@bongos/core 1.21.175 → 1.21.176

package/tests/ship_vendored_instance.mjs

@@ -11,7 +11,7 @@
 //   2. `main` checked out in a LINKED worktree → <root>/.git is a FILE → the same
 //      ENOENT on the lock;
 //   3. `main` in the primary checkout → the merge succeeded, then the post-merge
-//      smoke ran `node scripts/gds/smoke-gds.js` cwd-relative to the instance →
+//      smoke ran `node scripts/bongos/smoke-gds.js` cwd-relative to the instance →
 //      MODULE_NOT_FOUND → ship reset main and the task stuck at `confirmed`.
 //
 // This builds the real layout and runs ship's real local merge leg in it: a bare
@@ -92,7 +92,7 @@ function buildFixture(mainAt) {
   const core = path.join(inst, 'node_modules', '@bongos', 'core');
   fs.cpSync(CORE_TEMPLATE, core, { recursive: true });
   // The smoke stub records WHERE it was run from — the bug was it not being found.
-  writeFile(path.join(core, 'scripts', 'gds', 'smoke-gds.js'),
+  writeFile(path.join(core, 'scripts', 'bongos', 'smoke-gds.js'),
     "require('fs').writeFileSync(process.env.SMOKE_MARKER, JSON.stringify({ script: __filename, cwd: process.cwd() }));\n");
 
   // The task's own worktree + branch, carrying one commit.
@@ -123,10 +123,10 @@ function runMergeLeg(fx) {
   fs.writeFileSync(runner, `
     const path = require('path');
     const core = ${JSON.stringify(fx.core)};
-    const cli = require(path.join(core, 'scripts', 'gds', 'cli-lib.js'));
+    const cli = require(path.join(core, 'scripts', 'bongos', 'cli-lib.js'));
     cli.cliClient = async () => ({ tasks: { postTasksIdAttestGate: async () => ({ ok: true, status: 200, data: { tip_recorded: true } }) } });
-    const state = require(path.join(core, 'scripts', 'gds', 'ship-state.js'));
-    const { mergeLocally } = require(path.join(core, 'scripts', 'gds', 'ship-merge.js'));
+    const state = require(path.join(core, 'scripts', 'bongos', 'ship-state.js'));
+    const { mergeLocally } = require(path.join(core, 'scripts', 'bongos', 'ship-merge.js'));
     mergeLocally(${TASK}, 'vendored land').then(
       (o) => { console.log('ROOTS ' + JSON.stringify({ core: state.CORE_ROOT, instance: state.INSTANCE_ROOT, main: state.MAIN_CHECKED_OUT })); console.log('RESULT ' + JSON.stringify(o)); },
       (e) => { console.log('THREW ' + JSON.stringify({ code: e.code, message: e.message })); process.exitCode = 1; },
@@ -167,7 +167,7 @@ function assertLanded(fx, run) {
   assert.ok(!SMOKE_MISSING.test(run.out), `smoke-gds.js was not found:\n${run.out}`);
   // the smoke ran — from the CORE package, with the instance checkout as cwd
   const smoke = JSON.parse(fs.readFileSync(run.marker, 'utf8'));
-  assert.ok(same(path.dirname(smoke.script), path.join(fx.core, 'scripts', 'gds')), `smoke ran from ${smoke.script}`);
+  assert.ok(same(path.dirname(smoke.script), path.join(fx.core, 'scripts', 'bongos')), `smoke ran from ${smoke.script}`);
   assert.ok(same(smoke.cwd, fx.mainDir), `smoke cwd was ${smoke.cwd}, expected the main checkout ${fx.mainDir}`);
   // the work is on origin/main, and the lock is gone
   git(fx.inst, 'fetch', '-q', 'origin');
@@ -179,8 +179,8 @@ function assertLanded(fx, run) {
 console.log('ship merge leg in a vendored instance (task 1004584)');
 
 // ---- resolveRoots, pure: git answers injected, no repo needed ----
-const { resolveRoots } = require(path.join(REPO, 'scripts', 'gds', 'ship-state.js'));
-const VENDORED_DIR = path.join('/inst', 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+const { resolveRoots } = require(path.join(REPO, 'scripts', 'bongos', 'ship-state.js'));
+const VENDORED_DIR = path.join('/inst', 'node_modules', '@bongos', 'core', 'scripts', 'bongos');
 const VENDORED_CORE = path.resolve(VENDORED_DIR, '..', '..'); // drive-qualified on Windows, as resolveRoots returns it
 
 await t('resolveRoots: CORE_ROOT is the package dir, INSTANCE_ROOT the worktree with main', () => {

package/tests/ship_visual_regrade.mjs

@@ -17,7 +17,7 @@ import os from 'node:os';
 import path from 'node:path';
 
