@bongos/core 1.21.175 → 1.21.177

package/docs/recipes/windows-builders.md

@@ -13,7 +13,7 @@ PowerShell-specific gotchas (stderr false-failures, BOM) live in
 
 ## api.js: MSYS path mangling is auto-repaired (no more `MSYS_NO_PATHCONV=1`)
 
-- **Was:** Git Bash rewrites a leading-slash argument before node sees it — `node scripts/gds/api.js GET /tasks/123`
+- **Was:** Git Bash rewrites a leading-slash argument before node sees it — `node scripts/bongos/api.js GET /tasks/123`
   arrived as `GET C:/Program Files/Git/tasks/123` and hit the usage error, unless every call was
   prefixed `MSYS_NO_PATHCONV=1`.
 - **Now (task 1002809):** `api.js` detects the mangled prefix via `EXEPATH` and strips it itself
@@ -21,7 +21,7 @@ PowerShell-specific gotchas (stderr false-failures, BOM) live in
   still type it out of habit.
 - **Still true:** judge success by the JSON + status line, not folklore about exit codes — and if
   you ever see the libuv `UV_HANDLE_CLOSING` assertion after the JSON printed, that teardown class
-  of bug is tracked in [scripts/gds/CLAUDE.md](../../scripts/gds/CLAUDE.md) (task 1002734's
+  of bug is tracked in [scripts/bongos/CLAUDE.md](../../scripts/bongos/CLAUDE.md) (task 1002734's
   `cliExit` rule).
 
 ## api.js: inline `--body` loses its quotes — use `--body-file`
@@ -30,9 +30,9 @@ Shells on Windows strip/re-split inline JSON quoting. The durable pattern for an
 
 ```bash
 # write the JSON with a real editor/tool, then:
-node scripts/gds/api.js POST /tasks --body-file C:/tmp/body.json
+node scripts/bongos/api.js POST /tasks --body-file C:/tmp/body.json
 # or pipe it (no temp file):
-node scripts/gds/api.js POST /claims --body-file - <<'EOF'
+node scripts/bongos/api.js POST /claims --body-file - <<'EOF'
 {"task_id": 123, "worktree_name": "task-123"}
 EOF
 ```
@@ -52,9 +52,9 @@ placements work on Windows:
   is where the destructive trap lives. Use the helper, never hand-rolled `mklink`:
 
   ```bash
-  node scripts/gds/worktree.js add <task-id> --outside     # worktree + junction, no shell quoting
-  node scripts/gds/worktree.js remove task-<id>            # unlinks the junction FIRST
-  node scripts/gds/worktree.js list                        # shows which worktrees carry junctions
+  node scripts/bongos/worktree.js add <task-id> --outside     # worktree + junction, no shell quoting
+  node scripts/bongos/worktree.js remove task-<id>            # unlinks the junction FIRST
+  node scripts/bongos/worktree.js list                        # shows which worktrees carry junctions
   ```
 
 ### ⚠ The trap (why the helper exists — task 1002809)
@@ -88,7 +88,7 @@ for 13 registered worktrees when it was finally measured). Worse, a husk is invi
 directory has left. Sweep them when the lock has cleared:
 
 ```bash
-node scripts/gds/worktree.js prune-husks
+node scripts/bongos/worktree.js prune-husks
 ```
 
 It deletes only an **empty** husk that the current process is not standing in and that has not
@@ -101,7 +101,7 @@ residue. `--force` waives the 24-hour rule and nothing else.
 
 A raw `node --test tests/*.mjs` has a **large stable failure baseline on Windows boxes** (mostly
 DB-backed tests with no local Postgres — the count drifts and is not worth recording). Run
-**`node scripts/gds/run-unit-tests.js`** instead: it is the DB-free gate CI actually runs, so its
+**`node scripts/bongos/run-unit-tests.js`** instead: it is the DB-free gate CI actually runs, so its
 result means something locally.
 
 **That gate's Windows baseline, re-measured for task 1003860 on 2026-09-12 in a deps-installed
@@ -123,7 +123,7 @@ below).
 hard-exits after serving HTTP can print a clean verdict and then die natively —
 `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING)`, exit `127` or `3221226505`
 (`0xC0000409`). This is the `cliExit` class documented in
-[scripts/gds/CLAUDE.md](../../scripts/gds/CLAUDE.md). Timing decides it:
+[scripts/bongos/CLAUDE.md](../../scripts/bongos/CLAUDE.md). Timing decides it:
 `provisioning_github_app_routes` aborted 5 runs of 6, and in task 1003860 one unchanged tree
 answered 9 failures in one sweep and 8 in the next. A new failure could take a vanished one's
 place and the count would not move. `run-unit-tests.js` now recognises the abort by that stderr
@@ -158,7 +158,7 @@ branch, so a green branch can red the PR when a regenerated file goes stale agai
 
 When the pager closes the pipe mid-run, node dies on EPIPE and the land chain aborts silently —
 the task strands at `confirmed` (hit on task 1001860). Run it unpiped or `> file`; a stranded
-confirmed task re-lands by re-running `node scripts/gds/ship.js <id>` (resume is idempotent).
+confirmed task re-lands by re-running `node scripts/bongos/ship.js <id>` (resume is idempotent).
 
