@bongos/core 1.19.337 → 1.19.339

package/modules/memory/routes/memory.js

@@ -61,6 +61,8 @@ const express = require('express');
 const api = require('../../../src/module-api');
 const auth = api;
 const memory = require('../memory');
+// task 1003208: structured logging (pino via the doorway) — was console.*.
+const log = api.logger('memory');
 const db = api;
 
 // Per-builder rate limit for POST /memory/sync, layered ON TOP of the global
@@ -357,7 +359,7 @@ module.exports = function buildMemoryRouter() {
     } catch (e) {
       // A throw here means the transaction itself failed (BEGIN/COMMIT/connect),
       // not a per-file rejection — those come back inside the results array.
-      console.error('[gds] POST /memory/sync batch transaction error', { builderId, err: e });
+      log.error('[gds] POST /memory/sync batch transaction error', { builderId, err: e });
       return res.fail('store_failed', { status: 500, message: 'memory sync failed; nothing was stored' });
     }
 
@@ -397,9 +399,9 @@ module.exports = function buildMemoryRouter() {
         hint = 'Prune old memory files (the limit is per-builder, summed across all files).';
       } else if (code !== 'BAD_PATH' && code !== 'STORE_FAILED') {
         // Unknown helper error code — log for forensics, still report per-file.
-        console.error('[gds] POST /memory/sync store error', { builderId, path, code, err: e });
+        log.error('[gds] POST /memory/sync store error', { builderId, path, code, err: e });
       } else if (code === 'STORE_FAILED') {
-        console.error('[gds] POST /memory/sync unexpected error', { builderId, path, err: e });
+        log.error('[gds] POST /memory/sync unexpected error', { builderId, path, err: e });
       }
       const err = { path, code, message, ...(hint ? { hint } : {}) };
       errors.push(err);
@@ -452,7 +454,7 @@ module.exports = function buildMemoryRouter() {
         })),
       });
     } catch (err) {
-      console.error('[gds] GET /memory/files', { builderId, err });
+      log.error('[gds] GET /memory/files', { builderId, err });
       return res.fail('list_failed', { status: 500, message: 'could not list memory files' });
     }
   });
@@ -504,7 +506,7 @@ module.exports = function buildMemoryRouter() {
         created_at: row.created_at,
       });
     } catch (err) {
-      console.error('[gds] GET /memory/file', { builderId, path, err });
+      log.error('[gds] GET /memory/file', { builderId, path, err });
       return res.fail('fetch_failed', { status: 500, message: 'could not fetch memory file' });
     }
   });
@@ -537,7 +539,7 @@ module.exports = function buildMemoryRouter() {
       if (n === 0) return res.fail('not_found', 404, { path });
       return res.json({ deleted: true, builder_id: builderId, path });
     } catch (err) {
-      console.error('[gds] DELETE /memory/file', { builderId, path, err });
+      log.error('[gds] DELETE /memory/file', { builderId, path, err });
       return res.fail('delete_failed', { status: 500, message: 'could not delete memory file' });
     }
   });
@@ -568,7 +570,7 @@ module.exports = function buildMemoryRouter() {
       try {
         rows = await memory.listMemoryFiles(targetId);
       } catch (err) {
-        console.error('[gds] GET /memory/builders/:builderId/files', { targetId, err });
+        log.error('[gds] GET /memory/builders/:builderId/files', { targetId, err });
         return res.fail('list_failed', { status: 500, message: 'could not list memory files' });
       }
       // FAIL CLOSED: the audit row must land durably BEFORE we return any of the
@@ -579,7 +581,7 @@ module.exports = function buildMemoryRouter() {
       try {
         await recordForensicRead(req, { route, targetBuilderId: targetId, target: 'list', responseStatus: 200 });
       } catch (auditErr) {
-        console.error('[gds] forensic-read audit insert failed (read withheld)', {
+        log.error('[gds] forensic-read audit insert failed (read withheld)', {
           route, targetId, err: auditErr && auditErr.message ? auditErr.message : String(auditErr),
         });
         return res.fail('audit_failed', { status: 500, message: 'forensic read not served: audit could not be recorded' });
@@ -628,7 +630,7 @@ module.exports = function buildMemoryRouter() {
       try {
         row = await memory.fetchMemoryFile(targetId, path);
       } catch (err) {