 const require = createRequire(import.meta.url);
-const shipVisual = require('../scripts/gds/ship-visual.js');
+const shipVisual = require('../scripts/bongos/ship-visual.js');
 
 const PNG = Buffer.concat([Buffer.from('89504e470d0a1a0a0000000d49484452', 'hex'), Buffer.alloc(64)]);
 const TMP = mkdtempSync(path.join(os.tmpdir(), 'ship-visual-regrade-'));
@@ -112,7 +112,7 @@ test('a failed upload is a warning naming the manual re-attach, never a failure'
   let ok;
   try { ok = await shipVisual.upload({ taskId: 7, visual, client, errorLine: (d, s) => `HTTP ${s}` }); } finally { console.warn = saved; }
   assert.equal(ok, false);
-  assert.match(warn.join('\n'), /node scripts\/gds\/task\.js visual 7 <image>/);
+  assert.match(warn.join('\n'), /node scripts\/(?:gds|bongos)\/task\.js visual 7 <image>/);
 });
 
 test('no visual uploads nothing', async () => {
@@ -123,7 +123,7 @@ test('no visual uploads nothing', async () => {
 
 // ---- wiring ---------------------------------------------------------------
 
-const src = readFileSync(new URL('../scripts/gds/ship-flow.js', import.meta.url), 'utf8');
+const src = readFileSync(new URL('../scripts/bongos/ship-flow.js', import.meta.url), 'utf8');
 const stripComments = (s) => s.replace(/^\s*\/\/[^\n]*$/gm, '');
 const regrade = stripComments(src.slice(src.indexOf('async function regradeMain'), src.indexOf('module.exports')));
 const ship = stripComments(src.slice(src.indexOf('async function shipMain'), src.indexOf('async function regradeMain')));

package/tests/ship_zero_commit.mjs

@@ -18,7 +18,7 @@ import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const ship = require('../scripts/gds/ship.js');
+const ship = require('../scripts/bongos/ship.js');
 const { zeroCommitVerdict } = ship;
 
 let passed = 0;

package/tests/skill_docs_unavailable_regrade.mjs

@@ -3,7 +3,7 @@
 // the grader-hardening evaluation). A GRADER UNAVAILABLE outcome
 // (panel_outcome='unavailable', R01/R02) is not a quality rejection, and every
 // skill that walks a builder through shipping must say so and name the recovery:
-//   node scripts/gds/ship.js <id> --regrade
+//   node scripts/bongos/ship.js <id> --regrade
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { readFileSync, existsSync } from 'node:fs';
@@ -26,8 +26,8 @@ test('ship-path skills name the unavailable-vs-fail distinction and the --regrad
       `${name}: must name the grader-outage outcome (panel_outcome='unavailable')`);
     assert.match(md, /not a quality rejection/i,
       `${name}: must say an unavailable grade is NOT a quality rejection`);
-    assert.match(md, /node scripts\/gds\/ship\.js <(?:task-)?id> --regrade/,
-      `${name}: must name the recovery command: node scripts/gds/ship.js <id> --regrade`);
+    assert.match(md, /node scripts\/(?:gds|bongos)\/ship\.js <(?:task-)?id> --regrade/,
+      `${name}: must name the recovery command: node scripts/bongos/ship.js <id> --regrade`);
   }
   if (existsSync(path.join(ROOT, '.claude', 'skills'))) {
     assert.ok(present.length > 0, '.claude/skills exists but none of the ship-path skills were found — the check went vacuous');

package/tests/skill_friction_kind.mjs

@@ -180,7 +180,7 @@ test('the nightly routine files --kind skill-friction, not the pre-core_244 stan
   // that prose would satisfy a file-wide positive match while the example the
   // agent actually copies still said `cleanup`. (Verified: reverting only the
   // example left a file-wide match green.)
-  const example = routine.slice(routine.indexOf('node scripts/gds/capture.js'));
+  const example = routine.slice(routine.indexOf('node scripts/bongos/capture.js'));
   const block = example.slice(0, example.indexOf('```'));
   assert.match(
     block, /--kind skill-friction/,

package/tests/skill_grade_recover.mjs

@@ -34,7 +34,7 @@ test('/grade-recover exists and handles the three diagnosis branches', (t) => {
   assert.match(md, /tests\/\*?\.?mjs|checked-in test/i, 'requires a checked-in test per real finding');
 
   // The recovery command is named literally, and the raw confirm curl is never volunteered.
-  assert.match(md, /node scripts\/gds\/ship\.js <(?:task-)?id> --regrade/, 'names the --regrade recovery command');
+  assert.match(md, /node scripts\/(?:gds|bongos)\/ship\.js <(?:task-)?id> --regrade/, 'names the --regrade recovery command');
   assert.match(md, /never volunteer/i, 'states the never-volunteer rule for the raw confirm');
   assert.ok(!/curl[^\n]*\/confirm/.test(md), 'must not carry a ready-to-paste raw /confirm curl');
 });

package/tests/skill_grader_health.mjs

@@ -48,7 +48,7 @@ test('the grader health check (grade-sweep Part A) covers the four health axes o
   assert.match(md, /DEFAULT_GRADER_MODEL|selectGraderModel/, 'checks the live model pin');
 
