@bongos/core 1.19.316 → 1.19.317

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.316",
+  "version": "1.19.317",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.316",
+      "version": "1.19.317",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.316",
+  "version": "1.19.317",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/coreB-carve-proof.sh

@@ -50,6 +50,13 @@
 #   FULL_SUITE=1 bash scripts/gds/coreB-carve-proof.sh   # also run the full CI gate
 #   SKIP_SUITE=1 bash scripts/gds/coreB-carve-proof.sh   # legs 1-4 only (fast)
 
+# task 1003204 (goal 1000079): the lifecycle data layer is no longer one file —
+# modules/lifecycle/db.js is a re-export facade over twelve db-*.js units. Every
+# proof below that greps "the lifecycle db" must scan the FAMILY, or it silently
+# stops covering code that merely moved between units (and can even pass off a
+# doc-comment in the facade, which is exactly what happened before this fix).
+LIFECYCLE_DB="modules/lifecycle/db.js $(ls modules/lifecycle/db-*.js 2>/dev/null | tr '\n' ' ')"
+
 set -uo pipefail
 cd "$(dirname "$0")/../.."   # repo root (consistent with portability-smoke-*.sh)
 
@@ -191,10 +198,12 @@ grep -q "registerProvider('reward'" modules/economy/routes/reward.js 2>/dev/null
   && ok "economy registers the 'reward' provider at boot (modules/economy/routes/reward.js)" \
   || bad "economy does not registerProvider('reward')"
 # the lifecycle db slice carved to modules/lifecycle/db.js at R86 — it resolves the reward port there.
-if grep -q "resolveOptional('reward')" modules/lifecycle/db.js 2>/dev/null; then
-  ok "the lifecycle resolves economy via the kernel port (seams.resolveOptional('reward') in modules/lifecycle/db.js)"
+# task 1003204 split that slice into db.js + db-*.js, so scan the whole family: the
+# port call now lives in the unit that owns the transaction, not in the facade.
+if grep -q "resolveOptional('reward')" $LIFECYCLE_DB 2>/dev/null; then
+  ok "the lifecycle resolves economy via the kernel port (seams.resolveOptional('reward') in the lifecycle db family)"
 else
-  bad "the lifecycle does not resolve 'reward' via the seam in modules/lifecycle/db.js"
+  bad "the lifecycle does not resolve 'reward' via the seam in the modules/lifecycle db family"
 fi
 # no core file requires the moved economy files directly (llm-pricing stays core).
 if grep -rnE "require\(['\"][^'\"]*/(cost|streak|achievements|cost-summary-shape)['\"]\)" src/ server.js 2>/dev/null | grep -v node_modules | grep -v module-api | grep -v 'modules/economy' | grep -qv llm-pricing; then
@@ -352,11 +361,11 @@ grep -q "registerProvider('onboarding'" modules/onboarding/routes/onboarding.js
   || bad "onboarding does not registerProvider('onboarding')"
 # the lifecycle's claim/ship carved to modules/lifecycle/db.js at R86 (it ticks the
 # onboarding stage there); core auth.js (the auth callbacks) stays and resolves it too.
-if grep -q "resolveOptional('onboarding')" modules/lifecycle/db.js 2>/dev/null \
+if grep -q "resolveOptional('onboarding')" $LIFECYCLE_DB 2>/dev/null \
    && grep -q "resolveOptional('onboarding')" src/bongos/auth.js 2>/dev/null; then
-  ok "the lifecycle + core resolve onboarding via the kernel port (resolveOptional('onboarding') in modules/lifecycle/db.js + core auth.js)"
+  ok "the lifecycle + core resolve onboarding via the kernel port (resolveOptional('onboarding') in the lifecycle db family + core auth.js)"
 else
-  bad "the lifecycle or core does not resolve 'onboarding' via the seam (modules/lifecycle/db.js + auth.js)"
+  bad "the lifecycle or core does not resolve 'onboarding' via the seam (lifecycle db family + auth.js)"
 fi
 # no core file requires a moved onboarding domain file directly. The match is
 # scoped to the moved domain basenames; the onboarding CLIs (setup/onboarding-
@@ -590,10 +599,10 @@ if grep -qE "^async function (claimTask|shipTask|createTask|resolveClaim)\b" src
 else
   ok "the lifecycle state-machine SQL left src/bongos/db.js — the residue is the kernel identity/auth/twin slice (ADR 0093 §3)"
 fi
-if grep -qE "async function (claimTask|shipTask|createTask)\b" modules/lifecycle/db.js 2>/dev/null; then
-  ok "the lifecycle state-machine SQL now lives in modules/lifecycle/db.js (claim/ship/createTask/…)"
+if grep -qE "async function (claimTask|shipTask|createTask)\b" $LIFECYCLE_DB 2>/dev/null; then
+  ok "the lifecycle state-machine SQL now lives in the modules/lifecycle db family (claim/ship/createTask/…)"
 else
-  bad "the lifecycle state-machine SQL not found in modules/lifecycle/db.js"
+  bad "the lifecycle state-machine SQL not found in the modules/lifecycle db family"
 fi
 # lifecycle registers the `lifecycle` port; core read routes + cascade-dispatch resolve it.
 grep -q "registerProvider('lifecycle'" modules/lifecycle/routes/lifecycle.js 2>/dev/null \

