@bongos/core 1.21.175 → 1.21.177

package/modules/memory/search.js

@@ -551,8 +551,8 @@ function classifyEmptyResult(health) {
       healthy: false,
       message: 'THE SEARCH INDEX IS EMPTY — this is an outage, not an answer. No chunk has ever been '
         + 'written, or the table was wiped and never rebuilt. Nothing can be found until an ingest '
-        + 'succeeds: run `node scripts/gds/search-ingest-md.js` (repo docs) and '
-        + '`node scripts/gds/search-ingest-db.js` (DB prose), and check their exit codes — they run '
+        + 'succeeds: run `node scripts/bongos/search-ingest-md.js` (repo docs) and '
+        + '`node scripts/bongos/search-ingest-db.js` (DB prose), and check their exit codes — they run '
         + 'best-effort from the deploy and a failure there is easy to miss (task 1002859).',
     };
   }

package/modules/npm-release/release.js

@@ -16,7 +16,7 @@
 //   requestRelease    — what the button does: the same rule the workflow applies (release-core.js,
 //                       imported, never restated), then the dispatch.
 
-const { releaseDecision } = require('../../scripts/gds/release-core.js');
+const { releaseDecision } = require('../../scripts/bongos/release-core.js');
 
 const VERSION_RE = /^\d+\.\d+\.\d+$/;
 // The ledger window the evidence reads. A candidate older than this has been superseded many

package/modules/onboarding/howto-moments.js

@@ -9,7 +9,7 @@
 //     already has (the prompt, the active claims, whether this is the session's first
 //     prompt), injects the step, and marks it read;
 //   • any other AI tool: the instance CLAUDE.md tells it to run
-//     `npx bongos howto moment <id>` (scripts/gds/howto.js), which prints the step and
+//     `npx bongos howto moment <id>` (scripts/bongos/howto.js), which prints the step and
 //     marks it read the same way.
 //
 // Short by design: at most MAX_STEPS steps, from ONE moment, per prompt. A read (or

package/modules/onboarding/newcomer-restock.js

@@ -15,7 +15,7 @@
 // Each instance is a NORMAL one-shot task (credits / ship / graduation / version-
 // progress all unchanged) with source='newcomer-template' and a monotonic source_ref
 // `tmpl:<discipline>:<template_id>:<seq>`. The chore CONTENT (and per-template floor)
-// lives in scripts/gds/newcomer-floor.templates.json; the per-discipline DEFAULT floor
+// lives in scripts/bongos/newcomer-floor.templates.json; the per-discipline DEFAULT floor
 // is in newcomer-floor.config.json. Nothing is generated — only blank copies of the
 // same chore are restocked.
 //
@@ -28,8 +28,8 @@ const path = require('node:path');
 const db = require('./db');
 
 const REPO_ROOT = path.resolve(__dirname, '../..');
-const TEMPLATES_PATH = path.join(REPO_ROOT, 'scripts/gds/newcomer-floor.templates.json');
-const CONFIG_PATH = path.join(REPO_ROOT, 'scripts/gds/newcomer-floor.config.json');
+const TEMPLATES_PATH = path.join(REPO_ROOT, 'scripts/bongos/newcomer-floor.templates.json');
+const CONFIG_PATH = path.join(REPO_ROOT, 'scripts/bongos/newcomer-floor.config.json');
 const SOURCE_TAG = 'newcomer-template';
 const HARD_MAX_MINUTES = 60;
 // The crafts THIS instance offers, read through the published doorway (the one

package/modules/onboarding/onboarding.js

@@ -8,7 +8,7 @@
 // This module is the *pure* half of the pipeline: parse a Claude Code
 // transcript, compute deterministic friction signals, build the subagent
 // prompt, validate the subagent's JSON, and shape the idea_inbox payload.
-// No filesystem, no network, no DB — that lives in scripts/gds/onboarding-*.js
+// No filesystem, no network, no DB — that lives in scripts/bongos/onboarding-*.js
 // so this stays unit-testable and side-effect free (mirrors how grader.js
 // keeps buildPrompt/validateAndScore pure while runSubagent does the I/O).
 //

package/modules/pixel-art/skills/otb-tile-generate/SKILL.md

@@ -37,7 +37,7 @@ Runs `modules/art-pipeline/pipeline/orchestrator.py` for the requested tiles. Th
 
