@bongos/core 1.19.803 → 1.19.805

package/scripts/gds/smoke-claim-consistency.sh

@@ -9,11 +9,11 @@
 #   1. Create 2 disjoint __smoke__ tasks
 #   2. Claim both as the same builder
 #   3. Hit every consumer surface that currently exists:
-#        - GET /api/gds/me                              (always present)
-#        - GET /api/gds/builders/me   (PMS-V2 P6)       (capability-gated)
+#        - GET /api/bongos/me                              (always present)
+#        - GET /api/bongos/builders/me   (PMS-V2 P6)       (capability-gated)
 #      The /builder-start and /builder-session CLIs render server data;
 #      they do not constitute independent surfaces in the sense of
-#      criterion 7 (they consume /api/gds/* responses). We assert at the
+#      criterion 7 (they consume /api/bongos/* responses). We assert at the
 #      API boundary, which is where the bug class lives.
 #   4. Extract the ordered (task_id) sequence from each surface
 #   5. Assert all surfaces return identical sequences
@@ -24,7 +24,7 @@
 # which surfaces were checked vs skipped.
 #
 # TODO: once PMS-V2 P6 (#48 — /builders web profile) ships, the
-# /api/gds/builders/me surface will start returning 200 and this smoke
+# /api/bongos/builders/me surface will start returning 200 and this smoke
 # will automatically include it. No edits needed here.
 #
 # Usage:
@@ -101,7 +101,7 @@ print(json.dumps({
 }))
 ")
   local out
-  out=$(call POST /api/gds/tasks "${body}")
+  out=$(call POST /api/bongos/tasks "${body}")
   echo "${out}" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['id'])"
 }
 
@@ -110,13 +110,13 @@ claim_task() {
   local body
   body=$(python3 -c "import json; print(json.dumps({'task_id': ${task_id}, 'worktree_name': '__smoke__'}))")
   local out
-  out=$(call POST /api/gds/claims "${body}")
+  out=$(call POST /api/bongos/claims "${body}")
   echo "${out}" | python3 -c "import json,sys; print(json.load(sys.stdin)['claim']['id'])"
 }
 
 release_claim() {
   local claim_id="$1"
-  call POST "/api/gds/claims/${claim_id}/resolve" '{"outcome":"abandoned","notes_md":"smoke cleanup"}' >/dev/null || true
+  call POST "/api/bongos/claims/${claim_id}/resolve" '{"outcome":"abandoned","notes_md":"smoke cleanup"}' >/dev/null || true
 }
 
 echo "=== GDS claim-consistency smoke test ==="
@@ -168,8 +168,8 @@ checked=0
 skipped=0
 fail=0
 
-# Surface 1: /api/gds/me — always present.
-ME_PAYLOAD=$(call GET /api/gds/me)
+# Surface 1: /api/bongos/me — always present.
+ME_PAYLOAD=$(call GET /api/bongos/me)
 ME_IDS=$(extract_ids "${ME_PAYLOAD}" "[c['task_id'] for c in data.get('active_claims', [])]")
 # Filter to just our 2 smoke task_ids in case the builder has other live claims.
 ME_FILTERED=$(python3 -c "
@@ -177,19 +177,19 @@ ids = '${ME_IDS}'.split(',') if '${ME_IDS}' else []
 keep = [x for x in ids if x in ('${TASK_A}', '${TASK_B}')]
 print(','.join(keep))
 ")
-echo "/api/gds/me                 -> ${ME_FILTERED}"
+echo "/api/bongos/me                 -> ${ME_FILTERED}"
 if [[ "${ME_FILTERED}" == "${EXPECTED}" ]]; then
-  echo "  PASS /api/gds/me ordering matches"
+  echo "  PASS /api/bongos/me ordering matches"
   checked=$((checked+1))
 else
-  echo "  FAIL /api/gds/me ordering mismatch (expected ${EXPECTED}, got ${ME_FILTERED})"
+  echo "  FAIL /api/bongos/me ordering mismatch (expected ${EXPECTED}, got ${ME_FILTERED})"
   fail=1
 fi
 
