@bongos/core 1.21.175 → 1.21.176

package/tests/artifact_staleness.mjs

@@ -1,6 +1,6 @@
 // tests/artifact_staleness.mjs
 //
-// Covers scripts/gds/artifact-staleness.js (task 1001930, ADR 0110 pt.5) — the backstop
+// Covers scripts/bongos/artifact-staleness.js (task 1001930, ADR 0110 pt.5) — the backstop
 // for the gitignored, deploy-generated navigation docs.
 //
 // ADR 0110 untracked docs/repo-map.md + docs/session-log-index.md to kill a merge-collision
@@ -27,7 +27,7 @@ import { createRequire } from 'node:module';
 import { readFileSync, readdirSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
-const { ARTIFACTS, atMain, checkArtifact, check, report } = require('../scripts/gds/artifact-staleness.js');
+const { ARTIFACTS, atMain, checkArtifact, check, report } = require('../scripts/bongos/artifact-staleness.js');
 
 const SHA = 'a'.repeat(40);
 const OTHER = 'b'.repeat(40);
@@ -61,10 +61,10 @@ test('a feature branch is INCONCLUSIVE — the artifact would be judged against
 test('a DIRTY tree is inconclusive — a generator regenerates from the working tree, not from main', () => {
   // The real bug this caught: running the check against its own uncommitted source file
   // reported repo-map.md stale when it in fact matched main.
-  const r = atMain(fakeGit({ porcelain: ' M scripts/gds/artifact-staleness.js\n' }));
+  const r = atMain(fakeGit({ porcelain: ' M scripts/bongos/artifact-staleness.js\n' }));
   assert.equal(r.ok, false);
   assert.match(r.reason, /not clean/);
-  assert.match(r.reason, /scripts\/gds\/artifact-staleness\.js/);
+  assert.match(r.reason, /scripts\/(?:gds|bongos)\/artifact-staleness\.js/);
 });
 
 test('every porcelain status column is parsed whole — an unstaged " M" must not lose its first letter', () => {
@@ -72,9 +72,9 @@ test('every porcelain status column is parsed whole — an unstaged " M" must no
   // modification's leading space is significant, so the first line printed "cripts/…".
   // One case per column shape, first-line position included, since only the first line
   // was ever affected.
-  for (const line of [' M scripts/gds/artifact-staleness.js', 'M  scripts/gds/artifact-staleness.js', '?? scripts/gds/artifact-staleness.js', 'A  scripts/gds/artifact-staleness.js']) {
+  for (const line of [' M scripts/bongos/artifact-staleness.js', 'M  scripts/bongos/artifact-staleness.js', '?? scripts/bongos/artifact-staleness.js', 'A  scripts/bongos/artifact-staleness.js']) {
     const r = atMain(fakeGit({ porcelain: `${line}\n` }));
-    assert.match(r.reason, /\(scripts\/gds\/artifact-staleness\.js\)/, `mangled the path for "${line}"`);
+    assert.match(r.reason, /\(scripts\/(?:gds|bongos)\/artifact-staleness\.js\)/, `mangled the path for "${line}"`);
   }
 });
 
@@ -172,7 +172,7 @@ test('every registered artifact is really gitignored — a tracked file belongs
 
 test('every registered generator really exposes --check-whole — the contract this check is built on', () => {
   for (const a of ARTIFACTS) {
-    const src = readFileSync(new URL(`../scripts/gds/${a.generator}`, import.meta.url), 'utf8');
+    const src = readFileSync(new URL(`../scripts/bongos/${a.generator}`, import.meta.url), 'utf8');
     assert.match(src, /--check-whole/, `${a.generator} must support --check-whole`);
   }
 });
@@ -183,7 +183,7 @@ test('the two ADR 0110 artifacts are both covered, and the known exclusions stay
   // can be answered by this mechanism (a timestamped payload; a render needing Chromium).
   // The reasons are written out at ARTIFACTS — this asserts they were a decision, so that
   // adding either later is a deliberate act rather than a silent widening.
-  const src = readFileSync(new URL('../scripts/gds/artifact-staleness.js', import.meta.url), 'utf8');
+  const src = readFileSync(new URL('../scripts/bongos/artifact-staleness.js', import.meta.url), 'utf8');
   assert.match(src, /atlas\.json/, 'the atlas exclusion must stay documented');
   assert.match(src, /diagrams/, 'the diagram-render exclusion must stay documented');
 });
@@ -193,7 +193,7 @@ test('this check must NOT be wired into CI — a fresh clone legitimately has no
   // every single run — the "monitor nobody reads" failure ADR 0110 already has once. The
   // mistake is an easy one to make by analogy with publish-watch.js, which IS a workflow
   // (it reads git + the registry, so it is true anywhere). Assert no workflow invokes it.
-  const src = readFileSync(new URL('../scripts/gds/artifact-staleness.js', import.meta.url), 'utf8');
+  const src = readFileSync(new URL('../scripts/bongos/artifact-staleness.js', import.meta.url), 'utf8');
   assert.match(src, /NEVER in CI/, 'the file must state where it may run');
 
