@bongos/core 1.19.726 → 1.19.728

package/tests/art_stage.mjs

@@ -82,13 +82,13 @@ await ta('main: no sandbox here → rebuilds, reports no sandbox, not surfaced',
 await ta('main: box context → restarts, waits healthy, prints the sandbox URL', async () => {
   let restarted = false;
   const deps = baseDeps({
-    resolvePreviewContext: () => ({ kind: 'box', url: 'https://sandbox-x.amazonprimea.com', healthUrl: 'http://127.0.0.1:3000/', restart: () => { restarted = true; } }),
+    resolvePreviewContext: () => ({ kind: 'box', url: 'https://sandbox-x.example.com', healthUrl: 'http://127.0.0.1:3000/', restart: () => { restarted = true; } }),
   });
   const r = await art.main(['--tiles', 'container_a'], deps);
   assert.equal(r.ok, true);
   assert.equal(r.surfaced, true);
   assert.equal(restarted, true);
-  assert.ok(deps.logs.some((l) => l.includes('https://sandbox-x.amazonprimea.com')));
+  assert.ok(deps.logs.some((l) => l.includes('https://sandbox-x.example.com')));
   assert.ok(deps.logs.some((l) => /container_a/.test(l)), 'affected tiles printed');
 });
 

package/tests/auth_anthropic_identity.mjs

@@ -49,7 +49,7 @@ const t = async (name, fn) => {
   catch (e) { fail++; console.log(`FAIL  ${name}\n      ${e.stack || e.message}`); }
 };
 
-const LINKED = { builder_id: 1, github_login: 'lars589', rank: 'archon', status: 'active', anthropic_user_id: 'uuid-real' };
+const LINKED = { builder_id: 1, github_login: 'example-owner', rank: 'archon', status: 'active', anthropic_user_id: 'uuid-real' };
 
 await t('linked builder + DIFFERENT header (2nd Claude account) → next() called, NOT 403 (pin removed)', async () => {
   nextSession = LINKED;

package/tests/auth_duplicate_cookie.mjs

@@ -1,6 +1,6 @@
 // tests/auth_duplicate_cookie.mjs — regression for the duplicate gds_session
 // cookie 401 (#851). A browser can carry TWO gds_session cookies: a stale
-// host-only one (set on amazonprimea.com before the #726/#734 apex-scoping
+// host-only one (set on example.com before the #726/#734 apex-scoping
 // rollout) AND the current apex-scoped one. The old extractToken() returned the
 // FIRST value only, so a stale duplicate could shadow the live session and 401
 // the builder (hit on the Discord link callback for builder 25). extractTokens()

package/tests/auth_error_brand.mjs

@@ -21,7 +21,7 @@ const { renderAuthErrorPage } = authMod;
 const KEYS = ['titleSuffix', 'epigraph', 'heading', 'subtitle', 'ctaLabel'];
 // Instance-specific terms that must never appear in the NEUTRAL/vanilla copy —
 // exactly what was leaking onto cloudbongos.com before this fix.
-const OTB_LORE = [/archon/i, /\bgate\b/i, /chronicles/i, /amazonprimea/i, /\bboats\b/i, /drachma/i];
+const OTB_LORE = [/archon/i, /\bgate\b/i, /chronicles/i, /example/i, /\bboats\b/i, /drachma/i];
 
 // A vanilla boot has no instance config → the neutral starter alone (the
 // fail-to-vanilla path), exactly as a fresh `node src/platform-server.js` would.