package/scripts/gds/fitness.js

@@ -971,8 +971,12 @@ const PROMPT_IDENTITY_LITERALS = [
 // 1002201 sweep replaced that literal everywhere else. The straggler surfaced as a
 // 401 that locked a builder out of re-authenticating — a valid token verified
 // against the wrong host — and nothing in CI could see it (idea 1000564).
-const IDENTITY_SCAN_ROOTS = ['src/bongos', 'modules', 'scripts/gds'];
-const IDENTITY_SCAN_EXTRA_FILES = ['scripts/gds/architect-audit.js'];
+// Widened scripts/gds → ALL of scripts/ at task 1002756: migrate.sh's hardcoded
+// founder DB default (task 1002755) survived every gate because the detector never
+// saw the file — a gate that cannot see the file class the bug lives in is worse
+// than no gate, because it is trusted.
+const IDENTITY_SCAN_ROOTS = ['src/bongos', 'modules', 'scripts'];
+const IDENTITY_SCAN_EXTRA_FILES = [];
 // PERMANENT, COUNTED carve-outs for the scripts/gds root — {file: allowed hits}.
 //
 // Widening the root (task 1002427) surfaced 23 files. Task 1002428 swept them:
@@ -1010,7 +1014,15 @@ const IDENTITY_SCAN_EXTRA_FILES = ['scripts/gds/architect-audit.js'];
 //     units on that box invoke these by path. Re-pointing an instance's backups is
 //     deployment work, not a branding read. Their COUNT is still frozen here, so a
 //     NEW literal in any of them fails exactly like one in an unlisted file.
+//   * fitness.js / package-core.js — THE DETECTORS THEMSELVES: Check 13's regexes
+//     and package-core's PRIOR_INSTANCE_FLOOR name the brand because hunting it is
+//     their job. * seed-v3-tasks.js — the seeded-task-prose rationale above. All
+//     three passed pre-1002756 only by the old stripper's accidents (phantom
+//     blocks + regex-blindness); now they are seen and counted.
 const IDENTITY_SCAN_ALLOWED = {
+  'scripts/gds/fitness.js': 2,
+  'scripts/gds/package-core.js': 1,
+  'scripts/gds/seed-v3-tasks.js': 14,
   'scripts/gds/audit-replay.sh': 1,
   'scripts/gds/db-backup-nightly.sh': 1,
   'scripts/gds/db-backup-offsite.sh': 2,
@@ -1041,28 +1053,10 @@ const IDENTITY_SCAN_EXCLUDE = ['modules/game/'];
 // Directories with no authored source to gate.
 const IDENTITY_SCAN_SKIP_DIRS = new Set(['node_modules', '.git', 'generated', 'iterations', 'references']);
 
