@bongos/core 1.19.803 → 1.19.805

package/scripts/gds/login.js

@@ -32,13 +32,14 @@ const { branding } = require('../../src/branding');
 // --- pure helpers (unit-tested) ---------------------------------------------
 
 // Normalize whatever the user pastes into an origin: add https:// if no scheme,
-// drop trailing slashes, and tolerate a pasted /api/gds suffix.
+// drop trailing slashes, and tolerate a pasted API base — the canonical
+// /api/bongos or the permanent /api/gds alias, with or without the /v1 segment.
 function normalizeInstanceBase(raw) {
   let s = String(raw || '').trim();
   if (!s) throw new Error('missing instance URL');
   if (!/^https?:\/\//i.test(s)) s = `https://${s}`;
   s = s.replace(/\/+$/, '');
-  s = s.replace(/\/api\/gds\/?$/i, '');
+  s = s.replace(/\/api\/(?:bongos|gds)(?:\/v1)?\/?$/i, '');
   return s;
 }
 
@@ -95,7 +96,7 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 // The instance's OWN admission gate runs at poll (direct) or exchange (federated),
 // so the stranger path is identical for both.
 async function runDeviceFlow(base, { log, idp = null }) {
-  const startUrl = idp ? `${idp.origin}/api/gds/sso/device/start` : `${base}/api/gds/auth/device/start`;
+  const startUrl = idp ? `${idp.origin}/api/bongos/sso/device/start` : `${base}/api/bongos/auth/device/start`;
   const start = await fetchJson(startUrl, {
     method: 'POST',
     // Federated: the hub resolves + binds the client from the USER-TYPED origin
@@ -136,7 +137,7 @@ async function runDeviceFlow(base, { log, idp = null }) {
   openBrowser(verification_uri);
   log('  Waiting for you to approve in the browser…');
 
-  const pollUrl = idp ? `${idp.origin}/api/gds/sso/device/poll` : `${base}/api/gds/auth/device/poll`;
+  const pollUrl = idp ? `${idp.origin}/api/bongos/sso/device/poll` : `${base}/api/bongos/auth/device/poll`;
   const deadline = Date.now() + expires * 1000;
   while (Date.now() < deadline) {
     await sleep(interval * 1000);
@@ -150,7 +151,7 @@ async function runDeviceFlow(base, { log, idp = null }) {
     if (st === 'ok') {
       if (!idp) return { state: 'ok', token: poll.data.token, builder: poll.data.builder };
       // Federated: exchange the hub assertion at the instance for a real session.
-      const ex = await fetchJson(`${base}/api/gds/auth/device/exchange`, {
+      const ex = await fetchJson(`${base}/api/bongos/auth/device/exchange`, {
         method: 'POST',
         body: JSON.stringify({ assertion: poll.data.assertion }),
       });
@@ -200,9 +201,9 @@ async function main() {
   // 1. Manifest — brand + admission posture, and a check that this really is a
   //    Cloud Bongos instance before we start a device flow.
   log(`▸ Connecting to ${base}…`);
-  const man = await fetchJson(`${base}/api/gds/instance`);
+  const man = await fetchJson(`${base}/api/bongos/instance`);
   if (!man.ok || !man.data || man.data.schema !== 'instance-manifest/v1') {
-    console.error(`✖ ${base} does not look like a Cloud Bongos instance (no /api/gds/instance manifest).`);
+    console.error(`✖ ${base} does not look like a Cloud Bongos instance (no /api/bongos/instance manifest).`);
     process.exit(1);
   }
   const instanceName = man.data.name || base;
@@ -230,7 +231,7 @@ async function main() {
     let stored = null;
     try { stored = await loadStoredSession(base); } catch (_) { stored = null; }
     if (stored && stored.token) {
-      const me = await fetchJson(`${base}/api/gds/me`, { headers: { Authorization: `Bearer ${stored.token}` } });
+      const me = await fetchJson(`${base}/api/bongos/me`, { headers: { Authorization: `Bearer ${stored.token}` } });
       if (me.ok && me.data && me.data.builder) {
         await saveSession({ ...stored, builder: me.data.builder, api_base: base,
           instance: { name: instanceName, origin: base } });
@@ -265,7 +266,7 @@ async function main() {
       console.error('✖ need your GitHub username to request access.');
       process.exit(2);
     }
-    const reqRes = await fetchJson(`${base}/api/gds/access-requests`, {
+    const reqRes = await fetchJson(`${base}/api/bongos/access-requests`, {
       method: 'POST',
       body: JSON.stringify({ github_login: ghLogin, note: 'via bongos login' }),
     });
@@ -287,7 +288,7 @@ async function main() {
     const admitDeadline = Date.now() + 30 * 60 * 1000; // 30 min
     for (;;) {
       await sleep(5000);
-      const s = await fetchJson(`${base}/api/gds/access-requests/status?github_login=${encodeURIComponent(ghLogin)}`);
+      const s = await fetchJson(`${base}/api/bongos/access-requests/status?github_login=${encodeURIComponent(ghLogin)}`);
       const decision = pollDecision(s.data);
       if (decision === 'admitted') {
         log('\n  ✓ Approved! Finishing sign-in — approve once more in your browser.');

package/scripts/gds/main-audit.js

@@ -282,7 +282,7 @@ async function fetchRankMap({ useDb = false } = {}) {
   // Caveat: a zero-activity builder may be absent → resolves as UNRESOLVED
   // ('review' finding), never as falsely-trusted.
   try {
-    const res = await fetch(`${API_BASE}/api/gds/public/leaderboard`);
+    const res = await fetch(`${API_BASE}/api/bongos/public/leaderboard`);
     if (res.ok) {
       const data = await res.json();
       return rowsToMap(data?.leaderboard || []);