package/tests/auth_inactive_builder.mjs

@@ -59,7 +59,7 @@ await t('inactive builder with a live session → 403 builder_inactive, next() N
 });
 
 await t('active builder → next() called, req.builder populated (incl. status)', async () => {
-  nextSession = { builder_id: 1, github_login: 'lars589', rank: 'archon', status: 'active' };
+  nextSession = { builder_id: 1, github_login: 'example-owner', rank: 'archon', status: 'active' };
   const req = { headers: { authorization: 'Bearer abc123' } };
   const res = fakeRes();
   let nexted = false;

package/tests/backup_cli.mjs

@@ -46,7 +46,7 @@ function extractTimestamp(filename, dbName) {
 }
 
 t('extractTimestamp: well-formed filename', () => {
-  const ts = extractTimestamp('amazonprimea-2026-06-29T040001Z.sql.gz', 'amazonprimea');
+  const ts = extractTimestamp('example-2026-06-29T040001Z.sql.gz', 'example');
   assert.equal(ts, '2026-06-29T040001Z');
 });
 t('extractTimestamp: different db name', () => {
@@ -58,7 +58,7 @@ t('extractTimestamp: different db name', () => {
 // These verify the shape the CLI backup.js expects from GET /backup/status.
 
 t('status: latest_dump null when no dumps', () => {
-  const response = { backup_dir: '/var/backups/gds', db_name: 'amazonprimea', latest_dump: null, trigger_running: false };
+  const response = { backup_dir: '/var/backups/gds', db_name: 'example', latest_dump: null, trigger_running: false };
   assert.equal(response.latest_dump, null);
   assert.equal(response.trigger_running, false);
 });
@@ -66,9 +66,9 @@ t('status: latest_dump null when no dumps', () => {
 t('status: latest_dump populated when dumps exist', () => {
   const response = {
     backup_dir: '/var/backups/gds',
-    db_name: 'amazonprimea',
+    db_name: 'example',
     latest_dump: {
-      filename: 'amazonprimea-2026-06-29T040001Z.sql.gz',
+      filename: 'example-2026-06-29T040001Z.sql.gz',
       timestamp: '2026-06-29T040001Z',
       size_bytes: 614400,
       count: 7,

package/tests/bongos_box_connect.mjs

@@ -6,7 +6,7 @@ import { test } from 'node:test';
 import crypto from 'node:crypto';
 import lib from '../scripts/gds/box-connect-lib.js';
 
-const HOST = 'box-alice.dev.amazonprimea.com';
+const HOST = 'box-alice.dev.example.com';
 
 test('rankAtLeast gates --local at Metic+', () => {
   assert.equal(lib.rankAtLeast('metic', 'metic'), true);
@@ -69,7 +69,7 @@ test('buildKnownHostsUpsert drops the stale line for the host, keeps others, app
 // ACCUMULATED: the client kept verifying against the first, now-wrong entry
 // ("Host denied (verification failed)") on a box that had just re-reported keys.
 test('buildKnownHostsUpsert drops a host,ip entry for this box (the accumulation bug)', () => {
-  const existing = `${HOST},64.225.49.206 ssh-ed25519 STALE\n`;
+  const existing = `${HOST},192.0.2.30 ssh-ed25519 STALE\n`;
   const next = lib.buildKnownHostsUpsert(existing, HOST, 'ssh-ed25519 AAAANEW');
   assert.ok(!next.includes('STALE'), 'a `host,ip` field-1 names this host and must be replaced');
   assert.ok(next.includes(`${HOST} ssh-ed25519 AAAANEW`));

package/tests/bongos_downloads.mjs

@@ -23,7 +23,7 @@ function t(name, fn) {
 }
 
 const CFG = {
-  releases_repo: 'lars589/amazonprimea-bongos',
+  releases_repo: 'example-owner/example-bongos',
   version: '1.2.3',
   assets: {
     'mac-arm64': 'bongos-1.2.3-darwin-arm64',
@@ -39,7 +39,7 @@ t('maps a known target to the versioned release-asset URL', () => {
   const d = buildBongosDownloads(CFG);
   assert.equal(
     d.redirectFor('mac-arm64'),
-    'https://github.com/lars589/amazonprimea-bongos/releases/download/v1.2.3/bongos-1.2.3-darwin-arm64'
+    'https://github.com/example-owner/example-bongos/releases/download/v1.2.3/bongos-1.2.3-darwin-arm64'
   );
 });
 

