@bongos/core 1.21.174 → 1.21.176

package/scripts/gds/artifact-format.js

@@ -1,203 +1,6 @@
-// scripts/gds/artifact-format.js — the ONE packaging format Bongos ships code in:
-// a deterministic ustar+gzip tarball plus a compression-independent tree pin
-// (per-file sha256 + tree_sha256). Split out of package-core.js (task 1004271) so the
-// module store (ADR 0338 D1: "no second packaging format") builds and VERIFIES module
-// versions with the exact functions the core release uses — and so the always-on
-// server can read a tarball without loading package-core.js's release machinery.
-// Pure: no I/O beyond zlib/crypto, no git, no network.
-
-const zlib = require('node:zlib');
-const crypto = require('node:crypto');
-
-function sha256hex(buf) {
-  return crypto.createHash('sha256').update(buf).digest('hex');
-}
-
-// The PIN. A canonical, compression-independent digest of a packaged tree: one
-// "path\0mode\0filesha256\n" line per file, byte-sorted by path. A consumer
-// recomputes this from the unpacked tree to prove an install matches the pin.
-// `files` = [{ path, mode, sha256 }]. Modes are normalized so the pin is stable
-// regardless of the checkout's umask.
-function canonicalTreeHash(files) {
-  const lines = (files || [])
-    .map((f) => `${f.path}\u0000${normalizeMode(f.mode)}\u0000${f.sha256}`)
-    .sort();
-  return sha256hex(Buffer.from(lines.join('\n') + '\n', 'utf8'));
-}
-
-// Collapse ANY mode form — git's 100644/100755, our canonical 0000644/0000755, or a
-// raw filesystem octal string like "755" — to two canonical tar modes, keyed only on
-// the executable bit. IDEMPOTENT (normalizeMode(normalizeMode(x)) === normalizeMode(x))
-// AND exec-aware, so the tree pin reproduces byte-identically whether a consumer
-// recomputes it from the manifest's files[] (already-canonical modes) or from the
-// unpacked tree's stat() modes. Expects a STRING (git mode / canonical mode / octal).
-function normalizeMode(mode) {
-  const s = String(mode);
-  if (s === '100755' || s === '0000755' || s === '755') return '0000755';
-  const n = parseInt(s, 8);
-  if (Number.isFinite(n) && (n & 0o111)) return '0000755';
-  return '0000644';
-}
-
-// ---- a minimal, correct, DETERMINISTIC ustar+gzip writer (node-only, #686) ----
-// Deterministic (fixed mtime/uid/gid, normalized mode, sorted entries) so the same
-// source yields byte-identical bytes — a bonus over the tree_sha256 pin. Long paths
-// use the ustar name/prefix split, falling back to a GNU 'L' longname entry (read
-// by GNU tar, bsdtar/macOS, and node-tar) for the rare path that won't split.
-
-function octal(n, width) {
-  // width-1 octal digits, zero-padded, then a NUL — the classic numeric field.
-  return Buffer.from(n.toString(8).padStart(width - 1, '0').slice(-(width - 1)) + '\0', 'ascii');
-}
-
-function tarChecksum(block) {
-  let sum = 0;
-  for (let i = 0; i < 512; i++) sum += (i >= 148 && i < 156) ? 0x20 : block[i];
-  return sum;
-}
-
-// Build one 512-byte ustar header. `name`/`prefix` must already fit (<=100 / <=155).
-function ustarHeader({ name, prefix = '', mode, size, typeflag }) {
-  const h = Buffer.alloc(512, 0);
-  h.write(name, 0, 100, 'utf8');
-  octal(mode, 8).copy(h, 100);
-  octal(0, 8).copy(h, 108);   // uid
-  octal(0, 8).copy(h, 116);   // gid
-  octal(size, 12).copy(h, 124);
-  octal(0, 12).copy(h, 136);  // mtime = 0 (determinism)
-  h.write(typeflag, 156, 1, 'ascii');
-  h.write('ustar\0', 257, 6, 'ascii');
-  h.write('00', 263, 2, 'ascii');
-  if (prefix) h.write(prefix, 345, 155, 'utf8');
-  // checksum field: 6 octal digits + NUL + space, computed with the field = spaces.
