@bongos/core 1.19.337 → 1.19.339

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.337",
-  "core_contract": "1.19.337",
-  "source_commit": "a1079dd09b8ae45b780cdcab81eb44696be21f01",
+  "core_version": "1.19.339",
+  "core_contract": "1.19.339",
+  "source_commit": "2fec46ecdc4aff13a2b42b6dd37e7151fa7a7c6c",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T01:01:18.995Z",
+  "built_at": "2026-08-25T01:23:32.854Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 325,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1830,
-  "tree_sha256": "39cc259330321323f293c3d933377998d7c3cf229570269ccbf77fa1bef52857",
+  "tree_sha256": "7a407b4e4d5c929c91502bf31d949fb6bbf8634ce0a2ea6caa9b7dd48ddfbdd9",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -707,7 +707,7 @@
     {
       "path": "docs/adr/0055-server-mediated-branch-publish.md",
       "mode": "0000644",
-      "sha256": "11ee013554922e0f9dadb582373c22d4aaa6433ddcb14af28386c4843a39497f"
+      "sha256": "5607ab08040d7127fbdad579cf091166b5be5eb6e39a88d3e7337e4f94171fee"
     },
     {
       "path": "docs/adr/0056-prod-deploy-script-mirror-and-healthcheck-retry.md",
@@ -1362,7 +1362,7 @@
     {
       "path": "docs/adr/0176-private-repo-deploy-keys.md",
       "mode": "0000644",
-      "sha256": "eb560b832629f708ad458f64c6a282bf55ae86c24626431d48d258e9ca0ac6d6"
+      "sha256": "80c1b9d283892454f45504fe3f20f3a215967de7cca66a5b3ef30970bb8eed47"
     },
     {
       "path": "docs/adr/0177-goal-membership-kind.md",
@@ -2542,7 +2542,7 @@
     {
       "path": "modules/builder-settings/routes/settings.js",
       "mode": "0000644",
-      "sha256": "c4c80eeba135a2ea2cb11ec6dccf9f77a7c0b8b4204407973a743c531ce8f012"
+      "sha256": "c5198a5fb915be1015eec09ca0b614c96d820fdf491cb56d1c735b8839a441c0"
     },
     {
       "path": "modules/builder-settings/settings.js",
@@ -2872,7 +2872,7 @@
     {
       "path": "modules/dev-box/routes/box.js",
       "mode": "0000644",
-      "sha256": "ba75c28d8927ebbda1482f394a0062febc6e32a52863814d00d6ad2a6667a591"
+      "sha256": "4310c28d74085f2544f92e2191e7cbc4d646bbc4e304fec83099298e5f8d9c93"
     },
     {
       "path": "modules/discord/CLAUDE.md",
@@ -2912,7 +2912,7 @@
     {
       "path": "modules/discord/discord-bot.js",
       "mode": "0000644",
-      "sha256": "d71da1c7d9d2d823c97a64d0f4a87349372c0e4723e6ad3a5f381dcb2a77ee61"
+      "sha256": "7bdd8892cf1dcc7edddcc2e8f95d3174b7f902be83fd0a34ecfc2b7cc998ce55"
     },
     {
       "path": "modules/discord/discord-bugs.js",
@@ -2942,7 +2942,7 @@
     {
       "path": "modules/discord/discord-role-sync.js",
       "mode": "0000644",
-      "sha256": "52a7e8c1776621e37f0c19800b2e466d869d01750214bfd9f352a64d26ea91e9"
+      "sha256": "852abc58bdec011b6d3bf222a35e198c6ea98a761d57a76be85477ef85ae54f5"
     },
     {
       "path": "modules/discord/migrations/discord_001_board_messages.sql",
@@ -3192,7 +3192,7 @@
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "33f0cf42c404e087a6f3817392299dd2a478f41f748932e108747059b756e703"
+      "sha256": "8b29ea6478f4854dd5c74ea3538079db818707a575318634ce4f7504d2768289"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
@@ -3842,7 +3842,7 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "33a5eadf8400285304e3a1958f25ca104b67c7c5a8c1ac59698cff64b4c70589"
