@bongos/core 1.19.726 → 1.19.727

package/scripts/gds/cli-lib.js

@@ -49,7 +49,7 @@ const SESSION_READ_PATHS = SESSION_FILENAMES.flatMap((n) => ic.configReadPaths(n
 // pack. Override for local dev / staging:
 //   CLOUDBONGOS_API_BASE=http://localhost:3000 node scripts/gds/start.js
 // No CLI script hard-codes another instance's URL (task 1002201; pre-ADR-0139 the
-// literal 'https://amazonprimea.com' was baked in at four sites here). The session
+// founder instance's apex was baked in literally at four sites here). The session
 // leg was added at task 1002427 — this const previously stopped at the branding
 // default, so module-level consumers (reauth's Settings URL, the hall links
 // hallBase() prints) named the checkout's own instance instead of the one the
@@ -59,7 +59,7 @@ const API_BASE = ic.resolveApiBase();
 // User-Agent for the GDS CLI's HTTP calls — the branding-derived neutral platform UA
 // from the single source, src/branding.js userAgent() (`<repo.name|envPrefix>-gds/1.0`,
 // neutral fallback `cloud-bongos-gds/1.0`), matching the `cloud-bongos-` convention the
-// hooks use (tests/hook_user_agents.mjs). Was the hardcoded 'amazonprimea-gds-cli/1.0'
+// hooks use (tests/hook_user_agents.mjs). Was a hardcoded '<founder-instance>-gds-cli/1.0'
 // at both fetch sites — task 1002234. Resolved once so apiCall + cliClient never diverge
 // and branding is read a single time; falls back neutrally if branding is unreadable.
 const CLI_USER_AGENT = (() => {
@@ -126,7 +126,7 @@ function costPlusOnlyNote(fromServer) {
 // hallBase(base) — the instance's builders' hall root for a given API base, e.g.
 // https://cloudbongos.com/builders. Derived from the RESOLVED base (env → session →
 // branding default), never a hardcoded host — so a CLI-printed link always points at
-// the instance the command is actually talking to, not the founder's amazonprimea box
+// the instance the command is actually talking to, not the founder instance's box
 // (task 1002233; the printed-link twin of the task-1002201 default-base fix). Falls
 // back to `${base}/builders` when base isn't a parseable absolute URL.
 function hallBase(base = API_BASE) {
@@ -581,7 +581,7 @@ function printBoxScopeGuidanceAndExit() {
 // for ITS OWN origin, the CLI fell back to whatever instance the machine last
 // signed into (session.api_base, else the prod default) and acted THERE. On
 // 2026-07-08 a fresh `demo` clone (config/branding → demo.cloudbongos.com), with
-// no demo session on the machine, borrowed the founder's amazonprimea.com session
+// no demo session on the machine, borrowed the founder instance's session
 // and offered to write a task into the wrong LIVE backlog. A wrong-instance write
 // is a data-integrity hazard, so we fail CLOSED: if the session we'd authenticate
 // with belongs to a different instance than THIS repo is configured for, refuse
@@ -704,7 +704,7 @@ async function apiCall(method, urlPath, body = null, opts = {}) {
   // that instance's origin to session.api_base, so every later command targets it.
   // Precedence mirrors readSessionToken: an explicit <PREFIX>_API_BASE env wins
   // (local dev / staging override), then the logged-in instance, then prod. OTB
-  // sessions already store api_base='https://amazonprimea.com', so this is a no-op
+  // sessions already store the founder instance's api_base, so this is a no-op
   // for the OTB instance and only bites once someone logs in to a different one.
   const base = ic.resolveApiBase({ session: session || null });
   const headers = {
@@ -755,7 +755,7 @@ async function apiCall(method, urlPath, body = null, opts = {}) {
 //   • throwOnError:false — every call resolves to { status, ok, data } (never
 //     throws on HTTP status; network errors still reject), so the long-standing
 //     apiCall contract holds and status-inspecting callers port 1:1.
-//   • fetch    — a wrapper that keeps apiCall's behavior: the amazonprimea CLI
+//   • fetch    — a wrapper that keeps apiCall's behavior: the founder CLI
 //     User-Agent, plus the 401 and box_scope 403 auto-exit guidance.
 // Named methods (api.tasks.getTasksId({ id })) replace hand-built apiCall paths;
 // api.request(method, path, opts) is the escape hatch for non-spec routes.

package/scripts/gds/cutover-codemod.js

@@ -7,7 +7,7 @@
 // Its relative core require()s — `require('../../src/module-api')` (host modules, F1),
 // `require('./src/bongos/…')` (the game entrypoint server.js, F3) — point at the DELETED
 // instance `src/` → boot crash (the 2026-07-10 rehearsal, findings F1+F3:
-// docs/reviews/2026-07-10-amazonprimea-decouple-r89-rehearsal.md). Core modules are UNAFFECTED:
+// docs/reviews/2026-07-10-example-decouple-r89-rehearsal.md). Core modules are UNAFFECTED:
 // they ship INSIDE @bongos/core, where `src/` sits next to `modules/`, so their identical
 // relative requires still resolve. The fix is to rewrite the host files' core requires to the
 // package's EXPORTED subpaths (`@bongos/core/module-api`, `@bongos/core/serve-internal`, …).

package/scripts/gds/dev-lib.js

@@ -9,7 +9,7 @@
 // createdb, migrate, set PORT/PGDATABASE/PGHOST/OAuth env, launch the server) with
 // three silent mismatches: the server reads PORT from env and NOT from branding
 // (platform-server.js:44); the server DB name collapses to the OS user while
-// migrate.sh defaults to `amazonprimea` (pool.js:47 vs migrate.sh:52) unless
+// migrate.sh defaults to `example` (pool.js:47 vs migrate.sh:52) unless
 // PGDATABASE is set for BOTH; and node-pg defaults to the Linux peer socket
 // /var/run/postgresql (pool.js:46), which does not exist under Homebrew Postgres on
 // a Mac. `bongos dev` collapses all of that into one idempotent command.
@@ -91,7 +91,7 @@ function sanitizeDbName(s) {
 // The DB name BOTH migrate.sh and the server pool will use. Precedence:
 //   explicit --db / override  ->  branding db.database  ->  the repo dir name  ->
 //   'cloudbongos_dev'. Whatever we pick is exported as PGDATABASE for both sides,
-//   which is the fix for the pool.js(OS-user) vs migrate.sh(amazonprimea) split.
+//   which is the fix for the pool.js(OS-user) vs migrate.sh(example) split.
 function deriveDbName({ brandingDbName, instanceRoot, override } = {}) {
   return (
     sanitizeDbName(override) ||

package/scripts/gds/diagnose-achievements.js

@@ -17,9 +17,9 @@
 //
 // Usage:
 //   # report only (exit 1 if any builder has a missed unlock — a smoke check):
-//   ssh lars@104.236.254.243 'cd ~/amazonprimea && node scripts/gds/diagnose-achievements.js'
+//   ssh <user>@<db-host> 'cd ~/<instance> && node scripts/gds/diagnose-achievements.js'
 //   # backfill: actually unlock every missed achievement (idempotent), then report:
-//   ssh lars@104.236.254.243 'cd ~/amazonprimea && node scripts/gds/diagnose-achievements.js --apply'
+//   ssh <user>@<db-host> 'cd ~/<instance> && node scripts/gds/diagnose-achievements.js --apply'
 
 const { pool } = require('../../src/bongos/pool');
 const {

package/scripts/gds/fitness-checks-identity.js

@@ -72,9 +72,11 @@ const IDENTITY_SCAN_EXTRA_FILES = [];
 //     (`dev.<host>`, the terminal zone). These are infrastructure identifiers,
 //     not an instance URL; routing them through branding would be wrong. (Its
 //     two genuine API-base defaults WERE fixed in 1002428.)
-//   * publish-manifest.js — the literal FILENAMES of two real committed docs
-//     (docs/recipes/amazonprimea-decouple-*.md). Renaming the strings without
-//     renaming the files would break the publish manifest.
+//   * publish-manifest.js — the literal FILENAMES of three real committed docs
+//     (the two decouple recipes, plus the instance's own name/trademark ADR that
+//     task 1003869 excluded: its prose redacts cleanly but the FILENAME rides in
+//     the published manifest). Renaming the strings without renaming the files
+//     would break the publish manifest.
 //   * backfill-sessions.js / version-close.js — one-time operator runbook text
 //     naming the actual prod DB + a historical local directory. Describing what
 //     an operator must literally type is the correct content.
@@ -112,7 +114,7 @@ const IDENTITY_SCAN_ALLOWED = {
   'scripts/gds/seed-staging.sh': 4,
   'scripts/gds/backfill-sessions.js': 2,
   'scripts/gds/box.js': 3,
-  'scripts/gds/publish-manifest.js': 2,
+  'scripts/gds/publish-manifest.js': 3,
   'scripts/gds/seed-bongos-coreB-tranche1-tasks.js': 1,
   'scripts/gds/seed-bongos-coreB-tranche2-tasks.js': 1,
   'scripts/gds/seed-bongos-goal-hierarchy-tasks.js': 1,

package/scripts/gds/gen-diagrams.js

@@ -53,7 +53,7 @@ const ASSERT_PATH = path.join(DIR, 'assertions.json');
 // The conceptual diagrams (03/04) carry instance identity:
 // the currency name, the public host, the world/product name. Read them from
 // the branding contract so a neutral instance renders neutral diagrams and an
-// owner's instance renders its own — no hard-coded OTB/Amazonprimea tokens, no
+// owner's instance renders its own — no hard-coded OTB/Example tokens, no
 // prod IP. Fail-safe to the neutral defaults (the generator must run headless,
 // and a branding validation error must not break diagram regeneration).
 // NOTE: the diagram FILE ids (e.g. 03-drachmae-karma) are structural — the hall

package/scripts/gds/leak-scan-allowlist.js

@@ -0,0 +1,293 @@
+#!/usr/bin/env node
+'use strict';
+
+// scripts/gds/leak-scan-allowlist.js — the NAMED, REASONED exceptions to the
+// prior-instance leak scan (task 1003869, the public-@bongos/core gate).
+//
+// WHY THIS EXISTS. scanArtifactForLeaks (scripts/gds/package-core.js) flags any
+// prior-instance literal or public IP anywhere in the built artifact. Most hits are
+// real and get swept at source. A residue is not: some files must contain the very
+// string the scan looks for, because containing it is their job. A detector has to
+// carry the pattern it detects; a test that proves "a public IP is flagged" has to
+// hand the scanner a public IP. Those cannot be swept — swept, the tests stop
+// testing — so they are recorded HERE, each one named with the reason it stays.
+//
+// THE RULE THIS FILE ENFORCES ON ITSELF. An entry is (path, classes, reason). Never
+// a bare path: allowlisting a whole FILE would let a genuinely new leak ride into an
+// already-listed file unnoticed, which is precisely the failure mode the scan exists
+// to prevent. A literal whose class is not named for that path is still a hard failure.
+//
+// STALENESS IS A FAILURE TOO. unusedEntries() reports entries that matched nothing.
+// An allowlist nobody prunes becomes a list of permissions nobody remembers granting,
+// so the sweep's own test asserts every entry still earns its place.
+
+// Addresses that are never ANY instance's topology: public resolvers, IANA's
+// documentation host, and a well-known forge. Global rather than per-file because
+// the safety here comes from the literal itself, not from which file holds it —
+// 8.8.8.8 is Google's resolver in every file in the world. RFC-reserved ranges
+// (5737 TEST-NET, 2544 benchmarking, 3849 v6 doc) are NOT here: those are handled
+// a layer down in mirror-redact.js, which never classes them public to begin with.
+const WELL_KNOWN_PUBLIC_IPS = {
+  '8.8.8.8': 'Google Public DNS — the canonical example resolver',
+  '8.8.4.4': 'Google Public DNS, secondary',
+  '1.1.1.1': 'Cloudflare DNS — the canonical example resolver',
+  '1.0.0.1': 'Cloudflare DNS, secondary',
+  '9.9.9.9': 'Quad9 DNS — a public resolver used as a probe fixture',
+  '4.4.4.4': 'a public resolver address used as a second, distinct fixture',
+  '1.2.3.4': 'the conventional placeholder quad — routable, so it exercises the "public" branch, but nobody here owns it',
+  '3.8.8.8': 'a near-miss of 8.8.8.8, used to prove the match is exact and not a prefix',
+  '93.184.216.34': "IANA's example.com — the documentation host, by definition not ours",
+  '140.82.121.4': 'github.com — a public forge, reached by name everywhere else in the tree',
+  '2606:4700:4700::1111': 'Cloudflare DNS over IPv6 — the v6 counterpart of 1.1.1.1',
+  '2606:2800:220:1:248:1893:25c8:1946': "IANA's example.com over IPv6",
+};
+
+// (path, classes, reason). Scoped to one file and the classes that file legitimately
+// carries; see floorLiteralsFor() below for why an entry names a class, not a string.
+const FILE_ALLOWLIST = [
+  {
+    path: 'scripts/gds/mirror-redact.js',
+    classes: ['public-ip'],
+    reason:
+      'This file IS the IP detector. Its RFC range comments and boundary-guard doc comments '
+      + 'quote address forms so the next reader can see what each guard rejects. The same '
+      + "self-reference the file's own SELF-LEAK INVARIANT describes for instance literals: it "
+      + 'carries no instance topology, only universal RFC constants.',
+  },
+  {
+    path: 'scripts/gds/audit-authorship.sh',
+    classes: ['owner', 'token'],
+    reason:
+      'This IS the authorship detector. Its PATTERN and SPEC_ALLOWLIST_PATTERN must contain the '
+      + 'literals verbatim or they match nothing — the script exists to find exactly these. '
+      + 'Neutralising them here would silently disarm the audit that keeps them out elsewhere.',
+  },
+  {
+    path: 'tests/package_core.mjs',
+    classes: ['token', 'owner', 'public-ip'],
+    reason:
+      "The leak scanner's own test suite. It feeds scanArtifactForLeaks each literal and a "
+      + 'routable address and asserts they are flagged; with neutral fixtures it would assert '
+      + "nothing. The addresses it uses are placeholders (1.2.3.4), never this instance's.",
+  },
+  {
+    path: 'tests/mirror_redact.mjs',
+    classes: ['public-ip'],
+    reason:
+      'The redactor/detector test suite. It must hand firstPublicIP genuinely routable v4 and v6 '
+      + 'addresses to prove the narrowing guards did not blunt the gate, and near-miss forms '
+      + '(leading-zero octets, ::/8 shorthand) to prove they are rejected. Public resolvers only.',
+  },
+  {
+    path: 'tests/public_mirror_export.mjs',
+    classes: ['public-ip'],
+    reason:
+      'Exercises redactBlob end to end, which requires an address that survives to the gate. '
+      + 'Uses the synthetic-instance fixtures declared at the top of that file.',
+  },
+  // ── the DEFINITIONS the scan itself reads ──────────────────────────────────────────
+  {
+    path: 'scripts/gds/package-core.js',
+    classes: ['token', 'owner'],
+    reason:
+      'Holds PRIOR_INSTANCE_FLOOR — the single definition of what counts as a prior-instance '
+      + 'literal, which this allowlist and the scan both read. The list cannot be neutral without '
+      + 'the scan matching nothing at all.',
+  },
+  {
+    path: 'scripts/gds/fitness-checks-identity.js',
+    classes: ['token'],
+    reason:
+      'The identity fitness check. Its rule array IS a case-insensitive regex per host-brand '
+      + 'literal — the patterns that stop a brand being re-hardcoded anywhere else in the tree. '
+      + 'Neutralising them disarms the check that keeps the rest of this sweep from regressing. '
+      + '(Described, not quoted: quoting the patterns here put them straight back into a shipped '
+      + 'file, and the check itself caught this file doing exactly that.)',
+  },
+  {
+    path: 'scripts/gds/publish-manifest.js',
+    classes: ['token'],
+    reason:
+      'The exclusion list names real excluded FILES (the instance-decouple recipes). A path is not '
+      + 'prose — renamed, it stops matching and the excluded docs start publishing.',
+  },
+
+  // ── the literal IS the test subject ────────────────────────────────────────────────
+  // These four PLANT a host-brand literal and assert a guard catches it, or compare a
+  // fixture against this instance's real identity. Neutralising the literal does not make
+  // the test neutral — it makes it pass while proving nothing, which is worse than the hit
+  // it removes. Each was caught by the suite when a first sweep renamed it (task 1003869).
+  {
+    path: 'tests/fitness.mjs',
+    classes: ['token'],
+    reason:
+      'The identity gate\'s "not a no-op" proof plants a bare host-brand literal in code, a URL '
+      + 'and HTML, and asserts the gate reports all three. A neutral literal is not caught, so the '
+      + 'test would assert the gate works by handing it nothing to find.',
+  },
+  {
+    path: 'tests/government_vanilla_boot.mjs',
+    classes: ['token'],
+    reason:
+      'Same shape: it plants a host brand in the NEUTRAL config pack and asserts the identity '
+      + 'guard catches it. The planted string has to be a real host brand or there is nothing to catch.',
+  },
+  {
+    path: 'tests/module_provenance.mjs',
+    classes: ['token'],
+    reason:
+      "Asserts a module whose origin equals THIS instance's name resolves as own-built rather than "
+      + 'core-loaded. The fixture must carry the real identity for the comparison to mean anything; '
+      + 'renamed, it silently classified own-built modules as core.',
+  },
+  {
+    path: 'tests/claude_materialize.mjs',
+    classes: ['token'],
+    reason:
+      'Tests the REBRAND rules, whose whole job is rewriting a founder brand to a target. The '
+      + 'literal is the input being rewritten and the assertion is that it does not survive; '
+      + 'neutralising it collides with the example.org targets the same test rebrands TO.',
+  },
+  {
+    path: 'tests/cli_lib_formatters.mjs',
+    classes: ['token'],
+    reason:
+      'A negative assertion — that the formatter does not reintroduce a hardcoded founder host. '
+      + 'The literal is what must be absent, so it has to be named to be checked for.',
+  },
+  {
+    path: 'tests/smoke_target.mjs',
+    classes: ['token'],
+    reason:
+      'Four assert.doesNotMatch calls proving the smoke target resolves to THIS instance and never '
+      + 'the old hardcoded founder fallback. The literal is what must be absent — a test for its '
+      + 'absence has to name it, and neutralised the guard would pass against anything.',
+  },
+  {
+    path: 'tests/lib_sh_resolution.mjs',
+    classes: ['token'],
+    reason:
+      'Carries the host-identity scan pattern it runs over the baked box scripts — a detector '
+      + 'pattern, the same case as fitness-checks-identity.js.',
+  },
+  {
+    path: 'modules/provisioning/module.json',
+    classes: ['token'],
+    reason:
+      'author / origin / maintainer. This is genuine AUTHORSHIP attribution in an AGPL module '
+      + 'manifest, not leaked topology — naming who wrote a module is what a manifest is for. '
+      + 'Left as the owner wrote it: how a contributor is credited is the owner\'s call, not a '
+      + 'sweep\'s. Raise it with them if the core should attribute to the project instead.',
+  },
+
+  // ── migrations: already applied, therefore immutable ───────────────────────────────
+  // A migration that has run on every existing instance cannot be edited: the text is the
+  // historical record of what happened, and rewriting it desynchronises new installs from
+  // old ones without changing a single existing database. Listed file by file ON PURPOSE —
+  // a NEW migration naming a host brand is a real defect and must still fail the scan.
+  { path: 'migrations/003_pms.sql', classes: ['token'], reason: 'applied migration — comment names the status page of the instance it was written for' },
+  { path: 'migrations/006_pms_v2.sql', classes: ['token'], reason: 'applied migration — records where instance-scope rows were relocated' },
+  { path: 'migrations/011_backfill_v2_v3_done_when.sql', classes: ['token'], reason: 'applied migration — backfills done_when prose that names the instance' },
+  { path: 'migrations/067_builder_boxes.sql', classes: ['token'], reason: 'applied migration — documents the per-builder DNS shape in use at the time' },
+  { path: 'migrations/093_tasks_sandbox_review.sql', classes: ['token'], reason: 'applied migration — sample sandbox URL in a column comment' },
+  { path: 'migrations/111_medusa_customer0_framing.sql', classes: ['token'], reason: 'applied migration — the customer-zero framing IS its subject' },
+  { path: 'migrations/185_module_upstreaming_goal_wiring.sql', classes: ['token'], reason: 'applied migration — names the historical extract-core/split work items' },
+  { path: 'migrations/core_191_module_submissions.sql', classes: ['owner'], reason: 'applied migration — names the private upstream repo it explains the absence of' },
+
+  {
+    path: 'modules/public-landing/public/projects.html',
+    classes: ['public-ip'],
+    reason:
+      'Dense SVG path coordinates. The inlined forge logo contains runs like "…1.08.58 1.23.82.72 '
+      + '1.21…", which are four dot-separated numbers under 256 and therefore a valid dotted quad by '
+      + 'SHAPE — no guard can separate them from an address without knowing they sit in a path "d" '
+      + 'attribute, the same "why not a shape rule" secret-scrub.js records. The leading-zero guard '
+      + 'catches the variants that have one; this is the residue. No topology here, only geometry.',
+  },
+  {
+    path: 'modules/security/tests/artifact_scan.mjs',
+    classes: ['public-ip'],
+    reason: "The security module's scanner test — same reason as tests/package_core.mjs.",
+  },
+];
+
+// SELF-LEAK INVARIANT (the same one scripts/gds/mirror-redact.js holds about itself,
+// and enforced on this file by scripts/gds/audit-authorship.sh). An allowlist that
+// spelled out the literals it governs would reintroduce customer-zero's name into two
+// more shipped files — defeating the sweep that motivated it. So an entry names a
+// CLASS ('owner', 'token') and the concrete strings are resolved at call time from
+// PRIOR_INSTANCE_FLOOR, which is already the one definition package-core scans by.
+// Scoping is unchanged where it matters: an entry still only covers the file it names.
+function floorLiteralsFor(cls) {
+  const floor = require('./package-core.js').PRIOR_INSTANCE_FLOOR;
+  if (cls === 'owner') return floor.owners.map((s2) => s2.toLowerCase());
+  if (cls === 'token') return floor.tokens.map((s2) => s2.toLowerCase());
+  return [];
+}
+
+// Every concrete literal an entry's classes resolve to, plus 'public-ip' verbatim.
+function entryLiterals(entry) {
+  const out = [];
+  for (const c of entry.classes || []) {
+    if (c === 'public-ip') out.push('public-ip');
+    else out.push(...floorLiteralsFor(c));
+  }
+  return out;
+}
+
+const SEP = '>>';
+
+// The key a hit is looked up by. An IP hit collapses to the label (any well-known
+// address in an allowlisted file is covered by that file's reason); an instance
+// literal is keyed by the literal itself, so listing one never covers another.
+function hitKey(pathRel, label, sample) {
+  return `${pathRel}${SEP}${label === 'public-ip' ? 'public-ip' : String(sample).toLowerCase()}`;
+}
+
+// The reason a hit is tolerated, or null if it is not. `label` distinguishes an IP hit
+// ('public-ip') from an instance-literal hit, matching findLeaks' own labelling.
+function allowReason(pathRel, label, sample) {
+  if (label === 'public-ip' && Object.prototype.hasOwnProperty.call(WELL_KNOWN_PUBLIC_IPS, sample)) {
+    return `well-known address: ${WELL_KNOWN_PUBLIC_IPS[sample]}`;
+  }
+  const key = hitKey(pathRel, label, sample);
+  for (const e of FILE_ALLOWLIST) {
+    for (const l of entryLiterals(e)) {
+      if (`${e.path}${SEP}${l.toLowerCase()}` === key) return e.reason;
+    }
+  }
+  return null;
+}
+
+// Split scan hits into the ones a named exception covers and the ones that remain.
+function partitionHits(hits) {
+  const allowed = [];
+  const remaining = [];
+  for (const h of hits || []) {
+    const reason = allowReason(h.path, h.label, h.sample);
+    if (reason) allowed.push({ ...h, reason }); else remaining.push(h);
+  }
+  return { allowed, remaining };
+}
+
+// Entries that covered nothing in this scan — a stale permission. Reported so the
+// allowlist shrinks as the trunk gets cleaner instead of quietly outliving its reasons.
+function unusedEntries(hits) {
+  const seen = new Set((hits || []).map((h) => hitKey(h.path, h.label, h.sample)));
+  const stale = [];
+  for (const e of FILE_ALLOWLIST) {
+    // Staleness is per CLASS, not per resolved literal. A grant of 'token' covers every
+    // token in the floor, and a file that legitimately carries one of them but not the
+    // other is not a stale permission — reporting it as one would fire on a healthy tree
+    // forever, and a warning that never goes away is one nobody reads.
+    for (const cls of e.classes || []) {
+      const lits = cls === 'public-ip' ? ['public-ip'] : floorLiteralsFor(cls);
+      if (!lits.some((l) => seen.has(`${e.path}${SEP}${l.toLowerCase()}`))) {
+        stale.push({ path: e.path, literal: cls });
+      }
+    }
+  }
+  return stale;
+}
+
+module.exports = { WELL_KNOWN_PUBLIC_IPS, FILE_ALLOWLIST, entryLiterals, allowReason, partitionHits, unusedEntries };

package/scripts/gds/learning-capture.js

@@ -6,7 +6,7 @@
 // Usage:
 //   node scripts/gds/learning-capture.js \
 //     --tags "caddy,cloudflare" \
-//     --title "Origin cert needs *.amazonprimea.com SAN" \
+//     --title "Origin cert needs *.example.com SAN" \
 //     --body-file path/to/body.md
 //
 // Body source (in priority order): --body-file PATH > --body "text" > stdin.

package/scripts/gds/linkify-refs.js

@@ -54,7 +54,7 @@ const path = require('node:path');
 // WRITTEN INTO COMMITTED markdown, so a per-dev CLOUDBONGOS_API_BASE=localhost
 // override must never leak into a committed doc link (task 1002234; the committed-doc
 // twin of the task-1002233 printed-link fix, which purged the last hardcoded
-// `https://amazonprimea.com`). When branding is unreadable the base is the
+// `https://example.com`). When branding is unreadable the base is the
 // root-relative '/builders#/…' — never a hardcoded founder host. Reading branding is
 // a sync file read (no network), safe at module scope for this token-free CI gate.
 // A LOOPBACK origin is treated exactly like an unreadable one — root-relative,
@@ -178,7 +178,7 @@ const LIST_GLUE_RE = /^[\s,–—-]*(?:and|&|\+|or|to|through)?[\s,–—-]*$/i;
 // entity/idea/blocker refs; the idea/blocker resolver links are left alone.
 // HOST-AGNOSTIC (task 1002234 part b): matches any http(s) host OR a root-relative
 // '/builders#/…', so the mislink-cleanup path still recognizes a link a PRIOR run
-// committed under a DIFFERENT host — the legacy `amazonprimea.com` links, a
+// committed under a DIFFERENT host — the legacy `example.com` links, a
 // co-tenant's, or this instance's own — not only the current RESOLVER_BASE host.
 // How many digits a bare "#NNN" may carry — ONE source of truth, because the
 // width had drifted out of date in five places at once (task 1003542).

package/scripts/gds/local-preview-lib.js

@@ -1,7 +1,7 @@
 // scripts/gds/local-preview-lib.js — core of the LOCAL sandbox launcher (task 1056).
 //
 // Gives a builder working on a LOCAL full clone (laptop) the same private game
-// preview a dev box gets at sandbox-<login>.amazonprimea.com (ADR 0044/0046/0052)
+// preview a dev box gets at sandbox-<login>.example.com (ADR 0044/0046/0052)
 // — but served at http://localhost:<port> on their OWN machine: no Cloudflare
 // tunnel, no public URL, $0. It runs the ADR 0052 game-only entry
 // (src/preview-server.js), which serves ONLY the playable game (no /api/gds, no

package/scripts/gds/mirror-lineage-check.js

@@ -5,7 +5,7 @@
 // consistency + a no-leak check (GDS-V4 · V4.R73 · task 1212, implementing the
 // ADR 0099 "Consequences" recipe).
 //
-// C9 (Cloud Bongos ⇄ Amazonprimea decoupling) publishes a redacted, 6-month-
+// C9 (Cloud Bongos ⇄ Example decoupling) publishes a redacted, 6-month-
 // delayed public mirror of the private build repo (task 1211, scripts/public-
 // mirror-export.js). This check asserts the two lineages can't silently diverge:
 //

package/scripts/gds/mirror-redact.js

@@ -50,6 +50,18 @@ const REDACTED_IP = 'REDACTED_IP';      // droplet / public-IP replacement (NOT
 // ---------------------------------------------------------------------------
 const IPV4_CANDIDATE_RE = /\b(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})\b/g;
 
+// A dotted quad with a LEADING-ZERO octet is not an address in any notation a human
+// or a tool writes: `0` stands alone as one digit, and `07` reads as OCTAL, so no log
+// line, config file or doc spells a host that way. What does produce them is packed
+// numeric data — SVG path coordinates. `…5.47 7.59.4.07.5…` in the committed GitHub
+// logo path contains "7.59.4.07", which the candidate regex happily reads as an IP;
+// that alone accounted for ten phantom public-ip leaks across the design mocks and
+// the landing page. The guard reads the raw octet TEXT because the parsed number has
+// already lost the zero, and it costs zero recall — a real leaked IP never has one.
+function hasLeadingZeroOctet(octets) {
+  return octets.some((o) => o.length > 1 && o[0] === '0');
+}
+
 function isPublicRoutableIPv4(a, b, c, d) {
   for (const o of [a, b, c, d]) if (o < 0 || o > 255) return false; // not a valid dotted-quad
   if (a === 0) return false;                       // 0.0.0.0/8 "this network"
@@ -63,6 +75,7 @@ function isPublicRoutableIPv4(a, b, c, d) {
   if (a === 192 && b === 0 && c === 2) return false;     // 192.0.2.0/24 TEST-NET-1 (RFC 5737)
   if (a === 198 && b === 51 && c === 100) return false;  // 198.51.100.0/24 TEST-NET-2
   if (a === 203 && b === 0 && c === 113) return false;   // 203.0.113.0/24 TEST-NET-3
+  if (a === 198 && (b === 18 || b === 19)) return false;  // 198.18.0.0/15 benchmarking (RFC 2544)
   return true;
 }
 
@@ -115,6 +128,7 @@ function isPublicRoutableIPv6(s) {
   // assets and left the C9 full-tree mirror gate permanently red (task 1002470).
   if (h < 0x0100) return false;                 // reserved ::/8
   if (h >= 0xfe80 && h <= 0xfebf) return false; // link-local fe80::/10
+  if (h === 0x2001 && g[1] === 0x0db8) return false; // 2001:db8::/32 documentation (RFC 3849)
   if (h >= 0xfc00 && h <= 0xfdff) return false; // ULA fc00::/7
   if (h >= 0xff00) return false;                // multicast ff00::/8
   return true;                                  // global unicast (2000::/3, etc.)
@@ -122,7 +136,7 @@ function isPublicRoutableIPv6(s) {
 
 function redactPublicIPs(text) {
   let out = text.replace(IPV4_CANDIDATE_RE, (m, a, b, c, d) =>
-    isPublicRoutableIPv4(+a, +b, +c, +d) ? REDACTED_IP : m);
+    (!hasLeadingZeroOctet([a, b, c, d]) && isPublicRoutableIPv4(+a, +b, +c, +d)) ? REDACTED_IP : m);
   out = out.replace(IPV6_CANDIDATE_RE, (m) => (isPublicRoutableIPv6(m) ? REDACTED_IP : m));
   return out;
 }
@@ -131,7 +145,7 @@ function firstPublicIP(text) {
   IPV4_CANDIDATE_RE.lastIndex = 0;
   let m;
   while ((m = IPV4_CANDIDATE_RE.exec(text))) {
-    if (isPublicRoutableIPv4(+m[1], +m[2], +m[3], +m[4])) { IPV4_CANDIDATE_RE.lastIndex = 0; return m[0]; }
+    if (!hasLeadingZeroOctet([m[1], m[2], m[3], m[4]]) && isPublicRoutableIPv4(+m[1], +m[2], +m[3], +m[4])) { IPV4_CANDIDATE_RE.lastIndex = 0; return m[0]; }
   }
   IPV6_CANDIDATE_RE.lastIndex = 0;
   while ((m = IPV6_CANDIDATE_RE.exec(text))) {
@@ -305,6 +319,7 @@ function findSecretLeak(text, extraSecrets = [], opts = undefined) {
 module.exports = {
   NEUTRAL_DOMAIN, NEUTRAL_TOKEN, NEUTRAL_OWNER, REDACTED_IP,
   isPublicRoutableIPv4, isPublicRoutableIPv6, parseIPv6, redactPublicIPs, firstPublicIP,
+  hasLeadingZeroOctet,
   registrableLabel, escapeRegExp, deriveInstanceLiterals, collectSensitiveLiterals,
   buildRedactionRules, redactText, findLeaks, findSecretLeak,
 };

package/scripts/gds/newcomer-floor.templates.json

@@ -74,7 +74,7 @@
       "done_when": [
         "You filed 5–8 fresh ideas into the idea_inbox via `node scripts/gds/capture.js` (each prints a `Captured idea #N` confirmation), all in ONE branch (A product, or B internal/UX).",
         "Each idea has a clear title and a body with at least one sentence of detail — for Branch A, one line of in-world lore (who/what it is); for Branch B, what the rough edge is and what 'better' looks like.",
-        "Branch A ideas are in the world's voice and consistent with CLAUDE.md §3/§6/§7 (ancient-Greek coast, Amazonprimea, mythic 'discovered secret' tone — not modern/anachronistic).",
+        "Branch A ideas are in the world's voice and consistent with CLAUDE.md §3/§6/§7 (ancient-Greek coast, Example, mythic 'discovered secret' tone — not modern/anachronistic).",
         "Each idea body declares its track on a `track: product` or `track: internal` line so triage can route it.",
         "Before filing you ran `GET /api/gds/inbox` and confirmed your ideas are not near-duplicates of open ones.",
         "You touched only the idea_inbox via capture.js — no code, no migrations, no infra, no permission/pipeline files; nothing committed to the repo."

package/scripts/gds/package-core.js

@@ -87,6 +87,7 @@ const {
 } = require(path.join(REPO_ROOT, 'scripts/gds/mirror-redact.js'));
 const { collectEnvSecrets } = require(path.join(REPO_ROOT, 'modules/security/secret-scrub.js'));
 const { redactBlob, parseLsTree } = require(path.join(REPO_ROOT, 'scripts/public-mirror-export.js'));
+const { partitionHits, unusedEntries } = require(path.join(REPO_ROOT, 'scripts/gds/leak-scan-allowlist.js'));
 
 const MANIFEST_SCHEMA = 1;
 const ARTIFACT_NAME = 'bongos-core';
@@ -949,6 +950,22 @@ function main() {
     const scanFiles = staged.map((s) => ({ path: s.name.startsWith(TAR_ROOT) ? s.name.slice(TAR_ROOT.length) : s.name, content: s.buf }));
     const scan = scanArtifactForLeaks(scanFiles);
     const strict = process.argv.includes('--leak-scan-strict');
+    // Named, reasoned exceptions (task 1003869). A detector must carry the pattern it
+    // detects and a "public IPs are flagged" test must be handed a public IP, so those
+    // hits are real but not leaks. Each is listed per (file, literal) with its reason in
+    // scripts/gds/leak-scan-allowlist.js — never per bare file, which would let a NEW
+    // leak ride into an already-listed file unseen.
+    const { allowed, remaining } = partitionHits(scan.literalHits);
+    if (allowed.length) {
+      const byFile = [...new Set(allowed.map((h) => h.path))];
+      console.error(`[leak-scan] ${allowed.length} hit(s) across ${byFile.length} file(s) covered by a named exception (scripts/gds/leak-scan-allowlist.js).`);
+    }
+    const stale = unusedEntries(scan.literalHits);
+    if (stale.length) {
+      console.error(`[leak-scan] ! ${stale.length} allowlist entr(ies) matched nothing — the trunk got cleaner, so prune them:`);
+      for (const e of stale) console.error(`   ${e.path}  [${e.literal}]`);
+    }
+    scan.literalHits = remaining;
     if (scan.literalHits.length) {
       const byLit = {};
       for (const h of scan.literalHits) byLit[h.sample] = (byLit[h.sample] || 0) + 1;
@@ -959,7 +976,7 @@ function main() {
       for (const p of files.slice(0, 30)) console.error(`   ${p}`);
       if (files.length > 30) console.error(`   … +${files.length - 30} more file(s)`);
       if (strict) { console.error('[leak-scan] --leak-scan-strict: refusing to certify a leaky artifact.'); process.exit(1); }
-      console.error('[leak-scan] non-fatal for now — becomes a hard gate once the trunk sweep (task 1002219) + the fail-closed floor gate (task 1002217) land. Run --leak-scan-strict to enforce today.');
+      console.error('[leak-scan] non-fatal for now — the trunk sweep (task 1003869) is clearing the residue; it becomes a hard gate when task 1003870 arms publish.yml. Run --leak-scan-strict to enforce today.');
     } else {
       console.error('[leak-scan] ✓ no prior-instance literals in the built artifact.');
     }

package/scripts/gds/paste-token.js

@@ -35,7 +35,7 @@ const SESSION_PATH = ic.configPath(SESSION_FILENAMES[0]);
 // On a RE-auth a session file already exists, and its api_base is the best signal
 // of which instance the builder is on — this file used to hardcode the founder
 // host here (a straggler the task 1002201 sweep missed), so a token minted by
-// another instance was verified against amazonprimea.com and rejected 401 with a
+// another instance was verified against example.com and rejected 401 with a
 // perfectly valid token (task 1002427).
 const API_BASE = ic.resolveApiBase();
 

package/scripts/gds/provision-units.js

@@ -71,8 +71,8 @@ function serviceUnitPath(inst) { return `/etc/systemd/system/${inst.slug}.servic
 // ── nightly DB backup: per-instance timer + service (task 2213) ─────────────
 // PRODUCTIZES the manual task-2210 fix: a newly-provisioned instance was born with
 // NO backups (dir absent, GDS_BACKUP_DB unset → the script fell back to the
-// nonexistent `amazonprimea` default, and the repo's global gds-db-backup units
-// hardcode /home/lars/amazonprimea — wrong for the consumer node_modules/@bongos/
+// nonexistent `example` default, and the repo's global gds-db-backup units
+// hardcode /home/lars/example — wrong for the consumer node_modules/@bongos/
 // core layout). These generators emit a PER-INSTANCE unit pair that fixes all three:
 //   • name  → `<slug>-db-backup.{service,timer}` so co-tenant instances on one box
 //             never collide (each dumps its OWN db; the script's retention prune is