@bongos/core 1.21.175 → 1.21.176

package/scripts/gds/fitness-checks-identity.js

@@ -1,343 +1,6 @@
-// scripts/gds/fitness-checks-identity.js — the checks that keep the portable core
-// free of any one host's identity: kernel prompts (BV1.R76), the neutral config
-// packs (BV1.R102) and the design contract.
-//
-// Carved out of scripts/gds/fitness.js by task 1003206 (goal 1000079, the R03
-// de-monolith plan) to bring that file under the 1,500-line ratchet. A STRUCTURAL
-// move: the lines below are fitness.js's originals unchanged, and fitness.js
-// imports every name straight back, so the CHECKS registry and the module's
-// public surface (which the tests read heavily) are untouched.
-
+// scripts/gds/fitness-checks-identity.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/fitness-checks-identity.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-const { CORE_ROOT, MODULE_ROOTS, REPO_ROOT, rel } = require('./fitness-lib.js');
-
-// ============================================================================
-// Check 13 — portable code carries no hardcoded host-brand identity (BV1.R76 + task 1705)
-// ============================================================================
-//
-// The portable core (src/bongos/**) and every feature MODULE (modules/**) must read
-// the instance's product/world name + domains from branding() / window.__BRANDING__,
-// never a baked-in "Off the Boats" / "Amazonprimea" / apex domain (ADR 0062 §3/§5;
-// the branding contract). R76 shipped this as an 8-FILE allowlist over the kernel
-// LLM-prompt headers; task 1705 WIDENS it to a directory-wide scan, so ANY new brand
-// leak in portable code reds the build — not just the nine files someone remembered
-// to list. (The 2026-07-02 separation audit found five leaks the old allowlist missed:
-// the rank/graduation broadcasts, the auth error-page title, the apex-origin default,
-// and ~124 served-UI strings.) Comments are stripped first (block /* */, HTML
-// <!-- -->, and JS // line comments via a `://`-safe strip so a URL is never
-// truncated) because the de-brand rationale legitimately names the old literals in
-// prose. Instance-injected placeholders ({{worldName}} etc.) carry no literal, so
-// they pass untouched.
-//
-// EXCLUDED — the small instance-1 / ops allowlist (task 1705):
-//   - modules/game/**  — the INSTANCE'S OWN PRODUCT. A product's identity is
-//     instance-specific by definition (a vanilla instance ships a different product,
-//     or none); it is not portable-platform code the branding pack can neutralize.
-//     A documented carve-out, not an oversight.
-//   - generated / build-output dirs (no authored source).
-const PROMPT_IDENTITY_LITERALS = [
-  /off the boats/i,
-  /amazonprimea/i,
-  // The host's operating company (task 1002853): the scan already covered the status
-  // page's HTML, but with only the product listed its footer credited this company for years.
-  /hermeslines/i,
-];
-// Scan roots (recursive) + kernel-prompt CLIs that live outside them.
-// scripts/gds joined at task 1002427: the builder CLI was UNSCANNED, which is how
-// paste-token.js kept a hardcoded 'https://amazonprimea.com' long after the task
-// 1002201 sweep replaced that literal everywhere else. The straggler surfaced as a
-// 401 that locked a builder out of re-authenticating — a valid token verified
-// against the wrong host — and nothing in CI could see it (idea 1000564).
-// Widened scripts/gds → ALL of scripts/ at task 1002756: migrate.sh's hardcoded
-// founder DB default (task 1002755) survived every gate because the detector never
-// saw the file — a gate that cannot see the file class the bug lives in is worse
-// than no gate, because it is trusted.
-const IDENTITY_SCAN_ROOTS = ['src/bongos', 'modules', 'scripts'];
-const IDENTITY_SCAN_EXTRA_FILES = [];
-// PERMANENT, COUNTED carve-outs for the scripts/gds root — {file: allowed hits}.