    **View it on your sandbox without placing it in-game** (#1262): every tile you've generated — native + zoomed, with its score and critique — is served at **`https://sandbox-<login>.example.com/art`** (locally: `http://localhost:<port>/art`). This is the generated-art *gallery* (`modules/art-pipeline/generated/preview.html`), so you can show the builder what they made even when the tile isn't placed in the world yet. The atlas-rebuild in-game step below is only needed once you actually want it *in the playable world*.
 
-6. **See it in-game on your sandbox** (#1067): run `node scripts/gds/art-stage.js` (**ships with the `art-pipeline` host module, not the portable core** — absent from a core-only checkout, where this step doesn't apply) — it rebuilds the atlas the client loads, surfaces it on your sandbox live preview (`sandbox-<login>.example.com`, ADR 0044), and prints the URL + affected tiles. With the auto-reload (task 1065) an already-open tab refreshes itself. (The family/refresh runs also accept `--stage` to do this automatically: `family_orchestrator.py <id> --publish --stage`, `refresh_all.py --stage`.) Only a genuinely NEW base-tile *type* still needs a `public/game/world/tilePalette.js` mapping edit; an updated existing tile just needs the atlas rebuild above.
+6. **See it in-game on your sandbox** (#1067): run `node scripts/bongos/art-stage.js` (**ships with the `art-pipeline` host module, not the portable core** — absent from a core-only checkout, where this step doesn't apply) — it rebuilds the atlas the client loads, surfaces it on your sandbox live preview (`sandbox-<login>.example.com`, ADR 0044), and prints the URL + affected tiles. With the auto-reload (task 1065) an already-open tab refreshes itself. (The family/refresh runs also accept `--stage` to do this automatically: `family_orchestrator.py <id> --publish --stage`, `refresh_all.py --stage`.) Only a genuinely NEW base-tile *type* still needs a `public/game/world/tilePalette.js` mapping edit; an updated existing tile just needs the atlas rebuild above.
 
 ## Constraints
 

package/modules/platform-identity/origin-containment.js

@@ -29,7 +29,7 @@
 // instance's own public origin — so it is not offered.
 //
 // WHY ITS OWN FILE. The rule could not simply be shared where it sat: `platform-identity.js`
-// is AT its file-size ratchet (scripts/gds/fitness-ratchets.js, 1500 lines, no headroom)
+// is AT its file-size ratchet (scripts/bongos/fitness-ratchets.js, 1500 lines, no headroom)
 // and `project-stats.js` is a different file besides — the account-visibility.js /
 // publish-gate.js / projects-feed.js precedent, taken here for the same reason. It is
 // deliberately NOT re-exported from `platform-identity.js`: both callers require it

package/modules/platform-identity/publish-gate.js

@@ -21,7 +21,7 @@
 // re-implements a two-field rule inevitably does. That is the whole point of the file.
 //
 // WHY ITS OWN FILE. Same reason account-visibility.js is: platform-identity.js sits at
-// the file-size ratchet (scripts/gds/fitness-ratchets.js), and R16 (task 1002335) added
+// the file-size ratchet (scripts/bongos/fitness-ratchets.js), and R16 (task 1002335) added
 // the port + the phrase. platform-identity.js re-exports every symbol here, so the
 // module's public surface is unchanged and no caller has to know about the split.
 //

