@bongos/core 1.19.901 → 1.19.903

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.901",
-  "core_contract": "1.19.901",
-  "source_commit": "eaeb90f6f672cebb32a56069fe0f4cdab41c983a",
+  "core_version": "1.19.903",
+  "core_contract": "1.19.903",
+  "source_commit": "53ab83b870bf45e758ab22a2fb93103bfa42e51d",
   "source_ref": "HEAD",
-  "built_at": "2026-09-20T06:23:47.726Z",
+  "built_at": "2026-09-20T12:28:20.291Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 502,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2283,
+    "functional_verbatim": 2278,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2811,
-  "tree_sha256": "c3fd3f2ffac72933f622b7cb06be2429710627f38d9a3d541cb1ce7f595cdf6a",
+  "file_count": 2806,
+  "tree_sha256": "80c42879b74b051029afdcbf6fdcbbf26804064e32ea7abbcdc58a4fa44811fb",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -342,7 +342,7 @@
     {
       "path": "bin/bongos.js",
       "mode": "0000644",
-      "sha256": "36d11612cace3d69bd2e98c8f7b5b7d737d8bba5fd8fe1a0554a85e3cb1973ca"
+      "sha256": "ba5f4b2a9e61712cd1da655265c8baffcb732b65690fb81297ce5dcf12fa93cf"
     },
     {
       "path": "clients/bongos-client/README.md",
@@ -2632,7 +2632,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "3ff6099cba4fdc3c31689aa4f007bdb23a8aa5fca100f118eb817e44cf8986c0"
+      "sha256": "d6d904e3287c4286cd615dc97eb5d48295c06da5b430cb799aec003a34bdc5a1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2742,7 +2742,7 @@
     {
       "path": "docs/recipes/bongos-cli-release.md",
       "mode": "0000644",
-      "sha256": "de596822f2f5925fd9e4008cc0214c025a73f5ec3a0275aa6f9a117368ed2a76"
+      "sha256": "c8e3322e6399678c343bc45456fba2c17d9d0410af225ed7be9f9466414d3d80"
     },
     {
       "path": "docs/recipes/claude-design-loop.md",
@@ -2777,7 +2777,7 @@
     {
       "path": "docs/recipes/instance-first-run.md",
       "mode": "0000644",
-      "sha256": "259148d6e612209502b3f46e82e57c62da049fac4d883755e151be37de92fbf7"
+      "sha256": "5d20c34b8d61a72bf19ac18dbcf85545331c94d70634b7806a9d77799852e304"
     },
     {
       "path": "docs/recipes/instance-service-restart.md",
@@ -2787,7 +2787,7 @@
     {
       "path": "docs/recipes/local-dev.md",
       "mode": "0000644",
-      "sha256": "0e46f17cd96def91e202e7e4c42c54d569dca25fab2e43d5744199dd263b751f"
+      "sha256": "44ab0e2bf513149d530cd7d02d341ec12d4a902e0de8312faaee13f698a99aa0"
     },
     {
       "path": "docs/recipes/managed-settings-remote-control.md",
@@ -4182,7 +4182,7 @@
     {
       "path": "modules/economy/credits.js",
       "mode": "0000644",
-      "sha256": "ec69c40c89a3bb5f49dae8c04076646c972d1ed21d3b556ed6bc492dd15628c7"
+      "sha256": "b0f36f5d71bc376e090b14c6c95b3ac005fecd464e59bc73213d1d3a2b662469"
     },
     {
       "path": "modules/economy/migrations/economy_001_fix_gds_shipper_description.sql",
@@ -4202,12 +4202,12 @@
     {
       "path": "modules/economy/reward-policy.js",
       "mode": "0000644",
-      "sha256": "e1f432cc9871bcb992face1f8ecd9f63fea17b3b67c121d59e8e28a89ba8d7d5"
+      "sha256": "817f400faa29aabcfdeb98eabeca45790203dff2dbca2ed01336d69078dd2be2"
     },
     {
       "path": "modules/economy/reward.js",
       "mode": "0000644",
-      "sha256": "c4245b1b7c361eb44e0034f19227e208b956e9eb9ac03924e22b3017dd4a343a"
+      "sha256": "05f2aa731ed9bfc19088c0c6a59e0f91c6096806285e74e74b48f4530bcfa5f0"