-        console.error('[gds] GET /memory/builders/:builderId/file', { targetId, path, err });
+        log.error('[gds] GET /memory/builders/:builderId/file', { targetId, path, err });
         return res.fail('fetch_failed', { status: 500, message: 'could not fetch memory file' });
       }
       // FAIL CLOSED: audit the look — logged even if the path is a 404, because
@@ -640,7 +642,7 @@ module.exports = function buildMemoryRouter() {
       try {
         await recordForensicRead(req, { route, targetBuilderId: targetId, target: path, responseStatus: outcomeStatus });
       } catch (auditErr) {
-        console.error('[gds] forensic-read audit insert failed (read withheld)', {
+        log.error('[gds] forensic-read audit insert failed (read withheld)', {
           route, targetId, path, err: auditErr && auditErr.message ? auditErr.message : String(auditErr),
         });
         return res.fail('audit_failed', { status: 500, message: 'forensic read not served: audit could not be recorded' });
@@ -687,7 +689,7 @@ module.exports = function buildMemoryRouter() {
       try {
         rows = await memory.listMemoryFiles(targetId);
       } catch (err) {
-        console.error('[gds] GET /memory/bfg/builders/:builderId/files', { targetId, err });
+        log.error('[gds] GET /memory/bfg/builders/:builderId/files', { targetId, err });
         return res.fail('list_failed', { status: 500, message: 'could not list memory files' });
       }
       // FAIL CLOSED: the audit row must land before any of the target's data is
@@ -695,7 +697,7 @@ module.exports = function buildMemoryRouter() {
       try {
         await recordForensicRead(req, { route, targetBuilderId: targetId, target: 'list', responseStatus: 200, action: 'bfg_memory_read' });
       } catch (auditErr) {
-        console.error('[gds] bfg-read audit insert failed (read withheld)', { route, targetId, err: auditErr && auditErr.message ? auditErr.message : String(auditErr) });
+        log.error('[gds] bfg-read audit insert failed (read withheld)', { route, targetId, err: auditErr && auditErr.message ? auditErr.message : String(auditErr) });
         return res.fail('audit_failed', { status: 500, message: 'read not served: audit could not be recorded' });
       }
       res.set('Cache-Control', 'no-store');
@@ -731,14 +733,14 @@ module.exports = function buildMemoryRouter() {
       try {
         row = await memory.fetchMemoryFile(targetId, path);
       } catch (err) {
-        console.error('[gds] GET /memory/bfg/builders/:builderId/file', { targetId, path, err });
+        log.error('[gds] GET /memory/bfg/builders/:builderId/file', { targetId, path, err });
         return res.fail('fetch_failed', { status: 500, message: 'could not fetch memory file' });
       }
       const outcomeStatus = row ? 200 : 404;
       try {
         await recordForensicRead(req, { route, targetBuilderId: targetId, target: path, responseStatus: outcomeStatus, action: 'bfg_memory_read' });
       } catch (auditErr) {
-        console.error('[gds] bfg-read audit insert failed (read withheld)', { route, targetId, path, err: auditErr && auditErr.message ? auditErr.message : String(auditErr) });
+        log.error('[gds] bfg-read audit insert failed (read withheld)', { route, targetId, path, err: auditErr && auditErr.message ? auditErr.message : String(auditErr) });
         return res.fail('audit_failed', { status: 500, message: 'read not served: audit could not be recorded' });
       }
       if (!row) return res.fail('not_found', 404, { builder_id: targetId, path });
@@ -830,7 +832,7 @@ module.exports = function buildMemoryRouter() {
       try {
         target = await db.getBuilderById(targetId);
       } catch (err) {
-        console.error('[gds] bfg-write target lookup', { targetId, err });
+        log.error('[gds] bfg-write target lookup', { targetId, err });
         return res.fail('lookup_failed', 500);
       }
       if (!target) return res.fail('target_not_found', 404);
@@ -893,7 +895,7 @@ module.exports = function buildMemoryRouter() {
           // own assertBfgPath guard mapped to a clean 400 for any direct caller.
           return res.fail('bad_path', 400, { code });
         }
-        console.error('[gds] POST /memory/builders/:builderId/bfg-write', e);
+        log.error('[gds] POST /memory/builders/:builderId/bfg-write', e);
         return res.fail('bfg_write_failed', 500);
       }
     }

