@bongos/core 1.19.725 → 1.19.727

package/tests/government_protected_surfaces.mjs

@@ -518,3 +518,140 @@ test('the floor decision reads the hit\'s registry floor, so a re-map takes effe
   const atFloor = ppc.checkPermissionPaths({ changedFiles: ['migrations/001.sql'], builderRank: 'metic' });
   assert.equal(atFloor.hardFail, false);
 });
+
+
+// ---------------------------------------------------------------------------
+// task 1002874 — NFC + case-folding, the last piece of R101's ADR 0151 §4 scope.
+//
+// R101 shipped the registry with matching left exact-BYTES, deliberately and
+// declared: its hard constraint was byte-identical behaviour, and normalisation
+// changes what matches. This IS that change, so these come in two halves — the
+// wall must now hold against a re-spelling, and nothing protected before may have
+// stopped being protected.
+// ---------------------------------------------------------------------------
+
+// A real literal surface from the registry, not a fixture: this cannot pass
+// against a glob that no longer exists.
+const LITERAL = ppc.PROTECTED_SURFACES.find((s) => !s.glob.includes('*') && !s.glob.endsWith('/'));
+
+test('a CASE variant of a protected path is still protected', () => {
+  assert.ok(LITERAL, 'no literal surface in the registry — this test is reading the wrong shape');
+  assert.ok(ppc.surfaceFor(LITERAL.glob), 'the exact spelling must match (sanity)');
+  // macOS by default and Windows are case-INsensitive: this names the SAME file.
+  assert.ok(ppc.surfaceFor(LITERAL.glob.toUpperCase()),
+    'an uppercased spelling of a protected file must not step over the wall');
+  const mixed = LITERAL.glob.replace(/(^|\/)([a-z])/g, (m, s, c) => s + c.toUpperCase());
+  assert.ok(ppc.surfaceFor(mixed), `a mixed-case spelling must not step over the wall: ${mixed}`);
+});
+
+test('the REPORTED path keeps its original case — only matching is folded', () => {
+  const shouty = LITERAL.glob.toUpperCase();
+  const [hit] = ppc.matchProtected([shouty]);
+  assert.ok(hit, 'the case variant must be caught');
+  assert.equal(hit.file, shouty,
+    'findings, refusals and grader issues all carry this path; a lowercased one names '
+    + 'nothing on a case-SENSITIVE filesystem (Linux, i.e. CI) and would ENOENT for a file that exists');
+  assert.equal(hit.glob, LITERAL.glob, 'and the registry glob is reported verbatim, not folded');
+});
+
+test('an NFD-composed path matches its NFC glob', () => {
+  // The registry is pure ASCII today, so this exercises the mechanism directly:
+  // one filename, two different byte strings, either of which a checkout can hand you.
+  const nfc = 'modules/caf\u00e9/secret.js';
+  const nfd = 'modules/cafe\u0301/secret.js';
+  assert.notEqual(nfc, nfd, 'the two spellings must really differ in bytes, or this proves nothing');
+  const fold = (s) => s.normalize('NFC').toLowerCase();
+  const re = ppc.globToRegExp(fold(nfc));
+  assert.ok(re.test(fold(nfd)), 'NFD and NFC spellings of one filename must match the same glob');
+  assert.ok(re.test(fold(nfc.toUpperCase())), 'and case must not separate them either');
+});
+
+test('STRICTLY WIDENING: every glob still matches a path it matched before', () => {
+  // The regression that would matter is a path silently becoming UNprotected, so
+  // walk the whole registry and synthesise a concrete path from each glob.
+  let checked = 0;
+  for (const s of ppc.PROTECTED_SURFACES) {
+    const sample = s.glob.endsWith('/')
+      ? `${s.glob}probe.js`
+      : s.glob.replace(/\*\*/g, 'x/y').replace(/\*/g, 'z');
+    assert.ok(ppc.surfaceFor(sample), `${s.glob} no longer protects ${sample} — this change must never narrow`);
+    checked += 1;
+  }
+  assert.ok(checked >= 40, `only ${checked} surfaces walked — the registry read is not working`);
+});
+
+test('an UNprotected path is still unprotected — folding must not over-reach', () => {
+  for (const p of ['README.md', 'docs/notes.md', 'tests/example.mjs']) {
+    assert.equal(ppc.surfaceFor(p), null, `${p} must not become protected by normalisation`);
+  }
+});
+
+test('the matcher never uses a LOCALE-sensitive case fold (the Turkish-I hazard)', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'), 'utf8')
