@bongos/core 1.19.804 → 1.19.805

package/scripts/gds/start.js

@@ -732,7 +732,7 @@ async function main() {
   const rawClaimable = r.data.claimable || [];
 
   // Discipline routing (V3.R81 / #299). preferred_disciplines lives on the
-  // builder row (migration 027), surfaced via /api/gds/me.
+  // builder row (migration 027), surfaced via /api/bongos/me.
   const preferred = (me.ok && Array.isArray(me.data?.builder?.preferred_disciplines))
     ? me.data.builder.preferred_disciplines
     : [];

package/scripts/gds/status.js

@@ -5,7 +5,7 @@
 // ~10-step prose archaeology (grep seed file → eyeball "Gates R55–R63" →
 // re-query each task) that motivated the task. Reads the structured
 // criterion↔task link (task_criteria, migration 055) via the public endpoint
-// GET /api/gds/versions/:id/progress.
+// GET /api/bongos/versions/:id/progress.
 //
 // Usage:
 //   node scripts/gds/status.js                  # all criteria, default version
@@ -59,7 +59,7 @@ function parseArgs(argv) {
 async function fetchProgress(version) {
   let res;
   try {
-    res = await fetch(`${API_BASE}/api/gds/versions/${encodeURIComponent(version)}/progress`, {
+    res = await fetch(`${API_BASE}/api/bongos/versions/${encodeURIComponent(version)}/progress`, {
       headers: { 'User-Agent': require('../../src/branding').userAgent() },
     });
   } catch (err) {

package/scripts/gds/strand-watch.js

@@ -145,7 +145,7 @@ async function check({ nowMs = Date.now(), timeoutMs = DEFAULT_TIMEOUT_MS, confi
   let pages;
   try {
     pages = await Promise.all(WATCHED.map(async (status) => {
-      const res = await withTimeout(call('GET', `/api/gds/tasks?status=${status}&limit=${PAGE_LIMIT}`), status);
+      const res = await withTimeout(call('GET', `/api/bongos/tasks?status=${status}&limit=${PAGE_LIMIT}`), status);
       const body = res && (res.data || res);
       const tasks = body && Array.isArray(body.tasks) ? body.tasks : null;
       if (!tasks) throw new Error(`unexpected shape from /tasks?status=${status}`);

package/scripts/gds/triage.js

@@ -158,7 +158,7 @@ async function listOpenIdeas() {
   // GET /inbox in routes/inbox.js only returns open ideas regardless of
   // query — but the explicit param is forward-safe.
   if (!r.ok) {
-    throw new Error(`GET /api/gds/inbox failed: ${r.status} ${JSON.stringify(r.data)}`);
+    throw new Error(`GET /api/bongos/inbox failed: ${r.status} ${JSON.stringify(r.data)}`);
   }
   return r.data?.ideas ?? [];
 }
@@ -167,7 +167,7 @@ async function patchIdea(id, patch) {
   const api = await cliClient();
   const r = await api.inbox.patchInboxId({ id, body: patch });
   if (!r.ok) {
-    throw new Error(`PATCH /api/gds/inbox/${id} failed: ${r.status} ${JSON.stringify(r.data)}`);
+    throw new Error(`PATCH /api/bongos/inbox/${id} failed: ${r.status} ${JSON.stringify(r.data)}`);
   }
   return r.data?.idea;
 }
@@ -254,7 +254,7 @@ function applyGoalAnswer(defaultGoalId, rawAnswer) {
 }
 
 async function createTask({ versionId, title, description, priority, sourceRef, goalId = null }) {
-  // (The old note here said POST /api/gds/tasks does not accept 'kind'. That is
+  // (The old note here said POST /api/bongos/tasks does not accept 'kind'. That is
   // no longer true — routes/tasks.js takes it, and the hall promote path already
   // sends it. Left un-sent from THIS path deliberately: changing what kind a
   // triaged promotion lands with is a behaviour change task R13 was not asked to
@@ -284,7 +284,7 @@ async function createTask({ versionId, title, description, priority, sourceRef,
   const api = await cliClient();
   const r = await api.tasks.postTasks({ body });
   if (!r.ok) {
-    throw new Error(`POST /api/gds/tasks failed: ${r.status} ${JSON.stringify(r.data)}`);
+    throw new Error(`POST /api/bongos/tasks failed: ${r.status} ${JSON.stringify(r.data)}`);
   }
   return r.data?.task;
 }