-//
-// Widening the root (task 1002427) surfaced 23 files. Task 1002428 swept them:
-// every one whose literal was a real runtime bug is FIXED (a wrong instance URL
-// printed to a builder, an `amazonprimea-*` User-Agent that should come from
-// branding().userAgent(), a hardcoded product name in user-facing copy). What is
-// left below is NOT a backlog — each entry is a literal that is CORRECT as
-// written, so this list is permanent rather than a ratchet-to-zero.
-//
-// The COUNT is still enforced, which is the point: an entry may not grow. A file
-// here that gains a NEW hardcoded host fails the build exactly like an unlisted
-// one, and any file NOT listed must have zero hits. Getting better never fails.
-//
-// Why each is legitimate:
-//   * publish-manifest.js — the literal FILENAMES of three real committed docs
-//     (the two decouple recipes, plus the instance's own name/trademark ADR that
-//     task 1003869 excluded: its prose redacts cleanly but the FILENAME rides in
-//     the published manifest). Renaming the strings without renaming the files
-//     would break the publish manifest.
-//   * backfill-sessions.js / version-close.js — one-time operator runbook text
-//     naming the actual prod DB + a historical local directory. Describing what
-//     an operator must literally type is the correct content.
-//   * seed-*.js — the hits are PROSE INSIDE seeded task descriptions: historical
-//     records of what those tasks said when they were filed. Rewriting them would
-//     falsify the record; deleting the files would destroy it. They are inert
-//     (idempotent on source_ref) and referenced only by generated manifests.
-//   * the four *.sh entries — surfaced when `.sh` joined the extension set (task
-//     1002567). Each is a HOST-PINNED OPS script, not portable code: they name the
-//     live box's actual Postgres database/role and its actual /etc secrets dir, and
-//     every one of those literals is already only the DEFAULT behind an env override
-//     (GDS_BACKUP_DB, PROD_DB/STAGING_DB, PG_SOCKET). Each is an infrastructure
-//     identifier, not an instance URL, and the systemd
-//     units on that box invoke these by path. Re-pointing an instance's backups is
-//     deployment work, not a branding read. Their COUNT is still frozen here, so a
-//     NEW literal in any of them fails exactly like one in an unlisted file.
-//   * fitness-checks-identity.js / package-core.js — THE DETECTORS THEMSELVES: Check 13's regexes
-//     and package-core's PRIOR_INSTANCE_FLOOR name the brand because hunting it is
-//     their job. * seed-v3-tasks.js — the seeded-task-prose rationale above. All
-//     three passed pre-1002756 only by the old stripper's accidents (phantom
-//     blocks + regex-blindness); now they are seen and counted.
-const IDENTITY_SCAN_ALLOWED = {
-  // task 1003206 moved Check 13's own regexes out of fitness.js into THIS file
-  // when the monolith was split, so the detector's self-carve-out moved with them.
-  'scripts/gds/fitness-checks-identity.js': 3,
-  'scripts/gds/package-core.js': 1,
-  // audit-replay.sh + db-backup-{nightly,offsite}.sh were carved out here as
-  // "host-pinned ops"; task 1002757 RETIRED that justification for them — each
-  // now resolves its database from the branding pack (the migrate.sh pattern) and
-  // fails loudly rather than defaulting, so their counts ratcheted to zero and the
-  // entries are gone. seed-staging.sh keeps its carve-out on the OPPOSITE
-  // rationale: its literal is a fail-CLOSED safety interlock (the script wipes
-  // STAGING_DB and refuses unless the name matches exactly), so on any other
-  // instance it declines to run instead of destroying the wrong database.
-  'scripts/gds/seed-staging.sh': 4,
-  'scripts/gds/backfill-sessions.js': 2,
-  'scripts/gds/publish-manifest.js': 3,
-  'scripts/gds/seed-bongos-coreB-tranche1-tasks.js': 1,
-  'scripts/gds/seed-bongos-coreB-tranche2-tasks.js': 1,
-  'scripts/gds/seed-bongos-goal-hierarchy-tasks.js': 1,
-  'scripts/gds/seed-bongos-tasks.js': 1,
-  'scripts/gds/seed-gds-v4-tasks.js': 1,
-  'scripts/gds/seed-medusa-tasks.js': 7,
-  'scripts/gds/seed-module-upstreaming.js': 1,
-  'scripts/gds/seed-productization-tasks.js': 6,
-  'scripts/gds/seed-provisioning-tasks.js': 2,
-  'scripts/gds/version-close.js': 1,
-  // task 1002853 (the company literal joined the list): audit-authorship.sh is itself a
-  // detector — its ops allowlist names the founder's commit address so it can exempt it; grade-smoke.js
-  // is a protected grader probe whose fixture task prose names the company, the seed-*.js rationale.
