@bongos/core 1.19.725 → 1.19.727

package/src/bongos/routes/auth.js

@@ -267,12 +267,12 @@ const REPOS_COOKIE = 'gds_oauth_repos';
 const HANDSHAKE_COOKIE_MS = 30 * 60 * 1000;
 
 // The apex domain the instance is served under, read from the instance branding
-// pack's cookieDomain (".amazonprimea.com" → "amazonprimea.com",
+// pack's cookieDomain (".example.com" → "example.com",
 // ".cloudbongos.com" → "cloudbongos.com"). The session + OAuth-state cookies are
 // scoped to ".<apex>" so a single sign-in is shared across every subdomain
 // (apex, builders., status.) — the enabler for the dedicated builders subdomain
 // (#726). MUST come from config, not a hardcoded literal: a hardcoded
-// "amazonprimea.com" made every OTHER instance (e.g. cloudbongos.com) set a
+// "example.com" made every OTHER instance (e.g. cloudbongos.com) set a
 // cookie for the wrong domain, which the browser drops → the OAuth state cookie
 // never persisted → "state mismatch / the gate is closed" (ADR 0062 §3/§5: domains
 // woven into auth, config swaps must not widen cookie scope). Each instance scopes
@@ -296,7 +296,7 @@ function reqHost(req) {
 }
 
 // The production-facing hosts that share one sign-in. Deliberately enumerated
-// (not "any *.amazonprimea.com") so staging.amazonprimea.com — a SEPARATE
+// (not "any *.example.com") so staging.example.com — a SEPARATE
 // process + DB on :3001 — keeps a host-only cookie and never bleeds an
 // apex-scoped token into prod (or vice versa).
 // When COOKIE_APEX is "" (localhost / no configured cookieDomain) the set is
@@ -309,7 +309,7 @@ const APEX_COOKIE_HOSTS = new Set(
 
 // Cookie attributes that vary by host. On the production-facing hosts the
 // session cookie is scoped to the apex so it crosses subdomains (the enabler
-// for builders.amazonprimea.com, #726); everywhere else (localhost, staging)
+// for builders.example.com, #726); everywhere else (localhost, staging)
 // it stays host-only. Returns a spread-able object.
 function sessionCookieDomainOpts(req) {
   if (APEX_COOKIE_HOSTS.has(reqHost(req))) {
@@ -320,7 +320,7 @@ function sessionCookieDomainOpts(req) {
 
 // Validate a caller-supplied post-sign-in return target. Accept ONLY:
 //   - a relative path beginning with a single '/' (not '//', no backslash), or
-//   - an absolute https URL whose host is the apex or a *.amazonprimea.com sub.
+//   - an absolute https URL whose host is the apex or a *.example.com sub.
 // Anything else (other origins, javascript:, protocol-relative) → null, so the
 // caller falls back to the safe default. This is an open-redirect guard.
 function safeReturnTo(raw) {
@@ -355,7 +355,7 @@ function recoveryStartHref(req) {
 
 // The canonical sign-in origin, read from the instance branding pack (oauthOrigin,
 // else publicOrigin) so a non-OTB Cloud Bongos instance pins its OAuth redirects to
-// ITS OWN apex instead of a hardcoded "amazonprimea.com" (ADR 0062 §3/§5; the
+// ITS OWN apex instead of a hardcoded "example.com" (ADR 0062 §3/§5; the
 // branding contract). The fixed GDS_PUBLIC_ORIGIN env knob still wins for
 // dev/staging (auth.js's documented FIXED env name, not a <PREFIX>_ one). Resolved
 // once at module load; falls back to '' if branding fails, which leaves the env knob
@@ -535,7 +535,7 @@ module.exports = function buildAuthRouter() {
     const state = crypto.randomBytes(16).toString('hex');
     // redirect_uri is PINNED to the canonical origin (#734) — never derived from
     // the request host. GitHub only knows the apex callback, so a sign-in begun
-    // on builders.amazonprimea.com must still hand GitHub the apex redirect_uri
+    // on builders.example.com must still hand GitHub the apex redirect_uri
     // or GitHub rejects it. Same posture the Discord flow already uses.
     const redirectUri = `${WEB_REDIRECT_ORIGIN}/api/gds/auth/web/callback`;
     res.cookie(STATE_COOKIE, state, {
@@ -551,7 +551,7 @@ module.exports = function buildAuthRouter() {
     // the page gates); otherwise fall back to the Referer (the page that kicked
     // off sign-in), so the dozens of client 401 redirects land a builder back
     // where they were with no per-call-site change. Both go through the
-    // open-redirect allowlist (relative path or *.amazonprimea.com https).
+    // open-redirect allowlist (relative path or *.example.com https).
     const returnTo = safeReturnTo(req.query.return) || safeReturnTo(req.headers.referer);
     if (returnTo) {
       res.cookie(RETURN_COOKIE, returnTo, {
@@ -676,7 +676,7 @@ module.exports = function buildAuthRouter() {
         path: '/',
         expires: expiresAt,
         // Apex-scoped on the production hosts so one sign-in spans
-        // amazonprimea.com + builders. + status. (#726); host-only elsewhere.
+        // example.com + builders. + status. (#726); host-only elsewhere.
         ...sessionCookieDomainOpts(req),
       });
       // A browser arriving with an older session name must not keep it: two
@@ -805,7 +805,7 @@ module.exports = function buildAuthRouter() {
       secure: req.secure || req.headers['x-forwarded-proto'] === 'https',
       maxAge: 10 * 60 * 1000,
       // Apex-scoped (#734 parity) so the state survives the host switch: the
-      // link may start on builders.amazonprimea.com but DISCORD_REDIRECT_URI
+      // link may start on builders.example.com but DISCORD_REDIRECT_URI
       // always lands the callback on the apex. A host-only cookie would be
       // dropped on the hop and the state check would fail ("Link handshake
       // expired"). Mirrors the GitHub web-flow state cookie above.
@@ -1036,7 +1036,7 @@ module.exports = function buildAuthRouter() {
     const cookieToken = sessionCookieToken(req);
     if (!cookieToken) {
       // Name the instance's own sign-in host (from the branding pack), not a
-      // hardcoded "amazonprimea.com" (ADR 0062 §3/§5).
+      // hardcoded "example.com" (ADR 0062 §3/§5).
       const signInHost = configuredOAuthOrigin().replace(/^https?:\/\//, '').split('/')[0] || 'the sign-in page';
       return res.fail('cookie_required', { status: 403, message: `This endpoint mints CLI bearers from an authenticated browser session. Sign in at ${signInHost} first; bearer-only requests are rejected so a leaked CLI token cannot mint replacements for itself.` });
     }

