@bongos/core 1.21.174 → 1.21.176

package/scripts/bongos/fitness-checks-identity.js

@@ -0,0 +1,343 @@
+// scripts/bongos/fitness-checks-identity.js — the checks that keep the portable core
+// free of any one host's identity: kernel prompts (BV1.R76), the neutral config
+// packs (BV1.R102) and the design contract.
+//
+// Carved out of scripts/bongos/fitness.js by task 1003206 (goal 1000079, the R03
+// de-monolith plan) to bring that file under the 1,500-line ratchet. A STRUCTURAL
+// move: the lines below are fitness.js's originals unchanged, and fitness.js
+// imports every name straight back, so the CHECKS registry and the module's
+// public surface (which the tests read heavily) are untouched.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { CORE_ROOT, MODULE_ROOTS, REPO_ROOT, rel } = require('./fitness-lib.js');
+
+// ============================================================================
+// Check 13 — portable code carries no hardcoded host-brand identity (BV1.R76 + task 1705)
+// ============================================================================
+//
+// The portable core (src/bongos/**) and every feature MODULE (modules/**) must read
+// the instance's product/world name + domains from branding() / window.__BRANDING__,
+// never a baked-in "Off the Boats" / "Amazonprimea" / apex domain (ADR 0062 §3/§5;
+// the branding contract). R76 shipped this as an 8-FILE allowlist over the kernel
+// LLM-prompt headers; task 1705 WIDENS it to a directory-wide scan, so ANY new brand
+// leak in portable code reds the build — not just the nine files someone remembered
+// to list. (The 2026-07-02 separation audit found five leaks the old allowlist missed:
+// the rank/graduation broadcasts, the auth error-page title, the apex-origin default,
+// and ~124 served-UI strings.) Comments are stripped first (block /* */, HTML
+// <!-- -->, and JS // line comments via a `://`-safe strip so a URL is never
+// truncated) because the de-brand rationale legitimately names the old literals in
+// prose. Instance-injected placeholders ({{worldName}} etc.) carry no literal, so
+// they pass untouched.
+//
+// EXCLUDED — the small instance-1 / ops allowlist (task 1705):
+//   - modules/game/**  — the INSTANCE'S OWN PRODUCT. A product's identity is
+//     instance-specific by definition (a vanilla instance ships a different product,
+//     or none); it is not portable-platform code the branding pack can neutralize.
+//     A documented carve-out, not an oversight.
+//   - generated / build-output dirs (no authored source).
+const PROMPT_IDENTITY_LITERALS = [
+  /off the boats/i,
+  /amazonprimea/i,
+  // The host's operating company (task 1002853): the scan already covered the status
+  // page's HTML, but with only the product listed its footer credited this company for years.
+  /hermeslines/i,
+];
+// Scan roots (recursive) + kernel-prompt CLIs that live outside them.
+// scripts/bongos joined at task 1002427: the builder CLI was UNSCANNED, which is how
+// paste-token.js kept a hardcoded 'https://amazonprimea.com' long after the task
+// 1002201 sweep replaced that literal everywhere else. The straggler surfaced as a
+// 401 that locked a builder out of re-authenticating — a valid token verified
+// against the wrong host — and nothing in CI could see it (idea 1000564).
+// Widened scripts/bongos → ALL of scripts/ at task 1002756: migrate.sh's hardcoded
+// founder DB default (task 1002755) survived every gate because the detector never
+// saw the file — a gate that cannot see the file class the bug lives in is worse
+// than no gate, because it is trusted.
+const IDENTITY_SCAN_ROOTS = ['src/bongos', 'modules', 'scripts'];
+const IDENTITY_SCAN_EXTRA_FILES = [];
+// PERMANENT, COUNTED carve-outs for the scripts/bongos root — {file: allowed hits}.