   let names = [];

package/tests/atlas.mjs

@@ -15,7 +15,7 @@ import { onDiskModuleKeys } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const atlas = require(path.join(ROOT, 'scripts', 'gds', 'gen-atlas.js'));
+const atlas = require(path.join(ROOT, 'scripts', 'bongos', 'gen-atlas.js'));
 
 // Must stay in lockstep with modules/hall-ui/public/atlas.js (nodeFill/sizeFor/ringFor,
 // EDGE_STYLE, TOKENS, CENTER kinds). If the renderer learns a new kind, add it

package/tests/audit_deps.mjs

@@ -6,7 +6,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { findMissingDeps, classify } = require('../scripts/gds/audit-deps.js');
+const { findMissingDeps, classify } = require('../scripts/bongos/audit-deps.js');
 
 let passed = 0, failed = 0;
 const t = (n, f) => { try { f(); passed++; console.log(`  PASS  ${n}`); } catch (e) { failed++; console.log(`  FAIL  ${n}\n        ${e.message}`); } };

package/tests/audit_gate.mjs

@@ -9,7 +9,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const gate = require(path.join(ROOT, 'scripts', 'gds', 'audit-gate.js'));
+const gate = require(path.join(ROOT, 'scripts', 'bongos', 'audit-gate.js'));
 
 const AUDIT_FIXTURE = {
   vulnerabilities: {

package/tests/auth_flow_slice1.mjs

@@ -105,9 +105,9 @@ function stderrCapture() {
 // Require cli-lib FRESH so the _unauthExitInFlight module-state is clean.
 // We use the require cache hack: delete it from cache before each scenario.
 function freshCliLib() {
-  const path = require.resolve('../scripts/gds/cli-lib.js');
+  const path = require.resolve('../scripts/bongos/cli-lib.js');
   delete require.cache[path];
-  return require('../scripts/gds/cli-lib.js');
+  return require('../scripts/bongos/cli-lib.js');
 }
 
 console.log('cli-lib apiCall behavior:');
@@ -201,7 +201,7 @@ await t('exports include printUnauthGuidanceAndExit so other scripts can reuse',
 console.log('\ndoctor.js structural smoke:');
 
 await t('doctor.js executes and prints all four section headers', () => {
-  const r = spawnSync('node', ['scripts/gds/doctor.js'], { cwd: REPO, encoding: 'utf8', timeout: 30_000 });
+  const r = spawnSync('node', ['scripts/bongos/doctor.js'], { cwd: REPO, encoding: 'utf8', timeout: 30_000 });
   // The doctor is allowed to exit 0 or 1 — 1 means there's a red row, which
   // is a legitimate environment state. We're checking structure, not result.
   assert.ok([0, 1].includes(r.status), `unexpected exit code ${r.status}: ${r.stderr}`);

package/tests/auth_inactive_builder.mjs

@@ -155,14 +155,52 @@ await t('offboarded builder: an opted-in web sign-in never reaches upsertGithubT
   tokenWrites.length = 0;
   const res = await signInWithRepoOptIn();
   assert.equal(tokenWrites.length, 0, 'the token deactivateBuilder deleted must not be written back');
-  assert.ok(res.redirectedTo, 'sign-in itself is not refused: requireBuilder denies the session per request');
+  // A session would only sign them in to a hall that 403s every read, so the
+  // callback refuses with a page that says why instead of redirecting.
+  assert.equal(res.redirectedTo, null);
+  assert.equal(res.statusCode, 403);
 });
 
