@bongos/core 1.19.804 → 1.19.806

package/scripts/gds/smoke-batch-claim.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # GDS batch-claim smoke test. Renamed from PMS in V3.R01.
 #
-# Exercises POST /api/gds/claims/batch:
+# Exercises POST /api/bongos/claims/batch:
 #   Case A: 2 ready tasks, disjoint touches → 201, 2 claim rows.
 #   Case B: 2 ready tasks, OVERLAPPING touches → 409, BATCH_TOUCHES_CONFLICT,
 #           no claims persisted (both tasks stay 'ready').
@@ -70,7 +70,7 @@ print(json.dumps({
   'source': 'smoke',
   'source_ref': '${ts}-${suffix}'
 }))")
-  parse_call "$(call POST /api/gds/tasks "${body}")"
+  parse_call "$(call POST /api/bongos/tasks "${body}")"
   python3 -c "import json,sys; print(json.loads('''${PAYLOAD}''')['task']['id'])"
 }
 
@@ -83,7 +83,7 @@ cleanup() {
   echo "--- cleanup ---"
   for cid in "${CREATED_CLAIMS[@]:-}"; do
     [[ -z "${cid}" ]] && continue
-    call POST "/api/gds/claims/${cid}/resolve" \
+    call POST "/api/bongos/claims/${cid}/resolve" \
       '{"outcome":"abandoned","notes_md":"smoke cleanup"}' >/dev/null || true
   done
   for tid in "${CREATED_TASKS[@]:-}"; do
@@ -94,7 +94,7 @@ cleanup() {
     # failure. Every run since has leaked its fixtures as status='ready'
     # (the 2026-05-11 batch, then 1001920-1001925 from 2026-07-03). The real
     # endpoint is POST /tasks/:id/abandon {"reason": ...}.
-    if ! call POST "/api/gds/tasks/${tid}/abandon" \
+    if ! call POST "/api/bongos/tasks/${tid}/abandon" \
          '{"reason":"smoke cleanup (scripts/gds/smoke-batch-claim.sh)"}' >/dev/null 2>&1; then
       leaked+=("${tid}")
     fi
@@ -127,7 +127,7 @@ CREATED_TASKS+=("${TA1}" "${TA2}")
 echo "  created tasks ${TA1}, ${TA2}"
 
 BODY_A=$(python3 -c "import json; print(json.dumps({'task_ids':[${TA1},${TA2}],'worktree_name':'__smoke_batch__'}))")
-parse_call "$(call POST /api/gds/claims/batch "${BODY_A}")"
+parse_call "$(call POST /api/bongos/claims/batch "${BODY_A}")"
 if [[ "${CODE}" == "201" ]]; then
   N=$(python3 -c "import json,sys; print(len(json.loads('''${PAYLOAD}''')['claims']))")
   if [[ "${N}" == "2" ]]; then
@@ -154,7 +154,7 @@ CREATED_TASKS+=("${TB1}" "${TB2}")
 echo "  created tasks ${TB1}, ${TB2} (both touch __smoke__/batch/${ts}/shared)"
 
 BODY_B=$(python3 -c "import json; print(json.dumps({'task_ids':[${TB1},${TB2}]}))")
-parse_call "$(call POST /api/gds/claims/batch "${BODY_B}")"
+parse_call "$(call POST /api/bongos/claims/batch "${BODY_B}")"
 if [[ "${CODE}" == "409" ]]; then
   REASON=$(python3 -c "
 import json,sys
@@ -170,7 +170,7 @@ print(','.join(reasons))
   fi
   # Confirm neither task got claimed (status still 'ready').
   for tid in "${TB1}" "${TB2}"; do
-    parse_call "$(call GET "/api/gds/tasks/${tid}")"
+    parse_call "$(call GET "/api/bongos/tasks/${tid}")"
     S=$(python3 -c "import json,sys; print(json.loads('''${PAYLOAD}''')['task']['status'])")
     if [[ "${S}" == "ready" ]]; then
       ok "B: task #${tid} stayed 'ready' (rollback worked)"
@@ -191,7 +191,7 @@ CREATED_TASKS+=("${TC1}" "${TC2}")
 echo "  created tasks ${TC1} (will pre-claim), ${TC2} (still ready)"
 
 # Pre-claim TC1 via the single-claim path so it's already 'active'.
-parse_call "$(call POST /api/gds/claims "{\"task_id\":${TC1}}")"
+parse_call "$(call POST /api/bongos/claims "{\"task_id\":${TC1}}")"
 if [[ "${CODE}" == "201" ]]; then
   PRE_CLAIM_ID=$(python3 -c "import json,sys; print(json.loads('''${PAYLOAD}''')['claim']['id'])")
   CREATED_CLAIMS+=("${PRE_CLAIM_ID}")
@@ -201,7 +201,7 @@ else
 fi
 