+//
+// Widening the root (task 1002427) surfaced 23 files. Task 1002428 swept them:
+// every one whose literal was a real runtime bug is FIXED (a wrong instance URL
+// printed to a builder, an `amazonprimea-*` User-Agent that should come from
+// branding().userAgent(), a hardcoded product name in user-facing copy). What is
+// left below is NOT a backlog — each entry is a literal that is CORRECT as
+// written, so this list is permanent rather than a ratchet-to-zero.
+//
+// The COUNT is still enforced, which is the point: an entry may not grow. A file
+// here that gains a NEW hardcoded host fails the build exactly like an unlisted
+// one, and any file NOT listed must have zero hits. Getting better never fails.
+//
+// Why each is legitimate:
+//   * publish-manifest.js — the literal FILENAMES of three real committed docs
+//     (the two decouple recipes, plus the instance's own name/trademark ADR that
+//     task 1003869 excluded: its prose redacts cleanly but the FILENAME rides in
+//     the published manifest). Renaming the strings without renaming the files
+//     would break the publish manifest.
+//   * backfill-sessions.js / version-close.js — one-time operator runbook text
+//     naming the actual prod DB + a historical local directory. Describing what
+//     an operator must literally type is the correct content.
+//   * seed-*.js — the hits are PROSE INSIDE seeded task descriptions: historical
+//     records of what those tasks said when they were filed. Rewriting them would
+//     falsify the record; deleting the files would destroy it. They are inert
+//     (idempotent on source_ref) and referenced only by generated manifests.
+//   * the four *.sh entries — surfaced when `.sh` joined the extension set (task
+//     1002567). Each is a HOST-PINNED OPS script, not portable code: they name the
+//     live box's actual Postgres database/role and its actual /etc secrets dir, and
+//     every one of those literals is already only the DEFAULT behind an env override
+//     (GDS_BACKUP_DB, PROD_DB/STAGING_DB, PG_SOCKET). Each is an infrastructure
+//     identifier, not an instance URL, and the systemd
+//     units on that box invoke these by path. Re-pointing an instance's backups is
+//     deployment work, not a branding read. Their COUNT is still frozen here, so a
+//     NEW literal in any of them fails exactly like one in an unlisted file.
+//   * fitness-checks-identity.js / package-core.js — THE DETECTORS THEMSELVES: Check 13's regexes
+//     and package-core's PRIOR_INSTANCE_FLOOR name the brand because hunting it is
+//     their job. * seed-v3-tasks.js — the seeded-task-prose rationale above. All
+//     three passed pre-1002756 only by the old stripper's accidents (phantom
+//     blocks + regex-blindness); now they are seen and counted.
+const IDENTITY_SCAN_ALLOWED = {
+  // task 1003206 moved Check 13's own regexes out of fitness.js into THIS file
+  // when the monolith was split, so the detector's self-carve-out moved with them.
+  'scripts/bongos/fitness-checks-identity.js': 3,
+  'scripts/bongos/package-core.js': 1,
+  // audit-replay.sh + db-backup-{nightly,offsite}.sh were carved out here as
+  // "host-pinned ops"; task 1002757 RETIRED that justification for them — each
+  // now resolves its database from the branding pack (the migrate.sh pattern) and
+  // fails loudly rather than defaulting, so their counts ratcheted to zero and the
+  // entries are gone. seed-staging.sh keeps its carve-out on the OPPOSITE
+  // rationale: its literal is a fail-CLOSED safety interlock (the script wipes
+  // STAGING_DB and refuses unless the name matches exactly), so on any other
+  // instance it declines to run instead of destroying the wrong database.