   // Remediation + probe + the read-only contract.
-  assert.match(md, /node scripts\/gds\/ship\.js <(?:task-)?id> --regrade/, 'emits the exact remediation line');
+  assert.match(md, /node scripts\/(?:gds|bongos)\/ship\.js <(?:task-)?id> --regrade/, 'emits the exact remediation line');
   assert.match(md, /--probe/, 'offers the optional live calibration probe');
   assert.match(md, /grade-smoke\.js/, 'names the probe script');
   assert.match(md, /read-only/i, 'states the read-only contract');

package/tests/skill_lint.mjs

@@ -10,7 +10,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const lint = require('../scripts/gds/skill-lint.js');
+const lint = require('../scripts/bongos/skill-lint.js');
 
 const fm = (desc, extra = '') => `---\nname: demo\ndescription: ${desc}\n${extra}---\n\nBody text.\n`;
 const run = (text) => lint.lintSkillFile(text, { file: path.join('x', '.claude', 'skills', 'demo', 'SKILL.md') });

package/tests/skill_menu_ruling.mjs

@@ -12,7 +12,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const lint = require('../scripts/gds/skill-lint.js');
+const lint = require('../scripts/bongos/skill-lint.js');
 
 const byName = new Map(lint.listSkillFiles(ROOT).map((f) => [path.basename(path.dirname(f)), f]));
 const read = (n) => fs.readFileSync(byName.get(n), 'utf8');

package/tests/skill_preflight.mjs

@@ -15,7 +15,7 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const sp = require('../scripts/gds/skill-preflight.js');
+const sp = require('../scripts/bongos/skill-preflight.js');
 
 // ---- the declaration ------------------------------------------------------
 test('parseRequires reads the inline form', () => {
@@ -53,12 +53,12 @@ test('PROSE that names a command is not an instruction to run it', () => {
 });
 
 test('a FENCED command is an instruction, and is picked up', () => {
-  const md = '---\nname: x\n---\n```bash\nnode scripts/gds/push-main.js\n```\n';
+  const md = '---\nname: x\n---\n```bash\nnode scripts/bongos/push-main.js\n```\n';
   assert.deepEqual(sp.inferRequired(md), ['push-credential']);
 });
 
 test('a shell COMMENT inside a fence is discussion, not an instruction', () => {
-  const md = '---\nname: x\n---\n```bash\n# node scripts/gds/push-main.js is the sanctioned push\necho hi\n```\n';
+  const md = '---\nname: x\n---\n```bash\n# node scripts/bongos/push-main.js is the sanctioned push\necho hi\n```\n';
   assert.deepEqual(sp.inferRequired(md), []);
 });
 
@@ -198,7 +198,7 @@ test('an UNDECLARED fenced ops command is caught', () => {
   // passed a bad dir and therefore proved nothing about the undeclared path.
   const r = sp.checkOpsSkillsDeclareMachine({
     names: ['rogue'],
-    read: () => '---\nname: rogue\n---\n```bash\nnode scripts/gds/push-main.js\nssh me@host "~/deploy.sh"\n```\n',
+    read: () => '---\nname: rogue\n---\n```bash\nnode scripts/bongos/push-main.js\nssh me@host "~/deploy.sh"\n```\n',
   });
   assert.equal(r.hardFail, true, 'a skill fencing a main-push with no declaration must fail');
   const text = r.violations.join('\n');
@@ -210,7 +210,7 @@ test('an UNDECLARED fenced ops command is caught', () => {
 test('a skill that DOES declare its fenced commands passes', () => {
   const r = sp.checkOpsSkillsDeclareMachine({
     names: ['good'],
-    read: () => '---\nname: good\nrequires: [push-credential]\n---\n```bash\nnode scripts/gds/skill-preflight.js good\nnode scripts/gds/push-main.js\n```\n',
+    read: () => '---\nname: good\nrequires: [push-credential]\n---\n```bash\nnode scripts/bongos/skill-preflight.js good\nnode scripts/bongos/push-main.js\n```\n',
   });
   assert.equal(r.hardFail, false, r.violations.join('\n'));
 });
@@ -220,7 +220,7 @@ test('declaring MORE than the fences imply is allowed', () => {
   // train people to declare less.
   const r = sp.checkOpsSkillsDeclareMachine({
     names: ['careful'],
-    read: () => '---\nname: careful\nrequires: [gh, tty, main-checkout]\n---\nRun `node scripts/gds/skill-preflight.js careful` first.\n',
+    read: () => '---\nname: careful\nrequires: [gh, tty, main-checkout]\n---\nRun `node scripts/bongos/skill-preflight.js careful` first.\n',
   });
   assert.equal(r.hardFail, false, r.violations.join('\n'));
 });
@@ -281,7 +281,7 @@ test('invoking the preflight anywhere satisfies enforcement — top OR at the st
   // merge-mode gates at Step 0 (capabilities are preconditions for the whole
   // procedure); planning-session gates at the one step that needs ssh. Both are
   // legitimate, so the check must not demand a particular position.
-  const md = '---\nname: x\nrequires: [gh]\n---\nlater on:\n```bash\nnode scripts/gds/skill-preflight.js x\ngh pr view 1 --json state\n```\n';
+  const md = '---\nname: x\nrequires: [gh]\n---\nlater on:\n```bash\nnode scripts/bongos/skill-preflight.js x\ngh pr view 1 --json state\n```\n';
   const r = sp.checkOpsSkillsDeclareMachine({ names: ['x'], read: () => md });
   assert.equal(r.hardFail, false, r.violations.join('\n'));
 });

