@bongos/core 1.19.653 → 1.19.655

package/src/bongos/serve-internal.js

@@ -51,7 +51,7 @@ const { stealthGate } = require('./stealth-gate');
 const { platformVisibilityGate } = require('./platform-visibility-gate');
 const { clientModules, isModuleEnabled } = require('../modules');
 const { hallWidgetScripts, moduleWebSurfaces } = require('../module-loader/loader');
-const { resolveCoreRoot, resolveDocsRoot, resolveInstanceRoot } = require('../instance-config');
+const { resolveCoreRoot, resolveDocsRoot, resolveInstanceRoot, resolveEnv } = require('../instance-config');
 const { API_PREFIX, LEGACY_API_PREFIXES, API_VERSION, VERSIONED_API_PREFIX, ALL_API_PREFIXES } = require('./api-prefix');
 
 // ADR 0108 §1: every use of ROOT below (infra/ installers, modules/, docs/) is
@@ -640,7 +640,7 @@ function mountInternalSurfaces(app) {
     // Pinned public origin for the served installer scripts (never a request header —
     // a spoofed Host can't redirect a `curl | sh`). The fallback comes from the
     // branding pack, not a hardcoded host brand (ADR 0062 §3).
-    const BONGOS_PUBLIC_ORIGIN = process.env.GDS_PUBLIC_ORIGIN || branding().domains.publicOrigin;
+    const BONGOS_PUBLIC_ORIGIN = resolveEnv('PUBLIC_ORIGIN') || branding().domains.publicOrigin;
     const readBongosInstallScript = (name) => {
       try {
         return fs.readFileSync(path.join(ROOT, 'infra', name), 'utf8').split('__GDS_API_BASE__').join(BONGOS_PUBLIC_ORIGIN);

package/src/branding.js

@@ -18,7 +18,7 @@
 
 const fs = require('node:fs');
 const path = require('node:path');
-const { resolveCoreRoot, resolveInstanceRoot } = require('./instance-config');
+const { resolveCoreRoot, resolveInstanceRoot, resolveEnv, FALLBACK_ENV_PREFIX } = require('./instance-config');
 
 // ADR 0108 §1: the neutral starter ships WITH the core package; the instance
 // pack is host content. Both resolvers return the repo root today, so this is
@@ -106,9 +106,15 @@ function resolveBranding({ neutral = {}, instance = {}, env = {} } = {}) {
   // neutral/instance inputs — otherwise the deepFreeze below would also freeze
   // the caller's input objects (deepMerge shallow-copies only the top level).
   const resolved = structuredClone(deepMerge(neutral, instance));
-  const prefix = resolved.envPrefix || 'CLOUDBONGOS';
+  const prefix = resolved.envPrefix || FALLBACK_ENV_PREFIX;
   for (const [suffix, p, coerce] of ENV_OVERRIDES) {
-    const v = env[`${prefix}_${suffix}`];
+    // resolveEnv, not a bare env[] read: these overrides are set OUTSIDE the repo
+    // (/etc/cloudbongos/web.env, systemd units, the provisioning runner), so when
+    // task 1003703 moved the canonical prefix from CLOUDBONGOS_ to BONGOS_ a
+    // direct read would have silently stopped honoring every already-deployed
+    // CLOUDBONGOS_PUBLIC_ORIGIN — an origin regression with no error, found only
+    // by a broken OAuth callback. The legacy spellings warn once each instead.
+    const v = resolveEnv(suffix, { env, prefix });
     if (v === undefined || v === '') continue;
     // Most overrides are string-valued (origins, cookie domain) and set verbatim. A
     // 'bool'-tagged override (auth.idp) coerces the env string to a real boolean —
@@ -139,15 +145,26 @@ function readJson(p) {
 // OTB on the apex (server.js, the committed config/branding.json) and a vanilla
 // Cloud Bongos process pointed at its own pack (config/branding.cloudbongos.json)
 // — differentiated only by env, with no divergent clone to maintain. The loader
-// runs before the resolved envPrefix is known, so this is a FIXED env name (like
-// auth.js's GDS_PUBLIC_ORIGIN), not a <PREFIX>_ one. A relative path resolves
-// against the repo root.
+// runs before the resolved envPrefix is known, so this is a FIXED env name, not
+// a <PREFIX>_ one — which is exactly why it cannot go through resolveEnv() and
+// needs the two spellings listed by hand here. A relative path resolves against
+// the repo root.
+//
+// BONGOS_BRANDING_FILE is canonical since task 1003703; GDS_BRANDING_FILE is
+// still read (one deprecation warning per process) because it is set outside the
+// repo — the hall-preview server, CI jobs and side-by-side dev processes all
+// export it. Task 1003706 retires the old spelling.
 function loadBranding({ neutralPath = NEUTRAL_PATH, instancePath, env = process.env } = {}) {
   const neutral = readJson(neutralPath);
   if (!neutral) throw new Error(`branding: neutral starter not found at ${neutralPath}`);
   let ip = instancePath;
   if (ip === undefined) {
-    const override = env.GDS_BRANDING_FILE;
+    // prefix pinned to FALLBACK_ENV_PREFIX, not envPrefix(): this read happens
+    // BEFORE the pack that would name the prefix can be loaded, so the canonical
+    // spelling has to be a fixed one. Same pin, same reason, as
+    // resolveInstanceRootExplicit(). The legacy prefixes still resolve, which is
+    // what keeps every already-deployed GDS_BRANDING_FILE working.
+    const override = resolveEnv('BRANDING_FILE', { env, prefix: FALLBACK_ENV_PREFIX });
     ip = override ? path.resolve(resolveInstanceRoot(), override) : INSTANCE_PATH;
   }
   const instance = readJson(ip) || {};