package/tests/bongos_login.mjs

@@ -17,11 +17,11 @@ const { normalizeInstanceBase, pollDecision } = require('../scripts/gds/login.js
 const LOGIN_JS = path.join(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'), 'scripts', 'gds', 'login.js');
 
 test('normalizeInstanceBase adds https, strips trailing slashes + a pasted /api/gds', () => {
-  assert.equal(normalizeInstanceBase('amazonprimea.com'), 'https://amazonprimea.com');
-  assert.equal(normalizeInstanceBase('https://amazonprimea.com/'), 'https://amazonprimea.com');
-  assert.equal(normalizeInstanceBase('https://amazonprimea.com///'), 'https://amazonprimea.com');
-  assert.equal(normalizeInstanceBase('https://amazonprimea.com/api/gds'), 'https://amazonprimea.com');
-  assert.equal(normalizeInstanceBase('https://amazonprimea.com/api/gds/'), 'https://amazonprimea.com');
+  assert.equal(normalizeInstanceBase('example.com'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com/'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com///'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com/api/gds'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com/api/gds/'), 'https://example.com');
   assert.equal(normalizeInstanceBase('http://localhost:3000'), 'http://localhost:3000');
 });
 

package/tests/box_connect_e2e.mjs

@@ -138,8 +138,8 @@ t('installed managed-settings.json at the override dir, keyed off the session lo
   const f = path.join(settingsDir, 'managed-settings.json');
   assert.ok(fs.existsSync(f), 'managed-settings.json not written');
   const s = JSON.parse(fs.readFileSync(f, 'utf8'));
-  assert.equal(s.sshConfigs[0].sshHost, 'root@box-e2etester.dev.amazonprimea.com');
-  assert.deepEqual(s.sshHostAllowlist, ['*.dev.amazonprimea.com']);
+  assert.equal(s.sshConfigs[0].sshHost, 'root@box-e2etester.dev.example.com');
+  assert.deepEqual(s.sshHostAllowlist, ['*.dev.example.com']);
 });
 
 t('did NOT leak the GDS token into stdout/stderr', () => {

package/tests/box_dns_repoint.mjs

@@ -71,8 +71,8 @@ function runHook(scenario, extraEnv = {}, retries = '4') {
       ...process.env,
       PATH: `${tmp}:${process.env.PATH}`,
       CLOUDFLARE_API_TOKEN: 'faketoken',
-      CLOUDFLARE_ZONE: 'amazonprimea.com',
-      BOX_HOSTNAME: 'box-test.dev.amazonprimea.com',
+      CLOUDFLARE_ZONE: 'example.com',
+      BOX_HOSTNAME: 'box-test.dev.example.com',
       BOX_DNS_BACKOFF_BASE: '0', // no real sleeps in tests
       BOX_DNS_RETRIES: retries,
       FAKE_CF_SCENARIO: scenario,
@@ -87,7 +87,7 @@ function runHook(scenario, extraEnv = {}, retries = '4') {
 {
   const r = runHook('retry_zone', { BOX_IP: '1.2.3.4' });
   assert.equal(r.status, 0, `retry should self-heal to exit 0; got ${r.status} :: ${r.out}`);
-  assert.match(r.out, /updated A box-test\.dev\.amazonprimea\.com -> 1\.2\.3\.4/, r.out);
+  assert.match(r.out, /updated A box-test\.dev\.example\.com -> 1\.2\.3\.4/, r.out);
   const attempts = parseInt(fs.readFileSync(counterFile, 'utf8'));
   assert.ok(attempts >= 2, `zone lookup should have been retried (>=2 attempts), got ${attempts}`);
 }
@@ -115,19 +115,19 @@ function runHook(scenario, extraEnv = {}, retries = '4') {
 
   const hit = runHook('delete_hit', { BOX_DNS_DELETE: '1' });
   assert.equal(hit.status, 0, `delete of a present record exits 0; got ${hit.status} :: ${hit.out}`);
-  assert.match(hit.out, /deleted A box-test\.dev\.amazonprimea\.com/, hit.out);
+  assert.match(hit.out, /deleted A box-test\.dev\.example\.com/, hit.out);
 }
 