-# Surface 2: /api/gds/builders/me — PMS-V2 P6, capability-gated.
-BUILDERS_ME_CODE=$(probe_status /api/gds/builders/me)
+# Surface 2: /api/bongos/builders/me — PMS-V2 P6, capability-gated.
+BUILDERS_ME_CODE=$(probe_status /api/bongos/builders/me)
 if [[ "${BUILDERS_ME_CODE}" == "200" ]]; then
-  BME_PAYLOAD=$(call GET /api/gds/builders/me)
+  BME_PAYLOAD=$(call GET /api/bongos/builders/me)
   # Try both common shapes: top-level active_claims, or nested under builder/profile.
   BME_IDS=$(extract_ids "${BME_PAYLOAD}" "[c['task_id'] for c in (data.get('active_claims') or data.get('builder', {}).get('active_claims') or data.get('profile', {}).get('active_claims') or [])]")
   BME_FILTERED=$(python3 -c "
@@ -197,16 +197,16 @@ ids = '${BME_IDS}'.split(',') if '${BME_IDS}' else []
 keep = [x for x in ids if x in ('${TASK_A}', '${TASK_B}')]
 print(','.join(keep))
 ")
-  echo "/api/gds/builders/me        -> ${BME_FILTERED}"
+  echo "/api/bongos/builders/me        -> ${BME_FILTERED}"
   if [[ "${BME_FILTERED}" == "${EXPECTED}" ]]; then
-    echo "  PASS /api/gds/builders/me ordering matches /api/gds/me"
+    echo "  PASS /api/bongos/builders/me ordering matches /api/bongos/me"
     checked=$((checked+1))
   else
-    echo "  FAIL /api/gds/builders/me ordering mismatch (expected ${EXPECTED}, got ${BME_FILTERED})"
+    echo "  FAIL /api/bongos/builders/me ordering mismatch (expected ${EXPECTED}, got ${BME_FILTERED})"
     fail=1
   fi
 else
-  echo "/api/gds/builders/me        -> HTTP ${BUILDERS_ME_CODE} (SKIP — PMS-V2 P6 not live yet)"
+  echo "/api/bongos/builders/me        -> HTTP ${BUILDERS_ME_CODE} (SKIP — PMS-V2 P6 not live yet)"
   skipped=$((skipped+1))
 fi
 

package/scripts/gds/smoke-dependencies.sh

@@ -31,29 +31,29 @@ BASE="${GDS_BASE:-$(gds_api_base)}"
 SUFFIX="$(date +%s)"
 
 echo "=== 1. Create task B (depends-on target, status=ready) ==="
-B=$(curl -sS -X POST "$BASE/api/gds/tasks" \
+B=$(curl -sS -X POST "$BASE/api/bongos/tasks" \
   -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   --data "{\"version_id\":\"GDS-V3\",\"title\":\"__smoke__ dep-test B $SUFFIX\",\"description\":\"smoke\",\"status\":\"ready\",\"kind\":\"feature\",\"discipline\":\"engineering\",\"priority\":5,\"touches\":[\"smoke-dep-B-$SUFFIX/\"],\"source\":\"smoke\",\"source_ref\":\"smoke-dep-B-$SUFFIX\"}")
 B_ID=$(echo "$B" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['id'])")
 echo "  B id=$B_ID"
 
 echo "=== 2. Create task A (dependent, status=backlog) ==="
-A=$(curl -sS -X POST "$BASE/api/gds/tasks" \
+A=$(curl -sS -X POST "$BASE/api/bongos/tasks" \
   -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   --data "{\"version_id\":\"GDS-V3\",\"title\":\"__smoke__ dep-test A $SUFFIX\",\"description\":\"smoke\",\"status\":\"backlog\",\"kind\":\"feature\",\"discipline\":\"engineering\",\"priority\":5,\"touches\":[\"smoke-dep-A-$SUFFIX/\"],\"source\":\"smoke\",\"source_ref\":\"smoke-dep-A-$SUFFIX\"}")
 A_ID=$(echo "$A" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['id'])")
 echo "  A id=$A_ID"
 
 echo "=== 3. Wire A → depends_on B ==="
-curl -sS -X POST "$BASE/api/gds/tasks/$A_ID/dependencies" \
+curl -sS -X POST "$BASE/api/bongos/tasks/$A_ID/dependencies" \
   -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   --data "{\"depends_on_task_id\": $B_ID}" | python3 -m json.tool
 
 echo "=== 4. Manually promote A (testing claim-time gate, not auto-promote) ==="
-curl -sS -X POST "$BASE/api/gds/tasks/$A_ID/promote" -H "Authorization: Bearer $TOKEN" | python3 -m json.tool
+curl -sS -X POST "$BASE/api/bongos/tasks/$A_ID/promote" -H "Authorization: Bearer $TOKEN" | python3 -m json.tool
 
 echo "=== 5. Attempt claim A — MUST 409 DEPS_NOT_SHIPPED ==="
-CLAIM_RESP=$(curl -sS -X POST "$BASE/api/gds/claims" \
+CLAIM_RESP=$(curl -sS -X POST "$BASE/api/bongos/claims" \
   -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   --data "{\"task_id\": $A_ID, \"worktree_name\": \"smoke-$SUFFIX\"}")
 echo "$CLAIM_RESP" | python3 -m json.tool
@@ -63,14 +63,14 @@ echo "=== 6. Claim + ship B (the dep) ==="
 node scripts/gds/claim.js "$B_ID" --worktree "smoke-$SUFFIX-B"
 # Move through completed → confirmed → shipped using direct API calls (skip the
 # scanner/grader by going straight at /resolve + /confirm + /ship)
-curl -sS -X POST "$BASE/api/gds/claims/by-task/$B_ID/resolve" \
+curl -sS -X POST "$BASE/api/bongos/claims/by-task/$B_ID/resolve" \
   -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   --data '{"outcome":"completed","verification":{"passed":true,"smoke_ok":true}}' >/dev/null
-curl -sS -X POST "$BASE/api/gds/tasks/$B_ID/confirm" -H "Authorization: Bearer $TOKEN" >/dev/null
-curl -sS -X POST "$BASE/api/gds/tasks/$B_ID/ship"    -H "Authorization: Bearer $TOKEN" >/dev/null
+curl -sS -X POST "$BASE/api/bongos/tasks/$B_ID/confirm" -H "Authorization: Bearer $TOKEN" >/dev/null
+curl -sS -X POST "$BASE/api/bongos/tasks/$B_ID/ship"    -H "Authorization: Bearer $TOKEN" >/dev/null
 
