@bongos/core 1.19.726 → 1.19.727

package/tests/provision.mjs

@@ -154,7 +154,7 @@ t('buildCorePinRefreshCommit (the commit step): git sequence, token-URL push, an
     `git -C /srv/bongos/spike-harbor config user.email "${P.provisionerBotEmail()}"`,
   ]);
   assert.equal(P.provisionerBotEmail({ PROVISION_BOT_EMAIL: 'ops@acme.test' }), 'ops@acme.test', 'env override wins');
-  assert.doesNotMatch(P.provisionerBotEmail({}), /amazonprimea/i, 'never a founder-host address');
+  assert.doesNotMatch(P.provisionerBotEmail({}), /example/i, 'never a founder-host address');
   assert.equal(withTok.add, 'git -C /srv/bongos/spike-harbor add -A');
   assert.match(withTok.commit, /@bongos\/core 1\.19\.2 -> 1\.19\.196 \(task 1003050\)/);
   assert.match(withTok.push, /store --file=\/tmp\/cred.*x-access-token@github\.com\/jaxri\/spike-harbor\.git HEAD:main/);
@@ -179,7 +179,7 @@ t('backup units: per-instance names + the DB set on the unit (fixes the task-221
   assert.equal(P.backupServicePath(coTenant), '/etc/systemd/system/mercury-db-backup.service');
   assert.equal(P.backupTimerPath(coTenant), '/etc/systemd/system/mercury-db-backup.timer');
   const svc = P.backupService(coTenant);
-  // the DB is pinned on the unit → no fallback to the nonexistent amazonprimea default
+  // the DB is pinned on the unit → no fallback to the nonexistent example default
   assert.match(svc, /Environment=GDS_BACKUP_DB=mercury/);
   assert.match(svc, /Environment=GDS_BACKUP_DIR=\/var\/backups\/gds/);
   assert.match(svc, new RegExp(`User=${reEsc('lars')}`), 'runs as the app user (mirrors serviceUnit)');
@@ -189,7 +189,7 @@ t('backup units: per-instance names + the DB set on the unit (fixes the task-221
   assert.match(timer, /Unit=mercury-db-backup\.service/, 'the timer drives the per-instance service');
 });
 
-t('backupScriptPath resolves the CONSUMER LAYOUT, never the old /home/lars/amazonprimea monorepo path', () => {
+t('backupScriptPath resolves the CONSUMER LAYOUT, never the old /home/lars/example monorepo path', () => {
   // standalone → the script inside the instance's OWN pinned @bongos/core
   const standalone = { ...coTenant, hosting_shape: 'standalone' };
   const sPath = P.backupScriptPath(standalone);
@@ -198,8 +198,8 @@ t('backupScriptPath resolves the CONSUMER LAYOUT, never the old /home/lars/amazo
   // co-tenant → this control-plane checkout's scripts/gds (mirrors serviceUnit's REPO_ROOT split)
   assert.match(P.backupScriptPath(coTenant), /\/scripts\/gds\/db-backup-nightly\.sh$/);
   // the regression this whole task fixes: NEVER the hardcoded old monorepo path
-  assert.doesNotMatch(P.backupService(standalone), /\/home\/lars\/amazonprimea/);
-  assert.doesNotMatch(P.backupService(coTenant), /\/home\/lars\/amazonprimea/);
+  assert.doesNotMatch(P.backupService(standalone), /\/home\/lars\/example/);
+  assert.doesNotMatch(P.backupService(coTenant), /\/home\/lars\/example/);
 });
 
 t('webEnvBody: OAuth creds use the LOADED pack\'s envPrefix (not the slug) + brand/port/db', () => {
@@ -336,7 +336,7 @@ t('dnsUpsertEnv: hostname + target IP + derived zone; an explicit zone wins', ()
 t('dnsUpsertEnv: BOX_PROXIED defaults off (co-tenant on-demand ACME); proxied:true opts in (standalone behind the wildcard origin cert, task 2077)', () => {
   assert.equal(P.dnsUpsertEnv({ domain: 'mercury.example.com' }, { publicIp: '203.0.113.5' }).BOX_PROXIED, '0');
   assert.equal(P.dnsUpsertEnv({ domain: 'mercury.example.com' }, { publicIp: '203.0.113.5', proxied: false }).BOX_PROXIED, '0');
-  assert.equal(P.dnsUpsertEnv({ domain: 'demo.cloudbongos.com' }, { publicIp: '161.35.132.201', proxied: true }).BOX_PROXIED, '1');
+  assert.equal(P.dnsUpsertEnv({ domain: 'demo.cloudbongos.com' }, { publicIp: '198.51.100.20', proxied: true }).BOX_PROXIED, '1');
 });
 
 t('healthzCmd hits the instance port /healthz', () => {
@@ -460,7 +460,7 @@ await ta('provisionInstance(standalone): the backup unit ExecStart points at the
   // capture the unit BODIES, not just paths, so we can assert the ExecStart path
   const bodies = {};
   deps.writeFile = (p, body) => { writes.push(p); bodies[p] = body; return { ok: true }; };
-  const inst = { ...coTenant, hosting_shape: 'standalone', target_ref: 'lars589/mercury' };
+  const inst = { ...coTenant, hosting_shape: 'standalone', target_ref: 'example-owner/mercury' };
   await P.provisionInstance(inst, deps);
   const svc = bodies[P.backupServicePath(inst)];
   assert.ok(svc, 'wrote the backup service unit');
@@ -486,12 +486,12 @@ await ta('provisionInstance(standalone): web.env seats the signed-in builder, no
 
 await ta('provisionInstance(standalone) SCAFFOLDS its repo, then syncs (pull + npm ci) + migrates from the instance root', async () => {
   const { deps, cmds, writes } = recorder();
-  const r = await P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'lars589/mercury' }, deps);
+  const r = await P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'example-owner/mercury' }, deps);
   assert.equal(r.ok, true);
   const joined = cmds.join('\n');
   // scaffold leg (task 2055): git init → package-core → init --vendor-core → push
   assert.match(joined, /git -C \S+ init -q/, 'inits the instance working tree (empty repo — nothing to clone)');
-  assert.match(joined, /git -C \S+ remote add origin git@github-deploy:lars589\/mercury\.git/, 'sets the instance repo as origin');
+  assert.match(joined, /git -C \S+ remote add origin git@github-deploy:example-owner\/mercury\.git/, 'sets the instance repo as origin');
   assert.match(joined, /node scripts\/gds\/package-core\.js/, 'builds the core tarball');
   assert.match(joined, /init\.js --from .* --dir .* --no-seed --force --vendor-core /, 'materializes + file:-pins the core');
   assert.match(joined, /git -C .* push -u origin main/, 'pushes the scaffold');
@@ -518,27 +518,27 @@ await ta('provisionInstance(standalone) SCAFFOLDS its repo, then syncs (pull + n
 
