@bongos/core 1.21.174 → 1.21.176

package/tests/government_protected_surfaces.mjs

@@ -47,20 +47,21 @@ const EXPECTED_GLOBS_BEFORE_R101 = [
   'modules/grading/grader.js',
   'modules/grading/grader-workers/',
   'modules/grading/grader-rubric.json',
-  'scripts/gds/ship.js',
-  'scripts/gds/confirm.js',
-  'scripts/gds/merge-mode.js',
-  'scripts/gds/ci-grade.js',
-  'scripts/gds/grade-smoke.js',
-  'scripts/gds/conductor-dispatch.js',
-  'scripts/gds/main-audit.js',
-  'scripts/gds/push-main.js',
-  'scripts/gds/run-unit-tests.js',
-  'scripts/gds/gate-review.js',
-  'scripts/gds/setup.js',
-  'scripts/gds/install-git-hooks.js',
-  'scripts/gds/hooks/',
-  'scripts/gds/cli-lib.js',
+  'scripts/bongos/ship.js',
+  'scripts/bongos/confirm.js',
+  'scripts/bongos/merge-mode.js',
+  'scripts/bongos/ci-grade.js',
+  'scripts/bongos/grade-smoke.js',
+  'scripts/bongos/conductor-dispatch.js',
+  'scripts/bongos/main-audit.js',
+  'scripts/bongos/push-main.js',
+  'scripts/bongos/run-unit-tests.js',
+  'scripts/bongos/gate-review.js',
+  'scripts/bongos/setup.js',
+  'scripts/bongos/install-git-hooks.js',
+  'scripts/bongos/hooks/',
+  'scripts/gds/', // task 1004848: the @bongos-forwarder files still run on boxes
+  'scripts/bongos/cli-lib.js',
   'scripts/migrate.sh',
   'scripts/deploy/',
   'modules/lifecycle/merge-lock.js',
@@ -131,53 +132,53 @@ const ADDED_SINCE_R101 = [
   // closure.js names eight, so the audit's prose was already stale against shipped code.
   // The drift tripwire below is what keeps this list honest from here.
   {
-    after: 'scripts/gds/cli-lib.js',
-    glob: 'scripts/gds/git-merge-regen.js',
+    after: 'scripts/bongos/cli-lib.js',
+    glob: 'scripts/bongos/git-merge-regen.js',
     why: 'the otb-regen MERGE DRIVER. Registered as a relative command with cwd at the '
        + 'clone root, so git merge runs the BRANCH copy with the live server environment '
        + 'BEFORE any post-merge step — the earliest execution vector, and the one the '
        + "audit's \"after the merge\" framing missed.",
   },
   {
-    after: 'scripts/gds/git-merge-regen.js',
-    glob: 'scripts/gds/gen-repo-map.js',
+    after: 'scripts/bongos/git-merge-regen.js',
+    glob: 'scripts/bongos/gen-repo-map.js',
     why: 'a post-merge generator the resolver runs as execFile(node, [<clone>/...]) — the '
        + "branch's own copy, inheriting DATABASE_URL and BUILDER_SECRET_KEY.",
   },
   {
-    after: 'scripts/gds/gen-repo-map.js',
-    glob: 'scripts/gds/gen-file-map.js',
+    after: 'scripts/bongos/gen-repo-map.js',
+    glob: 'scripts/bongos/gen-file-map.js',
     why: 'a post-merge generator the resolver executes out of the clone, on the same path '
        + 'as gen-repo-map.js.',
   },
   {
-    after: 'scripts/gds/gen-file-map.js',
-    glob: 'scripts/gds/gen-session-index.js',
+    after: 'scripts/bongos/gen-file-map.js',
+    glob: 'scripts/bongos/gen-session-index.js',
     why: 'a post-merge generator the resolver executes out of the clone, on the same path '
        + 'as gen-repo-map.js.',
   },
   {
-    after: 'scripts/gds/gen-session-index.js',
-    glob: 'scripts/gds/copy-inventory.js',
+    after: 'scripts/bongos/gen-session-index.js',
+    glob: 'scripts/bongos/copy-inventory.js',
     why: 'a post-merge generator the resolver executes out of the clone. NOT one of the '
        + "audit's \"gen-* trio\" — it is the first of the four roots that prose omitted, "
        + 'which is why this registry is pinned to the closure rather than to the audit.',
   },
   {
-    after: 'scripts/gds/copy-inventory.js',
-    glob: 'scripts/gds/gen-api-docs.js',
+    after: 'scripts/bongos/copy-inventory.js',
+    glob: 'scripts/bongos/gen-api-docs.js',
     why: 'a post-merge generator the resolver executes out of the clone, and the widest '
