@bongos/core 1.19.1074 → 1.19.1075

package/bin/bongos.js

@@ -12,9 +12,7 @@
 // scripts/gds/cli-lib.js.
 //
 // Phases 2-4 extend this same CLI with a one-line installer + standalone binary
-// and instance-agnostic `login`/`init`/`upgrade`. (They also added `shell`/`code`,
-// VS Code Remote-SSH into a per-builder dev box; the dev box was retired and
-// those verbs removed with it — task 1003889.)
+// and instance-agnostic `login`/`init`/`upgrade`.
 
 'use strict';
 

package/docs/api/openapi.json

@@ -7,7 +7,7 @@
       "name": "AGPL-3.0-or-later",
       "url": "https://www.gnu.org/licenses/agpl-3.0.html"
     },
-    "description": "The Bongos API — the build-methodology backend\n(builders, tasks, claims, credits, grading, memory, dev boxes).\n\n**API version:** `v1` — served at `/api/bongos/v1`. The\nunversioned `/api/bongos` and legacy `/api/gds` are permanent aliases\npinned to this version; pin to `/api/bongos/v1` for a stable\ncontract (breaking changes ship a new `/vN`, ADR 0117). This is the\nCONTRACT version, distinct from the package build in `info.version`.\n\n**Base path:** `/api/bongos` (every path below is relative to it).\n\n**Auth:** a builder session — the `gds_session` cookie (web) or\n`Authorization: Bearer <token>` (CLI). **Ranks** gate writes and are\nenforced server-side per request, never cached (ADR 0016):\n`public` < `any-builder` < `metic+archon` < `archon`.\nEach operation carries its required rank in `x-rank`.\n\nGenerated from the live route files by `scripts/gds/gen-api-docs.js` —\ndo not hand-edit; it regenerates on every ship."
+    "description": "The Bongos API — the build-methodology backend\n(builders, tasks, claims, credits, grading, memory).\n\n**API version:** `v1` — served at `/api/bongos/v1`. The\nunversioned `/api/bongos` and legacy `/api/gds` are permanent aliases\npinned to this version; pin to `/api/bongos/v1` for a stable\ncontract (breaking changes ship a new `/vN`, ADR 0117). This is the\nCONTRACT version, distinct from the package build in `info.version`.\n\n**Base path:** `/api/bongos` (every path below is relative to it).\n\n**Auth:** a builder session — the `gds_session` cookie (web) or\n`Authorization: Bearer <token>` (CLI). **Ranks** gate writes and are\nenforced server-side per request, never cached (ADR 0016):\n`public` < `any-builder` < `metic+archon` < `archon`.\nEach operation carries its required rank in `x-rank`.\n\nGenerated from the live route files by `scripts/gds/gen-api-docs.js` —\ndo not hand-edit; it regenerates on every ship."
   },
   "x-api-version": "v1",
   "servers": [
@@ -13659,7 +13659,7 @@
           "provisioning"
         ],
         "summary": "GET /provisioning/fleet",
-        "description": "GET /provisioning/fleet — the full instance roster across all owners. rank: archon (exposes every owner's instance + cost; the /boxes precedent).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `provisioning.fleet.manage` (all required).",
+        "description": "GET /provisioning/fleet — the full instance roster across all owners. rank: archon (exposes every owner's instance + cost).\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `provisioning.fleet.manage` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "x-permissions": [
@@ -13700,7 +13700,7 @@
           "provisioning"
         ],
         "summary": "GET /provisioning/fleet/cost-ledger",
-        "description": "GET /provisioning/fleet/cost-ledger — per-instance monthly cost to us + estimated cost to its owner, with totals. rank: archon — cost oversight across the fleet (the /boxes/cost-ledger precedent). Declared among the archon routes (archon-first) for correct auditor classification.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `provisioning.fleet.manage` (all required).",
+        "description": "GET /provisioning/fleet/cost-ledger — per-instance monthly cost to us + estimated cost to its owner, with totals. rank: archon — cost oversight across the fleet. Declared among the archon routes (archon-first) for correct auditor classification.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `provisioning.fleet.manage` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/provisioning/routes/provisioning.js",
         "x-permissions": [
@@ -19293,7 +19293,7 @@
           "tasks"
         ],
         "summary": "GET /tasks/:id/publish-status",
-        "description": "GET /tasks/:id/publish-status?branch=<branch> — poll the PR + prod-deploy state for a server-mediated publish so ship.js can confirm the land WITHOUT gh on the box. Ownership-gated like the POST. Derives state live from GitHub. `branch` is optional (task 1003764): without it the server finds the task's own PR (both publish paths title it \"task <id>: …\") and the answer names the `branch` it used and its `branch_source`, so the check agents are sent to instead of git probes never refuses a live publish for want of a branch name.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "GET /tasks/:id/publish-status?branch=<branch> — poll the PR + prod-deploy state for a server-mediated publish so ship.js can confirm the land WITHOUT gh on the checkout. Ownership-gated like the POST. Derives state live from GitHub. `branch` is optional (task 1003764): without it the server finds the task's own PR (both publish paths title it \"task <id>: …\") and the answer names the `branch` it used and its `branch_source`, so the check agents are sent to instead of git probes never refuses a live publish for want of a branch name.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/lifecycle/routes/tasks.js",
         "parameters": [