 // ── standalone scaffold helpers + guards (task 2055) ──────────────────────────
 t('parseTargetRef: owner/repo, SSH + HTTPS URLs, .git suffix; garbage → null', () => {
-  assert.deepEqual(P.parseTargetRef('lars589/demo'), { owner: 'lars589', name: 'demo' });
-  assert.deepEqual(P.parseTargetRef('git@github-deploy:lars589/demo.git'), { owner: 'lars589', name: 'demo' });
-  assert.deepEqual(P.parseTargetRef('https://github.com/lars589/demo.git'), { owner: 'lars589', name: 'demo' });
+  assert.deepEqual(P.parseTargetRef('example-owner/demo'), { owner: 'example-owner', name: 'demo' });
+  assert.deepEqual(P.parseTargetRef('git@github-deploy:example-owner/demo.git'), { owner: 'example-owner', name: 'demo' });
+  assert.deepEqual(P.parseTargetRef('https://github.com/example-owner/demo.git'), { owner: 'example-owner', name: 'demo' });
   assert.equal(P.parseTargetRef('garbage'), null);
   assert.equal(P.parseTargetRef(''), null);
   assert.equal(P.parseTargetRef(null), null);
 });
 
 t('instanceRepoRemote: reuses the SSH deploy alias (no secret in the URL); alias overridable', () => {
-  assert.equal(P.instanceRepoRemote({ owner: 'lars589', name: 'demo' }), 'git@github-deploy:lars589/demo.git');
+  assert.equal(P.instanceRepoRemote({ owner: 'example-owner', name: 'demo' }), 'git@github-deploy:example-owner/demo.git');
   assert.equal(P.instanceRepoRemote({ owner: 'o', name: 'r' }, { sshAlias: 'gh-alt' }), 'git@gh-alt:o/r.git');
 });
 
 t('instanceInitSpec: builds a VALID greenfield init spec from the row + owner login', () => {
   const spec = P.instanceInitSpec(
-    { slug: 'demo', target_ref: 'lars589/demo', domain: 'demo.cloudbongos.com', port: 3003 },
-    { ownerLogin: 'lars589' },
+    { slug: 'demo', target_ref: 'example-owner/demo', domain: 'demo.cloudbongos.com', port: 3003 },
+    { ownerLogin: 'example-owner' },
   );
   assert.equal(spec.identity.productName, 'demo');
-  assert.deepEqual(spec.repo, { owner: 'lars589', name: 'demo' });
-  assert.equal(spec.firstAdmin, 'lars589');
+  assert.deepEqual(spec.repo, { owner: 'example-owner', name: 'demo' });
+  assert.equal(spec.firstAdmin, 'example-owner');
   assert.equal(spec.domains.publicOrigin, 'https://demo.cloudbongos.com');
   // it must satisfy init.validateSpec (greenfield) — the scaffold feeds it to `bongos init`
   const init = require('../scripts/gds/init.js');
@@ -566,7 +566,7 @@ await ta('scaffoldStandaloneRepo: idempotent — a repo that already carries pac
     mkdirSync(join(tmp, 'demo'), { recursive: true });
     writeFileSync(join(tmp, 'demo', 'package.json'), '{}\n');   // sign of a completed scaffold
     const { deps, cmds } = recorder({ apply: true });
-    const res = await P.scaffoldStandaloneRepo({ slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo' }, deps);
+    const res = await P.scaffoldStandaloneRepo({ slug: 'demo', hosting_shape: 'standalone', target_ref: 'example-owner/demo' }, deps);
     assert.equal(res.already, true);
     assert.equal(cmds.length, 0, 'no init/build/push when already scaffolded');
   } finally {
@@ -589,7 +589,7 @@ async function scaffoldWithEnv(env) {
     // the scaffold rebuilds via package-core.js (task 1002275). A consumer-instance root
     // (a real pin) takes the reuse path — covered by its own test below.
     await P.scaffoldStandaloneRepo(
-      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo' },
+      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'example-owner/demo' },
       { ...deps, env, instanceRoot: tmp },
     );
     return cmds.join('\n');
@@ -670,13 +670,13 @@ await ta('scaffoldStandaloneRepo: on a consumer control plane it REUSES the pinn
   try {
     const { deps, cmds } = recorder({ apply: true });
     await P.scaffoldStandaloneRepo(
-      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo' },
+      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'example-owner/demo' },
       { ...deps, instanceRoot: cp },
     );
     const joined = cmds.join('\n');
     assert.ok(!/package-core\.js/.test(joined), 'does NOT rebuild the core from source (the empty-set abort path)');
     assert.match(joined, new RegExp('init\\.js --from .* --no-seed --force --vendor-core ' + reEsc(pinned)), 'feeds the PINNED tarball to init --vendor-core');
-    assert.match(joined, /git -C \S+ remote add origin git@github-deploy:lars589\/demo\.git/, 'still targets the repo as origin');
+    assert.match(joined, /git -C \S+ remote add origin git@github-deploy:example-owner\/demo\.git/, 'still targets the repo as origin');
     assert.match(joined, /push /, 'still pushes the scaffold');
   } finally {
     P.CONFIG.standaloneBase = origBase;
@@ -738,7 +738,7 @@ await ta('scaffoldStandaloneRepo: a REGISTRY-pinned consumer control plane PACKS
   try {
     const { deps, cmds } = recorder({ apply: true });
     await P.scaffoldStandaloneRepo(
-      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo' },
+      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'example-owner/demo' },
       { ...deps, instanceRoot: cp },
     );
     const joined = cmds.join('\n');
@@ -771,14 +771,14 @@ await ta('scaffoldStandaloneRepo: pushes via the owner OAuth token (not SSH), to
     deps.writeFile = (p, body, opts) => { writes.push({ p, body, opts }); return { ok: true }; };
     deps.getGithubToken = async () => ({ token: 'gho_SECRET_TOKEN_XYZ', scope: 'public_repo' });
     await P.scaffoldStandaloneRepo(
-      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo', owner_builder_id: 7 },
+      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'example-owner/demo', owner_builder_id: 7 },
       { ...deps, instanceRoot: base },
     );
     const joined = cmds.join('\n');
     // SECURITY: the token must NEVER appear in a command string (makeExec logs commands)
     assert.ok(!joined.includes('gho_SECRET_TOKEN_XYZ'), 'token never appears in any command string');
     // pushes over HTTPS via the credential-store helper to HEAD:main, NOT the SSH origin
-    assert.match(joined, /credential\.helper='store --file=[^']*bongos-gitcred-demo[^']*' push https:\/\/x-access-token@github\.com\/lars589\/demo\.git HEAD:main/, 'pushes via the token credential-store helper');
+    assert.match(joined, /credential\.helper='store --file=[^']*bongos-gitcred-demo[^']*' push https:\/\/x-access-token@github\.com\/example-owner\/demo\.git HEAD:main/, 'pushes via the token credential-store helper');
     assert.ok(!/push -u origin main/.test(joined), 'does NOT use the SSH origin push when a token is available');
     // the credential file is written chmod 600, carries the token (content, NOT logged), then removed
     const cred = writes.find((w) => /bongos-gitcred-demo/.test(w.p));
@@ -799,7 +799,7 @@ await ta('scaffoldStandaloneRepo: no owner token → falls back to the SSH origi
   try {
     const { deps, cmds } = recorder({ apply: true });   // default getGithubToken → null
     await P.scaffoldStandaloneRepo(
-      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo', owner_builder_id: 7 },
+      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'example-owner/demo', owner_builder_id: 7 },
       { ...deps, instanceRoot: base },
     );
     const joined = cmds.join('\n');
@@ -869,7 +869,7 @@ async function scaffoldInMode(mode, { token = null, seedRoot = null } = {}) {
     deps.writeFile = (p, body, opts) => { writes.push({ p, body, opts }); return { ok: true }; };
     if (token) deps.getGithubToken = async () => ({ token, scope: 'read:user,repo' });
     await P.scaffoldStandaloneRepo(
-      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo', owner_builder_id: 7, onboard_mode: mode },
+      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'example-owner/demo', owner_builder_id: 7, onboard_mode: mode },
       { ...deps, instanceRoot: base },
     );
     return { joined: cmds.join('\n'), cmds, writes, root: join(base, 'demo') };
@@ -881,7 +881,7 @@ async function scaffoldInMode(mode, { token = null, seedRoot = null } = {}) {
 
