@bongos/core 1.21.174 → 1.21.176

package/scripts/gds/ask.js

@@ -1,231 +1,7 @@
 #!/usr/bin/env node
+// scripts/gds/ask.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/ask.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-//
-// scripts/gds/ask.js — the rewrite helper an agent runs BEFORE it asks a person
-// anything (task 1004704, goal 1000111: "agents must ask like humans").
-//
-// WHY. The owner's ruling: an AI agent asks a person the way a person would —
-// short, decidable, no slop. The shape is the ask (modules/government/asks.js,
-// task 1004703): one question of at most twelve words, two or three tap answers
-// each with a one-line result, a pick and why, the seat it waits on, what
-// happens if nobody answers; the long text rides along as `detail`. The server
-// refuses anything else, and a blocker an AI session files by hand without one
-// is refused too (`ask_required`). This helper is the loop that turns prose into
-// a card: write the card, check it, read every fix the server names, rewrite,
-// check again — and only then file it, or print it.
-//
-//   node scripts/gds/ask.js template            a blank card to fill in
-//   node scripts/gds/ask.js check <file|->      the server's verdict; on a pass,
-//                                               the card as a person reads it
-//
-// `check` asks the server (POST /government/asks/check, the dry run: nothing is
-// stored). With no session, or a server that cannot answer, it checks with the
-// same rules locally and says so. The file holds the ask bare or as { ask }, so
-// the body you will POST to /blockers can be checked as it is.
-//
-// The printed card is also what an agent puts in CHAT for an ask that is not a
-// stored matter: the "please confirm" list at the end of a run, a review
-// request, a help request. Same shape everywhere a person reads it.
-//
-// For scripts that file templated blockers: `checkedAsk` and `postWithAsk`
-// below. A templated card is checked here before it is sent, and a filing whose
-// card is refused is re-sent without it — a script's blocker always files.
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-const asks = require(path.join(__dirname, '..', '..', 'modules', 'government', 'asks.js'));
-
-const TEMPLATE = Object.freeze({
-  question: 'One question, twelve words at most?',
-  options: [
-    { key: 'yes', label: 'Do it', result: 'One line: what happens if they pick this.' },
-    { key: 'no', label: 'Leave it', result: 'One line: what happens if they pick this.' },
-  ],
-  recommend: { key: 'yes', why: 'One line: why you would pick it.' },
-  waits_on: 'owner',
-  if_nobody_answers: 'One line: what happens if nobody answers.',
-  detail: 'Optional. The long text rides along here; it is never the ask.',
-});
-
-// The ask in a body: bare, or as { ask } (the shape POST /blockers takes).
-function askOf(body) {
-  return body && typeof body === 'object' && !Array.isArray(body) && body.ask !== undefined ? body.ask : body;
-}
-
-// A templated card, checked with the server's own rules. → the stored form, or
-// null when it breaks a rule (the caller files without it rather than not at all).
-function checkedAsk(ask) {
-  const r = asks.checkAsk(ask);
-  return r.ok ? r.ask : null;
-}
-
-// File a blocker with its card. `post(body)` → { ok, status, data } (the shape
-// cli-lib's apiCall and the generated client both answer). A card that breaks a
-// rule is never sent; a server that refuses the card or cannot check it gets the
-// same blocker again without it, so the filing never depends on the card.
-const CARD_REFUSALS = new Set(['ask_refused', 'asks_unavailable', 'validation_failed']);
-async function postWithAsk(post, body, ask) {
-  const card = ask ? checkedAsk(ask) : null;
-  if (!card) return post(body);
-  const r = await post({ ...body, ask: card });
-  const code = r && r.data && r.data.error && r.data.error.code;
-  if (r && !r.ok && (r.status === 400 || r.status === 503) && CARD_REFUSALS.has(code)) return post(body);
-  return r;
-}
-
-// The verdict as plain lines. ok → the card; refused → the refusal and each fix.
