@bongos/core 1.21.174 → 1.21.176

package/src/bongos/module-scope-map.js

@@ -12,7 +12,7 @@
 //   1. `protected` is DERIVED, never hand-set — a module is protected iff its
 //      globs overlap PROTECTED_GLOBS, the SINGLE source in permission-path-check.js.
 //   2. We IMPORT PROTECTED_GLOBS; we never re-declare it. A fitness check
-//      (scripts/gds/fitness.js) reds the build if this file re-declares it.
+//      (scripts/bongos/fitness.js) reds the build if this file re-declares it.
 //
 // GLOB FORMAT = the touches[] convention (path-match.js): an exact path matches
 // one file; a trailing '/' covers the whole subtree. No '*'/'**' wildcards — the
@@ -89,7 +89,7 @@ const MODULE_GLOBS = {
     // by NO goal, because MODULE_GLOBS is the authoring territory and the shared
     // floor is only tests/. cli-lib.js is the CLI's own argv/session plumbing —
     // core library surface, so it sits with the rest of the kernel.
-    'scripts/gds/cli-lib.js',
+    'scripts/bongos/cli-lib.js',
   ],
   // --- the build state machine + ship/grade/deploy orchestration + schema ---
   // Carved into modules/lifecycle/ (BV1.R86 / ADR 0093 §1,§3): the task/claim/
@@ -103,20 +103,20 @@ const MODULE_GLOBS = {
   // goal-scope/task-affinity).
   lifecycle: [
     'modules/lifecycle/',
-    'scripts/gds/ship.js', 'scripts/gds/claim.js', 'scripts/gds/release.js',
-    'scripts/gds/ship-mode-manual.js', // task 1004631
+    'scripts/bongos/ship.js', 'scripts/bongos/claim.js', 'scripts/bongos/release.js',
+    'scripts/bongos/ship-mode-manual.js', // task 1004631
     // task 1004024: the 2026-08-23 ship.js carve, now protected (by name: no '*' here).
-    'scripts/gds/ship-check.js', 'scripts/gds/ship-deploy-target.js', 'scripts/gds/ship-escalation.js',
-    'scripts/gds/ship-finish.js', 'scripts/gds/ship-flow.js', 'scripts/gds/ship-git.js',
-    'scripts/gds/ship-grade-steps.js', 'scripts/gds/ship-grade.js', 'scripts/gds/ship-honesty.js',
-    'scripts/gds/ship-io.js', 'scripts/gds/ship-land.js', 'scripts/gds/ship-memory-sync.js',
-    'scripts/gds/ship-merge-gate.js', 'scripts/gds/ship-merge.js', 'scripts/gds/ship-mode-ask.js',
-    'scripts/gds/ship-preflight-steps.js',
-    'scripts/gds/ship-regen.js', 'scripts/gds/ship-resume.js', 'scripts/gds/ship-session-upload.js',
-    'scripts/gds/ship-state.js', 'scripts/gds/ship-surprise.js', 'scripts/gds/ship-visual.js',
-    'scripts/gds/merge-mode.js', 'scripts/gds/confirm.js', 'scripts/gds/main-audit.js',
-    'scripts/gds/gate-review.js', 'scripts/gds/push-main.js', 'scripts/gds/ci-grade.js',
-    'scripts/gds/merge-lock.js', 'scripts/gds/version-close.js',
+    'scripts/bongos/ship-check.js', 'scripts/bongos/ship-deploy-target.js', 'scripts/bongos/ship-escalation.js',
+    'scripts/bongos/ship-finish.js', 'scripts/bongos/ship-flow.js', 'scripts/bongos/ship-git.js',
+    'scripts/bongos/ship-grade-steps.js', 'scripts/bongos/ship-grade.js', 'scripts/bongos/ship-honesty.js',
+    'scripts/bongos/ship-io.js', 'scripts/bongos/ship-land.js', 'scripts/bongos/ship-memory-sync.js',
+    'scripts/bongos/ship-merge-gate.js', 'scripts/bongos/ship-merge.js', 'scripts/bongos/ship-mode-ask.js',
+    'scripts/bongos/ship-preflight-steps.js',
+    'scripts/bongos/ship-regen.js', 'scripts/bongos/ship-resume.js', 'scripts/bongos/ship-session-upload.js',
+    'scripts/bongos/ship-state.js', 'scripts/bongos/ship-surprise.js', 'scripts/bongos/ship-visual.js',
+    'scripts/bongos/merge-mode.js', 'scripts/bongos/confirm.js', 'scripts/bongos/main-audit.js',
+    'scripts/bongos/gate-review.js', 'scripts/bongos/push-main.js', 'scripts/bongos/ci-grade.js',
+    'scripts/bongos/merge-lock.js', 'scripts/bongos/version-close.js',
     'migrations/',
   