package/src/instance-config.js

@@ -21,7 +21,11 @@ const path = require('node:path');
 
 // Last-resort default if branding can't be read at all (vanilla, never OTB).
 const FALLBACK_DIR = 'cloudbongos';
-const FALLBACK_ENV_PREFIX = 'CLOUDBONGOS';
+// BONGOS is the CANONICAL env prefix (task 1003703 / criterion C3 of goal
+// 1000073). It was CLOUDBONGOS until then; that spelling moved into
+// LEGACY_ENV_PREFIXES below rather than being dropped, so a vanilla instance
+// already exporting CLOUDBONGOS_* keeps resolving.
+const FALLBACK_ENV_PREFIX = 'BONGOS';
 
 // Historical hard-coded config dir — always also checked on READ so a session /
 // ledger / key written before R61 (or by an instance that later changed its
@@ -30,8 +34,24 @@ const LEGACY_DIRS = ['otb'];
 
 // Legacy env prefixes tried (in order) AFTER the configured one. These cover the
 // three prefixes that coexisted pre-R61 (OTB_ operational, GDS_ API/auth, PMS_
-// the original name). Keeping them means prod's existing env is honored verbatim.
-const LEGACY_ENV_PREFIXES = ['OTB', 'GDS', 'PMS'];
+// the original name) plus CLOUDBONGOS_, which was the canonical default until
+// task 1003703 made it BONGOS_. Keeping them means prod's existing env is
+// honored verbatim.
+//
+// WHY THESE MUST OUTLIVE THIS TASK: these names are set OUTSIDE the repo —
+// /etc/cloudbongos/web.env on the droplet, systemd units, CI secrets, shipped
+// Dev Box binaries, live dev boxes. Deleting a spelling here is an outage the
+// next time one of those restarts. Task 1003706 (C3d) retires them deliberately,
+// after evidence — and asserts their ABSENCE, which is why the fallback needs a
+// test that it FIRES rather than one that merely tolerates it.
+const LEGACY_ENV_PREFIXES = ['CLOUDBONGOS', 'OTB', 'GDS', 'PMS'];
+
+// The core release in which the legacy prefixes above stop being read. Named in
+// every deprecation warning so an operator learns the deadline from the warning
+// itself rather than from a changelog they will not read. This lands in 1.19.x,
+// so 1.21 leaves a full minor of overlap; task 1003706 is the task that both
+// removes the fallback and moves this constant's meaning to "already gone".
+const LEGACY_ENV_SUNSET_RELEASE = '1.21';
 
 // Lazy require (ADR 0108 §1 made this a two-way edge: branding.js now requires
 // resolveCoreRoot()/resolveInstanceRoot() from this module, so a top-level
@@ -135,21 +155,62 @@ function readConfigFileSync(name, { encoding = 'utf8', b = safeBrand() } = {}) {
 }
 