        + 'one: it require()s src/bongos/route-rank-check, api-prefix and routes/_helpers, '
-       + 'which is why a restore scoped to scripts/gds/ was never sufficient.',
+       + 'which is why a restore scoped to scripts/bongos/ was never sufficient.',
   },
   {
-    after: 'scripts/gds/gen-api-docs.js',
-    glob: 'scripts/gds/gen-api-client.js',
+    after: 'scripts/bongos/gen-api-docs.js',
+    glob: 'scripts/bongos/gen-api-client.js',
     why: 'a post-merge generator the resolver executes out of the clone, inheriting the '
        + 'live server environment like its siblings.',
   },
   {
-    after: 'scripts/gds/gen-api-client.js',
+    after: 'scripts/bongos/gen-api-client.js',
     glob: '.gitattributes',
     why: 'never require()d, so it is not code — but it NAMES which paths git hands the '
        + 'otb-regen driver, so editing it changes how much of the tree that driver '
@@ -192,22 +193,22 @@ const ADDED_SINCE_R101 = [
   // cf-tunnel.js — were deleted with it in task 1003893, entries and all.)
   {
     after: 'modules/dev-box/box-credential.js',
-    glob: 'scripts/gds/provision-config.js',
+    glob: 'scripts/bongos/provision-config.js',
     why: 'reads process.env.DO_API_TOKEN. The DigitalOcean credential for instance '
        + 'provisioning, previously unprotected at any rank while the files deciding WHO '
        + 'may provision were protected at Metic.',
   },
   {
-    after: 'scripts/gds/provision-config.js',
-    glob: 'scripts/gds/provision-net.js',
+    after: 'scripts/bongos/provision-config.js',
+    glob: 'scripts/bongos/provision-net.js',
     why: 'reads process.env.CLOUDFLARE_API_TOKEN in checkDnsTokenScope. The filing task '
-       + 'placed this code in scripts/gds/provision.js, which by the time of the claim '
+       + 'placed this code in scripts/bongos/provision.js, which by the time of the claim '
        + 'read no credential at all — registering the file the prose named would have '
        + 'recorded the gap as closed while closing nothing.',
   },
   {
-    after: 'scripts/gds/provision-net.js',
-    glob: 'scripts/gds/do-api.js',
+    after: 'scripts/bongos/provision-net.js',
+    glob: 'scripts/bongos/do-api.js',
     why: 'the DigitalOcean API client the token is handed TO. It reads no process.env '
        + 'value — the token arrives as a parameter and the constructor throws when a live '
        + 'call has none — so the tripwire below does not demand it and its absence from '
@@ -264,7 +265,7 @@ const ADDED_SINCE_R101 = [
     'grader-prompt', 'grader-score', 'grader-subagent'],
     'the grader.js carve: the deterministic permission-path pre-pass and the server-side '
     + 'score guards a model cannot talk past.'),
-  ...carve('scripts/gds/ship.js', ['ship-check', 'ship-deploy-target', 'ship-escalation',
+  ...carve('scripts/bongos/ship.js', ['ship-check', 'ship-deploy-target', 'ship-escalation',
     'ship-finish', 'ship-flow', 'ship-git', 'ship-grade-steps', 'ship-grade', 'ship-honesty',
     'ship-io', 'ship-land', 'ship-memory-sync', 'ship-merge-gate', 'ship-merge', 'ship-mode-ask',
     'ship-preflight-steps', 'ship-regen', 'ship-resume', 'ship-session-upload', 'ship-state',
@@ -298,8 +299,8 @@ const ADDED_SINCE_R101 = [
   // task 1004631: a ship.js sibling added after the carve — registered so the carve
   // tripwire below stays green and the file sits at ship.js's floor.
   {
-    after: 'scripts/gds/ship-merge.js',
-    glob: 'scripts/gds/ship-mode-manual.js',
+    after: 'scripts/bongos/ship-merge.js',
+    glob: 'scripts/bongos/ship-mode-manual.js',
     why: 'split out of the protected ship.js: the ship-mode step every ship runs '
        + 'before it lands, so an edit here could change how work reaches main.',
   },
@@ -492,9 +493,9 @@ test('no protected glob uses a wildcard — the goal scope wall could not read i
 });
 