 // ── Part B: runDnsHook / runDnsHookBlackhole contract + the idea-309 repoint ────
 {
   const box = require('../scripts/gds/box.js');
-  const upOk = box.runDnsHook('box-x.dev.amazonprimea.com', '1.2.3.4', 'exit 0');
+  const upOk = box.runDnsHook('box-x.dev.example.com', '1.2.3.4', 'exit 0');
   assert.equal(upOk.ok, true, 'runDnsHook returns ok:true when the hook succeeds');
 
-  const upFail = box.runDnsHook('box-x.dev.amazonprimea.com', '1.2.3.4', 'exit 1');
+  const upFail = box.runDnsHook('box-x.dev.example.com', '1.2.3.4', 'exit 1');
   assert.equal(upFail.ok, false, 'runDnsHook returns ok:false when the hook FAILS (no silent swallow)');
 
-  const noIp = box.runDnsHook('box-x.dev.amazonprimea.com', null, 'exit 1');
+  const noIp = box.runDnsHook('box-x.dev.example.com', null, 'exit 1');
   assert.equal(noIp.ok, true, 'runDnsHook is a no-op (ok:true skipped) when ip is absent');
 
   // idea 309: on deprovision the box lifecycle REPOINTS the record to the
@@ -137,15 +137,15 @@ function runHook(scenario, extraEnv = {}, retries = '4') {
   const probe = path.join(tmp, 'blackhole-ip');
   process.env.PROBE_FILE = probe;
   const captureHook = `node -e 'require("fs").writeFileSync(process.env.PROBE_FILE, process.env.BOX_IP || "MISSING")'`;
-  const bhOk = box.runDnsHookBlackhole('box-x.dev.amazonprimea.com', captureHook);
+  const bhOk = box.runDnsHookBlackhole('box-x.dev.example.com', captureHook);
   assert.equal(bhOk.ok, true, 'runDnsHookBlackhole returns ok:true when the hook succeeds');
   assert.equal(fs.readFileSync(probe, 'utf8'), '192.0.2.1', 'runDnsHookBlackhole must REPOINT to the 192.0.2.1 sentinel (not delete)');
   delete process.env.PROBE_FILE;
 
-  const bhFail = box.runDnsHookBlackhole('box-x.dev.amazonprimea.com', 'exit 1');
+  const bhFail = box.runDnsHookBlackhole('box-x.dev.example.com', 'exit 1');
   assert.equal(bhFail.ok, false, 'runDnsHookBlackhole returns ok:false when the hook FAILS (best-effort, but still reports)');
 
-  const bhNoHook = box.runDnsHookBlackhole('box-x.dev.amazonprimea.com', null);
+  const bhNoHook = box.runDnsHookBlackhole('box-x.dev.example.com', null);
   assert.equal(bhNoHook.ok, true, 'runDnsHookBlackhole is a no-op (ok:true skipped) when no hook is configured');
 }
 

package/tests/box_host_keys.mjs

@@ -47,7 +47,7 @@ const RSA = 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC/FqVQUVRAmcDHRBeEZZwuW0xgsAP
 
 // 4) a hostname prefix (3 fields) → refused, not silently trimmed
 {
-  const r = validateHostKeyLines(`box-x.dev.amazonprimea.com ${ED}`);
+  const r = validateHostKeyLines(`box-x.dev.example.com ${ED}`);
   assert.equal(r.ok, false);
   assert.equal(r.error, 'expect_type_and_key_only');
 }

