@bongos/core 1.19.47 → 1.19.49

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.47",
-  "core_contract": "1.19.47",
-  "source_commit": "db1b5f6d74e9840d6f87d3cf3c8c5a4b16f5a667",
+  "core_version": "1.19.49",
+  "core_contract": "1.19.49",
+  "source_commit": "fd920fff3c9a5107c7e7d198f6e09d04c5f66f5b",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T18:11:51.578Z",
+  "built_at": "2026-08-11T18:36:50.229Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 290,
+    "docs_redacted": 291,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1216,
+    "functional_verbatim": 1217,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1527,
-  "tree_sha256": "7183ad3d761a851cbc20b435a3b193c60c242e90bf4808ea3d0c68bbb798a1d0",
+  "file_count": 1529,
+  "tree_sha256": "94afa19b71a022c6b15c9ce95d71b3c76fe6ed87758e5b38dbfa259e7215ca5b",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1294,10 +1294,15 @@
       "mode": "0000644",
       "sha256": "64fb6e129cf5484266e1b6a9cddd8ba88ff7438b9646c3f4d9ffd0cda3cce642"
     },
+    {
+      "path": "docs/adr/0165-instances-hookless-by-default.md",
+      "mode": "0000644",
+      "sha256": "d422e10adc391127a7f39b9eb8b5927c149ee455402bc5e4641f55e8b31b2d15"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "ceb8639779cb8f8f43c261800607ff47b90a70489d8f5b5c7e8e0e2c5244bdb1"
+      "sha256": "09a7ba734571fbb304c60a488fe9ccdb6ca06d01127cfb87f07b1cbb54d69408"
     },
     {
       "path": "docs/api-reference.md",
@@ -1327,7 +1332,7 @@
     {
       "path": "docs/canonical-permissions.md",
       "mode": "0000644",
-      "sha256": "dd85972912629d370d8fc79eff1661001e6b4ba9abe9866181c14fb0782c3131"
+      "sha256": "b7f66c6f1fbed274e5ba3295c06db8fc8edb84edd44f6ce92f6734e18267e3d9"
     },
     {
       "path": "docs/design-contract.md",
@@ -2687,7 +2692,7 @@
     {
       "path": "modules/economy/achievements.js",
       "mode": "0000644",
-      "sha256": "a68a7a4a1fcb5fd8c0f0fb0e5ee7222ad69796dd3a74eabe080916c36c42892a"
+      "sha256": "387c37df8b65bab755e8f006722e6665d9e5aafea29eabf868d1e2dfc4720e99"
     },
     {
       "path": "modules/economy/cost-classify.js",
@@ -3447,7 +3452,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "ad57ad242956c6ee3dc4aeddd66e980af48737fab644765aa3c400720f4a9668"
+      "sha256": "3f7f65007955c419ccce1c89cb1f6da6eeca6daa8a76a738540db2858ebff4e6"
     },
     {
       "path": "modules/lifecycle/routes/analytics.js",
@@ -3472,7 +3477,7 @@
     {
       "path": "modules/lifecycle/routes/gate-approvals.js",
       "mode": "0000644",
-      "sha256": "e88256fd506eafbecde48704f6eee72141451f38107fa10630257a171122d67a"
+      "sha256": "e65687656da193f9d23b398a94061f927cfbf8a63b5263c7e6ee48c5ef50f6e5"
     },
     {
       "path": "modules/lifecycle/routes/goals.js",
@@ -4022,7 +4027,7 @@
     {
       "path": "modules/status-ui/public/status.js",
       "mode": "0000644",