 echo "=== 7. Verify A auto-promoted (status should still be 'ready' from manual step 4, or auto-flipped from backlog) ==="
-A_STATUS=$(curl -sS -H "Authorization: Bearer $TOKEN" "$BASE/api/gds/tasks/$A_ID" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['status'])")
+A_STATUS=$(curl -sS -H "Authorization: Bearer $TOKEN" "$BASE/api/bongos/tasks/$A_ID" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['status'])")
 echo "  A status: $A_STATUS"
 [ "$A_STATUS" = "ready" ] && echo "  PASS" || (echo "  FAIL: A not ready"; exit 1)
 

package/scripts/gds/smoke-write.sh

@@ -4,9 +4,9 @@
 # Exercises the full claim → ship round-trip against the live API:
 #   1. Read session token from ~/.config/otb/bongos-session.json (or the legacy
 #      gds-session.json / pms-session.json names, all still accepted on read)
-#   2. POST /api/gds/tasks → create a synthetic task titled '__smoke__ <ts>'
-#   3. POST /api/gds/claims → claim it
-#   4. POST /api/gds/claims/:id/resolve outcome=shipped
+#   2. POST /api/bongos/tasks → create a synthetic task titled '__smoke__ <ts>'
+#   3. POST /api/bongos/claims → claim it
+#   4. POST /api/bongos/claims/:id/resolve outcome=shipped
 #   5. Validate: tasks.status flipped to 'shipped'
 #                session_logs row exists for this claim
 #                public/recent-shipped does NOT contain the smoke title
@@ -53,7 +53,7 @@ call() {
 }
 
 snapshot_progress() {
-  curl -sS "${API}/api/gds/public/progress" \
+  curl -sS "${API}/api/bongos/public/progress" \
     | python3 -c "import json,sys; d=json.load(sys.stdin); print(','.join(f\"{r['version_id']}:{r['shipped_weight']}/{r['total_weight']}\" for r in d['progress']))"
 }
 
@@ -83,7 +83,7 @@ echo "Version: ${VERSION_ID}"
 # version-select.js, and node is the interpreter a Windows builder box actually
 # has — the python3 the rest of this file depends on is frequently absent there
 # (it is the Microsoft Store stub), so a python3 step cannot be verified locally.
-GOAL_ID=$(call GET "/api/gds/goals?version=${VERSION_ID}" | node -e '
+GOAL_ID=$(call GET "/api/bongos/goals?version=${VERSION_ID}" | node -e '
 let s = "";
 process.stdin.on("data", (d) => { s += d; });
 process.stdin.on("end", () => {
@@ -140,21 +140,21 @@ print(json.dumps({
   'source_ref': '${ts}'
 }))
 ")
-TASK_JSON=$(call POST /api/gds/tasks "${CREATE_BODY}")
+TASK_JSON=$(call POST /api/bongos/tasks "${CREATE_BODY}")
 TASK_ID=$(echo "${TASK_JSON}" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['id'])")
 echo "created task #${TASK_ID}"
 
 echo
 echo "--- 2. claim task ---"
 CLAIM_BODY=$(python3 -c "import json; print(json.dumps({'task_id': ${TASK_ID}, 'worktree_name': '__smoke__'}))")
-CLAIM_JSON=$(call POST /api/gds/claims "${CLAIM_BODY}")
+CLAIM_JSON=$(call POST /api/bongos/claims "${CLAIM_BODY}")
 CLAIM_ID=$(echo "${CLAIM_JSON}" | python3 -c "import json,sys; print(json.load(sys.stdin)['claim']['id'])")
 echo "claim #${CLAIM_ID}"
 
 echo
 echo "--- 3. resolve claim shipped (verification.passed=true → lands at completed; grade gates confirm) ---"
 RESOLVE_BODY='{"outcome":"shipped","notes_md":"smoke-test","value_summary":"smoke-test","verification":{"passed":true,"scanner_clean":true,"smoke_clean":true}}'
-RESOLVE_JSON=$(call POST "/api/gds/claims/${CLAIM_ID}/resolve" "${RESOLVE_BODY}")
+RESOLVE_JSON=$(call POST "/api/bongos/claims/${CLAIM_ID}/resolve" "${RESOLVE_BODY}")
 echo "${RESOLVE_JSON}"
 
