@bongos/core 1.19.726 → 1.19.727

package/tests/instance_manifest.mjs

@@ -14,10 +14,10 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 
 // A client-safe branding projection (the shape clientBranding() returns).
 const BRAND_OTB = {
-  identity: { productName: 'Off the Boats', worldName: 'Amazonprimea', company: { name: 'Hermeslines' } },
+  identity: { productName: 'Example World', worldName: 'Example', company: { name: 'Hermeslines' } },
   currency: { label: 'drachmae', symbol: '' },
   theme: { colors: {}, fonts: { display: '', body: '', links: [] }, favicon: '', backdrop: '' },
-  copy: { tagline: 'Straight off the boats', hallName: 'Builders’ Hall', notFound: 'Page not found.' },
+  copy: { tagline: 'Straight example world', hallName: 'Builders’ Hall', notFound: 'Page not found.' },
   rankLabels: { xenos: 'Xenos', thetes: 'Thetes', metic: 'Metic', archon: 'Archon' },
   // the per-project policy the platform pushes (task 1003140) — the settings read-back
   project: { platformVisibility: 'gated', joinability: 'invite_only' },
@@ -37,12 +37,12 @@ const MODULES_VANILLA = {
   enabled: { game: false, 'art-pipeline': false, discord: false, 'dev-box': false },
   disciplines: ['engineer'],
 };
-const REPO = { owner: 'lars589', repo: 'amazonprimea', branch: 'main', blob_base: 'x', tree_base: 'y' };
+const REPO = { owner: 'example-owner', repo: 'example', branch: 'main', blob_base: 'x', tree_base: 'y' };
 
 test('manifest: schema id + headline name + embedded brand', () => {
   const m = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false, devBoxEnabled: true });
   assert.equal(m.schema, MANIFEST_SCHEMA);
-  assert.equal(m.name, 'Off the Boats');
+  assert.equal(m.name, 'Example World');
   assert.equal(m.brand, BRAND_OTB);
   assert.deepEqual(m.modules, MODULES_OTB);
 });
@@ -69,7 +69,7 @@ test('manifest: rank label falls back to the key when unlabelled', () => {
 
 test('manifest: repo projects to public clone coords; null on error', () => {
   const ok = buildInstanceManifest({ branding: BRAND_OTB, modules: MODULES_OTB, rankTier: RANK_TIER, repo: REPO, authConfigured: true, openEnrollment: false, devBoxEnabled: true });
-  assert.deepEqual(ok.repo, { owner: 'lars589', repo: 'amazonprimea', branch: 'main', url: 'https://github.com/lars589/amazonprimea' });
+  assert.deepEqual(ok.repo, { owner: 'example-owner', repo: 'example', branch: 'main', url: 'https://github.com/example-owner/example' });
   const none = buildInstanceManifest({ branding: BRAND_VANILLA, modules: MODULES_VANILLA, rankTier: RANK_TIER, repo: { error: 'no_repo_info' }, authConfigured: false, openEnrollment: false, devBoxEnabled: false });
   assert.equal(none.repo, null);
 });

package/tests/instance_mismatch_guard.mjs

@@ -7,7 +7,7 @@
 //
 // The guard stops the CLI from silently borrowing a DIFFERENT instance's session
 // (the 2026-07-08 demo-session failure, where a fresh demo clone used the
-// founder's amazonprimea.com session and offered to write into the wrong live
+// founder's example.com session and offered to write into the wrong live
 // backlog). Both helpers are deterministic with no DB/network/fs, so they
 // unit-test standalone. Run: node tests/instance_mismatch_guard.mjs
 