+      "sha256": "0215d0eadab112c023af4e67a1fa81060b0844334d29e3943f8c388f64cda533"
     },
     {
       "path": "modules/ideas/routing.js",
@@ -4047,7 +4047,7 @@
     {
       "path": "modules/lifecycle/routes/claims.js",
       "mode": "0000644",
-      "sha256": "b67f879dea205dd442685df384b8e8060a01b8caa34efc74e31253e556acfb25"
+      "sha256": "fb5dda00e0c378e2fb8b3190fdeaf4562be65097895bd67b68e67428a14c8297"
     },
     {
       "path": "modules/lifecycle/routes/dependencies.js",
@@ -4072,7 +4072,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "1184ba92761bf7d7a478b8a45bf87f22637ee7429ef83a1e7459b86946596321"
+      "sha256": "bfc87f9887cfe03abfdec0a9a3139917099922fc37d56fb0fcb4ec47980fb53b"
     },
     {
       "path": "modules/lifecycle/routes/help-requests.js",
@@ -4092,12 +4092,12 @@
     {
       "path": "modules/lifecycle/routes/task-write-routes.js",
       "mode": "0000644",
-      "sha256": "8adc74bb5d37e31ef56392ea7b48c59c982559f46ab4674664b936da5a5ce786"
+      "sha256": "d4b1eb471d334fdf164acd76814cc19358030b8d02146f51481d61a990925e41"
     },
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "bede51a6892901088de9ea75e12250efa5f5cfb85b0e25403f92820eef622cd4"
+      "sha256": "07a56f93428baf4d8cbf7a69a76c052e706ec7759134fcf3db153a37c9ab575c"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -4157,7 +4157,7 @@
     {
       "path": "modules/memory/routes/memory.js",
       "mode": "0000644",
-      "sha256": "1d0e08502f34acec327052a352444561f6c48305a89e1ed8c6acd22f3c4163c3"
+      "sha256": "f3b2f6f003acb77e004259ef62ae2b4cd81dddf3d761550086c687b63f6b8ff7"
     },
     {
       "path": "modules/memory/routes/search.js",
@@ -4337,7 +4337,7 @@
     {
       "path": "modules/platform-identity/routes/sso.js",
       "mode": "0000644",
-      "sha256": "e4cd3084c44b6ff3e3fdad141e530b098b330a25d609fd08f5ae2290fd251db0"
+      "sha256": "9b86c847d2b014fb9929fb655097496d6226c0cd1507c6fdf5ffdd2da6f84eb9"
     },
     {
       "path": "modules/platform-identity/tests/platform-identity.mjs",
@@ -4427,7 +4427,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "b9762b6b76d4ee7f57a3a8c37f126eb768ff8c90e194a575dddc7704a534062d"
+      "sha256": "5e9b3d225f06ab2d92b1f85d0d338ae6fa9aaae31afad92b043172e048455895"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -4727,12 +4727,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6e1f14fea8a5dac393261b47a9563eabca0bda30f2c9a6d56f22e17f548c42aa"
+      "sha256": "d422f518f25f5a4063fa0f114cb86ee4b501e8362e8c0f0f526707d8d6ec137d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b3c8163bb92a02b01ca2ec14a46b8b1b3c25f1e6ae25001b0fea4a2303820713"
+      "sha256": "4988c346e6258b2eca07502ffdf4991652f381983258a2a13de47dc4cafc72b6"
     },
     {
       "path": "public-docs/index.html",
@@ -5407,7 +5407,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "c338e450fff2710b9d6b0abade5de212040b0c05e24c5538c7dc5c119919b487"
+      "sha256": "0181ba9d5595199777a84b1bc8363d5cda55df68c1eeecb647a18c4fbb6697df"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -6287,7 +6287,7 @@
     {
       "path": "src/bongos/auth-admission.js",
       "mode": "0000644",
-      "sha256": "0895bbe37edb0d82d155c544f12ab6700dcaaf56ba1cee70df824ec1f40c3816"