package/src/bongos/routes/security.js

@@ -35,7 +35,7 @@ const SECURITY_DOC_CONTENT_MAX = 2_000_000;
 
 // Where the full ADR is expected to live on the droplet. Configurable so dev /
 // staging can point at a different file; the recommended prod path is
-// /etc/amazonprimea/security-adr.md (chmod 600, owned by the deploy user).
+// /etc/example/security-adr.md (chmod 600, owned by the deploy user).
 function adrPath() {
   return (resolveEnv('SECURITY_ADR_PATH') || '').trim() || null;
 }

package/src/bongos/routes.js

@@ -11,7 +11,7 @@
 // Three logical groups:
 //   - /auth/*   — GitHub Device Flow (CLI) + Authorization Code (web)
 //   - /me, /tasks/*, /claims/*, /cost/*, /credits/*, ...  — authenticated CLI/web ops
-//   - /public/* — read-only, no auth, for status.amazonprimea.com
+//   - /public/* — read-only, no auth, for status.example.com
 //
 // All JSON. Same Express app as the game server.
 

package/src/branding.js

@@ -186,7 +186,7 @@ const branding = () => (_cached ||= loadBranding());
 
 // The HTTP User-Agent the GDS sends on outbound API calls (GitHub, Discord),
 // derived from the instance branding pack so a non-OTB Cloud Bongos instance
-// identifies itself with ITS OWN name rather than a hardcoded "amazonprimea-gds"
+// identifies itself with ITS OWN name rather than a hardcoded "example-gds"
 // (ADR 0062 §3/§5; the branding contract). Source order: the repo name (the
 // GitHub binding these calls actually target), else the env prefix, else a neutral
 // fallback. Falls back hard if branding fails so an outbound call never crashes.

package/src/devbox-downloads.js

@@ -10,7 +10,7 @@
 //   GET /downloads/devbox/latest.json   → { version, assets: { target: url } }
 //   GET /downloads/devbox/<target>      → 302 to the release asset
 //
-// so every URL a builder ever sees or shares stays on amazonprimea.com, and a
+// so every URL a builder ever sees or shares stays on example.com, and a
 // release bump is a one-file config change that rides the normal ship flow.
 // Pure (config in, urls out) so tests need no server.
 

package/src/instance-config.js

@@ -73,9 +73,9 @@ function envPrefix(b = safeBrand()) {
 // The default API base the CLI targets when there is no <PREFIX>_API_BASE env
 // override AND no logged-in session api_base — i.e. the last-resort fallback.
 // Resolves to THIS instance's own publicOrigin from the branding pack (OTB →
-// https://amazonprimea.com, vanilla → http://localhost:3000), so the portable
+// https://example.com, vanilla → http://localhost:3000), so the portable
 // core never hard-codes another instance's URL (task 1002201 — pre-ADR-0139 the
-// literal 'https://amazonprimea.com' was baked into cli-lib, sending every
+// literal 'https://example.com' was baked into cli-lib, sending every
 // unconfigured consumer at the founder's game box). Single source of truth: every
 // CLI base resolution routes through here. Last-resort http://localhost:3000 when
 // branding can't be read at all — a local dev origin, never a foreign prod, so an

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.725'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.727'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/module-loader/provenance.js

@@ -6,7 +6,7 @@
 //
 // No module in this tree names a FOREIGN origin today — every module here was
 // built in this repo. Some name THIS instance as their origin (e.g. the
-// provisioning module's "Off the Boats (the first Cloud Bongos instance…)"),
+// provisioning module's "Example World (the first Cloud Bongos instance…)"),
 // which is still own-built. The split (core-loaded) side lights up only once a
 // module is actually pulled back in from the shared catalog under a different
 // project's name (ADR 0107 §8 pipeline, tasks 1770/1772).
@@ -17,7 +17,7 @@ function deriveProvenance(origin, ownProjectName) {
   const own = ownProjectName && String(ownProjectName).trim().toLowerCase();
   // "names this instance itself" (ADR 0107 §9) — an origin that IS, or leads
   // with, the own project name is own-built (a self-referential origin like
-  // "Off the Boats (the first Cloud Bongos instance)" counts). Only an origin
+  // "Example World (the first Cloud Bongos instance)" counts). Only an origin
   // naming a DIFFERENT project is core-loaded from the shared catalog. (An
   // exact `===` was too brittle: it was written when no module set `origin`,
   // so it never met a real, descriptive value — task 1776 re-land.)