     // ADOPTED (task 1004111): the deploy half of the ship pipeline lifecycle
@@ -140,15 +140,15 @@ const MODULE_GLOBS = {
     // System 3; its deps are lifecycle + builder-settings, not the grader — see
     // modules/grading/CLAUDE.md "NOT in this module"); grade-smoke is its CLI.
     'modules/grading/',
-    'src/bongos/cascade-dispatch.js', 'scripts/gds/grade-smoke.js',
+    'src/bongos/cascade-dispatch.js', 'scripts/bongos/grade-smoke.js',
   ],
   // --- memory, recall, search, learnings ---
   memory: [
     // Carved into modules/memory/ (BV1.R72 / ADR 0091 §2); the memory-owned CLIs
-    // stay under scripts/gds/ (a command travels with its domain — design 02§1).
+    // stay under scripts/bongos/ (a command travels with its domain — design 02§1).
     'modules/memory/',
-    'scripts/gds/recall.js', 'scripts/gds/learning-capture.js',
-    'scripts/gds/search-ingest-md.js', 'scripts/gds/search-ingest-db.js',
+    'scripts/bongos/recall.js', 'scripts/bongos/learning-capture.js',
+    'scripts/bongos/search-ingest-md.js', 'scripts/bongos/search-ingest-db.js',
   ],
   // --- admission, setup, newcomer floor ---
   // Carved into modules/onboarding/ (BV1.R81 / ADR 0093 §1): the friction
@@ -160,13 +160,13 @@ const MODULE_GLOBS = {
   // The onboarding-domain CLIs travel with the domain but stay under scripts/.
   onboarding: [
     'modules/onboarding/',
-    'scripts/gds/setup.js', 'scripts/gds/onboarding-config.js',
-    'scripts/gds/onboarding-analyze.js', 'scripts/gds/newcomer-floor.js',
+    'scripts/bongos/setup.js', 'scripts/bongos/onboarding-config.js',
+    'scripts/bongos/onboarding-analyze.js', 'scripts/bongos/newcomer-floor.js',
   ],
   // --- inbox, capture, triage, blockers (carved → modules/ideas/, BV1.R78) ---
   ideas: [
     'modules/ideas/',
-    'scripts/gds/capture.js', 'scripts/gds/triage.js', 'scripts/gds/render-ideas.js',
+    'scripts/bongos/capture.js', 'scripts/bongos/triage.js', 'scripts/bongos/render-ideas.js',
   ],
   // Role sub-specialities (task 1003855, ADR 0296). Carved into modules/specialities/
   // but never given a key here, so every file it owns — module.json, db.js, routes,
@@ -174,7 +174,7 @@ const MODULE_GLOBS = {
   // `specialities` was denied out_of_scope for touching the module it is named after
   // (found by task 1004132). Every OTHER on-disk module owns its own directory; this
   // was the only one that did not, and checkEveryModuleDirIsScoped in
-  // scripts/gds/scope-map-guard.js now fails CI if a new carve repeats it.
+  // scripts/bongos/scope-map-guard.js now fails CI if a new carve repeats it.
   specialities: [
     'modules/specialities/',
   ],
@@ -182,6 +182,10 @@ const MODULE_GLOBS = {
   'page-notes': [
     'modules/page-notes/',
   ],
+  // The /raise investor page (task 1004847, ADR 0384): hub-only.
+  raise: [
+    'modules/raise/',
+  ],
   // --- builder prefs (wandering/skill/sound/render) + builder-needs ---
   // Carved into modules/builder-settings/ (BV1.R80 / ADR 0093 §1): the five pref
   // libs + builder-needs + their db slice + the `/me/*-prefs` routes + the
@@ -192,7 +196,7 @@ const MODULE_GLOBS = {
   // comment itself said was core. The pref-mirroring CLIs travel with the
   // domain but stay under scripts/.
   'builder-settings': [
-    'scripts/gds/fetch-sound-prefs.js',
+    'scripts/bongos/fetch-sound-prefs.js',
     'modules/builder-settings/',
   ],
   // --- session records, cost/eval/digest, transcript corpus, BFG ---
@@ -203,10 +207,10 @@ const MODULE_GLOBS = {
   // modules/builder-settings/wandering-prefs — scripts are outside the kernel
   // boundary, so it's not a cross-module import).
   sessions: [
-    'scripts/gds/session.js', 'scripts/gds/session-cost.js', 'scripts/gds/session-eval.js',
-    'scripts/gds/session-digest.js', 'scripts/gds/backfill-sessions.js',
-    'scripts/gds/bfg-principal-token.js', 'scripts/gds/pulse.js',
-    'scripts/gds/repo-metrics.js',
+    'scripts/bongos/session.js', 'scripts/bongos/session-cost.js', 'scripts/bongos/session-eval.js',
+    'scripts/bongos/session-digest.js', 'scripts/bongos/backfill-sessions.js',
+    'scripts/bongos/bfg-principal-token.js', 'scripts/bongos/pulse.js',
+    'scripts/bongos/repo-metrics.js',
     'modules/sessions/',
   ],
   // --- conductor dispatch, architect audits, autonomy gate, routine timers ---
@@ -217,9 +221,9 @@ const MODULE_GLOBS = {
   // with its domain — design 02§1), as do the scheduled-task SKILL.md files.
   autonomy: [
     'modules/autonomy/',
-    'scripts/gds/autonomy-gate.js',
-    'scripts/gds/conductor-dispatch.js', 'scripts/gds/architect-audit.js',
-    'scripts/gds/run-routine.js', '.claude/scheduled-tasks/',
+    'scripts/bongos/autonomy-gate.js',
+    'scripts/bongos/conductor-dispatch.js', 'scripts/bongos/architect-audit.js',
+    'scripts/bongos/run-routine.js', '.claude/scheduled-tasks/',
   ],
   // --- red-team reports + bounty (rank-gated Metic+) ---
   security: [
@@ -279,7 +283,7 @@ const MODULE_GLOBS = {
   //     library (the design-style skills are the design-styles key since task
   //     1004470). default-on,
   //     declaration-only (three skills, no routes/port/migrations). The three
-  //     scripts/gds/ shims are core-side entry points over the module's CLIs —
+  //     scripts/bongos/ shims are core-side entry points over the module's CLIs —
   //     listed for task affinity (the memory/ideas precedent: a command travels with
   //     its domain). The contributed skill dirs follow the devsecops note above
   //     ('.claude/skills/' stays with whichever module ships the skill); the two
@@ -296,8 +300,8 @@ const MODULE_GLOBS = {
     // protected module: ui-design is unprotected, so a ui builder keeps reach over
     // their own working directory.
     '.impeccable/',
-    'scripts/gds/design-sync.js', 'scripts/gds/figma-design-sync.js', 'scripts/gds/validate-design.js',
-    'scripts/gds/ui-kit-transform.js', // the kit's stub reaches the real serving transforms through this command (task 1003320)
+    'scripts/bongos/design-sync.js', 'scripts/bongos/figma-design-sync.js', 'scripts/bongos/validate-design.js',
+    'scripts/bongos/ui-kit-transform.js', // the kit's stub reaches the real serving transforms through this command (task 1003320)
     '.claude/skills/design/', '.claude/skills/design-sync/', '.claude/skills/figma-design-sync/',
     'docs/recipes/claude-design-loop.md', 'docs/recipes/figma-design-loop.md',
   ],
@@ -319,7 +323,7 @@ const MODULE_GLOBS = {
   //     truth; text had none. R01 built the inventory (the copy-inventory
   //     generator + its committed registry under docs/), R02 the flag + queue on
   //     top of it. The generator travels with the domain but stays under
-  //     scripts/gds/ — the memory/ideas precedent (a command travels with its
+  //     scripts/bongos/ — the memory/ideas precedent (a command travels with its
