@bongos/core 1.19.1073 → 1.19.1075

package/tests/publish_manifest.mjs

@@ -57,8 +57,7 @@ const PUBLISH = [
   'modules/lifecycle/db.js',
   'modules/grading/grader.js',
   'modules/hall-ui/public/work.js',
-  'modules/dev-box/boxes.js',
-  'modules/provisioning/provisioning.js',  // instance-hosting control plane — CORE like its sibling dev-box (task 2135)
+  'modules/provisioning/provisioning.js',  // instance-hosting control plane — CORE (task 2135)
   // served-at-runtime surfaces a standalone must carry (task 2078) — their absence
   // from the packaged core 404'd the hall UI + /docs on demo.cloudbongos.com
   'clients/bongos-client/bongos-client.global.js', // /lib/bongos-client.js (window.BongosClient)
@@ -116,7 +115,7 @@ const EXCLUDE = [
   // instance identity + history
   'config/branding.json',
   'config/modules.json',
-  'config/devbox-app.json',
+  'config/hierarchy.json',
   'CODEOWNERS',
   'docs/project-context.md',
   'docs/lore/founding-myth.md',

package/tests/publish_reconciler.mjs

@@ -3,7 +3,7 @@
 // Unit tests for the server-owned publish reconciler (task 1134) — the durable
 // cure for the "strands at confirmed" class. A server-mediated publish (ADR 0055)
 // is async; ship.js stops polling after ~9 min, so the confirmed→shipped flip had
-// no driver once the box exited. This module sweeps confirmed tasks on a timer and
+// no driver once the client exited. This module sweeps confirmed tasks on a timer and
 // runs the EXACT shipTask + postShipBroadcast the publish-status route runs.
 //
 // runSweep is pure w.r.t. injected deps (db / githubPush / emit / loggers)
@@ -1366,7 +1366,7 @@ test('1002606 the aged stale strand now ALSO emits task.strand-flagged', async (
 
 // ---------------------------------------------------------------------------
 // task 1002645 — the reconciler was blind to laptop/wave ships. The sweep derives
-// claude/<worktree_name> (dev-box convention); a wave ship pushes
+// claude/<worktree_name> first; a wave ship pushes
 // worktree-<worktree_name>, so getPublishStatus saw pr_state:'none' and the whole
 // PR path (mergeIfGreen nudge — the ONLY merger where native auto-merge is
 // repo-disallowed — conflict heal, land proof) never engaged. PRs 34/35/36 all
@@ -1378,7 +1378,7 @@ test('1002645 THE PIN: a worktree-named branch (laptop wave ship) lands UNATTEND
   const deps = mkDeps({
     rows: [{ task_id: 2645, builder_id: 95, worktree_name: 'task-2645', published_head_sha: ON_MAIN }],
     statusByBranch: {
-      'claude/task-2645': NONE,                 // the derived dev-box branch has no PR
+      'claude/task-2645': NONE,                 // the derived claude/ branch has no PR
       'worktree-task-2645': LANDED_NO_WORKFLOW, // the REAL branch: merged, pin-bump repo
     },
     taskPrByTask: { 2645: { branch: 'worktree-task-2645', pr_number: 36, pr_state: 'closed', merged: true } },
@@ -1418,14 +1418,14 @@ test('1002645 a legacy laptop strand (no recorded tip) heals retroactively via t
   assert.deepEqual(deps._calls.ship, [{ taskId: 2616, builderId: 95 }]);
 });
 
-test('1002645 the fallback does NOT fire when the derived branch already has a PR (dev-box path unchanged)', async () => {
+test('1002645 the fallback does NOT fire when the derived branch already has a PR (derived-branch path unchanged)', async () => {
   const deps = mkDeps({
-    rows: [{ task_id: 900, builder_id: 1, worktree_name: 'wt-box' }],
-    statusByBranch: { 'claude/wt-box': PENDING },
+    rows: [{ task_id: 900, builder_id: 1, worktree_name: 'wt-derived' }],
+    statusByBranch: { 'claude/wt-derived': PENDING },
     taskPrByTask: { 900: new Error('search must not run') },
   });
   await reconciler.runSweep(deps);
-  assert.equal(deps._calls.search.length, 0, 'a dev-box ship keeps the derived-branch path — no extra API call');
+  assert.equal(deps._calls.search.length, 0, 'a ship whose derived branch has a PR keeps that path — no extra API call');
 });
 