-      "sha256": "7d21fcc9d685f12d90147008b8eb385d5b86c8c50ecd0347072c9aa9a2492f20"
+      "sha256": "bd0fcd32548c7b2cc7c6d36b0f31cba3e0575c95ff3dc85fdb15b11decbdfe42"
     },
     {
       "path": "modules/status-ui/public/style.css",
@@ -4032,12 +4037,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "c91ae553a7cd336d399c802db07c4aac4fb744633cf5c26a6da00a5c65b02a18"
+      "sha256": "7124698435e257f65256f4d3ab34277211b216cece5849b932368eccde73330f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cac25ff2006b5e47c3a22049068c6c155b3c9026860bda78a5c952996b050304"
+      "sha256": "16fecf0cf1d4f688f452ad27d37ba05776dd028444cd6cc9a2ab68deba3bb693"
     },
     {
       "path": "public-docs/index.html",
@@ -4457,7 +4462,7 @@
     {
       "path": "scripts/gds/audit-authorship.sh",
       "mode": "0000644",
-      "sha256": "eeeb1471e46e5b62ec95dd4d856ec2e6f48fd110f5a0ac86e6b0895d2aa0bfa8"
+      "sha256": "6922f6008c72db47855172fce7e40df0953575b7bead0504758648e2cf2859e9"
     },
     {
       "path": "scripts/gds/audit-deps.js",
@@ -5007,7 +5012,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "79c45444d67985ba0e6bc5e4d5cbff79f28a1490badf3bcfc7b39d8d1d47f7d5"
+      "sha256": "93a5c4a6d6f76cf1fa8ca4c902b19d6ef94f9147488f1c01d3413f692a196942"
     },
     {
       "path": "scripts/gds/publish-manifest.js",
@@ -5352,7 +5357,7 @@
     {
       "path": "scripts/setup-builder.sh",
       "mode": "0000644",
-      "sha256": "4bcbee9a407d41839b8dc01551cb580e86b2a387a9308db2d4da039ea762d9ff"
+      "sha256": "5860bf9daef3dd83a5ff4d3ee5e017e3cbd465ebda0c00df4ca622d629468ec4"
     },
     {
       "path": "scripts/snapshots/backfill-history.mjs",
@@ -5422,7 +5427,7 @@
     {
       "path": "src/bongos/auth.js",
       "mode": "0000644",
-      "sha256": "95428c88621510a97a5bfaf89a836508501b1db0f0910f529a260fa2dafce3b5"
+      "sha256": "a8215fa2659638d5850acb787eb3b193b18b545bc7e86f801764cab328b0c837"
     },
     {
       "path": "src/bongos/cascade-dispatch.js",
@@ -5597,7 +5602,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "62018ff2d9a9ed274a789c6141edce3dfe90a282f99f99965dcbf513e3f55037"
+      "sha256": "30be4d5a235cc704d4e1db264fb4e976ef6c614bc680fe90e05f3a199b62fd3d"
     },
     {
       "path": "src/bongos/routes/optimizer.js",
@@ -5657,7 +5662,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ac8f21f650da5da4f71f922b918e87bc5bfcf530c1b0b6210623bf7edd9433b0"
+      "sha256": "902071a6283cfb63ca5cc90c8ca201cd97e14490a380b4e4a51c231a89b02e3f"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -5854,6 +5859,11 @@
       "mode": "0000644",
       "sha256": "92b7033ab16d9d4472fcca4695d9df47938a45bdc62feda87b8771f5a2d59ff2"
     },
+    {
+      "path": "tests/authorship_audit.mjs",
+      "mode": "0000644",
+      "sha256": "4697e7e264023c148d1f18cac9695157de56b5dd3db4b60f2ab94d73a8d7af65"
+    },
     {
       "path": "tests/autonomous_fit_protected_paths.mjs",
       "mode": "0000644",