package/modules/platform-identity/routes/sso.js

@@ -19,6 +19,8 @@ const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 const hubKeys = require('../hub-keys');
 const hubDevice = require('../hub-device');
+// task 1003208: structured logging (pino via the doorway) — was console.*.
+const log = api.logger('platform-identity');
 
 const { pool, validateOrRespond, resolveSession } = api;
 
@@ -65,12 +67,12 @@ async function notifyInstanceLogout(membership, githubId) {
         body: JSON.stringify({ logout_token: token }),
         signal: ac.signal,
       });
-      if (!resp.ok) console.warn(`[platform-identity] SLO: ${origin} returned ${resp.status}`);
+      if (!resp.ok) log.warn(`[platform-identity] SLO: ${origin} returned ${resp.status}`);
     } finally {
       clearTimeout(timer);
     }
   } catch (err) {
-    console.warn(`[platform-identity] SLO: notifying ${origin} failed (non-blocking):`, err && err.message ? err.message : err);
+    log.warn(`[platform-identity] SLO: notifying ${origin} failed (non-blocking):`, err && err.message ? err.message : err);
   }
 }
 
@@ -90,7 +92,7 @@ async function fanOutBackchannelLogout(githubId) {
     const targets = (memberships || []).filter((m) => m.project_origin && m.client_id);
     await Promise.allSettled(targets.map((m) => notifyInstanceLogout(m, githubId)));
   } catch (err) {
-    console.error('[platform-identity] SLO fan-out failed (non-blocking):', err && err.message ? err.message : err);
+    log.error('[platform-identity] SLO fan-out failed (non-blocking):', err && err.message ? err.message : err);
   }
 }
 