     },
     {
       "path": "modules/economy/routes/cost.js",
@@ -4857,7 +4857,7 @@
     {
       "path": "modules/hall-ui/public/hall-kit.js",
       "mode": "0000644",
-      "sha256": "febbc27ca107c7da31f997119be95a73446bab70139339c10c951440fe2e1d28"
+      "sha256": "1be3b170f1aff7e830f661c14df487bc30ec33e15499449f68748acad63794f8"
     },
     {
       "path": "modules/hall-ui/public/hall-render.js",
@@ -5012,7 +5012,7 @@
     {
       "path": "modules/hall-ui/public/profile-charts.js",
       "mode": "0000644",
-      "sha256": "809c92461d3569e431afcb9e060c687722bccfdfd7f4b028bca5133d7df0c2ab"
+      "sha256": "456f477da6893e61f66778ea5cb6a15dc3c21ea4038f0a8184a4deca840f237c"
     },
     {
       "path": "modules/hall-ui/public/profile-connections.js",
@@ -5362,7 +5362,7 @@
     {
       "path": "modules/ideas/module.json",
       "mode": "0000644",
-      "sha256": "d78cc041fcd92485e38684a216a846e163ea443a8afea9f304aca3a2ac086d4d"
+      "sha256": "c23099e7c3a4768dc68778292c42988ee21234ed81d1832347e9fd272f6137d9"
     },
     {
       "path": "modules/ideas/pollers/descent-writer.js",
@@ -5377,7 +5377,7 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "5324f8d2eb8d55decadd371f2c48ee141e88b9aa3d62de0921d467aef401c2ae"
+      "sha256": "d4c91dcc603e4fc72ef6110a32350b2f59df19858f83a70962645a7fa09a55c4"
     },
     {
       "path": "modules/ideas/routing.js",
@@ -5517,7 +5517,7 @@
     {
       "path": "modules/lifecycle/db-ship.js",
       "mode": "0000644",
-      "sha256": "fc65aa01818dcd8c74d013e074ff9b6c71c34537230fc844e6a23b69cc93e22f"
+      "sha256": "14c269ad1bf569976421c71e0814d47338bd11f9382e9949e2e01f6f6f15f6c7"
     },
     {
       "path": "modules/lifecycle/db-tasks.js",
@@ -7762,12 +7762,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "81176248d1045cd137a823208e30bdf4907b4f08ae1c0c0ff85750a38d2aeed3"
+      "sha256": "20d17854b6e4522308515c26c6efe033baa02b0d1b86a40c211fddc2b0cecfde"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "bff9286aa9803a2eedaffb0f0798fcd15a27791208c786a6544424aa04db4a16"
+      "sha256": "8ee9f9ba3532c45ffd794bbdcae1c6d8d38fad130d73cf9c5275787ccfb60e53"
     },
     {
       "path": "public-docs/index.html",
@@ -7862,7 +7862,7 @@
     {
       "path": "scripts/gds/api.js",
       "mode": "0000644",
-      "sha256": "d36fa664267d64796faf071278437cb7cfa8c2b1c7ae2140bcb01d7c2ddf16e1"
+      "sha256": "6f6db1b581ac3a56bd8be0c5e8bee7189ee1621608f6c8751f908228c6325b21"
     },
     {
       "path": "scripts/gds/api.ps1",
@@ -8034,11 +8034,6 @@
       "mode": "0000644",
       "sha256": "9ae0402d6bec0d746ec6b09effe8165a237ed9dc8983de8613b969f82aa3a2c1"
     },
-    {
-      "path": "scripts/gds/box-connect-lib.js",
-      "mode": "0000644",
-      "sha256": "dbc4dd22d858a7d17c34ebf211edbd6d885afa39ab7b9e3032a7390cd5526638"
-    },
     {
       "path": "scripts/gds/box-infra.js",
       "mode": "0000644",
@@ -8072,7 +8067,7 @@
     {
       "path": "scripts/gds/build-cli-package.js",
       "mode": "0000644",
-      "sha256": "fcb5bdfe3341b177018a080c2cd7295bad3b1772696e61bef6154ec1e5767300"
+      "sha256": "a7a19db7b156f7e411e2a77146c2f9418b5b9ff7fa52be1e3dca56848307f98d"
     },
     {
       "path": "scripts/gds/bump-version.js",
@@ -8117,7 +8112,7 @@
     {
       "path": "scripts/gds/claude-materialize.js",
