@bongos/core 1.21.175 → 1.21.177

package/scripts/gds/deploy-divergence.js

@@ -1,446 +1,7 @@
 #!/usr/bin/env node
-// Compare what a live instance is SERVING against what is on main.
-//
-// WHO SEES A MERGE (task 1004682; the wording lives in modules/lifecycle/merge-reach.js):
-//   - The hub this checkout ships to (cloudbongos.com: the projects hub and the
-//     builders hall) redeploys from main on every merge, within minutes.
-//   - Projects hosted on the platform get a change only when a published core
-//     release carries it (auto-published per merge, ADR 0161) and their pin moves
-//     (patch-channel subscription or a core-upgrade).
-// This script used to print "Merging to main deploys nothing" — the ADR 0137 rule
-// (manual, owner-gated publish), false since ADR 0161 — and sessions repeated it
-// to the owner about work that was live. It now READS the hub's /version and says
-// whether the live build includes main's tip, instead of a blanket claim.
-//
-// Why it exists at all: between 2026-07-24 and 2026-08-03 a hundred and
-// seventy-one commits — including a whole governance permission system — sat on
-// main while cloudbongos.com served 1.18.17, every layer reported success, and
-// nobody noticed for ten days (blocker 1000097 / task 1002521). This script is
-// the comparison that was missing.
-//
-// Three independent gaps, all reported:
-//   1. UNRELEASED — commits on main since the last CORE_VERSION bump. No hosted
-//      project can take these at any pin, because no published version carries them.
-//   2. UNDEPLOYED — the live instance's coreVersion is behind the CORE_VERSION
-//      on main. A release exists that it has not picked up: on the hub, its
-//      redeploy is late or stuck; on a hosted project, its pin has not moved.
-//   3. SCHEMA BEHIND — live's /version reports schemaPending > 0: its database
-//      lacks migrations its running code ships (the 2026-07-04 502 outage
-//      shape; task 1002002). An instance too old to report it is not flagged.
-//
-// Usage:
-//   node scripts/gds/deploy-divergence.js                  # check the instance this checkout talks to
-//   node scripts/gds/deploy-divergence.js --url https://example.com
-//   node scripts/gds/deploy-divergence.js --quiet          # only print on divergence
-//   node scripts/gds/deploy-divergence.js --warn-only      # always exit 0 (for a non-blocking ship warning)
-//   node scripts/gds/deploy-divergence.js --line [--timeout-ms N]
-//                                                         # ONE line, or nothing; always exit 0
-//                                                         # (the SessionStart shape — wired in .claude/settings.json)
-//
-// Exit codes: 0 aligned (or --warn-only), 1 diverged, 2 could not determine.
-
-const fs = require('node:fs');
-const path = require('node:path');
-const { execSync } = require('node:child_process');
-
-const { API_BASE, arg, hasFlag } = require('./cli-lib');
-const { whoSeesAMerge, hubRule, HOSTED_LINE } = require('../../modules/lifecycle/merge-reach.js');
-
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-const MODULE_API = path.join(REPO_ROOT, 'src', 'module-api.js');
-
-// Read CORE_VERSION by regex rather than require() — this runs in checkouts
-// (and CI) where loading the doorway would pull config/branding that may not
-// resolve, and we only ever want the literal.
-function coreVersionAt(ref) {
-  let src;
-  try {
-    src = ref
-      ? execSync(`git show ${ref}:src/module-api.js`, { cwd: REPO_ROOT, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 * 1024 * 1024 })
-      : fs.readFileSync(MODULE_API, 'utf8');
-  } catch {
-    return null;
-  }
-  const m = src.match(/^const CORE_VERSION = '([^']+)'/m);
-  return m ? m[1] : null;
-}
-
-// 10s per call so one wedged git (index.lock contention, a slow filesystem)
-// cannot stall a caller indefinitely. This runs on the SessionStart path, where
-// the only other bounds were the fetch timeout and Claude Code's own hook
-// timeout — neither of which covers a hung execSync.