 ## ship.js: a failed post-land ship call may be a success — now auto-verified
 
@@ -179,17 +179,17 @@ you see a ship-call failure from older tooling, check `GET /tasks/<id>` before r
 
 - **Symptom:** `This session is isolated in the worktree … but this command is too complex to verify that it stays inside` (25×), `… changes directory to the shared checkout` (7×), `… runs export PATH= with a value every later program …` (6×), `… runs a command whose name is computed at runtime` (3×). 1,931 of 2,370 Bash calls in the scan were compound.
 - **Root cause:** a session that entered a worktree (EnterWorktree) has Claude Code checking that each Bash command stays inside it. A chain of `export … ; cd … && …` defeats the checker, so it refuses the whole command.
-- **Fix:** one purpose per command; use paths relative to the worktree (the Bash tool's cwd is the worktree); no `export PATH=` prefix once node is on PATH; never `cd` into the main checkout from a worktree session (learning 2026-08-29: `../../../` checks and dirties the MAIN checkout — run the worktree's own `scripts/gds/` copy).
+- **Fix:** one purpose per command; use paths relative to the worktree (the Bash tool's cwd is the worktree); no `export PATH=` prefix once node is on PATH; never `cd` into the main checkout from a worktree session (learning 2026-08-29: `../../../` checks and dirties the MAIN checkout — run the worktree's own `scripts/bongos/` copy).
 
 ## `git fetch` / `git push` / `ls-remote` fail here BY DESIGN
 
-- This machine holds no GitHub push credential (ADR 0031 §6 / ADR 0055). The scan found 22 `git fetch` attempts in three days, all wasted. Landing is server-mediated: `/builder-ship` uploads a bundle and the server pushes, opens the PR and lands it. To see whether work reached GitHub use `GET /api/bongos/tasks/:id/publish-status`, never a raw git probe. To base a new worktree on fresh main, `node scripts/gds/worktree.js add <task-id> --base origin/main` (worktree.js fetches through the sanctioned path).
+- This machine holds no GitHub push credential (ADR 0031 §6 / ADR 0055). The scan found 22 `git fetch` attempts in three days, all wasted. Landing is server-mediated: `/builder-ship` uploads a bundle and the server pushes, opens the PR and lands it. To see whether work reached GitHub use `GET /api/bongos/tasks/:id/publish-status`, never a raw git probe. To base a new worktree on fresh main, `node scripts/bongos/worktree.js add <task-id> --base origin/main` (worktree.js fetches through the sanctioned path).
 
 ## A worktree without `node_modules` fails 300+ tests — and the count is not the signal
 
 - **Symptom:** `Cannot find module 'pg'` / `'express'`; `npm test` reports ~300 FAILED; 9 `npm install`s and 2 dead junctions in three days of transcripts.
-- **What the tooling does now:** SessionStart prints one `[otb] node_modules is missing …` line (from `scripts/gds/preflight.js`'s check) when neither the worktree nor the main checkout has it. Install ONCE in the main checkout (`npm ci`); inside-repo worktrees resolve from it.
-- **Rule:** when comparing a local run against CI, compare failing test NAMES against an untouched checkout of `origin/main`, never counts — a ~25-failure Windows baseline has masked real regressions (session logs 2026-08-14, 2026-08-19). `node scripts/gds/ship-check.js --tests` prints the names.
+- **What the tooling does now:** SessionStart prints one `[otb] node_modules is missing …` line (from `scripts/bongos/preflight.js`'s check) when neither the worktree nor the main checkout has it. Install ONCE in the main checkout (`npm ci`); inside-repo worktrees resolve from it.
+- **Rule:** when comparing a local run against CI, compare failing test NAMES against an untouched checkout of `origin/main`, never counts — a ~25-failure Windows baseline has masked real regressions (session logs 2026-08-14, 2026-08-19). `node scripts/bongos/ship-check.js --tests` prints the names.
 - **The "a test can't find its dep inside a worktree" family is CLOSED — do not go looking for a worktree bootstrap to repair.** It had exactly one member, `tests/logger.mjs`, which required pino by an absolute `<root>/node_modules/pino`; task 1003616 changed it to a bare specifier with a `require.resolve` skip guard on 2026-09-07. Re-verified in task 1003529 from a fresh `.claude/worktrees/` worktree carrying no `node_modules` of its own: `logger` passes, and the whole gate resolves `pino`/`express` by walk-up to the main checkout. **The bug was never the missing `node_modules`** — an inside-repo worktree is not supposed to have one — it was the absolute path that stopped node walking up. A dep failure here means you are outside the repo (use `worktree.js add --outside`, which makes the junction) or the main checkout was never installed. Task 1003519 was a duplicate row for this same bug and is merged into 1003616.
 
 ## `tests/git_merge_regen.mjs` — when it reds, suspect `.gitattributes` first, not Windows
@@ -198,7 +198,7 @@ This test is the consistency gate between **two** sources that must agree, and i
 caught a real bug during task 1003548, so read its assertion before blaming the platform:
 
 - **Every path declared `merge=otb-regen` in `.gitattributes` must be in `REGENERABLE`**
-  (`scripts/gds/git-merge-regen.js`, derived from `gen-repo-map.NESTED_DIRS` + the whole-file set).
+  (`scripts/bongos/git-merge-regen.js`, derived from `gen-repo-map.NESTED_DIRS` + the whole-file set).
   Drop a doc from the generators and its `.gitattributes` line has to come out in the same commit —
   otherwise a merge on that path routes through a driver that cannot regenerate it. The failure reads
   `.gitattributes declares merge=otb-regen for <path> but REGENERABLE … does not know it`.
@@ -212,10 +212,10 @@ caught a real bug during task 1003548, so read its assertion before blaming the
 