+  'scripts/bongos/seed-staging.sh': 4,
+  'scripts/bongos/backfill-sessions.js': 2,
+  'scripts/bongos/publish-manifest.js': 3,
+  'scripts/bongos/seed-bongos-coreB-tranche1-tasks.js': 1,
+  'scripts/bongos/seed-bongos-coreB-tranche2-tasks.js': 1,
+  'scripts/bongos/seed-bongos-goal-hierarchy-tasks.js': 1,
+  'scripts/bongos/seed-bongos-tasks.js': 1,
+  'scripts/bongos/seed-gds-v4-tasks.js': 1,
+  'scripts/bongos/seed-medusa-tasks.js': 7,
+  'scripts/bongos/seed-module-upstreaming.js': 1,
+  'scripts/bongos/seed-productization-tasks.js': 6,
+  'scripts/bongos/seed-provisioning-tasks.js': 2,
+  'scripts/bongos/version-close.js': 1,
+  // task 1002853 (the company literal joined the list): audit-authorship.sh is itself a
+  // detector — its ops allowlist names the founder's commit address so it can exempt it; grade-smoke.js
+  // is a protected grader probe whose fixture task prose names the company, the seed-*.js rationale.
+  'scripts/bongos/audit-authorship.sh': 1,
+  'scripts/bongos/grade-smoke.js': 1,
+};
+// `.sh` joined at task 1002567: the extension set was `.js/.html/.css`, so NO shell
+// script had ever been scanned — which is how scripts/bongos/lib.sh kept a hardcoded
+// founder host as its API-base default (and a hardcoded ~/.config/otb token path)
+// through the entire task 1002201 sweep, leaving all five bash smokes dead on any
+// instance with a different configDir. The guard could not see the file class the
+// bug lived in.
+const IDENTITY_SCAN_EXTS = new Set(['.js', '.html', '.css', '.sh']);
+// Path-prefix carve-outs (see the header note). Kept SMALL and documented.
+const IDENTITY_SCAN_EXCLUDE = ['modules/game/'];
+// Directories with no authored source to gate.
+const IDENTITY_SCAN_SKIP_DIRS = new Set(['node_modules', '.git', 'generated', 'iterations', 'references']);
+
+// Comment stripping lives in identity-strip.js (task 1002756: extracted + replaced
+// the two-regex JS strip, which a `/*` inside a `//` comment could OPEN — it
+// silently hid ~330 provision.js lines from this gate). Re-exported for the tests.
+const { stripCommentsForIdentity } = require('./identity-strip');
+
+// An APEX-ONLY region is content the server DELETES on every instance that is not
+// the hub (`stripApexOnly`, src/platform-server.js — ADR 0152; the front door became
+// a module in ADR 0218, which is what first brought these pages under this gate).
+// This check exists so "a non-OTB instance renders ITS OWN brand"; text inside these
+// sentinels never reaches a non-hub instance at all, so it cannot produce that
+// failure. The hub's own landing legitimately NAMES the projects hosted on it, and
+// that catalog is exactly what the sentinels wrap.
+//
+// BLANKED, not removed, so a violation's reported line number still points at the
+// real line. Applied BEFORE the comment strip, which would otherwise eat the
+// sentinels (they are HTML comments) and take the region's boundaries with them.
+const APEX_ONLY_REGION = /<!--apex-only:start-->[\s\S]*?<!--apex-only:end-->/g;
+function blankApexOnly(text) {
+  return String(text).replace(APEX_ONLY_REGION, (m) => m.replace(/[^\n]/g, ' '));
+}
+
+// Pure: scan one file's comment-stripped source for a hardcoded host-brand literal.
+// Returns violation strings. Exported for the "actually catches a re-hardcode" test.
+function scanPromptIdentity(relFile, text, ext = path.extname(relFile)) {
+  const violations = [];
+  stripCommentsForIdentity(blankApexOnly(text), ext).split('\n').forEach((raw, i) => {
+    if (!raw.trim()) return;
+    for (const re of PROMPT_IDENTITY_LITERALS) {
+      const m = raw.match(re);
+      if (m) {
+        violations.push(`${relFile}:${i + 1} hardcodes the host-brand identity "${m[0]}" — read it from branding()/window.__BRANDING__ (identity/domains/currency), or use a {{worldName}}-style token, so a non-OTB instance renders ITS OWN brand (ADR 0062 §3/§5; BV1.R76 / task 1705).`);
+        break; // one hit per line is enough
+      }
+    }
+  });
+  return violations;
+}
+
+// Recursively collect scannable files under one root, honoring the skip-dir + carve-out lists.