-const GIT_TIMEOUT_MS = 10000;
-
-function git(cmd, fallback = null) {
-  try {
-    return execSync(`git ${cmd}`, {
-      cwd: REPO_ROOT, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
-      maxBuffer: 64 * 1024 * 1024, timeout: GIT_TIMEOUT_MS,
-    }).trim();
-  } catch {
-    return fallback;
-  }
-}
-
-// The commit that last changed the CORE_VERSION literal, and how many commits
-// sit on top of it. Must be `-G` (any diff line matching the regex), NOT `-S`:
-// `-S` fires only when the number of occurrences changes, and a bump rewrites
-// the single existing line — so `-S` silently walks back to the commit that
-// first introduced the constant and reports every commit since as unreleased.
-// `--no-merges` is load-bearing, not a nicety: a bump lands on main VIA a merge,
-// so counting merges means the moment any release lands there is always ≥1
-// "unreleased" commit — the merge that landed the bump. This check exists
-// because a real gap hid for ten days behind layers that all reported success;
-// one that cries wolf after every single release earns exactly the same
-// scrolling-past it was added to prevent. Merge commits carry no content of
-// their own, so they are not unreleased work. (task 1002558)
-function unreleasedSince(mainRef) {
-  const bump = git(`log ${mainRef} -1 --format=%H -G"^const CORE_VERSION = " -- src/module-api.js`);
-  if (!bump) return null;
-  const count = git(`rev-list --count --no-merges ${bump}..${mainRef}`);
-  const withMerges = git(`rev-list --count ${bump}..${mainRef}`);
-  return {
-    bump,
-    bumpShort: bump.slice(0, 8),
-    bumpSubject: git(`log -1 --format=%s ${bump}`, ''),
-    bumpDate: git(`log -1 --format=%cs ${bump}`, ''),
-    count: count === null ? null : Number(count),
-    countWithMerges: withMerges === null ? null : Number(withMerges),
-  };
-}
-
-// Does the live build include commit `sha`? true / false, or null when this
-// checkout cannot tell (task 1004682). Two ways to know, tried in order:
-//   1. The /version commit is one this repo has (a box that runs this checkout
-//      directly) — plain ancestry.
-//   2. Otherwise the commit is the hub's OWN repo (it consumes the core as a
-//      published package — measured 2026-10-09: cloudbongos.com reports a commit
-//      core main does not contain, at the coreVersion main declares). Then: find the
-//      first CORE_VERSION bump on main at or after `sha` — the release that carries
-//      it — and compare the live coreVersion against it. No bump yet ⇒ not yet.
-// Both inputs reach git, so both are hex-or-nothing and the ref is a fixed name.
-function liveIncludes(live, sha, mainRef = resolveMainRef()) {
-  const want = typeof sha === 'string' && /^[0-9a-f]{7,40}$/i.test(sha) ? sha.toLowerCase() : null;
-  if (!live || !want || !/^(origin\/main|HEAD)$/.test(mainRef)) return null;
-  const liveCommit = typeof live.commit === 'string' && /^[0-9a-f]{40}$/i.test(live.commit) ? live.commit : null;
-  if (liveCommit && git(`cat-file -e ${liveCommit}`) !== null) {
-    return git(`merge-base --is-ancestor ${want} ${liveCommit}`) !== null;
-  }
-  if (!isPlausibleVersion(live.coreVersion)) return null;
-  if (git(`merge-base --is-ancestor ${want} ${mainRef}`) === null) return null; // not on main here yet
-  // `sha` itself may be the bump (a hand-cut release); otherwise the first bump after it.
-  const selfBump = git(`log -1 --format=%H -G"^const CORE_VERSION = " ${want} -- src/module-api.js`, '');
-  const after = git(`log --ancestry-path --reverse --format=%H -G"^const CORE_VERSION = " ${want}..${mainRef} -- src/module-api.js`, '');
-  const carrier = selfBump && selfBump.startsWith(want) ? selfBump : (after ? after.split('\n')[0].trim() : null);
-  if (!carrier) return false; // on main, but no release carries it yet
-  const carried = coreVersionAt(carrier);
-  return carried ? cmpSemver(live.coreVersion, carried) >= 0 : null;
-}
-
-// The sanitised reading the merge-reach sentence is built from. `live` may be a
-// raw /version body (ship-finish passes one), so it goes through the same filters
-// fetchLive applies before anything is interpolated.
