@bongos/core 1.21.175 → 1.21.177

package/scripts/gds/audit-authorship.sh

@@ -1,329 +1,8 @@
 #!/usr/bin/env bash
-# scripts/gds/audit-authorship.sh — V3.R12 (#236).
-#
-# Audits the repo for hardcoded references to the original Archon's identity
-# in IMPLEMENTATION code. The point: a second builder's commits, scripts,
-# error messages, and skill outputs must NOT silently impersonate or
-# hardcode-credit the founding builder.
-#
-# What counts as a violation here:
-#   * `/Users/larskristensen/...` paths in code or skill instructions.
-#     (Use `$HOME` / `os.path.expanduser('~')` instead.)
-#   * `builder_id = 1` / `shipped_by = 1` hardcodes in code paths that run
-#     during a builder's session. (Use `req.builder.id` / the active claim.)
-#   * `lars589` / `larskristensen` literals in setup-path code or test data
-#     that would mis-attribute a second builder's work.
-#   * The founder's unix account in account position (`-o`/`-u <it>`,
-#     `User=<it>`, `APP_USER = '<it>'`) in runtime code — section 6.
-#
-# What is INTENTIONAL and allow-listed (NOT a violation):
-#   * Archived shipping docs in `limitations/*-shipped.md` — historical record.
-#   * ADRs, session logs, and the chat-broadcast plan — historical / decision
-#     records that name the founder by intent.
-#   * `CLAUDE.md` — §2 is explicitly about working with Lars as the prompter
-#     and project owner; that framing IS the point.
-#   * Droplet operational identity (`User=<owner>`, `<owner>@<droplet-ip>`,
-#     `/home/lars/amazonprimea`, `lars@hermeslines.com`) — that's the actual
-#     unix user / SSH target / ACME contact on the production server. It's
-#     infra config, not impersonation of a builder identity.
-#   * The seed script that ORIGINALLY created the V3 tasks
-#     (`scripts/gds/seed-v3-tasks.js`) — a frozen migration-style snapshot.
-#     Names appear in task descriptions by historical necessity.
-#     (The earlier `seed-v2-tasks.js` + `import-backlog.js` seeds were
-#     deleted as dead code in task 1079.)
-#   * Self-references in this audit script and in the V3.R09 / V3.R12 task
-#     descriptions captured in `seed-v3-tasks.js`.
-#   * GitHub remote `lars589/amazonprimea` — actual repo owner; cloning
-#     anything else would clone a different project.
-#   * Comments that document who decided something or who originally ran a
-#     one-time backfill — historical decision-attribution. Allowlisted
-#     PER FILE below (a content-level "looks like a comment" filter would
-#     also match live code — a JS private class field, a //host literal —
-#     so it could be gamed; file entries with justifications can't).
-#   * Test data that pins a real contract, allowlisted PER FILE below: owner
-#     approval RECORDS the Archon's login, the terminal-URL guard validates
-#     term-<login> hostnames — identity in an assertion is the contract.
-#     New test files are still scanned (no blanket tests/ exclusion).
-#   * Sample API payloads (fixtures/) and gitignored build output (dist/).
-#
-# Usage:
-#   bash scripts/gds/audit-authorship.sh           # check, exit 1 on new hits
-#   bash scripts/gds/audit-authorship.sh --verbose # print every hit (incl.
-#                                                  # allowlisted) for review
-#
-# CI lane: tests/authorship_audit.mjs runs this inside the required `unit`
-# check (task 1002640 — it previously had no caller and 342 stale hits).
-# No writes, no network.
-
-set -uo pipefail
-
-# Anchor to repo root regardless of where the script was invoked from.
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "$REPO_ROOT"
-
-VERBOSE=0
-for arg in "$@"; do
-  case "$arg" in
-    --verbose|-v) VERBOSE=1 ;;
-    -h|--help)
-      sed -n '2,50p' "$0" | sed 's/^# \{0,1\}//'
-      exit 0
-      ;;
-  esac
-done
-
-# Uses plain `grep -RE` so the script runs on any machine — including CI
-# images that don't bundle ripgrep — and on the bare droplet. Exclude paths
-# are passed via the standard --exclude / --exclude-dir flags.
-
-# ----------------------------------------------------------------------------
-# 1. Path-exclusion args — paths where hits NEVER count (frozen archives,
-#    generated content, dot-git, third-party deps). Filtered at the grep
-#    level so they never even enter the candidate set.
-# ----------------------------------------------------------------------------
-EXCLUDE_DIRS=(
-  --exclude-dir=node_modules
-  --exclude-dir=.git
-  --exclude-dir=dist               # gitignored build/package output (a stale
-                                   # core tarball tree re-reports every hit in
-                                   # it — task 1002640); grep -R walks the
-                                   # filesystem, not the git index.