 BODY_C=$(python3 -c "import json; print(json.dumps({'task_ids':[${TC1},${TC2}]}))")
-parse_call "$(call POST /api/gds/claims/batch "${BODY_C}")"
+parse_call "$(call POST /api/bongos/claims/batch "${BODY_C}")"
 if [[ "${CODE}" == "409" ]]; then
   ENUM=$(python3 -c "
 import json,sys
@@ -217,7 +217,7 @@ print(','.join(str(i) for i in ids))
     bad "C: 409 but failures[] missing #${TC1} (got: ${ENUM})"
   fi
   # Confirm TC2 stayed 'ready' (no partial commit).
-  parse_call "$(call GET "/api/gds/tasks/${TC2}")"
+  parse_call "$(call GET "/api/bongos/tasks/${TC2}")"
   S=$(python3 -c "import json,sys; print(json.loads('''${PAYLOAD}''')['task']['status'])")
   if [[ "${S}" == "ready" ]]; then
     ok "C: task #${TC2} stayed 'ready' (no partial commit)"

package/scripts/gds/smoke-batch-release.sh

@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
 # GDS batch-release + dry-run-validate smoke test (task 1758).
 #
-# Exercises POST /api/gds/claims/batch/release:
+# Exercises POST /api/bongos/claims/batch/release:
 #   Case A: 2 own active claims → 200, both in released[], both tasks 'ready'.
 #   Case B: 1 own active claim + 1 bogus claim id → 200 (NOT all-or-nothing —
 #           the batch has no cross-claim invariant), the good one released,
 #           the bad one enumerated in failures[] with CLAIM_NOT_FOUND.
 #
-# Exercises POST /api/gds/claims/batch/validate:
+# Exercises POST /api/bongos/claims/batch/validate:
 #   Case C: 2 ready tasks, disjoint touches → parallel_safe:true, both valid.
 #   Case D: 2 ready tasks, OVERLAPPING touches → parallel_safe:false, both
 #           marked invalid (BATCH_TOUCHES_CONFLICT) — and, since this is a
@@ -76,7 +76,7 @@ print(json.dumps({
   'source': 'smoke',
   'source_ref': '${ts}-${suffix}'
 }))")
-  parse_call "$(call POST /api/gds/tasks "${body}")"
+  parse_call "$(call POST /api/bongos/tasks "${body}")"
   python3 -c "import json,sys; print(json.loads('''${PAYLOAD}''')['task']['id'])"
 }
 
@@ -90,7 +90,7 @@ claim_task() {
   # can hold as many of these as it needs for fixture setup (NULL sessions are
   # explicitly excluded from the uniq_active_claim_per_session index).
   local tid="$1"
-  parse_call "$(call POST /api/gds/claims/batch "{\"task_ids\":[${tid}],\"bind_session\":false}")"
+  parse_call "$(call POST /api/bongos/claims/batch "{\"task_ids\":[${tid}],\"bind_session\":false}")"
   python3 -c "import json,sys; print(json.loads('''${PAYLOAD}''')['claims'][0]['id'])"
 }
 
@@ -104,7 +104,7 @@ cleanup() {
   echo "--- cleanup ---"
   for cid in "${CREATED_CLAIMS[@]:-}"; do
     [[ -z "${cid}" ]] && continue
-    call POST "/api/gds/claims/${cid}/resolve" \
+    call POST "/api/bongos/claims/${cid}/resolve" \
       '{"outcome":"abandoned","notes_md":"smoke cleanup"}' >/dev/null || true
   done
   for tid in "${CREATED_TASKS[@]:-}"; do
@@ -112,7 +112,7 @@ cleanup() {
     # task 1002856: same bug as smoke-batch-claim.sh — /tasks/:id/promote is the
     # backlog->ready transition and ignores a status field, so this never
     # abandoned anything and the redirect swallowed the failure.
-    if ! call POST "/api/gds/tasks/${tid}/abandon" \
+    if ! call POST "/api/bongos/tasks/${tid}/abandon" \
          '{"reason":"smoke cleanup (scripts/gds/smoke-batch-release.sh)"}' >/dev/null 2>&1; then
       leaked+=("${tid}")
     fi
@@ -145,7 +145,7 @@ CA2=$(claim_task "${TA2}"); CREATED_CLAIMS+=("${CA2}")
 echo "  claimed #${TA1}→claim ${CA1}, #${TA2}→claim ${CA2}"
 
 BODY_A=$(python3 -c "import json; print(json.dumps({'claim_ids':[${CA1},${CA2}]}))")
-parse_call "$(call POST /api/gds/claims/batch/release "${BODY_A}")"
+parse_call "$(call POST /api/bongos/claims/batch/release "${BODY_A}")"
 if [[ "${CODE}" == "200" ]]; then
   N=$(python3 -c "import json,sys; print(len(json.loads('''${PAYLOAD}''')['released']))")
   NF=$(python3 -c "import json,sys; print(len(json.loads('''${PAYLOAD}''')['failures']))")
@@ -159,7 +159,7 @@ else
   bad "A: expected 200, got ${CODE} → ${PAYLOAD}"
 fi
 for tid in "${TA1}" "${TA2}"; do
-  parse_call "$(call GET "/api/gds/tasks/${tid}")"
+  parse_call "$(call GET "/api/bongos/tasks/${tid}")"
   S=$(python3 -c "import json,sys; print(json.loads('''${PAYLOAD}''')['task']['status'])")
   if [[ "${S}" == "ready" ]]; then
     ok "A: task #${tid} back to 'ready'"
@@ -179,7 +179,7 @@ BOGUS_CLAIM_ID=999999999
 echo "  claimed #${TB1}→claim ${CB1}; bogus id ${BOGUS_CLAIM_ID}"
 