-// Prefer origin/main — the released trunk — but fall back to HEAD in a checkout with
-// no remote (a box, a tarball). Shared by check() and hubReading() so both agree.
-function resolveMainRef() {
-  return git('rev-parse --verify --quiet origin/main') ? 'origin/main' : 'HEAD';
-}
-
-function hubReading({ target, live, sha, mainRef = resolveMainRef() } = {}) {
-  return {
-    host: safeHost(target || API_BASE),
-    liveShort: live ? safeCommitShort(live.commitShort) || safeCommitShort(typeof live.commit === 'string' ? live.commit.slice(0, 8) : null) : null,
-    includes: live ? liveIncludes(live, sha, mainRef) : null,
-  };
-}
-
-function cmpSemver(a, b) {
-  const pa = String(a).split('.').map(Number);
-  const pb = String(b).split('.').map(Number);
-  for (let i = 0; i < 3; i += 1) {
-    const d = (pa[i] || 0) - (pb[i] || 0);
-    if (d) return d < 0 ? -1 : 1;
-  }
-  return 0;
-}
-
-const DEFAULT_TIMEOUT_MS = 15000;
-
-// Strict semver — `1.19.69`, `2.0.0-rc.1`, `1.2.3+build.5`. Anchored, length-capped,
-// and deliberately narrower than anything we would ever publish, because this is
-// the filter standing between an unauthenticated network response and an agent's
-// context window (see the trust-boundary note in fetchLive).
-const SEMVER_RE = /^\d{1,6}\.\d{1,6}\.\d{1,6}(?:-[0-9A-Za-z.-]{1,32})?(?:\+[0-9A-Za-z.-]{1,32})?$/;
-const isPlausibleVersion = (v) => typeof v === 'string' && v.length <= 64 && SEMVER_RE.test(v);
-
-// commitShort is only ever displayed, never compared — but it comes from the same
-// untrusted response, so it gets the same treatment: hex or nothing.
-const safeCommitShort = (c) => (typeof c === 'string' && /^[0-9a-f]{4,40}$/i.test(c) ? c : null);
-
-// schemaPending is interpolated into the line too: a bounded non-negative integer or nothing.
-const safeCount = (n) => (Number.isInteger(n) && n >= 0 && n <= 100000 ? n : null);
-
-// The host is local config (API_BASE / --url), not a network response — but it is
-// still interpolated into injected text, so it is bounded and stripped of anything
-// that could read as prose rather than a hostname.
-function safeHost(target) {
-  const host = String(target).replace(/^https?:\/\//, '').replace(/\/+$/, '');
-  return /^[A-Za-z0-9.:_-]{1,120}$/.test(host) ? host : 'the configured instance';
-}
-
-async function fetchLive(base, timeoutMs = DEFAULT_TIMEOUT_MS) {
-  const url = `${String(base).replace(/\/+$/, '')}/version`;
-  const ctl = new AbortController();
-  const timer = setTimeout(() => ctl.abort(), timeoutMs);
-  try {
-    const res = await fetch(url, { signal: ctl.signal, headers: { accept: 'application/json' } });
-    if (!res.ok) return { url, error: `HTTP ${res.status}` };
-    const body = await res.json();
-    if (!body || !body.coreVersion) return { url, error: 'no coreVersion field in /version' };
-    // TRUST BOUNDARY. /version is an unauthenticated response from whatever
-    // API_BASE resolves to, and --line embeds this value in text injected
-    // straight into an agent's SessionStart context. Interpolating it raw would
-    // hand anyone who can answer as that host (a hostile GDS_API_BASE/OTB_API_BASE,
-    // DNS or host compromise, a compromised instance) a silent every-session
-    // prompt-injection channel. cmpSemver is no defence — it Number()-parses only
-    // the leading dot-segment, so "999.0.0 <instructions to the agent>" compares
-    // fine and would carry the whole string through.
-    //
-    // So: accept ONLY a strict semver, and treat anything else as unreadable.
-    // The caller already renders an unreadable /version as undetermined, which
-    // --line turns into silence — the fail-open path stays fail-open, while the
-    // CONTENT fails closed.