-function verdictLines({ ok, ask, message, errors, where }) {
-  const out = [];
-  if (ok) {
-    out.push(`✓ This ask has the shape${where === 'local' ? ' (checked here; the server could not be asked)' : ''}. As a person reads it:`);
-    out.push('');
-    out.push(asks.cardText(ask));
-    return out;
-  }
-  out.push(`✗ ${message || asks.refusalLine(errors)}`);
-  if (where === 'local') out.push('  (checked here; the server could not be asked)');
-  const list = Array.isArray(errors) ? errors : [];
-  if (list.length) {
-    out.push('');
-    out.push('Fix each, then check again:');
-    for (const e of list) out.push(`  - ${e.field}: ${e.message}`);
-  }
-  return out;
-}
-
-function readJson(file) {
-  const raw = file === '-' ? fs.readFileSync(0, 'utf8') : fs.readFileSync(file, 'utf8');
-  return JSON.parse(raw.replace(/^/, ''));
-}
-
-// The server's verdict, or null when it could not give one (no session, offline,
-// no government module, not allowed) — the caller then checks locally.
-async function serverVerdict(ask, { client } = {}) {
-  let api = client;
-  try {
-    if (!api) {
-      const lib = require('./cli-lib');
-      if (!lib.readSessionToken()) return null;
-      api = await lib.cliClient({ allowUnauthenticated: true });
-    }
-    const r = await api.request('POST', '/government/asks/check', { body: { ask } });
-    if (r && r.ok && r.data && r.data.ok) return { ok: true, ask: r.data.ask, where: 'server' };
-    const err = r && r.data && r.data.error;
-    if (r && r.status === 400 && err && err.code === 'ask_refused') {
-      return { ok: false, message: err.message, errors: (err.details && err.details.errors) || [], where: 'server' };
-    }
-    return null;
-  } catch (_) {
-    return null;
-  }
-}
-
-async function check(file, deps = {}) {
-  let body;
-  try { body = readJson(file); } catch (e) {
-    return { code: 2, lines: [`ask: could not read the card as JSON (${e.message}). Start from: node scripts/gds/ask.js template`] };
-  }
-  const ask = askOf(body);
-  let v = deps.local ? null : await serverVerdict(ask, deps);
-  if (!v) {
-    const r = asks.checkAsk(ask);
-    v = { ok: r.ok, ask: r.ask, errors: r.errors, where: 'local' };
-  }
-  return { code: v.ok ? 0 : 1, lines: verdictLines(v) };
-}
-
-// ---------- the reword list (owner, 2026-10-23) ----------
-// A reader pressed "?" on a city card: the matter's words did not make sense.
-// `unclear` prints what waits for a rewrite (the flagged matters, or with
-// --legacy every open matter that waits on a person and has no stored card
-// yet), each with the words it has now; `put` stores the rewritten card
-// (PUT /government/asks/:matter), which closes the matter's flag.
