@bongos/core 1.21.175 → 1.21.177

package/scripts/gds/redteam-patrol.js

@@ -1,437 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/redteam-patrol.js — the weekly deterministic red-team patrol
-// (task 1003128, goal 1000076; ADR 0180 §3, docs/audits/ai-dev-redteam-baseline.md).
-//
-// The patrol is the third enforcement layer (prevent → gate → PATROL): checks
-// too slow, too networked, or too history-wide for the merge gate, run weekly
-// by the .claude/scheduled-tasks/redteam-weekly routine. It is ADVISORY by
-// doctrine (ADR 0158 §2 — a verdict never self-executes): findings are FILED as
-// security reports for Archon adjudication, never turned into gates here.
-//
-// Checks (all deterministic — no model reads anything):
-//   1. history-secrets — full-git-history gitleaks scan (.gitleaks.toml config;
-//      the CI gate only scans the current tree, so a key deleted years ago but
-//      still live is THIS check's catch). Needs the gitleaks binary
-//      (GITLEAKS_BIN or on PATH) — absent means a loud degraded note.
-//   2. dependency-review — npm audit delta vs config/audit-baseline.json
-//      (reuses audit-gate.js), release-age cooldown (<7 days — ADR 0180 §3),
-//      young direct deps (<90 days — the slopsquat shape), stale overrides.
-//   3. action-pins — every workflow `uses:` must be pinned to a 40-hex SHA
-//      (the tj-actions lesson).
-//   4. baseline-staleness — a shrink-only quality baseline that has not moved in
-//      8 weeks (task 1003210). Belongs HERE and not in the merge gate for the
-//      same reason the other three do: it is history-wide and time-based, so it
-//      is not a property of anyone's diff — failing a PR because ambient debt
-//      turned eight weeks old punishes whoever pushed next. The audit asked for
-//      "the repeatable, scheduled version" of a review it had done by hand; this
-//      is it.
-//
-// Filing: DRY-RUN by default (prints what it would file). --file POSTs one
-// report PER CLASS (max severity within the class, details in repro_steps_md)
-// to /api/bongos/security/reports. --canary proves the end-to-end pipe: plants a
-// constructed token, asserts the scanner catches it, files a low "[canary]"
-// report, and dispute-closes it so the queue stays clean.
-//
-// UNATTENDED RUNS (task 1003209). The scheduler is .github/workflows/redteam-patrol.yml
-// — CI, not the always-on server, because all three checks read things only the
-// REPO has: full git history, .github/workflows/, and a package-lock npm can audit
-// (ADR 0188). A CI runner has no GDS session, so --file would otherwise hit
-// cli-lib's interactive re-auth wall and print "run /builder-reauth" into a cron
-// log. Instead --file preflights the session and, when there is none, follows the
-// main-audit.js --require-roster doctrine: report LOUDLY rather than green-and-
-// vacuous. The exit code says whether a finding was LOST, not whether findings
-// exist — findings are advisory (ADR 0158 §2) and a patrol that goes red merely for
-// doing its job trains everyone to ignore it:
-//
-//   ran + filed                     → 0
-//   ran, nothing to file            → 0 (with or without a session)
-//   ran, has findings, cannot file  → 2 — the one state where evidence evaporates
-//
-// Findings are ALSO appended to $GITHUB_STEP_SUMMARY when set, so a scheduled run
-// is readable in the Actions UI without opening the log.
-
+// scripts/gds/redteam-patrol.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/redteam-patrol.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { execSync, execFileSync } = require('child_process');
-
-const ROOT = path.resolve(__dirname, '..', '..');
-const COOLDOWN_DAYS = 7;   // ADR 0180 §3 — patrol-enforced until npm ≥ 11.10 in CI
-const YOUNG_PKG_DAYS = 90; // a very new package is the slopsquat/typosquat shape
-const MAX_ITEMS_PER_REPORT = 10;
-
-const SEV_ORDER = { low: 0, medium: 1, high: 2, critical: 3 };
-// npm audit says "moderate"; the bounty table says "medium".