-  'scripts/gds/audit-authorship.sh': 1,
-  'scripts/gds/grade-smoke.js': 1,
-};
-// `.sh` joined at task 1002567: the extension set was `.js/.html/.css`, so NO shell
-// script had ever been scanned — which is how scripts/gds/lib.sh kept a hardcoded
-// founder host as its API-base default (and a hardcoded ~/.config/otb token path)
-// through the entire task 1002201 sweep, leaving all five bash smokes dead on any
-// instance with a different configDir. The guard could not see the file class the
-// bug lived in.
-const IDENTITY_SCAN_EXTS = new Set(['.js', '.html', '.css', '.sh']);
-// Path-prefix carve-outs (see the header note). Kept SMALL and documented.
-const IDENTITY_SCAN_EXCLUDE = ['modules/game/'];
-// Directories with no authored source to gate.
-const IDENTITY_SCAN_SKIP_DIRS = new Set(['node_modules', '.git', 'generated', 'iterations', 'references']);
-
-// Comment stripping lives in identity-strip.js (task 1002756: extracted + replaced
-// the two-regex JS strip, which a `/*` inside a `//` comment could OPEN — it
-// silently hid ~330 provision.js lines from this gate). Re-exported for the tests.
-const { stripCommentsForIdentity } = require('./identity-strip');
-
-// An APEX-ONLY region is content the server DELETES on every instance that is not
-// the hub (`stripApexOnly`, src/platform-server.js — ADR 0152; the front door became
-// a module in ADR 0218, which is what first brought these pages under this gate).
-// This check exists so "a non-OTB instance renders ITS OWN brand"; text inside these
-// sentinels never reaches a non-hub instance at all, so it cannot produce that
-// failure. The hub's own landing legitimately NAMES the projects hosted on it, and
-// that catalog is exactly what the sentinels wrap.
-//
-// BLANKED, not removed, so a violation's reported line number still points at the
-// real line. Applied BEFORE the comment strip, which would otherwise eat the
-// sentinels (they are HTML comments) and take the region's boundaries with them.
-const APEX_ONLY_REGION = /<!--apex-only:start-->[\s\S]*?<!--apex-only:end-->/g;
-function blankApexOnly(text) {
-  return String(text).replace(APEX_ONLY_REGION, (m) => m.replace(/[^\n]/g, ' '));
-}
-
-// Pure: scan one file's comment-stripped source for a hardcoded host-brand literal.
-// Returns violation strings. Exported for the "actually catches a re-hardcode" test.
-function scanPromptIdentity(relFile, text, ext = path.extname(relFile)) {
-  const violations = [];
-  stripCommentsForIdentity(blankApexOnly(text), ext).split('\n').forEach((raw, i) => {
-    if (!raw.trim()) return;
-    for (const re of PROMPT_IDENTITY_LITERALS) {
-      const m = raw.match(re);
-      if (m) {
-        violations.push(`${relFile}:${i + 1} hardcodes the host-brand identity "${m[0]}" — read it from branding()/window.__BRANDING__ (identity/domains/currency), or use a {{worldName}}-style token, so a non-OTB instance renders ITS OWN brand (ADR 0062 §3/§5; BV1.R76 / task 1705).`);
-        break; // one hit per line is enough
-      }
-    }
-  });
-  return violations;
-}
-
-// Recursively collect scannable files under one root, honoring the skip-dir + carve-out lists.
