@bongos/core 1.19.315 → 1.19.317

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.315",
+  "version": "1.19.317",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.315",
+      "version": "1.19.317",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.315",
+  "version": "1.19.317",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/coreB-carve-proof.sh

@@ -50,6 +50,13 @@
 #   FULL_SUITE=1 bash scripts/gds/coreB-carve-proof.sh   # also run the full CI gate
 #   SKIP_SUITE=1 bash scripts/gds/coreB-carve-proof.sh   # legs 1-4 only (fast)
 
+# task 1003204 (goal 1000079): the lifecycle data layer is no longer one file —
+# modules/lifecycle/db.js is a re-export facade over twelve db-*.js units. Every
+# proof below that greps "the lifecycle db" must scan the FAMILY, or it silently
+# stops covering code that merely moved between units (and can even pass off a
+# doc-comment in the facade, which is exactly what happened before this fix).
+LIFECYCLE_DB="modules/lifecycle/db.js $(ls modules/lifecycle/db-*.js 2>/dev/null | tr '\n' ' ')"
+
 set -uo pipefail
 cd "$(dirname "$0")/../.."   # repo root (consistent with portability-smoke-*.sh)
 
@@ -191,10 +198,12 @@ grep -q "registerProvider('reward'" modules/economy/routes/reward.js 2>/dev/null
   && ok "economy registers the 'reward' provider at boot (modules/economy/routes/reward.js)" \
   || bad "economy does not registerProvider('reward')"
 # the lifecycle db slice carved to modules/lifecycle/db.js at R86 — it resolves the reward port there.
-if grep -q "resolveOptional('reward')" modules/lifecycle/db.js 2>/dev/null; then
-  ok "the lifecycle resolves economy via the kernel port (seams.resolveOptional('reward') in modules/lifecycle/db.js)"
+# task 1003204 split that slice into db.js + db-*.js, so scan the whole family: the
+# port call now lives in the unit that owns the transaction, not in the facade.
+if grep -q "resolveOptional('reward')" $LIFECYCLE_DB 2>/dev/null; then
+  ok "the lifecycle resolves economy via the kernel port (seams.resolveOptional('reward') in the lifecycle db family)"
 else
-  bad "the lifecycle does not resolve 'reward' via the seam in modules/lifecycle/db.js"
+  bad "the lifecycle does not resolve 'reward' via the seam in the modules/lifecycle db family"
 fi
 # no core file requires the moved economy files directly (llm-pricing stays core).
 if grep -rnE "require\(['\"][^'\"]*/(cost|streak|achievements|cost-summary-shape)['\"]\)" src/ server.js 2>/dev/null | grep -v node_modules | grep -v module-api | grep -v 'modules/economy' | grep -qv llm-pricing; then
@@ -352,11 +361,11 @@ grep -q "registerProvider('onboarding'" modules/onboarding/routes/onboarding.js
   || bad "onboarding does not registerProvider('onboarding')"
 # the lifecycle's claim/ship carved to modules/lifecycle/db.js at R86 (it ticks the
 # onboarding stage there); core auth.js (the auth callbacks) stays and resolves it too.
-if grep -q "resolveOptional('onboarding')" modules/lifecycle/db.js 2>/dev/null \
+if grep -q "resolveOptional('onboarding')" $LIFECYCLE_DB 2>/dev/null \
    && grep -q "resolveOptional('onboarding')" src/bongos/auth.js 2>/dev/null; then
-  ok "the lifecycle + core resolve onboarding via the kernel port (resolveOptional('onboarding') in modules/lifecycle/db.js + core auth.js)"
+  ok "the lifecycle + core resolve onboarding via the kernel port (resolveOptional('onboarding') in the lifecycle db family + core auth.js)"
 else
-  bad "the lifecycle or core does not resolve 'onboarding' via the seam (modules/lifecycle/db.js + auth.js)"
+  bad "the lifecycle or core does not resolve 'onboarding' via the seam (lifecycle db family + auth.js)"
 fi
 # no core file requires a moved onboarding domain file directly. The match is
 # scoped to the moved domain basenames; the onboarding CLIs (setup/onboarding-
@@ -590,10 +599,10 @@ if grep -qE "^async function (claimTask|shipTask|createTask|resolveClaim)\b" src
 else
   ok "the lifecycle state-machine SQL left src/bongos/db.js — the residue is the kernel identity/auth/twin slice (ADR 0093 §3)"
 fi
-if grep -qE "async function (claimTask|shipTask|createTask)\b" modules/lifecycle/db.js 2>/dev/null; then
-  ok "the lifecycle state-machine SQL now lives in modules/lifecycle/db.js (claim/ship/createTask/…)"
+if grep -qE "async function (claimTask|shipTask|createTask)\b" $LIFECYCLE_DB 2>/dev/null; then
+  ok "the lifecycle state-machine SQL now lives in the modules/lifecycle db family (claim/ship/createTask/…)"
 else
-  bad "the lifecycle state-machine SQL not found in modules/lifecycle/db.js"
+  bad "the lifecycle state-machine SQL not found in the modules/lifecycle db family"
 fi
 # lifecycle registers the `lifecycle` port; core read routes + cascade-dispatch resolve it.
 grep -q "registerProvider('lifecycle'" modules/lifecycle/routes/lifecycle.js 2>/dev/null \