-// Strip comments so a rationale comment naming the old brand never trips the scan.
-// The JS // strip is `://`-safe (keeps the char before `//` unless it's `:`), so a
-// hardcoded "https://amazonprimea.com" URL is NOT truncated and still gets caught.
-function stripCommentsForIdentity(text, ext) {
-  let t = String(text == null ? '' : text);
-  if (ext === '.html') return t.replace(/<!--[\s\S]*?-->/g, '');
-  // Shell has no block comments, so it returns BEFORE the /* */ strip below (a
-  // `"$TMP"/*` glob would otherwise eat real code). Only FULL-LINE `#` comments
-  // (and the shebang) are stripped: cutting from an inline `#` would truncate
-  // `${v#p}` / `$#` lines and could hide a literal sitting after them.
-  if (ext === '.sh') return t.split(/\r?\n/).map((l) => (/^\s*#/.test(l) ? '' : l)).join('\n');
-  t = t.replace(/\/\*[\s\S]*?\*\//g, ''); // block comments (js + css)
-  // Split on /\r?\n/, NOT '\n' (task 1002428). On a CRLF checkout the old split
-  // left a trailing \r on every line, and since `.` does not match \r the `.*$`
-  // in the line-comment pattern could never reach end-of-string — so NO line
-  // comment was stripped and every rationale comment naming the old brand was
-  // scanned as if it were code. That silently broke this function's whole
-  // contract ("a rationale comment naming the old brand never trips the scan")
-  // on Windows, and made the check disagree with Linux CI on the same tree.
-  if (ext === '.js') t = t.split(/\r?\n/).map((l) => l.replace(/(^|[^:])\/\/.*$/, '$1')).join('\n');
-  return t;
-}
+// Comment stripping lives in identity-strip.js (task 1002756: extracted + replaced
+// the two-regex JS strip, which a `/*` inside a `//` comment could OPEN — it
+// silently hid ~330 provision.js lines from this gate). Re-exported for the tests.
+const { stripCommentsForIdentity } = require('./identity-strip');
 
 // Pure: scan one file's comment-stripped source for a hardcoded host-brand literal.
 // Returns violation strings. Exported for the "actually catches a re-hardcode" test.
@@ -1153,7 +1147,7 @@ function checkKernelPromptsNoHardcodedIdentity() {
     hardFail: violations.length > 0,
     violations,
     warnings: [],
-    note: `${scanned} portable source file(s) scanned (.js/.html/.css/.sh under src/bongos/** + modules/** + scripts/gds/** + kernel-prompt CLIs, minus the instance-1 product + generated dirs) — none may hardcode the host brand; identity comes from branding()/window.__BRANDING__ (ADR 0062 §3/§5). ${ratcheted} scripts/gds file(s) hold documented permanent carve-outs (real DNS zones, real doc filenames, operator runbook text, historical seeded prose) capped at a count they may not exceed — task 1002428.`,
+    note: `${scanned} portable source file(s) scanned (.js/.html/.css/.sh under src/bongos/** + modules/** + scripts/** (whole root, task 1002756), minus the instance-1 product + generated dirs) — none may hardcode the host brand; identity comes from branding()/window.__BRANDING__ (ADR 0062 §3/§5). ${ratcheted} scripts/gds file(s) hold documented permanent carve-outs (real DNS zones, real doc filenames, operator runbook text, historical seeded prose) capped at a count they may not exceed — task 1002428.`,
   };
 }
 
@@ -1798,8 +1792,22 @@ const GOAL_VOCAB_SURFACE = [
 // allowlist longer than the rule; scanning the LINES THAT NAME THE TABLE catches
 // the only thing that can regress here — a membership query reaching for the old
 // column — with no false positives to excuse.
+// task 1003204 (goal 1000079) split that 5k-line file into db.js (a re-export
+// facade) + twelve db-*.js units, so the membership SQL is no longer in db.js at
+// all. Enumerate the family from disk rather than naming one file: a line-scoped
+// scan costs nothing on the units that hold no membership SQL, and a future
+// re-carve cannot silently disarm the rule by moving the queries again.
+const LIFECYCLE_DB_FILES = (() => {
+  const dir = path.join(CORE_ROOT, 'modules', 'lifecycle');
+  try {
+    return fs.readdirSync(dir)
+      .filter((f) => f === 'db.js' || (f.startsWith('db-') && f.endsWith('.js')))
+      .sort()
+      .map((f) => `modules/lifecycle/${f}`);
+  } catch { return ['modules/lifecycle/db.js']; }
+})();
 const GOAL_VOCAB_LINE_SCOPED = [
-  { file: 'modules/lifecycle/db.js', mustMention: /goal_members/ },
+  ...LIFECYCLE_DB_FILES.map((file) => ({ file, mustMention: /goal_members/ })),
   // sso.js is the federation surface: only the lines that name the membership table
   // or its upsert are in scope, so the file's other server-to-server prose stays out.
   { file: 'modules/platform-identity/routes/sso.js', mustMention: /project_memberships|upsertMembership/ },

