@bongos/core 1.19.804 → 1.19.806

package/modules/sessions/upload-health.js

@@ -0,0 +1,197 @@
+'use strict';
+
+// modules/sessions/upload-health.js — the PURE verdict over session-upload
+// coverage (task 1003865, goal 1000118).
+//
+// THE OUTAGE THIS EXISTS FOR. A Windows path-encoding bug made every transcript
+// lookup miss, so each ship skipped its session upload with `transcript_not_found`.
+// No session_records row was written, so no `session.token_reward` credit booked —
+// and since ADR 0146 made cost-plus the SOLE reward stream, the affected builder
+// earned nothing for real shipped work. It ran for weeks before a human noticed.
+//
+// WHY NOTHING NOTICED. The only trace was `session-upload-skips.jsonl`, written by
+// recordUploadSkip on the BUILDER'S OWN MACHINE. It never reaches the server, so
+// from the server's side a skipped upload and a builder who simply did not work
+// look identical: the absence of a row, in both cases.
+//
+// So the signal is built from two things the server already knows INDEPENDENTLY:
+// a task reached `shipped`, and whether that task's builder uploaded any session
+// around then. A ship with no session record for its builder inside a window is
+// the unit of evidence.
+//
+// ---------------------------------------------------------------------------
+// PER BUILDER, AND THAT IS THE WHOLE DESIGN — measured, not assumed.
+//
+// The obvious version of this check — the uncovered share across the CORPUS —
+// cannot see the outage at all. Measured against the real corpora on 2026-09-16
+// (4,495 session records and 2,640 ships carrying shipped_at + shipped_by, paged
+// out of /sessions/search and /tasks):
+//
+//   corpus-wide uncovered share, ±24h:  2026-06 1.7% · 2026-07 3.4% ·
+//                                       2026-08 2.0% · 2026-09 0.2%
+//
+// July and August — the outage months — are indistinguishable from the rest. Of
+// course they are: the failure was one builder on one machine, about 19 ships out
+// of the ~1,164 that landed across those two months. A corpus-wide ratio puts the
+// signal two orders of magnitude beneath its own noise floor.
+//
+// Keyed on the BUILDER, the same data separates cleanly. Re-running the check as
+// it would have run — a rolling 14-day lookback stepped one day at a time over
+// the ~92 evaluable days — at ±24h, min 8 ships, firing above 25%:
+//
+//   fires on 13 days, ALL of them 2026-07-24 … 2026-08-05, ALL one builder
+//   peak 2026-07-25: 19 of 19 ships with no session record — a total outage
+//   silent on the other ~79 days and on every other builder
+//
+// That is the stated outage window (2026-07 into 2026-08) and about the stated
+// ship count ("at least 16 ships"), found without being told where to look.
+//
+// The window width is measured too, not chosen: at ±12h the same sweep fires on
+// 27 days across THREE builders — long sessions that upload once at the end drift
+// past a narrow window and read as outages. ±24h keeps them in.
+// ---------------------------------------------------------------------------
+//
+// KEYED ON BUILDER + TIME, NEVER ON task_ids. `session_records.task_ids` is EMPTY
+// on 54% of rows (1,771 of 3,873 when task 1002448 measured it in 2026-09), so
+// "no session record NAMES this task" is not a usable predicate — it reports the
+// linkage gap as an outage. This file never sees task_ids at all, and the SQL in
+// db.js does not mention it; a test asserts that about the SQL actually emitted.
+//
+// PURE so the firing condition is provable without a database, and so the route
+// (on demand) and the poller (periodically) cannot answer the question two
+// different ways.
+
+// ---- the knobs, every one of them measured above ---------------------------
+
+// The window around a ship in which its builder must have uploaded SOMETHING.
+// The digest uploads at ship time (uploadSessionOnShip, inside finishShip), so a
+// healthy ship's nearest upload is minutes away — p50 is 0.21h across the whole
+// corpus. The width is for what is awkward but not an outage: a long session that
+// uploads once after several ships, a land that polled for hours, a clock that
+// disagrees. ±12h costs three false builders; ±24h costs nothing measurable.
+const DEFAULT_WINDOW_HOURS = 24;
+
+// How far back the check looks. Long enough that one quiet week cannot empty it,
+// short enough that a resolved outage stops firing instead of haunting the number
+// for a quarter. 14 days is what the sweep above was tuned on.
+const DEFAULT_LOOKBACK_DAYS = 14;
+
+// Below this many ships IN THE LOOKBACK, a builder is not judged at all. Three
+// uncovered out of four is 75% and means nothing; the same share over twenty
+// ships is the outage. A check that fires on someone's quiet fortnight teaches
+// people to mute it, which is the state this task exists to fix.
+const DEFAULT_MIN_SHIPS = 8;
+