@@ -25,14 +25,14 @@ function test(name, fn) {
 }
 
 const DEMO = { domains: { publicOrigin: 'https://demo.cloudbongos.com' } };
-const OTB = { domains: { publicOrigin: 'https://amazonprimea.com' } };
+const OTB = { domains: { publicOrigin: 'https://example.com' } };
 const noEnv = {}; // no <PREFIX>_API_BASE override in scope
 const branded = () => true;  // simulate a checkout that HAS config/branding.json (a declared instance)
 const neutral = () => false; // simulate a NEUTRAL checkout (portable core — no config/branding.json)
 
 test('instanceOriginHost: extracts host, tolerates trailing slash', () => {
-  assert.equal(cli.instanceOriginHost('https://amazonprimea.com'), 'amazonprimea.com');
-  assert.equal(cli.instanceOriginHost('https://amazonprimea.com/'), 'amazonprimea.com');
+  assert.equal(cli.instanceOriginHost('https://example.com'), 'example.com');
+  assert.equal(cli.instanceOriginHost('https://example.com/'), 'example.com');
   assert.equal(cli.instanceOriginHost('https://demo.cloudbongos.com/api/gds'), 'demo.cloudbongos.com');
 });
 
@@ -43,20 +43,20 @@ test('instanceOriginHost: unparseable input → null (edge)', () => {
 });
 
 test('match: same-host session + branding → no mismatch (the OTB/normal case)', () => {
-  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: OTB, env: noEnv, hasInstanceConfig: branded });
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://example.com' }, brand: OTB, env: noEnv, hasInstanceConfig: branded });
   assert.equal(r.mismatch, false);
 });
 
 test('match: scheme/trailing-slash differences still match on host', () => {
-  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com/' }, brand: OTB, env: noEnv, hasInstanceConfig: branded });
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://example.com/' }, brand: OTB, env: noEnv, hasInstanceConfig: branded });
   assert.equal(r.mismatch, false);
 });
 
-test('mismatch: demo repo + founder amazonprimea session → REFUSE (the reported failure)', () => {
-  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: DEMO, env: noEnv, hasInstanceConfig: branded });
+test('mismatch: demo repo + founder example session → REFUSE (the reported failure)', () => {
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://example.com' }, brand: DEMO, env: noEnv, hasInstanceConfig: branded });
   assert.equal(r.mismatch, true);
   assert.equal(r.expected, 'https://demo.cloudbongos.com');
-  assert.equal(r.actual, 'https://amazonprimea.com');
+  assert.equal(r.actual, 'https://example.com');
 });
 
 test('mismatch: demo repo + cloudbongos.com session (sibling instance) → REFUSE', () => {
@@ -66,15 +66,15 @@ test('mismatch: demo repo + cloudbongos.com session (sibling instance) → REFUS
 
 test('env-override: an explicit *_API_BASE override wins (dev/staging) → no mismatch', () => {
   const r = cli.detectInstanceMismatch({
-    session: { api_base: 'https://amazonprimea.com' }, brand: DEMO,
+    session: { api_base: 'https://example.com' }, brand: DEMO,
     env: { GDS_API_BASE: 'http://localhost:3000' },
   });
   assert.equal(r.mismatch, false);
 });
 
 test('no-branding: repo declares no publicOrigin → cannot assert a mismatch → no mismatch', () => {
-  assert.equal(cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: {}, env: noEnv, hasInstanceConfig: branded }).mismatch, false);
-  assert.equal(cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: { domains: {} }, env: noEnv, hasInstanceConfig: branded }).mismatch, false);
+  assert.equal(cli.detectInstanceMismatch({ session: { api_base: 'https://example.com' }, brand: {}, env: noEnv, hasInstanceConfig: branded }).mismatch, false);
+  assert.equal(cli.detectInstanceMismatch({ session: { api_base: 'https://example.com' }, brand: { domains: {} }, env: noEnv, hasInstanceConfig: branded }).mismatch, false);
 });
 
 test('NEUTRAL checkout (no config/branding.json) → trust the session, NO mismatch (task 1002399)', () => {
@@ -88,7 +88,7 @@ test('NEUTRAL checkout (no config/branding.json) → trust the session, NO misma
 