-await t('offboarded builder: completeWebFlow never hands the repo token back', async () => {
+await t('offboarded builder: completeWebFlow refuses and mints no session', async () => {
   builderRow = { ...ROW, status: 'inactive' };
-  const out = await auth.completeWebFlow({ code: 'c0de', redirectUri: 'http://localhost/cb', captureRepoToken: true });
-  assert.equal(out.githubToken, undefined);
-  assert.equal(out.githubScope, undefined);
+  await assert.rejects(
+    auth.completeWebFlow({ code: 'c0de', redirectUri: 'http://localhost/cb', captureRepoToken: true }),
+    (err) => err.code === 'BUILDER_INACTIVE',
+  );
+});
+
+await t('offboarded builder: the CLI device flow refuses too, and its route answers 403 builder_inactive', async () => {
+  builderRow = { ...ROW, status: 'inactive' };
+  const { deviceFlows } = require('../src/bongos/auth-config.js');
+  deviceFlows.set('dev1', { interval: 0, last_polled_at: 0, expires_at: Date.now() + 60_000 });
+  await assert.rejects(auth.pollDeviceFlow('dev1', 'test'), (err) => err.code === 'BUILDER_INACTIVE');
+
+  deviceFlows.set('dev2', { interval: 0, last_polled_at: 0, expires_at: Date.now() + 60_000 });
+  const poll = buildAuthRouter().stack
+    .find((l) => l.route?.path === '/auth/device/poll' && l.route.methods.post).route.stack.at(-1).handle;
+  const res = fakeRes();
+  await poll({ body: { device_code: 'dev2' }, headers: { 'user-agent': 'test' } }, res);
+  assert.equal(res._status, 403);
+  assert.equal(res._json.state, 'builder_inactive');
+});
+
+await t('offboarded builder: the hub (IdP) sign-in refuses too', async () => {
+  builderRow = { ...ROW, status: 'inactive' };
+  const authConfig = require('../src/bongos/auth-config.js');
+  const realLoad = authConfig.loadIdpConfig;
+  const realFetch = globalThis.fetch;
+  authConfig.loadIdpConfig = () => ({ origin: 'https://hub.example', clientId: 'c1', clientSecret: 's' });
+  globalThis.fetch = async () => ({ ok: true, json: async () => ({ github_id: 4242, github_login: ROW.github_login }), text: async () => '' });
+  const idpPath = require.resolve('../src/bongos/auth-idp.js');
+  delete require.cache[idpPath];
+  try {
+    const idp = require('../src/bongos/auth-idp.js');
+    await assert.rejects(idp.completeIdpFlow({ code: 'x', redirectUri: 'https://p.example/cb' }), (err) => err.code === 'BUILDER_INACTIVE');
+  } finally {
+    authConfig.loadIdpConfig = realLoad;
+    globalThis.fetch = realFetch;
+    delete require.cache[idpPath];
+  }
 });
 
 await t('active builder: an opted-in web sign-in still captures the repo token (control)', async () => {

package/tests/auth_session_expiry_db.mjs

@@ -30,7 +30,10 @@
 //      two things a "sessions never expire" change could plausibly have broken.
 //   5. THE MIGRATION, run for real: it clears a pre-existing CLI expiry, leaves
 //      web and revoked rows alone, and is idempotent.
-//   6. The point of the whole task — a session idle far past 24h authenticates.
+//   6. The idle limit (ADR 0383, which superseded ADR 0294's "never expires"):
+//      a CLI session idle past 24h but under 10 days still authenticates; one
+//      idle past 10 days is refused, and is NOT marked revoked (revocation stays
+//      the explicit, audited action).
 //
 // Real-DB integration test: self-skips without a reachable Postgres; in
 // run-unit-tests.js's INTEGRATION set so the default DB-free lane never runs it.
@@ -173,12 +176,21 @@ await t('core_243 is idempotent — a re-run changes nothing', async () => {
   assert.notEqual((await row(`SELECT expires_at FROM builder_sessions WHERE token_hash='${h('old-web')}'`)).expires_at, null);
 });
 
-// The whole point of the task, stated as a test.
-await t('a CLI session idle for 21 DAYS still authenticates', async () => {
-  await client.query(`UPDATE builder_sessions SET last_used_at = now() - interval '21 days' WHERE token_hash='${h('cli-tok')}'`);
+// ADR 0383: sessions of any source end after 10 idle days, measured on
+// last_used_at. Both sides of the line, so neither "never expires" (ADR 0294)
+// nor a limit tighter than 10 days can come back unnoticed.
+await t('a CLI session idle for 9 DAYS still authenticates', async () => {
+  await client.query(`UPDATE builder_sessions SET last_used_at = now() - interval '9 days' WHERE token_hash='${h('cli-tok')}'`);
   assert.notEqual(await kernel.lookupSession('cli-tok'), null);
 });
 