package/tests/art_stage.mjs

@@ -82,13 +82,13 @@ await ta('main: no sandbox here → rebuilds, reports no sandbox, not surfaced',
 await ta('main: box context → restarts, waits healthy, prints the sandbox URL', async () => {
   let restarted = false;
   const deps = baseDeps({
-    resolvePreviewContext: () => ({ kind: 'box', url: 'https://sandbox-x.amazonprimea.com', healthUrl: 'http://127.0.0.1:3000/', restart: () => { restarted = true; } }),
+    resolvePreviewContext: () => ({ kind: 'box', url: 'https://sandbox-x.example.com', healthUrl: 'http://127.0.0.1:3000/', restart: () => { restarted = true; } }),
   });
   const r = await art.main(['--tiles', 'container_a'], deps);
   assert.equal(r.ok, true);
   assert.equal(r.surfaced, true);
   assert.equal(restarted, true);
-  assert.ok(deps.logs.some((l) => l.includes('https://sandbox-x.amazonprimea.com')));
+  assert.ok(deps.logs.some((l) => l.includes('https://sandbox-x.example.com')));
   assert.ok(deps.logs.some((l) => /container_a/.test(l)), 'affected tiles printed');
 });
 

package/tests/auth_anthropic_identity.mjs

@@ -49,7 +49,7 @@ const t = async (name, fn) => {
   catch (e) { fail++; console.log(`FAIL  ${name}\n      ${e.stack || e.message}`); }
 };
 
-const LINKED = { builder_id: 1, github_login: 'lars589', rank: 'archon', status: 'active', anthropic_user_id: 'uuid-real' };
+const LINKED = { builder_id: 1, github_login: 'example-owner', rank: 'archon', status: 'active', anthropic_user_id: 'uuid-real' };
 
 await t('linked builder + DIFFERENT header (2nd Claude account) → next() called, NOT 403 (pin removed)', async () => {
   nextSession = LINKED;

package/tests/auth_duplicate_cookie.mjs

@@ -1,6 +1,6 @@
 // tests/auth_duplicate_cookie.mjs — regression for the duplicate gds_session
 // cookie 401 (#851). A browser can carry TWO gds_session cookies: a stale
-// host-only one (set on amazonprimea.com before the #726/#734 apex-scoping
+// host-only one (set on example.com before the #726/#734 apex-scoping
 // rollout) AND the current apex-scoped one. The old extractToken() returned the
 // FIRST value only, so a stale duplicate could shadow the live session and 401
 // the builder (hit on the Discord link callback for builder 25). extractTokens()

package/tests/auth_error_brand.mjs

@@ -21,7 +21,7 @@ const { renderAuthErrorPage } = authMod;
 const KEYS = ['titleSuffix', 'epigraph', 'heading', 'subtitle', 'ctaLabel'];
 // Instance-specific terms that must never appear in the NEUTRAL/vanilla copy —
 // exactly what was leaking onto cloudbongos.com before this fix.
-const OTB_LORE = [/archon/i, /\bgate\b/i, /chronicles/i, /amazonprimea/i, /\bboats\b/i, /drachma/i];
+const OTB_LORE = [/archon/i, /\bgate\b/i, /chronicles/i, /example/i, /\bboats\b/i, /drachma/i];
 
 // A vanilla boot has no instance config → the neutral starter alone (the
 // fail-to-vanilla path), exactly as a fresh `node src/platform-server.js` would.

package/tests/auth_inactive_builder.mjs

@@ -59,7 +59,7 @@ await t('inactive builder with a live session → 403 builder_inactive, next() N
 });
 
 await t('active builder → next() called, req.builder populated (incl. status)', async () => {
-  nextSession = { builder_id: 1, github_login: 'lars589', rank: 'archon', status: 'active' };
+  nextSession = { builder_id: 1, github_login: 'example-owner', rank: 'archon', status: 'active' };
   const req = { headers: { authorization: 'Bearer abc123' } };
   const res = fakeRes();
   let nexted = false;

package/tests/backup_cli.mjs

@@ -46,7 +46,7 @@ function extractTimestamp(filename, dbName) {
 }
 
 t('extractTimestamp: well-formed filename', () => {
-  const ts = extractTimestamp('amazonprimea-2026-06-29T040001Z.sql.gz', 'amazonprimea');
+  const ts = extractTimestamp('example-2026-06-29T040001Z.sql.gz', 'example');
   assert.equal(ts, '2026-06-29T040001Z');
 });
 t('extractTimestamp: different db name', () => {
@@ -58,7 +58,7 @@ t('extractTimestamp: different db name', () => {
 // These verify the shape the CLI backup.js expects from GET /backup/status.
 