package/docs/module-api-changelog.md

@@ -2635,5 +2635,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1072 with no explicit bump. run 36485068639. (task 1002620)
   1.19.1074 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1073 with no explicit bump. run 36510198162. (task 1002620)
+  1.19.1075 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1074 with no explicit bump. run 36512197709. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/copy-desk/routes/copy-desk.js

@@ -66,7 +66,7 @@ const { waitingRoundOrFail, refuseDecision, nextWaiting } = require('../page-dec
 const { validateOrRespond } = api;
 
 // The doorway's namespaced logger, not console.error (task 1003114). Same seam
-// builder-settings / dev-box / ideas / government already use: a module's log
+// builder-settings / ideas / government already use: a module's log
 // lines come out structured and attributable, and an error object logged as
 // `{ err }` keeps its stack instead of being stringified into one line.
 const log = api.logger('copy-desk');

package/modules/discord/ship-broadcast.js

@@ -8,9 +8,9 @@
 // either path. ship.js re-exports it so its existing regression test is unchanged.
 //
 // postShipBroadcast is the SERVER-SIDE poster (task 1045). On the server-mediated
-// publish path a dev box cannot post the broadcast — it holds no webhook secret
-// (ADR 0053 "box holds nothing"), which is exactly why a box ship was silently
-// skipping the public announcement. So when the GDS server confirms the deploy
+// publish path the uploading checkout cannot post the broadcast — it holds no
+// webhook secret, which is exactly why such a ship was silently skipping the
+// public announcement. So when the GDS server confirms the deploy
 // landed (publish-status reconcile, confirmed→shipped), the server — which holds
 // the webhook secrets and just deployed — fires the broadcast instead. Best-effort:
 // it never throws, so a Discord hiccup can never undo a ship.

package/modules/economy/credits.js

@@ -919,7 +919,7 @@ async function awardIdeaGovernancePassCredit(client, {
 //                  column the route's empty-session guard checks). Used ONLY as a
 //                  fallback: when modelUsage prices to $0 but the session carried
 //                  real tokens, the reward is priced from totalTokens at the opus
-//                  rate so the dev-box/CI agent path (which historically uploaded
+//                  rate so the CI agent path (which historically uploaded
 //                  empty/unpriceable model_usage → $0 reward; ADR 0097) still pays
 //                  the real cost-plus amount. This is NOT a fabricated dollar value
 //                  — it prices REAL token counts via the same locked PRICES table.
@@ -941,7 +941,7 @@ async function awardIdeaGovernancePassCredit(client, {
 // what actually paid.
 //
 // Cost-plus zero-out fallback (task 1676). priceModelUsage returns $0 when
-// model_usage is empty or carries no token counts — the exact dev-box/CI symptom
+// model_usage is empty or carries no token counts — the exact CI-agent symptom
 // ADR 0097 records ("upload no priced model usage"). When that happens but the
 // session DID carry real tokens, price the total at the opus rate so the reward
 // reflects the real spend instead of silently rounding to 0. The blend assumes a

package/modules/ideas/projection.js

@@ -50,7 +50,7 @@ const IDEA_COLS = IDEA_COL_NAMES.join(', ');
 //
 // THE DOOR IS READ OFF THE SESSION, not claimed in the body. A web cookie is the
 // hall (the ideas form, the sky's composer), a device-flow token is the CLI
-// (capture.js, spark.js), anything else (a box token, a program on the port) is
+// (capture.js, spark.js), anything else (a program on the port) is
 // the API — so a filer cannot say they came through a door they did not. The one
 // value a body may ADD is 'planning': a planning session's capture is a CLI
 // filing no session can tell apart, so capture.js --via planning names it. The

package/modules/lifecycle/db-ship.js

@@ -224,17 +224,17 @@ async function resolveClaim({ claimId, builderId, outcome, notesMd, valueSummary
     }
 
