@bongos/core 1.19.1074 → 1.19.1076

package/modules/provisioning/routes/provisioning.js

@@ -2,7 +2,7 @@
 // surface (ADR 0111 §1/§2, task #1942). Instance hosting + domains: the web-tier
 // REQUEST + STATE surface for standing up + operating a Cloud Bongos instance.
 //
-// THE TRUST BOUNDARY (ADR 0111 §2 / ADR 0016 / the dev-box /box precedent). The
+// THE TRUST BOUNDARY (ADR 0111 §2 / ADR 0016). The
 // internet-facing web process NEVER calls a cloud API and holds NO provider tokens.
 // A mutation route only ENQUEUES an intent (provision | teardown) into
 // provisioning_intents and returns; the control-plane runner (scripts/gds/
@@ -27,7 +27,7 @@
 //                                                      task 1003581 — see the handler)
 //     POST   /provisioning/instances/:id/teardown  — request teardown of one's own
 //     GET    /provisioning/instances/:id/invite-suggestions — who is worth inviting (R28, ADR 0251)
-//   Archon-scoped (requireRank('archon') — the fleet, the /boxes precedent):
+//   Archon-scoped (requireRank('archon') — the fleet):
 //     GET    /provisioning/fleet                    — the full instance roster + the box's slot `capacity` (ADR 0285)
 //     GET    /provisioning/fleet/cost-ledger        — per-instance cost to us + to its owner, with totals
 //     POST   /provisioning/instances/:id/force-teardown — tear down ANY instance
@@ -204,7 +204,7 @@ module.exports = function provisioningRoutes() {
   // it. Archon-first keeps every route classifying to its true gate.
 
   // GET /provisioning/fleet — the full instance roster across all owners.
-  // rank: archon (exposes every owner's instance + cost; the /boxes precedent).
+  // rank: archon (exposes every owner's instance + cost).
   router.get('/provisioning/fleet', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     try {
       const status = req.query.status || undefined;
@@ -217,7 +217,7 @@ module.exports = function provisioningRoutes() {
   });
 
   // GET /provisioning/fleet/cost-ledger — per-instance monthly cost to us + estimated cost to its owner, with totals.
-  // rank: archon — cost oversight across the fleet (the /boxes/cost-ledger precedent).
+  // rank: archon — cost oversight across the fleet.
   // Declared among the archon routes (archon-first) for correct auditor classification.
   router.get('/provisioning/fleet/cost-ledger', auth.requireBuilder, auth.requirePermission('provisioning.fleet.manage'), async (req, res) => {
     try {

package/modules/sessions/db.js

@@ -187,7 +187,7 @@ async function syncSessionDrachmaeEarnedTx(client, builderId, sessionId) {
 // safe, and lets a later, costlier ship in the same session book its increment.
 // task 1676: pass totalTokens so the reward can fall back to pricing the
 // session's real token total when modelUsage is empty/unpriceable — the
-// dev-box/CI agent path that historically paid $0 cost-plus (ADR 0097).
+// CI agent path that historically paid $0 cost-plus (ADR 0097).
 async function awardSessionTokenRewardTx(client, { builderId, sessionId, modelUsage, totalTokens }) {
   const reward = seams.resolveOptional('reward');
   if (!reward) return { drachmae: 0, trueCostUsd: 0, awarded: false, unknownModels: [], deferred: false };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1074",
+  "version": "1.19.1076",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1074",
+      "version": "1.19.1076",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1074",
+  "version": "1.19.1076",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7821,5 +7821,33 @@
       "id": "1003781",
       "text": "Every module now has its own version number, shown in the module list and the hall's Modules tab — the first step toward publishing and updating modules through the store."
     }
+  ],
+  "1.19.1075": [
+    {
+      "id": "1003897",
+      "text": "Cleanup: the code, tests and settings no longer describe the dev box as if it still existed, and seven code-quality limits are tightened to today's better numbers. Nothing changes for builders."
+    }
+  ],
+  "1.19.1076": [
+    {
+      "id": "1004363",
+      "text": "Fixed the test that was still stopping new releases. It created a sample task without saying what kind of work it was, which the database no longer allows. With it fixed, the release carrying the database fix can go out, and t"
+    },
+    {
+      "id": "1003460",
+      "text": "Ctrl-K now searches the project's memory: typing prose merges in matching tasks/ideas/blockers from the existing recall search endpoint, debounced and gracefully degrading if the endpoint is ever unavailable — jumping by id, p"
+    },
+    {
+      "id": "1003899",
+      "text": "The dev box can't quietly come back: an automated check now fails the build if its code, tables, permissions or files reappear, and points whoever tripped it to the decision record that explains why."
+    },
+    {
+      "id": "1004362",
+      "text": "Fixed the database update that kept making the site upgrade roll back. It tried to delete old dev-box logins while one past task claim still pointed at one of them, and the database refused. The update now clears that pointer"
+    },
+    {
+      "id": "1003898",
+      "text": "The dev box's removal is written up in one decision record (ADR 0346), and the 20 older records that described it now point there. The live guides, the design mockups and the README no longer tell anyone to use a dev box."
+    }
   ]
 }

