@bongos/core 1.21.175 → 1.21.176

package/scripts/gds/accessibility-replay.js

@@ -1,195 +1,6 @@
-// scripts/gds/accessibility-replay.js — the two-profile replay regression for the
-// accessibility dimension (task 1002517; clauses 5 and 8 of criterion
-// `accessibility-fluency-profile`, which named this run as its OWN proof).
-//
-// WHAT IT PROVES, and why it is not already covered.
-// tests/session_accessibility.mjs pins the scorer's contracts against synthetic
-// fixtures it builds itself — a test of the arithmetic. It cannot answer the
-// criterion's actual question, which is about PROSE: does the dimension reward a
-// reply a newcomer can use, and does it leave an expert's reply alone? So this
-// harness takes a FIXED set of eight questions a newcomer really asks, each the
-// documented trigger of a surface that exists, answered twice — once in each
-// register — and scores both runs.
-//
-// Four legs. Each one fails a different way of being wrong:
-//
-//   1. FLOOR          the non-technical run, under the non-technical profile,
-//                     clears FLOOR. The dimension recognises accessible prose.
-//   2. NO PENALTY     the engineer run, under the engineer profile, is not
-//                     scored at all — every signal waived, score null.
-//   3. DISCRIMINATION the SAME engineer prose under the NON-TECHNICAL profile
-//                     falls BELOW FLOOR, with every detector registering hits.
-//                     Without this leg 1 proves nothing — a scorer that returned
-//                     10 for everything, or three detectors that had gone blind,
-//                     would pass leg 1 and look identical to a working one.
-//   4. LENGTH         `doubleRun` says the same prose twice. Chars double, hits
-//                     double, the rate is unchanged, so the score must be
-//                     IDENTICAL. That is the metric reading density rather than
-//                     volume, asserted against real prose.
-//
-// WHERE TERSENESS PROTECTION ACTUALLY COMES FROM, since the task's "watch out"
-// is a metric that punishes an expert's brevity. It is leg 2 — the WAIVER — not
-// the per-1000-character rates. The rates make the score independent of how long
-// an answer is at a fixed density (leg 4); they do NOT make it independent of
-// density, and they should not: three undefined terms in three hundred
-// characters really is denser than three in three thousand. What protects the
-// expert is that their profile removes those two signals from the scoring set
-// entirely. `terseVariant` — every turn cut to its first sentence, a genuinely
-// shorter and thinner answer — is checked too, asserting only that answering
-// more briefly never COSTS points; it is a guard, not the mechanism.
-//
-// One honest asymmetry this surfaced and the corpus now records: under
-// `technical_level: engineer` with `toolchain_familiarity: new`, the engineer
-// run still scores, because terminal-where-a-click-path-exists is waived by the
-// TOOLCHAIN setting, not the technical one. "I think in code" and "I live in a
-// terminal" are two different answers, and the scorer is right to keep them
-// apart. tests/accessibility_replay.mjs pins that pairing so a future widening
-// of the engineer waiver has to be a deliberate edit.
-//
-// The corpus is data — tests/fixtures/accessibility-replay.json — so adding a
-// prompt is an edit to JSON, not to code.
-//
-// Run:  node scripts/gds/accessibility-replay.js
-//       node scripts/gds/accessibility-replay.js --json
-
+// scripts/gds/accessibility-replay.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/accessibility-replay.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-const { scoreAccessibility, bandFor } = require('../../modules/sessions/accessibility.js');
-
-const CORPUS_PATH = path.join(__dirname, '..', '..', 'tests', 'fixtures', 'accessibility-replay.json');
-
-// FLOOR — the score a non-technical run has to clear. It is bandFor()'s
-// 'workable' boundary and deliberately not a second independent number: the
-// scorer already draws the line between prose a newcomer can work with and prose
-// that is merely dense, and inventing a different one here would let the two
-// drift. tests/accessibility_replay.mjs asserts they stay tied.
-const FLOOR = 6.0;
-
-function loadCorpus(file = CORPUS_PATH) {
-  return JSON.parse(fs.readFileSync(file, 'utf8'));
-}
-
-// terseVariant — each turn cut to its first sentence: a shorter, thinner answer.