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/\/\/[^\n]*/g, '');
+  assert.ok(src.length > 1000, `comment-stripping left only ${src.length} chars — the scan is reading nothing`);
+  assert.ok(!/toLocaleLowerCase|toLocaleUpperCase/.test(src),
+    'toLocaleLowerCase("tr") maps I to dotless i — measured — so a Turkish locale would fold '
+    + 'two different paths together. Plain toLowerCase is locale-independent by specification '
+    + 'and is the correct primitive here; the ADR note warning against it does not apply to JS.');
+  assert.match(src, /toLowerCase\(\)/, 'and the fold must actually be applied');
+  assert.match(src, /normalize\('NFC'\)/, 'as must NFC composition');
+});
+
+
+// ---------------------------------------------------------------------------
+// task 1002874, round 2 — the fold has to reach every PROTECTED matcher, not just
+// the one in permission-path-check.
+//
+// Round 1 fixed matchProtected/surfaceFor and trusted the task description's claim
+// that all eleven substrate consumers route through them. They do not.
+// gate-review.js — the CI ESCALATE / HARD_FLOOR classifier — imported the RAW
+// PROTECTED_GLOBS plus globToRegExp and compiled its own byte-exact regexes, so an
+// uppercased spelling of a gate surface still walked past the auto-merge gate after
+// the wall itself was fixed. Its isCanonicalPath() rejects non-NFC and non-ASCII
+// but does not case-fold, so it never covered this.
+// ---------------------------------------------------------------------------
+
+test('compileGlobMatcher folds BOTH sides', () => {
+  const m = ppc.compileGlobMatcher(['src/bongos/auth.js', 'migrations/']);
+  assert.ok(m('src/bongos/auth.js'), 'exact still matches');
+  assert.ok(m('SRC/BONGOS/AUTH.JS'), 'case variant matches');
+  assert.ok(m('Migrations/001.sql'), 'a folded subtree prefix still matches');
+  assert.ok(!m('docs/readme.md'), 'and an unrelated path does not');
+  assert.ok(!m(''), 'empty is never a match');
+  assert.ok(!m(null), 'nor is a missing path');
+});
+
+test('gate-review classifies a CASE-VARIANT gate surface as hard-floor', () => {
+  const gr = require(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'));
+  const literal = gr.HARD_FLOOR_GLOBS.find((g) => !g.includes('*') && !g.endsWith('/'));
+  assert.ok(literal, 'no literal hard-floor glob — this test is reading the wrong shape');
+  assert.ok(gr.matchesHardFloor(literal), 'the exact spelling must escalate (sanity)');
+  assert.ok(gr.matchesHardFloor(literal.toUpperCase()),
+    'an uppercased gate surface must still escalate — otherwise CI auto-merge is bypassable '
+    + 'by re-spelling, which is the hole this task exists to close');
+});
+
+test('no consumer compiles a PROTECTED glob list byte-exact', () => {
+  // The drift guard. Both globToRegExp and the raw glob lists are exported, so a
+  // consumer can rebuild the byte-exact matcher by accident — which is exactly what
+  // gate-review had done. globToRegExp stays exported because ALLOW-lists
+  // legitimately need it: folding publish-manifest's PUBLISH_ALLOWLIST would widen
+  // what reaches the public OSS mirror, i.e. publish MORE. So the ban is narrow —
+  // pairing a PROTECTED list with the raw compiler in one file.
+  const dir = path.join(ROOT, 'scripts', 'gds');
+  const files = fs.readdirSync(dir).filter((f) => f.endsWith('.js'));
+  assert.ok(files.length > 20, `only ${files.length} scripts scanned — the sweep is not reading the CLI directory`);
+  const offenders = [];
+  for (const f of files) {
+    const src = fs.readFileSync(path.join(dir, f), 'utf8')
+      .replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '');
+    const usesRawCompiler = /globToRegExp\s*\(/.test(src);
+    const usesProtectedList = /(PROTECTED_GLOBS|HARD_FLOOR_GLOBS)\s*\.\s*map/.test(src);
+    if (usesRawCompiler && usesProtectedList) offenders.push(f);
+  }
+  assert.deepEqual(offenders, [],
+    `these compile a protected-surface list with the raw byte-exact compiler; use `
+    + `compileGlobMatcher so the fold reaches them too: ${offenders.join(', ')}`);
+});