-  --exclude-dir=iterations         # under art/, historical cost ledger
-  --exclude-dir=generated          # under art/, generated PNGs / metadata
-  --exclude-dir=docs               # human prose: ADRs, recipes, plans,
-                                   # session logs, architecture notes —
-                                   # naming the founder by intent
-  --exclude-dir=blockers           # blockers ARE the things stuck on Lars
-  --exclude-dir=limitations        # archives + scope-truth docs
-  --exclude-dir=fixtures           # sample API payloads (hall-preview) mirror
-                                   # real prod rows, which name real builders —
-                                   # frozen sample data, not runtime code.
-  --exclude-dir=worktrees          # .claude/worktrees/ holds N full repo
-                                   # copies (one per builder worktree); from
-                                   # the main checkout, recursing them is slow
-                                   # AND produces 100s of duplicate self-hits
-                                   # (#558). Each worktree audits its own tree.
-)
-EXCLUDE_FILES=(
-  --exclude=session-log-archive.md
-  --exclude='*-shipped.md'         # frozen version archives in limitations/
-  --exclude='*.sql'                # migrations ran AS lars at migration time
-  --exclude=CLAUDE.md              # §2 is about the prompter by intent
-  --exclude=README.md              # README credits / examples
-  --exclude=chat-inbox.md          # framing references
-  --exclude=generative-ideas.md    # historical idea capture
-  --exclude=.git                   # in a worktree, .git is a file (gitdir
-                                   # pointer to main repo) — skip it
-)
-
-# ----------------------------------------------------------------------------
-# 2. The regex — what we're scanning for.
-#    Three families:
-#      a) /Users/larskristensen/... — runtime hardcoded home-dir paths
-#      b) builder_id = 1 / shipped_by = 1 — hardcoded primary key references
-#      c) literal lars589 / larskristensen identifiers in code surface
-# ----------------------------------------------------------------------------
-PATTERN='(/Users/larskristensen)|(\bbuilder_id\s*=\s*1\b)|(\bshipped_by\s*=\s*1\b)|(\blars589\b)|(\blarskristensen\b)'
-
-# ----------------------------------------------------------------------------
-# 3. The allowlist — file:line tokens where the regex IS expected to match.
-#    Each entry is a substring match against "file:line: <captured-text>"
-#    style records. Add a new allowlist entry only with a justification
-#    comment.
-# ----------------------------------------------------------------------------
-ALLOWLIST=(
-  # Frozen seed scripts — the V3 plan literally contains the strings being
-  # audited because the task DESCRIPTION (#234/V3.R09 and #236/V3.R12) names
-  # them. Stripping them would lose the task history.
-  'scripts/gds/seed-v3-tasks.js'
-
-  # Audit-replay docs the builders table example "1 for lars589" — that's
-  # the actual row in the prod DB; renaming the example breaks the doc.
-  'scripts/gds/audit-replay.sh'
-
-  # provision-staging.sh clones the actual GitHub repo owned by lars589.
-  # That's the GitHub org/user that owns the repo; not a builder identity.
-  'scripts/deploy/provision-staging.sh'
-
-  # CODEOWNERS is GitHub's owner-review list (task 1002611 / ADR 0159): the
-  # format requires the literal @username on every entry. Repo-hosting
-  # identity, same nature as provision-staging.sh — not a builder identity
-  # hardcoded in code.
-  'CODEOWNERS'
-
-  # This audit script's own self-reference (it documents what it's looking for).
-  'scripts/gds/audit-authorship.sh'
-
-  # skill-usage-review explains how Claude Code encodes cwd into the
-  # transcripts directory name — explanatory text describing why the glob
-  # is now builder-agnostic. Not a runtime hardcode.
-  '.claude/scheduled-tasks/skill-usage-review/SKILL.md'
-
-  # setup_smoke explicitly asserts the ABSENCE of /Users/larskristensen
-  # leaks in setup.js — the string appearing in the comment IS the
-  # specification of what's forbidden in implementation code.
-  'tests/setup_smoke.mjs'
-
-  # Test DATA that pins a real contract (task 1002640) — identity in an
-  # assertion IS the contract, not a mis-attribution: owner approval RECORDS
-  # the Archon's login (gate_approvals), packaging/provisioning tests
-  # exercise the real repo owner + the mirror-redaction floor. Listed per file
-  # (never a blanket tests/ exclusion) so a NEW test file is still scanned.