 ## CRLF: a multi-line find silently misses, and a whole-file diff is usually line endings
 
-- Several hall files (`roster.css`, `roster.html`, `style.css`, the privacy spec) and every `.claude/skills/*/SKILL.md` are CRLF; `scripts/gds/*.js` and the tests are LF. An exact-string patch must detect the file's EOL before joining lines (`text.includes('\r\n') ? '\r\n' : '\n'`), or the find matches nothing and the edit is a silent no-op (session log 2026-08-24).
+- Several hall files (`roster.css`, `roster.html`, `style.css`, the privacy spec) and every `.claude/skills/*/SKILL.md` are CRLF; `scripts/bongos/*.js` and the tests are LF. An exact-string patch must detect the file's EOL before joining lines (`text.includes('\r\n') ? '\r\n' : '\n'`), or the find matches nothing and the edit is a silent no-op (session log 2026-08-24).
 - A `git diff --stat` that touches every line of a file you barely edited is an EOL flip — check with `git diff --stat --ignore-cr-at-eol`, and restore the original EOL before committing.
 - **`copy-inventory.js --check` no longer reds on line endings alone** (task 1003619). It used to: the generator emits LF and the check byte-compared that against a CRLF worktree file, so `/ship-check` showed one permanent red line on every Windows checkout while the committed content was already correct — and a builder who "fixed" it committed a whole-file CRLF diff. `docs/copy-inventory.md` is now pinned `text eol=lf` in `.gitattributes` (its `.json` sibling always was, via `*.json`), and the check compares EOL-blind so an already-CRLF worktree passes without a re-clone. If it reports STALE now, the content really is stale — regenerate, don't reach for `--ignore-cr-at-eol`. Since task 1003981 `*.md` IS pinned repo-wide (`*.md text eol=lf`), so a fresh clone gets LF markdown everywhere and a markdown reader no longer has to be CRLF-aware to be correct. An EXISTING Windows checkout keeps its CRLF copies until git rewrites them — the clean filter still normalises to LF on add, so `git status` stays quiet and nothing is broken; to convert in place, `git rm --cached -r . && git reset --hard`.
-- **A freshness check compares CONTENT, so route it through `sameContent()`** (`scripts/gds/gen-freshness.js`) rather than `===` on file bytes. A pin is the wrong lever on its own: regenerating never clears a byte-wise red, because the write lands LF and git converts it back on the next checkout. `tests/gen_freshness.mjs` enforces this for the four gated generators; `tests/api_client.mjs` was outside that guard and reported the client STALE forever on Windows until task 1003529 (`index.d.ts` and `README.md` are the two generated client files with no `eol=lf` pin).
+- **A freshness check compares CONTENT, so route it through `sameContent()`** (`scripts/bongos/gen-freshness.js`) rather than `===` on file bytes. A pin is the wrong lever on its own: regenerating never clears a byte-wise red, because the write lands LF and git converts it back on the next checkout. `tests/gen_freshness.mjs` enforces this for the four gated generators; `tests/api_client.mjs` was outside that guard and reported the client STALE forever on Windows until task 1003529 (`index.d.ts` and `README.md` are the two generated client files with no `eol=lf` pin).
 
 ## Four Windows traps that make a test lie — all four found in one pass (task 1003529)
 

package/docs/research/llm-model-agnostic-and-cheaper-grader.md

@@ -66,11 +66,11 @@ Model identity is a **substring-on-the-id** convention repeated in four places.
 
 Not everything goes through `runSubagent`. A `grep` for direct `claude` spawns / `CLAUDE_BIN` turned up these additional sites — each is a *second* spawn shape to bring under the port (or to leave as-is if it stays Claude-only): ✅
 
-- **`scripts/gds/architect-audit.js`** — *reuses* `grader.runSubagentCached` (so it inherits the port for free) but hard-codes `ARCHITECT_MODEL = 'claude-opus-4-7'` (≈ line 55). One constant to parameterize.
-- **`scripts/gds/run-routine.js`** — the scheduled-routine runner; `judgment`/`hybrid` modes "spawn `claude -p`" over a skill body (≈ lines 11–14, 140). Its own spawn helper.
+- **`scripts/bongos/architect-audit.js`** — *reuses* `grader.runSubagentCached` (so it inherits the port for free) but hard-codes `ARCHITECT_MODEL = 'claude-opus-4-7'` (≈ line 55). One constant to parameterize.
+- **`scripts/bongos/run-routine.js`** — the scheduled-routine runner; `judgment`/`hybrid` modes "spawn `claude -p`" over a skill body (≈ lines 11–14, 140). Its own spawn helper.
 - **`modules/autonomy/pollers/routine-timers.js`** — drives routine spawns (autonomy module).
-- **`scripts/gds/onboarding-analyze.js`**, **`scripts/gds/newcomer-floor.js`**, **`scripts/gds/doctor.js`** — each references the `claude` binary directly (onboarding analysis, newcomer-floor classification, env doctor checks).
-- **`scripts/gds/session-cost.js`** — does **not** spawn; it *parses* Claude Code's transcript layout: `~/.claude/projects/<encoded-cwd>/*.jsonl`, per-turn `message.usage` token blocks, and excludes grader-worker subprocess transcripts (≈ lines 32–86, `priceTranscript` ≈ line 140). This is a coupling to the **Claude Code interactive harness's on-disk format**, not to the model — see §2.4.
+- **`scripts/bongos/onboarding-analyze.js`**, **`scripts/bongos/newcomer-floor.js`**, **`scripts/bongos/doctor.js`** — each references the `claude` binary directly (onboarding analysis, newcomer-floor classification, env doctor checks).
+- **`scripts/bongos/session-cost.js`** — does **not** spawn; it *parses* Claude Code's transcript layout: `~/.claude/projects/<encoded-cwd>/*.jsonl`, per-turn `message.usage` token blocks, and excludes grader-worker subprocess transcripts (≈ lines 32–86, `priceTranscript` ≈ line 140). This is a coupling to the **Claude Code interactive harness's on-disk format**, not to the model — see §2.4.
 
