@bongos/core 1.19.838 → 1.19.839

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.838",
-  "core_contract": "1.19.838",
-  "source_commit": "f5c78584166eedac7972dcb10f61e55d7c1685e7",
+  "core_version": "1.19.839",
+  "core_contract": "1.19.839",
+  "source_commit": "2799589e44782acf35629e14f332ac30686ed028",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T17:02:39.487Z",
+  "built_at": "2026-09-17T17:25:32.211Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 494,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2257,
+    "functional_verbatim": 2258,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2777,
-  "tree_sha256": "61bef3a77f3f90a904e83ae13d78fa314c21c944451e91a369fb047fc78d9b7a",
+  "file_count": 2778,
+  "tree_sha256": "209c682e3b1a302720d23b8e207501aba43d917dc24ebe0fe4d11836c49a6af8",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -382,7 +382,7 @@
     {
       "path": "config/branding.neutral.json",
       "mode": "0000644",
-      "sha256": "b56024a95ccf9e236bf8248b7d1f96c4510e3feac55c2885497ecd8f841bdb7b"
+      "sha256": "3c46f007c474b0fe300ad1c6e2c80237948a81a8ad726f15f74ec5ba7cf2b610"
     },
     {
       "path": "config/design-tokens.neutral.json",
@@ -2022,12 +2022,12 @@
     {
       "path": "docs/branding-contract.md",
       "mode": "0000644",
-      "sha256": "807e79e99b60a7a310c532af8ce5d3c9a23da4f5ac568cf6dd501feeca93ba46"
+      "sha256": "78cb92eedefb10a2cd23b0dff8e2a6d5499295487372b7ef7da5619f99d4cdde"
     },
     {
       "path": "docs/branding-fill-prompt.md",
       "mode": "0000644",
-      "sha256": "38961b4a3b3e0789b64365dc3cb70eb3407f45e9a8ecdd1667ef80ec8470e272"
+      "sha256": "91e0fab10096223b9e99ba764330b61f5c64f754d0b2845a050057ddbe5a34e0"
     },
     {
       "path": "docs/canonical-permissions.md",
@@ -2037,12 +2037,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "47070b89dd6a26d425e630db6b592b9b99ce73197e39c21b416caa5a12b330df"
+      "sha256": "e457040f6938ad12012fb8ceb1b59de65d43f2fca74849181f1e448979a4c811"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "cceabb45bbe7b9aabe8484777a8567fc9d73f274486475a80b1c04a43152f7c8"
+      "sha256": "77a0c2bb223c37af27b3dac3ca8864bad9b1bcb0bc6c326c96f40cec6f9ba95d"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2567,7 +2567,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "aed7cd21803eab964c3d296c5f938e8c94b9e05fb865ce3bb5780574a5fdcebb"
+      "sha256": "689361320ab6192aade8cb602c862af1f14454238575da829015077f55743628"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7432,7 +7432,7 @@
     {
       "path": "modules/status-ui/public/index.html",
       "mode": "0000644",
-      "sha256": "c9a37a51e098cd7ab7dfbb1a800b767ac25f5ade6ef40c22ea47ca326a4b8dc3"
+      "sha256": "25e98c2822bb8b3613edbe369ac374128e07bc6c8abf126f90a781e5e0238e8e"
     },
     {
       "path": "modules/status-ui/public/snapshots/.gitkeep",
@@ -7867,12 +7867,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9baa1aa306e1c7925d66fc09484dc2c214ad13fa47e4d71c39fc6d7ca2d6e8a6"
+      "sha256": "fe22ff711989f39c34fa95045c0736e26abc2400d698548f353121fbd1ff8828"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9b0fe6c23bdb7eb915bcb6d049e341258d1daa654a791355ac8ca92bfd58a02b"
+      "sha256": "f15fdfca04599ce879e85f8229aeba9019d17476e6020ebdec4ea03a98d4bd76"
     },
     {
       "path": "public-docs/index.html",
@@ -8372,7 +8372,7 @@
     {
       "path": "scripts/gds/fitness-checks-identity.js",
       "mode": "0000644",
-      "sha256": "583b21bf6527b657058ebfab50aff8c51cec96a0b1baa4d01daea55e90d0ccf7"
+      "sha256": "ae5589886edaa98d66d7bb4b918b47220628c82337535ffeaa2b5cb0c5e2adc0"
     },
     {
       "path": "scripts/gds/fitness-checks-packaging.js",
@@ -8412,7 +8412,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "42c49bcab43be3367f05b99f4dfded590edf89ae10c1a3df2d9312b6e0d33fc9"
+      "sha256": "5f96e59cb4c27e20c6acaabf8f97b94dc69875b5fb5770fb37e4fb838128b189"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -9457,7 +9457,7 @@
     {
       "path": "scripts/status-mirror-sync.js",
       "mode": "0000644",
-      "sha256": "845c8dad87038fe273563e8eda7126e70ac1afe8f9eee8c4364a4404490c4f5f"
+      "sha256": "013860b6269302ca2b9db511cfdd3b915e9963bfcbd3d528dcd086cbe40f94a8"
     },
     {
       "path": "scripts/status-probe.mjs",
@@ -9772,7 +9772,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "697273b43a6825da4828c7b9e6e721843dcf9fd74bd30b94cc22e129995110f4"
+      "sha256": "fb6c9149b602356e3973b62c5042c373c92018e04242decd4a29c2c0897ddec3"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -9782,7 +9782,7 @@
     {
       "path": "src/branding.js",
       "mode": "0000644",
-      "sha256": "1d9d566c08fcba34060177bf1bd9c47df08f7c61b6805c305a34fd2d0d280310"
+      "sha256": "086e80cd5effd41bcbada467b5538afa2d35f549b8efd90408d99e39ab2e29ec"
     },
     {
       "path": "src/build-info.js",
@@ -9802,7 +9802,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3363fefd57cbb3a31327b1c613ebdd4a325e26071a575237a7e0ec467a3f74c7"
+      "sha256": "027988bab5433e279e5b5cd479a768f655dd68bc1e7e19d31279d140be462d2a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11032,7 +11032,7 @@
     {
       "path": "tests/fitness.mjs",
       "mode": "0000644",
-      "sha256": "b222f8b2436ccf9f392c836104e9f889a8bbe537390fcd53872f359114388f0a"
+      "sha256": "7252f8134ae29b16df7c136865acb110263cc862781d7ae26ee416398caa1f09"
     },
     {
       "path": "tests/fitness_gds_ratchet.mjs",
@@ -13509,6 +13509,11 @@
       "mode": "0000644",
       "sha256": "369981934c65608fb4198c7840bd918c25caa3e5a1aa44b22fe38663e728e7f2"
     },
+    {
+      "path": "tests/status_company_attribution.mjs",
+      "mode": "0000644",
+      "sha256": "4b92c96ae496736b0f44182e64d42a24f108cb51fbeb5cf7cd5814ad336b14f6"
+    },
     {
       "path": "tests/status_mirror_sync.mjs",
       "mode": "0000644",