+// The uncovered share that counts as broken, per builder. The real outage ran at
+// 86-100%; every healthy builder-fortnight in the same sweep stayed under this.
+// Set here rather than at 50% so a PARTIAL outage — some ships uploading, some
+// not — still fires, which is the shape a flaky path bug actually has.
+const DEFAULT_MAX_UNCOVERED_SHARE = 0.25;
+
+// ---- the clamps ------------------------------------------------------------
+//
+// Both reach an SQL interval, and both are reachable from a URL. They are clamped
+// HERE rather than at the route because the route is not the only caller — the
+// poller is the other — and a bound that lives at one of two call sites is not a
+// bound.
+function clampLookbackDays(n) {
+  const x = Number(n);
+  if (!Number.isFinite(x)) return DEFAULT_LOOKBACK_DAYS;
+  return Math.max(1, Math.min(365, Math.trunc(x)));
+}
+function clampWindowHours(n) {
+  const x = Number(n);
+  if (!Number.isFinite(x)) return DEFAULT_WINDOW_HOURS;
+  return Math.max(1, Math.min(720, Math.trunc(x)));
+}
+// The offender sample is evidence, not a report: enough rows to recognise the
+// shape (one machine? one week? everyone?), never the whole corpus.
+function clampSampleLimit(n) {
+  if (n == null) return 20;
+  const x = Number(n);
+  if (!Number.isFinite(x)) return 20;
+  return Math.max(1, Math.min(100, Math.trunc(x)));
+}
+
+// ---- the verdict -----------------------------------------------------------
+
+function toCount(v) {
+  const n = Number(v);
+  return Number.isFinite(n) && n > 0 ? Math.trunc(n) : 0;
+}
+
+// normalizeBuilderRows — take what the SQL returns (per-builder counts, with
+// Postgres' bigint-as-string) and hand back clean numbers. A row without a
+// builder is dropped rather than trusted, and an uncovered count above the ship
+// count is a query bug, not an outage several times over: clamp, don't propagate.
+function normalizeBuilderRows(rows) {
+  const list = Array.isArray(rows) ? rows : [];
+  return list
+    .filter((r) => r && r.builder_id != null)
+    .map((r) => {
+      const ships = toCount(r.ships);
+      const uncovered = Math.min(ships, toCount(r.uncovered));
+      return {
+        builder_id: String(r.builder_id),
+        github_login: r.github_login == null ? null : String(r.github_login),
+        ships,
+        uncovered,
+        uncovered_share: ships > 0 ? Number((uncovered / ships).toFixed(4)) : 0,
+      };
+    });
+}
+
+// uploadHealthVerdict — is any builder's session upload silently failing?
+//
+// The verdict always carries its own arithmetic and names the builder, because
+// the first question a firing check has to answer is "on what evidence", and the
+// answer to "whose machine" is what makes it actionable. An alert that cannot
+// answer either is one more thing to mute.
+function uploadHealthVerdict(rows, opts = {}) {
+  const minShips = Number.isFinite(opts.minShips) ? opts.minShips : DEFAULT_MIN_SHIPS;
+  const maxShare = Number.isFinite(opts.maxUncoveredShare) ? opts.maxUncoveredShare : DEFAULT_MAX_UNCOVERED_SHARE;
+  const builders = normalizeBuilderRows(rows).sort((a, b) => b.uncovered_share - a.uncovered_share);
+  const judged = builders.filter((b) => b.ships >= minShips);
+  const offenders = judged.filter((b) => b.uncovered_share > maxShare);
+  const ships = builders.reduce((a, b) => a + b.ships, 0);
+  const uncovered = builders.reduce((a, b) => a + b.uncovered, 0);
+  const base = { ships, uncovered, builders, judged: judged.length, offenders, minShips, maxUncoveredShare: maxShare };
+
+  if (judged.length === 0) {
+    return {
+      ...base,
+      firing: false,
+      status: 'insufficient-data',
+      reason: `no builder shipped ${minShips}+ tasks in the window (${builders.length} builder(s), ${ships} ship(s) total) — not enough to judge`,
+    };
+  }
+  if (offenders.length > 0) {
+    const worst = offenders[0];
+    const who = worst.github_login || `builder #${worst.builder_id}`;
+    const rest = offenders.length > 1 ? ` (and ${offenders.length - 1} other builder(s) over the line)` : '';
+    return {
+      ...base,
+      firing: true,
+      status: 'uploads-missing',
+      reason: `${who} has ${worst.uncovered} of ${worst.ships} ships (${(worst.uncovered_share * 100).toFixed(1)}%) with no session record in the window${rest}. Their session uploads are probably failing, which means the cost-plus reward is not booking for work that shipped.`,
+    };
+  }
+  return {
+    ...base,
+    firing: false,
+    status: 'healthy',
+    reason: `${judged.length} builder(s) judged, worst ${(judged[0].uncovered_share * 100).toFixed(1)}% uncovered — under the ${(maxShare * 100).toFixed(0)}% threshold`,
+  };
+}
+
+module.exports = {
+  DEFAULT_WINDOW_HOURS,
+  DEFAULT_LOOKBACK_DAYS,
+  DEFAULT_MIN_SHIPS,
+  DEFAULT_MAX_UNCOVERED_SHARE,
+  clampLookbackDays,
+  clampWindowHours,
+  clampSampleLimit,
+  normalizeBuilderRows,
+  uploadHealthVerdict,
+};