-async function client(deps) {
-  if (deps && deps.client) return deps.client;
-  const lib = require('./cli-lib');
-  if (!lib.readSessionToken()) throw new Error('no Bongos session — run /builder-setup first');
-  return lib.cliClient();
-}
-function matterLines(m) {
-  const out = [`${m.id}  [${m.building}]${m.flag && m.flag.times > 1 ? `  flagged ${m.flag.times}x` : ''}`];
-  out.push(`  title:  ${String(m.title || '').trim()}`);
-  if (m.detail) out.push(`  detail: ${String(m.detail).replace(/\s+/g, ' ').trim().slice(0, 600)}`);
-  if (m.ask) out.push(`  card:   ${m.ask.question} (${(m.ask.options || []).map((o) => o.label).join(' / ')})`);
-  if (m.flag && m.flag.note) out.push(`  why unclear: ${m.flag.note}`);
-  if (Array.isArray(m.acts) && m.acts.length) out.push(`  acts:   ${m.acts.map((a) => a.key + (Array.isArray(a.options) && a.options.length ? '(' + a.options.map((o) => o.key).join('|') + ')' : '')).join(', ')}`);
-  return out;
-}
-async function unclear({ legacy = false, json = false } = {}, deps = {}) {
-  const api = await client(deps);
-  let list;
-  if (legacy) {
-    const r = await api.request('GET', '/government/docket');
-    if (!r || !r.ok) return { code: 1, lines: [`ask: the docket could not be read (${r && r.status}).`] };
-    list = ((r.data && r.data.matters) || []).filter((m) => m && m.state === 'needs' && !m.ask)
-      .map((m) => ({ id: m.id, building: m.building, source: m.source, title: m.title, detail: m.detail || null, ask: null, acts: m.acts || [], flag: m.unclear || null }));
-  } else {
-    const r = await api.request('GET', '/government/asks/unclear');
-    if (!r || !r.ok) return { code: 1, lines: [`ask: the reword list could not be read (${r && r.status}).`] };
-    list = (r.data && r.data.matters) || [];
-  }
-  if (json) return { code: 0, lines: [JSON.stringify(list, null, 2)] };
-  if (!list.length) return { code: 0, lines: [legacy ? 'ask: every open matter already carries a card.' : 'ask: nothing on the reword list.'] };
-  const lines = [`${list.length} ${legacy ? 'open matter(s) with no card yet' : 'matter(s) flagged as unclear'}:`, ''];
-  list.forEach((m) => { lines.push(...matterLines(m), ''); });
-  lines.push('Write each one a card (node scripts/gds/ask.js template), check it, then: node scripts/gds/ask.js put <matter-id> <file>');
-  return { code: 0, lines };
-}
-async function put(matterId, file, deps = {}) {
-  let body;
-  try { body = readJson(file); } catch (e) { return { code: 2, lines: [`ask: could not read the card as JSON (${e.message}).`] }; }
-  const local = asks.checkAsk(askOf(body));
-  if (!local.ok) return { code: 1, lines: verdictLines({ ok: false, ask: null, errors: local.errors, where: 'local' }) };
-  const api = await client(deps);
-  const r = await api.request('PUT', '/government/asks/' + encodeURIComponent(matterId), { body: { ask: askOf(body) } });
-  if (r && r.ok && r.data && r.data.ok) return { code: 0, lines: [`ask: saved the card on ${matterId}; its "?" flag is closed.`, '', ...verdictLines({ ok: true, ask: r.data.ask, where: 'server' })] };
-  const err = r && r.data && r.data.error;
-  return { code: 1, lines: [`ask: ${matterId} was not saved (${r && r.status}${err ? ' ' + err.code : ''}). ${err && err.message ? err.message : ''}`.trim()] };
-}
-
-const USAGE = [
-  'usage:',
-  '  node scripts/gds/ask.js template          print a blank card to fill in',
-  '  node scripts/gds/ask.js check <file|->    check a card; on a pass, print it as a person reads it',
-  '      --local                               check with the rules here, without the server',
-  '  node scripts/gds/ask.js unclear           the reword list: matters a reader flagged with "?"',
-  '      --legacy                              instead: every open matter on a person with no card yet',
-  '      --json                                as JSON',
-  '  node scripts/gds/ask.js put <matter> <file>  store a rewritten card on a matter (closes its flag)',
-].join('\n');
-
-async function main(argv = process.argv.slice(2)) {
-  const cmd = argv[0];
-  if (cmd === 'template') {
-    console.log(JSON.stringify(TEMPLATE, null, 2));
-    return 0;
-  }
-  if (cmd === 'check' && argv[1]) {
-    const r = await check(argv[1], { local: argv.includes('--local') });
-    console.log(r.lines.join('\n'));
-    return r.code;
-  }
-  if (cmd === 'unclear') {
-    const r = await unclear({ legacy: argv.includes('--legacy'), json: argv.includes('--json') });
-    console.log(r.lines.join('\n'));
-    return r.code;
-  }
-  if (cmd === 'put' && argv[1] && argv[2]) {
-    const r = await put(argv[1], argv[2]);
-    console.log(r.lines.join('\n'));
-    return r.code;
-  }
-  console.error(USAGE);
-  return 2;
-}
-
-if (require.main === module) {
-  main().then((code) => { process.exitCode = code; }, (e) => { console.error(`ask: ${e && e.message}`); process.exitCode = 1; });
-}
-
-module.exports = { TEMPLATE, askOf, checkedAsk, postWithAsk, verdictLines, serverVerdict, check, unclear, put, main };
+require('../bongos/forwarder.js').forward(module, 'ask.js');

package/scripts/gds/audit-authorship.sh

@@ -1,329 +1,8 @@
 #!/usr/bin/env bash
-# scripts/gds/audit-authorship.sh — V3.R12 (#236).