     // Task #1048 (ADR 0046 follow-up): record the builder's sandbox self-approval
-    // as a durable fact on the task. When a dev-box builder reviews a staged
+    // as a durable fact on the task. When a builder reviews a staged
     // game change on their sandbox and approves shipping it (TTY 'y', or an
     // explicit --approved re-run on the dominant non-TTY path), ship.js threads
     // { stamp, url, method } through this resolve call. We stamp `by` + `at`
     // SERVER-SIDE (never trust the client for identity or time) and persist the
     // blob to tasks.sandbox_review. Only on a 'shipped' resolve carrying a
-    // payload — laptop ships, non-game diffs, quick-tunnel boxes, --skip-stage,
+    // payload — laptop ships, non-game diffs, --skip-stage,
     // and un-approved re-runs send nothing, leaving the column NULL.
     if (outcome === 'shipped' && sandboxReview && typeof sandboxReview === 'object' && sandboxReview.stamp) {
       // Sanitize the client-supplied fields (defense in depth): the builder's
-      // box controls stamp/url/method, so clamp lengths, whitelist `method`, and
+      // machine controls stamp/url/method, so clamp lengths, whitelist `method`, and
       // accept only an https:// URL. This keeps a forged/oversized value — or a
       // future stored-XSS string like a `javascript:` URL rendered in the hall —
       // out of the persisted record. `by`/`at` stay SERVER-stamped (never
@@ -1098,7 +1098,7 @@ async function confirmTask({ taskId, builderId }, deps = {}) {
 // first-class way to KILL a task that is no longer relevant. The only routes to
 // status='abandoned' were offboarding a builder (offboardBuilder, which seals
 // each open claim) and a raw SQL UPDATE — so stale/moot tasks sat in 'ready' as
-// claimable noise (the box-teardown chores #819/#822/#827 and the dup tasks
+// claimable noise (the teardown chores #819/#822/#827 and the dup tasks
 // #907/#926 that other sessions had already shipped, all retired 2026-06-13).
 // This is the missing transition.
 //

package/modules/lifecycle/github-push.js

@@ -1,18 +1,16 @@
 // GDS server-mediated branch publish (ADR 0055 / task 1025).
 //
 // WHY THIS EXISTS
-// A builder on a cloud dev box cannot publish in `ci` deploy mode: the box has
-// NO GitHub push credential by design (credential-less HTTPS origin, no gh, no
-// GH_TOKEN — infra/builder-box-cloud-init.yaml scrubs the clone token), and its
-// baked GDS session is box-scoped (deny-by-default, #919/ADR 0053). CI self-
+// A checkout with NO GitHub push credential by design (credential-less HTTPS
+// origin, no gh, no GH_TOKEN) cannot publish in `ci` deploy mode. CI self-
 // deploy (#859/ADR 0042) fixed only the LAST leg (Actions deploys main->prod);
-// the box still can't get its branch onto GitHub to open the PR.
+// such a checkout still can't get its branch onto GitHub to open the PR.
 //
-// THE FIX (owner-chosen: "the box holds nothing"). The box uploads its branch as
-// a THIN git bundle to the GDS over a RE-AUTHED (non-box) cli session; the server
+// THE FIX (owner-chosen: "the checkout holds nothing"). The checkout uploads its
+// branch as a THIN git bundle to the GDS over a RE-AUTHED cli session; the server
 // pushes the branch to GitHub + opens the PR + enables auto-merge using a SERVER-
-// side push credential. The box never holds a GitHub push credential, so the #919
-// model is preserved. The credential is scoped to a single repo (Contents:write +
+// side push credential. The checkout never holds a GitHub push credential, so the
+// #919 model is preserved. The credential is scoped to a single repo (Contents:write +
 // Pull-requests:write + Actions:read) and CANNOT push to branch-protected `main`
 // nor bypass required checks — a leaked server credential can only land code on a
 // feature branch behind the same checks every PR faces.
@@ -30,8 +28,8 @@
 // This module is the server seam: push a bundle, open/find the PR, enable auto-
 // merge, report status. All git runs through execFile arg-arrays (shell:false,
 // the #681 injection discipline); the credentialed URL is built in-process and
-// NEVER persisted to a remote nor echoed on an error path (the box-source-fetch.sh
-// "one-shot URL, scrub the credential" pattern). The GitHub API calls are raw
+// NEVER persisted to a remote nor echoed on an error path (the "one-shot URL,
+// scrub the credential" pattern). The GitHub API calls are raw
 // global fetch (no Octokit — fetch is used throughout auth.js), header shape
 // mirrors auth.js fetchGithubUser.
 
@@ -574,7 +572,7 @@ async function enableAutoMergeDetailed({ nodeId }, deps = {}) {
 }
 
 // getPublishStatus — report the PR + prod-deploy state so ship.js can poll
-// WITHOUT gh on the box. Returns:
+// WITHOUT gh on the checkout. Returns:
 //   { pr_state, merged, merge_sha, deploy_status, deploy_probe }  where
 //   pr_state ∈ open|closed|none,
 //   deploy_status ∈ pending|success|none|unconfigured|unavailable
@@ -811,7 +809,7 @@ function prReferencesTask(status, taskId) {
 