package/modules/status-ui/module.json

@@ -1,7 +1,7 @@
 {
   "key": "status-ui",
   "title": "Status dashboard (\"The Watch\")",
-  "description": "The public build-status dashboard served at status.<apex> (status.example.com) — the live up/down banner, version-progress rollups, cost summary, recent ships, leaderboard, and the ecosystem fingerprint, all polling the read-only /api/gds/public/* surface every 60s. A WEB-SURFACE core-domain module carved out of the GDS core in BV1.R84 (ADR 0093 §1; 02-module-map §6 — a web surface is first-class). default-on: a Cloud Bongos instance ships its status page like it ships its hall. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir) the loader hands serve-internal, which serves the module's public/ dir on the matching host exactly as it served public-status/ before. The public read endpoints it renders stay SHARED core in routes/public.js (the hall + the off-box mirror read them too).",
+  "description": "The public build-status dashboard served at status.<apex> (status.example.com) — the live up/down banner, version-progress rollups, cost summary, recent ships, leaderboard, and the ecosystem fingerprint, all polling the read-only /api/bongos/public/* surface every 60s. A WEB-SURFACE core-domain module carved out of the GDS core in BV1.R84 (ADR 0093 §1; 02-module-map §6 — a web surface is first-class). default-on: a Cloud Bongos instance ships its status page like it ships its hall. Registers no port and contributes no routes — it declares a webSurface (host prefix + static dir) the loader hands serve-internal, which serves the module's public/ dir on the matching host exactly as it served public-status/ before. The public read endpoints it renders stay SHARED core in routes/public.js (the hall + the off-box mirror read them too).",
   "coreVersion": "^1.11.0",
   "default": true,
   "maintenance": { "status": "core-maintained" },

package/modules/status-ui/public/explore.js

@@ -113,7 +113,7 @@
     return el;
   }
 
-  fetch('/api/gds/projects/featured', { headers: { Accept: 'application/json' } })
+  fetch('/api/bongos/projects/featured', { headers: { Accept: 'application/json' } })
     .then(function (r) { if (!r.ok) throw new Error('http ' + r.status); return r.json(); })
     .then(function (data) {
       var projects = (data && Array.isArray(data.projects)) ? data.projects : [];

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.804",
+  "version": "1.19.806",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.804",
+      "version": "1.19.806",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.804",
+  "version": "1.19.806",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/agent-invoke.js

@@ -610,7 +610,7 @@ module.exports = {
 
 function usage() {
   console.error('Usage: node scripts/gds/agent-invoke.js <agent> "<question>" [--out <path>] [--json]');
-  console.error('  <agent>      the agent name as it appears in the registry (GET /api/gds/agents)');
+  console.error('  <agent>      the agent name as it appears in the registry (GET /api/bongos/agents)');
   console.error('  --out <path> write the answer to a file and record it as the run\'s output_ref');
   console.error('  --json       print the whole result as JSON instead of prose');
 }
@@ -624,7 +624,7 @@ async function main() {
   // Rule 5. requireSession exits with its own guidance when there is no session.
   const cli = require('./cli-lib');
   await cli.requireSession();
-  const me = await cli.apiCall('GET', '/api/gds/me');
+  const me = await cli.apiCall('GET', '/api/bongos/me');
   const builder = (me && me.data && me.data.builder) || null;
   if (!builder || !builder.id) {
     console.error('agent-invoke: could not resolve who you are from /me — a fire has to be attributable.');
@@ -659,7 +659,7 @@ async function main() {
     console.error(`\n  ${name}: ${result.code}`);
     if (result.reason) console.error(`  ${result.reason}`);
     if (result.code === 'agent_not_found') {
-      console.error('  Nothing by that name is in the registry. `node scripts/gds/api.js GET /api/gds/agents` lists it.');
+      console.error('  Nothing by that name is in the registry. `node scripts/gds/api.js GET /api/bongos/agents` lists it.');
     }
     if (result.code === 'agent_refused' && /not enabled/.test(result.reason || '')) {
       console.error('  Definitions land in the registry DISABLED by design: agents-sync reconciles');