   //     domain, design 02§1). The generated artifacts are listed as exact paths
   //     so a copy task's touches[] can name them without claiming all of docs/.
   //     KEY IS 'copy-desk', NOT 'copy': the branding contract already owns a
@@ -328,7 +332,7 @@ const MODULE_GLOBS = {
   //     fitness check on the English word alone.
   'copy-desk': [
     'modules/copy-desk/',
-    'scripts/gds/copy-inventory.js',
+    'scripts/bongos/copy-inventory.js',
     'docs/copy-registry.json', 'docs/copy-inventory.md',
   ],
   // --- the declarative agent registry (goal 1000038, ADR 0083 default:false):
@@ -338,11 +342,11 @@ const MODULE_GLOBS = {
   //     (files-are-source — the committed definitions ARE the input agents-sync
   //     upserts), listed alongside it on the autonomy precedent, which likewise
   //     owns its '.claude/scheduled-tasks/' definition dir. The sync CLI travels
-  //     with the domain but stays under scripts/gds/ (the provisioning
+  //     with the domain but stays under scripts/bongos/ (the provisioning
   //     precedent). Without this key the three Agents goals (1000038/39/40) could
   //     declare no wall at all (task 1002736).
   agents: [
-    'modules/agents/', '.claude/agents/', 'scripts/gds/agents-sync.js',
+    'modules/agents/', '.claude/agents/', 'scripts/bongos/agents-sync.js',
   ],
   // --- the hub identity provider + the PROJECTS CATALOG it owns (ADR 0141): platform
   //     accounts, the SSO client registry, project memberships/invites, and the
@@ -372,7 +376,7 @@ const MODULE_GLOBS = {
   //     them (task 1002690). ---
   provisioning: [
     'modules/provisioning/',
-    'scripts/gds/provision.js',
+    'scripts/bongos/provision.js',
   ],
   discord: [
     // The bot, broadcast, link/role seams, channels, and bug-attachments graduated
@@ -389,9 +393,9 @@ const MODULE_GLOBS = {
   //     the effect tests/government_protected_surfaces.mjs pins against. Given this key
   //     by task 1003892 (their previous owner was retired).
   'control-plane': [
-    'scripts/gds/provision-config.js',
-    'scripts/gds/provision-net.js',
-    'scripts/gds/do-api.js',
+    'scripts/bongos/provision-config.js',
+    'scripts/bongos/provision-net.js',
+    'scripts/bongos/do-api.js',
     'infra/',
   ],
   // --- the dev-hygiene enforcement surfaces: CI workflows, the agent permission/
@@ -423,58 +427,59 @@ const MODULE_GLOBS = {
     // scanner config above (task 1004146).
     '.gitignore', '.env.local.example',
     'package.json', 'package-lock.json',
-    'scripts/gds/fitness.js', 'scripts/gds/docs-entropy.js',
-    'scripts/gds/redteam-patrol.js', 'scripts/gds/audit-gate.js',
-    'scripts/gds/fitness-ratchets.js', 'scripts/gds/control-manifest.js',
+    'scripts/bongos/fitness.js', 'scripts/bongos/docs-entropy.js',
+    'scripts/bongos/redteam-patrol.js', 'scripts/bongos/audit-gate.js',
+    'scripts/bongos/fitness-ratchets.js', 'scripts/bongos/control-manifest.js',
     // Every file fitness.js actually requires (task 1003949). Since fitness.js hit
     // its line ratchet, the house style is that each new check lands in its OWN file
     // beside it — and none of them was listed here, so scopeSubset() resolved them to
     // no territory and a goal scoped to devsecops was denied out_of_scope for touching
     // the very tooling it owns (the 1002690 / 1002736 / 1003124 / 1003655 class).
     //
-    // This list is kept honest by scripts/gds/scope-map-guard.js rather than by
+    // This list is kept honest by scripts/bongos/scope-map-guard.js rather than by
     // remembering: it derives the same set from fitness.js's own requires and fails
     // CI when one is missing. That guard exists because appending is not a fix — the
     // task that filed this named FOURTEEN unowned files and there were twenty-two.
-    'scripts/gds/scope-map-guard.js',
+    'scripts/bongos/scope-map-guard.js',
     // Landed from task 1003763 while this branch was in flight, and the guard below
     // caught it unowned on the merge - which is the drift it exists to stop.
-    'scripts/gds/home-isolation-guard.js',
+    'scripts/bongos/home-isolation-guard.js',
     // Required WITHOUT the .js extension by fitness.js, which is how they stayed
     // invisible to the first cut of scope-map-guard (grade round 1): Node resolves
     // require('./skill-lint') fine, but a pattern anchored on '.js' matched none of them.
-    'scripts/gds/gen-api-docs.js', 'scripts/gds/migration-namespace.js',
-    'scripts/gds/skill-lint.js', 'scripts/gds/run-routine.js',
-    'scripts/gds/adr-namespace.js', 'scripts/gds/baseline-staleness.js',
-    'scripts/gds/category-advisory-guard.js', 'scripts/gds/client-baseurl-guard.js',
-    'scripts/gds/doc-cli-guard.js', 'scripts/gds/doc-control-claims.js', 'scripts/gds/doc-comment-coverage.js',
-    'scripts/gds/exec-path-guard.js', 'scripts/gds/fitness-lib.js',
-    'scripts/gds/fitness-checks-error-envelope.js', 'scripts/gds/fitness-checks-identity.js',
-    'scripts/gds/fitness-checks-packaging.js', 'scripts/gds/fitness-checks-route-pins.js',
-    'scripts/gds/fitness-checks-vocabulary.js', 'scripts/gds/fitness-checks-write-validation.js',
-    'scripts/gds/fitness-migration-contraction.js', 'scripts/gds/role-pack-guard.js',
-    'scripts/gds/scope-roster-guard.js',
-    'scripts/gds/route-shadow-guard.js', 'scripts/gds/routine-schedule.js',
-    'scripts/gds/seam-wiring-guard.js', 'scripts/gds/skill-preflight.js',
-    'scripts/gds/test-path-guard.js', 'scripts/gds/version-literal-guard.js', 'scripts/gds/dev-box-guard.js',
+    'scripts/bongos/gen-api-docs.js', 'scripts/bongos/migration-namespace.js',
+    'scripts/bongos/skill-lint.js', 'scripts/bongos/run-routine.js',
+    'scripts/bongos/adr-namespace.js', 'scripts/bongos/baseline-staleness.js',
+    'scripts/bongos/category-advisory-guard.js', 'scripts/bongos/client-baseurl-guard.js',
+    'scripts/bongos/doc-cli-guard.js', 'scripts/bongos/doc-control-claims.js', 'scripts/bongos/doc-comment-coverage.js',
+    'scripts/bongos/exec-path-guard.js', 'scripts/bongos/fitness-lib.js',
+    'scripts/bongos/fitness-checks-error-envelope.js', 'scripts/bongos/fitness-checks-identity.js',
+    'scripts/bongos/fitness-checks-packaging.js', 'scripts/bongos/fitness-checks-route-pins.js',
+    'scripts/bongos/fitness-checks-vocabulary.js', 'scripts/bongos/fitness-checks-write-validation.js',
+    'scripts/bongos/fitness-migration-contraction.js', 'scripts/bongos/role-pack-guard.js',
+    'scripts/bongos/scope-roster-guard.js',
+    'scripts/bongos/route-shadow-guard.js', 'scripts/bongos/routine-schedule.js',
+    'scripts/bongos/seam-wiring-guard.js', 'scripts/bongos/skill-preflight.js',
+    'scripts/bongos/test-path-guard.js', 'scripts/bongos/version-literal-guard.js', 'scripts/bongos/dev-box-guard.js',
   