+await t('a CLI session idle for 11 DAYS is refused, and left unrevoked', async () => {
+  await settle();
+  await client.query(`UPDATE builder_sessions SET last_used_at = now() - interval '11 days' WHERE token_hash='${h('cli-tok')}'`);
+  assert.equal(await kernel.lookupSession('cli-tok'), null);
+  assert.equal((await row(`SELECT revoked_at FROM builder_sessions WHERE token_hash='${h('cli-tok')}'`)).revoked_at, null);
+});
+
 await client.query(`SET search_path TO public`);
 client.release();
 await pool.query(`DROP SCHEMA ${SCHEMA} CASCADE`);

package/tests/auth_session_ttl.mjs

@@ -229,6 +229,29 @@ t('refresh-on-use still bumps last_used_at (the own-sessions list reads it)', ()
   assert.match(refreshSql, /last_used_at = now\(\)/);
 });
 
+section('\nidle limit (ADR 0383):');
+
+// A session of any source unused for 10 days stops authenticating.
+async function lookupWithLastUsed(lastUsedAt) {
+  const saved = require.cache[poolPath].exports.pool.query;
+  require.cache[poolPath].exports.pool.query = async () => ({
+    rows: [{ session_id: '1', builder_id: '1', expires_at: null, revoked_at: null, source: 'cli', last_used_at: lastUsedAt }],
+  });
+  try { return await kernel.lookupSession('t'); } finally { require.cache[poolPath].exports.pool.query = saved; }
+}
+
+t('SESSION_IDLE_LIMIT_MS is exactly 10 days', () => {
+  assert.equal(kernel.SESSION_IDLE_LIMIT_MS, 10 * 24 * 60 * 60 * 1000);
+});
+
+t('a never-expires CLI session used 9 days ago still authenticates', async () => {
+  assert.ok(await lookupWithLastUsed(new Date(Date.now() - 9 * 24 * 60 * 60 * 1000)));
+});
+
+t('a never-expires CLI session idle for 11 days is refused', async () => {
+  assert.equal(await lookupWithLastUsed(new Date(Date.now() - 11 * 24 * 60 * 60 * 1000)), null);
+});
+
 section('\nmigration core_243 scope:');
 
 // The migration clears expires_at on rows that already exist. Its source filter

package/tests/authorship_audit.mjs

@@ -1,6 +1,6 @@
 // tests/authorship_audit.mjs — the no-hardcoded-Archon-identity gate (task 1002640).
 //
-// scripts/gds/audit-authorship.sh (named as THE enforcement in
+// scripts/bongos/audit-authorship.sh (named as THE enforcement in
 // docs/canonical-permissions.md) had no caller — no CI lane, no test, no skill
 // — and 342 stale hits on a clean tree. This test makes it a real gate: it runs
 // inside the required `unit` check, so a new hardcoded founder-identity
@@ -16,7 +16,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const REPO = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
-const SCRIPT = path.join(REPO, 'scripts', 'gds', 'audit-authorship.sh');
+const SCRIPT = path.join(REPO, 'scripts', 'bongos', 'audit-authorship.sh');
 const SPAWN_TIMEOUT_MS = 75_000; // under run-unit-tests' 90s cap
 
 const r = spawnSync('bash', [SCRIPT], {

package/tests/autobongos_cadence.mjs

@@ -28,7 +28,7 @@ process.env.AUTOBONGOS_HEARTBEAT_FILE = require('node:path').join(
 );
 
 const cadence = require('../modules/autonomy/cadence.js');
-const runner = require('../scripts/gds/autobongos-run.js');
+const runner = require('../scripts/bongos/autobongos-run.js');
 
 const { classifyEvent, nextCadence, START, DEFAULTS, signalFingerprint, shouldJumpWait } = cadence;
 

package/tests/autobongos_fence.mjs

@@ -13,7 +13,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const fence = require('../modules/autonomy/fence.js');
-const runner = require('../scripts/gds/autobongos-run.js');
+const runner = require('../scripts/bongos/autobongos-run.js');
 const catalog = require('../modules/government/catalog.js');
 
 const { decideRun, decideTask, normaliseFence, allowedGoals } = fence;

package/tests/autobongos_grade_cap.mjs

@@ -16,7 +16,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
-const cap = require('../scripts/gds/autobongos-grade-cap.js');
+const cap = require('../scripts/bongos/autobongos-grade-cap.js');
 const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
 const fail = { passed: false, score: 5.6, signals: { panel_outcome: 'fail' } };
@@ -111,7 +111,7 @@ for (const flags of [['--regrade'], [], ['--skip-grade']]) {
   test(`ship.js ${flags.join(' ') || '(plain re-ship)'} refuses a third grade in an autonomous run`, () => {
     const { env } = ledgerWith([fail, fail]);
     const home = fs.mkdtempSync(path.join(os.tmpdir(), 'grade-cap-home-'));
-    const res = spawnSync(process.execPath, [path.join(REPO, 'scripts', 'gds', 'ship.js'), '4242', ...flags], {
+    const res = spawnSync(process.execPath, [path.join(REPO, 'scripts', 'bongos', 'ship.js'), '4242', ...flags], {
       cwd: REPO,
       encoding: 'utf8',
       timeout: 30000,