package/config/branding.neutral.json

@@ -5,7 +5,8 @@
     "worldName": "Cloud Bongos",
     "company": {
       "name": "",
-      "site": ""
+      "site": "",
+      "tagline": ""
     }
   },
   "llmProjectName": "this project",

package/docs/branding-contract.md

@@ -21,7 +21,7 @@ env override   →   instance config (config/branding.json)   →   neutral star
 |---|---|
 | `identity.productName` | The product name (e.g. "Example"). **Required.** |
 | `identity.worldName` | The in-world / civilization name rendered at runtime (e.g. "Example"). **Required.** |
-| `identity.company` | `{ name, site }` of the operating company (may be empty). |
+| `identity.company` | `{ name, site, tagline }` of the operating company — every field may be empty. `tagline` is the free-text clause that follows the name in the status page footer ("{{worldName}} is the work of **name**, *tagline*."), so put a location there if you want one; there is no separate location field. The footer stamps them as `{{companyName}}` / `{{companySite}}` / `{{companyTagline}}`, and each clause sits in a `<!--brand-if:KEY-->…<!--/brand-if:KEY-->` region that drops whole when its field is empty: no name hides the whole sentence, no site renders the name unlinked, no tagline ends the sentence at the name. (task [#1002853](https://cloudbongos.com/builders#/task/1002853)) |
 | `llmProjectName` | The project name injected into grader / architect / onboarding **LLM prompts**, so a non-OTB instance is graded against its own identity. **Required.** |
 | `domains.publicOrigin` | Public game/app origin. **Required.** |
 | `domains.buildersOrigin` / `statusOrigin` | Hall + status origins. **These three (`publicOrigin`/`buildersOrigin`/`statusOrigin`) are the docs-discovery contract** ([ADR 0114](adr/0114-instance-docs-discovery-contract.md)): the hall is the canonical doc-reading surface, `/docs` on `publicOrigin` renders the API reference, the status page is the outage fallback. `GET <publicOrigin>/api/bongos` re-advertises them (`hall`/`status`/`public`) so an agent resolves the surfaces with no hard-coded host. |