package/tests/skip_is_not_pass.mjs

@@ -32,7 +32,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { countSkips } from '../scripts/gds/run-unit-tests.js';
+import { countSkips } from '../scripts/bongos/run-unit-tests.js';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -209,3 +209,24 @@ test('countSkips also reads node:test\'s own summary — otherwise THIS file\'s
   // The word in a case NAME must not be counted, same discipline as the SKIP line rule.
   assert.equal(countSkips('  ok  reports how many it skipped 9\n'), 0);
 });
+
+test('countSkips reads the lowercase and whole-file skip shapes too, not only `  SKIP`', () => {
+  // task 1004865: a third of the suites that skip never print the uppercase `  SKIP` line. They
+  // print `  skip <case> — why` (infra_exec_paths, workflow_exec_paths, agent_invoke_live), a
+  // parenthesised `(skipped — why)` under a case, or `<file>.mjs SKIPPED — why` when the whole
+  // file has nothing to run against (page_notes_db, howto_state's db half, every *_db file
+  // without Postgres). Uncounted, each of those read as a clean `ok` in the roll-up.
+  assert.equal(countSkips('  skip infra unit — host topology absent in this checkout\n'), 1);
+  assert.equal(countSkips('  skip  agent_invoke_live — set AGENT_INVOKE_LIVE=1 to spend ~$1\n'), 1);
+  assert.equal(countSkips('        (skipped — a real bot token is present on this machine)\n'), 1);
+  assert.equal(countSkips('        (skipped: no bash here)\n'), 1);
+  assert.equal(countSkips('     (skip — no config/deploy.json in this checkout)\n'), 1);
+  assert.equal(countSkips('page_notes_db.mjs SKIPPED — no reachable Postgres (ECONNREFUSED).\n'), 1);
+  assert.equal(countSkips('  (db half SKIPPED — no reachable Postgres: ECONNREFUSED.)\n'), 1);
+  // One line is one skip, however many of the shapes it happens to match.
+  assert.equal(countSkips('SKIPPED — no database\n'), 1);
+  // Still line-leading or marker-shaped only: a passing case whose NAME says skip is not a skip.
+  assert.equal(countSkips('  ok  skips identical files, pulls the rest\n'), 0);
+  assert.equal(countSkips('  PASS  skip all marks every other step skipped\n'), 0);
+  assert.equal(countSkips('  ok  pullMemory: 0 written + skips → summary\n'), 0);
+});

package/tests/smoke_dependencies_witness.mjs

@@ -1,6 +1,6 @@
 // tests/smoke_dependencies_witness.mjs
 //
-// task 1004191 (finding 62 of the task 1000379 audit): scripts/gds/smoke-dependencies.sh
+// task 1004191 (finding 62 of the task 1000379 audit): scripts/bongos/smoke-dependencies.sh
 // is the only round-trip for the auto-promotion trigger, and its status check used
 // to assert on task A — which the script itself promotes BY HAND in an earlier
 // step. "A is ready after B ships" therefore passed with the trigger broken.
@@ -16,7 +16,7 @@ import { readFileSync } from 'node:fs';
 import { makeRunner } from './helpers.mjs';
 
 const { test, summary } = makeRunner();
-const src = readFileSync(new URL('../scripts/gds/smoke-dependencies.sh', import.meta.url), 'utf8');
+const src = readFileSync(new URL('../scripts/bongos/smoke-dependencies.sh', import.meta.url), 'utf8');
 const code = src.split('\n').filter((l) => !/^\s*#/.test(l)).join('\n');
 