+function collectIdentityFiles(absRoot, relRoot) {
+  const out = [];
+  let entries;
+  try { entries = fs.readdirSync(absRoot, { withFileTypes: true }); }
+  catch { return out; }
+  for (const e of entries) {
+    const rel = relRoot ? `${relRoot}/${e.name}` : e.name;
+    if (e.isDirectory()) {
+      if (IDENTITY_SCAN_SKIP_DIRS.has(e.name)) continue;
+      if (IDENTITY_SCAN_EXCLUDE.some((p) => `${rel}/`.startsWith(p))) continue;
+      out.push(...collectIdentityFiles(path.join(absRoot, e.name), rel));
+    } else if (IDENTITY_SCAN_EXTS.has(path.extname(e.name))
+               && !IDENTITY_SCAN_EXCLUDE.some((p) => rel.startsWith(p))) {
+      out.push(rel);
+    }
+  }
+  return out;
+}
+
+function checkKernelPromptsNoHardcodedIdentity() {
+  const violations = [];
+  let scanned = 0;
+  // Collect {abs, rel}: src/bongos is CORE; modules ship from BOTH roots (ADR 0108 §Consequences #4).
+  // Dedup by repo-relative path so a shared checkout never scans a file twice, and read each file
+  // from the root it was actually found under (a module may live in the instance repo post-split).
+  const seen = new Set();
+  const entries = [];
+  const addFrom = (rootAbs, sub) => {
+    for (const relFromRoot of collectIdentityFiles(path.join(rootAbs, sub), sub)) {
+      if (seen.has(relFromRoot)) continue;
+      seen.add(relFromRoot);
+      entries.push({ abs: path.join(rootAbs, relFromRoot), rel: relFromRoot });
+    }
+  };
+  for (const root of IDENTITY_SCAN_ROOTS) {
+    for (const rootAbs of (root === 'modules' ? MODULE_ROOTS : [CORE_ROOT])) addFrom(rootAbs, root);
+  }
+  for (const extra of IDENTITY_SCAN_EXTRA_FILES) {
+    if (!seen.has(extra)) { seen.add(extra); entries.push({ abs: path.join(CORE_ROOT, extra), rel: extra }); }
+  }
+  let ratcheted = 0;
+  for (const { abs, rel: relFile } of entries) {
+    let text;
+    try { text = fs.readFileSync(abs, 'utf8'); }
+    catch { continue; } // a file moved/carved away is not a failure of this gate
+    scanned += 1;
+    const found = scanPromptIdentity(relFile, text);
+    // Permanently allowed at a COUNT (task 1002428): the listed literals are
+    // correct as written, but an entry may not GROW — a new hardcode in one of
+    // these files fails exactly like one in an unlisted file.
+    const allowed = IDENTITY_SCAN_ALLOWED[relFile];
+    if (allowed !== undefined) {
+      if (found.length > allowed) {
+        violations.push(
+          `${relFile} now hardcodes the host-brand identity ${found.length} time(s), above its allowed ${allowed} — ` +
+          `the carve-out covers the EXISTING literals (see IDENTITY_SCAN_ALLOWED), not new ones. ` +
+          `Read the host from branding()/window.__BRANDING__ instead (task 1002428).`
+        );
+      } else {
+        ratcheted += 1;
+      }
+      continue;
+    }
+    violations.push(...found);
+  }
+  return {
+    name: 'portable code carries no hardcoded host identity (BV1.R76 / task 1705)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} portable source file(s) scanned (.js/.html/.css/.sh under src/bongos/** + modules/** + scripts/** (whole root, task 1002756), minus the instance-1 product + generated dirs) — none may hardcode the host brand; identity comes from branding()/window.__BRANDING__ (ADR 0062 §3/§5). ${ratcheted} scripts/bongos file(s) hold documented permanent carve-outs (real DNS zones, real doc filenames, operator runbook text, historical seeded prose) capped at a count they may not exceed — task 1002428.`,
+  };
+}
+
+// ============================================================================
+// Check 15b — core-shipped NEUTRAL config packs carry no host identity (BV1.R102)
+// ============================================================================
+//
+// Sibling of Check 15 for the CONFIG class. IDENTITY_SCAN_EXTS is js/html/css, so
+// the scan above never opens a .json — yet config/*.neutral.json is precisely what
+// a vanilla instance boots from (branding R76, governance R96). A host name leaking
+// into a neutral pack ships one instance's brand to EVERY fresh instance, and until
+// this check nothing in CI could see it.