-function collectIdentityFiles(absRoot, relRoot) {
-  const out = [];
-  let entries;
-  try { entries = fs.readdirSync(absRoot, { withFileTypes: true }); }
-  catch { return out; }
-  for (const e of entries) {
-    const rel = relRoot ? `${relRoot}/${e.name}` : e.name;
-    if (e.isDirectory()) {
-      if (IDENTITY_SCAN_SKIP_DIRS.has(e.name)) continue;
-      if (IDENTITY_SCAN_EXCLUDE.some((p) => `${rel}/`.startsWith(p))) continue;
-      out.push(...collectIdentityFiles(path.join(absRoot, e.name), rel));
-    } else if (IDENTITY_SCAN_EXTS.has(path.extname(e.name))
-               && !IDENTITY_SCAN_EXCLUDE.some((p) => rel.startsWith(p))) {
-      out.push(rel);
-    }
-  }
-  return out;
-}
-
-function checkKernelPromptsNoHardcodedIdentity() {
-  const violations = [];
-  let scanned = 0;
-  // Collect {abs, rel}: src/bongos is CORE; modules ship from BOTH roots (ADR 0108 §Consequences #4).
-  // Dedup by repo-relative path so a shared checkout never scans a file twice, and read each file
-  // from the root it was actually found under (a module may live in the instance repo post-split).
-  const seen = new Set();
-  const entries = [];
-  const addFrom = (rootAbs, sub) => {
-    for (const relFromRoot of collectIdentityFiles(path.join(rootAbs, sub), sub)) {
-      if (seen.has(relFromRoot)) continue;
-      seen.add(relFromRoot);
-      entries.push({ abs: path.join(rootAbs, relFromRoot), rel: relFromRoot });
-    }
-  };
-  for (const root of IDENTITY_SCAN_ROOTS) {
-    for (const rootAbs of (root === 'modules' ? MODULE_ROOTS : [CORE_ROOT])) addFrom(rootAbs, root);
-  }
-  for (const extra of IDENTITY_SCAN_EXTRA_FILES) {
-    if (!seen.has(extra)) { seen.add(extra); entries.push({ abs: path.join(CORE_ROOT, extra), rel: extra }); }
-  }
-  let ratcheted = 0;
-  for (const { abs, rel: relFile } of entries) {
-    let text;
-    try { text = fs.readFileSync(abs, 'utf8'); }
-    catch { continue; } // a file moved/carved away is not a failure of this gate
-    scanned += 1;
-    const found = scanPromptIdentity(relFile, text);
-    // Permanently allowed at a COUNT (task 1002428): the listed literals are
-    // correct as written, but an entry may not GROW — a new hardcode in one of
-    // these files fails exactly like one in an unlisted file.
-    const allowed = IDENTITY_SCAN_ALLOWED[relFile];
-    if (allowed !== undefined) {
-      if (found.length > allowed) {
-        violations.push(
-          `${relFile} now hardcodes the host-brand identity ${found.length} time(s), above its allowed ${allowed} — ` +
-          `the carve-out covers the EXISTING literals (see IDENTITY_SCAN_ALLOWED), not new ones. ` +
-          `Read the host from branding()/window.__BRANDING__ instead (task 1002428).`
-        );
-      } else {
-        ratcheted += 1;
-      }
-      continue;
-    }
-    violations.push(...found);
-  }
-  return {
-    name: 'portable code carries no hardcoded host identity (BV1.R76 / task 1705)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: `${scanned} portable source file(s) scanned (.js/.html/.css/.sh under src/bongos/** + modules/** + scripts/** (whole root, task 1002756), minus the instance-1 product + generated dirs) — none may hardcode the host brand; identity comes from branding()/window.__BRANDING__ (ADR 0062 §3/§5). ${ratcheted} scripts/gds file(s) hold documented permanent carve-outs (real DNS zones, real doc filenames, operator runbook text, historical seeded prose) capped at a count they may not exceed — task 1002428.`,
-  };
-}
-
-// ============================================================================
-// Check 15b — core-shipped NEUTRAL config packs carry no host identity (BV1.R102)
-// ============================================================================
-//
-// Sibling of Check 15 for the CONFIG class. IDENTITY_SCAN_EXTS is js/html/css, so
-// the scan above never opens a .json — yet config/*.neutral.json is precisely what
-// a vanilla instance boots from (branding R76, governance R96). A host name leaking
-// into a neutral pack ships one instance's brand to EVERY fresh instance, and until
-// this check nothing in CI could see it.