package/docs/branding-fill-prompt.md

@@ -8,7 +8,7 @@ Paste the block below into your own LLM (Claude, etc.). It interviews you and em
 >
 > Interview me for:
 > 1. **Product name** and the **in-world / display name** (can be the same).
-> 2. **Operating company** name + website (optional).
+> 2. **Operating company** name + website + a one-line descriptor such as "a rocket works in Dayton, Ohio" (all optional; `identity.company.tagline`).
 > 3. **Domains:** public origin, hall origin, status origin, the OAuth sign-in origin, and the session cookie domain (use `""` for a host-only cookie unless you run subdomains — never widen it casually).
 > 4. **GitHub repo** (`owner`, `name`) this instance ships to.
 > 5. **Reward currency label** (the unit builders earn; the math is fixed — this is display only).

package/docs/copy-inventory.md

@@ -1472,7 +1472,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | id | conf | text | where |
 |---|---|---|---|
 | `33aaf5eb47b2` | certain | ${…} of ${…} spent | `modules/status-ui/public/status.js:222` |
-| `c5fbe5ea4335` | certain | , a third-party logistics house in Cleveland, Ohio. | `modules/status-ui/public/index.html:355` |
+| `d31b6094f7ac` | certain | , {{companyTagline}} | `modules/status-ui/public/index.html:356` |
 | `2045078fb115` | certain | 90 days ago | `modules/status-ui/public/status.js:477` |
 | `e4848e2d9386` | certain | A new portrait is set down each time the city's stones are reshaped. Scroll to see how {{worldName}} has grown | `modules/status-ui/public/index.html:344` |
 | `390faeaffb47` | certain | A project | `modules/status-ui/public/explore.js:71` |
@@ -1560,10 +1560,10 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `b97f429c33fe` | certain | works shipped (90d) | `modules/status-ui/public/index.html:218` |
 | `71a303e1ba09` | certain | works wrought, last 7 days | `modules/status-ui/public/index.html:167` |
 | `24ea04f49b3d` | certain | year's purse | `modules/status-ui/public/index.html:259` |
-| `4c45bbf03088` | certain | {{Currency}} are wrought by the lawmen's review; redemption awaits their seal. | `modules/status-ui/public/index.html:356` |
+| `4c45bbf03088` | certain | {{Currency}} are wrought by the lawmen's review; redemption awaits their seal. | `modules/status-ui/public/index.html:357` |
 | `89aa84ef4595` | certain | {{Currency}} spent, against the value wrought. | `modules/status-ui/public/index.html:245` |
 | `35872b9ecc49` | certain | {{currency}} spent | `modules/status-ui/public/index.html:251` |
-| `e87f28d25342` | certain | {{worldName}} is the work of | `modules/status-ui/public/index.html:355` |
+| `e87f28d25342` | certain | {{worldName}} is the work of | `modules/status-ui/public/index.html:356` |
 | `7a15e19adbd2` | certain | {{worldName}} — the public ledger | `modules/status-ui/public/index.html:6` |
 | `7a15e19adbd2` | certain | {{worldName}} — the public ledger | `modules/status-ui/public/index.html:6` |
 | `12e0efd49a32` | certain | {…} goal{…} · {…} achieved | `modules/status-ui/public/status.js:582` |

package/docs/copy-registry.json

@@ -17802,11 +17802,11 @@
       "confidence": "certain"
     },
     {
-      "id": "c5fbe5ea4335",
+      "id": "d31b6094f7ac",
       "surface": "status-dashboard",
-      "text": ", a third-party logistics house in Cleveland, Ohio.",
+      "text": ", {{companyTagline}}",
       "file": "modules/status-ui/public/index.html",
-      "line": 355,
+      "line": 356,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -18598,7 +18598,7 @@
       "surface": "status-dashboard",
       "text": "{{Currency}} are wrought by the lawmen's review; redemption awaits their seal.",
       "file": "modules/status-ui/public/index.html",
-      "line": 356,
+      "line": 357,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -18625,7 +18625,7 @@
       "surface": "status-dashboard",
       "text": "{{worldName}} is the work of",
       "file": "modules/status-ui/public/index.html",
-      "line": 355,
+      "line": 356,
       "origin": "html-text",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -2150,5 +2150,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.836 with no explicit bump. run 35248928789. (task 1002620)
   1.19.838 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.837 with no explicit bump. run 35250225228. (task 1002620)
+  1.19.839 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.838 with no explicit bump. run 35252591179. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/status-ui/public/index.html