 ### 2.4 The interactive session is coupled to the harness, not just the model
 
@@ -78,7 +78,7 @@ The main builder session runs inside the **Claude Code CLI harness** itself, whi
 
 - **`session-cost.js`** reads the harness's JSONL transcript format and prices it with `llm-pricing` (the interactive session has no `total_cost_usd` envelope, only token counts — that's the whole reason `llm-pricing.js` exists, per its header). ✅
 - The **subagent model-routing policy** lives in `CLAUDE.md §2` as prose ("main session = Opus 4.8 (1M); subagents set `model` explicitly; Haiku for plumbing, Opus for everything else"). It is a *human/agent instruction*, not code — so "model-agnostic" at the interactive tier is partly a **docs/policy** change, not only a code change. ⚠️
-- `scripts/gds/cli-lib.js`, `setup.js`, `me.js`, `auth.js`, `db.js`, `db-kernel.js` matched the grep but on inspection reference Claude only in **comments / `~/.config/otb/` paths / the `claude`-CLI auth story**, not in a model call. Low-priority for a provider port; relevant only if the platform ever wants the *interactive* tier on a non-Claude harness (out of scope for ADR 0089, which targets the **grader/platform** calls, not the human's editor). ✅🔧
+- `scripts/bongos/cli-lib.js`, `setup.js`, `me.js`, `auth.js`, `db.js`, `db-kernel.js` matched the grep but on inspection reference Claude only in **comments / `~/.config/otb/` paths / the `claude`-CLI auth story**, not in a model call. Low-priority for a provider port; relevant only if the platform ever wants the *interactive* tier on a non-Claude harness (out of scope for ADR 0089, which targets the **grader/platform** calls, not the human's editor). ✅🔧
 
 ### 2.5 What is NOT coupled (already abstracted, leave alone)
 
@@ -222,6 +222,6 @@ Per the task's instruction, this doc lists recommended follow-ups rather than cr
 
 ## 9. Sources
 
-- The live repo, read 2026-06-28: `modules/grading/grader.js`, `modules/grading/grader-workers/index.js`, `modules/grading/CLAUDE.md`, `src/bongos/llm-pricing.js`, `src/bongos/cascade-dispatch.js`, `modules/builder-settings/skill-prefs.js`, `scripts/gds/ci-grade.js`, `scripts/gds/architect-audit.js`, `scripts/gds/session-cost.js`, `scripts/gds/run-routine.js`.
+- The live repo, read 2026-06-28: `modules/grading/grader.js`, `modules/grading/grader-workers/index.js`, `modules/grading/CLAUDE.md`, `src/bongos/llm-pricing.js`, `src/bongos/cascade-dispatch.js`, `modules/builder-settings/skill-prefs.js`, `scripts/bongos/ci-grade.js`, `scripts/bongos/architect-audit.js`, `scripts/bongos/session-cost.js`, `scripts/bongos/run-routine.js`.
 - [ADR 0089 — Modular, multi-model adversarial grader](../adr/0089-modular-multi-model-adversarial-grader.md) (the accepted direction this spike grounds; includes the external literature + market sweep — self-preference, PoLL, *Nine Judges*, open-weight model licenses, hosting math).
 - [ADR 0028 — Honest LLM spend accounting](../adr/0028-honest-llm-spend-accounting.md), [ADR 0077 — Content-addressed LLM cache](../adr/0077-content-addressed-llm-cache.md), [ADR 0080 — LLM cache API transport & trust model](../adr/0080-llm-cache-api-transport-and-trust-model.md), [ADR 0062 — Instance-model decoupling](../adr/0062-medusa-instance-model-decoupling.md), [ADR 0021 — Per-builder skill model preferences](../adr/0021-per-builder-skill-model-preferences.md).

package/docs/research/task-network-map-readability.md

@@ -2,7 +2,7 @@
 
 - **Task:** [1003282](https://cloudbongos.com/builders#/task/1003282) · goal 1000072 (Human legibility)
 - **Date:** 2026-08-28
-- **Harness:** [`scripts/gds/spike-task-map.js`](../../scripts/gds/spike-task-map.js) — no dependencies, no network, no DB. Re-run with `node scripts/gds/spike-task-map.js`.
+- **Harness:** `scripts/bongos/spike-task-map.js` — no dependencies, no network, no DB. Deleted once this verdict was written ([task 1004857](https://cloudbongos.com/builders#/task/1004857)); recover it with `git show b8c20cba2:scripts/bongos/spike-task-map.js > spike-task-map.js` to re-run it.
 - **Figures:** [`docs/research/task-network-map/`](task-network-map/) — rendered by the harness, not drawn by hand.
 