 // Resolve an env var by SUFFIX across the configured prefix + legacy prefixes.
-// resolveEnv('API_BASE') tries <PREFIX>_API_BASE (CLOUDBONGOS_ on vanilla, OTB_
-// on the OTB instance), then OTB_/GDS_/PMS_API_BASE. Returns undefined if none
-// is set to a non-empty value. `extraLegacy` prepends suffix-specific aliases
-// (rare — e.g. a var that had an idiosyncratic legacy name).
-function resolveEnv(suffix, { env = process.env, prefix = envPrefix(), legacy = LEGACY_ENV_PREFIXES } = {}) {
-  const seen = new Set();
-  for (const pfx of [prefix, ...legacy]) {
+// resolveEnv('API_BASE') tries <PREFIX>_API_BASE (BONGOS_ on vanilla, OTB_ on
+// the OTB instance), then CLOUDBONGOS_/OTB_/GDS_/PMS_API_BASE. Returns undefined
+// if none is set to a non-empty value.
+//
+// THE CANONICAL SPELLING ALWAYS WINS, including over a legacy one set to a
+// different value — an operator mid-migration who sets the new name expects it
+// to take effect, and silently preferring the old one would make the rename
+// untestable. Each legacy name that is READ (won or shadowed) emits ONE warning
+// per process naming the old spelling, the new one, and the release the old
+// stops working in; see warnLegacyEnv below. `warn` is injectable so a test can
+// assert the warning fires rather than only that the value resolves.
+function resolveEnv(suffix, { env = process.env, prefix = envPrefix(), legacy = LEGACY_ENV_PREFIXES, warn = warnLegacyEnv } = {}) {
+  const canonical = `${prefix}_${suffix}`;
+  const canonicalValue = prefix ? env[canonical] : undefined;
+  const canonicalSet = canonicalValue !== undefined && canonicalValue !== '';
+  // Every legacy spelling is visited even when the canonical one already won —
+  // a spelling that is merely SHADOWED is still set on some box, and it will
+  // stop being read at the sunset, so it earns its one warning too. Warning only
+  // on the winner would leave the "both set" operator with no notice at all.
+  const seen = new Set([prefix].filter(Boolean));
+  let winner = canonicalSet ? canonicalValue : undefined;
+  for (const pfx of legacy) {
     if (!pfx || seen.has(pfx)) continue;
     seen.add(pfx);
-    const v = env[`${pfx}_${suffix}`];
-    if (v !== undefined && v !== '') return v;
+    const name = `${pfx}_${suffix}`;
+    const v = env[name];
+    if (v === undefined || v === '') continue;
+    warn({ legacyName: name, canonicalName: canonical, shadowed: canonicalSet, differs: canonicalSet && canonicalValue !== v });
+    if (winner === undefined) winner = v;
   }
-  return undefined;
+  return winner;
 }
 
+// One warning per legacy env NAME per process. A silent fallback is how an old
+// spelling survives forever — but a warning per READ would drown a CLI that
+// resolves the same knob in a loop, so the emitted set is the dedupe key.
+const _legacyEnvWarned = new Set();
+
+function warnLegacyEnv({ legacyName, canonicalName, shadowed, differs, log = console } = {}) {
+  if (_legacyEnvWarned.has(legacyName)) return false;
+  _legacyEnvWarned.add(legacyName);
+  const fate = differs
+    ? `${canonicalName} is ALSO set to a different value and WINS`
+    : shadowed
+      ? `${canonicalName} is also set and wins`
+      : `rename it to ${canonicalName}`;
+  log.warn(`[bongos] deprecated env ${legacyName} — ${fate}. The legacy spelling stops being read in core ${LEGACY_ENV_SUNSET_RELEASE}.`);
+  return true;
+}
+
+// NOT exported, deliberately: warnLegacyEnv, LEGACY_ENV_SUNSET_RELEASE and the
+// ledger are internals. resolveEnv's injectable `warn` is the whole test seam a
+// caller needs, and a test of the DEFAULT path captures console.warn — which
+// exercises the real wiring rather than a hand-called helper. Exporting them
+// would also add three untraceable entries to the knip dead-code ratchet.
+
 // resolveCoreRoot() / resolveInstanceRoot() — the ADR 0108 §1 configurable-root
 // resolvers, extending this module's established zero-risk pattern from
 // ~/.config to the in-repo roots. Two OPPOSITE directions, both load-bearing:

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.653'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.655'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/modules.js

@@ -27,7 +27,7 @@ const path = require('node:path');
 // resolver below spans built-in + discovered modules (ADR 0083 / BV1.R41). Empty
 // until a module is moved into modules/ — so this is a no-op on the current tree.
 const loader = require('./module-loader/loader');
-const { resolveCoreRoot, resolveInstanceRoot } = require('./instance-config');
+const { resolveCoreRoot, resolveInstanceRoot, resolveEnv, FALLBACK_ENV_PREFIX } = require('./instance-config');
 const { responsibilitiesFor } = require('./role-responsibilities');
 
 // ADR 0108 §1: the neutral starter ships WITH the core package; the instance
@@ -121,7 +121,7 @@ function coerceBool(v) {
 // Pure resolver — all inputs injected, so tests drive it with zero I/O.
 // Returns a frozen { <moduleKey>: boolean } covering EVERY registry key, plus a
 // non-enumerable resolution that throws on an unknown module key (typo guard).
-function resolveModules({ neutral = {}, instance = {}, env = {}, envPrefix = 'CLOUDBONGOS', registry = MODULE_REGISTRY } = {}) {
+function resolveModules({ neutral = {}, instance = {}, env = {}, envPrefix = FALLBACK_ENV_PREFIX, registry = MODULE_REGISTRY } = {}) {
   // The known-key set + defaults come from the passed registry: callers inject
   // the built-in MODULE_REGISTRY (the default, what the pure unit tests use) or
   // the effective built-in+discovered registry (what loadModules passes). This
@@ -157,8 +157,12 @@ function resolveModules({ neutral = {}, instance = {}, env = {}, envPrefix = 'CL
   // Env overrides: <PREFIX>_MODULE_<KEY> where KEY is upper-snake of the module
   // name (dev-box -> DEV_BOX). Highest precedence.
   for (const key of known) {
-    const envName = `${envPrefix}_MODULE_${key.toUpperCase().replace(/-/g, '_')}`;
-    const raw = env[envName];
+    const suffix = `MODULE_${key.toUpperCase().replace(/-/g, '_')}`;
+    const envName = `${envPrefix}_${suffix}`;
+    // resolveEnv, not env[envName]: a provisioned instance sets these per box
+    // (provision-units.js writes them into the systemd unit), so the pre-rename
+    // spelling must keep switching the same module off. Warns once per legacy name.
+    const raw = resolveEnv(suffix, { env, prefix: envPrefix });
     if (raw !== undefined && raw !== '') {
       const b = coerceBool(raw);
       if (b === undefined) throw new Error(`modules: ${envName}="${raw}" is not a boolean (use 1/0, on/off, true/false)`);
@@ -203,14 +207,18 @@ function loadModules({ neutralPath = NEUTRAL_PATH, instancePath, env = process.e
   const neutral = readJson(neutralPath) || {};
   let ip = instancePath;
   if (ip === undefined) {
-    const override = env.GDS_MODULES_FILE;
+    // Canonical spelling pinned to FALLBACK_ENV_PREFIX for the same reason as
+    // branding's selector — read before the pack that names the prefix. The
+    // legacy prefixes still resolve (one warning each), so an already-deployed
+    // GDS_MODULES_FILE / GDS_BRANDING_FILE keeps selecting the same pack.
+    const override = resolveEnv('MODULES_FILE', { env, prefix: FALLBACK_ENV_PREFIX });
     if (override) ip = path.resolve(resolveInstanceRoot(), override);
-    else if (env.GDS_BRANDING_FILE) ip = NEUTRAL_PATH;
+    else if (resolveEnv('BRANDING_FILE', { env, prefix: FALLBACK_ENV_PREFIX })) ip = NEUTRAL_PATH;
     else ip = INSTANCE_PATH;
   }
   const instance = readJson(ip) || {};
   // Reuse the branding env prefix so an instance has ONE prefix, not two.
-  let envPrefix = 'CLOUDBONGOS';
+  let envPrefix = FALLBACK_ENV_PREFIX;
   try { envPrefix = require('./branding').branding().envPrefix || envPrefix; } catch { /* fail-to-default */ }
   // Resolve against the EFFECTIVE registry (built-in + discovered) so a config
   // flag for a discovered module is honored. No-op until a module exists.