package/scripts/gds/identity-strip.js

@@ -0,0 +1,75 @@
+'use strict';
+// identity-strip.js — comment stripping for fitness.js Check 13 (the hardcoded-
+// identity gate), extracted in task 1002756. Strips comments so a rationale
+// comment naming the old brand never trips the scan, WITHOUT ever letting a
+// comment marker inside another construct change state.
+//
+// Per extension:
+//   .html — <!-- --> blocks removed.
+//   .sh   — FULL-LINE `#` comments (and the shebang) only: cutting from an inline
+//           `#` would truncate `${v#p}` / `$#` lines and could hide a literal
+//           sitting after them. Shell has no block comments, so no /* */ pass (a
+//           `"$TMP"/*` glob would otherwise eat real code).
+//   .css  — /* */ blocks removed (css has only block comments).
+//   .js   — a single character-level pass (task 1002756). The old two-regex
+//           approach (block strip THEN line strip) could be OPENED by a `/*`
+//           sitting inside a `//` line comment — provision.js's
+//           `// … import <dir>/*.caddy` paired with a real `*/` 330 lines later
+//           and silently deleted everything between from the scanned text,
+//           hiding a genuine hardcoded literal in that window. The scanner
+//           tracks string state (' " ` — literals INSIDE strings are what the
+//           gate exists to catch, so string bodies are PRESERVED), comment
+//           state, and regex-literal state (a `//` or `/*` inside /…/ is not a
+//           comment; regex bodies are preserved). CRLF-safe by construction
+//           (task 1002428): newlines pass through untouched, and block-comment
+//           newlines are kept so reported line numbers hold.
+const KEYWORDS_BEFORE_REGEX = new Set(['return', 'typeof', 'case', 'in', 'of', 'instanceof', 'new', 'delete', 'void', 'do', 'else', 'yield', 'await']);
+
+function stripCommentsForIdentity(text, ext) {
+  const t = String(text == null ? '' : text);
+  if (ext === '.html') return t.replace(/<!--[\s\S]*?-->/g, '');
+  if (ext === '.sh') return t.split(/\r?\n/).map((l) => (/^\s*#/.test(l) ? '' : l)).join('\n');
+  if (ext === '.css') return t.replace(/\/\*[\s\S]*?\*\//g, '');
+  let out = '';
+  const n = t.length;
+  let i = 0;
+  const regexCanFollow = () => {
+    const trimmed = out.replace(/[ \t]+$/, '');
+    if (trimmed === '' || /[\n(,=:[!&|?{};+\-*%~^<>]$/.test(trimmed)) return true;
+    const word = /[A-Za-z_$][\w$]*$/.exec(trimmed);
+    return !!(word && KEYWORDS_BEFORE_REGEX.has(word[0]));
+  };
+  while (i < n) {
+    const c = t[i], d = t[i + 1];
+    if (c === '/' && d === '/') { while (i < n && t[i] !== '\n') i++; continue; } // line comment
+    if (c === '/' && d === '*') { // block comment — keep newlines so line numbers hold
+      i += 2;
+      while (i < n && !(t[i] === '*' && t[i + 1] === '/')) { if (t[i] === '\n') out += '\n'; i++; }
+      i += 2; continue;
+    }
+    if (c === '\'' || c === '"' || c === '`') { // string — body PRESERVED (leaks live here)
+      const q = c; out += c; i++;
+      while (i < n && t[i] !== q) {
+        if (t[i] === '\\') { out += t[i] + (t[i + 1] || ''); i += 2; continue; }
+        out += t[i]; i++;
+      }
+      out += q; i++; continue;
+    }
+    if (c === '/' && regexCanFollow()) { // regex literal — body preserved, markers inert
+      out += '/'; i++;
+      let inClass = false;
+      while (i < n && (inClass || t[i] !== '/') && t[i] !== '\n') {
+        if (t[i] === '\\') { out += t[i] + (t[i + 1] || ''); i += 2; continue; }
+        if (t[i] === '[') inClass = true;
+        else if (t[i] === ']') inClass = false;
+        out += t[i]; i++;
+      }
+      if (t[i] === '/') { out += '/'; i++; }
+      continue;
+    }
+    out += c; i++;
+  }
+  return out;
+}
+
+module.exports = { stripCommentsForIdentity };