 test('stemSiblings finds a split-out file and nothing that merely resembles one', () => {
-  const tree = ['scripts/gds/ship.js', 'scripts/gds/ship-land.js', 'scripts/gds/shipper.js',
-    'scripts/gds/ship_x.js', 'scripts/gds/sub/ship-x.js', 'scripts/gds/ship-notes.md', 'src/ship-y.js'];
-  assert.deepEqual(stemSiblings('scripts/gds/ship.js', tree), ['scripts/gds/ship-land.js']);
+  const tree = ['scripts/bongos/ship.js', 'scripts/bongos/ship-land.js', 'scripts/bongos/shipper.js',
+    'scripts/bongos/ship_x.js', 'scripts/bongos/sub/ship-x.js', 'scripts/bongos/ship-notes.md', 'src/ship-y.js'];
+  assert.deepEqual(stemSiblings('scripts/bongos/ship.js', tree), ['scripts/bongos/ship-land.js']);
 });
 
 test('every file split out of a protected file is itself protected (1004024 carve tripwire)', () => {
@@ -526,7 +527,7 @@ test('every file split out of a protected file is itself protected (1004024 carv
 // that HOLDS the DigitalOcean / Cloudflare credentials those decisions spend.
 //
 // WHY THIS IS COMPUTED AND NOT LISTED. The task offered two options, both resting on a
-// named file: "scripts/gds/provision.js is the sole holder of the DO and CF tokens". By
+// named file: "scripts/bongos/provision.js is the sole holder of the DO and CF tokens". By
 // the time it was claimed that sentence was false in both halves — provision.js reads
 // NEITHER token (the code moved), and the readers are spread across five files. Taking the
 // prose at its word would have registered a file holding no credential and recorded the
@@ -659,7 +660,7 @@ test('every credential reader in the tree is a protected surface (1002891 tripwi
 // ---------- the hard-floor subset: gate-review's second list may narrow, never diverge ----------
 //
 // task 1002875, from idea 1000620 (raised as a major by the BV1.R101 ship grader).
-// scripts/gds/gate-review.js keeps its own HARD_FLOOR_GLOBS — the rank-INDEPENDENT
+// scripts/bongos/gate-review.js keeps its own HARD_FLOOR_GLOBS — the rank-INDEPENDENT
 // escalate-to-owner set — and the comment above it declares the array to be "A subset of
 // PROTECTED_GLOBS". That was a checkable invariant stated in prose and enforced by nothing.
 //
@@ -676,7 +677,7 @@ test('every credential reader in the tree is a protected surface (1002891 tripwi
 // computes or filters the list cannot leave the visible source saying one thing while the
 // gate enforces another.
 function hardFloorGlobsFromSource() {
-  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'), 'utf8');
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'gate-review.js'), 'utf8');
   const block = src.match(/const HARD_FLOOR_GLOBS = \[([\s\S]*?)\n\];/);
   assert.ok(block, 'could not find the HARD_FLOOR_GLOBS array literal in gate-review.js — '
     + 'if it was renamed or restructured, this test must be taught the new shape rather '
@@ -691,7 +692,7 @@ test('every hard-floor glob is a protected surface (1002875 subset tripwire)', (
     + 'and the array has held about two dozen since it was written. A parse that returns '
     + 'few or none passes the subset check vacuously.');
 
-  const gr = require(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'));
+  const gr = require(path.join(ROOT, 'scripts', 'bongos', 'gate-review.js'));
   assert.deepEqual(fromSource, gr.HARD_FLOOR_GLOBS,
     'the HARD_FLOOR_GLOBS literal in gate-review.js no longer matches the array the module '
     + 'exports and compiles into its matcher. The source and the enforced list must be the '
@@ -700,7 +701,7 @@ test('every hard-floor glob is a protected surface (1002875 subset tripwire)', (
   const registry = new Set(ppc.PROTECTED_GLOBS);
   for (const glob of gr.HARD_FLOOR_GLOBS) {
     assert.ok(registry.has(glob),
-      `'${glob}' is a HARD FLOOR surface in scripts/gds/gate-review.js — CI escalates any `
+      `'${glob}' is a HARD FLOOR surface in scripts/bongos/gate-review.js — CI escalates any `
       + 'edit to it to the owner regardless of rank — but it is not in '
       + 'modules/government/protected-surfaces.json, so no rank floor covers it at all. '
       + 'The hard floor is declared to be a SUBSET of the protected set: it may be '
@@ -721,7 +722,7 @@ test('registering the credential readers widened no module wall', () => {
   const protectedNow = map.protectedModules();
   assert.ok(!protectedNow.includes('provisioning'),
     'the provisioning module derived protected:true — a credential-reader entry reached '
-    + 'modules/provisioning/ or scripts/gds/provision.js, which walls goals 1000032, '
+    + 'modules/provisioning/ or scripts/bongos/provision.js, which walls goals 1000032, '
     + '1000046 and 1000059 behind an Archon join. Keep the entries file-level.');
   // Since task 1003892 the readers are owned by their own control-plane scope, which
   // is protected BY them — that is where the wall belongs, not on provisioning.
@@ -877,7 +878,7 @@ test('registering the switchboard widened no module wall', () => {
   //
   // `agents` is the module to watch, and the ONLY one this test can honestly cite.
   // `autonomy` — which owns .claude/scheduled-tasks/, the routine bodies — was ALREADY
-  // protected before this entry, through scripts/gds/conductor-dispatch.js in group
+  // protected before this entry, through scripts/bongos/conductor-dispatch.js in group
   // 'pipeline' (verified glob by glob: none of its other five globs is protected). So its
   // flag is not evidence either way here, and asserting it unprotected would have been a
   // test that fails for a reason unrelated to what it claims to check.
@@ -914,7 +915,7 @@ test('registering the switchboard widened no module wall', () => {
     '.claude/agents/ became protected — task 1002492 considered and rejected that, and '
     + 'task 1004006 walled the module SOURCE without reopening it. An agent definition '
     + 'is scoped by validate.js, not by a rank floor on the file.');
-  assert.ok(ppc.surfaceFor('scripts/gds/conductor-dispatch.js'),
+  assert.ok(ppc.surfaceFor('scripts/bongos/conductor-dispatch.js'),
     'the autonomy module was protected through conductor-dispatch.js before this entry. '
     + 'If that glob is gone, re-derive which modules this registry walls before trusting '
     + 'the assertion above.');
@@ -941,7 +942,7 @@ test('a floor raise flows through to the enforcers, not just the registry', () =
   // checkPermissionPaths, the authoritative post-push audit through its per-hit
   // comparison (task 1003191 — it used to test the global minimum and silently
   // downgraded every raise).
-  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'main-audit.js'), 'utf8');
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'main-audit.js'), 'utf8');
   assert.ok(!/\bppc\.isBelowFloor\s*\(/.test(src),
     'main-audit.js must not decide floors with isBelowFloor — that tests the registry '
     + 'GLOBAL MINIMUM, so a governance floor raise is silently downgraded in the one '
@@ -1290,7 +1291,7 @@ test('compileGlobMatcher folds BOTH sides', () => {
 });
 