 t('status: latest_dump null when no dumps', () => {
-  const response = { backup_dir: '/var/backups/gds', db_name: 'amazonprimea', latest_dump: null, trigger_running: false };
+  const response = { backup_dir: '/var/backups/gds', db_name: 'example', latest_dump: null, trigger_running: false };
   assert.equal(response.latest_dump, null);
   assert.equal(response.trigger_running, false);
 });
@@ -66,9 +66,9 @@ t('status: latest_dump null when no dumps', () => {
 t('status: latest_dump populated when dumps exist', () => {
   const response = {
     backup_dir: '/var/backups/gds',
-    db_name: 'amazonprimea',
+    db_name: 'example',
     latest_dump: {
-      filename: 'amazonprimea-2026-06-29T040001Z.sql.gz',
+      filename: 'example-2026-06-29T040001Z.sql.gz',
       timestamp: '2026-06-29T040001Z',
       size_bytes: 614400,
       count: 7,

package/tests/bongos_box_connect.mjs

@@ -6,7 +6,7 @@ import { test } from 'node:test';
 import crypto from 'node:crypto';
 import lib from '../scripts/gds/box-connect-lib.js';
 
-const HOST = 'box-alice.dev.amazonprimea.com';
+const HOST = 'box-alice.dev.example.com';
 
 test('rankAtLeast gates --local at Metic+', () => {
   assert.equal(lib.rankAtLeast('metic', 'metic'), true);
@@ -69,7 +69,7 @@ test('buildKnownHostsUpsert drops the stale line for the host, keeps others, app
 // ACCUMULATED: the client kept verifying against the first, now-wrong entry
 // ("Host denied (verification failed)") on a box that had just re-reported keys.
 test('buildKnownHostsUpsert drops a host,ip entry for this box (the accumulation bug)', () => {
-  const existing = `${HOST},64.225.49.206 ssh-ed25519 STALE\n`;
+  const existing = `${HOST},192.0.2.30 ssh-ed25519 STALE\n`;
   const next = lib.buildKnownHostsUpsert(existing, HOST, 'ssh-ed25519 AAAANEW');
   assert.ok(!next.includes('STALE'), 'a `host,ip` field-1 names this host and must be replaced');
   assert.ok(next.includes(`${HOST} ssh-ed25519 AAAANEW`));

package/tests/bongos_downloads.mjs

@@ -23,7 +23,7 @@ function t(name, fn) {
 }
 
 const CFG = {
-  releases_repo: 'lars589/amazonprimea-bongos',
+  releases_repo: 'example-owner/example-bongos',
   version: '1.2.3',
   assets: {
     'mac-arm64': 'bongos-1.2.3-darwin-arm64',
@@ -39,7 +39,7 @@ t('maps a known target to the versioned release-asset URL', () => {
   const d = buildBongosDownloads(CFG);
   assert.equal(
     d.redirectFor('mac-arm64'),
-    'https://github.com/lars589/amazonprimea-bongos/releases/download/v1.2.3/bongos-1.2.3-darwin-arm64'
+    'https://github.com/example-owner/example-bongos/releases/download/v1.2.3/bongos-1.2.3-darwin-arm64'
   );
 });
 

package/tests/bongos_login.mjs

@@ -17,11 +17,11 @@ const { normalizeInstanceBase, pollDecision } = require('../scripts/gds/login.js
 const LOGIN_JS = path.join(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'), 'scripts', 'gds', 'login.js');
 
 test('normalizeInstanceBase adds https, strips trailing slashes + a pasted /api/gds', () => {
-  assert.equal(normalizeInstanceBase('amazonprimea.com'), 'https://amazonprimea.com');
-  assert.equal(normalizeInstanceBase('https://amazonprimea.com/'), 'https://amazonprimea.com');
-  assert.equal(normalizeInstanceBase('https://amazonprimea.com///'), 'https://amazonprimea.com');
-  assert.equal(normalizeInstanceBase('https://amazonprimea.com/api/gds'), 'https://amazonprimea.com');
-  assert.equal(normalizeInstanceBase('https://amazonprimea.com/api/gds/'), 'https://amazonprimea.com');
+  assert.equal(normalizeInstanceBase('example.com'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com/'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com///'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com/api/gds'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com/api/gds/'), 'https://example.com');
   assert.equal(normalizeInstanceBase('http://localhost:3000'), 'http://localhost:3000');
 });
 

package/tests/box_connect_e2e.mjs

@@ -138,8 +138,8 @@ t('installed managed-settings.json at the override dir, keyed off the session lo
   const f = path.join(settingsDir, 'managed-settings.json');
   assert.ok(fs.existsSync(f), 'managed-settings.json not written');
   const s = JSON.parse(fs.readFileSync(f, 'utf8'));
-  assert.equal(s.sshConfigs[0].sshHost, 'root@box-e2etester.dev.amazonprimea.com');
-  assert.deepEqual(s.sshHostAllowlist, ['*.dev.amazonprimea.com']);
+  assert.equal(s.sshConfigs[0].sshHost, 'root@box-e2etester.dev.example.com');
+  assert.deepEqual(s.sshHostAllowlist, ['*.dev.example.com']);
 });
 
