);
     assert.equal(b.el('tw-notice').querySelectorAll('b').length, 0);
+    // The panel names the same lines, escaped too.
+    assert.equal(b.el('tw-refused').hidden, false);
+    assert.match(b.el('tw-refused-list').innerHTML, /hero: “<b>new<\/b> line” \(added\)/);
+    assert.equal(b.el('tw-refused-list').querySelectorAll('b').length, 0);
+  });
+
+  // Task 1004354: the owner's Google Docs upload was refused and nothing on
+  // the screen said so where they were looking.
+  await test('a refused upload opens a panel over the page: what happened, the next step, and a way on', async () => {
+    const b = bootEditor({ answers: {
+      'GET /copy-desk/pages/landing:index/draft': ok(editorRead()),
+      'FETCH POST /copy-desk/pages/landing:index/draft.docx': { ok: false, data: { error: { code: 'wrong_page', details: { page_details: false, mismatched: ['title', 'headings'], what_this_means: 'This file is not the download of this page: its title or its section headings are not this page\'s. Nothing was saved.' } } } },
+    } });
+    await b.settle();
+    assert.equal(b.el('tw-refused').hidden, true, 'closed until a refusal');
+    b.el('tw-file').fire('change', { target: { files: [{ type: '' }], value: 'x' } });
+    await b.settle();
+    assert.equal(b.el('tw-refused').hidden, false);
+    assert.equal(b.el('tw-refused-title').textContent, 'This file is a different page.');
+    assert.equal(boot.focused, b.el('tw-refused-title'), 'focus moves to the panel');
+    assert.match(b.el('tw-refused-what').textContent, /not the download of this page/);
+    assert.match(b.el('tw-refused-next').textContent, /Pick the file you downloaded from this page/);
+    assert.equal(b.el('tw-refused-list').hidden, true, 'no lines to name');
+    assert.equal(b.el('tw-refused-download').hidden, false);
+    assert.equal(b.el('tw-bar').inert, true);
+    assert.equal(b.el('tw-paper').inert, true);
+    assert.equal(b.el('tw-upload').textContent, 'upload .docx');
+    // Close: the page is back, and the paper still says what happened.
+    await b.click('tw-refused-close');
+    assert.equal(b.el('tw-refused').hidden, true);
+    assert.equal(b.el('tw-bar').inert, false);
+    assert.equal(b.el('tw-paper').inert, false);
+    assert.equal(boot.focused, b.el('tw-upload'));
+    assert.match(b.el('tw-notice').innerHTML, /not the download of this page/);
+    // Download again from the panel: it closes, and the page downloads.
+    b.el('tw-file').fire('change', { target: { files: [{ type: '' }], value: 'x' } });
+    await b.settle();
+    await b.click('tw-refused-download');
+    await b.settle();
+    assert.equal(b.el('tw-refused').hidden, true);
+    assert.equal(b.el('tw-download').textContent, 'downloaded .docx');
+  });
+
+  await test('each refusal the upload can answer has its own headline and next step', () => {
+    for (const code of ['wrong_page', 'reading_moved', 'structure_changed', 'not_a_docx', 'upload_too_large', 'page_not_held', 'page_in_flight']) {
+      const r = lib.uploadRefusal(code);
+      assert.ok(r.title && r.title !== 'Your file was not saved.', code);
+      assert.ok(r.next.length > 20, code);
+    }
+    assert.equal(lib.uploadRefusal('something_new').title, 'Your file was not saved.');
+    assert.match(lib.uploadRefusal('not_a_docx').next, /Google Docs/);
   });
 
   await test('submit: saves first, then "Home is in.", next up, and take next opens the next page', async () => {
@@ -409,7 +460,7 @@ try {
     assert.ok(HTML.indexOf('tweak-editor-lib.js') < HTML.indexOf('tweak-editor.js?'), 'the lib loads first');
     assert.match(HTML, /shell\.js\?v=2026-09-28-archive/);
     assert.equal(/fonts\.googleapis\.com\/css/.test(HTML), false);
-    for (const id of ['tw-bar', 'tw-counter', 'tw-open', 'tw-download', 'tw-upload', 'tw-file', 'tw-submit', 'tw-paper', 'tw-doc', 'tw-notice', 'tw-done', 'tw-take', 'tw-pick', 'tw-picks']) {
+    for (const id of ['tw-bar', 'tw-counter', 'tw-open', 'tw-download', 'tw-upload', 'tw-file', 'tw-submit', 'tw-paper', 'tw-doc', 'tw-notice', 'tw-done', 'tw-take', 'tw-pick', 'tw-picks', 'tw-refused', 'tw-refused-title', 'tw-refused-list', 'tw-refused-next', 'tw-refused-download', 'tw-refused-close']) {
       assert.ok(new RegExp(`id="${id}"`).test(HTML), `#${id} is in the markup`);
     }
     assert.match(HTML, />← studio</);