     // ADOPTED (task 1004111): the enforcement surfaces this module already IS.
-    // install-git-hooks.js + scripts/gds/hooks/ are the pre-push hook beside the
+    // install-git-hooks.js + scripts/bongos/hooks/ are the pre-push hook beside the
     // .husky/ it owns; git-merge-regen.js + .gitattributes are the merge-driver
     // PAIR and must not straddle a module boundary; run-unit-tests.js is the CI
     // runner; gen-api-client.js is the sibling of the gen-api-docs.js above.
     // CODEOWNERS is review routing, which is this module's job.
-    'scripts/gds/install-git-hooks.js',
-    'scripts/gds/hooks/',
-    'scripts/gds/git-merge-regen.js',
+    'scripts/bongos/install-git-hooks.js',
+    'scripts/bongos/hooks/',
+    'scripts/gds/', // task 1004848: the @bongos-forwarder files the move left; protected, so a goal must own them
+    'scripts/bongos/git-merge-regen.js',
     '.gitattributes',
-    'scripts/gds/run-unit-tests.js',
-    'scripts/gds/gen-api-client.js',
+    'scripts/bongos/run-unit-tests.js',
+    'scripts/bongos/gen-api-client.js',
     'CODEOWNERS',
   ],
   // --- the METHODOLOGY surfaces: the instruction core an agent session actually
   //     reads — the always-loaded root CLAUDE.md, the docs library it indexes, the
-  //     slash-command skills, and the two scripts/gds files that compose a session's
+  //     slash-command skills, and the two scripts/bongos files that compose a session's
   //     opening context (start.js and the discipline→mode table it routes on).
   //     Added by task 1002989 (goal 1000095, working area 6) as PREP for the
   //     kernel↔pack split (task 1002990): that work rewrites CLAUDE.md, authors the
@@ -495,7 +500,7 @@ const MODULE_GLOBS = {
   //       there for task affinity — overlap is legal (touchesOverlap is prefix-aware
   //       both directions) and it keeps those walls standing on their own.
   //       KNOWN CONSEQUENCE: docs/ was previously owned by nobody, which the ship-time
-  //       module-drift advisory (scripts/gds/ship-flow.js, BV1.R53) read as
+  //       module-drift advisory (scripts/bongos/ship-flow.js, BV1.R53) read as
   //       "cross-cutting, allowed". A module_key-labelled task that also writes a
   //       session log / ADR / regenerated doc now trips that WARNING (advisory only —
   //       it refuses solely under --enforce-module). Filed as an idea to teach the
@@ -509,7 +514,7 @@ const MODULE_GLOBS = {
   //     • '.claude/rules/' is pre-carved territory for task 1003687 (move the
   //       CLAUDE.md content charter to a paths-scoped rule file) — the carve precedes
   //       the feature, ADR 0086 §4, on the devsecops '.npmrc' precedent.
-  //     NOT here: scripts/gds/fitness.js. Task 1002989's brief named it as uncovered,
+  //     NOT here: scripts/bongos/fitness.js. Task 1002989's brief named it as uncovered,
   //     but that brief predates task 1003124, which gave devsecops the fitness/entropy
   //     tooling. One owner per enforcement tool — the CLAUDE.md budget check is
   //     enforcement, not methodology prose. ---
@@ -517,14 +522,14 @@ const MODULE_GLOBS = {
     'CLAUDE.md',
     'docs/',
     '.claude/skills/', '.claude/rules/',
-    'scripts/gds/start.js', 'scripts/gds/discipline-modes.json',
+    'scripts/bongos/start.js', 'scripts/bongos/discipline-modes.json',
   
