@bongos/core 1.19.725 → 1.19.727

package/.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-# Amazonprimea Dev Box — the OTB builder environment as code (ADR 0031 §3).
+# Example Dev Box — the OTB builder environment as code (ADR 0031 §3).
 # Base Ubuntu 24.04 ships Python 3.12 (matches CI's art-pipeline cert) + a non-root
 # `vscode` sudo user. Node 22 / gh / Claude Code arrive as version-pinned features
 # (devcontainer.json); this Dockerfile covers the OS bits features don't: firewall

package/.devcontainer/devcontainer.json

@@ -1,12 +1,12 @@
 {
-  // Amazonprimea Dev Box — the OTB builder environment as code (ADR 0031 §3).
+  // Example Dev Box — the OTB builder environment as code (ADR 0031 §3).
   //
   // This is the single box spec every builder runs, reached via Claude Desktop
   // → SSH or the web → Remote Control (ADR 0031 §1). It builds identically on a
   // DigitalOcean box and on a laptop via Docker Desktop. The pre-distributed
   // Desktop "managed settings" that lock a non-technical builder to exactly this
   // box are a separate task (#599); this file is the box itself.
-  "name": "Amazonprimea Dev Box",
+  "name": "Example Dev Box",
 
   "build": {
     "dockerfile": "Dockerfile",

package/.devcontainer/healthcheck.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# healthcheck.sh — image-level toolchain integrity check for the Amazonprimea
+# healthcheck.sh — image-level toolchain integrity check for the Example
 # Dev Box (ADR 0031 §3).
 #
 # This is the IMAGE half of "doctor.js as the health check": it answers "was the

package/.devcontainer/init-firewall.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# init-firewall.sh — default-deny outbound firewall for the Amazonprimea Dev Box.
+# init-firewall.sh — default-deny outbound firewall for the Example Dev Box.
 #
 # ADR 0031 §3 + §6: the box is an org-controlled, egress-restricted surface. This
 # script flips the container to default-DROP and then allow-lists ONLY the hosts

package/.devcontainer/post-create.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# post-create.sh — first-run provisioning for the Amazonprimea Dev Box.
+# post-create.sh — first-run provisioning for the Example Dev Box.
 #
 # Runs once, as the `vscode` user, after the container is created and the repo is
 # mounted at /workspace (devcontainer.json: postCreateCommand). This is where
@@ -28,7 +28,7 @@ cd /workspace 2>/dev/null || cd "$(git rev-parse --show-toplevel 2>/dev/null ||
 bold=$'\033[1m'; green=$'\033[32m'; yellow=$'\033[33m'; dim=$'\033[2m'; reset=$'\033[0m'
 say()  { echo "${bold}$*${reset}"; }
 
-say "Amazonprimea Dev Box — first-run provisioning"
+say "Example Dev Box — first-run provisioning"
 echo
 
 # git trusts the mounted workspace even though its owner differs from the

package/.env.local.example

@@ -28,6 +28,6 @@ GOOGLE_AI_STUDIO_KEY=
 # --- GitHub OAuth (server only) -----------------------------------------------
 # Needed only if you are running the GDS server yourself (server.js) and want
 # Device Flow auth to work. The production droplet has these in
-# /etc/amazonprimea/ — builders do NOT need these for normal day-to-day work.
+# /etc/example/ — builders do NOT need these for normal day-to-day work.
 # BONGOS_GITHUB_CLIENT_ID=
 # BONGOS_GITHUB_CLIENT_SECRET=

package/Dockerfile

@@ -7,7 +7,7 @@
 # Cloud Bongos brand with every feature module off). Brand/configure an instance
 # by mounting your own config/*.json (see docs/recipes/self-host.md).
 #
-# No prod topology is referenced anywhere here: no droplet IP, no amazonprimea
+# No prod topology is referenced anywhere here: no droplet IP, no example
 # domain, no peer-auth socket. The DB is reached over TCP via PG* env vars,
 # supplied by docker-compose.yml (or your own orchestrator).
 

package/docs/copy-inventory.md

@@ -1541,6 +1541,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `b1cf8460ad34` | certain | Every project is a real GitHub repository that you own. Start from a clean slate, or bring a repo you already  | `modules/public-landing/public/projects.html:1127` |
 | `71b0ef2552c4` | certain | Every project you own, in one place — its live status, its address, and the controls that matter. Sign in with | `modules/public-landing/public/projects.html:619` |
 | `478bc7f0e492` | certain | Every project you own: what it is, whether it is answering, and the controls that matter. Each row says what t | `modules/public-landing/public/projects.html:611` |
+| `1b5a6cfc494c` | certain | Example World | `modules/public-landing/public/index.html:741` |
 | `7c8dcf228e70` | certain | Extras for this project | `modules/public-landing/public/projects.html:1100` |
 | `2585087f4873` | certain | Fair use | `modules/public-landing/public/terms.html:72` |
 | `fec69b6c7458` | certain | Filter by state | `modules/public-landing/public/projects.html:641` |
@@ -1599,7 +1600,6 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `fad4acf2aba6` | certain | Not Sure | `modules/public-landing/public/projects.html:1037` |
 | `f8665480baf6` | certain | Nothing is sold, and nothing is shared for advertising. | `modules/public-landing/public/privacy.html:67` |
 | `837fdaa0936a` | certain | Nothing matches that. | `modules/public-landing/public/projects.html:649` |
-| `2c951d1c7f72` | certain | Example | `modules/public-landing/public/index.html:741` |
 | `1bc11853e893` | certain | On the map | `modules/public-landing/public/projects.html:824` |
 | `b4ac8f44710c` | certain | On the public map | `modules/public-landing/public/projects.html:742` |
 | `69400ca12477` | certain | Once you have signed in here and accepted these terms, your profile and that record are public by default: at  | `modules/public-landing/public/terms.html:68` |