 // task 1002645 — locate a task's PR by the "task <id>: …" TITLE convention, for when
 // the reconciler cannot derive the branch. The sweep derives claude/<worktree_name>
-// (the dev-box convention), but a laptop/wave ship pushes its own branch name
+// (the conventional name), but a laptop/wave ship pushes its own branch name
 // (worktree-<worktree_name>), so the derived branch finds no PR and the sweep's whole
 // PR path — the mergeIfGreen nudge (the ONLY green-PR merger where native auto-merge
 // is repo-disallowed), conflict heal, land proof — never engages; the task strands at
@@ -972,7 +970,7 @@ function mergeBlockReason(s) {
     const bad = s.checks.filter(_BAD_CHECK);
     if (bad.length) return `failing_check:${bad[0].name}`;
     // Red, and the failing check is one of the nulled nodes: say the list is blind
-    // rather than guess "review or pending", which sent a box retrying (task 1003988).
+    // rather than guess "review or pending", which sent a ship retrying (task 1003988).
     if (s.checks_unreadable && ['FAILURE', 'ERROR'].includes(s.rollup_state)) return 'failing_check_unreadable';
     return 'blocked_required_review_or_pending_check';
   }

package/modules/lifecycle/publish-reconciler.js

@@ -4,18 +4,18 @@
 // "strands at confirmed" failure class.
 //
 // WHY THIS EXISTS
-// A server-mediated publish (ADR 0055) is ASYNCHRONOUS: a dev box uploads its
+// A server-mediated publish (ADR 0055) is ASYNCHRONOUS: a checkout uploads its
 // branch, the server pushes + opens the PR + arms auto-merge, then GitHub runs
-// the required checks, merges, and Actions deploys to prod. The box's ship.js
+// the required checks, merges, and Actions deploys to prod. The uploader's ship.js
 // only POLLS for ~9 min (pollServerPublish) and then EXITS, printing "it flips to
 // shipped on its own". But the confirmed→shipped transition lived in exactly ONE
 // place — the GET /tasks/:id/publish-status reconcile-on-read (routes/tasks.js).
 // That flip can ONLY happen while a client keeps issuing that GET. Real CI (check
-// queue + merge queue + deploy) routinely finishes AFTER the box has stopped
+// queue + merge queue + deploy) routinely finishes AFTER the client has stopped
 // polling, so nothing ever re-checks and the task row freezes at 'confirmed'
 // forever — even though prod is live. Every prior point-fix (1025/1027/1037/1041/
 // 1045/1046/1049/1050/1052/1068) compensated for a symptom of this one gap:
-// "the box must stay alive and keep polling to finish its OWN ship."
+// "the client must stay alive and keep polling to finish its OWN ship."
 //
 // THE FIX. Move the last mile to the SERVER, where it belongs. A periodic sweep
 // (this module) finds every 'confirmed' task, derives its branch from the latest
@@ -23,7 +23,7 @@
 // succeeded?), and on a confirmed land runs the EXACT db.shipTask +
 // ship-broadcast.postShipBroadcast the publish-status route already runs. The land
 // no longer depends on the shipper's CLI being alive — it works for EVERY builder,
-// on a box, a laptop, or a desktop session, and retroactively heals strands left
+// on a laptop or a desktop session, and retroactively heals strands left
 // by a session that exited early. Idempotent: shipTask throws TASK_NOT_CONFIRMED
 // if a client poll (or a prior sweep) already flipped it, so a sweep racing the
 // route never double-ships nor double-broadcasts.
@@ -333,7 +333,7 @@ async function runSweep(deps = {}) {
 
   // task 1002645 — the per-branch PR path (merge nudge → conflict/stale heal →
   // publish-status), extracted so it can run TWICE for one task: first on the
-  // derived claude/<worktree_name> branch (the dev-box convention), then — when
+  // derived claude/<worktree_name> branch (the conventional name), then — when
   // that finds no PR — on the REAL branch adopted from the task's own PR
   // (findTaskPullRequest). Mutates the sweep counters via closure; returns
   // { status, prNotLanded }.
@@ -605,7 +605,7 @@ async function runSweep(deps = {}) {
       }
     }
 
-    // task 1002645 — the claude/<worktree_name> derivation is the DEV-BOX convention;
+    // task 1002645 — the claude/<worktree_name> derivation is only ONE convention;
     // a laptop/wave ship pushes its own branch name (worktree-<worktree_name>), so the
     // derived branch finds no PR and the merge nudge / conflict heal / land proof all
     // sat idle while the task stranded at 'confirmed' (wave PRs 34/35/36 — native
@@ -768,8 +768,8 @@ async function runSweep(deps = {}) {
       logFn(
         `[publish-reconciler] task ${r.task_id} (${landNote}) landed → shipped`
       );
-      // The box that published could not post the Discord broadcast (no webhook
-      // secret — ADR 0053). The server holds the secrets, so it fires it here,
+      // The checkout that published cannot post the Discord broadcast (no webhook
+      // secret). The server holds the secrets, so it fires it here,
       // exactly ONCE on the confirmed→shipped transition. Best-effort: never let
       // a broadcast hiccup turn a successful reconcile into a failure.
       try {
@@ -827,7 +827,7 @@ async function runSweep(deps = {}) {
 