package/scripts/gds/version-close.js

@@ -5,8 +5,8 @@
 //
 // What it does:
 //   1. Verifies the version is ready to close (calls
-//      GET /api/gds/versions/close-suggestions and checks the gate).
-//   2. Lists shipped tasks for the version (GET /api/gds/tasks) and drafts a
+//      GET /api/bongos/versions/close-suggestions and checks the gate).
+//   2. Lists shipped tasks for the version (GET /api/bongos/tasks) and drafts a
 //      <scope>-shipped.md archive grouped by kind/bucket from value_summary.
 //   3. Identifies carry-over candidates (backlog + ready) and drafts a
 //      next-version scope stub (e.g. limitations/pms-v3.md) with a

package/scripts/hall-preview/README.md

@@ -4,7 +4,7 @@ The dev-box sandbox previews the **game only** — `/builders` 404s there (idea
 hall-ui changes are reviewed here: a DB-less fixture server that serves the **real**
 `modules/hall-ui/public` files through the **real** serving seams (boot-time `?v=`
 content-hash stamping, `{{token}}` replacement, `window.__BRANDING__`/`__MODULES__`
-injection, theme markup), answering every `/api/gds|bongos/*` read from checked-in
+injection, theme markup), answering every `/api/bongos|bongos/*` read from checked-in
 fixtures. Proven recipe from tasks 1723/1742, checked in by task 2167.
 
 ## Quickstart

package/scripts/hall-preview/server.js

@@ -5,7 +5,7 @@
 // so hall-ui changes are reviewed HERE: a tiny express app that serves the real
 // modules/hall-ui/public files through the REAL serving seams (boot-time ?v=
 // stamping, {{token}} replacement, __BRANDING__/__MODULES__ injection, theme
-// markup) with the /api/gds|bongos reads answered from checked-in fixtures.
+// markup) with the /api/bongos|bongos reads answered from checked-in fixtures.
 // Boots DB-less (pg pools connect lazily). Proven recipe from tasks 1723/1742,
 // finally checked in.
 //

package/src/bongos/auth-admission.js

@@ -62,7 +62,7 @@ async function reportMembershipCheckIn({ githubId, githubLogin, displayName, ava
   if (!idp) return;
   const kind = membershipKind({ githubLogin });
   try {
-    await fetch(`${idp.origin}/api/gds/sso/membership/check-in`, {
+    await fetch(`${idp.origin}/api/bongos/sso/membership/check-in`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
       body: JSON.stringify({
@@ -159,7 +159,7 @@ async function reportActivityRollup({ builderId, githubId = null }) {
     if (!/^\d+$/.test(String(ghId ?? ''))) return;
     const shipped = await pool.query('SELECT count(*)::int AS n FROM tasks WHERE shipped_by = $1', [builderId]);
     const recentShips = await recentShipsForRollup(builderId);
-    await fetch(`${idp.origin}/api/gds/sso/activity/rollup`, {
+    await fetch(`${idp.origin}/api/bongos/sso/activity/rollup`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
       body: JSON.stringify({
@@ -434,7 +434,7 @@ async function readApplicantProfileFromHub(githubId) {
   const idp = loadIdpConfig();
   if (!idp || githubId == null) return null;
   try {
-    const r = await fetch(`${idp.origin}/api/gds/sso/applicant-profile`, {
+    const r = await fetch(`${idp.origin}/api/bongos/sso/applicant-profile`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
       signal: AbortSignal.timeout(APPLICANT_PROFILE_TIMEOUT_MS),

package/src/bongos/auth-idp.js

@@ -31,7 +31,7 @@ const { loadIdpConfig } = require('./auth-config.js');
 const { newSessionToken } = require('./auth-github.js');
 
 function idpAuthorizeUrl(origin, clientId, state, redirectUri) {
-  const u = new URL(`${String(origin).replace(/\/+$/, '')}/api/gds/sso/authorize`);
+  const u = new URL(`${String(origin).replace(/\/+$/, '')}/api/bongos/sso/authorize`);
   u.searchParams.set('client_id', clientId);
   u.searchParams.set('redirect_uri', redirectUri);
   u.searchParams.set('state', state);
@@ -48,7 +48,7 @@ function buildIdpAuthorizeUrl(state, redirectUri) {
 // with the instance's client_id + client_secret; the hub returns IDENTITY ONLY
 // (github_id, github_login, display_name, avatar_url) — never a rank (ADR 0141 §2).
 async function exchangeIdpCode({ code, redirectUri, idp }) {
-  const res = await fetch(`${idp.origin}/api/gds/sso/token`, {
+  const res = await fetch(`${idp.origin}/api/bongos/sso/token`, {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',