package/tests/box_onboard.mjs

@@ -131,28 +131,28 @@ console.log('managed-settings:');
 t('buildManagedSettings: shape matches the template; allowlist pins the passed sshZone', () => {
   // world + sshZone are supplied by the caller from the branding pack (task 1705);
   // the renderer is pure and bakes exactly what it's given.
-  const s = o.buildManagedSettings({ login: 'alice', hostname: 'box-alice.dev.amazonprimea.com', world: 'Amazonprimea', sshZone: 'dev.amazonprimea.com' });
+  const s = o.buildManagedSettings({ login: 'alice', hostname: 'box-alice.dev.example.com', world: 'Example', sshZone: 'dev.example.com' });
   assert.equal(s.sshConfigs[0].id, 'otb-alice');
-  assert.equal(s.sshConfigs[0].name, 'Amazonprimea Dev Box');
-  assert.equal(s.sshConfigs[0].sshHost, 'root@box-alice.dev.amazonprimea.com');
+  assert.equal(s.sshConfigs[0].name, 'Example Dev Box');
+  assert.equal(s.sshConfigs[0].sshHost, 'root@box-alice.dev.example.com');
   assert.equal(s.sshConfigs[0].startDirectory, '~/workspace');
-  assert.deepEqual(s.sshHostAllowlist, ['*.dev.amazonprimea.com']);
+  assert.deepEqual(s.sshHostAllowlist, ['*.dev.example.com']);
 });
 
 t('buildManagedSettings: bad login / hostname throw coded errors (no injection into the JSON)', () => {
-  assert.throws(() => o.buildManagedSettings({ login: 'a/b', hostname: 'x.dev.amazonprimea.com' }), /BAD_LOGIN|invalid login/);
+  assert.throws(() => o.buildManagedSettings({ login: 'a/b', hostname: 'x.dev.example.com' }), /BAD_LOGIN|invalid login/);
   assert.throws(() => o.buildManagedSettings({ login: 'alice', hostname: 'evil"\nhost' }), /BAD_HOSTNAME|invalid hostname/);
 });
 
 console.log('connect guide:');
 
 t('renderConnectGuide: bakes the apiBase into the bootstrap URLs', () => {
-  const g = o.renderConnectGuide({ apiBase: 'https://staging.amazonprimea.com' });
-  assert.ok(g.includes('https://staging.amazonprimea.com/api/gds/box/connect.sh'));
+  const g = o.renderConnectGuide({ apiBase: 'https://staging.example.com' });
+  assert.ok(g.includes('https://staging.example.com/api/gds/box/connect.sh'));
   assert.ok(g.includes('/api/gds/box/connect.ps1'));
   // the supplied apiBase is baked verbatim (the caller PINS the origin — it is never
   // a hardcoded host brand, task 1705)
-  assert.ok(o.renderConnectGuide({ apiBase: 'https://amazonprimea.com' }).includes('https://amazonprimea.com/api/gds/box/connect.sh'));
+  assert.ok(o.renderConnectGuide({ apiBase: 'https://example.com' }).includes('https://example.com/api/gds/box/connect.sh'));
 });
 
 console.log('DB query shapes (fake pool):');
@@ -297,7 +297,7 @@ await ta('GET /box/managed-settings: → 200 JSON keyed off the session login',
   assert.equal(r.status, 200);
   const b = await r.json();
   assert.equal(b.sshConfigs[0].id, 'otb-alice');
-  assert.equal(b.sshConfigs[0].sshHost, 'root@box-alice.dev.amazonprimea.com');
+  assert.equal(b.sshConfigs[0].sshHost, 'root@box-alice.dev.example.com');
 });
 
 await ta('GET /box/connect.sh: PUBLIC, no auth → 200; bakes the PINNED origin and IGNORES a spoofed Host (blocker #2/#5)', async () => {

package/tests/box_scope_session.mjs

@@ -85,7 +85,7 @@ await t('box session + allowBoxScope (middleware ran) → next() called, req.bui
 