+//
+// Only the NEUTRAL packs are scanned, deliberately: an instance pack (config/
+// branding.json, config/government.json) is host content that legitimately names
+// its host, and is boundary-excluded from the published core anyway.
+function checkNeutralConfigsNoHostIdentity() {
+  const violations = [];
+  const dir = path.join(CORE_ROOT, 'config');
+  let names = [];
+  try { names = fs.readdirSync(dir).filter((n) => n.endsWith('.neutral.json')).sort(); }
+  catch { /* no config/ dir in this root — nothing to gate */ }
+  for (const name of names) {
+    const relFile = `config/${name}`;
+    let text;
+    try { text = fs.readFileSync(path.join(dir, name), 'utf8'); }
+    catch { continue; } // a pack that moved away is not a failure of this gate
+    violations.push(...scanPromptIdentity(relFile, text, '.json'));
+  }
+  return {
+    name: 'neutral config packs carry no host identity (BV1.R102)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${names.length} core-shipped config/*.neutral.json pack(s) scanned — a vanilla instance boots from these alone, so none may name a host brand. Instance packs (config/<name>.json) are host content and are deliberately NOT scanned.`,
+  };
+}
+
+// ---- design contract (ADR 0081 / task 1377) --------------------------------
+
+function checkDesignContract() {
+  const { spawnSync } = require('node:child_process');
+  // The validator + adapters live in the ui-design module (task 1003324, ADR 0197);
+  // scripts/bongos/validate-design.js is a shim over the module file spawned here.
+  const validatorPath = path.join(REPO_ROOT, 'modules', 'ui-design', 'scripts', 'validate-design.js');
+  const adaptersDir = path.join(REPO_ROOT, 'modules', 'ui-design', 'adapters');
+  const hasAdapters = (() => {
+    try { return fs.readdirSync(adaptersDir).some((e) => fs.statSync(path.join(adaptersDir, e)).isDirectory()); }
+    catch { return false; }
+  })();
+
+  const result = spawnSync(process.execPath, [validatorPath, '--json'], { encoding: 'utf8' });
+  let report = { ok: true, errors: [], warnings: [] };
+  try { report = JSON.parse(result.stdout || '{}'); } catch { /* fall through with defaults */ }
+  if (result.status !== 0 && !report.errors.length) {
+    report.errors.push(result.stderr ? result.stderr.trim() : 'validate-design.js exited non-zero');
+    report.ok = false;
+  }
+
+  return {
+    name: 'design contract valid (modules/ui-design/docs/design-contract.md / ADR 0081)',
+    ok: report.ok,
+    hardFail: !report.ok && hasAdapters,
+    violations: report.errors || [],
+    warnings: report.warnings || [],
+    note: hasAdapters
+      ? 'Hard-fail: adapters present — contract must be valid. Run: node scripts/bongos/validate-design.js'
+      : 'Warn-only until first adapter lands (task 1378 / task 1379). Run: node scripts/bongos/validate-design.js',
+  };
+}
+
+
+module.exports = {
+  IDENTITY_SCAN_ALLOWED,
+  IDENTITY_SCAN_EXCLUDE,
+  IDENTITY_SCAN_EXTRA_FILES,
+  IDENTITY_SCAN_EXTS,
+  IDENTITY_SCAN_ROOTS,
+  IDENTITY_SCAN_SKIP_DIRS,
+  PROMPT_IDENTITY_LITERALS,
+  checkDesignContract,
+  checkKernelPromptsNoHardcodedIdentity,
+  checkNeutralConfigsNoHostIdentity,
+  collectIdentityFiles,
+  scanPromptIdentity,
+  stripCommentsForIdentity,
+  blankApexOnly,           // ADR 0218 — apex-only regions never reach a child instance (tested)
+};

package/scripts/bongos/fitness-checks-packaging.js

@@ -0,0 +1,132 @@
+// scripts/bongos/fitness-checks-packaging.js — Checks 16 + 16b: core code must not
+// HARD-require a boundary-EXCLUDED config or module.