package/scripts/gds/newcomer-floor.config.json

@@ -1,6 +1,6 @@
 {
   "_doc": "Supply knob for the deterministic newcomer-task floor replenisher (scripts/gds/newcomer-floor.js) and the on-claim restock (src/bongos/newcomer-restock.js). As of task 1488 each discipline holds a LIST of chore templates, and each chore keeps its OWN standing pool to its OWN `floor` (declared per-template in newcomer-floor.templates.json). The `floor` in this disciplines map is now the DEFAULT applied to any template that omits its own — i.e. a fallback, not the primary knob. The pool is measured in READY copies of each template (source_ref tmpl:<discipline>:<template_id>:<seq>); when a chore's ready copies drop below its floor, fresh identical copies are stamped — deterministic, no AI subagent, no 401. The CHORE definitions (and their per-template floors) live in templates.json (edit there to add/change a chore or tune its pool depth).",
-  "_review_gate": "`auto_promote` is the review toggle for the CLI seeder. true -> stamped copies land at status='ready' (claimable immediately). Safe here because output is deterministic and the templates are pre-approved (set true 2026-06-16, owner decision). false -> copies land at status='backlog' (NOT Xenos-claimable) for an Archon to promote via POST /api/gds/tasks/:id/promote. (The on-claim restock always stamps 'ready' — it tops a just-claimed chore's pool back up so the shelf is never empty.)",
+  "_review_gate": "`auto_promote` is the review toggle for the CLI seeder. true -> stamped copies land at status='ready' (claimable immediately). Safe here because output is deterministic and the templates are pre-approved (set true 2026-06-16, owner decision). false -> copies land at status='backlog' (NOT Xenos-claimable) for an Archon to promote via POST /api/bongos/tasks/:id/promote. (The on-claim restock always stamps 'ready' — it tops a just-claimed chore's pool back up so the shelf is never empty.)",
   "_floor_note": "Per-template `floor` lives in newcomer-floor.templates.json (next to each chore's credits_reward + est_minutes). The disciplines map below is only the per-discipline DEFAULT used when a template omits its own floor. credits_reward is never read from here.",
   "templates_path": "newcomer-floor.templates.json",
   "auto_promote": true,

package/scripts/gds/newcomer-floor.js

@@ -37,7 +37,7 @@
 //                      deterministic and the templates are pre-approved.
 //   false           -> copies land status='backlog' for an Archon to promote.
 //
-// AUTH: POST /api/gds/tasks is archon-gated (creating work is scope-shaping —
+// AUTH: POST /api/bongos/tasks is archon-gated (creating work is scope-shaping —
 // ADR 0016). Run under an Archon session (on the droplet, the operator's).
 //
 // Usage:
@@ -393,7 +393,7 @@ function report(summary, FLAGS, { checkOnly }) {
   }
   if (!summary.autoPromote && !FLAGS.dryRun && summary.stamped.some((g) => g.task_id)) {
     console.log('\nNext: a Metic+ builder promotes the new backlog copies to ready:');
-    console.log('  node scripts/gds/api.js POST /api/gds/tasks/<id>/promote   (or the builders\' hall)');
+    console.log('  node scripts/gds/api.js POST /api/bongos/tasks/<id>/promote   (or the builders\' hall)');
   }
 }
 