-#
-# Audits the repo for hardcoded references to the original Archon's identity
-# in IMPLEMENTATION code. The point: a second builder's commits, scripts,
-# error messages, and skill outputs must NOT silently impersonate or
-# hardcode-credit the founding builder.
-#
-# What counts as a violation here:
-#   * `/Users/larskristensen/...` paths in code or skill instructions.
-#     (Use `$HOME` / `os.path.expanduser('~')` instead.)
-#   * `builder_id = 1` / `shipped_by = 1` hardcodes in code paths that run
-#     during a builder's session. (Use `req.builder.id` / the active claim.)
-#   * `lars589` / `larskristensen` literals in setup-path code or test data
-#     that would mis-attribute a second builder's work.
-#   * The founder's unix account in account position (`-o`/`-u <it>`,
-#     `User=<it>`, `APP_USER = '<it>'`) in runtime code — section 6.
-#
-# What is INTENTIONAL and allow-listed (NOT a violation):
-#   * Archived shipping docs in `limitations/*-shipped.md` — historical record.
-#   * ADRs, session logs, and the chat-broadcast plan — historical / decision
-#     records that name the founder by intent.
-#   * `CLAUDE.md` — §2 is explicitly about working with Lars as the prompter
-#     and project owner; that framing IS the point.
-#   * Droplet operational identity (`User=<owner>`, `<owner>@<droplet-ip>`,
-#     `/home/lars/amazonprimea`, `lars@hermeslines.com`) — that's the actual
-#     unix user / SSH target / ACME contact on the production server. It's
-#     infra config, not impersonation of a builder identity.
-#   * The seed script that ORIGINALLY created the V3 tasks
-#     (`scripts/gds/seed-v3-tasks.js`) — a frozen migration-style snapshot.
-#     Names appear in task descriptions by historical necessity.
-#     (The earlier `seed-v2-tasks.js` + `import-backlog.js` seeds were
-#     deleted as dead code in task 1079.)
-#   * Self-references in this audit script and in the V3.R09 / V3.R12 task
-#     descriptions captured in `seed-v3-tasks.js`.
-#   * GitHub remote `lars589/amazonprimea` — actual repo owner; cloning
-#     anything else would clone a different project.
-#   * Comments that document who decided something or who originally ran a
-#     one-time backfill — historical decision-attribution. Allowlisted
-#     PER FILE below (a content-level "looks like a comment" filter would
-#     also match live code — a JS private class field, a //host literal —
-#     so it could be gamed; file entries with justifications can't).
-#   * Test data that pins a real contract, allowlisted PER FILE below: owner
-#     approval RECORDS the Archon's login, the terminal-URL guard validates
-#     term-<login> hostnames — identity in an assertion is the contract.
-#     New test files are still scanned (no blanket tests/ exclusion).
-#   * Sample API payloads (fixtures/) and gitignored build output (dist/).
-#
-# Usage:
-#   bash scripts/gds/audit-authorship.sh           # check, exit 1 on new hits
-#   bash scripts/gds/audit-authorship.sh --verbose # print every hit (incl.
-#                                                  # allowlisted) for review
-#
-# CI lane: tests/authorship_audit.mjs runs this inside the required `unit`
-# check (task 1002640 — it previously had no caller and 342 stale hits).