package/modules/platform-identity/tests/platform-identity.mjs

@@ -3,7 +3,7 @@
 // DB-free unit suite for the hub identity-provider domain (ADR 0141, task #1002106).
 // Two layers: the pure crypto helpers (no DB), and the domain DB functions against
 // a RECORDING FAKE pool (asserts the SQL shape + params + the security invariants
-// without needing Postgres). Auto-run by scripts/gds/run-unit-tests.js ONLY when the
+// without needing Postgres). Auto-run by scripts/bongos/run-unit-tests.js ONLY when the
 // platform-identity module is enabled; run standalone:
 //   node modules/platform-identity/tests/platform-identity.mjs
 //

package/modules/provisioning/capacity.js

@@ -21,7 +21,7 @@
 // the db it is handed; `readLocalMeminfo` reads this host's /proc/meminfo, for the
 // web tier and the CLI, which run ON the control plane). The runner reads the same
 // file through its box executor instead, so an overflow box is measured where the
-// project will actually run (scripts/gds/provision-capacity.js). No module-api, no
+// project will actually run (scripts/bongos/provision-capacity.js). No module-api, no
 // express, no pool of its own — this file is the shared arithmetic, not a surface.
 'use strict';
 

package/modules/provisioning/core-upgrade.js

@@ -19,7 +19,7 @@
 // tool that can answer "is this version published" is update-channel.js's
 // `listAvailableVersions`, which shells out via spawnSync — it would block the
 // entire event loop for the seconds npm takes, stalling every other request on a
-// single-process server. It also lives in scripts/gds/, which a module may not
+// single-process server. It also lives in scripts/bongos/, which a module may not
 // require (ADR 0083). So publication and channel policy are enforced by the RUNNER,
 // which is a CLI process where both are free. What is enforced here is everything
 // that can be decided without the network: shape, state, format, and the guard.
@@ -273,7 +273,7 @@ function lastMoveSuperseded(target, served, recommended, registryRead = false) {
  * project's GitHub repo (task 1004065) — `{ code, text }`, or null. PURE.
  *
  * The runner writes it into the intent's last_error as `repo_not_updated:<code>: <text>`
- * (scripts/gds/provision-core-upgrade.js repoNote; re-stated here because a module may
+ * (scripts/bongos/provision-core-upgrade.js repoNote; re-stated here because a module may
  * not require a script, and round-tripped by tests/core_upgrade_runner.mjs). ONLY that
  * shape is read: any other text on a done row is not turned into a warning, because
  * inventing one would tell an owner their repo is stale on no evidence.
@@ -414,14 +414,20 @@ async function loadPreview(pool, provisioning, inst) {
   return previewFromSnapshot(inst, rows[0], openIntent, await lastCoreMove(pool, inst.id));
 }
 