-// Mechanical on purpose. A hand-written "terse version" in the corpus would be a
-// version tuned until it passed; taking the first sentence of prose written for
-// another purpose is a variant nobody got to tune.
-function terseVariant(turns) {
-  return turns.map((t) => {
-    const m = /^[^.!?]*[.!?]/.exec(t);
-    return m ? m[0] : t;
-  });
-}
-
-// doubleRun — the same prose said twice. Every count doubles and so does the
-// character total, so every rate is unchanged and the score must come back
-// EXACTLY equal. This is the length-independence property at prose altitude: a
-// scorer that had drifted to absolute counts would double its penalties here.
-function doubleRun(turns) {
-  return [...turns, ...turns];
-}
-
-// asDetail — a run's replies as the per-turn digest shape scoreAccessibility
-// reads. The user turns are included because a real digest has them and
-// assistantProse must keep ignoring them; if it ever stopped, the prompts would
-// start scoring the builder's own words and every number here would move.
-function asDetail(corpus, replies, { transform } = {}) {
-  const detail = [];
-  let i = 0;
-  for (const { id, prompt } of corpus.prompts) {
-    detail.push({ i: i++, role: 'user', snippet: prompt });
-    const turns = replies[id] || [];
-    for (const snippet of transform ? transform(turns) : turns) {
-      detail.push({ i: i++, role: 'assistant', snippet });
-    }
-  }
-  return detail;
-}
-
-const TRANSFORMS = { terse: terseVariant, doubled: doubleRun };
-
-// replay — score one named run under one profile. `profile` defaults to the
-// run's own declared profile, which is the pairing the criterion asks about;
-// passing another is how leg 3 reads engineer prose as a newcomer would.
-function replay(corpus, runName, { profile, variant } = {}) {
-  const run = corpus.runs[runName];
-  if (!run) throw new Error(`no such run in the corpus: ${runName}`);
-  const transform = variant ? TRANSFORMS[variant] : undefined;
-  if (variant && !transform) throw new Error(`no such variant: ${variant}`);
-  const effective = profile || run.profile;
-  const result = scoreAccessibility(asDetail(corpus, run.replies, { transform }), { profile: effective });
-  return { run: runName, variant: variant || 'full', profile: effective, result };
-}
-
-// The partial engineer profile — thinks in code, new to the toolchain. Named
-// here because it is the pairing that shows the two waivers are independent.
-const ENGINEER_NEW_TO_TOOLCHAIN = Object.freeze({ technical_level: 'engineer', toolchain_familiarity: 'new' });
-
-function rows(corpus) {
-  const newcomer = corpus.runs.non_technical.profile;
-  return [
-    ['non-technical prose, non-technical profile', replay(corpus, 'non_technical')],
-    ['engineer prose, engineer profile', replay(corpus, 'engineer')],
-    ['engineer prose, NON-TECHNICAL profile', replay(corpus, 'engineer', { profile: newcomer })],
-    ['engineer prose, engineer but new to the terminal', replay(corpus, 'engineer', { profile: ENGINEER_NEW_TO_TOOLCHAIN })],
-    ['non-technical prose, said twice', replay(corpus, 'non_technical', { variant: 'doubled' })],
-    ['non-technical prose, first sentences only', replay(corpus, 'non_technical', { variant: 'terse' })],
-  ];
-}
-
-function fmt(n) {
-  return n == null ? '—' : n.toFixed(1);
-}
-
-function formatReport(corpus) {
-  const lines = [`accessibility replay — ${corpus.prompts.length} fixed beginner prompts, floor ${FLOOR.toFixed(1)}`, ''];
-  for (const [label, r] of rows(corpus)) {
-    const { score, band, sampled_chars: chars, sampled_turns: turns } = r.result;
-    const waived = r.result.signals.filter((s) => s.waived).length;
-    lines.push(
-      `  ${label.padEnd(48)} ${fmt(score).padStart(5)}  ${band.padEnd(9)} ` +
-        `${String(turns).padStart(3)} turns  ${String(chars).padStart(5)} chars  ${waived}/3 waived`
-    );
-    for (const s of r.result.signals) {
-      if (s.waived) continue;
-      if (!s.count) continue;
-      lines.push(
-        `      ${s.type.padEnd(28)} ${String(s.count).padStart(2)} hits  rate ${s.rate.toFixed(2)}/1k  −${s.penalty.toFixed(2)}`
-      );
-    }
-  }
-  return lines.join('\n');
-}
-
-// main — the CLI. `write` is injectable so the test can exercise both output
-// paths without printing a screenful of JSON into the test log.
