@bongos/core 1.19.331 → 1.19.333

package/scripts/gds/box.js

@@ -58,92 +58,7 @@ const BOX_INFRA_TEMPLATE = 'builder-box-cloud-init.yaml';
 // Ordered candidate infra/ dirs — first that actually holds the cloud-init
 // template wins. Pure (env + repoRoot injected) so it is unit-testable without
 // touching the real filesystem layout.
-function boxInfraCandidates({ env = process.env, repoRoot = REPO_ROOT } = {}) {
-  const out = [];
-  const seen = new Set();
-  const add = (d) => { if (d && !seen.has(d)) { seen.add(d); out.push(d); } };
-  // 1. explicit override: <PREFIX>_BOX_INFRA_DIR (operator escape hatch).
-  const override = instanceConfig.resolveEnv('BOX_INFRA_DIR', { env });
-  if (override) add(path.resolve(override));
-  // 2. the instance root via an EXPLICIT pointer (<PREFIX>_INSTANCE_ROOT env or a
-  //    bongos.config.json {"instanceRoot":"."}) — where a vendored instance keeps infra/.
-  const inst = instanceConfig.resolveInstanceRootExplicit({ env });
-  if (inst) add(path.join(inst, 'infra'));
-  // 3. REPO_ROOT/infra — the dev single-checkout (and the ADR 0144 node_modules workaround).
-  add(path.join(repoRoot, 'infra'));
-  // 4. walk up out of node_modules from the core root, so a vendored
-  //    …/node_modules/@bongos/core still finds its host instance's infra/ with no pointer set.
-  let dir = repoRoot;
-  for (let i = 0; i < 6; i += 1) {
-    const parent = path.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-    add(path.join(dir, 'infra'));
-  }
-  return out;
-}
-
-// The resolved infra/ dir (first candidate holding the template), or null when the
-// box cloud-init cannot be located anywhere — the caller MUST fail loud on null
-// rather than provision a box with empty user-data (ADR 0150).
-function resolveBoxInfraDir(opts = {}) {
-  for (const c of boxInfraCandidates(opts)) {
-    try { if (fs.existsSync(path.join(c, BOX_INFRA_TEMPLATE))) return c; }
-    catch { /* unreadable candidate → try the next */ }
-  }
-  return null;
-}
-
-// task 1002757 — the instance's own apex; null when unconfigured (callers refuse).
-const { instanceApex } = require('./instance-apex');
-
-const CONFIG = {
-  floor: process.env.BOX_PROVISION_MIN_RANK || 'xenos',
-  region: process.env.BOX_REGION || 'nyc3',
-  size: process.env.BOX_SIZE || 's-2vcpu-4gb',
-  baseImage: process.env.BOX_BASE_IMAGE || 'ubuntu-24-04-x64',
-  idleMinutes: numEnv('BOX_IDLE_MINUTES', 10),
-  dormantDays: numEnv('BOX_DORMANT_DAYS', 14),
-  // task 1002727 — how many days BEFORE the reclaim a builder gets warned.
-  dormantWarnLeadDays: numEnv('BOX_DORMANT_WARN_LEAD_DAYS', 3),
-  sshKeyIds: (process.env.BOX_SSH_KEY_IDS || '').split(',').map((s) => s.trim()).filter(Boolean),
-  dnsHook: process.env.BOX_DNS_HOOK || null,
-  tag: process.env.BOX_TAG || 'otb-builder-box',
-  // task 1002757 settled this file's old carve-out: an operator-plane DNS zone is
-  // still a FUNCTIONAL DEFAULT, and a founder literal aimed another operator's
-  // fleet at the founder's zone. Derived from the instance apex, null when
-  // unconfigured — hostnameFor() then refuses instead of minting a dead FQDN.
-  dnsZone: process.env.BOX_DNS_ZONE || (instanceApex() ? `dev.${instanceApex()}` : null),
-};
-
-// Named-tunnel automation for the browser terminal (#771, ADR 0038 Part B).
-// OPT-IN, default OFF — an unset BOX_NAMED_TUNNEL leaves the box on the tokenless
-// quick tunnel (trycloudflare.com), the zero-secret #760 default. When the operator
-// turns it on AND supplies a Cloudflare token with Tunnel + DNS scope (the same
-// CLOUDFLARE_API_TOKEN box-dns uses) + the account id, every provision creates a
-// stable term-<login>.<terminalZone> tunnel and bakes its connector token into the
-// box; deprovision tears it down.