       "mode": "0000644",
-      "sha256": "8ac759488eef696a18a0035f51deed3b537c44f28d0191a108692b2399ae1787"
+      "sha256": "37cbab033c9ba88ae557e8569fcabca9d361b4e26fc335ed5adacddf245ab38d"
     },
     {
       "path": "scripts/gds/claude-md-template.js",
@@ -8132,18 +8127,13 @@
     {
       "path": "scripts/gds/cli-lib.js",
       "mode": "0000644",
-      "sha256": "d320945b629ad20f4e6cc272f3b531d6f98ed2dae2f07286b459db5b15d2c07a"
+      "sha256": "cbe71309f4e100b096eee7d91b90a4cc9e549caa3df51473f2ca3029ca4c8ba5"
     },
     {
       "path": "scripts/gds/client-baseurl-guard.js",
       "mode": "0000644",
       "sha256": "8ac4c8909b75aa5e2022a967ba9ac0cbcdac60da9d75757603827b86964c825b"
     },
-    {
-      "path": "scripts/gds/code.js",
-      "mode": "0000644",
-      "sha256": "6a726d269ec9a44fac6bdc7bdeb74bafbc2e3f303755296959b3a08642f98943"
-    },
     {
       "path": "scripts/gds/codemod-rename-src-gds.js",
       "mode": "0000644",
@@ -8457,7 +8447,7 @@
     {
       "path": "scripts/gds/go-live.js",
       "mode": "0000644",
-      "sha256": "f246947d973eec84ea174736bc87bf52b4716c939fc86bff4037b330f6790f9a"
+      "sha256": "3ff8b2370bd93c5469708900ba3d36066aa82f4858831ce6e4b1b7e817e29dcb"
     },
     {
       "path": "scripts/gds/goal-names.js",
@@ -8572,7 +8562,7 @@
     {
       "path": "scripts/gds/login.js",
       "mode": "0000644",
-      "sha256": "5699ace73061de80bfc44213775cdecefc6d597f656abe76f67061eb43fd440c"
+      "sha256": "fcb70ddb8175d4cbbfd3217dcb9352e6280d5597c8caffe88a6399b54041e93b"
     },
     {
       "path": "scripts/gds/main-audit.js",
@@ -8677,7 +8667,7 @@
     {
       "path": "scripts/gds/plain-cards.js",
       "mode": "0000644",
-      "sha256": "63344839b3cb2cba39757b5501759aaef8e1bf100468d7304a56d4e709f2f8cf"
+      "sha256": "e65a6264bbf4e28da17a46c0f8400e53207e141ed57e0e4826d7320f91b25f46"
     },
     {
       "path": "scripts/gds/portability-smoke-art.sh",
@@ -9084,11 +9074,6 @@
       "mode": "0000644",
       "sha256": "79027b353a20b02c363d691ba30eda7d3456b8a081199ddc2c2559162523d66c"
     },
-    {
-      "path": "scripts/gds/shell.js",
-      "mode": "0000644",
-      "sha256": "087def1396283b19cb8a6deea4cc7f362d7a2f164d496a587220f0a48568aae6"
-    },
     {
       "path": "scripts/gds/ship-check.js",
       "mode": "0000644",
@@ -9142,7 +9127,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "53f43c609206ea62e71f562aaceed316b6aea217612f74dcd800e30f06b17ea5"
+      "sha256": "1a659cdc35cfda09e6e28cff97313871c648cfca24c08c6c97116e84649e6f67"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -9777,7 +9762,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5ac46b294e25abc7c2a076f538a123991a638f3069dd4980ba2b75392942b710"
+      "sha256": "565add1bbddcccee0c1b0e3e748b36d607af667350a541338faf48025cbfb904"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10309,11 +10294,6 @@
       "mode": "0000644",
       "sha256": "786a97b9cb24ed38c8703113533d733eb475ed671e3fc5b5ca5ce679b8d4a4a4"
     },
-    {
-      "path": "tests/bongos_box_connect.mjs",
-      "mode": "0000644",
-      "sha256": "6ca9d015de848e7a96a47bbe7f12564c7b8f9652339674f5e127068800ebb21c"
-    },
     {
       "path": "tests/bongos_cli.mjs",
       "mode": "0000644",
@@ -10322,7 +10302,7 @@
     {
       "path": "tests/bongos_dispatch.mjs",
       "mode": "0000644",