package/scripts/gds/artifact-staleness.js

@@ -32,8 +32,8 @@
 //
 // ── WHERE THIS MAY RUN — read before scheduling it anywhere new ───────────────
 //
-// ONLY where the artifacts are SUPPOSED to already exist: a deployed instance, or a
-// dev box after its source-fetch regen. NEVER in CI. A fresh `git clone` legitimately
+// ONLY where the artifacts are SUPPOSED to already exist: a deployed instance after its
+// source-fetch regen. NEVER in CI. A fresh `git clone` legitimately
 // has no `docs/repo-map.md` — it is gitignored, so it is not in the repository at all
 // — and this check would report it absent on every single run. A monitor that is red
 // every run teaches its reader to ignore it, which is the exact failure ADR 0110's

package/scripts/gds/backfill-task-rewards.js

@@ -4,12 +4,12 @@
 // scripts/gds/backfill-task-rewards.js — retroactive drachmae backfill for
 // shipped tasks that paid 0 reward (task 1672, ADR 0097).
 //
-// THE GAP. A task's `credits_reward` defaults to 0; many early/dev-box/CI ships
+// THE GAP. A task's `credits_reward` defaults to 0; many early and CI ships
 // never had an author-estimated reward set, so the kind-multiplied task-confirm
 // credit (modules/economy/credits.js insertMultipliedConfirmCredit) computed
 // `0 × multiplier = 0` and minted nothing. The cost-plus *session* reward
 // (reason='session.token_reward', ADR 0054) was supposed to backstop those, but
-// it pays ~0 for dev-box/CI agent ships (no priced model usage uploaded), so
+// it pays ~0 for CI agent ships (no priced model usage uploaded), so
 // those builders earned nothing for real shipped work. This script lets an
 // Archon retroactively pay a *fair, reviewed* per-task amount — once, safely.
 //
@@ -133,7 +133,7 @@ function planForBuilder(builderId, taskRewards, costPlusAlreadyPaid, alreadyBack
 // =========================================================================
 
 function loadPool() {
-  // Lazy + guarded: a builder box has no DATABASE_URL / no peer-auth Postgres,
+  // Lazy + guarded: a builder machine has no DATABASE_URL / no peer-auth Postgres,
   // so --help and --dry-run must not crash here. We only reach for the pool when
   // we actually need to read/write the DB, and we report a clean message if the
   // connection is unavailable rather than throwing a raw stack.
@@ -230,7 +230,7 @@ async function buildPlan(pool, mapping, defaultRaw) {
   //    session-level (task_id NULL), so we net at the BUILDER level — the audit
   //    question is "did the cost-plus stream already compensate this builder for
   //    the work these tasks represent". The dry-run surfaces this number so the
-  //    Archon can see whether it actually fired (it pays ~0 for dev-box/CI ships).
+  //    Archon can see whether it actually fired (it pays ~0 for CI ships).
   const { rows: costPlusRows } = await pool.query(
     `SELECT builder_id, COALESCE(SUM(delta), 0)::int AS paid
        FROM credit_log
@@ -334,7 +334,7 @@ async function main() {
   try {
     pool = loadPool();
   } catch (err) {
-    console.error('No DB connection available (expected on a builder box with no prod credentials).');
+    console.error('No DB connection available (expected on a builder machine with no prod credentials).');
     console.error('This script is inert here — run --help for usage. Detail:', err.message);
     process.exit(2);
   }

package/scripts/gds/claude-materialize.js

@@ -352,7 +352,7 @@ const STARTER_COMMANDS = [
   // `git diff|log|show` rule, also on purpose: the harness already runs their
   // read-only forms unprompted, and a prefix rule would switch off its flag check
   // (`--output=<file>` writes anywhere, `diff --no-index` reads any file).
-  // tests/box_ship_permissions.mjs pins this list to the core's, rule for rule.
+  // tests/cli_allowlist_permissions.mjs pins this list to the core's, rule for rule.
   'bongos start:*',
   'bongos status:*',
   'bongos recall:*',
@@ -381,7 +381,7 @@ const STARTER_COMMANDS = [
 ];
 // One rule per command PER SHELL TOOL (task 1004014): the shell tool is `PowerShell` on a Windows
 // laptop, and a `Bash(...)` rule says nothing about its commands. The tools are the ones the guards
-// see (`.claude/hooks/shell-tools.js`) — held equal by tests/box_ship_permissions.mjs, not a require.
+// see (`.claude/hooks/shell-tools.js`) — held equal by tests/cli_allowlist_permissions.mjs, not a require.
 const STARTER_SHELL_TOOLS = ['Bash', 'PowerShell'];
 const STARTER_ALLOW = STARTER_SHELL_TOOLS.flatMap((tool) => STARTER_COMMANDS.map((command) => `${tool}(${command})`));
 