package/docs/copy-registry.json

@@ -13893,6 +13893,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "1b5a6cfc494c",
+      "surface": "landing",
+      "text": "Example World",
+      "file": "modules/public-landing/public/index.html",
+      "line": 741,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "7c8dcf228e70",
       "surface": "landing",
@@ -14415,15 +14424,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "2c951d1c7f72",
-      "surface": "landing",
-      "text": "Off the Boats",
-      "file": "modules/public-landing/public/index.html",
-      "line": 741,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "1bc11853e893",
       "surface": "landing",

package/docs/module-api-changelog.md

@@ -1924,5 +1924,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.723 with no explicit bump. run 34759302425. (task 1002620)
   1.19.725 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.724 with no explicit bump. run 34760272743. (task 1002620)
+  1.19.726 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.725 with no explicit bump. run 34763380132. (task 1002620)
+  1.19.727 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.726 with no explicit bump. run 34763937238. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/devbox-app-release.md

@@ -1,6 +1,6 @@
 # Releasing the Dev Box desktop app
 
-How a new version of OTB Dev Box (`devbox-app/`, ADR 0045) reaches builders.
+How a new version of the Dev Box app (`devbox-app/`, ADR 0045) reaches builders.
 The chain: CI builds installers → operator publishes them to the PUBLIC
 releases repo → a one-line config bump re-points the branded
 `/downloads/devbox/*` redirects. Nothing binary ever rides the git deploy.
@@ -21,8 +21,8 @@ releases repo → a one-line config bump re-points the branded
   (302 → release asset; targets `mac-arm64`, `mac-x64`, `win-x64`, `win-arm64` + aliases)
   and `/downloads/devbox/latest.json` (what the app's update check reads).
   Server side: `src/devbox-downloads.js`, mounted in `server.js`.
-- **Install-window backdrop ([#912](https://example.com/builders#/task/912), fixed in [#1235](https://example.com/builders#/task/1235)):** the on-brand
-  Greek-coast art is `build-resources/dmg-background.png` (+ `@2x`), drawn by
+- **Install-window backdrop ([#912](https://example.com/builders#/task/912), fixed in [#1235](https://example.com/builders#/task/1235)):** the backdrop
+  art is `build-resources/dmg-background.png` (+ `@2x`), drawn by
   `scripts/gen-dmg-backdrop.py`. Committed art — re-run that script + commit if you change
   the layout/copy. **The DMG is NOT styled by electron-builder.** electron-builder writes a
   `.DS_Store` whose background reference includes a modern `pBBk` bookmark that Finder on
@@ -64,7 +64,7 @@ releases repo → a one-line config bump re-points the branded
    `src/devbox-downloads.js` composes):
    ```
    gh release create v1.1.0 -R example-owner/example-devbox \
-     --title "OTB Dev Box v1.1.0" --notes "…" /tmp/devbox-rel/*.dmg /tmp/devbox-rel/*.exe
+     --title "Dev Box v1.1.0" --notes "…" /tmp/devbox-rel/*.dmg /tmp/devbox-rel/*.exe
    ```
 5. Update `config/devbox-app.json`: `version` + the four asset filenames
    (they embed the version — `tests/devbox_downloads.mjs` fails the gate on a

package/modules/dev-box/app/scripts/dmgbuild-settings.py

@@ -1,10 +1,10 @@
-# dmgbuild settings for the OTB Dev Box install window (task 1235).
+# dmgbuild settings for the Dev Box install window (task 1235).
 #
 # WHY dmgbuild and not electron-builder's own DMG styling:
 # electron-builder writes a .DS_Store whose background reference includes a
 # modern security-scoped bookmark (`pBBk`). Finder on macOS >= Sonoma/Sequoia
 # (verified white on 15.7.4) cannot resolve that bookmark, so it falls back to a
-# solid white window — the embedded Greek-coast backdrop (task 912) is present
+# solid white window — the embedded backdrop (task 912) is present
 # but never drawn. dmgbuild writes an alias-only `.DS_Store` (no `pBBk`) that
 # Finder DOES resolve, so the backdrop renders. The OS is not the problem; the
 # bookmark electron-builder emits is. scripts/apply-dmg-backdrop.sh re-packages
@@ -16,16 +16,16 @@
 
 import os.path
 
-# -D app=<path to OTB Dev Box.app>  -D bg=<path to the hidpi backdrop tiff>
+# -D app=<path to the Dev Box .app>  -D bg=<path to the hidpi backdrop tiff>
 application = defines["app"]
 backdrop = defines["bg"]
-appname = os.path.basename(application)  # "OTB Dev Box.app"
+appname = os.path.basename(application)  # e.g. "<Product> Dev Box.app"
 