package/docs/adr/0165-instances-hookless-by-default.md

@@ -0,0 +1,40 @@
+# 0165 — Instances are hookless by default: no scaffolded `.husky/`; local hooks stay an instance-owned opt-in
+
+- **Status:** Accepted
+- **Date:** 2026-08-11
+- **Deciders:** Claude (jaxri session), under the bug-wave mandate — flagged owner-adjacent; the ADR is the revisit point
+
+**Track:** `internal` (provisioning / trust boundary). Task [1002641](https://cloudbongos.com/builders#/task/1002641), from idea 1000655. Relates to [ADR 0043](<redacted>.md) (Layer 1), [ADR 0055](<redacted>.md) (server-mediated publish), [ADR 0162](<redacted>.md) (CI-only gates).
+
+---
+
+## Context
+
+Task 1002608 delivered `.husky/pre-push` — the ADR 0043 **Layer 1** local permission gate — for **this core repo**, and `scripts/gds/install-git-hooks.js` (run by `/builder-setup`) activates whatever hooks a clone's `.husky/` tracks by setting `core.hooksPath`.
+
+But nothing delivers Layer 1 to a **scaffolded standalone instance**: `init.js` / `provision.js` / `onboard.js` materialize no `.husky/`, and `publish-manifest.js` excludes `.husky/` from the published core artifact **by design** (`PROTECTED_TOPOLOGY_EXCLUDE` — a core update must never silently rewrite an instance's local gate topology). So instances run with no pre-push permission gate and no pre-commit secrets hook. Task 1002641 asks: is that a gap to fill, or the accepted posture?
+
+## Decision
+
+**Hookless-by-default is the accepted posture for instances. Provisioning scaffolds no `.husky/`. Local hooks are an instance-owned opt-in: an instance that wants them commits its own `.husky/`, and the core's existing `install-git-hooks.js` activates them on every builder's machine.**
+
+Four structural reasons:
+
+1. **The population Layer 1 constrains holds no push credential on an instance.** Sub-Metic builders work dev boxes where the git origin is credential-less and landing goes through **server-mediated publish** (ADR 0053/0055): the box uploads a bundle, the *server* pushes and opens the PR. A client-side pre-push hook on the box guards a push that cannot happen. Metic+ builders with real push access are inside the trust boundary, and their pushes meet the server-side gates that actually enforce: branch protection, the required `unit` check (fitness, gate-review tests, the authorship gate — task 1002640), and the every-push `main-audit`.
+2. **A client hook is not a security boundary** (ADR 0016: the DB and server enforce; local edits grant nothing). On the core repo, `.husky/pre-push` is defense-in-depth for contributors with direct push access — a materially different population than instance builders. Scaffolding it onto instances would *look* like a control while a hostile clone deletes it in one command.
+3. **The core cannot maintain what it deliberately does not ship.** `.husky/` is `PROTECTED_TOPOLOGY_EXCLUDE`d from the artifact, so scaffolded hooks would be born orphans — no upgrade path, rotting silently until they misfire. A written control that no longer runs teaches builders to ignore controls (the audit-authorship lesson, task 1002640).
+4. **ADR 0162 (owner directive): gates live in CI, rank-consistent and hands-free.** Instance-side client gates re-introduce the blocked-builder friction class that ADR retired — a broken hook strands a legitimate land until a human intervenes.
+
+**Secrets hooks follow the same rule.** A pre-commit secrets guard needs per-machine tooling and gives false local confidence; the PR-time CI secret scan is the enforcing control on every land.
+
+**The opt-in stays real, and stays instance-owned.** `install-git-hooks.js` ships in the core and already runs at `/builder-setup` on every instance; it activates whatever `.husky/` the *instance's own repo* tracks. Policy (which hooks, if any) is the instance's; the activation mechanism is the core's. That split mirrors the branding contract (ADR 0062 §7).
+
+## Rejected
+
+- **Scaffold `.husky/` wrappers at `init`/provision** — orphaned gate topology the core can't update (reason 3), guarding a push path instance builders don't have (reason 1).
+- **An `init --with-hooks` flag** — speculative surface; no instance has asked. If one does, it composes trivially on the opt-in path above.
+- **Treating hooklessness as a security regression to hotfix** — the enforcing controls on instances are server-side and already in place; Layer 1 was always the advisory outermost layer, not the wall.
+
+## When to revisit
+
+An instance model where builders routinely push directly with their own credentials (no server-mediated publish, no branch protection) would remove reasons 1–2; revisit then.

package/docs/adr/README.md

@@ -237,5 +237,6 @@ This keeps the decision history honest and traceable.
 