package/scripts/gds/cli-lib.js

@@ -24,12 +24,12 @@ const ic = require('../../src/instance-config');
 // namespaced instance, still resolves (R61 / task 1200). os.homedir() keeps it
 // per-user on any machine.
 //
-// WHY THE OLD NAMES STAY READABLE. This file is on disk on every builder machine
-// and every live dev box. Renaming it with no fallback signs all of them out at
-// once and every /builder-* command dies with 'no Bongos session'. So a read that
-// resolves through a superseded name MIGRATES forward (see loadSession), and the
-// old file is deliberately LEFT IN PLACE — a builder may roll back to an older
-// CLI, which can only see the old name. Part 4 (task 1003706) deletes it behind a
+// WHY THE OLD NAMES STAY READABLE. This file is on disk on every builder machine.
+// Renaming it with no fallback signs all of them out at once and every /builder-*
+// command dies with 'no Bongos session'. So a read that resolves through a
+// superseded name MIGRATES forward (see loadSession), and the old file is
+// deliberately LEFT IN PLACE — a builder may roll back to an older CLI, which
+// can only see the old name. Part 4 (task 1003706) deletes it behind a
 // test of its absence. (task 1003704)
 //
 // Order is FILENAME-major, not directory-major: the newest name found in ANY read
@@ -330,7 +330,7 @@ async function writeSessionToStore(session) {
 //      upgrading would still lose it.
 //   2. store the incoming one under its own host.
 //   3. write the ACTIVE pointer exactly where it has always gone, so every existing reader —
-//      in-repo skills, hooks, the dev box — behaves identically.
+//      in-repo skills and hooks — behaves identically.
 async function saveSession(session) {
   const dir = path.dirname(SESSION_PATH);
   await fsp.mkdir(dir, { recursive: true });

package/scripts/gds/codemod-rename-src-gds.js

@@ -12,7 +12,7 @@
 //      never clobbered:
 //         src/gds/...     -> src/bongos/...     (directory refs)
 //         "src/gds"       -> "src/bongos"       (bare, at a boundary)
-//         src/gds-client  -> src/gds-client     (UNCHANGED: devbox-app/src/gds-client.js)
+//         src/gds-client  -> src/gds-client     (UNCHANGED: a look-alike file name)
 //         src/gdsx        -> src/gdsx           (UNCHANGED here: prefix-edge fixture)
 //
 //   Regex: /src\/gds(?![A-Za-z0-9_-])/g  -- trailing guard only. No LEADING guard:

package/scripts/gds/context-pack.js

@@ -31,13 +31,11 @@ const path = require('node:path');
 // so importing it from a CLI is safe — same precedent as next-number.js reading
 // the repo tree directly. This is the "not hand-maintained" guarantee.
 //
-// OPTIONAL, because the file may not be ON DISK (task 1003085). A task-scoped box
-// (ADR 0148) materializes modules/<key> only for the modules the CLAIM puts in
-// scope, so on a box with NO active claim modules/lifecycle is absent and this
-// require threw MODULE_NOT_FOUND at import time. That killed /builder-start AND
-// /builder-claim — the exact two commands needed to escape the state, since the
-// claim is what would fetch the module. A deadlock, escapable only by calling
-// POST /claims with curl. The header's FAIL-OPEN promise ("must NEVER throw or
+// OPTIONAL, because the file may not be ON DISK (task 1003085). A sparse checkout
+// can lack modules/lifecycle, and when it did this require threw
+// MODULE_NOT_FOUND at import time. That killed /builder-start AND /builder-claim
+// — the two commands a builder needs to recover — leaving a deadlock escapable
+// only by calling POST /claims with curl. The header's FAIL-OPEN promise ("must NEVER throw or
 // block a claim") was already the right rule; this require was the line that did
 // not keep it.
 //