 test('gate-review classifies a CASE-VARIANT gate surface as hard-floor', () => {
-  const gr = require(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'));
+  const gr = require(path.join(ROOT, 'scripts', 'bongos', 'gate-review.js'));
   const literal = gr.HARD_FLOOR_GLOBS.find((g) => !g.includes('*') && !g.endsWith('/'));
   assert.ok(literal, 'no literal hard-floor glob — this test is reading the wrong shape');
   assert.ok(gr.matchesHardFloor(literal), 'the exact spelling must escalate (sanity)');
@@ -1306,7 +1307,7 @@ test('no consumer compiles a PROTECTED glob list byte-exact', () => {
   // legitimately need it: folding publish-manifest's PUBLISH_ALLOWLIST would widen
   // what reaches the public OSS mirror, i.e. publish MORE. So the ban is narrow —
   // pairing a PROTECTED list with the raw compiler in one file.
-  const dir = path.join(ROOT, 'scripts', 'gds');
+  const dir = path.join(ROOT, 'scripts', 'bongos');
   const files = fs.readdirSync(dir).filter((f) => f.endsWith('.js'));
   assert.ok(files.length > 20, `only ${files.length} scripts scanned — the sweep is not reading the CLI directory`);
   const offenders = [];

package/tests/government_require_permission.mjs

@@ -27,7 +27,7 @@ const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 // The same stripper the category guard scans with, rather than a second copy: both
 // checks are answering "which text here is executable", and two answers in one tree
 // is how one of them quietly stops agreeing with the other (task 1003832).
-const { stripComments } = require(path.join(ROOT, 'scripts', 'gds', 'category-advisory-guard.js'));
+const { stripComments } = require(path.join(ROOT, 'scripts', 'bongos', 'category-advisory-guard.js'));
 
 // Minimal res double capturing status + body, with res.fail() installed exactly
 // as the router installs it (mirrors tests/rank_gate.mjs).
@@ -416,6 +416,14 @@ test('every modules/*/routes gate is migrated, bar the one documented holdout',
     // construction: blocker 1000126 carries the audience question to the owner,
     // and spike 1002786 R3 mints the atom that removes this entry.
     'platform-identity/routes/scouting.js',
+    // Still requireRank after BV1.R105 — and at the BOTTOM of the ladder, which is the
+    // point. `POST /raise/edit` (task 1004847) is open to any active builder by the
+    // owner's decision of 2026-10-25, so its gate is requireRank(EDIT_MIN_RANK='xenos'):
+    // "signed in, active, and on the ladder". No permission atom means that — every
+    // atom names a specific authority, and borrowing one would make this page's edit
+    // door move whenever an unrelated grant does. If the owner later narrows who may
+    // edit, that is the moment to mint an atom and remove this entry (task 1004852).
+    'raise/routes/raise.js',
   ].sort();
 
   const modulesDir = path.join(ROOT, 'modules');

package/tests/government_vanilla_boot.mjs

@@ -41,7 +41,7 @@ const GOV = path.join(ROOT, 'modules', 'government');
 const catalog = require(path.join(GOV, 'catalog.js'));
 const { loadGovernmentConfig, resolveGovernmentConfig, NEUTRAL_PATH, INSTANCE_PATH } = require(path.join(GOV, 'config.js'));
 const { effectivePermissions, resolveBuilderPermissions } = require(path.join(GOV, 'resolver.js'));
-const fitness = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
+const fitness = require(path.join(ROOT, 'scripts', 'bongos', 'fitness.js'));
 const { envPrefix } = require(path.join(ROOT, 'src', 'instance-config'));
 