@@ -352,7 +352,8 @@
     <svg><use href="#orn-diamond"/></svg>
   </div>
   <p class="foot__seal">By order of the Senate</p>
-  <p>{{worldName}} is the work of <a href="https://hermeslines.com" target="_blank" rel="noopener"><strong>Hermeslines</strong></a>, a third-party logistics house in Cleveland, Ohio.</p>
+  <!-- task 1002853: every company field is optional, so each clause drops whole when its pack field is empty -->
+  <!--brand-if:companyName--><p>{{worldName}} is the work of <!--brand-if:companySite--><a href="{{companySite}}" target="_blank" rel="noopener"><!--/brand-if:companySite--><strong>{{companyName}}</strong><!--brand-if:companySite--></a><!--/brand-if:companySite--><!--brand-if:companyTagline-->, {{companyTagline}}<!--/brand-if:companyTagline-->.</p><!--/brand-if:companyName-->
   <p>{{Currency}} are wrought by the lawmen's review; redemption awaits their seal.</p>
 </footer>
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.838",
+  "version": "1.19.839",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.838",
+      "version": "1.19.839",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.838",
+  "version": "1.19.839",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness-checks-identity.js

@@ -41,6 +41,9 @@ const { CORE_ROOT, MODULE_ROOTS, REPO_ROOT, rel } = require('./fitness-lib.js');
 const PROMPT_IDENTITY_LITERALS = [
   /off the boats/i,
   /amazonprimea/i,
+  // The host's operating company (task 1002853): the scan already covered the status
+  // page's HTML, but with only the product listed its footer credited this company for years.
+  /hermeslines/i,
 ];
 // Scan roots (recursive) + kernel-prompt CLIs that live outside them.
 // scripts/gds joined at task 1002427: the builder CLI was UNSCANNED, which is how
@@ -101,7 +104,7 @@ const IDENTITY_SCAN_EXTRA_FILES = [];
 const IDENTITY_SCAN_ALLOWED = {
   // task 1003206 moved Check 13's own regexes out of fitness.js into THIS file
   // when the monolith was split, so the detector's self-carve-out moved with them.
-  'scripts/gds/fitness-checks-identity.js': 2,
+  'scripts/gds/fitness-checks-identity.js': 3,
   'scripts/gds/package-core.js': 1,
   // audit-replay.sh + db-backup-{nightly,offsite}.sh were carved out here as
   // "host-pinned ops"; task 1002757 RETIRED that justification for them — each
@@ -125,6 +128,11 @@ const IDENTITY_SCAN_ALLOWED = {
   'scripts/gds/seed-productization-tasks.js': 6,
   'scripts/gds/seed-provisioning-tasks.js': 2,
   'scripts/gds/version-close.js': 1,
+  // task 1002853 (the company literal joined the list): audit-authorship.sh is itself a
+  // detector — its ops allowlist names the founder's commit address so it can exempt it; grade-smoke.js
+  // is a protected grader probe whose fixture task prose names the company, the seed-*.js rationale.
+  'scripts/gds/audit-authorship.sh': 1,
+  'scripts/gds/grade-smoke.js': 1,
 };
 // `.sh` joined at task 1002567: the extension set was `.js/.html/.css`, so NO shell
 // script had ever been scanned — which is how scripts/gds/lib.sh kept a hardcoded

package/scripts/gds/fitness.js

@@ -113,6 +113,12 @@ const ROOT_CHAR_HARD_MAX = 42000; // ~10.5K tokens — the always-loaded file mu
 const ROOT_CHAR_TARGET = 32000;   // ~8K tokens — aspirational, mirrors the ~200-line aim.
 const estTokens = (n) => Math.round(n / 4); // ~4 chars/token for markdown prose.
 