-      "sha256": "f378b55969f723290ead5e959eef038745ba24e628418ed04c88671ead7354d3"
+      "sha256": "befc2f51a56d220107e825453148203a0cb7d9877bd8ab17bc71c8e93658efee"
     },
     {
       "path": "tests/bongos_downloads.mjs",
@@ -10389,11 +10369,6 @@
       "mode": "0000644",
       "sha256": "59b8fb0907125768a87a1ee24d74b1e0fa6b3e6ca6bed823fdd4db176e65b03a"
     },
-    {
-      "path": "tests/box_scope_predicate.mjs",
-      "mode": "0000644",
-      "sha256": "9dc459d61e6d47311609ff4639bb5ff9c9c36172ef5441204731a4a7818be0cd"
-    },
     {
       "path": "tests/box_scope_session.mjs",
       "mode": "0000644",
@@ -10562,18 +10537,13 @@
     {
       "path": "tests/claude_materialize.mjs",
       "mode": "0000644",
-      "sha256": "6354cd31332b41d64ada0c89363c5a17b9bbb5e5589e3bcf993afc7614591782"
+      "sha256": "60eb54f19f26f3557afd6b12f0f2867208638a2b6547f58abd192b6f07e805c3"
     },
     {
       "path": "tests/clawback_confirmed_backlog.mjs",
       "mode": "0000644",
       "sha256": "dca080c2976cdde34584a823aaae08d0175f34694c10897adb777a3f0ffb8cab"
     },
-    {
-      "path": "tests/cli_box_scope.mjs",
-      "mode": "0000644",
-      "sha256": "b9258f690d5dc7c87bcbb12d510b3071a38669777ae9a92a99e683e76ea15e83"
-    },
     {
       "path": "tests/cli_dispatcher.mjs",
       "mode": "0000644",
@@ -10592,7 +10562,7 @@
     {
       "path": "tests/cli_package.mjs",
       "mode": "0000644",
-      "sha256": "e16f3fd835e440bad8a24ea1807663f08709bfe21b65cc25772b7d707bbba540"
+      "sha256": "e7839e6ac47b12fe4decd50e31d37fba3bad7ac475e8f24e948bb49b52a3e83e"
     },
     {
       "path": "tests/cli_sessions.mjs",
@@ -10602,7 +10572,7 @@
     {
       "path": "tests/cli_surface.mjs",
       "mode": "0000644",
-      "sha256": "1475bff8f7e51244f451401f92ac647ddf859eacecf277a8b3f9990a23b84059"
+      "sha256": "cc10440e148e19a157cd18f0325e121f5492484e09550578e98870dba61090a9"
     },
     {
       "path": "tests/cli_token_reissue.mjs",
@@ -11627,7 +11597,7 @@
     {
       "path": "tests/hall_kit_charts.mjs",
       "mode": "0000644",
-      "sha256": "5654f4366ddcfcb61848a119a2dba3827f3fe19c0151005558a803c2e09db573"
+      "sha256": "d9d37e08fb0293f83a7d218edd789de9eb63aca1e9cd7f910c5ffba41639918e"
     },
     {
       "path": "tests/hall_landing_boot.mjs",
@@ -11814,6 +11784,11 @@
       "mode": "0000644",
       "sha256": "3e43b2afa7ea9e8ccee99759c27f7ab28f7a49823cc3b7e921071714d2d0d7f1"
     },
+    {
+      "path": "tests/idea_descent_ship_credit.mjs",
+      "mode": "0000644",
+      "sha256": "e2bc31f771f80549cf50f9614b5473485f6c9db9b9179f3830a76738e1247ac7"
+    },
     {
       "path": "tests/idea_detail_page.mjs",
       "mode": "0000644",
@@ -12522,7 +12497,7 @@
     {
       "path": "tests/plain_cards.mjs",
       "mode": "0000644",
-      "sha256": "925f4ffa450b2eddff31712b8ea1cd3e7853110f156d8fd4574f1ba1d05d16a8"
+      "sha256": "7549965b77f59c63fc2ac5fe5eb6cb4d292da9140bff5d589c47f99b784ab579"
     },
     {
       "path": "tests/planning_session_skill.mjs",
@@ -12962,7 +12937,7 @@
     {
       "path": "tests/rank_tier_single_source.mjs",
       "mode": "0000644",
-      "sha256": "fa78ebe4b9be867c6fc546ab53cd6cc4b76c532ae4effcce6bce83f6386e1ab3"
+      "sha256": "c6c5832636160010eb44af6a5fb049756d778e413d532643f2d3be4d69651303"
     },
     {
       "path": "tests/rate_limit_public.mjs",