-function mapSeverity(s) {
-  const v = String(s || '').toLowerCase();
-  return v === 'moderate' ? 'medium' : (SEV_ORDER[v] !== undefined ? v : 'low');
-}
-function maxSeverity(findings) {
-  return findings.reduce((m, f) => (SEV_ORDER[f.severity] > SEV_ORDER[m] ? f.severity : m), 'low');
-}
-
-// ---------- 1. full-history secret scan ----------
-
-function gitleaksBin() {
-  const explicit = process.env.GITLEAKS_BIN;
-  if (explicit && fs.existsSync(explicit)) return explicit;
-  try {
-    execFileSync(process.platform === 'win32' ? 'where' : 'which', ['gitleaks'], { stdio: 'pipe' });
-    return 'gitleaks';
-  } catch {
-    return null;
-  }
-}
-
-// Parse a gitleaks JSON report file into patrol findings.
-function parseGitleaksReport(raw) {
-  let rows;
-  try { rows = JSON.parse(raw); } catch { return []; }
-  if (!Array.isArray(rows)) return [];
-  return rows.map((r) => ({
-    severity: 'high',
-    item: `${r.RuleID || r.ruleID || 'secret'} in ${r.File || r.file || '?'}${r.Commit ? ` @ ${String(r.Commit).slice(0, 8)}` : ''}`,
-  }));
-}
-
-function historySecretScan() {
-  const bin = gitleaksBin();
-  if (!bin) {
-    return { degraded: 'gitleaks binary not found (set GITLEAKS_BIN or `brew install gitleaks`) — history scan SKIPPED', findings: [] };
-  }
-  const report = path.join(os.tmpdir(), `gitleaks-patrol-${process.pid}.json`);
-  try {
-    execFileSync(bin, ['git', '.', '--config', '.gitleaks.toml', '--redact', '--no-banner',
-      '--report-format', 'json', '--report-path', report], { cwd: ROOT, stdio: 'pipe' });
-  } catch {
-    /* non-zero exit = leaks found; the report file is still written */
-  }
-  let findings = [];
-  try { findings = parseGitleaksReport(fs.readFileSync(report, 'utf8')); } catch { /* no report = clean */ }
-  try { fs.unlinkSync(report); } catch { /* already gone */ }
-  return { degraded: null, findings };
-}
-
-// ---------- 2. dependency review ----------
-
-function npmViewJson(spec) {
-  try {
-    return JSON.parse(execSync(`npm view ${spec} --json`, { cwd: ROOT, stdio: 'pipe', timeout: 30000 }).toString());
-  } catch {
-    return null;
-  }
-}
-
-function ageDays(iso, now = Date.now()) {
-  const t = Date.parse(iso);
-  return Number.isFinite(t) ? (now - t) / 86400000 : null;
-}
-
-function lockedVersion(lock, name) {
-  const entry = lock.packages && lock.packages[`node_modules/${name}`];
-  return entry && entry.version;
-}
-
-// Pure: what to say about ONE `overrides` entry. Extracted so the rule is a table
-// a test can enumerate — the networked half (npm view) stays outside.
-//
-// THE BUG THIS REPLACES (task 1003283, report 1000025). The old rule compared the
-// pinned MAJOR against `dist-tags.latest` and filed a medium whenever latest was
-// higher. That flags every override which deliberately holds a major line — which
-// is the normal reason an override exists at all. It fired on `undici ^6.28.0`
-// "while latest is 8.10.0", when 6.28.0 is the newest 6.x, `discord.js` (the only
-// consumer) requires the 6.x line, and `npm audit` finds nothing. Acting on it
-// would have BROKEN the dependent; ignoring it weekly is the alert-fatigue failure
-// ADR 0188 §2.4 exists to prevent — here inside the patrol itself.