 await ta('scaffoldStandaloneRepo(adopt): CLONES the existing repo instead of git-init-ing a fresh tree', async () => {
   const { joined } = await scaffoldInMode('adopt', { token: 'gho_TOK' });
-  assert.match(joined, /clone https:\/\/x-access-token@github\.com\/lars589\/demo\.git/, 'clones over the token URL (covers a PRIVATE repo the shared deploy key cannot read)');
+  assert.match(joined, /clone https:\/\/x-access-token@github\.com\/example-owner\/demo\.git/, 'clones over the token URL (covers a PRIVATE repo the shared deploy key cannot read)');
   assert.ok(!/git -C \S+ init -q/.test(joined), 'never git-inits a fresh tree on the adopt path — that is what produced the unrelated history');
   assert.ok(!/checkout -B main/.test(joined), 'does not force-create the branch over the cloned one');
   assert.match(joined, /init\.js --from .* --no-seed --adopt --accept /, 'materializes via init --adopt --accept (layering, accept-gated)');
@@ -889,7 +889,7 @@ await ta('scaffoldStandaloneRepo(adopt): CLONES the existing repo instead of git
   // (`git pull --ff-only origin main`, and the box timer's `git reset --hard origin/main`)
   // reads origin, and the one-shot token URL cannot authenticate once its credential file
   // is deleted.
-  assert.match(joined, /git -C \S+ remote set-url origin git@github-deploy:lars589\/demo\.git/, 'normalizes origin to the SSH remote after cloning');
+  assert.match(joined, /git -C \S+ remote set-url origin git@github-deploy:example-owner\/demo\.git/, 'normalizes origin to the SSH remote after cloning');
 });
 
 // THE SAFETY PROPERTY. Since ADR 0155 this credential can write to EVERY repo the owner
@@ -900,7 +900,7 @@ await ta('scaffoldStandaloneRepo(adopt): NEVER force-pushes and never passes --f
   assert.ok(!/--force/.test(joined), 'no --force anywhere in the adopt argv');
   assert.ok(!/ -f\b/.test(joined.replace(/rm -f /g, '')), 'no -f force shorthand (rm -f of the credential file excepted)');
   assert.ok(!/\+refs|\+HEAD|:\+/.test(joined), 'no leading-+ refspec (the other way to force a push)');
-  assert.match(joined, /push https:\/\/x-access-token@github\.com\/lars589\/demo\.git HEAD:main/, 'a plain fast-forward push');
+  assert.match(joined, /push https:\/\/x-access-token@github\.com\/example-owner\/demo\.git HEAD:main/, 'a plain fast-forward push');
 });
 
 await ta('scaffoldStandaloneRepo(greenfield): unchanged — git init + --force, no clone', async () => {
@@ -914,7 +914,7 @@ await ta('scaffoldStandaloneRepo(greenfield): unchanged — git init + --force,
 