 t('did NOT leak the GDS token into stdout/stderr', () => {

package/tests/box_dns_repoint.mjs

@@ -71,8 +71,8 @@ function runHook(scenario, extraEnv = {}, retries = '4') {
       ...process.env,
       PATH: `${tmp}:${process.env.PATH}`,
       CLOUDFLARE_API_TOKEN: 'faketoken',
-      CLOUDFLARE_ZONE: 'amazonprimea.com',
-      BOX_HOSTNAME: 'box-test.dev.amazonprimea.com',
+      CLOUDFLARE_ZONE: 'example.com',
+      BOX_HOSTNAME: 'box-test.dev.example.com',
       BOX_DNS_BACKOFF_BASE: '0', // no real sleeps in tests
       BOX_DNS_RETRIES: retries,
       FAKE_CF_SCENARIO: scenario,
@@ -87,7 +87,7 @@ function runHook(scenario, extraEnv = {}, retries = '4') {
 {
   const r = runHook('retry_zone', { BOX_IP: '1.2.3.4' });
   assert.equal(r.status, 0, `retry should self-heal to exit 0; got ${r.status} :: ${r.out}`);
-  assert.match(r.out, /updated A box-test\.dev\.amazonprimea\.com -> 1\.2\.3\.4/, r.out);
+  assert.match(r.out, /updated A box-test\.dev\.example\.com -> 1\.2\.3\.4/, r.out);
   const attempts = parseInt(fs.readFileSync(counterFile, 'utf8'));
   assert.ok(attempts >= 2, `zone lookup should have been retried (>=2 attempts), got ${attempts}`);
 }
@@ -115,19 +115,19 @@ function runHook(scenario, extraEnv = {}, retries = '4') {
 
   const hit = runHook('delete_hit', { BOX_DNS_DELETE: '1' });
   assert.equal(hit.status, 0, `delete of a present record exits 0; got ${hit.status} :: ${hit.out}`);
-  assert.match(hit.out, /deleted A box-test\.dev\.amazonprimea\.com/, hit.out);
+  assert.match(hit.out, /deleted A box-test\.dev\.example\.com/, hit.out);
 }
 
 // ── Part B: runDnsHook / runDnsHookBlackhole contract + the idea-309 repoint ────
 {
   const box = require('../scripts/gds/box.js');
-  const upOk = box.runDnsHook('box-x.dev.amazonprimea.com', '1.2.3.4', 'exit 0');
+  const upOk = box.runDnsHook('box-x.dev.example.com', '1.2.3.4', 'exit 0');
   assert.equal(upOk.ok, true, 'runDnsHook returns ok:true when the hook succeeds');
 
-  const upFail = box.runDnsHook('box-x.dev.amazonprimea.com', '1.2.3.4', 'exit 1');
+  const upFail = box.runDnsHook('box-x.dev.example.com', '1.2.3.4', 'exit 1');
   assert.equal(upFail.ok, false, 'runDnsHook returns ok:false when the hook FAILS (no silent swallow)');
 
-  const noIp = box.runDnsHook('box-x.dev.amazonprimea.com', null, 'exit 1');
+  const noIp = box.runDnsHook('box-x.dev.example.com', null, 'exit 1');
   assert.equal(noIp.ok, true, 'runDnsHook is a no-op (ok:true skipped) when ip is absent');
 
   // idea 309: on deprovision the box lifecycle REPOINTS the record to the
@@ -137,15 +137,15 @@ function runHook(scenario, extraEnv = {}, retries = '4') {
   const probe = path.join(tmp, 'blackhole-ip');
   process.env.PROBE_FILE = probe;
   const captureHook = `node -e 'require("fs").writeFileSync(process.env.PROBE_FILE, process.env.BOX_IP || "MISSING")'`;
-  const bhOk = box.runDnsHookBlackhole('box-x.dev.amazonprimea.com', captureHook);
+  const bhOk = box.runDnsHookBlackhole('box-x.dev.example.com', captureHook);
   assert.equal(bhOk.ok, true, 'runDnsHookBlackhole returns ok:true when the hook succeeds');
   assert.equal(fs.readFileSync(probe, 'utf8'), '192.0.2.1', 'runDnsHookBlackhole must REPOINT to the 192.0.2.1 sentinel (not delete)');
   delete process.env.PROBE_FILE;
 
-  const bhFail = box.runDnsHookBlackhole('box-x.dev.amazonprimea.com', 'exit 1');
+  const bhFail = box.runDnsHookBlackhole('box-x.dev.example.com', 'exit 1');
   assert.equal(bhFail.ok, false, 'runDnsHookBlackhole returns ok:false when the hook FAILS (best-effort, but still reports)');
 
-  const bhNoHook = box.runDnsHookBlackhole('box-x.dev.amazonprimea.com', null);
+  const bhNoHook = box.runDnsHookBlackhole('box-x.dev.example.com', null);
   assert.equal(bhNoHook.ok, true, 'runDnsHookBlackhole is a no-op (ok:true skipped) when no hook is configured');
 }
 

package/tests/box_host_keys.mjs

@@ -47,7 +47,7 @@ const RSA = 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/FqVQUVRAmcDHRBeEZZwuW0xgsAP
 