 // ---- cli / web sessions are unaffected by the box gate -----------------------
 await t('cli session on a non-box route → unaffected, next() called', async () => {
-  nextSession = { builder_id: 1, github_login: 'lars589', rank: 'archon', status: 'active', source: 'cli' };
+  nextSession = { builder_id: 1, github_login: 'example-owner', rank: 'archon', status: 'active', source: 'cli' };
   const req = { headers: { authorization: 'Bearer clitoken' } }; // no allowBoxScope
   const res = fakeRes();
   let nexted = false;

package/tests/box_terminal_ssrf.mjs

@@ -24,9 +24,9 @@ const test = (name, fn) => {
   catch (e) { fail++; console.log(`FAIL  ${name}\n      ${e.message}`); }
 };
 
-const LOGIN = 'lars589';
+const LOGIN = 'example-owner';
 // The dev-box apex is INJECTED rather than taken from the live instance branding
-// (task 1002470). Two reasons: the neutral core has no amazonprimea.com apex, so the
+// (task 1002470). Two reasons: the neutral core has no example.com apex, so the
 // three allow-cases could not pass; and every reject-case below was passing for the
 // WRONG reason — an apex mismatch, not the rule it names. With a pinned apex,
 // 'rejects another builder's term- host' really does prove the login binding.
@@ -34,10 +34,10 @@ const APEX = 'apex.example';
 
 // ---- allowed: the two legitimate tunnel shapes -------------------------------
 test('allows the named-tunnel apex host bound to the caller login', () => {
-  assert.equal(isSafeTerminalUrl(`https://term-lars589.${APEX}`, LOGIN, APEX), true);
+  assert.equal(isSafeTerminalUrl(`https://term-example-owner.${APEX}`, LOGIN, APEX), true);
 });
 test(`allows the named-tunnel dev-zone host (term-<login>.dev.${APEX})`, () => {
-  assert.equal(isSafeTerminalUrl(`https://term-lars589.dev.${APEX}/`, LOGIN, APEX), true);
+  assert.equal(isSafeTerminalUrl(`https://term-example-owner.dev.${APEX}/`, LOGIN, APEX), true);
 });
 test('allows a Cloudflare quick-tunnel host (*.trycloudflare.com)', () => {
   assert.equal(isSafeTerminalUrl('https://random-words-1234.trycloudflare.com', LOGIN, APEX), true);
@@ -66,10 +66,10 @@ for (const bad of [
 
 // ---- rejected: wrong scheme / shape / cross-login ----------------------------
 test('rejects http (must be https)', () => {
-  assert.equal(isSafeTerminalUrl(`http://term-lars589.${APEX}`, LOGIN, APEX), false);
+  assert.equal(isSafeTerminalUrl(`http://term-example-owner.${APEX}`, LOGIN, APEX), false);
 });
 test('rejects embedded credentials (user:pass@host)', () => {
-  assert.equal(isSafeTerminalUrl(`https://user:pass@term-lars589.${APEX}`, LOGIN, APEX), false);
+  assert.equal(isSafeTerminalUrl(`https://user:pass@term-example-owner.${APEX}`, LOGIN, APEX), false);
 });
 test('rejects another builder\'s term- host (login binding)', () => {
   assert.equal(isSafeTerminalUrl(`https://term-someoneelse.${APEX}`, LOGIN, APEX), false);
@@ -89,7 +89,7 @@ test('rejects garbage / unparseable', () => {
   assert.equal(isSafeTerminalUrl(null, LOGIN, APEX), false);
 });
 test('rejects when login is empty (cannot bind the term- form)', () => {
-  assert.equal(isSafeTerminalUrl(`https://term-lars589.${APEX}`, '', APEX), false);
+  assert.equal(isSafeTerminalUrl(`https://term-example-owner.${APEX}`, '', APEX), false);
 });
 
 console.log(`\n${pass} passed, ${fail} failed`);