-    if (!isPlausibleVersion(body.coreVersion)) {
-      return { url, error: 'coreVersion in /version is not a plausible version string' };
-    }
-    return {
-      url,
-      coreVersion: String(body.coreVersion),
-      commitShort: safeCommitShort(body.commitShort),
-      // Full sha, hex-or-nothing: only ever handed to git (liveIncludes), never printed.
-      commit: typeof body.commit === 'string' && /^[0-9a-f]{40}$/i.test(body.commit) ? body.commit : null,
-      schemaPending: safeCount(body.schemaPending),
-    };
-  } catch (e) {
-    return { url, error: e.name === 'AbortError' ? `timed out after ${timeoutMs}ms` : (e.message || String(e)) };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-// Is the automation that should have PREVENTED this divergence itself alive? (task 1003158)
-//
-// This script detects the SYMPTOM — live is behind main — and only ever at a moment a human is
-// already looking. What went unwatched is the auto-upgrade subscription itself: when it stopped,
-// nothing said so, and cloudbongos.com sat 36 releases behind for days. Reading the roster here means
-// a dead upgrader is reported in the same breath as the staleness it was supposed to prevent.
-//
-// Speaks ONLY when a subscription manifest is actually present. An ordinary core checkout has none by
-// design (ADR 0136 — it ships empty), and alarming about that every session is exactly the noise that
-// gets a real warning scrolled past. Present-but-broken, or present-and-subscribing-nothing, is the
-// signal worth having: someone meant to enroll instances here and none are being upgraded.
-function subscriptionHealth(dir = REPO_ROOT) {
-  try {
-    const uc = require('./update-channel');
-    const roster = uc.loadSubscriptions({ instanceDir: dir });
-    if (!roster.present) return null;
-    return uc.describeRoster(roster, { controlPlane: true });
-  } catch {
-    return null; // never let the health probe break the divergence check it rides along with
-  }
-}
-
-// withReach: compute the who-sees-a-merge reading (a few git calls). The SessionStart
-// --line never prints it, so it passes false and pays nothing for it.
-async function check({ base, timeoutMs = DEFAULT_TIMEOUT_MS, withReach = true } = {}) {
-  const target = base || arg('--url') || API_BASE;
-  const local = coreVersionAt(null);
-  if (!local) return { ok: false, undetermined: true, reason: 'could not read CORE_VERSION from src/module-api.js', target };
-
-  // Prefer origin/main — the released trunk — but fall back to HEAD in a
-  // checkout with no remote (a box, a tarball) so the check still says
-  // something useful instead of bailing.
-  const mainRef = resolveMainRef();
-  const onMain = coreVersionAt(mainRef) || local;
-  const unreleased = unreleasedSince(mainRef);
-  const live = await fetchLive(target, timeoutMs);
-
-  const subscriptions = subscriptionHealth();
-
-  if (live.error) return { ok: false, undetermined: true, reason: `could not read ${live.url}: ${live.error}`, target, local, onMain, unreleased, subscriptions };
-
-  const behind = cmpSemver(live.coreVersion, onMain) < 0;
-  const ahead = cmpSemver(live.coreVersion, onMain) > 0;
-  const hasUnreleased = !!(unreleased && unreleased.count > 0);
-  const schemaBehind = live.schemaPending > 0;
-  // "this merge", read from here, is main's tip: ship-finish runs this right after a land.
-  const reach = withReach ? hubReading({ target, live, sha: git(`rev-parse ${mainRef}`), mainRef }) : null;
-
-  return {
-    ok: !behind && !hasUnreleased && !schemaBehind,
-    target, local, onMain, mainRef, unreleased, live, behind, ahead, hasUnreleased, schemaBehind, subscriptions, reach,
-  };
-}
-
-function report(r, { quiet = false } = {}) {
-  const say = (...a) => console.log(...a);
-
-  if (r.undetermined) {
-    console.error(`deploy-divergence: undetermined — ${r.reason}`);
-    return;
-  }
-  if (r.ok && quiet) return;
-
-  const host = String(r.target).replace(/^https?:\/\//, '');
-  say('');
-  say(`  Deploy divergence · ${host}`);
-  say('  ──────────────────────────────────────────────────────────');
-  say(`  live (serving)      ${r.live.coreVersion}${r.live.commitShort ? `  (instance commit ${r.live.commitShort})` : ''}`);
-  say(`  ${r.mainRef.padEnd(18)}  ${r.onMain}`);
-  // Only worth a line when a bump is in flight in this tree but not yet landed.