package/scripts/gds/fitness.js

@@ -971,8 +971,12 @@ const PROMPT_IDENTITY_LITERALS = [
 // 1002201 sweep replaced that literal everywhere else. The straggler surfaced as a
 // 401 that locked a builder out of re-authenticating — a valid token verified
 // against the wrong host — and nothing in CI could see it (idea 1000564).
-const IDENTITY_SCAN_ROOTS = ['src/bongos', 'modules', 'scripts/gds'];
-const IDENTITY_SCAN_EXTRA_FILES = ['scripts/gds/architect-audit.js'];
+// Widened scripts/gds → ALL of scripts/ at task 1002756: migrate.sh's hardcoded
+// founder DB default (task 1002755) survived every gate because the detector never
+// saw the file — a gate that cannot see the file class the bug lives in is worse
+// than no gate, because it is trusted.
+const IDENTITY_SCAN_ROOTS = ['src/bongos', 'modules', 'scripts'];
+const IDENTITY_SCAN_EXTRA_FILES = [];
 // PERMANENT, COUNTED carve-outs for the scripts/gds root — {file: allowed hits}.
 //
 // Widening the root (task 1002427) surfaced 23 files. Task 1002428 swept them:
@@ -1010,7 +1014,15 @@ const IDENTITY_SCAN_EXTRA_FILES = ['scripts/gds/architect-audit.js'];
 //     units on that box invoke these by path. Re-pointing an instance's backups is
 //     deployment work, not a branding read. Their COUNT is still frozen here, so a
 //     NEW literal in any of them fails exactly like one in an unlisted file.
+//   * fitness.js / package-core.js — THE DETECTORS THEMSELVES: Check 13's regexes
+//     and package-core's PRIOR_INSTANCE_FLOOR name the brand because hunting it is
+//     their job. * seed-v3-tasks.js — the seeded-task-prose rationale above. All
+//     three passed pre-1002756 only by the old stripper's accidents (phantom
+//     blocks + regex-blindness); now they are seen and counted.
 const IDENTITY_SCAN_ALLOWED = {
+  'scripts/gds/fitness.js': 2,
+  'scripts/gds/package-core.js': 1,
+  'scripts/gds/seed-v3-tasks.js': 14,
   'scripts/gds/audit-replay.sh': 1,
   'scripts/gds/db-backup-nightly.sh': 1,
   'scripts/gds/db-backup-offsite.sh': 2,
@@ -1041,28 +1053,10 @@ const IDENTITY_SCAN_EXCLUDE = ['modules/game/'];
 // Directories with no authored source to gate.
 const IDENTITY_SCAN_SKIP_DIRS = new Set(['node_modules', '.git', 'generated', 'iterations', 'references']);
 
-// Strip comments so a rationale comment naming the old brand never trips the scan.
-// The JS // strip is `://`-safe (keeps the char before `//` unless it's `:`), so a
-// hardcoded "https://amazonprimea.com" URL is NOT truncated and still gets caught.
-function stripCommentsForIdentity(text, ext) {
-  let t = String(text == null ? '' : text);
-  if (ext === '.html') return t.replace(/<!--[\s\S]*?-->/g, '');
-  // Shell has no block comments, so it returns BEFORE the /* */ strip below (a
-  // `"$TMP"/*` glob would otherwise eat real code). Only FULL-LINE `#` comments
-  // (and the shebang) are stripped: cutting from an inline `#` would truncate
-  // `${v#p}` / `$#` lines and could hide a literal sitting after them.
-  if (ext === '.sh') return t.split(/\r?\n/).map((l) => (/^\s*#/.test(l) ? '' : l)).join('\n');
-  t = t.replace(/\/\*[\s\S]*?\*\//g, ''); // block comments (js + css)
-  // Split on /\r?\n/, NOT '\n' (task 1002428). On a CRLF checkout the old split
-  // left a trailing \r on every line, and since `.` does not match \r the `.*$`
-  // in the line-comment pattern could never reach end-of-string — so NO line
-  // comment was stripped and every rationale comment naming the old brand was
-  // scanned as if it were code. That silently broke this function's whole
-  // contract ("a rationale comment naming the old brand never trips the scan")
-  // on Windows, and made the check disagree with Linux CI on the same tree.
-  if (ext === '.js') t = t.split(/\r?\n/).map((l) => l.replace(/(^|[^:])\/\/.*$/, '$1')).join('\n');
-  return t;
-}
+// Comment stripping lives in identity-strip.js (task 1002756: extracted + replaced
+// the two-regex JS strip, which a `/*` inside a `//` comment could OPEN — it
+// silently hid ~330 provision.js lines from this gate). Re-exported for the tests.
+const { stripCommentsForIdentity } = require('./identity-strip');
 