 test('1002645 a PR-search failure is swallowed — the sweep continues to the next task and retries next sweep', async () => {
@@ -1481,7 +1481,7 @@ test('1002723 THE PIN: a PR on the BARE worktree branch (task-<id>, no prefix) l
   });
   const r = await reconciler.runSweep(deps);
   assert.equal(r.reconciled, 1, 'the merged-PR-on-bare-branch shape must land with no manual flip');
-  assert.ok(deps._calls.status.includes('claude/task-77'), 'dev-box convention tried first');
+  assert.ok(deps._calls.status.includes('claude/task-77'), 'the derived claude/<worktree_name> branch is tried first');
   assert.ok(deps._calls.status.includes('task-77'), 'then the bare worktree branch');
   assert.deepEqual(deps._calls.ship, [{ taskId: 77, builderId: 3 }]);
 });

package/tests/push_path_brief.mjs

@@ -1,11 +1,12 @@
 // tests/push_path_brief.mjs
 //
-// Task 1003259 / idea 1000838 — a dev-box agent, unable to see WHY its git probes were
-// failing, asked the owner to mint a PAT and store it on the box. push-path-brief.js is
-// the SessionStart line that states the credential model natively so that request never
-// gets made again. These tests pin BOTH halves: the line fires on the server-publish
-// path with the load-bearing phrases intact, and it is SILENT everywhere else — the
-// silence is half the design (a line firing on every healthy laptop becomes wallpaper).
+// Task 1003259 / idea 1000838 — an agent on a checkout with no GitHub push credential, unable
+// to see WHY its git probes were failing, asked the owner to mint a PAT and store it on the
+// machine. push-path-brief.js is the SessionStart line that states the credential model
+// natively so that request never gets made again. These tests pin BOTH halves: the line
+// fires on the server-publish path with the load-bearing phrases intact, and it is SILENT
+// everywhere else — the silence is half the design (a line firing on every healthy laptop
+// becomes wallpaper).
 //
 // DB-free + network-free: briefLine is pure, and the CLI cases force the path with
 // OTB_PUSH_VIA_SERVER so pushVia() never spawns gh. Run:  node tests/push_path_brief.mjs
@@ -31,14 +32,14 @@ t('server path gets the brief, with every load-bearing phrase', () => {
   const l = brief.briefLine('server');
   assert.ok(typeof l === 'string' && l.length > 0, 'expected a line on the server path');
   // Each phrase is one of the three facts the 2026-08-24 incident showed an agent
-  // cannot infer from inside a box. Losing any of them re-opens the gap.
+  // cannot infer from inside such a checkout. Losing any of them re-opens the gap.
   for (const must of [
     'NO GitHub push credential',
     'BY DESIGN',
     '/builder-ship',
     'NEVER ask the owner for a PAT',
     'publish-status',
-    // task 1003988: a box that cannot see which test failed re-pushes blind.
+    // task 1003988: a session that cannot see which test failed re-pushes blind.
     'merge_driver.failing_tests',
     'checks_unreadable',
   ]) {
@@ -58,7 +59,7 @@ t('undetermined path stays silent (fail-open, exact vocabulary only)', () => {
 });
 
 t('the line is the exported static constant — nothing is interpolated', () => {
-  // Trust boundary: this string is injected into every box session's context. Pinning
+  // Trust boundary: this string is injected into every server-publish session's context. Pinning
   // it to the constant proves no builder-authored text can ever ride along.
   assert.equal(brief.briefLine('server'), brief.BRIEF);
 });

package/tests/rank_tier_single_source.mjs

@@ -12,8 +12,7 @@
 //      modules/discord/discord-channels.js): dependency-free substrate
 //      (permission-path-check runs in a bare git hook), source-parsed literals
 //      (src/bongos/db.js — gate-review.js + diagram-facts.js regex its text),
-//      standalone CLIs (sequence), the require-free dev-box
-//      module template (boxes.js), zero-dep catalog + its text-parsing auditor
+//      standalone CLIs (sequence), zero-dep catalog + its text-parsing auditor
 //      (route-rank-check), and the hall browser statics.
 //   3. NO NEW parallel map can land: a repo scan flags any rank→number map or
 //      rank-ladder array literal outside the allowlist below, both directions —
@@ -38,7 +37,6 @@ const lifecycleDb = require(path.join(ROOT, 'modules', 'lifecycle', 'db.js'));
 const ppc = require(path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'));
 const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
 const sequence = require(path.join(ROOT, 'scripts', 'gds', 'sequence.js'));
-const boxes = require(path.join(ROOT, 'modules', 'dev-box', 'boxes.js'));
 const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 
 const LADDER = kernel.LIVE_RANK_LADDER;
@@ -81,15 +79,6 @@ test('1-based local copies match: permission-path-check, sequence CLI', () => {
   assert.deepEqual(sequence.RANK_TIER, TIER, 'sequence.js CLI copy drifted');
 });
 