+      "sha256": "74830f017c5472e2420095e158c905dccfd046d1442263b374ae87f2ceebde86"
     },
     {
       "path": "src/bongos/auth-config.js",
@@ -6447,17 +6447,17 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "e2195c0f80c1a7ae3a07e2234d2b97e6a20366b740fe3d0329dd8d8d6f9c1969"
+      "sha256": "be7b68b01d82fb3ac714d92f22b6adbc1788fb47b9ce8345d4cf14bd1fb92e94"
     },
     {
       "path": "src/bongos/routes/backup.js",
       "mode": "0000644",
-      "sha256": "23f9a3f8c3e0741fb9bd771942cd8beb8f434a748a2d006eab858710ea2f0cc7"
+      "sha256": "b6bab9ff17e967cbdb18d29f7e027d0ab74874c8b444434f955456829a5ed547"
     },
     {
       "path": "src/bongos/routes/builders.js",
       "mode": "0000644",
-      "sha256": "9423af249991f4d40e03ffa8d73a3584279f9d1095115c420047a735103bb417"
+      "sha256": "afc0f563da646c6a2d7c3b1adeaeaaf19cf2db48251005f6f003511d2dba65e9"
     },
     {
       "path": "src/bongos/routes/github.js",
@@ -6502,7 +6502,7 @@
     {
       "path": "src/bongos/routes/public.js",
       "mode": "0000644",
-      "sha256": "295b4bafc8a7bf832ed33fb0d35f4487a788caaff994383cda451cc24de2c6c7"
+      "sha256": "a6cf425b755630a6720ed4099ecb187131d8c0dbb9d2d6a02d0a4f5915e2ecb5"
     },
     {
       "path": "src/bongos/routes/security.js",
@@ -6532,7 +6532,7 @@
     {
       "path": "src/bongos/uptime-poller.js",
       "mode": "0000644",
-      "sha256": "6d8af1a53c181db91f643e328cf5abfbbf65fb6893a4b53c4fa3a46da881ad8f"
+      "sha256": "2237a2938586f9600974e01dccec88893bf86cc9cd56c498522f1a9318dffafe"
     },
     {
       "path": "src/branding.js",
@@ -6557,7 +6557,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8ffe1c3c3683e95f182da6cad74272574cbe1a2d94a9b959221cc71084c1b8d3"
+      "sha256": "930f33a07876e76cf85203ff41de06eb1eebe120508946991f2ad0c73bd0a99c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8092,7 +8092,7 @@
     {
       "path": "tests/logger.mjs",
       "mode": "0000644",
-      "sha256": "88508517d49ad11a01d2dbc97767c4baa6789753ea42afe76699bc2bab5017d4"
+      "sha256": "edf87a88bd7130e85844db291d5f1d7b6de561434501bdb064dfadf0e23befe1"
     },
     {
       "path": "tests/main_audit.mjs",

package/docs/adr/0055-server-mediated-branch-publish.md

@@ -49,5 +49,17 @@ A **fine-grained GitHub PAT** scoped to the single repo: `Contents: read/write`
 - A dev-box builder ships end-to-end: `/builder-reauth` → claim → edit → `/builder-stage` ([ADR 0046](<redacted>.md)) → `/builder-ship`, with the GDS doing the push. The box holds no GitHub credential, so the [ADR 0053](0053-scoped-dev-box-session.md) blast-radius argument still holds.
 - The blast radius moves from "box holds a push credential" to "server holds a branch-push-only PAT." This is the direction blocker [#15](https://example.com/builders#/blocker/15) ([SEC #863](https://example.com/builders#/task/863)) already wants — a server identity holding the push credential, not builder machines.
 - **Follow-up (hardening) — DONE + LIVE (task 1028 code, task 1043 cutover):** the standing PAT is replaced by a **GitHub App** (the server holds only the App private key and mints short-lived, repo-scoped installation tokens per push). See the *Update* above — the App is live on prod and the PAT has been removed.