 # Contents of the disk image.
 files = [application]
 symlinks = {"Applications": "/Applications"}
 
-# Window + icon layout — matched to the backdrop art's two marble wells.
+# Window + icon layout — matched to the two icon wells the backdrop art draws.
 background = backdrop
 window_rect = ((150, 150), (660, 400))  # ((x, y), (w, h)); w/h match the 660x400 art
 icon_size = 100

package/modules/dev-box/app/scripts/gen-brand.js

@@ -10,7 +10,7 @@
 //   renderer/theme.generated.css — the :root design tokens (palette + fonts)
 //   electron-builder.yml         — rendered from electron-builder.tmpl.yml
 //
-// So ONE source tree builds a "Cloud Bongos Dev Box" here and an "Amazonprimea
+// So ONE source tree builds a "Cloud Bongos Dev Box" here and an "Example
 // Dev Box" on the OTB instance — the brand is a build input, not baked into code
 // (the ADR 0004 posture, generalised: no instance's name is hardcoded anywhere).
 //

package/modules/dev-box/app/src/brand.js

@@ -3,7 +3,7 @@
 // GENERATED, not hardcoded: scripts/gen-brand.js writes src/brand.generated.json
 // from the instance's config/branding.json at build time (prestart / pretest /
 // predist), so the SAME source tree renders a "Cloud Bongos Dev Box" here and an
-// "Amazonprimea Dev Box" on the OTB instance — no instance name is baked into
+// "Example Dev Box" on the OTB instance — no instance name is baked into
 // code (the ADR 0004 posture, generalised to every instance). The generated file
 // is committed (the Cloud Bongos default) so a fresh checkout runs without a
 // generate step; every build regenerates it from the local branding.

package/modules/dev-box/app/test/unit.mjs

@@ -91,8 +91,8 @@ console.log('terminalAuthUrl:');
 
 t('embeds otb:<credential> userinfo in the terminal URL', () => {
   assert.equal(
-    terminalAuthUrl({ url: 'https://term-lars589.amazonprimea.com', credential: 'abc123' }),
-    `https://${TERMINAL_USER}:abc123@term-lars589.amazonprimea.com/`
+    terminalAuthUrl({ url: 'https://term-example-owner.example.com', credential: 'abc123' }),
+    `https://${TERMINAL_USER}:abc123@term-example-owner.example.com/`
   );
 });
 
@@ -165,11 +165,11 @@ t('an rsa-only scan is NOT complete (#925 — Desktop ssh2 negotiates ed25519)',
 console.log('hostKeyLinesFor (task 1187 / idea 235 — authoritative host keys):');
 
 t('builds <host> <type> <base64> lines from the reported keys, ed25519 present', () => {
-  const r = hostKeyLinesFor('box-x.dev.amazonprimea.com', 'ssh-ed25519 AAAA\necdsa-sha2-nistp256 BBBB');
+  const r = hostKeyLinesFor('box-x.dev.example.com', 'ssh-ed25519 AAAA\necdsa-sha2-nistp256 BBBB');
   assert.equal(r.ok, true);
   assert.deepEqual(r.lines, [
-    'box-x.dev.amazonprimea.com ssh-ed25519 AAAA',
-    'box-x.dev.amazonprimea.com ecdsa-sha2-nistp256 BBBB',
+    'box-x.dev.example.com ssh-ed25519 AAAA',
+    'box-x.dev.example.com ecdsa-sha2-nistp256 BBBB',
   ]);
 });
 
@@ -196,32 +196,32 @@ t('empty report / missing hostname are rejected', () => {
 console.log('knownHostsHasKey + verifyKnownHosts (idea 264 — self-verify the on-disk pin):');
 
 const HKEY = 'AAAAC3NzaC1lZDI1NTE5AAAAIBh0r5JKa722SY0UXjqHv2'; // sample ed25519 blob
-const EXPECTED = hostKeyLinesFor('box-x.dev.amazonprimea.com', `ssh-ed25519 ${HKEY}\necdsa-sha2-nistp256 BBBB`).lines;
+const EXPECTED = hostKeyLinesFor('box-x.dev.example.com', `ssh-ed25519 ${HKEY}\necdsa-sha2-nistp256 BBBB`).lines;
 
 t('authoritative key present in file → true', () => {
-  const file = `box-x.dev.amazonprimea.com ssh-ed25519 ${HKEY}\nother.example.com ssh-rsa K`;
-  assert.equal(knownHostsHasKey(file, 'box-x.dev.amazonprimea.com', EXPECTED), true);
+  const file = `box-x.dev.example.com ssh-ed25519 ${HKEY}\nother.example.com ssh-rsa K`;
+  assert.equal(knownHostsHasKey(file, 'box-x.dev.example.com', EXPECTED), true);
 });
 
 t('STALE ed25519 (rebuild minted a new key) → false, even though a host line exists', () => {
-  const file = 'box-x.dev.amazonprimea.com ssh-ed25519 OLDOLDOLD';
-  assert.equal(knownHostsHasKey(file, 'box-x.dev.amazonprimea.com', EXPECTED), false);
+  const file = 'box-x.dev.example.com ssh-ed25519 OLDOLDOLD';
+  assert.equal(knownHostsHasKey(file, 'box-x.dev.example.com', EXPECTED), false);
 });
 
 t('MISSING (ssh-keygen -R removed it / empty file) → false', () => {
-  assert.equal(knownHostsHasKey('unrelated.example.com ssh-ed25519 ZZZZ', 'box-x.dev.amazonprimea.com', EXPECTED), false);
-  assert.equal(knownHostsHasKey('', 'box-x.dev.amazonprimea.com', EXPECTED), false);
+  assert.equal(knownHostsHasKey('unrelated.example.com ssh-ed25519 ZZZZ', 'box-x.dev.example.com', EXPECTED), false);
+  assert.equal(knownHostsHasKey('', 'box-x.dev.example.com', EXPECTED), false);
 });
 
