@bongos/core 1.19.319 → 1.19.321

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.319",
-  "core_contract": "1.19.319",
-  "source_commit": "682a79a31b7882310cc854404a34a8743b0e3804",
+  "core_version": "1.19.321",
+  "core_contract": "1.19.321",
+  "source_commit": "242735e2b39608c5500b8c5bd231832a90c5fae7",
   "source_ref": "HEAD",
-  "built_at": "2026-08-23T22:19:11.577Z",
+  "built_at": "2026-08-24T01:17:55.486Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 323,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1438,
+    "functional_verbatim": 1455,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1783,
-  "tree_sha256": "7c253e075a3fb04c94cc2fb0df42550178740faa03e84c8e9c1cb7675be2c23f",
+  "file_count": 1800,
+  "tree_sha256": "5d80f6db5c26850188eb0c3f5ace7c42ff85561d277dc525e24f46cdcf52dee8",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -182,7 +182,7 @@
     {
       "path": ".claude/skills/merge-mode/SKILL.md",
       "mode": "0000644",
-      "sha256": "a1f797a9267428facc357c59b09d8eafd6b6d8ca36e6d6d7ae0c6bf60c11ab58"
+      "sha256": "5d58991170f12c2b32897c8e662fa85ef88207f8c4fd59fc75cafbec235c58fa"
     },
     {
       "path": ".claude/skills/new-project/SKILL.md",
@@ -282,7 +282,7 @@
     {
       "path": ".devcontainer/init-firewall.sh",
       "mode": "0000644",
-      "sha256": "3480f465f10bccdb86f8102fd4c80dff3b7363ff83c34c44c00fe5b1c5cda46e"
+      "sha256": "65dfe7467e1ec1c6f8a32b89cd3207a6bda13f805d77e54384320f83733e0cfa"
     },
     {
       "path": ".devcontainer/post-create.sh",
@@ -357,7 +357,7 @@
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
       "mode": "0000644",
-      "sha256": "f5595ad7ce7c3930fc5e2ae1c41c1d3fb8ae33846388027e023e2274011af08a"
+      "sha256": "80573aa533a5f95b6974f0e87d50f0d4f08395565e2027e9ea239caec7c4862e"
     },
     {
       "path": "clients/bongos-client/index.cjs",
@@ -1447,12 +1447,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "a5b27853df9525f4690cf32059ecd843c4a1a2a4b6b6126f648df036ecbd50c1"
+      "sha256": "265f46593fe663dc38aa7980b0eacde8e6ab001b75301c5d0e38f1c1887d0e11"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "7ffb442359c38c1fb57e363dd4309ae59adc597598e2ea79745267276bf68736"
+      "sha256": "e2e2af87ad6c8023e6b7399caac2372f08a87f41239873e83dbff39ac2fe1855"
     },
     {
       "path": "docs/design-contract.md",
@@ -2827,7 +2827,7 @@
     {
       "path": "modules/dev-box/box-access.js",
       "mode": "0000644",
-      "sha256": "870976966de7c48be4172390dc8e4f7d2eb6ac53e20dfb3fd5d40b08cfcd7850"
+      "sha256": "a51e16aba67547c0692d9422587f83d8ce40f0e45830463b80bfd188401eb6c0"
     },
     {
       "path": "modules/dev-box/box-credential.js",
@@ -3312,7 +3312,7 @@
     {
       "path": "modules/hall-ui/public/builders.js",
       "mode": "0000644",
-      "sha256": "076103658308541ef6b976bc333c67a2dc0069913fadbd5551c6241cc320bda4"
+      "sha256": "779e604e91dc4a057ac4db81f2215f7f26c7ec5eac65aae1680c0014bad05851"
     },
     {
       "path": "modules/hall-ui/public/chime.wav",