 test('neutral guard is precedence-safe: env override still wins even when neutral', () => {
   // env override short-circuits before the neutral check — order-independent.
-  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://amazonprimea.com' }, brand: DEMO, env: { GDS_API_BASE: 'http://localhost:3000' }, hasInstanceConfig: neutral });
+  const r = cli.detectInstanceMismatch({ session: { api_base: 'https://example.com' }, brand: DEMO, env: { GDS_API_BASE: 'http://localhost:3000' }, hasInstanceConfig: neutral });
   assert.equal(r.mismatch, false);
 });
 

package/tests/leak_scan_allowlist.mjs

@@ -0,0 +1,94 @@
+// tests/leak_scan_allowlist.mjs
+//
+// Task 1003869 — the named exceptions to the prior-instance leak scan. The allowlist is
+// a security carve-out, so what matters is not that it permits the right things but that
+// it CANNOT permit the wrong ones: scoping is per (path, literal), a listed file does not
+// become a free pass, and an entry that stops matching is reported rather than forgotten.
+//
+// Run:  node tests/leak_scan_allowlist.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const A = require('../scripts/gds/leak-scan-allowlist.js');
+const { allowReason, partitionHits, unusedEntries, FILE_ALLOWLIST, WELL_KNOWN_PUBLIC_IPS } = A;
+const { PRIOR_INSTANCE_FLOOR } = require('../scripts/gds/package-core.js');
+
+// This test file is itself published, so it derives the literals it exercises rather
+// than spelling them out — the same self-leak invariant the allowlist module holds.
+const OWNER = PRIOR_INSTANCE_FLOOR.owners[0];
+const TOKEN = PRIOR_INSTANCE_FLOOR.tokens[0];
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── every entry carries its reason ───────────────────────────────────────────────────
+t('every entry names a path, at least one literal, and a substantive reason', () => {
+  for (const e of FILE_ALLOWLIST) {
+    assert.ok(e.path && typeof e.path === 'string', 'entry needs a path');
+    assert.ok(Array.isArray(e.classes) && e.classes.length > 0, `${e.path} needs classes`);
+    assert.ok(typeof e.reason === 'string' && e.reason.length > 40,
+      `${e.path} needs a reason that explains itself, not a label`);
+  }
+  for (const [ip, why] of Object.entries(WELL_KNOWN_PUBLIC_IPS)) {
+    assert.ok(typeof why === 'string' && why.length > 10, `${ip} needs a reason`);
+  }
+});
+
+// ── scoping: a listed file is NOT a free pass ────────────────────────────────────────
+t('an allowlisted file still fails on a literal it was not listed for', () => {
+  // mirror-redact.js is listed for public-ip only. An owner login appearing there would
+  // be a real leak — the SELF-LEAK INVARIANT that file documents about itself.
+  assert.ok(allowReason('scripts/gds/mirror-redact.js', 'public-ip', '8.8.8.8'));
+  assert.equal(allowReason('scripts/gds/mirror-redact.js', `literal:${OWNER}`, OWNER), null,
+    'a literal whose class is not named for this path must still fail');
+});
+t('an entry does not leak across to another path', () => {
+  // audit-authorship.sh may carry the owner login; an arbitrary script may not.
+  assert.ok(allowReason('scripts/gds/audit-authorship.sh', `literal:${OWNER}`, OWNER));
+  assert.equal(allowReason('scripts/gds/some-other-script.js', `literal:${OWNER}`, OWNER), null);
+});
+t('an unlisted file gets no exception at all', () => {
+  assert.equal(allowReason('src/bongos/routes/auth.js', `literal:${TOKEN}`, TOKEN), null);
+  assert.equal(allowReason('src/anything.js', 'public-ip', '203.0.113.9'), null,
+    'an address that is not well-known is not covered anywhere');
+});
+
+// ── well-known addresses are global, and exact ───────────────────────────────────────
+t('a well-known public address is covered in any file, but only by exact match', () => {
+  assert.ok(allowReason('tests/anything.mjs', 'public-ip', '8.8.8.8'));
+  assert.ok(allowReason('modules/whatever/x.js', 'public-ip', '1.1.1.1'));
+  // An address that is not on the well-known list is covered NOWHERE — the whole point of
+  // the sweep. Asserted with RFC 5737 documentation addresses rather than this instance's
+  // real ones: a test that pins "our droplet must not be allowlisted" by NAMING the droplet
+  // puts it straight back into the published trunk, which is the leak it is guarding against.
+  assert.equal(allowReason('tests/anything.mjs', 'public-ip', '198.51.100.7'), null);
+  assert.equal(allowReason('tests/anything.mjs', 'public-ip', '192.0.2.99'), null);
+});
+
+// ── partition + staleness ────────────────────────────────────────────────────────────
+t('partitionHits separates covered hits from real ones and attaches the reason', () => {
+  const hits = [
+    { path: 'tests/mirror_redact.mjs', label: 'public-ip', sample: '8.8.8.8' },
+    { path: 'src/bongos/routes/auth.js', label: `literal:${TOKEN}`, sample: TOKEN },
+  ];
+  const { allowed, remaining } = partitionHits(hits);
+  assert.equal(allowed.length, 1);
+  assert.ok(allowed[0].reason.length > 10, 'a covered hit carries the reason it was covered');
+  assert.equal(remaining.length, 1);
+  assert.equal(remaining[0].path, 'src/bongos/routes/auth.js');
+});
+t('unusedEntries reports an entry that has stopped matching', () => {
+  // No hits at all → every file entry is stale, which is the signal to prune.
+  assert.ok(unusedEntries([]).length > 0);
+  // A hit that covers one entry removes exactly that one from the stale list.
+  const stale = unusedEntries([{ path: 'scripts/gds/mirror-redact.js', label: 'public-ip', sample: '8.8.8.8' }]);
+  assert.ok(!stale.some((s) => s.path === 'scripts/gds/mirror-redact.js' && s.literal === 'public-ip'));
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/migrate_root_resolution.mjs