 t('no authoritative key → any ed25519 line for the host counts (keyscan fallback)', () => {
-  assert.equal(knownHostsHasKey('box-x.dev.amazonprimea.com ssh-ed25519 WHATEVER', 'box-x.dev.amazonprimea.com', []), true);
+  assert.equal(knownHostsHasKey('box-x.dev.example.com ssh-ed25519 WHATEVER', 'box-x.dev.example.com', []), true);
   // ...but an rsa-only pin (no ed25519, the algo Desktop verifies) is NOT enough.
-  assert.equal(knownHostsHasKey('box-x.dev.amazonprimea.com ssh-rsa RRRR', 'box-x.dev.amazonprimea.com', []), false);
+  assert.equal(knownHostsHasKey('box-x.dev.example.com ssh-rsa RRRR', 'box-x.dev.example.com', []), false);
 });
 
 t('host,ip combined first field + comments/blanks are handled', () => {
-  const file = `# a comment\n\nbox-x.dev.amazonprimea.com,1.2.3.4 ssh-ed25519 ${HKEY}`;
-  assert.equal(knownHostsHasKey(file, 'box-x.dev.amazonprimea.com', EXPECTED), true);
+  const file = `# a comment\n\nbox-x.dev.example.com,1.2.3.4 ssh-ed25519 ${HKEY}`;
+  assert.equal(knownHostsHasKey(file, 'box-x.dev.example.com', EXPECTED), true);
 });
 
 t('no hostname → false (fail-closed)', () => {

package/modules/dev-box/box-access.js

@@ -58,7 +58,7 @@ const {
 // SANDBOX-FOR-EVERYONE (ADR 0052, task #1001 — Lars, 2026-06-13): the PRODUCT/game
 // code is now in the starter scope too — `src/world`, `src/rooms`, and the
 // `public/` game client — so EVERY box (not just Metic+ full-clone boxes) can run
-// the live sandbox (sandbox-<login>.amazonprimea.com, ADR 0044). The box serves
+// the live sandbox (sandbox-<login>.example.com, ADR 0044). The box serves
 // the game from a GAME-ONLY entry (src/preview-server.js) that never mounts
 // /api/gds, so the privacy boundary that matters for a PUBLIC sandbox URL is the
 // RUNTIME (what the box process exposes), NOT source exclusion. That is consistent

package/modules/dev-box/routes/box.js

@@ -96,7 +96,7 @@ function provisionFloor() { return process.env.BOX_PROVISION_MIN_RANK || 'xenos'
 // metadata), [::1], *.local/*.internal — so a builder could make the prod server
 // probe arbitrary internal endpoints. A legitimate terminal URL is ALWAYS one of
 // exactly two shapes (see cf-tunnel.js terminalHostname + the quick-tunnel
-// default): the named tunnel `term-<login>.<zone>` under amazonprimea.com, or a
+// default): the named tunnel `term-<login>.<zone>` under example.com, or a
 // Cloudflare quick tunnel `*.trycloudflare.com`. We bind the named form to the
 // CALLER's own login so one builder can't even name another's terminal host.
 // PURE + exported for unit tests (no network, no DB).

package/modules/discord/discord-approvals.js

@@ -3,7 +3,7 @@
 // Discord reaction → Archon approval (task 1100).
 //
 // An Archon's 👍/👎 on a request line in #member-approvals fires the SAME server
-// action the amazonprimea hall fires:
+// action the example hall fires:
 //   #member-approvals  👍 → access_requests → 'invited'   (PATCH /access-requests/:id)
 //                      👎 → access_requests → 'dismissed'
 //

package/modules/grading/grader-model.js

@@ -125,7 +125,7 @@ function workerModelFor(kind, graderModel, builderModel) {
 
 // The instance's project name, injected into the grader's identity line so a
 // non-OTB Cloud Bongos instance is graded against ITS OWN project, never a
-// hardcoded "Off the Boats" (ADR 0062 §3/§5; the branding contract's
+// hardcoded "Example World" (ADR 0062 §3/§5; the branding contract's
 // llmProjectName field). Reached through the doorway like every other host-
 // context read in this module — never a deep core require. Resolved once at
 // module load (the brand is a per-process singleton); falls back to a neutral

package/modules/grading/grader-prompt.js

@@ -22,7 +22,7 @@ Your job is to FIND WHAT IS WRONG with this change. **The default verdict is FAI
 Begin by hunting for these specific failure modes. When you find one, CITE the diff line or name the failing acceptance criterion:
 
 - TODOs, FIXMEs, "for now", "temporary" or "stub" comments left in shipped code.
-- Hardcoded shortcuts: assuming one builder, one user, one project root, one tenant, one environment, or one identity. Look for literal "lars", "lars589", absolute /Users paths, hardcoded ports, hardcoded IDs.
+- Hardcoded shortcuts: assuming one builder, one user, one project root, one tenant, one environment, or one identity. Look for literal "lars", "example-owner", absolute /Users paths, hardcoded ports, hardcoded IDs.
 - Scope gaps: acceptance criteria in the description that the diff DOES NOT satisfy. Read the description's "Acceptance" section line by line.
 - Demo / dummy / mock code that lies: returns a fixed value, fakes a successful result, mocks at the wrong layer, or pretends to call something it doesn't.
 - Missing tests for new logic: any non-trivial new function, route handler, branch, or aggregation that ships without a covering test.

package/modules/grading/grader-workers/quality.js

@@ -31,7 +31,7 @@ You do NOT score whether the description was implemented — that's the Narc's j
 You begin by hunting for these specific failure modes. When you find one, CITE the diff line or quote the offending code:
 