package/tests/helpers.mjs

@@ -58,7 +58,7 @@ export function makeSqlAwareClient(handler) {
 // tests/ is PUBLISHABLE, but the paths some tests assert are on
 // publish-manifest.js's PROTECTED_TOPOLOGY_EXCLUDE list (`.claude/hooks/`,
 // `.claude/settings.json`, `infra/`, `.github/`, `scripts/deploy/`) or are
-// instance-only content (`devbox-app/`, `config/<instance>.json`). A neutral
+// instance-only content (`config/<instance>.json`). A neutral
 // core checkout carries none of it, so an unconditional load CRASHED the file
 // at import and red-X'd the unit gate for every consumer.
 //

package/tests/host_topology_skips.mjs

@@ -3,7 +3,7 @@
 // tests/ is publishable, but some tests assert paths the neutral core deliberately does
 // not carry: publish-manifest.js's PROTECTED_TOPOLOGY_EXCLUDE (`.claude/hooks/`,
 // `.claude/settings.json`, `infra/`, `.github/`, `scripts/deploy/`) plus instance-only
-// content (`devbox-app/`, `config/<instance>.json`, an uninstalled module). Those files
+// content (`config/<instance>.json`, an uninstalled module). Those files
 // used to CRASH at import and red-X the unit gate for every consumer; they now skip
 // cleanly via the helpers in tests/helpers.mjs and run in full wherever the topology is
 // materialized.
@@ -33,8 +33,7 @@ const ALLOWED = {
   allow_rule_guard: '.claude/hooks/allow-rule-guard.js (package-excluded)',
   art_stage: 'scripts/gds/art-stage.js (art-pipeline tooling, not in the core)',
   bongos_downloads: 'config/bongos-cli.json (instance content)',
-  box_dns_repoint: 'infra/box-dns-cloudflare.sh (host topology)',
-  box_ship_permissions: '.claude/settings.json (package-excluded)',
+  cli_allowlist_permissions: '.claude/settings.json (package-excluded)',
   conductor: '.claude/hooks/conductor.js (package-excluded)',
   deploy_instance: 'scripts/deploy/deploy-instance.sh (host topology)',
   eviction_policy: '.claude/hooks/eviction-policy.js (package-excluded)',
@@ -94,5 +93,5 @@ test('the ratchet is non-vacuous and actually detects a skip', () => {
   assert.ok(actual.length >= 15, `expected the known skip set, found ${actual.length}`);
   assert.ok(actual.includes('stop_refcheck'), 'the hand-rolled precedent must still be detected');
   assert.ok(actual.includes('conductor'), 'a requireHostModule caller must be detected');
-  assert.ok(actual.includes('box_dns_repoint'), 'a skipUnlessPresent caller must be detected');
+  assert.ok(actual.includes('deploy_instance'), 'a skipUnlessPresent caller must be detected');
 });