package/scripts/gds/provision.js

@@ -158,9 +158,11 @@ const CONFIG = {
   // on the control plane, where the token + the packaging tools live. UNSET
   // (default) = every step runs locally, byte-identical to today.
   remoteHost: process.env.PROVISION_REMOTE_HOST || null,
-  // The co-hosting box's checkout dir — the cwd for the remote migrate (its relative
-  // ./scripts/migrate.sh). Defaults to that box's shared checkout.
-  remoteCwd: process.env.PROVISION_REMOTE_CHECKOUT || '/home/lars/amazonprimea',
+  // The co-hosting box's checkout dir — the remote migrate's cwd. NO baked-in default
+  // (task 1002756: the founder-pinned path was an identity leak, and a silent wrong
+  // cwd aims mutating SSH steps at a dir that may not exist); remote mode requires it
+  // explicitly (guarded at the makeExec call), local mode never reads it.
+  remoteCwd: process.env.PROVISION_REMOTE_CHECKOUT || null,
   // ssh options for the control-plane → co-hosting hop. BatchMode so a missing key
   // fails fast (never hangs on a prompt); accept-new pins the host key on first
   // connect (the operator can pre-seed known_hosts for strict pinning).
@@ -2441,6 +2443,8 @@ async function main() {
   // local) for the box-mutating steps; controlExec is ALWAYS local — the token
   // step (Cloudflare DNS hook) + the standalone repo scaffold run on the control
   // plane where the token + packaging tools live (task 2065, ADR 0130).
+  // Remote mode needs an explicit checkout dir (task 1002756 — no founder default).
+  if (CONFIG.remoteHost && !CONFIG.remoteCwd) { console.error('PROVISION_REMOTE_HOST is set but PROVISION_REMOTE_CHECKOUT is not — name the co-hosting box\'s checkout dir (the old hardcoded default was removed, task 1002756).'); process.exit(2); }
   const exec = makeExec({ apply, remoteHost: CONFIG.remoteHost, remoteCwd: CONFIG.remoteCwd, sshOpts: CONFIG.sshOpts });
   const controlExec = makeExec({ apply });
   const deps = {

package/src/module-api.js

@@ -1059,8 +1059,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.314 with no explicit bump. run 32668969037. (task 1002620)
 //   1.19.316 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.315 with no explicit bump. run 32669347711. (task 1002620)
+//   1.19.317 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.316 with no explicit bump. run 32669571610. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.316'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.317'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auto_satisfy_criteria.mjs

@@ -34,7 +34,7 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
-import { makeRunner } from './helpers.mjs';
+import { makeRunner, lifecycleDbSource } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
@@ -113,7 +113,8 @@ await test('EXEC: every write goes through the caller-supplied exec (so a ship t
 });
 
 await test('EXEC: shipTask passes its transaction CLIENT, and the reconciler passes the pool', () => {
-  const db = readFileSync(new URL('../modules/lifecycle/db.js', import.meta.url), 'utf8');
+  // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+  const db = lifecycleDbSource();
   // db.js is over the fitness oversize threshold, so the hook is ONE line there
   // and its body lives in done-when.closeCompletedWorkForShip. What must hold is
   // that the thing handed in is the txn client, not a pool.