 | 0163 | [**Pre-197 display names: a transitional 'legacy' source, resolved at first sign-in** ([task 1002643](https://cloudbongos.com/builders#/task/1002643); idea 1000659). Amends [ADR 0156](<redacted>.md), whose migration defaulted every pre-existing row to `'github'` — false for builders who renamed after their last sign-in but before 197 landed, so their names kept reverting. No audit trail exists to backfill precisely, so `core_214` marks every pre-197 `'github'` row `'legacy'` (scoped by 197's `applied_at` on the instance — portable) and the upsert resolves each at its first sign-in: stored = incoming GitHub name → provably GitHub-derived → `'github'`; differs → treated as builder-set → kept, stamped `'user'`. Accepted misclassification: a GitHub-side rename in the window freezes a stale label (visible, self-fixable in Settings) — preferred over silently destroying deliberate renames. Rejected: `display_name <> github_login` heuristic (freezes nearly everyone), comparing forever on all `'github'` rows (turns every future GitHub rename into a frozen name).](<redacted>.md) | GDS / builder experience |
 | 0164 | [**The implausible-pass guard reads substance + evidence; the Metic+ honor-system residual is explicit** ([task 1002658](https://cloudbongos.com/builders#/task/1002658); grader-hardening goal 1000056). The guard fired only on `issues.length===0` — one fabricated `{}` defeated it, its magnitude inputs are client-supplied, and every in-sample firing (eval 2-for-2, tasks 1002643 ×2, 1002663) was a false positive on an honest unanimous zero-issue panel PASS. Redesign: count only SUBSTANTIVE issues (known severity + non-empty summary — padding trips the guard regardless), and waive the zero-issue pass when `signals.workers` carries the full &ge;3-worker panel shape, stamped `implausible_pass_waived` for /grade-audit. The residual is named, not hidden: every grade-time input is client-authored, so plausibility at grade time is honest-mistake hygiene; the binding authorities on the real diff are land-time (CI unit, gate-review, main audit) — Metic+ grade-time honesty is accepted honor-system per this ADR. The ADR-0042 CI grade-gate (land it vs record permanent deferral) goes to the owner as a blocker, not decided here. No approval step added or removed (ADR 0162).](<redacted>.md) | GDS / grading |
+| 0165 | [**Instances are hookless by default: no scaffolded `.husky/`; local hooks stay an instance-owned opt-in** ([task 1002641](https://cloudbongos.com/builders#/task/1002641); idea 1000655). Task 1002608 delivered the ADR 0043 Layer 1 pre-push gate for the CORE repo, but nothing materializes `.husky/` on a scaffolded standalone instance (`publish-manifest.js` excludes it by design). Decision: that is the accepted posture, not a gap. Sub-Metic instance builders hold no push credential at all (server-mediated publish, ADR 0053/0055) — a client pre-push hook guards a push that cannot happen; a client hook is not a security boundary (ADR 0016); the core cannot maintain hooks it deliberately does not ship (scaffolded hooks would be born orphans — the audit-authorship rot lesson, task 1002640); and ADR 0162 puts gates in CI, rank-consistent and hands-free. Secrets hooks follow the same rule (the PR-time CI secret scan enforces). The opt-in stays real and instance-owned: an instance commits its own `.husky/` and the core's `install-git-hooks.js` (already run by `/builder-setup`) activates it. Rejected: scaffolding wrappers at init, an `--with-hooks` flag (speculative), treating hooklessness as a regression. Revisit if an instance model has builders pushing directly with their own credentials.](<redacted>.md) | provisioning / trust boundary |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/docs/canonical-permissions.md