package/tests/html_comment_nesting.mjs

@@ -0,0 +1,137 @@
+// tests/html_comment_nesting.mjs — no served page's comment may quote comment
+// syntax (task 1004359, BV2.TW24).
+//
+// An HTML comment ends at the FIRST closer, whatever its author meant. The head
+// note of contact, privacy and terms quoted the apex-only sentinel verbatim, so
+// the sentinel's closer ended the note early and the rest of the developer
+// prose rendered as text at the top of all three pages — and the page reader
+// filed it as page copy, so it reached Tweak Mode's editor too.
+//
+// The guard: in every served .html (each modules/<key>/public tree, plus
+// public-docs), no comment's body holds another opener, and no closer stands
+// outside a comment. Raw-text elements (script, style, textarea) are skipped:
+// the browser never parses comments inside them.
+//
+// The file list is walked from disk, not git, so a new untracked page is
+// scanned too, and a floor on the count keeps an emptied list from passing.
+//
+// Run:  node --test tests/html_comment_nesting.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const OPEN = '<!' + '--';
+const CLOSE = '--' + '>';
+
+/** Every .html under a served tree: modules/<key>/public/** and public-docs/**. */
+function servedHtml() {
+  const roots = [path.join(ROOT, 'public-docs')];
+  for (const key of fs.readdirSync(path.join(ROOT, 'modules'))) {
+    roots.push(path.join(ROOT, 'modules', key, 'public'));
+  }
+  const out = [];
+  const walk = (dir) => {
+    if (!fs.existsSync(dir)) return;
+    for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+      const p = path.join(dir, e.name);
+      if (e.isDirectory()) { if (e.name !== 'node_modules') walk(p); }
+      else if (e.name.endsWith('.html')) out.push(p);
+    }
+  };
+  roots.forEach(walk);
+  return out;
+}
+
+/** Blank raw-text elements, keeping newlines so line numbers still point true. */
+function blankRawText(html) {
+  return html.replace(/<(script|style|textarea)\b[^>]*>[\s\S]*?<\/\1\s*>/gi,
+    (m) => m.replace(/[^\n]/g, ' '));
+}
+
+const lineAt = (s, i) => s.slice(0, i).split('\n').length;
+
+/**
+ * The comment traps in one page, as "line N: why" strings (empty when clean).
+ * A comment runs from an opener to the FIRST closer after it, as the parser reads it.
+ */
+function commentTraps(html) {
+  const s = blankRawText(html);
+  const traps = [];
+  let i = 0;
+  for (;;) {
+    const o = s.indexOf(OPEN, i);
+    const c = s.indexOf(CLOSE, i);
+    if (c !== -1 && (o === -1 || c < o)) {
+      traps.push(`line ${lineAt(s, c)}: a comment closer outside any comment (text before it has leaked onto the page)`);
+      i = c + CLOSE.length;
+      continue;
+    }
+    if (o === -1) break;
+    const end = s.indexOf(CLOSE, o + OPEN.length);
+    if (end === -1) { traps.push(`line ${lineAt(s, o)}: a comment that never closes`); break; }
+    const inner = s.slice(o + OPEN.length, end).indexOf(OPEN);
+    if (inner !== -1) {
+      traps.push(`line ${lineAt(s, o + OPEN.length + inner)}: a comment that quotes a comment opener (its own closer ends the outer comment early)`);
+    }
+    i = end + CLOSE.length;
+  }
+  return traps;
+}
+
+// ── the detector, at unit altitude ──────────────────────────────────────────
+
+test('detector: the exact TW24 head note is caught', () => {
+  const html = `<head>\n${OPEN} Server-stamped: every ${OPEN}apex-only${CLOSE} region is REMOVED off\n     the hub. ${CLOSE}\n<title>x</title>`;
+  const traps = commentTraps(html);
+  assert.equal(traps.length, 2, traps.join('\n'));
+  assert.match(traps[0], /^line 2: .*quotes a comment opener/);
+  assert.match(traps[1], /^line 3: .*closer outside any comment/);
+});
+
+test('detector: the fixed wording and the real sentinels are clean', () => {
+  const html = `${OPEN} every apex-only:start/end region is REMOVED off the hub ${CLOSE}\n`
+    + `<p>a</p>${OPEN}apex-only:start${CLOSE}<p>b</p>${OPEN}apex-only:end${CLOSE}`;
+  assert.deepEqual(commentTraps(html), []);
+});
+
+test('detector: a lone opener inside a comment is caught even with no stray closer', () => {
+  assert.equal(commentTraps(`${OPEN} see ${OPEN} here ${CLOSE}`).length, 1);
+});
+
+test('detector: an unclosed comment is caught', () => {
+  assert.match(commentTraps(`<p>a</p>${OPEN} never ends`)[0], /never closes/);
+});
+
+test('detector: comment syntax inside script, style and textarea is ignored', () => {
+  const html = `<script>const re = /${OPEN}x${CLOSE}/; if (a ${CLOSE} b) {}</script>`
+    + `<style>/* ${CLOSE} */</style><textarea>${OPEN}</textarea>`;
+  assert.deepEqual(commentTraps(html), []);
+});
+
+test('detector: line numbers survive a blanked script above the trap', () => {
+  const html = `<script>\n1\n2\n</script>\n${OPEN} a ${OPEN} b ${CLOSE}`;
+  assert.match(commentTraps(html)[0], /^line 5: /);
+});
+
+// ── every served page ───────────────────────────────────────────────────────
+
+test('every served .html page is free of comment traps', () => {
+  const files = servedHtml();
+  // 39 pages on 2026-09-28 (hall 31, landing 5, status 2, public-docs 1); a
+  // floor well under that keeps a broken walk from passing on an empty list.
+  assert.ok(files.length >= 30, `expected at least 30 served pages, found ${files.length}`);
+  const names = files.map((f) => path.relative(ROOT, f).split(path.sep).join('/'));
+  for (const must of ['modules/public-landing/public/contact.html',
+    'modules/public-landing/public/privacy.html', 'modules/public-landing/public/terms.html']) {
+    assert.ok(names.includes(must), `${must} is in the scanned set`);
+  }
+  const bad = [];
+  files.forEach((f, k) => {
+    for (const t of commentTraps(fs.readFileSync(f, 'utf8'))) bad.push(`${names[k]} ${t}`);
+  });
+  assert.deepEqual(bad, [], `comment traps:\n${bad.join('\n')}`);
+});