package/src/bongos/auth.js

@@ -3,11 +3,11 @@
 // Two flows that produce the same `builder_sessions` row:
 //
 // - Device Flow (CLI):
-//     1. POST /api/gds/auth/device/start
+//     1. POST /api/bongos/auth/device/start
 //          → { user_code, verification_uri, device_code, interval, expires_in }
 //          The CLI shows user_code to the user and asks them to open
 //          verification_uri in a browser.
-//     2. CLI polls POST /api/gds/auth/device/poll { device_code }
+//     2. CLI polls POST /api/bongos/auth/device/poll { device_code }
 //          → 'pending' | 'slow_down' | 'expired' | 'denied' |
 //            { token, builder: {...} }
 //
@@ -364,7 +364,7 @@ async function requireBuilder(req, res, next) {
 // and also falls back to Referer, so this is belt-and-braces for navigations
 // where Referer may be stripped. Returns '' if the host can't be determined.
 function signInWithReturn(req) {
-  const base = '/api/gds/auth/web/start';
+  const base = '/api/bongos/auth/web/start';
   const proto = req.headers['x-forwarded-proto'] || (req.secure ? 'https' : 'http');
   const host = req.headers['x-forwarded-host'] || req.headers['host'];
   if (!host) return base;

package/src/bongos/db.js

@@ -737,7 +737,7 @@ async function revokeSession(token) {
 
 // revokeSessionById — V3.R38 / #259. Kill ONE session by primary key. Returns
 // the number of rows revoked (0 if id didn't exist or was already revoked, 1
-// otherwise). Used by POST /api/gds/auth/revoke (Archon-only).
+// otherwise). Used by POST /api/bongos/auth/revoke (Archon-only).
 
 async function revokeSessionById(sessionId) {
   const { rowCount } = await pool.query(
@@ -751,7 +751,7 @@ async function revokeSessionById(sessionId) {
 
 // revokeAllSessionsForBuilder — V3.R38 / #259. Kill EVERY non-revoked session
 // for a single builder. Returns the count of sessions revoked. Used by:
-//   * POST /api/gds/auth/revoke-all (Archon-only direct call)
+//   * POST /api/bongos/auth/revoke-all (Archon-only direct call)
 //   * setBuilderRank when newRank < oldRank (rank-change-near-instant per C7)
 
 async function revokeAllSessionsForBuilder(builderId) {

package/src/bongos/llm-cache.js

@@ -151,7 +151,7 @@ async function lookup(cacheKey, { tokensSavedEst = 0 } = {}) {
   // must never take down the thing it accelerates.
   if (_apiCall) {
     try {
-      const r = await _apiCall('POST', '/api/gds/llm-cache/lookup',
+      const r = await _apiCall('POST', '/api/bongos/llm-cache/lookup',
         { cache_key: cacheKey, tokens_saved_est: est }, { allowUnauthenticated: true });
       if (r && r.ok && r.data && r.data.hit) return r.data.result || null;
     } catch (_) { /* network/auth error → miss */ }
@@ -185,7 +185,7 @@ async function store(spec, { resultStdout, resultCostUsd = 0 } = {}) {
   // cost server-side; best-effort: any error → no-store (never throws).
   if (_apiCall) {
     try {
-      const r = await _apiCall('POST', '/api/gds/llm-cache/store',
+      const r = await _apiCall('POST', '/api/bongos/llm-cache/store',
         { spec, result_stdout: resultStdout, result_cost_usd: Number(resultCostUsd) || 0 },
         { allowUnauthenticated: true });
       return !!(r && r.ok && r.data && r.data.stored);

package/src/bongos/metrics.js

@@ -14,7 +14,7 @@
 //   - process/runtime: uptime, RSS, heap, CPU (counter), event-loop lag, build_info
 //   - HTTP (from httpMiddleware): gds_http_requests_total{method,route,status} +
 //     gds_http_request_duration_seconds histogram — route normalized to a
-//     low-cardinality template so /api/gds/tasks/1380 and /…/1381 share a series.
+//     low-cardinality template so /api/bongos/tasks/1380 and /…/1381 share a series.
 //     Gives error-rate + 4xx/5xx per route. 401/403 also bump gds_auth_failures_total.
 //   - DB gauges (collected at scrape, read-only — never instruments the gate-floor
 //     ship pipeline): tasks-by-status, claims (all-time + active), builders-by-rank,