-  'tests/provision.mjs'
-  'tests/package_core.mjs'
-  'tests/init.mjs'
-  'tests/gate_approvals.mjs'
-  'tests/publish_reconciler.mjs'
-  'tests/dev_lib.mjs'
-  'tests/ship_card.mjs'
-  'tests/scrubber_corpus.mjs'
-  'tests/module_submissions.mjs'
-  'tests/provisioning_onboard_mode.mjs'
-  'tests/instance_manifest.mjs'
-  'tests/bongos_downloads.mjs'
-  'tests/status_mirror_sync.mjs'
-  'tests/search_isolation.mjs'
-  'tests/grade_aggregates_unavailable.mjs'
-  'tests/first_admin_bootstrap.mjs'
-  'tests/discord_approvals.mjs'
-  'tests/currency_label.mjs'
-  'tests/cloud_bongos_pack.mjs'
-  'tests/bump_version.mjs'
-  'tests/auth_inactive_builder.mjs'
-  'tests/auth_anthropic_identity.mjs'
-
-  # The mirror-redaction floor: PRIOR_INSTANCE_FLOOR carries the prior
-  # instance's owner literal precisely so packaging can SCRUB it from every
-  # published core — the anti-leak spec, not a runtime hardcode (task 1002640).
-  'scripts/gds/package-core.js'
-
-  # Frozen seed script — a task DESCRIPTION quotes migration 023's founding-
-  # Archon literal as the thing that task exists to remove (the
-  # seed-v3-tasks.js class: stripping it would lose the task history).
-  'scripts/gds/seed-medusa-tasks.js'
-)
-
-# ----------------------------------------------------------------------------
-# 4. Operational-identity allowlist — these patterns reference the droplet's
-#    unix user / SSH target / ACME contact / cron user / DB role. They are
-#    legitimate operational configuration, not impersonation of a builder.
-# ----------------------------------------------------------------------------
-OPS_ALLOWLIST_PATTERN='(^User=lars$|/home/lars/|lars@104\.236\.254\.243|lars@hermeslines\.com|^DROPLET=.*lars@|sudo -u postgres .*-O lars\b|PGUSER=lars\b|createdb -O lars\b|"-U" "?lars"?|-U lars\b|runs as user .lars.|service .* lars\b|cron .*lars\b)'
-
-# ----------------------------------------------------------------------------
-# 4b. Spec-string allowlist — content patterns where the literal "lars589"
-#    (etc.) appears precisely because it is the THING THE AUDIT FORBIDS,
-#    quoted inside a prompt/comment that instructs a reader (human or the LLM
-#    grader) to hunt for it. The grader workers' prompts say `Look for literal
-#    "lars", "lars589", absolute /Users paths ...` — that's the audit's own
-#    specification embedded in a prompt, not a runtime hardcode that
-#    mis-attributes a builder. Matched on line content (not file path) so the
-#    rest of grader.js stays auditable for a genuine hardcode.
-#
-#    The pattern is the FULL exact prompt phrase, not just `Look for literal`,
-#    so the suppression can't double as a smuggling channel: a contributor
-#    can't sneak a real hardcode past the audit by appending a short comment,
-#    because escaping requires reproducing this whole sentence verbatim — at
-#    which point the line is self-evidently a prompt-spec, not plausible cover
-#    for `builder_id = "lars589"`.
-# ----------------------------------------------------------------------------
-SPEC_ALLOWLIST_PATTERN='[Ll]ook for literal "lars", "lars589", absolute /Users paths'
-
-# ----------------------------------------------------------------------------
-# 5. Scan, filter, report.
-# ----------------------------------------------------------------------------
-TMP_RAW="$(mktemp)"
-TMP_HITS="$(mktemp)"
-TMP_FILTERED="$(mktemp)"
-trap 'rm -f "$TMP_RAW" "$TMP_HITS" "$TMP_FILTERED"' EXIT
-
-# Walk every file under repo root (excluding the path-level exclusions above).
-# grep -R recurses into hidden subdirs by default (including .claude/, which
-# absolutely DOES need auditing since skill prompts live there). The
-# --exclude-dir entries below cull the dirs we don't care about.
-grep -RIn -E "${EXCLUDE_DIRS[@]}" "${EXCLUDE_FILES[@]}" -e "$PATTERN" . 2>/dev/null \
-  | sed 's|^\./||' \
-  | sort -u \
-  > "$TMP_RAW" || true
-
-# Apply file-level allowlist (entry is a path prefix match against "file:" portion).
-ALLOWLIST_RE=''
-for e in "${ALLOWLIST[@]}"; do
-  # Escape regex metachars conservatively (just dots — paths only have those).