 BODY_B=$(python3 -c "import json; print(json.dumps({'claim_ids':[${CB1},${BOGUS_CLAIM_ID}]}))")
-parse_call "$(call POST /api/gds/claims/batch/release "${BODY_B}")"
+parse_call "$(call POST /api/bongos/claims/batch/release "${BODY_B}")"
 if [[ "${CODE}" == "200" ]]; then
   RELEASED_IDS=$(python3 -c "
 import json,sys
@@ -214,7 +214,7 @@ TC1=$(mk_task C1 "__smoke__/batch-release/${ts}/c1"); CREATED_TASKS+=("${TC1}")
 TC2=$(mk_task C2 "__smoke__/batch-release/${ts}/c2"); CREATED_TASKS+=("${TC2}")
 
 BODY_C=$(python3 -c "import json; print(json.dumps({'task_ids':[${TC1},${TC2}]}))")
-parse_call "$(call POST /api/gds/claims/batch/validate "${BODY_C}")"
+parse_call "$(call POST /api/bongos/claims/batch/validate "${BODY_C}")"
 if [[ "${CODE}" == "200" ]]; then
   PS=$(python3 -c "import json,sys; print(json.loads('''${PAYLOAD}''')['parallel_safe'])")
   if [[ "${PS}" == "True" ]]; then
@@ -227,7 +227,7 @@ else
 fi
 # Dry run — confirm NOTHING got claimed.
 for tid in "${TC1}" "${TC2}"; do
-  parse_call "$(call GET "/api/gds/tasks/${tid}")"
+  parse_call "$(call GET "/api/bongos/tasks/${tid}")"
   S=$(python3 -c "import json,sys; print(json.loads('''${PAYLOAD}''')['task']['status'])")
   if [[ "${S}" == "ready" ]]; then
     ok "C: task #${tid} still 'ready' (validate did not claim)"
@@ -244,7 +244,7 @@ TD2=$(mk_task D2 "__smoke__/batch-release/${ts}/shared"); CREATED_TASKS+=("${TD2
 echo "  created tasks ${TD1}, ${TD2} (both touch __smoke__/batch-release/${ts}/shared)"
 
 BODY_D=$(python3 -c "import json; print(json.dumps({'task_ids':[${TD1},${TD2}]}))")
-parse_call "$(call POST /api/gds/claims/batch/validate "${BODY_D}")"
+parse_call "$(call POST /api/bongos/claims/batch/validate "${BODY_D}")"
 if [[ "${CODE}" == "200" ]]; then
   PS=$(python3 -c "import json,sys; print(json.loads('''${PAYLOAD}''')['parallel_safe'])")
   REASONS=$(python3 -c "
@@ -265,7 +265,7 @@ else
   bad "D: expected 200, got ${CODE} → ${PAYLOAD}"
 fi
 for tid in "${TD1}" "${TD2}"; do
-  parse_call "$(call GET "/api/gds/tasks/${tid}")"
+  parse_call "$(call GET "/api/bongos/tasks/${tid}")"
   S=$(python3 -c "import json,sys; print(json.loads('''${PAYLOAD}''')['task']['status'])")
   if [[ "${S}" == "ready" ]]; then
     ok "D: task #${tid} still 'ready' (validate did not claim)"
@@ -283,7 +283,7 @@ CE1=$(claim_task "${TE1}"); CREATED_CLAIMS+=("${CE1}")
 echo "  #${TE1} pre-claimed (claim ${CE1}, now 'active'); #${TE2} stays 'ready'"
 
 BODY_E=$(python3 -c "import json; print(json.dumps({'task_ids':[${TE1},${TE2}]}))")
-parse_call "$(call POST /api/gds/claims/batch/validate "${BODY_E}")"
+parse_call "$(call POST /api/bongos/claims/batch/validate "${BODY_E}")"
 if [[ "${CODE}" == "200" ]]; then
   VALID_E1=$(python3 -c "
 import json,sys

package/scripts/gds/smoke-claim-consistency.sh

@@ -9,11 +9,11 @@
 #   1. Create 2 disjoint __smoke__ tasks
 #   2. Claim both as the same builder
 #   3. Hit every consumer surface that currently exists:
-#        - GET /api/gds/me                              (always present)
-#        - GET /api/gds/builders/me   (PMS-V2 P6)       (capability-gated)
+#        - GET /api/bongos/me                              (always present)
+#        - GET /api/bongos/builders/me   (PMS-V2 P6)       (capability-gated)
 #      The /builder-start and /builder-session CLIs render server data;
 #      they do not constitute independent surfaces in the sense of
-#      criterion 7 (they consume /api/gds/* responses). We assert at the
+#      criterion 7 (they consume /api/bongos/* responses). We assert at the
 #      API boundary, which is where the bug class lives.
 #   4. Extract the ordered (task_id) sequence from each surface
 #   5. Assert all surfaces return identical sequences
@@ -24,7 +24,7 @@
 # which surfaces were checked vs skipped.
 #
 # TODO: once PMS-V2 P6 (#48 — /builders web profile) ships, the
-# /api/gds/builders/me surface will start returning 200 and this smoke
+# /api/bongos/builders/me surface will start returning 200 and this smoke
 # will automatically include it. No edits needed here.
 #
 # Usage:
@@ -101,7 +101,7 @@ print(json.dumps({
 }))
 ")
   local out
-  out=$(call POST /api/gds/tasks "${body}")
+  out=$(call POST /api/bongos/tasks "${body}")
   echo "${out}" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['id'])"
 }
 