-const CF = {
-  enabled: /^(1|true|yes)$/i.test(process.env.BOX_NAMED_TUNNEL || ''),
-  apiToken: process.env.CLOUDFLARE_API_TOKEN || null,
-  accountId: process.env.CLOUDFLARE_ACCOUNT_ID || null,
-  // The Cloudflare ZONE the record lives in (the registrable apex) — the terminal
-  // host is a record WITHIN it, matching box-dns-cloudflare.sh. Distinct from
-  // terminalZone (the host suffix). Both resolve from the instance (task 1002757).
-  zone: process.env.CLOUDFLARE_ZONE || instanceApex(),
-  // Host suffix for term-<login>.<terminalZone>. DEFAULTS TO THE APEX, NOT dev.*:
-  // the terminal rides a PROXIED tunnel, and free Universal SSL covers <apex> +
-  // *.<apex> (ONE label) but not a TWO-label host like term-x.dev.<apex>, which
-  // fails TLS at the edge (verified live, #771). An operator holding an Advanced
-  // Certificate for *.dev.<apex> can override via BOX_TERMINAL_ZONE. (The SSH
-  // A-record path stays on dev.* — proxied=false, so it needs no edge cert.)
-  terminalZone: process.env.BOX_TERMINAL_ZONE || instanceApex(),
-};
-
-// Named-tunnel automation is live only when the operator opted in AND the
-// credentials are present. Missing creds while enabled is a loud config error at
-// provision time (see cmdProvision), not a silent fall-back, so an operator who
-// meant to use named tunnels learns immediately.
+const { CF, CONFIG, boxInfraCandidates, dropletName, hasFlag, hostnameFor, numEnv, readCloudInit, resolveBoxInfraDir, runDnsHook, runDnsHookBlackhole, shortStamp } = require('./box-infra.js');
 function namedTunnelEnabled() { return CF.enabled; }
 function namedTunnelConfigured() { return CF.enabled && CF.apiToken && CF.accountId; }
 
@@ -194,20 +109,6 @@ async function preflightCookieStripScope() {
   return scope;
 }
 
-function numEnv(name, dflt) {
-  const v = process.env[name];
-  if (v == null || v === '') return dflt;
-  const n = Number(v);
-  return Number.isFinite(n) && n > 0 ? n : dflt;
-}
-
-function hasFlag(args, name) { return args.includes(name); }
-
-// Lazy + memoized DB + lib load so `--help` and arg errors don't require Postgres
-// (this CLI runs on a non-droplet machine for dry-run planning of pure logic too):
-// nothing is require()d until the first makeDo/makeCf/IIFE call, and repeat calls
-// reuse the first resolution instead of re-running the six requires.
-let _deps;
 function loadDeps() {
   if (_deps) return _deps;
   // eslint-disable-next-line global-require
@@ -274,151 +175,6 @@ async function resolveBuilder(pool, ref) {
 }
 
 // A short, DNS-safe-ish suffix from the current time (CLI context — Date is fine).
-function shortStamp() {
-  return new Date().toISOString().replace(/[-:T.Z]/g, '').slice(2, 14);
-}
-
-function dropletName(login) { return `otb-box-${login}`; }
-// Refuses on an unresolved zone (task 1002757) — `box-x.undefined` would mint a
-// DNS record and a box that can never be reached.
-function hostnameFor(login) {
-  if (!CONFIG.dnsZone) throw new Error('box: no DNS zone configured — set BOX_DNS_ZONE, or give this instance a domains.publicOrigin in config/branding.json (task 1002757).');
-  return `box-${login}.${CONFIG.dnsZone}`;
-}
-
-// Run the optional DNS hook so the per-builder hostname tracks the new IP; with no
-// hook configured, print the reminder — the stable-hostname CUTOVER is #599's, #598
-// only records IP + hostname and offers the hook so an operator can wire DNS without
-// editing this file. → { ok, error?, skipped? }. task 1180: callers MUST act on
-// ok:false (box_events row + flag the box), never continue silently — that swallow
-// left @kingaonline's A record pinned at a dead IP while provision reported success.
-// The hook retries transient Cloudflare blips, so ok:false is a real, exhausted
-// failure. `hook` is injectable so the contract is unit-testable (#1034).