-//
-// The real signal is narrower: a pin whose LOCKED version has fallen behind what
-// its own range already allows. That is rot nobody chose. Trailing the latest
-// major is reported as a NOTE instead, because only a human can say whether a
-// dependent still constrains the line.
-//
-// `satisfying` is every published version matching `range`, ASCENDING (npm's own
-// order), so the newest in-range version is simply the last element — no semver
-// comparator needed, and no dependency added to do it.
-function overrideVerdict({ name, range, locked, satisfying = [], latest = null } = {}) {
-  const newestInRange = satisfying.length ? satisfying[satisfying.length - 1] : null;
-  if (newestInRange && locked && newestInRange !== locked && satisfying.includes(locked)) {
-    return {
-      finding: { severity: 'medium', item: `stale override: ${name} is locked at ${locked} but its own pin "${range}" already allows ${newestInRange} — refresh the lockfile` },
-    };
-  }
-  const pinnedMajor = parseInt(String(range).replace(/^[^0-9]*/, ''), 10);
-  const latestMajor = parseInt(String(latest), 10);
-  if (Number.isFinite(pinnedMajor) && Number.isFinite(latestMajor) && latestMajor > pinnedMajor) {
-    return {
-      note: `override ${name} "${range}" trails the latest major (${latest}) — expected when a dependent requires that line; verify before lifting, do NOT bump blind`,
-    };
-  }
-  return {};
-}
-
-function dependencyReview() {
-  const findings = [];
-  const notes = [];
-  const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
-  const lock = JSON.parse(fs.readFileSync(path.join(ROOT, 'package-lock.json'), 'utf8'));
-
-  // 2a — audit delta vs the committed baseline (same lens as the CI gate, but
-  // the patrol also reports RESOLVED entries so the baseline gets shrunk).
-  const auditGate = require('./audit-gate.js');
-  try {
-    let raw;
-    try { raw = execSync('npm audit --omit=dev --json', { cwd: ROOT, maxBuffer: 32 * 1024 * 1024, stdio: 'pipe' }).toString(); }
-    catch (e) { raw = e && e.stdout ? e.stdout.toString() : null; }
-    const current = auditGate.extractFindings(JSON.parse(raw));
-    const baseline = JSON.parse(fs.readFileSync(auditGate.BASELINE_PATH, 'utf8')).findings || [];
-    const verdict = auditGate.compare(current, baseline);
-    for (const f of [...verdict.newGating, ...verdict.newAdvisory]) {
-      findings.push({ severity: mapSeverity(f.severity), item: `new advisory: [${f.severity}] ${f.name} (${f.id}) ${f.title}` });
-    }
-    for (const f of verdict.resolved) notes.push(`baseline shrinkable: ${f.name} (${f.id}) no longer reproduces`);
-  } catch (e) {
-    notes.push(`audit delta SKIPPED (infra): ${e.message}`);
-  }
-
-  // 2b — release-age cooldown + young packages, direct deps only (9 today).
-  for (const name of Object.keys(pkg.dependencies || {})) {
-    const version = lockedVersion(lock, name);
-    if (!version) continue;
-    const meta = npmViewJson(`${name} time`);
-    const time = meta && (meta.time || meta);
-    if (!time) { notes.push(`npm view failed for ${name} — cooldown check skipped`); continue; }
-    const vAge = ageDays(time[version]);
-    if (vAge !== null && vAge < COOLDOWN_DAYS) {
-      findings.push({ severity: 'medium', item: `cooldown breach: ${name}@${version} published ${vAge.toFixed(1)}d ago (<${COOLDOWN_DAYS}d — ADR 0180 §3)` });
-    }
-    const cAge = ageDays(time.created);
-    if (cAge !== null && cAge < YOUNG_PKG_DAYS) {
-      findings.push({ severity: 'medium', item: `young package: ${name} created ${cAge.toFixed(0)}d ago (<${YOUNG_PKG_DAYS}d — verify it is the intended package)` });
-    }
-  }
-
-  // 2c — override staleness (the undici lesson: a pin nobody watches rots) —
-  // measured INSIDE the pinned range, see overrideVerdict above.