@@ -110,13 +110,13 @@ claim_task() {
   local body
   body=$(python3 -c "import json; print(json.dumps({'task_id': ${task_id}, 'worktree_name': '__smoke__'}))")
   local out
-  out=$(call POST /api/gds/claims "${body}")
+  out=$(call POST /api/bongos/claims "${body}")
   echo "${out}" | python3 -c "import json,sys; print(json.load(sys.stdin)['claim']['id'])"
 }
 
 release_claim() {
   local claim_id="$1"
-  call POST "/api/gds/claims/${claim_id}/resolve" '{"outcome":"abandoned","notes_md":"smoke cleanup"}' >/dev/null || true
+  call POST "/api/bongos/claims/${claim_id}/resolve" '{"outcome":"abandoned","notes_md":"smoke cleanup"}' >/dev/null || true
 }
 
 echo "=== GDS claim-consistency smoke test ==="
@@ -168,8 +168,8 @@ checked=0
 skipped=0
 fail=0
 
-# Surface 1: /api/gds/me — always present.
-ME_PAYLOAD=$(call GET /api/gds/me)
+# Surface 1: /api/bongos/me — always present.
+ME_PAYLOAD=$(call GET /api/bongos/me)
 ME_IDS=$(extract_ids "${ME_PAYLOAD}" "[c['task_id'] for c in data.get('active_claims', [])]")
 # Filter to just our 2 smoke task_ids in case the builder has other live claims.
 ME_FILTERED=$(python3 -c "
@@ -177,19 +177,19 @@ ids = '${ME_IDS}'.split(',') if '${ME_IDS}' else []
 keep = [x for x in ids if x in ('${TASK_A}', '${TASK_B}')]
 print(','.join(keep))
 ")
-echo "/api/gds/me                 -> ${ME_FILTERED}"
+echo "/api/bongos/me                 -> ${ME_FILTERED}"
 if [[ "${ME_FILTERED}" == "${EXPECTED}" ]]; then
-  echo "  PASS /api/gds/me ordering matches"
+  echo "  PASS /api/bongos/me ordering matches"
   checked=$((checked+1))
 else
-  echo "  FAIL /api/gds/me ordering mismatch (expected ${EXPECTED}, got ${ME_FILTERED})"
+  echo "  FAIL /api/bongos/me ordering mismatch (expected ${EXPECTED}, got ${ME_FILTERED})"
   fail=1
 fi
 
-# Surface 2: /api/gds/builders/me — PMS-V2 P6, capability-gated.
-BUILDERS_ME_CODE=$(probe_status /api/gds/builders/me)
+# Surface 2: /api/bongos/builders/me — PMS-V2 P6, capability-gated.
+BUILDERS_ME_CODE=$(probe_status /api/bongos/builders/me)
 if [[ "${BUILDERS_ME_CODE}" == "200" ]]; then
-  BME_PAYLOAD=$(call GET /api/gds/builders/me)
+  BME_PAYLOAD=$(call GET /api/bongos/builders/me)
   # Try both common shapes: top-level active_claims, or nested under builder/profile.
   BME_IDS=$(extract_ids "${BME_PAYLOAD}" "[c['task_id'] for c in (data.get('active_claims') or data.get('builder', {}).get('active_claims') or data.get('profile', {}).get('active_claims') or [])]")
   BME_FILTERED=$(python3 -c "
@@ -197,16 +197,16 @@ ids = '${BME_IDS}'.split(',') if '${BME_IDS}' else []
 keep = [x for x in ids if x in ('${TASK_A}', '${TASK_B}')]
 print(','.join(keep))
 ")
-  echo "/api/gds/builders/me        -> ${BME_FILTERED}"
+  echo "/api/bongos/builders/me        -> ${BME_FILTERED}"
   if [[ "${BME_FILTERED}" == "${EXPECTED}" ]]; then
-    echo "  PASS /api/gds/builders/me ordering matches /api/gds/me"
+    echo "  PASS /api/bongos/builders/me ordering matches /api/bongos/me"
     checked=$((checked+1))
   else
-    echo "  FAIL /api/gds/builders/me ordering mismatch (expected ${EXPECTED}, got ${BME_FILTERED})"
+    echo "  FAIL /api/bongos/builders/me ordering mismatch (expected ${EXPECTED}, got ${BME_FILTERED})"
     fail=1
   fi
 else
-  echo "/api/gds/builders/me        -> HTTP ${BUILDERS_ME_CODE} (SKIP — PMS-V2 P6 not live yet)"
+  echo "/api/bongos/builders/me        -> HTTP ${BUILDERS_ME_CODE} (SKIP — PMS-V2 P6 not live yet)"
   skipped=$((skipped+1))
 fi
 