     // ADOPTED (task 1004111): the three freshness generators that write the docs
     // this module owns — repo-map, file-map and the session index all emit into
     // docs/ (and CLAUDE.md), so the generator belongs with its output.
-    'scripts/gds/gen-repo-map.js',
-    'scripts/gds/gen-file-map.js',
-    'scripts/gds/gen-session-index.js',
+    'scripts/bongos/gen-repo-map.js',
+    'scripts/bongos/gen-file-map.js',
+    'scripts/bongos/gen-session-index.js',
   ],
 };
 
@@ -569,7 +574,7 @@ const SHARED_GLOBS = Object.freeze(
 // ── Roots no module glob touches, and why (task 1004132) ────────────────────────
 //
 // This is the RECORDED DECISION behind "the core is owned by nobody", not a note
-// about it. `checkNoNewUnownedRoot` in scripts/gds/scope-map-guard.js reads this
+// about it. `checkNoNewUnownedRoot` in scripts/bongos/scope-map-guard.js reads this
 // map and fails CI BOTH ways: a tracked root that appears here-less is new unowned
 // territory, and an entry whose root became owned (or stopped existing) is stale.
 //
@@ -590,8 +595,8 @@ const SHARED_GLOBS = Object.freeze(
 // filed to avoid; freezing the set and naming the arguable ones is the cheap half.
 const UNOWNED_ROOTS = Object.freeze({
   // Generated packaging manifests — written by package-core.js, never hand-edited.
-  '.bongos-core.json': 'generated package manifest (scripts/gds/package-core.js)',
-  '.cloudbongos-core.json': 'generated package manifest (scripts/gds/package-core.js)',
+  '.bongos-core.json': 'generated package manifest (scripts/bongos/package-core.js)',
+  '.cloudbongos-core.json': 'generated package manifest (scripts/bongos/package-core.js)',
   // Governance + legal. Deliberately not methodology: methodology owns docs/, and
   // these are the project's constitutional documents rather than its handbook.
   'LICENSE': 'project legal text',
@@ -604,18 +609,18 @@ const UNOWNED_ROOTS = Object.freeze({
   'DESIGN.md': 'top-level design statement',
   'PRODUCT.md': 'top-level product statement',
   // The core itself. bin/ is the CLI entrypoint and clients/ is the GENERATED API
-  // client (scripts/gds/gen-api-client.js); public-docs/ is the published site.
+  // client (scripts/bongos/gen-api-client.js); public-docs/ is the published site.
   // These are core, and core is Archon territory by ADR 0086 — the primary case
   // this list exists to record.
   'bin/': 'core CLI entrypoint — Archon territory (ADR 0086)',
-  'clients/': 'generated API client (scripts/gds/gen-api-client.js)',
+  'clients/': 'generated API client (scripts/bongos/gen-api-client.js)',
   'public-docs/': 'published docs site — core',
 });
 