 // Every precedence test injects exactly the env it asserts on — an ambient

package/tests/government_vocabulary.mjs

@@ -2,7 +2,7 @@
 // (goal 1000068 R07, task 1003008).
 //
 // The rule under test says: "role" means a CRAFT — Artist, Ideator, or Builder —
-// and never a rank. `scripts/gds/fitness.js` checkVocabularyWall enforces it on
+// and never a rank. `scripts/bongos/fitness.js` checkVocabularyWall enforces it on
 // the government surface, in the CI `unit` check.
 //
 // WHY THIS FILE EXISTS AT ALL. A naming rule is the easiest kind of check to
@@ -18,7 +18,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const fitness = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
+const fitness = require(path.join(ROOT, 'scripts', 'bongos', 'fitness.js'));
 
 // ---------- the wall holds on the real tree ----------
 

package/tests/government_walk.mjs

@@ -1,7 +1,7 @@
 // tests/government_walk.mjs — the government walk stays true (task 1004658, goal
 // 1000111, criterion gov-proven-and-kept-proven).
 //
-// scripts/gds/government-walk.js walks a throwaway project's whole government —
+// scripts/bongos/government-walk.js walks a throwaway project's whole government —
 // genesis, every form, every building's act-alone gate, every matter action — and
 // writes the pass/fail table to docs/governance/government-walk.md. This runs the
 // walk again in its own process (it points the instance root at a temp folder and
@@ -25,7 +25,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const SCRIPT = path.join(ROOT, 'scripts', 'gds', 'government-walk.js');
+const SCRIPT = path.join(ROOT, 'scripts', 'bongos', 'government-walk.js');
 const walk = require(SCRIPT);
 const dr = require(path.join(ROOT, 'modules', 'government', 'decision-rules.js'));
 const decisionBoard = require(path.join(ROOT, 'modules', 'government', 'decision-board.js'));

package/tests/grade_body_limit.mjs

@@ -18,6 +18,7 @@
 
 import test from 'node:test';
 import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -74,7 +75,7 @@ test('a realistic mass-change body fits the new limit', () => {
   // The shape that broke it: one path per changed file, plus the panel's findings. 1,141
   // paths measured ~38 KB of JSON on their own — comfortably over 64 KB once the grade
   // output is added, and comfortably under 1 MB.
-  const files = Array.from({ length: 1200 }, (_, i) => `scripts/gds/some-fairly-long-script-name-${i}.js`);
+  const files = Array.from({ length: 1200 }, (_, i) => `scripts/bongos/some-fairly-long-script-name-${i}.js`);
   const body = JSON.stringify({
     committed_files: files,
     subagent_output: { functional_fidelity: 9, code_quality: 9, notes: 'x'.repeat(20_000) },
@@ -109,7 +110,7 @@ test('computeRawDiffHash does not collapse an uncapturable diff to hash("")', ()
   // diff. shouldReuseGrade compares that hash to the stored grade's, so two different large
   // diffs on one task collided and a stale PASS could be reused on changed code, skipping
   // the panel entirely.
-  const src = read('scripts/gds/ship-grade.js');
+  const src = read('scripts/bongos/ship-grade.js');
 
   const fn = src.slice(src.indexOf('function computeRawDiffHash'), src.indexOf('function shouldReuseGrade'));
   assert.ok(fn.length > 0, 'computeRawDiffHash is gone');
@@ -128,7 +129,7 @@ test('computeRawDiffHash does not collapse an uncapturable diff to hash("")', ()
 test('both diff captures use one shared size, not two drifting numbers', () => {
   // The two call sites are the same decision; a second literal is how one gets fixed and
   // the other does not — which is exactly what happened here.
-  const src = read('scripts/gds/ship-grade.js');
+  const src = read('scripts/bongos/ship-grade.js');
   assert.match(src, /const DIFF_CAPTURE_MAX_BYTES = /, 'the capture size must be named once');
   const uses = (src.match(/maxBuffer: DIFF_CAPTURE_MAX_BYTES/g) || []).length;
   assert.equal(uses, 2, `both diff captures must share the constant, saw ${uses}`);
@@ -144,7 +145,8 @@ test('the grade endpoint keeps its full generated description', () => {
   //
   // Pinned on LENGTH rather than exact prose so ordinary edits to the comment do not red
   // this, while the collapse (which is an order-of-magnitude drop) still does.
-  const spec = JSON.parse(read('docs/api/openapi.json'));
+  // The spec is gitignored (task 1004866): build it from the routes.
+  const spec = createRequire(import.meta.url)('../scripts/bongos/gen-api-docs.js').build().spec;
   const desc = spec.paths['/tasks/{id}/grade']?.post?.description || '';
   assert.ok(desc.length > 400,
     `the grade endpoint's generated description collapsed to ${desc.length} chars — `

package/tests/grade_correlation_audit.mjs

@@ -19,7 +19,7 @@ import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
-const A = require('../scripts/gds/grade-correlation-audit.js');
+const A = require('../scripts/bongos/grade-correlation-audit.js');
 const ROOT = fileURLToPath(new URL('..', import.meta.url));
 