@@ -265,7 +265,9 @@ pre-merge gate misses, independent of the builder's cooperation:
   [`src/bongos/permission-path-check.js`](../src/bongos/permission-path-check.js) (source of truth).
 - **Nobody pushes `main` directly.** The pre-push hook (`.husky/pre-push`, tracked in this repo and
   activated per-clone by `/builder-setup` via `install-git-hooks.js` — inert on a clone that never
-  activated it; ADR 0043 §"G-2/G-17 resolution") blocks it; the graded
+  activated it; ADR 0043 §"G-2/G-17 resolution") blocks it. This hook is a CORE-repo control:
+  scaffolded standalone instances are hookless by default — deliberate, not a gap
+  ([ADR 0165](adr/<redacted>.md)); the graded
   pipeline pushes only via `scripts/gds/push-main.js` (which carries the `OTB_ALLOW_MAIN_PUSH`
   override). A raw push is caught and reverted by the **post-push main audit**
   (`scripts/gds/main-audit.js`) — nightly and as the `~/deploy.sh` deploy gate — which is the
@@ -299,6 +301,6 @@ identity. Use `req.builder.*` server-side, the active session client-side, `$HOM
 - **Infra config, not impersonation:** the droplet's operational identity (`User=lars`,
   `lars@REDACTED_IP`, `/home/lars/example`, `lars@example.com`).
 - **Enforcement:** [`scripts/gds/audit-authorship.sh`](../scripts/gds/audit-authorship.sh) — exits 0
-  clean, exits 1 with a hit list + remediation hints if a new hardcode shows up. Hookable from CI /
-  pre-commit. Re-run after any change that touches identity surfaces; state was clean (0 hits) as of
-  the V3.R12 sweep.
+  clean, exits 1 with a hit list + remediation hints if a new hardcode shows up. Runs on every PR
+  inside the required `unit` check via `tests/authorship_audit.mjs` (task 1002640 — it previously had
+  no caller and its exclusions had rotted to 342 stale hits). State clean (0 hits) as of that rewire.

package/modules/economy/achievements.js

@@ -239,7 +239,7 @@ async function evaluateAfterCreditAward(client, builderId, totalBefore, totalAft
 // with grader_bypass on only ever unlocked first-claim (the claim path works).
 // And breaking-the-100c-bar was boundary-only (totalBefore<100 && totalAfter>=100)
 // on a credit branch the per-session cost-plus reward (ADR 0054) never hits, so
-// it fired for NOBODY — even lars589 at 22k credits. The whole board looked dead.
+// it fired for NOBODY — even the founding Archon at 22k credits. The whole board looked dead.
 //
 // reconcileBuilderAchievements evaluates every achievement against CURRENT DB
 // state and unlocks any the builder is eligible for but hasn't. It is:

package/modules/lifecycle/publish-reconciler.js

@@ -122,8 +122,8 @@ function couldBeStaleGenerated(m) {
 
 // task 1002461 — render the reconciler's operating target: which repo it resolved
 // and whether it holds a credential. This is the line that makes a WRONG repo bind
-// visible without owner access (the live failure: the hub bound
-// cloudbongos/cloudbongos-instance while the PRs were in lars589/cloud-bongos).
+// visible without owner access (the live failure: the hub bound the instance
+// repo while the PRs were in the core repo).
 // Pure — takes the resolved facts, returns the string — so the wording is
 // unit-tested without a boot.
 function describeTarget({ configured, repo } = {}) {

package/modules/lifecycle/routes/gate-approvals.js

@@ -4,7 +4,7 @@
 // WHY. The gate-review CI check (ADR 0058) clears an ESCALATE (hard floor) ONLY on
 // an owner approval, and a NEEDS_TRUST without a Metic+ author likewise blocks until
 // the owner approves. Historically that owner approval was a GitHub APPROVED review
-// by lars589 on the head sha — i.e. the owner had to leave a GitHub/terminal review.
+// by the repo owner on the head sha — i.e. the owner had to leave a GitHub/terminal review.
 // This router gives Archons a browser-only equivalent (feedback: auth flows must be
 // UI-first), trust-consistent with the existing server-set `gate-author-trust`
 // status: the server re-checks the caller's Archon rank server-side (ADR 0016) and

package/modules/status-ui/public/status.js

@@ -4,7 +4,7 @@
 // API base for the public read endpoints (#737). Empty = same-origin, the case
 // when this file is served by the droplet itself (status.amazonprimea.com
 // proxies /api/* to the same Node process). The OFF-BOX GitHub Pages mirror
-// (lars589/amazonprimea-status, ADR 0029) injects window.STATUS_API_BASE =
+// (the owner's status-mirror repo, ADR 0029) injects window.STATUS_API_BASE =
 // 'https://amazonprimea.com' in its <head> so the same byte-identical file
 // fetches cross-origin from the droplet there (CORS is open). Keeping this file
 // identical on both hosts is what lets the mirror sync be a pure copy.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.47",
+  "version": "1.19.49",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.47",
+      "version": "1.19.49",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.47",
+  "version": "1.19.49",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/audit-authorship.sh