-function makeCoreUpgradePreviewHandler({ provisioning, pool, parseId, log }) {
+// `mayMove(req)` (optional) answers whether this viewer's press would be let
+// through; its answer rides the preview as `viewer_may_move` (task 1004829).
+async function withViewer(preview, mayMove, req) {
+  return mayMove ? { ...preview, viewer_may_move: await mayMove(req) } : preview;
+}
+
+function makeCoreUpgradePreviewHandler({ provisioning, pool, parseId, log, mayMove = null }) {
   return async function coreUpgradePreviewHandler(req, res) {
     const id = parseId(req, res);
     if (!id) return;
     try {
       const inst = await provisioning.getInstanceById(pool, id);
       if (!inst) return res.fail('instance_not_found', 404);
-      return res.json({ ok: true, preview: await loadPreview(pool, provisioning, inst) });
+      return res.json({ ok: true, preview: await withViewer(await loadPreview(pool, provisioning, inst), mayMove, req) });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id/core-upgrade', err);
       return failFrom(res, err, 'core_upgrade_preview_failed');
@@ -433,7 +439,7 @@ function makeCoreUpgradePreviewHandler({ provisioning, pool, parseId, log }) {
  * Where the deploy page starts: "which row is this platform?"
  *
  * THE PAGE CANNOT BE EXPECTED TO KNOW THE ID. The self row is created once, by hand, at
- * install time (scripts/gds/enroll-control-plane.js) — so its id differs per install and
+ * install time (scripts/bongos/enroll-control-plane.js) — so its id differs per install and
  * is nobody's to memorise. The alternative was to have the page list the fleet and filter
  * it client-side, which would make a page about ONE box read every project row to find it,
  * and would answer nothing at all for an Archon who does not own the control-plane row.
@@ -442,17 +448,17 @@ function makeCoreUpgradePreviewHandler({ provisioning, pool, parseId, log }) {
  * of an install that has not run the enrolment yet, and the only useful thing to say is
  * which command creates it.
  */
-function makeControlPlaneHandler({ provisioning, pool, log }) {
+function makeControlPlaneHandler({ provisioning, pool, log, mayMove = null }) {
   return async function controlPlaneHandler(req, res) {
     try {
       const { rows } = await pool.query("SELECT * FROM provisioning_instances WHERE hosting_shape = 'control-plane' LIMIT 1");
       if (!rows[0]) {
         return res.fail('control_plane_not_enrolled', {
           status: 404,
-          message: 'This platform has no deploy door yet. Whoever administers the box runs `node scripts/gds/enroll-control-plane.js --owner <builderId> --apply` once, and it appears here.',
+          message: 'This platform has no deploy door yet. Whoever administers the box runs `node scripts/bongos/enroll-control-plane.js --owner <builderId> --apply` once, and it appears here.',
         });
       }
-      return res.json({ ok: true, preview: await loadPreview(pool, provisioning, rows[0]) });
+      return res.json({ ok: true, preview: await withViewer(await loadPreview(pool, provisioning, rows[0]), mayMove, req) });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/control-plane', err);
       return failFrom(res, err, 'control_plane_read_failed');
@@ -463,7 +469,7 @@ function makeControlPlaneHandler({ provisioning, pool, log }) {
 // ---- the project's update rule (task 1004445) -------------------------------------
 //
 // RE-STATED, NOT REQUIRED. The list is update-channel.js VALID_CHANNELS / DEFAULT_CHANNEL,
-// which lives in scripts/gds/ and a module may not require (ADR 0083) — the same reason
+// which lives in scripts/bongos/ and a module may not require (ADR 0083) — the same reason
 // parseRepoNote re-states the runner's note shape. tests/core_upgrade_door.mjs asserts the
 // two lists are equal, so they cannot drift apart silently; migration provisioning_029's
 // CHECK is the third copy, and the database refuses anything outside it.

package/modules/provisioning/credential-preflight.js

@@ -12,7 +12,7 @@
 // definition of "usable credential", and 1002898 carved this out rather than guess
 // at one: written against the wrong definition it would either refuse valid creates
 // or keep admitting doomed ones. 1002735 settled it, so this file encodes THAT
-// definition and nothing else — what `ensurePrivateRepoAccess` (scripts/gds/
+// definition and nothing else — what `ensurePrivateRepoAccess` (scripts/bongos/
 // provision-repo.js) will demand at standup time, asked one round-trip earlier:
 //
 //   public target_ref   → any readable credential is enough. The recurring deploy
@@ -37,7 +37,7 @@
 // github-repos.getUserRepo. `src/module-api.js` is a KERNEL file (ADR 0091 §1) and
 // may depend only on kernel files; `src/bongos/db.js` and `src/bongos/github-repos.js`
 // are domain, so routing either through the doorway fails the boundary check in
-// scripts/gds/fitness.js. Modules own their data access through the exposed `pool`
+// scripts/bongos/fitness.js. Modules own their data access through the exposed `pool`
 // (the module contract's own rule), so the two small reads below are that ownership,
 // not a shortcut around it. Both are DELIBERATE TWINS of core's versions and say so;
 // `grantedScopeCoversRepos` is reached through the doorway instead of re-implemented
@@ -51,7 +51,7 @@
 // auth stack or touching the network.
 'use strict';
 