package/scripts/gds/smoke-dependencies.sh

@@ -31,29 +31,29 @@ BASE="${GDS_BASE:-$(gds_api_base)}"
 SUFFIX="$(date +%s)"
 
 echo "=== 1. Create task B (depends-on target, status=ready) ==="
-B=$(curl -sS -X POST "$BASE/api/gds/tasks" \
+B=$(curl -sS -X POST "$BASE/api/bongos/tasks" \
   -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   --data "{\"version_id\":\"GDS-V3\",\"title\":\"__smoke__ dep-test B $SUFFIX\",\"description\":\"smoke\",\"status\":\"ready\",\"kind\":\"feature\",\"discipline\":\"engineering\",\"priority\":5,\"touches\":[\"smoke-dep-B-$SUFFIX/\"],\"source\":\"smoke\",\"source_ref\":\"smoke-dep-B-$SUFFIX\"}")
 B_ID=$(echo "$B" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['id'])")
 echo "  B id=$B_ID"
 
 echo "=== 2. Create task A (dependent, status=backlog) ==="
-A=$(curl -sS -X POST "$BASE/api/gds/tasks" \
+A=$(curl -sS -X POST "$BASE/api/bongos/tasks" \
   -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   --data "{\"version_id\":\"GDS-V3\",\"title\":\"__smoke__ dep-test A $SUFFIX\",\"description\":\"smoke\",\"status\":\"backlog\",\"kind\":\"feature\",\"discipline\":\"engineering\",\"priority\":5,\"touches\":[\"smoke-dep-A-$SUFFIX/\"],\"source\":\"smoke\",\"source_ref\":\"smoke-dep-A-$SUFFIX\"}")
 A_ID=$(echo "$A" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['id'])")
 echo "  A id=$A_ID"
 
 echo "=== 3. Wire A → depends_on B ==="
-curl -sS -X POST "$BASE/api/gds/tasks/$A_ID/dependencies" \
+curl -sS -X POST "$BASE/api/bongos/tasks/$A_ID/dependencies" \
   -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   --data "{\"depends_on_task_id\": $B_ID}" | python3 -m json.tool
 
 echo "=== 4. Manually promote A (testing claim-time gate, not auto-promote) ==="
-curl -sS -X POST "$BASE/api/gds/tasks/$A_ID/promote" -H "Authorization: Bearer $TOKEN" | python3 -m json.tool
+curl -sS -X POST "$BASE/api/bongos/tasks/$A_ID/promote" -H "Authorization: Bearer $TOKEN" | python3 -m json.tool
 
 echo "=== 5. Attempt claim A — MUST 409 DEPS_NOT_SHIPPED ==="
-CLAIM_RESP=$(curl -sS -X POST "$BASE/api/gds/claims" \
+CLAIM_RESP=$(curl -sS -X POST "$BASE/api/bongos/claims" \
   -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   --data "{\"task_id\": $A_ID, \"worktree_name\": \"smoke-$SUFFIX\"}")
 echo "$CLAIM_RESP" | python3 -m json.tool
@@ -63,14 +63,14 @@ echo "=== 6. Claim + ship B (the dep) ==="
 node scripts/gds/claim.js "$B_ID" --worktree "smoke-$SUFFIX-B"
 # Move through completed → confirmed → shipped using direct API calls (skip the
 # scanner/grader by going straight at /resolve + /confirm + /ship)
-curl -sS -X POST "$BASE/api/gds/claims/by-task/$B_ID/resolve" \
+curl -sS -X POST "$BASE/api/bongos/claims/by-task/$B_ID/resolve" \
   -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
   --data '{"outcome":"completed","verification":{"passed":true,"smoke_ok":true}}' >/dev/null
-curl -sS -X POST "$BASE/api/gds/tasks/$B_ID/confirm" -H "Authorization: Bearer $TOKEN" >/dev/null
-curl -sS -X POST "$BASE/api/gds/tasks/$B_ID/ship"    -H "Authorization: Bearer $TOKEN" >/dev/null
+curl -sS -X POST "$BASE/api/bongos/tasks/$B_ID/confirm" -H "Authorization: Bearer $TOKEN" >/dev/null
+curl -sS -X POST "$BASE/api/bongos/tasks/$B_ID/ship"    -H "Authorization: Bearer $TOKEN" >/dev/null
 
 echo "=== 7. Verify A auto-promoted (status should still be 'ready' from manual step 4, or auto-flipped from backlog) ==="
-A_STATUS=$(curl -sS -H "Authorization: Bearer $TOKEN" "$BASE/api/gds/tasks/$A_ID" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['status'])")
+A_STATUS=$(curl -sS -H "Authorization: Bearer $TOKEN" "$BASE/api/bongos/tasks/$A_ID" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['status'])")
 echo "  A status: $A_STATUS"
 [ "$A_STATUS" = "ready" ] && echo "  PASS" || (echo "  FAIL: A not ready"; exit 1)
 