 // task 1366 — server-side session-cost reconcile, piggybacked on the same 5-min
 // sweep. System 1's client cost hook silently skips the MAJORITY of sessions (a
-// cloud box / cowork VM / overnight agent runs with no GDS token, so the
+// cowork VM / overnight agent runs with no GDS token, so the
 // SessionEnd hook quiet-skips), so a server pass re-prices the model_usage we
 // ALREADY stored on session_records into a cost_log row — keyed on the SAME
 // (source, source_ref) the client would use, so logCost's ON CONFLICT DO NOTHING

package/modules/lifecycle/routes/tasks.js

@@ -624,7 +624,7 @@ module.exports = function buildTasksRouter() {
       // confirmed→shipped flip and throws TASK_NOT_CONFIRMED on a repeat, so
       // whichever entry point wins the transition is the only one that reaches
       // this line — the emit fires exactly ONCE per ship across all three
-      // paths. The server is thus the SINGLE ship broadcaster (the box/laptop
+      // paths. The server is thus the SINGLE ship broadcaster (the laptop
       // local post in scripts/gds/ship.js was removed as a duplicate, task
       // 1749). Best-effort: emitAsync isolates listener errors so a broadcast
       // hiccup can never turn a successful ship into a 500.
@@ -1108,9 +1108,9 @@ module.exports = function buildTasksRouter() {
   // ==========================================================================
   // Server-mediated branch publish (ADR 0055 / task 1025)
   // --------------------------------------------------------------------------
-  // A builder on a cloud dev box has NO GitHub push credential (#919/ADR 0053
-  // box-scope + credential-less origin), so in `ci` deploy mode ship.js cannot
-  // `git push` + `gh pr create`. Instead the box uploads its branch as a THIN
+  // A checkout with NO GitHub push credential (credential-less origin, #919)
+  // cannot `git push` + `gh pr create`, so in `ci` deploy mode ship.js uploads
+  // its branch as a THIN
   // git bundle here; the server pushes it + opens the PR + enables auto-merge
   // using its own push credential — a GitHub App installation token (preferred,
   // task 1028) or the GITHUB_PUSH_TOKEN PAT fallback; single repo, Contents:write
@@ -1255,7 +1255,7 @@ module.exports = function buildTasksRouter() {
 
   // GET /tasks/:id/publish-status?branch=<branch> — poll the PR + prod-deploy
   // state for a server-mediated publish so ship.js can confirm the land WITHOUT
-  // gh on the box. Ownership-gated like the POST. Derives state live from GitHub.
+  // gh on the checkout. Ownership-gated like the POST. Derives state live from GitHub.
   // `branch` is optional (task 1003764): without it the server finds the task's own PR
   // (both publish paths title it "task <id>: …") and the answer names the `branch` it
   // used and its `branch_source`, so the check agents are sent to instead of git probes
@@ -1302,9 +1302,9 @@ module.exports = function buildTasksRouter() {
         try {
           const shipped = await db.shipTask({ taskId: id, builderId: req.builder.id, landAssurance: RECONCILE_PROOF }); // ADR 0184
           reconciled = true;
-          // task 1045: the box that published can't post the Discord broadcast —
-          // it holds no webhook secret (ADR 0053 "box holds nothing"), so a box
-          // ship was silently skipping the public announcement. The server holds
+          // task 1045: the checkout that published can't post the Discord
+          // broadcast — it holds no webhook secret, so such a ship was silently
+          // skipping the public announcement. The server holds
           // the secrets and just confirmed the deploy, so it fires the broadcast
           // here — exactly ONCE, on the confirmed→shipped transition. shipTask
           // throws TASK_NOT_CONFIRMED on a repeat poll, so this never re-posts.

package/modules/lifecycle/ship-card.js

@@ -9,7 +9,7 @@
 //
 // ONE generator, two render paths, both PURE:
 //   renderMonospaceCard(model) — alignment-proof left-rule text. The CLIs ALWAYS
-//     print this, so headless / cron / dev-box runs and feeds without the in-feed
+//     print this, so headless / cron runs and feeds without the in-feed
 //     visualization tool still get a consistent summary.
 //   renderCardHtml(model)      — the populated, branded HTML the skills render in
 //     the chat feed via the visualization tool (show_widget). Brand tokens come

package/modules/lifecycle/task-visuals.js

@@ -181,8 +181,8 @@ function isPubliclyViewable(task) {
 // The CANONICAL prefix (src/bongos/api-prefix.js) is hard-coded rather than
 // imported: this lib is deliberately core-free so it unit-tests with a Buffer and
 // a temp dir, and the doorway does not publish the prefix. It is safe to hard-code
-// because BOTH prefixes are permanent — '/api/gds' is a forever alias for shipped
-// Dev Box binaries and the off-box status mirror — so a URL stored under either
+// because BOTH prefixes are permanent — '/api/gds' is a forever alias for older
+// CLIs and the off-box status mirror — so a URL stored under either
 // keeps resolving, and every renderer's guard accepts both.
 const SERVE_PREFIX = '/api/bongos/task-visuals';
 function urlForName(name) {