package/tests/dependencies_migration.mjs

@@ -13,7 +13,7 @@ import { strict as assert } from 'node:assert';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
-import { makeRunner } from './helpers.mjs';
+import { makeRunner, lifecycleDbSource } from './helpers.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const repoRoot = join(__dirname, '..');
@@ -22,7 +22,8 @@ const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
 const mig = read('migrations', '163_polymorphic_dependencies.sql');
 const migN = mig.replace(/\s+/g, ' ');
 // the task-dependency CRUD + the claim-gate slice carved to the lifecycle module at BV1.R86.
-const dbSrc = read('modules', 'lifecycle', 'db.js');
+// task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+const dbSrc = lifecycleDbSource();
 
 const { test, summary } = makeRunner();
 

package/tests/fitness.mjs

@@ -542,6 +542,49 @@ test('identity gate skips comments + instance-injected tokens (no false positive
   assert.equal(scanPromptIdentity('x.html', '<title>{{worldName}} — the gate</title>').length, 0, 'a {{worldName}} token carries no literal');
 });
 
+// task 1002756 — the two holes that let migrate.sh's founder DB default survive:
+// (1) the stripper could be OPENED by a `/*` inside a `//` line comment (a real
+// `*/` hundreds of lines later then swallowed everything between — provision.js
+// lost ~330 lines from the scanned text), and (2) whole file classes were never
+// scanned. These lock the stripper; the root widening is pinned by the note test.
+test('identity gate: a /* inside a line comment cannot open a phantom block (task 1002756)', () => {
+  const { scanPromptIdentity } = fitness;
+  const src = [
+    '// glob note: import <dir>/*.caddy',        // the phantom opener shape
+    'const leak = "amazonprimea.example";',      // must STILL be seen
+    'doThing();',
+    '/* a real block */ const ok = 1;',
+  ].join('\n');
+  assert.equal(scanPromptIdentity('x.js', src).length, 1, 'the literal after a /*-bearing line comment must be caught');
+});
+
+test('identity gate: a // inside a block comment does not truncate the block', () => {
+  const { scanPromptIdentity } = fitness;
+  const src = [
+    '/* rationale: see https://amazonprimea.com — historical // note',
+    'still inside the block, amazonprimea again',
+    '*/',
+    'const clean = 1;',
+  ].join('\n');
+  assert.equal(scanPromptIdentity('x.js', src).length, 0, 'comment prose naming the brand must not trip the scan');
+});
+
+test('identity gate: comment markers inside strings and regex literals are inert', () => {
+  const { scanPromptIdentity } = fitness;
+  // A string containing /* must not open a comment that hides a later literal…
+  assert.equal(scanPromptIdentity('x.js', 'const g = "src/*.js";\nconst leak = "amazonprimea";').length, 1);
+  // …a regex containing the brand is code and IS caught (the detectors carve out their own hits)…
+  assert.equal(scanPromptIdentity('x.js', 'const re = /amazonprimea/i;').length, 1);
+  // …and a division sign is not mistaken for a regex opener that swallows code.
+  assert.equal(scanPromptIdentity('x.js', 'const x = a / b / c;\nconst leak = "amazonprimea";').length, 1);
+});
+
+test('identity gate scans the WHOLE scripts/ root, not just scripts/gds (task 1002756)', () => {
+  const r = fitness.checkKernelPromptsNoHardcodedIdentity();
+  assert.match(r.note, /scripts\/\*\* \(whole root/, 'note must document the widened root');
+  assert.equal(r.hardFail, false, 'live tree must be clean under the widened scan:\n' + r.violations.join('\n'));
+});
+
 // --- write-route validation build check (BV1.R12 / task 1999, ADR 0118) ---
 
 test('write-route validation check: the live tree is clean (R11 sweep reached 100%)', () => {

package/tests/goal_abuse_matrix.mjs

@@ -46,7 +46,7 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
-import { makeRunner } from './helpers.mjs';
+import { makeRunner, lifecycleDbSource } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 
@@ -201,7 +201,8 @@ await test('[Q6] non-member on a public PROTECTED-scope goal → action=apply (s
   assert.equal(r.action, 'apply', 'a protected-scope goal is never offered as open-join');
 });
 await test('[Q7] source contract: BOTH INSERT INTO claims sites run the extracted gate (batch cannot bypass)', () => {
-  const dbSrc = readFileSync(new URL('../modules/lifecycle/db.js', import.meta.url), 'utf8');
+  // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+  const dbSrc = lifecycleDbSource();
   const insertSites = dbSrc.match(/INSERT INTO claims \(/g) || [];
   assert.equal(insertSites.length, 2, 'exactly two claim-insert sites (claimTask + claimTasksBatch) — a third needs the gate too');
   const gateCalls = dbSrc.match(/await goalMembershipFailures\(/g) || [];