-function runDnsHook(hostname, ip, hook = CONFIG.dnsHook) {
-  if (!ip) return { ok: true, skipped: true };
-  if (!hook) {
-    console.log(`  ↳ DNS: point ${hostname} → ${ip} (no BOX_DNS_HOOK set; #599 owns the cutover)`);
-    return { ok: true, skipped: true };
-  }
-  try {
-    execFileSync('bash', ['-c', hook], {
-      cwd: REPO_ROOT, stdio: 'pipe',
-      env: { ...process.env, BOX_HOSTNAME: hostname, BOX_IP: ip },
-    });
-    console.log(`  ↳ DNS hook updated ${hostname} → ${ip}`);
-    return { ok: true };
-  } catch (e) {
-    const msg = (e.stderr && e.stderr.toString().trim()) || e.message;
-    console.log(`  ⚠ DNS hook failed: ${msg} (point ${hostname} → ${ip} manually)`);
-    return { ok: false, error: msg };
-  }
-}
-
-// Blackhole sentinel for a torn-down box's A record (idea 309). 192.0.2.1 is in
-// TEST-NET-1 (RFC 5737) — reserved for documentation and GUARANTEED never to be a
-// routable host, so no recycled DigitalOcean IP can ever land here. A perfect
-// dead end to park a record at.
-const DNS_BLACKHOLE_IP = '192.0.2.1';
-
-// Park the per-builder A record at the blackhole sentinel on deprovision (idea 309,
-// refining task 1180). 1180 DELETED the record so it couldn't dangle at a recycled
-// DO IP, but delete-then-recreate across a reap→rebuild left an NXDOMAIN window that
-// resolvers negative-cache for the zone's SOA neg-TTL (~30 min, not builder-editable)
-// — a client querying then kept getting ENOTFOUND long after the box was back.
-// REPOINTING to a non-routable sentinel keeps the name always-resolving (nothing to
-// negative-cache) while preserving 1180's guarantee that a torn-down box's name can
-// never dial a stranger's recycled IP; the next provision/wake PUTs the live IP
-// in-place at the 60s TTL, no gap. Best-effort like the prior delete. Reuses
-// runDnsHook's UPSERT path; `hook` injectable for tests. → { ok, error?, skipped? }
-function runDnsHookBlackhole(hostname, hook = CONFIG.dnsHook) {
-  if (!hook || !hostname) return { ok: true, skipped: true };
-  return runDnsHook(hostname, DNS_BLACKHOLE_IP, hook);
-}
-
-// Read the cloud-init template and substitute the repo URL from BOX_REPO_URL
-// (kept out of the repo file so no GitHub identity is hardcoded — V3.R12 rule).
-// An unset URL leaves the placeholder; the cloud-init then logs guidance rather
-// than cloning, and #600 wires the scoped credential.
-// Read + render the cloud-init. `authorizedKeysBlock` is the otb-managed block
-// for the builder being provisioned (#685) — base64'd here and baked in so the
-// FIRST SSH login works before the box has a GDS token. An empty/absent block
-// renders an empty managed block (a keyless box; the operator is warned upstream).
-function readCloudInit({ authorizedKeysBlock = '', boxEnv = '', gdsSession = '', infraDir = resolveBoxInfraDir() } = {}) {
-  // Fail loud, never provision a BARE box (ADR 0150). No infra/ located → there is
-  // no cloud-init to render, so THROW here rather than the old silent `return null`
-  // that let cmdProvision ship empty user-data (a box that boots as bare Ubuntu).
-  if (!infraDir) {
-    throw new Error(
-      `box cloud-init not found: no infra/${BOX_INFRA_TEMPLATE} in any candidate location `
-      + `(set <PREFIX>_BOX_INFRA_DIR or <PREFIX>_INSTANCE_ROOT, or ship infra/). A box must `
-      + `never be provisioned without user-data — it would boot bare (ADR 0150).`,
-    );
-  }
-  const p = path.join(infraDir, BOX_INFRA_TEMPLATE);
-  // gzip+base64 a repo file into the cloud-init write_files (`encoding: gz+b64`).
-  // EVERY inlined infra file goes through this: cloud-init gunzips it back to the
-  // exact bytes on the box, so it is byte-identical to plain b64 but ~2-3x smaller,
-  // which keeps the rendered user-data well under DO's 64 KiB cap (#903; the source
-  // -fetch growth in task 1314 had pushed the all-b64-but-source-fetch render to
-  // 67 KB — gz+b64-ing the rest brings it back to ~51 KB, task 1321). Only the
-  // dynamic runtime values (authorized_keys, box.env, gds-session) stay plain b64
-  // below — they are minted per-provision, not read from infra/. A missing inlined
-  // file is COLLECTED and fails loud after the render (ADR 0150) — a half-wired box
-  // (that component silently never boots) is a bug, not something to warn past.