-  const cksum = tarChecksum(h);
-  h.write(cksum.toString(8).padStart(6, '0').slice(-6) + '\0 ', 148, 8, 'ascii');
-  return h;
-}
-
-// Split a >100-byte path into { name<=100, prefix<=155 } at a '/' boundary, or
-// return null if no split fits (→ caller uses the GNU longname fallback).
-function splitUstarName(fullPath) {
-  const bytes = Buffer.byteLength(fullPath, 'utf8');
-  if (bytes <= 100) return { name: fullPath, prefix: '' };
-  // Find the LAST '/' such that the tail (after it) is <=100 and the head <=155.
-  for (let i = fullPath.length - 1; i > 0; i--) {
-    if (fullPath[i] !== '/') continue;
-    const prefix = fullPath.slice(0, i);
-    const name = fullPath.slice(i + 1);
-    if (Buffer.byteLength(name, 'utf8') <= 100 && Buffer.byteLength(prefix, 'utf8') <= 155) {
-      return { name, prefix };
-    }
-  }
-  return null;
-}
-
-function padTo512(buf) {
-  const rem = buf.length % 512;
-  return rem === 0 ? buf : Buffer.concat([buf, Buffer.alloc(512 - rem, 0)]);
-}
-
-// GNU longname pseudo-entry: a header (typeflag 'L', name '././@LongLink') whose
-// BODY is the full path (incl. trailing NUL), immediately followed by the real
-// file entry. Read by GNU tar, bsdtar/macOS, and node-tar.
-function gnuLongName(fullPath) {
-  const payload = Buffer.from(fullPath + '\0', 'utf8');
-  const hdr = ustarHeader({ name: '././@LongLink', mode: 0o644, size: payload.length, typeflag: 'L' });
-  return Buffer.concat([hdr, padTo512(payload)]);
-}
-
-// entries: [{ name, mode, buf }] — `name` includes the TAR_ROOT prefix. Returns a
-// gzip'd tar Buffer. Pure + deterministic given sorted entries.
-function buildTar(entries) {
-  const sorted = [...entries].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
-  const chunks = [];
-  for (const e of sorted) {
-    const mode = e.mode & 0o7777;
-    const split = splitUstarName(e.name);
-    if (split) {
-      chunks.push(ustarHeader({ name: split.name, prefix: split.prefix, mode, size: e.buf.length, typeflag: '0' }));
-    } else {
-      chunks.push(gnuLongName(e.name));
-      chunks.push(ustarHeader({ name: e.name.slice(0, 100), mode, size: e.buf.length, typeflag: '0' }));
-    }
-    chunks.push(padTo512(e.buf));
-  }
-  // two zero blocks terminate the archive
-  chunks.push(Buffer.alloc(1024, 0));
-  const tar = Buffer.concat(chunks);
-  return zlib.gzipSync(tar, { level: 9 });
-}
-
-
-
-// ---- the matching READER (task 1004271) -------------------------------------
-// Reads back exactly what buildTar writes — plain ustar file entries (name/prefix
-// split) and GNU 'L' longname entries — into [{ name, mode, buf }]. It is the store's
-// side of the format, so it is strict rather than permissive: any other entry type
-// (a directory, a symlink, a pax header), a size or count over the caps, a truncated
-// archive or a bad header checksum is a THROWN error, never a skipped entry. A server
-// that verifies uploads must not quietly accept a shape it did not check.
-//
-// Two entry points over one parser: readTar (sync — the CLI and tests) and
-// readTarAsync, which inflates on libuv's thread pool so a server verifying an upload
-// does not hold the event loop for the decompression. The parse itself is a single
-// linear pass over the inflated bytes.