@@ -4642,12 +4642,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cb1d669bd4b49b50fc37854b48c9363f3b6a7bccf503cd3a1291dfa87ac072ac"
+      "sha256": "6f62185348f89cc7ae1c8998a25d4bdccb2e204ad81581555686f37057db1511"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ca4620fbb1129ae165e0f7bfb9f4bc6d837c027a2d7326eec6d9418718bbf03c"
+      "sha256": "3ba87e851af1bf1ad2a08cb62d4c875be12d7ec6d86ffda9e5b26e24fee313ae"
     },
     {
       "path": "public-docs/index.html",
@@ -5032,7 +5032,7 @@
     {
       "path": "scripts/gds/audit-replay.sh",
       "mode": "0000644",
-      "sha256": "8a4ef9dad703de16c367df07e16391b0180539c258f926ccb18d80a9a8c59a81"
+      "sha256": "ce9ff07ca0fc8807a97de74780569d43f02ba492351773451c72b8f4c883de8e"
     },
     {
       "path": "scripts/gds/audit-ships.js",
@@ -5087,7 +5087,7 @@
     {
       "path": "scripts/gds/box.js",
       "mode": "0000644",
-      "sha256": "c8a79e6541a2e26e590bd8ee1bbf31cb0f7300c53dbd30c241f4c1f04a2af7bf"
+      "sha256": "c1146f6fd4bb2b27e912a5ae50f3f597abbce26ae109366daad4fd828dc1e243"
     },
     {
       "path": "scripts/gds/build-bongos.js",
@@ -5197,12 +5197,12 @@
     {
       "path": "scripts/gds/db-backup-nightly.sh",
       "mode": "0000644",
-      "sha256": "2afaef8ff953b32f3db2ddf3203d8952937c377d811117c4cb7da3b5b8de5911"
+      "sha256": "0a4b3490ad5d4724c693053b16af61f6632e4933d18bedbdc5737a84111f03ae"
     },
     {
       "path": "scripts/gds/db-backup-offsite.sh",
       "mode": "0000644",
-      "sha256": "2957e4720e4a8de53d31d2c193b64743b3f0fee9d8e0caddc4f9c4a2ded2b857"
+      "sha256": "f455e4a6fdd69f0105104752c86099e3a17dad7b4802fa715191cedab9762cd2"
     },
     {
       "path": "scripts/gds/demote.js",
@@ -5242,7 +5242,7 @@
     {
       "path": "scripts/gds/discipline-modes.json",
       "mode": "0000644",
-      "sha256": "9006f87739fe8708cc75bccec381a80a41dd4c354ba1b626f722b2c8ccdf369e"
+      "sha256": "ae93a1068fa02259bc68372ce374e00db99df048730e3b3734619ec7f20da2dc"
     },
     {
       "path": "scripts/gds/discord-channels.js",
@@ -5257,7 +5257,7 @@
     {
       "path": "scripts/gds/doc-cli-guard.js",
       "mode": "0000644",
-      "sha256": "e7feb497a7b568273d1a2c16c2a65036c60017d163d792d05d3c43addcfd7d8f"
+      "sha256": "6f157f0b3a5618bcc2372b6d3a2805ff212013b421720470b443da35aa72cf26"
     },
     {
       "path": "scripts/gds/docs-entropy.js",
@@ -5292,12 +5292,12 @@
     {
       "path": "scripts/gds/fitness-ratchets.js",
       "mode": "0000644",
-      "sha256": "a27a3873f516abdc52f7f482603779010bbc1af4d6e73c0b86dd34292017bc9a"
+      "sha256": "3f32080357abdecb0f0860c5c9313f12283f01774c8367ac22c1c12d0d176411"
     },
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "fc4af6845de5bf3775629d492bb793f96cf707dfd9837e338cb2344250f733b5"
+      "sha256": "2de9f3b0e2c488ac1170aa90eab53c850b37c332676e36c4c8f214b219019352"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5312,22 +5312,22 @@
     {
       "path": "scripts/gds/gds-db-backup.service",
       "mode": "0000644",
-      "sha256": "517ccbb96ac54d0492402c56133675a167fce9af47866442031f79adba77fe0b"