-//
-// Only the NEUTRAL packs are scanned, deliberately: an instance pack (config/
-// branding.json, config/government.json) is host content that legitimately names
-// its host, and is boundary-excluded from the published core anyway.
-function checkNeutralConfigsNoHostIdentity() {
-  const violations = [];
-  const dir = path.join(CORE_ROOT, 'config');
-  let names = [];
-  try { names = fs.readdirSync(dir).filter((n) => n.endsWith('.neutral.json')).sort(); }
-  catch { /* no config/ dir in this root — nothing to gate */ }
-  for (const name of names) {
-    const relFile = `config/${name}`;
-    let text;
-    try { text = fs.readFileSync(path.join(dir, name), 'utf8'); }
-    catch { continue; } // a pack that moved away is not a failure of this gate
-    violations.push(...scanPromptIdentity(relFile, text, '.json'));
-  }
-  return {
-    name: 'neutral config packs carry no host identity (BV1.R102)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: `${names.length} core-shipped config/*.neutral.json pack(s) scanned — a vanilla instance boots from these alone, so none may name a host brand. Instance packs (config/<name>.json) are host content and are deliberately NOT scanned.`,
-  };
-}
-
-// ---- design contract (ADR 0081 / task 1377) --------------------------------
-
-function checkDesignContract() {
-  const { spawnSync } = require('node:child_process');
-  // The validator + adapters live in the ui-design module (task 1003324, ADR 0197);
-  // scripts/gds/validate-design.js is a shim over the module file spawned here.
-  const validatorPath = path.join(REPO_ROOT, 'modules', 'ui-design', 'scripts', 'validate-design.js');
-  const adaptersDir = path.join(REPO_ROOT, 'modules', 'ui-design', 'adapters');
-  const hasAdapters = (() => {
-    try { return fs.readdirSync(adaptersDir).some((e) => fs.statSync(path.join(adaptersDir, e)).isDirectory()); }
-    catch { return false; }
-  })();
-
-  const result = spawnSync(process.execPath, [validatorPath, '--json'], { encoding: 'utf8' });
-  let report = { ok: true, errors: [], warnings: [] };
-  try { report = JSON.parse(result.stdout || '{}'); } catch { /* fall through with defaults */ }
-  if (result.status !== 0 && !report.errors.length) {
-    report.errors.push(result.stderr ? result.stderr.trim() : 'validate-design.js exited non-zero');
-    report.ok = false;
-  }
-
-  return {
-    name: 'design contract valid (modules/ui-design/docs/design-contract.md / ADR 0081)',
-    ok: report.ok,
-    hardFail: !report.ok && hasAdapters,
-    violations: report.errors || [],
-    warnings: report.warnings || [],
-    note: hasAdapters
-      ? 'Hard-fail: adapters present — contract must be valid. Run: node scripts/gds/validate-design.js'
-      : 'Warn-only until first adapter lands (task 1378 / task 1379). Run: node scripts/gds/validate-design.js',
-  };
-}
-
-
-module.exports = {
-  IDENTITY_SCAN_ALLOWED,
-  IDENTITY_SCAN_EXCLUDE,
-  IDENTITY_SCAN_EXTRA_FILES,
-  IDENTITY_SCAN_EXTS,
-  IDENTITY_SCAN_ROOTS,
-  IDENTITY_SCAN_SKIP_DIRS,
-  PROMPT_IDENTITY_LITERALS,
-  checkDesignContract,
-  checkKernelPromptsNoHardcodedIdentity,
-  checkNeutralConfigsNoHostIdentity,
-  collectIdentityFiles,
-  scanPromptIdentity,
-  stripCommentsForIdentity,
-  blankApexOnly,           // ADR 0218 — apex-only regions never reach a child instance (tested)
-};
+require('../bongos/forwarder.js').forward(module, 'fitness-checks-identity.js');

package/scripts/gds/fitness-checks-packaging.js

@@ -1,132 +1,6 @@
-// scripts/gds/fitness-checks-packaging.js — Checks 16 + 16b: core code must not
-// HARD-require a boundary-EXCLUDED config or module.