package/scripts/gds/dev-box-guard.js

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+// scripts/gds/dev-box-guard.js — the dev box stays retired (task 1003899, goal
+// 1000120; ADR 0346).
+//
+// WHY. The dev box was removed across a dozen areas: a module, a third of it
+// leaked into the core, four tables, a session source, three permissions, a CLI,
+// a desktop app, hall pages. A removal spread that wide rots back in one careless
+// import, fixture or copied migration. This is the ratchet that holds it: every
+// tracked file outside the historical record is scanned for the retired names,
+// and any hit fails CI with a pointer to ADR 0346, so the next builder learns WHY
+// and not only THAT.
+//
+// WHAT COUNTS, narrowly — each rule names a thing that only ever meant the box:
+//   • module-key     the key `dev-box` used AS A KEY: quoted ('dev-box', "dev-box",
+//                    `dev-box`) or as a path segment (modules/dev-box/). Matched
+//                    with fitness-lib's delimited-token matcher, so `dev-boxes`
+//                    and an ADR filename like 0072-dev-box-code-… never hit. Prose
+//                    ("the dev-box removal") is deliberately not a key.
+//   • identifier     the dropped tables and columns: builder_boxes, box_intents,
+//                    box_events, builder_ssh_keys, box_blocked*.
+//   • permission     a quoted permission key of the retired `box.*.*` family.
+//   • session-source a session `source` compared or assigned to 'box'.
+//   • path           a tracked file under scripts/gds/box*, infra/box-*,
+//                    modules/dev-box/ or .devcontainer/.
+// "box" alone is NOT a rule: it also means a server (the co-hosting box, box.env).
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('node:child_process');
+const { keyTokenRe } = require('./fitness-lib.js');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const ADR = 'docs/adr/0346-dev-boxes-are-retired.md';
+const NAME = 'the dev box stays retired (ADR 0346)';
+
+// THE EXEMPTION LIST — the one place a file may still name the box. Each entry is
+// `path-or-prefix` → why. A prefix ends in '/'. Keep reasons about the file's
+// PURPOSE, never about what the tree happens to contain today.
+const DEV_BOX_EXEMPT = new Map([
+  // The historical record — superseded, never rewritten (ADR README "Superseding").
+  ['docs/adr/', 'historical record: ADRs are superseded by ADR 0346, never rewritten'],
+  ['docs/session-logs/', 'historical record: dated session logs'],
+  ['docs/audits/', 'historical record: dated audit reports'],
+  ['docs/governance/', 'historical record: dated governance reports'],
+  ['limitations/', 'historical record: shipped-version scope archives'],
+  ['docs/module-api-changelog.md', 'history ledger of doorway releases; entries are appended, never rewritten'],
+  // Applied migrations: they created the box objects and, last, dropped them. Named one
+  // by one so a NEW migration is still checked. The column drop of task 1004360 joins
+  // this list when it lands.
+  ['migrations/067_builder_boxes.sql', 'applied migration (created the box tables)'],
+  ['migrations/069_builder_ssh_keys.sql', 'applied migration'],
+  ['migrations/070_box_intents.sql', 'applied migration'],
+  ['migrations/071_box_first_provision_approval.sql', 'applied migration'],
+  ['migrations/073_box_terminal_access.sql', 'applied migration'],
+  ['migrations/078_box_claude_active.sql', 'applied migration'],
+  ['migrations/079_box_first_connected_at.sql', 'applied migration'],
+  ['migrations/090_box_scoped_sessions.sql', 'applied migration (added the box session source)'],
+  ['migrations/102_remove_box_first_provision_approval.sql', 'applied migration'],
+  ['migrations/104_builder_box_blocked.sql', 'applied migration (added the box_blocked columns)'],
+  ['migrations/105_box_host_keys.sql', 'applied migration'],
+  ['migrations/121_box_code_version.sql', 'applied migration'],
+  ['migrations/core_236_rank_floor_backfill.sql', 'applied migration (names the key in an example)'],
+  ['migrations/core_237_box_widen_paths.sql', 'applied migration'],
+  ['migrations/core_238_box_unattended_cap.sql', 'applied migration'],
+  ['migrations/core_248_module_enablement_overrides.sql', 'applied migration (names the key in an example)'],
+  ['migrations/core_258_drop_dev_box_tables.sql', 'the migration that drops the box tables and session source by name (task 1003895)'],
+  ['modules/government/migrations/governance_002_seed_and_backfill.sql', 'applied migration (seeded the box.* keys)'],
+  ['modules/government/migrations/governance_007_delegate_archon_ops_to_metic.sql', 'applied migration'],
+  ['modules/government/migrations/government_019_retire_box_permissions.sql', 'the migration that revokes the box.* keys by name (task 1003894)'],
+  ['modules/provisioning/migrations/provisioning_014_module_selection.sql', 'applied migration (names the key in an example)'],
+  ['modules/provisioning/migrations/provisioning_001_tables.sql', 'applied migration (its comments cite the box queue it was modelled on)'],