-  const missingInfra = [];
-  const fileGzB64 = (name) => {
-    try {
-      return zlib.gzipSync(fs.readFileSync(path.join(infraDir, name))).toString('base64');
-    } catch {
-      missingInfra.push(name);
-      return '';
-    }
-  };
-  const raw = fs.readFileSync(p, 'utf8');
-  // Inject the rank-gated source-fetch (#600) + authorized-keys-fetch (#685)
-  // scripts as gz+b64 (a single YAML-safe token — no indentation/escaping
-  // pitfalls; cloud-init gunzips encoding: gz+b64 back to the exact file), plus
-  // the baked authorized_keys block. ONE canonical copy of each lives in infra/.
-  const rendered = raw
-    .replace(/__REPO_URL__/g, process.env.BOX_REPO_URL || '')
-    .replace(/__BOX_SOURCE_FETCH_B64__/g, fileGzB64('box-source-fetch.sh'))
-    .replace(/__BOX_AUTHKEYS_FETCH_B64__/g, fileGzB64('box-authorized-keys-fetch.sh'))
-    .replace(/__BUILDER_AUTHORIZED_KEYS_B64__/g, Buffer.from(authorizedKeysBlock || '', 'utf8').toString('base64'))
-    // /etc/otb/box.env — empty by default (quick tunnel); the named-tunnel
-    // connector token + stable hostname when BOX_NAMED_TUNNEL is on (#771).
-    .replace(/__BOX_ENV_B64__/g, Buffer.from(boxEnv || '', 'utf8').toString('base64'))
-    // /root/.config/otb/gds-session.json — the builder's GDS session, minted at
-    // provision so box-source-fetch (#600) can authenticate on FIRST boot and
-    // clone the rank-scoped repo. Without it the box never clones (the #818
-    // chicken-and-egg: the session normally comes from /builder-setup, which
-    // lives in the un-cloned repo).
-    .replace(/__GDS_SESSION_B64__/g, Buffer.from(gdsSession || '', 'utf8').toString('base64'))
-    // #774: the browser-terminal units, inlined so they start at FIRST BOOT
-    // (independent of the repo clone). ONE canonical copy lives in infra/.
-    .replace(/__BOX_TERMINAL_SERVICE_B64__/g, fileGzB64('box-terminal.service'))
-    // #917: credential-drift watcher pair — restarts ttyd when the credential
-    // file lands/changes after the service started (the wake/first-boot race).
-    .replace(/__BOX_TERMINAL_CREDSYNC_SERVICE_B64__/g, fileGzB64('box-terminal-credsync.service'))
-    .replace(/__BOX_TERMINAL_CREDENTIAL_PATH_B64__/g, fileGzB64('box-terminal-credential.path'))
-    .replace(/__CLOUDFLARED_SERVICE_B64__/g, fileGzB64('cloudflared.service'))
-    .replace(/__CLOUDFLARED_RUN_B64__/g, fileGzB64('cloudflared-run.sh'))
-    // #893: the `close-box` teardown command, present at first boot so a bare
-    // browser-only box has it before any repo clone (box-source-fetch refreshes
-    // it on existing boxes). ONE canonical copy lives in infra/close-box.sh.
-    .replace(/__CLOSE_BOX_B64__/g, fileGzB64('close-box.sh'))
-    // task 986: the browser-terminal auto-launcher — runs `claude` on first
-    // connect so the builder skips the "type claude" step. box-source-fetch
-    // refreshes it on existing boxes. ONE canonical copy in infra/otb-box-launch.sh.
-    .replace(/__OTB_BOX_LAUNCH_B64__/g, fileGzB64('otb-box-launch.sh'));
-  if (missingInfra.length) {
-    throw new Error(
-      `box cloud-init is incomplete under ${infraDir}: missing ${missingInfra.join(', ')} `
-      + `— a box would boot half-wired (ADR 0150). Fix the instance infra/ before provisioning.`,
-    );
-  }
-  return rendered;
-}
-
 // ---- provision -------------------------------------------------------------
 
 async function cmdProvision(pool, boxes, boxOnboard, ref, { apply }) {

package/scripts/gds/fitness-checks-identity.js

@@ -0,0 +1,320 @@
+// scripts/gds/fitness-checks-identity.js — the checks that keep the portable core
+// free of any one host's identity: kernel prompts (BV1.R76), the neutral config
+// packs (BV1.R102) and the design contract.