 // Pure: scan one file's comment-stripped source for a hardcoded host-brand literal.
 // Returns violation strings. Exported for the "actually catches a re-hardcode" test.
@@ -1153,7 +1147,7 @@ function checkKernelPromptsNoHardcodedIdentity() {
     hardFail: violations.length > 0,
     violations,
     warnings: [],
-    note: `${scanned} portable source file(s) scanned (.js/.html/.css/.sh under src/bongos/** + modules/** + scripts/gds/** + kernel-prompt CLIs, minus the instance-1 product + generated dirs) — none may hardcode the host brand; identity comes from branding()/window.__BRANDING__ (ADR 0062 §3/§5). ${ratcheted} scripts/gds file(s) hold documented permanent carve-outs (real DNS zones, real doc filenames, operator runbook text, historical seeded prose) capped at a count they may not exceed — task 1002428.`,
+    note: `${scanned} portable source file(s) scanned (.js/.html/.css/.sh under src/bongos/** + modules/** + scripts/** (whole root, task 1002756), minus the instance-1 product + generated dirs) — none may hardcode the host brand; identity comes from branding()/window.__BRANDING__ (ADR 0062 §3/§5). ${ratcheted} scripts/gds file(s) hold documented permanent carve-outs (real DNS zones, real doc filenames, operator runbook text, historical seeded prose) capped at a count they may not exceed — task 1002428.`,
   };
 }
 
@@ -1655,7 +1649,6 @@ function checkWriteRoutesValidated() {
   };
 }
 
-// ---- runner ----------------------------------------------------------------
 
 // ── Check 19 — the ADR 0174 vocabulary wall (goal 1000068 R07, task 1003008) ──
 //
@@ -1799,8 +1792,22 @@ const GOAL_VOCAB_SURFACE = [
 // allowlist longer than the rule; scanning the LINES THAT NAME THE TABLE catches
 // the only thing that can regress here — a membership query reaching for the old
 // column — with no false positives to excuse.
+// task 1003204 (goal 1000079) split that 5k-line file into db.js (a re-export
+// facade) + twelve db-*.js units, so the membership SQL is no longer in db.js at
+// all. Enumerate the family from disk rather than naming one file: a line-scoped
+// scan costs nothing on the units that hold no membership SQL, and a future
+// re-carve cannot silently disarm the rule by moving the queries again.
+const LIFECYCLE_DB_FILES = (() => {
+  const dir = path.join(CORE_ROOT, 'modules', 'lifecycle');
+  try {
+    return fs.readdirSync(dir)
+      .filter((f) => f === 'db.js' || (f.startsWith('db-') && f.endsWith('.js')))
+      .sort()
+      .map((f) => `modules/lifecycle/${f}`);
+  } catch { return ['modules/lifecycle/db.js']; }
+})();
 const GOAL_VOCAB_LINE_SCOPED = [
-  { file: 'modules/lifecycle/db.js', mustMention: /goal_members/ },
+  ...LIFECYCLE_DB_FILES.map((file) => ({ file, mustMention: /goal_members/ })),
   // sso.js is the federation surface: only the lines that name the membership table
   // or its upsert are in scope, so the file's other server-to-server prose stays out.
   { file: 'modules/platform-identity/routes/sso.js', mustMention: /project_memberships|upsertMembership/ },
@@ -1899,6 +1906,7 @@ const CHECKS = [
   checkWriteRoutesValidated, // Check 18 — BV1 R12 / task 1999: every body-reading write route validates (ADR 0118)
   require('./fitness-ratchets.js').checkQualityRatchets, // Check 20 — task 1003129: quality budgets only tighten (mechanics + knip CI step live in fitness-ratchets.js)
   require('./doc-cli-guard.js').checkDocNamesRealCli, // Check 22 — task 1003165 / G01: a doc that names a CLI invocation must match the real CLI
+  require('./skill-preflight.js').checkOpsSkillsDeclareMachine, // Check 23 — task 1003167 / G03: an ops skill declares the machine it needs
   require('./control-manifest.js').checkControlsExist, // Check 21 — task 1003131: goal-1000076 controls assert their own existence (the ADR 0022 assurance-of-assurance)
 ];
 