package/tests/autobongos_heartbeat_head.mjs

@@ -33,7 +33,7 @@ const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ab-head-'));
 process.env.AUTOBONGOS_HEARTBEAT_FILE = path.join(dir, 'beat.json');
 process.env.AUTOBONGOS_LOG_FILE = path.join(dir, 'runs.jsonl');
 
-const runner = require('../scripts/gds/autobongos-run.js');
+const runner = require('../scripts/bongos/autobongos-run.js');
 
 const SHA = 'abcdef0123456789abcdef0123456789abcdef01';
 

package/tests/autobongos_host_access.mjs

@@ -17,7 +17,7 @@ import path from 'node:path';
 
 const require = createRequire(import.meta.url);
 const fence = require('../modules/autonomy/fence.js');
-const runner = require('../scripts/gds/autobongos-run.js');
+const runner = require('../scripts/bongos/autobongos-run.js');
 
 const { needsHostAccess, decideTask } = fence;
 
@@ -48,9 +48,9 @@ const T1003980 = {
 };
 const CODE_TASK = {
   id: 9002, goal_id: 1000119, kind: 'feature', status: 'ready', requires_rank: 'xenos',
-  touches: ['scripts/gds/sequence.js'], manual_degree: null, automation_tag: null,
+  touches: ['scripts/bongos/sequence.js'], manual_degree: null, automation_tag: null,
   title: 'Teach the picker a new halt reason',
-  description: 'Add a halt reason to scripts/gds/sequence.js and cover it with a tests/*.mjs case. '.repeat(4)
+  description: 'Add a halt reason to scripts/bongos/sequence.js and cover it with a tests/*.mjs case. '.repeat(4)
     + 'DONE WHEN: the new case passes and the old ones still do.',
 };
 

package/tests/autobongos_loop.mjs

@@ -12,8 +12,8 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const {
   WORKER_VERDICT_SCHEMA, buildWorkerArgs, buildWorkerPrompt, parseWorkerEnvelope, classifyRun, usageLimitHit,
-} = require('../scripts/gds/autobongos-loop.js');
-const runner = require('../scripts/gds/autobongos-run.js');
+} = require('../scripts/bongos/autobongos-loop.js');
+const runner = require('../scripts/bongos/autobongos-run.js');
 
 const goodVerdict = { outcome: 'shipped', task_id: 42, what_happened: 'added the thing', undetermined_decisions: [] };
 const envelope = (over = {}) => ({
@@ -558,7 +558,7 @@ test('a gate whose stranded task cannot be read back keeps waiting rather than g
 });
 
 test('the runner and claim.js agree on the queue-gated exit code', () => {
-  const claim = require('../scripts/gds/claim.js');
+  const claim = require('../scripts/bongos/claim.js');
   assert.equal(runner.QUEUE_GATED_EXIT, claim.QUEUE_GATED_EXIT);
   assert.notEqual(runner.QUEUE_GATED_EXIT, 1, 'it must differ from the generic refusal, or the runner cannot tell them apart');
 });
@@ -1059,7 +1059,7 @@ test('forever does NOT exit while the code is current', async () => {
 });
 