package/scripts/gds/newcomer-floor.templates.json

@@ -70,13 +70,13 @@
       "est_minutes": 45,
       "credits_reward": 12,
       "title": "Idea-seed pass: file 5-8 fresh in-world ideas (names, lore, or builder-UX) into the idea inbox",
-      "description": "## What you'll do\n\nThe seed of almost everything built here is the **idea_inbox** — a queue anyone can drop ideas into, which trusted builders later triage into real tasks. Your first ship as an ideator is simple and concrete: **add a small batch of fresh ideas to that inbox.** You write no code, touch no game, change no system — you think, write a few short well-shaped ideas, and file them with one command each.\n\nIt is identical for every newcomer and **always valuable**: the inbox is never \"done\" — every triage pass consumes ideas (promote/discard/merge), so it is permanently hungry for fresh input, and a growing world always wants more names, more lore, more texture. Your batch is brand-new content, so it can never duplicate \"the work\" — the supply IS the work.\n\n## Pick ONE branch\n\n- **Branch A — PRODUCT flavour (default).** Ideas that grow the world players see: **names + one line of lore** for a character, structure, landmark, district, ship, or festival; or a world-background snippet (a custom, a superstition, a line a named NPC says). Tone: mythic, mysterious, a \"discovered secret\"; Mediterranean ancient-Greek coast (just south of Athens); NOT modern, NOT tongue-in-cheek-modern. Ground it in CLAUDE.md §3/§6/§7.\n- **Branch B — INTERNAL / builder-UX.** Small user-experience improvement ideas for the GDS / builders' hall (the surfaces builders use, not the game): a clearer label, a confusing onboarding message, a quality-of-life tweak to a status page or a slash-command's output. See `docs/TRACKS.md` for product vs internal.\n\n## How to find your way in\n\n1. (Branch A) Read CLAUDE.md §3/§6/§7 for tone. (Branch B) Skim `docs/TRACKS.md` and click around your instance's /builders hall for the rough edge you'll write up.\n2. See what's already filed so you don't repeat it: `node scripts/gds/api.js GET /api/gds/inbox`.\n3. File each idea with `node scripts/gds/capture.js \"<title>\" --body-file <path>` (filing an idea is the open-to-all path — a Xenos/Thetes session is allowed to do it; you just can't triage them). Put one line of detail + a `track: product` or `track: internal` line in each body file.",
+      "description": "## What you'll do\n\nThe seed of almost everything built here is the **idea_inbox** — a queue anyone can drop ideas into, which trusted builders later triage into real tasks. Your first ship as an ideator is simple and concrete: **add a small batch of fresh ideas to that inbox.** You write no code, touch no game, change no system — you think, write a few short well-shaped ideas, and file them with one command each.\n\nIt is identical for every newcomer and **always valuable**: the inbox is never \"done\" — every triage pass consumes ideas (promote/discard/merge), so it is permanently hungry for fresh input, and a growing world always wants more names, more lore, more texture. Your batch is brand-new content, so it can never duplicate \"the work\" — the supply IS the work.\n\n## Pick ONE branch\n\n- **Branch A — PRODUCT flavour (default).** Ideas that grow the world players see: **names + one line of lore** for a character, structure, landmark, district, ship, or festival; or a world-background snippet (a custom, a superstition, a line a named NPC says). Tone: mythic, mysterious, a \"discovered secret\"; Mediterranean ancient-Greek coast (just south of Athens); NOT modern, NOT tongue-in-cheek-modern. Ground it in CLAUDE.md §3/§6/§7.\n- **Branch B — INTERNAL / builder-UX.** Small user-experience improvement ideas for the GDS / builders' hall (the surfaces builders use, not the game): a clearer label, a confusing onboarding message, a quality-of-life tweak to a status page or a slash-command's output. See `docs/TRACKS.md` for product vs internal.\n\n## How to find your way in\n\n1. (Branch A) Read CLAUDE.md §3/§6/§7 for tone. (Branch B) Skim `docs/TRACKS.md` and click around your instance's /builders hall for the rough edge you'll write up.\n2. See what's already filed so you don't repeat it: `node scripts/gds/api.js GET /api/bongos/inbox`.\n3. File each idea with `node scripts/gds/capture.js \"<title>\" --body-file <path>` (filing an idea is the open-to-all path — a Xenos/Thetes session is allowed to do it; you just can't triage them). Put one line of detail + a `track: product` or `track: internal` line in each body file.",
       "done_when": [
         "You filed 5–8 fresh ideas into the idea_inbox via `node scripts/gds/capture.js` (each prints a `Captured idea #N` confirmation), all in ONE branch (A product, or B internal/UX).",
         "Each idea has a clear title and a body with at least one sentence of detail — for Branch A, one line of in-world lore (who/what it is); for Branch B, what the rough edge is and what 'better' looks like.",
         "Branch A ideas are in the world's voice and consistent with CLAUDE.md §3/§6/§7 (ancient-Greek coast, Example, mythic 'discovered secret' tone — not modern/anachronistic).",
         "Each idea body declares its track on a `track: product` or `track: internal` line so triage can route it.",
-        "Before filing you ran `GET /api/gds/inbox` and confirmed your ideas are not near-duplicates of open ones.",
+        "Before filing you ran `GET /api/bongos/inbox` and confirmed your ideas are not near-duplicates of open ones.",
         "You touched only the idea_inbox via capture.js — no code, no migrations, no infra, no permission/pipeline files; nothing committed to the repo."
       ],
       "touches": [],

package/scripts/gds/onboarding-ship.js

@@ -11,7 +11,7 @@
 // realized as a privacy-preserving two-step: this script gzips completed
 // transcripts into a local spool, and onboarding-analyze.js then ships only
 // the *distilled friction signal* (not the raw transcript) to the shared GDS
-// via POST /api/gds/inbox. The raw transcript never leaves the machine — a
+// via POST /api/bongos/inbox. The raw transcript never leaves the machine — a
 // deliberate privacy choice given transcripts can contain anything the builder
 // typed. A dedicated upload endpoint would need a new route + storage table
 // (migration), both outside this task's touches[].

package/scripts/gds/paste-token.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // scripts/gds/paste-token.js — V3.R91 / #401.
 //
-// Accept a CLI bearer minted by the builders' hall (POST /api/gds/auth/cli-token/issue)
+// Accept a CLI bearer minted by the builders' hall (POST /api/bongos/auth/cli-token/issue)
 // and write it into ~/.config/otb/bongos-session.json. Preserves any existing
 // fields (notably gemini_api_key registered via /builder-setup) so a token
 // paste never silently un-registers a builder's Gemini key.
@@ -14,7 +14,7 @@
 // builder can copy + paste a single line.
 //
 // Safety contract:
-//   1. The token is verified against /api/gds/me BEFORE the session file is
+//   1. The token is verified against /api/bongos/me BEFORE the session file is
 //      touched. A bad paste exits non-zero with a clear message and leaves
 //      the existing session intact.
 //   2. The file is written with mode 0600, same as setup.js.
@@ -70,7 +70,7 @@ async function main() {
   //    paste was meant to REPLACE, not destroy.
   let me;
   try {
-    const res = await fetch(`${API_BASE}/api/gds/me`, {
+    const res = await fetch(`${API_BASE}/api/bongos/me`, {
       headers: { Authorization: `Bearer ${token}` },
     });
     if (res.status === 401) {

package/scripts/gds/portability-smoke-memory.sh

@@ -109,11 +109,11 @@ if [ -z "$REMOTE" ]; then bad "could not resolve origin remote for fresh-clone t
 fi
 
 # --- 3. unauthenticated memory read is rejected (guard) ----------------------
-code=$(curl -sS -o /dev/null -w '%{http_code}' "$BASE/api/gds/memory/files" || echo 000)
+code=$(curl -sS -o /dev/null -w '%{http_code}' "$BASE/api/bongos/memory/files" || echo 000)
 [ "$code" = "401" ] && ok "unauth GET /memory/files → 401" || bad "unauth GET /memory/files → $code (expected 401)"
 