+      "sha256": "211b85d1663beaf4174ecde2f157816e28144f34c0bede467a13917754044039"
     },
     {
       "path": "scripts/gds/gds-db-backup.timer",
       "mode": "0000644",
-      "sha256": "1bb011177ddf312f8c80e170748ae82c65ebc869c77713cea9a72ebdf777ab1a"
+      "sha256": "78885667bc92135c40b5830341650bdef55ff757e57be58ddc274717cf03f8ad"
     },
     {
       "path": "scripts/gds/gds-db-offsite.service",
       "mode": "0000644",
-      "sha256": "3482659a13ed7673f49beedb1265a58759ed8d8e27eb98befc67775bbbf9a51b"
+      "sha256": "6b94054101083d1cc6fcd425fb907aa1212da0f60857bce395d25eb490d14702"
     },
     {
       "path": "scripts/gds/gds-db-offsite.timer",
       "mode": "0000644",
-      "sha256": "74a54d8a7f8b673fa8a33c6399690aa390e432fddcd75f27945cf41df27cafd8"
+      "sha256": "26a3dcc15c98128229df015292b8f9e9d3a41152c8803555f858fa4bb6a26d53"
     },
     {
       "path": "scripts/gds/gen-api-client.js",
@@ -5414,6 +5414,11 @@
       "mode": "0000644",
       "sha256": "668d97543e863394527bad2a629037bfc81eea2f8244f53eb5e79fd43f7485c0"
     },
+    {
+      "path": "scripts/gds/instance-apex.js",
+      "mode": "0000644",
+      "sha256": "fcb59a4eda007d98179dfe54956fcce4ff07c11ca941ed6dea41b38c0daca421"
+    },
     {
       "path": "scripts/gds/key-card.js",
       "mode": "0000644",
@@ -5527,7 +5532,7 @@
     {
       "path": "scripts/gds/newcomer-floor.templates.json",
       "mode": "0000644",
-      "sha256": "71aea42030aaba504d29841b67de74e2c7c58d62d3a2cfc90996734e35c4236b"
+      "sha256": "5049d67431a8d3d4b336f4d849068db47a52687755312e26192a8ce61edc039d"
     },
     {
       "path": "scripts/gds/newcomer-floor.test.js",
@@ -5597,7 +5602,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "b445702caa082164d8b733a44be2407f3e3889f28838dfd38222a6a0eb5ec672"
+      "sha256": "1d6b8330d3a9e9ae563c1cadc7416ab8d33ce80f3ba0e21b10c5634b508a7670"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -5864,15 +5869,95 @@
       "mode": "0000644",
       "sha256": "087def1396283b19cb8a6deea4cc7f362d7a2f164d496a587220f0a48568aae6"
     },
+    {
+      "path": "scripts/gds/ship-deploy-target.js",
+      "mode": "0000644",
+      "sha256": "61c24ea220b7bc2bc36d6b30fd660e7c00c22d7a58150b390a9fe36aea1591b7"
+    },
+    {
+      "path": "scripts/gds/ship-finish.js",
+      "mode": "0000644",
+      "sha256": "c21571c599889317e9023b8486c2d9969087af30a5394a834e16df45e4fea531"
+    },
+    {
+      "path": "scripts/gds/ship-flow.js",
+      "mode": "0000644",
+      "sha256": "efad88d4ead86356f27650b81c5ee28362bc94695dede92958e5398e9e71748c"
+    },
+    {
+      "path": "scripts/gds/ship-git.js",
+      "mode": "0000644",
+      "sha256": "dd635e743229912e2c574003f2b94c47283b03f06d6efbb1cd1355efa2ce76bd"
+    },
+    {
+      "path": "scripts/gds/ship-grade-steps.js",
+      "mode": "0000644",
+      "sha256": "52dc5ae1aca08033d2d217694273d8fed1597c0329491118ffa48ccdadc0a3ca"
+    },
+    {
+      "path": "scripts/gds/ship-grade.js",
+      "mode": "0000644",
+      "sha256": "51b9132fc77f5f639a4597b26a6a5d083bf43c56944bf6710c939cafa074ba90"