-function main(argv = process.argv.slice(2), write = (s) => process.stdout.write(s)) {
-  const corpus = loadCorpus();
-  if (argv.includes('--json')) {
-    const out = { floor: FLOOR };
-    for (const [label, r] of rows(corpus)) out[label] = r.result;
-    write(`${JSON.stringify(out, null, 2)}\n`);
-    return 0;
-  }
-  write(`${formatReport(corpus)}\n`);
-  return 0;
-}
-
-module.exports = {
-  FLOOR,
-  CORPUS_PATH,
-  ENGINEER_NEW_TO_TOOLCHAIN,
-  loadCorpus,
-  terseVariant,
-  doubleRun,
-  asDetail,
-  replay,
-  rows,
-  formatReport,
-  bandFor,
-  main,
-};
-
-if (require.main === module) process.exit(main());
+require('../bongos/forwarder.js').forward(module, 'accessibility-replay.js');

package/scripts/gds/address-park-sweep.sh

@@ -1,91 +1,8 @@
 #!/usr/bin/env bash
-# scripts/gds/address-park-sweep.sh — park the addresses of projects torn down BEFORE
-# teardown learned to do it itself (task 1003947, the backfill half of task 1002897).
-#
-# WHY. Task 1002897 made a teardown remove its <slug>.caddy block and park its hostname
-# at the RFC 5737 blackhole. That only applies to teardowns run after the pin carries it,
-# so every earlier row still has its Caddy block proxying to a dead port and its A record
-# pointing at the platform: eleven hostnames answered 502 on 2026-09-16, while the hub
-# copy says "nothing answers there". This is that same teardown step, run once over the
-# ledger's torn-down rows. It does not re-run `provision.js teardown <slug>`, which would
-# rewrite each row's torn_down_at.
-#
-# The reserved-hostname rule, the zone and the apex come from the INSTALLED core (the
-# same helpers a teardown calls), so this sweep cannot disagree with what teardown parks.
-#
-# Run on the control plane as a sudoer:
-#   bash scripts/gds/address-park-sweep.sh            # survey only — read-only
-#   bash scripts/gds/address-park-sweep.sh --apply    # remove the snippets, reload Caddy, park the hostnames
-# Run from anywhere but an instance's own vendored core, set INSTANCE_DIR to that instance.
-#
-# Left in place on purpose, even with --apply: each project's database, dumps and checkout,
-# and the row's domain + port (ADR 0181 — a revive re-uses that address).
-set -uo pipefail
-
-APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
-DB="${PGDATABASE:-cloudbongos}"
-# The instance checkout and the account that owns it (task 1004135) — never a named person.
-# Run from an instance's vendored core, the checkout is three levels up (the rule
-# selfInstanceRoot() in provision-repo.js uses); from anywhere else it must be named. The
-# account is that checkout's owner unless PROVISION_APP_USER pins it; root holds no role here.
-CORE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-case "$CORE_DIR" in */node_modules/@bongos/core) INSTANCE_DIR="${INSTANCE_DIR:-${CORE_DIR%/node_modules/@bongos/core}}" ;; esac
-[ -n "${INSTANCE_DIR:-}" ] || { echo "set INSTANCE_DIR to the control plane's instance checkout — this sweep is not running from one"; exit 1; }
-# Owner by name: GNU stat spells it `-c %U`, BSD/macOS stat `-f %Su`, and each refuses the
-# other's flag, so GNU is asked first and BSD answers when it refuses (task 1004170).