 await ta('scaffoldStandaloneRepo(adopt): no owner token → clones over the SSH remote (no credential helper)', async () => {
   const { joined } = await scaffoldInMode('adopt');   // recorder default getGithubToken → null
-  assert.match(joined, /clone git@github-deploy:lars589\/demo\.git/, 'falls back to the SSH remote');
+  assert.match(joined, /clone git@github-deploy:example-owner\/demo\.git/, 'falls back to the SSH remote');
   assert.ok(!/credential\.helper=/.test(joined), 'no credential helper without a token');
   assert.match(joined, /push -u origin main/, 'and the SSH origin push');
 });
@@ -944,7 +944,7 @@ await ta('scaffoldStandaloneRepo(adopt): a default branch that is not `main` fai
     deps.exec = (cmd) => ({ ok: true, stdout: /rev-parse --abbrev-ref HEAD/.test(cmd) ? 'master\n' : '' });
     await assert.rejects(
       () => P.scaffoldStandaloneRepo(
-        { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo', owner_builder_id: 7, onboard_mode: 'adopt' },
+        { slug: 'demo', hosting_shape: 'standalone', target_ref: 'example-owner/demo', owner_builder_id: 7, onboard_mode: 'adopt' },
         { ...deps, instanceRoot: base },
       ),
       /default branch is "master", not "main"/,
@@ -969,7 +969,7 @@ await ta('scaffoldStandaloneRepo(adopt): the credential file is removed even whe
     };
     await assert.rejects(
       () => P.scaffoldStandaloneRepo(
-        { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo', owner_builder_id: 7, onboard_mode: 'adopt' },
+        { slug: 'demo', hosting_shape: 'standalone', target_ref: 'example-owner/demo', owner_builder_id: 7, onboard_mode: 'adopt' },
         { ...deps, instanceRoot: base },
       ),
       /non-fast-forward/,
@@ -1475,11 +1475,11 @@ console.log('\nremote orchestration over SSH (task 2065):');
 
 t('makeExec(remoteHost): a step is ssh-wrapped and cd\'s to the remote checkout (dry-run)', () => {
   const logs = [];
-  const run = P.makeExec({ apply: false, log: (m) => logs.push(m), remoteHost: 'lars@10.0.0.9', remoteCwd: '/home/lars/amazonprimea', sshOpts: '-o BatchMode=yes' });
+  const run = P.makeExec({ apply: false, log: (m) => logs.push(m), remoteHost: 'lars@10.0.0.9', remoteCwd: '/home/lars/example', sshOpts: '-o BatchMode=yes' });
   run('createdb mercury');
   const line = logs.join('\n');
   assert.match(line, /\[ssh lars@10\.0\.0\.9\]/, 'shows the ssh target');
-  assert.match(line, /cd \/home\/lars\/amazonprimea && createdb mercury/, 'cd to the remote checkout, then the command');
+  assert.match(line, /cd \/home\/lars\/example && createdb mercury/, 'cd to the remote checkout, then the command');
 });
 
 t('makeExec(remoteHost): explicit cwd overrides the default; env is composed INTO the remote script (crosses the ssh hop)', () => {
@@ -1544,8 +1544,8 @@ await ta('provisionInstance(co-tenant, remote): box steps use the box `exec`, bu
 await ta('provisionInstance(standalone, remote): EVERY box step runs control-plane-local — nothing crosses to the co-hosting box; the A record points at the control plane (task 2074)', async () => {
   const savedPub = P.CONFIG.publicIp, savedCp = P.CONFIG.controlPlaneIp, savedHook = P.CONFIG.dnsHook, savedRemote = P.CONFIG.remoteHost;
   P.CONFIG.remoteHost = 'cohost';              // remote-exec mode: co-tenant steps WOULD go to the co-hosting box
-  P.CONFIG.publicIp = '104.236.254.243';       // the co-hosting box's IP (where co-tenants run)
-  P.CONFIG.controlPlaneIp = '161.35.132.201';  // the control plane's OWN IP (where a standalone runs)
+  P.CONFIG.publicIp = '192.0.2.10';       // the co-hosting box's IP (where co-tenants run)
+  P.CONFIG.controlPlaneIp = '198.51.100.20';  // the control plane's OWN IP (where a standalone runs)
   P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
   try {
     const box = [], control = [], boxWrites = [], controlWrites = [], dnsEnvs = [];
@@ -1560,7 +1560,7 @@ await ta('provisionInstance(standalone, remote): EVERY box step runs control-pla
       doApi: null,
       checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
     };
-    await P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'lars589/mercury', domain: 'mercury.cloudbongos.com' }, deps);
+    await P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'example-owner/mercury', domain: 'mercury.cloudbongos.com' }, deps);
     // The bug (task 2074): these landed on the REMOTE box, which never had the scaffolded
     // dir. They must ALL be on the control-plane executor now.
     for (const re of [/git pull --ff-only/, /npm ci/, /createdb mercury/, /migrate\.sh/, /systemctl enable --now/, /systemctl reload caddy/, /healthz/]) {
@@ -1579,7 +1579,7 @@ await ta('provisionInstance(standalone, remote): EVERY box step runs control-pla
     // DNS: the A record points at the CONTROL PLANE's IP (not the co-hosting box's publicIp).
     const dns = dnsEnvs.find((e) => e.cmd === '/opt/infra/box-dns-cloudflare.sh');
     assert.ok(dns, 'DNS hook ran on the control executor');
-    assert.equal(dns.env.BOX_IP, '161.35.132.201', 'A record → the control-plane IP, NOT the co-hosting box');
+    assert.equal(dns.env.BOX_IP, '198.51.100.20', 'A record → the control-plane IP, NOT the co-hosting box');
     assert.equal(dns.env.BOX_PROXIED, '1', 'standalone A record is PROXIED (behind the wildcard origin cert; task 2077) — publicly-trusted cert + hidden IP');
   } finally { P.CONFIG.publicIp = savedPub; P.CONFIG.controlPlaneIp = savedCp; P.CONFIG.dnsHook = savedHook; P.CONFIG.remoteHost = savedRemote; }
 });
@@ -1587,7 +1587,7 @@ await ta('provisionInstance(standalone, remote): EVERY box step runs control-pla
 await ta('provisionInstance(standalone, remote, --apply): FAILS LOUD when the control-plane IP is unset (never silently points the domain at the co-hosting box)', async () => {
   const savedPub = P.CONFIG.publicIp, savedCp = P.CONFIG.controlPlaneIp, savedHook = P.CONFIG.dnsHook, savedRemote = P.CONFIG.remoteHost;
   P.CONFIG.remoteHost = 'cohost';              // split-box mode
-  P.CONFIG.publicIp = '104.236.254.243';       // co-hosting box — must NOT be used for a standalone A record
+  P.CONFIG.publicIp = '192.0.2.10';       // co-hosting box — must NOT be used for a standalone A record
   P.CONFIG.controlPlaneIp = null;              // operator forgot to set it
   P.CONFIG.dnsHook = '/opt/infra/box-dns-cloudflare.sh';
   try {
@@ -1600,7 +1600,7 @@ await ta('provisionInstance(standalone, remote, --apply): FAILS LOUD when the co
       checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
     };
     await assert.rejects(
-      () => P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'lars589/mercury', domain: 'mercury.cloudbongos.com' }, deps),
+      () => P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'example-owner/mercury', domain: 'mercury.cloudbongos.com' }, deps),
       /PROVISION_CONTROL_PLANE_IP/,
       'must demand the control-plane IP, not fall back to the co-hosting box',
     );
@@ -1792,7 +1792,7 @@ await ta('provisionInstance(standalone, hub-configured): still NOT federated —
     deps.controlWriteFile = (p, body) => { bodies[p] = body; return { ok: true }; };
     deps.writeFile = (p, body) => { bodies[p] = body; return { ok: true }; };
     deps.platformIdentity = pi; deps.hubKeys = hubKeysOn;
-    await P.provisionInstance({ ...coTenantWithDomain, hosting_shape: 'standalone', target_ref: 'lars589/mercury' }, deps);
+    await P.provisionInstance({ ...coTenantWithDomain, hosting_shape: 'standalone', target_ref: 'example-owner/mercury' }, deps);
     const env = bodies[P.webEnvPath({ ...coTenantWithDomain, hosting_shape: 'standalone' })];
     assert.ok(env, 'wrote web.env');
     assert.doesNotMatch(env, /_AUTH_IDP=/, 'standalone is the self-hosted path — no federation');
@@ -2283,7 +2283,7 @@ function repoAuthDeps({ apply = true, priv = true, token = 'gho_TOK', keys = [],
   deps.fsImpl = { existsSync: () => existing, readFileSync: () => `${pub}\n` };
   return { deps, cmds, apiCalls };
 }
-const privInst = { id: 9, slug: 'demo', hosting_shape: 'standalone', status: 'requested', owner_builder_id: 7, target_ref: 'lars589/demo' };
+const privInst = { id: 9, slug: 'demo', hosting_shape: 'standalone', status: 'requested', owner_builder_id: 7, target_ref: 'example-owner/demo' };
 