package/tests/infra_exec_paths.mjs

@@ -31,11 +31,10 @@ function test(name, fn) {
   catch (err) { console.error(`  FAIL ${name}`); console.error('    ', err.message); failed++; }
 }
 
-// Host topology means systemd UNITS, not the bare infra/ directory: the neutral core
-// carries no units and no launcher (task 1002470), but it DOES ship the four ON-BOX
-// reporter scripts in infra/ (task 1002699 — dev boxes clone this repo and wire them
-// as crons). So the real-tree unit lint is gated on *.service files being present,
-// and the launcher checks on core-node.sh — the synthetic counterfactuals always run.
+// Host topology means systemd UNITS: the neutral core carries no units, no launcher
+// and no infra/ directory (task 1002470), so the real-tree unit lint is gated on
+// *.service files being present, and the launcher checks on core-node.sh — the
+// synthetic counterfactuals always run.
 const INFRA_DIR = path.join(REPO, 'infra');
 const HAS_UNITS = fs.existsSync(INFRA_DIR) &&
   fs.readdirSync(INFRA_DIR).some((f) => f.endsWith('.service'));
@@ -50,10 +49,10 @@ hostTest('lint-infra-exec: every core-script unit resolves in a consumer layout
   const r = lintInfraExec({ instanceRoot: REPO, coreRoot: REPO });
   assert.deepEqual(r.violations, [], `expected no violations, got: ${JSON.stringify(r.violations)}`);
   assert.ok(r.ok, 'lint should pass');
-  assert.equal(r.checked.length, 11, `expected all 11 core-script units repointed + resolving, got ${r.checked.length}`);
-  // The three core CLIs the units invoke are all covered.
+  assert.ok(r.checked.length >= 2, `expected the core-script units repointed + resolving, got ${r.checked.length}`);
+  // The core CLIs the units invoke are all covered.
   const rels = new Set(r.checked.map((c) => c.rel));
-  for (const rel of ['scripts/gds/box.js', 'scripts/gds/provision.js', 'scripts/gds/search-ingest-db.js']) {
+  for (const rel of ['scripts/gds/provision.js', 'scripts/gds/search-ingest-db.js']) {
     assert.ok(rels.has(rel), `expected a unit routing through ${rel}`);
   }
 });
@@ -64,9 +63,9 @@ test('lint-infra-exec: a bare repo-relative core ExecStart is flagged (counterfa
   try {
     fs.mkdirSync(path.join(tmp, 'infra'), { recursive: true });
     fs.mkdirSync(path.join(tmp, 'scripts', 'gds'), { recursive: true });
-    fs.writeFileSync(path.join(tmp, 'scripts', 'gds', 'box.js'), '// probe\n');
+    fs.writeFileSync(path.join(tmp, 'scripts', 'gds', 'provision.js'), '// probe\n');
     fs.writeFileSync(path.join(tmp, 'infra', 'legacy.service'),
-      '[Service]\nExecStart=/usr/bin/node scripts/gds/box.js run-intents --apply\n');
+      '[Service]\nExecStart=/usr/bin/node scripts/gds/provision.js run-intents --apply\n');
     const r = lintInfraExec({ instanceRoot: tmp, coreRoot: tmp });
     assert.ok(!r.ok, 'a bare repo-relative core ExecStart must fail the lint');
     assert.equal(r.violations.length, 1);