 await test('a second dependent C is created at backlog and wired to B', () => {

package/tests/smoke_preflight.mjs

@@ -15,7 +15,7 @@ import net from 'node:net';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { isLocalTarget, probeListener } = require('../scripts/gds/smoke-gds.js');
+const { isLocalTarget, probeListener } = require('../scripts/bongos/smoke-gds.js');
 
 let passed = 0;
 let failed = 0;

package/tests/smoke_target.mjs

@@ -22,7 +22,7 @@ import path from 'node:path';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { resolveSmokeTarget, formatTargetReport, buildChecks } = require('../scripts/gds/smoke-gds.js');
+const { resolveSmokeTarget, formatTargetReport, buildChecks } = require('../scripts/bongos/smoke-gds.js');
 const ic = require('../src/instance-config.js');
 
 let passed = 0;
@@ -191,7 +191,7 @@ test('report shouts BOTH origins when they disagree — the silence that made th
 // os.homedir()), no *_API_BASE, and a branding pack with an empty publicOrigin.
 
 function runScript(env) {
-  const script = path.resolve(process.cwd(), 'scripts', 'gds', 'smoke-gds.js');
+  const script = path.resolve(process.cwd(), 'scripts', 'bongos', 'smoke-gds.js');
   try {
     const stdout = execFileSync(process.execPath, [script], { env, encoding: 'utf8', timeout: 30_000 });
     return { code: 0, stdout };

package/tests/smoke_write_contract.mjs

@@ -1,7 +1,7 @@
 // tests/smoke_write_contract.mjs — the write-path smoke's own contract
 // (task 1002018).
 //
-// TWO DEFECTS, ONE FILE. Both were found by trying to RUN scripts/gds/smoke-write.sh
+// TWO DEFECTS, ONE FILE. Both were found by trying to RUN scripts/bongos/smoke-write.sh
 // rather than by reading it, and neither was visible to any existing test:
 //
 // 1. IT COULD NOT RUN AT ALL. goal_id became required on POST /tasks (task 1003598,
@@ -30,7 +30,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const SH = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'smoke-write.sh'), 'utf8');
+const SH = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'smoke-write.sh'), 'utf8');
 
 // ---- defect 1: the create must carry a goal_id, resolved not hardcoded -----
 

package/tests/sound_player.mjs

@@ -109,13 +109,13 @@ test('EVERY event-sound variant resolves to a real file, and each event offers a
 test('the generator is idempotent, so the assets are reproducible not mysterious', () => {
   // --check exits non-zero if a re-run would change any byte. An asset nobody can
   // regenerate is how this repo lost the player in the first place.
-  execFileSync(process.execPath, [path.join(ROOT, 'scripts', 'gds', 'gen-sounds.js'), '--check'], { stdio: 'pipe' });
+  execFileSync(process.execPath, [path.join(ROOT, 'scripts', 'bongos', 'gen-sounds.js'), '--check'], { stdio: 'pipe' });
 });
 
 test('the generator does NOT touch chime.wav', () => {
   // chime predates this task and is the sound builders already know; regenerating
   // it would silently swap a familiar sound for a different one.
-  const gen = require(path.join(ROOT, 'scripts', 'gds', 'gen-sounds.js'));
+  const gen = require(path.join(ROOT, 'scripts', 'bongos', 'gen-sounds.js'));
   assert.ok(!Object.keys(gen.SOUNDS).includes('chime'));
   assert.deepEqual(Object.keys(gen.SOUNDS).sort(), ['alert', 'fanfare', 'ship', 'triumph']);
 });
@@ -125,7 +125,7 @@ test('the generator does NOT touch chime.wav', () => {
 test("ship-state's guarded require now resolves the REAL player, not its no-op stub", () => {
   // task 1002199 wrapped this require so a missing player could not crash ship.js.
   // The guard stays — but it must no longer be what actually runs.
-  const shipState = require(path.join(ROOT, 'scripts', 'gds', 'ship-state.js'));
+  const shipState = require(path.join(ROOT, 'scripts', 'bongos', 'ship-state.js'));
   assert.equal(typeof shipState.playSound, 'function');
   assert.equal(shipState.playSound.name, 'playSound',
     'the stub is an anonymous arrow; the real one is a named function');
@@ -144,8 +144,8 @@ test('every prefs READER resolves the same path the WRITER uses', () => {
   const ic = require(path.join(ROOT, 'src', 'instance-config.js'));
   const canonical = ic.configPath('sound-prefs.json');
 
-  const shipIo = require(path.join(ROOT, 'scripts', 'gds', 'ship-io.js'));
-  const turnEnd = require(path.join(ROOT, 'scripts', 'gds', 'turn-end-sound.js'));
+  const shipIo = require(path.join(ROOT, 'scripts', 'bongos', 'ship-io.js'));
+  const turnEnd = require(path.join(ROOT, 'scripts', 'bongos', 'turn-end-sound.js'));
 