package/scripts/gds/smoke-write.sh

@@ -4,9 +4,9 @@
 # Exercises the full claim → ship round-trip against the live API:
 #   1. Read session token from ~/.config/otb/bongos-session.json (or the legacy
 #      gds-session.json / pms-session.json names, all still accepted on read)
-#   2. POST /api/gds/tasks → create a synthetic task titled '__smoke__ <ts>'
-#   3. POST /api/gds/claims → claim it
-#   4. POST /api/gds/claims/:id/resolve outcome=shipped
+#   2. POST /api/bongos/tasks → create a synthetic task titled '__smoke__ <ts>'
+#   3. POST /api/bongos/claims → claim it
+#   4. POST /api/bongos/claims/:id/resolve outcome=shipped
 #   5. Validate: tasks.status flipped to 'shipped'
 #                session_logs row exists for this claim
 #                public/recent-shipped does NOT contain the smoke title
@@ -53,7 +53,7 @@ call() {
 }
 
 snapshot_progress() {
-  curl -sS "${API}/api/gds/public/progress" \
+  curl -sS "${API}/api/bongos/public/progress" \
     | python3 -c "import json,sys; d=json.load(sys.stdin); print(','.join(f\"{r['version_id']}:{r['shipped_weight']}/{r['total_weight']}\" for r in d['progress']))"
 }
 
@@ -83,7 +83,7 @@ echo "Version: ${VERSION_ID}"
 # version-select.js, and node is the interpreter a Windows builder box actually
 # has — the python3 the rest of this file depends on is frequently absent there
 # (it is the Microsoft Store stub), so a python3 step cannot be verified locally.
-GOAL_ID=$(call GET "/api/gds/goals?version=${VERSION_ID}" | node -e '
+GOAL_ID=$(call GET "/api/bongos/goals?version=${VERSION_ID}" | node -e '
 let s = "";
 process.stdin.on("data", (d) => { s += d; });
 process.stdin.on("end", () => {
@@ -140,21 +140,21 @@ print(json.dumps({
   'source_ref': '${ts}'
 }))
 ")
-TASK_JSON=$(call POST /api/gds/tasks "${CREATE_BODY}")
+TASK_JSON=$(call POST /api/bongos/tasks "${CREATE_BODY}")
 TASK_ID=$(echo "${TASK_JSON}" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['id'])")
 echo "created task #${TASK_ID}"
 
 echo
 echo "--- 2. claim task ---"
 CLAIM_BODY=$(python3 -c "import json; print(json.dumps({'task_id': ${TASK_ID}, 'worktree_name': '__smoke__'}))")
-CLAIM_JSON=$(call POST /api/gds/claims "${CLAIM_BODY}")
+CLAIM_JSON=$(call POST /api/bongos/claims "${CLAIM_BODY}")
 CLAIM_ID=$(echo "${CLAIM_JSON}" | python3 -c "import json,sys; print(json.load(sys.stdin)['claim']['id'])")
 echo "claim #${CLAIM_ID}"
 
 echo
 echo "--- 3. resolve claim shipped (verification.passed=true → lands at completed; grade gates confirm) ---"
 RESOLVE_BODY='{"outcome":"shipped","notes_md":"smoke-test","value_summary":"smoke-test","verification":{"passed":true,"scanner_clean":true,"smoke_clean":true}}'
-RESOLVE_JSON=$(call POST "/api/gds/claims/${CLAIM_ID}/resolve" "${RESOLVE_BODY}")
+RESOLVE_JSON=$(call POST "/api/bongos/claims/${CLAIM_ID}/resolve" "${RESOLVE_BODY}")
 echo "${RESOLVE_JSON}"
 
 echo
@@ -162,7 +162,7 @@ echo "--- 4. validate ---"
 fail=0
 
 # 4a. recent-shipped does NOT contain the smoke title
-RECENT=$(curl -sS "${API}/api/gds/public/recent-shipped")
+RECENT=$(curl -sS "${API}/api/bongos/public/recent-shipped")
 if echo "${RECENT}" | python3 -c "
 import json, sys
 data = json.load(sys.stdin)
@@ -196,7 +196,7 @@ fi
 # (Pre-#209 this asserted 'confirmed', which has been failing on every run
 # since the grader gate landed — fixed in #468.) The task should never reach
 # 'shipped' (that needs a merge). credits_reward=0, so no credit_log row.
-TASK_AFTER=$(call GET "/api/gds/tasks/${TASK_ID}")
+TASK_AFTER=$(call GET "/api/bongos/tasks/${TASK_ID}")
 STATUS_AFTER=$(echo "${TASK_AFTER}" | python3 -c "import json,sys; print(json.load(sys.stdin)['task']['status'])")
 if [[ "${STATUS_AFTER}" == "completed" ]]; then
   echo "PASS task.status = completed (resolve landed it at completed; grade gates confirm — V3.R18 #209)"
@@ -249,7 +249,7 @@ cleanup_throwaway_task() {
   out=$(curl -sS -X POST \
     -H "Authorization: Bearer ${TOKEN}" -H "Content-Type: application/json" \
     -d "${reason}" -w "\n%{http_code}" \
-    "${API}/api/gds/tasks/${TASK_ID}/abandon") || true
+    "${API}/api/bongos/tasks/${TASK_ID}/abandon") || true
   code="${out##*$'\n'}"
   case "${code}" in
     2*)  echo "PASS cleaned up throwaway task #${TASK_ID} (abandoned)" ;;

package/scripts/gds/start.js

@@ -732,7 +732,7 @@ async function main() {
   const rawClaimable = r.data.claimable || [];
 