+- **Verified end-to-end on hardware, 2026-08-25 (task 1003247)** — first proof since the
+  repo went private (~2026-08-15). The verification was performed by shipping from a live dev
+  box: `/builder-reauth` -> claim -> edit -> `/builder-ship`. The instance that carried it
+  through was **task 1003252**, whose ship published its branch and produced **PR #353**,
+  which auto-merged and deployed. Task 1003247 is the decision record of that verification --
+  it is not the branch PR #353 was opened from. The box demonstrably held no push credential
+  at the time: with a working READ credential in hand, `git push --dry-run` returned 403
+  `Write access to repository not granted`. A PR nonetheless existing is the proof that the
+  server, not the box, did the push. Also exercised: box source-fetch against a PRIVATE repo,
+  a non-box-scoped session, bundle upload to `POST /tasks/:id/publish-branch`, and the
+  confirmed->shipped flip.
+
 - **Residual:** the server verifies the bundle tip == the claimed sha and that the caller holds the claim, but does not cheaply prove every commit in the bundle was authored under the claim — branch protection + required checks on `main` (which the credential cannot bypass) are the real gate, exactly as for any PR.
 - **Operator action — DONE (blocker 31, resolved 2026-06-13):** the GitHub App was created and `GITHUB_APP_ID` + `GITHUB_APP_INSTALLATION_ID` + `GITHUB_APP_PRIVATE_KEY` set on the droplet (task 1043); `GITHUB_PUSH_TOKEN` then removed. To rotate the key: generate a new private key in the App's settings, replace `GITHUB_APP_PRIVATE_KEY` (single-line, literal `\n`) in `/etc/example/web-source.env`, restart `example`. To roll back to the PAT: restore `web-source.env.bak-task1043` and set a fresh `GITHUB_PUSH_TOKEN` (with the App vars absent, `resolveToken()` falls back to the PAT).

package/docs/adr/0176-private-repo-deploy-keys.md

@@ -51,8 +51,18 @@ best-effort revokes the key by title. Pushes keep preferring the owner-token HTT
 - The flip-to-private refusal on the manage page (task 1003045) stays until existing
   already-provisioned instances get the same wiring on flip — a follow-up task, since their
   origin still rides the shared alias.
-- Builder **dev boxes** of a private-repo project are out of scope here: their
-  `box-source-fetch.sh` clone uses box-side auth and needs the same treatment (follow-up).
+- Builder **dev boxes** of a private-repo project were parked here as out of scope.
+  **Answered on hardware 2026-08-25 (task 1003247): a box CAN read the private repo, and the
+  auth design needed no change.** The GDS-backed credential helper (`otb-git-credential`,
+  task 1002907) fetches a per-request, per-LIVE-rank credential from `/box/source-access`, so
+  `git ls-remote origin` succeeds against the private repo. ADR 0055's posture holds
+  underneath it: that same credential is read-only, so `git push` still returns 403 `Write
+  access to repository not granted`. The real gap was not box-side auth at all but a
+  config-dir mismatch -- `box-source-fetch.sh` and the helper read the legacy
+  `~/.config/otb/` while `/builder-reauth` writes to the branding `configDir`, so after a
+  re-auth both presented a dead token and every git op died with the opaque "could not read
+  Username". Task 1003252 fixed the four tracked `infra/box-*.sh` scripts; the two
+  instance-owned consumers are task 1003253.
 - `bongos upgrade --commit-pin` on a private instance pushes its pin via `origin` — now the
   read-only key, so GitHub refuses it and the pull-deploy reset can revert the bump.
   `upgrade.js` needs the owner-token push path (follow-up).

package/modules/builder-settings/routes/settings.js

@@ -29,6 +29,8 @@ const interactionPrefs = require('../interaction-prefs');
 const modelAllocPrefs = require('../model-alloc-prefs');
 const renderPrefs = require('../render-prefs');
 const displayName = require('../display-name');
+// task 1003208: structured logging (pino via the doorway) — was console.*.