package/tests/claude_materialize.mjs

@@ -466,7 +466,7 @@ t('materializeClaude: copied hooks carry NO founder origin/config-dir; a disable
   const dir = mkdtempSync(join(tmpdir(), 'rb-e2e-'));
   // Target instance: demo-branded, art-pipeline OFF (so its otb-* skills must be dropped).
   mkdirSync(join(dir, 'config'), { recursive: true });
-  writeFileSync(join(dir, 'config', 'branding.json'), JSON.stringify({ domains: { publicOrigin: 'https://demo.cloudbongos.com', buildersOrigin: 'https://demo.cloudbongos.com', statusOrigin: 'https://demo.cloudbongos.com', oauthOrigin: 'https://demo.cloudbongos.com' }, configDir: 'cloudbongos', envPrefix: 'CLOUDBONGOS' }));
+  writeFileSync(join(dir, 'config', 'branding.json'), JSON.stringify({ domains: { publicOrigin: 'https://demo.cloudbongos.com', buildersOrigin: 'https://demo.cloudbongos.com', statusOrigin: 'https://demo.cloudbongos.com', oauthOrigin: 'https://demo.cloudbongos.com' }, configDir: 'cloudbongos', envPrefix: 'BONGOS' }));
   writeFileSync(join(dir, 'config', 'modules.json'), JSON.stringify({ modules: { 'art-pipeline': false } }));
   const res = m.materializeClaude({ coreRoot: ROOT, instanceDir: dir, dryRun: false });
   // Founder core → demo: a branding delta exists and rules are built. The NEUTRAL

package/tests/cli_exit_no_abort.mjs

@@ -1,6 +1,13 @@
 // tests/cli_exit_no_abort.mjs — the GDS CLIs must not abort natively on exit
 // (task 1002734; the pre-push twin of this is tests/pre_push_hook.mjs, task 1002725).
 //
+// Guards api.js AND main-audit.js (task 1003772). main-audit --verify-head IS the
+// deploy gate (infra/deploy.sh calls it so a poisoned main never reaches
+// production), so there the destroyed exit code is not cosmetic: the abort fires
+// AFTER the verdict prints, and a caller reading the code cannot tell a clean
+// audit from a real blocker. It reproduced 1/1 on Windows + Node 24 before the fix
+// and went 5/5 clean after it.
+//
 // THE BUG. On Windows + Node 24, calling process.exit() after the CLI has made a
 // request aborts the process before it can exit cleanly:
 //
@@ -26,13 +33,24 @@ import { test } from 'node:test';
 import { spawnSync, spawn } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
+import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const API = path.join(ROOT, 'scripts', 'gds', 'api.js');
+const MAIN_AUDIT = path.join(ROOT, 'scripts', 'gds', 'main-audit.js');
 const CLI_LIB = path.join(ROOT, 'scripts', 'gds', 'cli-lib.js');
 const DEAD_BASE = 'http://127.0.0.1:9'; // discard port — connection refused, instantly
 
+// Point a CLI at a base URL. DERIVED, not hardcoded: instance-config resolves
+// <PREFIX>_API_BASE first and only then the legacy GDS_/OTB_/PMS_ spellings, so a
+// literal here would (a) add to the legacy-GDS ratchet the rename is retiring and
+// (b) silently stop steering the CLI on any instance whose brand pack sets a
+// different prefix — the test would then hit the REAL API instead of the stub.
+const { envPrefix } = createRequire(import.meta.url)(path.join(ROOT, 'src', 'instance-config.js'));
+const API_BASE_ENV = `${envPrefix()}_API_BASE`;
+const atBase = (url) => ({ [API_BASE_ENV]: url });
+
 // The native abort prints this and nothing else can be relied on; it is NOT a
 // JS-level error, so it never appears as a caught exception.
 const ABORT_RE = /Assertion failed|UV_HANDLE_CLOSING/i;
@@ -41,7 +59,7 @@ function runApi(args, env = {}) {
   return spawnSync(process.execPath, [API, ...args], {
     cwd: ROOT,
     encoding: 'utf8',
-    env: { ...process.env, GDS_API_BASE: DEAD_BASE, ...env },
+    env: { ...process.env, ...atBase(DEAD_BASE), ...env },
   });
 }
 