@@ -34,14 +34,24 @@
 #   * GitHub remote `lars589/amazonprimea` — actual repo owner; cloning
 #     anything else would clone a different project.
 #   * Comments that document who decided something or who originally ran a
-#     one-time backfill — historical decision-attribution.
+#     one-time backfill — historical decision-attribution. Allowlisted
+#     PER FILE below (a content-level "looks like a comment" filter would
+#     also match live code — a JS private class field, a //host literal —
+#     so it could be gamed; file entries with justifications can't).
+#   * Test data that pins a real contract, allowlisted PER FILE below: owner
+#     approval RECORDS the Archon's login, the terminal-URL guard validates
+#     term-<login> hostnames — identity in an assertion is the contract.
+#     New test files are still scanned (no blanket tests/ exclusion).
+#   * Sample API payloads (fixtures/) and gitignored build output (dist/).
 #
 # Usage:
 #   bash scripts/gds/audit-authorship.sh           # check, exit 1 on new hits
 #   bash scripts/gds/audit-authorship.sh --verbose # print every hit (incl.
 #                                                  # allowlisted) for review
 #
-# Hookable from CI / pre-commit. No writes, no network.
+# CI lane: tests/authorship_audit.mjs runs this inside the required `unit`
+# check (task 1002640 — it previously had no caller and 342 stale hits).
+# No writes, no network.
 
 set -uo pipefail
 
@@ -72,6 +82,10 @@ done
 EXCLUDE_DIRS=(
   --exclude-dir=node_modules
   --exclude-dir=.git
+  --exclude-dir=dist               # gitignored build/package output (a stale
+                                   # core tarball tree re-reports every hit in
+                                   # it — task 1002640); grep -R walks the
+                                   # filesystem, not the git index.
   --exclude-dir=iterations         # under art/, historical cost ledger
   --exclude-dir=generated          # under art/, generated PNGs / metadata
   --exclude-dir=docs               # human prose: ADRs, recipes, plans,
@@ -79,6 +93,9 @@ EXCLUDE_DIRS=(
                                    # naming the founder by intent
   --exclude-dir=blockers           # blockers ARE the things stuck on Lars
   --exclude-dir=limitations        # archives + scope-truth docs
+  --exclude-dir=fixtures           # sample API payloads (hall-preview) mirror
+                                   # real prod rows, which name real builders —
+                                   # frozen sample data, not runtime code.
   --exclude-dir=worktrees          # .claude/worktrees/ holds N full repo
                                    # copies (one per builder worktree); from
                                    # the main checkout, recursing them is slow
@@ -151,6 +168,53 @@ ALLOWLIST=(
   # leaks in setup.js — the string appearing in the comment IS the
   # specification of what's forbidden in implementation code.
   'tests/setup_smoke.mjs'
+
+  # Test DATA that pins a real contract (task 1002640) — identity in an
+  # assertion IS the contract, not a mis-attribution: owner approval RECORDS
+  # the Archon's login (gate_approvals), the terminal-URL SSRF guard validates
+  # term-<login> hostnames (box_terminal_ssrf), packaging/provisioning tests
+  # exercise the real repo owner + the mirror-redaction floor. Listed per file
+  # (never a blanket tests/ exclusion) so a NEW test file is still scanned.
+  'tests/provision.mjs'
+  'tests/package_core.mjs'
+  'tests/init.mjs'
+  'tests/box_terminal_ssrf.mjs'
+  'tests/gate_approvals.mjs'
+  'tests/publish_reconciler.mjs'
+  'tests/dev_lib.mjs'
+  'tests/ship_card.mjs'
+  'tests/scrubber_corpus.mjs'
+  'tests/module_submissions.mjs'
+  'tests/boxes.mjs'
+  'tests/provisioning_onboard_mode.mjs'
+  'tests/instance_manifest.mjs'
+  'tests/bongos_downloads.mjs'
+  'tests/status_mirror_sync.mjs'
+  'tests/search_isolation.mjs'
+  'tests/grade_aggregates_unavailable.mjs'
+  'tests/first_admin_bootstrap.mjs'
+  'tests/discord_approvals.mjs'
+  'tests/currency_label.mjs'
+  'tests/cloud_bongos_pack.mjs'
+  'tests/bump_version.mjs'
+  'tests/box_scope_session.mjs'
+  'tests/auth_inactive_builder.mjs'
+  'tests/auth_anthropic_identity.mjs'
+  'modules/dev-box/app/test/unit.mjs'
+
+  # The public landing page links the open-source repo by URL — repo-hosting
+  # identity (the provision-staging.sh class), not a builder identity.
+  'public-landing/create.html'
+
+  # The mirror-redaction floor: PRIOR_INSTANCE_FLOOR carries the prior
+  # instance's owner literal precisely so packaging can SCRUB it from every
+  # published core — the anti-leak spec, not a runtime hardcode (task 1002640).
+  'scripts/gds/package-core.js'
+
+  # Frozen seed script — a task DESCRIPTION quotes migration 023's founding-
+  # Archon literal as the thing that task exists to remove (the
+  # seed-v3-tasks.js class: stripping it would lose the task history).
+  'scripts/gds/seed-medusa-tasks.js'
 )
 