-  esc="${e//./\\.}"
-  ALLOWLIST_RE+="^${esc}:|"
-done
-ALLOWLIST_RE="${ALLOWLIST_RE%|}"
-
-if [ -n "$ALLOWLIST_RE" ]; then
-  grep -vE "$ALLOWLIST_RE" "$TMP_RAW" > "$TMP_HITS" || true
-else
-  cp "$TMP_RAW" "$TMP_HITS"
-fi
-
-# Apply operational-identity + spec-string pattern allowlists (both match on
-# line content, not file path). NB deliberately NO comment-line filter: a
-# content pattern like `^\s*(//|#)` also matches live code (a JS private class
-# field `#name = ...`, a protocol-relative `//host` continuation line), so a
-# real hardcode could dress as a comment to slip through. Historical-
-# attribution comments get per-file ALLOWLIST entries instead (task 1002640).
-grep -vE "$OPS_ALLOWLIST_PATTERN" "$TMP_HITS" \
-  | grep -vE "$SPEC_ALLOWLIST_PATTERN" > "$TMP_FILTERED" || true
-
-# ----------------------------------------------------------------------------
-# 6. The founder's UNIX ACCOUNT in account position (task 1002719). Family (c)
-#    greps the GitHub login, and a unix name is not a GitHub login — which is
-#    how the standup's `install -d -o <founder> …` reached every operator's box
-#    unseen. Runtime code only (tests/ pin fixtures by design), and the ops
-#    allowlist above does NOT apply: "that is the droplet's unix user" is the
-#    very assumption this family refuses in code that runs on other planes.
-#    Derive the account instead (provision-repo.js appUser()).
-# ----------------------------------------------------------------------------
-UNIX_USER_PATTERN='((^|[^A-Za-z0-9_.-])(-o|-g|-u)[ =]lars\b)|(\b(User|Group)=lars\b)|(\bchown( -R)? lars\b)|([A-Za-z_]*[Uu][Ss][Ee][Rr][A-Za-z_]*\s*[:=]\s*["'"'"']lars["'"'"'])'
-UNIX_ALLOWLIST=(
-  # This script's own pattern.
-  'scripts/gds/audit-authorship.sh'
-)
-UNIX_ALLOWLIST_RE=''
-for e in "${UNIX_ALLOWLIST[@]}"; do
-  UNIX_ALLOWLIST_RE+="^${e//./\\.}:|"
-done
-UNIX_ALLOWLIST_RE="${UNIX_ALLOWLIST_RE%|}"
-
-grep -RIn -E "${EXCLUDE_DIRS[@]}" --exclude-dir=tests --exclude-dir=test "${EXCLUDE_FILES[@]}" -e "$UNIX_USER_PATTERN" . 2>/dev/null \
-  | sed 's|^\./||' \
-  | sort -u \
-  | grep -vE "$UNIX_ALLOWLIST_RE" >> "$TMP_FILTERED" || true
-
-HIT_COUNT=$(wc -l < "$TMP_FILTERED" | tr -d ' ')
-
-if [ "$VERBOSE" = "1" ]; then
-  TOTAL=$(wc -l < "$TMP_RAW" | tr -d ' ')
-  AFTER_FILE=$(wc -l < "$TMP_HITS" | tr -d ' ')
-  echo "audit-authorship: scan summary"
-  echo "  raw hits (post path-exclude): $TOTAL"
-  echo "  after file allowlist:          $AFTER_FILE"
-  echo "  after ops + spec allowlists:   $HIT_COUNT"
-  echo ""
-fi
-
-if [ "$HIT_COUNT" -eq 0 ]; then
-  echo "audit-authorship: PASS — no hardcoded Archon-identity references in implementation code."
-  exit 0
-fi
-
-echo "audit-authorship: FAIL — found $HIT_COUNT hardcoded reference(s) to the original Archon in implementation code."
-echo ""
-echo "Hits:"
-cat "$TMP_FILTERED"
-echo ""
-echo "Remediation:"
-echo "  * Paths like /Users/larskristensen/...  ->  use \$HOME or os.path.expanduser('~')"
-echo "  * builder_id = 1 / shipped_by = 1       ->  use req.builder.id / the active claim"
-echo "  * lars589 / larskristensen literals     ->  use the current builder's github_login"
-echo "  * -o/-u lars, User=lars, *user = 'lars' ->  derive the account (appUser() in provision-repo.js)"
-echo ""
-echo "If a hit IS intentional (historical doc, droplet operational identity,"
-echo "or a frozen seed/import script), add it to the ALLOWLIST or"
-echo "OPS_ALLOWLIST_PATTERN in this script with a one-line justification."