-  if (r.local !== r.onMain) say(`  working tree        ${r.local}  (not yet on ${r.mainRef})`);
-  if (r.unreleased) {
-    say(`  last bump           ${r.unreleased.bumpShort} ${r.unreleased.bumpDate} — ${r.unreleased.bumpSubject}`);
-  }
-  say('');
-
-  // Who sees a merge — the same two lines the ship card prints (merge-reach.js).
-  const reachBlock = () => {
-    say('');
-    for (const l of whoSeesAMerge(r.reach || { host: safeHost(r.target) })) say(`  ${l}`);
-    say('');
-  };
-
-  if (r.ok) {
-    say('  ✓ aligned — live matches main, and main carries no unreleased commits.');
-    reachBlock();
-    return;
-  }
-
-  if (r.hasUnreleased) {
-    // Say which number this is: work commits and with-merges differ a lot on a
-    // big window (93 vs 171 for 1.18.18), and an unlabelled figure invites the
-    // "~100 vs 171" disagreement that muddied blocker 1000097.
-    const u = r.unreleased;
-    const merges = u.countWithMerges != null && u.countWithMerges !== u.count
-      ? ` (${u.countWithMerges} counting merges)` : '';
-    say(`  ⚠ UNRELEASED — ${u.count} work commit${u.count === 1 ? '' : 's'}${merges} on ${r.mainRef} since the last CORE_VERSION bump.`);
-    say('    No hosted project can take these at ANY pin: no published version contains them yet.');
-    say('    The publish lane (ADR 0161) normally carries a merge within minutes; a gap that stays means it is disarmed or red.');
-  }
-  if (r.behind) {
-    say(`  ⚠ UNDEPLOYED — live is ${r.live.coreVersion}, main declares ${r.onMain}.`);
-    say('    A release exists that this instance has not picked up. On the hub, its redeploy is late or stuck;');
-    say('    on a hosted project, its pin has not moved (see docs/recipes/upgrading-the-core.md).');
-  }
-  if (r.schemaBehind) {
-    const n = r.live.schemaPending;
-    say(`  ⚠ SCHEMA BEHIND — live's database is missing ${n} migration${n === 1 ? '' : 's'} its running code ships.`);
-    say('    The first query that touches them fails (the 2026-07-04 502 was this shape).');
-    say('    Fix: run migrate against that instance DB with PGDATABASE set (see docs/recipes/upgrading-the-core.md).');
-  }
-  if (r.ahead) {
-    say(`  note: live (${r.live.coreVersion}) is AHEAD of ${r.mainRef} (${r.onMain}) — this checkout is stale; fetch.`);
-  }
-  // The watcher's watcher: if this checkout carries a subscription roster and that roster is not
-  // healthy, the unattended upgrade is not going to close the gap above on its own.
-  if (r.subscriptions && r.subscriptions.level !== 'ok') {
-    say('');
-    say(`  ${r.subscriptions.level === 'alarm' ? '⚠ AUTO-UPGRADE' : 'note: auto-upgrade'} — ${r.subscriptions.message}`);
-    if (r.behind) say('    So the gap above will NOT close by itself.');
-  }
-  reachBlock();
-}
-
-// ONE line, for injecting into an agent's SessionStart context (task 1002713).
-// The full report() block is right for a ship card and far too heavy for every
-// session, so this compresses the same check() result to a single sentence.
-//
-// Returns null when there is nothing an agent must know: aligned, or the check
-// could not be determined at all. A SessionStart hook prints only a string, so
-// null IS the silence — an unreachable instance must never editorialize.
-function line(r) {
-  if (!r || r.undetermined || r.ok) return null;
-
-  const host = safeHost(r.target);
-  // Defence in depth: fetchLive already rejects a non-semver coreVersion, so a
-  // value reaching here is known-safe. Re-checking costs nothing and means a
-  // future caller that builds its own result object cannot reopen the hole.