-const DEFAULT_READ_LIMITS = { maxUnpackedBytes: 64 * 1024 * 1024, maxFiles: 5000 };
-const gunzipAsync = require('node:util').promisify(zlib.gunzip);
-
-const unreadable = (maxUnpackedBytes, e) =>
-  new Error(`not a readable gzip tarball within ${maxUnpackedBytes} bytes (${e.code || e.message})`);
-
-function readTar(tgz, { maxUnpackedBytes = DEFAULT_READ_LIMITS.maxUnpackedBytes, maxFiles = DEFAULT_READ_LIMITS.maxFiles } = {}) {
-  let tar;
-  try { tar = zlib.gunzipSync(tgz, { maxOutputLength: maxUnpackedBytes }); }
-  catch (e) { throw unreadable(maxUnpackedBytes, e); }
-  return parseTar(tar, { maxFiles });
-}
-
-async function readTarAsync(tgz, { maxUnpackedBytes = DEFAULT_READ_LIMITS.maxUnpackedBytes, maxFiles = DEFAULT_READ_LIMITS.maxFiles } = {}) {
-  let tar;
-  try { tar = await gunzipAsync(tgz, { maxOutputLength: maxUnpackedBytes }); }
-  catch (e) { throw unreadable(maxUnpackedBytes, e); }
-  return parseTar(tar, { maxFiles });
-}
-
-function parseTar(tar, { maxFiles }) {
-  const cstr = (b, from, len) => {
-    const s = b.subarray(from, from + len);
-    const z = s.indexOf(0);
-    return (z < 0 ? s : s.subarray(0, z)).toString('utf8');
-  };
-  const out = [];
-  let off = 0;
-  let longName = null;
-  while (true) {
-    if (off + 512 > tar.length) throw new Error('tarball is truncated (no end-of-archive marker)');
-    const h = tar.subarray(off, off + 512);
-    if (h.every((x) => x === 0)) break;
-    const stored = parseInt(cstr(h, 148, 8).trim(), 8);
-    if (stored !== tarChecksum(h)) throw new Error(`tar header checksum mismatch at byte ${off}`);
-    const size = parseInt(cstr(h, 124, 12).trim() || '0', 8);
-    if (!Number.isFinite(size) || size < 0) throw new Error(`bad entry size at byte ${off}`);
-    const type = String.fromCharCode(h[156] || 48);
-    const bodyStart = off + 512;
-    const bodyEnd = bodyStart + size;
-    if (bodyEnd > tar.length) throw new Error('tarball is truncated mid-entry');
-    const body = tar.subarray(bodyStart, bodyEnd);
-    off = bodyStart + size + ((512 - (size % 512)) % 512);
-    if (type === 'L') { longName = cstr(body, 0, body.length); continue; }
-    if (type !== '0' && type !== '\u0000') throw new Error(`unsupported tar entry type "${type}" — only regular files are allowed`);
-    const prefix = cstr(h, 345, 155);
-    const name = longName || (prefix ? `${prefix}/${cstr(h, 0, 100)}` : cstr(h, 0, 100));
-    longName = null;
-    out.push({ name, mode: parseInt(cstr(h, 100, 8).trim() || '0', 8), buf: Buffer.from(body) });
-    if (out.length > maxFiles) throw new Error(`tarball has more than ${maxFiles} files`);
-  }
-  return out;
-}
-
-module.exports = {
-  sha256hex, canonicalTreeHash, normalizeMode,
-  octal, tarChecksum, ustarHeader, splitUstarName, padTo512, gnuLongName, buildTar,
-  readTar, readTarAsync,
-};
+// scripts/gds/artifact-format.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/artifact-format.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'artifact-format.js');

package/scripts/gds/artifact-staleness.js

@@ -1,267 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/artifact-staleness.js — are the gitignored generated artifacts on
-// THIS machine actually current with the commit it has checked out? (task 1001930,
-// ADR 0110 pt.5)
-//
-// WHY THIS EXISTS. ADR 0110 moved `docs/repo-map.md` and `docs/session-log-index.md`
-// off the git graph: they are 100%-generated, two parallel branches collided on them
-// constantly, so they became untracked files regenerated at deploy. That trade was
-// deliberate, and the ADR names the debt it took on in its own Consequences:
-//
-//   "A generator that breaks at deploy leaves a stale/absent file with no blocking
-//    backstop; the LOUD ::ERROR:: line is the alarm (mandatory, not optional)."
-//
-// That alarm is a line in the droplet's journald. Nobody reads journald. The per-PR
-// freshness gate cannot help either — the files are gitignored, so they never appear
-// in a diff for CI to check (`--check-whole`'s own comment says it plainly: "used by
-// nothing hard; deploy owns it"). So if the deploy regen step silently stops running,
-// every agent keeps reading a symbol map of a codebase that has moved on, and nothing
-// anywhere says so. This check is the backstop that posture depends on.
-//
-// WHAT IT COMPARES. For each registered artifact, its own generator's `--check-whole`
-// answers "would regenerating this file change it?" — run against the checkout that is
-// actually serving. A difference means the deploy generator did not run, or ran and
-// broke. Asking the generator rather than reimplementing the comparison is the point:
-// there is exactly one definition of "fresh" per artifact and it lives with the thing
-// that writes it, so this check cannot drift away from what deploy produces.