@@ -104,7 +122,7 @@ test('api.js exits 0 after a SUCCESSFUL request — the path that aborted in the
   const { proc, port } = await startStub();
   try {
     for (let i = 0; i < 3; i++) {
-      const r = runApi(['GET', '/api/gds/me', '--quiet'], { GDS_API_BASE: `http://127.0.0.1:${port}` });
+      const r = runApi(['GET', '/api/gds/me', '--quiet'], atBase(`http://127.0.0.1:${port}`));
       assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively after a 200:\n${r.stderr}`);
       assert.equal(r.status, 0, `a successful request must exit 0, got ${r.status} (127 = the abort); stderr: ${r.stderr}`);
       assert.match(r.stdout, /"ok"/, 'the JSON body must still reach stdout');
@@ -133,3 +151,92 @@ test('api.js routes its post-request exits through cliExit, not process.exit', (
   );
   assert.match(afterRequest, /cliExit\(/, 'the post-request paths must set the exit code via cliExit');
 });
+
+// ---- main-audit.js — the deploy gate (task 1003772) ------------------------
+// Ranges are always HEAD..HEAD: it resolves on every checkout including a shallow
+// CI clone, audits zero commits, and still runs the WHOLE pipeline — fetchRankMap
+// is called before the verdict, so the exit is a post-request exit either way.
+//
+// THE STATIC CHECK IS THE REAL NET, and this was measured, not assumed: with the
+// hard exit deliberately put back, the static test failed while all four
+// behavioural tests below still PASSED. The same run against a real range
+// (`--range origin/main~15..origin/main`, 31 commits, a live roster call) aborted
+// at exit 127. So the abort needs the full stack to line up — enough commits and a
+// real request — which a network-free test cannot stage, exactly as the api.js
+// note above says. The behavioural tests are still worth their runtime: they pin
+// the exit CODES (0 / 2) that callers branch on, and their timeouts catch the
+// documented conversion trap where a leaked timer turns the crash into a hang.
+
+function runAudit(args, env = {}) {
+  return spawnSync(process.execPath, [MAIN_AUDIT, ...args], {
+    cwd: ROOT,
+    encoding: 'utf8',
+    timeout: 60_000, // dropping a hard exit trades a crash for a HANG if a timer leaks
+    env: { ...process.env, ...atBase(DEAD_BASE), ...env },
+  });
+}
+
+test('main-audit.js routes every exit through cliExit, not process.exit', () => {
+  const src = fs.readFileSync(MAIN_AUDIT, 'utf8');
+  const stripped = src.replace(/\/\/[^\n]*/g, '');
+  // Unlike api.js, main-audit has no pre-request exits worth keeping separate —
+  // all seven sites were converted, so the guard is simply "none left".
+  assert.ok(
+    !/process\.exit\s*\(/.test(stripped),
+    'no process.exit() may remain in main-audit.js — that is what aborts node on Windows, '
+    + 'and this script IS the deploy gate whose exit code the abort destroys'
+  );
+  assert.match(src, /cliExit\(/, 'the exit paths must set the exit code via cliExit');
+});
+
+test('main-audit.js exits cleanly after a FAILED roster request', () => {
+  const r = runAudit(['--range', 'HEAD..HEAD']);
+  assert.notEqual(r.signal, 'SIGTERM', 'timed out — a leaked timer turned the crash into a hang');
+  assert.doesNotMatch(r.stderr || '', ABORT_RE, `native abort on the audit path:\n${r.stderr}`);
+  assert.equal(r.status, 0, `a clean audit must exit 0, not ${r.status} (127 = the abort)`);
+  assert.match(r.stdout, /✓ clean/, 'the verdict must still reach stdout');
+});
+
+test('main-audit.js --verify-head exits 0 on a clean audit — the deploy gate reads this code', () => {
+  // The gate path specifically: infra/deploy.sh treats non-zero as "do not deploy",
+  // so an abort here blocks a deploy that nothing is actually wrong with.
+  for (let i = 0; i < 3; i++) {
+    const r = runAudit(['--verify-head', '--range', 'HEAD..HEAD']);
+    assert.notEqual(r.signal, 'SIGTERM', `run ${i + 1} timed out — leaked handle`);
+    assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively:\n${r.stderr}`);
+    assert.equal(r.status, 0, `run ${i + 1} exited ${r.status}; stderr: ${r.stderr}`);
+  }
+});
+
+test('main-audit.js --require-roster still exits 2 when the roster is unreachable', () => {
+  // The post-request DID-NOT-RUN path. Converting it to cliExit must not turn a
+  // refusal into a vacuous green — exit 2 is what stops CI calling this a pass.
+  const r = runAudit(['--require-roster', '--range', 'HEAD..HEAD']);
+  assert.notEqual(r.signal, 'SIGTERM', 'timed out — leaked handle');
+  assert.doesNotMatch(r.stderr || '', ABORT_RE);
+  assert.equal(r.status, 2, `an unavailable roster must exit 2, got ${r.status}`);
+  assert.match(r.stderr, /DID NOT RUN/);
+});
+
+test('main-audit.js reports an unresolvable range as exit 2 (pre-request path)', () => {
+  const r = runAudit(['--range', 'bogusref..HEAD']);
+  assert.doesNotMatch(r.stderr || '', ABORT_RE);
+  assert.equal(r.status, 2, 'an unresolvable range is exit 2, and must not be mistaken for clean');
+  assert.match(r.stderr, /DID NOT RUN/);
+});
+
+test('main-audit.js exits 0 after a SUCCESSFUL roster request — the teardown that aborted in the wild', async () => {
+  // A refused connection tears down far less machinery than a 200. The wild repro
+  // was a successful roster call, so this is the case that actually matters.
+  const { proc, port } = await startStub();
+  try {
+    for (let i = 0; i < 3; i++) {
+      const r = runAudit(['--range', 'HEAD..HEAD'], atBase(`http://127.0.0.1:${port}`));
+      assert.notEqual(r.signal, 'SIGTERM', `run ${i + 1} timed out — leaked handle`);
+      assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively after a 200:\n${r.stderr}`);
+      assert.equal(r.status, 0, `run ${i + 1} exited ${r.status} (127 = the abort); stderr: ${r.stderr}`);
+    }
+  } finally {
+    proc.kill();
+  }
+});