-exit 1
+# scripts/gds/audit-authorship.sh — @bongos-forwarder (task 1004848). Generated by
+# scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+# The real script is scripts/bongos/audit-authorship.sh. This forwarder keeps callers that still name
+# the old path working, and warns once so they get repointed. Task 1003706 removes it.
+if [ -z "${BONGOS_FORWARDER_WARNED:-}" ]; then echo "[bongos] scripts/gds/audit-authorship.sh has moved to scripts/bongos/audit-authorship.sh. This old path still works for now, but update whatever called it. The forwarders in scripts/gds/ are removed in a later release." >&2; fi
+export BONGOS_FORWARDER_WARNED=1
+exec bash "$(dirname "$0")/../bongos/audit-authorship.sh" "$@"

package/scripts/gds/audit-deps.js

@@ -1,189 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/audit-deps.js — likely-missing-dependency detector CLI (task 349).
-//
-// WHY: an under-specified dependencies[] lets work start before the task it
-// implicitly builds on has shipped, racing already-built work (the original
-// motivation: task 307 was claimable before the rank system it needed had
-// shipped). This surfaces OPEN tasks whose touches[] overlap an UNSHIPPED task
-// they do NOT already depend on — candidate missing edges for a human to triage.
-//
-// THIS IS ADVISORY. Most touches[] overlaps are PARALLEL work on a shared surface
-// (src/bongos/db.js, migrations/, CLAUDE.md, …), NOT a build-order dependency.
-// Backfilling a wrong edge GATES the dependent (POST /claims → 409
-// DEPS_NOT_SHIPPED) until the named blocker ships. So: act only on `high`
-// confidence, by hand, after reading both task descriptions.
-//
-// PURE CORE MOVED to modules/lifecycle/missing-dep-classify.js (task 1002827),
-// so dependency-advisory.js's live POST /tasks path can reuse the ONE canonical
-// `classify`/`findMissingDeps` — the same one tests/audit_deps.mjs covers —
-// without pulling this file's CLI-only machinery (cliClient's session-token
-// I/O, resolveDefaultVersion) into the running server. This file is now the
-// CLI wrapper only: argv parsing, the corpus fetch, and --stranded's dead-edge
-// report. Every name below is RE-EXPORTED unchanged so no caller of this file
-// (including tests/audit_deps.mjs) needs to know it moved.
-//
-//   node scripts/gds/audit-deps.js [--version GDS-V3] [--min high|medium|low] [--json]
-//   node scripts/gds/audit-deps.js --stranded [--json]   # the INVERSE: dead edges (task 1003153),
-//                                                      # plus prose-declared gates naming a dead task (task 1003857, advisory)
-
-const { cliClient } = require('./cli-lib');
-const { resolveDefaultVersion } = require('./version-select.js');
-// task 1003153 — the DEAD-edge detector core, shared with the claim refusal so
-// "abandoned dependency" means one thing across the CLI, the route and this audit.
-const { findStrandedTasks, findProseGatedTasks } = require('../../modules/lifecycle/dead-deps.js');
-// task 1003752 — the route's page bound + the first-page offset rule, declared once.
-const { TASK_LIST_MAX_LIMIT, buildTaskPageQuery } = require('../../modules/lifecycle/task-list-limits.js');
-const { OPEN, isUnshippedBlocker, HOTSPOTS, classify, findMissingDeps } =
-  require('../../modules/lifecycle/missing-dep-classify.js');
-
-// Read the WHOLE task corpus, one allowed page at a time (task 1003752). This
-// was a single `limit: 3000` read, which GET /tasks caps at TASK_LIST_MAX_LIMIT
-// (1000) — so it 400'd on every run and the detector below never saw a single
-// task. Paging is not a nicety here: the corpus passed one page long ago (3610
-// rows on 2026-09-16), so even a legal `limit: 1000` would silently UNDER-read,
-// which in a detector is the same failure wearing a success exit code.
-//
-// `getPage(query)` is injected rather than closed over so the loop is testable
-// with no API; it returns the { ok, status, data } shape cliClient gives back.
-// Dedupes by id: listTasks orders by `priority NULLS LAST, created_at, id`, so
-// pages are stable — but a detector whose whole job is surfacing rows nobody
-// can see must not be the thing that loses one.
-async function fetchAllTasks(getPage, { query = {}, pageSize = TASK_LIST_MAX_LIMIT, maxPages = 100 } = {}) {
-  const byId = new Map();
-  let offset = 0;
-  for (let page = 0; page < maxPages; page++) {
-    const q = buildTaskPageQuery({ ...query, limit: pageSize, offset });
-    const r = await getPage(q);
-    if (!r || !r.ok) throw new Error(`HTTP ${r && r.status}`);
-    const rows = (r.data && r.data.tasks) || [];
-    for (const t of rows) byId.set(String(t.id), t);
-    // A short page is the end of the table. Compare against the CLAMPED size
-    // the route actually honoured, never the size the caller asked for.