+  // Retirement guards: code and tests whose JOB is to name the retired thing.
+  ['src/modules.js', 'RETIRED_MODULE_KEYS: an instance config still saying "dev-box": true boots with a warning'],
+  ['tests/modules.mjs', 'proves the retired-key tolerance (and that a typo like "dev-boxes" still throws)'],
+  ['tests/government_session_scope.mjs', 'proves a leftover source=box session is refused'],
+  ['tests/auth_page_gate.mjs', 'proves a leftover source=box session is refused a page'],
+  ['tests/terms_acceptance.mjs', 'proves a leftover source=box session cannot mint an acceptance'],
+  ['tests/government_seed.mjs', 'proves government_019 revoked the box.* keys from every rank'],
+  ['tests/core_258_box_session_claims_db.mjs', 'proves core_258 applies over a claim created from a box session (task 1004362)'],
+  ['tests/government_protected_surfaces.mjs', 'RETIRED_SINCE_R101: retired protected paths may leave the registry only once gone'],
+  ['scripts/gds/dev-box-guard.js', 'this guard (it defines the rules)'],
+  // Captured data and seed history that name real records.
+  ['scripts/gds/seed-', 'one-shot task seeders: their subject is the historical tasks they filed'],
+  ['scripts/hall-preview/fixtures/', 'captured API responses: the ledger still holds these task and goal rows'],
+  ['.bongos-core.json', 'a 1.0.0 seed manifest from July (commit b6ee5d29) that this repo never regenerates'],
+]);
+
+const TEXT_EXT = /\.(js|mjs|cjs|json|md|sql|sh|html|css|yml|yaml|txt|toml)$/;
+const PATH_RULE = /^(scripts\/gds\/box|infra\/box-|modules\/dev-box\/|\.devcontainer\/)/;
+
+function exemptionFor(rel) {
+  for (const [entry, why] of DEV_BOX_EXEMPT) {
+    if (entry.endsWith('/') || entry.endsWith('-') ? rel.startsWith(entry) : rel === entry) return why;
+  }
+  return null;
+}
+
+// The key used as a key: fitness-lib's delimited match, with a quote, backtick or
+// slash on both sides (a colon may close it, as in a JSON key).
+// Compiled once for the whole scan; a global regex is stateful, so lastIndex is reset per line.
+const KEY_RE = new RegExp(keyTokenRe('dev-box').source, 'g');
+function namesModuleKey(line) {
+  const re = KEY_RE;
+  re.lastIndex = 0;
+  let m;
+  while ((m = re.exec(line))) {
+    if (/['"`/]/.test(m[1] || '') && /['"`/:]/.test(m[2] || '')) { re.lastIndex = 0; return true; }
+    re.lastIndex = m.index + 1;
+  }
+  return false;
+}
+
+const LINE_RULES = [
+  ['module-key', namesModuleKey],
+  ['identifier', (l) => /\b(builder_boxes|box_intents|box_events|builder_ssh_keys|box_blocked\w*)\b/.test(l)],
+  ['permission', (l) => /['"`]box\.[a-z_]+\.[a-z_]+['"`]/.test(l)],
+  ['session-source', (l) => /\bsource\b\s*(?:===?|!==?|:|=|IN\s*\()[^\n]{0,40}['"]box['"]/i.test(l)],
+];
+
+// Pure: scan one file's text. Returns [{ rule, line }].
+function scanText(text) {
+  const hits = [];
+  String(text == null ? '' : text).split('\n').forEach((l, i) => {
+    for (const [rule, test] of LINE_RULES) if (test(l)) hits.push({ rule, line: i + 1 });
+  });
+  return hits;
+}
+
+function trackedFiles(root = REPO_ROOT) {
+  return execFileSync('git', ['ls-files'], { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, timeout: 30000 })
+    .split('\n').filter(Boolean);
+}
+
+// The fitness check. `files` and `read` are injectable so the tests can plant a
+// violation without touching the tree.
+function checkNoDevBox({ files, read } = {}) {
+  const list = files || trackedFiles();
+  const readFile = read || ((rel) => fs.readFileSync(path.join(REPO_ROOT, rel), 'utf8'));
+  const violations = [];
+  for (const rel of list) {
+    if (exemptionFor(rel)) continue;
+    if (PATH_RULE.test(rel)) violations.push(`${rel} — path: a retired dev-box location (ADR 0346)`);
+    if (!TEXT_EXT.test(rel)) continue;
+    let text;
+    try { text = readFile(rel); } catch { continue; }
+    for (const { rule, line } of scanText(text)) violations.push(`${rel}:${line} — ${rule}: a retired dev-box name (ADR 0346)`);
+  }
+  const note = `The dev box was removed on purpose (${ADR}). ${list.length} tracked file(s) scanned for its module key, tables/columns, box.* permissions, box session source and paths. `
+    + `A hit means use what replaced it (a local checkout; server-mediated publish for a checkout with no push credential). Only a retirement guard or a historical record may name the box: add it to DEV_BOX_EXEMPT in scripts/gds/dev-box-guard.js, with its reason.`;
+  if (list.length === 0) {
+    return { name: NAME, ok: false, hardFail: true, violations: ['scan defect — enumerated 0 tracked files; a broken enumeration, not a clean result.'], warnings: [], note };
+  }
+  return { name: NAME, ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings: [], note };
+}
+
+module.exports = { checkNoDevBox, scanText, namesModuleKey, exemptionFor, DEV_BOX_EXEMPT, PATH_RULE };
+
+if (require.main === module) {
+  const r = checkNoDevBox();
+  console.log(`${r.ok ? 'PASS' : 'FAIL'}  ${r.name}\n${r.note}`);
+  for (const v of r.violations) console.log(`  ✗ ${v}`);
+  process.exitCode = r.ok ? 0 : 1;
+}