package/src/bongos/middleware/audit.js

@@ -1,13 +1,13 @@
 // src/bongos/middleware/audit.js — append-only audit log for authenticated writes
 // (V3.R35 / #256).
 //
-// Wire-up: mounted INSIDE the /api/gds sub-router by routes.js, AFTER the JSON
+// Wire-up: mounted INSIDE the /api/bongos sub-router by routes.js, AFTER the JSON
 // body parser and AFTER each route's auth middleware has run (the middleware
 // fires on res 'finish', so by then auth either populated req.builder or sent
 // a 401 — both cases are handled below).
 //
 // What it captures:
-//   - Every authenticated POST/PATCH/PUT/DELETE that the /api/gds router
+//   - Every authenticated POST/PATCH/PUT/DELETE that the /api/bongos router
 //     served. Reads (GET) are explicitly skipped — they're high-volume and
 //     low-signal for forensics.
 //   - The redacted request body, the response status the client actually saw,
@@ -161,7 +161,7 @@ function clientIp(req) {
 // (e.g. 404 from the router), fall back to req.path.
 function routePattern(req) {
   if (req.route && req.route.path) {
-    // baseUrl carries '/api/gds' plus any sub-router prefix; combining them
+    // baseUrl carries '/api/bongos' plus any sub-router prefix; combining them
     // yields the full pattern. trim trailing slash for tidiness.
     const base = (req.baseUrl || '').replace(/\/+$/, '');
     const tail = req.route.path === '/' ? '' : req.route.path;

package/src/bongos/middleware/rate-limit.js

@@ -1,7 +1,7 @@
 // src/bongos/middleware/rate-limit.js — V3.R34 (#255).
 //
 // Five sliding-window in-memory limiters. The first two are the GLOBAL pair and
-// protect write methods on /api/gds/* only — read methods (GET, HEAD, OPTIONS)
+// protect write methods on /api/bongos/* only — read methods (GET, HEAD, OPTIONS)
 // bypass them entirely; #3, #4 and #5 are mounted per-surface to close exactly that
 // gap where an unauthenticated READ is itself the abuse.
 //

package/src/bongos/platform-visibility-gate.js

@@ -127,7 +127,7 @@ function isGated() { return mode() === GATED; }
 
 // Express routes case-insensitively and tolerates one trailing slash, so the
 // exempt test must see the path the way the router will — otherwise a probe
-// spelled `/HEALTHZ` or `/api/gds/instance/` is refused while the router would
+// spelled `/HEALTHZ` or `/api/bongos/instance/` is refused while the router would
 // have served it. Mismatches still fail CLOSED; this only keeps the list honest.
 function normalizePath(p) {
   let s = String(p || '').toLowerCase();
@@ -160,7 +160,7 @@ function productName() {
 // subdomain, a dev port, or plain http would otherwise be dropped at the default
 // page. Only a GET/HEAD path is safe to come back to; anything else returns to '/'.
 function signInHref(req) {
-  const base = '/api/gds/auth/web/start';
+  const base = '/api/bongos/auth/web/start';
   const back = (req.method === 'GET' || req.method === 'HEAD') ? relativeReturn(req.originalUrl) : null;
   return back ? `${base}?return=${encodeURIComponent(back)}` : base;
 }

package/src/bongos/routes/_helpers.js

@@ -409,7 +409,7 @@ function hardenRouterStack(router, seen = new Set()) {
 // Read-only, no-auth, no-secret routes, so a static '*' is safe; the caller
 // mounts it scoped to a `/public…` prefix (passed as `scope` for documentation
 // + signature parity) so it can't leak onto the authenticated routes on the same
-// /api/gds base. Behavior is BYTE-IDENTICAL to the two copy-pasted blocks it
+// /api/bongos base. Behavior is BYTE-IDENTICAL to the two copy-pasted blocks it
 // replaces (routes/analytics.js + routes/public.js): sets
 // Access-Control-Allow-Origin:*, and answers an OPTIONS preflight with
 // Allow-Methods 'GET, OPTIONS' + Allow-Headers 'Content-Type' and a 204.