package/tests/boxes.mjs

@@ -898,10 +898,10 @@ t('#903: rendered cloud-init user-data stays under DigitalOcean\'s 64KB cap', ()
     .split('__CLOUDFLARED_SERVICE_B64__').join(gz('cloudflared.service'))
     .split('__CLOUDFLARED_RUN_B64__').join(gz('cloudflared-run.sh'))
     .split('__CLOSE_BOX_B64__').join(gz('close-box.sh'))
-    .split('__REPO_URL__').join('git@github.com:owner/amazonprimea.git')
+    .split('__REPO_URL__').join('git@github.com:owner/example.git')
     .split('__BUILDER_AUTHORIZED_KEYS_B64__').join(Buffer.from('ssh-ed25519 AAAA...k1\nssh-ed25519 AAAA...k2\n').toString('base64'))
-    .split('__BOX_ENV_B64__').join(Buffer.from('BOX_TUNNEL_TOKEN=' + 'x'.repeat(200) + '\nBOX_TERMINAL_HOSTNAME=term-x.amazonprimea.com\nBOX_TERMINAL_CREDENTIAL=' + 'a'.repeat(48) + '\nBOX_PREVIEW_HOSTNAME=sandbox-x.amazonprimea.com\n').toString('base64'))
-    .split('__GDS_SESSION_B64__').join(Buffer.from(JSON.stringify({ token: 'x'.repeat(64), builder: { id: 1, github_login: 'x', rank: 'archon' }, api_base: 'https://amazonprimea.com' })).toString('base64'));
+    .split('__BOX_ENV_B64__').join(Buffer.from('BOX_TUNNEL_TOKEN=' + 'x'.repeat(200) + '\nBOX_TERMINAL_HOSTNAME=term-x.example.com\nBOX_TERMINAL_CREDENTIAL=' + 'a'.repeat(48) + '\nBOX_PREVIEW_HOSTNAME=sandbox-x.example.com\n').toString('base64'))
+    .split('__GDS_SESSION_B64__').join(Buffer.from(JSON.stringify({ token: 'x'.repeat(64), builder: { id: 1, github_login: 'x', rank: 'archon' }, api_base: 'https://example.com' })).toString('base64'));
   const bytes = Buffer.byteLength(out, 'utf8');
   assert.ok(bytes < 64 * 1024, `rendered cloud-init is ${bytes}B; must stay under DO's 65536B cap`);
 });
@@ -1193,13 +1193,13 @@ t('planDropletDrift: a droplet a live box owns is in sync (no drift)', () => {
 t('planDropletDrift: ZOMBIE — droplet exists but its box row is destroyed (the bug)', () => {
   // The exact task-1289 shape: deprovision marked the row destroyed + nulled
   // droplet_id, but the droplet was never actually deleted.
-  const droplets = [{ id: 222, name: 'otb-box-lars589', tags: ['otb-builder-box', 'builder:lars589'], created_at: '2026-05-01T00:00:00Z' }];
-  const boxRows = [{ builder_id: 3, github_login: 'lars589', state: 'destroyed', droplet_id: null }];
+  const droplets = [{ id: 222, name: 'otb-box-example-owner', tags: ['otb-builder-box', 'builder:example-owner'], created_at: '2026-05-01T00:00:00Z' }];
+  const boxRows = [{ builder_id: 3, github_login: 'example-owner', state: 'destroyed', droplet_id: null }];
   const { zombies, ghosts } = boxes.planDropletDrift({ droplets, boxRows, nowMs: NOW });
   assert.equal(ghosts.length, 0);
   assert.equal(zombies.length, 1);
   assert.equal(zombies[0].dropletId, '222');
-  assert.equal(zombies[0].login, 'lars589');
+  assert.equal(zombies[0].login, 'example-owner');
   assert.equal(zombies[0].builderId, 3, 'maps the zombie back to its builder for edge teardown');
 });
 