+//
+// Carved out of scripts/bongos/fitness.js by task 1003825, on the task-1003192
+// precedent. That file had returned to the 1,500-line ratchet with ONE line of
+// headroom (1,499 of 1,500, fitness-ratchets.js OVERSIZE_LINES), so the next check
+// registered there would have tipped it over and redded the ratchet for whoever
+// wrote it. These two checks left together because they are one subject — the same
+// question asked of a config and of a module — and because the pair depends only on
+// CORE_ROOT / rel / walkJs / walkJsAllRoots, all already public on fitness-lib.js,
+// so the carve adds no import cycle.
+//
+// fitness.js requires both names straight back, so the CHECKS registry and the
+// module surface the tests read are unchanged.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { CORE_ROOT, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
+// ============================================================================
+// Check 16 — core code must not HARD-require an instance-excluded config/*.json
+// ============================================================================
+//
+// A vanilla self-host boot ships only the PUBLISHABLE tree (publish-manifest.js). An
+// instance-only config (config/bongos-cli.json, config/branding.json,
+// config/modules.json, …) is boundary-EXCLUDED, so a bare `require('../../config/<excluded>.json')`
+// in core code throws MODULE_NOT_FOUND and CRASHES the boot on a fresh instance — the exact
+// class that shipped in R88 (two hard-requires in src/bongos/serve-internal.js; task 1824). The
+// cure is to READ the config instead of requiring it, tolerating a missing file
+// (tryLoadInstanceConfig in src/bongos/serve-internal.js / fs.existsSync → fail-to-vanilla), which
+// also drops the require() literal so it no longer matches here. Check 1 (core↔host) scans
+// code→code IMPORTS and misses this code→config class. Only an EXCLUDED config is a violation;
+// a publishable neutral.*/schema config (which ships with the core) is fine.
+const CONFIG_REQUIRE_RE = /require\(\s*['"]([^'"]*config\/[^'"]*\.json)['"]\s*\)/g;
+
+function checkCoreRequiresExcludedConfig() {
+  const { isPublishable } = require('./publish-manifest');
+  const violations = [];
+  // src/ + scripts/ are CORE; modules ship from BOTH roots (ADR 0108 §Consequences #4). Dedup by
+  // repo-relative path so a shared checkout scans each file once.