@@ -72,7 +72,7 @@ function printRoots({ cwd, initCwd } = {}) {
 }
 
 // A synthetic consumer: a dir with a bongos.config.json pointing at itself, exactly
-// as the post-split amazonprimea repo carries (bongos.config.json { instanceRoot: "." }).
+// as the post-split example repo carries (bongos.config.json { instanceRoot: "." }).
 function makeConsumer() {
   const dir = mkFixture('r89-consumer-');
   writeFileSync(path.join(dir, 'bongos.config.json'), JSON.stringify({ instanceRoot: '.' }));
@@ -249,7 +249,7 @@ t('the pre-fix unquoted loop now fails loudly instead of silently skipping', ()
 // ==========================================================================
 // WHICH DATABASE does migrate target? (task 1002755)
 //
-// scripts/migrate.sh:52 used to read `DB="${PGDATABASE:-amazonprimea}"` — one host instance's
+// scripts/migrate.sh:52 used to read `DB="${PGDATABASE:-example}"` — one host instance's
 // database name, baked into a script the core ships to EVERY instance. With no PGDATABASE in the
 // environment, a co-hosted box silently aimed at a stranger's database and everywhere else died
 // with a confusing "database ... does not exist" — after the caller had already moved its version
@@ -314,7 +314,7 @@ t('an instance that names no database is REFUSED, never defaulted', () => {
   assert.match(r.stderr, /cannot determine which database/i);
   assert.match(r.stderr, /Refusing to guess/i);
   // the regression itself: it must not reach for another instance's database
-  assert.doesNotMatch(`${r.stdout}${r.stderr}`, /amazonprimea/i);
+  assert.doesNotMatch(`${r.stdout}${r.stderr}`, /example/i);
 });
 