 # --- 4. authenticated builder can pull their server-canonical memory ---------
-FILES_JSON=$(curl -sS -H "Authorization: Bearer $TOKEN" "$BASE/api/gds/memory/files" || echo '{}')
+FILES_JSON=$(curl -sS -H "Authorization: Bearer $TOKEN" "$BASE/api/bongos/memory/files" || echo '{}')
 COUNT=$(echo "$FILES_JSON" | python3 -c "import json,sys;print(json.load(sys.stdin).get('count',-1))" 2>/dev/null || echo -1)
 if [ "$COUNT" -ge 1 ] 2>/dev/null; then
   ok "authenticated pull lists $COUNT server-canonical memory file(s)"
@@ -125,7 +125,7 @@ fi
 # Take the first listed file, fetch it, recompute sha256, compare to server's.
 FIRST_PATH=$(echo "$FILES_JSON" | python3 -c "import json,sys;f=json.load(sys.stdin).get('files',[]);print(f[0]['path'] if f else '')" 2>/dev/null || echo "")
 if [ -n "$FIRST_PATH" ]; then
-  VERDICT=$(curl -sS -H "Authorization: Bearer $TOKEN" --get "$BASE/api/gds/memory/file" --data-urlencode "path=$FIRST_PATH" \
+  VERDICT=$(curl -sS -H "Authorization: Bearer $TOKEN" --get "$BASE/api/bongos/memory/file" --data-urlencode "path=$FIRST_PATH" \
     | python3 -c "
 import json,sys,hashlib
 d=json.load(sys.stdin)
@@ -158,9 +158,9 @@ if [ "${GDS_SMOKE_ALLOW_WRITE:-0}" = "1" ] && [ "$TOKEN_SRC" = "env" ]; then
   PUSH_BODY=$(python3 -c "import json,sys;print(json.dumps({'files':[{'path':'$SPATH','content':sys.argv[1]}]}))" "$STAMP")
   PUSH_CODE=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
     -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
-    "$BASE/api/gds/memory/sync" -d "$PUSH_BODY" || echo 000)
+    "$BASE/api/bongos/memory/sync" -d "$PUSH_BODY" || echo 000)
   if [ "$PUSH_CODE" = "200" ]; then
-    RT=$(curl -sS -H "Authorization: Bearer $TOKEN" --get "$BASE/api/gds/memory/file" --data-urlencode "path=$SPATH" \
+    RT=$(curl -sS -H "Authorization: Bearer $TOKEN" --get "$BASE/api/bongos/memory/file" --data-urlencode "path=$SPATH" \
       | python3 -c "import json,sys;d=json.load(sys.stdin);print('OK' if d.get('content')==sys.argv[1] else 'MISMATCH')" "$STAMP" 2>/dev/null || echo ERR)
     [ "$RT" = "OK" ] && ok "push→pull sync round-trip (content persisted + retrieved intact)" \
                      || bad "push→pull round-trip content mismatch ($RT)"

package/scripts/gds/prove-strict-versioning.js

@@ -71,14 +71,14 @@ function errorCode(body) {
 
 /** GET a Bongos API path, returning the parsed body. Throws on a non-2xx. */
 async function get(path) {
-  const r = await apiCall('GET', `/api/gds${path}`);
+  const r = await apiCall('GET', `/api/bongos${path}`);
   if (!r.ok) throw new Error(`GET ${path} → ${r.status}`);
   return r.data;
 }
 
 /** POST a probe. Returns the status WITHOUT throwing — the status IS the proof. */
 async function probePost(path, body) {
-  const r = await apiCall('POST', `/api/gds${path}`, body || {});
+  const r = await apiCall('POST', `/api/bongos${path}`, body || {});
   return { status: r.status, body: r.data, why: errorCode(r.data) };
 }
 

package/scripts/gds/provision-net.js

@@ -55,7 +55,7 @@ function shouldFederate(inst, deps) {
 // device sign-in (and a wrong origin would be a takeover vector). client_id is the
 // (unique, DNS-safe) slug, so a re-provision rotates the SAME row's secret via
 // registerClient's ON CONFLICT rather than orphaning a client. redirect_uri lists both
-// callback prefixes the core may emit (/api/gds is what auth.js builds today) so the
+// callback prefixes the core may emit (/api/bongos is what auth.js builds today) so the
 // hub's exact-match allow-list accepts the browser leg. --apply gates the real hub
 // write; dry-run returns a placeholder block (so webEnvBody can still be composed) + logs.
 async function federateInstance(inst, deps) {
@@ -246,7 +246,7 @@ function healthzCmd(inst) {
 
 // The instance manifest, read over loopback — the identity companion to healthzCmd (task 1003740).
 function identityCmd(inst) {
-  return `curl -sS --max-time 5 http://127.0.0.1:${inst.port}/api/gds/instance`;
+  return `curl -sS --max-time 5 http://127.0.0.1:${inst.port}/api/bongos/instance`;
 }
 
 // Does a freshly provisioned instance report ITSELF, or the platform it is hosted on?

package/scripts/gds/provision-units.js

@@ -153,7 +153,7 @@ WantedBy=timers.target
 //
 // The pin outlived it, and src/branding.js's ENV_OVERRIDES cover domains, auth.idp and landing —
 // never `identity.productName`. So every hosted instance kept serving the NEUTRAL pack's name:
-// GET /api/gds/instance on hermeslines-marketing, mercury and demo all answered "Cloud Bongos"
+// GET /api/bongos/instance on hermeslines-marketing, mercury and demo all answered "Cloud Bongos"
 // while each instance's own pack on disk said otherwise, and `bongos login <instance>` greeted a
 // newcomer with the platform's name at the moment they were deciding whether to trust it.
 //
@@ -310,10 +310,10 @@ function settingsEnvVarsFor(inst) {
 }
 
 // The instance's own public manifest — the settings read-back ADR 0190 names
-// (GET /api/gds/instance → brand.project). Sibling of provision-net's healthzCmd:
+// (GET /api/bongos/instance → brand.project). Sibling of provision-net's healthzCmd:
 // same loopback + timeout, a different question ("did you READ it?").
 function instanceManifestCmd(inst) {
-  return `curl -sS --max-time 5 http://127.0.0.1:${inst.port}/api/gds/instance`;
+  return `curl -sS --max-time 5 http://127.0.0.1:${inst.port}/api/bongos/instance`;
 }
 