 // A CLI ENTRYPOINT — a single executable script under scripts/, e.g.
-// 'scripts/gds/setup.js'. Structural, not a list: it is a path test, so no roster
+// 'scripts/bongos/setup.js'. Structural, not a list: it is a path test, so no roster
 // is hand-maintained here and nothing has to be kept in step with PROTECTED_GLOBS.
-// Directories ('scripts/deploy/', 'scripts/gds/hooks/') are territory, not
+// Directories ('scripts/deploy/', 'scripts/bongos/hooks/') are territory, not
 // commands, and are deliberately NOT matched.
 function isCommandPath(glob) {
   return /^scripts\/.*\.js$/.test(glob);
@@ -635,7 +640,7 @@ function protectingGlobs(globs) {
 // WHY THIS IS NOT JUST touchesOverlap(globs, PROTECTED_GLOBS) ANY MORE.
 //   That asked "does this module touch the trust core", and three modules answered
 //   yes because of exactly one CLI they own that happens to sit on a protected
-//   path: onboarding (scripts/gds/setup.js), autonomy (conductor-dispatch.js),
+//   path: onboarding (scripts/bongos/setup.js), autonomy (conductor-dispatch.js),
 //   copy-desk (copy-inventory.js). Owning the command is not owning the authority
 //   — modules/government/ IS government, but setup.js merely lives near
 //   onboarding — so the whole module became Archon-only to scope a goal to on the
@@ -652,7 +657,7 @@ function protectingGlobs(globs) {
 //
 // THE WALL THAT MATTERS DOES NOT MOVE. This decides who may CREATE a goal whose
 // territory includes a protected path. It does not decide who may WRITE one: a
-// sub-Metic builder touching scripts/gds/setup.js is still refused by
+// sub-Metic builder touching scripts/bongos/setup.js is still refused by
 // checkPermissionPaths (goal-scope-check.js wall 2), exactly as before.
 function isProtected(globs) {
   return protectingGlobs(globs).some((g) => !isCommandPath(g));
@@ -745,7 +750,7 @@ function isCrossCuttingModule(key) {
 }
 
 // Pure: of `files`, the ones that stray into a DIFFERENT module's territory for a
-// task scoped to `moduleKey`. Extracted from scripts/gds/ship-flow.js (BV1.R53,
+// task scoped to `moduleKey`. Extracted from scripts/bongos/ship-flow.js (BV1.R53,
 // task 1422) so the rule is testable without running a ship.
 //
 // A file is drift only if it is (a) outside the declared module's own globs and

package/src/bongos/module-store.js

@@ -2,7 +2,7 @@
 // module version's tarball and record it in the registry (task 1004271, ADR 0338 D1).
 //
 // The route (POST /store/modules/:key/versions in routes/modules.js) verifies the
-// upload with scripts/gds/module-artifact.js first; this file only persists what has
+// upload with scripts/bongos/module-artifact.js first; this file only persists what has
 // already passed. Two halves, in this order:
 //
 //   1. stageArtifact — write the tarball under the store dir (a temp name first;

package/src/bongos/module-submissions.js

@@ -6,7 +6,7 @@
 // lives in THIS instance's own DB rather than a live cross-repo call.
 //
 // Pure DB access — the packaging (pre-check, file read, sign-off) is
-// scripts/gds/module.js's job (build tooling, fs-only); the route wires the
+// scripts/bongos/module.js's job (build tooling, fs-only); the route wires the
 // two together.
 
 const { pool } = require('./pool');

package/src/bongos/optimizer.js

@@ -180,7 +180,7 @@ ${OPEN_BLOCKER_GUARD}${UNSHIPPED_DEPS_GUARD}
     for (const t of touches) chosenTouches.push(t);
   }
 
-  // CLI (scripts/gds/session.js printPlan) expects this exact shape, matching
+  // CLI (scripts/bongos/session.js printPlan) expects this exact shape, matching
   // the local-fallback contract: { recommended, long_tail, rationale_for,
   // time_used_min, time_budget_min }. The local fallback was written first
   // and is the canonical contract — this endpoint was diverging in field

package/src/bongos/package-registry.js

@@ -12,7 +12,7 @@
 // needs would have been inside the one module only one hall runs.
 //
 // WHY THE NEWEST PACKAGE'S NOTES. package-core writes release-notes.json from the WHOLE
-// history at pack time (scripts/gds/release-notes.js, task 1004218), so the newest version
+// history at pack time (scripts/bongos/release-notes.js, task 1004218), so the newest version
 // alone lists every version before it. One file answers every reader. The copy the
 // running core carries stops at its own version, which is exactly the range both readers
 // are asked about most: what is published but not running yet.