 - TODOs, FIXMEs, "for now", "temporary" or "stub" comments left in shipped code.
-- Hardcoded shortcuts assuming one builder, one user, one project root, one tenant. Look for literal "lars", "lars589", absolute /Users paths, hardcoded ports, hardcoded IDs that should be lookups.
+- Hardcoded shortcuts assuming one builder, one user, one project root, one tenant. Look for literal "lars", "example-owner", absolute /Users paths, hardcoded ports, hardcoded IDs that should be lookups.
 - Dead code: helpers, exports, branches, or files added but never called from anywhere in the post-merge tree. Use Read on the receiving site if unsure.
 - Broken invariants: methodology rules in CLAUDE.md (the "every change is backed by a claimed GDS task" rule, no-hardcoded-Archon-identity per V3.R12, server-enforced permissions per ADR 0016), cross-verified Python/JS lookups, ground-vs-object cell split per ADR 0012.
 - Missing tests for new logic: any non-trivial new function, route handler, branch, or aggregation that ships without a covering test.

package/modules/hall-ui/module.json

@@ -1,7 +1,7 @@
 {
   "key": "hall-ui",
   "title": "Builders' Hall",
-  "description": "The authenticated builders' hall served at builders.<apex> (builders.amazonprimea.com) — the roster, work board, standing/karma, leaderboard, achievements, primer, system maps, settings, dev-box pair page, and the Archon-only watch/harbor/gate pages, all polling /api/gds/* and the read-only /api/gds/public/* surface. The largest WEB-SURFACE core-domain module (~13k LOC), carved out of the GDS core in BV1.R85 (ADR 0093 §1; 02-module-map §6). default-on: a Cloud Bongos instance ships its hall like it ships its status page. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir). Unlike the generic status surface, the hall keeps its dedicated serving block in serve-internal.js (the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection) — the webSurfaces declaration is the discovery + scope-map + window.__MODULES__ record; serve-internal serves it from this module's public/ dir with that richer machinery. The me/public/leaderboard read endpoints it renders stay SHARED core in routes/{me,public,builders}.js (the status surface + the off-box mirror read them too).",
+  "description": "The authenticated builders' hall served at builders.<apex> (builders.example.com) — the roster, work board, standing/karma, leaderboard, achievements, primer, system maps, settings, dev-box pair page, and the Archon-only watch/harbor/gate pages, all polling /api/gds/* and the read-only /api/gds/public/* surface. The largest WEB-SURFACE core-domain module (~13k LOC), carved out of the GDS core in BV1.R85 (ADR 0093 §1; 02-module-map §6). default-on: a Cloud Bongos instance ships its hall like it ships its status page. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir). Unlike the generic status surface, the hall keeps its dedicated serving block in serve-internal.js (the builders.<apex> + apex /builders/* shim, canonical redirects, the citizen/Archon page gates, asset-stamping, and the module hall-widget injection) — the webSurfaces declaration is the discovery + scope-map + window.__MODULES__ record; serve-internal serves it from this module's public/ dir with that richer machinery. The me/public/leaderboard read endpoints it renders stay SHARED core in routes/{me,public,builders}.js (the status surface + the off-box mirror read them too).",
   "coreVersion": "^1.11.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/hall-ui/public/brand-apply.js

@@ -41,7 +41,7 @@
   // BV1.R75 (ADR 0062 §4): drive the hall index page's chrome — <title>, <h1>, and
   // meta description — from the branding pack so the reskin reaches the browser tab,
   // not just the page body. copy.hallName is the hall's name ("Builders' Hall");
-  // identity.productName / worldName is the instance ("Off the Boats" / "Amazonprimea").
+  // identity.productName / worldName is the instance ("Example World" / "Example").
   // The static markup is the no-JS / pre-load fallback. SCOPED to the hall index via
   // the #hall-h1 marker: the other hall pages (sessions/watch/work) carry their own
   // page-specific titles + headings and must keep them — gating on #hall-h1 leaves

package/modules/hall-ui/public/shell.js

@@ -354,7 +354,7 @@
     if (!el) return;
     // Apex origin for external links (the API docs live on the apex, not this
     // builders./status. subdomain). Derived from the current host so it's correct
-    // on any instance (amazonprimea.com, cloudbongos.com, localhost).
+    // on any instance (example.com, cloudbongos.com, localhost).
     var APEX_ORIGIN = window.location.origin.replace('://builders.', '://').replace('://status.', '://');
     // Instance product/world name for the "back to home" wayfinding link — same
     // source renderFoot() uses, so the core carries no hardcoded identity.

package/modules/hall-ui/public/work.js

@@ -1,5 +1,5 @@
 // public-builders/work.js — the Work Board (/builders/work, served at
-// builders.amazonprimea.com/work).
+// builders.example.com/work).
 //
 // Signed-in builders only. The page is the builder-facing SOURCE OF TRUTH for
 // "works in progress"; it gathers two views the hall + status dashboard used to

package/modules/lifecycle/conflict-resolve.js

@@ -70,7 +70,7 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
 // The merge-bot git identity, derived from the instance branding pack so a non-OTB
 // Cloud Bongos instance signs its auto-resolved merge commits with ITS OWN name +
-// apex, never a hardcoded "Off the Boats GDS" / "amazonprimea.com" (ADR 0062 §3/§5;
+// apex, never a hardcoded "Example World GDS" / "example.com" (ADR 0062 §3/§5;
 // the branding contract). Falls back to a neutral identity if branding fails to
 // resolve so the resolver never crashes on a config error. NEVER a real person.
 function botIdentity() {

package/modules/lifecycle/db-analytics.js

@@ -234,7 +234,7 @@ async function gradeByBuilder(days = 30) {
 }
 
 // Public grade-trend timeline — array of { day, n, avg_score }. Powers a
-// chart on status.amazonprimea.com.
+// chart on status.example.com.
 