+const log = api.logger('builder-settings');
 
 // Register the `builder-settings` kernel PORT (BV1.R80 / ADR 0093 §1). The core
 // consumers (routes/me.js's GET /me aggregator + cascade-dispatch.js) resolve it
@@ -67,7 +69,7 @@ module.exports = function buildBuilderSettingsRouter() {
         allowed_models: skillPrefs.ALLOWED_MODELS,
       });
     } catch (err) {
-      console.error('[gds] GET /me/skill-prefs', err);
+      log.error('[gds] GET /me/skill-prefs', err);
       res.fail('read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -98,7 +100,7 @@ module.exports = function buildBuilderSettingsRouter() {
         allowed_models: skillPrefs.ALLOWED_MODELS,
       });
     } catch (err) {
-      console.error('[gds] PATCH /me/skill-prefs', err);
+      log.error('[gds] PATCH /me/skill-prefs', err);
       res.fail('write_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -124,7 +126,7 @@ module.exports = function buildBuilderSettingsRouter() {
         known_sounds: soundPrefs.KNOWN_SOUNDS,
       });
     } catch (err) {
-      console.error('[gds] GET /me/sound-prefs', err);
+      log.error('[gds] GET /me/sound-prefs', err);
       res.fail('read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -156,7 +158,7 @@ module.exports = function buildBuilderSettingsRouter() {
         known_sounds: soundPrefs.KNOWN_SOUNDS,
       });
     } catch (err) {
-      console.error('[gds] PATCH /me/sound-prefs', err);
+      log.error('[gds] PATCH /me/sound-prefs', err);
       res.fail('write_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -178,7 +180,7 @@ module.exports = function buildBuilderSettingsRouter() {
         events:       eventSoundPrefs.EVENTS,
       });
     } catch (err) {
-      console.error('[gds] GET /me/event-sound-prefs', err);
+      log.error('[gds] GET /me/event-sound-prefs', err);
       res.fail('read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -205,7 +207,7 @@ module.exports = function buildBuilderSettingsRouter() {
         events:       eventSoundPrefs.EVENTS,
       });
     } catch (err) {
-      console.error('[gds] PATCH /me/event-sound-prefs', err);
+      log.error('[gds] PATCH /me/event-sound-prefs', err);
       res.fail('write_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -225,7 +227,7 @@ module.exports = function buildBuilderSettingsRouter() {
       const stored = await db.getBuilderBehaviorPrefs(req.builder.id);
       res.json(wanderingPrefs.describeForApi(stored, builder?.rank));
     } catch (err) {
-      console.error('[gds] GET /me/wandering', err);
+      log.error('[gds] GET /me/wandering', err);
       res.fail('read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -251,7 +253,7 @@ module.exports = function buildBuilderSettingsRouter() {
       const saved = await db.setBuilderBehaviorPrefs(req.builder.id, next);
       res.json(wanderingPrefs.describeForApi(saved, builder?.rank));
     } catch (err) {
-      console.error('[gds] PATCH /me/wandering', err);
+      log.error('[gds] PATCH /me/wandering', err);
       res.fail('write_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -269,7 +271,7 @@ module.exports = function buildBuilderSettingsRouter() {
       const stored = await db.getBuilderBehaviorPrefs(req.builder.id);
       res.json(interactionPrefs.describeForApi(stored));
     } catch (err) {
-      console.error('[gds] GET /me/interaction', err);
+      log.error('[gds] GET /me/interaction', err);