package/tests/goal_advisory.mjs

@@ -17,7 +17,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
 import http from 'node:http';
-import { makeRunner } from './helpers.mjs';
+import { makeRunner, lifecycleDbSource } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 
@@ -25,7 +25,8 @@ const require = createRequire(import.meta.url);
 const { adviseGoal, candidateGoals, generalGoalTitle, buildGoalAdvisory } = require('../modules/lifecycle/goal-advisory.js');
 
 const tasksSrc = readFileSync(new URL('../modules/lifecycle/routes/tasks.js', import.meta.url), 'utf8');
-const dbSrc = readFileSync(new URL('../modules/lifecycle/db.js', import.meta.url), 'utf8');
+// task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+const dbSrc = lifecycleDbSource();
 const { test, summary } = makeRunner();
 
 const V = 'BONGOS-V1';

package/tests/government_claim_eligibility.mjs

@@ -37,6 +37,7 @@ const LIFECYCLE = path.join(ROOT, 'modules', 'lifecycle');
 const eligibility = require(path.join(LIFECYCLE, 'claim-eligibility.js'));
 const db = require(path.join(LIFECYCLE, 'db.js'));
 const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+import { lifecycleDbSource } from './helpers.mjs';
 
 const { CLAIM_ANY, CLAIM_NEWCOMER, permissionAllowsClaim, claimEligibilityAllows } = eligibility;
 
@@ -147,7 +148,8 @@ test('the permission predicate cannot see requires_rank at all (structural)', ()
 });
 
 test('every claim path in db.js still gates on requires_rank as its own check', () => {
-  const src = fs.readFileSync(path.join(LIFECYCLE, 'db.js'), 'utf8');
+  // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+  const src = lifecycleDbSource();
   // claimTask, claimTasksBatch, validateClaimBatch — three call sites, three
   // separate rankAllowsTask conjuncts. If a refactor ever folds the floor into the
   // permission predicate, this count drops and the test reds.

package/tests/government_rank_sync.mjs

@@ -18,6 +18,7 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { lifecycleDbSource } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -189,8 +190,14 @@ test('the writer runs on the CALLER\'s transaction client when given one', () =>
 });
 
 test('both rank-change twins rotate the role inside their transaction', () => {
-  for (const rel of ['src/bongos/db.js', 'modules/lifecycle/db.js']) {
-    const src = fs.readFileSync(path.join(ROOT, rel), 'utf8');
+  // task 1003204: the lifecycle twin moved out of db.js into db-rank-authz.js
+  // when the monolith was carved up. Read the whole lifecycle family so the
+  // assertion follows the code instead of a filename.
+  const twins = [
+    ['src/bongos/db.js', fs.readFileSync(path.join(ROOT, 'src/bongos/db.js'), 'utf8')],
+    ['modules/lifecycle/db-*.js', lifecycleDbSource()],
+  ];
+  for (const [rel, src] of twins) {
     const body = src.slice(src.indexOf('async function _applyRankChangeTx'));
     const upd = body.indexOf('UPDATE builders SET rank');
     const sync = body.indexOf('await syncGovernanceRankRole(client');

package/tests/helpers.mjs

@@ -123,3 +123,22 @@ export function requireHostModule(require, spec, note) {
     throw err;
   }
 }
+
+// lifecycleDbSource — the LIFECYCLE data layer as one source string.
+//
+// task 1003204 (goal 1000079) split the 5,748-line modules/lifecycle/db.js into
+// db.js (a pure re-export facade) + twelve cohesive db-*.js units. A pile of
+// tests assert things about "the data layer" by regexing its source — that the
+// claim paths gate on requires_rank, that a literal appears in exactly one
+// place, that dependency CRUD points at the right table. Those assertions were
+// always about the LAYER, not about one filename, so they read the whole family
+// here. Reading the family (rather than repointing each test at whichever db-*
+// unit happens to hold the code today) also means a future re-carve moves code
+// between units without silently disarming the assertion.
+export function lifecycleDbSource(modulesDir = path.join(ROOT, 'modules')) {
+  const dir = path.join(modulesDir, 'lifecycle');
+  const files = fs.readdirSync(dir)
+    .filter((f) => f === 'db.js' || (f.startsWith('db-') && f.endsWith('.js')))
+    .sort();
+  return files.map((f) => fs.readFileSync(path.join(dir, f), 'utf8')).join('\n');
+}