-  const liveVer = isPlausibleVersion(r.live?.coreVersion) ? r.live.coreVersion : null;
-  const mainVer = isPlausibleVersion(r.onMain) ? r.onMain : null;
-
-  const parts = [];
-  if (r.behind && liveVer && mainVer) {
-    parts.push(`${host} is SERVING core ${liveVer}, but main declares ${mainVer}`);
-  } else if (r.ahead && liveVer && mainVer) {
-    // Live ahead of main is not "fine" — it means this checkout is stale, and an
-    // agent reading main would describe the wrong code as deployed.
-    parts.push(`${host} is SERVING core ${liveVer}, AHEAD of main's ${mainVer} — this checkout is behind`);
-  }
-  if (r.hasUnreleased) {
-    const n = r.unreleased.count;
-    parts.push(`${n} commit${n === 1 ? ' on main is' : 's on main are'} UNRELEASED (no version carries them)`);
-  }
-  const versionParts = parts.length;
-  const pending = r.schemaBehind ? safeCount(r.live?.schemaPending) : null;
-  if (pending) {
-    parts.push(`its database is MISSING ${pending} migration${pending === 1 ? '' : 's'} the running code ships, so the first query that touches ${pending === 1 ? 'it' : 'them'} fails`);
-  }
-  if (!parts.length) return null;
-
-  const advice = [];
-  // Fixed vocabulary + the bounded host only (this line is injected context).
-  if (versionParts) advice.push(`${hubRule(host)}; ${HOSTED_LINE.charAt(0).toLowerCase()}${HOSTED_LINE.slice(1)} Say which one you mean before calling work live.`);
-  if (pending) advice.push('Run migrate against that instance DB (PGDATABASE set) before anything else.');
-  return `Deploy state (read from ${host}/version): ${parts.join('; ')}. ${advice.join(' ')}`;
-}
-
-async function main() {
-  const quiet = hasFlag('--quiet');
-  const warnOnly = hasFlag('--warn-only');
-  // --line: the SessionStart shape. FAIL-OPEN — a divergence is context for the
-  // agent, and an unreachable instance is nothing at all; neither is a failure of
-  // the session this is injected into. So: swallow everything, exit 0 always.
-  //
-  // Note it sets exitCode and RETURNS rather than calling process.exit(). Exiting
-  // explicitly here raced libuv's teardown of the fetch socket and aborted the
-  // process on Windows/Node 24 (`Assertion failed: !(handle->flags &
-  // UV_HANDLE_CLOSING)`, exit 127) — the line printed correctly and the command
-  // still "failed", which is the one outcome a fail-open path must never produce.
-  // Natural exit is both clean and prompt (~180ms) because the check is the only
-  // work in flight.
-  if (hasFlag('--line')) {
-    const ms = Number(arg('--timeout-ms')) || DEFAULT_TIMEOUT_MS;
-    try {
-      // Shared across concurrent session starts (task 1003689): four sessions opened
-      // seconds apart asked this same question four times and all four timed out, which
-      // emits NO line — and silence from a truth-teller reads as "nothing to report".
-      const { cached } = require('./probe-cache.js');
-      const { value: one } = await cached('deploy-divergence-line', async () => line(await check({ timeoutMs: ms, withReach: false })));
-      if (one) console.log(one);
-    } catch { /* offline, no git, unreadable module-api — all silence */ }
-    process.exitCode = 0;
-    return undefined;
-  }
-  const r = await check();
-  report(r, { quiet });
-  // Same reason --line sets exitCode instead of calling process.exit: exiting
-  // explicitly here raced libuv's teardown of the fetch socket and aborted with
-  // `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING)` → exit 127, so the
-  // documented 0/1/2 contract above was not actually what callers saw on
-  // Windows. Pre-dates task 1002713 (reproduced on clean origin/main); fixed
-  // here because it is this same exit path. The codes themselves are unchanged.
-  if (warnOnly) process.exitCode = 0;
-  else if (r.undetermined) process.exitCode = 2;
-  else process.exitCode = r.ok ? 0 : 1;
-  return undefined;
-}
-
-if (require.main === module) {
-  main().catch((e) => {
-    console.error('deploy-divergence: failed —', e.message || e);
-    process.exit(2);
-  });
-}
-
-module.exports = { check, report, line, coreVersionAt, unreleasedSince, cmpSemver, subscriptionHealth, liveIncludes, hubReading };
+// scripts/gds/deploy-divergence.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/deploy-divergence.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'deploy-divergence.js');

package/scripts/gds/deploy-main-audit-gate.sh

@@ -1,97 +1,8 @@
 #!/bin/sh
-# scripts/gds/deploy-main-audit-gate.sh — the SEC #863 / ADR 0043 deploy-side gate.