 // Did the restarted instance CONSUME the pushed settings? Compares each key of

package/scripts/gds/pulse.js

@@ -15,7 +15,7 @@
 //
 // -------------------------------------------------------------------------
 // Pulse-mode follow-up note (unchanged from original):
-//   POST /api/gds/pulse is NOT yet wired (route lives in src/bongos/routes.js,
+//   POST /api/bongos/pulse is NOT yet wired (route lives in src/bongos/routes.js,
 //   which is OUT of THAT task's touches[]). Once a follow-up task adds
 //   the route, the pulse path starts working with no changes. Until then,
 //   running it will print a 404 from the server — that is expected.
@@ -314,7 +314,7 @@ async function releaseStale({ timer, dryRun }) {
   const r = await api.request('POST', '/pulse', { body: { claim_id: claimId } });
   if (!r.ok) {
     // Fire-and-forget: log the diagnostic but do not fail.
-    // Until the /api/gds/pulse route is mounted, this routinely returns 404.
+    // Until the /api/bongos/pulse route is mounted, this routinely returns 404.
     console.error(`pulse non-ok (status ${r.status}):`, r.data);
     process.exit(0);
   }

package/scripts/gds/push-path-brief.js

@@ -18,7 +18,7 @@
 // strand-watch.js. On the server-publish path (pushVia() 'server' — no authenticated
 // gh, i.e. a dev box or any credential-less checkout) it prints ONE line stating the
 // credential model and where the truth about published work lives
-// (GET /api/gds/tasks/:id/publish-status). On a laptop that pushes locally
+// (GET /api/bongos/tasks/:id/publish-status). On a laptop that pushes locally
 // (pushVia() 'local') it prints NOTHING — a line that fires on every healthy laptop
 // becomes wallpaper and the real one gets scrolled past (the strand-watch lesson).
 //
@@ -40,7 +40,7 @@ const BRIEF = 'This machine holds NO GitHub push credential — BY DESIGN (ADR 0
   + 'git push / ls-remote / fetch against origin fail with auth errors here, and that is not a fault to fix. '
   + 'Landing is server-mediated — /builder-ship uploads a git bundle and the SERVER pushes, opens the PR, and lands it. '
   + 'NEVER ask the owner for a PAT or credential; that request is always wrong on this machine. '
-  + 'To see whether work reached GitHub, use GET /api/gds/tasks/:id/publish-status — never raw git probes.';
+  + 'To see whether work reached GitHub, use GET /api/bongos/tasks/:id/publish-status — never raw git probes.';
 
 // briefLine(via) — the unit-testable core: the SessionStart line for this publish
 // path, or null. Null IS the silence (the laptop case, and the undetermined case —

package/scripts/gds/reauth.js

@@ -11,7 +11,7 @@
 // getting back in — the slow Device Flow, terminal codes, Gemini-key prompts — is
 // not something to keep. This script is the fix:
 //
-//   1. Detect — is the current session still valid? (GET /api/gds/me)
+//   1. Detect — is the current session still valid? (GET /api/bongos/me)
 //        valid   → print who you are + exit 0. Nothing to do.
 //        invalid → exit 10 ("re-auth needed") after opening the browser.
 //   2. Guide — open the builder's Settings page in the default browser (where

package/scripts/gds/recall.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // scripts/gds/recall.js — one-call project-knowledge search (task 955, V4.R17 /
-// ADR 0060). Wraps POST /api/gds/search: lexical (FTS + pg_trgm) fused with RRF,
+// ADR 0060). Wraps POST /api/bongos/search: lexical (FTS + pg_trgm) fused with RRF,
 // rank/owner-scoped server-side (a sub-Metic caller never sees protected docs;
 // you only ever see your own private chunks). Authenticated — reads the builder
 // session like every other /builder-* CLI.

package/scripts/gds/redteam-patrol.js

@@ -28,7 +28,7 @@
 //
 // Filing: DRY-RUN by default (prints what it would file). --file POSTs one
 // report PER CLASS (max severity within the class, details in repro_steps_md)
-// to /api/gds/security/reports. --canary proves the end-to-end pipe: plants a
+// to /api/bongos/security/reports. --canary proves the end-to-end pipe: plants a
 // constructed token, asserts the scanner catches it, files a low "[canary]"
 // report, and dispute-closes it so the queue stays clean.
 //
@@ -317,14 +317,14 @@ function filingBlocker() {
 
 async function fileReport(report) {
   const { apiCall } = require('./cli-lib.js');
-  const r = await apiCall('POST', '/api/gds/security/reports', report);
+  const r = await apiCall('POST', '/api/bongos/security/reports', report);
   const row = (r.data && r.data.report) || {};
   return row.id || null;
 }
 
 async function disputeReport(id, note) {
   const { apiCall } = require('./cli-lib.js');
-  return apiCall('POST', `/api/gds/security/reports/${id}/dispute`, { note });
+  return apiCall('POST', `/api/bongos/security/reports/${id}/dispute`, { note });
 }
 