 test('the wrapper loops on the upgrade code and only on that code', () => {
-  const raw = readFileSync(new URL('../scripts/gds/autobongos-service.cmd', import.meta.url), 'utf8');
+  const raw = readFileSync(new URL('../scripts/bongos/autobongos-service.cmd', import.meta.url), 'utf8');
   // LIVE lines only, and no regex here on purpose. A first cut of this test
   // matched the raw file text and passed happily against a commented-out
   // "REM goto run" — which is precisely the regression it exists to catch.
@@ -1115,7 +1115,7 @@ const loopDeps = (over = {}) => ({
   loadedHead: async () => 'a'.repeat(40),
   now: () => Date.now() + runner.MIN_UPTIME_BEFORE_UPGRADE_MS + 1000,
   codeDrifted: async () => ({ from: 'aaaaaaaa', to: 'cccccccc' }),
-  loadedFiles: () => ['scripts/gds/autobongos-run.js', 'scripts/gds/sequence.js'],
+  loadedFiles: () => ['scripts/bongos/autobongos-run.js', 'scripts/bongos/sequence.js'],
   state: runner.newRunnerState(),
   ...over,
 });
@@ -1139,11 +1139,11 @@ test('a change to a file the supervisor has LOADED restarts, and says which file
   const rows = [];
   const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 2, refreshInPlace: true }, loopDeps({
     record: (r) => { rows.push(r); return r; },
-    refreshCheckout: async () => ({ ok: true, to: 'c'.repeat(40), changed: ['docs/x.md', 'scripts/gds/sequence.js'] }),
+    refreshCheckout: async () => ({ ok: true, to: 'c'.repeat(40), changed: ['docs/x.md', 'scripts/bongos/sequence.js'] }),
   }));
   assert.equal(code, runner.UPGRADE_EXIT_CODE);
   const exit = rows.find((r) => r.event === 'upgrade_exit');
-  assert.match(exit.reason, /scripts\/gds\/sequence\.js/);
+  assert.match(exit.reason, /scripts\/(?:gds|bongos)\/sequence\.js/);
   assert.ok(!/docs\/x\.md/.test(exit.reason), 'only the files that force the restart are named');
 });
 
@@ -1170,7 +1170,7 @@ test('the real --forever entry point is the one place that arms the in-place ref
   // main() is the production call shape and is not driven by these tests (it
   // would run the real loop), so its one line is pinned by source. Without it the
   // refresh is dead code and every merge to main restarts the runner again.
-  const src = readFileSync(new URL('../scripts/gds/autobongos-run.js', import.meta.url), 'utf8');
+  const src = readFileSync(new URL('../scripts/bongos/autobongos-run.js', import.meta.url), 'utf8');
   const line = src.split('\n').find((l) => l.includes('if (opts.forever) return forever('));
   assert.ok(line, 'main() must still hand --forever to forever()');
   assert.ok(line.includes('refreshInPlace: true'), `and arm the refresh there: ${line}`);
@@ -1195,17 +1195,17 @@ test('after a refresh, drift is measured from the REFRESHED commit, so it does n
 });
 
 test('supervisorTouched: loaded files and the supervisor\'s own paths count; nothing else does', () => {
-  const loaded = ['scripts/gds/sequence.js'];
+  const loaded = ['scripts/bongos/sequence.js'];
   assert.deepEqual(runner.supervisorTouched(['docs/a.md', 'src/x.js'], loaded), []);
-  assert.deepEqual(runner.supervisorTouched(['scripts/gds/sequence.js'], loaded), ['scripts/gds/sequence.js']);
-  assert.deepEqual(runner.supervisorTouched(['scripts/gds/autobongos-verify.js'], []), ['scripts/gds/autobongos-verify.js']);
+  assert.deepEqual(runner.supervisorTouched(['scripts/bongos/sequence.js'], loaded), ['scripts/bongos/sequence.js']);
+  assert.deepEqual(runner.supervisorTouched(['scripts/bongos/autobongos-verify.js'], []), ['scripts/bongos/autobongos-verify.js']);
   assert.deepEqual(runner.supervisorTouched(['modules/autonomy/fence.js'], []), ['modules/autonomy/fence.js']);
-  assert.deepEqual(runner.supervisorTouched(['scripts/gds/claim.js'], loaded), [], 'claim.js runs as a child process, so it is always fresh');
+  assert.deepEqual(runner.supervisorTouched(['scripts/bongos/claim.js'], loaded), [], 'claim.js runs as a child process, so it is always fresh');
 });
 
 test('loadedFiles lists this process\'s own repo modules, repo-relative with forward slashes', () => {
   const files = runner.loadedFiles();
-  assert.ok(files.includes('scripts/gds/autobongos-run.js'));
+  assert.ok(files.includes('scripts/bongos/autobongos-run.js'));
   assert.ok(files.every((f) => !f.includes('\\') && !f.startsWith('/') && !f.includes('node_modules/')));
 });
 