+//
+// Carved out of scripts/gds/fitness.js by task 1003206 (goal 1000079, the R03
+// de-monolith plan) to bring that file under the 1,500-line ratchet. A STRUCTURAL
+// move: the lines below are fitness.js's originals unchanged, and fitness.js
+// imports every name straight back, so the CHECKS registry and the module's
+// public surface (which the tests read heavily) are untouched.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { CORE_ROOT, MODULE_ROOTS, REPO_ROOT, rel } = require('./fitness-lib.js');
+
+// ============================================================================
+// Check 13 — portable code carries no hardcoded host-brand identity (BV1.R76 + task 1705)
+// ============================================================================
+//
+// The portable core (src/bongos/**) and every feature MODULE (modules/**) must read
+// the instance's product/world name + domains from branding() / window.__BRANDING__,
+// never a baked-in "Off the Boats" / "Amazonprimea" / apex domain (ADR 0062 §3/§5;
+// the branding contract). R76 shipped this as an 8-FILE allowlist over the kernel
+// LLM-prompt headers; task 1705 WIDENS it to a directory-wide scan, so ANY new brand
+// leak in portable code reds the build — not just the nine files someone remembered
+// to list. (The 2026-07-02 separation audit found five leaks the old allowlist missed:
+// the rank/graduation broadcasts, the auth error-page title, the apex-origin default,
+// and ~124 served-UI strings.) Comments are stripped first (block /* */, HTML
+// <!-- -->, and JS // line comments via a `://`-safe strip so a URL is never
+// truncated) because the de-brand rationale legitimately names the old literals in
+// prose. Instance-injected placeholders ({{worldName}} etc.) carry no literal, so
+// they pass untouched.
+//
+// EXCLUDED — the small instance-1 / ops allowlist (task 1705):
+//   - modules/game/**  — the INSTANCE'S OWN PRODUCT. A product's identity is
+//     instance-specific by definition (a vanilla instance ships a different product,
+//     or none); it is not portable-platform code the branding pack can neutralize.
+//     A documented carve-out, not an oversight.
+//   - generated / build-output dirs (no authored source).
+const PROMPT_IDENTITY_LITERALS = [
+  /off the boats/i,
+  /amazonprimea/i,
+];
+// Scan roots (recursive) + kernel-prompt CLIs that live outside them.
+// scripts/gds joined at task 1002427: the builder CLI was UNSCANNED, which is how
+// paste-token.js kept a hardcoded 'https://amazonprimea.com' long after the task
+// 1002201 sweep replaced that literal everywhere else. The straggler surfaced as a
+// 401 that locked a builder out of re-authenticating — a valid token verified
+// against the wrong host — and nothing in CI could see it (idea 1000564).
+// Widened scripts/gds → ALL of scripts/ at task 1002756: migrate.sh's hardcoded
+// founder DB default (task 1002755) survived every gate because the detector never
+// saw the file — a gate that cannot see the file class the bug lives in is worse
+// than no gate, because it is trusted.
+const IDENTITY_SCAN_ROOTS = ['src/bongos', 'modules', 'scripts'];
+const IDENTITY_SCAN_EXTRA_FILES = [];
+// PERMANENT, COUNTED carve-outs for the scripts/gds root — {file: allowed hits}.
+//
+// Widening the root (task 1002427) surfaced 23 files. Task 1002428 swept them:
+// every one whose literal was a real runtime bug is FIXED (a wrong instance URL
+// printed to a builder, an `amazonprimea-*` User-Agent that should come from
+// branding().userAgent(), a hardcoded product name in user-facing copy). What is
+// left below is NOT a backlog — each entry is a literal that is CORRECT as
+// written, so this list is permanent rather than a ratchet-to-zero.
+//
+// The COUNT is still enforced, which is the point: an entry may not grow. A file
+// here that gains a NEW hardcoded host fails the build exactly like an unlisted
+// one, and any file NOT listed must have zero hits. Getting better never fails.
+//
+// Why each is legitimate:
+//   * box.js — REAL Cloudflare/DNS zone names for the operator plane
+//     (`dev.<host>`, the terminal zone). These are infrastructure identifiers,
+//     not an instance URL; routing them through branding would be wrong. (Its
+//     two genuine API-base defaults WERE fixed in 1002428.)
+//   * publish-manifest.js — the literal FILENAMES of two real committed docs
+//     (docs/recipes/amazonprimea-decouple-*.md). Renaming the strings without
+//     renaming the files would break the publish manifest.
+//   * backfill-sessions.js / version-close.js — one-time operator runbook text
+//     naming the actual prod DB + a historical local directory. Describing what
+//     an operator must literally type is the correct content.