-    if (rows.length < q.limit) return [...byId.values()];
-    offset += q.limit;
-  }
-  throw new Error(`more than ${maxPages} pages of tasks — refusing to loop forever`);
-}
-// --stranded (task 1003153): the INVERSE audit. findMissingDeps asks "which edge
-// is MISSING"; this asks "which existing edge is DEAD" — a live task gated by an
-// ABANDONED dependency. That edge can never satisfy (an abandoned task can never
-// ship), so the dependent never auto-promotes and can never be claimed: stranded,
-// not waiting. Per the owner ruling (2026-08-21) the gates stay strict, which
-// makes this detector the remedy — an abandoned dependency must be REPORTED as a
-// top-priority thing to resolve rather than blocking silently and forever.
-// Exits 1 when anything is stranded, so a sweep or CI leg can gate on it.
-async function reportStranded({ asJson }) {
-  const api = await cliClient();
-  let all;
-  try {
-    all = await fetchAllTasks((query) => api.tasks.getTasks({ query }), { query: { include: 'deps' } });
-  } catch (e) {
-    console.error(`audit-deps: could not list tasks (${e.message})`);
-    process.exit(1);
-  }
-  const stranded = findStrandedTasks(all);
-  // task 1003857: the same question asked of PROSE. The structured graph above
-  // reads blocked_by edges; a gate written in a description is unpoliced, and stales
-  // identically — task 1002839 told a builder to coordinate with "existing open task
-  // 1001380", abandoned since 2026-08-18. Reported HERE rather than in a second tool
-  // so there is one answer to "what is stranded".
-  const statusById = (() => {
-    const byId = new Map(all.map((t) => [String(t.id), String(t.status)]));
-    return (id) => byId.get(String(id)) || null;
-  })();
-  const proseGated = findProseGatedTasks(all, statusById);
-
-  // Context worth stating even at zero: abandoned tasks that still CARRY
-  // dependents are the latent trap. They report clean only because every
-  // dependent happens to be terminal too — one promote would light them up.
-  const gatingAbandoned = new Set();
-  for (const t of all) for (const d of (t.blocked_by || [])) {
-    if (String(d.status) === 'abandoned') gatingAbandoned.add(String(d.id));
-  }
-
-  if (asJson) {
-    console.log(JSON.stringify({ stranded, prose_gated: proseGated, abandoned_deps_with_dependents: [...gatingAbandoned] }, null, 2));
-    // ADVISORY: a prose match never changes the exit code. It is weaker evidence than
-    // an edge — the text may be history, a citation, or simply wrong — so it reports
-    // candidates for a human and must not gate a sweep or a CI leg.
-    return stranded.length ? 1 : 0;
-  }
-  console.log(`audit-deps --stranded: ${all.length} task(s) scanned — ${stranded.length} LIVE task(s) stranded by an abandoned dependency\n`);
-  for (const s of stranded) {
-    console.log(`[STRANDED] #${s.task_id} [${s.status}]  ${(s.title || '').slice(0, 70)}`);
-    for (const d of s.dead_deps) console.log(`           dead edge → #${d.id} [${d.status}]  ${(d.title || '').slice(0, 60)}`);
-    console.log(`           fix: drop the edge (DELETE /dependencies {"from_kind":"task","from_id":${s.task_id},"to_kind":"task","to_id":${s.dead_deps[0].id}})`);
-    console.log(`             or restore the dep (POST /tasks/${s.dead_deps[0].id}/promote)\n`);
-  }
-  if (proseGated.length) {
-    console.log(`Prose-declared gates naming a dead task: ${proseGated.length} (ADVISORY — a human reads these; they never gate a claim)\n`);
-    for (const p of proseGated) {
-      console.log(`[PROSE]    #${p.task_id} [${p.status}]  ${(p.title || '').slice(0, 70)}`);
-      for (const d of p.prose_dead_deps) console.log(`           body names → #${d.id} [${d.status}]`);
-      console.log('           fix: correct the sentence (PATCH /tasks/' + p.task_id + ' {"description":…}), or promote the named task if the gate is real\n');
-    }
-  }
-  if (!stranded.length) {
-    console.log('Nothing stranded — no live task is gated by an abandoned dependency.');
-    console.log(`Latent exposure: ${gatingAbandoned.size} abandoned task(s) still carry dependents; they read clean only`);
-    console.log('because those dependents are themselves terminal. Promoting one would strand it immediately.');
-  }
-  return stranded.length ? 1 : 0;
-}
-
-async function main() {
-  const argv = process.argv.slice(2);
-  if (argv.includes('--stranded')) {
-    process.exitCode = await reportStranded({ asJson: argv.includes('--json') });
-    return;
-  }
-  // task 1003166 (G02): the default was 'GDS-V3', which has shipped — so a bare
-  // `audit-deps` audited a closed version and reported nothing useful.