 await ta('ensurePrivateRepoAccess(private): registers a READ-ONLY key and wires origin + core.sshCommand into the checkout', async () => {
   const { deps, cmds, apiCalls } = repoAuthDeps({ existing: false });
@@ -2300,7 +2300,7 @@ await ta('ensurePrivateRepoAccess(private): registers a READ-ONLY key and wires
   assert.equal(add[1], 'cloudbongos-deploy-demo', 'titled per-instance so teardown can revoke by title');
   assert.equal(add[3], true, 'read_only: a leaked box key must never be able to write the owner\'s repo');
   // origin re-pointed at PLAIN github.com (the shared alias would resolve the wrong key)…
-  assert.match(joined, /git -C \S+\/demo remote set-url origin git@github\.com:lars589\/demo\.git/);
+  assert.match(joined, /git -C \S+\/demo remote set-url origin git@github\.com:example-owner\/demo\.git/);
   // …and core.sshCommand pinned to the key IN THE REPO CONFIG: survives `git reset --hard`,
   // applies to every future git op here, and -F \/dev\/null keeps ~/.ssh/config identities out.
   assert.match(joined, /git -C \S+\/demo config core\.sshCommand "ssh -F \/dev\/null -i \S+\/\.git\/cloudbongos-deploy-key -o IdentitiesOnly=yes/);
@@ -2326,14 +2326,14 @@ await ta('ensurePrivateRepoAccess(flipped public): UN-wires — origin back to t
   assert.equal(r.unwired, true);
   assert.deepEqual(apiCalls.find((c) => c[0] === 'del'), ['del', 11], 'revokes the now-orphaned key');
   const joined = cmds.join('\n');
-  assert.match(joined, /remote set-url origin git@github-deploy:lars589\/demo\.git/, 'origin returns to the shared alias');
+  assert.match(joined, /remote set-url origin git@github-deploy:example-owner\/demo\.git/, 'origin returns to the shared alias');
   assert.match(joined, /config --unset core\.sshCommand/);
   assert.match(joined, /rm -f \S+\/\.git\/cloudbongos-deploy-key \S+\/\.git\/cloudbongos-deploy-key\.pub/);
 });
 
 await ta('ensurePrivateRepoAccess(private, non-admin token): refuses UP FRONT with the fix, not a raw 403 mid-standup', async () => {
   const { deps, cmds, apiCalls } = repoAuthDeps({ existing: false });
-  deps.githubRepos.getUserRepo = async () => ({ full_name: 'lars589/demo', private: true, admin: false });
+  deps.githubRepos.getUserRepo = async () => ({ full_name: 'example-owner/demo', private: true, admin: false });
   await assert.rejects(() => P.ensurePrivateRepoAccess(privInst, deps), /repository access is not admin: .*ADMIN/);
   assert.ok(!cmds.some((c) => /ssh-keygen/.test(c)), 'no key minted for a credential that cannot register it');
   assert.ok(!apiCalls.some((c) => c[0] === 'add'));
@@ -2357,7 +2357,7 @@ await ta('ensurePrivateRepoAccess: 422 key_in_use (repo changed under a slug-key
 await ta('ensurePrivateRepoAccess: a transient GitHub failure surfaces as a plain sentence, never raw jargon on the owner card', async () => {
   const { deps } = repoAuthDeps({ existing: true });
   deps.githubRepos.listDeployKeys = async () => { const e = new Error('GitHub deploy-key list failed (502)'); e.code = 'github_error'; throw e; };
-  await assert.rejects(() => P.ensurePrivateRepoAccess(privInst, deps), /deploy-key setup failed for lars589\/demo: .*try again/);
+  await assert.rejects(() => P.ensurePrivateRepoAccess(privInst, deps), /deploy-key setup failed for example-owner\/demo: .*try again/);
 });
 
 await ta('ensurePrivateRepoAccess(no token): skips without touching git or GitHub (task 1002909 owns the request-time refusal)', async () => {
@@ -2378,7 +2378,7 @@ await ta('ensurePrivateRepoAccess: an already-registered CURRENT key re-asserts
   assert.ok(!apiCalls.some((c) => c[0] === 'del'), 'no deletion');
   assert.ok(!cmds.some((c) => /ssh-keygen/.test(c)), 'no new keypair');
   // the wiring is still re-asserted (a re-provision heals a hand-edited remote)
-  assert.ok(cmds.some((c) => /remote set-url origin git@github\.com:lars589\/demo\.git/.test(c)));
+  assert.ok(cmds.some((c) => /remote set-url origin git@github\.com:example-owner\/demo\.git/.test(c)));
   assert.ok(cmds.some((c) => /config core\.sshCommand/.test(c)));
 });
 