package/tests/init.mjs

@@ -88,7 +88,6 @@ test('buildModulesConfig: every known module present, enabled ones true', () =>
   assert.equal(m['art-pipeline'], true);
   assert.equal(m.game, false);
   assert.equal(m.discord, false);
-  assert.equal(m['dev-box'], false);
 });
 
 test('buildModulesConfig: vanilla (no modules) = all off', () => {
@@ -122,8 +121,8 @@ test('kickoffTasks: 7 base steps + 1 per enabled module', () => {
   const withArt = init.kickoffTasks(fullSpec());
   assert.equal(withArt.length, 8);                        // +1 Gemini key task
   assert.ok(withArt.some((t) => /Gemini/i.test(t.title)));
-  const all = init.kickoffTasks(init.normalizeSpec({ modules: ['art-pipeline', 'discord', 'dev-box'], firstAdmin: 'x', repo: { owner: 'o', name: 'n' } }));
-  assert.equal(all.length, 10);
+  const all = init.kickoffTasks(init.normalizeSpec({ modules: ['art-pipeline', 'discord'], firstAdmin: 'x', repo: { owner: 'o', name: 'n' } }));
+  assert.equal(all.length, 9);
 });
 
 test('kickoffTasks: includes the load-bearing owner-manual steps', () => {
@@ -141,7 +140,7 @@ test('kickoffTasks: includes the load-bearing owner-manual steps', () => {
 test('kickoffTasks: every kind/discipline satisfies the DB CHECK vocabulary', () => {
   const { VALID_KINDS, VALID_DISCIPLINES } = require('../modules/lifecycle/task-classifier.js');
   const all = [
-    ...init.kickoffTasks(init.normalizeSpec({ modules: ['art-pipeline', 'discord', 'dev-box', 'game'],
+    ...init.kickoffTasks(init.normalizeSpec({ modules: ['art-pipeline', 'discord', 'game'],
       firstAdmin: 'x', repo: { owner: 'o', name: 'n' } })),
     init.productionTopologyKickoff(),
   ];
@@ -429,7 +428,7 @@ test('enabledModuleDeps: merges only the ENABLED modules’ declared deps', () =
     'art-pipeline': { sharp: '^0.34.5' },
   }[k] || {});
   const merged = init.enabledModuleDeps(
-    { modules: { discord: true, game: false, 'art-pipeline': true, 'dev-box': false } },
+    { modules: { discord: true, game: false, 'art-pipeline': true } },
     { readDeps }
   );
   assert.deepEqual(merged, { 'discord.js': '^14.26.4', sharp: '^0.34.5' }); // game excluded (off)

package/tests/instance_manifest.mjs

@@ -30,17 +30,17 @@ const BRAND_VANILLA = {
   rankLabels: {},
 };
 const MODULES_OTB = {
-  enabled: { game: true, 'art-pipeline': true, discord: true, 'dev-box': true },
+  enabled: { game: true, 'art-pipeline': true, discord: true },
   disciplines: ['engineer', 'artist'],
 };
 const MODULES_VANILLA = {
-  enabled: { game: false, 'art-pipeline': false, discord: false, 'dev-box': false },
+  enabled: { game: false, 'art-pipeline': false, discord: false },
   disciplines: ['engineer'],
 };
 const REPO = { owner: 'example-owner', repo: 'example', branch: 'main', blob_base: 'x', tree_base: 'y' };
 
 test('manifest: schema id + headline name + embedded brand', () => {
-  const m = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false, devBoxEnabled: true });
+  const m = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false });
   assert.equal(m.schema, MANIFEST_SCHEMA);
   assert.equal(m.name, 'Example World');
   assert.equal(m.brand, BRAND_OTB);
@@ -48,13 +48,13 @@ test('manifest: schema id + headline name + embedded brand', () => {
 });
 