+    },
     {
       "path": "scripts/gds/ship-honesty.js",
       "mode": "0000644",
       "sha256": "32827178a46cc01c36c422e1adef433be99492e8444a8affbe51e5e8c1e8ce9f"
     },
+    {
+      "path": "scripts/gds/ship-io.js",
+      "mode": "0000644",
+      "sha256": "dc863484634845b84913532db0606a64006f6a506b97b94ea131dfdc1c1ed245"
+    },
+    {
+      "path": "scripts/gds/ship-land.js",
+      "mode": "0000644",
+      "sha256": "c3224ab05621b1e1e523b926c7a3d0e09b36c7de3fc6d984ee6c588dfcdd1e38"
+    },
+    {
+      "path": "scripts/gds/ship-memory-sync.js",
+      "mode": "0000644",
+      "sha256": "3eb7d979b1d1706b532cd93e272e254e166bdc27d18101e0d4b7b1a0f7b51346"
+    },
+    {
+      "path": "scripts/gds/ship-merge.js",
+      "mode": "0000644",
+      "sha256": "7c5751c146bcddc9cbf88c6177925e049413d0d275ddb174d5d92b38e75ecab8"
+    },
+    {
+      "path": "scripts/gds/ship-preflight-steps.js",
+      "mode": "0000644",
+      "sha256": "6b6e7afdcc66c44e191c43b566e36af7f0519f5dbeb751c8ff9b3285a637603a"
+    },
+    {
+      "path": "scripts/gds/ship-regen.js",
+      "mode": "0000644",
+      "sha256": "32599b3ae9c5f32dc82250dba824f9acea98ae1a4ac8b0d5d0e61870186921f6"
+    },
+    {
+      "path": "scripts/gds/ship-resume.js",
+      "mode": "0000644",
+      "sha256": "4d56098b0b7df003e7efece23b8d1bca55dd272774117cd75074a1c7609939ec"
+    },
+    {
+      "path": "scripts/gds/ship-session-upload.js",
+      "mode": "0000644",
+      "sha256": "f340c466aa2eb2b7e79fb8626f687de3f85f3631a103e36f0ca91a27787efb7f"
+    },
+    {
+      "path": "scripts/gds/ship-state.js",
+      "mode": "0000644",
+      "sha256": "a22377162ea9449249ee338e434c2b595a4de88743e6dacc290138f0ea9799dc"
+    },
+    {
+      "path": "scripts/gds/ship-surprise.js",
+      "mode": "0000644",
+      "sha256": "ff7e9d74c4349a3c5bb41df121165f4868fd78913211872c4b055a7282463144"
+    },
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "8f2c0ca63abae081cccfa96059ae07b008bd108f85866a248075cb4a1b7e025e"
+      "sha256": "342dd41ae45a1c7babd30b0ec136706034e4873a43bb6779a7df428bcceffb33"
     },
     {
       "path": "scripts/gds/skill-preflight.js",
@@ -6047,7 +6132,7 @@
     {
       "path": "scripts/status-probe.mjs",
       "mode": "0000644",
-      "sha256": "65a888b9834aaef34f844a0cf4c142a645b90c63d94e7a00d6de19d4d0153c7e"
+      "sha256": "c3681a59b442751e44e9b070d757fb20df381c6cc3df093d659a02854d1bbdc8"
     },
     {
       "path": "src/asset-version.js",
@@ -6332,7 +6417,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c918c65478a9b35e7a10371f117e8a826c063f577331147740f9fa8ffa121161"
+      "sha256": "31c5e453080859713ed00c327a6b1fb1a022d2509438523979bad2e0e8feb7bf"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6647,7 +6732,7 @@
     {
       "path": "tests/box_access.mjs",
       "mode": "0000644",
-      "sha256": "1e4db680c5925e473fff9ad6247e797bd9089fdf3696c3ffb161903bda41dcda"
+      "sha256": "fcad6c578c2d8698d6ad93fe04f500734d589013590f006910f1bc33fc908642"
     },
     {
       "path": "tests/box_auth_check.mjs",