 const close = (a, b, eps = 1e-9) => assert.ok(Math.abs(a - b) < eps, `${a} != ${b}`);
@@ -147,10 +147,10 @@ test('the CLI reports a saved dataset — refusals by name, and --json — with
   const file = path.join(dir, 'dataset.json');
   fs.writeFileSync(file, JSON.stringify({ grades: [row(1), row(2, { quality: 'fail' })], overrides: [] }));
   try {
-    const text = execFileSync(process.execPath, ['scripts/gds/grade-correlation-audit.js', '--file', file], { cwd: ROOT, encoding: 'utf8' });
+    const text = execFileSync(process.execPath, ['scripts/bongos/grade-correlation-audit.js', '--file', file], { cwd: ROOT, encoding: 'utf8' });
     assert.match(text, /2 recorded panel round\(s\) over 2 task\(s\), minimum n = 30/);
     assert.match(text, /narc × quality\s+REFUSED — n=2 is below the minimum of 30/);
-    const json = JSON.parse(execFileSync(process.execPath, ['scripts/gds/grade-correlation-audit.js', '--file', file, '--json'], { cwd: ROOT, encoding: 'utf8' }));
+    const json = JSON.parse(execFileSync(process.execPath, ['scripts/bongos/grade-correlation-audit.js', '--file', file, '--json'], { cwd: ROOT, encoding: 'utf8' }));
     assert.equal(json.panels, 2);
     assert.equal(json.pairwise.length, 6);
   } finally {

package/tests/grade_diff_hash.mjs

@@ -16,7 +16,7 @@ import { createRequire } from 'node:module';
 import { makeSqlAwareClient } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
-const { diffHash, shouldReuseGrade, reconstructPanelIssues } = require('../scripts/gds/ship.js');
+const { diffHash, shouldReuseGrade, reconstructPanelIssues } = require('../scripts/bongos/ship.js');
 const db = require('../modules/lifecycle/db.js');
 // applyGrade resolves the 'reward' kernel port; register it so calls in the
 // passed=true path don't blow up on null (mirrors grade_attribution.mjs).

package/tests/grade_engine_replay.mjs

@@ -2,7 +2,7 @@
 // (task 1002839, ADR 0089 §1).
 //
 // The corpus (tests/fixtures/grade-replay/recorded-panel-grades.json) is real:
-// production grade rows pulled by `scripts/gds/grade-replay.js --live
+// production grade rows pulled by `scripts/bongos/grade-replay.js --live
 // --write-fixture`, one per panel shape, with review prose hashed. Each row
 // carries the judges' persisted verdicts and the decision the server stored.
 // Replaying the verdicts through the grade engine's aggregate + gate stages must
@@ -21,7 +21,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const grader = require('../modules/grading/grader.js');
-const replay = require('../scripts/gds/grade-replay.js');
+const replay = require('../scripts/bongos/grade-replay.js');
 const { grades: corpus } = require('./fixtures/grade-replay/recorded-panel-grades.json');
 
 const clone = (v) => JSON.parse(JSON.stringify(v));

package/tests/grade_server_authoritative.mjs

@@ -6,7 +6,7 @@
 // THE FINDING: validateAndScore only shape-validates the submitted numbers —
 // `passed` is computed from the CLIENT's values. The real adversarial panel + the
 // deterministic route-rank / permission-path pre-passes run CLIENT-SIDE in
-// scripts/gds/ship.js; the server never re-runs them. So a builder could POST
+// scripts/bongos/ship.js; the server never re-runs them. So a builder could POST
 // {functional_fidelity:10, code_quality:10, confidence:1, issues:[]} to self-pass,
 // and forged signals.diff_stats / committed_files could mint the net-negative
 // "Subtractor" bonus + shipper badges (SR-18).

package/tests/grade_unavailable_display.mjs

@@ -12,7 +12,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const ship = require('../scripts/gds/ship.js');
+const ship = require('../scripts/bongos/ship.js');
 const grader = require('../modules/grading/grader.js');
 const { formatGradeOutcome } = ship;
 

package/tests/grader.mjs

@@ -6,7 +6,7 @@
 //
 // The v2 subagent itself is a real-network call, so the tests stop at the
 // validator + prompt-builder boundary; the network-touching end-to-end check
-// lives in scripts/gds/grade-smoke.js and is run manually.
+// lives in scripts/bongos/grade-smoke.js and is run manually.
 //
 // Run:  node tests/grader.mjs
 