 async function gradeTrendByDay(days = 30) {
   // A day whose rows are all outages keeps its row (n=0, avg_score NULL,

package/modules/lifecycle/routes/analytics.js

@@ -5,7 +5,7 @@
 //     OWN curve; an Archon may read any builder's (the cross-builder aggregate
 //     is just every builder's own page, plus the ecosystem feed below).
 //   - GET /public/analytics/ecosystem — no auth. Ecosystem-wide aggregate with
-//     NO per-builder identity, for status.amazonprimea.com. Individual curves
+//     NO per-builder identity, for status.example.com. Individual curves
 //     never cross onto the open web (mirrors the public-task privacy gate).
 //
 // All data derives from existing columns (see db.builderAnalytics /

package/modules/onboarding/approval-broadcast.js

@@ -3,7 +3,7 @@
 // When a new-builder access request (access_requests, status='pending') needs an
 // Archon's go-ahead, the GDS posts a one-line request to the Archon-only
 // #member-approvals Discord channel so the Archon can approve it WITHOUT opening
-// the amazonprimea hall.
+// the example hall.
 //
 // The Archon then 👍 (approve) or 👎 (decline) the message; the in-process bot's
 // reaction handler (src/bongos/discord-approvals.js) re-derives the reactor's LIVE

package/modules/onboarding/onboarding.js

@@ -295,7 +295,7 @@ function compactTranscript(turns) {
 
 // The instance's project name, injected into the analysis prompt so a non-OTB
 // Cloud Bongos instance onboards against ITS OWN project rather than a hardcoded
-// "Off the Boats" (ADR 0062 §3/§5; the branding contract's llmProjectName field).
+// "Example World" (ADR 0062 §3/§5; the branding contract's llmProjectName field).
 // Resolved LAZILY (inside the header builder, not at module load) so this module
 // stays side-effect-free at require time — it is the *pure* half of the pipeline.
 // Falls back to a neutral phrase if branding fails to resolve.

package/modules/provisioning/tests/liveness.mjs

@@ -189,7 +189,7 @@ t('private/reserved addresses are recognized; public ones are not', () => {
     'fe80::1', 'fd00::5', '::ffff:10.0.0.5', 'garbage']) {
     assert.equal(liveness.isPrivateAddress(bad), true, `${bad} must be private/refused`);
   }
-  for (const ok of ['93.184.216.34', '161.35.132.201', '2606:2800:220:1:248:1893:25c8:1946']) {
+  for (const ok of ['93.184.216.34', '1.2.3.4', '2606:2800:220:1:248:1893:25c8:1946']) {
     assert.equal(liveness.isPrivateAddress(ok), false, `${ok} must be public`);
   }
 });

package/modules/public-landing/public/index.html

@@ -738,7 +738,7 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
       <ul class="orbs" data-orbs>
         <li class="orb-item o1">
           <span class="orb-bead" aria-hidden="true"></span>
-          <span class="orb-name">Off the Boats</span>
+          <span class="orb-name">Example World</span>
           <span class="orb-meta">a game, 11 builders</span>
         </li>
         <li class="orb-item o2">

package/modules/public-landing/public/projects-floor.states.json

@@ -1,5 +1,5 @@
 {
-  "_": "The all-null floor card (task 1003301) on the hub's own catalog (task 1003345): the same page, the same stub, the catalog aliased to featured-hub.json — the landing's three plus Tidewater, a null row nobody owns. Demo, the landing catalog's floor row, is owned by the signed-in stub, and an owned orb's plain click opens its manage view, never its card. Since task 1003352 it also carries the card BACKDROP state: featured-hub gives Off the Boats a card_backdrop, so the owner's plate can be seen standing in front of the project's own picture. Rendered by name: node modules/ui-design/kit/render.js --states public-landing/projects-floor.states.json",
+  "_": "The all-null floor card (task 1003301) on the hub's own catalog (task 1003345): the same page, the same stub, the catalog aliased to featured-hub.json — the landing's three plus Tidewater, a null row nobody owns. Demo, the landing catalog's floor row, is owned by the signed-in stub, and an owned orb's plain click opens its manage view, never its card. Since task 1003352 it also carries the card BACKDROP state: featured-hub gives Example World a card_backdrop, so the owner's plate can be seen standing in front of the project's own picture. Rendered by name: node modules/ui-design/kit/render.js --states public-landing/projects-floor.states.json",
   "page": "/projects",
   "surface": "public-landing",
   "modes": [
@@ -64,7 +64,7 @@
       "actions": [
         [
           "dispatchClick",
-          "#orbField a.worldOrb[data-origin=\"https://amazonprimea.com\"]"
+          "#orbField a.worldOrb[data-origin=\"https://example.com\"]"
         ],
         [
           "wait",