package/scripts/gds/api.js

@@ -8,10 +8,10 @@
 // session token + API base, so there is no manual token extraction here.
 //
 // Usage:
-//   node scripts/gds/api.js GET  /api/gds/inbox
-//   node scripts/gds/api.js POST /api/gds/blockers/5/resolve --body '{"resolution_note":"fixed in #690"}'
-//   node scripts/gds/api.js POST /api/gds/security/reports   --body-file report.json
-//   echo '{"verdict":"promote"}' | node scripts/gds/api.js PATCH /api/gds/inbox/12 --body-file -
+//   node scripts/gds/api.js GET  /api/bongos/inbox
+//   node scripts/gds/api.js POST /api/bongos/blockers/5/resolve --body '{"resolution_note":"fixed in #690"}'
+//   node scripts/gds/api.js POST /api/bongos/security/reports   --body-file report.json
+//   echo '{"verdict":"promote"}' | node scripts/gds/api.js PATCH /api/bongos/inbox/12 --body-file -
 //
 // The HTTP status goes to STDERR ("POST /path → 201"); the pretty-printed JSON
 // body goes to STDOUT, so `... | node -e ...` style piping stays clean. Exit 0

package/scripts/gds/api.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # scripts/gds/api.sh — Git Bash/Linux passthrough wrapper around api.js.
-# MSYS_NO_PATHCONV avoids Git Bash mangling API paths (e.g. /api/gds/inbox) into
+# MSYS_NO_PATHCONV avoids Git Bash mangling API paths (e.g. /api/bongos/inbox) into
 # Windows paths before node ever sees them.
 export MSYS_NO_PATHCONV=1
 exec node "$(dirname "$0")/api.js" "$@"

package/scripts/gds/architect-audit.js

@@ -268,7 +268,7 @@ async function main() {
   console.log(`\n📜 wrote ${relDoc}`);
 
   // File the seed ideas to the planning inbox. Payload mirrors capture.js
-  // (POST /api/gds/inbox): { title, body_md, kind, suggested_version }.
+  // (POST /api/bongos/inbox): { title, body_md, kind, suggested_version }.
   // Provenance (which audit produced it) is folded into body_md.
   let filed = 0;
   const api = await cliClient();

package/scripts/gds/artifact-audit.js

@@ -157,7 +157,7 @@ async function fetchAuditedTasks({ call = apiCall } = {}) {
     for (let page = 0; page < 100; page++) {
       const q = buildTaskPageQuery({ status, limit: TASK_LIST_MAX_LIMIT, offset });
       const qs = new URLSearchParams(q).toString();
-      const r = await call('GET', `/api/gds/tasks?${qs}`);
+      const r = await call('GET', `/api/bongos/tasks?${qs}`);
       if (!r || !r.ok) throw new Error(`GET /tasks?status=${status} → ${r && r.status}`);
       const page_rows = (r.data && r.data.tasks) || [];
       rows.push(...page_rows);
@@ -208,7 +208,7 @@ function blockerBody(stranded) {
 
 async function fileBlocker(stranded, { call = apiCall } = {}) {
   if (!stranded.length) return { filed: false, reason: 'nothing to report' };
-  const r = await call('POST', '/api/gds/blockers', {
+  const r = await call('POST', '/api/bongos/blockers', {
     title: `${stranded.length} shipped task(s) claim an artifact nothing on main names`,
     body_md: blockerBody(stranded),
     source: 'artifact-audit',

package/scripts/gds/audit-ships.js

@@ -160,7 +160,7 @@ async function fetchShipped(days) {
   const d = b.domains || {};
   const statusBase = String(d.statusOrigin || d.publicOrigin || '').replace(/\/+$/, '');
   const r = await fetch(
-    `${statusBase}/api/gds/public/recent-shipped?days=${days}&limit=500`
+    `${statusBase}/api/bongos/public/recent-shipped?days=${days}&limit=500`
   );
   const data = await r.json();
   return data.tasks || [];
@@ -174,7 +174,7 @@ async function fetchFullTask(id) {
 }
 
 async function fetchLearning(taskId) {
-  // /api/gds/learnings?task=<id> — we just need body_md.
+  // /api/bongos/learnings?task=<id> — we just need body_md.
   const api = await cliClient();
   const r = await api.learnings.getLearnings({ query: { task: taskId } });
   if (!r.ok) return null;

package/scripts/gds/backfill-cost.js

@@ -2,7 +2,7 @@
 // Backfill cost_log from the art-pipeline cost ledger.
 //
 // Reads art/iterations/cost_ledger.jsonl (gitignored, lives in whichever
-// worktree ran the pipeline) and POSTs each row to /api/gds/cost.
+// worktree ran the pipeline) and POSTs each row to /api/bongos/cost.
 //
 // Idempotent thanks to migration 004_pms_cost_idempotency.sql:
 // re-running this script is a no-op (skipped rows print as 'dup').