package/src/bongos/routes/audit-log.js

@@ -14,7 +14,7 @@ const VALID_METHODS = new Set(['POST', 'PATCH', 'PUT', 'DELETE']);
 module.exports = function buildAuditLogRouter() {
   const router = express.Router();
 
-  // GET /api/gds/audit-log?limit=&offset=&builder_id=&method=
+  // GET /api/bongos/audit-log?limit=&offset=&builder_id=&method=
   //
   // Paginated, newest-first. Clamps:
   //   limit  → 1..500, default 100

package/src/bongos/routes/auth.js

@@ -92,7 +92,7 @@ function renderAuthErrorPage(heading, detail, opts = {}) {
     catch { return AUTH_ERROR_FALLBACK; }
   })();
   const subtitle = opts.subtitle || copy.subtitle;
-  const cta = opts.cta || { href: opts.startHref || '/api/gds/auth/web/start', label: copy.ctaLabel };
+  const cta = opts.cta || { href: opts.startHref || '/api/bongos/auth/web/start', label: copy.ctaLabel };
   const note = opts.note || "If this keeps happening, the GitHub OAuth app's authorized callback URL may be misconfigured. See docs/recipes/ops-gotchas.md (GitHub OAuth section).";
   // The instance name in the tab title comes from the branding pack, never a
   // hardcoded host brand — a non-OTB instance sees its own name (ADR 0062 §3).
@@ -165,7 +165,7 @@ function renderAccessPendingPage(login, startHref) {
 </header>
 <main>
   <section class="scroll">
-    <div class="landing" id="pending" data-login="${safeLogin}" data-start="${escapeHtml(startHref || '/api/gds/auth/web/start')}">
+    <div class="landing" id="pending" data-login="${safeLogin}" data-start="${escapeHtml(startHref || '/api/bongos/auth/web/start')}">
       <p>We're checking your access now. You'll be signed in automatically as soon as it clears — no need to refresh.</p>
       <p class="landing__note" id="pending-note">Checking…</p>
     </div>
@@ -178,7 +178,7 @@ function renderAccessPendingPage(login, startHref) {
   var login = el ? el.getAttribute('data-login') : '';
   /* server-built from the still-valid handshake cookies (task 1003234): the
      fresh sign-in keeps the wizard return + repo scope a founder started with */
-  var start = (el && el.getAttribute('data-start')) || '/api/gds/auth/web/start';
+  var start = (el && el.getAttribute('data-start')) || '/api/bongos/auth/web/start';
   var EVERY_MS = 3000;
   var GIVE_UP_MS = 5 * 60 * 1000;
   var started = Date.now();
@@ -190,7 +190,7 @@ function renderAccessPendingPage(login, startHref) {
       note.textContent = 'Still waiting on approval. You can leave this page open, or try signing in again later.';
       return;
     }
-    fetch('/api/gds/auth/web/admission-status?login=' + encodeURIComponent(login), { credentials: 'omit' })
+    fetch('/api/bongos/auth/web/admission-status?login=' + encodeURIComponent(login), { credentials: 'omit' })
       .then(function (r) { return r.ok ? r.json() : null; })
       .then(function (j) {
         if (j && j.admitted) { land(); return; }
@@ -350,7 +350,7 @@ function recoveryStartHref(req) {
   if (returnTo) params.set('return', returnTo);
   if (parseCookie(req, REPOS_COOKIE) === '1') params.set('repos', '1');
   const q = params.toString();
-  return '/api/gds/auth/web/start' + (q ? '?' + q : '');
+  return '/api/bongos/auth/web/start' + (q ? '?' + q : '');
 }
 
 // The canonical sign-in origin, read from the instance branding pack (oauthOrigin,

package/src/bongos/routes/backup.js

@@ -153,7 +153,7 @@ module.exports = function buildBackupRouter() {
 
       res.status(202).json({
         ok: true,
-        message: 'Backup started — poll GET /api/gds/backup/status to see the new dump land (usually < 30 s).',
+        message: 'Backup started — poll GET /api/bongos/backup/status to see the new dump land (usually < 30 s).',
         started_at: startedAt,
       });
     }));