 test('manifest: brand.project rides the manifest — the settings read-back a manage page needs (task 1003140 / ADR 0190)', () => {
-  const m = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false, devBoxEnabled: true });
+  const m = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false });
   assert.deepEqual(m.brand.project, { platformVisibility: 'gated', joinability: 'invite_only' },
     'a client reads what the instance RESOLVED from here, never from the platform PATCH response');
 });
 
 test('manifest: rank ladder ordered entry→top, labelled from brand', () => {
-  const m = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false, devBoxEnabled: true });
+  const m = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false });
   assert.deepEqual(m.ranks.map((r) => r.key), ['xenos', 'thetes', 'metic', 'archon']);
   assert.deepEqual(m.ranks.map((r) => r.tier), [1, 2, 3, 4]);
   assert.equal(m.ranks[0].label, 'Xenos');
@@ -62,46 +62,39 @@ test('manifest: rank ladder ordered entry→top, labelled from brand', () => {
 });
 
 test('manifest: rank label falls back to the key when unlabelled', () => {
-  const m = buildInstanceManifest({ branding: BRAND_VANILLA, modules: MODULES_VANILLA, rankTier: RANK_TIER, repo: { error: 'no_repo_info' }, authConfigured: false, openEnrollment: false, devBoxEnabled: false });
+  const m = buildInstanceManifest({ branding: BRAND_VANILLA, modules: MODULES_VANILLA, rankTier: RANK_TIER, repo: { error: 'no_repo_info' }, authConfigured: false, openEnrollment: false });
   assert.equal(m.ranks[0].label, 'xenos');
   assert.equal(m.ranks[2].label, 'metic');
 });
 
 test('manifest: repo projects to public clone coords; null on error', () => {
-  const ok = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false, devBoxEnabled: true });
+  const ok = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false });
   assert.deepEqual(ok.repo, { owner: 'example-owner', repo: 'example', branch: 'main', url: 'https://github.com/example-owner/example' });
-  const none = buildInstanceManifest({ branding: BRAND_VANILLA, modules: MODULES_VANILLA, rankTier: RANK_TIER, repo: { error: 'no_repo_info' }, authConfigured: false, openEnrollment: false, devBoxEnabled: false });
+  const none = buildInstanceManifest({ branding: BRAND_VANILLA, modules: MODULES_VANILLA, rankTier: RANK_TIER, repo: { error: 'no_repo_info' }, authConfigured: false, openEnrollment: false });
   assert.equal(none.repo, null);
 });
 
 test('manifest: auth methods gated on configured', () => {
-  const on = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false, devBoxEnabled: true });
+  const on = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false });
   assert.deepEqual(on.auth.methods, AUTH_METHODS);
   assert.equal(on.auth.configured, true);
-  const off = buildInstanceManifest({ branding: BRAND_VANILLA, modules: MODULES_VANILLA, rankTier: RANK_TIER, repo: { error: 'x' }, authConfigured: false, openEnrollment: false, devBoxEnabled: false });
+  const off = buildInstanceManifest({ branding: BRAND_VANILLA, modules: MODULES_VANILLA, rankTier: RANK_TIER, repo: { error: 'x' }, authConfigured: false, openEnrollment: false });
   assert.deepEqual(off.auth.methods, []);
   assert.equal(off.auth.configured, false);
 });
 
 test('manifest: admission policy reflects open-enrollment flag', () => {
-  const invite = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false, devBoxEnabled: true });
+  const invite = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false });
   assert.equal(invite.admission.policy, 'invite-only');
-  const open = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: true, devBoxEnabled: true });
+  const open = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: true });
   assert.equal(open.admission.policy, 'open');
 });
 