 echo
@@ -162,7 +162,7 @@ echo "--- 4. validate ---"
 fail=0
 
 # 4a. recent-shipped does NOT contain the smoke title
-RECENT=$(curl -sS "${API}/api/gds/public/recent-shipped")
+RECENT=$(curl -sS "${API}/api/bongos/public/recent-shipped")
 if echo "${RECENT}" | python3 -c "
 import json, sys
 data = json.load(sys.stdin)
@@ -196,7 +196,7 @@ fi
 # (Pre-#209 this asserted 'confirmed', which has been failing on every run
 # since the grader gate landed — fixed in #468.) The task should never reach
 # 'shipped' (that needs a merge). credits_reward=0, so no credit_log row.
-TASK_AFTER=$(call GET "/api/gds/tasks/${TASK_ID}")
+TASK_AFTER=$(call GET "/api/bongos/tasks/${TASK_ID}")
 STATUS_AFTER=$(echo "${TASK_AFTER}" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['status'])")
 if [[ "${STATUS_AFTER}" == "completed" ]]; then
   echo "PASS task.status = completed (resolve landed it at completed; grade gates confirm — V3.R18 #209)"
@@ -249,7 +249,7 @@ cleanup_throwaway_task() {
   out=$(curl -sS -X POST \
     -H "Authorization: Bearer ${TOKEN}" -H "Content-Type: application/json" \
     -d "${reason}" -w "\n%{http_code}" \
-    "${API}/api/gds/tasks/${TASK_ID}/abandon") || true
+    "${API}/api/bongos/tasks/${TASK_ID}/abandon") || true
   code="${out##*$'\n'}"
   case "${code}" in
     2*)  echo "PASS cleaned up throwaway task #${TASK_ID} (abandoned)" ;;

package/scripts/gds/start.js

@@ -732,7 +732,7 @@ async function main() {
   const rawClaimable = r.data.claimable || [];
 
   // Discipline routing (V3.R81 / #299). preferred_disciplines lives on the
-  // builder row (migration 027), surfaced via /api/gds/me.
+  // builder row (migration 027), surfaced via /api/bongos/me.
   const preferred = (me.ok && Array.isArray(me.data?.builder?.preferred_disciplines))
     ? me.data.builder.preferred_disciplines
     : [];

package/scripts/gds/status.js

@@ -5,7 +5,7 @@
 // ~10-step prose archaeology (grep seed file → eyeball "Gates R55–R63" →
 // re-query each task) that motivated the task. Reads the structured
 // criterion↔task link (task_criteria, migration 055) via the public endpoint
-// GET /api/gds/versions/:id/progress.
+// GET /api/bongos/versions/:id/progress.
 //
 // Usage:
 //   node scripts/gds/status.js                  # all criteria, default version
@@ -59,7 +59,7 @@ function parseArgs(argv) {
 async function fetchProgress(version) {
   let res;
   try {
-    res = await fetch(`${API_BASE}/api/gds/versions/${encodeURIComponent(version)}/progress`, {
+    res = await fetch(`${API_BASE}/api/bongos/versions/${encodeURIComponent(version)}/progress`, {
       headers: { 'User-Agent': require('../../src/branding').userAgent() },
     });
   } catch (err) {

package/scripts/gds/strand-watch.js

@@ -145,7 +145,7 @@ async function check({ nowMs = Date.now(), timeoutMs = DEFAULT_TIMEOUT_MS, confi
   let pages;
   try {
     pages = await Promise.all(WATCHED.map(async (status) => {
-      const res = await withTimeout(call('GET', `/api/gds/tasks?status=${status}&limit=${PAGE_LIMIT}`), status);
+      const res = await withTimeout(call('GET', `/api/bongos/tasks?status=${status}&limit=${PAGE_LIMIT}`), status);
       const body = res && (res.data || res);
       const tasks = body && Array.isArray(body.tasks) ? body.tasks : null;
       if (!tasks) throw new Error(`unexpected shape from /tasks?status=${status}`);

package/scripts/gds/triage.js

@@ -158,7 +158,7 @@ async function listOpenIdeas() {
   // GET /inbox in routes/inbox.js only returns open ideas regardless of
   // query — but the explicit param is forward-safe.
   if (!r.ok) {
-    throw new Error(`GET /api/gds/inbox failed: ${r.status} ${JSON.stringify(r.data)}`);
+    throw new Error(`GET /api/bongos/inbox failed: ${r.status} ${JSON.stringify(r.data)}`);
   }
   return r.data?.ideas ?? [];
 }
@@ -167,7 +167,7 @@ async function patchIdea(id, patch) {
   const api = await cliClient();
   const r = await api.inbox.patchInboxId({ id, body: patch });
   if (!r.ok) {
-    throw new Error(`PATCH /api/gds/inbox/${id} failed: ${r.status} ${JSON.stringify(r.data)}`);
+    throw new Error(`PATCH /api/bongos/inbox/${id} failed: ${r.status} ${JSON.stringify(r.data)}`);
   }
   return r.data?.idea;
 }
@@ -254,7 +254,7 @@ function applyGoalAnswer(defaultGoalId, rawAnswer) {
 }
 