-//
-// ABSENT AND STALE ARE REPORTED SEPARATELY, and the split is operational, not cosmetic:
-// absent means the regen step never ran here at all (a deploy line was dropped, or a
-// fresh clone was never generated into), stale means it ran once and has not since.
-// Those send someone to two different places, so the report must not blur them.
-//
-// ── WHERE THIS MAY RUN — read before scheduling it anywhere new ───────────────
-//
-// ONLY where the artifacts are SUPPOSED to already exist: a deployed instance after its
-// source-fetch regen. NEVER in CI. A fresh `git clone` legitimately
-// has no `docs/repo-map.md` — it is gitignored, so it is not in the repository at all
-// — and this check would report it absent on every single run. A monitor that is red
-// every run teaches its reader to ignore it, which is the exact failure ADR 0110's
-// warn-only posture already has. That is why this ships as a scheduled routine on the
-// instance and NOT as a `.github/workflows/` job, unlike its sibling publish-watch.js
-// (which reads git and the registry, and so is true anywhere).
-//
-// THE MAIN GUARD. "Fresh" here means "matches what THIS commit generates". On a
-// deployed instance that commit is main, because deploy does `git reset --hard
-// origin/main` — so the question the caller actually wants ("does the served artifact
-// lag main's HEAD?") and the question `--check-whole` answers are the same question.
-// In a feature worktree they are NOT: the artifact would be compared against that
-// branch, and a pass or a fail would both be meaningless. So a checkout that is not at
-// origin/main is INCONCLUSIVE (exit 2), never a finding — a monitor that cannot tell
-// which question it just answered must say so rather than guess.
+// scripts/gds/artifact-staleness.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/artifact-staleness.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const { spawnSync } = require('child_process');
-const fs = require('fs');
-const path = require('path');
-
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-const GIT_TIMEOUT_MS = 15000;
-const CHECK_TIMEOUT_MS = 120000;
-
-// The gitignored, whole-file generated artifacts this check covers.
-//
-// MEMBERSHIP RULE — an artifact belongs here when all three hold: it is gitignored (so
-// no PR gate can see it), it is written by a deploy-time generator (so it can silently
-// stop being written), and its generator exposes `--check-whole` (so freshness has one
-// definition, owned by the writer). tests/artifact_staleness.mjs pins this list against
-// .gitignore and against the generators' real flags, so an artifact that gains a
-// `--check-whole` and is left out of here fails that test rather than going unwatched.
-//
-// DELIBERATELY NOT HERE, and each for a reason that is not "we forgot":
-//   • modules/hall-ui/public/atlas.json (gen-atlas.js, ADR 0094) — gitignored and
-//     deploy-generated, but its payload embeds `generatedAt: new Date()`, so a
-//     regenerate-and-compare differs on every run by construction. Checking it needs a
-//     comparison over `views` only, or a freshness-by-age test against the last deploy
-//     — a different mechanism, not this one. gen-atlas has no --check mode at all today.
-//   • docs/onboarding/diagrams/*.svg|png — rendering them needs a headless Chromium the
-//     droplet does not have (the reason ADR 0110 deferred the diagram half in the first
-//     place), so freshness cannot be evaluated where this runs. Their FACTS are already
-//     backstopped by the diagram-drift routine, which reads assertions.json instead.
-const ARTIFACTS = Object.freeze([
-  Object.freeze({
-    rel: 'docs/repo-map.md',
-    generator: 'gen-repo-map.js',
-    what: 'the symbol skeleton agents navigate the codebase by (ADR 0063)',
-  }),
-  Object.freeze({
-    rel: 'docs/session-log-index.md',
-    generator: 'gen-session-index.js',
-    what: 'the full session-log index the CLAUDE.md §13 snippet links out to (ADR 0062 §8)',
-  }),
-]);
-
-function git(args, run = spawnSync) {
-  const raw = gitRaw(args, run);
-  return raw === null ? null : raw.trim();
-}
-
-// Untrimmed, because `git status --porcelain` is column-significant: a line is
-// `XY<space>PATH` and an unstaged modification's X is a SPACE (" M path"). Trimming the
-// buffer eats that leading space on the FIRST line only, so a slice(3) then swallows the
-// path's first character — which is exactly how this printed "cripts/gds/…" until
-// tests/artifact_staleness.mjs caught it.