       res.fail('read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -289,7 +291,7 @@ module.exports = function buildBuilderSettingsRouter() {
       const saved = await db.setBuilderBehaviorPrefs(req.builder.id, nextPrefs);
       res.json(interactionPrefs.describeForApi(saved));
     } catch (err) {
-      console.error('[gds] PATCH /me/interaction', err);
+      log.error('[gds] PATCH /me/interaction', err);
       res.fail('write_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -309,7 +311,7 @@ module.exports = function buildBuilderSettingsRouter() {
       const stored = await db.getBuilderBehaviorPrefs(req.builder.id);
       res.json(modelAllocPrefs.describeForApi(stored, instanceModels()));
     } catch (err) {
-      console.error('[gds] GET /me/model-allocation', err);
+      log.error('[gds] GET /me/model-allocation', err);
       res.fail('read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -329,7 +331,7 @@ module.exports = function buildBuilderSettingsRouter() {
       const saved = await db.setBuilderBehaviorPrefs(req.builder.id, nextPrefs);
       res.json(modelAllocPrefs.describeForApi(saved, instanceModels()));
     } catch (err) {
-      console.error('[gds] PATCH /me/model-allocation', err);
+      log.error('[gds] PATCH /me/model-allocation', err);
       res.fail('write_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -349,7 +351,7 @@ module.exports = function buildBuilderSettingsRouter() {
       const stored = await db.getBuilderBehaviorPrefs(req.builder.id);
       res.json(renderPrefs.describeForApi(stored));
     } catch (err) {
-      console.error('[gds] GET /me/render', err);
+      log.error('[gds] GET /me/render', err);
       res.fail('read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -371,7 +373,7 @@ module.exports = function buildBuilderSettingsRouter() {
       const saved = await db.setBuilderBehaviorPrefs(req.builder.id, next);
       res.json(renderPrefs.describeForApi(saved));
     } catch (err) {
-      console.error('[gds] PATCH /me/render', err);
+      log.error('[gds] PATCH /me/render', err);
       res.fail('write_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -388,7 +390,7 @@ module.exports = function buildBuilderSettingsRouter() {
       const current = await db.getBuilderDisplayName(req.builder.id);
       res.json({ display_name: current, max_length: displayName.MAX_LENGTH });
     } catch (err) {
-      console.error('[gds] GET /me/display-name', err);
+      log.error('[gds] GET /me/display-name', err);
       res.fail('read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -408,7 +410,7 @@ module.exports = function buildBuilderSettingsRouter() {
       const saved = await db.setBuilderDisplayName(req.builder.id, v.value);
       res.json({ display_name: saved, max_length: displayName.MAX_LENGTH });
     } catch (err) {
-      console.error('[gds] PATCH /me/display-name', err);
+      log.error('[gds] PATCH /me/display-name', err);
       res.fail('write_failed', { status: 500, message: 'internal error' });
     }
   });

package/modules/dev-box/routes/box.js

@@ -39,6 +39,8 @@ const boxOnboard = require('../box-onboard');
 // queries lifted out of core db.js. Kernel reads (getBuilderById) still come
 // from the doorway via `gdsDb`.
 const db = require('../db');
+// task 1003208: structured logging (pino via the doorway) — was console.*.
+const log = api.logger('dev-box');
 
 // Repo root, for serving the (non-secret) bootstrap scripts that live in infra/.