@@ -815,20 +815,20 @@ test('buildContextBundle REFUSES a truncated prefix that shows none of the chang
   const head = '// preamble\n'.repeat(2_000);            // ~24k chars, all before the change
   const big = `${head}function formatPublishFailure(data, status, branch) {\n  return 'x';\n}\n`;
   const diff = [
-    'diff --git a/scripts/gds/ship.js b/scripts/gds/ship.js',
-    '--- a/scripts/gds/ship.js',
-    '+++ b/scripts/gds/ship.js',
+    'diff --git a/scripts/bongos/ship.js b/scripts/bongos/ship.js',
+    '--- a/scripts/bongos/ship.js',
+    '+++ b/scripts/bongos/ship.js',
     '@@ -1226,0 +1226,3 @@',
     '+function formatPublishFailure(data, status, branch) {',
     "+  return 'x';",
     '+}',
   ].join('\n');
   const bundle = grader.buildContextBundle({
-    changedFiles: ['scripts/gds/ship.js'], cwd: '/r', diff,
+    changedFiles: ['scripts/bongos/ship.js'], cwd: '/r', diff,
     fsImpl: { lstatSync: () => plainFileStat, readFileSync: () => big },
   });
   assert.deepEqual(bundle.files, [], 'a prefix with none of the change is not bundled');
-  assert.deepEqual(bundle.skipped, ['scripts/gds/ship.js'], 'it lands in skipped, where the prompt tells the worker to Read it');
+  assert.deepEqual(bundle.skipped, ['scripts/bongos/ship.js'], 'it lands in skipped, where the prompt tells the worker to Read it');
 });
 
 test('buildContextBundle still bundles a truncated file when the change IS visible in the prefix (task 1002905)', () => {
@@ -1656,7 +1656,7 @@ await testAsync('v4 runWorker (#465): one retry only — if the retry also error
   assert.equal(r.error, 'SUBAGENT_NONZERO_EXIT');
 });
 
-// --- #467: per-worker timeouts + transient-error set + audit-exports core ---
+// --- #467: per-worker timeouts + transient-error set ---
 
 test('v4 #467 / task 1002580: every gating/advisory worker gets the 360s heavy-tier budget', () => {
   // task 1002580: Hacker/Efficiency were 240s on the (false) assumption they are
@@ -1689,22 +1689,6 @@ test('v4 #465/#467: TRANSIENT_WORKER_ERRORS covers infra noise but NOT timeout',
   assert.ok(!t.has('PROMPT_TOO_LONG'), 'a window overflow is deterministic, never retried (task 1003318)');
 });
 
-test('v4 #467: audit-exports classifyExports — consumed / test-only / DEAD', () => {
-  const auditExports = require('../scripts/gds/audit-exports.js');
-  const target = '/repo/src/bongos/grader.js';
-  const corpus = {
-    [target]: 'function usedSym(){} function testSym(){} function deadSym(){}', // self — excluded
-    '/repo/src/server.js': 'grader.usedSym()',          // consumer in src/
-    '/repo/tests/grader.mjs': 'grader.testSym === 1',   // consumer only in tests/
-    // deadSym appears nowhere outside the defining file
-  };
-  const out = auditExports.classifyExports(target, ['usedSym', 'testSym', 'deadSym'], corpus);
-  const by = Object.fromEntries(out.map((r) => [r.name, r.status]));
-  assert.equal(by.usedSym, 'consumed');
-  assert.equal(by.testSym, 'test-only');
-  assert.equal(by.deadSym, 'DEAD');
-});
-
 test('v4 WORKERS.resolvePanel: unknown kind throws (typo catches don\'t silently skip)', () => {
   assert.throws(() => grader.WORKERS.resolvePanel(['narc', 'nopenotreal']), /unknown worker kind/i);
 });
@@ -2135,7 +2119,7 @@ test('isTrivialDiff: a logic-path file (src/) → false even when small', () =>
 test('isTrivialDiff: scripts/ and tests/ are logic paths → false', () => {
   assert.equal(
     grader.isTrivialDiff({
-      changedFiles: ['scripts/gds/smoke-write.sh'],
+      changedFiles: ['scripts/bongos/smoke-write.sh'],
       diffStats: { files_changed: 1, lines_added: 2, lines_removed: 1 },
     }),
     false

package/tests/grader_generated_provenance.mjs

@@ -120,13 +120,13 @@ test('the session-log ship shape implicates gen-session-index.js, and every othe
   ]);
 });
 
-test('a docs-only regeneration implicates gen-api-docs.js for each doc it owns that changed', () => {
-  const g = prov.generatorsInDiff(['docs/api/openapi.json', 'docs/api-reference.md']);
+test('a docs-only regeneration implicates gen-api-docs.js for the doc it owns', () => {
+  const g = prov.generatorsInDiff(['docs/routes-permissions.md']);
   assert.equal(g.length, 1);
   assert.equal(g[0].script, 'gen-api-docs.js');
-  assert.deepEqual(g[0].owned.map((o) => o.file).sort(), ['docs/api-reference.md', 'docs/api/openapi.json']);
-  // routes-permissions.md did NOT change, so it is not claimed.
-  assert.ok(!g[0].owned.some((o) => o.file === 'docs/routes-permissions.md'));
+  assert.deepEqual(g[0].owned.map((o) => o.file), ['docs/routes-permissions.md']);
+  // task 1004866: the gitignored spec + reference are claimed by nobody (never in a diff).
+  assert.deepEqual(prov.generatorsInDiff(['docs/api/openapi.json', 'docs/api-reference.md']), []);
 });
 
 test('THE DELIBERATE TRADE: a route change + its regenerated docs gets NO claim', () => {
@@ -136,7 +136,7 @@ test('THE DELIBERATE TRADE: a route change + its regenerated docs gets NO claim'
   // about a generator's whole require-chain, which the panel rightly rejected as
   // unsound. The case this feature exists for — the session-log ship — is
   // docs-only and stays covered.
-  assert.deepEqual(prov.generatorsInDiff(['modules/lifecycle/routes/tasks.js', 'docs/api/openapi.json']), []);
+  assert.deepEqual(prov.generatorsInDiff(['modules/lifecycle/routes/tasks.js', 'docs/routes-permissions.md']), []);
 });
 