package/modules/public-landing/public/projects.probes.json

@@ -53,12 +53,12 @@
       "steps": [["press", "Escape"], ["wait", 150]],
       "expect": { "dialog": false } },
     { "name": "the poster (task 1003301): art, five faces and +N, two figures on the art, the address, a member's hall door", "continue": true,
-      "steps": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://amazonprimea.com\"]"], ["wait", 900]],
+      "steps": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://example.com\"]"], ["wait", 900]],
       "expect": { "dialog": true, "hasClass": [["#projCard", "has-art"]],
                   "visible": ["#cardArt", "#cardFaces", "#cardBuildersFig", "#cardShippedFig", "#cardOpen", "#cardHall"],
                   "count": [["#cardFaces img", 5], ["#projCard > div", 1]],
-                  "text": [["#cardBuilders", "11"], ["#cardShipped", "0"], ["#cardRel", "you build here"], ["#cardRuns", "amazonprimea.com"], ["#cardFaces .facesMore", "+6"], ["#cardHall", "Builders' hall"]],
-                  "href": [["#cardHall", "https://builders.amazonprimea.com/"], ["#cardOpen", "https://amazonprimea.com/"]] } },
+                  "text": [["#cardBuilders", "11"], ["#cardShipped", "0"], ["#cardRel", "you build here"], ["#cardRuns", "example.com"], ["#cardFaces .facesMore", "+6"], ["#cardHall", "Builders' hall"]],
+                  "href": [["#cardHall", "https://builders.example.com/"], ["#cardOpen", "https://example.com/"]] } },
     { "name": "the ladder: a project that answered nothing is the card that shipped before (disc, name, tagline, address, listed, one door)", "continue": true,
       "steps": [["press", "Escape"], ["wait", 150], ["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://tidewater.cloudbongos.com\"]"], ["wait", 500]],
       "expect": { "dialog": true, "hasClass": [["#projCard", "has-art", false]],
@@ -76,7 +76,7 @@
     { "name": "the table: the hall glyph rides the door cell on the one member row whose hall is elsewhere, and on the platform's row", "continue": true,
       "steps": [["press", "Escape"], ["wait", 150], ["click", "#projTrig"], ["wait", 120], ["click", "a[data-sub=\"table\"]"], ["wait", 300]],
       "expect": { "dialog": false, "visible": ["#selfHall"], "count": [["#mapRows li[data-generated] .rowHall", 1], ["#mapRows li[data-generated] .facts", 7], ["#mapRows li[data-generated] .runs", 7], ["#mapRows li[data-generated] .rowDoors", 7]],
-                  "href": [["#mapRows li[data-generated] .rowHall", "https://builders.amazonprimea.com/"]] } },
+                  "href": [["#mapRows li[data-generated] .rowHall", "https://builders.example.com/"]] } },
     { "name": "the table: the sort left the column head — the pills carry the order, and the sentence under the list states it (task 1003356)", "continue": true,
       "steps": [["click", ".tblSort button[data-sort=\"builders\"]"], ["wait", 200]],
       "expect": { "attr": [[".tblSort button[data-sort=\"builders\"]", "aria-pressed", "true"], [".tblSort button[data-sort=\"name\"]", "aria-pressed", "false"]],

package/modules/public-landing/public/projects.states.json

@@ -9,7 +9,7 @@
   "ignoreControls": [".skip", ".vh"],
   "states": {
     "out-map": { "auth": false, "expect": { "expanded": false } },
-    "in-map": { "auth": true, "expect": { "expanded": false, "count": [["#orbField .worldOrb[data-shape][data-style]", 7]], "attr": [["#selfOrb", "data-template", "pair-chrome"], ["#orbField a.worldOrb[data-origin=\"https://amazonprimea.com\"]", "data-template", "bead-wash"], ["#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]", "data-shape", "pair"], ["#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]", "data-material", "obsidian"], ["#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]", "data-template", "pair-obsidian-tint"], ["#orbField a.worldOrb[data-origin=\"https://emersonian-circles.cloudbongos.com\"]", "data-template", "bead-obsidian-plain"]] } },
+    "in-map": { "auth": true, "expect": { "expanded": false, "count": [["#orbField .worldOrb[data-shape][data-style]", 7]], "attr": [["#selfOrb", "data-template", "pair-chrome"], ["#orbField a.worldOrb[data-origin=\"https://example.com\"]", "data-template", "bead-wash"], ["#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]", "data-shape", "pair"], ["#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]", "data-material", "obsidian"], ["#orbField a.worldOrb[data-origin=\"https://demo.cloudbongos.com\"]", "data-template", "pair-obsidian-tint"], ["#orbField a.worldOrb[data-origin=\"https://emersonian-circles.cloudbongos.com\"]", "data-template", "bead-obsidian-plain"]] } },
     "in-map-projects": { "auth": true, "actions": [["click", "#projTrig"], ["wait", 350]], "expect": { "expanded": true, "open": "#menuProjects" } },
     "in-map-profile": { "auth": true, "actions": [["click", "#who"], ["wait", 350]], "expect": { "expanded": true, "open": "#menuProfile" } },
     "in-map-kbd": { "auth": true, "actions": [["focus", "#projTrig"], ["press", "Enter"], ["wait", 350], ["press", "ArrowDown"], ["wait", 120]], "expect": { "expanded": true, "activeText": "Table" } },
@@ -40,7 +40,7 @@
     "in-new-done": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500]], "expect": {"visible":["#panel-done","#liveProgress .prog","#humanSteps li"],"hidden":["#panel-review","#qWrap"]} },
     "in-new-resume-offer": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500],["click","#projTrig"],["wait",350],["click","#menuProjects [data-nav=\"new\"]"],["wait",500]], "expect": {"visible":["#panel-name","#wizResume","#wizResumeGo"],"hidden":["#panel-done"],"text":[["#wizResumeName","Mercury"]]} },
     "out-map-projects": { "auth": false, "actions": [["click", "#projTrig"], ["wait", 350]], "expect": { "expanded": true, "hidden": ["#menuProjects [data-nav=\"mine\"]"] } },
-    "card": { "auth": true, "actions": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://amazonprimea.com\"]"], ["wait", 900]], "expect": { "dialog": true, "hasClass": [["#projCard", "has-art"]], "visible": ["#cardArt", "#cardFaces", "#cardBuildersFig", "#cardShippedFig", "#cardOpen", "#cardHall"], "text": [["#cardBuilders", "11"], ["#cardShipped", "0"], ["#cardRel", "you build here"], ["#cardRuns", "amazonprimea.com"], ["#cardFaces .facesMore", "+6"]], "count": [["#cardFaces img", 5]], "href": [["#cardHall", "https://builders.amazonprimea.com/"]] } },
+    "card": { "auth": true, "actions": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://example.com\"]"], ["wait", 900]], "expect": { "dialog": true, "hasClass": [["#projCard", "has-art"]], "visible": ["#cardArt", "#cardFaces", "#cardBuildersFig", "#cardShippedFig", "#cardOpen", "#cardHall"], "text": [["#cardBuilders", "11"], ["#cardShipped", "0"], ["#cardRel", "you build here"], ["#cardRuns", "example.com"], ["#cardFaces .facesMore", "+6"]], "count": [["#cardFaces img", 5]], "href": [["#cardHall", "https://builders.example.com/"]] } },
     "card-noart": { "auth": true, "actions": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://emersonian-circles.cloudbongos.com\"]"], ["wait", 600]], "expect": { "dialog": true, "hasClass": [["#projCard", "has-art", false]], "hidden": ["#cardArt", "#cardFaces", "#cardHall"], "visible": ["#cardBuildersFig", "#cardShippedFig", "#cardOpen"], "text": [["#cardShipped", "30+"], ["#cardRel", "you build here"]] } },
     "card-self": { "auth": true, "actions": [["dispatchClick", "#selfOrb"], ["wait", 600]], "expect": { "dialog": true, "hidden": ["#cardArt"], "visible": ["#cardBuildersFig", "#cardShippedFig", "#cardFaces", "#cardOpen", "#cardHall"], "text": [["#cardRel", "yours"]] } }
   },