-  for (const [name, range] of Object.entries(pkg.overrides || {})) {
-    if (typeof range !== 'string') continue;
-    const latest = npmViewJson(`${name} dist-tags.latest`);
-    // Every published version matching the range, ascending. npm returns a bare
-    // string when exactly one matches, so normalise to an array.
-    const matched = npmViewJson(`"${name}@${range}" version`);
-    const satisfying = matched == null ? [] : (Array.isArray(matched) ? matched : [matched]);
-    if (!latest && !satisfying.length) { notes.push(`npm view failed for override ${name} — staleness check skipped`); continue; }
-    const v = overrideVerdict({ name, range, locked: lockedVersion(lock, name), satisfying, latest });
-    if (v.finding) findings.push(v.finding);
-    if (v.note) notes.push(v.note);
-  }
-  return { findings, notes };
-}
-
-// ---------- 3. workflow action pins ----------
-
-const USES_RE = /^\s*(?:-\s+)?uses:\s*(\S+)/;
-const SHA_PINNED_RE = /@[0-9a-f]{40}(\s|$)/;
-
-function unpinnedUses(yamlText) {
-  const out = [];
-  for (const line of yamlText.split('\n')) {
-    const m = USES_RE.exec(line);
-    if (!m) continue;
-    const ref = m[1];
-    if (ref.startsWith('./') || ref.startsWith('docker://')) continue; // local/composite + digest-pinnable images
-    if (!SHA_PINNED_RE.test(ref)) out.push(ref);
-  }
-  return out;
-}
-
-function actionPinCheck() {
-  const dir = path.join(ROOT, '.github', 'workflows');
-  const findings = [];
-  if (!fs.existsSync(dir)) return { findings };
-  for (const f of fs.readdirSync(dir).filter((n) => n.endsWith('.yml') || n.endsWith('.yaml'))) {
-    for (const ref of unpinnedUses(fs.readFileSync(path.join(dir, f), 'utf8'))) {
-      findings.push({ severity: 'medium', item: `unpinned action in ${f}: "${ref}" — pin to a 40-hex commit SHA (tj-actions lesson)` });
-    }
-  }
-  return { findings };
-}
-
-// ---------- report assembly + filing ----------
-
-function buildClassReport(className, findings, notes = []) {
-  const shown = findings.slice(0, MAX_ITEMS_PER_REPORT);
-  const body = [
-    ...shown.map((f) => `- [${f.severity}] ${f.item}`),
-    ...(findings.length > shown.length ? [`…and ${findings.length - shown.length} more`] : []),
-    ...(notes.length ? ['', 'Notes:', ...notes.map((n) => `- ${n}`)] : []),
-  ].join('\n');
-  return {
-    target: `redteam-patrol/${className}`,
-    severity: maxSeverity(findings),
-    title: `[patrol] ${className}: ${findings.length} finding(s)`,
-    description: `Weekly deterministic red-team patrol (task 1003128; advisory per ADR 0158 §2 — adjudicate, then fix via ordinary tasks).`,
-    repro_steps_md: body,
-  };
-}
-
-// Append markdown to the Actions job summary when running under GitHub Actions.
-// Best-effort and inert everywhere else — a patrol run must never fail because a
-// log surface was unavailable.
-function stepSummary(md) {
-  const dest = process.env.GITHUB_STEP_SUMMARY;
-  if (!dest) return;
-  try { fs.appendFileSync(dest, `${md}\n`); } catch { /* never fatal */ }
-}
-
-// Pure: what a completed sweep should DO with its findings, and the exit code
-// that disposition deserves. Extracted so the honest-exit contract is a table a
-// test can enumerate rather than branching buried in main().