   // Discipline routing (V3.R81 / #299). preferred_disciplines lives on the
-  // builder row (migration 027), surfaced via /api/gds/me.
+  // builder row (migration 027), surfaced via /api/bongos/me.
   const preferred = (me.ok && Array.isArray(me.data?.builder?.preferred_disciplines))
     ? me.data.builder.preferred_disciplines
     : [];

package/scripts/gds/status.js

@@ -5,7 +5,7 @@
 // ~10-step prose archaeology (grep seed file → eyeball "Gates R55–R63" →
 // re-query each task) that motivated the task. Reads the structured
 // criterion↔task link (task_criteria, migration 055) via the public endpoint
-// GET /api/gds/versions/:id/progress.
+// GET /api/bongos/versions/:id/progress.
 //
 // Usage:
 //   node scripts/gds/status.js                  # all criteria, default version
@@ -59,7 +59,7 @@ function parseArgs(argv) {
 async function fetchProgress(version) {
   let res;
   try {
-    res = await fetch(`${API_BASE}/api/gds/versions/${encodeURIComponent(version)}/progress`, {
+    res = await fetch(`${API_BASE}/api/bongos/versions/${encodeURIComponent(version)}/progress`, {
       headers: { 'User-Agent': require('../../src/branding').userAgent() },
     });
   } catch (err) {

package/scripts/gds/strand-watch.js

@@ -145,7 +145,7 @@ async function check({ nowMs = Date.now(), timeoutMs = DEFAULT_TIMEOUT_MS, confi
   let pages;
   try {
     pages = await Promise.all(WATCHED.map(async (status) => {
-      const res = await withTimeout(call('GET', `/api/gds/tasks?status=${status}&limit=${PAGE_LIMIT}`), status);
+      const res = await withTimeout(call('GET', `/api/bongos/tasks?status=${status}&limit=${PAGE_LIMIT}`), status);
       const body = res && (res.data || res);
       const tasks = body && Array.isArray(body.tasks) ? body.tasks : null;
       if (!tasks) throw new Error(`unexpected shape from /tasks?status=${status}`);

package/scripts/gds/triage.js

@@ -158,7 +158,7 @@ async function listOpenIdeas() {
   // GET /inbox in routes/inbox.js only returns open ideas regardless of
   // query — but the explicit param is forward-safe.
   if (!r.ok) {
-    throw new Error(`GET /api/gds/inbox failed: ${r.status} ${JSON.stringify(r.data)}`);
+    throw new Error(`GET /api/bongos/inbox failed: ${r.status} ${JSON.stringify(r.data)}`);
   }
   return r.data?.ideas ?? [];
 }
@@ -167,7 +167,7 @@ async function patchIdea(id, patch) {
   const api = await cliClient();
   const r = await api.inbox.patchInboxId({ id, body: patch });
   if (!r.ok) {
-    throw new Error(`PATCH /api/gds/inbox/${id} failed: ${r.status} ${JSON.stringify(r.data)}`);
+    throw new Error(`PATCH /api/bongos/inbox/${id} failed: ${r.status} ${JSON.stringify(r.data)}`);
   }
   return r.data?.idea;
 }
@@ -254,7 +254,7 @@ function applyGoalAnswer(defaultGoalId, rawAnswer) {
 }
 
 async function createTask({ versionId, title, description, priority, sourceRef, goalId = null }) {
-  // (The old note here said POST /api/gds/tasks does not accept 'kind'. That is
+  // (The old note here said POST /api/bongos/tasks does not accept 'kind'. That is
   // no longer true — routes/tasks.js takes it, and the hall promote path already
   // sends it. Left un-sent from THIS path deliberately: changing what kind a
   // triaged promotion lands with is a behaviour change task R13 was not asked to
@@ -284,7 +284,7 @@ async function createTask({ versionId, title, description, priority, sourceRef,
   const api = await cliClient();
   const r = await api.tasks.postTasks({ body });
   if (!r.ok) {
-    throw new Error(`POST /api/gds/tasks failed: ${r.status} ${JSON.stringify(r.data)}`);
+    throw new Error(`POST /api/bongos/tasks failed: ${r.status} ${JSON.stringify(r.data)}`);
   }
   return r.data?.task;
 }

package/scripts/gds/version-close.js

@@ -5,8 +5,8 @@
 //
 // What it does:
 //   1. Verifies the version is ready to close (calls
-//      GET /api/gds/versions/close-suggestions and checks the gate).
-//   2. Lists shipped tasks for the version (GET /api/gds/tasks) and drafts a
+//      GET /api/bongos/versions/close-suggestions and checks the gate).
+//   2. Lists shipped tasks for the version (GET /api/bongos/tasks) and drafts a
 //      <scope>-shipped.md archive grouped by kind/bucket from value_summary.
 //   3. Identifies carry-over candidates (backlog + ready) and drafts a
 //      next-version scope stub (e.g. limitations/pms-v3.md) with a

package/scripts/hall-preview/README.md

@@ -4,7 +4,7 @@ The dev-box sandbox previews the **game only** — `/builders` 404s there (idea
 hall-ui changes are reviewed here: a DB-less fixture server that serves the **real**
 `modules/hall-ui/public` files through the **real** serving seams (boot-time `?v=`
 content-hash stamping, `{{token}}` replacement, `window.__BRANDING__`/`__MODULES__`
-injection, theme markup), answering every `/api/gds|bongos/*` read from checked-in
+injection, theme markup), answering every `/api/bongos|bongos/*` read from checked-in
 fixtures. Proven recipe from tasks 1723/1742, checked in by task 2167.
 