+// Where the charter BODY lives since task 1003687. It is guidance for EDITING a
+// CLAUDE.md, so it is paths-scoped (`paths:` frontmatter, same mechanism as
+// .claude/rules/hook-authoring.md) and costs nothing in the sessions — the large
+// majority — that never open one. The kernel keeps the heading and a pointer.
+const CHARTER_RULE_REL = '.claude/rules/claudemd-authoring.md';
+
 function checkClaudeMdBudget(opts = {}) {
   const p = path.join(INSTANCE_ROOT, 'CLAUDE.md'); // the root CLAUDE.md is INSTANCE content (materialized per instance; ADR 0108)
   const text = opts.text != null ? opts.text : fs.readFileSync(p, 'utf8');
@@ -133,8 +139,35 @@ function checkClaudeMdBudget(opts = {}) {
   }
   if (!text.includes('## Working with this file (content charter)')) {
     violations.push('CLAUDE.md is missing the content-charter section (ADR 0061) — the per-line test + "what goes where" table must stay.');
+  } else {
+    // Task 1003687 relocated the charter BODY to a paths-scoped rule, so the kernel
+    // keeps the heading and a pointer. That makes the heading cheap to fake: a section
+    // with nothing behind it satisfies a substring check while the rules it names are
+    // gone. So the charter must resolve to something — either inline here, or through a
+    // pointer whose target actually exists and still carries the two rules + the table.
+    const namesRule = text.includes(CHARTER_RULE_REL);
+    const inlineCharter = text.includes('Per-line test:');
+    if (namesRule) {
+      const rulePath = path.join(INSTANCE_ROOT, CHARTER_RULE_REL); // .claude/ is materialized INSTANCE content (ADR 0108 §3)
+      if (!fs.existsSync(rulePath)) {
+        violations.push(`CLAUDE.md points its content charter at ${CHARTER_RULE_REL}, but that file does not exist — a pointer to nothing is worse than no pointer (ADR 0061 / task 1003687).`);
+      } else {
+        const rule = fs.readFileSync(rulePath, 'utf8');
+        const missing = [];
+        if (!/^---\r?\n[\s\S]*?\bpaths:[\s\S]*?["']\*\*\/CLAUDE\.md["'][\s\S]*?^---$/m.test(rule)) {
+          missing.push('`paths:` frontmatter matching `**/CLAUDE.md` (without it the rule never loads, and the charter is simply gone)');
+        }
+        if (!rule.includes('Per-line test:')) missing.push('the per-line test');
+        if (!rule.includes('## What goes where')) missing.push('the "what goes where" table');
+        if (missing.length) {
+          violations.push(`${CHARTER_RULE_REL} is missing ${missing.join(', ')} — the kernel delegates the charter to it, so the charter is only as real as that file (ADR 0061 / task 1003687).`);
+        }
+      }
+    } else if (!inlineCharter) {
+      violations.push('The CLAUDE.md content-charter section is hollow — it has the heading but neither the per-line test inline nor a pointer to `' + CHARTER_RULE_REL + '`. The heading exists to make the rules findable; on its own it only satisfies this check (ADR 0061).');
+    }
   }
-  return { name: 'root CLAUDE.md budget + charter', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings, note: `≤ ${ROOT_HARD_MAX} lines / ${ROOT_CHAR_HARD_MAX} chars (~${estTokens(ROOT_CHAR_HARD_MAX)} tok); targets ~${ROOT_TARGET} lines / ~${estTokens(ROOT_CHAR_TARGET)} tok; charter present.` };
+  return { name: 'root CLAUDE.md budget + charter', ok: violations.length === 0, hardFail: violations.length > 0, violations, warnings, note: `≤ ${ROOT_HARD_MAX} lines / ${ROOT_CHAR_HARD_MAX} chars (~${estTokens(ROOT_CHAR_HARD_MAX)} tok); targets ~${ROOT_TARGET} lines / ~${estTokens(ROOT_CHAR_TARGET)} tok; charter resolves (inline or via ${CHARTER_RULE_REL}).` };
 }
 
 // ============================================================================

package/scripts/status-mirror-sync.js

@@ -48,7 +48,7 @@ const { execFileSync } = require('node:child_process');
 
 const REPO_ROOT = path.resolve(__dirname, '..');
 const SRC = path.join(REPO_ROOT, 'modules', 'status-ui', 'public');
-const { branding, clientBranding } = require('../src/branding');
+const { branding, clientBranding, applyBrandConditionals } = require('../src/branding');
 
 // Stamp instance-identity tokens into the mirror HTML. The off-box mirror is
 // served by a static Pages host, NOT the branding-injecting Node server — so this
@@ -63,15 +63,19 @@ function brandTokens(html, brand = {}, publicOrigin = '', buildersOrigin = '') {
   const tagline = (brand.copy && brand.copy.tagline) || '';
   const cur = (brand.currency && brand.currency.label) || 'credits';
   const Cur = cur ? cur.charAt(0).toUpperCase() + cur.slice(1) : cur;
+  const company = (brand.identity && brand.identity.company) || {};
   const esc = (s) => String(s == null ? '' : s)
     .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
     .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
-  return html
+  return applyBrandConditionals(html, { companyName: company.name, companySite: company.site, companyTagline: company.tagline })
     .split('{{worldName}}').join(esc(world))
     .split('{{productName}}').join(esc(product))
     .split('{{Currency}}').join(esc(Cur))
     .split('{{currency}}').join(esc(cur))
     .split('{{tagline}}').join(esc(tagline))
+    .split('{{companyName}}').join(esc(company.name))
+    .split('{{companySite}}').join(esc(company.site))
+    .split('{{companyTagline}}').join(esc(company.tagline))
     .split('{{publicOrigin}}').join(esc(publicOrigin || ''))
     .split('{{buildersOrigin}}').join(esc(buildersOrigin || publicOrigin || ''));
 }