-test('0-based local copies match: dev-box boxes.js', () => {
-  for (const [name, map] of [['boxes', boxes.RANK_ORDER]]) {
-    assert.deepEqual(Object.keys(map).sort(), [...RANK_KEYS].sort(), `${name} keys drifted`);
-    for (const r of RANK_KEYS) {
-      assert.equal(map[r], TIER[r] - 1, `${name}.RANK_ORDER.${r} must be tier-1 (0-based)`);
-    }
-  }
-});
-
 test('ladder mirrors match: governance catalog, route-rank-check', () => {
   assert.deepEqual([...catalog.RANK_ORDER], [...LADDER]);
   assert.deepEqual([...rrc.PERMISSION_RANK_ORDER], [...LADDER]);
@@ -192,7 +181,6 @@ const MAP_ALLOWLIST = new Set([
   'src/bongos/db.js',
   'src/bongos/permission-path-check.js',
   'scripts/gds/sequence.js',
-  'modules/dev-box/boxes.js',
   'modules/hall-ui/public/builders.js',
   // task 1003206 carved the hall page scripts up. builders.js KEPT its map (the
   // renderers read it through the injected ctx), while goals-page.js's travelled

package/tests/regrade_eligibility.mjs

@@ -202,7 +202,7 @@ test('buildGradePayload confidence defaults to null when signals omit it', () =>
 //
 // The 'confirmed' answer hardcoded "run /merge-mode", which lands by pushing main
 // via push-main.js (SEC #863 / ADR 0043) and needs an authenticated gh plus a main
-// checkout. A server-mediated builder (pushVia()==='server' — every dev box) has
+// checkout. A server-mediated builder (pushVia()==='server' — a checkout with no GitHub push credential) has
 // neither, so the advice was unreachable by construction. It cost a real builder
 // 163 minutes on 2026-08-21. strandNextStep already had the right wording for both
 // modes; these pin that the two modes now diverge and that neither regresses.

package/tests/rename_history_restraint.mjs

@@ -123,7 +123,7 @@ test('the alias mount passes while present and FAILS when dropped', () => {
   assert.equal(check.checkAliasMounts({ mounts: ['/api/bongos/v1', '/api/bongos', '/api/gds'], required }).ok, true);
 
   const r = check.checkAliasMounts({ mounts: ['/api/bongos/v1', '/api/bongos'], required });
-  assert.equal(r.ok, false, 'shipped Dev Box binaries call the alias and cannot be force-updated');
+  assert.equal(r.ok, false, 'shipped binaries and live instances call the alias and cannot be force-updated');
   assert.deepEqual(r.missing, ['/api/gds']);
 });
 

package/tests/repo_map.mjs

@@ -87,22 +87,21 @@ test('extractor parses functions, classes, arrow consts, and module.exports', ()
   // exercise the pure extractor against the real auth.js + a known class file
   const r = run(['--json']);
   const model = JSON.parse(r.stdout);
-  // cf-tunnel.js moved modules/dev-box/ -> scripts/gds/ in task 1943 (ADR 0111 §2,
-  // shared control-plane clients). Pin the extractor against its current home.
-  const cfTunnel = model.allSyms.find((s) => s.name === 'CfTunnelApi' && s.file === 'scripts/gds/cf-tunnel.js');
-  assert.ok(cfTunnel && cfTunnel.kind === 'class', 'class declarations are detected');
+  // DoApi is a plain `class X extends Y` declaration in a control-plane client.
+  const doApi = model.allSyms.find((s) => s.name === 'DoApi' && s.file === 'scripts/gds/do-api.js');
+  assert.ok(doApi && doApi.kind === 'class', 'class declarations are detected');
   const apiCall = model.allSyms.find((s) => s.name === 'apiCall' && s.file === 'scripts/gds/cli-lib.js');
   assert.ok(apiCall && apiCall.exported && apiCall.kind === 'fn', 'exported arrow/fn const detected with export flag');
 });
 
-test('--whole-only never writes a TRACKED nested block (the sparse-box deadlock guard, task 1002962)', () => {
-  // A dev box is a SPARSE checkout — box-access.js materializes only the claim's
-  // module cone. The block ordering is `b.refs - a.refs || name` and `refs` counts
-  // references across the VISIBLE corpus, so a box with 7 of 20 modules emits a
-  // legitimately different block. box-source-fetch.sh used to write it, dirtying
-  // tracked files, and the NEXT `git pull` aborted on "local changes would be
-  // overwritten" — a silent permanent sync deadlock (one box sat 257 commits behind
-  // for three days). A box CONSUMES these blocks; only a full checkout may write them.
+test('--whole-only never writes a TRACKED nested block (the sparse-checkout deadlock guard, task 1002962)', () => {
+  // A SPARSE checkout holds only part of the module tree. The block ordering is
+  // `b.refs - a.refs || name` and `refs` counts references across the VISIBLE
+  // corpus, so a checkout with 7 of 20 modules emits a legitimately different block.
+  // A fetch script used to write it, dirtying tracked files, and the NEXT `git pull`
+  // aborted on "local changes would be overwritten" — a silent permanent sync
+  // deadlock (one checkout sat 257 commits behind for three days). A sparse checkout
+  // CONSUMES these blocks; only a full checkout may write them.
   //
   // Asserted on CONTENT, not on the log line: dirty a tracked block, run --whole-only,
   // and require the block to come back byte-identical. A regression that re-enabled the
@@ -117,7 +116,7 @@ test('--whole-only never writes a TRACKED nested block (the sparse-box deadlock
     assert.equal(
       readFileSync(tracked, 'utf8'),
       drifted,
-      '--whole-only rewrote a tracked nested block — this is the deadlock that stranded a box 257 commits behind',
+      '--whole-only rewrote a tracked nested block — this is the deadlock that stranded a checkout 257 commits behind',
     );
     assert.ok(!r.stdout.includes('CLAUDE.md'), `--whole-only must not report a nested-doc write; got: ${r.stdout.trim()}`);
   } finally {