@@ -2398,7 +2398,7 @@ await ta('ensurePrivateRepoAccess: repo_not_found with a token → a PLAIN error
   deps.githubRepos.getUserRepo = async () => { const e = new Error('GitHub answered 404 for that repository'); e.code = 'repo_not_found'; throw e; };
   await assert.rejects(
     () => P.ensurePrivateRepoAccess(privInst, deps),
-    /repository not found: .*lars589\/demo.*credential/i,
+    /repository not found: .*example-owner\/demo.*credential/i,
   );
 });
 
@@ -2415,10 +2415,10 @@ await ta('ensurePrivateRepoAccess(dry-run): fully OFFLINE — no token read, no
 
 await ta('provisionInstance(standalone): the private-repo wiring lands BETWEEN the scaffold and the step-2 pull', async () => {
   const { deps, cmds } = repoAuthDeps({ existing: false });
-  const r = await P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'lars589/mercury' }, deps);
+  const r = await P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'example-owner/mercury' }, deps);
   assert.equal(r.ok, true);
   const idx = (re) => cmds.findIndex((c) => re.test(c));
-  assert.ok(idx(/remote set-url origin git@github\.com:lars589\/mercury\.git/) >= 0, 'wired the private origin');
+  assert.ok(idx(/remote set-url origin git@github\.com:example-owner\/mercury\.git/) >= 0, 'wired the private origin');
   assert.ok(idx(/remote set-url origin git@github\.com:/) < idx(/git pull --ff-only origin main/),
     'the pull that failed on prod (mercury, 2026-08-17) now runs AFTER the key wiring');
 });

package/tests/provisioning_github_app_routes.mjs

@@ -81,7 +81,7 @@ console.log('\nprovisioningOrigin override (task 2101 — customer App carries t
   // so mothershipOrigin() must prefer it over publicOrigin. mothershipOrigin() calls
   // api.branding() (module-api captured the fn ref at require-time), so override THAT.
   const prevBranding = api.branding;
-  api.branding = () => ({ ...realBranding(), identity: { productName: 'Cloud Bongos' }, domains: { publicOrigin: 'https://amazonprimea.com', provisioningOrigin: 'https://get.cloudbongos.com' } });
+  api.branding = () => ({ ...realBranding(), identity: { productName: 'Cloud Bongos' }, domains: { publicOrigin: 'https://example.com', provisioningOrigin: 'https://get.cloudbongos.com' } });
   const res = await fetch(`${base}/provisioning/instances/42/github-app`, { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });
   const j = await res.json();
   t('redirect_url uses provisioningOrigin, not the game publicOrigin', j.manifest && j.manifest.redirect_url === 'https://get.cloudbongos.com/api/bongos/provisioning/github-app/callback', j.manifest && j.manifest.redirect_url);

package/tests/provisioning_onboard_mode.mjs

@@ -52,7 +52,7 @@ function recordingDb(returnRow = {}) {
 await ta('createInstance: onboardMode "adopt" is persisted', async () => {
   const db = recordingDb();
   await provisioning.createInstance(db, {
-    ownerBuilderId: 7, slug: 'demo', targetRef: 'lars589/demo',
+    ownerBuilderId: 7, slug: 'demo', targetRef: 'example-owner/demo',
     hostingShape: 'standalone', onboardMode: 'adopt',
   });
   const insert = db.calls.find((c) => /INSERT INTO provisioning_instances/i.test(c.text));
@@ -150,7 +150,7 @@ function post(path, body) {
 await ta('POST /instances: onboard_mode=adopt is threaded through to createInstance', async () => {
   lastCreateArgs = null;
   const res = await post('/provisioning/instances', {
-    slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo', onboard_mode: 'adopt',
+    slug: 'demo', hosting_shape: 'standalone', target_ref: 'example-owner/demo', onboard_mode: 'adopt',
   });
   assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
   assert.equal(lastCreateArgs && lastCreateArgs.onboardMode, 'adopt');

package/tests/publish_reconciler.mjs

@@ -1187,12 +1187,12 @@ test('1915 the heal path never runs when the module lacks refreshStaleGenerated
 // (once — per-tick would be spam), and name the RESOLVED owner/repo so a WRONG
 // repo bind is visible without owner access.
 // ---------------------------------------------------------------------------
-const REPO_OK = { owner: 'lars589', repo: 'cloud-bongos', branch: 'main' };
+const REPO_OK = { owner: 'example-owner', repo: 'cloud-bongos', branch: 'main' };
 const REPO_ERR = { error: 'no_repo_info', detail: 'git remote origin not parseable' };
 
 test('1002461 describeTarget names the resolved owner/repo and the credential state', () => {
   const s = reconciler.describeTarget({ configured: true, repo: REPO_OK });
-  assert.match(s, /lars589\/cloud-bongos/, 'the resolved repo must be visible');
+  assert.match(s, /example-owner\/cloud-bongos/, 'the resolved repo must be visible');
   assert.match(s, /main/);
   assert.match(s, /credential present/i);
 });
@@ -1200,7 +1200,7 @@ test('1002461 describeTarget names the resolved owner/repo and the credential st
 test('1002461 describeTarget shouts when there is no credential', () => {
   const s = reconciler.describeTarget({ configured: false, repo: REPO_OK });
   assert.match(s, /NO PUSH CREDENTIAL/, 'the missing credential must be unmissable');
-  assert.match(s, /lars589\/cloud-bongos/, 'still names the repo — a wrong bind and a missing credential are separate faults');
+  assert.match(s, /example-owner\/cloud-bongos/, 'still names the repo — a wrong bind and a missing credential are separate faults');
 });
 