package/src/bongos/serve-internal.js

@@ -46,7 +46,7 @@ const { buildStampedHtml } = require('../asset-version');
 const { buildInfo } = require('../build-info');
 const { buildDevboxDownloads } = require('../devbox-downloads');
 const { buildBongosDownloads } = require('../bongos-downloads');
-const { clientBranding, branding } = require('../branding');
+const { clientBranding, branding, applyBrandConditionals } = require('../branding');
 const { prelaunchGate } = require('./prelaunch-gate');
 const { platformVisibilityGate } = require('./platform-visibility-gate');
 const { clientModules, isModuleEnabled } = require('../modules');
@@ -205,6 +205,8 @@ function injectBrandingGlobal(html, brand = clientBranding(), mods = clientModul
 // served page can carry a correct cross-host href or canonical/og: URL: a client
 // fill cannot reach them, and a baked one would make every instance advertise
 // whichever instance happened to author the file (task 1002748, direction C5/C6).
+// {{companyName}} {{companySite}} {{companyTagline}} are optional, so a page wraps
+// each clause in a brand-if region that drops whole when its field is empty (task 1002853).
 // Pure + exported for the test; both origins are injectable so it drives with zero I/O.
 function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOrigin(), hallOrigin = safeBuildersOrigin(), sourceRepo = safeSourceRepoUrl(), instanceBase = safeInstanceBase(), hubOrigin = safeHubOrigin()) {
   const world = (brand.identity && brand.identity.worldName) || '';
@@ -213,12 +215,17 @@ function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOri
   const cur = (brand.currency && brand.currency.label) || 'credits';
   const Cur = cur ? cur.charAt(0).toUpperCase() + cur.slice(1) : cur;
   const hall = hallOrigin || origin || '';
-  return dropEmptyHrefLinks(String(html == null ? '' : html), { publicOrigin: origin || '', buildersOrigin: hall, sourceRepoUrl: sourceRepo || '' })
+  const company = (brand.identity && brand.identity.company) || {};
+  const conditioned = applyBrandConditionals(html == null ? '' : html, { companyName: company.name, companySite: company.site, companyTagline: company.tagline });
+  return dropEmptyHrefLinks(conditioned, { publicOrigin: origin || '', buildersOrigin: hall, sourceRepoUrl: sourceRepo || '' })
     .split('{{worldName}}').join(esc(world))
     .split('{{productName}}').join(esc(product))
     .split('{{Currency}}').join(esc(Cur))
     .split('{{currency}}').join(esc(cur))
     .split('{{tagline}}').join(esc(tagline))
+    .split('{{companyName}}').join(esc(company.name))
+    .split('{{companySite}}').join(esc(company.site))
+    .split('{{companyTagline}}').join(esc(company.tagline))
     .split('{{publicOrigin}}').join(esc(origin || ''))
     // a pack that names no hall of its own resolves to its OWN apex — never to
     // whichever instance authored the file

package/src/branding.js

@@ -221,7 +221,11 @@ function clientBranding(b = branding()) {
     identity: {
       productName: b.identity?.productName || '',
       worldName: b.identity?.worldName || '',
-      company: { name: b.identity?.company?.name || '' },
+      company: {
+        name: b.identity?.company?.name || '',
+        site: b.identity?.company?.site || '',
+        tagline: b.identity?.company?.tagline || '',
+      },
     },
     currency: {
       label: b.currency?.label || 'credits',
@@ -308,4 +312,20 @@ function clientReward() {
   }
 }
 
-module.exports = { resolveBranding, loadBranding, deepMerge, branding, clientBranding, userAgent, NEUTRAL_PATH, INSTANCE_PATH };
+// Resolve the `<!--brand-if:KEY-->…<!--/brand-if:KEY-->` regions of a served page:
+// kept (markers removed) when `values[KEY]` is non-empty, dropped whole otherwise,
+// so an optional pack field removes its entire clause instead of rendering half a
+// sentence (task 1002853). Lives here, not in serve-internal, because the off-box
+// status mirror stamps the same page without loading the server. Repeats until
+// stable so a region nested inside a kept one resolves too.
+const BRAND_IF_REGION = /<!--brand-if:(\w+)-->([\s\S]*?)<!--\/brand-if:\1-->/g;
+function applyBrandConditionals(html, values) {
+  let out = String(html);
+  for (let prev; prev !== out;) {
+    prev = out;
+    out = out.replace(BRAND_IF_REGION, (_, key, inner) => (values[key] ? inner : ''));
+  }
+  return out;
+}
+
+module.exports = { resolveBranding, loadBranding, deepMerge, branding, clientBranding, userAgent, applyBrandConditionals, NEUTRAL_PATH, INSTANCE_PATH };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.838'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.839'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/fitness.mjs