 async function createTask({ versionId, title, description, priority, sourceRef, goalId = null }) {
-  // (The old note here said POST /api/gds/tasks does not accept 'kind'. That is
+  // (The old note here said POST /api/bongos/tasks does not accept 'kind'. That is
   // no longer true — routes/tasks.js takes it, and the hall promote path already
   // sends it. Left un-sent from THIS path deliberately: changing what kind a
   // triaged promotion lands with is a behaviour change task R13 was not asked to
@@ -284,7 +284,7 @@ async function createTask({ versionId, title, description, priority, sourceRef,
   const api = await cliClient();
   const r = await api.tasks.postTasks({ body });
   if (!r.ok) {
-    throw new Error(`POST /api/gds/tasks failed: ${r.status} ${JSON.stringify(r.data)}`);
+    throw new Error(`POST /api/bongos/tasks failed: ${r.status} ${JSON.stringify(r.data)}`);
   }
   return r.data?.task;
 }

package/scripts/gds/version-close.js

@@ -5,8 +5,8 @@
 //
 // What it does:
 //   1. Verifies the version is ready to close (calls
-//      GET /api/gds/versions/close-suggestions and checks the gate).
-//   2. Lists shipped tasks for the version (GET /api/gds/tasks) and drafts a
+//      GET /api/bongos/versions/close-suggestions and checks the gate).
+//   2. Lists shipped tasks for the version (GET /api/bongos/tasks) and drafts a
 //      <scope>-shipped.md archive grouped by kind/bucket from value_summary.
 //   3. Identifies carry-over candidates (backlog + ready) and drafts a
 //      next-version scope stub (e.g. limitations/pms-v3.md) with a

package/scripts/hall-preview/README.md

@@ -4,7 +4,7 @@ The dev-box sandbox previews the **game only** — `/builders` 404s there (idea
 hall-ui changes are reviewed here: a DB-less fixture server that serves the **real**
 `modules/hall-ui/public` files through the **real** serving seams (boot-time `?v=`
 content-hash stamping, `{{token}}` replacement, `window.__BRANDING__`/`__MODULES__`
-injection, theme markup), answering every `/api/gds|bongos/*` read from checked-in
+injection, theme markup), answering every `/api/bongos|bongos/*` read from checked-in
 fixtures. Proven recipe from tasks 1723/1742, checked in by task 2167.
 
 ## Quickstart

package/scripts/hall-preview/server.js

@@ -5,7 +5,7 @@
 // so hall-ui changes are reviewed HERE: a tiny express app that serves the real
 // modules/hall-ui/public files through the REAL serving seams (boot-time ?v=
 // stamping, {{token}} replacement, __BRANDING__/__MODULES__ injection, theme
-// markup) with the /api/gds|bongos reads answered from checked-in fixtures.
+// markup) with the /api/bongos|bongos reads answered from checked-in fixtures.
 // Boots DB-less (pg pools connect lazily). Proven recipe from tasks 1723/1742,
 // finally checked in.
 //

package/src/bongos/auth-admission.js

@@ -62,7 +62,7 @@ async function reportMembershipCheckIn({ githubId, githubLogin, displayName, ava
   if (!idp) return;
   const kind = membershipKind({ githubLogin });
   try {
-    await fetch(`${idp.origin}/api/gds/sso/membership/check-in`, {
+    await fetch(`${idp.origin}/api/bongos/sso/membership/check-in`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
       body: JSON.stringify({
@@ -159,7 +159,7 @@ async function reportActivityRollup({ builderId, githubId = null }) {
     if (!/^\d+$/.test(String(ghId ?? ''))) return;
     const shipped = await pool.query('SELECT count(*)::int AS n FROM tasks WHERE shipped_by = $1', [builderId]);
     const recentShips = await recentShipsForRollup(builderId);
-    await fetch(`${idp.origin}/api/gds/sso/activity/rollup`, {
+    await fetch(`${idp.origin}/api/bongos/sso/activity/rollup`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
       body: JSON.stringify({
@@ -434,7 +434,7 @@ async function readApplicantProfileFromHub(githubId) {
   const idp = loadIdpConfig();
   if (!idp || githubId == null) return null;
   try {
-    const r = await fetch(`${idp.origin}/api/gds/sso/applicant-profile`, {
+    const r = await fetch(`${idp.origin}/api/bongos/sso/applicant-profile`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
       signal: AbortSignal.timeout(APPLICANT_PROFILE_TIMEOUT_MS),