-# No writes, no network.
-
-set -uo pipefail
-
-# Anchor to repo root regardless of where the script was invoked from.
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "$REPO_ROOT"
-
-VERBOSE=0
-for arg in "$@"; do
-  case "$arg" in
-    --verbose|-v) VERBOSE=1 ;;
-    -h|--help)
-      sed -n '2,50p' "$0" | sed 's/^# \{0,1\}//'
-      exit 0
-      ;;
-  esac
-done
-
-# Uses plain `grep -RE` so the script runs on any machine — including CI
-# images that don't bundle ripgrep — and on the bare droplet. Exclude paths
-# are passed via the standard --exclude / --exclude-dir flags.
-
-# ----------------------------------------------------------------------------
-# 1. Path-exclusion args — paths where hits NEVER count (frozen archives,
-#    generated content, dot-git, third-party deps). Filtered at the grep
-#    level so they never even enter the candidate set.
-# ----------------------------------------------------------------------------
-EXCLUDE_DIRS=(
-  --exclude-dir=node_modules
-  --exclude-dir=.git
-  --exclude-dir=dist               # gitignored build/package output (a stale
-                                   # core tarball tree re-reports every hit in
-                                   # it — task 1002640); grep -R walks the
-                                   # filesystem, not the git index.
-  --exclude-dir=iterations         # under art/, historical cost ledger
-  --exclude-dir=generated          # under art/, generated PNGs / metadata
-  --exclude-dir=docs               # human prose: ADRs, recipes, plans,
-                                   # session logs, architecture notes —
-                                   # naming the founder by intent
-  --exclude-dir=blockers           # blockers ARE the things stuck on Lars
-  --exclude-dir=limitations        # archives + scope-truth docs
-  --exclude-dir=fixtures           # sample API payloads (hall-preview) mirror
-                                   # real prod rows, which name real builders —
-                                   # frozen sample data, not runtime code.
-  --exclude-dir=worktrees          # .claude/worktrees/ holds N full repo
-                                   # copies (one per builder worktree); from
-                                   # the main checkout, recursing them is slow
-                                   # AND produces 100s of duplicate self-hits
-                                   # (#558). Each worktree audits its own tree.
-)
-EXCLUDE_FILES=(
-  --exclude=session-log-archive.md
-  --exclude='*-shipped.md'         # frozen version archives in limitations/
-  --exclude='*.sql'                # migrations ran AS lars at migration time
-  --exclude=CLAUDE.md              # §2 is about the prompter by intent
-  --exclude=README.md              # README credits / examples
-  --exclude=chat-inbox.md          # framing references
-  --exclude=generative-ideas.md    # historical idea capture
-  --exclude=.git                   # in a worktree, .git is a file (gitdir
-                                   # pointer to main repo) — skip it
-)
-
-# ----------------------------------------------------------------------------
-# 2. The regex — what we're scanning for.
-#    Three families:
-#      a) /Users/larskristensen/... — runtime hardcoded home-dir paths
-#      b) builder_id = 1 / shipped_by = 1 — hardcoded primary key references
-#      c) literal lars589 / larskristensen identifiers in code surface
-# ----------------------------------------------------------------------------
-PATTERN='(/Users/larskristensen)|(\bbuilder_id\s*=\s*1\b)|(\bshipped_by\s*=\s*1\b)|(\blars589\b)|(\blarskristensen\b)'
-
-# ----------------------------------------------------------------------------
-# 3. The allowlist — file:line tokens where the regex IS expected to match.
-#    Each entry is a substring match against "file:line: <captured-text>"
-#    style records. Add a new allowlist entry only with a justification
-#    comment.
-# ----------------------------------------------------------------------------
-ALLOWLIST=(
-  # Frozen seed scripts — the V3 plan literally contains the strings being
-  # audited because the task DESCRIPTION (#234/V3.R09 and #236/V3.R12) names
-  # them. Stripping them would lose the task history.