package/src/bongos/path-match.js

@@ -5,7 +5,7 @@
 // gone — git merge + /merge-mode are the ground-truth collision detector — but
 // matchOne itself is a small, pure "does any path/dir-prefix entry cover this
 // file?" helper still used by the conductor for diff→claim attribution
-// (scripts/gds/conductor-dispatch.js, .claude/hooks/conductor.js). It lives
+// (scripts/bongos/conductor-dispatch.js, .claude/hooks/conductor.js). It lives
 // here, on its own, so those consumers don't depend on a scanner that no longer
 // exists.
 //

package/src/bongos/permission-path-check.js

@@ -11,11 +11,11 @@
 //
 // This module is PURE and dependency-free (no pg, no network, no require of any
 // other repo module) so it can run in three places with identical logic:
-//   1. the LOCAL pre-push git hook (scripts/gds/hooks/pre-push.js) — fast,
+//   1. the LOCAL pre-push git hook (scripts/bongos/hooks/pre-push.js) — fast,
 //      cooperative, blocks the honest builder before the push leaves the box;
 //   2. the GRADER pre-pass (modules/grading/grader.js) — folds a finding into the panel
 //      so a sub-Metic permission-path ship hard-fails the grade;
-//   3. the post-push main AUDIT (scripts/gds/main-audit.js) — the authoritative
+//   3. the post-push main AUDIT (scripts/bongos/main-audit.js) — the authoritative
 //      net that reads the REAL git history + REAL builder ranks server-side and
 //      flags/reverts what slipped past 1 and 2 (the only layer that catches a
 //      raw `git push origin main`, since a free-plan private repo can't forbid
@@ -56,7 +56,7 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 //
 // WHY `fs` AND NOT `require`: ADR 0083's one-way rule forbids core from
 // require-ing a MODULE's code (a module's behavior + enable/disable state must
-// never be something the kernel depends on), and scripts/gds/fitness.js enforces
+// never be something the kernel depends on), and scripts/bongos/fitness.js enforces
 // that on `require` edges. This is not code — it is a static declarative data
 // file that ships inside the core package next to this file (modules/ ships with
 // @bongos/core, ADR 0108 §1). The sibling trust primitive route-rank-check.js

package/src/bongos/platform-visibility-gate.js

@@ -199,10 +199,8 @@ body{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px;
   background:#edecee;color:#17181a}
 @media(prefers-color-scheme:dark){body{background:#000000;color:#ffffff}}
 .box{width:min(380px,100%);text-align:center}
-.dots{display:flex;gap:10px;justify-content:center;margin-bottom:22px}
-.dots i{display:block;border-radius:50%;background:#fb9569}
-.dots i:first-child{width:38px;height:38px}
-.dots i:last-child{width:28px;height:28px;background:#c9512c;align-self:flex-end}
+.mark{display:block;width:48px;height:48px;margin:0 auto 22px}
+@media(prefers-color-scheme:dark){.mark .mr{stroke:#e2e1e4}.mark .mp{fill:#e2e1e4}}
 h1{font-size:20px;font-weight:700;margin:0 0 6px}
 p{margin:0 0 20px;opacity:.72;font-size:14px}
 /* dark ink on the accent fill: the chrome world's salmon carries white at 2.19:1 */
@@ -210,7 +208,7 @@ a.btn{display:inline-block;padding:11px 22px;border-radius:999px;background:#fb9
   font:700 14px/1 inherit;text-decoration:none}
 a.btn:focus{outline:2px solid #a3481a;outline-offset:2px}
 </style></head><body><div class="box">
-<div class="dots"><i></i><i></i></div>
+<svg class="mark" viewBox="0 0 200 200" aria-hidden="true"><path class="mr" d="M137 31 A78 78 0 1 0 170 66" fill="none" stroke="#17181a" stroke-width="15" stroke-linecap="round"/><circle class="mp" cx="100" cy="100" r="55" fill="#17181a"/><circle cx="156" cy="46" r="12" fill="#fb9569"/></svg>
 <h1>${safe}</h1>
 <p>This project’s pages are open to its members. Sign in to continue.</p>
 <a class="btn" href="${escAttr(signIn)}">Sign in</a>

package/src/bongos/prelaunch-gate.js

@@ -82,7 +82,10 @@ const SUBMIT_PATHS = [SUBMIT_PATH, LEGACY_SUBMIT_PATH];
 //   /metrics  Prometheus, already access-gated on its own terms (loopback or
 //             bearer token) — double-gating it would break the scrape
 //   /version  the deploy pin check, a public commit sha
-const EXEMPT = [/^\/api\//, /^\/healthz$/, /^\/metrics$/, /^\/version$/, /^\/__prelaunch$/, /^\/__stealth$/];
+//   /raise    the investor page (task 1004847, ADR 0384) carries its own password
+//             gate and NDA; investors are not told the pre-launch password. On an
+//             instance without the raise module the path is simply a 404.
+const EXEMPT = [/^\/api\//, /^\/healthz$/, /^\/metrics$/, /^\/version$/, /^\/__prelaunch$/, /^\/__stealth$/, /^\/raise(\/|$)/];
 