-//
-// The load-bearing row is the last one. Findings are ADVISORY (ADR 0158 §2), so a
-// run that finds three things and files them is a SUCCESS — going red merely for
-// doing its job is how a weekly lane becomes noise everyone filters. Red is
-// reserved for the single state where evidence EVAPORATES: findings exist,
-// filing was asked for, and it cannot happen.
-function disposition({ findingClasses = 0, doFile = false, blocker = null } = {}) {
-  if (!findingClasses) return { action: 'clean', exitCode: 0 };
-  if (!doFile) return { action: 'dry-run', exitCode: 0 };
-  if (blocker) return { action: 'not-filed', exitCode: 2 };
-  return { action: 'file', exitCode: 0 };
-}
-
-// Is there a GDS session this run could file with? Returns the reason it cannot,
-// or null when filing is possible. Read directly (readSessionToken) rather than
-// probing with apiCall, because apiCall's 401 path exits the process with
-// interactive re-auth guidance — useless in a cron log and indistinguishable from
-// a crash.
-function filingBlocker() {
-  try {
-    const { readSessionToken } = require('./cli-lib.js');
-    return readSessionToken() ? null : 'no GDS session on this runner';
-  } catch (e) {
-    return `session unreadable: ${e && e.message}`;
-  }
-}
-
-async function fileReport(report) {
-  const { apiCall } = require('./cli-lib.js');
-  const r = await apiCall('POST', '/api/bongos/security/reports', report);
-  const row = (r.data && r.data.report) || {};
-  return row.id || null;
-}
-
-async function disputeReport(id, note) {
-  const { apiCall } = require('./cli-lib.js');
-  return apiCall('POST', `/api/bongos/security/reports/${id}/dispute`, { note });
-}
-
-// ---------- canary ----------
-
-async function runCanary(file) {
-  const bin = gitleaksBin();
-  if (!bin) { console.error('canary FAIL: gitleaks binary unavailable'); process.exit(1); }
-  const token = 'ghp_' + 'Ab1Cd2Ef3Gh4Ij5Kl6Mn7Op8Qr9St0Uv1Wx2Y'; // constructed, never a literal shape
-  const canaryPath = path.join(ROOT, 'src', `patrol-canary-${process.pid}.js`);
-  fs.writeFileSync(canaryPath, `const t = "${token}";\n`);
-  let caught = false;
-  try {
-    const report = path.join(os.tmpdir(), `gitleaks-canary-${process.pid}.json`);
-    try {
-      execFileSync(bin, ['dir', '.', '--config', '.gitleaks.toml', '--redact', '--no-banner',
-        '--report-format', 'json', '--report-path', report], { cwd: ROOT, stdio: 'pipe' });
-    } catch { /* leaks found → non-zero, expected */ }
-    try {
-      caught = parseGitleaksReport(fs.readFileSync(report, 'utf8')).some((f) => f.item.includes('patrol-canary'));
-      fs.unlinkSync(report);
-    } catch { caught = false; }
-  } finally {
-    fs.unlinkSync(canaryPath);
-  }
-  if (!caught) { console.error('canary FAIL: planted token was not detected'); process.exit(1); }
-  console.log('canary: planted token detected by the scanner ✓');
-  if (file) {
-    const id = await fileReport({
-      target: 'redteam-patrol/canary',
-      severity: 'low',
-      title: '[canary] patrol self-test — planted token detected end-to-end',
-      description: 'Seeded finding proving the patrol can detect and FILE (task 1003128 done-when). Dispute-closed by the patrol itself; no action needed.',
-      repro_steps_md: '- plant constructed ghp_ token in src/ → gitleaks dir catches it → report filed → dispute-closed.',
-    });
-    if (!id) { console.error('canary FAIL: report did not file'); process.exit(1); }
-    console.log(`canary: filed security report ${id} ✓`);
-    await disputeReport(id, 'canary self-test (task 1003128) — auto-closed by the patrol');
-    console.log('canary: dispute-closed ✓ — end-to-end pipe proven');
-  }
-}
-
-// ---------- main ----------
-
-async function main() {
-  if (process.argv.includes('--canary')) {
-    await runCanary(process.argv.includes('--file'));
-    return;
-  }
-  const doFile = process.argv.includes('--file');
-
-  const classes = [];
-  const secrets = historySecretScan();
-  if (secrets.findings.length) classes.push(buildClassReport('history-secrets', secrets.findings));
-  if (secrets.degraded) console.warn(`patrol: DEGRADED — ${secrets.degraded}`);
-
-  const deps = dependencyReview();
-  if (deps.findings.length) classes.push(buildClassReport('dependency-review', deps.findings, deps.notes));
-  else if (deps.notes.length) console.log(`patrol: dependency notes:\n${deps.notes.map((n) => `  - ${n}`).join('\n')}`);
-
-  const pins = actionPinCheck();
-  if (pins.findings.length) classes.push(buildClassReport('action-pins', pins.findings));
-
-  // Deterministic and local (git history + one JSON file) — no network, no model.