 ## The answer
@@ -35,7 +35,7 @@ not change the verdict. Point the harness at a real dump to replace every number
 with a measured one:
 
 ```
-node scripts/gds/spike-task-map.js --from tasks.json     # a GET /tasks?include=deps dump
+node spike-task-map.js --from tasks.json     # a GET /tasks?include=deps dump (harness recovered from history, see above)
 ```
 
 Four views of the same corpus, all at 1280×720 (a laptop viewport with the hall's chrome
@@ -179,7 +179,7 @@ of new map to build is none.**
   is what makes the verdict robust — every conclusion above holds from p=2% to p=40% —
   but the *specific* numbers are model output, not observation. Re-run with `--from`.
 - **The goal count (40) and the 85% within-goal edge preference are modelled**, from the
-  repo's own record of ~38 open goals on BONGOS-V1 (`scripts/gds/goal-names.js`) and from
+  repo's own record of ~38 open goals on BONGOS-V1 (`scripts/bongos/goal-names.js`) and from
   how dependencies are declared in practice. A very different real distribution would
   change C's edge count — not A's isolation, which is bounded by p by construction.
 - **`marks` is a proxy for legibility, not legibility.** It counts what is

package/migrations/core_278_builder_tester_tag.sql

@@ -0,0 +1,18 @@
+-- core_278 a builder account can carry the tester tag
+-- Applied under task 1004845.
+--
+-- WHY. Some accounts exist to try the product, not to build it (the dormant-accounts
+-- sweep of 2026-10-23 found five). Merging or archiving them loses something the owner
+-- wants kept, and leaving them untouched fills the leaderboard and the directory with
+-- people who are not really there. The tag keeps the account whole and takes it out of
+-- the public lists.
+--
+-- SHAPE. One boolean, false by default, NOT NULL: every existing builder is an ordinary
+-- builder and an older release that never names the column keeps inserting as before.
+-- It is not system_role: that column marks machine principals, with its own CHECK and
+-- no API writer, and a human tester is neither.
+
+ALTER TABLE builders ADD COLUMN IF NOT EXISTS is_tester boolean NOT NULL DEFAULT false;
+
+INSERT INTO schema_migrations (version) VALUES ('core_278_builder_tester_tag')
+  ON CONFLICT (version) DO NOTHING;

package/migrations/core_279_bongos_shipper_new_scripts_path.sql

@@ -0,0 +1,13 @@
+-- core_279_bongos_shipper_new_scripts_path.sql — the shipper badge names the builder
+-- CLI's new folder (task 1004848).
+--
+-- scripts/gds/ moved to scripts/bongos/ (criterion C3 of goal 1000073). The badge's
+-- description is what the hall and the locked-progress hint show a builder, so it
+-- names the folder they will actually touch. The evaluator in
+-- modules/economy/achievements.js matches BOTH spellings — tasks shipped before the
+-- move recorded the old path in touches[] and still count — so only the words change.
+-- The id `gds-shipper` stays: builder_achievements rows key on it.
+
+UPDATE achievements
+   SET description = 'Ship a task whose touches[] include src/bongos/ or scripts/bongos/.'
+ WHERE id = 'gds-shipper';

package/modules/agents/lib/answer-hold.js

@@ -27,7 +27,7 @@
 //     agent read sitting in memory for no one.
 //
 // A caller that needs the answer durably passes `--out` to
-// `scripts/gds/agent-invoke.js` and owns the file. That is the deliberate split:
+// `scripts/bongos/agent-invoke.js` and owns the file. That is the deliberate split:
 // the CLI delivers to the operator's disk, the route delivers to the operator's
 // next request, and neither writes agent prose into a table.
 //

package/modules/agents/lib/gate.js

@@ -4,7 +4,7 @@
 // not, what does the ledger row say (task 1002493).
 //
 // WHY IT IS ITS OWN FILE. Two callers ask the same question from opposite sides
-// of the trust boundary: `scripts/gds/agent-invoke.js` (task 1002491) runs where
+// of the trust boundary: `scripts/bongos/agent-invoke.js` (task 1002491) runs where
 // the operator is, and `POST /agents/:name/invoke` runs on the server. A gate
 // with two implementations is a gate with two behaviours the day one of them is
 // edited — and the interesting half of this answer is the REASON, which is the

package/modules/agents/lib/validate.js

@@ -54,7 +54,7 @@ const TRIGGER_TYPES = Object.freeze(['event', 'on-demand', 'cron']);
 
 // The cadence vocabulary a 'cron' trigger may declare, in trigger_spec.cadence.
 //
-// DUPLICATED FROM scripts/gds/routine-schedule.js ON PURPOSE, for the reason
+// DUPLICATED FROM scripts/bongos/routine-schedule.js ON PURPOSE, for the reason
 // RANK_ORDER below is duplicated: a module may require only src/module-api.js
 // (ADR 0083), so it cannot reach into scripts/. The two copies are kept honest by
 // tests/agents_cron_trigger.mjs, which reads routine-schedule.js's own CADENCES +

package/modules/autonomy/db.js

@@ -62,6 +62,14 @@ async function readAutonomyRuns({ routine = null, limit = 20 } = {}) {
   return rows.map((r) => ({ ...r, id: String(r.id) }));
 }
 
+// readRankRoster — every builder's id, login, rank and status, for the daily
+// rank-roles check (task 1004878). No WHERE on purpose: an INACTIVE builder on a
+// legacy rank is exactly the row a future CHECK-narrowing migration would fail on.
+async function readRankRoster() {
+  const { rows } = await pool.query('SELECT id, github_login, rank, status FROM builders ORDER BY id');
+  return rows;
+}
+
 // ── the Autobongos fence (task 1003908, ADR 0307 §6) ─────────────────────────
 //
 // These back the one control surface the runner host cannot write to. Everything
@@ -350,6 +358,7 @@ module.exports = {
   recordAutonomyRun,
   lastAutonomyHead,
   readAutonomyRuns,
+  readRankRoster,
   recordRunnerHeartbeat,
   readRunnerHeartbeats,
   readFence,

package/modules/autonomy/gauge.js

@@ -24,7 +24,7 @@
 // failure a missing file looks most like.
 //
 // PURE. No I/O, no clock of its own — `now` is always injected. The readers that
-// touch disk live in the CLI (scripts/gds/autonomy-gauge.js), the same split
+// touch disk live in the CLI (scripts/bongos/autonomy-gauge.js), the same split
 // autonomy-gate.js draws between `decide` and `gatherSignals`.
 