-APP_USER="${PROVISION_APP_USER:-$(stat -c %U "$INSTANCE_DIR" 2>/dev/null || stat -f %Su "$INSTANCE_DIR" 2>/dev/null)}"
-if [ "$APP_USER" = root ] || ! [[ "$APP_USER" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]]; then
-  echo "cannot use '$APP_USER' as the app account — set PROVISION_APP_USER to the unprivileged account that owns $INSTANCE_DIR"; exit 1
-fi
-SITES="${PROVISION_CADDY_SNIPPET_DIR:-/etc/caddy/sites}"
-BOX_ENV="${BOX_ENV:-/etc/cloudbongos/box.env}"
-
-rows=$(sudo -n -u "$APP_USER" psql -d "$DB" -tAF '|' -c "select slug, coalesce(domain, '') from provisioning_instances where status='torn_down' order by slug" 2>/dev/null) \
-  || { echo "cannot read provisioning_instances from $DB as $APP_USER"; exit 1; }
-
-# slug|domain|zone|reserved|blackhole per row, plus an apex line — from the installed core.
-plan=$(sudo -n -u "$APP_USER" env ROWS="$rows" bash -c 'cd "$1" && exec node -' _ "$INSTANCE_DIR" <<'JS'
-const core = './node_modules/@bongos/core';
-const { isReservedHostname } = require(`${core}/modules/provisioning/provisioning.js`);
-const { dnsReleaseEnv } = require(`${core}/scripts/gds/provision-net.js`);
-const apex = require(`${core}/scripts/gds/instance-apex.js`).instanceApex();
-console.log(`apex|${apex || ''}`);
-for (const line of String(process.env.ROWS || '').split('\n').filter(Boolean)) {
-  const [slug, domain] = line.split('|');
-  const env = domain ? dnsReleaseEnv(domain) : { CLOUDFLARE_ZONE: '', BOX_IP: '' };
-  console.log(['row', slug, domain || '', env.CLOUDFLARE_ZONE, domain && isReservedHostname(domain, apex) ? 1 : 0, env.BOX_IP].join('|'));
-}
-JS
-) || { echo "cannot load the installed core from $INSTANCE_DIR"; exit 1; }
-
-apex=$(printf '%s\n' "$plan" | awk -F'|' '$1 == "apex" {print $2}')
-[ -n "$apex" ] || { echo "the installed core names no apex — refusing: the reserved-hostname guard would be blind"; exit 1; }
-echo "== torn-down rows still holding a Caddy block or an unparked address (apex $apex) =="
-
-left=(); reload=0
-while IFS='|' read -r kind slug domain zone reserved blackhole; do
-  [ "$kind" = "row" ] || continue
-  # The slug grammar provisioning.isValidSlug enforces; anything else never reaches a command.
-  [[ "$slug" =~ ^[a-z0-9]([a-z0-9-]*[a-z0-9])?$ ]] || continue
-  if [ -e "$SITES/$slug.caddy" ]; then
-    printf '  %-22s snippet %s\n' "$slug" "$SITES/$slug.caddy"
-    left+=("$slug:snippet")
-    if [ "$APPLY" = 1 ]; then sudo -n rm -f "$SITES/$slug.caddy" </dev/null && reload=1; fi
-  fi
-  [ -n "$domain" ] || continue
-  if [ "$reserved" = 1 ]; then printf '  %-22s %s is platform-reserved — never parked\n' "$slug" "$domain"; continue; fi
-  now=$(getent ahostsv4 "$domain" 2>/dev/null </dev/null | awk 'NR == 1 {print $1}')
-  [ -z "$now" ] || [ "$now" = "$blackhole" ] && continue
-  printf '  %-22s %s resolves to %s — park at %s (zone %s)\n' "$slug" "$domain" "$now" "$blackhole" "$zone"
-  left+=("$slug:dns")
-  [ "$APPLY" = 1 ] || continue
-  sudo -n -u "$APP_USER" bash -c 'set -a; . "$1"; set +a; BOX_HOSTNAME="$2" BOX_IP="$3" CLOUDFLARE_ZONE="$4" BOX_PROXIED=0 exec "$BOX_DNS_HOOK"' \
-    _ "$BOX_ENV" "$domain" "$blackhole" "$zone" </dev/null || echo "  ⚠ could not park $domain — re-run to retry"
-done <<< "$plan"
-
-[ "$reload" = 1 ] && { sudo -n systemctl reload caddy || echo "  ⚠ caddy reload failed — the removed blocks are still loaded"; }
-
-echo "== summary =="
-if [ "$APPLY" = 1 ]; then echo "  acted on (${#left[@]}): ${left[*]:-none}"; else echo "  left (${#left[@]}): ${left[*]:-none}"; fi
-if [ "$APPLY" = 1 ]; then echo "  (applied — re-run without --apply to confirm nothing is left; DNS may take a TTL to settle)";
-else echo "  (survey only — re-run with --apply to remove the snippets, reload Caddy and park the hostnames)"; fi
+# scripts/gds/address-park-sweep.sh — @bongos-forwarder (task 1004848). Generated by
+# scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+# The real script is scripts/bongos/address-park-sweep.sh. This forwarder keeps callers that still name
+# the old path working, and warns once so they get repointed. Task 1003706 removes it.