package/scripts/gds/backfill-sessions.js

@@ -56,7 +56,7 @@ const argVal = (name) => {
 };
 const EXISTING_FILE = argVal('existing') || '/tmp/otb-existing-session-ids.txt';
 const LIMIT = argVal('limit') ? parseInt(argVal('limit'), 10) : Infinity;
-// The /api/gds write limiter is per-IP 30 writes / 60s (the binding constraint;
+// The /api/bongos write limiter is per-IP 30 writes / 60s (the binding constraint;
 // per-session is 60/60s). 2100ms spacing keeps us safely under 30/min so the
 // limiter never trips during a long backfill. Override with --pace=<ms>.
 const PACE_MS = argVal('pace') ? parseInt(argVal('pace'), 10) : 2100;

package/scripts/gds/backfill-subagent-rewards.js

@@ -37,7 +37,7 @@
 // SAFETY MODEL (mirrors scripts/gds/backfill-task-rewards.js, ADR 0097):
 //   * DRY-RUN BY DEFAULT. With no flags it prints the full plan + grand total and
 //     writes NOTHING. A live mint requires ALL of: --apply, Archon rank verified
-//     server-side via GET /api/gds/me, and a typed y/N confirmation (--yes skips
+//     server-side via GET /api/bongos/me, and a typed y/N confirmation (--yes skips
 //     only the typing).
 //   * IDEMPOTENT BY CONSTRUCTION, not by a new bookkeeping key. Every mint goes
 //     through the REAL reward writer (modules/economy/credits.js

package/scripts/gds/backfill-task-rewards.js

@@ -17,7 +17,7 @@
 //   * DRY-RUN BY DEFAULT. With no flags it prints the full plan + grand total
 //     and writes NOTHING. A live mint requires ALL of:
 //       --apply               explicit opt-in to write
-//       Archon rank           verified server-side via GET /api/gds/me; the
+//       Archon rank           verified server-side via GET /api/bongos/me; the
 //                             script refuses for any other rank
 //       interactive y/N       a typed confirmation at the terminal (skip only
 //                             with --yes, which an Archon must pass deliberately)
@@ -372,7 +372,7 @@ async function main() {
     const api = await cliClient();
     me = await api.me.getMe();
   } catch (err) {
-    console.error('--apply requires a verified Archon session; could not reach /api/gds/me:', err.message);
+    console.error('--apply requires a verified Archon session; could not reach /api/bongos/me:', err.message);
     await pool.end().catch(() => {});
     process.exit(3);
   }

package/scripts/gds/box-auth-check.js

@@ -70,7 +70,7 @@ async function probeMe(tokenInfo) {
   const ctl = new AbortController();
   const timer = setTimeout(() => ctl.abort(), ME_TIMEOUT_MS);
   try {
-    const res = await fetch(`${tokenInfo.apiBase}/api/gds/me`, {
+    const res = await fetch(`${tokenInfo.apiBase}/api/bongos/me`, {
       method: 'GET',
       headers: { Authorization: `Bearer ${tokenInfo.token}`, 'User-Agent': 'box-auth-check/1.0' },
       signal: ctl.signal,

package/scripts/gds/box-sync.js

@@ -89,8 +89,8 @@ async function runWiden(argv) {
   const listOnly = !add && !remove && !clear;
 
   const r = listOnly
-    ? await apiCall('GET', '/api/gds/box/widen')
-    : await apiCall('POST', '/api/gds/box/widen', {
+    ? await apiCall('GET', '/api/bongos/box/widen')
+    : await apiCall('POST', '/api/bongos/box/widen', {
       ...(add ? { add: [add] } : {}),
       ...(remove ? { remove: [remove] } : {}),
       ...(clear ? { clear: true } : {}),
@@ -200,7 +200,7 @@ function formatScopeReport(scope) {
 async function reportScope() {
   try {
     const { apiCall } = require('./cli-lib');
-    const r = await apiCall('GET', '/api/gds/box/scope');
+    const r = await apiCall('GET', '/api/bongos/box/scope');
     if (!r || r.status !== 200) {
       console.log('scope: could not read your box scope right now (that does not affect the sync above).');
       return;