 const WEEK_SECONDS = 7 * 24 * 60 * 60;

package/modules/autonomy/governor-docket.js

@@ -9,7 +9,7 @@
 // only when it needs a governor: the switch is off, or it is on with no goal
 // allowed (nothing can build either way). And the "money" reading: the one
 // budget this project actually records is the unattended-spend ceiling the
-// autonomy gate brakes on (scripts/gds/autonomy-gate.js `ceilingUsd`), against
+// autonomy gate brakes on (scripts/bongos/autonomy-gate.js `ceilingUsd`), against
 // the month's unattended spend (economy's `autonomousApiSpendMtd`, through the
 // `reward` port). So "money left" is honestly "what unattended building may still
 // spend this month" — the project has no wider budget to count down from, and the
@@ -20,7 +20,7 @@
 
 const api = require('../../src/module-api');
 const db = require('./db');
-const autonomyGate = require('../../scripts/gds/autonomy-gate');
+const autonomyGate = require('../../scripts/bongos/autonomy-gate');
 const runnerHealth = require('./runner-health');
 
 const POINT = 'governor.docket';

package/modules/autonomy/module.json

@@ -1,7 +1,7 @@
 {
   "key": "autonomy",
   "title": "Autonomy & MAS (conductor · architect · gate · routine timers)",
-  "description": "The Multi-Agent System's autonomy surfaces (ADR 0024): the $0 deterministic autonomy gate (System 3 — a precheck route + the gate CLI, inert until OTB_AUTONOMY_ENABLED=1), the conductor mid-flight dispatch CLI (Phase 4), the Architect bounded first-principles --scope audit CLI (Phase 5), and the in-process routine timers (System 4 / ADR 0078 amendment — the weekly peer-vote-tally poller). A core-domain module carved out of the GDS core in BV1.R83 (ADR 0093 §1); default-on because the autonomy machinery + the durable routine timer ship to every instance (both are inert/no-op until armed or the pool is reachable). Cross-cutting: it OBSERVES lifecycle events. The routine timer reaches the lifecycle `tallyPeerVotes` capability through the published doorway (a tracked lifecycle leak until R86), never a core require; the precheck route + the gate/conductor/architect CLIs travel with this domain (the CLIs stay under scripts/, outside the kernel boundary, so they may still read the ideas/economy/lifecycle signals + the grader directly). Registers no port — core never calls back in.",
+  "description": "The Multi-Agent System's autonomy surfaces (ADR 0024): the $0 deterministic autonomy gate (System 3 — a precheck route + the gate CLI, inert until OTB_AUTONOMY_ENABLED=1), the conductor mid-flight dispatch CLI (Phase 4), the Architect bounded first-principles --scope audit CLI (Phase 5), and the in-process routine timers (System 4 / ADR 0078 amendment — the weekly peer-vote-tally poller, and since task 1004878 the daily rank-roles and dependency-audit checks). A core-domain module carved out of the GDS core in BV1.R83 (ADR 0093 §1); default-on because the autonomy machinery + the durable routine timer ship to every instance (both are inert/no-op until armed or the pool is reachable). Cross-cutting: it OBSERVES lifecycle events. The routine timer reaches the lifecycle `tallyPeerVotes` capability through the published doorway (a tracked lifecycle leak until R86), never a core require; the precheck route + the gate/conductor/architect CLIs travel with this domain (the CLIs stay under scripts/, outside the kernel boundary, so they may still read the ideas/economy/lifecycle signals + the grader directly). Registers no port — core never calls back in.",
   "version": "1.0.0",
   "coreVersion": "^1.11.0",
   "category": { "parent": "work" },
@@ -9,7 +9,7 @@
   "maintenance": { "status": "core-maintained" },
   "contributes": {
     "routes": ["autonomy"],
-    "pollers": ["routine-timers"]
+    "pollers": ["routine-timers", "daily-checks"]
   },
   "provides": [],
   "consumes": []