-//
-// Carved out of scripts/gds/fitness.js by task 1003825, on the task-1003192
-// precedent. That file had returned to the 1,500-line ratchet with ONE line of
-// headroom (1,499 of 1,500, fitness-ratchets.js OVERSIZE_LINES), so the next check
-// registered there would have tipped it over and redded the ratchet for whoever
-// wrote it. These two checks left together because they are one subject — the same
-// question asked of a config and of a module — and because the pair depends only on
-// CORE_ROOT / rel / walkJs / walkJsAllRoots, all already public on fitness-lib.js,
-// so the carve adds no import cycle.
-//
-// fitness.js requires both names straight back, so the CHECKS registry and the
-// module surface the tests read are unchanged.
-
+// scripts/gds/fitness-checks-packaging.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/fitness-checks-packaging.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-const { CORE_ROOT, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
-// ============================================================================
-// Check 16 — core code must not HARD-require an instance-excluded config/*.json
-// ============================================================================
-//
-// A vanilla self-host boot ships only the PUBLISHABLE tree (publish-manifest.js). An
-// instance-only config (config/bongos-cli.json, config/branding.json,
-// config/modules.json, …) is boundary-EXCLUDED, so a bare `require('../../config/<excluded>.json')`
-// in core code throws MODULE_NOT_FOUND and CRASHES the boot on a fresh instance — the exact
-// class that shipped in R88 (two hard-requires in src/bongos/serve-internal.js; task 1824). The
-// cure is to READ the config instead of requiring it, tolerating a missing file
-// (tryLoadInstanceConfig in src/bongos/serve-internal.js / fs.existsSync → fail-to-vanilla), which
-// also drops the require() literal so it no longer matches here. Check 1 (core↔host) scans
-// code→code IMPORTS and misses this code→config class. Only an EXCLUDED config is a violation;
-// a publishable neutral.*/schema config (which ships with the core) is fine.
-const CONFIG_REQUIRE_RE = /require\(\s*['"]([^'"]*config\/[^'"]*\.json)['"]\s*\)/g;
-
-function checkCoreRequiresExcludedConfig() {
-  const { isPublishable } = require('./publish-manifest');
-  const violations = [];
-  // src/ + scripts/ are CORE; modules ship from BOTH roots (ADR 0108 §Consequences #4). Dedup by
-  // repo-relative path so a shared checkout scans each file once.
-  const seen = new Set();
-  const allAbs = [
-    ...['src', 'scripts'].flatMap((d) => walkJs(path.join(CORE_ROOT, d))),
-    ...walkJsAllRoots('modules'),
-  ];
-  for (const abs of allAbs) {
-    const relFile = rel(abs);
-    if (seen.has(relFile)) continue;
-    seen.add(relFile);
-    if (!isPublishable(relFile)) continue; // only CORE (publishable) code can crash a vanilla boot
-    for (const raw of fs.readFileSync(abs, 'utf8').split('\n')) {
-      const trimmed = raw.trim();
-      if (trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*')) continue;
-      let m;
-      CONFIG_REQUIRE_RE.lastIndex = 0;
-      while ((m = CONFIG_REQUIRE_RE.exec(raw))) {
-        const relCfg = rel(path.resolve(path.dirname(abs), m[1]));
-        if (!isPublishable(relCfg)) {
-          violations.push(`${relFile} → require('${m[1]}') hard-requires an instance-excluded config (${relCfg}) — guard the read (tryLoadInstanceConfig in src/bongos/serve-internal.js / fs.existsSync, fail-to-vanilla) so a fresh core boots (task 1824).`);
-        }
-      }
-    }
-  }
-  return {
-    name: 'core never hard-requires an excluded config (task 1824)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: "a publishable src/·scripts/·modules/ .js must not require('…config/X.json') when X.json is boundary-excluded — guard the read so a vanilla core boots.",
-  };
-}
-
-// ============================================================================
-// Check 16b — core code must not require an instance-EXCLUDED module (task 2135)
-// ============================================================================
-//
-// Sibling of Check 16 for the code→MODULE class. A publishable core file that
-// require()s a boundary-EXCLUDED module (modules/game, modules/art-pipeline,
-// modules/character-anim, …) throws MODULE_NOT_FOUND once that module lives in the
-// consumer's instance repo rather than the core package (R89 split). The cure is
-// either to reclassify the module INTO core (if it belongs there — e.g. provisioning)
-// or to exclude the requiring file with the feature it serves (art tooling).