-// Mirrors scripts/gds/provision-repo.js parseTargetRef EXACTLY. The preflight and
+// Mirrors scripts/bongos/provision-repo.js parseTargetRef EXACTLY. The preflight and
 // the runner must agree on what a target_ref means, or this admits refs the runner
 // cannot parse (and refuses ones it can) — a divergence that would be silent.
 function parseTargetRef(ref) {

package/modules/provisioning/disconnect.js

@@ -3,7 +3,7 @@
 //
 // A teardown keeps the database, backups and address (ADR 0181); a disconnect erases
 // them and deletes the row, so the name, port and address are reusable. The web tier
-// only enqueues it; scripts/gds/provision-disconnect.js is the runner leg that does it.
+// only enqueues it; scripts/bongos/provision-disconnect.js is the runner leg that does it.
 //
 // Its own file because provisioning.js sits at the size ratchet. It reaches the queue
 // through the provisioning module OBJECT, so a test can stub getOpenIntent/enqueueIntent.

package/modules/provisioning/dns-resolves.js

@@ -7,7 +7,7 @@
 // (cloudbongos.com's SOA minimum is 1800s). The hub used to link an address as soon as
 // the row read 'active', so a founder who clicked before the name answered anywhere
 // could not reach their own project from their home network for up to half an hour.
-// The fix has two halves: the runner creates the DNS record FIRST (scripts/gds/
+// The fix has two halves: the runner creates the DNS record FIRST (scripts/bongos/
 // provision.js), and the hub holds every link to the address until `dns_resolves` is
 // true — a fact only a lookup the PLATFORM made can establish, never the status alone.
 //

package/modules/provisioning/module.json

@@ -1,7 +1,7 @@
 {
   "key": "provisioning",
   "title": "Instance provisioning",
-  "description": "Stand up + operate a Cloud Bongos instance's own infrastructure (server, database, domain, DNS, TLS) via the API, so an owner does not manage infra by hand (ADR 0111). Owns the web-tier REQUEST + STATE surface only: it enqueues provisioning intents + reads instance state — it holds NO cloud-provider tokens and calls NO cloud API. A separate control-plane runner (scripts/gds/provision.js, task P3) is the sole token-holder that drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute WORKLOADS.",
+  "description": "Stand up + operate a Cloud Bongos instance's own infrastructure (server, database, domain, DNS, TLS) via the API, so an owner does not manage infra by hand (ADR 0111). Owns the web-tier REQUEST + STATE surface only: it enqueues provisioning intents + reads instance state — it holds NO cloud-provider tokens and calls NO cloud API. A separate control-plane runner (scripts/bongos/provision.js, task P3) is the sole token-holder that drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute WORKLOADS.",
   "version": "1.0.0",
   "coreVersion": "^1.14.0",
   "category": { "parent": "hosting" },

package/modules/provisioning/onboard-plan.js

@@ -2,7 +2,7 @@
 //
 // Goal 35 / criterion 165 names the sequence as the source of truth: "The canonical
 // step sequence is the source of truth; skill/CLI/hall are forms over it." This file
-// is that ONE source. The CLI (`bongos onboard`, scripts/gds/onboard.js) and the hub's
+// is that ONE source. The CLI (`bongos onboard`, scripts/bongos/onboard.js) and the hub's
 // ?view=new create wizard (task 1002763) read it — via a direct
 // require (the CLI) or the public GET /provisioning/onboard-plan route (the web) — so
 // the sequence can never drift between the forms (task 2085, anti-drift).