package/tests/cloud_bongos_pack.mjs

@@ -28,7 +28,7 @@ test('R74: a vanilla boot resolves to the Cloud Bongos identity', () => {
   assert.equal(b.identity.productName, 'Cloud Bongos');
   assert.equal(b.identity.worldName, 'Cloud Bongos');
   assert.equal(b.currency.label, 'credits'); // not "drachmae"
-  assert.equal(b.envPrefix, 'CLOUDBONGOS');
+  assert.equal(b.envPrefix, 'BONGOS'); // canonical since task 1003703; CLOUDBONGOS_ still resolves as a legacy prefix
 });
 
 test('R74: the vanilla pack carries the Cloud Bongos LOOK (chrome palette, Manrope, bongo favicon)', () => {

package/tests/idea_develop_spark.mjs

@@ -382,6 +382,49 @@ await test('the CLI names both parties, and never prints "undefined"', () => {
   assert.doesNotMatch(out, /undefined|null/);
 });
 
+// task 1003654 — the R157 proof walk read "A board ratification window is open
+// until null" five times on cloudbongos.com. A NULL closes_at is the no-clock
+// constitution, NOT a broken window, so the copy has to name how the sitting
+// closes. One case per pass rule, plus the unknown-rule fallback, because the
+// whole failure was one branch that assumed a deadline always exists.
+for (const [rule, expected] of [
+  ['first_ratifier', /no clock; it closes on the first vote/],
+  ['consent', /no clock; it stands unless someone objects/],
+  ['majority', /no clock; it waits for a majority/],
+  ['unanimous', /no clock; it waits for a unanimous yes/],
+  [null, /no clock; it stays open until the board decides/],
+]) {
+  await test(`a clockless ${rule || 'unknown-rule'} window says how it closes, never "until null"`, () => {
+    const out = cli.renderDeveloped({
+      idea: { id: '77', completeness_score: 88 },
+      author_id: '9', developer_id: '42', self_developed: false,
+      board_window: { item_id: '3', closes_at: null, pass_rule: rule },
+    });
+    assert.match(out, /ratification window is open/);
+    assert.match(out, expected);
+    assert.doesNotMatch(out, /until null|undefined/);
+  });
+}
+
+// Held equal to government's own rule list, the way board.js's FULL_IDEA_PASS_BAR
+// is held equal to economy's — the CLI cannot require() a sibling module, so the
+// test is where the two lists meet. Without this, adding a fifth pass rule
+// silently drops its authors onto the unreadable-rule fallback.
+await test('EVERY pass rule government declares gets its own sentence, not the fallback', () => {
+  const { PASS_RULES } = require('../modules/government/config.js');
+  const fallback = cli.renderDeveloped({
+    idea: { id: '77', completeness_score: 88 }, author_id: '9', developer_id: '42', self_developed: false,
+    board_window: { item_id: '3', closes_at: null, pass_rule: '__no_such_rule__' },
+  });
+  for (const rule of PASS_RULES) {
+    const out = cli.renderDeveloped({
+      idea: { id: '77', completeness_score: 88 }, author_id: '9', developer_id: '42', self_developed: false,
+      board_window: { item_id: '3', closes_at: null, pass_rule: rule },
+    });