+if [ -z "${BONGOS_FORWARDER_WARNED:-}" ]; then echo "[bongos] scripts/gds/address-park-sweep.sh has moved to scripts/bongos/address-park-sweep.sh. This old path still works for now, but update whatever called it. The forwarders in scripts/gds/ are removed in a later release." >&2; fi
+export BONGOS_FORWARDER_WARNED=1
+exec bash "$(dirname "$0")/../bongos/address-park-sweep.sh" "$@"

package/scripts/gds/adopt-detect.js

@@ -1,123 +1,7 @@
 #!/usr/bin/env node
+// scripts/gds/adopt-detect.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/adopt-detect.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-// scripts/gds/adopt-detect.js — inspect an EXISTING repo tree so `bongos init --adopt`
-// fits what is already there instead of assuming the reference layout (ADR 0121
-// §Decision 4 / task 2043).
-//
-// WHY. Greenfield init writes into a blank slate. `--adopt` LAYERS onto a real repo,
-// so before it writes anything it must know the shape of that repo: language/runtime,
-// package manager, test + CI setup, source layout, and whether it already carries a
-// migrations dir / .claude/ / config/. This detection is the INPUT the later adopt
-// legs consume: real-state capture (task 2044) uses it to seed the right modules + the
-// interview, and the conflict pre-flight (task 2045) reads hasMigrations / ci / layout
-// to compute the blast radius (migration-namespace + CI-workflow collisions).
-//
-// It only READS (existsSync/readFileSync/readdirSync) — no writes, no network — so it
-// is safe to run first, and returns a plain data object (no I/O side effects) for the
-// caller to print and for 2044/2045 to consume. Every probe degrades to a negative
-// signal on a missing/unreadable file; detectStack never throws on repo contents.
-
-const nodeFs = require('node:fs');
-const nodePath = require('node:path');
-
-// A repo's package manager, inferred from its lockfile (the authoritative signal),
-// falling back to npm when a package.json exists with no lockfile at all.
-function detectPackageManager(exists, hasPkg) {
-  if (exists('pnpm-lock.yaml')) return 'pnpm';
-  if (exists('yarn.lock')) return 'yarn';
-  if (exists('bun.lockb')) return 'bun';
-  if (exists('package-lock.json')) return 'npm';
-  return hasPkg ? 'npm' : null;
-}
-
-// Detect the stack + layout of the repo rooted at `dir`. Pure but for the injected
-// (or default node) fs reads. Returns a structured summary.
-function detectStack({ dir, fs = nodeFs, path = nodePath } = {}) {
-  if (!dir) throw new Error('detectStack: dir is required');
-  const at = (rel) => path.join(dir, rel);
-  const exists = (rel) => { try { return fs.existsSync(at(rel)); } catch { return false; } };
-  const readJson = (rel) => { try { return JSON.parse(fs.readFileSync(at(rel), 'utf8')); } catch { return null; } };
-  const listDir = (rel = '.') => { try { return fs.readdirSync(at(rel)); } catch { return []; } };
-  const isDir = (rel) => { try { return fs.statSync(at(rel)).isDirectory(); } catch { return false; } };
-
-  const pkg = readJson('package.json');
-  const deps = { ...((pkg && pkg.dependencies) || {}), ...((pkg && pkg.devDependencies) || {}) };
-
-  // languages / runtime — the marker files each ecosystem leaves at the root.