package/scripts/gds/doctor.js

@@ -371,7 +371,7 @@ function checkDeployTooling() {
   }
 
   // ADR 0055 / task 1025: in ci mode there are two publish paths. A machine with
-  // no GitHub push credential (a dev box) ships SERVER-MEDIATED — it uploads its
+  // no GitHub push credential ships SERVER-MEDIATED — it uploads its
   // branch to the GDS, which pushes + opens the PR with the server's credential —
   // so gh is NOT needed here. Resolve the same path ship.js will take and skip the
   // gh requirement when it's server-mediated.
@@ -382,7 +382,7 @@ function checkDeployTooling() {
     /* keep 'local'; the gh checks below are the safe, stricter default */
   }
   if (via === 'server') {
-    ok('deploy', `Deploy mode: ci (server-mediated publish) — this machine has no GitHub push credential, so the GDS pushes your branch + opens the PR for you. gh is not required here. NOTE: on a dev box, run /builder-reauth (browser) first so your session is a real cli session, not the box-scoped one.`);
+    ok('deploy', `Deploy mode: ci (server-mediated publish) — this machine has no GitHub push credential, so the GDS pushes your branch + opens the PR for you. gh is not required here.`);
     return;
   }
 
@@ -425,7 +425,7 @@ function checkDeployTooling() {
 
 // Intent-runner drift (task 1002722): a runner on a stale core once turned a domain-attach
 // into a teardown (task 1002716). Only a host with *intent-runner* units shows this section,
-// so a builder laptop or dev box sees nothing.
+// so a builder laptop sees nothing.
 function runnerDriftRows(results) {
   return (results || []).map((r) => {
     const msg = `${r.name}: ${r.reason}`;

package/scripts/gds/fitness-checks-packaging.js

@@ -24,7 +24,7 @@ const { CORE_ROOT, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
 // ============================================================================
 //
 // A vanilla self-host boot ships only the PUBLISHABLE tree (publish-manifest.js). An
-// instance-only config (config/devbox-app.json, config/bongos-cli.json, config/branding.json,
+// instance-only config (config/bongos-cli.json, config/branding.json,
 // config/modules.json, …) is boundary-EXCLUDED, so a bare `require('../../config/<excluded>.json')`
 // in core code throws MODULE_NOT_FOUND and CRASHES the boot on a fresh instance — the exact
 // class that shipped in R88 (two hard-requires in src/bongos/serve-internal.js; task 1824). The
@@ -81,9 +81,9 @@ function checkCoreRequiresExcludedConfig() {
 // require()s a boundary-EXCLUDED module (modules/game, modules/art-pipeline,
 // modules/character-anim, …) throws MODULE_NOT_FOUND once that module lives in the
 // consumer's instance repo rather than the core package (R89 split). The cure is
-// either to reclassify the module INTO core (if it belongs there — e.g. provisioning,
-// sibling of dev-box) or to exclude the requiring file with the feature it serves
-// (art tooling). Catches BOTH require forms: a direct literal
+// either to reclassify the module INTO core (if it belongs there — e.g. provisioning)
+// or to exclude the requiring file with the feature it serves (art tooling).
+// Catches BOTH require forms: a direct literal
 // require('../modules/<key>/…') AND a require(path.join(<root>, 'modules/<key>/…')).
 // Only an EXCLUDED module required from a PUBLISHABLE file is a violation; requiring a
 // publishable (core) module is fine, and the loader's DYNAMIC dispatch

package/scripts/gds/fitness-lib.js

@@ -70,8 +70,18 @@ function walkJsAllRoots(subpath, roots = MODULE_ROOTS) {
   return out;
 }
 
+// Match a module key as a DELIMITED token so `art-pipeline` hits in `'art-pipeline'` /
+// `mount('art-pipeline')` but never inside `art-pipelines` or `xart-pipeline`. Hyphens are
+// non-word chars, so the boundary guards against word-chars AND hyphens on both
+// sides (no lookbehind — portable on every node the unit gate runs). Moved here from
+// fitness.js (task 1003899) so dev-box-guard.js matches the retired key the same way.
+function keyTokenRe(key) {
+  const esc = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return new RegExp(`(^|[^\\w-])${esc}($|[^\\w-])`);
+}
 
 module.exports = {
+  keyTokenRe,
   CORE_ROOT,
   INSTANCE_ROOT,
   MODULE_ROOTS,

package/scripts/gds/fitness-ratchets.js

@@ -350,7 +350,7 @@ const METRIC_HINTS = {
   legacy_api_gds_callers:
     ' — a NEW in-repo caller was written against the permanent `/api/gds` alias (task 1004064, '
     + 'idea 1001030). Ask for `/api/bongos` instead: the alias exists for callers we CANNOT update '
-    + '(shipped Dev Box binaries, live dev boxes), not for code in this repo. Run '
+    + '(shipped binaries, live instances), not for code in this repo. Run '
     + '`node scripts/gds/api-alias-caller-scan.js --files` to see every counted line. The alias '
     + 'contract, the pinned OAuth callbacks, the uptime poller + smoke, the rename guardrails, '
     + 'tests/, docs/, migrations/ and captured fixtures are excluded by construction — and so is '