package/src/bongos/routes/builders.js

@@ -456,7 +456,7 @@ module.exports = function buildBuildersRouter() {
   // Public read (no auth). Spec says the hall renders other builders'
   // checklists read-only — a builder's onboarding progress is roster-visible
   // signal, same posture as rank or drachmae shown on the leaderboard. The
-  // builder's own row is also surfaced inside /api/gds/me; this endpoint is
+  // builder's own row is also surfaced inside /api/bongos/me; this endpoint is
   // what the hall hits for the CURRENT viewer AND for any other builder
   // whose card is rendered.
   //

package/src/bongos/routes/instance.js

@@ -1,4 +1,4 @@
-// src/bongos/routes/instance.js — GET /api/gds/instance (V4.R82, task 1249, ADR 0062 / Cloud Bongos C8).
+// src/bongos/routes/instance.js — GET /api/bongos/instance (V4.R82, task 1249, ADR 0062 / Cloud Bongos C8).
 //
 // The instance manifest: one public, pre-auth, read-only descriptor that a CLI
 // (`bongos login <url>`) fetches to configure ITSELF — the conda

package/src/bongos/routes/live.js

@@ -105,7 +105,7 @@ function streamLive(req, res, deps = {}) {
 function buildLiveRouter() {
   const router = express.Router();
 
-  // GET /api/gds/live — SSE stream of Bongos state-change nudges for the hall.
+  // GET /api/bongos/live — SSE stream of Bongos state-change nudges for the hall.
   // rank: any-builder — requireBuilder gates anonymous/abuse traffic (defense
   // in depth; the payload leaks nothing). Mirrors the room's #983 signed-in
   // gate. EventSource carries the gds_session cookie on this same-origin GET, so

package/src/bongos/routes/me.js

@@ -157,7 +157,7 @@ module.exports = function buildMeRouter() {
   // V3.R24 (#244): the `builder` payload now carries `karma` (migration 040
   // added the column + karma_log table). The field is surfaced by
   // db.getBuilderById() — no shape change here, just documenting that the
-  // /api/gds/me response is the canonical place clients read karma from.
+  // /api/bongos/me response is the canonical place clients read karma from.
   //
   // rank: any-builder — own identity + own contributions; preserved per CRITICAL §4.
   router.get('/me', auth.requireBuilder, async (req, res) => {
@@ -621,7 +621,7 @@ module.exports = function buildMeRouter() {
   // The five per-builder PREFERENCE routes — /me/skill-prefs, /me/sound-prefs,
   // /me/event-sound-prefs, /me/wandering, /me/render (GET + PATCH each) — moved to
   // modules/builder-settings/routes/settings.js (BV1.R80 / ADR 0093 §1). They keep
-  // their exact /me/* paths (the loader mounts that router on this same /api/gds
+  // their exact /me/* paths (the loader mounts that router on this same /api/bongos
   // router, before the public catch-all), so the API is byte-identical. The GET
   // /me aggregator above stays here as a thin facade resolving the
   // `builder-settings` port for its wandering/render/needs slices (02-module-map §2).

package/src/bongos/routes/modules.js

@@ -148,7 +148,7 @@ module.exports = function buildModulesRouter() {
       res.json({ ok: true, key, enabled, note: 'Live on this box now. Persisting past the next deploy needs config/modules.json committed.' });
     }));
 
-  // POST /api/gds/modules/:key/submit — ADR 0107 §1 upstreaming submission.
+  // POST /api/bongos/modules/:key/submit — ADR 0107 §1 upstreaming submission.
   //
   // task 1770. Body: { signed_by?: "Name <email>" }. Re-runs the §4
   // AGPL/publish pre-check + requires a DCO-style sign-off against THIS box's
@@ -213,7 +213,7 @@ module.exports = function buildModulesRouter() {
       res.status(201).json({ ok: true, submission });
     }));
 
-  // GET /api/gds/modules/submissions?status=&module_key= — the upstreaming
+  // GET /api/bongos/modules/submissions?status=&module_key= — the upstreaming
   // review queue (task 1771 reads this). Metadata only — no file contents (a
   // future GET .../:id can add a with-files fetch if the review UI needs it).
   //

package/src/bongos/routes/public.js

@@ -115,7 +115,7 @@ module.exports = function buildPublicRouter() {
   // CORS for the public surface (ADR 0029 / #566): the off-box status page reads
   // these cross-origin. Read-only, no-auth, no-secret routes, so a static '*' is
   // safe; scoped to '/public' so it can't leak onto the authenticated routes on
-  // the same /api/gds base. No Vary:Origin — the ACAO never varies by origin.
+  // the same /api/bongos base. No Vary:Origin — the ACAO never varies by origin.
   // Shared middleware: corsPublicGet (_helpers.js) — byte-identical to analytics.js.
   router.use('/public', corsPublicGet('/public'));
 

package/src/bongos/routes/security.js

@@ -74,7 +74,7 @@ async function readFullAdr() {
 module.exports = function buildSecurityRouter() {
   const router = express.Router();
 