-  const languages = [];
-  if (pkg || exists('tsconfig.json') || exists('jsconfig.json')) languages.push(exists('tsconfig.json') ? 'typescript' : 'javascript');
-  if (exists('requirements.txt') || exists('pyproject.toml') || exists('setup.py') || exists('Pipfile')) languages.push('python');
-  if (exists('go.mod')) languages.push('go');
-  if (exists('Cargo.toml')) languages.push('rust');
-  if (exists('Gemfile')) languages.push('ruby');
-  if (exists('pom.xml') || exists('build.gradle') || exists('build.gradle.kts')) languages.push('java');
-  if (exists('composer.json')) languages.push('php');
-  const runtime = pkg ? 'node' : exists('go.mod') ? 'go' : languages[0] || 'unknown';
-
-  // test frameworks — from deps, then config-file / marker probes for non-node stacks.
-  const testFrameworks = [];
-  for (const fw of ['jest', 'vitest', 'mocha', 'ava', 'jasmine', 'tap']) {
-    if (deps[fw]) testFrameworks.push(fw);
-  }
-  if (exists('pytest.ini') || exists('tox.ini') || deps.pytest) testFrameworks.push('pytest');
-  const hasTestScript = !!(pkg && pkg.scripts && pkg.scripts.test);
-
-  // CI systems — the workflow file(s) each CI reads.
-  const ci = [];
-  if (isDir('.github/workflows')) {
-    const workflows = listDir('.github/workflows').filter((f) => /\.ya?ml$/.test(f)).sort();
-    ci.push({ system: 'github-actions', workflows });
-  }
-  if (exists('.gitlab-ci.yml')) ci.push({ system: 'gitlab-ci' });
-  if (exists('.circleci/config.yml')) ci.push({ system: 'circleci' });
-  if (exists('Jenkinsfile')) ci.push({ system: 'jenkins' });
-  if (exists('azure-pipelines.yml')) ci.push({ system: 'azure-pipelines' });
-
-  // directory layout — top-level dirs minus dotdirs + node_modules; then the common
-  // source roots among them (so a later leg can fit the fitness boundary to reality).
-  const topLevelDirs = listDir('.')
-    .filter((n) => n !== 'node_modules' && !n.startsWith('.') && isDir(n))
-    .sort();
-  const sourceDirs = ['src', 'lib', 'app', 'source', 'packages', 'pkg', 'internal'].filter((d) => topLevelDirs.includes(d));
-
-  // pre-existing surfaces the pre-flight (2045) + layering (2042) care about.
-  const migrationsDirs = ['migrations', 'db/migrations', 'prisma/migrations', 'sql/migrations'].filter((d) => isDir(d));
-  const rootEntries = listDir('.').filter((n) => !n.startsWith('.'));
-
-  return {
-    runtime,
-    languages,
-    packageManager: detectPackageManager(exists, !!pkg),
-    hasPackageJson: !!pkg,
-    packageName: (pkg && pkg.name) || null,
-    testFrameworks,
-    hasTestScript,
-    ci,
-    topLevelDirs,
-    sourceDirs,
-    migrationsDirs,
-    hasMigrations: migrationsDirs.length > 0,
-    hasClaudeDir: exists('.claude'),
-    hasConfigDir: exists('config'),
-    isEmptyRepo: rootEntries.length === 0,
-  };
-}
-
-// Human-readable lines for the adopt report — one bullet each. Kept separate from
-// detectStack so the data + its display are independently testable.