package/modules/memory/routes/memory.js

@@ -32,8 +32,8 @@
 //
 // RENDER / STORED-XSS (#575, audit 2026-06-19) — memory content is stored RAW
 // and is NEVER emitted as HTML. Every endpoint here returns it as JSON
-// (res.json — content as a string field), and the only consumers are the CLI /
-// dev-box memory sync (it writes the strings to the local filesystem) and the
+// (res.json — content as a string field), and the only consumers are the CLI
+// memory sync (it writes the strings to the local filesystem) and the
 // Archon-only forensic reads (also JSON). An audit of every web surface
 // (modules/hall-ui/public/, modules/status-ui/public/) found NO code path that interpolates
 // memory content into the DOM: there is no markdown→HTML renderer in the client

package/modules/platform-identity/routes/sso.js

@@ -249,8 +249,9 @@ module.exports = function ssoRoutes() {
     //
     // resolveSession is the RAW resolver (so we can redirect rather than 401), so it
     // does NOT apply requireBuilder's deny gates — we must. sessionUsableForFederation
-    // rejects a deactivated account, a dev-box-scoped token (outside the ADR 0016
-    // trust boundary), and service principals: none may mint a federated identity code.
+    // rejects a deactivated account, a session of an undeclared source (outside
+    // the ADR 0016 trust boundary), and service principals: none may mint a
+    // federated identity code.
     let session;
     try {
       session = await resolveSession(req);

package/modules/provisioning/capacity.js

@@ -137,7 +137,7 @@ async function countPlaced(db, shapes, { excludeId = null } = {}) {
 }
 
 // readLocalMeminfo — THIS host's /proc/meminfo, for the surfaces that run on the
-// control plane itself. Null (not a throw) where it does not exist, e.g. a dev box
+// control plane itself. Null (not a throw) where it does not exist, e.g. a laptop
 // that is not Linux — the summary then reads 'default' and says so.
 function readLocalMeminfo() {
   try { return fs.readFileSync('/proc/meminfo', 'utf8'); } catch { return null; }

package/modules/provisioning/provisioning.js

@@ -351,8 +351,9 @@ function defaultDomainForSlug(slug, apex) {
 }
 
 // Labels the platform itself occupies (or has planned) directly under the instance
-// apex, plus the dev-box hostname prefixes. The runner's DNS write is an UPSERT,
-// so a project claiming one of these would overwrite platform records — refuse at
+// apex, plus the `term-` / `sandbox-` hostname prefixes older per-builder machines
+// took. The runner's DNS write is an UPSERT, so a project claiming one of these
+// would overwrite platform records — refuse at
 // the API layer instead (task 1002704; the guard applies to auto-assigned AND
 // bring-your-own hostnames, on create and on attach). Anything deeper than one
 // label under the apex is also refused: it breaks the wildcard-cert rule (one
@@ -1133,7 +1134,7 @@ async function setInstanceStatus(db, id, status, patch = {}) {
 
 // Enqueue a provision/teardown intent. Idempotent: the partial unique index
 // ux_provisioning_intents_open makes a second open enqueue collide (23505); we
-// then return the already-open intent with created:false (mirrors boxes.enqueueIntent).
+// then return the already-open intent with created:false.
 async function enqueueIntent(db, instanceId, action, requestedBy, targetVersion = null) {
   await require('./control-plane-guard').assertIntentAllowed(db, instanceId, action); // ADR 0293 D2; required HERE because this file is at the size ratchet
   try {

package/modules/provisioning/routes/provisioning.js

@@ -2,7 +2,7 @@
 // surface (ADR 0111 §1/§2, task #1942). Instance hosting + domains: the web-tier
 // REQUEST + STATE surface for standing up + operating a Cloud Bongos instance.
 //
-// THE TRUST BOUNDARY (ADR 0111 §2 / ADR 0016 / the dev-box /box precedent). The
+// THE TRUST BOUNDARY (ADR 0111 §2 / ADR 0016). The
 // internet-facing web process NEVER calls a cloud API and holds NO provider tokens.
 // A mutation route only ENQUEUES an intent (provision | teardown) into
 // provisioning_intents and returns; the control-plane runner (scripts/gds/
@@ -27,7 +27,7 @@
 //                                                      task 1003581 — see the handler)
 //     POST   /provisioning/instances/:id/teardown  — request teardown of one's own
 //     GET    /provisioning/instances/:id/invite-suggestions — who is worth inviting (R28, ADR 0251)
-//   Archon-scoped (requireRank('archon') — the fleet, the /boxes precedent):
+//   Archon-scoped (requireRank('archon') — the fleet):
 //     GET    /provisioning/fleet                    — the full instance roster + the box's slot `capacity` (ADR 0285)
 //     GET    /provisioning/fleet/cost-ledger        — per-instance cost to us + to its owner, with totals
 //     POST   /provisioning/instances/:id/force-teardown — tear down ANY instance
@@ -204,7 +204,7 @@ module.exports = function provisioningRoutes() {
   // it. Archon-first keeps every route classifying to its true gate.
 