@@ -51,6 +51,51 @@ test('CLAUDE.md char/token budget actually fires on within-line bloat (not a no-
   assert.ok(r.violations.some((v) => /char/i.test(v) && /token/i.test(v)), 'the violation must name the char/token budget');
 });
 
+// --- the charter is RELOCATED, not deleted (task 1003687) --------------------
+// The charter body moved to a paths-scoped rule, so the kernel keeps only a heading
+// and a pointer. That makes the heading trivially fakeable: a section with nothing
+// behind it satisfies a substring check while the rules it names are gone. These
+// pin that the check resolves the pointer rather than trusting the heading — a green
+// check over a missing charter would be a false claim of coverage.
+const CHARTER_HEADING = '## Working with this file (content charter)';
+const CHARTER_RULE_REL = '.claude/rules/claudemd-authoring.md';
+
+test('the charter rule file exists and is paths-scoped to CLAUDE.md', () => {
+  const rule = fs.readFileSync(path.join(ROOT, CHARTER_RULE_REL), 'utf8');
+  assert.match(rule, /^---\r?\n[\s\S]*?\bpaths:[\s\S]*?["']\*\*\/CLAUDE\.md["'][\s\S]*?^---$/m,
+    'without `paths:` frontmatter matching **/CLAUDE.md the rule never loads, and the charter is simply gone');
+  assert.ok(rule.includes('Per-line test:'), 'the per-line test must survive the move');
+  assert.ok(rule.includes('## What goes where'), 'the "what goes where" table must survive the move');
+});
+
+test('the live CLAUDE.md delegates the charter to the rule file', () => {
+  const kernel = fs.readFileSync(path.join(ROOT, 'CLAUDE.md'), 'utf8');
+  assert.ok(kernel.includes(CHARTER_HEADING), 'the heading keeps the rule findable from the file it governs');
+  assert.ok(kernel.includes(CHARTER_RULE_REL), 'the heading must point somewhere, or it is decoration');
+});
+
+test('a hollow charter heading hard-fails (the heading alone is not the charter)', () => {
+  const r = fitness.checkClaudeMdBudget({ text: `${CHARTER_HEADING}\n` });
+  assert.equal(r.hardFail, true, 'a heading with neither inline rules nor a pointer must fail');
+  assert.ok(r.violations.some((v) => /hollow/i.test(v)), 'the violation must name the hollow section');
+});
+
+test('an inline charter still passes (a downstream kernel that never split it)', () => {
+  const r = fitness.checkClaudeMdBudget({ text: `${CHARTER_HEADING}\n- **Per-line test:** …\n` });
+  assert.equal(r.hardFail, false, 'relocation is the cure, not the requirement — inline is still a real charter');
+});
+
+test('a pointer at a missing rule file hard-fails', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'charter-ptr-'));
+  fs.writeFileSync(path.join(dir, 'CLAUDE.md'), `${CHARTER_HEADING}\ncharter: ${CHARTER_RULE_REL}\n`);
+  const out = require('node:child_process').execFileSync(process.execPath,
+    ['-e', `const f=require(${JSON.stringify(path.join(ROOT, 'scripts/gds/fitness.js'))});process.stdout.write(JSON.stringify(f.checkClaudeMdBudget()))`],
+    { env: { ...process.env, BONGOS_INSTANCE_ROOT: dir }, encoding: 'utf8' });
+  const r = JSON.parse(out);
+  assert.equal(r.hardFail, true, 'a pointer to nothing is worse than no pointer');
+  assert.ok(r.violations.some((v) => /does not exist/i.test(v)), 'the violation must say the target is missing');
+});
+
 test('CLAUDE.md char budget is ratcheted and ordered (target < ceiling, live file under it)', () => {
   assert.ok(fitness.ROOT_CHAR_TARGET < fitness.ROOT_CHAR_HARD_MAX, 'target must sit below the hard ceiling');
   const r = fitness.checkClaudeMdBudget();
@@ -778,6 +823,8 @@ test('identity gate actually CATCHES a re-hardcode (code, URL, HTML) — not a n
   assert.equal(scanPromptIdentity('x.js', 'const u = "https://amazonprimea.com/x";').length, 1, 'a leak inside a URL must be caught');
   assert.equal(scanPromptIdentity('x.html', '<title>Amazonprimea</title>').length, 1, 'an HTML title leak must be caught');
   assert.equal(scanPromptIdentity('x.js', 'const p = "Off the Boats";').length, 1, 'the product name must be caught');
+  // task 1002853: the founder's company rode the core status footer because only the product was listed
+  assert.equal(scanPromptIdentity('x.html', '<a href="https://hermeslines.com">Hermeslines</a>').length, 1, 'the host company must be caught');
 });
 