 // ---------- canary ----------

package/scripts/gds/render-ideas.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 // Renders generative-ideas.md from the GDS idea_inbox table.
 //
-// Reads via GET /api/gds/inbox (authenticated). Writes a generated markdown
+// Reads via GET /api/bongos/inbox (authenticated). Writes a generated markdown
 // view to the repo's top-level generative-ideas.md. The file is overwritten
 // on every run — manual edits will not survive. Capture via /builder-capture
 // or `node scripts/gds/capture.js`; triage via /builder-triage or the API.
 //
-// Note (2026-05-10): the current GET /api/gds/inbox endpoint returns open
+// Note (2026-05-10): the current GET /api/bongos/inbox endpoint returns open
 // ideas only (see src/bongos/inbox.js listOpenIdeas). The "Recently Promoted",
 // "Recently Discarded", and "Merged" sections will be empty until the API
 // is extended to expose those statuses. The script is forward-compatible:
@@ -33,7 +33,7 @@ const HEADER = `<!-- GENERATED FILE — Edit via /builder-capture or /builder-tr
 >
 > **Capture an idea:** \`node scripts/gds/capture.js "short title"\` (or the \`/builder-capture\` slash command).
 >
-> **Triage open ideas:** \`/idea-triage\` (or \`PATCH /api/gds/inbox/<id>\` with \`{ status: 'promoted' | 'discarded' | 'merged', promoted_to_task_id: N }\`).
+> **Triage open ideas:** \`/idea-triage\` (or \`PATCH /api/bongos/inbox/<id>\` with \`{ status: 'promoted' | 'discarded' | 'merged', promoted_to_task_id: N }\`).
 `;
 
 function fmtTimestamp(iso) {
@@ -102,13 +102,13 @@ function renderSection(heading, ideas, emptyMsg) {
 }
 
 async function fetchAllIdeas() {
-  // GET /api/gds/inbox currently returns open ideas only. We request the max
+  // GET /api/bongos/inbox currently returns open ideas only. We request the max
   // limit so this works as the inbox grows. When the API is extended to
   // return other statuses, this script will pick them up automatically.
   const api = await cliClient();
   const { ok, status, data } = await api.inbox.getInbox({ query: { limit: 500 } });
   if (!ok) {
-    throw new Error(`GET /api/gds/inbox failed: HTTP ${status} ${JSON.stringify(data)}`);
+    throw new Error(`GET /api/bongos/inbox failed: HTTP ${status} ${JSON.stringify(data)}`);
   }
   return data.ideas || [];
 }

package/scripts/gds/repo-metrics.js

@@ -5,7 +5,7 @@
 // "You can't manage what you don't measure." This dependency-free CLI shells
 // out to git / wc / knip and emits a JSON snapshot of repo health, then upserts
 // it into repo_health_snapshots (idempotent on calendar date — rerun same day
-// = upsert, not a new row). The latest row feeds /api/gds/public/repo-health,
+// = upsert, not a new row). The latest row feeds /api/bongos/public/repo-health,
 // which renders a trend tile on status.example.com.
 //
 // What the snapshot contains:

package/scripts/gds/sandbox-stage.js

@@ -219,11 +219,11 @@ function restartPreview(deps = {}) {
 // task 1002607: the discriminator probe URL — same origin as the health URL, at
 // the API healthz path only the FULL server mounts. Pure + exported for tests.
 function apiHealthzProbeUrl(healthUrl) {
-  try { return new URL('/api/gds/healthz', healthUrl).toString(); } catch { return null; }
+  try { return new URL('/api/bongos/healthz', healthUrl).toString(); } catch { return null; }
 }
 
 // task 1002607: is the thing answering the health URL actually the MAIN server?
-// The game-only preview entry (ADR 0052) mounts no /api/gds, so a 200 from the
+// The game-only preview entry (ADR 0052) mounts no /api/bongos, so a 200 from the
 // API healthz proves the answerer is the full server — whose default bind is the
 // SAME 127.0.0.1:3000 the box health check probes — not the preview. A probe
 // error/404 means "not the main server", which is the expected preview answer.
@@ -254,7 +254,7 @@ async function waitHealthy(deps = {}) {
         if (await answeredByMainServer(healthUrl, fetchImpl)) {
           return {
             ok: false,
-            reason: `${healthUrl} is answered by the MAIN server (/api/gds/healthz responded 200), not the game preview — the preview did not start (its port is taken by the full server)`,
+            reason: `${healthUrl} is answered by the MAIN server (/api/bongos/healthz responded 200), not the game preview — the preview did not start (its port is taken by the full server)`,
           };
         }
         return { ok: true };

package/scripts/gds/seed-adopt-tasks.js

@@ -38,7 +38,7 @@ const TASKS = [
   const idByRef = {};
   // Phase 1: create tasks (idempotent on source_ref) + link the criterion.
   for (const t of TASKS) {
-    const create = await apiCall('POST', '/api/gds/tasks', {
+    const create = await apiCall('POST', '/api/bongos/tasks', {
       version_id: 'BONGOS-V1',
       goal_id: GOAL_ID,
       title: t.title,
@@ -54,7 +54,7 @@ const TASKS = [
     const id = task && task.id;
     if (!id) { console.log(`  ${t.ref}: CREATE FAILED — ${create.status} ${JSON.stringify(create.data).slice(0, 160)}`); continue; }
     idByRef[t.ref] = id;
-    const link = await apiCall('POST', `/api/gds/tasks/${id}/criteria`, { criterion_ids: t.crit });
+    const link = await apiCall('POST', `/api/bongos/tasks/${id}/criteria`, { criterion_ids: t.crit });
     console.log(`  ${t.ref} -> task ${id} (${t.kind}, P${t.priority}, goal ${task.goal_id}) · criterion ${link.status === 200 ? 'ok' : (JSON.stringify(link.data).slice(0, 120))}`);
   }
   // Phase 2: dependency edges (idempotent on (task_id, depends_on_task_id)).
@@ -65,7 +65,7 @@ const TASKS = [
     const localDepIds = t.deps.map((d) => idByRef[d]).filter(Boolean);
     const allDeps = [...localDepIds, ...t.extDeps];
     for (const depId of allDeps) {
-      const r = await apiCall('POST', `/api/gds/tasks/${id}/dependencies`, { depends_on_task_id: depId });
+      const r = await apiCall('POST', `/api/bongos/tasks/${id}/dependencies`, { depends_on_task_id: depId });
       console.log(`  ${t.ref}(${id}) -> ${depId} ${r.status === 200 || r.status === 201 ? 'ok' : (JSON.stringify(r.data).slice(0, 120))}`);
     }
   }