+//   * seed-*.js — the hits are PROSE INSIDE seeded task descriptions: historical
+//     records of what those tasks said when they were filed. Rewriting them would
+//     falsify the record; deleting the files would destroy it. They are inert
+//     (idempotent on source_ref) and referenced only by generated manifests.
+//   * the four *.sh entries — surfaced when `.sh` joined the extension set (task
+//     1002567). Each is a HOST-PINNED OPS script, not portable code: they name the
+//     live box's actual Postgres database/role and its actual /etc secrets dir, and
+//     every one of those literals is already only the DEFAULT behind an env override
+//     (GDS_BACKUP_DB, PROD_DB/STAGING_DB, PG_SOCKET). Same rationale as box.js's real
+//     DNS zones — an infrastructure identifier, not an instance URL, and the systemd
+//     units on that box invoke these by path. Re-pointing an instance's backups is
+//     deployment work, not a branding read. Their COUNT is still frozen here, so a
+//     NEW literal in any of them fails exactly like one in an unlisted file.
+//   * fitness-checks-identity.js / package-core.js — THE DETECTORS THEMSELVES: Check 13's regexes
+//     and package-core's PRIOR_INSTANCE_FLOOR name the brand because hunting it is
+//     their job. * seed-v3-tasks.js — the seeded-task-prose rationale above. All
+//     three passed pre-1002756 only by the old stripper's accidents (phantom
+//     blocks + regex-blindness); now they are seen and counted.
+const IDENTITY_SCAN_ALLOWED = {
+  // task 1003206 moved Check 13's own regexes out of fitness.js into THIS file
+  // when the monolith was split, so the detector's self-carve-out moved with them.
+  'scripts/gds/fitness-checks-identity.js': 2,
+  'scripts/gds/package-core.js': 1,
+  'scripts/gds/seed-v3-tasks.js': 14,
+  // audit-replay.sh + db-backup-{nightly,offsite}.sh were carved out here as
+  // "host-pinned ops"; task 1002757 RETIRED that justification for them — each
+  // now resolves its database from the branding pack (the migrate.sh pattern) and
+  // fails loudly rather than defaulting, so their counts ratcheted to zero and the
+  // entries are gone. seed-staging.sh keeps its carve-out on the OPPOSITE
+  // rationale: its literal is a fail-CLOSED safety interlock (the script wipes
+  // STAGING_DB and refuses unless the name matches exactly), so on any other
+  // instance it declines to run instead of destroying the wrong database.
+  'scripts/gds/seed-staging.sh': 4,
+  'scripts/gds/backfill-sessions.js': 2,
+  'scripts/gds/box.js': 3,
+  'scripts/gds/publish-manifest.js': 2,
+  'scripts/gds/seed-bongos-coreB-tranche1-tasks.js': 1,
+  'scripts/gds/seed-bongos-coreB-tranche2-tasks.js': 1,
+  'scripts/gds/seed-bongos-goal-hierarchy-tasks.js': 1,
+  'scripts/gds/seed-bongos-tasks.js': 1,
+  'scripts/gds/seed-gds-v4-tasks.js': 1,
+  'scripts/gds/seed-medusa-tasks.js': 7,
+  'scripts/gds/seed-module-upstreaming.js': 1,
+  'scripts/gds/seed-productization-tasks.js': 6,
+  'scripts/gds/seed-provisioning-tasks.js': 2,
+  'scripts/gds/version-close.js': 1,
+};
+// `.sh` joined at task 1002567: the extension set was `.js/.html/.css`, so NO shell
+// script had ever been scanned — which is how scripts/gds/lib.sh kept a hardcoded
+// founder host as its API-base default (and a hardcoded ~/.config/otb token path)
+// through the entire task 1002201 sweep, leaving all five bash smokes dead on any
+// instance with a different configDir. The guard could not see the file class the
+// bug lived in.
+const IDENTITY_SCAN_EXTS = new Set(['.js', '.html', '.css', '.sh']);
+// Path-prefix carve-outs (see the header note). Kept SMALL and documented.
+const IDENTITY_SCAN_EXCLUDE = ['modules/game/'];
+// Directories with no authored source to gate.
+const IDENTITY_SCAN_SKIP_DIRS = new Set(['node_modules', '.git', 'generated', 'iterations', 'references']);
+
+// Comment stripping lives in identity-strip.js (task 1002756: extracted + replaced
+// the two-regex JS strip, which a `/*` inside a `//` comment could OPEN — it
+// silently hid ~330 provision.js lines from this gate). Re-exported for the tests.