package/scripts/gds/fitness.js

@@ -33,7 +33,7 @@ const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-con
 // live beside it — the shared roots/walkers and three check clusters. They are
 // IMPORTED (not registered by path) so the CHECKS array and module.exports below
 // stay byte-identical to the single-file version every test was written against.
-const { CORE_ROOT, INSTANCE_ROOT, MODULE_ROOTS, REPO_ROOT, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
+const { CORE_ROOT, INSTANCE_ROOT, MODULE_ROOTS, REPO_ROOT, keyTokenRe, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
 const { IDENTITY_SCAN_ALLOWED, IDENTITY_SCAN_EXCLUDE, IDENTITY_SCAN_EXTRA_FILES, IDENTITY_SCAN_EXTS, IDENTITY_SCAN_ROOTS, IDENTITY_SCAN_SKIP_DIRS, PROMPT_IDENTITY_LITERALS, checkDesignContract, checkKernelPromptsNoHardcodedIdentity, checkNeutralConfigsNoHostIdentity, collectIdentityFiles, scanPromptIdentity, stripCommentsForIdentity } = require('./fitness-checks-identity.js');
 const { WRITE_VALIDATION_BASELINE, WRITE_VALIDATION_EXEMPT, checkWriteRoutesValidated, scanUnvalidatedWriteRoutes } = require('./fitness-checks-write-validation.js');
 const { GOAL_VOCAB_CITATION, GOAL_VOCAB_LINE_SCOPED, GOAL_VOCAB_SURFACE, LIFECYCLE_DB_FILES, PRELAUNCH_SURFACE, RENAME_IDENTITY_RE, VOCAB_ALLOW, VOCAB_BANNED, VOCAB_CITATION, VOCAB_EXTS, VOCAB_HISTORICAL_REF, VOCAB_SURFACE, checkGoalMembershipVocabulary, checkGovernmentRenameIdentity, checkPrelaunchVocabulary, checkVocabularyWall, vocabFilesToScan } = require('./fitness-checks-vocabulary.js');
@@ -683,15 +683,6 @@ function moduleDir(key) {
   return path.join(CORE_ROOT, 'modules', key);
 }
 
-// Match a module key as a DELIMITED token so `art-pipeline` hits in `'art-pipeline'` /
-// `mount('art-pipeline')` but never inside `art-pipelines` or `xart-pipeline`. Hyphens are
-// non-word chars, so the boundary guards against word-chars AND hyphens on both
-// sides (no lookbehind — portable on every node the unit gate runs).
-function keyTokenRe(key) {
-  const esc = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-  return new RegExp(`(^|[^\\w-])${esc}($|[^\\w-])`);
-}
-
 // Pure: scan kernel source text for any hardcoded module key, skipping comment
 // lines. Returns violation strings (one per hit). Exported for the negative test
 // (mirrors scanScopeMapSource / scanDeterministicBody).
@@ -1350,6 +1341,7 @@ const CHECKS = [
   // Task 1003206 carved this file from 2,004 lines to ~1,350, so that toll is paid
   // and the check gets its own line back.
   require('./version-literal-guard.js').checkNoVersionLiterals,
+  require('./dev-box-guard.js').checkNoDevBox, // task 1003899 / ADR 0346: the retired dev box stays out (its exemption list lives in that file)
   require('./control-manifest.js').checkControlsExist, // Check 21 — task 1003131: goal-1000076 controls assert their own existence (the ADR 0022 assurance-of-assurance)
   require('./routine-schedule.js').checkRoutineCadencesScheduled, // Check 25 — task 1003209: a routine that declares a cadence must have a scheduler firing it AT that period (ADR 0188)
   require('./baseline-staleness.js').checkBaselineFloors, // Check 26 — task 1003210: a shrink-only baseline that never shrinks is unmanaged debt; a floor exempting one must say why

package/scripts/gds/gen-api-client.js

@@ -208,8 +208,8 @@ function stripEsmExports(esm) {
     .replace(/^export default createClient;\n?/m, '');
 }
 
-// index.cjs — for Node consumers that use require() (e.g. the devbox Electron
-// app, which is a zero-dep CJS subproject and vendors this file at package time).
+// index.cjs — for Node consumers that use require() (e.g. a zero-dep CJS subproject
+// that vendors this file at package time).
 function renderClientCjs(esm) {
   const header =
     '// @bongos/client (CommonJS build) — GENERATED from index.mjs by\n' +
@@ -394,8 +394,8 @@ function renderPackageJson(spec) {
     // updated while the API it is generated FROM moved 500+ core versions. It had zero consumers
     // the whole time: nothing across the core or any instance repo ever declared it as a
     // dependency — every consumer VENDORS a copy instead. That was two places when this was
-    // written; task 1003891 deleted the Dev Box Electron app and ADR 0324 retired
-    // @cloudbongos/cli, so there is now no vendoring consumer left at all. The
+    // written; both have since been deleted or retired (ADR 0324 retired
+    // @cloudbongos/cli), so there is now no vendoring consumer left at all. The
     // owner removed it from the registry on 2026-09-09.
     //
     // The manifest itself stays: `main`/`types`/`exports` are what make the vendored copy and a