-function gitRaw(args, run = spawnSync) {
-  const r = run('git', args, { cwd: REPO_ROOT, encoding: 'utf8', timeout: GIT_TIMEOUT_MS });
-  if (!r || r.error || r.status !== 0) return null;
-  return String(r.stdout || '');
-}
-
-// The paths in a porcelain listing, status columns removed.
-function porcelainPaths(raw) {
-  return raw.split('\n').filter((l) => l.length > 3).map((l) => l.slice(3).trim()).filter(Boolean);
-}
-
-// Is this checkout a fair thing to compare the artifacts against — at origin/main AND
-// clean? Returns { ok } or { ok:false, reason }; git being unable to answer is equally
-// inconclusive.
-//
-// The CLEAN half is not belt-and-braces, and it was found by running this check against
-// its own uncommitted source file: a generator regenerates from the WORKING TREE, so one
-// uncommitted file that moves a symbol makes repo-map.md "stale" against a main it in
-// fact matches. On the droplet the tree is clean by construction (deploy does
-// `git reset --hard`), so requiring it costs a correct run nothing — while without it
-// every hand-run from a working checkout invents a finding, which is precisely how a
-// monitor teaches its reader to ignore it. Gitignored files (the artifacts themselves)
-// never appear in `--porcelain`, so they cannot trip this.
-function atMain(run = spawnSync) {
-  const head = git(['rev-parse', 'HEAD'], run);
-  const main = git(['rev-parse', 'origin/main'], run);
-  if (!head) return { ok: false, reason: 'could not read HEAD (not a git checkout?)' };
-  if (!main) return { ok: false, reason: 'could not read origin/main (no remote ref here?)' };
-  if (head !== main) {
-    const branch = git(['rev-parse', '--abbrev-ref', 'HEAD'], run) || '(detached)';
-    return { ok: false, reason: `checkout is at ${branch} ${head.slice(0, 8)}, not origin/main ${main.slice(0, 8)}` };
-  }
-  const dirty = gitRaw(['status', '--porcelain'], run);
-  if (dirty === null) return { ok: false, reason: 'could not read the working tree state' };
-  const paths = porcelainPaths(dirty);
-  if (paths.length) {
-    const shown = paths.slice(0, 3).join(', ');
-    const more = paths.length > 3 ? `, +${paths.length - 3} more` : '';
-    return { ok: false, reason: `working tree is not clean (${shown}${more}) — the generators would compare against those edits, not main` };
-  }
-  return { ok: true, sha: head };
-}
-
-// Ask ONE artifact's own generator whether it is current.
-//   fresh    exit 0 — regenerating would change nothing
-//   stale    exit 2 — it would (absent counts as stale; `present` says which)
-//   unknown  anything else — the generator itself could not answer, which is not a
-//            finding about the artifact and must never be reported as one.
-function checkArtifact(a, { root = REPO_ROOT, run = spawnSync, exists = fs.existsSync } = {}) {
-  const present = exists(path.join(root, a.rel));
-  const r = run(process.execPath, [path.join(root, 'scripts', 'gds', a.generator), '--check-whole'],
-    { cwd: root, encoding: 'utf8', timeout: CHECK_TIMEOUT_MS });
-  if (!r || r.error) {
-    return { ...a, state: 'unknown', present, detail: r && r.error ? r.error.message : 'generator did not run' };
-  }
-  if (r.status === 0) return { ...a, state: 'fresh', present };
-  if (r.status === 2) return { ...a, state: present ? 'stale' : 'absent', present };
-  const said = String(r.stderr || r.stdout || '').trim().split('\n').pop() || `exit ${r.status}`;
-  return { ...a, state: 'unknown', present, detail: said };
-}
-
-function check({ root = REPO_ROOT, run = spawnSync, exists = fs.existsSync, artifacts = ARTIFACTS, requireMain = true } = {}) {
-  if (requireMain) {
-    const m = atMain(run);
-    if (!m.ok) { const e = new Error(m.reason); e.inconclusive = true; throw e; }
-  }
-  const results = artifacts.map((a) => checkArtifact(a, { root, run, exists }));
-  return {
-    results,
-    fresh: results.filter((r) => r.state === 'fresh'),
-    stale: results.filter((r) => r.state === 'stale'),
-    absent: results.filter((r) => r.state === 'absent'),
-    unknown: results.filter((r) => r.state === 'unknown'),
-  };
-}
-
-// Plain language: this lands in Discord #ship-news, where the audience is the owner,
-// not whoever wrote the generator.