@@ -149,7 +151,7 @@ module.exports = function ssoRoutes() {
     try {
       client = await pi.getClient(clientId, { pool });
     } catch (err) {
-      console.error('[platform-identity] /sso/authorize getClient', err);
+      log.error('[platform-identity] /sso/authorize getClient', err);
       return res.status(500).type('text/html').send(errorPage('Internal error resolving the project.'));
     }
     if (!client || client.status !== 'active') {
@@ -171,7 +173,7 @@ module.exports = function ssoRoutes() {
     try {
       session = await resolveSession(req);
     } catch (err) {
-      console.error('[platform-identity] /sso/authorize resolveSession', err);
+      log.error('[platform-identity] /sso/authorize resolveSession', err);
       return res.status(500).type('text/html').send(errorPage('Internal error checking your hub session.'));
     }
     const usable = pi.sessionUsableForFederation(session);
@@ -213,7 +215,7 @@ module.exports = function ssoRoutes() {
       if (state) u.searchParams.set('state', state);
       return res.redirect(302, u.toString());
     } catch (err) {
-      console.error('[platform-identity] /sso/authorize mint', err);
+      log.error('[platform-identity] /sso/authorize mint', err);
       return res.status(500).type('text/html').send(errorPage('Could not complete the sign-in handoff.'));
     }
   });
@@ -261,7 +263,7 @@ module.exports = function ssoRoutes() {
         avatar_url: identity.avatar_url,
       });
     } catch (err) {
-      console.error('[platform-identity] POST /sso/token', err);
+      log.error('[platform-identity] POST /sso/token', err);
       return res.fail('token_exchange_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -302,7 +304,7 @@ module.exports = function ssoRoutes() {
       const out = await hubDevice.startHubGithubDevice(client.client_id);
       res.json(out);
     } catch (err) {
-      console.error('[platform-identity] /sso/device/start', err);
+      log.error('[platform-identity] /sso/device/start', err);
       // 424, not 502: Cloudflare replaces origin 5xx bodies with its own page, so a
       // proxied upstream refusal must ride a 4xx to keep its JSON diagnosis readable
       // externally (finding W2, task 1003052 — the core device/start twin).
@@ -345,7 +347,7 @@ module.exports = function ssoRoutes() {
       });
       res.json({ state: 'ok', assertion });
     } catch (err) {
-      console.error('[platform-identity] /sso/device/poll', err);
+      log.error('[platform-identity] /sso/device/poll', err);
       // 424, matching the core device/poll (finding W2, task 1003052): this catch
       // proxies the hub's GitHub poll refusals, and a 5xx body never survives
       // Cloudflare. (The !out.client_id branch above keeps its 500: an internal
@@ -399,7 +401,7 @@ module.exports = function ssoRoutes() {
       await pi.upsertMembership({ clientId: client_id, githubId: github_id, membershipKind }, { pool });
       res.json({ ok: true });
     } catch (err) {
-      console.error('[platform-identity] /sso/membership/check-in', err);
+      log.error('[platform-identity] /sso/membership/check-in', err);
       res.fail('checkin_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -453,7 +455,7 @@ module.exports = function ssoRoutes() {
       }, { pool });
       res.json({ ok: true });
     } catch (err) {
-      console.error('[platform-identity] /sso/activity/rollup', err);
+      log.error('[platform-identity] /sso/activity/rollup', err);
       res.fail('rollup_failed', { status: 500, message: 'internal error' });
     }
   });

package/modules/provisioning/routes/provisioning.js

@@ -34,6 +34,8 @@ const { pool, validateOrRespond, parseId } = api;
 const provisioning = require('../provisioning');
 const { onboardPlan, stepsForShape } = require('../onboard-plan');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
+// task 1003208: structured logging (pino via the doorway) — was console.*.
+const log = api.logger('provisioning');
 