-  const ver = argv.includes('--version')
-    ? argv[argv.indexOf('--version') + 1]
-    : await resolveDefaultVersion();
-  if (!ver) {
-    console.error('audit-deps: no version is building; pass --version <id>.');
-    process.exitCode = 1;
-    return;
-  }
-  const minRank = argv.includes('--min') ? argv[argv.indexOf('--min') + 1] : 'low';
-  const asJson = argv.includes('--json');
-  const order = { high: 3, medium: 2, low: 1 };
-
-  const api = await cliClient();
-  const r = await api.tasks.getTasks({ query: { version: ver } });
-  if (!r.ok) { console.error(`audit-deps: could not list tasks (${r.status})`); process.exit(1); }
-  const all = r.data.tasks || [];
-  const openTasks = all.filter((t) => OPEN.has(t.status) && Array.isArray(t.touches) && t.touches.length);
-
-  // dependencies[] lives in a join table, not the task row — hydrate per open task.
-  for (const t of openTasks) {
-    const dr = await api.tasks.getTasksIdDependencies({ id: t.id });
-    t.dependencies = dr.ok ? (dr.data.dependencies || []).map((d) => String(d.id)) : [];
-  }
-  const byId = new Map(all.map((t) => [String(t.id), t]));
-  // Feed the FULL task set (open + others) so blockers in any status are visible.
-  const edges = findMissingDeps([...openTasks, ...all.filter((t) => !OPEN.has(t.status))])
-    .filter((e) => order[e.confidence] >= (order[minRank] || 1))
-    .sort((a, b) => order[b.confidence] - order[a.confidence]);
-
-  if (asJson) { console.log(JSON.stringify(edges, null, 2)); return; }
-  console.log(`audit-deps: ${ver} — ${openTasks.length} open task(s) audited, ${edges.length} candidate edge(s) >= ${minRank}\n`);
-  for (const e of edges) {
-    const t = byId.get(String(e.task_id)) || {};
-    const o = byId.get(String(e.dep_id)) || {};
-    console.log(`[${e.confidence.toUpperCase().padEnd(6)}] #${e.task_id} should-maybe-depend-on #${e.dep_id} [${e.dep_status}]`);
-    console.log(`         from: ${(t.title || '').slice(0, 70)}`);
-    console.log(`         dep : ${(o.title || '').slice(0, 70)}`);
-    console.log(`         on  : ${e.paths.join(', ')}\n`);
-  }
-  if (!edges.length) console.log('No candidate missing dependencies at this confidence — the graph is clean here.');
-  console.log('NB: advisory only. Backfill `high` edges by hand (POST /tasks/:id/dependencies) after reading both tasks; a wrong edge gates the dependent.');
-}
-
-module.exports = { findMissingDeps, classify, OPEN, isUnshippedBlocker, HOTSPOTS, reportStranded, fetchAllTasks };
-
-if (require.main === module) {
-  main().catch((e) => { console.error('audit-deps:', e.message); process.exit(1); });
-}
+// scripts/gds/audit-deps.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/audit-deps.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'audit-deps.js');

package/scripts/gds/audit-gate.js

@@ -1,121 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/audit-gate.js — the dependency vulnerability gate (task 1003127,
-// goal 1000076; ADR 0180, docs/audits/ai-dev-redteam-baseline.md §3).
-//
-// Ratchet semantics, matching the goal's other budgets: a committed BASELINE
-// (config/audit-baseline.json) records the advisories that predate the gate.
-// A HIGH or CRITICAL advisory NOT in the baseline fails CI; anything below
-// high warns; a baseline entry that no longer reproduces prints a shrink nudge
-// (removing it is an ordinary PR). Fixes are explicit tasks — a blanket
-// `npm audit fix` does not even run against this tree (workspace: protocol).
-//
-// Fail contract: CLOSED on findings, OPEN on infrastructure — a registry
-// outage or unparseable audit output warns and exits 0 rather than bricking
-// every PR (the gate's job is catching new advisories, not proving uptime).