-#
-# Refuses a deploy when a builder BELOW Metic modified a permission-sensitive path in the
-# delta this deploy introduces. Run from the instance checkout root, AFTER the working tree
-# has been moved to the new commit and BEFORE anything is migrated or restarted.
-#
-#   OTB_DEPLOY_PREV_SHA="$(git rev-parse HEAD)"; export OTB_DEPLOY_PREV_SHA   # BEFORE the pull
-#   git reset --hard origin/main
-#   sh node_modules/@bongos/core/scripts/gds/deploy-main-audit-gate.sh || exit 1
-#   ...migrate, restart...
-#
-# WHY THIS LIVES IN THE CORE (task 1001426). It used to live in the control-plane repo's
-# infra/, where a standalone instance checkout cannot reach it — and on cloudbongos.com it
-# was never wired into ~/deploy.sh at all, so the "poison never reaches prod" check had
-# never once run. Shipping it beside main-audit.js means every instance inherits the gate
-# with its pinned core, and there is no per-instance copy to drift.
-#
-# THE MARKER IS THE CHECKED-OUT HEAD, AND IT ADVANCES ONLY ON SUCCESS.
-# That is the substance of this task and the reason the restore below is in the GATE rather
-# than in each caller's deploy script. The gate can only audit what was pulled, so it runs
-# after the tree has already moved. Exiting non-zero and leaving it moved would mean the
-# next deploy computes OTB_DEPLOY_PREV_SHA from the POISONED commit, never re-audits that
-# delta, and finds the poison already checked out — the marker-bypass this gate exists to
-# close, reintroduced one layer up. So a refusal puts the tree back where it started.
-# Set OTB_GATE_NO_RESTORE=1 only when the caller restores it itself.
-#
-# STRICT IS OFF BY DEFAULT, AND THAT IS NOT LAZINESS. Rank resolution keys on github_login
-# only (#863-followup finding #6: display_name is builder-controlled, so keying it let one
-# builder alias another's rank). A deploy lane whose commits are authored under a human
-# display name ("Firstname Lastname") rather than the builder's github_login therefore
-# resolves to nothing, and OTB_AUDIT_STRICT=1 would block every deploy forever.
-# Non-strict still hard-blocks the incident class this was built for: a RESOLVED below-Metic
-# author touching a protected path. Turn strict on once the lane commits under logins.
-#
-# KNOWN LIMIT, stated because a gate nobody distrusts is worse than no gate: if the roster
-# cannot be read at all, every author is unresolved and non-strict passes. main-audit.js
-# announces that loudly on stderr (task 1001426 gave it a fallback and a voice — it used to
-# fail silently and return an empty map, so the gate reported a clean audit that never ran).
-# Availability is chosen over a hard stop deliberately: a database blip must not freeze
-# deploys. Read the stderr.
-
-set -eu
-
-# The range rides main-audit.js's --range flag, never an env var (task 1001441): a
-# shell cannot compute the instance's branded env prefix (<PREFIX>_AUDIT_RANGE), and
-# argv needs none. AUDIT_RANGE below is this script's own variable, not exported.
-AUDIT_RANGE=""
-if [ -n "${OTB_DEPLOY_PREV_SHA:-}" ]; then
-  AUDIT_RANGE="${OTB_DEPLOY_PREV_SHA}..HEAD"
-  echo "main audit: range ${AUDIT_RANGE} (exact deploy delta)"
-else
-  echo "main audit: OTB_DEPLOY_PREV_SHA not set — falling back to the wide window."
-  echo "  (Recommended: capture OTB_DEPLOY_PREV_SHA=\$(git rev-parse HEAD) BEFORE the pull;"
-  echo "   without it a poisoned commit buried under the window can escape, and a refusal"
-  echo "   cannot put the tree back.)"