 t('--print-migrations stays DB-free — a dry run must not require a database name', () => {
@@ -333,7 +333,7 @@ t('migrate.sh hardcodes no instance database name', () => {
   const code = src.split(/\r?\n/).filter((l) => !/^\s*#/.test(l)).join('\n');
   assert.doesNotMatch(code, /PGDATABASE:-\s*[A-Za-z]/,
     'PGDATABASE must have no literal fallback — resolve from the branding pack instead');
-  assert.doesNotMatch(code, /amazonprimea/i, 'no instance database name in executable lines');
+  assert.doesNotMatch(code, /example/i, 'no instance database name in executable lines');
 });
 
 console.log(`\nmigrate_root_resolution: ${passed} passed, ${failed} failed`);

package/tests/mirror_redact.mjs

@@ -104,12 +104,12 @@ t('isPublicRoutableIPv4 classifier boundaries', () => {
 
 // ── IPv6 floor: global unicast redacted, loopback/link-local/ULA kept ─────────────────
 t('public IPv6 (the droplet) redacted; loopback/link-local/ULA kept', () => {
-  const out = redactText('v6 2604:a880:800:14:0:2:ee66:b000 keep fe80::1 fc00::5 ::1', rules);
+  const out = redactText('v6 2606:4700:4700::1111 keep fe80::1 fc00::5 ::1', rules);
   assert.ok(!out.includes('2604:a880'), `public IPv6 leaked: ${out}`);
   assert.ok(out.includes('fe80::1') && out.includes('fc00::5') && out.includes('::1'), out);
 });
 t('isPublicRoutableIPv6 + a "12:34:56" timestamp is NOT treated as an IP', () => {
-  assert.equal(isPublicRoutableIPv6('2604:a880:800:14:0:2:ee66:b000'), true);
+  assert.equal(isPublicRoutableIPv6('2606:4700:4700::1111'), true);
   assert.equal(isPublicRoutableIPv6('fe80::1'), false);
   assert.equal(isPublicRoutableIPv6('fc00::5'), false);
   assert.equal(isPublicRoutableIPv6('::1'), false);
@@ -127,14 +127,38 @@ t('reserved ::/8 is NOT a public IP — degenerate shorthand in binary is not a
   }
   // ...and the narrowing did NOT blunt the gate: real global unicast still fires, in
   // both the detector and the redactor.
-  for (const s of ['2000::1', '2001:db8::1', '2606:4700:4700::1111', '3fff::1']) {
+  for (const s of ['2000::1', '2606:4700:4700::1111', '3fff::1']) {
     assert.equal(isPublicRoutableIPv6(s), true, `${s} is a real public address and must still be flagged`);
   }
+  // 2001:db8::/32 is RESERVED FOR DOCUMENTATION (RFC 3849) — the IPv6 analogue of the
+  // RFC 5737 TEST-NET ranges v4 already exempts, and for the same reason: it is the
+  // address an example is SUPPOSED to use, nothing is reachable there, and flagging it
+  // only punishes docs for being written correctly (task 1003869). It was listed above
+  // as "a real public address" until then, which RFC 3849 says it is not.
+  for (const s of ['2001:db8::1', '2001:0db8:85a3:0000:0000:8a2e:0370:7334']) {
+    assert.equal(isPublicRoutableIPv6(s), false, `${s} is the RFC 3849 doc range and must not be flagged`);
+  }
   assert.equal(firstPublicIP('sprite bytes :: more bytes'), null, 'binary-ish shorthand is not reported');
   assert.equal(firstPublicIP('origin 2606:4700:4700::1111'), '2606:4700:4700::1111');
   assert.ok(!redactText('host 2606:4700:4700::1111', []).includes('2606:4700'), 'a real public IPv6 is still redacted');
 });
 