@@ -7187,7 +7272,7 @@
     {
       "path": "tests/fitness_ratchets.mjs",
       "mode": "0000644",
-      "sha256": "781bdee0778645704b5179bf99507e839743158714f799e45d6cc64f8fc30477"
+      "sha256": "e33edfa4925694d824c042f1fd06a977f1ac14b5c1cb24b5326014ca9f86ece0"
     },
     {
       "path": "tests/fitness_two_root.mjs",
@@ -7602,7 +7687,7 @@
     {
       "path": "tests/helpers.mjs",
       "mode": "0000644",
-      "sha256": "7a306648d5fd083313126ce98d364e19d130313edf7d37dd23e3767c7e527c8f"
+      "sha256": "3c1066d26925b277bee1cab8b04f8c467296a6fa0c2a1861761f10da89798fb2"
     },
     {
       "path": "tests/hierarchy-config.mjs",
@@ -8212,7 +8297,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "a0e47992e3e5b3158a8949b695fd6306aa01f39a51776fbfc2c5a0d47b881951"
+      "sha256": "304f8d9243512672a706a1e073a4874aec2e24a43cfbed550967db1fd23a16dc"
     },
     {
       "path": "tests/provisioning_default_domain.mjs",
@@ -8342,7 +8427,7 @@
     {
       "path": "tests/regrade_eligibility.mjs",
       "mode": "0000644",
-      "sha256": "f72bacf8fc2bf0d1209dfb3d9b619a364386c2eacea87352ac0f7cdb3f769a56"
+      "sha256": "a7a0a61260a4ee78f5452b76ee6d8ef732104cf9c32a3c05bfa25517bf883aeb"
     },
     {
       "path": "tests/render_prefs.mjs",
@@ -8577,7 +8662,7 @@
     {
       "path": "tests/ship_assurance.mjs",
       "mode": "0000644",
-      "sha256": "6fc882d215ce78f968b25477db8596ea70a28765fd222b8a9ffca331e7f2827c"
+      "sha256": "7257c4041ba48300172bbacbed4b0727ebd222e3626c7e871d845c048646dc12"
     },
     {
       "path": "tests/ship_autolinkify.mjs",
@@ -8652,7 +8737,7 @@
     {
       "path": "tests/ship_publish_error.mjs",
       "mode": "0000644",
-      "sha256": "eb8c52362355479a50c83ba84968d605b93f98e93513cf8436dd096e6514f6e8"
+      "sha256": "b6ca6ac4802b035c02be382a8aa7f63f5381b02524343d5fe002336c1aadc512"
     },
     {
       "path": "tests/ship_resume.mjs",

package/.claude/skills/merge-mode/SKILL.md

@@ -117,7 +117,9 @@ This mirrors what `ship.js` does automatically; it's here because /merge-mode de
 
 **Step 5 — smoke tests, push, deploy.**
 
-> **Deploy mode (#679 / [ADR 0042](../../../docs/adr/<redacted>.md)).** `config/deploy.json` is now `mode: ci` (CI cutover landed 2026-06-13), so the **`ci`** path is current: there is no laptop merge and no SSH at all — landing happens via PR auto-merge and [`.github/workflows/deploy-prod.yml`](../../../.github/workflows/deploy-prod.yml) deploys `main`→prod from Actions. In `ci` mode, do NOT run the `git push origin main` + `ssh … ~/deploy.sh` lines below — instead confirm the PR auto-merged and the `deploy-prod` Actions run went green. The block below is the **legacy `laptop`** deploy mode (the operator's machine pushes `main` and SSHes the droplet) — it is the fallback path and only applies if `config/deploy.json` is reverted to `mode: laptop`. Check the active mode with `node -e "const s=require('./scripts/gds/ship.js'),fs=require('fs');let c=null;try{c=fs.readFileSync('config/deploy.json','utf8')}catch{}console.log(s.parseDeployMode(process.env.OTB_DEPLOY_MODE,c))"`.