   // GET /provisioning/fleet — the full instance roster across all owners.
-  // rank: archon (exposes every owner's instance + cost; the /boxes precedent).
+  // rank: archon (exposes every owner's instance + cost).
   router.get('/provisioning/fleet', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     try {
       const status = req.query.status || undefined;
@@ -217,7 +217,7 @@ module.exports = function provisioningRoutes() {
   });
 
   // GET /provisioning/fleet/cost-ledger — per-instance monthly cost to us + estimated cost to its owner, with totals.
-  // rank: archon — cost oversight across the fleet (the /boxes/cost-ledger precedent).
+  // rank: archon — cost oversight across the fleet.
   // Declared among the archon routes (archon-first) for correct auditor classification.
   router.get('/provisioning/fleet/cost-ledger', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     try {

package/modules/sessions/db.js

@@ -187,7 +187,7 @@ async function syncSessionDrachmaeEarnedTx(client, builderId, sessionId) {
 // safe, and lets a later, costlier ship in the same session book its increment.
 // task 1676: pass totalTokens so the reward can fall back to pricing the
 // session's real token total when modelUsage is empty/unpriceable — the
-// dev-box/CI agent path that historically paid $0 cost-plus (ADR 0097).
+// CI agent path that historically paid $0 cost-plus (ADR 0097).
 async function awardSessionTokenRewardTx(client, { builderId, sessionId, modelUsage, totalTokens }) {
   const reward = seams.resolveOptional('reward');
   if (!reward) return { drachmae: 0, trueCostUsd: 0, awarded: false, unknownModels: [], deferred: false };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1074",
+  "version": "1.19.1075",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1074",
+      "version": "1.19.1075",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1074",
+  "version": "1.19.1075",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7821,5 +7821,11 @@
       "id": "1003781",
       "text": "Every module now has its own version number, shown in the module list and the hall's Modules tab — the first step toward publishing and updating modules through the store."
     }
+  ],
+  "1.19.1075": [
+    {
+      "id": "1003897",
+      "text": "Cleanup: the code, tests and settings no longer describe the dev box as if it still existed, and seven code-quality limits are tightened to today's better numbers. Nothing changes for builders."
+    }
   ]
 }

package/scripts/gds/artifact-staleness.js

@@ -32,8 +32,8 @@
 //
 // ── WHERE THIS MAY RUN — read before scheduling it anywhere new ───────────────
 //
-// ONLY where the artifacts are SUPPOSED to already exist: a deployed instance, or a
-// dev box after its source-fetch regen. NEVER in CI. A fresh `git clone` legitimately
+// ONLY where the artifacts are SUPPOSED to already exist: a deployed instance after its
+// source-fetch regen. NEVER in CI. A fresh `git clone` legitimately
 // has no `docs/repo-map.md` — it is gitignored, so it is not in the repository at all
 // — and this check would report it absent on every single run. A monitor that is red
 // every run teaches its reader to ignore it, which is the exact failure ADR 0110's

package/scripts/gds/backfill-task-rewards.js

@@ -4,12 +4,12 @@
 // scripts/gds/backfill-task-rewards.js — retroactive drachmae backfill for
 // shipped tasks that paid 0 reward (task 1672, ADR 0097).
 //
-// THE GAP. A task's `credits_reward` defaults to 0; many early/dev-box/CI ships
+// THE GAP. A task's `credits_reward` defaults to 0; many early and CI ships
 // never had an author-estimated reward set, so the kind-multiplied task-confirm
 // credit (modules/economy/credits.js insertMultipliedConfirmCredit) computed
 // `0 × multiplier = 0` and minted nothing. The cost-plus *session* reward
 // (reason='session.token_reward', ADR 0054) was supposed to backstop those, but
-// it pays ~0 for dev-box/CI agent ships (no priced model usage uploaded), so
+// it pays ~0 for CI agent ships (no priced model usage uploaded), so
 // those builders earned nothing for real shipped work. This script lets an
 // Archon retroactively pay a *fair, reviewed* per-task amount — once, safely.
 //
@@ -133,7 +133,7 @@ function planForBuilder(builderId, taskRewards, costPlusAlreadyPaid, alreadyBack
 // =========================================================================
 