-// Catches BOTH require forms: a direct literal
-// require('../modules/<key>/…') AND a require(path.join(<root>, 'modules/<key>/…')).
-// Only an EXCLUDED module required from a PUBLISHABLE file is a violation; requiring a
-// publishable (core) module is fine, and the loader's DYNAMIC dispatch
-// (path.join(dir,'routes',rk) — no literal modules/<key>/ string) is invisible here.
-const MODULE_PATH_IN_STRING_RE = /['"](?:[^'"]*\/)?modules\/([a-z0-9][a-z0-9-]*)\/[^'"]*['"]/g;
-
-function checkCoreRequiresExcludedModule() {
-  const { isPublishable } = require('./publish-manifest');
-  const violations = [];
-  const seen = new Set();
-  const allAbs = [
-    ...['src', 'scripts'].flatMap((d) => walkJs(path.join(CORE_ROOT, d))),
-    ...walkJsAllRoots('modules'),
-  ];
-  for (const abs of allAbs) {
-    const relFile = rel(abs);
-    if (seen.has(relFile)) continue;
-    seen.add(relFile);
-    if (!isPublishable(relFile)) continue; // only CORE (publishable) code can crash a vanilla boot
-    for (const raw of fs.readFileSync(abs, 'utf8').split('\n')) {
-      const trimmed = raw.trim();
-      if (trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*')) continue;
-      if (!/require\s*\(/.test(raw)) continue; // only lines that actually require()
-      let m;
-      MODULE_PATH_IN_STRING_RE.lastIndex = 0;
-      while ((m = MODULE_PATH_IN_STRING_RE.exec(raw))) {
-        const key = m[1];
-        if (isPublishable(`modules/${key}/module.json`)) continue; // requiring a CORE module is fine
-        violations.push(`${relFile} → require(...'modules/${key}/…') pulls in an instance-EXCLUDED module — reclassify it into core (if it belongs there) or exclude ${relFile} with the feature it serves, so a fresh core boots (task 2135).`);
-      }
-    }
-  }
-  return {
-    name: 'core never requires an excluded module (task 2135)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: "a publishable src/·scripts/·modules/ .js must not require('…modules/<key>/…') when that module is boundary-excluded — MODULE_NOT_FOUND post-split (R89).",
-  };
-}
-
-module.exports = {
-  checkCoreRequiresExcludedConfig,
-  checkCoreRequiresExcludedModule,
-};
+require('../bongos/forwarder.js').forward(module, 'fitness-checks-packaging.js');

package/scripts/gds/fitness-checks-route-pins.js

@@ -1,76 +1,6 @@
-// scripts/gds/fitness-checks-route-pins.js — Check 4b (task 1003192): every
-// MODULE_EXPECTED_RANKS key names a real module directory.
-//
-// Carved out of scripts/gds/fitness.js on the task-1003206 precedent (the R03
-// de-monolith plan): that file sits against the 1,500-line ratchet with two lines
-// of headroom, so a new check lands here rather than tipping it over. fitness.js
-// imports the name straight back, so the CHECKS registry and the module's public
-// surface — which the tests read heavily — are unchanged.