-fi
-
-STRICT=""
-[ "${OTB_AUDIT_STRICT:-0}" = "1" ] && STRICT="--strict"
-
-# Prefer the installed core; fall back to an in-tree checkout (the core repo itself).
-MAIN_AUDIT="node_modules/@bongos/core/scripts/gds/main-audit.js"
-[ -f "$MAIN_AUDIT" ] || MAIN_AUDIT="scripts/gds/main-audit.js"
-if [ ! -f "$MAIN_AUDIT" ]; then
-  echo "X DEPLOY ABORTED: main-audit.js not found (looked in node_modules/@bongos/core and in-tree)."
-  echo "  A gate that cannot find its auditor must fail closed, not wave the deploy through."
-  exit 1
-fi
-
-if [ -n "$AUDIT_RANGE" ]; then set -- --range "$AUDIT_RANGE"; else set --; fi
-# ${1+"$@"}, not "$@": an empty "$@" under set -u is an unbound-variable error in
-# older /bin/sh (bash 3.2, macOS).
-if node "$MAIN_AUDIT" --verify-head --db ${STRICT} ${1+"$@"}; then
-  echo "OK main audit clean${STRICT:+ (strict)} — proceeding with deploy."
-  exit 0
-fi
-
-echo ""
-echo "X DEPLOY ABORTED (SEC #863): a below-Metic${STRICT:+ or unresolved} author modified a"
-echo "  permission-sensitive path in this deploy. Investigate and revert before deploying:"
-echo "      node $MAIN_AUDIT --range \"\${AUDIT_RANGE:-HEAD~200..HEAD}\" --revert"
-
-if [ -n "${OTB_DEPLOY_PREV_SHA:-}" ] && [ "${OTB_GATE_NO_RESTORE:-0}" != "1" ]; then
-  if git rev-parse --verify --quiet "${OTB_DEPLOY_PREV_SHA}^{commit}" >/dev/null; then
-    echo ""
-    echo "  restoring the checkout to ${OTB_DEPLOY_PREV_SHA} — the deployed marker advances only on success,"
-    echo "  so the NEXT deploy re-audits this same delta instead of treating it as already-reviewed."
-    git reset --hard "${OTB_DEPLOY_PREV_SHA}" >/dev/null
-  else
-    echo ""
-    echo "  ::WARNING:: cannot restore — ${OTB_DEPLOY_PREV_SHA} is not a commit in this checkout."
-    echo "  The tree is left at the REFUSED commit; the next deploy will not re-audit this delta."
-  fi
-fi
-
-exit 1
+# scripts/gds/deploy-main-audit-gate.sh — @bongos-forwarder (task 1004848). Generated by
+# scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+# The real script is scripts/bongos/deploy-main-audit-gate.sh. This forwarder keeps callers that still name
+# the old path working, and warns once so they get repointed. Task 1003706 removes it.
+if [ -z "${BONGOS_FORWARDER_WARNED:-}" ]; then echo "[bongos] scripts/gds/deploy-main-audit-gate.sh has moved to scripts/bongos/deploy-main-audit-gate.sh. This old path still works for now, but update whatever called it. The forwarders in scripts/gds/ are removed in a later release." >&2; fi
+export BONGOS_FORWARDER_WARNED=1
+exec sh "$(dirname "$0")/../bongos/deploy-main-audit-gate.sh" "$@"

package/scripts/gds/design-sync.js

@@ -1,12 +1,7 @@
 #!/usr/bin/env node
+// scripts/gds/design-sync.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/design-sync.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-// design-sync.js — thin shim: the Claude Design sync CLI lives in the ui-design
-// module at modules/ui-design/scripts/design-sync.js (task 1003324, ADR 0197).
-//
-// WHY a shim rather than re-pointing every caller: `node scripts/gds/<x>.js` is
-// the form the skills and recipes use, and the form claude-materialize rewrites to
-// `bongos exec scripts/gds/<x>.js` when the core installs as a package — so this
-// path stays the stable, documented entry point. Flags pass straight through:
-//   node scripts/gds/design-sync.js                 — build the token-preview bundle, print the manifest
-//   node scripts/gds/design-sync.js --surface <id>  — limit to one surface
-require('../../modules/ui-design/scripts/design-sync.js');
+require('../bongos/forwarder.js').forward(module, 'design-sync.js');