-function report(r) {
-  const bad = [...r.absent, ...r.stale];
-  if (!bad.length && !r.unknown.length) {
-    return `Generated navigation docs are current — ${r.fresh.length} artifact(s) match this commit.`;
-  }
-  const lines = [];
-  if (bad.length) {
-    lines.push(`⚠ ${bad.length} generated file(s) on this instance no longer match the code being served.`);
-    lines.push('');
-    for (const a of r.absent) lines.push(`  • ${a.rel} — MISSING entirely. Nothing has generated it here. It is ${a.what}.`);
-    for (const a of r.stale) lines.push(`  • ${a.rel} — out of date: it no longer matches what this commit would produce. It is ${a.what}.`);
-    lines.push('');
-    lines.push('These are rebuilt by the deploy step, so this means that step stopped running or broke.');
-    lines.push('Nothing blocks on them, which is why it went unreported until now — anyone reading these');
-    lines.push('files is being given an out-of-date picture. Check the deploy log for its regen lines');
-    lines.push('(they print ::ERROR:: when a generator fails).');
-  }
-  if (r.unknown.length) {
-    if (bad.length) lines.push('');
-    lines.push(`Could not check ${r.unknown.length} artifact(s):`);
-    for (const a of r.unknown) lines.push(`  • ${a.rel} — ${a.detail}`);
-  }
-  return lines.join('\n');
-}
-
-// Deliver the finding here rather than through run-routine.js's `sink: discord`.
-// run-routine treats a non-zero step as a FAILED step and aborts BEFORE it routes
-// stdout, so exiting 1 on a finding would throw that finding away. publish-watch.js
-// and artifact-audit.js carry the same shape for the same reason; their routine steps
-// all stay `sink: none` and the script performs its own side effect.
-async function deliver(text) {
-  const { postWebhook } = require(path.join(__dirname, '..', 'discord', 'lib.js'));
-  await postWebhook('ship_news', text);
-}
-
-async function main() {
-  const argv = process.argv.slice(2);
-  const json = argv.includes('--json');
-
-  let r;
-  try {
-    r = check({ requireMain: !argv.includes('--any-ref') });
-  } catch (err) {
-    // Exit 2 = COULD NOT RUN, kept distinct from 1 (ran, found something) so a
-    // scheduler can go red on the former and merely report the latter.
-    console.error(`artifact-staleness could not complete: ${err && err.message ? err.message : err}`);
-    if (err && err.inconclusive) {
-      console.error('  Freshness is only meaningful against the commit being served. Re-run on the');
-      console.error('  deployed instance, or pass --any-ref to compare against whatever is checked out.');
-    }
-    process.exit(2);
-  }
-
-  const text = report(r);
-  const found = r.stale.length + r.absent.length;
-
-  if (json) { console.log(JSON.stringify(r, null, 2)); process.exit(found ? 1 : 0); }
-
-  // A healthy run is deliberately quiet — it tells a person who ran it by hand
-  // (stderr) and posts nothing. A daily "all fine" is how a channel becomes wallpaper.
-  if (!found) {
-    console.error(text);
-    // An artifact we could not check is not a finding, but it must not be silent
-    // either: a permanently-unknown artifact is unwatched without anyone deciding so.
-    process.exit(r.unknown.length ? 2 : 0);
-  }
-
-  console.log(text);
-  if (argv.includes('--no-post')) process.exit(1);
-
-  try {
-    await deliver(text);
-    console.error('posted the finding to Discord #ship-news.');
-    process.exit(1);
-  } catch (err) {
-    // Found something and could not say it — the original defect one layer down, so
-    // it is the LOUDEST outcome: exit 3 is >= 2, which turns the scheduled run red.
-    console.error(`\nFOUND STALE ARTIFACTS AND COULD NOT DELIVER THE FINDING: ${err && err.message ? err.message : err}`);
-    console.error('The finding is above. Set DISCORD_SHIP_NEWS_WEBHOOK so this reaches #ship-news.');
-    process.exit(3);
-  }
-}
-
-if (require.main === module) main();
-
-module.exports = { ARTIFACTS, atMain, checkArtifact, check, report };
+require('../bongos/forwarder.js').forward(module, 'artifact-staleness.js');