package/modules/provisioning/paid-shape-gate.js

@@ -26,7 +26,7 @@
 //   cloud-host    — the project's hall, hosted by us (ADR 0345), and the only shape the
 //                   create wizard sends. It runs the caller's OWN repo on the platform's
 //                   own box: the unit's WorkingDirectory is that checkout
-//                   (`scripts/gds/provision-units.js`) and the module loader discovers
+//                   (`scripts/bongos/provision-units.js`) and the module loader discovers
 //                   modules from `resolveInstanceRoot()`, which is process.cwd()
 //                   (`src/module-loader/loader.js`). So the caller names a repo and the
 //                   platform require()s its `modules/` — code execution on the control
@@ -47,7 +47,7 @@
 //                   because on someone else's account a bigger plan is a setting, not a
 //                   hosting shape we model.
 //   control-plane — the platform's OWN row (ADR 0293 D2, task 1003159), enrolled by
-//                   `scripts/gds/enroll-control-plane.js` so the owner's deploy door has
+//                   `scripts/bongos/enroll-control-plane.js` so the owner's deploy door has
 //                   something to point at. Never a thing a builder asks for. See below.
 //
 // So the authority question belongs to the SHAPE, not the route. Gating the whole route

package/modules/provisioning/planet-physics.js

@@ -70,7 +70,7 @@ const WORK_KINDS = Object.freeze(['code', 'digital-files', 'physical-work']);
 // Question 4. A project that already exists picks its legal type; a new one says
 // roughly where it is heading (the canvas: "there's nothing to sign yet"). One key,
 // because they answer one question and a project holds exactly one of them.
-const ENTITY_INTENTS = Object.freeze(['intent-company', 'intent-nonprofit', 'intent-solo', 'intent-unsure']);
+const ENTITY_INTENTS = Object.freeze(['intent-company', 'intent-nonprofit', 'intent-solo', 'intent-group', 'intent-unsure']);
 const ENTITY_FORMS = Object.freeze([
   'nonprofit', 'for-profit', 'corporate-division', 'research', // organization
   'university-project', 'social-group',                        // group
@@ -98,6 +98,9 @@ const PLANET_PHYSICS_QUESTIONS = Object.freeze({
   builder_geography: Object.freeze({ kind: 'one', values: Object.freeze(['us-only', 'us-eu', 'global', 'not-sure']) }),
   minors_on_board: Object.freeze({ kind: 'one', values: Object.freeze([false, true]) }),
   entity: Object.freeze({ kind: 'one', values: Object.freeze([...ENTITY_INTENTS, ...ENTITY_FORMS]) }),
+  // What kind of group owns the project, in the founder's own words (the owner answer
+  // 'intent-group'). Free text, trimmed, 120 characters at most.
+  entity_group_type: Object.freeze({ kind: 'text', max: 120 }),
   builders_at_start: BUILDER_COUNT,
   builders_expected: BUILDER_COUNT,
   reward_intents: Object.freeze({ kind: 'many', values: Object.freeze(['non-monetary', 'cash', 'equity', 'future-payouts']) }),
@@ -120,6 +123,11 @@ function canonicalAnswer(question, value) {
     if (!Array.isArray(value) || !value.every((v) => question.values.includes(v))) return undefined;
     return question.values.filter((v) => value.includes(v));
   }
+  if (question.kind === 'text') {
+    const t = typeof value === 'string' ? value.trim() : '';
+    // no control characters or line breaks: the value lands in labels, logs and the review line
+    return t && t.length <= question.max && !/[\u0000-\u001f\u007f]/.test(t) ? t : undefined;
+  }
   if (question.kind === 'count') {
     return Number.isInteger(value) && value >= question.min && value <= question.max ? value : undefined;
   }
@@ -130,10 +138,11 @@ function canonicalAnswer(question, value) {
 // than a dozen (the country and region codes) are named by their standard instead of
 // printed. PURE.
 function answerFaultMessage(key, question) {
-  const list = (values) => (values.length > 12
+  const list = (values) => (values.length > 12 && (key === 'home_country' || key === 'home_region')
     ? (key === 'home_country' ? 'an ISO 3166-1 alpha-2 country code, like US or DE' : 'a US state or Canadian province code, like US-CA or CA-ON')
     : `one of: ${values.join(', ')}`);
   if (question.kind === 'many') return `"${key}" must be a list, each item ${list(question.values)} — or null to un-answer it.`;
+  if (question.kind === 'text') return `"${key}" must be text of 1 to ${question.max} characters — or null to un-answer it.`;
   if (question.kind === 'count') return `"${key}" must be a whole number from ${question.min} to ${question.max} — or null to un-answer it.`;
   return `"${key}" must be ${list(question.values)} — or null to un-answer it.`;
 }