-//
-// Run:            node scripts/gds/audit-gate.js
-// Refresh floor:  node scripts/gds/audit-gate.js --update-baseline
-
+// scripts/gds/audit-gate.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/audit-gate.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const { execSync } = require('child_process');
-
-const ROOT = path.resolve(__dirname, '..', '..');
-const BASELINE_PATH = path.join(ROOT, 'config', 'audit-baseline.json');
-const GATE_SEVERITIES = new Set(['high', 'critical']);
-
-// npm audit JSON → flat advisory findings, one per (advisory, vulnerable pkg).
-// Identity is the advisory's numeric `source` id + the package it hits — stable
-// across runs, unlike the parent-package rollups npm prints.
-function extractFindings(auditJson) {
-  const out = new Map();
-  const vulns = (auditJson && auditJson.vulnerabilities) || {};
-  for (const entry of Object.values(vulns)) {
-    for (const via of entry.via || []) {
-      if (typeof via !== 'object' || via === null || via.source == null) continue;
-      const key = `${via.source}:${via.name}`;
-      if (!out.has(key)) {
-        out.set(key, {
-          id: String(via.source),
-          name: via.name,
-          severity: String(via.severity || entry.severity || 'unknown').toLowerCase(),
-          title: via.title || '',
-        });
-      }
-    }
-  }
-  return [...out.values()].sort((a, b) => (a.name + a.id).localeCompare(b.name + b.id));
-}
-
-// Pure gate decision — exported for the hermetic test.
-function compare(currentFindings, baselineFindings) {
-  const baseKeys = new Set((baselineFindings || []).map((f) => `${f.id}:${f.name}`));
-  const curKeys = new Set(currentFindings.map((f) => `${f.id}:${f.name}`));
-  const fresh = currentFindings.filter((f) => !baseKeys.has(`${f.id}:${f.name}`));
-  return {
-    newGating: fresh.filter((f) => GATE_SEVERITIES.has(f.severity)),
-    newAdvisory: fresh.filter((f) => !GATE_SEVERITIES.has(f.severity)),
-    resolved: (baselineFindings || []).filter((f) => !curKeys.has(`${f.id}:${f.name}`)),
-  };
-}
-
-function readBaseline() {
-  try {
-    return JSON.parse(fs.readFileSync(BASELINE_PATH, 'utf8')).findings || [];
-  } catch {
-    return [];
-  }
-}
-
-function runAudit() {
-  try {
-    return execSync('npm audit --omit=dev --json', { cwd: ROOT, maxBuffer: 32 * 1024 * 1024 }).toString();
-  } catch (e) {
-    // npm audit exits 1 when advisories exist — that IS the payload.
-    if (e && e.stdout) return e.stdout.toString();
-    throw e;
-  }
-}
-
-function main() {
-  const update = process.argv.includes('--update-baseline');
-  let findings;
-  try {
-    findings = extractFindings(JSON.parse(runAudit()));
-  } catch (e) {
-    console.warn(`audit-gate: WARN — npm audit did not produce parseable JSON (${e.message}); failing OPEN (infra, not findings).`);
-    process.exit(0);
-  }
-
-  if (update) {
-    fs.writeFileSync(
-      BASELINE_PATH,
-      JSON.stringify({ _comment: 'audit-gate baseline (ADR 0180): pre-existing advisories the gate tolerates. Shrink-only — remove entries as fix tasks land; never add by hand to silence a NEW advisory.', updated: null, findings }, null, 2) + '\n',
-    );
-    console.log(`audit-gate: baseline updated — ${findings.length} finding(s) recorded at ${path.relative(ROOT, BASELINE_PATH)}.`);
-    return;
-  }
-
-  const verdict = compare(findings, readBaseline());
-  for (const f of verdict.resolved) {
-    console.log(`audit-gate: ratchet-down available — baseline entry no longer reproduces: [${f.severity}] ${f.name} (${f.id}) ${f.title}`);
-  }
-  for (const f of verdict.newAdvisory) {
-    console.warn(`audit-gate: WARN new ${f.severity} advisory (below the gate): ${f.name} (${f.id}) ${f.title}`);
-  }
-  if (verdict.newGating.length) {
-    console.error('audit-gate: FAIL — new high/critical advisories not in the baseline:');
-    for (const f of verdict.newGating) {
-      console.error(`  [${f.severity}] ${f.name} (advisory ${f.id}) ${f.title}`);
-    }
-    console.error('Fix or pin the dependency. The baseline only records PRE-GATE debt; do not add new entries to silence this.');
-    process.exit(1);
-  }
-  console.log(`audit-gate: PASS — ${findings.length} known finding(s), 0 new at high/critical.`);
-}
-
-if (require.main === module) main();
-
-module.exports = { extractFindings, compare, GATE_SEVERITIES, BASELINE_PATH };
+require('../bongos/forwarder.js').forward(module, 'audit-gate.js');