package/modules/status-ui/module.json

@@ -1,7 +1,7 @@
 {
   "key": "status-ui",
   "title": "Status dashboard (\"The Watch\")",
-  "description": "The public build-status dashboard served at status.<apex> (status.amazonprimea.com) — the live up/down banner, version-progress rollups, cost summary, recent ships, leaderboard, and the ecosystem fingerprint, all polling the read-only /api/gds/public/* surface every 60s. A WEB-SURFACE core-domain module carved out of the GDS core in BV1.R84 (ADR 0093 §1; 02-module-map §6 — a web surface is first-class). default-on: a Cloud Bongos instance ships its status page like it ships its hall. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir) the loader hands serve-internal, which serves the module's public/ dir on the matching host exactly as it served public-status/ before. The public read endpoints it renders stay SHARED core in routes/public.js (the hall + the off-box mirror read them too).",
+  "description": "The public build-status dashboard served at status.<apex> (status.example.com) — the live up/down banner, version-progress rollups, cost summary, recent ships, leaderboard, and the ecosystem fingerprint, all polling the read-only /api/gds/public/* surface every 60s. A WEB-SURFACE core-domain module carved out of the GDS core in BV1.R84 (ADR 0093 §1; 02-module-map §6 — a web surface is first-class). default-on: a Cloud Bongos instance ships its status page like it ships its hall. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir) the loader hands serve-internal, which serves the module's public/ dir on the matching host exactly as it served public-status/ before. The public read endpoints it renders stay SHARED core in routes/public.js (the hall + the off-box mirror read them too).",
   "coreVersion": "^1.11.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/status-ui/public/status.js

@@ -1,11 +1,11 @@
-// status.amazonprimea.com — public dashboard JS.
+// status.example.com — public dashboard JS.
 // Polls /api/bongos/public/* every 60 seconds. No auth, no SPA framework.
 
 // API base for the public read endpoints (#737). Empty = same-origin, the case
-// when this file is served by the droplet itself (status.amazonprimea.com
+// when this file is served by the droplet itself (status.example.com
 // proxies /api/* to the same Node process). The OFF-BOX GitHub Pages mirror
 // (the owner's status-mirror repo, ADR 0029) injects window.STATUS_API_BASE =
-// 'https://amazonprimea.com' in its <head> so the same byte-identical file
+// 'https://example.com' in its <head> so the same byte-identical file
 // fetches cross-origin from the droplet there (CORS is open). Keeping this file
 // identical on both hosts is what lets the mirror sync be a pure copy.
 const API = (typeof window !== 'undefined' && window.STATUS_API_BASE) || '';
@@ -1275,7 +1275,7 @@ document.addEventListener('visibilitychange', () => {
 
 // ---------- deep-link resolver (#654) ----------
 // A bare doc ref like "#173" links into the Builders' Hall, but a viewer can also
-// land on the PUBLIC status dashboard at status.amazonprimea.com/#/idea/173 (or
+// land on the PUBLIC status dashboard at status.example.com/#/idea/173 (or
 // /#/task/N, /#/blocker/N). Resolve it to a MINIMAL card — id + status + type
 // only; an idea/blocker title is NEVER shown here (the public endpoints withhold
 // it), and a task title only when the projection already marked it public

package/modules/status-ui/public/style.css

@@ -1,4 +1,4 @@
-/* status.amazonprimea.com — public ledger of an ancient-Greek city.
+/* status.example.com — public ledger of an ancient-Greek city.
    Form factor: weathered marble + parchment, Cinzel inscription headings,
    EB Garamond body. Square corners, hairline double-rules, no SaaS softness.
    Palette stays inside the locked Mediterranean range. */