-  // GET /api/gds/security/adr
+  // GET /api/bongos/security/adr
   //
   // Metic+ only. Returns the full security ADR as { adr_md, source,
   // fetched_at } when the file is provisioned; otherwise 404 with a
@@ -125,7 +125,7 @@ module.exports = function buildSecurityRouter() {
   // now `permission_forbidden`, not `rank_forbidden`.
   // -----------------------------------------------------------------------
 
-  // GET /api/gds/security/docs — list doc METADATA (no content).
+  // GET /api/bongos/security/docs — list doc METADATA (no content).
   //
   // rank: archon — index of exploit-detail engagement reports. Gate:
   // requirePermission('security.report.adjudicate') — BV1.R104.
@@ -144,7 +144,7 @@ module.exports = function buildSecurityRouter() {
     }
   );
 
-  // GET /api/gds/security/docs/:slug — one doc WITH content, or 404.
+  // GET /api/bongos/security/docs/:slug — one doc WITH content, or 404.
   //
   // rank: archon — reads the full exploit-detail report body. Gate:
   // requirePermission('security.report.adjudicate') — BV1.R104.
@@ -177,7 +177,7 @@ module.exports = function buildSecurityRouter() {
     }
   );
 
-  // POST /api/gds/security/docs — upsert a doc by slug. The director uploads
+  // POST /api/bongos/security/docs — upsert a doc by slug. The director uploads
   // each dated engagement report here after deploy.
   //
   // Body: { slug, title, content_md }. content_md uses a large explicit cap

package/src/bongos/routes.js

@@ -108,7 +108,7 @@ function buildGdsRouter() {
   });
 
   // Audit middleware (V3.R35 #256) — attaches a res 'finish' hook so every
-  // authenticated POST/PATCH/PUT/DELETE under /api/gds is recorded in
+  // authenticated POST/PATCH/PUT/DELETE under /api/bongos is recorded in
   // audit_log AFTER the response is sent. It cannot fail the request: throws
   // are caught, DB errors are swallowed, and it never mutates req/res in a
   // way downstream handlers can see. Mounted BEFORE the feature routers so

package/src/bongos/serve-internal.js

@@ -2,7 +2,7 @@
 //
 // Mounts every non-game surface the platform serves onto an Express app:
 //   * /healthz + /version          — liveness + deployed-build info
-//   * /api/gds/*                    — the GDS API (buildGdsRouter)
+//   * /api/bongos/*                    — the GDS API (buildGdsRouter)
 //   * /downloads/devbox/*           — Dev Box installer redirect surface (#904)
 //   * generic module web-surface   — each enabled module's contributes.webSurfaces
 //     hosts                          served on its Host prefix by ONE generic static
@@ -179,7 +179,7 @@ function jsonForScript(value) {
 // the pack wins. Applied to the boot-time stamped HTML maps (the pack is a
 // boot-time singleton, computed once). Off-box surfaces that can't be
 // server-injected (the GitHub-Pages status page) read the same projection from
-// GET /api/gds/public/branding. Pure + exported for the unit test.
+// GET /api/bongos/public/branding. Pure + exported for the unit test.
 function injectBrandingGlobal(html, brand = clientBranding(), mods = clientModules()) {
   // window.__MODULES__ — the enabled feature-module set (R54 task 1193, ADR 0062
   // §4), injected the same way as __BRANDING__ so hall/status scripts can hide
@@ -456,7 +456,7 @@ function injectModuleHallWidgets(html, scripts = hallWidgetScripts({ isEnabled:
 // builders.<apex> gets the builder surface (served by the hall-ui MODULE's web
 // surface, BV1.R85 — its DEDICATED block below); the apex host gets the game
 // (server.js) or — on a game-less instance — a plain 404 (platform-server.js). All
-// share the same process + the same /api/gds/* surface (mounted host-agnostically
+// share the same process + the same /api/bongos/* surface (mounted host-agnostically
 // below). The prefix checks are apex-agnostic (any domain), so no brand string lives
 // here. isStatusHost + isBuildersHost stay the literal "status."/"builders."
 // predicates the entrypoints (server.js/platform-server.js) use to keep their apex
@@ -830,7 +830,7 @@ function mountInternalSurfaces(app) {
   // clean path so the address bar never shows ".../builders". PAGE paths only —
   // the slug is [a-z0-9-]+ with no dot, so asset URLs the pages emit
   // (/builders/style.css, /builders/*.js, /builders/diagrams/*.png) and the API
-  // (/api/gds/builders/*) never match and pass through to the shim below.
+  // (/api/bongos/builders/*) never match and pass through to the shim below.
   const BUILDERS_CANONICAL_RE = /^\/builders(?:\/([a-z0-9-]+))?\/?$/i;
   app.use((req, res, next) => {
     if (!isBuildersHost(req)) return next();
@@ -1056,8 +1056,8 @@ function mountInternalSurfaces(app) {
   // read from BUILDERS_DIR. The module key is NOT named — the path is the
   // hall-ui module's public dir, resolved once here.
   //
-  // Auth is handled client-side: the page calls /api/gds/me; on 401 it redirects
-  // the browser to /api/gds/auth/web/start, which (per src/bongos/routes/auth.js)
+  // Auth is handled client-side: the page calls /api/bongos/me; on 401 it redirects
+  // the browser to /api/bongos/auth/web/start, which (per src/bongos/routes/auth.js)
   // loops back to /builders with a gds_session cookie set.
   const BUILDERS_DIR = path.join(ROOT, 'modules', 'hall-ui', 'public');
   const buildersStatic = express.static(BUILDERS_DIR, {