 // PRELAUNCH_PASSWORD is primary; STEALTH_PASSWORD is the deprecated alias. This
 // is the ONE read site for either, which is what makes honouring both a single
@@ -198,10 +201,8 @@ body{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px;
   background:#edecee;color:#17181a}
 @media(prefers-color-scheme:dark){body{background:#000000;color:#ffffff}}
 .box{width:min(380px,100%);text-align:center}
-.dots{display:flex;gap:10px;justify-content:center;margin-bottom:22px}
-.dots i{display:block;border-radius:50%;background:#fb9569}
-.dots i:first-child{width:38px;height:38px}
-.dots i:last-child{width:28px;height:28px;background:#c9512c;align-self:flex-end}
+.mark{display:block;width:48px;height:48px;margin:0 auto 22px}
+@media(prefers-color-scheme:dark){.mark .mr{stroke:#e2e1e4}.mark .mp{fill:#e2e1e4}}
 h1{font-size:20px;font-weight:700;margin:0 0 6px}
 p{margin:0 0 20px;opacity:.72;font-size:14px}
 form{display:flex;gap:8px}
@@ -215,7 +216,7 @@ button{padding:11px 20px;border:0;border-radius:999px;background:#fb9569;color:#
 .err{margin:14px 0 0;color:#b3261e;font-size:13.5px}
 @media(prefers-color-scheme:dark){.err{color:#ffb4a8}}
 </style></head><body><div class="box">
-<div class="dots"><i></i><i></i></div>
+<svg class="mark" viewBox="0 0 200 200" aria-hidden="true"><path class="mr" d="M137 31 A78 78 0 1 0 170 66" fill="none" stroke="#17181a" stroke-width="15" stroke-linecap="round"/><circle class="mp" cx="100" cy="100" r="55" fill="#17181a"/><circle cx="156" cy="46" r="12" fill="#fb9569"/></svg>
 <h1>${name}</h1>
 <p>Not open to the world yet. Enter the password to have a look.</p>
 <form method="POST" action="${SUBMIT_PATH}">

package/src/bongos/route-rank-check.js

@@ -56,7 +56,7 @@ const SPECIALTY = 'deterministic: every src/bongos/routes/ route must classify t
 // here; a second list is a list that drifts.
 //
 // READ AS DATA, NOT require()d. ADR 0083's one-way rule forbids core from importing a
-// MODULE's code (scripts/gds/fitness.js enforces it on require edges) and this file is
+// MODULE's code (scripts/bongos/fitness.js enforces it on require edges) and this file is
 // core, so we parse the catalog's `floor:` declarations out of its SOURCE — the same
 // technique this file already applies to modules/*/routes/*.js, and the posture the
 // sibling trust primitive permission-path-check.js takes with
@@ -779,7 +779,7 @@ const PATH_LOOKAHEAD = 5;
 // it. Canonicalising at the scanner fixes all of them in one place; doing it per-consumer
 // is how the contract and the gate list drift apart.
 //
-// The CONSTRAINT ITSELF still matters to one reader: scripts/gds/route-shadow-guard.js
+// The CONSTRAINT ITSELF still matters to one reader: scripts/bongos/route-shadow-guard.js
 // reads raw source with its own regex, precisely because a constrained param is the thing
 // that makes a route safe to mount before a literal. That guard must keep seeing it.
 const PARAM_CONSTRAINT_RE = /:([A-Za-z0-9_]+)\([^)]*\)/g;

package/src/bongos/routes/auth.js

@@ -645,6 +645,9 @@ module.exports = function buildAuthRouter() {
       if (err && err.code === 'NOT_APPROVED') {
         return res.status(403).json({ state: 'not_approved', error: 'not_approved' });
       }
+      if (err && err.code === 'BUILDER_INACTIVE') {
+        return res.status(403).json({ state: 'builder_inactive', error: 'builder_inactive' });
+      }
       log.error('[gds] device/poll', err);
       // 424 for the same reason as device/start above (finding W2, task 1003052):
       // this catch proxies GitHub's poll refusals too, and a 5xx body never
@@ -1011,6 +1014,16 @@ module.exports = function buildAuthRouter() {
           },
         ));
       }
+      if (err && err.code === 'BUILDER_INACTIVE') {
+        return res.status(403).type('text/html').send(renderAuthErrorPage(
+          'This account has been switched off',
+          `The GitHub account ${err.login ? `“${err.login}” ` : ''}belongs to a builder whose account has been switched off, so it can no longer sign in. If that is a mistake, ask the ${admitterLabel()} to switch it back on. To use a different GitHub account, sign in again and choose it.`,
+          {
+            subtitle: 'A switched-off account cannot sign in.',
+            cta: { href: '/builders', label: 'Go to the hall' },
+          },
+        ));
+      }
       log.error('[gds] web/callback', err);
       res.status(500).type('text/html').send(renderAuthErrorPage(
         'The handshake threw an error',
@@ -1308,8 +1321,8 @@ module.exports = function buildAuthRouter() {
         api_base: issuer || null,
         // A VERB, never a path (task 1003961). This string is composed HERE and run
         // THERE — on an instance, where the core is an installed dependency and
-        // `scripts/gds/` does not exist, so the previous
-        // `node scripts/gds/paste-token.js <token>` named a file the builder did not
+        // `scripts/bongos/` does not exist, so the previous
+        // `node scripts/bongos/paste-token.js <token>` named a file the builder did not
         // have and the copy button handed out a command that could not run. The verb
         // is run through `npx` (task 1004575): a builder's clone does not put bare
         // `bongos` on PATH, and `npx bongos` resolves the project's own bin there.

package/src/bongos/routes/backup.js

@@ -40,7 +40,7 @@ const DB_NAME = resolveEnv('BACKUP_DB')
   || (() => { try { return branding().db && branding().db.database; } catch { return null; } })()
   || 'gds';
 const BACKUP_SCRIPT = resolveEnv('BACKUP_SCRIPT')
-  || path.join(REPO_ROOT, 'scripts', 'gds', 'db-backup-nightly.sh');
+  || path.join(REPO_ROOT, 'scripts', 'bongos', 'db-backup-nightly.sh');
 
 // In-memory guard: true while a trigger-initiated dump is running.
 let triggerRunning = false;