package/modules/provisioning/pollers/liveness-sweep.js

@@ -31,7 +31,7 @@ const githubSetup = require('../github-setup');
 const { planNotices, postNotice } = require('./liveness-notify');
 // task 1004000: the runner-drift check rides this tick rather than installing a timer of
 // its own — the sweep already runs every ~5 min on the one host that can see the systemd
-// units. It reads the checker as a SUBPROCESS, not a require: `scripts/gds/runner-drift.js`
+// units. It reads the checker as a SUBPROCESS, not a require: `scripts/bongos/runner-drift.js`
 // is core-package territory (ADR 0083) and its systemctl reads are blocking, so requiring
 // it would have put N×15s of event-loop work in the process serving live traffic. See
 // ./runner-drift-notify.js's header.

package/modules/provisioning/pollers/runner-drift-notify.js

@@ -5,7 +5,7 @@
 // (task 1004000, the follow-up the task 1002722 grade asked for).
 //
 // WHY. Three drift signals already existed and every one of them needed a human to go
-// and look: `scripts/gds/runner-drift.js` exits 1, `bongos doctor` has an "Intent
+// and look: `scripts/bongos/runner-drift.js` exits 1, `bongos doctor` has an "Intent
 // runners" section, and each run-intents tick writes a `⚠ DRIFT:` banner into the
 // journal. A stale runner is exactly the condition nobody is looking for — it drains
 // intents perfectly happily using last month's code — so a signal that waits to be read
@@ -49,10 +49,10 @@
 //     rather than reading as healthy.
 //
 // HOW IT READS SYSTEMD, AND WHY NOT BY require(). The checker itself is
-// `scripts/gds/runner-drift.js`, which is CORE-package territory: a module may require
+// `scripts/bongos/runner-drift.js`, which is CORE-package territory: a module may require
 // only the published doorway `src/module-api.js` (ADR 0083, `docs/modules-contract.md`,
 // and this module's own CLAUDE.md header). So this reads it the way its sibling reads
-// `scripts/discord/post.js` — as a SUBPROCESS, `node scripts/gds/runner-drift.js --json`
+// `scripts/discord/post.js` — as a SUBPROCESS, `node scripts/bongos/runner-drift.js --json`
 // — which crosses no require boundary and needs no new doorway for a fact only the
 // control plane's own host can answer.
 //
@@ -75,7 +75,7 @@
 const { execFile } = require('node:child_process');
 const path = require('node:path');
 
-// scripts/gds/runner-drift.js is invoked from the repo root regardless of cwd, the same
+// scripts/bongos/runner-drift.js is invoked from the repo root regardless of cwd, the same
 // way ./liveness-notify.js invokes scripts/discord/post.js.
 const REPO_ROOT = path.resolve(__dirname, '..', '..', '..');
 // Generous next to the checker's own per-call 15s, and it exists so a hung systemctl
@@ -92,7 +92,7 @@ function readRunnerDrift({ instanceRoot, execFileImpl = execFile, timeoutMs = RE
     const done = (v) => { if (!settled) { settled = true; resolve(v); } };
     try {
       execFileImpl('node',
-        ['scripts/gds/runner-drift.js', '--instance-root', String(instanceRoot || ''), '--json'],
+        ['scripts/bongos/runner-drift.js', '--instance-root', String(instanceRoot || ''), '--json'],
         { cwd: REPO_ROOT, timeout: timeoutMs, maxBuffer: 4 * 1024 * 1024 },
         (_err, stdout) => {
           // _err is IGNORED on purpose: exit 1 IS the drift signal (see the header).