-function formatStackSummary(s) {
-  const lines = [];
-  lines.push(`runtime: ${s.runtime}${s.languages.length ? ` (${s.languages.join(', ')})` : ''}`);
-  lines.push(`package manager: ${s.packageManager || 'none detected'}`);
-  lines.push(`tests: ${s.testFrameworks.length ? s.testFrameworks.join(', ') : s.hasTestScript ? 'test script present' : 'none detected'}`);
-  lines.push(`CI: ${s.ci.length ? s.ci.map((c) => c.system).join(', ') : 'none detected'}`);
-  lines.push(`source dirs: ${s.sourceDirs.length ? s.sourceDirs.join(', ') : s.topLevelDirs.length ? s.topLevelDirs.slice(0, 6).join(', ') : 'none'}`);
-  if (s.hasMigrations) lines.push(`migrations: ${s.migrationsDirs.join(', ')} (the pre-flight step will check for namespace collisions)`);
-  const carries = [];
-  if (s.hasClaudeDir) carries.push('.claude/');
-  if (s.hasConfigDir) carries.push('config/');
-  if (carries.length) lines.push(`already carries: ${carries.join(', ')} (layering leaves pre-existing files untouched)`);
-  return lines;
-}
-
-module.exports = { detectStack, detectPackageManager, formatStackSummary };
+require('../bongos/forwarder.js').forward(module, 'adopt-detect.js');

package/scripts/gds/adopt-import.js

@@ -1,111 +1,7 @@
 #!/usr/bin/env node
+// scripts/gds/adopt-import.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/adopt-import.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-// scripts/gds/adopt-import.js — import an existing repo's backlog into GDS tasks so
-// `bongos init --adopt` starts the ledger TRUTHFUL rather than empty (ADR 0121
-// §Decision 3 / task 2044). Sources, in precedence order:
-//   1. GitHub issues — the repo's OPEN issues (via a GitHub token the env supplies)
-//   2. a local backlog file — TODO / ROADMAP / BACKLOG (.md) at the repo root
-//   3. none — the owner captures tasks later (the real version + goal + kickoff still seed)
-//
-// Pure parsers + an injectable fetch keep it testable with no live network. Import is
-// best-effort: a failed/absent GitHub fetch falls through to the local file, and no
-// backlog at all is fine (the ledger still starts with the repo's REAL version/goal).
-
-const nodeFs = require('node:fs');
-const nodePath = require('node:path');
-
-const BACKLOG_FILENAMES = ['TODO.md', 'ROADMAP.md', 'BACKLOG.md', 'TODO', 'ROADMAP', 'BACKLOG'];
-const DEFAULT_MAX = 50; // don't flood a fresh ledger; cap the import + report the cap
-
-// PURE — parse a markdown backlog file into task candidates. Recognizes GitHub-style
-// checklist items (- [ ] / - [x]), plain bullet/numbered list items, and uses the
-// nearest preceding heading as light body context. Checked-off items ([x]) are DONE
-// and skipped (a backlog import wants open work). Returns [{ title, body }].
-function parseBacklogFile(text) {
-  const out = [];
-  let heading = '';
-  for (const raw of String(text == null ? '' : text).split(/\r?\n/)) {
-    const line = raw.trimEnd();
-    const h = line.match(/^#{1,6}\s+(.*)$/);
-    if (h) { heading = h[1].trim(); continue; }
-    // - [ ] item | - [x] done | - item | * item | 1. item
-    const m = line.match(/^\s*(?:[-*]|\d+\.)\s+(?:\[([ xX])\]\s+)?(.*\S)\s*$/);
-    if (!m) continue;
-    if (m[1] && m[1].toLowerCase() === 'x') continue; // checked off → done → skip
-    const title = m[2].trim();
-    if (!title) continue;
-    out.push({ title: title.slice(0, 200), body: heading ? `Imported from the repo backlog (under "${heading}").` : 'Imported from the repo backlog.' });
-  }
-  return out;
-}
-
-// Find the first recognized backlog file at the repo root. Returns its basename or null.
-function findBacklogFile(dir, fs = nodeFs, path = nodePath) {
-  for (const name of BACKLOG_FILENAMES) {
-    try {
-      const abs = path.join(dir, name);
-      if (fs.existsSync(abs) && fs.statSync(abs).isFile()) return name;
-    } catch { /* unreadable → skip */ }
-  }
-  return null;
-}
-
-// PURE — GitHub issues API array → task candidates. Filters out pull requests (the
-// issues endpoint returns PRs too, marked by a pull_request key) and non-open issues.