-test('manifest: dev-box availability mirrors the module flag', () => {
-  const on = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false, devBoxEnabled: true });
-  assert.equal(on.devBox.available, true);
-  const off = buildInstanceManifest({ branding: BRAND_VANILLA, modules: MODULES_VANILLA, rankTier: RANK_TIER, repo: { error: 'x' }, authConfigured: false, openEnrollment: false, devBoxEnabled: false });
-  assert.equal(off.devBox.available, false);
-});
-
 test('manifest: no server-only secrets/topology leak into the body', () => {
   // The assembler only ever reads the client-safe projections it is handed, so
   // even if a caller passed a fuller object, these server-only keys must not
   // appear. We assert on the serialized body (deep, key-name based).
-  const m = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false, devBoxEnabled: true });
+  const m = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false });
   const json = JSON.stringify(m);
   for (const forbidden of ['cookieDomain', 'oauthOrigin', 'publicOrigin', 'envPrefix', 'client_secret', 'dbName', 'instanceDbName', 'token']) {
     assert.ok(!json.includes(forbidden), `manifest leaked "${forbidden}"`);
@@ -109,8 +102,8 @@ test('manifest: no server-only secrets/topology leak into the body', () => {
 });
 
 test('manifest: vanilla instance is fully populated (every field present)', () => {
-  const m = buildInstanceManifest({ branding: BRAND_VANILLA, modules: MODULES_VANILLA, rankTier: RANK_TIER, repo: { error: 'x' }, authConfigured: false, openEnrollment: false, devBoxEnabled: false });
-  for (const k of ['schema', 'name', 'brand', 'modules', 'ranks', 'repo', 'auth', 'admission', 'devBox']) {
+  const m = buildInstanceManifest({ branding: BRAND_VANILLA, modules: MODULES_VANILLA, rankTier: RANK_TIER, repo: { error: 'x' }, authConfigured: false, openEnrollment: false });
+  for (const k of ['schema', 'name', 'brand', 'modules', 'ranks', 'repo', 'auth', 'admission']) {
     assert.ok(k in m, `missing field ${k}`);
   }
   assert.equal(m.name, 'Cloud Bongos');
@@ -124,7 +117,7 @@ const buildInstanceRouter = instanceMod;
 import { strangerManifest } from '../src/bongos/routes/instance.js';
 
 const IDP = { origin: 'https://hub.example.com', client_id: 'proj-1' };
-const FULL = () => buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: false, openEnrollment: false, devBoxEnabled: true, idp: IDP });
+const FULL = () => buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: false, openEnrollment: false, idp: IDP });
 
 test('stranger manifest: schema, name, brand.project, auth (idp kept), admission — and nothing else', () => {
   const s = strangerManifest(FULL());
@@ -136,13 +129,13 @@ test('stranger manifest: schema, name, brand.project, auth (idp kept), admission
   assert.deepEqual(s.auth, { methods: AUTH_METHODS, configured: true, idp: IDP });
   assert.deepEqual(s.admission, { policy: 'invite-only' });
   const json = JSON.stringify(s);
-  for (const gone of ['example-owner', 'github.com', 'Straight example world', 'Hermeslines', 'drachmae', 'art-pipeline', 'Archon', 'devBox']) {
+  for (const gone of ['example-owner', 'github.com', 'Straight example world', 'Hermeslines', 'drachmae', 'art-pipeline', 'Archon']) {
     assert.ok(!json.includes(gone), `a stranger must not read "${gone}"`);
   }
 });
 
 test('stranger manifest: a brand with no project policy projects none', () => {
-  const s = strangerManifest(buildInstanceManifest({ branding: BRAND_VANILLA, modules: MODULES_VANILLA, rankTier: RANK_TIER, repo: { error: 'x' }, authConfigured: false, openEnrollment: true, devBoxEnabled: false }));
+  const s = strangerManifest(buildInstanceManifest({ branding: BRAND_VANILLA, modules: MODULES_VANILLA, rankTier: RANK_TIER, repo: { error: 'x' }, authConfigured: false, openEnrollment: true }));
   assert.deepEqual(JSON.parse(JSON.stringify(s.brand)), { identity: { productName: 'Cloud Bongos' } });
   assert.equal(s.admission.policy, 'open');
 });

package/tests/kickoff_checklist.mjs

@@ -76,7 +76,7 @@ test('firstSignIn: never reads spec.repo or spec.firstAdmin (the steps that need
 });
 
 test('every variant satisfies the DB CHECK vocabulary (tasks_kind_check / tasks_discipline_check)', () => {
-  const full = { ...spec(), modules: ['art-pipeline', 'discord', 'dev-box'] };
+  const full = { ...spec(), modules: ['art-pipeline', 'discord'] };
   const all = [
     ...kickoffChecklist(full),
     ...kickoffChecklist(full, { provisioned: true }),