-  'scripts/gds/seed-v3-tasks.js'
-
-  # Audit-replay docs the builders table example "1 for lars589" — that's
-  # the actual row in the prod DB; renaming the example breaks the doc.
-  'scripts/gds/audit-replay.sh'
-
-  # provision-staging.sh clones the actual GitHub repo owned by lars589.
-  # That's the GitHub org/user that owns the repo; not a builder identity.
-  'scripts/deploy/provision-staging.sh'
-
-  # CODEOWNERS is GitHub's owner-review list (task 1002611 / ADR 0159): the
-  # format requires the literal @username on every entry. Repo-hosting
-  # identity, same nature as provision-staging.sh — not a builder identity
-  # hardcoded in code.
-  'CODEOWNERS'
-
-  # This audit script's own self-reference (it documents what it's looking for).
-  'scripts/gds/audit-authorship.sh'
-
-  # skill-usage-review explains how Claude Code encodes cwd into the
-  # transcripts directory name — explanatory text describing why the glob
-  # is now builder-agnostic. Not a runtime hardcode.
-  '.claude/scheduled-tasks/skill-usage-review/SKILL.md'
-
-  # setup_smoke explicitly asserts the ABSENCE of /Users/larskristensen
-  # leaks in setup.js — the string appearing in the comment IS the
-  # specification of what's forbidden in implementation code.
-  'tests/setup_smoke.mjs'
-
-  # Test DATA that pins a real contract (task 1002640) — identity in an
-  # assertion IS the contract, not a mis-attribution: owner approval RECORDS
-  # the Archon's login (gate_approvals), packaging/provisioning tests
-  # exercise the real repo owner + the mirror-redaction floor. Listed per file
-  # (never a blanket tests/ exclusion) so a NEW test file is still scanned.
-  'tests/provision.mjs'
-  'tests/package_core.mjs'
-  'tests/init.mjs'
-  'tests/gate_approvals.mjs'
-  'tests/publish_reconciler.mjs'
-  'tests/dev_lib.mjs'
-  'tests/ship_card.mjs'
-  'tests/scrubber_corpus.mjs'
-  'tests/module_submissions.mjs'
-  'tests/provisioning_onboard_mode.mjs'
-  'tests/instance_manifest.mjs'
-  'tests/bongos_downloads.mjs'
-  'tests/status_mirror_sync.mjs'
-  'tests/search_isolation.mjs'
-  'tests/grade_aggregates_unavailable.mjs'
-  'tests/first_admin_bootstrap.mjs'
-  'tests/discord_approvals.mjs'
-  'tests/currency_label.mjs'
-  'tests/cloud_bongos_pack.mjs'
-  'tests/bump_version.mjs'
-  'tests/auth_inactive_builder.mjs'
-  'tests/auth_anthropic_identity.mjs'
-
-  # The mirror-redaction floor: PRIOR_INSTANCE_FLOOR carries the prior
-  # instance's owner literal precisely so packaging can SCRUB it from every
-  # published core — the anti-leak spec, not a runtime hardcode (task 1002640).
-  'scripts/gds/package-core.js'
-
-  # Frozen seed script — a task DESCRIPTION quotes migration 023's founding-
-  # Archon literal as the thing that task exists to remove (the
-  # seed-v3-tasks.js class: stripping it would lose the task history).
-  'scripts/gds/seed-medusa-tasks.js'
-)
-
-# ----------------------------------------------------------------------------
-# 4. Operational-identity allowlist — these patterns reference the droplet's
-#    unix user / SSH target / ACME contact / cron user / DB role. They are
-#    legitimate operational configuration, not impersonation of a builder.