package/tests/grade_aggregates_unavailable.mjs

@@ -76,7 +76,7 @@ await test('gradeByBuilder: quality-filtered, and pass_rate is NULL (not 0.000)
   const sql = (await captureSql(() => db.gradeByBuilder(30)))[0];
   assertQualityFiltered(sql, 'gradeByBuilder');
   // The old shape ROUND(COALESCE(AVG(...),0),3) fabricated a 0.000 fail-streak
-  // for an all-outage window — the lars589 symptom. COALESCE must be gone from
+  // for an all-outage window — the example-owner symptom. COALESCE must be gone from
   // the pass_rate expression so it reads NULL ("no graded work") instead.
   assert.ok(!sql.includes('ROUND(COALESCE(AVG'), 'pass_rate must not coalesce an empty window to 0');
   assert.ok(/AVG\(CASE WHEN g\.passed THEN 1 ELSE 0 END\) FILTER/.test(sql), 'pass_rate must average quality rows only');

package/tests/hook_user_agents.mjs

@@ -3,8 +3,8 @@
 // task 2122 (demo-audit fix B) — the scaffolded .claude/hooks must NOT hardcode a
 // founder-instance brand in their outbound HTTP User-Agent. Those hooks are copied
 // into a consumer instance by claude-materialize, whose rebrand maps domain HOSTS
-// (amazonprimea.com), config dirs, and env prefixes — but NOT a bare brand token
-// like `amazonprimea-gds-cli` (no TLD). So a branded UA there leaks the founder's
+// (example.com), config dirs, and env prefixes — but NOT a bare brand token
+// like `example-gds-cli` (no TLD). So a branded UA there leaks the founder's
 // host-brand into every scaffolded instance (criterion gcarry-prod-vanilla).
 //
 // Invariant: every `'User-Agent': '<value>'` literal in .claude/hooks/*.js uses the

package/tests/init.mjs

@@ -27,8 +27,8 @@ function test(name, fn) {
 const fullSpec = () => init.normalizeSpec({
   identity: { productName: 'Cloud Bongos' },
   tagline: 'Building software is laying down a beat.',
-  repo: { owner: 'lars589', name: 'cloud-bongos' },
-  firstAdmin: 'lars589',
+  repo: { owner: 'example-owner', name: 'cloud-bongos' },
+  firstAdmin: 'example-owner',
   currency: { label: 'credits' },
   domains: { publicOrigin: 'http://localhost:3000' },
   modules: ['art-pipeline'],
@@ -48,8 +48,8 @@ test('buildBrandingConfig: lean overrides only (no theme block)', () => {
   const b = init.buildBrandingConfig(fullSpec());
   assert.equal(b.identity.productName, 'Cloud Bongos');
   assert.equal(b.identity.worldName, 'Cloud Bongos');     // defaults to productName
-  assert.equal(b.repo.owner, 'lars589');
-  assert.equal(b.firstAdmin, 'lars589');
+  assert.equal(b.repo.owner, 'example-owner');
+  assert.equal(b.firstAdmin, 'example-owner');
   assert.equal(b.currency.label, 'credits');
   assert.equal(b.envPrefix, 'BONGOS'); // canonical since task 1003703
   assert.equal(b.copy.tagline, 'Building software is laying down a beat.');
@@ -219,8 +219,8 @@ test('versionPayload: always sends an explicit, valid track', () => {
 // ---- provisioning arm (ADR 0111 §3, task 1946) ----
 const provSpec = (over = {}) => init.normalizeSpec({
   identity: { productName: 'Cloud Bongos' },
-  repo: { owner: 'lars589', name: 'cloud-bongos' },
-  firstAdmin: 'lars589',
+  repo: { owner: 'example-owner', name: 'cloud-bongos' },
+  firstAdmin: 'example-owner',
   version: { id: 'V1', name: 'V1', done_when: 'x' },
   provisioning: over,
 });

package/tests/instance_config.mjs

@@ -177,7 +177,7 @@ test('resolveDocsRoot: the explicit instance root when set, else coreRoot (no-op
 // Regression fixture for a bug that locked a builder out of re-authenticating.
 // Three call sites resolved the API base three different ways and none reached
 // the instance the builder was actually signed into:
-//   * paste-token.js hardcoded 'https://amazonprimea.com' (a straggler the task
+//   * paste-token.js hardcoded 'https://example.com' (a straggler the task
 //     1002201 sweep missed), so a token minted by cloudbongos.com was verified
 //     against the founder's host and rejected 401 — a VALID token, wrong host.
 //   * reauth.js used the module-level branding default, so it printed a

package/tests/instance_manifest.mjs

@@ -14,10 +14,10 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 
 // A client-safe branding projection (the shape clientBranding() returns).
 const BRAND_OTB = {
-  identity: { productName: 'Off the Boats', worldName: 'Amazonprimea', company: { name: 'Hermeslines' } },
+  identity: { productName: 'Example World', worldName: 'Example', company: { name: 'Hermeslines' } },
   currency: { label: 'drachmae', symbol: '' },
   theme: { colors: {}, fonts: { display: '', body: '', links: [] }, favicon: '', backdrop: '' },
-  copy: { tagline: 'Straight off the boats', hallName: 'Builders’ Hall', notFound: 'Page not found.' },
+  copy: { tagline: 'Straight example world', hallName: 'Builders’ Hall', notFound: 'Page not found.' },
   rankLabels: { xenos: 'Xenos', thetes: 'Thetes', metic: 'Metic', archon: 'Archon' },
   // the per-project policy the platform pushes (task 1003140) — the settings read-back
   project: { platformVisibility: 'gated', joinability: 'invite_only' },
@@ -37,12 +37,12 @@ const MODULES_VANILLA = {
   enabled: { game: false, 'art-pipeline': false, discord: false, 'dev-box': false },
   disciplines: ['engineer'],
 };
-const REPO = { owner: 'lars589', repo: 'amazonprimea', branch: 'main', blob_base: 'x', tree_base: 'y' };
+const REPO = { owner: 'example-owner', repo: 'example', branch: 'main', blob_base: 'x', tree_base: 'y' };
 
 test('manifest: schema id + headline name + embedded brand', () => {
   const m = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false, devBoxEnabled: true });
   assert.equal(m.schema, MANIFEST_SCHEMA);
-  assert.equal(m.name, 'Off the Boats');
+  assert.equal(m.name, 'Example World');
   assert.equal(m.brand, BRAND_OTB);
   assert.deepEqual(m.modules, MODULES_OTB);
 });
@@ -69,7 +69,7 @@ test('manifest: rank label falls back to the key when unlabelled', () => {
 
 test('manifest: repo projects to public clone coords; null on error', () => {
   const ok = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false, devBoxEnabled: true });
-  assert.deepEqual(ok.repo, { owner: 'lars589', repo: 'amazonprimea', branch: 'main', url: 'https://github.com/lars589/amazonprimea' });
+  assert.deepEqual(ok.repo, { owner: 'example-owner', repo: 'example', branch: 'main', url: 'https://github.com/example-owner/example' });
   const none = buildInstanceManifest({ branding: BRAND_VANILLA, modules: MODULES_VANILLA, rankTier: RANK_TIER, repo: { error: 'no_repo_info' }, authConfigured: false, openEnrollment: false, devBoxEnabled: false });
   assert.equal(none.repo, null);
 });

package/tests/instance_mismatch_guard.mjs

@@ -7,7 +7,7 @@
 //
 // The guard stops the CLI from silently borrowing a DIFFERENT instance's session
 // (the 2026-07-08 demo-session failure, where a fresh demo clone used the
-// founder's amazonprimea.com session and offered to write into the wrong live
+// founder's example.com session and offered to write into the wrong live
 // backlog). Both helpers are deterministic with no DB/network/fs, so they
 // unit-test standalone. Run: node tests/instance_mismatch_guard.mjs
 
@@ -25,14 +25,14 @@ function test(name, fn) {
 }
 
 const DEMO = { domains: { publicOrigin: 'https://demo.cloudbongos.com' } };
-const OTB = { domains: { publicOrigin: 'https://amazonprimea.com' } };
+const OTB = { domains: { publicOrigin: 'https://example.com' } };
 const noEnv = {}; // no <PREFIX>_API_BASE override in scope
 const branded = () => true;  // simulate a checkout that HAS config/branding.json (a declared instance)
 const neutral = () => false; // simulate a NEUTRAL checkout (portable core — no config/branding.json)
 
 test('instanceOriginHost: extracts host, tolerates trailing slash', () => {
-  assert.equal(cli.instanceOriginHost('https://amazonprimea.com'), 'amazonprimea.com');
-  assert.equal(cli.instanceOriginHost('https://amazonprimea.com/'), 'amazonprimea.com');
+  assert.equal(cli.instanceOriginHost('https://example.com'), 'example.com');
+  assert.equal(cli.instanceOriginHost('https://example.com/'), 'example.com');
   assert.equal(cli.instanceOriginHost('https://demo.cloudbongos.com/api/gds'), 'demo.cloudbongos.com');
 });
 
@@ -43,20 +43,20 @@ test('instanceOriginHost: unparseable input → null (edge)', () => {
 });
 
 test('match: same-host session + branding → no mismatch (the OTB/normal case)', () => {
-  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: OTB, env: noEnv, hasInstanceConfig: branded });
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://example.com' }, brand: OTB, env: noEnv, hasInstanceConfig: branded });
   assert.equal(r.mismatch, false);
 });
 
 test('match: scheme/trailing-slash differences still match on host', () => {
-  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com/' }, brand: OTB, env: noEnv, hasInstanceConfig: branded });
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://example.com/' }, brand: OTB, env: noEnv, hasInstanceConfig: branded });
   assert.equal(r.mismatch, false);
 });
 
-test('mismatch: demo repo + founder amazonprimea session → REFUSE (the reported failure)', () => {
-  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: DEMO, env: noEnv, hasInstanceConfig: branded });
+test('mismatch: demo repo + founder example session → REFUSE (the reported failure)', () => {
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://example.com' }, brand: DEMO, env: noEnv, hasInstanceConfig: branded });
   assert.equal(r.mismatch, true);
   assert.equal(r.expected, 'https://demo.cloudbongos.com');
-  assert.equal(r.actual, 'https://amazonprimea.com');
+  assert.equal(r.actual, 'https://example.com');
 });
 
 test('mismatch: demo repo + cloudbongos.com session (sibling instance) → REFUSE', () => {
@@ -66,15 +66,15 @@ test('mismatch: demo repo + cloudbongos.com session (sibling instance) → REFUS
 
 test('env-override: an explicit *_API_BASE override wins (dev/staging) → no mismatch', () => {
   const r = cli.detectInstanceMismatch({
-    session: { api_base: 'https://amazonprimea.com' }, brand: DEMO,
+    session: { api_base: 'https://example.com' }, brand: DEMO,
     env: { GDS_API_BASE: 'http://localhost:3000' },
   });
   assert.equal(r.mismatch, false);
 });
 
 test('no-branding: repo declares no publicOrigin → cannot assert a mismatch → no mismatch', () => {
-  assert.equal(cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: {}, env: noEnv, hasInstanceConfig: branded }).mismatch, false);
-  assert.equal(cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: { domains: {} }, env: noEnv, hasInstanceConfig: branded }).mismatch, false);
+  assert.equal(cli.detectInstanceMismatch({ session: { api_base: 'https://example.com' }, brand: {}, env: noEnv, hasInstanceConfig: branded }).mismatch, false);
+  assert.equal(cli.detectInstanceMismatch({ session: { api_base: 'https://example.com' }, brand: { domains: {} }, env: noEnv, hasInstanceConfig: branded }).mismatch, false);
 });
 
 test('NEUTRAL checkout (no config/branding.json) → trust the session, NO mismatch (task 1002399)', () => {
@@ -88,7 +88,7 @@ test('NEUTRAL checkout (no config/branding.json) → trust the session, NO misma
 
 test('neutral guard is precedence-safe: env override still wins even when neutral', () => {
   // env override short-circuits before the neutral check — order-independent.
-  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: DEMO, env: { GDS_API_BASE: 'http://localhost:3000' }, hasInstanceConfig: neutral });
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://example.com' }, brand: DEMO, env: { GDS_API_BASE: 'http://localhost:3000' }, hasInstanceConfig: neutral });
   assert.equal(r.mismatch, false);
 });
 

package/tests/leak_scan_allowlist.mjs

@@ -0,0 +1,94 @@
+// tests/leak_scan_allowlist.mjs
+//
+// Task 1003869 — the named exceptions to the prior-instance leak scan. The allowlist is
+// a security carve-out, so what matters is not that it permits the right things but that
+// it CANNOT permit the wrong ones: scoping is per (path, literal), a listed file does not
+// become a free pass, and an entry that stops matching is reported rather than forgotten.
+//
+// Run:  node tests/leak_scan_allowlist.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const A = require('../scripts/gds/leak-scan-allowlist.js');
+const { allowReason, partitionHits, unusedEntries, FILE_ALLOWLIST, WELL_KNOWN_PUBLIC_IPS } = A;
+const { PRIOR_INSTANCE_FLOOR } = require('../scripts/gds/package-core.js');
+
+// This test file is itself published, so it derives the literals it exercises rather
+// than spelling them out — the same self-leak invariant the allowlist module holds.
+const OWNER = PRIOR_INSTANCE_FLOOR.owners[0];
+const TOKEN = PRIOR_INSTANCE_FLOOR.tokens[0];
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── every entry carries its reason ───────────────────────────────────────────────────
+t('every entry names a path, at least one literal, and a substantive reason', () => {
+  for (const e of FILE_ALLOWLIST) {
+    assert.ok(e.path && typeof e.path === 'string', 'entry needs a path');
+    assert.ok(Array.isArray(e.classes) && e.classes.length > 0, `${e.path} needs classes`);
+    assert.ok(typeof e.reason === 'string' && e.reason.length > 40,
+      `${e.path} needs a reason that explains itself, not a label`);
+  }
+  for (const [ip, why] of Object.entries(WELL_KNOWN_PUBLIC_IPS)) {
+    assert.ok(typeof why === 'string' && why.length > 10, `${ip} needs a reason`);
+  }
+});
+
+// ── scoping: a listed file is NOT a free pass ────────────────────────────────────────
+t('an allowlisted file still fails on a literal it was not listed for', () => {
+  // mirror-redact.js is listed for public-ip only. An owner login appearing there would
+  // be a real leak — the SELF-LEAK INVARIANT that file documents about itself.
+  assert.ok(allowReason('scripts/gds/mirror-redact.js', 'public-ip', '8.8.8.8'));
+  assert.equal(allowReason('scripts/gds/mirror-redact.js', `literal:${OWNER}`, OWNER), null,
+    'a literal whose class is not named for this path must still fail');
+});
+t('an entry does not leak across to another path', () => {
+  // audit-authorship.sh may carry the owner login; an arbitrary script may not.
+  assert.ok(allowReason('scripts/gds/audit-authorship.sh', `literal:${OWNER}`, OWNER));
+  assert.equal(allowReason('scripts/gds/some-other-script.js', `literal:${OWNER}`, OWNER), null);
+});
+t('an unlisted file gets no exception at all', () => {
+  assert.equal(allowReason('src/bongos/routes/auth.js', `literal:${TOKEN}`, TOKEN), null);
+  assert.equal(allowReason('src/anything.js', 'public-ip', '203.0.113.9'), null,
+    'an address that is not well-known is not covered anywhere');
+});
+
+// ── well-known addresses are global, and exact ───────────────────────────────────────
+t('a well-known public address is covered in any file, but only by exact match', () => {
+  assert.ok(allowReason('tests/anything.mjs', 'public-ip', '8.8.8.8'));
+  assert.ok(allowReason('modules/whatever/x.js', 'public-ip', '1.1.1.1'));
+  // An address that is not on the well-known list is covered NOWHERE — the whole point of
+  // the sweep. Asserted with RFC 5737 documentation addresses rather than this instance's
+  // real ones: a test that pins "our droplet must not be allowlisted" by NAMING the droplet
+  // puts it straight back into the published trunk, which is the leak it is guarding against.
+  assert.equal(allowReason('tests/anything.mjs', 'public-ip', '198.51.100.7'), null);
+  assert.equal(allowReason('tests/anything.mjs', 'public-ip', '192.0.2.99'), null);
+});
+
+// ── partition + staleness ────────────────────────────────────────────────────────────
+t('partitionHits separates covered hits from real ones and attaches the reason', () => {
+  const hits = [
+    { path: 'tests/mirror_redact.mjs', label: 'public-ip', sample: '8.8.8.8' },
+    { path: 'src/bongos/routes/auth.js', label: `literal:${TOKEN}`, sample: TOKEN },
+  ];
+  const { allowed, remaining } = partitionHits(hits);
+  assert.equal(allowed.length, 1);
+  assert.ok(allowed[0].reason.length > 10, 'a covered hit carries the reason it was covered');
+  assert.equal(remaining.length, 1);
+  assert.equal(remaining[0].path, 'src/bongos/routes/auth.js');
+});
+t('unusedEntries reports an entry that has stopped matching', () => {
+  // No hits at all → every file entry is stale, which is the signal to prune.
+  assert.ok(unusedEntries([]).length > 0);
+  // A hit that covers one entry removes exactly that one from the stale list.
+  const stale = unusedEntries([{ path: 'scripts/gds/mirror-redact.js', label: 'public-ip', sample: '8.8.8.8' }]);
+  assert.ok(!stale.some((s) => s.path === 'scripts/gds/mirror-redact.js' && s.literal === 'public-ip'));
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/migrate_root_resolution.mjs

@@ -72,7 +72,7 @@ function printRoots({ cwd, initCwd } = {}) {
 }
 
 // A synthetic consumer: a dir with a bongos.config.json pointing at itself, exactly
-// as the post-split amazonprimea repo carries (bongos.config.json { instanceRoot: "." }).
+// as the post-split example repo carries (bongos.config.json { instanceRoot: "." }).
 function makeConsumer() {
   const dir = mkFixture('r89-consumer-');
   writeFileSync(path.join(dir, 'bongos.config.json'), JSON.stringify({ instanceRoot: '.' }));
@@ -249,7 +249,7 @@ t('the pre-fix unquoted loop now fails loudly instead of silently skipping', ()
 // ==========================================================================
 // WHICH DATABASE does migrate target? (task 1002755)
 //
-// scripts/migrate.sh:52 used to read `DB="${PGDATABASE:-amazonprimea}"` — one host instance's
+// scripts/migrate.sh:52 used to read `DB="${PGDATABASE:-example}"` — one host instance's
 // database name, baked into a script the core ships to EVERY instance. With no PGDATABASE in the
 // environment, a co-hosted box silently aimed at a stranger's database and everywhere else died
 // with a confusing "database ... does not exist" — after the caller had already moved its version
@@ -314,7 +314,7 @@ t('an instance that names no database is REFUSED, never defaulted', () => {
   assert.match(r.stderr, /cannot determine which database/i);
   assert.match(r.stderr, /Refusing to guess/i);
   // the regression itself: it must not reach for another instance's database
-  assert.doesNotMatch(`${r.stdout}${r.stderr}`, /amazonprimea/i);
+  assert.doesNotMatch(`${r.stdout}${r.stderr}`, /example/i);
 });
 
 t('--print-migrations stays DB-free — a dry run must not require a database name', () => {
@@ -333,7 +333,7 @@ t('migrate.sh hardcodes no instance database name', () => {
   const code = src.split(/\r?\n/).filter((l) => !/^\s*#/.test(l)).join('\n');
   assert.doesNotMatch(code, /PGDATABASE:-\s*[A-Za-z]/,
     'PGDATABASE must have no literal fallback — resolve from the branding pack instead');
-  assert.doesNotMatch(code, /amazonprimea/i, 'no instance database name in executable lines');
+  assert.doesNotMatch(code, /example/i, 'no instance database name in executable lines');
 });
 
 console.log(`\nmigrate_root_resolution: ${passed} passed, ${failed} failed`);

package/tests/mirror_redact.mjs

@@ -104,12 +104,12 @@ t('isPublicRoutableIPv4 classifier boundaries', () => {
 
 // ── IPv6 floor: global unicast redacted, loopback/link-local/ULA kept ─────────────────
 t('public IPv6 (the droplet) redacted; loopback/link-local/ULA kept', () => {
-  const out = redactText('v6 2604:a880:800:14:0:2:ee66:b000 keep fe80::1 fc00::5 ::1', rules);
+  const out = redactText('v6 2606:4700:4700::1111 keep fe80::1 fc00::5 ::1', rules);
   assert.ok(!out.includes('2604:a880'), `public IPv6 leaked: ${out}`);
   assert.ok(out.includes('fe80::1') && out.includes('fc00::5') && out.includes('::1'), out);
 });
 t('isPublicRoutableIPv6 + a "12:34:56" timestamp is NOT treated as an IP', () => {
-  assert.equal(isPublicRoutableIPv6('2604:a880:800:14:0:2:ee66:b000'), true);
+  assert.equal(isPublicRoutableIPv6('2606:4700:4700::1111'), true);
   assert.equal(isPublicRoutableIPv6('fe80::1'), false);
   assert.equal(isPublicRoutableIPv6('fc00::5'), false);
   assert.equal(isPublicRoutableIPv6('::1'), false);
@@ -127,14 +127,38 @@ t('reserved ::/8 is NOT a public IP — degenerate shorthand in binary is not a
   }
   // ...and the narrowing did NOT blunt the gate: real global unicast still fires, in
   // both the detector and the redactor.
-  for (const s of ['2000::1', '2001:db8::1', '2606:4700:4700::1111', '3fff::1']) {
+  for (const s of ['2000::1', '2606:4700:4700::1111', '3fff::1']) {
     assert.equal(isPublicRoutableIPv6(s), true, `${s} is a real public address and must still be flagged`);
   }
+  // 2001:db8::/32 is RESERVED FOR DOCUMENTATION (RFC 3849) — the IPv6 analogue of the
+  // RFC 5737 TEST-NET ranges v4 already exempts, and for the same reason: it is the
+  // address an example is SUPPOSED to use, nothing is reachable there, and flagging it
+  // only punishes docs for being written correctly (task 1003869). It was listed above
+  // as "a real public address" until then, which RFC 3849 says it is not.
+  for (const s of ['2001:db8::1', '2001:0db8:85a3:0000:0000:8a2e:0370:7334']) {
+    assert.equal(isPublicRoutableIPv6(s), false, `${s} is the RFC 3849 doc range and must not be flagged`);
+  }
   assert.equal(firstPublicIP('sprite bytes :: more bytes'), null, 'binary-ish shorthand is not reported');
   assert.equal(firstPublicIP('origin 2606:4700:4700::1111'), '2606:4700:4700::1111');
   assert.ok(!redactText('host 2606:4700:4700::1111', []).includes('2606:4700'), 'a real public IPv6 is still redacted');
 });
 
+// ── candidate guards: things that LOOK like an address but are not one ───────────────
+t('a leading-zero octet is packed numeric data, not an address (task 1003869)', () => {
+  // The committed GitHub logo path contains "…5.47 7.59.4.07.5…". The candidate regex
+  // reads 7.59.4.07 as a dotted quad, and it flagged ten phantom public-ip leaks across
+  // the design mocks and the landing page. No notation writes a host with a leading-zero
+  // octet ("07" is octal), so the guard costs nothing on a genuinely leaked address.
+  assert.equal(firstPublicIP('M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.5-.17'), null);
+  assert.equal(firstPublicIP('host 7.59.4.07'), null);
+  assert.equal(firstPublicIP('host 7.59.4.7'), '7.59.4.7', 'the same quad without the zero IS an address');
+});
+t('RFC 2544 benchmarking space 198.18/15 is not instance topology', () => {
+  assert.equal(isPublicRoutableIPv4(198, 18, 0, 1), false);
+  assert.equal(isPublicRoutableIPv4(198, 19, 255, 254), false);
+  assert.equal(isPublicRoutableIPv4(198, 20, 0, 1), true, 'the neighbouring /15 is ordinary public space');
+});
+
 // ── the DETECTOR is stricter than redaction ───────────────────────────────────────────
 t('findLeaks catches a raw literal substring a bounded rule would miss', () => {
   // "azoltanb" has no word boundary around zoltan; a \bzoltan\b rule misses it, the
@@ -143,7 +167,7 @@ t('findLeaks catches a raw literal substring a bounded rule would miss', () => {
   assert.ok(findLeaks('inline widgetco reference', literals).length > 0);
 });
 t('findLeaks is clean on fully-redacted output (fixed point)', () => {
-  const dirty = 'https://widgetco.com by zoltan at 8.8.8.8 and 2604:a880:800:14:0:2:ee66:b000';
+  const dirty = 'https://widgetco.com by zoltan at 8.8.8.8 and 2606:4700:4700::1111';
   const clean = redactText(dirty, rules);
   assert.deepEqual(findLeaks(clean, literals), [], `residual leaks: ${JSON.stringify(findLeaks(clean, literals))}`);
 });

package/tests/module_catalog.mjs

@@ -121,7 +121,7 @@ test('buildCatalog: keeps the DECLARED manifest fields beside the display credit
 
 test('buildCatalog: source and provenance are independent axes', () => {
   const rows = catalog.buildCatalog({
-    loaded: [loadedIn(CORE, 'provisioning', { origin: 'Off the Boats', author: 'Off the Boats' })],
+    loaded: [loadedIn(CORE, 'provisioning', { origin: 'Example World', author: 'Example World' })],
     coreRoot: CORE, instanceRoot: INST,
     ownProjectName: 'Mercury',
   });
@@ -156,7 +156,7 @@ test('buildCatalog: survives a manifest with nothing but the required keys', ()
 const sample = () => catalog.buildCatalog({
   loaded: [
     loadedIn(CORE, 'economy', { description: 'drachmae and credits' }),
-    loadedIn(CORE, 'provisioning', { author: 'Off the Boats', origin: 'Off the Boats', license: 'AGPL-3.0' }),
+    loadedIn(CORE, 'provisioning', { author: 'Example World', origin: 'Example World', license: 'AGPL-3.0' }),
     loadedIn(INST, 'game', { description: 'the world' }),
   ],
   enabled: { economy: true, game: true },
@@ -174,7 +174,7 @@ test('searchCatalog: matches key, description, author, origin and licence; empty
   assert.equal(catalog.searchCatalog(rows, '').length, 3);
   assert.equal(catalog.searchCatalog(rows, '   ').length, 3);
   assert.deepEqual(catalog.searchCatalog(rows, 'DRACHMAE').map((r) => r.key), ['economy'], 'case-insensitive, over description');
-  assert.deepEqual(catalog.searchCatalog(rows, 'off the boats').map((r) => r.key), ['provisioning'], 'over the credit');
+  assert.deepEqual(catalog.searchCatalog(rows, 'example world').map((r) => r.key), ['provisioning'], 'over the credit');
   assert.deepEqual(catalog.searchCatalog(rows, 'agpl').map((r) => r.key), ['provisioning'], 'over the licence');
   assert.deepEqual(catalog.searchCatalog(rows, 'nothing-matches-this'), []);
 });
@@ -202,7 +202,7 @@ test('formatCatalog: renders every row with its credit, and marks the inferred o
   assert.match(out, /2 in the core catalog \(1 enabled\) · 1 built here · 3 total/);
   assert.match(out, /\[x\]\s+economy/, 'an enabled module is marked [x]');
   assert.match(out, /\[ \]\s+provisioning/, 'a disabled module is marked [ ]');
-  assert.match(out, /Off the Boats/, 'a declared credit is shown');
+  assert.match(out, /Example World/, 'a declared credit is shown');
   assert.match(out, /credit not declared in module\.json/, 'the inferred-credit footnote appears when one is shown');
 });
 
@@ -227,7 +227,7 @@ test('formatCatalog: a search with no hits says so instead of printing an empty
 
 test('cmdList: --json emits the rows + summary, and honours --catalog/--search', () => {
   const lines = [];
-  const code = mod.cmdList(['--json', '--catalog', '--search', 'off the boats'], {
+  const code = mod.cmdList(['--json', '--catalog', '--search', 'example world'], {
     log: (s) => lines.push(s),
     gather: () => ({ rows: sample(), skipped: [], errors: [], core: '1.19.0' }),
   });

package/tests/module_submissions.mjs

@@ -59,14 +59,14 @@ await test('createModuleSubmission() INSERTs, jsonb-casts manifest/files/sign_of
   const precheckPassedAt = new Date('2026-07-08T00:00:00.000Z');
   nextRows = [{
     id: 1, module_key: 'widget', submitted_by: 42, manifest, sign_off: signOff,
-    precheck_passed_at: precheckPassedAt, source_repo: 'lars589/amazonprimea',
+    precheck_passed_at: precheckPassedAt, source_repo: 'example-owner/example',
     status: 'pending', reviewed_by: null, reviewed_at: null, review_notes: null,
     submitted_at: '2026-07-08T00:00:01.000Z',
   }];
 
   const row = await moduleSubmissions.createModuleSubmission({
     moduleKey: 'widget', submittedBy: 42, manifest, files, signOff, precheckPassedAt,
-    sourceRepo: 'lars589/amazonprimea',
+    sourceRepo: 'example-owner/example',
   });
 
   const { text, params } = lastCall();
@@ -83,7 +83,7 @@ await test('createModuleSubmission() INSERTs, jsonb-casts manifest/files/sign_of
   assert.equal(params[3], JSON.stringify(files));
   assert.equal(params[4], JSON.stringify(signOff));
   assert.equal(params[5], precheckPassedAt);
-  assert.equal(params[6], 'lars589/amazonprimea');
+  assert.equal(params[6], 'example-owner/example');
 
   assert.equal(row.id, 1);
   assert.equal(row.status, 'pending');

package/tests/package_core.mjs

@@ -585,7 +585,7 @@ t('scanArtifactForLeaks: flags a prior-instance literal in any shipped file', ()
 
 t('scanArtifactForLeaks: flags a public IP but not a private/localhost one', () => {
   const r = scanArtifactForLeaks([
-    { path: 'a.js', content: 'host = 104.236.254.243\n' },   // public → flagged
+    { path: 'a.js', content: 'host = 1.2.3.4\n' },           // public → flagged
     { path: 'b.js', content: 'host = 127.0.0.1; lan = 10.0.0.5\n' }, // localhost + private → not
   ]);
   const byPath = Object.fromEntries(r.literalHits.map((h) => [h.path, h.label]));