package/bin/bongos.js

@@ -11,9 +11,10 @@
 // code. No auth/API logic lives here; the target scripts already share
 // scripts/gds/cli-lib.js.
 //
-// Phases 2-4 extend this same CLI with `shell`/`code` (VS Code Remote-SSH into
-// the dev box), a one-line installer + standalone binary, and instance-agnostic
-// `login`/`init`/`upgrade`.
+// Phases 2-4 extend this same CLI with a one-line installer + standalone binary
+// and instance-agnostic `login`/`init`/`upgrade`. (They also added `shell`/`code`,
+// VS Code Remote-SSH into a per-builder dev box; the dev box was retired and
+// those verbs removed with it — task 1003889.)
 
 'use strict';
 
@@ -52,8 +53,6 @@ const BUNDLED_RUNNERS = {
   // bare laptop has the standalone binary and nothing else (task 1003961).
   'paste-token.js': () => require('../scripts/gds/paste-token.js'),
   'api.js': () => require('../scripts/gds/api.js'),
-  'shell.js': () => require('../scripts/gds/shell.js'),
-  'code.js': () => require('../scripts/gds/code.js'),
   'init.js': () => require('../scripts/gds/init.js'),
   'onboard.js': () => require('../scripts/gds/onboard.js'),
 };
@@ -70,7 +69,7 @@ if (VERSION === '0.0.0') { try { VERSION = require('../package.json').version ||
 //   `script`     a file under scripts/gds/ (or api.js for actions with no
 //                dedicated builder script yet).
 //   `prefixArgs` inserted before the user's args — used to drive the generic
-//                api.js caller (e.g. waking your box is just POST /box/ensure).
+//                api.js caller for an action with no dedicated script.
 //   `selfHelp`   the script prints its own (richer) usage on --help/-h, so the
 //                dispatcher forwards the flag instead of answering it (task
 //                1002625). Only set it after verifying the script really does —
@@ -96,9 +95,6 @@ const VERBS = {
   // name, the way claim/ship/release already are (ADR 0104).
   'paste-token': { script: 'paste-token.js', group: 'account', summary: 'Finish re-auth: store the token copied from Settings  (bongos paste-token <token>)' },
   doctor:  { script: 'doctor.js', group: 'account', summary: 'Check your local toolchain + session' },
-  box:     { script: 'api.js', prefixArgs: ['POST', '/api/gds/box/ensure'], group: 'account', summary: 'Turn on / wake your cloud dev box' },
-  shell:   { script: 'shell.js', group: 'account', summary: 'Open a terminal on your dev box  (--local for a local clone)' },
-  code:    { script: 'code.js',  group: 'account', summary: 'Open VS Code on your dev box over Remote-SSH  (--local for a local clone)' },
 
   init:    { script: 'init.js', group: 'instance', summary: 'Scaffold a new instance (config + first version + kickoff tasks)' },
   dev:     { script: 'dev.js', group: 'instance', summary: 'Run THIS instance locally in one command (Postgres + migrate + server + sign-in)', selfHelp: true },
@@ -245,12 +241,10 @@ function runBundled(verb, def, forwarded) {
   if (!runner) {
     process.stderr.write(
       `bongos: "${verb}" needs the full project (git + a repo clone), which the standalone binary doesn't carry.\n\n` +
-        `Get onto a real environment first, then run it there:\n` +
+        `Get a checkout of the project repo, then run it there:\n` +
         `  bongos login <instance-url>   sign in to an instance\n` +
-        `  bongos code                   open VS Code on your cloud dev box (has everything)\n` +
-        `  bongos shell                  open a terminal on your cloud dev box\n` +
         `  bongos init                   scaffold a new instance here\n\n` +
-        `The standalone binary covers the on-ramp: login, box, shell, code, init, reauth, paste-token.\n`
+        `The standalone binary covers the on-ramp: login, init, reauth, paste-token.\n`
     );
     return 2;
   }

package/docs/module-api-changelog.md

@@ -2276,5 +2276,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.899 with no explicit bump. run 35492534307. (task 1002620)
   1.19.901 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.900 with no explicit bump. run 35494090938. (task 1002620)
+  1.19.902 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.901 with no explicit bump. run 35497860558. (task 1002620)
+  1.19.903 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.902 with no explicit bump. run 35510679104. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/bongos-cli-release.md