package/scripts/gds/identity-strip.js

@@ -0,0 +1,75 @@
+'use strict';
+// identity-strip.js — comment stripping for fitness.js Check 13 (the hardcoded-
+// identity gate), extracted in task 1002756. Strips comments so a rationale
+// comment naming the old brand never trips the scan, WITHOUT ever letting a
+// comment marker inside another construct change state.
+//
+// Per extension:
+//   .html — <!-- --> blocks removed.
+//   .sh   — FULL-LINE `#` comments (and the shebang) only: cutting from an inline
+//           `#` would truncate `${v#p}` / `$#` lines and could hide a literal
+//           sitting after them. Shell has no block comments, so no /* */ pass (a
+//           `"$TMP"/*` glob would otherwise eat real code).
+//   .css  — /* */ blocks removed (css has only block comments).
+//   .js   — a single character-level pass (task 1002756). The old two-regex
+//           approach (block strip THEN line strip) could be OPENED by a `/*`
+//           sitting inside a `//` line comment — provision.js's
+//           `// … import <dir>/*.caddy` paired with a real `*/` 330 lines later
+//           and silently deleted everything between from the scanned text,
+//           hiding a genuine hardcoded literal in that window. The scanner
+//           tracks string state (' " ` — literals INSIDE strings are what the
+//           gate exists to catch, so string bodies are PRESERVED), comment
+//           state, and regex-literal state (a `//` or `/*` inside /…/ is not a
+//           comment; regex bodies are preserved). CRLF-safe by construction
+//           (task 1002428): newlines pass through untouched, and block-comment
+//           newlines are kept so reported line numbers hold.
+const KEYWORDS_BEFORE_REGEX = new Set(['return', 'typeof', 'case', 'in', 'of', 'instanceof', 'new', 'delete', 'void', 'do', 'else', 'yield', 'await']);
+
+function stripCommentsForIdentity(text, ext) {
+  const t = String(text == null ? '' : text);
+  if (ext === '.html') return t.replace(/<!--[\s\S]*?-->/g, '');
+  if (ext === '.sh') return t.split(/\r?\n/).map((l) => (/^\s*#/.test(l) ? '' : l)).join('\n');
+  if (ext === '.css') return t.replace(/\/\*[\s\S]*?\*\//g, '');
+  let out = '';
+  const n = t.length;
+  let i = 0;
+  const regexCanFollow = () => {
+    const trimmed = out.replace(/[ \t]+$/, '');
+    if (trimmed === '' || /[\n(,=:[!&|?{};+\-*%~^<>]$/.test(trimmed)) return true;
+    const word = /[A-Za-z_$][\w$]*$/.exec(trimmed);
+    return !!(word && KEYWORDS_BEFORE_REGEX.has(word[0]));
+  };
+  while (i < n) {
+    const c = t[i], d = t[i + 1];
+    if (c === '/' && d === '/') { while (i < n && t[i] !== '\n') i++; continue; } // line comment
+    if (c === '/' && d === '*') { // block comment — keep newlines so line numbers hold
+      i += 2;
+      while (i < n && !(t[i] === '*' && t[i + 1] === '/')) { if (t[i] === '\n') out += '\n'; i++; }
+      i += 2; continue;
+    }
+    if (c === '\'' || c === '"' || c === '`') { // string — body PRESERVED (leaks live here)
+      const q = c; out += c; i++;
+      while (i < n && t[i] !== q) {
+        if (t[i] === '\\') { out += t[i] + (t[i + 1] || ''); i += 2; continue; }
+        out += t[i]; i++;
+      }
+      out += q; i++; continue;
+    }
+    if (c === '/' && regexCanFollow()) { // regex literal — body preserved, markers inert
+      out += '/'; i++;
+      let inClass = false;
+      while (i < n && (inClass || t[i] !== '/') && t[i] !== '\n') {
+        if (t[i] === '\\') { out += t[i] + (t[i + 1] || ''); i += 2; continue; }
+        if (t[i] === '[') inClass = true;
+        else if (t[i] === ']') inClass = false;
+        out += t[i]; i++;
+      }
+      if (t[i] === '/') { out += '/'; i++; }
+      continue;
+    }
+    out += c; i++;
+  }
+  return out;
+}
+
+module.exports = { stripCommentsForIdentity };