package/scripts/gds/seed-board-room-tasks.js

@@ -15,7 +15,7 @@ const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json'
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function api(method, path, body, _tries = 0) {
   await sleep(500); // base throttle to stay under the per-IP rate limit
-  const res = await fetch(`${BASE}/api/gds${path}`, {
+  const res = await fetch(`${BASE}/api/bongos${path}`, {
     method, headers: H, body: body ? JSON.stringify(body) : undefined,
   });
   const text = await res.text();

package/scripts/gds/seed-bongos-app-tasks.js

@@ -6,8 +6,8 @@
 // Design home: the "Bongos App — V1" plan artifact (favicon 🥁).
 //
 // Shape mirrors seed-bongos-tasks.js exactly:
-//   - POST /api/gds/tasks   { version_id:'BONGOS-V1', criterion_ids:['C1'], ... }
-//   - POST /api/gds/tasks/:id/dependencies   { depends_on_task_ids:[...] }
+//   - POST /api/bongos/tasks   { version_id:'BONGOS-V1', criterion_ids:['C1'], ... }
+//   - POST /api/bongos/tasks/:id/dependencies   { depends_on_task_ids:[...] }
 //   - idempotent on source_ref (skips already-created); deps idempotent server-side.
 // Run migration 120_bongos_v1_planning_seed.sql FIRST so the version + C1..C4 exist.
 // After this runs, promote the zero-dependency tasks (R01/R02/R03) to 'ready'

package/scripts/gds/seed-bongos-coreB-tranche1-tasks.js

@@ -53,12 +53,12 @@ async function post(path, body) {
       criterion_ids: ['C7'],
       source: 'planning', source_ref: `BONGOS-V1-coreB-${t.ref}`,
     };
-    let { status, json } = await post('/api/gds/tasks', body);
+    let { status, json } = await post('/api/bongos/tasks', body);
     let id = json.id || (json.task && json.task.id);
     if (!id && t.kind === 'verify') {
       // memory: kind=verify has 500'd before (idea #357). Fall back, keep going.
       console.log(`  ${t.ref}: kind=verify failed (${json.error || status}); retrying as kind=feature`);
-      ({ status, json } = await post('/api/gds/tasks', { ...body, kind: 'feature' }));
+      ({ status, json } = await post('/api/bongos/tasks', { ...body, kind: 'feature' }));
       id = json.id || (json.task && json.task.id);
     }
     if (!id) { console.log(`  ${t.ref}: CREATE FAILED — ${status} ${JSON.stringify(json).slice(0, 160)}`); continue; }
@@ -73,7 +73,7 @@ async function post(path, body) {
     for (const dep of t.deps) {
       const depId = idByRef[dep];
       if (!depId) { console.log(`  ${t.ref}: dep ${dep} not created — skip`); continue; }
-      const { status, json } = await post(`/api/gds/tasks/${id}/dependencies`, { depends_on_task_id: depId });
+      const { status, json } = await post(`/api/bongos/tasks/${id}/dependencies`, { depends_on_task_id: depId });
       console.log(`  ${t.ref}(${id}) depends on ${dep}(${depId}) -> ${status === 200 || status === 201 ? 'ok' : (json.error || status)}`);
     }
   }

package/scripts/gds/seed-bongos-coreB-tranche2-tasks.js

@@ -69,19 +69,19 @@ async function post(path, body) {
       criterion_ids: ['C7'],
       source: 'planning', source_ref: `BONGOS-V1-coreB-${t.ref}`,
     };
-    let { status, json } = await post('/api/gds/tasks', body);
+    let { status, json } = await post('/api/bongos/tasks', body);
     let id = json.id || (json.task && json.task.id);
     if (!id && t.kind === 'verify') {
       // memory: kind=verify has 500'd before (idea #357). Fall back, keep going.
       console.log(`  ${t.ref}: kind=verify failed (${json.error || status}); retrying as kind=feature`);
-      ({ status, json } = await post('/api/gds/tasks', { ...body, kind: 'feature' }));
+      ({ status, json } = await post('/api/bongos/tasks', { ...body, kind: 'feature' }));
       id = json.id || (json.task && json.task.id);
     }
     if (!id) { console.log(`  ${t.ref}: CREATE FAILED — ${status} ${JSON.stringify(json).slice(0, 160)}`); continue; }
     idByRef[t.ref] = id;
     // Link C7 explicitly (criterion_ids at create is not honored on this build;
     // the /criteria endpoint is idempotent — re-adding an existing link is a no-op).
-    const link = await post(`/api/gds/tasks/${id}/criteria`, { criterion_ids: ['C7'] });
+    const link = await post(`/api/bongos/tasks/${id}/criteria`, { criterion_ids: ['C7'] });
     console.log(`  ${t.ref} -> task ${id} (${t.kind}, P${t.priority}) · C7 link ${link.status === 200 ? 'ok' : (link.json.error || link.status)}`);
   }
   // Phase 2: wire dependencies (idempotent on (task_id, depends_on_task_id)).
@@ -92,7 +92,7 @@ async function post(path, body) {
     for (const dep of t.deps) {
       const depId = idByRef[dep];
       if (!depId) { console.log(`  ${t.ref}: dep ${dep} not created — skip`); continue; }
-      const { status, json } = await post(`/api/gds/tasks/${id}/dependencies`, { depends_on_task_id: depId });
+      const { status, json } = await post(`/api/bongos/tasks/${id}/dependencies`, { depends_on_task_id: depId });
       console.log(`  ${t.ref}(${id}) depends on ${dep}(${depId}) -> ${status === 200 || status === 201 ? 'ok' : (json.error || status)}`);
     }
   }