+// ── candidate guards: things that LOOK like an address but are not one ───────────────
+t('a leading-zero octet is packed numeric data, not an address (task 1003869)', () => {
+  // The committed GitHub logo path contains "…5.47 7.59.4.07.5…". The candidate regex
+  // reads 7.59.4.07 as a dotted quad, and it flagged ten phantom public-ip leaks across
+  // the design mocks and the landing page. No notation writes a host with a leading-zero
+  // octet ("07" is octal), so the guard costs nothing on a genuinely leaked address.
+  assert.equal(firstPublicIP('M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.5-.17'), null);
+  assert.equal(firstPublicIP('host 7.59.4.07'), null);
+  assert.equal(firstPublicIP('host 7.59.4.7'), '7.59.4.7', 'the same quad without the zero IS an address');
+});
+t('RFC 2544 benchmarking space 198.18/15 is not instance topology', () => {
+  assert.equal(isPublicRoutableIPv4(198, 18, 0, 1), false);
+  assert.equal(isPublicRoutableIPv4(198, 19, 255, 254), false);
+  assert.equal(isPublicRoutableIPv4(198, 20, 0, 1), true, 'the neighbouring /15 is ordinary public space');
+});
+
 // ── the DETECTOR is stricter than redaction ───────────────────────────────────────────
 t('findLeaks catches a raw literal substring a bounded rule would miss', () => {
   // "azoltanb" has no word boundary around zoltan; a \bzoltan\b rule misses it, the
@@ -143,7 +167,7 @@ t('findLeaks catches a raw literal substring a bounded rule would miss', () => {
   assert.ok(findLeaks('inline widgetco reference', literals).length > 0);
 });
 t('findLeaks is clean on fully-redacted output (fixed point)', () => {
-  const dirty = 'https://widgetco.com by zoltan at 8.8.8.8 and 2604:a880:800:14:0:2:ee66:b000';
+  const dirty = 'https://widgetco.com by zoltan at 8.8.8.8 and 2606:4700:4700::1111';
   const clean = redactText(dirty, rules);
   assert.deepEqual(findLeaks(clean, literals), [], `residual leaks: ${JSON.stringify(findLeaks(clean, literals))}`);
 });

package/tests/module_catalog.mjs

@@ -121,7 +121,7 @@ test('buildCatalog: keeps the DECLARED manifest fields beside the display credit
 
 test('buildCatalog: source and provenance are independent axes', () => {
   const rows = catalog.buildCatalog({
-    loaded: [loadedIn(CORE, 'provisioning', { origin: 'Off the Boats', author: 'Off the Boats' })],
+    loaded: [loadedIn(CORE, 'provisioning', { origin: 'Example World', author: 'Example World' })],
     coreRoot: CORE, instanceRoot: INST,
     ownProjectName: 'Mercury',
   });
@@ -156,7 +156,7 @@ test('buildCatalog: survives a manifest with nothing but the required keys', ()
 const sample = () => catalog.buildCatalog({
   loaded: [
     loadedIn(CORE, 'economy', { description: 'drachmae and credits' }),
-    loadedIn(CORE, 'provisioning', { author: 'Off the Boats', origin: 'Off the Boats', license: 'AGPL-3.0' }),
+    loadedIn(CORE, 'provisioning', { author: 'Example World', origin: 'Example World', license: 'AGPL-3.0' }),
     loadedIn(INST, 'game', { description: 'the world' }),
   ],
   enabled: { economy: true, game: true },
@@ -174,7 +174,7 @@ test('searchCatalog: matches key, description, author, origin and licence; empty
   assert.equal(catalog.searchCatalog(rows, '').length, 3);
   assert.equal(catalog.searchCatalog(rows, '   ').length, 3);
   assert.deepEqual(catalog.searchCatalog(rows, 'DRACHMAE').map((r) => r.key), ['economy'], 'case-insensitive, over description');
-  assert.deepEqual(catalog.searchCatalog(rows, 'off the boats').map((r) => r.key), ['provisioning'], 'over the credit');
+  assert.deepEqual(catalog.searchCatalog(rows, 'example world').map((r) => r.key), ['provisioning'], 'over the credit');
   assert.deepEqual(catalog.searchCatalog(rows, 'agpl').map((r) => r.key), ['provisioning'], 'over the licence');
   assert.deepEqual(catalog.searchCatalog(rows, 'nothing-matches-this'), []);
 });
@@ -202,7 +202,7 @@ test('formatCatalog: renders every row with its credit, and marks the inferred o
   assert.match(out, /2 in the core catalog \(1 enabled\) · 1 built here · 3 total/);
   assert.match(out, /\[x\]\s+economy/, 'an enabled module is marked [x]');
   assert.match(out, /\[ \]\s+provisioning/, 'a disabled module is marked [ ]');
-  assert.match(out, /Off the Boats/, 'a declared credit is shown');
+  assert.match(out, /Example World/, 'a declared credit is shown');
   assert.match(out, /credit not declared in module\.json/, 'the inferred-credit footnote appears when one is shown');
 });
 