 // How long a GitHub-App-Manifest `state` token is valid — the owner must click the
 // pre-filled link + approve on GitHub within this window (task 2080). Comfortably
@@ -279,7 +281,7 @@ module.exports = function provisioningRoutes() {
       const rows = await provisioning.listAllInstances(pool, { status });
       res.json({ instances: rows.map(fleetInstance) });
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/fleet', err);
+      log.error('[provisioning] GET /provisioning/fleet', err);
       res.fail('fleet_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -294,7 +296,7 @@ module.exports = function provisioningRoutes() {
       const out = await provisioning.costLedger(pool, { limit });
       res.json(out);
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/fleet/cost-ledger', err);
+      log.error('[provisioning] GET /provisioning/fleet/cost-ledger', err);
       res.fail('cost_ledger_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -347,7 +349,7 @@ module.exports = function provisioningRoutes() {
       res.json({ ok: true, queued: r.created, action: 'teardown', status: inst.status, superseded: r.superseded,
         message: r.created ? 'The instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
     } catch (err) {
-      console.error('[provisioning] POST /provisioning/instances/:id/force-teardown', err);
+      log.error('[provisioning] POST /provisioning/instances/:id/force-teardown', err);
       res.fail('teardown_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -522,7 +524,7 @@ module.exports = function provisioningRoutes() {
         ...(typeIgnored ? { type_ignored: typeIgnored } : {}),
       });
     } catch (err) {
-      console.error('[provisioning] POST /provisioning/instances', err);
+      log.error('[provisioning] POST /provisioning/instances', err);
       res.fail('request_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -570,7 +572,7 @@ module.exports = function provisioningRoutes() {
       // disclosure this route has no reason to make.
       res.json({ slug, available: reason === null, reason, address: address || null });
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/slug-available', err);
+      log.error('[provisioning] GET /provisioning/slug-available', err);
       res.fail('check_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -590,7 +592,7 @@ module.exports = function provisioningRoutes() {
       }
       res.json({ instances });
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/instances', err);
+      log.error('[provisioning] GET /provisioning/instances', err);
       res.fail('list_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -622,7 +624,7 @@ module.exports = function provisioningRoutes() {
         open_intent: open ? { action: open.action, state: open.state } : null,
       });
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/instances/:id', err);
+      log.error('[provisioning] GET /provisioning/instances/:id', err);
       res.fail('read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -644,7 +646,7 @@ module.exports = function provisioningRoutes() {
       if (instanceAccessDenied(inst, req.builder)) return res.fail('instance_not_found', 404);
       res.json({ ok: true, settings: provisioning.effectiveSettings(inst), options: provisioning.SETTINGS_VOCAB });
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/instances/:id/settings', err);
+      log.error('[provisioning] GET /provisioning/instances/:id/settings', err);
       res.fail('settings_read_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -679,7 +681,7 @@ module.exports = function provisioningRoutes() {
       }).catch(() => {});
       res.json({ ok: true, settings: provisioning.effectiveSettings(updated) });
     } catch (err) {
-      console.error('[provisioning] PATCH /provisioning/instances/:id/settings', err);
+      log.error('[provisioning] PATCH /provisioning/instances/:id/settings', err);
       res.fail('settings_update_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -716,7 +718,7 @@ module.exports = function provisioningRoutes() {
       res.json({ ok: true, queued: r.created, action: 'teardown', status: inst.status, superseded: r.superseded,
         message: r.created ? 'Your instance will be torn down shortly.' : 'A teardown is already queued for that instance.' });
     } catch (err) {
-      console.error('[provisioning] POST /provisioning/instances/:id/teardown', err);
+      log.error('[provisioning] POST /provisioning/instances/:id/teardown', err);
       res.fail('teardown_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -841,7 +843,7 @@ module.exports = function provisioningRoutes() {
           ? 'Your instance is being wired to its new address — this card will show whether it answers.'
           : 'Address recorded — it will be wired when the instance is provisioned.' });
     } catch (err) {
-      console.error('[provisioning] POST /provisioning/instances/:id/domain', err);
+      log.error('[provisioning] POST /provisioning/instances/:id/domain', err);
       res.fail('domain_attach_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -899,7 +901,7 @@ module.exports = function provisioningRoutes() {
         expires_at: expiresAt,
       });
     } catch (err) {
-      console.error('[provisioning] POST /provisioning/instances/:id/github-app', err);
+      log.error('[provisioning] POST /provisioning/instances/:id/github-app', err);
       res.fail('github_app_manifest_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -955,7 +957,7 @@ module.exports = function provisioningRoutes() {
       const ok = await provisioning.isProvisionedHostname(pool, req.query.domain);
       return res.status(ok ? 200 : 404).json({ ok });
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/tls-check', err);
+      log.error('[provisioning] GET /provisioning/tls-check', err);
       return res.status(503).json({ ok: false, error: 'check_failed' });
     }
   });
@@ -989,7 +991,7 @@ module.exports = function provisioningRoutes() {
         app_slug: row.app_slug || null,
       });
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/github-app/status', err);
+      log.error('[provisioning] GET /provisioning/github-app/status', err);
       return res.status(500).json({ ok: false, error: 'status_check_failed' });
     }
   });
@@ -1039,7 +1041,7 @@ module.exports = function provisioningRoutes() {
         : callbackPage({ ok: true, title: 'GitHub app created',
           body: '<p>Nice — GitHub created the app. We’re placing its credentials on your instance now; this finishes on its own within a few minutes.</p><p class="muted">You can close this tab.</p>' }));
     } catch (err) {
-      console.error('[provisioning] GET /provisioning/github-app/callback', err);
+      log.error('[provisioning] GET /provisioning/github-app/callback', err);
       return sendPage(500, callbackPage({ ok: false, title: 'Something went wrong',
         body: '<p>We couldn’t record GitHub’s response. Try starting the sign-in setup again from your instance’s page.</p>' }));
     }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.337",
+  "version": "1.19.339",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.337",
+      "version": "1.19.339",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.337",
+  "version": "1.19.339",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -488,6 +488,12 @@ const KERNEL_FILES = [
   'src/bongos/goal-scope-check.js',          // goal create-gate scope wall (composes the 3 matchers above; ADR 0086 §3, BV1.R60)
   'src/bongos/secret-box.js',                // AES-256-GCM per-builder secret box
   'src/bongos/pool.js',                      // the singleton Postgres pool accessor
+  // task 1003208: the structured logger is kernel infrastructure in the same sense
+  // the pool is — src/module-api.js hands every module a child of it, so it sits
+  // BELOW the module boundary, not beside a domain. It imports only node built-ins
+  // and pino, so joining the roster costs nothing and buys the import-direction
+  // guarantee on the file every module now logs through.
+  'src/bongos/logger.js',                    // pino + request correlation + ADR 0022 redaction
   'src/bongos/db-kernel.js',                 // the kernel db slice — identity/audit/rank/withTx (BV1.R69)
   'src/bongos/routes/_helpers.js',           // shared request validators the doorway re-exports
   // config / identity (host context a module reads, never hardcodes)