package/scripts/gds/box.js

@@ -197,14 +197,14 @@ async function resolveBuilder(pool, ref) {
 // 1002466). Split out of cmdProvision so GDS_BASE — and the named-tunnel block
 // baked in beside it — can be unit-tested without DB/DO/Cloudflare.
 //
-// GDS_BASE is the FULL api base (origin + /api/gds), matching what
+// GDS_BASE is the FULL api base (origin + /api/bongos), matching what
 // infra/box-report-*.sh already derive from the session file when the env var is
 // absent (`"$GDS_BASE/box/host-keys"` with no further path inserted) — every box
 // used to get this only as a fallback derived on-box; baking it explicitly closes
 // the one on-box script (box-source-fetch.sh, out-of-repo) that skips that
 // derivation entirely and hardcodes a different instance's origin instead.
 function buildBoxEnv({ apiOrigin, namedTunnel }) {
-  let env = `# /etc/otb/box.env — baked by box.js provision\nGDS_BASE=${String(apiOrigin).replace(/\/+$/, '')}/api/gds\n`;
+  let env = `# /etc/otb/box.env — baked by box.js provision\nGDS_BASE=${String(apiOrigin).replace(/\/+$/, '')}/api/bongos\n`;
   if (namedTunnel) {
     const { token, hostname, credential, previewHostname } = namedTunnel;
     env += `# named tunnel (#771/#774, ADR 0038)\nBOX_TUNNEL_TOKEN=${token}\nBOX_TERMINAL_HOSTNAME=${hostname}\nBOX_TERMINAL_CREDENTIAL=${credential}\nBOX_PREVIEW_HOSTNAME=${previewHostname}\n`;
@@ -506,16 +506,16 @@ function printWelcomePacket(login, scope) {
   console.log('own Mac/Windows (it signs you in, makes + registers your SSH key, and');
   console.log('installs the Claude Desktop connection file):');
   console.log('');
-  console.log(`  macOS/Linux:  curl -fsSL ${base}/api/gds/box/connect.sh | bash`);
-  console.log(`  Windows:      irm ${base}/api/gds/box/connect.ps1 | iex`);
-  console.log(`  (guide:       ${base}/api/gds/box/connect )`);
+  console.log(`  macOS/Linux:  curl -fsSL ${base}/api/bongos/box/connect.sh | bash`);
+  console.log(`  Windows:      irm ${base}/api/bongos/box/connect.ps1 | iex`);
+  console.log(`  (guide:       ${base}/api/bongos/box/connect )`);
   console.log('');
   console.log(`Then: restart Claude Desktop → Code → Environment → "${boxEnvLabel()} Dev Box".`);
   console.log('');
   console.log('On a Chromebook / browser-only device (no Claude Desktop)? Skip the above —');
   console.log('your box serves its own terminal in a browser tab (ADR 0038). Once it is');
   console.log('active, get the URL + password and open it:');
-  console.log(`  GET ${base}/api/gds/box/terminal   (or run /builder-box)`);
+  console.log(`  GET ${base}/api/bongos/box/terminal   (or run /builder-box)`);
   console.log('In that terminal, type `claude` to start working.');
   console.log('');
   console.log(`Your box:  ${host}  (scope=${scope})`);
@@ -532,8 +532,8 @@ async function cmdOnboard(pool, boxes, boxOnboard, ref, { apply, allowNoKeys })
     console.error(`✖ @${builder.github_login} has no registered SSH key yet — the box would have no way in.`);
     console.error('');
     console.error('  Ask the builder to connect FIRST (this registers their key), then re-run onboard:');
-    console.error(`    macOS/Linux:  curl -fsSL ${gdsBase()}/api/gds/box/connect.sh | bash`);
-    console.error(`    Windows:      irm ${gdsBase()}/api/gds/box/connect.ps1 | iex`);
+    console.error(`    macOS/Linux:  curl -fsSL ${gdsBase()}/api/bongos/box/connect.sh | bash`);
+    console.error(`    Windows:      irm ${gdsBase()}/api/bongos/box/connect.ps1 | iex`);
     console.error('');
     console.error('  (Override with --allow-no-keys to provision a keyless box anyway — you will');
     console.error('   then have to re-provision once they register a key.)');
@@ -890,7 +890,7 @@ async function cmdSweepDormant(pool, boxes, { apply }) {
 