@@ -227,7 +227,7 @@ test('formatCatalog: a search with no hits says so instead of printing an empty
 
 test('cmdList: --json emits the rows + summary, and honours --catalog/--search', () => {
   const lines = [];
-  const code = mod.cmdList(['--json', '--catalog', '--search', 'off the boats'], {
+  const code = mod.cmdList(['--json', '--catalog', '--search', 'example world'], {
     log: (s) => lines.push(s),
     gather: () => ({ rows: sample(), skipped: [], errors: [], core: '1.19.0' }),
   });

package/tests/module_submissions.mjs

@@ -59,14 +59,14 @@ await test('createModuleSubmission() INSERTs, jsonb-casts manifest/files/sign_of
   const precheckPassedAt = new Date('2026-07-08T00:00:00.000Z');
   nextRows = [{
     id: 1, module_key: 'widget', submitted_by: 42, manifest, sign_off: signOff,
-    precheck_passed_at: precheckPassedAt, source_repo: 'lars589/amazonprimea',
+    precheck_passed_at: precheckPassedAt, source_repo: 'example-owner/example',
     status: 'pending', reviewed_by: null, reviewed_at: null, review_notes: null,
     submitted_at: '2026-07-08T00:00:01.000Z',
   }];
 
   const row = await moduleSubmissions.createModuleSubmission({
     moduleKey: 'widget', submittedBy: 42, manifest, files, signOff, precheckPassedAt,
-    sourceRepo: 'lars589/amazonprimea',
+    sourceRepo: 'example-owner/example',
   });
 
   const { text, params } = lastCall();
@@ -83,7 +83,7 @@ await test('createModuleSubmission() INSERTs, jsonb-casts manifest/files/sign_of
   assert.equal(params[3], JSON.stringify(files));
   assert.equal(params[4], JSON.stringify(signOff));
   assert.equal(params[5], precheckPassedAt);
-  assert.equal(params[6], 'lars589/amazonprimea');
+  assert.equal(params[6], 'example-owner/example');
 
   assert.equal(row.id, 1);
   assert.equal(row.status, 'pending');

package/tests/package_core.mjs

@@ -585,7 +585,7 @@ t('scanArtifactForLeaks: flags a prior-instance literal in any shipped file', ()
 
 t('scanArtifactForLeaks: flags a public IP but not a private/localhost one', () => {
   const r = scanArtifactForLeaks([
-    { path: 'a.js', content: 'host = 104.236.254.243\n' },   // public → flagged
+    { path: 'a.js', content: 'host = 1.2.3.4\n' },           // public → flagged
     { path: 'b.js', content: 'host = 127.0.0.1; lan = 10.0.0.5\n' }, // localhost + private → not
   ]);
   const byPath = Object.fromEntries(r.literalHits.map((h) => [h.path, h.label]));