package/tests/runner_drift.mjs

@@ -77,9 +77,9 @@ t('assessRunnerUnit: a drop-in that ADDS an ExecStart without clearing leaves th
 t('runnerScriptPath: node + a relative script resolves against WorkingDirectory; a wrapper resolves to null', () => {
   assert.equal(runnerScriptPath({ workingDirectory: INSTANCE, execStart: '/usr/bin/node node_modules/@bongos/core/scripts/gds/provision.js run-intents --apply' }),
     `${INSTANCE}/node_modules/@bongos/core/scripts/gds/provision.js`);
-  assert.equal(runnerScriptPath({ workingDirectory: '/w', execStart: '/usr/bin/env node /abs/core/scripts/gds/box.js run-intents' }), '/abs/core/scripts/gds/box.js');
-  assert.equal(runnerScriptPath({ workingDirectory: '/w', execStart: '-/usr/bin/node scripts/gds/box.js' }), '/w/scripts/gds/box.js', 'systemd exec prefixes are stripped');
-  assert.equal(runnerScriptPath({ workingDirectory: '/w', execStart: '/usr/bin/env NODE_ENV=production node --max-old-space-size=512 scripts/gds/box.js' }), '/w/scripts/gds/box.js', 'env assignments and node flags are skipped');
+  assert.equal(runnerScriptPath({ workingDirectory: '/w', execStart: '/usr/bin/env node /abs/core/scripts/gds/provision.js run-intents' }), '/abs/core/scripts/gds/provision.js');
+  assert.equal(runnerScriptPath({ workingDirectory: '/w', execStart: '-/usr/bin/node scripts/gds/provision.js' }), '/w/scripts/gds/provision.js', 'systemd exec prefixes are stripped');
+  assert.equal(runnerScriptPath({ workingDirectory: '/w', execStart: '/usr/bin/env NODE_ENV=production node --max-old-space-size=512 scripts/gds/provision.js' }), '/w/scripts/gds/provision.js', 'env assignments and node flags are skipped');
   assert.equal(runnerScriptPath({ workingDirectory: '/w', execStart: '/usr/bin/env bash infra/core-node.sh scripts/gds/provision.js' }), null,
     'a shell wrapper decides at runtime which core it loads — the gate must not guess');
 });
@@ -130,24 +130,6 @@ t('runnerBanner: names the runner core + path, and flags a differing instance co
   assert.equal(runnerBanner({ runnerVersion: null, runnerRoot: '/r', instanceVersion: null, instanceRoot: '/i' }), 'runner core ? from /r (no installed core at /i)');
 });
 
-// box.js run-intents is the other runner the incident class covers — it opens with the same line.
-const { cmdRunIntents: boxRunIntents } = await import('../scripts/gds/box.js');
-{
-  const lines = [];
-  const origLog = console.log;
-  const origRoot = process.env.BONGOS_INSTANCE_ROOT;
-  process.env.BONGOS_INSTANCE_ROOT = '/no/such/instance';
-  console.log = (l) => lines.push(String(l));
-  try { await boxRunIntents({ query: async () => ({ rows: [] }) }, {}, null, { apply: false }); }
-  finally {
-    console.log = origLog;
-    if (origRoot === undefined) delete process.env.BONGOS_INSTANCE_ROOT; else process.env.BONGOS_INSTANCE_ROOT = origRoot;
-  }
-  t('box.js run-intents opens with the runner core version line', () => {
-    assert.match(lines[0], /^runner core \d+\.\d+\.\d+ from .+ \(no installed core at \/no\/such\/instance\)$/);
-  });
-}
-
 const { runnerDriftRows } = await import('../scripts/gds/doctor.js');
 
 t('doctor maps each verdict to a row: ok → ok, drift → FAIL with the fix, unresolved → warn', () => {