package/modules/autonomy/pollers/daily-checks.js

@@ -0,0 +1,262 @@
+'use strict';
+
+// modules/autonomy/pollers/daily-checks.js — the deterministic daily checks, fired
+// by the always-on server itself (task 1004878).
+//
+// WHY IN-PROCESS. Every one of these routines declared a cadence and nothing fired
+// it: the repo's only scheduler was .github/workflows/, whose minutes are billable
+// and already oversubscribed, and the operator-side cron the SKILL.md files kept
+// asking for was never written. The routine-timers poller beside this one solved
+// the same problem for peer-vote-tally (ADR 0078 amendment) — an in-process timer
+// costs nothing and cannot be forgotten by an operator. This is that pattern for
+// the daily checks.
+//
+// THE CHECKS (the rows of ../server-schedule.js with poller 'daily-checks'):
+//   - rank-roles-audit  — every builder on one of the live ranks (task 1002873).
+//                         Reads the roster straight from this instance's DB, so it
+//                         needs no CLI session — the reason the script never ran
+//                         unattended.
+//   - dep-audit-nightly — `npm audit` of the DEPLOYED instance (its own root and
+//                         lockfile, not a repo checkout), high/critical only.
+//
+// DAILY BY THE CLOCK, NOT BY THE BOOT. The server restarts on every deploy, and a
+// boot-anchored timer would re-run (and re-file) on each one. So the timer only
+// ticks hourly and asks the ledger: a check runs when its last `autonomy_runs` row
+// is (nearly) a day old. The same rows are what GET /autonomy/runs shows, so
+// "did the daily check run, and what did it find" is answerable from a laptop.
+//
+// ONE IDEA PER DISTINCT FINDING SET. A finding is filed into the idea inbox once;
+// the run row stores a fingerprint of what was found, and the next day's identical
+// result is recorded as `unchanged` instead of filed again. A changed set (a new
+// vulnerability, a second bad rank) files again. A clean run clears it, so a
+// regression after a fix is a fresh idea.
+//
+// Mirrors routine-timers.js (but logs through api.logger, not console): kill switch ROUTINE_TIMERS_DISABLED, unref'd timers,
+// best-effort (a throw logs and waits for the next tick — never crashes the
+// server), pure w.r.t. injected deps so it unit-tests without a database, and a
+// quiet no-op anywhere the database is unreachable (builder laptops).
+
+const { execFile } = require('node:child_process');
+const crypto = require('node:crypto');
+const api = require('../../../src/module-api');
+const autonomyDb = require('../db');
+const rankRoles = require('../rank-roles');
+const depAudit = require('../../../scripts/security/dep-audit');
+const { SERVER_ROUTINES, periodMs } = require('../server-schedule');
+
+const log = api.logger('autonomy');
+
+const ROUTINES = SERVER_ROUTINES.filter((r) => r.poller === 'daily-checks').map((r) => r.routine);
+
+const TICK_MS = Number(process.env.ROUTINE_DAILY_CHECKS_TICK_MS) || 60 * 60_000;
+// Later than peer-vote's 90s so the two first ticks never land together.
+const FIRST_MS = Number(process.env.ROUTINE_DAILY_CHECKS_FIRST_MS) || 3 * 60_000;
+const JITTER_MS = 60_000;
+// A check is due this long BEFORE a full period has passed. Hourly ticks land up to
+// an hour late; without the slack each day's run would slide an hour later than the
+// last. With it, runs stay between 23.5 and 24.5 hours apart.
+const DUE_SLACK_MS = 30 * 60_000;
+// npm audit is a network call to the registry; one stuck call must not hold the
+// next day's check hostage.
+const NPM_AUDIT_TIMEOUT_MS = 5 * 60_000;
+
+// ── the checks ─────────────────────────────────────────────────────────────────
+// Each returns { keys, idea } — `keys` identify the findings (empty = clean) and
+// feed the fingerprint; `idea` is what gets filed. A check that cannot run THROWS:
+// "could not check" must never be recorded as clean.
+
+async function checkRankRoles(deps) {
+  const rows = await deps.db.readRankRoster();
+  const offenders = rankRoles.findRanksWithoutRoles(rows, deps.liveRanks || api.LIVE_RANK_LADDER);
+  return {
+    keys: offenders.map((o) => `${o.id}:${o.rank}`),
+    idea: { ...rankRoles.ideaFor(offenders, { filedBy: "the server's daily rank-roles check" }), kind: 'bug' },
+  };
+}
+
+// The async spawn. execFile reports npm's own exit 1 (findings present) as an error
+// too, so only a missing binary or a timeout counts as "could not run".
+function npmAudit(cwd) {
+  return new Promise((resolve) => {
+    execFile('npm', depAudit.NPM_AUDIT_ARGS, { cwd, maxBuffer: 32 * 1024 * 1024, timeout: NPM_AUDIT_TIMEOUT_MS },
+      (err, stdout, stderr) => {
+        const failed = err && (err.code === 'ENOENT' || err.killed);
+        resolve({ stdout, stderr, error: failed ? (err.code === 'ENOENT' ? 'npm not found' : 'npm audit timed out') : null });
+      });
+  });
+}
+
+async function checkDepAudit(deps) {
+  const cwd = deps.cwd || api.resolveInstanceRoot();
+  const out = await (deps.npmAudit || npmAudit)(cwd);
+  if (out.error) throw new Error(out.error);
+  const res = depAudit.parseNpmAudit(out.stdout, out.stderr);
+  if (!res.ok) throw new Error(res.raw_error);
+  const f = res.findings;
+  return {
+    keys: f.map((x) => `${x.package}:${x.id || x.summary}`),
+    idea: {
+      kind: 'infra',
+      title: `[dep-audit] ${f.length} high/critical ${f.length === 1 ? 'vulnerability' : 'vulnerabilities'} in this instance's dependencies`,
+      bodyMd: [
+        `The server's daily \`npm audit\` of this instance (${cwd}) found ${f.length} high/critical advisory(ies):`,
+        '',
+        ...f.map((x) => `- **${x.package}** (${x.severity}) — ${x.summary}${x.url ? ` — ${x.url}` : ''}. Fix: ${x.fix}.`),