 test('1002461 describeTarget reports an unresolved repo instead of pretending', () => {
@@ -1218,7 +1218,7 @@ test('1002461 an unconfigured sweep WARNs — the skip is no longer silent', asy
   assert.equal(r.skipped, 'unconfigured', 'still a no-op — this task only adds the log');
   assert.equal(deps._calls.errors.length, 1, 'the skip must say so');
   assert.match(deps._calls.errors[0], /NO PUSH CREDENTIAL/);
-  assert.match(deps._calls.errors[0], /lars589\/cloud-bongos/, 'names the repo it would have used');
+  assert.match(deps._calls.errors[0], /example-owner\/cloud-bongos/, 'names the repo it would have used');
 });
 
 test('1002461 the unconfigured WARN fires ONCE, not once per tick (no log spam)', async () => {

package/tests/sandbox_stage.mjs

@@ -40,7 +40,7 @@ t('isDevBox: true only when box.env exists', () => {
 
 // ---------- readPreviewHostname ----------
 t('readPreviewHostname: plain, quoted, export-prefixed, missing, empty', () => {
-  assert.equal(sbx.readPreviewHostname('BOX_PREVIEW_HOSTNAME=sandbox-somebuilder.amazonprimea.com\n'), 'sandbox-somebuilder.amazonprimea.com');
+  assert.equal(sbx.readPreviewHostname('BOX_PREVIEW_HOSTNAME=sandbox-somebuilder.example.com\n'), 'sandbox-somebuilder.example.com');
   assert.equal(sbx.readPreviewHostname('A=1\nBOX_PREVIEW_HOSTNAME="sandbox-x.example.com"\nB=2'), 'sandbox-x.example.com');
   assert.equal(sbx.readPreviewHostname("export BOX_PREVIEW_HOSTNAME='sandbox-y.example.com'"), 'sandbox-y.example.com');
   assert.equal(sbx.readPreviewHostname('BOX_TERMINAL_HOSTNAME=term-x.example.com'), null);

package/tests/scrubber_corpus.mjs

@@ -97,7 +97,7 @@ function positives() {
   // by the "token": assignment + the hex entropy rule, not by any prefix match.
   const sessTok = randStr(110, 64, HEX);
   const sessionJson =
-    '{\n  "token": "' + sessTok + '",\n  "builder": "lars589",\n  "rank": "archon"\n}';
+    '{\n  "token": "' + sessTok + '",\n  "builder": "example-owner",\n  "rank": "archon"\n}';
   // The same real token as it appears on the wire: a bare-64-hex cookie value +
   // an Authorization: Bearer header (the two ways it leaves a CLI session).
   const wireTok = randStr(115, 64, HEX);
@@ -130,7 +130,7 @@ function positives() {
     { name: 'PEM private key body', secret: pemBody, context: `key:\n${pem}\n(end)` },
     { name: 'gds-session.json token (real bare-64-hex shape)', secret: sessTok, context: `$ cat ~/.config/otb/gds-session.json\n${sessionJson}` },
     { name: 'real GDS token on the wire (cookie)', secret: wireTok, context: `Cookie: gds_session=${wireTok}; Path=/` },
-    { name: 'real GDS token on the wire (Bearer header)', secret: wireTok, context: `curl -H "Authorization: Bearer ${wireTok}" https://amazonprimea.com/api/gds/me` },
+    { name: 'real GDS token on the wire (Bearer header)', secret: wireTok, context: `curl -H "Authorization: Bearer ${wireTok}" https://example.com/api/gds/me` },
     { name: 'env GITHUB_TOKEN value', secret: envGithub.split('=')[1], context: envGithub },
     { name: 'env access_token value', secret: envAccess.split('=')[1], context: envAccess },
     { name: 'JSON client_secret value', secret: envClient.match(/"client_secret": "([^"]+)"/)[1], context: envClient },
@@ -178,7 +178,7 @@ function negatives() {
     'internationalization is a long english word',
     'see docs/adr/0022-secrets-policy.md for the policy',
     'merge-mode swept the confirmed queue and deployed',
-    'the vendor sells physical and digital goods in Amazonprimea',
+    'the vendor sells physical and digital goods in Example',
     'P0: kill the grader bypass and rotate the token soon', // "token" but no value after a separator
     'git log shows acf3f3c bcb0794 282a155 fc8f4a5', // short SHAs (< 20)
   ];

package/tests/search_isolation.mjs

@@ -165,7 +165,7 @@ if (!client) {
   try {
     await client.query('BEGIN');
     await client.query(`SET LOCAL pg_trgm.word_similarity_threshold = ${search.TRGM_THRESHOLD}`);
-    // builder 1 exists (lars589); seed a protected (metic) chunk, a public one,
+    // builder 1 exists (example-owner); seed a protected (metic) chunk, a public one,
     // and a chunk owned by builder 1 — all matching q='enforcement'.
     await client.query(`INSERT INTO search_chunks (source_kind, source_ref, chunk_index, heading_path, title, body, min_rank, owner_builder_id, content_hash) VALUES
       ('doc','__iso__/protected.md',0,'p','PROT','trust boundary permission core enforcement','metic',NULL,'i1'),

package/tests/session_records.mjs

@@ -502,7 +502,7 @@ test('a failed/empty subagent spawn digests to 0 tokens despite 1 assistant turn
   // assistant_turns>=1 guard let these into the corpus (#698); total_tokens===0
   // is what now excludes them — in the backfill AND server-side at POST.
   const spawn = [
-    { type: 'user', message: { content: 'You are the **Hacker** — a specialist adversarial subagent for the Off the Boats project.' } },
+    { type: 'user', message: { content: 'You are the **Hacker** — a specialist adversarial subagent for the Example World project.' } },
     {
       type: 'assistant',
       message: {

package/tests/ship_card.mjs

@@ -15,7 +15,7 @@ import fs from 'node:fs';
 const require = createRequire(import.meta.url);
 const card = require('../modules/lifecycle/ship-card.js');
 