-function parseGitHubIssues(issues) {
-  if (!Array.isArray(issues)) return [];
-  return issues
-    .filter((i) => i && !i.pull_request && (i.state === undefined || i.state === 'open') && i.title)
-    .map((i) => ({ title: String(i.title).slice(0, 200), body: `Imported from ${i.html_url || `issue #${i.number}`}.`, number: i.number }));
-}
-
-// Fetch a repo's OPEN issues via the GitHub REST API. Injectable fetchImpl for tests.
-// Best-effort: any network/auth failure → [] + an onWarn note (never blocks the adopt).
-async function fetchGitHubIssues({ owner, repo, token, fetchImpl = globalThis.fetch, max = DEFAULT_MAX, onWarn = () => {} }) {
-  if (!owner || !repo || !token || typeof fetchImpl !== 'function') return [];
-  try {
-    const url = `https://api.github.com/repos/${owner}/${repo}/issues?state=open&per_page=${Math.min(max, 100)}`;
-    const res = await fetchImpl(url, { headers: { Authorization: `Bearer ${token}`, Accept: 'application/vnd.github+json', 'User-Agent': 'bongos-init-adopt' } });
-    if (!res || !res.ok) { onWarn(`GitHub issues fetch failed (${res ? res.status : 'no response'}) — falling back to a local backlog file`); return []; }
-    return parseGitHubIssues(await res.json()).slice(0, max);
-  } catch (e) {
-    onWarn(`GitHub issues fetch error (${e.message}) — falling back to a local backlog file`);
-    return [];
-  }
-}
-
-// Resolve the backlog from the best available source. Precedence: an EXPLICIT file the
-// owner named → GitHub issues → an auto-detected local file → none. Returns
-// { source, tasks:[{ title, kind, description }], truncated }.
-async function resolveBacklogTasks({ dir, repo = {}, githubToken, backlogFile, fetchImpl, fs = nodeFs, path = nodePath, max = DEFAULT_MAX, onWarn = () => {} } = {}) {
-  const toTasks = (cands) => cands.slice(0, max).map((t) => ({ title: t.title, kind: 'unclassified', description: t.body || '' }));
-  const readParse = (abs) => { try { return parseBacklogFile(fs.readFileSync(abs, 'utf8')); } catch { return []; } };
-
-  // 0. an explicit backlog file the owner named (path relative to dir, or absolute).
-  if (backlogFile) {
-    const abs = path.isAbsolute(backlogFile) ? backlogFile : path.join(dir, backlogFile);
-    const parsed = readParse(abs);
-    if (parsed.length) return { source: backlogFile, tasks: toTasks(parsed), truncated: parsed.length > max };
-    onWarn(`backlog file "${backlogFile}" was empty or unreadable — trying other sources`);
-  }
-
-  // 1. GitHub issues (only when we have both a token and the repo coordinates)
-  if (githubToken && repo.owner && repo.name) {
-    const gh = await fetchGitHubIssues({ owner: repo.owner, repo: repo.name, token: githubToken, fetchImpl, max, onWarn });
-    if (gh.length) return { source: 'github-issues', tasks: toTasks(gh), truncated: gh.length >= max };
-  }
-
-  // 2. local backlog file
-  const file = findBacklogFile(dir, fs, path);
-  if (file) {
-    let text = '';
-    try { text = fs.readFileSync(path.join(dir, file), 'utf8'); } catch { /* unreadable → empty */ }
-    const parsed = parseBacklogFile(text);
-    if (parsed.length) return { source: file, tasks: toTasks(parsed), truncated: parsed.length > max };
-  }
-
-  // 3. none — the version + goal + kickoff still seed; the owner captures tasks later
-  return { source: 'none', tasks: [], truncated: false };
-}
-
-module.exports = { parseBacklogFile, findBacklogFile, parseGitHubIssues, fetchGitHubIssues, resolveBacklogTasks, BACKLOG_FILENAMES, DEFAULT_MAX };
+require('../bongos/forwarder.js').forward(module, 'adopt-import.js');