+> **Deploy mode (#679 / [ADR 0042](../../../docs/adr/<redacted>.md)).** `config/deploy.json` is now `mode: ci` (CI cutover landed 2026-06-13), so the **`ci`** path is current: there is no laptop merge and no SSH at all — landing happens via PR auto-merge and [`.github/workflows/deploy-prod.yml`](../../../.github/workflows/deploy-prod.yml) deploys `main`→prod from Actions. In `ci` mode, do NOT run the `git push origin main` + `ssh … ~/deploy.sh` lines below — instead confirm the PR auto-merged and the `deploy-prod` Actions run went green. The block below is the **legacy `laptop`** deploy mode (the operator's machine pushes `main` and SSHes the droplet) — it is the fallback path and only applies if `config/deploy.json` is reverted to `mode: laptop`. Check the active mode with `node scripts/gds/ship.js --print-deploy-mode`.
+
+> **Do NOT probe `parseDeployMode` directly (task 1003221).** It reads only the env var and `config/deploy.json`, and **defaults to `laptop`** when neither is present — and `config/` is not in the dev-box sparse checkout (`BASE_SPARSE_PATHS`, ADR 0148), so on a box that probe answers `laptop` every time. It sent a builder down the laptop merge path — local merge, `push-main.js`, SSH deploy — on a machine with none of those credentials (2026-08-21, 163 minutes). `effectiveDeployMode` is the credential-aware answer and reroutes to `ci` when the machine cannot push locally; the flag above prints that one.
 
 ```bash
 node scripts/gds/smoke-gds.js    # 16/16 expected (cross-platform; replaces smoke-gds.sh)

package/.devcontainer/init-firewall.sh

@@ -18,7 +18,9 @@
 #   - GitHub  (api.github.com/meta ranges) ......... git push/pull, `gh`
 #   - npm registry (registry.npmjs.org) ............ `npm ci`
 #   - Anthropic API (api.anthropic.com + telemetry)  the brain (tokens), Claude Code
-#   - amazonprimea.com + staging ................... the GDS API (/api/gds/* CLI)   [OTB]
+#   - THIS instance's own API host(s) .............. the GDS API (/api/gds/* CLI)
+#     (resolved from config/branding.json at runtime — task 1002757; a hardcoded
+#      founder host allow-listed someone else's server and BLOCKED the builder's own)
 #   - generativelanguage.googleapis.com ............ the pixel-art pipeline (Gemini) [OTB]
 #   - pypi.org + files.pythonhosted.org ............ `pip install` art deps          [OTB]
 #
@@ -45,13 +47,42 @@ ALLOWED_HOSTS=(
   "api.anthropic.com"
   "statsig.anthropic.com"
   "sentry.io"
-  "amazonprimea.com"
-  "staging.amazonprimea.com"
   "generativelanguage.googleapis.com"
   "pypi.org"
   "files.pythonhosted.org"
+  # THIS instance's own hosts are appended below from its branding pack.
 )
 
+# Append the instance's OWN API hosts, read from config/branding.json at runtime
+# (task 1002757). Was two hardcoded founder hosts, which allow-listed someone
+# else's server and left the builder's own GDS API blocked — the devcontainer
+# then failed every /builder-* call for a reason nothing in the log explained.
+# GDS_ALLOW_HOSTS (space/comma separated) overrides for a non-standard setup.