   const sendWarning = async (box, days) => {
     const left = Math.max(CONFIG.dormantDays - days, 0);
-    const ping = postReclaimPing(`@${box.github_login} — your dev box has been parked ${days} days. Its saved disk image will be reclaimed in ${left} day(s) to save cost, and anything on it you haven't pushed will be gone with it. Wake it any time with POST /api/gds/box/ensure to keep it.`);
+    const ping = postReclaimPing(`@${box.github_login} — your dev box has been parked ${days} days. Its saved disk image will be reclaimed in ${left} day(s) to save cost, and anything on it you haven't pushed will be gone with it. Wake it any time with POST /api/bongos/box/ensure to keep it.`);
     if (!ping.ok) { pingFailed++; return false; }
     await boxes.recordEvent(pool, {
       boxId: box.id, builderId: box.builder_id, event: 'dormant_warning',
@@ -921,7 +921,7 @@ async function cmdSweepDormant(pool, boxes, { apply }) {
     try {
       await deprovisionOne(pool, boxes, needDo(), box, { actor: 'sweep:dormant' });
       reclaimed++;
-      const ping = postReclaimPing(`@${box.github_login} — your dev box was parked for ${days} days and has now been reclaimed to save cost, as warned. Queue a fresh one anytime with POST /api/gds/box/ensure (no operator needed); your memory is server-side and unaffected.`);
+      const ping = postReclaimPing(`@${box.github_login} — your dev box was parked for ${days} days and has now been reclaimed to save cost, as warned. Queue a fresh one anytime with POST /api/bongos/box/ensure (no operator needed); your memory is server-side and unaffected.`);
       if (!ping.ok) pingFailed++;
       console.log(`  ✓ reclaimed @${box.github_login} (parked ${days}d)${ping.ok ? '' : ' [chat ping failed]'}`);
     } catch (e) { errors++; await markErrorUnlessDestroyed(pool, boxes, box.builder_id, e.message); console.log(`  ✖ @${box.github_login}: ${e.message}`); }

package/scripts/gds/build-cli-package.js

@@ -131,7 +131,7 @@ const VERBS = {
   login:   { script: 'login.js',   group: 'account', summary: 'Sign in to an instance  (bongos login <url> — browser click, no paste)' },
   reauth:  { script: 'reauth.js',  group: 'account', summary: 'Refresh your session' },
   setup:   { script: 'setup.js',   group: 'account', summary: 'Finish builder setup on this instance (disciplines, consent)' },
-  box:     { script: 'api.js', prefixArgs: ['POST', '/api/gds/box/ensure'], group: 'account', summary: 'Turn on / wake your cloud dev box' },
+  box:     { script: 'api.js', prefixArgs: ['POST', '/api/bongos/box/ensure'], group: 'account', summary: 'Turn on / wake your cloud dev box' },
   shell:   { script: 'shell.js',   group: 'account', summary: 'Open a terminal on your dev box' },
   code:    { script: 'code.js',    group: 'account', summary: 'Open VS Code on your dev box over Remote-SSH' },
 
@@ -142,7 +142,7 @@ const VERBS = {
   cost:    { script: 'cost.js',    group: 'work', summary: 'Log a cost entry' },
   release: { script: 'release.js', group: 'work', summary: 'Cancel a claim — task returns to ready' },
 
-  api:     { script: 'api.js',     group: 'work', summary: 'Call any instance endpoint  (bongos api GET /api/gds/me)' },
+  api:     { script: 'api.js',     group: 'work', summary: 'Call any instance endpoint  (bongos api GET /api/bongos/me)' },
 };
 
 // Verbs that exist in the full core CLI and are deliberately absent here. The dispatcher prints
@@ -419,7 +419,7 @@ Run \`bongos help\` for the current list. In short: \`login\`, \`reauth\`, \`set
 the web hall can do is reachable from the terminal:
 
 \`\`\`sh
-bongos api GET /api/gds/me
+bongos api GET /api/bongos/me
 \`\`\`
 
 ## Writing code

package/scripts/gds/capture.js

@@ -37,7 +37,7 @@
 //   --kind     → server auto-classifies from title+body (keyword heuristics
 //                today; replaced by the real classifier when task B1 ships)
 //   --version  → most recent version with status='building' (queried from
-//                /api/gds/versions); leave null if there isn't one
+//                /api/bongos/versions); leave null if there isn't one
 //   --priority → null (set later at triage time)
 //   --goal     → capture-time ROUTING (task 1003070, R09 of goal 1000071,
 //                interview decision 4). Naming a goal turns this filing into a
@@ -396,7 +396,7 @@ async function main() {
     await offerToDevelop(idea.id);
   }
 