 // 4) a hostname prefix (3 fields) → refused, not silently trimmed
 {
-  const r = validateHostKeyLines(`box-x.dev.amazonprimea.com ${ED}`);
+  const r = validateHostKeyLines(`box-x.dev.example.com ${ED}`);
   assert.equal(r.ok, false);
   assert.equal(r.error, 'expect_type_and_key_only');
 }

package/tests/box_onboard.mjs

@@ -131,28 +131,28 @@ console.log('managed-settings:');
 t('buildManagedSettings: shape matches the template; allowlist pins the passed sshZone', () => {
   // world + sshZone are supplied by the caller from the branding pack (task 1705);
   // the renderer is pure and bakes exactly what it's given.
-  const s = o.buildManagedSettings({ login: 'alice', hostname: 'box-alice.dev.amazonprimea.com', world: 'Amazonprimea', sshZone: 'dev.amazonprimea.com' });
+  const s = o.buildManagedSettings({ login: 'alice', hostname: 'box-alice.dev.example.com', world: 'Example', sshZone: 'dev.example.com' });
   assert.equal(s.sshConfigs[0].id, 'otb-alice');
-  assert.equal(s.sshConfigs[0].name, 'Amazonprimea Dev Box');
-  assert.equal(s.sshConfigs[0].sshHost, 'root@box-alice.dev.amazonprimea.com');
+  assert.equal(s.sshConfigs[0].name, 'Example Dev Box');
+  assert.equal(s.sshConfigs[0].sshHost, 'root@box-alice.dev.example.com');
   assert.equal(s.sshConfigs[0].startDirectory, '~/workspace');
-  assert.deepEqual(s.sshHostAllowlist, ['*.dev.amazonprimea.com']);
+  assert.deepEqual(s.sshHostAllowlist, ['*.dev.example.com']);
 });
 
 t('buildManagedSettings: bad login / hostname throw coded errors (no injection into the JSON)', () => {
-  assert.throws(() => o.buildManagedSettings({ login: 'a/b', hostname: 'x.dev.amazonprimea.com' }), /BAD_LOGIN|invalid login/);
+  assert.throws(() => o.buildManagedSettings({ login: 'a/b', hostname: 'x.dev.example.com' }), /BAD_LOGIN|invalid login/);
   assert.throws(() => o.buildManagedSettings({ login: 'alice', hostname: 'evil"\nhost' }), /BAD_HOSTNAME|invalid hostname/);
 });
 
 console.log('connect guide:');
 
 t('renderConnectGuide: bakes the apiBase into the bootstrap URLs', () => {
-  const g = o.renderConnectGuide({ apiBase: 'https://staging.amazonprimea.com' });
-  assert.ok(g.includes('https://staging.amazonprimea.com/api/gds/box/connect.sh'));
+  const g = o.renderConnectGuide({ apiBase: 'https://staging.example.com' });
+  assert.ok(g.includes('https://staging.example.com/api/gds/box/connect.sh'));
   assert.ok(g.includes('/api/gds/box/connect.ps1'));
   // the supplied apiBase is baked verbatim (the caller PINS the origin — it is never
   // a hardcoded host brand, task 1705)
-  assert.ok(o.renderConnectGuide({ apiBase: 'https://amazonprimea.com' }).includes('https://amazonprimea.com/api/gds/box/connect.sh'));
+  assert.ok(o.renderConnectGuide({ apiBase: 'https://example.com' }).includes('https://example.com/api/gds/box/connect.sh'));
 });
 
 console.log('DB query shapes (fake pool):');
@@ -297,7 +297,7 @@ await ta('GET /box/managed-settings: → 200 JSON keyed off the session login',
   assert.equal(r.status, 200);
   const b = await r.json();
   assert.equal(b.sshConfigs[0].id, 'otb-alice');
-  assert.equal(b.sshConfigs[0].sshHost, 'root@box-alice.dev.amazonprimea.com');
+  assert.equal(b.sshConfigs[0].sshHost, 'root@box-alice.dev.example.com');
 });
 
 await ta('GET /box/connect.sh: PUBLIC, no auth → 200; bakes the PINNED origin and IGNORES a spoofed Host (blocker #2/#5)', async () => {

package/tests/box_scope_session.mjs

@@ -85,7 +85,7 @@ await t('box session + allowBoxScope (middleware ran) → next() called, req.bui
 
 // ---- cli / web sessions are unaffected by the box gate -----------------------
 await t('cli session on a non-box route → unaffected, next() called', async () => {
-  nextSession = { builder_id: 1, github_login: 'lars589', rank: 'archon', status: 'active', source: 'cli' };
+  nextSession = { builder_id: 1, github_login: 'example-owner', rank: 'archon', status: 'active', source: 'cli' };
   const req = { headers: { authorization: 'Bearer clitoken' } }; // no allowBoxScope
   const res = fakeRes();
   let nexted = false;

package/tests/box_terminal_ssrf.mjs

@@ -24,9 +24,9 @@ const test = (name, fn) => {
   catch (e) { fail++; console.log(`FAIL  ${name}\n      ${e.message}`); }
 };
 
-const LOGIN = 'lars589';
+const LOGIN = 'example-owner';
 // The dev-box apex is INJECTED rather than taken from the live instance branding
-// (task 1002470). Two reasons: the neutral core has no amazonprimea.com apex, so the
+// (task 1002470). Two reasons: the neutral core has no example.com apex, so the
 // three allow-cases could not pass; and every reject-case below was passing for the
 // WRONG reason — an apex mismatch, not the rule it names. With a pinned apex,
 // 'rejects another builder's term- host' really does prove the login binding.
@@ -34,10 +34,10 @@ const APEX = 'apex.example';
 