 # ----------------------------------------------------------------------------
@@ -212,7 +276,11 @@ else
 fi
 
 # Apply operational-identity + spec-string pattern allowlists (both match on
-# line content, not file path).
+# line content, not file path). NB deliberately NO comment-line filter: a
+# content pattern like `^\s*(//|#)` also matches live code (a JS private class
+# field `#name = ...`, a protocol-relative `//host` continuation line), so a
+# real hardcode could dress as a comment to slip through. Historical-
+# attribution comments get per-file ALLOWLIST entries instead (task 1002640).
 grep -vE "$OPS_ALLOWLIST_PATTERN" "$TMP_HITS" \
   | grep -vE "$SPEC_ALLOWLIST_PATTERN" > "$TMP_FILTERED" || true
 

package/scripts/gds/provision.js

@@ -851,7 +851,7 @@ ${prefix}_OAUTH_ORIGIN=${origin}
   // <prefix>_FIRST_ADMIN before branding.firstAdmin). WITHOUT it a provisioned instance
   // has NO owner — first sign-in is refused / lands rankless and the owner can never
   // claim their own instance (goal 35 / criterion 165 regression, caught live 2026-07-07:
-  // demo had every origin override but no FIRST_ADMIN, so lars589 could not be seated).
+  // demo had every origin override but no FIRST_ADMIN, so the owner could not be seated).
   // Derived from the instance repo owner (target_ref = "<owner>/<repo>"), the SAME source
   // instanceInitSpec uses for the scaffold's branding.firstAdmin — so this env override and
   // the scaffolded config/branding.json agree. (Org-owned repo: the org login is not a

package/scripts/setup-builder.sh

@@ -14,15 +14,15 @@
 #   ./scripts/setup-builder.sh [--skip-keys] [--no-auth] [--help]
 #
 # Run this from INSIDE a clone of the repo. If you don't have the code yet,
-# do "Step 0 — get the project onto your machine" first (see README.md):
-#   git clone https://github.com/lars589/amazonprimea.git && cd amazonprimea
+# do "Step 0 — get the project onto your machine" first (see README.md) —
+# clone YOUR instance's repo, then cd into it.
 set -uo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # Guard: this shim must run from inside the repo (where setup-builder.js lives).
 if [ ! -f "$SCRIPT_DIR/setup-builder.js" ]; then
   echo "setup-builder: can't find setup-builder.js next to this script." >&2
   echo "Did you clone the repo and cd into it? See README.md 'Step 0 — get the project onto your machine'." >&2
-  echo "  git clone https://github.com/lars589/amazonprimea.git && cd amazonprimea" >&2
+  echo "  (clone YOUR instance's repo, then cd into it and re-run this script)" >&2
   exit 1
 fi
 exec node "$SCRIPT_DIR/setup-builder.js" "$@"