 ## Quickstart

package/scripts/hall-preview/server.js

@@ -5,7 +5,7 @@
 // so hall-ui changes are reviewed HERE: a tiny express app that serves the real
 // modules/hall-ui/public files through the REAL serving seams (boot-time ?v=
 // stamping, {{token}} replacement, __BRANDING__/__MODULES__ injection, theme
-// markup) with the /api/gds|bongos reads answered from checked-in fixtures.
+// markup) with the /api/bongos|bongos reads answered from checked-in fixtures.
 // Boots DB-less (pg pools connect lazily). Proven recipe from tasks 1723/1742,
 // finally checked in.
 //

package/src/bongos/auth-admission.js

@@ -62,7 +62,7 @@ async function reportMembershipCheckIn({ githubId, githubLogin, displayName, ava
   if (!idp) return;
   const kind = membershipKind({ githubLogin });
   try {
-    await fetch(`${idp.origin}/api/gds/sso/membership/check-in`, {
+    await fetch(`${idp.origin}/api/bongos/sso/membership/check-in`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
       body: JSON.stringify({
@@ -159,7 +159,7 @@ async function reportActivityRollup({ builderId, githubId = null }) {
     if (!/^\d+$/.test(String(ghId ?? ''))) return;
     const shipped = await pool.query('SELECT count(*)::int AS n FROM tasks WHERE shipped_by = $1', [builderId]);
     const recentShips = await recentShipsForRollup(builderId);
-    await fetch(`${idp.origin}/api/gds/sso/activity/rollup`, {
+    await fetch(`${idp.origin}/api/bongos/sso/activity/rollup`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
       body: JSON.stringify({
@@ -434,7 +434,7 @@ async function readApplicantProfileFromHub(githubId) {
   const idp = loadIdpConfig();
   if (!idp || githubId == null) return null;
   try {
-    const r = await fetch(`${idp.origin}/api/gds/sso/applicant-profile`, {
+    const r = await fetch(`${idp.origin}/api/bongos/sso/applicant-profile`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
       signal: AbortSignal.timeout(APPLICANT_PROFILE_TIMEOUT_MS),

package/src/bongos/auth-idp.js

@@ -31,7 +31,7 @@ const { loadIdpConfig } = require('./auth-config.js');
 const { newSessionToken } = require('./auth-github.js');
 
 function idpAuthorizeUrl(origin, clientId, state, redirectUri) {
-  const u = new URL(`${String(origin).replace(/\/+$/, '')}/api/gds/sso/authorize`);
+  const u = new URL(`${String(origin).replace(/\/+$/, '')}/api/bongos/sso/authorize`);
   u.searchParams.set('client_id', clientId);
   u.searchParams.set('redirect_uri', redirectUri);
   u.searchParams.set('state', state);
@@ -48,7 +48,7 @@ function buildIdpAuthorizeUrl(state, redirectUri) {
 // with the instance's client_id + client_secret; the hub returns IDENTITY ONLY
 // (github_id, github_login, display_name, avatar_url) — never a rank (ADR 0141 §2).
 async function exchangeIdpCode({ code, redirectUri, idp }) {
-  const res = await fetch(`${idp.origin}/api/gds/sso/token`, {
+  const res = await fetch(`${idp.origin}/api/bongos/sso/token`, {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',

package/src/bongos/auth.js

@@ -3,11 +3,11 @@
 // Two flows that produce the same `builder_sessions` row:
 //
 // - Device Flow (CLI):
-//     1. POST /api/gds/auth/device/start
+//     1. POST /api/bongos/auth/device/start
 //          → { user_code, verification_uri, device_code, interval, expires_in }
 //          The CLI shows user_code to the user and asks them to open
 //          verification_uri in a browser.
-//     2. CLI polls POST /api/gds/auth/device/poll { device_code }
+//     2. CLI polls POST /api/bongos/auth/device/poll { device_code }
 //          → 'pending' | 'slow_down' | 'expired' | 'denied' |
 //            { token, builder: {...} }
 //
@@ -364,7 +364,7 @@ async function requireBuilder(req, res, next) {
 // and also falls back to Referer, so this is belt-and-braces for navigations
 // where Referer may be stripped. Returns '' if the host can't be determined.
 function signInWithReturn(req) {
-  const base = '/api/gds/auth/web/start';
+  const base = '/api/bongos/auth/web/start';
   const proto = req.headers['x-forwarded-proto'] || (req.secure ? 'https' : 'http');
   const host = req.headers['x-forwarded-host'] || req.headers['host'];
   if (!host) return base;