+    assert.notEqual(out, fallback, `pass rule '${rule}' falls through to the unreadable-rule fallback`);
+  }
+});
+
 await test('self-development reads as one person, not a handoff to yourself', () => {
   const out = cli.renderDeveloped({ idea: { id: '1', completeness_score: 70 }, author_id: '9', developer_id: '9', self_developed: true });
   assert.match(out, /You had the thought and you developed it/);

package/tests/idea_resubmit.mjs

@@ -25,7 +25,7 @@ const api = require('../src/module-api.js');
 
 // ---- the government port stub (registered BEFORE the routes load) ----------
 let rejectionAnswer = null;      // what latestRejectionForIdea returns
-let windowAnswer = { opened: true, item: { id: '31', closes_at: null } };
+let windowAnswer = { opened: true, item: { id: '31', closes_at: null, constitution: { pass_rule: 'first_ratifier' } } };
 const portCalls = [];
 if (!api.hasProvider('government')) {
   api.registerProvider('government', {
@@ -84,7 +84,7 @@ const fullIdea = (over = {}) => ({
 let passed = 0, failed = 0;
 async function test(name, fn) {
   queries = []; portCalls.length = 0;
-  rejectionAnswer = null; windowAnswer = { opened: true, item: { id: '31', closes_at: null } };
+  rejectionAnswer = null; windowAnswer = { opened: true, item: { id: '31', closes_at: null, constitution: { pass_rule: 'first_ratifier' } } };
   try { await fn(); passed++; console.log(`  ok  ${name}`); }
   catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
 }
@@ -113,7 +113,11 @@ await test('a board objection outranks the mechanical flag, and an ANSWERED sect
   assert.equal(r.payload.flagged_section, 'purpose', 'the human objection wins over the weakest-section flag');
   assert.equal(r.payload.flagged_section_changed, true);
   assert.equal(r.payload.rejection_source, 'board');
-  assert.deepEqual(r.payload.board_window, { item_id: '31', closes_at: null }, 'a new window opened');
+  // The pass rule rides along with the deadline (task 1003654): a clockless
+  // sitting reports closes_at null, and without the rule a caller cannot tell
+  // that apart from a broken window — which is how "open until null" reached
+  // authors in the first place.
+  assert.deepEqual(r.payload.board_window, { item_id: '31', closes_at: null, pass_rule: 'first_ratifier' }, 'a new window opened, and it says how it closes');
 });
 
 await test('reworking everything EXCEPT the flagged section reads changed:false', async () => {

package/tests/init.mjs

@@ -51,7 +51,7 @@ test('buildBrandingConfig: lean overrides only (no theme block)', () => {
   assert.equal(b.repo.owner, 'lars589');
   assert.equal(b.firstAdmin, 'lars589');
   assert.equal(b.currency.label, 'credits');
-  assert.equal(b.envPrefix, 'CLOUDBONGOS');
+  assert.equal(b.envPrefix, 'BONGOS'); // canonical since task 1003703
   assert.equal(b.copy.tagline, 'Building software is laying down a beat.');
   assert.equal(b.theme, undefined);                       // lean — neutral fills the look
   assert.equal(b.domains.buildersOrigin, 'http://localhost:3000');