package/scripts/gds/gen-api-docs.js

@@ -837,7 +837,7 @@ function buildOpenapi(model) {
       license: { name: 'AGPL-3.0-or-later', url: 'https://www.gnu.org/licenses/agpl-3.0.html' },
       description: [
         `The Bongos API — the build-methodology backend`,
-        `(builders, tasks, claims, credits, grading, memory, dev boxes).`,
+        `(builders, tasks, claims, credits, grading, memory).`,
         ``,
         `**API version:** \`${API_VERSION}\` — served at \`${VERSIONED_API_PREFIX}\`. The`,
         `unversioned \`${API_PREFIX}\` and legacy \`/api/gds\` are permanent aliases`,

package/scripts/gds/gen-repo-map.js

@@ -11,7 +11,7 @@
 //       interpretive prose stays put while the file list / signatures can't silently drift.
 //
 // Zero-dependency on purpose: the codebase is CommonJS JS, and a portable-core capability must
-// regenerate in CI and on every dev box with no native build / no node-gyp / no WASM grammar to
+// regenerate in CI and on any checkout with no native build / no node-gyp / no WASM grammar to
 // fetch (the whole point of Paths B+C is keeping every instance navigable cheaply). A line+regex
 // extractor is accurate enough for an *advisory* navigation aid (it is not a compiler input). A
 // richer tree-sitter/WASM backend can slot in behind extractFile() later for polyglot instances
@@ -25,9 +25,9 @@
 //   node scripts/gds/gen-repo-map.js --check-block # exit 2 only if a TRACKED nested block would change (the CI gate)
 //   node scripts/gds/gen-repo-map.js --check-whole # exit 2 only if docs/repo-map.md would change
 //   node scripts/gds/gen-repo-map.js --whole-only  # WRITE docs/repo-map.md only; never touch the
-//                                                  # tracked nested blocks (what a SPARSE dev-box
+//                                                  # tracked nested blocks (what a SPARSE
 //                                                  # checkout must use — task 1002962)
-// docs/repo-map.md is GITIGNORED + regenerated at deploy/box-fetch since ADR 0110 (task 1926);
+// docs/repo-map.md is GITIGNORED + regenerated at deploy since ADR 0110 (task 1926);
 // only the nested-doc symbol blocks stay tracked, so CI gates the block bucket, not the whole file.
 //   node scripts/gds/gen-repo-map.js --json       # print the extracted model as JSON (debug)
 
@@ -458,7 +458,7 @@ function injectBlock(existing, block) {
 function main() {
   // Two artifact BUCKETS, gated separately since ADR 0110 (task 1926):
   //   • 'whole' — docs/repo-map.md, which is now GITIGNORED and regenerated at
-  //     deploy / box-source-fetch (the gen-atlas.js model), so it carries no
+  //     deploy (the gen-atlas.js model), so it carries no
   //     committed copy and two parallel branches can never collide on it.
   //   • 'block' — the generated symbol BLOCK inside each nested CLAUDE.md, which
   //     stays hand-written prose + a tracked block, so it MUST stay fresh in git.
@@ -472,16 +472,15 @@ function main() {
   // 1002962). --whole-only regenerates the GITIGNORED docs/repo-map.md and leaves
   // the TRACKED nested blocks alone.
   //
-  // WHY a caller ever needs this: a dev box is a SPARSE checkout (box-access.js
-  // materializes only the claim's module cone). The block ordering is
-  // `b.refs - a.refs || name`, and `refs` counts references across the VISIBLE
-  // corpus — so a box with 7 of 20 modules computes different counts and emits a
-  // legitimately different block. Written into a tracked file that dirties the
-  // working tree, and box-source-fetch.sh's NEXT `git pull` aborts with "local
-  // changes would be overwritten" — a silent, permanent sync deadlock (one box sat
-  // 257 commits behind for three days). A box CONSUMES these blocks; they arrive
-  // correct with the pull, generated by CI from the whole tree. Only a full
-  // checkout may produce them.
+  // WHY a caller ever needs this: a SPARSE checkout materializes only part of the
+  // tree. The block ordering is `b.refs - a.refs || name`, and `refs` counts
+  // references across the VISIBLE corpus — so a checkout with 7 of 20 modules
+  // computes different counts and emits a legitimately different block. Written
+  // into a tracked file that dirties the working tree, and the NEXT `git pull`
+  // aborts with "local changes would be overwritten" — a silent, permanent sync
+  // deadlock (one checkout sat 257 commits behind for three days). A sparse
+  // checkout CONSUMES these blocks; they arrive correct with the pull, generated
+  // by CI from the whole tree. Only a full checkout may produce them.
   const wholeOnly = process.argv.includes('--whole-only');
   const model = buildModel();