+  const seen = new Set();
+  const allAbs = [
+    ...['src', 'scripts'].flatMap((d) => walkJs(path.join(CORE_ROOT, d))),
+    ...walkJsAllRoots('modules'),
+  ];
+  for (const abs of allAbs) {
+    const relFile = rel(abs);
+    if (seen.has(relFile)) continue;
+    seen.add(relFile);
+    if (!isPublishable(relFile)) continue; // only CORE (publishable) code can crash a vanilla boot
+    for (const raw of fs.readFileSync(abs, 'utf8').split('\n')) {
+      const trimmed = raw.trim();
+      if (trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*')) continue;
+      let m;
+      CONFIG_REQUIRE_RE.lastIndex = 0;
+      while ((m = CONFIG_REQUIRE_RE.exec(raw))) {
+        const relCfg = rel(path.resolve(path.dirname(abs), m[1]));
+        if (!isPublishable(relCfg)) {
+          violations.push(`${relFile} → require('${m[1]}') hard-requires an instance-excluded config (${relCfg}) — guard the read (tryLoadInstanceConfig in src/bongos/serve-internal.js / fs.existsSync, fail-to-vanilla) so a fresh core boots (task 1824).`);
+        }
+      }
+    }
+  }
+  return {
+    name: 'core never hard-requires an excluded config (task 1824)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: "a publishable src/·scripts/·modules/ .js must not require('…config/X.json') when X.json is boundary-excluded — guard the read so a vanilla core boots.",
+  };
+}
+
+// ============================================================================
+// Check 16b — core code must not require an instance-EXCLUDED module (task 2135)
+// ============================================================================
+//
+// Sibling of Check 16 for the code→MODULE class. A publishable core file that
+// require()s a boundary-EXCLUDED module (modules/game, modules/art-pipeline,
+// modules/character-anim, …) throws MODULE_NOT_FOUND once that module lives in the
+// consumer's instance repo rather than the core package (R89 split). The cure is
+// either to reclassify the module INTO core (if it belongs there — e.g. provisioning)
+// or to exclude the requiring file with the feature it serves (art tooling).
+// Catches BOTH require forms: a direct literal
+// require('../modules/<key>/…') AND a require(path.join(<root>, 'modules/<key>/…')).
+// Only an EXCLUDED module required from a PUBLISHABLE file is a violation; requiring a
+// publishable (core) module is fine, and the loader's DYNAMIC dispatch
+// (path.join(dir,'routes',rk) — no literal modules/<key>/ string) is invisible here.
+const MODULE_PATH_IN_STRING_RE = /['"](?:[^'"]*\/)?modules\/([a-z0-9][a-z0-9-]*)\/[^'"]*['"]/g;
+
+function checkCoreRequiresExcludedModule() {
+  const { isPublishable } = require('./publish-manifest');
+  const violations = [];
+  const seen = new Set();
+  const allAbs = [
+    ...['src', 'scripts'].flatMap((d) => walkJs(path.join(CORE_ROOT, d))),
+    ...walkJsAllRoots('modules'),
+  ];
+  for (const abs of allAbs) {
+    const relFile = rel(abs);
+    if (seen.has(relFile)) continue;
+    seen.add(relFile);
+    if (!isPublishable(relFile)) continue; // only CORE (publishable) code can crash a vanilla boot
+    for (const raw of fs.readFileSync(abs, 'utf8').split('\n')) {
+      const trimmed = raw.trim();
+      if (trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*')) continue;
+      if (!/require\s*\(/.test(raw)) continue; // only lines that actually require()
+      let m;
+      MODULE_PATH_IN_STRING_RE.lastIndex = 0;
+      while ((m = MODULE_PATH_IN_STRING_RE.exec(raw))) {
+        const key = m[1];
+        if (isPublishable(`modules/${key}/module.json`)) continue; // requiring a CORE module is fine
+        violations.push(`${relFile} → require(...'modules/${key}/…') pulls in an instance-EXCLUDED module — reclassify it into core (if it belongs there) or exclude ${relFile} with the feature it serves, so a fresh core boots (task 2135).`);
+      }
+    }
+  }
+  return {
+    name: 'core never requires an excluded module (task 2135)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: "a publishable src/·scripts/·modules/ .js must not require('…modules/<key>/…') when that module is boundary-excluded — MODULE_NOT_FOUND post-split (R89).",
+  };
+}
+
+module.exports = {
+  checkCoreRequiresExcludedConfig,
+  checkCoreRequiresExcludedModule,
+};

package/scripts/bongos/fitness-checks-route-pins.js

@@ -0,0 +1,76 @@
+// scripts/bongos/fitness-checks-route-pins.js — Check 4b (task 1003192): every
+// MODULE_EXPECTED_RANKS key names a real module directory.