-# ----------------------------------------------------------------------------
-OPS_ALLOWLIST_PATTERN='(^User=lars$|/home/lars/|lars@104\.236\.254\.243|lars@hermeslines\.com|^DROPLET=.*lars@|sudo -u postgres .*-O lars\b|PGUSER=lars\b|createdb -O lars\b|"-U" "?lars"?|-U lars\b|runs as user .lars.|service .* lars\b|cron .*lars\b)'
-
-# ----------------------------------------------------------------------------
-# 4b. Spec-string allowlist — content patterns where the literal "lars589"
-#    (etc.) appears precisely because it is the THING THE AUDIT FORBIDS,
-#    quoted inside a prompt/comment that instructs a reader (human or the LLM
-#    grader) to hunt for it. The grader workers' prompts say `Look for literal
-#    "lars", "lars589", absolute /Users paths ...` — that's the audit's own
-#    specification embedded in a prompt, not a runtime hardcode that
-#    mis-attributes a builder. Matched on line content (not file path) so the
-#    rest of grader.js stays auditable for a genuine hardcode.
-#
-#    The pattern is the FULL exact prompt phrase, not just `Look for literal`,
-#    so the suppression can't double as a smuggling channel: a contributor
-#    can't sneak a real hardcode past the audit by appending a short comment,
-#    because escaping requires reproducing this whole sentence verbatim — at
-#    which point the line is self-evidently a prompt-spec, not plausible cover
-#    for `builder_id = "lars589"`.
-# ----------------------------------------------------------------------------
-SPEC_ALLOWLIST_PATTERN='[Ll]ook for literal "lars", "lars589", absolute /Users paths'
-
-# ----------------------------------------------------------------------------
-# 5. Scan, filter, report.
-# ----------------------------------------------------------------------------
-TMP_RAW="$(mktemp)"
-TMP_HITS="$(mktemp)"
-TMP_FILTERED="$(mktemp)"
-trap 'rm -f "$TMP_RAW" "$TMP_HITS" "$TMP_FILTERED"' EXIT
-
-# Walk every file under repo root (excluding the path-level exclusions above).
-# grep -R recurses into hidden subdirs by default (including .claude/, which
-# absolutely DOES need auditing since skill prompts live there). The
-# --exclude-dir entries below cull the dirs we don't care about.
-grep -RIn -E "${EXCLUDE_DIRS[@]}" "${EXCLUDE_FILES[@]}" -e "$PATTERN" . 2>/dev/null \
-  | sed 's|^\./||' \
-  | sort -u \
-  > "$TMP_RAW" || true
-
-# Apply file-level allowlist (entry is a path prefix match against "file:" portion).
-ALLOWLIST_RE=''
-for e in "${ALLOWLIST[@]}"; do
-  # Escape regex metachars conservatively (just dots — paths only have those).
-  esc="${e//./\\.}"
-  ALLOWLIST_RE+="^${esc}:|"
-done
-ALLOWLIST_RE="${ALLOWLIST_RE%|}"
-
-if [ -n "$ALLOWLIST_RE" ]; then
-  grep -vE "$ALLOWLIST_RE" "$TMP_RAW" > "$TMP_HITS" || true
-else
-  cp "$TMP_RAW" "$TMP_HITS"
-fi
-
-# Apply operational-identity + spec-string pattern allowlists (both match on
-# line content, not file path). NB deliberately NO comment-line filter: a
-# content pattern like `^\s*(//|#)` also matches live code (a JS private class
-# field `#name = ...`, a protocol-relative `//host` continuation line), so a
-# real hardcode could dress as a comment to slip through. Historical-
-# attribution comments get per-file ALLOWLIST entries instead (task 1002640).
-grep -vE "$OPS_ALLOWLIST_PATTERN" "$TMP_HITS" \
-  | grep -vE "$SPEC_ALLOWLIST_PATTERN" > "$TMP_FILTERED" || true
-
-# ----------------------------------------------------------------------------
-# 6. The founder's UNIX ACCOUNT in account position (task 1002719). Family (c)
-#    greps the GitHub login, and a unix name is not a GitHub login — which is
-#    how the standup's `install -d -o <founder> …` reached every operator's box
-#    unseen. Runtime code only (tests/ pin fixtures by design), and the ops
-#    allowlist above does NOT apply: "that is the droplet's unix user" is the
-#    very assumption this family refuses in code that runs on other planes.