+const { stripCommentsForIdentity } = require('./identity-strip');
+
+// Pure: scan one file's comment-stripped source for a hardcoded host-brand literal.
+// Returns violation strings. Exported for the "actually catches a re-hardcode" test.
+function scanPromptIdentity(relFile, text, ext = path.extname(relFile)) {
+  const violations = [];
+  stripCommentsForIdentity(text, ext).split('\n').forEach((raw, i) => {
+    if (!raw.trim()) return;
+    for (const re of PROMPT_IDENTITY_LITERALS) {
+      const m = raw.match(re);
+      if (m) {
+        violations.push(`${relFile}:${i + 1} hardcodes the host-brand identity "${m[0]}" — read it from branding()/window.__BRANDING__ (identity/domains/currency), or use a {{worldName}}-style token, so a non-OTB instance renders ITS OWN brand (ADR 0062 §3/§5; BV1.R76 / task 1705).`);
+        break; // one hit per line is enough
+      }
+    }
+  });
+  return violations;
+}
+
+// Recursively collect scannable files under one root, honoring the skip-dir + carve-out lists.
+function collectIdentityFiles(absRoot, relRoot) {
+  const out = [];
+  let entries;
+  try { entries = fs.readdirSync(absRoot, { withFileTypes: true }); }
+  catch { return out; }
+  for (const e of entries) {
+    const rel = relRoot ? `${relRoot}/${e.name}` : e.name;
+    if (e.isDirectory()) {
+      if (IDENTITY_SCAN_SKIP_DIRS.has(e.name)) continue;
+      if (IDENTITY_SCAN_EXCLUDE.some((p) => `${rel}/`.startsWith(p))) continue;
+      out.push(...collectIdentityFiles(path.join(absRoot, e.name), rel));
+    } else if (IDENTITY_SCAN_EXTS.has(path.extname(e.name))
+               && !IDENTITY_SCAN_EXCLUDE.some((p) => rel.startsWith(p))) {
+      out.push(rel);
+    }
+  }
+  return out;
+}
+
+function checkKernelPromptsNoHardcodedIdentity() {
+  const violations = [];
+  let scanned = 0;
+  // Collect {abs, rel}: src/bongos is CORE; modules ship from BOTH roots (ADR 0108 §Consequences #4).
+  // Dedup by repo-relative path so a shared checkout never scans a file twice, and read each file
+  // from the root it was actually found under (a module may live in the instance repo post-split).
+  const seen = new Set();
+  const entries = [];
+  const addFrom = (rootAbs, sub) => {
+    for (const relFromRoot of collectIdentityFiles(path.join(rootAbs, sub), sub)) {
+      if (seen.has(relFromRoot)) continue;
+      seen.add(relFromRoot);
+      entries.push({ abs: path.join(rootAbs, relFromRoot), rel: relFromRoot });
+    }
+  };
+  for (const root of IDENTITY_SCAN_ROOTS) {
+    for (const rootAbs of (root === 'modules' ? MODULE_ROOTS : [CORE_ROOT])) addFrom(rootAbs, root);
+  }
+  for (const extra of IDENTITY_SCAN_EXTRA_FILES) {
+    if (!seen.has(extra)) { seen.add(extra); entries.push({ abs: path.join(CORE_ROOT, extra), rel: extra }); }
+  }
+  let ratcheted = 0;
+  for (const { abs, rel: relFile } of entries) {
+    let text;
+    try { text = fs.readFileSync(abs, 'utf8'); }
+    catch { continue; } // a file moved/carved away is not a failure of this gate
+    scanned += 1;
+    const found = scanPromptIdentity(relFile, text);
+    // Permanently allowed at a COUNT (task 1002428): the listed literals are
+    // correct as written, but an entry may not GROW — a new hardcode in one of
+    // these files fails exactly like one in an unlisted file.