package/tests/migration_allocation.mjs

@@ -28,6 +28,7 @@ import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 import { createRequire } from 'node:module';
+import { lifecycleDbSource } from './helpers.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const repoRoot = join(__dirname, '..');
@@ -49,7 +50,8 @@ async function test(name, fn) {
 const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
 const migrationSql = read('migrations', '081_tasks_needs_migration.sql');
 // the tasks db slice + the tasks route carved to modules/lifecycle/ at BV1.R86.
-const dbSrc = read('modules', 'lifecycle', 'db.js');
+// task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+const dbSrc = lifecycleDbSource();
 const routesSrc = read('modules', 'lifecycle', 'routes', 'tasks.js');
 const captureSrc = read('scripts', 'gds', 'capture.js');
 

package/tests/publish_reconciler.mjs

@@ -16,6 +16,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const reconciler = require('../modules/lifecycle/publish-reconciler.js');
+import { lifecycleDbSource } from './helpers.mjs';
 
 let passed = 0;
 let failed = 0;
@@ -1647,7 +1648,8 @@ test('vector 2: shipped_at is stamped ONLY by shipTask, and shipTask requires co
   const url = await import('node:url');
   const path = await import('node:path');
   const ROOT = path.dirname(path.dirname(url.fileURLToPath(import.meta.url)));
-  const dbSrc = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/db.js'), 'utf8');
+  // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+  const dbSrc = lifecycleDbSource();
 
   // Every statement that writes shipped_at, ignoring SELECT projections and comments.
   const writes = [...dbSrc.matchAll(/shipped_at\s*=\s*now\(\)/g)];

package/tests/rank_gate.mjs

@@ -26,6 +26,7 @@ const require = createRequire(import.meta.url);
 const auth = require('../src/bongos/auth.js');
 const db = require('../modules/lifecycle/db.js');
 const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+import { lifecycleDbSource } from './helpers.mjs';
 
 let passed = 0;
 let failed = 0;
@@ -319,7 +320,8 @@ console.log('\nlistClaimableTasks SQL rank-tier CASE (regression: thetes drift):
 
 const __dir = dirname(fileURLToPath(import.meta.url));
 // listClaimableTasks carved to the lifecycle module at BV1.R86 — read the SQL there.
-const dbSrc = readFileSync(join(__dir, '..', 'modules', 'lifecycle', 'db.js'), 'utf8');
+// task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+const dbSrc = lifecycleDbSource();
 
 t('every live rank appears in the claimable CASE at its REQUIRES_RANK_TIER value', () => {
   // Isolate the listClaimableTasks function body so we don't match CASE

package/tests/reward_gate.mjs

@@ -25,6 +25,7 @@ const db = require('../modules/lifecycle/db.js');
 // the SAME singleton object db.js captured, so mutating its .query stubs the INSERT
 // createTask runs — no database needed.
 const sharedPool = require('../src/module-api.js').pool;
+import { lifecycleDbSource } from './helpers.mjs';
 
 const __dir = dirname(fileURLToPath(import.meta.url));
 const root = join(__dir, '..');
@@ -132,7 +133,8 @@ t('null task is a no-op (no throw, no assignment)', () => {
 console.log('\nenforcement points (source-wiring — AUTO-ASSIGN):');
 
 const tasksRouteSrc = readFileSync(join(root, 'modules/lifecycle/routes/tasks.js'), 'utf8');
-const dbSrc = readFileSync(join(root, 'modules/lifecycle/db.js'), 'utf8');
+// task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+const dbSrc = lifecycleDbSource();
 const migration178 = readFileSync(join(root, 'migrations/178_reward_gate_auto_assign_revert_autopromote.sql'), 'utf8');
 
 t('promote route AUTO-ASSIGNS then proceeds (no 409 refusal for missing reward)', () => {