 // ---- 3. verify: pass ⇒ verified, fail ⇒ unverified ----
@@ -197,11 +197,11 @@ test('a clean diff runs NO generator at all', () => {
 
 test('one generator failing does not taint another that passed', () => {
   const m = prov.verifyGeneratedProvenance({
-    changedFiles: ['CLAUDE.md', 'docs/api/openapi.json'],
+    changedFiles: ['CLAUDE.md', 'docs/routes-permissions.md'],
     run: (script) => { if (script === 'gen-api-docs.js') throw new Error('stale'); },
   });
   assert.deepEqual([...new Set(m.verified.map((v) => v.file))], ['CLAUDE.md']);
-  assert.deepEqual(m.unverified.map((v) => v.file), ['docs/api/openapi.json']);
+  assert.deepEqual(m.unverified.map((v) => v.file), ['docs/routes-permissions.md']);
 });
 
 // ---- 4/5. the prompt section ----
@@ -225,7 +225,7 @@ test('the verified section states the load-bearing facts', () => {
 });
 
 test('a whole-file generator is described as whole-file, not as a fence', () => {
-  const m = prov.verifyGeneratedProvenance({ changedFiles: ['docs/api/openapi.json'], run: () => {} });
+  const m = prov.verifyGeneratedProvenance({ changedFiles: ['docs/routes-permissions.md'], run: () => {} });
   const s = prov.provenanceSection(m);
   assert.match(s, /ENTIRE FILE is output of `gen-api-docs\.js`/);
   assert.doesNotMatch(s, /region inside the/, 'no fence language for a whole-file artifact');
@@ -251,11 +251,11 @@ test('the async verifier is what the grade path uses, and it does not block', as
   // spawns, so prompt construction only READS the finished manifest.
   const calls = [];
   const m = await prov.verifyGeneratedProvenanceAsync({
-    changedFiles: ['CLAUDE.md', 'docs/api/openapi.json'],
+    changedFiles: ['CLAUDE.md', 'docs/routes-permissions.md'],
     run: async (script, flag) => { calls.push(`${script} ${flag}`); },
   });
   assert.deepEqual(calls.sort(), ['gen-api-docs.js --check', 'gen-interaction-posture.js --check', 'gen-session-index.js --check-block']);
-  assert.deepEqual([...new Set(m.verified.map((v) => v.file))].sort(), ['CLAUDE.md', 'docs/api/openapi.json']);
+  assert.deepEqual([...new Set(m.verified.map((v) => v.file))].sort(), ['CLAUDE.md', 'docs/routes-permissions.md']);
 });
 
 test('the async verifier runs NOTHING for a diff with no generated file', async () => {
@@ -353,8 +353,8 @@ test('verification runs ONLY for a diff that introduces no executable file', ()
   // line: if nothing in the diff can RUN, running a generator cannot execute
   // anything the diff added — no require-chain to reason about.
   assert.ok(!prov.diffCarriesExecutable(['CLAUDE.md', 'docs/session-logs/x.md']), 'the motivating case stays eligible');
-  assert.ok(!prov.diffCarriesExecutable(['docs/api/openapi.json', 'docs/api-reference.md']));
-  assert.ok(prov.diffCarriesExecutable(['scripts/gds/gen-repo-map.js']), 'the generator itself');
+  assert.ok(!prov.diffCarriesExecutable(['docs/routes-permissions.md', 'docs/api-reference.md']));
+  assert.ok(prov.diffCarriesExecutable(['scripts/bongos/gen-repo-map.js']), 'the generator itself');
   assert.ok(prov.diffCarriesExecutable(['CLAUDE.md', 'modules/lifecycle/db.js']), 'anything a generator might require');
   assert.ok(prov.diffCarriesExecutable(['CLAUDE.md', 'deploy.sh']), 'shell too');
   assert.ok(prov.diffCarriesExecutable(['CLAUDE.md', 'tests/x.mjs']));
@@ -392,7 +392,7 @@ test('the implicated checks run concurrently, not in series', async () => {
   let inFlight = 0;
   let maxInFlight = 0;
   await prov.verifyGeneratedProvenanceAsync({
-    changedFiles: ['CLAUDE.md', 'docs/api/openapi.json', 'docs/file-map.md'],
+    changedFiles: ['CLAUDE.md', 'docs/routes-permissions.md', 'docs/file-map.md'],
     run: async () => {
       inFlight += 1;
       maxInFlight = Math.max(maxInFlight, inFlight);