package/src/bongos/auth-idp.js

@@ -31,7 +31,7 @@ const { loadIdpConfig } = require('./auth-config.js');
 const { newSessionToken } = require('./auth-github.js');
 
 function idpAuthorizeUrl(origin, clientId, state, redirectUri) {
-  const u = new URL(`${String(origin).replace(/\/+$/, '')}/api/gds/sso/authorize`);
+  const u = new URL(`${String(origin).replace(/\/+$/, '')}/api/bongos/sso/authorize`);
   u.searchParams.set('client_id', clientId);
   u.searchParams.set('redirect_uri', redirectUri);
   u.searchParams.set('state', state);
@@ -48,7 +48,7 @@ function buildIdpAuthorizeUrl(state, redirectUri) {
 // with the instance's client_id + client_secret; the hub returns IDENTITY ONLY
 // (github_id, github_login, display_name, avatar_url) — never a rank (ADR 0141 §2).
 async function exchangeIdpCode({ code, redirectUri, idp }) {
-  const res = await fetch(`${idp.origin}/api/gds/sso/token`, {
+  const res = await fetch(`${idp.origin}/api/bongos/sso/token`, {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',

package/src/bongos/auth.js

@@ -3,11 +3,11 @@
 // Two flows that produce the same `builder_sessions` row:
 //
 // - Device Flow (CLI):
-//     1. POST /api/gds/auth/device/start
+//     1. POST /api/bongos/auth/device/start
 //          → { user_code, verification_uri, device_code, interval, expires_in }
 //          The CLI shows user_code to the user and asks them to open
 //          verification_uri in a browser.
-//     2. CLI polls POST /api/gds/auth/device/poll { device_code }
+//     2. CLI polls POST /api/bongos/auth/device/poll { device_code }
 //          → 'pending' | 'slow_down' | 'expired' | 'denied' |
 //            { token, builder: {...} }
 //
@@ -364,7 +364,7 @@ async function requireBuilder(req, res, next) {
 // and also falls back to Referer, so this is belt-and-braces for navigations
 // where Referer may be stripped. Returns '' if the host can't be determined.
 function signInWithReturn(req) {
-  const base = '/api/gds/auth/web/start';
+  const base = '/api/bongos/auth/web/start';
   const proto = req.headers['x-forwarded-proto'] || (req.secure ? 'https' : 'http');
   const host = req.headers['x-forwarded-host'] || req.headers['host'];
   if (!host) return base;

package/src/bongos/db.js

@@ -737,7 +737,7 @@ async function revokeSession(token) {
 
 // revokeSessionById — V3.R38 / #259. Kill ONE session by primary key. Returns
 // the number of rows revoked (0 if id didn't exist or was already revoked, 1
-// otherwise). Used by POST /api/gds/auth/revoke (Archon-only).
+// otherwise). Used by POST /api/bongos/auth/revoke (Archon-only).
 
 async function revokeSessionById(sessionId) {
   const { rowCount } = await pool.query(
@@ -751,7 +751,7 @@ async function revokeSessionById(sessionId) {
 
 // revokeAllSessionsForBuilder — V3.R38 / #259. Kill EVERY non-revoked session
 // for a single builder. Returns the count of sessions revoked. Used by:
-//   * POST /api/gds/auth/revoke-all (Archon-only direct call)
+//   * POST /api/bongos/auth/revoke-all (Archon-only direct call)
 //   * setBuilderRank when newRank < oldRank (rank-change-near-instant per C7)
 
 async function revokeAllSessionsForBuilder(builderId) {

package/src/bongos/llm-cache.js

@@ -151,7 +151,7 @@ async function lookup(cacheKey, { tokensSavedEst = 0 } = {}) {
   // must never take down the thing it accelerates.
   if (_apiCall) {
     try {
-      const r = await _apiCall('POST', '/api/gds/llm-cache/lookup',
+      const r = await _apiCall('POST', '/api/bongos/llm-cache/lookup',
         { cache_key: cacheKey, tokens_saved_est: est }, { allowUnauthenticated: true });
       if (r && r.ok && r.data && r.data.hit) return r.data.result || null;
     } catch (_) { /* network/auth error → miss */ }
@@ -185,7 +185,7 @@ async function store(spec, { resultStdout, resultCostUsd = 0 } = {}) {
   // cost server-side; best-effort: any error → no-store (never throws).
   if (_apiCall) {
     try {
-      const r = await _apiCall('POST', '/api/gds/llm-cache/store',
+      const r = await _apiCall('POST', '/api/bongos/llm-cache/store',
         { spec, result_stdout: resultStdout, result_cost_usd: Number(resultCostUsd) || 0 },
         { allowUnauthenticated: true });
       return !!(r && r.ok && r.data && r.data.stored);