 const REPO_ROOT = path.resolve(__dirname, '..', '..', '..');
@@ -240,7 +242,7 @@ module.exports = function buildBoxRouter() {
         })),
       });
     } catch (err) {
-      console.error('[gds] GET /boxes', err);
+      log.error('[gds] GET /boxes', err);
       res.fail('roster_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -256,7 +258,7 @@ module.exports = function buildBoxRouter() {
       const out = await boxes.boxCostLedger(pool, { limit });
       res.json(out);
     } catch (err) {
-      console.error('[gds] GET /boxes/cost-ledger', err);
+      log.error('[gds] GET /boxes/cost-ledger', err);
       res.fail('cost_ledger_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -301,7 +303,7 @@ module.exports = function buildBoxRouter() {
           : 'A close request is already queued for that box.',
       });
     } catch (err) {
-      console.error('[gds] POST /boxes/:builderId/close', err);
+      log.error('[gds] POST /boxes/:builderId/close', err);
       res.fail('close_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -379,7 +381,7 @@ module.exports = function buildBoxRouter() {
         close_queued: closeQueued,
       });
     } catch (err) {
-      console.error('[gds] PATCH /boxes/:builderId/block', err);
+      log.error('[gds] PATCH /boxes/:builderId/block', err);
       res.fail('block_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -403,7 +405,7 @@ module.exports = function buildBoxRouter() {
         cost,
       });
     } catch (err) {
-      console.error('[gds] GET /box/me', err);
+      log.error('[gds] GET /box/me', err);
       res.fail('box_read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -449,7 +451,7 @@ module.exports = function buildBoxRouter() {
         try {
           scopeKeys = await lifecycle.moduleScopeForActiveClaims(req.builder.id);
         } catch (scopeErr) {
-          console.error('[gds] source-access scope read (non-fatal, → rank scope)', scopeErr && scopeErr.message ? scopeErr.message : scopeErr);
+          log.error('[gds] source-access scope read (non-fatal, → rank scope)', scopeErr && scopeErr.message ? scopeErr.message : scopeErr);
           scopeKeys = undefined;
         }
       }
@@ -461,7 +463,7 @@ module.exports = function buildBoxRouter() {
         try {
           hasActiveClaims = (await lifecycle.activeClaimCountForBuilder(req.builder.id)) > 0;
         } catch (claimErr) {
-          console.error('[gds] source-access claim-count read (non-fatal, → BASE)', claimErr && claimErr.message ? claimErr.message : claimErr);
+          log.error('[gds] source-access claim-count read (non-fatal, → BASE)', claimErr && claimErr.message ? claimErr.message : claimErr);
           hasActiveClaims = undefined;
         }
       }
@@ -530,7 +532,7 @@ module.exports = function buildBoxRouter() {
     } catch (err) {
       // Log the detail server-side; do NOT leak it to the caller — this is a
       // credential-issuing endpoint, and err.message can carry DB/query internals.
-      console.error('[gds] GET /box/source-access', err);
+      log.error('[gds] GET /box/source-access', err);
       res.fail('source_access_failed', 500);
     }
   });
@@ -566,7 +568,7 @@ module.exports = function buildBoxRouter() {
         try {
           scopeKeys = await lifecycle.moduleScopeForActiveClaims(req.builder.id);
         } catch (scopeErr) {
-          console.error('[gds] /box/scope scope read (non-fatal, → rank scope)', scopeErr && scopeErr.message ? scopeErr.message : scopeErr);
+          log.error('[gds] /box/scope scope read (non-fatal, → rank scope)', scopeErr && scopeErr.message ? scopeErr.message : scopeErr);
           scopeKeys = undefined;
         }
       }
@@ -577,7 +579,7 @@ module.exports = function buildBoxRouter() {
         try {
           hasActiveClaims = (await lifecycle.activeClaimCountForBuilder(req.builder.id)) > 0;
         } catch (claimErr) {
-          console.error('[gds] /box/scope claim-count read (non-fatal, → BASE)', claimErr && claimErr.message ? claimErr.message : claimErr);
+          log.error('[gds] /box/scope claim-count read (non-fatal, → BASE)', claimErr && claimErr.message ? claimErr.message : claimErr);
           hasActiveClaims = undefined;
         }
       }
@@ -594,7 +596,7 @@ module.exports = function buildBoxRouter() {
       // an array). false → the rank fallback (no active claim / no lifecycle port).