@@ -1233,11 +1233,11 @@ test('refreshCheckout in the main checkout fetches, diffs from the LOADED commit
     calls.push(args.join(' '));
     if (args[1] === '--git-dir' || args[1] === '--git-common-dir') return { ok: true, stdout: '.git\n' };
     if (args[0] === 'rev-parse' && args[1] === 'FETCH_HEAD') return { ok: true, stdout: `${tip}\n` };
-    if (args[0] === 'diff') return { ok: true, stdout: 'docs/a.md\r\nscripts/gds/sequence.js\n' };
+    if (args[0] === 'diff') return { ok: true, stdout: 'docs/a.md\r\nscripts/bongos/sequence.js\n' };
     return { ok: true, stdout: '' };
   };
   const r = await runner.refreshCheckout({ run, loadedHead: async () => 'a'.repeat(40) });
-  assert.deepEqual(r, { ok: true, to: tip, changed: ['docs/a.md', 'scripts/gds/sequence.js'] });
+  assert.deepEqual(r, { ok: true, to: tip, changed: ['docs/a.md', 'scripts/bongos/sequence.js'] });
   const order = ['fetch', 'diff', 'reset'].map((v) => calls.findIndex((c) => c.startsWith(v)));
   assert.ok(order.every((i) => i >= 0) && order[0] < order[1] && order[1] < order[2], `fetch → diff → reset, got ${calls.join(' | ')}`);
   assert.ok(calls.find((c) => c.startsWith('diff')).includes('a'.repeat(40)), 'the diff is from what the process LOADED, so a change that landed several refreshes ago still counts');
@@ -1397,7 +1397,7 @@ test('the server heartbeat carries the goal the current task came from', async (
 // Owner rule: a task that fails the grade twice goes to the owner. The prompt
 // asked for it and was ignored (task 1004512: $63.81 over three rounds), so the
 // supervisor reads the run's grade ledger itself.
-const gradeCapLib = require('../scripts/gds/autobongos-grade-cap.js');
+const gradeCapLib = require('../scripts/bongos/autobongos-grade-cap.js');
 const fakeGrade = (passed, outage = false) => ({ passed, score: passed ? 8 : 5, signals: { panel_outcome: outage ? 'unavailable' : (passed ? 'pass' : 'fail') } });
 function ledgerHarness(grades, { ledgerStatus = 'completed' } = {}) {
   const file = join(mkdtempSync(join(tmpdir(), 'abgcap-')), 'run.jsonl');
@@ -1544,7 +1544,7 @@ test('forever re-checks pending lands once per loop, and a failing check never s
 });
 
 test('main() arms the land re-check for --forever', () => {
-  const src = readFileSync(new URL('../scripts/gds/autobongos-run.js', import.meta.url), 'utf8');
+  const src = readFileSync(new URL('../scripts/bongos/autobongos-run.js', import.meta.url), 'utf8');
   const line = src.split('\n').find((l) => l.includes('if (opts.forever) return forever('));
   assert.match(line, /recheckLands: true/, 'without this the runner never re-probes a slow land');
 });

package/tests/autobongos_service_ps1.mjs

@@ -1,5 +1,5 @@
 // tests/autobongos_service_ps1.mjs — the Windows host installer's own behaviour
-// (scripts/gds/autobongos-service.ps1).
+// (scripts/bongos/autobongos-service.ps1).
 //
 // task 1004375: `stop` printed "stopped" while the runner kept running. The
 // runner, started under the S4U logon type, sat in a session the interactive user
@@ -22,7 +22,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
 
-const PS1 = fileURLToPath(new URL('../scripts/gds/autobongos-service.ps1', import.meta.url));
+const PS1 = fileURLToPath(new URL('../scripts/bongos/autobongos-service.ps1', import.meta.url));
 
 function findShell() {
   for (const bin of ['pwsh', 'powershell']) {
@@ -136,7 +136,7 @@ test('the command-line stop exits non-zero when the process survived', () => {
 // The pid is only as good as the FILE it is read from. stop must look where the
 // runner writes, so Get-HeartbeatFile asks the runner's own heartbeatPath() --
 // these pin that the two agree, including its first-precedence env override.
-const runner = createRequire(import.meta.url)('../scripts/gds/autobongos-run.js');
+const runner = createRequire(import.meta.url)('../scripts/bongos/autobongos-run.js');
 
 test('stop reads the heartbeat file the runner itself writes', { skip }, async () => {
   const saved = process.env.AUTOBONGOS_HEARTBEAT_FILE;

package/tests/autobongos_tweak_lane.mjs

@@ -16,8 +16,8 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const lane = require('../scripts/gds/autobongos-tweak-lane.js');
-const runner = require('../scripts/gds/autobongos-run.js');
+const lane = require('../scripts/bongos/autobongos-tweak-lane.js');
+const runner = require('../scripts/bongos/autobongos-run.js');
 const { matchProtected } = require('../src/bongos/permission-path-check');
 
 const INV = { pages: [

package/tests/autobongos_verify.mjs

@@ -12,9 +12,9 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const verify = require('../scripts/gds/autobongos-verify.js');
+const verify = require('../scripts/bongos/autobongos-verify.js');
 const { classifyLedger, blockerFor, probeArtifact, verifyShip } = verify;
-const strandWatch = require('../scripts/gds/strand-watch.js');
+const strandWatch = require('../scripts/bongos/strand-watch.js');
 