-//
-// WHY THE CHECK EXISTS. src/bongos/route-rank-check.js pins the expected rank of
-// each privileged module route, but pin SCOPE derives from successfully-classified
-// routes: a MODULE_EXPECTED_RANKS key matching no discovered module is dropped and
-// its pins pass VACUOUSLY, while the loader keeps mounting modules/<key>/routes/ in
-// production by the same convention the scan discovers them by. Measured on the real
-// classifier: with modules/security/ renamed, all six security pins went inert and a
-// POST /security/reports downgraded to any-builder drew zero findings — a pinned
-// privileged WRITE route silently unguarded.
-//
-// THIS IS THE SOURCE-REPO HALF of a two-layer guard. checkRouteRanks fires when a
-// module directory is PRESENT but contributed no route (a rename/move under a live
-// module); it deliberately stays silent on a wholly absent directory, because it runs
-// on every ship and an instance may legitimately omit an optional module. Here every
-// module is expected to exist, so a whole-directory rename or a typo'd key — neither
-// of which the other layer can see — hard-fails. The governance→government rename had
-// to hand-carry double-keyed pins precisely because nothing mechanical caught this.
-
+// scripts/gds/fitness-checks-route-pins.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/fitness-checks-route-pins.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-const { REPO_ROOT } = require('./fitness-lib.js');
-const { checkRouteRanks, MODULE_EXPECTED_RANKS } = require('../../src/bongos/route-rank-check');
-
-// ============================================================================
-// Check 4 — no route bypasses server-side rank checks (ADR 0016)  [reuses route-rank-check]
-// ============================================================================
-// Moved here with Check 4b (task 1003192): the two are the same subject — Check 4 asks
-// whether each route carries a gate, 4b whether the pins that assert those gates are
-// actually in scope — and keeping them together is what buys fitness.js headroom against
-// the 1,500-line ratchet instead of leaving it sitting exactly on the cap.
-function checkRankGuards() {
-  const r = checkRouteRanks();
-  // hardFail = an ungated WRITE route or a downgraded privileged route. Unclassified read routes
-  // are 'concerns' (the Hacker adjudicates intent) — surfaced as warnings, not a hard failure.
-  const violations = r.findings.filter((f) => f.severity === 'blocker').map((f) => `${f.route} (${f.file}) — ${f.summary}`);
-  const warnings = r.findings.filter((f) => f.severity !== 'blocker').map((f) => `${f.route} (${f.file}) — ${f.summary}`);
-  return { name: 'route rank guards (ADR 0016)', ok: !r.hardFail, hardFail: r.hardFail, violations, warnings, note: `${r.routeCount} routes classify to a known rank; no ungated writes, no privileged downgrades.` };
-}
-
-// ============================================================================
-// Check 4b — module rank-pin keys resolve to a real modules/<key>/ dir
-// ============================================================================
-function checkModulePinKeysResolve() {
-  const violations = [];
-  for (const key of Object.keys(MODULE_EXPECTED_RANKS)) {
-    if (!fs.existsSync(path.join(REPO_ROOT, 'modules', key))) {
-      violations.push(`MODULE_EXPECTED_RANKS.${key} names no modules/${key}/ directory — its `
-        + `${Object.keys(MODULE_EXPECTED_RANKS[key]).length} rank pin(s) are INERT and pass vacuously `
-        + '(src/bongos/route-rank-check.js). Rename the key to the module\'s current directory, or drop the entry.');
-    }
-  }
-  return {
-    name: 'module rank-pin keys resolve (task 1003192)',
-    ok: violations.length === 0,
-    hardFail: violations.length > 0,
-    violations,
-    warnings: [],
-    note: `${Object.keys(MODULE_EXPECTED_RANKS).length} module pin blocks all name a live modules/<key>/ directory.`,
-  };
-}
-
-module.exports = {
-  checkRankGuards,
-  checkModulePinKeysResolve,
-};
+require('../bongos/forwarder.js').forward(module, 'fitness-checks-route-pins.js');