package/src/bongos/metrics.js

@@ -14,7 +14,7 @@
 //   - process/runtime: uptime, RSS, heap, CPU (counter), event-loop lag, build_info
 //   - HTTP (from httpMiddleware): gds_http_requests_total{method,route,status} +
 //     gds_http_request_duration_seconds histogram — route normalized to a
-//     low-cardinality template so /api/gds/tasks/1380 and /…/1381 share a series.
+//     low-cardinality template so /api/bongos/tasks/1380 and /…/1381 share a series.
 //     Gives error-rate + 4xx/5xx per route. 401/403 also bump gds_auth_failures_total.
 //   - DB gauges (collected at scrape, read-only — never instruments the gate-floor
 //     ship pipeline): tasks-by-status, claims (all-time + active), builders-by-rank,

package/src/bongos/middleware/audit.js

@@ -1,13 +1,13 @@
 // src/bongos/middleware/audit.js — append-only audit log for authenticated writes
 // (V3.R35 / #256).
 //
-// Wire-up: mounted INSIDE the /api/gds sub-router by routes.js, AFTER the JSON
+// Wire-up: mounted INSIDE the /api/bongos sub-router by routes.js, AFTER the JSON
 // body parser and AFTER each route's auth middleware has run (the middleware
 // fires on res 'finish', so by then auth either populated req.builder or sent
 // a 401 — both cases are handled below).
 //
 // What it captures:
-//   - Every authenticated POST/PATCH/PUT/DELETE that the /api/gds router
+//   - Every authenticated POST/PATCH/PUT/DELETE that the /api/bongos router
 //     served. Reads (GET) are explicitly skipped — they're high-volume and
 //     low-signal for forensics.
 //   - The redacted request body, the response status the client actually saw,
@@ -161,7 +161,7 @@ function clientIp(req) {
 // (e.g. 404 from the router), fall back to req.path.
 function routePattern(req) {
   if (req.route && req.route.path) {
-    // baseUrl carries '/api/gds' plus any sub-router prefix; combining them
+    // baseUrl carries '/api/bongos' plus any sub-router prefix; combining them
     // yields the full pattern. trim trailing slash for tidiness.
     const base = (req.baseUrl || '').replace(/\/+$/, '');
     const tail = req.route.path === '/' ? '' : req.route.path;

package/src/bongos/middleware/rate-limit.js

@@ -1,7 +1,7 @@
 // src/bongos/middleware/rate-limit.js — V3.R34 (#255).
 //
 // Five sliding-window in-memory limiters. The first two are the GLOBAL pair and
-// protect write methods on /api/gds/* only — read methods (GET, HEAD, OPTIONS)
+// protect write methods on /api/bongos/* only — read methods (GET, HEAD, OPTIONS)
 // bypass them entirely; #3, #4 and #5 are mounted per-surface to close exactly that
 // gap where an unauthenticated READ is itself the abuse.
 //

package/src/bongos/platform-visibility-gate.js

@@ -127,7 +127,7 @@ function isGated() { return mode() === GATED; }
 
 // Express routes case-insensitively and tolerates one trailing slash, so the
 // exempt test must see the path the way the router will — otherwise a probe
-// spelled `/HEALTHZ` or `/api/gds/instance/` is refused while the router would
+// spelled `/HEALTHZ` or `/api/bongos/instance/` is refused while the router would
 // have served it. Mismatches still fail CLOSED; this only keeps the list honest.
 function normalizePath(p) {
   let s = String(p || '').toLowerCase();
@@ -160,7 +160,7 @@ function productName() {
 // subdomain, a dev port, or plain http would otherwise be dropped at the default
 // page. Only a GET/HEAD path is safe to come back to; anything else returns to '/'.
 function signInHref(req) {
-  const base = '/api/gds/auth/web/start';
+  const base = '/api/bongos/auth/web/start';
   const back = (req.method === 'GET' || req.method === 'HEAD') ? relativeReturn(req.originalUrl) : null;
   return back ? `${base}?return=${encodeURIComponent(back)}` : base;
 }

package/src/bongos/routes/_helpers.js

@@ -409,7 +409,7 @@ function hardenRouterStack(router, seen = new Set()) {
 // Read-only, no-auth, no-secret routes, so a static '*' is safe; the caller
 // mounts it scoped to a `/public…` prefix (passed as `scope` for documentation
 // + signature parity) so it can't leak onto the authenticated routes on the same
-// /api/gds base. Behavior is BYTE-IDENTICAL to the two copy-pasted blocks it
+// /api/bongos base. Behavior is BYTE-IDENTICAL to the two copy-pasted blocks it
 // replaces (routes/analytics.js + routes/public.js): sets
 // Access-Control-Allow-Origin:*, and answers an OPTIONS preflight with
 // Allow-Methods 'GET, OPTIONS' + Allow-Headers 'Content-Type' and a 204.

package/src/bongos/routes/audit-log.js

@@ -14,7 +14,7 @@ const VALID_METHODS = new Set(['POST', 'PATCH', 'PUT', 'DELETE']);
 module.exports = function buildAuditLogRouter() {
   const router = express.Router();
 