package/src/bongos/auth-admission.js

@@ -29,6 +29,9 @@ const seams = require('../module-seams');
 const ic = require('../instance-config');
 const { branding, userAgent } = require('../branding');
 const { loadIdpConfig } = require('./auth-config.js');
+// task 1003208: structured logging — was console.*. A core file logs through
+// the kernel logger directly; only MODULES go via api.logger (the doorway).
+const log = require('./logger').logger.child({ src: 'auth-admission' });
 
 function membershipKind({ githubLogin } = {}) {
   const fa = firstAdminLogin();
@@ -70,7 +73,7 @@ async function reportMembershipCheckIn({ githubId, githubLogin, displayName, ava
       }),
     });
   } catch (err) {
-    console.log('[auth] hub membership check-in failed (non-blocking):', err.message);
+    log.info('[auth] hub membership check-in failed (non-blocking):', err.message);
   }
 }
 
@@ -107,7 +110,7 @@ async function reportActivityRollup({ builderId, githubId }) {
       }),
     });
   } catch (err) {
-    console.log('[auth] hub activity rollup failed (non-blocking):', err.message);
+    log.info('[auth] hub activity rollup failed (non-blocking):', err.message);
   }
 }
 
@@ -180,7 +183,7 @@ async function webAdmissionStatus(login) {
     // A DB hiccup must not turn the waiting page into a false "you're in".
     // Fail closed on `admitted`; still let a firstAdmin keep polling, since
     // that is the bootstrap window this page exists for.
-    console.error('[auth] webAdmissionStatus', err);
+    log.error('[auth] webAdmissionStatus', err);
     return { admitted: false, expectedSoon: isFirstAdmin };
   }
 
@@ -213,11 +216,11 @@ async function maybeSeatFirstAdmin(builder) {
   try {
     const seated = await seatFirstAdminIfUnclaimed(builder.id, builder.github_login);
     if (seated) {
-      console.log(`[auth] first-admin bootstrap: seated ${builder.github_login} as Archon (configured firstAdmin, no prior Archon).`);
+      log.info(`[auth] first-admin bootstrap: seated ${builder.github_login} as Archon (configured firstAdmin, no prior Archon).`);
       return { ...builder, rank: 'archon' };
     }
   } catch (err) {
-    console.error('[auth] first-admin bootstrap failed (non-fatal):', err.message);
+    log.error('[auth] first-admin bootstrap failed (non-fatal):', err.message);
   }
   return builder;
 }
@@ -246,7 +249,7 @@ async function safeSyncRankRole(builder) {
     await seams.resolveOptional('government.rankSync')
       ?.syncRank(null, { builderId: builder.id, rank: builder.rank });
   } catch (err) {
-    console.error('[auth] rank-role sync failed (non-fatal):', err.message);
+    log.error('[auth] rank-role sync failed (non-fatal):', err.message);
   }
 }
 