 function loadPool() {
-  // Lazy + guarded: a builder box has no DATABASE_URL / no peer-auth Postgres,
+  // Lazy + guarded: a builder machine has no DATABASE_URL / no peer-auth Postgres,
   // so --help and --dry-run must not crash here. We only reach for the pool when
   // we actually need to read/write the DB, and we report a clean message if the
   // connection is unavailable rather than throwing a raw stack.
@@ -230,7 +230,7 @@ async function buildPlan(pool, mapping, defaultRaw) {
   //    session-level (task_id NULL), so we net at the BUILDER level — the audit
   //    question is "did the cost-plus stream already compensate this builder for
   //    the work these tasks represent". The dry-run surfaces this number so the
-  //    Archon can see whether it actually fired (it pays ~0 for dev-box/CI ships).
+  //    Archon can see whether it actually fired (it pays ~0 for CI ships).
   const { rows: costPlusRows } = await pool.query(
     `SELECT builder_id, COALESCE(SUM(delta), 0)::int AS paid
        FROM credit_log
@@ -334,7 +334,7 @@ async function main() {
   try {
     pool = loadPool();
   } catch (err) {
-    console.error('No DB connection available (expected on a builder box with no prod credentials).');
+    console.error('No DB connection available (expected on a builder machine with no prod credentials).');
     console.error('This script is inert here — run --help for usage. Detail:', err.message);
     process.exit(2);
   }

package/scripts/gds/claude-materialize.js

@@ -352,7 +352,7 @@ const STARTER_COMMANDS = [
   // `git diff|log|show` rule, also on purpose: the harness already runs their
   // read-only forms unprompted, and a prefix rule would switch off its flag check
   // (`--output=<file>` writes anywhere, `diff --no-index` reads any file).
-  // tests/box_ship_permissions.mjs pins this list to the core's, rule for rule.
+  // tests/cli_allowlist_permissions.mjs pins this list to the core's, rule for rule.
   'bongos start:*',
   'bongos status:*',
   'bongos recall:*',
@@ -381,7 +381,7 @@ const STARTER_COMMANDS = [
 ];
 // One rule per command PER SHELL TOOL (task 1004014): the shell tool is `PowerShell` on a Windows
 // laptop, and a `Bash(...)` rule says nothing about its commands. The tools are the ones the guards
-// see (`.claude/hooks/shell-tools.js`) — held equal by tests/box_ship_permissions.mjs, not a require.
+// see (`.claude/hooks/shell-tools.js`) — held equal by tests/cli_allowlist_permissions.mjs, not a require.
 const STARTER_SHELL_TOOLS = ['Bash', 'PowerShell'];
 const STARTER_ALLOW = STARTER_SHELL_TOOLS.flatMap((tool) => STARTER_COMMANDS.map((command) => `${tool}(${command})`));
 

package/scripts/gds/cli-lib.js

@@ -24,12 +24,12 @@ const ic = require('../../src/instance-config');
 // namespaced instance, still resolves (R61 / task 1200). os.homedir() keeps it
 // per-user on any machine.
 //
-// WHY THE OLD NAMES STAY READABLE. This file is on disk on every builder machine
-// and every live dev box. Renaming it with no fallback signs all of them out at
-// once and every /builder-* command dies with 'no Bongos session'. So a read that
-// resolves through a superseded name MIGRATES forward (see loadSession), and the
-// old file is deliberately LEFT IN PLACE — a builder may roll back to an older
-// CLI, which can only see the old name. Part 4 (task 1003706) deletes it behind a
+// WHY THE OLD NAMES STAY READABLE. This file is on disk on every builder machine.
+// Renaming it with no fallback signs all of them out at once and every /builder-*
+// command dies with 'no Bongos session'. So a read that resolves through a
+// superseded name MIGRATES forward (see loadSession), and the old file is
+// deliberately LEFT IN PLACE — a builder may roll back to an older CLI, which
+// can only see the old name. Part 4 (task 1003706) deletes it behind a
 // test of its absence. (task 1003704)
 //
 // Order is FILENAME-major, not directory-major: the newest name found in ANY read
@@ -330,7 +330,7 @@ async function writeSessionToStore(session) {
 //      upgrading would still lose it.
 //   2. store the incoming one under its own host.
 //   3. write the ACTIVE pointer exactly where it has always gone, so every existing reader —
-//      in-repo skills, hooks, the dev box — behaves identically.
+//      in-repo skills and hooks — behaves identically.
 async function saveSession(session) {
   const dir = path.dirname(SESSION_PATH);
   await fsp.mkdir(dir, { recursive: true });

package/scripts/gds/codemod-rename-src-gds.js

@@ -12,7 +12,7 @@
 //      never clobbered:
 //         src/gds/...     -> src/bongos/...     (directory refs)
 //         "src/gds"       -> "src/bongos"       (bare, at a boundary)
-//         src/gds-client  -> src/gds-client     (UNCHANGED: devbox-app/src/gds-client.js)
+//         src/gds-client  -> src/gds-client     (UNCHANGED: a look-alike file name)
 //         src/gdsx        -> src/gdsx           (UNCHANGED here: prefix-edge fixture)
 //
 //   Regex: /src\/gds(?![A-Za-z0-9_-])/g  -- trailing guard only. No LEADING guard: