@bongos/core 1.19.726 → 1.19.727

package/scripts/gds/publish-manifest.js

@@ -281,12 +281,27 @@ const INSTANCE_EXCLUDE = [
   'docs/design/container-exterior-tiles.md',
   'docs/design/container-interior.md',
   'docs/design/world-map-scroll.md',
+  // instance-specific UI MOCKUPS — iteration snapshots of THIS instance's own hub (hub v1/v2/v3,
+  // the wizard, the projects hub, the world chrome), branded end to end in markup a consumer of
+  // the portable core has no use for: they are our design history, not methodology. Same reason as
+  // the game-design carve-out above, and the same failure mode — redaction de-brands names in DOCS,
+  // but an .html is a FUNCTIONAL file that ships verbatim, so every brand string in the mock markup
+  // reached the published artifact. They were 117 of the 240 remaining leak-scan hits. Excluding the
+  // subtree rather than the six files is deliberate: it is the boundary that holds when someone adds
+  // mockup number seven. (task 1003869)
+  'docs/design/mocks/',
   // instance-HISTORY ADRs (task 1002219 / audit H5). These record THIS platform-family's own
   // migration + identity history (the amazonprimea→cloudbongos lift, the standalone reprovision,
   // the cloudbongos identity hub) — they are inherently full of the prior instance's name/owner and
   // genericize to nothing (unlike a portable methodology ADR). docs/adr/ is allowlisted wholesale for
   // the portable decision records; these three stay in this repo and never ship in the core, mirroring
   // the instance-recipe / game-design carve-outs above. (The portable ADRs + the README index still publish.)
+  // The instance's OWN name + trademark decision. Its prose redacts cleanly, but the FILENAME
+  // carries the brand and the publish manifest lists every path — so the literal shipped in
+  // .bongos-core.json no matter how well the body was redacted. It also genericizes to nothing:
+  // "accepting trademark risk on <our name>" is not a decision another instance inherits.
+  // (task 1003869 — the last literal in the artifact.)
+  'docs/adr/0004-amazonprimea-name-and-trademark-acceptance.md',
   'docs/adr/0139-platform-history-migration-to-cloudbongos.md',
   'docs/adr/0140-cloudbongos-standalone-reprovision.md',
   'docs/adr/0141-cross-site-identity-federated-hub-idp.md',

package/scripts/gds/repo-metrics.js

@@ -6,7 +6,7 @@
 // out to git / wc / knip and emits a JSON snapshot of repo health, then upserts
 // it into repo_health_snapshots (idempotent on calendar date — rerun same day
 // = upsert, not a new row). The latest row feeds /api/gds/public/repo-health,
-// which renders a trend tile on status.amazonprimea.com.
+// which renders a trend tile on status.example.com.
 //
 // What the snapshot contains:
 //   - total_loc + loc_by_dir   — tracked JS/MJS line counts, per watched dir

package/scripts/gds/sandbox-stage.js

@@ -6,7 +6,7 @@
 //
 // Two preview contexts (resolvePreviewContext picks one):
 //   - BOX (ADR 0031): box-game-preview.service serves the working tree at
-//     https://sandbox-<login>.amazonprimea.com; "staging" restarts the service.
+//     https://sandbox-<login>.example.com; "staging" restarts the service.
 //   - LOCAL (task 1056): a builder on a full local clone (laptop) runs the same
 //     ADR 0052 game-only entry privately at http://localhost:<port> via
 //     scripts/gds/local-preview.js; "staging" (re)starts that local process.

package/scripts/gds/seed-bongos-coreB-tranche1-tasks.js

@@ -7,7 +7,7 @@
 // Run: node scripts/gds/seed-bongos-coreB-tranche1-tasks.js
 const os = require('os');
 const TOKEN = require(os.homedir() + '/.config/otb/gds-session.json').token;
-const BASE = require('../../src/instance-config').resolveEnv('BASE') || 'https://amazonprimea.com';
+const BASE = require('../../src/instance-config').resolveEnv('BASE') || 'https://example.com';
 const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
 
 // ref → task spec. depends_on_refs are local R## refs resolved after create.

package/scripts/gds/seed-bongos-coreB-tranche2-tasks.js

@@ -9,7 +9,7 @@
 // Run: node scripts/gds/seed-bongos-coreB-tranche2-tasks.js
 const os = require('os');
 const TOKEN = require(os.homedir() + '/.config/otb/gds-session.json').token;
-const BASE = require('../../src/instance-config').resolveEnv('BASE') || 'https://amazonprimea.com';
+const BASE = require('../../src/instance-config').resolveEnv('BASE') || 'https://example.com';
 const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
 
 // ref → task spec. deps are local R## refs resolved after create. Clean-slicing

package/scripts/gds/seed-bongos-goal-hierarchy-tasks.js

@@ -47,7 +47,7 @@ const TASKS = [
   {
     key: 'G02',
     title: 'config/hierarchy.json + hierarchy-config.js — the six-tier preset (onboarding-edited)',
-    description: `Phase 1 of the goal hierarchy (ADR 0086 §1 — the ADR 0062 core/host pattern applied to the work model). Add \`config/hierarchy.json\` (joins branding.json/modules.json as host config) declaring the tiers — names, order, and which tier carries scope, membership, and criteria. Ship the six-tier Amazonprimea preset: Project → Version → Goal → Criteria → Task → Sub-task. Add \`src/bongos/hierarchy-config.js\` (mirrors src/modules.js) to load + validate it. v1 "editable" = owner-set labels, enable/disable, and which tier owns scope/criteria/membership; arbitrary custom tier graphs are explicitly DEFERRED. Owner fills/edits during onboarding (extend the scripts/gds/init.js interview).
+    description: `Phase 1 of the goal hierarchy (ADR 0086 §1 — the ADR 0062 core/host pattern applied to the work model). Add \`config/hierarchy.json\` (joins branding.json/modules.json as host config) declaring the tiers — names, order, and which tier carries scope, membership, and criteria. Ship the six-tier Example preset: Project → Version → Goal → Criteria → Task → Sub-task. Add \`src/bongos/hierarchy-config.js\` (mirrors src/modules.js) to load + validate it. v1 "editable" = owner-set labels, enable/disable, and which tier owns scope/criteria/membership; arbitrary custom tier graphs are explicitly DEFERRED. Owner fills/edits during onboarding (extend the scripts/gds/init.js interview).
 
 **Done when:** hierarchy.json + hierarchy-config.js exist; the loader validates + exposes the tier set; the six-tier preset is the OTB default; onboarding can set labels/enable/scope-owner; unit test covers a malformed preset rejected.`,
     kind: 'feature', discipline: 'engineer', priority: 5,

package/scripts/gds/seed-bongos-tasks.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // Seed the 6 net-new "Cloud Bongos CLI" tasks added to GDS-V4 (C8) — the
 // conda/Miniconda-style terminal-first onboarding toolkit. `bongos` is the CLI
-// command (Cloud Bongos = the standalone build platform; Amazonprimea =
+// command (Cloud Bongos = the standalone build platform; Example =
 // instance 1). Design doc: artifact 02bcca71 (the bongos toolkit).
 //
 // Shape mirrors seed-medusa-tasks.js exactly:
@@ -98,7 +98,7 @@ A small public, read-only endpoint returning the instance descriptor assembled f
 
 \`bongos login <instance-url>\` fetches the P4A manifest, runs the GitHub device-flow (browser-click, no token paste — the UI-first rule), stores a per-instance scoped session, and brands the CLI for that instance. For someone NOT yet admitted, it files the public POST /api/gds/access-requests (their GitHub username) and polls — telling them "an Archon will approve you with a 👍 in Discord" — until admission flips, then completes sign-in. No GitHub collaborator invite is involved. Default admission is invite-only. Also folds the already-planned \`bongos init\` (scaffold a brand-new instance, R65) and \`bongos upgrade\` (R64) in as subcommands of the same CLI.
 
-**Done when:** \`bongos login <any-instance-url>\` works end-to-end including the not-yet-admitted path (files the request, polls, completes once approved); the CLI is instance-agnostic (no hard-coded amazonprimea); \`init\`/\`upgrade\` are reachable subcommands.`,
+**Done when:** \`bongos login <any-instance-url>\` works end-to-end including the not-yet-admitted path (files the request, polls, completes once approved); the CLI is instance-agnostic (no hard-coded example); \`init\`/\`upgrade\` are reachable subcommands.`,
     kind: 'feature', discipline: 'engineer', priority: 3,
     est_minutes: 360, manual_degree: 2, credits_reward: 60,
     touches: ['bin/', 'scripts/gds/'], criteria: ['C8'], deps: ['P1', 'P4A'],

package/scripts/gds/seed-gds-v4-tasks.js

@@ -379,7 +379,7 @@ Reconcile shipped tasks against uploaded session records (BFG 6D follow-up to ta
     title: 'Embedding provider decision + key provisioning (Archon go-ahead)',
     description: `**Criterion:** one-call-recall (gated by V4.R24's go/no-go).
 
-If the eval gate says GO: pick the provider (research recommendation: Voyage voyage-4-lite — $0.02/M tokens, 200M free tier, Matryoshka dims; fallback OpenAI text-embedding-3-small), create the account, provision EMBEDDINGS_API_KEY into /etc/amazonprimea/secrets.env per ADR 0022. New external account = Lars's explicit go-ahead per the budget rules.
+If the eval gate says GO: pick the provider (research recommendation: Voyage voyage-4-lite — $0.02/M tokens, 200M free tier, Matryoshka dims; fallback OpenAI text-embedding-3-small), create the account, provision EMBEDDINGS_API_KEY into /etc/example/secrets.env per ADR 0022. New external account = Lars's explicit go-ahead per the budget rules.
 
 **Done when:** decision recorded (ADR addendum), key live on the droplet, cost expectations logged.`,
     kind: 'decision', discipline: 'engineering', priority: 2,

package/scripts/gds/seed-medusa-tasks.js

@@ -2,9 +2,9 @@
 // Seed the 24 net-new "Medusa" tasks (R50–R73) added to GDS-V4 in the
 // 2026-06-17 Medusa Planning Session (meta task 1188 / claim 982).
 //
-// Medusa = decouple the GDS from the Amazonprimea game into a standalone,
+// Medusa = decouple the GDS from the Example game into a standalone,
 // configurable, self-hostable, AGPL open-source, non-profit, AI-first build
-// platform. Amazonprimea becomes instance 1.
+// platform. Example becomes instance 1.
 //
 // Companion migration 110_medusa_planning_seed.sql handles:
 //   - the 2 done_when_criteria rows (C8 = medusa-standalone-instance,
@@ -66,7 +66,7 @@ A Medusa-only boot (sibling to src/preview-server.js) that builds the Express ap
     title: 'GDS-owned DB pool + migration carve-out + drop the track enum',
     description: `Part of Medusa (C8). Cross-ref: R50 design.
 
-A GDS-owned pool reading DATABASE_URL/PG* (not hard-defaulting to the amazonprimea DB name); a GDS-only migration sequence (game migrations 001/002 simply not applied on a fresh non-game instance); drop the product/internal 'track' distinction. Live prod keeps its existing DB. Zero cross-FKs exist between game and GDS tables, so the split is clean.
+A GDS-owned pool reading DATABASE_URL/PG* (not hard-defaulting to the example DB name); a GDS-only migration sequence (game migrations 001/002 simply not applied on a fresh non-game instance); drop the product/internal 'track' distinction. Live prod keeps its existing DB. Zero cross-FKs exist between game and GDS tables, so the split is clean.
 
 **Done when:** a fresh-DB migration run produces only the build-system schema; a query asserts the game tables (world_events, players, seats) are absent; live prod unaffected.`,
     kind: 'infra', discipline: 'engineer', priority: 5,
@@ -80,7 +80,7 @@ A GDS-owned pool reading DATABASE_URL/PG* (not hard-defaulting to the amazonprim
 
 A per-instance config layer (config/branding.json + a documented schema + a neutral starter + a fill-it-in prompt an owner's own LLM uses) supplying product name, domain/cookie apex, sign-in (OAuth) origin, repo binding, currency label, copy, fonts, palette, icons/favicon/cursors. Core reads identity + branding from this layer; defaults preserve live OTB exactly. NOT a vanilla strip — branding becomes per-instance config; OTB's look becomes instance 1's pack (extracted in R57).
 
-**Done when:** core resolves all identity + branding from config; booting under a non-amazonprimea.com domain + a non-game name needs config only, no source edits. Gates most de-brand + self-host tasks.`,
+**Done when:** core resolves all identity + branding from config; booting under a non-example.com domain + a non-game name needs config only, no source edits. Gates most de-brand + self-host tasks.`,
     kind: 'feature', discipline: 'engineer', priority: 5,
     est_minutes: 360, manual_degree: 2, credits_reward: 60,
     touches: ['config/', 'src/bongos/', 'public-builders/'], criteria: ['C8'], deps: ['R50'],
@@ -128,7 +128,7 @@ Make the reward currency a configurable label (neutral default; OTB's instance =
     title: "Extract OTB's look into instance 1's branding pack (not a vanilla strip)",
     description: `Part of Medusa (C8). Cross-ref: R53, R56.
 
-Move the ~272 archaic strings, the Greek fonts, the parchment palette, favicon/cursors/SVG sigils, and the page copy out of the hall + status code and into instance 1's branding pack; core renders from the R53 branding layer with a neutral starter as the fallback. status.amazonprimea.com + builders.amazonprimea.com look IDENTICAL afterward — their look just comes from config now. Add a rank display-label map so the Greek rank LABELS are presentation (the enum stays Greek by decision).
+Move the ~272 archaic strings, the Greek fonts, the parchment palette, favicon/cursors/SVG sigils, and the page copy out of the hall + status code and into instance 1's branding pack; core renders from the R53 branding layer with a neutral starter as the fallback. status.example.com + builders.example.com look IDENTICAL afterward — their look just comes from config now. Add a rank display-label map so the Greek rank LABELS are presentation (the enum stays Greek by decision).
 
 **Done when:** no project branding is hard-coded in public-builders/ or public-status/; OTB's surfaces render unchanged from instance 1's pack; a fresh instance renders the neutral starter.`,
     kind: 'refactor', discipline: 'engineer', priority: 4,
@@ -142,7 +142,7 @@ Move the ~272 archaic strings, the Greek fonts, the parchment palette, favicon/c
 
 scripts/gds/gen-diagrams.js auto-generates the onboarding diagrams + assertions.json on every deploy. Make its template strings + assertions read the instance branding config so deploy-time regeneration emits neutral (instance-correct) branding. Rank names stay Greek by decision. This prevents the "we de-branded but Greek text reappeared after the next deploy" regression.
 
-**Done when:** running gen-diagrams.js under a neutral instance config produces diagrams + assertions.json with no hard-coded OTB/Amazonprimea tokens; OTB's instance still renders its own branding.`,
+**Done when:** running gen-diagrams.js under a neutral instance config produces diagrams + assertions.json with no hard-coded OTB/Example tokens; OTB's instance still renders its own branding.`,
     kind: 'refactor', discipline: 'engineer', priority: 4,
     est_minutes: 180, manual_degree: 2, credits_reward: 30,
     touches: ['scripts/gds/gen-diagrams.js'], criteria: ['C8'], deps: ['R53'],
@@ -190,7 +190,7 @@ The CLI config root (~/.config/otb/: gds-session.json, env, discord-webhooks.jso
     title: 'Config-driven owner bootstrap + per-instance repo/OAuth binding',
     description: `Part of Medusa (C8). Cross-ref: R52, R53.
 
-Replace migration 023's hard-coded founding-Archon literal (UPDATE builders SET rank='archon' WHERE github_login='lars589') with an install-time first-admin bootstrap from instance config. Make the GitHub repo binding (repo-info.js — the OTB_GITHUB_OWNER/REPO seam already exists) and the OAuth/App config per-instance. Single-project model keeps the global economy fine — only the owner literal + repo/OAuth need to generalize.
+Replace migration 023's hard-coded founding-Archon literal (UPDATE builders SET rank='archon' WHERE github_login='example-owner') with an install-time first-admin bootstrap from instance config. Make the GitHub repo binding (repo-info.js — the OTB_GITHUB_OWNER/REPO seam already exists) and the OAuth/App config per-instance. Single-project model keeps the global economy fine — only the owner literal + repo/OAuth need to generalize.
 
 **Done when:** grep over migrations/ returns zero login literals; a fresh install seats the configured first admin; repo + OAuth resolve from instance config.`,
     kind: 'feature', discipline: 'engineer', priority: 4,
@@ -202,7 +202,7 @@ Replace migration 023's hard-coded founding-Archon literal (UPDATE builders SET
     title: 'Containerized self-host instance (Dockerfile + docker-compose)',
     description: `Part of Medusa (C8). Cross-ref: R51, R52.
 
-A Dockerfile + docker-compose (app + Postgres) that brings a Medusa instance up from clean state with ZERO hard-coded droplet IP (104.236.254.243), amazonprimea systemd unit, or hand-maintained ~/deploy.sh. This is the self-host artifact; it does not touch prod's existing laptop/CI deploy path.
+A Dockerfile + docker-compose (app + Postgres) that brings a Medusa instance up from clean state with ZERO hard-coded droplet IP, instance-specific systemd unit, or hand-maintained ~/deploy.sh. This is the self-host artifact; it does not touch prod's existing laptop/CI deploy path.
 
 **Done when:** \`docker compose up\` on a machine that has never seen our droplet brings up Medusa + Postgres and the hall is reachable; no prod topology referenced anywhere in the path.`,
     kind: 'infra', discipline: 'engineer', priority: 4,
@@ -248,7 +248,7 @@ Separate the portable methodology core Medusa ships (the working rules, the sess
   {
     ref: 'R67',
     title: 'PROOF — Medusa dogfood: a second, differently-branded non-game instance ships a task',
-    description: `Part of Medusa (C8) — the proof-task that satisfies C8 ("the GDS builds itself"). Customer 0 = Medusa itself, running on the vanilla brand pack (R74); customer 1 = Amazonprimea.
+    description: `Part of Medusa (C8) — the proof-task that satisfies C8 ("the GDS builds itself"). Customer 0 = Medusa itself, running on the vanilla brand pack (R74); customer 1 = Example.
 
 Stand Medusa up as customer 0 (its own database, vanilla brand, no game code) and take one real task through the full lifecycle on it: claim -> grade -> merge -> ship with credits awarded. Medusa building Medusa, on Medusa. (A separate non-game third project is an acceptable alternative proof, but customer-0 self-build is the truest.)
 
@@ -342,7 +342,7 @@ Verify the private and public lineages stay consistent: migration numbering (the
     title: 'Medusa vanilla brand pack — the plain "customer 0" identity (Substack-like)',
     description: `Part of Medusa (C8). Cross-ref: R53 (branding-contract layer), R57 (customer 1 / OTB pack).
 
-Design + build the canonical Medusa VANILLA brand pack — the identity Medusa itself runs on as **customer 0** (Amazonprimea is customer 1). Deliberately PLAIN, clean, modern, professional — restrained palette, clean sans-serif type, minimal wordmark, plain-English product copy, simple favicon/icons. Aesthetic touchstone: Substack-plain; take INSPIRATION from planetscale.com's simplicity (do NOT copy). Delivered as a branding pack against the R53 contract; it is the default the hall + status render under when no other pack is supplied, and the brand Medusa ships on. Distinct from R57 (extracting customer 1 / OTB's Greek look) — this is customer 0's identity. No game/Greek flavor.
+Design + build the canonical Medusa VANILLA brand pack — the identity Medusa itself runs on as **customer 0** (Example is customer 1). Deliberately PLAIN, clean, modern, professional — restrained palette, clean sans-serif type, minimal wordmark, plain-English product copy, simple favicon/icons. Aesthetic touchstone: Substack-plain; take INSPIRATION from planetscale.com's simplicity (do NOT copy). Delivered as a branding pack against the R53 contract; it is the default the hall + status render under when no other pack is supplied, and the brand Medusa ships on. Distinct from R57 (extracting customer 1 / OTB's Greek look) — this is customer 0's identity. No game/Greek flavor.
 
 **Done when:** a complete Medusa vanilla brand pack (name/wordmark, restrained palette, clean type, plain copy, favicon/icons) renders the hall + status as a plain, professional dev toolkit; it is the pack customer 0 (Medusa) runs on; verified on the standalone boot.`,
     kind: 'feature', discipline: 'artist', priority: 4,

package/scripts/gds/seed-module-upstreaming.js

@@ -19,7 +19,7 @@ const DRY = process.argv.includes('--dry-run');
 const VERSION = 'BONGOS-V1';
 const GOAL_TITLE = 'Module upstreaming & catalog — instances contribute modules into core';
 const GOAL_DESC =
-  'ADR 0107. The reverse of the ADR 0100/0103 distribution arrow: instances (Amazonprimea, ' +
+  'ADR 0107. The reverse of the ADR 0100/0103 distribution arrow: instances (Example, ' +
   'Mercury) build feature modules and submit them for approval to be merged INTO the shared ' +
   'Cloud Bongos core catalog, credited to author + origin project. Accepted modules land in ' +
   'core modules/<key>/ default-off, added to the isPublishable() allowlist; every instance may ' +

package/scripts/gds/seed-productization-tasks.js

@@ -52,7 +52,7 @@ const TASKS = [
     title: 'ADR: instance docs-discovery contract (how an agent finds its hall/docs)',
     description: `From the 2026-07-04 review (bullet 6). Today the only pointer to an instance's doc surface is \`domains.buildersOrigin\` in branding.json. A fresh self-hosted instance needs a DEFINED contract for how an agent reliably locates its builders' hall + rendered docs from config alone (standard docs location? discovery endpoint? manifest field?). Write an ADR that pins the contract, then CLAUDE.md's preamble references it instead of hand-waving.
 
-**Done when:** an ADR records the docs-discovery contract; branding/config carries the needed field(s); CLAUDE.md §0 points at the contract; a second instance can resolve its docs surface with no hard-coded amazonprimea.`,
+**Done when:** an ADR records the docs-discovery contract; branding/config carries the needed field(s); CLAUDE.md §0 points at the contract; a second instance can resolve its docs surface with no hard-coded example.`,
     kind: 'decision', discipline: 'engineer', priority: 3,
     est_minutes: 90, manual_degree: 3, credits_reward: 20,
     touches: ['docs/adr/', 'config/', 'CLAUDE.md'], criteria: ['C16'], deps: [],
@@ -80,12 +80,12 @@ const TASKS = [
   {
     key: 'NAV-HYGIENE',
     title: 'Nav hygiene — reference the module, split instance-specifics',
-    description: `From the 2026-07-04 review (bullets 42, 57, 64, 66, 68, 94). Several nav rows (and §2 prose) INLINE content that belongs to a module or to instance-specifics. Convert them to module references, and split anything naming the amazonprimea servers/assets into project-specific detail. By module:
-- **discord** (57, 64, 94): inbound #ideas, build-broadcast, channel layout → reference the discord module; the general mechanism lives there, anything naming the amazonprimea Discord server specifically → project-specific detail.
+    description: `From the 2026-07-04 review (bullets 42, 57, 64, 66, 68, 94). Several nav rows (and §2 prose) INLINE content that belongs to a module or to instance-specifics. Convert them to module references, and split anything naming the example servers/assets into project-specific detail. By module:
+- **discord** (57, 64, 94): inbound #ideas, build-broadcast, channel layout → reference the discord module; the general mechanism lives there, anything naming the example Discord server specifically → project-specific detail.
 - **art-pipeline** (66): the pixel-art design-system row → reference the art module; the pixel/greek style choice itself is instance detail.
 - **game** (68): world-cell model + paths-as-overlays rows → the game module / instance context (out of the portable core).
 
-**Done when:** those nav/§2 items are thin references to their modules; no module-owned or amazonprimea-server-specific detail is inlined in the core; the game-specific rows are out of core.`,
+**Done when:** those nav/§2 items are thin references to their modules; no module-owned or example-server-specific detail is inlined in the core; the game-specific rows are out of core.`,
     kind: 'cleanup', discipline: 'engineer', priority: 3,
     est_minutes: 120, manual_degree: 3, credits_reward: 25,
     touches: ['CLAUDE.md'], criteria: ['C32'], deps: [],
@@ -123,7 +123,7 @@ const TASKS = [
   {
     key: 'IDENTITY-ORG',
     title: 'Rationalize the identity apparatus + structure project-context.md',
-    description: `From the 2026-07-04 review (bullets 109-111, 134/140, 187). Almost every identity section (§§1,3,5,6,7,9) is now a thin pointer to project-context.md, the §3 stub verbosely re-explains the core↔host split that §1 + the charter already cover, and the §6/§7 stubs still NAME the instance ("the Amazonprimea world", "the \`otb-*\` art skills"). Meanwhile project-context.md is getting overloaded (bullet 187). Fix: collapse §§3/5/6/7 to a single minimal pointer (or one-liners), genericize instance names out of any surviving stub, and give project-context.md a real section structure.
+    description: `From the 2026-07-04 review (bullets 109-111, 134/140, 187). Almost every identity section (§§1,3,5,6,7,9) is now a thin pointer to project-context.md, the §3 stub verbosely re-explains the core↔host split that §1 + the charter already cover, and the §6/§7 stubs still NAME the instance ("the Example world", "the \`otb-*\` art skills"). Meanwhile project-context.md is getting overloaded (bullet 187). Fix: collapse §§3/5/6/7 to a single minimal pointer (or one-liners), genericize instance names out of any surviving stub, and give project-context.md a real section structure.
 
 **Done when:** the stub scaffolding is minimal + instance-name-free in the core; project-context.md has a clear, non-overloaded structure; anchors/cross-refs still resolve.`,
     kind: 'cleanup', discipline: 'engineer', priority: 3,
@@ -148,7 +148,7 @@ const TASKS = [
     title: 'Scheduled-routines portability to self-host + multi-builder',
     description: `From the 2026-07-04 review (bullet 241). The ~17 autonomous cron routines under \`.claude/scheduled-tasks/\` (overnight-code-review, idea-triage-nightly, overnight-builder, bfg, security-review-weekly, …) are written for this instance. Define how they port to a self-hosted, multi-builder world: which run instance-wide vs per-builder, how a fresh instance inherits/configures them, and what a builder gets by default. Spike → a contract (and likely a config surface).
 
-**Done when:** there's a documented model for which routines are instance-wide vs per-builder, how a fresh instance inherits them, and how a builder configures their own; no routine hard-assumes the amazonprimea instance.`,
+**Done when:** there's a documented model for which routines are instance-wide vs per-builder, how a fresh instance inherits them, and how a builder configures their own; no routine hard-assumes the example instance.`,
     kind: 'spike', discipline: 'engineer', priority: 2,
     est_minutes: 120, manual_degree: 3, credits_reward: 25,
     touches: ['.claude/scheduled-tasks/', 'docs/'], criteria: ['C16'], deps: [],

package/scripts/gds/seed-provisioning-tasks.js

@@ -7,7 +7,7 @@
 // Run: node scripts/gds/seed-provisioning-tasks.js
 const os = require('os');
 const TOKEN = require(os.homedir() + '/.config/otb/gds-session.json').token;
-const BASE = require('../../src/instance-config').resolveEnv('BASE') || 'https://amazonprimea.com';
+const BASE = require('../../src/instance-config').resolveEnv('BASE') || 'https://example.com';
 const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' };
 const GOAL = 26; // Cloud Bongos productization and self-host
 
@@ -27,7 +27,7 @@ const TASKS = [
     deps: ['P1', 'P2'], extDeps: [] },
   { ref: 'P4', kind: 'infra', discipline: 'engineer', priority: 2, est: 300,
     title: 'BV1 — Automated DNS record + Caddy on-demand ACME TLS for a provisioned host',
-    description: 'ADR 0111 §4. Cloudflare A-record UPSERT via the shared client (P2), plus Caddy on-demand ACME (Let\'s Encrypt) so a NEWLY provisioned host is TLS-ready with no manual Cloudflare Origin-Cert console step (the least-automated leg today). On-demand TLS MUST be allow-listed to hostnames the module actually provisioned (no cert-minting for arbitrary names). Existing amazonprimea/cloudbongos apexes keep their Origin Certs unchanged. deps: P2, P3. (buildable now)',
+    description: 'ADR 0111 §4. Cloudflare A-record UPSERT via the shared client (P2), plus Caddy on-demand ACME (Let\'s Encrypt) so a NEWLY provisioned host is TLS-ready with no manual Cloudflare Origin-Cert console step (the least-automated leg today). On-demand TLS MUST be allow-listed to hostnames the module actually provisioned (no cert-minting for arbitrary names). Existing example/cloudbongos apexes keep their Origin Certs unchanged. deps: P2, P3. (buildable now)',
     deps: ['P2', 'P3'], extDeps: [] },
   { ref: 'P5', kind: 'feature', discipline: 'engineer', priority: 2, est: 240,
     title: 'BV1 — Wire provisioning into `bongos init` (idea #345 — "configured via the API")',

package/scripts/gds/seed-staging.sh

@@ -16,19 +16,32 @@
 #      column that referenced a session, then deletes all sessions so NO real
 #      bearer token persists on staging.
 #
-# SAFETY: hard-refuses to target anything but `amazonprimea_staging`, so a
+# SAFETY: hard-refuses to target any database not named `*_staging`, so a
 # fat-fingered env can never point the wipe at production. Everything runs at
-# table-owner privilege (no superuser) since `lars` owns the staging objects.
+# table-owner privilege (no superuser) — the invoking role owns the staging objects.
 #
 # "What's real, what's faked on staging": see docs/recipes/staging-data.md.
 
 set -euo pipefail
 
-PROD_DB="${PROD_DB:-amazonprimea}"
-STAGING_DB="${STAGING_DB:-amazonprimea_staging}"
+# No baked-in database names. A portable core cannot know an instance's DB, and the
+# founder's two were hardcoded here until task 1003869 — including inside the safety
+# check, which meant de-branding the names alone would have quietly disarmed it. So the
+# guard is STRUCTURAL now instead of a name comparison: the target must be named
+# <something>_staging. That keeps the original property ("a fat-fingered env can never
+# point the wipe at production", since no production DB is called *_staging) and extends
+# it to every instance rather than one. Both names must be set explicitly — this script
+# WIPES its target, so there is no default worth guessing.
+PROD_DB="${PROD_DB:-}"
+STAGING_DB="${STAGING_DB:-}"
 
-if [ "$STAGING_DB" != "amazonprimea_staging" ]; then
-  echo "REFUSING: STAGING_DB must be 'amazonprimea_staging' (got '$STAGING_DB'). This script wipes its target." >&2
+if [ -z "$STAGING_DB" ] || [ -z "$PROD_DB" ]; then
+  echo "REFUSING: set PROD_DB (the dump source) and STAGING_DB (the wipe target) explicitly." >&2
+  echo "  e.g. PROD_DB=myapp STAGING_DB=myapp_staging $0" >&2
+  exit 2
+fi
+if ! printf '%s' "$STAGING_DB" | grep -qE '^[A-Za-z0-9_]+_staging$'; then
+  echo "REFUSING: STAGING_DB '$STAGING_DB' must be a bare identifier ending in '_staging'. This script wipes its target." >&2
   exit 2
 fi
 if [ "$PROD_DB" = "$STAGING_DB" ]; then

package/scripts/gds/ship-deploy-target.js

@@ -171,7 +171,7 @@ function readSessionApiBase() {
 // PR-body deploy note, and the manual-confirm curl guidance. Precedence mirrors the
 // CLI's own base resolution: <PREFIX>_API_BASE env → the signed-in session's
 // api_base → branding publicOrigin → null (unknowable). There is NO hardcoded
-// founder host — 5 sites here baked in `https://amazonprimea.com`, so a ci-land /
+// founder host — 5 sites here baked in `https://example.com`, so a ci-land /
 // manual-confirm on a migrated instance pointed the builder at the WRONG box; the
 // ci-land/guidance sibling of resolveDeployTarget()'s laptop-mode fix (task 1002232
 // ⊃ task 1002202). Pure over its injected inputs (env / sessionApiBase / branding)

package/scripts/gds/ship-flow.js

@@ -306,7 +306,7 @@ async function shipMain() {
 
   // ---- Sandbox-first review gate (#927, ADR 0046) ----
   // On a dev box, a diff that touches game surfaces must be STAGED on the
-  // builder's own live preview (sandbox-<login>.amazonprimea.com, ADR 0044)
+  // builder's own live preview (sandbox-<login>.example.com, ADR 0044)
   // and reviewed in a browser before the claim resolves — see it running,
   // get the chance to iterate, THEN decide to ship to the main game. Laptop
   // sessions, non-game diffs, quick-tunnel boxes, and --skip-stage all pass

package/scripts/gds/smoke-gds.js

@@ -54,7 +54,7 @@ function matchedApiBaseVar(env) {
 // null.
 //
 // There is deliberately NO hardcoded host. This file baked in
-// `https://amazonprimea.com` as its fallback, so a builder signed into any OTHER
+// `https://example.com` as its fallback, so a builder signed into any OTHER
 // instance who shipped without an env override ran the ship's verification smoke
 // against the founder's box — which PASSED, because that box is healthy. The ship
 // then reported "smoke=clean" on the strength of testing a system it never

package/scripts/status-probe.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// External uptime prober for amazonprimea.com (incident 2026-06-03, task #565).
+// External uptime prober for example.com (incident 2026-06-03, task #565).
 //
 // WHY THIS EXISTS, AND WHY IT IS NOT src/bongos/uptime-poller.js:
 //   The in-process poller (src/bongos/uptime-poller.js) runs INSIDE the Node
@@ -27,7 +27,7 @@
 //   the step output). Non-zero only on its own internal error.
 //
 // USAGE:
-//   node scripts/status-probe.mjs [--dir .] [--target https://amazonprimea.com/healthz]
+//   node scripts/status-probe.mjs [--dir .] [--target https://example.com/healthz]
 //                                 [--attempts 3] [--timeout-ms 15000] [--gap-ms 10000]
 
 import { readFile, writeFile, mkdir } from 'node:fs/promises';

package/src/bongos/auth-discord.js

@@ -167,9 +167,9 @@ async function addDiscordGuildMember({ guildId, discordUserId, accessToken, role
 
 // Collect EVERY candidate auth token on the request, in priority order, with
 // duplicates removed. A browser can legitimately carry MORE THAN ONE
-// gds_session cookie: a host-only one (set on amazonprimea.com before the
+// gds_session cookie: a host-only one (set on example.com before the
 // #726/#734 apex-scoping rollout) AND the current apex-scoped one
-// (.amazonprimea.com). The browser sends both in the Cookie header. We must try
+// (.example.com). The browser sends both in the Cookie header. We must try
 // them ALL — picking only the first (as the old single-value extractToken did)
 // meant a stale/expired duplicate could shadow the live session and 401 the
 // builder (hit on the Discord link callback for builder 25). Order: Bearer

package/src/bongos/live-channel.js

@@ -35,7 +35,7 @@ let reconnectDelayMs = 2000;  // backoff before re-LISTEN; test-tunable via _set
 // exact same socket + database (PGHOST/PGDATABASE env overrides honored for
 // non-droplet environments). The DB-name default resolves through pool.js's
 // instanceDbName() — the SINGLE source for the instance's configured db.database
-// (from the branding pack) — instead of a second hardcoded "amazonprimea" literal
+// (from the branding pack) — instead of a second hardcoded "example" literal
 // (ADR 0062 §5). A non-OTB instance LISTENs on its OWN DB, and there is one place
 // to change the default.
 function pgConfig() {

package/src/bongos/pool.js

@@ -10,7 +10,7 @@
 // DB resolution (highest wins), NOT hard-defaulting to a host's DB name:
 //   DATABASE_URL  ->  PGHOST/PGDATABASE env  ->  the instance's configured db.database
 //   (config/branding.json, else config/branding.neutral.json)
-// OTB's branding pack carries db.database='amazonprimea', so prod (no DB env set) resolves to the
+// OTB's branding pack carries db.database='example', so prod (no DB env set) resolves to the
 // exact same socket+database it used before this carve-out — live prod is unaffected. A fresh
 // instance points this at its own DB via env or its own branding pack; the neutral starter has
 // db.database=null so a misconfigured instance fails loudly rather than silently targeting OTB.

package/src/bongos/routes/auth.js

@@ -267,12 +267,12 @@ const REPOS_COOKIE = 'gds_oauth_repos';
 const HANDSHAKE_COOKIE_MS = 30 * 60 * 1000;
 
 // The apex domain the instance is served under, read from the instance branding
-// pack's cookieDomain (".amazonprimea.com" → "amazonprimea.com",
+// pack's cookieDomain (".example.com" → "example.com",
 // ".cloudbongos.com" → "cloudbongos.com"). The session + OAuth-state cookies are
 // scoped to ".<apex>" so a single sign-in is shared across every subdomain
 // (apex, builders., status.) — the enabler for the dedicated builders subdomain
 // (#726). MUST come from config, not a hardcoded literal: a hardcoded
-// "amazonprimea.com" made every OTHER instance (e.g. cloudbongos.com) set a
+// "example.com" made every OTHER instance (e.g. cloudbongos.com) set a
 // cookie for the wrong domain, which the browser drops → the OAuth state cookie
 // never persisted → "state mismatch / the gate is closed" (ADR 0062 §3/§5: domains
 // woven into auth, config swaps must not widen cookie scope). Each instance scopes
@@ -296,7 +296,7 @@ function reqHost(req) {
 }
 
 // The production-facing hosts that share one sign-in. Deliberately enumerated
-// (not "any *.amazonprimea.com") so staging.amazonprimea.com — a SEPARATE
+// (not "any *.example.com") so staging.example.com — a SEPARATE
 // process + DB on :3001 — keeps a host-only cookie and never bleeds an
 // apex-scoped token into prod (or vice versa).
 // When COOKIE_APEX is "" (localhost / no configured cookieDomain) the set is
@@ -309,7 +309,7 @@ const APEX_COOKIE_HOSTS = new Set(
 
 // Cookie attributes that vary by host. On the production-facing hosts the
 // session cookie is scoped to the apex so it crosses subdomains (the enabler
-// for builders.amazonprimea.com, #726); everywhere else (localhost, staging)
+// for builders.example.com, #726); everywhere else (localhost, staging)
 // it stays host-only. Returns a spread-able object.
 function sessionCookieDomainOpts(req) {
   if (APEX_COOKIE_HOSTS.has(reqHost(req))) {
@@ -320,7 +320,7 @@ function sessionCookieDomainOpts(req) {
 
 // Validate a caller-supplied post-sign-in return target. Accept ONLY:
 //   - a relative path beginning with a single '/' (not '//', no backslash), or
-//   - an absolute https URL whose host is the apex or a *.amazonprimea.com sub.
+//   - an absolute https URL whose host is the apex or a *.example.com sub.
 // Anything else (other origins, javascript:, protocol-relative) → null, so the
 // caller falls back to the safe default. This is an open-redirect guard.
 function safeReturnTo(raw) {
@@ -355,7 +355,7 @@ function recoveryStartHref(req) {
 
 // The canonical sign-in origin, read from the instance branding pack (oauthOrigin,
 // else publicOrigin) so a non-OTB Cloud Bongos instance pins its OAuth redirects to
-// ITS OWN apex instead of a hardcoded "amazonprimea.com" (ADR 0062 §3/§5; the
+// ITS OWN apex instead of a hardcoded "example.com" (ADR 0062 §3/§5; the
 // branding contract). The fixed GDS_PUBLIC_ORIGIN env knob still wins for
 // dev/staging (auth.js's documented FIXED env name, not a <PREFIX>_ one). Resolved
 // once at module load; falls back to '' if branding fails, which leaves the env knob
@@ -535,7 +535,7 @@ module.exports = function buildAuthRouter() {
     const state = crypto.randomBytes(16).toString('hex');
     // redirect_uri is PINNED to the canonical origin (#734) — never derived from
     // the request host. GitHub only knows the apex callback, so a sign-in begun
-    // on builders.amazonprimea.com must still hand GitHub the apex redirect_uri
+    // on builders.example.com must still hand GitHub the apex redirect_uri
     // or GitHub rejects it. Same posture the Discord flow already uses.
     const redirectUri = `${WEB_REDIRECT_ORIGIN}/api/gds/auth/web/callback`;
     res.cookie(STATE_COOKIE, state, {
@@ -551,7 +551,7 @@ module.exports = function buildAuthRouter() {
     // the page gates); otherwise fall back to the Referer (the page that kicked
     // off sign-in), so the dozens of client 401 redirects land a builder back
     // where they were with no per-call-site change. Both go through the
-    // open-redirect allowlist (relative path or *.amazonprimea.com https).
+    // open-redirect allowlist (relative path or *.example.com https).
     const returnTo = safeReturnTo(req.query.return) || safeReturnTo(req.headers.referer);
     if (returnTo) {
       res.cookie(RETURN_COOKIE, returnTo, {
@@ -676,7 +676,7 @@ module.exports = function buildAuthRouter() {
         path: '/',
         expires: expiresAt,
         // Apex-scoped on the production hosts so one sign-in spans
-        // amazonprimea.com + builders. + status. (#726); host-only elsewhere.
+        // example.com + builders. + status. (#726); host-only elsewhere.
         ...sessionCookieDomainOpts(req),
       });
       // A browser arriving with an older session name must not keep it: two
@@ -805,7 +805,7 @@ module.exports = function buildAuthRouter() {
       secure: req.secure || req.headers['x-forwarded-proto'] === 'https',
       maxAge: 10 * 60 * 1000,
       // Apex-scoped (#734 parity) so the state survives the host switch: the
-      // link may start on builders.amazonprimea.com but DISCORD_REDIRECT_URI
+      // link may start on builders.example.com but DISCORD_REDIRECT_URI
       // always lands the callback on the apex. A host-only cookie would be
       // dropped on the hop and the state check would fail ("Link handshake
       // expired"). Mirrors the GitHub web-flow state cookie above.
@@ -1036,7 +1036,7 @@ module.exports = function buildAuthRouter() {
     const cookieToken = sessionCookieToken(req);
     if (!cookieToken) {
       // Name the instance's own sign-in host (from the branding pack), not a
-      // hardcoded "amazonprimea.com" (ADR 0062 §3/§5).
+      // hardcoded "example.com" (ADR 0062 §3/§5).
       const signInHost = configuredOAuthOrigin().replace(/^https?:\/\//, '').split('/')[0] || 'the sign-in page';
       return res.fail('cookie_required', { status: 403, message: `This endpoint mints CLI bearers from an authenticated browser session. Sign in at ${signInHost} first; bearer-only requests are rejected so a leaked CLI token cannot mint replacements for itself.` });
     }

package/src/bongos/routes/security.js

@@ -35,7 +35,7 @@ const SECURITY_DOC_CONTENT_MAX = 2_000_000;
 
 // Where the full ADR is expected to live on the droplet. Configurable so dev /
 // staging can point at a different file; the recommended prod path is
-// /etc/amazonprimea/security-adr.md (chmod 600, owned by the deploy user).
+// /etc/example/security-adr.md (chmod 600, owned by the deploy user).
 function adrPath() {
   return (resolveEnv('SECURITY_ADR_PATH') || '').trim() || null;
 }

package/src/bongos/routes.js

@@ -11,7 +11,7 @@
 // Three logical groups:
 //   - /auth/*   — GitHub Device Flow (CLI) + Authorization Code (web)
 //   - /me, /tasks/*, /claims/*, /cost/*, /credits/*, ...  — authenticated CLI/web ops
-//   - /public/* — read-only, no auth, for status.amazonprimea.com
+//   - /public/* — read-only, no auth, for status.example.com
 //
 // All JSON. Same Express app as the game server.
 

package/src/branding.js

@@ -186,7 +186,7 @@ const branding = () => (_cached ||= loadBranding());
 
 // The HTTP User-Agent the GDS sends on outbound API calls (GitHub, Discord),
 // derived from the instance branding pack so a non-OTB Cloud Bongos instance
-// identifies itself with ITS OWN name rather than a hardcoded "amazonprimea-gds"
+// identifies itself with ITS OWN name rather than a hardcoded "example-gds"
 // (ADR 0062 §3/§5; the branding contract). Source order: the repo name (the
 // GitHub binding these calls actually target), else the env prefix, else a neutral
 // fallback. Falls back hard if branding fails so an outbound call never crashes.

package/src/devbox-downloads.js

@@ -10,7 +10,7 @@
 //   GET /downloads/devbox/latest.json   → { version, assets: { target: url } }
 //   GET /downloads/devbox/<target>      → 302 to the release asset
 //
-// so every URL a builder ever sees or shares stays on amazonprimea.com, and a
+// so every URL a builder ever sees or shares stays on example.com, and a
 // release bump is a one-file config change that rides the normal ship flow.
 // Pure (config in, urls out) so tests need no server.
 

package/src/instance-config.js

@@ -73,9 +73,9 @@ function envPrefix(b = safeBrand()) {
 // The default API base the CLI targets when there is no <PREFIX>_API_BASE env
 // override AND no logged-in session api_base — i.e. the last-resort fallback.
 // Resolves to THIS instance's own publicOrigin from the branding pack (OTB →
-// https://amazonprimea.com, vanilla → http://localhost:3000), so the portable
+// https://example.com, vanilla → http://localhost:3000), so the portable
 // core never hard-codes another instance's URL (task 1002201 — pre-ADR-0139 the
-// literal 'https://amazonprimea.com' was baked into cli-lib, sending every
+// literal 'https://example.com' was baked into cli-lib, sending every
 // unconfigured consumer at the founder's game box). Single source of truth: every
 // CLI base resolution routes through here. Last-resort http://localhost:3000 when
 // branding can't be read at all — a local dev origin, never a foreign prod, so an

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.726'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.727'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/module-loader/provenance.js

@@ -6,7 +6,7 @@
 //
 // No module in this tree names a FOREIGN origin today — every module here was
 // built in this repo. Some name THIS instance as their origin (e.g. the
-// provisioning module's "Off the Boats (the first Cloud Bongos instance…)"),
+// provisioning module's "Example World (the first Cloud Bongos instance…)"),
 // which is still own-built. The split (core-loaded) side lights up only once a
 // module is actually pulled back in from the shared catalog under a different
 // project's name (ADR 0107 §8 pipeline, tasks 1770/1772).
@@ -17,7 +17,7 @@ function deriveProvenance(origin, ownProjectName) {
   const own = ownProjectName && String(ownProjectName).trim().toLowerCase();
   // "names this instance itself" (ADR 0107 §9) — an origin that IS, or leads
   // with, the own project name is own-built (a self-referential origin like
-  // "Off the Boats (the first Cloud Bongos instance)" counts). Only an origin
+  // "Example World (the first Cloud Bongos instance)" counts). Only an origin
   // naming a DIFFERENT project is core-loaded from the shared catalog. (An
   // exact `===` was too brittle: it was written when no module set `origin`,
   // so it never met a real, descriptive value — task 1776 re-land.)