package/src/bongos/routes/auth.js

@@ -7,6 +7,9 @@ const { pairStore } = require('../app-pair');
 const { publicOrigin, parseCookie, validateOrRespond } = require('./_helpers');
 const { branding } = require('../../branding');
 const seams = require('../../module-seams');
+// task 1003208: structured logging — was console.*. A core file logs through
+// the kernel logger directly; only MODULES go via api.logger (the doorway).
+const log = require('../logger').logger.child({ src: 'auth' });
 
 function escapeHtml(s) {
   return String(s ?? '').replace(/[&<>"']/g, (c) => ({
@@ -358,7 +361,7 @@ module.exports = function buildAuthRouter() {
       const out = await auth.startDeviceFlow();
       res.json(out);
     } catch (err) {
-      console.error('[gds] device/start', err);
+      log.error('[gds] device/start', err);
       // Surface the underlying reason (task 2126). A thrown device-flow start is almost
       // always a GitHub OAuth-App misconfig (device_flow_disabled / bad client) — safe,
       // non-secret, and actionable — so return it instead of an opaque "internal error".
@@ -394,7 +397,7 @@ module.exports = function buildAuthRouter() {
       if (err && err.code === 'NOT_APPROVED') {
         return res.status(403).json({ state: 'not_approved', error: 'not_approved' });
       }
-      console.error('[gds] device/poll', err);
+      log.error('[gds] device/poll', err);
       // 424 for the same reason as device/start above (finding W2, task 1003052):
       // this catch proxies GitHub's poll refusals too, and a 5xx body never
       // survives Cloudflare — the JSON envelope (its code at minimum) must.
@@ -432,7 +435,7 @@ module.exports = function buildAuthRouter() {
       }
       // A bad / expired / forged / wrong-audience assertion is an auth failure (401),
       // not a server error — never mint a session for it.
-      console.error('[gds] /auth/device/exchange', err);
+      log.error('[gds] /auth/device/exchange', err);
       res.fail('invalid_assertion', { status: 401, message: String(err.message || 'invalid assertion').slice(0, 160) });
     }
   });
@@ -536,7 +539,7 @@ module.exports = function buildAuthRouter() {
       return res.json({ admitted: !!admitted });
     } catch (err) {
       // Fail closed and quietly — the page just keeps polling.
-      console.error('[gds] auth/web/admission-status', err);
+      log.error('[gds] auth/web/admission-status', err);
       return res.json({ admitted: false });
     }
   });
@@ -594,7 +597,7 @@ module.exports = function buildAuthRouter() {
         try {
           await db.upsertGithubToken({ builderId: builder.id, token: githubToken, scope: githubScope });
         } catch (e) {
-          console.error('[gds] web/callback: repo-token capture failed (non-blocking):', e.message);
+          log.error('[gds] web/callback: repo-token capture failed (non-blocking):', e.message);
         }
       }
       // The state cookie is apex-scoped now (#734) — clear it with the same
@@ -636,7 +639,7 @@ module.exports = function buildAuthRouter() {
         } catch (probeErr) {
           // Never let the classifier turn a clean 403 into a 500 — fall through
           // to the existing page, which is the safe answer for a stranger.
-          console.error('[gds] web/callback admission classify', probeErr);
+          log.error('[gds] web/callback admission classify', probeErr);
         }
         if (expectedSoon) {
           return res.status(202).type('text/html').send(renderAccessPendingPage(err.login, recoveryStartHref(req)));
@@ -657,7 +660,7 @@ module.exports = function buildAuthRouter() {
           },
         ));
       }
-      console.error('[gds] web/callback', err);
+      log.error('[gds] web/callback', err);
       res.status(500).type('text/html').send(renderAuthErrorPage(
         'The handshake threw an error',