-  const stale = require('./baseline-staleness.js').stalenessFindings();
-  if (stale.length) classes.push(buildClassReport('baseline-staleness', stale));
-
-  if (secrets.degraded) stepSummary(`> **DEGRADED** — ${secrets.degraded}`);
-
-  if (!classes.length) {
-    console.log('patrol: clean sweep — nothing to file.');
-    stepSummary('## red-team patrol\n\nClean sweep — no findings to file.');
-    return;
-  }
-
-  stepSummary(['## red-team patrol', ...classes.map((c) =>
-    `### ${c.title}\n\nseverity: **${c.severity}**\n\n${c.repro_steps_md}`)].join('\n\n'));
-
-  // Preflight the session ONCE, before the first POST: a half-filed sweep (class
-  // one lands, class two hits the auth wall and exits) is worse than not starting.
-  const blocker = doFile ? filingBlocker() : null;
-  const { action, exitCode } = disposition({ findingClasses: classes.length, doFile, blocker });
-  if (action === 'not-filed') {
-    console.error(`patrol: DID NOT FILE — ${blocker}. ${classes.length} finding class(es) above are NOT in the adjudication queue.`);
-    console.error('patrol: sign in on this runner (or set the scheduler\'s session secret) and re-run — see docs/recipes/redteam-patrol.md.');
-    for (const report of classes) console.error(`  [${report.severity}] ${report.title}\n${report.repro_steps_md}`);
-    stepSummary(`\n> **NOT FILED** — ${blocker}. These findings exist only in this run's log.`);
-    process.exitCode = exitCode;
-    return;
-  }
-
-  for (const report of classes) {
-    if (doFile) {
-      const id = await fileReport(report);
-      console.log(`patrol: filed [${report.severity}] ${report.title} → report ${id}`);
-    } else {
-      console.log(`patrol (dry-run): would file [${report.severity}] ${report.title}\n${report.repro_steps_md}\n`);
-    }
-  }
-  if (!doFile) console.log('patrol: dry run — pass --file to POST these as security reports.');
-}
-
-if (require.main === module) {
-  main().catch((e) => { console.error(`patrol: ERROR ${e.message}`); process.exit(1); });
-}
-
-module.exports = {
-  parseGitleaksReport, unpinnedUses, ageDays, mapSeverity, maxSeverity,
-  buildClassReport, lockedVersion, COOLDOWN_DAYS, YOUNG_PKG_DAYS,
-  stepSummary, filingBlocker, disposition, overrideVerdict,
-};
+require('../bongos/forwarder.js').forward(module, 'redteam-patrol.js');

package/scripts/gds/regen-instance-docs.js

@@ -1,47 +1,7 @@
 #!/usr/bin/env node
+// scripts/gds/regen-instance-docs.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/regen-instance-docs.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-// regen-instance-docs.js — regenerate a STANDALONE instance's live navigation docs (task 1002314).