+//
+// Carved out of scripts/bongos/fitness.js on the task-1003206 precedent (the R03
+// de-monolith plan): that file sits against the 1,500-line ratchet with two lines
+// of headroom, so a new check lands here rather than tipping it over. fitness.js
+// imports the name straight back, so the CHECKS registry and the module's public
+// surface — which the tests read heavily — are unchanged.
+//
+// WHY THE CHECK EXISTS. src/bongos/route-rank-check.js pins the expected rank of
+// each privileged module route, but pin SCOPE derives from successfully-classified
+// routes: a MODULE_EXPECTED_RANKS key matching no discovered module is dropped and
+// its pins pass VACUOUSLY, while the loader keeps mounting modules/<key>/routes/ in
+// production by the same convention the scan discovers them by. Measured on the real
+// classifier: with modules/security/ renamed, all six security pins went inert and a
+// POST /security/reports downgraded to any-builder drew zero findings — a pinned
+// privileged WRITE route silently unguarded.
+//
+// THIS IS THE SOURCE-REPO HALF of a two-layer guard. checkRouteRanks fires when a
+// module directory is PRESENT but contributed no route (a rename/move under a live
+// module); it deliberately stays silent on a wholly absent directory, because it runs
+// on every ship and an instance may legitimately omit an optional module. Here every
+// module is expected to exist, so a whole-directory rename or a typo'd key — neither
+// of which the other layer can see — hard-fails. The governance→government rename had
+// to hand-carry double-keyed pins precisely because nothing mechanical caught this.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { REPO_ROOT } = require('./fitness-lib.js');
+const { checkRouteRanks, MODULE_EXPECTED_RANKS } = require('../../src/bongos/route-rank-check');
+
+// ============================================================================
+// Check 4 — no route bypasses server-side rank checks (ADR 0016)  [reuses route-rank-check]
+// ============================================================================
+// Moved here with Check 4b (task 1003192): the two are the same subject — Check 4 asks
+// whether each route carries a gate, 4b whether the pins that assert those gates are
+// actually in scope — and keeping them together is what buys fitness.js headroom against
+// the 1,500-line ratchet instead of leaving it sitting exactly on the cap.
+function checkRankGuards() {
+  const r = checkRouteRanks();
+  // hardFail = an ungated WRITE route or a downgraded privileged route. Unclassified read routes
+  // are 'concerns' (the Hacker adjudicates intent) — surfaced as warnings, not a hard failure.
+  const violations = r.findings.filter((f) => f.severity === 'blocker').map((f) => `${f.route} (${f.file}) — ${f.summary}`);
+  const warnings = r.findings.filter((f) => f.severity !== 'blocker').map((f) => `${f.route} (${f.file}) — ${f.summary}`);
+  return { name: 'route rank guards (ADR 0016)', ok: !r.hardFail, hardFail: r.hardFail, violations, warnings, note: `${r.routeCount} routes classify to a known rank; no ungated writes, no privileged downgrades.` };
+}
+
+// ============================================================================
+// Check 4b — module rank-pin keys resolve to a real modules/<key>/ dir
+// ============================================================================
+function checkModulePinKeysResolve() {
+  const violations = [];
+  for (const key of Object.keys(MODULE_EXPECTED_RANKS)) {
+    if (!fs.existsSync(path.join(REPO_ROOT, 'modules', key))) {
+      violations.push(`MODULE_EXPECTED_RANKS.${key} names no modules/${key}/ directory — its `
+        + `${Object.keys(MODULE_EXPECTED_RANKS[key]).length} rank pin(s) are INERT and pass vacuously `
+        + '(src/bongos/route-rank-check.js). Rename the key to the module\'s current directory, or drop the entry.');
+    }
+  }
+  return {
+    name: 'module rank-pin keys resolve (task 1003192)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${Object.keys(MODULE_EXPECTED_RANKS).length} module pin blocks all name a live modules/<key>/ directory.`,
+  };
+}
+
+module.exports = {
+  checkRankGuards,
+  checkModulePinKeysResolve,
+};