         `The server tried to exchange the auth code for a session and something went wrong: ${err.message}. Try again; if it persists, ask the ${admitterLabel()} to investigate the server logs.`,
@@ -778,7 +781,7 @@ module.exports = function buildAuthRouter() {
           });
           joined = true;
         } catch (e) {
-          console.log('[gds] discord auto-join failed (non-blocking):', e.message);
+          log.info('[gds] discord auto-join failed (non-blocking):', e.message);
         }
       }
       // F5 role-sync belt-and-braces (ADR 0033 §4): set/repair the rank-role even
@@ -790,7 +793,7 @@ module.exports = function buildAuthRouter() {
       // callback returns there (settings.js surfaces the ?discord= toast).
       res.redirect(joined ? '/builders/settings?discord=joined' : '/builders/settings?discord=linked');
     } catch (err) {
-      console.error('[gds] discord/callback', err);
+      log.error('[gds] discord/callback', err);
       res.status(500).type('text/html').send(renderAuthErrorPage(
         'The Discord link threw an error',
         `Linking failed unexpectedly. Try again; if it persists, ask the ${admitterLabel()} to check the server logs.`,
@@ -814,13 +817,13 @@ module.exports = function buildAuthRouter() {
         )(null);
         if (guildId) {
           auth.removeDiscordGuildMember({ guildId, discordUserId: link.discord_user_id })
-            .then((r) => console.log(`[gds] discord unlink kick: ${r.removed ? 'removed' : r.reason}`))
-            .catch((e) => console.log('[gds] discord unlink kick failed (non-blocking):', e.message));
+            .then((r) => log.info(`[gds] discord unlink kick: ${r.removed ? 'removed' : r.reason}`))
+            .catch((e) => log.info('[gds] discord unlink kick failed (non-blocking):', e.message));
         }
       }
       res.json({ ok: true, unlinked: removed });
     } catch (err) {
-      console.error('[gds] discord/unlink', err);
+      log.error('[gds] discord/unlink', err);
       res.fail('unlink_failed', 500);
     }
   });
@@ -897,7 +900,7 @@ module.exports = function buildAuthRouter() {
       if (builder) await db.revokeAllSessionsForBuilder(builder.id);
       res.json({ ok: true });
     } catch (err) {
-      console.error('[gds] /auth/backchannel-logout revoke', err);
+      log.error('[gds] /auth/backchannel-logout revoke', err);
       res.fail('server_error', { status: 500, message: 'logout failed' });
     }
   });
@@ -941,7 +944,7 @@ module.exports = function buildAuthRouter() {
         paste_command: `node scripts/gds/paste-token.js ${token}`,
       });
     } catch (err) {
-      console.error('[gds] POST /auth/cli-token/issue', err);
+      log.error('[gds] POST /auth/cli-token/issue', err);
       res.fail('issue_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -968,7 +971,7 @@ module.exports = function buildAuthRouter() {
       const revoked = await db.revokeSessionById(id);
       res.json({ ok: true, revoked });
     } catch (err) {
-      console.error('[gds] POST /auth/revoke', err);
+      log.error('[gds] POST /auth/revoke', err);
       res.fail('revoke_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -995,7 +998,7 @@ module.exports = function buildAuthRouter() {
       const revoked = await db.revokeAllSessionsForBuilder(id);
       res.json({ ok: true, revoked });
     } catch (err) {
-      console.error('[gds] POST /auth/revoke-all', err);
+      log.error('[gds] POST /auth/revoke-all', err);
       res.fail('revoke_all_failed', { status: 500, message: 'internal error' });
     }
   });
@@ -1092,7 +1095,7 @@ module.exports = function buildAuthRouter() {
       }
       res.json({ ok: true });
     } catch (err) {
-      console.error('[gds] POST /auth/app-pair/approve', err);
+      log.error('[gds] POST /auth/app-pair/approve', err);
       res.fail('approve_failed', { status: 500, message: 'internal error' });
     }
   });