@@ -30,7 +30,8 @@ brew install example-owner/bongos/bongos          # macOS/Linux
 scoop bucket add bongos https://github.com/example-owner/scoop-bongos; scoop install bongos
 ```
 
-Then: `bongos login <instance-url>` → `bongos code` / `bongos shell` onto a dev box.
+Then: `bongos login <instance-url>` → `bongos start`. Writing code needs a checkout of the
+project repo, where the full CLI is installed.
 
 ## One-time owner setup (tracked as the open blocker on [#1248](https://example.com/builders#/task/1248))
 
@@ -61,6 +62,6 @@ Verify: `curl -fsSL https://example.com/downloads/bongos/version` shows the new
 `bin/bongos.js` is one dispatcher with two runtimes ([task 1248](https://example.com/builders#/task/1248)):
 
 - **repo / `npm i -g`** → runs under `node`; spawns each sibling `scripts/gds/*.js` (unchanged).
-- **compiled binary** → `process.execPath` is the `bongos` binary (no `node`, no scripts on disk), so it dispatches the **bundled on-ramp verbs in-process**: `login`/`setup`, `reauth`, `box`, `shell`, `code`, `init`. The heavy work verbs (`ship`/`claim`/`start`/`status`/`recall`/`cost`/`release`/`module`/`package-core`) and `doctor` are **not** bundled — they need a full repo + git to run, and pulling their dependency trees in would bloat the binary. Run those on a dev box (`bongos code`/`shell`) or in a clone (where `npm i -g` gives the full CLI). A bare-binary user who invokes one gets a clear "get onto a real environment first" message.
+- **compiled binary** → `process.execPath` is the `bongos` binary (no `node`, no scripts on disk), so it dispatches the **bundled on-ramp verbs in-process**: `login`/`setup`, `reauth`, `paste-token`, `api`, `init`, `onboard`. The heavy work verbs (`ship`/`claim`/`start`/`status`/`recall`/`cost`/`release`/`module`/`package-core`) and `doctor` are **not** bundled — they need a full repo + git to run, and pulling their dependency trees in would bloat the binary. Run those in a clone, where `npm i -g` gives the full CLI. A bare-binary user who invokes one gets a clear "get onto a real environment first" message.
 
 Follow-ups (not blocking the first release): SHA-pin `oven-sh/setup-bun`, code-sign the mac/win binaries, and expand the bundled verb set if a self-host workflow needs more offline.

package/docs/recipes/instance-first-run.md

@@ -48,8 +48,7 @@ npm install
 npx bongos dev        # Postgres → createdb → migrate → server → sign-in, in one step
 ```
 
-Full guide: [`docs/recipes/local-dev.md`](local-dev.md) (ADR 0149). Prefer a cloud dev box
-over running locally? Use `bongos box` + `bongos code`.
+Full guide: [`docs/recipes/local-dev.md`](local-dev.md) (ADR 0149).
 
 ## Notes
 

package/docs/recipes/local-dev.md

@@ -77,8 +77,6 @@ the Client ID + secret to `~/.config/<configDir>/gds-github.json` as
   go back to a hosted instance later, `bongos login https://<that-instance>`.
 - **Multiple projects at once** each get their own database + port, so their `bongos dev`
   servers don't collide.
-- **Prefer the cloud?** `bongos box` + `bongos code` give you a remote dev box instead — no
-  local database or server to run.
 - **Ready for a real host?** `bongos serve` runs this *same* boot path on a server —
   systemd-supervised, bind address derived from your public origin, no browser needed. See
   [`server-bring-up.md`](server-bring-up.md) ([ADR 0169](../adr/0169-bongos-serve-server-bring-up.md)).