@@ -1383,8 +1383,8 @@ function sweepHarness({ idleRows, parkThrows = null }) {
 
 await ta('cmdSweepIdle: an idle box is PARKED — snapshot retained, no snapshot delete', async () => {
   const NOW_ROW = {
-    id: 3, builder_id: 3, state: 'active', droplet_id: '591743808', droplet_name: 'box-lars589',
-    github_login: 'lars589', last_activity_at: new Date(Date.now() - 5 * 3600_000).toISOString(),
+    id: 3, builder_id: 3, state: 'active', droplet_id: '591743808', droplet_name: 'box-example-owner',
+    github_login: 'example-owner', last_activity_at: new Date(Date.now() - 5 * 3600_000).toISOString(),
     claude_active: false, snapshot_id: null,
   };
   const h = sweepHarness({ idleRows: [NOW_ROW] });
@@ -1414,7 +1414,7 @@ await ta('cmdSweepIdle: an idle box is PARKED — snapshot retained, no snapshot
 
 await ta('cmdSweepIdle: dry-run reports "would park" and touches nothing', async () => {
   const row = {
-    id: 3, builder_id: 3, state: 'active', droplet_id: '591743808', github_login: 'lars589',
+    id: 3, builder_id: 3, state: 'active', droplet_id: '591743808', github_login: 'example-owner',
     last_activity_at: new Date(Date.now() - 5 * 3600_000).toISOString(), claude_active: false,
   };
   const h = sweepHarness({ idleRows: [row] });

package/tests/branding.mjs

@@ -21,7 +21,7 @@ const NEUTRAL = {
 
 // A GENERIC sample instance pack — exercises the resolver's override/merge/precedence logic
 // without baking any real instance's identity into the (published) test. (task 1002219 / audit H5:
-// swept the former customer-1 sample — Off the Boats / amazonprimea / Hermeslines — to neutral.)
+// swept the former customer-1 sample — Example World / example / Hermeslines — to neutral.)
 const SAMPLE = {
   identity: { productName: 'Acme Rockets', worldName: 'Acme', company: { name: 'Acme Corp', site: 'https://acme.example' } },
   llmProjectName: 'Acme Rockets',
@@ -95,7 +95,7 @@ test('deepMerge does not mutate its inputs', () => {
 test('the committed neutral pack loads + resolves to the neutral identity (the trunk carries no instance branding.json)', () => {
   // The neutral trunk ships config/branding.neutral.json only — no config/branding.json — so
   // loadBranding resolves to the plain Cloud Bongos identity (task 1002219 / audit H5: this used to
-  // assert the customer-1 OTB identity, stale since the amazonprimea→cloudbongos rebrand, ADR 0139/0140).
+  // assert the customer-1 OTB identity, stale since the example→cloudbongos rebrand, ADR 0139/0140).
   const b = loadBranding({ env: {} });
   assert.equal(b.identity.productName, 'Cloud Bongos');
   assert.equal(b.identity.worldName, 'Cloud Bongos');

package/tests/bump_version.mjs

@@ -146,7 +146,7 @@ test('a HUMAN release commit never matches — skipping it would swallow its pub
 });
 
 test('work-merge subjects, junk, and empties never match', () => {
-  assert.equal(isReleaseCommit('Merge pull request #30 from lars589/claude/cloudbongos-npm-registry-b9a57f'), false);
+  assert.equal(isReleaseCommit('Merge pull request #30 from example-owner/claude/cloudbongos-npm-registry-b9a57f'), false);
   assert.equal(isReleaseCommit('fix(ship): protection-aware deploy mode'), false);
   assert.equal(isReleaseCommit(''), false);
   assert.equal(isReleaseCommit(null), false);
@@ -190,7 +190,7 @@ test('publish.yml wires the terminator: guard step present, every armed step gat
 test('laneReleasedVersions reads the versions this lane announced', () => {
   const subjects = [
     'release: core 1.19.368 — CI auto-patch carrier (publish-on-merge, ADR 0161)',
-    'Merge pull request #385 from lars589/some-branch',
+    'Merge pull request #385 from example-owner/some-branch',
     'release: core 1.19.367 — CI auto-patch carrier (publish-on-merge, ADR 0161)',
     'feat(security): something unrelated',
   ];