 const NOW = Date.parse('2026-09-18T12:00:00.000Z');
 const task = (over = {}) => ({ id: '1003903', title: 'A task', status: 'shipped', updated_at: '2026-09-18T11:59:00.000Z', ...over });

package/tests/autonomous_fit_protected_paths.mjs

@@ -50,9 +50,9 @@ t('a task touching the rank/auth machinery is protected', () => {
 });
 
 t('a task touching the ship/grade/deploy pipeline is protected', () => {
-  assert.equal(isProtected({ touches: ['scripts/gds/ship.js'] }), true);
+  assert.equal(isProtected({ touches: ['scripts/bongos/ship.js'] }), true);
   assert.equal(isProtected({ touches: ['modules/grading/grader.js'] }), true); // BV1.R73: grading carved to modules/grading/
-  assert.equal(isProtected({ touches: ['scripts/gds/push-main.js'] }), true);
+  assert.equal(isProtected({ touches: ['scripts/bongos/push-main.js'] }), true);
 });
 
 t('a task touching the routes/ subtree (gates live here) is protected', () => {
@@ -67,7 +67,7 @@ t('a task touching the trust-boundary docs / methodology core is protected', ()
 });
 
 t('a MIX of one safe + one protected touch is still protected (any match wins)', () => {
-  assert.equal(isProtected({ touches: ['public/game/world/terrain.js', 'scripts/gds/ship.js'] }), true);
+  assert.equal(isProtected({ touches: ['public/game/world/terrain.js', 'scripts/bongos/ship.js'] }), true);
 });
 
 // ---------- ordinary builder work is NOT excluded ----------

package/tests/autonomy_config_idle.mjs

@@ -13,7 +13,7 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const ci = require('../modules/autonomy/config-idle.js');
 const { describeRunner } = require('../modules/autonomy/runner-health.js');
-const runner = require('../scripts/gds/autobongos-run.js');
+const runner = require('../scripts/bongos/autobongos-run.js');
 
 const NOW = Date.parse('2026-10-02T09:47:00.000Z');
 const agoS = (s) => new Date(NOW - s * 1000).toISOString();

package/tests/autonomy_digest.mjs

@@ -12,7 +12,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const { buildDigest, renderDigest, windowsFromGauge, humanDuration } = require('../modules/autonomy/digest.js');
-const cli = require('../scripts/gds/autobongos-digest.js');
+const cli = require('../scripts/bongos/autobongos-digest.js');
 
 const T0 = Date.parse('2026-09-19T02:00:00.000Z');
 const at = (m) => new Date(T0 + m * 60000).toISOString();

package/tests/autonomy_gate.mjs

@@ -5,7 +5,7 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
-const { decide, autofixAllowed, isEnabled, ceilingUsd, AUTONOMY_FLAG, DEFAULT_CEILING_USD } = require('../scripts/gds/autonomy-gate.js');
+const { decide, autofixAllowed, isEnabled, ceilingUsd, AUTONOMY_FLAG, DEFAULT_CEILING_USD } = require('../scripts/bongos/autonomy-gate.js');
 
 let passed = 0, failed = 0;
 function test(name, fn) {

package/tests/autonomy_gauge.mjs

@@ -16,8 +16,8 @@ import path from 'node:path';
 const require = createRequire(import.meta.url);
 const { decideCapacity, readGauge, reserveFor, weeklyPace, whenPaceAllows, cfg } =
   require('../modules/autonomy/gauge.js');
-const statusline = require('../scripts/gds/autonomy-gauge-statusline.js');
-const cli = require('../scripts/gds/autonomy-gauge.js');
+const statusline = require('../scripts/bongos/autonomy-gauge-statusline.js');
+const cli = require('../scripts/bongos/autonomy-gauge.js');
 
 // Run fn with env vars set, always restoring them.
 function withEnv(vars, fn) {

package/tests/autonomy_runner_identity.mjs

@@ -22,7 +22,7 @@ const req = createRequire(import.meta.url);
 const express = req('express');
 const { attachFail } = req(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
 const health = req(path.join(ROOT, 'modules/autonomy/runner-health.js'));
-const runner = req(path.join(ROOT, 'scripts/gds/autobongos-run.js'));
+const runner = req(path.join(ROOT, 'scripts/bongos/autobongos-run.js'));
 
 const NOW = Date.parse('2026-10-01T12:00:00.000Z');
 const agoS = (s) => new Date(NOW - s * 1000).toISOString();