package/scripts/gds/preflight.js

@@ -40,11 +40,34 @@ const HEADLESS_AUTH_ENV = ['CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_API_KEY'];
 // caller — /builder-start runs on every session open — can reuse THIS exact
 // finding without paying for the `claude --version` spawn the full
 // preflightChecks() does. Pure: injectable fs + repoRoot.
+//
+// WORKTREES (task 1003167 / idea 1000788): this used to test `repoRoot/node_modules`
+// ONLY, and a git worktree never has its own. But node's module resolution walks UP
+// from the requiring file, so every require in a worktree resolves against the real
+// repo root and works fine — meaning the check fired on essentially every claim
+// (worktree-per-claim is the project default), telling the builder to burn an
+// `npm ci` they did not need. A preflight that cries wolf is worse than none: it
+// trains people to read past the one time it is right. So resolve the way node
+// itself does — walk up — and only then call it missing.
 function depsFinding({ repoRoot = REPO_ROOT, fs = nodeFs } = {}) {
   let hasDeps = false;
-  try { hasDeps = fs.existsSync(nodePath.join(repoRoot, 'node_modules')); } catch (_) { /* treat as missing */ }
+  let foundAt = null;
+  try {
+    let dir = nodePath.resolve(repoRoot);
+    for (;;) {
+      if (fs.existsSync(nodePath.join(dir, 'node_modules'))) { hasDeps = true; foundAt = dir; break; }
+      const up = nodePath.dirname(dir);
+      if (up === dir) break; // hit the filesystem root
+      dir = up;
+    }
+  } catch (_) { /* treat as missing */ }
   if (hasDeps) {
-    return { level: 'ok', title: 'Dependencies', detail: 'node_modules present.' };
+    const here = nodePath.resolve(repoRoot) === foundAt;
+    return {
+      level: 'ok',
+      title: 'Dependencies',
+      detail: here ? 'node_modules present.' : `node_modules resolved from a parent (${foundAt}) — normal in a git worktree; requires resolve fine.`,
+    };
   }
   return {
     level: 'warn',

package/scripts/gds/provision.js

@@ -158,9 +158,11 @@ const CONFIG = {
   // on the control plane, where the token + the packaging tools live. UNSET
   // (default) = every step runs locally, byte-identical to today.
   remoteHost: process.env.PROVISION_REMOTE_HOST || null,
-  // The co-hosting box's checkout dir — the cwd for the remote migrate (its relative
-  // ./scripts/migrate.sh). Defaults to that box's shared checkout.
-  remoteCwd: process.env.PROVISION_REMOTE_CHECKOUT || '/home/lars/amazonprimea',
+  // The co-hosting box's checkout dir — the remote migrate's cwd. NO baked-in default
+  // (task 1002756: the founder-pinned path was an identity leak, and a silent wrong
+  // cwd aims mutating SSH steps at a dir that may not exist); remote mode requires it
+  // explicitly (guarded at the makeExec call), local mode never reads it.
+  remoteCwd: process.env.PROVISION_REMOTE_CHECKOUT || null,
   // ssh options for the control-plane → co-hosting hop. BatchMode so a missing key
   // fails fast (never hangs on a prompt); accept-new pins the host key on first
   // connect (the operator can pre-seed known_hosts for strict pinning).
@@ -2441,6 +2443,8 @@ async function main() {
   // local) for the box-mutating steps; controlExec is ALWAYS local — the token
   // step (Cloudflare DNS hook) + the standalone repo scaffold run on the control
   // plane where the token + packaging tools live (task 2065, ADR 0130).
+  // Remote mode needs an explicit checkout dir (task 1002756 — no founder default).
+  if (CONFIG.remoteHost && !CONFIG.remoteCwd) { console.error('PROVISION_REMOTE_HOST is set but PROVISION_REMOTE_CHECKOUT is not — name the co-hosting box\'s checkout dir (the old hardcoded default was removed, task 1002756).'); process.exit(2); }
   const exec = makeExec({ apply, remoteHost: CONFIG.remoteHost, remoteCwd: CONFIG.remoteCwd, sshOpts: CONFIG.sshOpts });
   const controlExec = makeExec({ apply });
   const deps = {