-//
-// THE GAP. On the monorepo, the gitignored whole-file navigation docs are regenerated at deploy by
-// scripts/deploy/deploy-prod.sh (ADR 0110 §2/§3). STANDALONE instances
-// (ADR 0108 — their own lean repo with @bongos/core vendored) never got that step: their bespoke
-// pull-deploy regenerated NOTHING, so a fresh instance shipped with an empty docs/ and nothing kept
-// the session-log index live. This script is the STANDALONE analogue of deploy-prod.sh's regen block
-// — one line for an instance's deploy.sh to call after `git reset --hard` + migrate.
-//
-// USAGE (from the instance repo, core vendored in node_modules):
-//   node node_modules/@bongos/core/scripts/gds/regen-instance-docs.js
-// It resolves the INSTANCE root (bongos.config.json instanceRoot / <PREFIX>_INSTANCE_ROOT / cwd) and
-// writes docs/session-log-index.md THERE (gitignored on the instance, so the next
-// `git reset --hard origin/main` never wipes it and no branch can ever diff it).
-//
-// SCOPE + CONTRACT: see regenerateNavDocs() in upgrade.js — it owns the generator list and the
-// rationale for what is and isn't deploy-regenerated (repo-map is core-scoped; file-map + API docs
-// are tracked/committed; diagrams are the headless-browser exception). Best-effort + LOUD per
-// ADR 0110 §2 "accepted staleness": a broken generator prints `::ERROR::` (journald greps it) but
-// this script ALWAYS exits 0 — a stale nav doc is tolerable; a failed deploy is not.
-
-const path = require('node:path');
-const { resolveInstanceRoot } = require('../../src/instance-config');
-const { regenerateNavDocs } = require('./upgrade');
-
-function main() {
-  const coreRoot = path.resolve(__dirname, '..', '..'); // the @bongos/core package this script ships in
-  const instanceDir = resolveInstanceRoot();
-  const res = regenerateNavDocs({ instanceDir, coreRoot });
-  if (res.ran.length) {
-    console.log(`regen-instance-docs: regenerated ${res.ran.join(', ')} → ${instanceDir}/docs/`);
-  }
-  if (!res.ok) {
-    for (const f of res.failed) {
-      // LOUD (ADR 0110 §2): journald greps ::ERROR:: so a broken generator surfaces.
-      console.error(`::ERROR:: regen-instance-docs: ${f.gen} failed — ${f.reason}`);
-    }
-  }
-  // Best-effort: NEVER fail the deploy. A stale/absent nav doc is tolerable; the ::ERROR:: is the alarm.
-  process.exit(0);
-}
-
-if (require.main === module) main();
-
-module.exports = { main };
+require('../bongos/forwarder.js').forward(module, 'regen-instance-docs.js');

package/scripts/gds/release-core.js

@@ -1,80 +1,7 @@
 #!/usr/bin/env node
+// scripts/gds/release-core.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/release-core.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-// scripts/gds/release-core.js — may this version of @bongos/core be RELEASED? (task 1004298, ADR 0361)
-//
-// Merges publish as candidates (under the `next` label). A version reaches other projects only when
-// the owner presses Release on /deploy, which runs publish.yml's release job, which asks this script
-// and then moves the registry's `latest` label. Every consumer that offers a version to a project
-// other than the platform hall reads `latest` (update-channel.js versionsForFollow), so this label IS
-// the release.
-//
-// WHY A SCRIPT AND NOT A SHELL STEP. The rule has four ways to say no, and a shell `if` chain inside
-// a workflow file is the one place nothing can test it. The decision is pure and unit-tested
-// (tests/release_core.mjs); the workflow only runs it and acts on `go`.