package/src/branding.js

@@ -206,7 +206,7 @@ function userAgent() {
 }
 
 // The CLIENT-SAFE projection of the resolved pack — the subset the browser is
-// allowed to see, served by GET /api/gds/public/branding and consumed by the
+// allowed to see, served by GET /api/bongos/public/branding and consumed by the
 // hall + status front-ends. Deliberately a small allow-list, NOT the whole pack:
 // origins, repo binding, db name, and env prefix are server-only and must never
 // reach the client. R56 (task 1195) seeded it with the configurable currency

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.804'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.805'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/module-seams.js

@@ -188,7 +188,7 @@ function listEvents() {
 //
 // Canonical extension points (the names core consumes):
 //   • 'profile.fields'  — server-side: each contributor is `async (ctx) => ({…slice})`;
-//                         the slices merge into the GET /api/gds/me payload.
+//                         the slices merge into the GET /api/bongos/me payload.
 //                         (The client settings-panel seam is its browser twin,
 //                          window.OTB.contributeSettingsPanel in dom-utils.js.)
 
@@ -240,7 +240,7 @@ async function collectContributions(point, ctx) {
 // a module's contribution can't clobber a core field). Mutates + returns `base`,
 // and reports any collided keys so the caller can surface them — that signals a
 // move task took over a core key without first removing the core copy. Used by
-// GET /api/gds/me to fold 'profile.fields' slices into the profile payload.
+// GET /api/bongos/me to fold 'profile.fields' slices into the profile payload.
 function mergeContributions(base, slices) {
   const collisions = [];
   for (const slice of slices || []) {

package/src/platform-server.js

@@ -7,7 +7,7 @@
 // WHAT IT SERVES — the entire internal surface, via the shared mount that
 // server.js also uses (so the two entrypoints never drift, ADR 0052):
 //   * /healthz + /version
-//   * /api/gds/*                 — the full GDS API (buildGdsRouter)
+//   * /api/bongos/*                 — the full GDS API (buildGdsRouter)
 //   * the status dashboard host  — modules/status-ui/public/ (the status-ui module's
 //                                  web surface, BV1.R84 — served by the loader seam)
 //   * the builders' hall host    — modules/hall-ui/public/ (the hall-ui module's
@@ -269,7 +269,7 @@ function buildPlatformApp() {
     });
   }
 
-  // Non-game tail. Anything that did not resolve to /api/gds, the status host,
+  // Non-game tail. Anything that did not resolve to /api/bongos, the status host,
   // or the builders' hall lands here. There is NO game to fall through to, so:
   //   * an API-shaped path gets a self-describing JSON 404 (never HTML), the
   //     same contract server.js gives so a mis-prefixed CLI call is legible;