+    const allowed = IDENTITY_SCAN_ALLOWED[relFile];
+    if (allowed !== undefined) {
+      if (found.length > allowed) {
+        violations.push(
+          `${relFile} now hardcodes the host-brand identity ${found.length} time(s), above its allowed ${allowed} — ` +
+          `the carve-out covers the EXISTING literals (see IDENTITY_SCAN_ALLOWED), not new ones. ` +
+          `Read the host from branding()/window.__BRANDING__ instead (task 1002428).`
+        );
+      } else {
+        ratcheted += 1;
+      }
+      continue;
+    }
+    violations.push(...found);
+  }
+  return {
+    name: 'portable code carries no hardcoded host identity (BV1.R76 / task 1705)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} portable source file(s) scanned (.js/.html/.css/.sh under src/bongos/** + modules/** + scripts/** (whole root, task 1002756), minus the instance-1 product + generated dirs) — none may hardcode the host brand; identity comes from branding()/window.__BRANDING__ (ADR 0062 §3/§5). ${ratcheted} scripts/gds file(s) hold documented permanent carve-outs (real DNS zones, real doc filenames, operator runbook text, historical seeded prose) capped at a count they may not exceed — task 1002428.`,
+  };
+}
+
+// ============================================================================
+// Check 15b — core-shipped NEUTRAL config packs carry no host identity (BV1.R102)
+// ============================================================================
+//
+// Sibling of Check 15 for the CONFIG class. IDENTITY_SCAN_EXTS is js/html/css, so
+// the scan above never opens a .json — yet config/*.neutral.json is precisely what
+// a vanilla instance boots from (branding R76, governance R96). A host name leaking
+// into a neutral pack ships one instance's brand to EVERY fresh instance, and until
+// this check nothing in CI could see it.
+//
+// Only the NEUTRAL packs are scanned, deliberately: an instance pack (config/
+// branding.json, config/government.json) is host content that legitimately names
+// its host, and is boundary-excluded from the published core anyway.
+function checkNeutralConfigsNoHostIdentity() {
+  const violations = [];
+  const dir = path.join(CORE_ROOT, 'config');
+  let names = [];
+  try { names = fs.readdirSync(dir).filter((n) => n.endsWith('.neutral.json')).sort(); }
+  catch { /* no config/ dir in this root — nothing to gate */ }
+  for (const name of names) {
+    const relFile = `config/${name}`;
+    let text;
+    try { text = fs.readFileSync(path.join(dir, name), 'utf8'); }
+    catch { continue; } // a pack that moved away is not a failure of this gate
+    violations.push(...scanPromptIdentity(relFile, text, '.json'));
+  }
+  return {
+    name: 'neutral config packs carry no host identity (BV1.R102)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${names.length} core-shipped config/*.neutral.json pack(s) scanned — a vanilla instance boots from these alone, so none may name a host brand. Instance packs (config/<name>.json) are host content and are deliberately NOT scanned.`,
+  };
+}
+
+// ---- design contract (ADR 0081 / task 1377) --------------------------------
+
+function checkDesignContract() {
+  const { spawnSync } = require('node:child_process');
+  const validatorPath = path.join(REPO_ROOT, 'scripts', 'gds', 'validate-design.js');
+  const adaptersDir = path.join(REPO_ROOT, 'src', 'ui', 'adapters');
+  const hasAdapters = (() => {
+    try { return fs.readdirSync(adaptersDir).some((e) => fs.statSync(path.join(adaptersDir, e)).isDirectory()); }
+    catch { return false; }
+  })();
+
+  const result = spawnSync(process.execPath, [validatorPath, '--json'], { encoding: 'utf8' });
+  let report = { ok: true, errors: [], warnings: [] };
+  try { report = JSON.parse(result.stdout || '{}'); } catch { /* fall through with defaults */ }
+  if (result.status !== 0 && !report.errors.length) {
+    report.errors.push(result.stderr ? result.stderr.trim() : 'validate-design.js exited non-zero');
+    report.ok = false;
+  }
+
+  return {
+    name: 'design contract valid (docs/design-contract.md / ADR 0081)',
+    ok: report.ok,
+    hardFail: !report.ok && hasAdapters,
+    violations: report.errors || [],
+    warnings: report.warnings || [],
+    note: hasAdapters
+      ? 'Hard-fail: adapters present — contract must be valid. Run: node scripts/gds/validate-design.js'
+      : 'Warn-only until first adapter lands (task 1378 / task 1379). Run: node scripts/gds/validate-design.js',
+  };
+}
+
+
+module.exports = {
+  IDENTITY_SCAN_ALLOWED,
+  IDENTITY_SCAN_EXCLUDE,
+  IDENTITY_SCAN_EXTRA_FILES,
+  IDENTITY_SCAN_EXTS,
+  IDENTITY_SCAN_ROOTS,
+  IDENTITY_SCAN_SKIP_DIRS,
+  PROMPT_IDENTITY_LITERALS,
+  checkDesignContract,
+  checkKernelPromptsNoHardcodedIdentity,
+  checkNeutralConfigsNoHostIdentity,
+  collectIdentityFiles,
+  scanPromptIdentity,
+  stripCommentsForIdentity,
+};