 // ---- allowed: the two legitimate tunnel shapes -------------------------------
 test('allows the named-tunnel apex host bound to the caller login', () => {
-  assert.equal(isSafeTerminalUrl(`https://term-lars589.${APEX}`, LOGIN, APEX), true);
+  assert.equal(isSafeTerminalUrl(`https://term-example-owner.${APEX}`, LOGIN, APEX), true);
 });
 test(`allows the named-tunnel dev-zone host (term-<login>.dev.${APEX})`, () => {
-  assert.equal(isSafeTerminalUrl(`https://term-lars589.dev.${APEX}/`, LOGIN, APEX), true);
+  assert.equal(isSafeTerminalUrl(`https://term-example-owner.dev.${APEX}/`, LOGIN, APEX), true);
 });
 test('allows a Cloudflare quick-tunnel host (*.trycloudflare.com)', () => {
   assert.equal(isSafeTerminalUrl('https://random-words-1234.trycloudflare.com', LOGIN, APEX), true);
@@ -66,10 +66,10 @@ for (const bad of [
 
 // ---- rejected: wrong scheme / shape / cross-login ----------------------------
 test('rejects http (must be https)', () => {
-  assert.equal(isSafeTerminalUrl(`http://term-lars589.${APEX}`, LOGIN, APEX), false);
+  assert.equal(isSafeTerminalUrl(`http://term-example-owner.${APEX}`, LOGIN, APEX), false);
 });
 test('rejects embedded credentials (user:pass@host)', () => {
-  assert.equal(isSafeTerminalUrl(`https://user:pass@term-lars589.${APEX}`, LOGIN, APEX), false);
+  assert.equal(isSafeTerminalUrl(`https://user:pass@term-example-owner.${APEX}`, LOGIN, APEX), false);
 });
 test('rejects another builder\'s term- host (login binding)', () => {
   assert.equal(isSafeTerminalUrl(`https://term-someoneelse.${APEX}`, LOGIN, APEX), false);
@@ -89,7 +89,7 @@ test('rejects garbage / unparseable', () => {
   assert.equal(isSafeTerminalUrl(null, LOGIN, APEX), false);
 });
 test('rejects when login is empty (cannot bind the term- form)', () => {
-  assert.equal(isSafeTerminalUrl(`https://term-lars589.${APEX}`, '', APEX), false);
+  assert.equal(isSafeTerminalUrl(`https://term-example-owner.${APEX}`, '', APEX), false);
 });
 
 console.log(`\n${pass} passed, ${fail} failed`);

package/tests/boxes.mjs

@@ -898,10 +898,10 @@ t('#903: rendered cloud-init user-data stays under DigitalOcean\'s 64KB cap', ()
     .split('__CLOUDFLARED_SERVICE_B64__').join(gz('cloudflared.service'))
     .split('__CLOUDFLARED_RUN_B64__').join(gz('cloudflared-run.sh'))
     .split('__CLOSE_BOX_B64__').join(gz('close-box.sh'))
-    .split('__REPO_URL__').join('git@github.com:owner/amazonprimea.git')
+    .split('__REPO_URL__').join('git@github.com:owner/example.git')
     .split('__BUILDER_AUTHORIZED_KEYS_B64__').join(Buffer.from('ssh-ed25519 AAAA...k1\nssh-ed25519 AAAA...k2\n').toString('base64'))
-    .split('__BOX_ENV_B64__').join(Buffer.from('BOX_TUNNEL_TOKEN=' + 'x'.repeat(200) + '\nBOX_TERMINAL_HOSTNAME=term-x.amazonprimea.com\nBOX_TERMINAL_CREDENTIAL=' + 'a'.repeat(48) + '\nBOX_PREVIEW_HOSTNAME=sandbox-x.amazonprimea.com\n').toString('base64'))
-    .split('__GDS_SESSION_B64__').join(Buffer.from(JSON.stringify({ token: 'x'.repeat(64), builder: { id: 1, github_login: 'x', rank: 'archon' }, api_base: 'https://amazonprimea.com' })).toString('base64'));
+    .split('__BOX_ENV_B64__').join(Buffer.from('BOX_TUNNEL_TOKEN=' + 'x'.repeat(200) + '\nBOX_TERMINAL_HOSTNAME=term-x.example.com\nBOX_TERMINAL_CREDENTIAL=' + 'a'.repeat(48) + '\nBOX_PREVIEW_HOSTNAME=sandbox-x.example.com\n').toString('base64'))
+    .split('__GDS_SESSION_B64__').join(Buffer.from(JSON.stringify({ token: 'x'.repeat(64), builder: { id: 1, github_login: 'x', rank: 'archon' }, api_base: 'https://example.com' })).toString('base64'));
   const bytes = Buffer.byteLength(out, 'utf8');
   assert.ok(bytes < 64 * 1024, `rendered cloud-init is ${bytes}B; must stay under DO's 65536B cap`);
 });
@@ -1193,13 +1193,13 @@ t('planDropletDrift: a droplet a live box owns is in sync (no drift)', () => {
 t('planDropletDrift: ZOMBIE — droplet exists but its box row is destroyed (the bug)', () => {
   // The exact task-1289 shape: deprovision marked the row destroyed + nulled
   // droplet_id, but the droplet was never actually deleted.
-  const droplets = [{ id: 222, name: 'otb-box-lars589', tags: ['otb-builder-box', 'builder:lars589'], created_at: '2026-05-01T00:00:00Z' }];
-  const boxRows = [{ builder_id: 3, github_login: 'lars589', state: 'destroyed', droplet_id: null }];
+  const droplets = [{ id: 222, name: 'otb-box-example-owner', tags: ['otb-builder-box', 'builder:example-owner'], created_at: '2026-05-01T00:00:00Z' }];
+  const boxRows = [{ builder_id: 3, github_login: 'example-owner', state: 'destroyed', droplet_id: null }];
   const { zombies, ghosts } = boxes.planDropletDrift({ droplets, boxRows, nowMs: NOW });
   assert.equal(ghosts.length, 0);
   assert.equal(zombies.length, 1);
   assert.equal(zombies[0].dropletId, '222');
-  assert.equal(zombies[0].login, 'lars589');
+  assert.equal(zombies[0].login, 'example-owner');
   assert.equal(zombies[0].builderId, 3, 'maps the zombie back to its builder for edge teardown');
 });
 