package/src/bongos/auth.js

@@ -63,7 +63,7 @@ const SCOPE = 'read:user';
 // support is needed". It is needed. `public_repo` grants write to PUBLIC repos
 // only, so ADOPTING an existing PRIVATE repo dies at the provisioner's scaffold
 // push with GitHub 403 "Write access to repository not granted" — observed live on
-// lars589/hermeslines-marketing. ADR 0155 takes the reversal at the owner's
+// a private repo of the owner's. ADR 0155 takes the reversal at the owner's
 // explicit call, accepting the cost it names: a token we persist can now write to
 // EVERY repo the user owns, not just their public ones.
 const REPO_SCOPE = 'repo';

package/src/bongos/routes/modules.js

@@ -65,7 +65,7 @@ function ownProjectName() {
   try { return require('../../branding').branding().identity.productName; } catch { return null; }
 }
 
-// "owner/name", e.g. "lars589/amazonprimea" — the provenance a submission
+// "owner/name", e.g. "some-owner/their-repo" — the provenance a submission
 // carries (ADR 0107 §2: attribution/provenance travels WITH the module as a
 // portable record, not a cross-GDS link). null if the branding pack has none.
 function sourceRepoLabel() {

package/src/module-api.js

@@ -521,8 +521,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.45 with no explicit bump. run 31520432748. (task 1002620)
 //   1.19.47 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.46 with no explicit bump. run 31521404176. (task 1002620)
+//   1.19.48 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.47 with no explicit bump. run 31522865111. (task 1002620)
+//   1.19.49 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.48 with no explicit bump. run 31523559509. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.47'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.49'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/authorship_audit.mjs

@@ -0,0 +1,44 @@
+// tests/authorship_audit.mjs — the no-hardcoded-Archon-identity gate (task 1002640).
+//
+// scripts/gds/audit-authorship.sh (named as THE enforcement in
+// docs/canonical-permissions.md) had no caller — no CI lane, no test, no skill
+// — and 342 stale hits on a clean tree. This test makes it a real gate: it runs
+// inside the required `unit` check, so a new hardcoded founder-identity
+// reference in implementation code fails the PR. The script is local-only (grep
+// over the tree — no DB, no network). Fail-open only where the RUNTIME is
+// missing: a builder machine without bash on PATH (the gen-diagrams render-step
+// precedent) skips with a warning; Linux CI always has bash, so the gate is
+// always live where it matters.
+
+import { strict as assert } from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const REPO = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SCRIPT = path.join(REPO, 'scripts', 'gds', 'audit-authorship.sh');
+const SPAWN_TIMEOUT_MS = 75_000; // under run-unit-tests' 90s cap
+
+const r = spawnSync('bash', [SCRIPT], {
+  cwd: REPO,
+  encoding: 'utf8',
+  timeout: SPAWN_TIMEOUT_MS,
+  maxBuffer: 8 * 1024 * 1024,
+});
+
+if (r.error && r.error.code === 'ENOENT') {
+  console.warn('authorship_audit: bash not on PATH — skipping (the gate runs on Linux CI; a bash-less builder box cannot run a .sh).');
+  process.exit(0);
+}
+
+// NO timeout fail-open: the audit is local-only (grep over the tree — no DB,
+// no network), so unlike an infra-dependent check there is no innocent reason
+// for it to hang; a diff engineered to make the scan slow must FAIL the gate,
+// not slip through it. spawnSync's ETIMEDOUT falls through to the assertions.
+assert.equal(r.error, undefined, `audit-authorship.sh failed to run: ${r.error && r.error.message}`);
+assert.equal(
+  r.status,
+  0,
+  `audit-authorship.sh found hardcoded founder-identity references in implementation code:\n${r.stdout}\n${r.stderr}`
+);
+console.log('authorship_audit: clean — no hardcoded Archon-identity references in implementation code.');