-const BRAND = { productName: 'Off the Boats', currency: 'drachmae' };
+const BRAND = { productName: 'Example World', currency: 'drachmae' };
 const row = (m, k) => { const r = m.rows.find((x) => x.k === k); return r ? r.v : undefined; };
 
 const shippedInput = {
@@ -230,13 +230,13 @@ test('review: warning tone, link action to the sandbox URL', () => {
   const m = card.buildCardModel({
     stage: 'review', taskId: 1271, title: 'Add model preference', brand: BRAND,
     valueSummary: 'Pick the subagent model.', fileCount: 6, added: 240, removed: 15,
-    sandboxUrl: 'https://sandbox-lars589.amazonprimea.com',
+    sandboxUrl: 'https://sandbox-example-owner.example.com',
   });
   assert.equal(m.cfg.tone, 'warning');
   assert.equal(m.action.kind, 'link');
-  assert.equal(m.action.url, 'https://sandbox-lars589.amazonprimea.com');
+  assert.equal(m.action.url, 'https://sandbox-example-owner.example.com');
   const html = card.renderCardHtml(m);
-  assert.match(html, /href="https:\/\/sandbox-lars589\.amazonprimea\.com"/);
+  assert.match(html, /href="https:\/\/sandbox-example-owner\.example\.com"/);
   assert.match(html, /Open in sandbox/);
   assert.match(html, /staged on your sandbox/);
 });
@@ -244,7 +244,7 @@ test('review: warning tone, link action to the sandbox URL', () => {
 // ---- monospace ----
 test('monospace: rows + brand + currency + indent', () => {
   const out = card.renderMonospaceCard(card.buildCardModel(shippedInput));
-  assert.match(out, /Off the Boats · task #1266/);
+  assert.match(out, /Example World · task #1266/);
   assert.match(out, /Shipped/);
   assert.match(out, /\+112\/−37/);
   assert.match(out, /12,936 drachmae/);
@@ -289,7 +289,7 @@ test('emitCard with widgetsEnabled:false: monospace only, no HTML, off-marker',
   const file = card.emitCard(card.buildCardModel(shippedInput), 99998, { log: (s) => lines.push(s), widgetsEnabled: false });
   const out = lines.join('\n');
   assert.equal(file, null, 'no HTML file written when widgets are off');
-  assert.match(out, /Off the Boats · task #1266/); // the monospace card still printed
+  assert.match(out, /Example World · task #1266/); // the monospace card still printed
   assert.ok(!out.includes('[otb-card-html]'), 'no [otb-card-html] marker emitted');
   assert.match(out, /widgets are off/); // off-marker tells the skill not to call show_widget
 });

package/tests/ship_ci_deploy.mjs

@@ -133,7 +133,7 @@ test('resolveDeployTarget: blank/whitespace config values are treated as unset',
 
 // ---- 1c. resolveInstanceBase precedence + the "no hardcoded host" guarantee (task 1002232) ----
 // The ci-land /version + /healthz probes, the ci PR-body deploy note, and the
-// manual-confirm curl guidance all baked in `https://amazonprimea.com`, so a
+// manual-confirm curl guidance all baked in `https://example.com`, so a
 // ci-land / manual-confirm on a migrated instance pointed at the WRONG box. The
 // helper derives the origin: env → session api_base → branding publicOrigin → null.
 // Every case injects env/sessionApiBase/branding so the machine's own env + session

package/tests/single_host_hall.mjs

@@ -60,7 +60,7 @@ test('single-host instance: the configured buildersOrigin host IS the hall host'
     [
       'emersonian-circles.cloudbongos.com',
       'builders.anything.com',
-      'amazonprimea.com',
+      'example.com',
       'status.emersonian-circles.cloudbongos.com',
       'evil.example',
       '',
@@ -71,7 +71,7 @@ test('single-host instance: the configured buildersOrigin host IS the hall host'
   // Back-compat: a builders.<apex> host still matches via startsWith("builders.").
   assert.equal(v['builders.anything.com'], true);
   // A DIFFERENT apex is NOT the hall host, so its /builders redirect still fires.
-  assert.equal(v['amazonprimea.com'], false);
+  assert.equal(v['example.com'], false);
   // The status subdomain of the single host is a status host, not the hall.
   assert.equal(v['status.emersonian-circles.cloudbongos.com'], false);
   // Unrelated / empty hosts are never the hall.
@@ -83,16 +83,16 @@ test('conventional two-host instance: the apex stays a NON-builders host (no reg
   const v = buildersHostVerdicts(
     {
       domains: {
-        publicOrigin: 'https://amazonprimea.com',
-        buildersOrigin: 'https://builders.amazonprimea.com',
-        statusOrigin: 'https://status.amazonprimea.com',
+        publicOrigin: 'https://example.com',
+        buildersOrigin: 'https://builders.example.com',
+        statusOrigin: 'https://status.example.com',
       },
     },
-    ['builders.amazonprimea.com', 'amazonprimea.com', 'status.amazonprimea.com'],
+    ['builders.example.com', 'example.com', 'status.example.com'],
   );
   // The dedicated subdomain is the hall (both the startsWith and the config branch agree).
-  assert.equal(v['builders.amazonprimea.com'], true);
+  assert.equal(v['builders.example.com'], true);
   // The apex is NOT the hall — /builders must still 301 to the subdomain here.
-  assert.equal(v['amazonprimea.com'], false);
-  assert.equal(v['status.amazonprimea.com'], false);
+  assert.equal(v['example.com'], false);
+  assert.equal(v['status.example.com'], false);
 });

package/tests/smoke_preflight.mjs

@@ -31,7 +31,7 @@ await t('isLocalTarget: localhost / 127.0.0.1 / ::1 / 0.0.0.0 are local', () =>
 });
 
 await t('isLocalTarget: prod + LAN hosts are NOT local (remote stays a real failure)', () => {
-  for (const h of ['amazonprimea.com', 'status.amazonprimea.com', '10.0.0.5', 'example.com']) {
+  for (const h of ['example.com', 'status.example.com', '10.0.0.5', 'example.com']) {
     assert.equal(isLocalTarget(h), false, `${h} should be remote`);
   }
 });