-  // Migration detection lives only on the server now (POST /api/gds/tasks sets
+  // Migration detection lives only on the server now (POST /api/bongos/tasks sets
   // tasks.needs_migration from the title/description on create — migration 081,
   // task 876). Ideas carry no touches[] and aren't tasks, so the old CLI-side
   // "keep 'migrations/' in touches[]" hint was removed with the sentinel it

package/scripts/gds/ci-grade.js

@@ -3,7 +3,7 @@
 // gate (#855, ADR 0042). This is the security KEYSTONE for the ci deploy mode.
 //
 // WHY it must run in CI (not "read the recorded grade"):
-//   POST /api/gds/tasks/:id/grade records the grader scores FROM THE REQUEST
+//   POST /api/bongos/tasks/:id/grade records the grader scores FROM THE REQUEST
 //   BODY — the server does not independently recompute them. In laptop mode the
 //   grader runs on the OPERATOR's trusted machine, so that's fine. In ci mode the
 //   merge trigger moves to an UNTRUSTED builder machine; a tampered local ship.js

package/scripts/gds/claim-recall.js

@@ -2,11 +2,11 @@
 // Claim-time recall hits (#956 / V4.R18 — criterion sessions-start-knowing).
 //
 // When a builder claims a task, surface the top project-knowledge sources for it
-// (POST /api/gds/search — the rank/owner-scoped lexical recall layer, ADR 0060) so
+// (POST /api/bongos/search — the rank/owner-scoped lexical recall layer, ADR 0060) so
 // the work starts already pointed at the relevant ADRs / recipes / session-logs /
 // learnings instead of re-discovering them. This is the claim-time half of the
 // recall surface the V4.R04 context pack (#942) promised; #963 added the
-// resumed-session (SessionStart) half. The two share the same /api/gds/search call
+// resumed-session (SessionStart) half. The two share the same /api/bongos/search call
 // and the same title-cleaning, so a session sees the same knowledge whether it
 // claims fresh or resumes.
 //

package/scripts/gds/cli-lib.js

@@ -810,7 +810,7 @@ async function cliClient(opts = {}) {
 // ---- does this instance even HAVE dev boxes? (task 1003730) -----------------
 // The dev-box module is a CONTROL-PLANE capability: it provisions DigitalOcean droplets, so a
 // hosted co-tenant instance runs without it. The instance manifest has always said so —
-// GET /api/gds/instance carries modules.enabled — but no CLI script read it, so `bongos shell`
+// GET /api/bongos/instance carries modules.enabled — but no CLI script read it, so `bongos shell`
 // on such an instance died with a bare `POST /box/ensure failed (HTTP 404: not_found)`.
 //
 // That mattered far more than a bad error string: the public CLI (ADR 0258) answers
@@ -956,7 +956,7 @@ function tableTask(t) {
 
 // V3.R13 (#237): one-line "next: <stage>" nudge for newcomers.
 //
-// Given the /api/gds/me response, print a banner pointing at the next
+// Given the /api/bongos/me response, print a banner pointing at the next
 // uncleared onboarding stage. Silent when the builder has graduated or has
 // already cleared first_ship (the post-newcomer threshold) — gates lift
 // after the first ship, so the nudge is too. Also silent when the
@@ -1038,7 +1038,7 @@ function printCostWarning(meBody) {
 }
 
 // task 1013 / ADR 0073: the CLI half of the consistent "the system needs an input
-// from you" signal. Given the /api/gds/me response, print a short line for each
+// from you" signal. Given the /api/bongos/me response, print a short line for each
 // `needs` item in the action_needed state — the builder's private surface is the
 // right place to tell them an input is missing (mirrors printCostWarning). Silent
 // when nothing needs action (covered / satisfied items don't nag) or when the

package/scripts/gds/context-pack.js

@@ -184,7 +184,7 @@ function osFacts({ platform, runWhich }) {
   };
 }
 
-// Normalize active claims (from /api/gds/me) into {id, title, current} rows.
+// Normalize active claims (from /api/bongos/me) into {id, title, current} rows.
 // currentTaskId marks the one just claimed so the print can say "(this one)".
 function normalizeClaims(activeClaims, currentTaskId) {
   const rows = Array.isArray(activeClaims) ? activeClaims : [];

package/scripts/gds/copy-apply.js

@@ -219,7 +219,7 @@ function refuse(result) {
 // answered from the same source of truth — the shape of bug where a rule is
 // enforced on one path and merely stated on the other (task 1003493).
 async function activeClaims() {
-  const me = await apiCall('GET', '/api/gds/me');
+  const me = await apiCall('GET', '/api/bongos/me');
   if (!me.ok) return { ok: false, code: 'no_session', detail: { status: me.status, run: 'node scripts/gds/setup.js' } };
   return { ok: true, claims: me.data.active_claims || (me.data.active_claim ? [me.data.active_claim] : []) };
 }
@@ -295,7 +295,7 @@ async function loadPatch({ taskId, patchFile }) {
       ? ['```' + proposals.FENCE, raw.trim(), '```'].join('\n')
       : raw);
   }
-  const res = await apiCall('GET', `/api/gds/tasks/${taskId}`);
+  const res = await apiCall('GET', `/api/bongos/tasks/${taskId}`);
   if (!res.ok) {
     return { ok: false, code: 'task_unreadable', detail: { task: taskId, status: res.status } };
   }