package/tests/parallel-load.mjs

@@ -17,12 +17,12 @@
 //
 // SAFETY: never point the live mode at production. It mutates real claim/task
 // state. Target staging (once #262 seeds it) or a local instance. The harness
-// refuses a BASE_URL containing "amazonprimea.com" without --i-know (the prod
+// refuses a BASE_URL containing "example.com" without --i-know (the prod
 // host), so a fat-fingered run can't churn the live game's GDS.
 //
 // Usage:
 //   node tests/parallel-load.mjs                         # self-test (CI-safe)
-//   BASE_URL=https://staging.amazonprimea.com TOKEN=… \
+//   BASE_URL=https://staging.example.com TOKEN=… \
 //     node tests/parallel-load.mjs --workers 5 --duration 1800   # live (staging)
 //
 // Exit 0 = no anomalies (no 5xx, no unexpected outcome class). Exit 1 = a
@@ -324,9 +324,9 @@ function report(stats, wallMs) {
 
 (async () => {
   if (!SELF_TEST && !KNOW_PROD) {
-    // Parse the actual HOSTNAME — a substring match on "amazonprimea.com" /
+    // Parse the actual HOSTNAME — a substring match on "example.com" /
     // "staging." can be fooled by query strings or paths (e.g.
-    // https://amazonprimea.com/x?ref=staging.foo). Refuse the prod apex/www
+    // https://example.com/x?ref=staging.foo). Refuse the prod apex/www
     // host; allow the staging subdomain and anything else (localhost, etc.).
     let host = '';
     try {
@@ -335,10 +335,10 @@ function report(stats, wallMs) {
       console.error(`REFUSING: BASE_URL "${BASE_URL}" is not a valid URL.`);
       process.exit(2);
     }
-    const isProd = host === 'amazonprimea.com' || host === 'www.amazonprimea.com';
+    const isProd = host === 'example.com' || host === 'www.example.com';
     if (isProd) {
       console.error(`REFUSING: BASE_URL host "${host}" is PRODUCTION. This harness mutates claim/task state.`);
-      console.error('Point it at staging (staging.amazonprimea.com, once #262 seeds it) or a local instance.');
+      console.error('Point it at staging (staging.example.com, once #262 seeds it) or a local instance.');
       console.error('If you really mean it, pass --i-know (you almost certainly do not).');
       process.exit(2);
     }

package/tests/projects_hub.mjs

@@ -1821,7 +1821,7 @@ test("the field is the void: no drawn grid, no stars, no twinkle; the labels, th
 
 test('the kit proves the field path: the fixture carries a curated template and the states file reads it back', () => {
   const fixture = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', 'featured.json'), 'utf8'));
-  const otb = fixture.projects.find((p) => p.origin === 'https://amazonprimea.com');
+  const otb = fixture.projects.find((p) => p.origin === 'https://example.com');
   assert.equal(otb.template, 'bead-wash');
   const demo = fixture.projects.find((p) => p.origin === 'https://demo.cloudbongos.com');
   assert.equal(demo.template, 'pair-gold-wash', 'a material template rides the wire (task 1003337)');
@@ -1831,7 +1831,7 @@ test('the kit proves the field path: the fixture carries a curated template and
   const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8'));
   const attrs = states.states['in-map'].expect.attr.map((a) => a.join(' '));
   assert.ok(attrs.includes('#selfOrb data-template pair-chrome'));
-  assert.ok(attrs.some((a) => a.includes('amazonprimea.com') && a.endsWith('data-template bead-wash')), 'the curated template reaches the orb');
+  assert.ok(attrs.some((a) => a.includes('example.com') && a.endsWith('data-template bead-wash')), 'the curated template reaches the orb');
   assert.ok(attrs.some((a) => a.includes('demo.cloudbongos.com') && a.endsWith('data-material obsidian')), 'the material reaches the orb as its own attribute');
   assert.ok(attrs.some((a) => a.includes('demo.cloudbongos.com') && a.endsWith('data-template pair-obsidian-tint')), 'the owner\'s choice outranks the curated template on the sky (task 1003347)');
 });