+REPO_ROOT_FW="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+INSTANCE_HOSTS="${GDS_ALLOW_HOSTS:-}"
+if [ -z "$INSTANCE_HOSTS" ]; then
+  INSTANCE_HOSTS="$(node -e '
+    const d = (require(process.argv[1]).branding().domains) || {};
+    const hosts = new Set();
+    // Only *_ORIGIN-shaped values yield a host, and only a real public FQDN
+    // counts: the neutral starter pack carries localhost:3000 and bare subdomain
+    // PREFIXES ("sandbox-", "term-"), none of which is an allow-listable host.
+    for (const v of Object.values(d)) {
+      if (typeof v !== "string" || !v.trim()) continue;
+      let host = null;
+      try { host = new URL(v).hostname; } catch { host = v.trim(); }
+      if (!host) continue;
+      if (!/^(?=.{1,253}$)[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i.test(host)) continue;
+      if (/^localhost$/i.test(host)) continue;
+      hosts.add(host.toLowerCase());
+    }
+    process.stdout.write([...hosts].join(" "));
+  ' "$REPO_ROOT_FW/src/branding" 2>/dev/null || true)"
+fi
+for h in ${INSTANCE_HOSTS//,/ }; do
+  [ -n "$h" ] && ALLOWED_HOSTS+=("$h")
+done
+
 log()  { echo "[firewall] $*"; }
 die() {
   # Honor the documented escape hatch: a cap/permission failure on a laptop
@@ -189,8 +220,13 @@ log "  ✓ allow-listed host (api.github.com) is reachable"
 
 # Our own GDS API must be reachable (the CLI depends on it). Non-fatal warn:
 # the host may be mid-deploy; the firewall correctness is already proven above.
-if curl -fsS --max-time 10 https://amazonprimea.com/healthz 2>/dev/null | grep -q '^ok$'; then
-  log "  ✓ GDS API (amazonprimea.com) is reachable"
+# The instance's OWN first API host (task 1002757 — was a founder literal, so this
+# probe reported a stranger's health as the container's connectivity).
+GDS_PROBE_HOST="$(printf '%s\n' ${INSTANCE_HOSTS//,/ } | head -n 1)"
+if [ -z "$GDS_PROBE_HOST" ]; then
+  log "  · no instance API host resolved from the branding pack — skipping the GDS reachability probe"
+elif curl -fsS --max-time 10 "https://$GDS_PROBE_HOST/healthz" 2>/dev/null | grep -q '^ok$'; then
+  log "  ✓ GDS API ($GDS_PROBE_HOST) is reachable"
 else
   log "  ! GDS API healthz did not return ok (host may be redeploying) — allow rule is in place"
 fi

package/clients/bongos-client/examples/hello-world.mjs

@@ -21,8 +21,17 @@
 
 import { createClient, ApiError, API_VERSION } from '../index.mjs';
 
-// baseUrl defaults to this instance's public v1 surface; override for a self-host.
-const baseUrl = process.env.BONGOS_BASE_URL || 'https://amazonprimea.com/api/bongos/v1';
+// Point this at YOUR instance: set BONGOS_BASE_URL to its public v1 surface,
+// e.g. https://your-instance.example.com/api/bongos/v1. There is deliberately no
+// default (task 1002757): this example ships in the published npm client, and a
+// baked-in host meant every consumer's copy-paste starting point called someone
+// else's server.
+const baseUrl = process.env.BONGOS_BASE_URL;
+if (!baseUrl) {
+  console.error('Set BONGOS_BASE_URL to your instance\'s API base, e.g.:');
+  console.error('  BONGOS_BASE_URL=https://your-instance.example.com/api/bongos/v1 node examples/hello-world.mjs');
+  process.exit(2);
+}
 const token = process.env.BONGOS_TOKEN; // optional — only needed for the /me call
 
 const api = createClient({ baseUrl, token });