   // The player's canonical path must BE the writer's path.
   assert.equal(player.PREFS_PATH, canonical, 'play.js must read where the writer writes');
@@ -162,8 +162,8 @@ test('no reader hardcodes the pre-rename otb path as its ONLY location', () => {
   // reader whose only path is the legacy one is the bug returning.
   const files = [
     path.join(ROOT, '.claude', 'sounds', 'play.js'),
-    path.join(ROOT, 'scripts', 'gds', 'ship-io.js'),
-    path.join(ROOT, 'scripts', 'gds', 'turn-end-sound.js'),
+    path.join(ROOT, 'scripts', 'bongos', 'ship-io.js'),
+    path.join(ROOT, 'scripts', 'bongos', 'turn-end-sound.js'),
   ];
   for (const f of files) {
     const src = fs.readFileSync(f, 'utf8');
@@ -191,7 +191,7 @@ test('the legacy prefs file is still honoured when the canonical one is absent',
 test('the Stop hook resolves the builder CHOSEN variant, not just the fallback', () => {
   // The hook exists at all only as of this task — .claude/settings.json had no
   // Stop hook, so the "Claude finished a turn" sound had nothing to fire it.
-  const turnEnd = require(path.join(ROOT, 'scripts', 'gds', 'turn-end-sound.js'));
+  const turnEnd = require(path.join(ROOT, 'scripts', 'bongos', 'turn-end-sound.js'));
   assert.equal(turnEnd.EVENT_ID, 'user-input');
   assert.equal(turnEnd.FALLBACK_WAV, 'chime');
   const wav = turnEnd.resolveWav();

package/tests/source_text_test_ratchet.mjs

@@ -0,0 +1,97 @@
+// tests/source_text_test_ratchet.mjs — the "tests that only read source text"
+// ratchet (task 1004868, goal 1000135, code audit 2026-10-25 finding R11).
+//
+// WHY. A gate nobody has watched FAIL is not a gate. The load-bearing case here
+// is the negative one: adding ONE new pure source-text test to today's tree must
+// red the ratchet. The detector takes an injected file list + reader, so the new
+// test is virtual — nothing is written into the repo.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const scan = require(path.join(ROOT, 'scripts', 'bongos', 'source-text-test-scan.js'));
+const ratchets = require(path.join(ROOT, 'scripts', 'bongos', 'fitness-ratchets.js'));
+
+// A test that pins wording: reads a page's script and regex-matches it.
+const PURE_SOURCE_TEXT = [
+  "import assert from 'node:assert/strict';",
+  "import { test } from 'node:test';",
+  "import fs from 'node:fs';",
+  "import path from 'node:path';",
+  "const SRC = fs.readFileSync(path.join('public', 'hall.js'), 'utf8');",
+  "test('wording', () => { assert.match(SRC, /Sign out/); });",
+].join('\n');
+
+test('a test that only reads source text IS counted', () => {
+  assert.equal(scan.isSourceTextOnly(PURE_SOURCE_TEXT), true);
+  assert.equal(scan.isSourceTextOnly(PURE_SOURCE_TEXT.replace(/\n/g, '\r\n')), true, 'CRLF must not hide it');
+});
+
+test('a test that exercises code is NOT counted, whichever way it does so', () => {
+  const variants = {
+    'imports the module': "import { f } from '../src/hall.js';",
+    'imports a helper': "import { boot } from './helpers.mjs';",
+    'requires a package': "const pg = require('pg');",
+    'spawns a process': "import { spawnSync } from 'node:child_process';",
+    'evaluates extracted code': "import vm from 'node:vm';",
+    'starts a server': "import http from 'node:http';",
+    'computed require': "const m = require(path.join(ROOT, 'src', 'x.js'));",
+    'dynamic import': 'const m = await import(url);',
+    'new Function': "const fn = new Function('return 1');",
+  };
+  for (const [why, line] of Object.entries(variants)) {
+    assert.equal(scan.isSourceTextOnly(`${PURE_SOURCE_TEXT}\n${line}`), false, `${why} is behaviour`);
+  }
+});
+
+test('reading only docs/JSON, or naming a .js file in a comment, is NOT counted', () => {
+  assert.equal(scan.isSourceTextOnly(PURE_SOURCE_TEXT.replace("'hall.js'", "'README.md'")), false);
+  const commentOnly = [
+    '// tests/x.mjs — pins what ship.js prints',
+    "import fs from 'node:fs';",
+    "const doc = fs.readFileSync('docs/a.md', 'utf8');",
+  ].join('\n');
+  assert.equal(scan.isSourceTextOnly(commentOnly), false);
+});
+
+test('a regex method named exec() is not mistaken for a spawned process', () => {
+  assert.equal(scan.isSourceTextOnly(`${PURE_SOURCE_TEXT}\nconst m = /x/.exec(SRC);`), true);
+});
+
+test("today's tree matches the committed baseline", () => {
+  const r = scan.scanSourceTextTests();
+  assert.ok(r.scanned > 100, `the scan must enumerate the test suite (got ${r.scanned})`);
+  assert.ok(r.files.includes('tests/projects_hub.mjs'), 'the audit\'s largest offender must be counted');
+  assert.ok(!r.files.includes('tests/source_text_test_ratchet.mjs'), 'this file exercises the scanner, so it is not counted');
+  const baselines = JSON.parse(fs.readFileSync(ratchets.BASELINE_PATH, 'utf8')).metrics;
+  assert.equal(typeof baselines.source_text_only_tests, 'number', 'the baseline is recorded');
+  assert.ok(r.total <= baselines.source_text_only_tests, `${r.total} must not exceed baseline ${baselines.source_text_only_tests}`);
+});
+
+test('adding ONE new pure source-text test reds the ratchet, with guidance on what to write instead', () => {
+  const real = scan.scanSourceTextTests();
+  const added = 'tests/new_wording_pin.mjs';
+  const grown = scan.scanSourceTextTests({
+    files: [...scan.trackedTestFiles(), added],
+    read: (f) => (f === added ? PURE_SOURCE_TEXT : fs.readFileSync(path.join(ROOT, f), 'utf8')),
+  });
+  assert.equal(grown.total, real.total + 1);
+  const baselines = { source_text_only_tests: real.total };
+  const { violations } = ratchets.compareToBaselines({ source_text_only_tests: grown.total }, baselines);
+  assert.equal(violations.length, 1);
+  assert.match(violations[0], /source_text_only_tests regressed/);
+  assert.match(violations[0], /behaviour/, 'the failure says how to write a behaviour test');
+  assert.match(violations[0], /source-text-test-scan\.js --files/, 'the failure names the listing command');
+});
+
+test('a collapsed scan is NOT MEASURED rather than a flattering zero', () => {
+  const metrics = ratchets.sourceTextTestMetrics({ files: [] });
+  assert.deepEqual(metrics, {}, 'zero files scanned must omit the metric, not report 0');
+  const ok = ratchets.sourceTextTestMetrics({ files: ['a.mjs'], read: () => PURE_SOURCE_TEXT });
+  assert.deepEqual(ok, { source_text_only_tests: 1 });
+});