+        '',
+        'Most of these arrive through the core package, so the fix is usually a core release',
+        'that bumps the dependency, then moving this instance onto it.',
+        '',
+        'Filed by modules/autonomy/pollers/daily-checks.js (task 1004878). The same set is not',
+        're-filed tomorrow; a changed set is.',
+      ].join('\n'),
+    },
+  };
+}
+
+const CHECKS = {
+  'rank-roles-audit': checkRankRoles,
+  'dep-audit-nightly': checkDepAudit,
+};
+
+// ── the ledger half ────────────────────────────────────────────────────────────
+
+const fingerprint = (keys) =>
+  crypto.createHash('sha1').update([...keys].sort().join('\n')).digest('hex').slice(0, 12);
+
+// The fingerprint the last DELIVERED finding carried, or null. Only a `go` row
+// counts: an error or an undelivered filing in between must not make tomorrow's
+// identical result look new, and must not make it look delivered either.
+function lastFiledFingerprint(rows) {
+  const go = (rows || []).find((r) => r.decision === 'go');
+  const m = go && /\bfp=([0-9a-f]+)/.exec(go.reason || '');
+  return m ? m[1] : null;
+}
+
+function isDue(rows, routine, now) {
+  const last = (rows || [])[0];
+  if (!last) return true;
+  const at = new Date(last.created_at).getTime();
+  if (!Number.isFinite(at)) return true;
+  return now - at >= periodMs(routine) - DUE_SLACK_MS;
+}
+
+// One routine, once: run it if it is due, file what it found if that is new, and
+// write the row that says so. NEVER throws.
+async function runCheck(routine, deps = {}) {
+  const db = deps.db || autonomyDb;
+  const logFn = deps.log || ((m) => log.info(m));
+  const errFn = deps.error || ((m) => log.error(m));
+  const now = deps.now ? deps.now() : Date.now();
+  const record = (decision, reason) =>
+    db.recordAutonomyRun({ routine, decision, reason }).catch((e) =>
+      errFn(`[daily-checks] ${routine}: could not record the run (${e && e.message})`));
+
+  let rows;
+  try {
+    rows = await db.readAutonomyRuns({ routine, limit: 10 });
+  } catch (e) {
+    return { skipped: 'db_unreachable', error: e && e.message };
+  }
+  if (!isDue(rows, routine, now)) return { skipped: 'not_due' };
+
+  let result;
+  try {
+    result = await CHECKS[routine]({ ...deps, db });
+  } catch (e) {
+    const msg = (e && e.message) || String(e);
+    errFn(`[daily-checks] ${routine}: could not run (${msg})`);
+    await record('no-go', `error: ${msg}`.slice(0, 500));
+    return { outcome: 'error', error: msg };
+  }
+
+  if (!result.keys.length) {
+    await record('go', 'clean');
+    return { outcome: 'clean' };
+  }
+  const fp = fingerprint(result.keys);
+  const n = result.keys.length;
+  if (fp === lastFiledFingerprint(rows)) {
+    await record('go', `findings n=${n} fp=${fp} unchanged`);
+    return { outcome: 'unchanged', fingerprint: fp };
+  }
+  const capture = deps.captureIdea || api.resolveOptional('ideas.capture');
+  if (typeof capture !== 'function') {
+    errFn(`[daily-checks] ${routine}: ${n} finding(s) and no idea inbox to file them in (ideas module off)`);
+    await record('no-go', `findings n=${n} fp=${fp} undelivered: no ideas.capture`);
+    return { outcome: 'undelivered', fingerprint: fp };
+  }
+  try {
+    const idea = await capture({ ...result.idea, filedVia: 'api' });
+    logFn(`[daily-checks] ${routine}: ${n} finding(s) filed as idea ${idea && idea.id}`);
+    await record('go', `findings n=${n} fp=${fp} idea=${idea && idea.id}`);
+    return { outcome: 'filed', fingerprint: fp, ideaId: idea && idea.id };
+  } catch (e) {
+    const msg = (e && (e.message || e.code)) || String(e);
+    errFn(`[daily-checks] ${routine}: ${n} finding(s), filing failed (${msg})`);
+    await record('no-go', `findings n=${n} fp=${fp} undelivered: ${msg}`.slice(0, 500));
+    return { outcome: 'undelivered', fingerprint: fp, error: msg };
+  }
+}
+
+// One tick: every daily routine in turn. Sequential on purpose — npm audit is the
+// heavy one and nothing here is urgent enough to run two at once.
+let running = false;
+let warnedUnreachable = false;
+async function tick(deps = {}) {
+  if (running) return [];
+  running = true;
+  try {
+    const out = [];
+    for (const routine of ROUTINES) {
+      const r = await runCheck(routine, deps);
+      if (r.skipped === 'db_unreachable' && !warnedUnreachable) {
+        warnedUnreachable = true;
+        log.info(`[daily-checks] skipped — database unreachable (${r.error}); a builder machine has nothing to check`);
+      }
+      out.push({ routine, ...r });
+    }
+    return out;
+  } finally {
+    running = false;
+  }
+}
+
+let firstTimer = null;
+let interval = null;
+
+function start(deps = {}) {
+  if (process.env.ROUTINE_TIMERS_DISABLED === '1') {
+    log.info('[daily-checks] disabled (ROUTINE_TIMERS_DISABLED=1)');
+    return;
+  }
+  if (firstTimer || interval) return; // already started
+  const fire = () => tick(deps).catch((e) => log.error(`[daily-checks] tick crashed: ${e && e.message}`));
+  firstTimer = setTimeout(() => {
+    fire();
+    interval = setInterval(fire, TICK_MS);
+    if (interval.unref) interval.unref();
+  }, FIRST_MS + Math.floor(Math.random() * JITTER_MS));
+  if (firstTimer.unref) firstTimer.unref();
+  log.info(`[daily-checks] started — ${ROUTINES.join(', ')} once a day (checked hourly against the run ledger)`);
+}
+
+function stop() {
+  if (firstTimer) clearTimeout(firstTimer);
+  if (interval) clearInterval(interval);
+  firstTimer = interval = null;
+}
+
+module.exports = {
+  start,
+  stop,
+  tick,
+  runCheck,
+  isDue,
+  fingerprint,
+  lastFiledFingerprint,
+  checkRankRoles,
+  checkDepAudit,
+  ROUTINES,
+  TICK_MS,
+  DUE_SLACK_MS,
+};