 test('identity gate skips comments + instance-injected tokens (no false positives)', () => {

package/tests/status_company_attribution.mjs

@@ -0,0 +1,60 @@
+// tests/status_company_attribution.mjs — the status page footer's company clause
+// comes from the branding pack, and disappears whole when the pack names no company
+// (task 1002853). Before it, a vanilla instance's CORE-served status page credited
+// the founder's own logistics company as its maker.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { applyBrandTokens } = require('../src/bongos/serve-internal.js');
+const { clientBranding } = require('../src/branding.js');
+const { brandTokens } = require('../scripts/status-mirror-sync.js');
+
+const PAGE = readFileSync(new URL('../modules/status-ui/public/index.html', import.meta.url), 'utf8');
+const brand = (company) => ({ identity: { productName: 'Acme Rockets', worldName: 'Acme', company }, currency: { label: 'tokens' } });
+const footer = (html) => html.match(/<footer[\s\S]*?<\/footer>/)[0];
+const stamp = (company) => footer(applyBrandTokens(PAGE, brand(company), 'https://acme.example', '', '', '', ''));
+
+test('the source page names no company and carries every company slot as a token', () => {
+  assert.doesNotMatch(PAGE, /hermeslines|cleveland/i);
+  for (const t of ['companyName', 'companySite', 'companyTagline']) assert.ok(PAGE.includes(`{{${t}}}`), `{{${t}}} is missing`);
+});
+
+test('a pack with no company drops the whole attribution sentence, not half of it', () => {
+  const out = stamp({ name: '', site: 'https://ignored.example', tagline: 'ignored' });
+  assert.doesNotMatch(out, /is the work of|ignored/);
+  assert.doesNotMatch(out, /\{\{|brand-if/);
+  assert.match(out, /Tokens are wrought/, 'the neighbouring footer lines survive');
+});
+
+test('a full company renders the linked name and its tagline', () => {
+  const out = stamp({ name: 'Acme Corp', site: 'https://acme-corp.example', tagline: 'a rocket works in Dayton' });
+  assert.match(out, /<p>Acme is the work of <a href="https:\/\/acme-corp\.example" target="_blank" rel="noopener"><strong>Acme Corp<\/strong><\/a>, a rocket works in Dayton\.<\/p>/);
+  assert.doesNotMatch(out, /\{\{|brand-if/);
+});
+
+test('a company with no site or tagline renders the bare name, never an empty href or a dangling comma', () => {
+  const out = stamp({ name: 'Acme Corp', site: '', tagline: '' });
+  assert.match(out, /<p>Acme is the work of <strong>Acme Corp<\/strong>\.<\/p>/);
+  assert.doesNotMatch(out, /href=""|, \./);
+});
+
+test('company values are escaped like every other token', () => {
+  const out = stamp({ name: 'A<b>', site: 'https://x.example/"onmouseover="x', tagline: '' });
+  assert.ok(out.includes('<strong>A&lt;b&gt;</strong>'));
+  assert.ok(out.includes('href="https://x.example/&quot;onmouseover=&quot;x"'));
+});
+
+test('the off-box mirror stamps the footer exactly as the served page does (KEEP IN SYNC)', () => {
+  for (const company of [{ name: '', site: '', tagline: '' }, { name: 'Acme Corp', site: 'https://acme-corp.example', tagline: 'a rocket works' }, { name: 'Acme Corp', site: '', tagline: '' }]) {
+    assert.equal(footer(brandTokens(PAGE, brand(company), 'https://acme.example')), stamp(company));
+  }
+});
+
+test('clientBranding exposes the company site and tagline the footer stamps from', () => {
+  const c = clientBranding({ identity: { company: { name: 'Acme Corp', site: 'https://acme-corp.example', tagline: 'a rocket works' } } });
+  assert.deepEqual(c.identity.company, { name: 'Acme Corp', site: 'https://acme-corp.example', tagline: 'a rocket works' });
+  assert.deepEqual(clientBranding({}).identity.company, { name: '', site: '', tagline: '' });
+});