-  // GET /api/gds/audit-log?limit=&offset=&builder_id=&method=
+  // GET /api/bongos/audit-log?limit=&offset=&builder_id=&method=
   //
   // Paginated, newest-first. Clamps:
   //   limit  → 1..500, default 100

package/src/bongos/routes/auth.js

@@ -92,7 +92,7 @@ function renderAuthErrorPage(heading, detail, opts = {}) {
     catch { return AUTH_ERROR_FALLBACK; }
   })();
   const subtitle = opts.subtitle || copy.subtitle;
-  const cta = opts.cta || { href: opts.startHref || '/api/gds/auth/web/start', label: copy.ctaLabel };
+  const cta = opts.cta || { href: opts.startHref || '/api/bongos/auth/web/start', label: copy.ctaLabel };
   const note = opts.note || "If this keeps happening, the GitHub OAuth app's authorized callback URL may be misconfigured. See docs/recipes/ops-gotchas.md (GitHub OAuth section).";
   // The instance name in the tab title comes from the branding pack, never a
   // hardcoded host brand — a non-OTB instance sees its own name (ADR 0062 §3).
@@ -165,7 +165,7 @@ function renderAccessPendingPage(login, startHref) {
 </header>
 <main>
   <section class="scroll">
-    <div class="landing" id="pending" data-login="${safeLogin}" data-start="${escapeHtml(startHref || '/api/gds/auth/web/start')}">
+    <div class="landing" id="pending" data-login="${safeLogin}" data-start="${escapeHtml(startHref || '/api/bongos/auth/web/start')}">
       <p>We're checking your access now. You'll be signed in automatically as soon as it clears — no need to refresh.</p>
       <p class="landing__note" id="pending-note">Checking…</p>
     </div>
@@ -178,7 +178,7 @@ function renderAccessPendingPage(login, startHref) {
   var login = el ? el.getAttribute('data-login') : '';
   /* server-built from the still-valid handshake cookies (task 1003234): the
      fresh sign-in keeps the wizard return + repo scope a founder started with */
-  var start = (el && el.getAttribute('data-start')) || '/api/gds/auth/web/start';
+  var start = (el && el.getAttribute('data-start')) || '/api/bongos/auth/web/start';
   var EVERY_MS = 3000;
   var GIVE_UP_MS = 5 * 60 * 1000;
   var started = Date.now();
@@ -190,7 +190,7 @@ function renderAccessPendingPage(login, startHref) {
       note.textContent = 'Still waiting on approval. You can leave this page open, or try signing in again later.';
       return;
     }
-    fetch('/api/gds/auth/web/admission-status?login=' + encodeURIComponent(login), { credentials: 'omit' })
+    fetch('/api/bongos/auth/web/admission-status?login=' + encodeURIComponent(login), { credentials: 'omit' })
       .then(function (r) { return r.ok ? r.json() : null; })
       .then(function (j) {
         if (j && j.admitted) { land(); return; }
@@ -350,7 +350,7 @@ function recoveryStartHref(req) {
   if (returnTo) params.set('return', returnTo);
   if (parseCookie(req, REPOS_COOKIE) === '1') params.set('repos', '1');
   const q = params.toString();
-  return '/api/gds/auth/web/start' + (q ? '?' + q : '');
+  return '/api/bongos/auth/web/start' + (q ? '?' + q : '');
 }
 
 // The canonical sign-in origin, read from the instance branding pack (oauthOrigin,

package/src/bongos/routes/backup.js

@@ -153,7 +153,7 @@ module.exports = function buildBackupRouter() {
 
       res.status(202).json({
         ok: true,
-        message: 'Backup started — poll GET /api/gds/backup/status to see the new dump land (usually < 30 s).',
+        message: 'Backup started — poll GET /api/bongos/backup/status to see the new dump land (usually < 30 s).',
         started_at: startedAt,
       });
     }));

package/src/bongos/routes/builders.js

@@ -456,7 +456,7 @@ module.exports = function buildBuildersRouter() {
   // Public read (no auth). Spec says the hall renders other builders'
   // checklists read-only — a builder's onboarding progress is roster-visible
   // signal, same posture as rank or drachmae shown on the leaderboard. The
-  // builder's own row is also surfaced inside /api/gds/me; this endpoint is
+  // builder's own row is also surfaced inside /api/bongos/me; this endpoint is
   // what the hall hits for the CURRENT viewer AND for any other builder
   // whose card is rendered.
   //

package/src/bongos/routes/instance.js

@@ -1,4 +1,4 @@
-// src/bongos/routes/instance.js — GET /api/gds/instance (V4.R82, task 1249, ADR 0062 / Cloud Bongos C8).
+// src/bongos/routes/instance.js — GET /api/bongos/instance (V4.R82, task 1249, ADR 0062 / Cloud Bongos C8).
 //
 // The instance manifest: one public, pre-auth, read-only descriptor that a CLI
 // (`bongos login <url>`) fetches to configure ITSELF — the conda