package/tests/speciality_corpus_scope.mjs

@@ -25,7 +25,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const { SOURCES } = require(path.join(ROOT, 'scripts', 'gds', 'search-ingest-db.js'));
+const { SOURCES } = require(path.join(ROOT, 'scripts', 'bongos', 'search-ingest-db.js'));
 
 const source = SOURCES.find((s) => s.name === 'specialities_documents');
 

package/tests/speciality_session_skills.mjs

@@ -141,7 +141,7 @@ await test('the real adoption read selects both sets the line needs', () => {
 
 // ---- grants nothing: nothing that decides what runs reads the enabled set ----
 await test('no permission or materialisation surface reads enabled_skills', () => {
-  for (const rel of ['scripts/gds/claude-materialize.js', 'src/bongos/auth.js', 'src/bongos/permission-path-check.js', '.claude/hooks/conductor.js']) {
+  for (const rel of ['scripts/bongos/claude-materialize.js', 'src/bongos/auth.js', 'src/bongos/permission-path-check.js', '.claude/hooks/conductor.js']) {
     const text = fs.readFileSync(path.join(ROOT, rel), 'utf8');
     assert.doesNotMatch(text, /enabled_skills/, `${rel} must not key anything off the enabled set`);
   }

package/tests/sso_checkin_legacy_field_gone.mjs

@@ -38,6 +38,7 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
+const apiArtifacts = () => require('../scripts/bongos/api-artifacts.js').buildApiArtifacts();
 const express = require('express');
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -218,7 +219,8 @@ test('CONTROL: a check-in naming no kind at all still defaults to member (the se
 // ── 3. CONTRACT: the generated API surface no longer offers the field ──────────
 
 test('the generated OpenAPI request schema for the check-in has no `role` property', () => {
-  const spec = JSON.parse(readFileSync(join(ROOT, 'docs', 'api', 'openapi.json'), 'utf8'));
+  // The spec + reference are gitignored (task 1004866): build them from the routes.
+  const spec = JSON.parse(apiArtifacts()['docs/api/openapi.json']);
   const key = Object.keys(spec.paths).find((p) => p.endsWith('/sso/membership/check-in'));
   assert.ok(key, 'the check-in route is in the spec');
   const ref = spec.paths[key].post.requestBody.content['application/json'].schema.$ref;
@@ -230,7 +232,7 @@ test('the generated OpenAPI request schema for the check-in has no `role` proper
 });
 
 test('the generated API reference row for the check-in lists one spelling', () => {
-  const md = readFileSync(join(ROOT, 'docs', 'api-reference.md'), 'utf8');
+  const md = apiArtifacts()['docs/api-reference.md'];
   const row = md.split('\n').find((l) => l.includes('`/api/bongos/sso/membership/check-in`'));
   assert.ok(row, 'the check-in row is in the reference');
   const fields = row.split('|')[4];

package/tests/stale_timer.mjs

@@ -27,11 +27,11 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
 const st = require(path.join(ROOT, 'src/stale-timer.js'));
 