package/scripts/gds/seed-bongos-tasks.js

@@ -5,8 +5,8 @@
 // instance 1). Design doc: artifact 02bcca71 (the bongos toolkit).
 //
 // Shape mirrors seed-medusa-tasks.js exactly:
-//   - POST /api/gds/tasks   { version_id:'GDS-V4', criterion_ids:['C8'], ... }
-//   - POST /api/gds/tasks/:id/dependencies   { depends_on_task_ids:[...] }
+//   - POST /api/bongos/tasks   { version_id:'GDS-V4', criterion_ids:['C8'], ... }
+//   - POST /api/bongos/tasks/:id/dependencies   { depends_on_task_ids:[...] }
 //   - idempotent on source_ref (skips already-created); deps idempotent server-side.
 //
 // Display R## numbers are assigned dynamically from the current max V4.R## in
@@ -81,12 +81,12 @@ A \`curl -fsSL https://get.bongos.dev | sh\` bootstrap (detects OS/arch, downloa
   },
   {
     key: 'P4A',
-    title: 'Instance manifest endpoint — GET /api/gds/instance (brand + modules + repo)',
+    title: 'Instance manifest endpoint — GET /api/bongos/instance (brand + modules + repo)',
     description: `Part of Cloud Bongos / C8. Cross-ref: R53 (branding-contract layer), R54 (feature-module selection). This is the read-API over those two configs — the conda "environment.yml" a CLI fetches to configure itself.
 
 A small public, read-only endpoint returning the instance descriptor assembled from the R53 branding contract + the R54 module flags: product/instance name + brand (identity, copy, theme — NO secrets), enabled feature-modules, the GitHub repo binding, the rank ladder, supported auth methods (device-flow / app-pair), admission policy (invite-only vs open), and whether a managed dev-box backend is available. So \`bongos login <url>\` brands itself, knows the repo for \`--local\`, and hides verbs an instance doesn't run (e.g. no \`box\` if dev-box is off). Today GET /healthz returns only { ok, auth_configured } — this is a genuine gap.
 
-**Done when:** GET /api/gds/instance returns a documented manifest assembled from the branding contract + module flags, contains no secrets/topology, is fetchable pre-auth (CORS read), and the CLI can brand + feature-gate itself from it. Depends on R53/R54 so the brand + module sources exist.`,
+**Done when:** GET /api/bongos/instance returns a documented manifest assembled from the branding contract + module flags, contains no secrets/topology, is fetchable pre-auth (CORS read), and the CLI can brand + feature-gate itself from it. Depends on R53/R54 so the brand + module sources exist.`,
     kind: 'feature', discipline: 'engineer', priority: 3,
     est_minutes: 240, manual_degree: 2, credits_reward: 50,
     touches: ['src/bongos/routes/', 'src/bongos/'], criteria: ['C8'], deps: ['R53', 'R54'],
@@ -96,7 +96,7 @@ A small public, read-only endpoint returning the instance descriptor assembled f
     title: 'bongos login <instance> (instance-agnostic) + stranger access-request flow; folds in init/upgrade',
     description: `Part of Cloud Bongos / C8. Cross-ref: P1, P4A (manifest), R64 (\`medusa/bongos upgrade\`), R65 (\`init\`), ADR 0050/0057/0059 (admission).
 
-\`bongos login <instance-url>\` fetches the P4A manifest, runs the GitHub device-flow (browser-click, no token paste — the UI-first rule), stores a per-instance scoped session, and brands the CLI for that instance. For someone NOT yet admitted, it files the public POST /api/gds/access-requests (their GitHub username) and polls — telling them "an Archon will approve you with a 👍 in Discord" — until admission flips, then completes sign-in. No GitHub collaborator invite is involved. Default admission is invite-only. Also folds the already-planned \`bongos init\` (scaffold a brand-new instance, R65) and \`bongos upgrade\` (R64) in as subcommands of the same CLI.
+\`bongos login <instance-url>\` fetches the P4A manifest, runs the GitHub device-flow (browser-click, no token paste — the UI-first rule), stores a per-instance scoped session, and brands the CLI for that instance. For someone NOT yet admitted, it files the public POST /api/bongos/access-requests (their GitHub username) and polls — telling them "an Archon will approve you with a 👍 in Discord" — until admission flips, then completes sign-in. No GitHub collaborator invite is involved. Default admission is invite-only. Also folds the already-planned \`bongos init\` (scaffold a brand-new instance, R65) and \`bongos upgrade\` (R64) in as subcommands of the same CLI.
 
 **Done when:** \`bongos login <any-instance-url>\` works end-to-end including the not-yet-admitted path (files the request, polls, completes once approved); the CLI is instance-agnostic (no hard-coded example); \`init\`/\`upgrade\` are reachable subcommands.`,
     kind: 'feature', discipline: 'engineer', priority: 3,

package/scripts/gds/seed-bongos-v1-idea-routing-tasks.js

@@ -28,7 +28,7 @@ const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json'
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function api(method, path, body, _tries = 0) {
   await sleep(400); // base throttle to stay under the per-IP rate limit
-  const res = await fetch(`${BASE}/api/gds${path}`, {
+  const res = await fetch(`${BASE}/api/bongos${path}`, {
     method, headers: H, body: body ? JSON.stringify(body) : undefined,
   });
   const text = await res.text();

package/scripts/gds/seed-bongos-v1-seo-tasks.js

@@ -16,7 +16,7 @@ const H = { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json'
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function api(method, path, body, _tries = 0) {
   await sleep(400); // base throttle to stay under the per-IP rate limit
-  const res = await fetch(`${BASE}/api/gds${path}`, {
+  const res = await fetch(`${BASE}/api/bongos${path}`, {
     method, headers: H, body: body ? JSON.stringify(body) : undefined,
   });
   const text = await res.text();