       return res.json({ ...meta, task_scope: Array.isArray(scopeKeys) });
     } catch (err) {
-      console.error('[gds] GET /box/scope', err);
+      log.error('[gds] GET /box/scope', err);
       res.fail('box_scope_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -618,7 +620,7 @@ module.exports = function buildBoxRouter() {
       const state = await boxes.bumpActivity(pool, req.builder.id, { claudeActive });
       res.json({ ok: true, state: state || 'none' });
     } catch (err) {
-      console.error('[gds] POST /box/heartbeat', err);
+      log.error('[gds] POST /box/heartbeat', err);
       res.fail('heartbeat_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -653,7 +655,7 @@ module.exports = function buildBoxRouter() {
           : 'A close request is already queued for your box.',
       });
     } catch (err) {
-      console.error('[gds] POST /box/close', err);
+      log.error('[gds] POST /box/close', err);
       res.fail('close_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -698,7 +700,7 @@ module.exports = function buildBoxRouter() {
         key: { id: row.id, key_type: row.key_type, fingerprint: row.fingerprint, label: row.label },
       });
     } catch (err) {
-      console.error('[gds] POST /box/ssh-key', err);
+      log.error('[gds] POST /box/ssh-key', err);
       res.fail('register_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -714,7 +716,7 @@ module.exports = function buildBoxRouter() {
         })),
       });
     } catch (err) {
-      console.error('[gds] GET /box/ssh-key', err);
+      log.error('[gds] GET /box/ssh-key', err);
       res.fail('list_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -730,7 +732,7 @@ module.exports = function buildBoxRouter() {
       if (!removed) return res.fail('not_found', 404);
       res.json({ ok: true, deleted: removed });
     } catch (err) {
-      console.error('[gds] DELETE /box/ssh-key/:id', err);
+      log.error('[gds] DELETE /box/ssh-key/:id', err);
       res.fail('delete_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -766,7 +768,7 @@ module.exports = function buildBoxRouter() {
       await boxOnboard.touchSshKeysUsed(pool, req.builder.id).catch(() => {});
       res.type('text/plain').send(boxOnboard.buildAuthorizedKeysFile(keys));
     } catch (err) {
-      console.error('[gds] GET /box/authorized-keys', err);
+      log.error('[gds] GET /box/authorized-keys', err);
       res.fail('authorized_keys_failed', 500);
     }
   });
@@ -786,7 +788,7 @@ module.exports = function buildBoxRouter() {
       if (err && (err.code === 'BAD_LOGIN' || err.code === 'BAD_HOSTNAME')) {
         return res.fail('bad_identity', { status: 400, message: 'internal error' });
       }
-      console.error('[gds] GET /box/managed-settings', err);
+      log.error('[gds] GET /box/managed-settings', err);
       res.fail('managed_settings_failed', 500);
     }
   });
@@ -869,7 +871,7 @@ module.exports = function buildBoxRouter() {
           : `A ${intent.action} is already queued for your box.`,
       });
     } catch (err) {
-      console.error('[gds] POST /box/ensure', err);
+      log.error('[gds] POST /box/ensure', err);
       res.fail('ensure_failed', 500);
     }
   });
@@ -947,7 +949,7 @@ module.exports = function buildBoxRouter() {
           : 'Box is up; waiting for the terminal service + tunnel to publish their URL (a few seconds after boot).',
       });
     } catch (err) {
-      console.error('[gds] GET /box/terminal', err);
+      log.error('[gds] GET /box/terminal', err);
       res.fail('terminal_failed', 500);
     }
   });
@@ -983,7 +985,7 @@ module.exports = function buildBoxRouter() {
       }
       res.json({ ok: true, state });
     } catch (err) {
-      console.error('[gds] POST /box/terminal', err);
+      log.error('[gds] POST /box/terminal', err);
       res.fail('terminal_failed', 500);
     }
   });
@@ -1012,7 +1014,7 @@ module.exports = function buildBoxRouter() {
       }
       res.json({ ok: true, state, count: parsed.lines.length });
     } catch (err) {
-      console.error('[gds] POST /box/host-keys', err);
+      log.error('[gds] POST /box/host-keys', err);
       res.fail('host_keys_failed', 500);
     }
   });
@@ -1049,7 +1051,7 @@ module.exports = function buildBoxRouter() {
       }
       res.json({ ok: true, state });
     } catch (err) {
-      console.error('[gds] POST /box/version', err);
+      log.error('[gds] POST /box/version', err);
       res.fail('version_report_failed', 500);
     }
   });