@@ -1383,8 +1383,8 @@ function sweepHarness({ idleRows, parkThrows = null }) {
 
 await ta('cmdSweepIdle: an idle box is PARKED — snapshot retained, no snapshot delete', async () => {
   const NOW_ROW = {
-    id: 3, builder_id: 3, state: 'active', droplet_id: '591743808', droplet_name: 'box-lars589',
-    github_login: 'lars589', last_activity_at: new Date(Date.now() - 5 * 3600_000).toISOString(),
+    id: 3, builder_id: 3, state: 'active', droplet_id: '591743808', droplet_name: 'box-example-owner',
+    github_login: 'example-owner', last_activity_at: new Date(Date.now() - 5 * 3600_000).toISOString(),
     claude_active: false, snapshot_id: null,
   };
   const h = sweepHarness({ idleRows: [NOW_ROW] });
@@ -1414,7 +1414,7 @@ await ta('cmdSweepIdle: an idle box is PARKED — snapshot retained, no snapshot
 
 await ta('cmdSweepIdle: dry-run reports "would park" and touches nothing', async () => {
   const row = {
-    id: 3, builder_id: 3, state: 'active', droplet_id: '591743808', github_login: 'lars589',
+    id: 3, builder_id: 3, state: 'active', droplet_id: '591743808', github_login: 'example-owner',
     last_activity_at: new Date(Date.now() - 5 * 3600_000).toISOString(), claude_active: false,
   };
   const h = sweepHarness({ idleRows: [row] });

package/tests/branding.mjs

@@ -21,7 +21,7 @@ const NEUTRAL = {
 
 // A GENERIC sample instance pack — exercises the resolver's override/merge/precedence logic
 // without baking any real instance's identity into the (published) test. (task 1002219 / audit H5:
-// swept the former customer-1 sample — Off the Boats / amazonprimea / Hermeslines — to neutral.)
+// swept the former customer-1 sample — Example World / example / Hermeslines — to neutral.)
 const SAMPLE = {
   identity: { productName: 'Acme Rockets', worldName: 'Acme', company: { name: 'Acme Corp', site: 'https://acme.example' } },
   llmProjectName: 'Acme Rockets',
@@ -95,7 +95,7 @@ test('deepMerge does not mutate its inputs', () => {
 test('the committed neutral pack loads + resolves to the neutral identity (the trunk carries no instance branding.json)', () => {
   // The neutral trunk ships config/branding.neutral.json only — no config/branding.json — so
   // loadBranding resolves to the plain Cloud Bongos identity (task 1002219 / audit H5: this used to
-  // assert the customer-1 OTB identity, stale since the amazonprimea→cloudbongos rebrand, ADR 0139/0140).
+  // assert the customer-1 OTB identity, stale since the example→cloudbongos rebrand, ADR 0139/0140).
   const b = loadBranding({ env: {} });
   assert.equal(b.identity.productName, 'Cloud Bongos');
   assert.equal(b.identity.worldName, 'Cloud Bongos');

package/tests/bump_version.mjs

@@ -146,7 +146,7 @@ test('a HUMAN release commit never matches — skipping it would swallow its pub
 });
 
 test('work-merge subjects, junk, and empties never match', () => {
-  assert.equal(isReleaseCommit('Merge pull request #30 from lars589/claude/cloudbongos-npm-registry-b9a57f'), false);
+  assert.equal(isReleaseCommit('Merge pull request #30 from example-owner/claude/cloudbongos-npm-registry-b9a57f'), false);
   assert.equal(isReleaseCommit('fix(ship): protection-aware deploy mode'), false);
   assert.equal(isReleaseCommit(''), false);
   assert.equal(isReleaseCommit(null), false);
@@ -190,7 +190,7 @@ test('publish.yml wires the terminator: guard step present, every armed step gat
 test('laneReleasedVersions reads the versions this lane announced', () => {
   const subjects = [
     'release: core 1.19.368 — CI auto-patch carrier (publish-on-merge, ADR 0161)',
-    'Merge pull request #385 from lars589/some-branch',
+    'Merge pull request #385 from example-owner/some-branch',
     'release: core 1.19.367 — CI auto-patch carrier (publish-on-merge, ADR 0161)',
     'feat(security): something unrelated',
   ];