-//
-// THE RULE:
-//   - the version must be a plain x.y.z (it is interpolated into an npm command line);
-//   - it must be PUBLISHED — Release labels a version, it never builds one;
-//   - it must be newer than the current release. Releasing an OLDER version would move every
-//     project's offer backwards, which is a rollback for everyone, not a release; that is a
-//     different act and needs a person at a terminal, not a button.
-//   - releasing the version already released is a no-op, not an error — a double press is harmless.
-//
-// Usage (in publish.yml's release job):
-//   node scripts/gds/release-core.js --version 1.20.80
-// Prints the decision; writes go=true|false to $GITHUB_OUTPUT when set. Exit 0 for go and no-op,
-// 1 for a refusal.
-
-const fs = require('node:fs');
-const { spawnSync } = require('node:child_process');
-const { CORE_PKG, parseSemver, compareSemver, isStable } = require('./update-channel.js');
-
-const VERSION_RE = /^[0-9]+\.[0-9]+\.[0-9]+$/;
-
-/**
- * PURE. `versions`: every published version. `latest`: the version the registry labels `latest`
- * now, or null. Returns { go, noop, reason }.
- */
-function releaseDecision({ version, versions, latest } = {}) {
-  const v = String(version == null ? '' : version).trim();
-  if (!VERSION_RE.test(v)) return { go: false, noop: false, reason: `"${v}" is not a version (x.y.z)` };
-  const list = Array.isArray(versions) ? versions : [];
-  if (!list.includes(v)) return { go: false, noop: false, reason: `${v} is not published — Release labels a published version, it never builds one` };
-  if (!isStable(v)) return { go: false, noop: false, reason: `${v} is a prerelease` };
-  if (latest && parseSemver(latest)) {
-    const c = compareSemver(v, latest);
-    if (c === 0) return { go: false, noop: true, reason: `${v} is already the release` };
-    if (c < 0) return { go: false, noop: false, reason: `${v} is older than the current release ${latest} — releasing it would move every project backwards` };
-  }
-  return { go: true, noop: false, reason: latest ? `release ${v} (was ${latest})` : `release ${v} (no release yet)` };
-}
-
-function readRegistry({ pkg = CORE_PKG, run = spawnSync } = {}) {
-  const res = run('npm', ['view', pkg, 'versions', 'dist-tags', '--json'], { encoding: 'utf8', timeout: 60000 });
-  if (!res || res.status !== 0) return { ok: false, error: String((res && res.stderr) || 'npm view failed').trim().split('\n')[0] };
-  try {
-    const doc = JSON.parse(String(res.stdout || '{}'));
-    const versions = Array.isArray(doc.versions) ? doc.versions : (typeof doc.versions === 'string' ? [doc.versions] : []);
-    const tags = doc['dist-tags'] || {};
-    return { ok: true, versions, latest: typeof tags.latest === 'string' ? tags.latest : null };
-  } catch (e) {
-    return { ok: false, error: `unparseable npm output: ${e.message}` };
-  }
-}
-
-function main(argv = process.argv.slice(2), { env = process.env, read = readRegistry, log = console.log, err = console.error } = {}) {
-  const i = argv.indexOf('--version');
-  const version = i >= 0 ? argv[i + 1] : '';
-  const out = (go) => { if (env.GITHUB_OUTPUT) fs.appendFileSync(env.GITHUB_OUTPUT, `go=${go}\n`); };
-  const reg = read();
-  if (!reg.ok) { err(`release-core: could not read the registry (${reg.error})`); out(false); return 1; }
-  const d = releaseDecision({ version, versions: reg.versions, latest: reg.latest });
-  out(d.go);
-  if (d.go || d.noop) { log(`release-core: ${d.reason}`); return 0; }
-  err(`release-core: refused — ${d.reason}`);
-  return 1;
-}
-
-if (require.main === module) process.exit(main());
-
-module.exports = { releaseDecision, main };
+require('../bongos/forwarder.js').forward(module, 'release-core.js');