-#    Derive the account instead (provision-repo.js appUser()).
-# ----------------------------------------------------------------------------
-UNIX_USER_PATTERN='((^|[^A-Za-z0-9_.-])(-o|-g|-u)[ =]lars\b)|(\b(User|Group)=lars\b)|(\bchown( -R)? lars\b)|([A-Za-z_]*[Uu][Ss][Ee][Rr][A-Za-z_]*\s*[:=]\s*["'"'"']lars["'"'"'])'
-UNIX_ALLOWLIST=(
-  # This script's own pattern.
-  'scripts/gds/audit-authorship.sh'
-)
-UNIX_ALLOWLIST_RE=''
-for e in "${UNIX_ALLOWLIST[@]}"; do
-  UNIX_ALLOWLIST_RE+="^${e//./\\.}:|"
-done
-UNIX_ALLOWLIST_RE="${UNIX_ALLOWLIST_RE%|}"
-
-grep -RIn -E "${EXCLUDE_DIRS[@]}" --exclude-dir=tests --exclude-dir=test "${EXCLUDE_FILES[@]}" -e "$UNIX_USER_PATTERN" . 2>/dev/null \
-  | sed 's|^\./||' \
-  | sort -u \
-  | grep -vE "$UNIX_ALLOWLIST_RE" >> "$TMP_FILTERED" || true
-
-HIT_COUNT=$(wc -l < "$TMP_FILTERED" | tr -d ' ')
-
-if [ "$VERBOSE" = "1" ]; then
-  TOTAL=$(wc -l < "$TMP_RAW" | tr -d ' ')
-  AFTER_FILE=$(wc -l < "$TMP_HITS" | tr -d ' ')
-  echo "audit-authorship: scan summary"
-  echo "  raw hits (post path-exclude): $TOTAL"
-  echo "  after file allowlist:          $AFTER_FILE"
-  echo "  after ops + spec allowlists:   $HIT_COUNT"
-  echo ""
-fi
-
-if [ "$HIT_COUNT" -eq 0 ]; then
-  echo "audit-authorship: PASS — no hardcoded Archon-identity references in implementation code."
-  exit 0
-fi
-
-echo "audit-authorship: FAIL — found $HIT_COUNT hardcoded reference(s) to the original Archon in implementation code."
-echo ""
-echo "Hits:"
-cat "$TMP_FILTERED"
-echo ""
-echo "Remediation:"
-echo "  * Paths like /Users/larskristensen/...  ->  use \$HOME or os.path.expanduser('~')"
-echo "  * builder_id = 1 / shipped_by = 1       ->  use req.builder.id / the active claim"
-echo "  * lars589 / larskristensen literals     ->  use the current builder's github_login"
-echo "  * -o/-u lars, User=lars, *user = 'lars' ->  derive the account (appUser() in provision-repo.js)"
-echo ""
-echo "If a hit IS intentional (historical doc, droplet operational identity,"
-echo "or a frozen seed/import script), add it to the ALLOWLIST or"
-echo "OPS_ALLOWLIST_PATTERN in this script with a one-line justification."
-exit 1
+# scripts/gds/audit-authorship.sh — @bongos-forwarder (task 1004848). Generated by
+# scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+# The real script is scripts/bongos/audit-authorship.sh. This forwarder keeps callers that still name
+# the old path working, and warns once so they get repointed. Task 1003706 removes it.
+if [ -z "${BONGOS_FORWARDER_WARNED:-}" ]; then echo "[bongos] scripts/gds/audit-authorship.sh has moved to scripts/bongos/audit-authorship.sh. This old path still works for now, but update whatever called it. The forwarders in scripts/gds/ are removed in a later release." >&2; fi
+export BONGOS_FORWARDER_WARNED=1
+exec bash "$(dirname "$0")/../bongos/audit-authorship.sh" "$@"