-const PULSE_CLI = read('scripts/gds/pulse.js');
+const PULSE_CLI = read('scripts/bongos/pulse.js');
 const PULSE_LIB = read('modules/sessions/pulse.js');
 const DB_SHIP = read('modules/lifecycle/db-ship.js');
 const ROSTER_ROUTE = read('src/bongos/routes/builders.js');
-const FITNESS = read('scripts/gds/fitness.js');
+const FITNESS = read('scripts/bongos/fitness.js');
 const DOORWAY = read('src/module-api.js');
 
 const { test, summary } = makeRunner();
@@ -146,7 +146,7 @@ await test('every staleness surface resolves through the one timer', () => {
 await test('the sweeper no longer reads the env var itself', () => {
   // The precedence has ONE home. A second reader is how 6-vs-24 happened.
   assert.ok(!/process\.env\.GDS_STALE_CLAIM_HOURS/.test(PULSE_CLI),
-    'scripts/gds/pulse.js must not re-read GDS_STALE_CLAIM_HOURS directly');
+    'scripts/bongos/pulse.js must not re-read GDS_STALE_CLAIM_HOURS directly');
 });
 
 await test('an explicit argument still overrides at every layer', () => {

package/tests/stale_worktrees.mjs

@@ -3,7 +3,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { readFileSync } from 'node:fs';
-import { parseWorktreeList, classifyWorktrees, classifyHusks, lineFor } from '../scripts/gds/stale-worktrees.js';
+import { parseWorktreeList, classifyWorktrees, classifyHusks, lineFor } from '../scripts/bongos/stale-worktrees.js';
 
 const PORCELAIN = [
   'worktree C:/repo',

package/tests/start_env_guard.mjs

@@ -18,7 +18,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { isConnectionError, instanceNotRunningCard, isLocalOrigin } = require('../scripts/gds/start.js');
+const { isConnectionError, instanceNotRunningCard, isLocalOrigin } = require('../scripts/bongos/start.js');
 
 let passed = 0;
 let failed = 0;

package/tests/start_goal_first.mjs

@@ -3,7 +3,7 @@
 //
 // The owner's rules (2026-10-08): the joined goals sit ABOVE the claimable table
 // and never replace it, and a task with no goal is listed under "Other work".
-// These drive the pure helpers in scripts/gds/start-goals.js and the real table
+// These drive the pure helpers in scripts/bongos/start-goals.js and the real table
 // renderer start.js uses, so the property that matters — every claimable row is
 // still listed, exactly once — is checked on what the builder actually sees.
 
@@ -13,7 +13,7 @@ import { makeRunner } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const { test, summary } = makeRunner();
-const sg = require('../scripts/gds/start-goals.js');
+const sg = require('../scripts/bongos/start-goals.js');
 
 const GOALS = [
   { id: 10, title: 'Alpha', status: 'open', viewer_is_member: false },
@@ -75,7 +75,7 @@ await test('a builder in no goal gets no goals list, and the table still lists e
 
 await test('start.js renders "Your goals" ABOVE the table and groups the table by goal (the wiring)', () => {
   const fs = require('node:fs');
-  const src = fs.readFileSync(require.resolve('../scripts/gds/start.js'), 'utf8');
+  const src = fs.readFileSync(require.resolve('../scripts/bongos/start.js'), 'utf8');
   const goalsAt = src.indexOf("surface.strong('Your goals')");
   const tableAt = src.indexOf("surface.strong('Claim one to start')");
   assert.ok(goalsAt > 0 && goalsAt < tableAt, 'markdown: goals before the table');

package/tests/start_inbox_count.mjs

@@ -25,7 +25,7 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 
 const require = createRequire(import.meta.url);
-const START_PATH = require.resolve('../scripts/gds/start.js');
+const START_PATH = require.resolve('../scripts/bongos/start.js');
 const { inboxOpenCount } = require(START_PATH);
 
 let passed = 0;

package/tests/start_rebase_warning.mjs

@@ -18,7 +18,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const { rebaseWarningModel, rebaseWarningMarkdown, rebaseWarningWidget } =
-  require('../scripts/gds/start.js');
+  require('../scripts/bongos/start.js');
 
 let passed = 0;
 let failed = 0;