package/modules/provisioning/provisioning.js

@@ -4,7 +4,7 @@
 // DESIGN — the trust boundary (ADR 0111 §2 / ADR 0016). This file NEVER calls a
 // cloud provider (no DigitalOcean, no Cloudflare, no registrar) and holds NO
 // tokens. It only reads/writes the module's own provisioning_* tables and ENQUEUES
-// intents. The control-plane runner (scripts/gds/provision.js, task P3) is the sole
+// intents. The control-plane runner (scripts/bongos/provision.js, task P3) is the sole
 // token-holder that drains provisioning_intents and does the real infra work.
 //
 // `db` is dependency-INJECTED (passed in as the first arg), so this file has NO
@@ -293,7 +293,7 @@ const TIER_MONTHLY_USD = {
 };
 
 // The size the RUNNER actually creates when a dedicated instance names no tier
-// (`scripts/gds/provision.js`: `size: inst.tier || 's-2vcpu-4gb'`). It lives here
+// (`scripts/bongos/provision.js`: `size: inst.tier || 's-2vcpu-4gb'`). It lives here
 // because costEstimateUsd has to agree with it: before task 1003692 the estimate
 // treated an absent tier as unpriced and reported $0 for a droplet the runner was
 // really billing at $24/mo, so the fleet cost ledger under-reported by the full

package/modules/provisioning/render-lookup.js

@@ -12,7 +12,7 @@
 //   - the key is the owner's own, held in memory for this one request; it is never
 //     stored, logged or returned, and it is not encrypted here because it is not kept.
 //   - every service in the answer is asserted to carry the workspace asked about — the
-//     same guard the runner's client applies (scripts/gds/render-api.js). A module may
+//     same guard the runner's client applies (scripts/bongos/render-api.js). A module may
 //     not require that file (ADR 0083), so this carries its own two GETs rather than a
 //     second client.
 //

package/modules/provisioning/render-standup.js

@@ -3,7 +3,7 @@
 //
 // The web tier never calls Render (ADR 0111 §2): it checks the SHAPE of what the owner
 // sent, encrypts their key, and queues a `render-standup` intent carrying it. The runner
-// leg, scripts/gds/provision-render.js, spends the key in one drain and clears it.
+// leg, scripts/bongos/provision-render.js, spends the key in one drain and clears it.
 //
 // What the encryption buys, said plainly: it protects the key from a database dump or a
 // nightly backup while the intent waits for the runner. It does NOT defend against a
@@ -14,7 +14,7 @@
 // project's own `provision` run holds the one open-intent slot. Rather than refuse, the key
 // rides THAT run (task 1004352): the runner sets the app up on Render straight after the
 // project is up, in the same drain, and clears the key either way
-// (scripts/gds/provision-render.js afterProvision).
+// (scripts/bongos/provision-render.js afterProvision).
 //
 // Its own file because provisioning.js sits at the size ratchet.
 'use strict';
@@ -58,7 +58,7 @@ const SERVICE_RE = /^srv-[a-z0-9]{8,64}$/;
 // a second, database-less copy of the project's hall on Render, where it never answers and
 // the deploy times out — measured live on project 43 (task 1004483). It cannot see through
 // `npm start`, so the scaffold no longer puts the hall there: it is `npm run hall`, and
-// `npm start` is left for the app (task 1004484, scripts/gds/init.js).
+// `npm start` is left for the app (task 1004484, scripts/bongos/init.js).
 const HALL_COMMAND_RE = /platform-server\.js|node_modules[\\/]@bongos[\\/]core/i;
 const HALL_REFUSAL = 'That command starts the project’s Builders’ hall, which we already host — not your app. Give the command that starts your app.';
 function badRequest(body) {

package/modules/provisioning/repo-private.js

@@ -4,7 +4,7 @@
 // A project stood up with a public repository reads its code with the platform's shared
 // key, which cannot read a private one — so the flip must wait until the project has its
 // own read-only deploy key. That wiring needs the box and the owner's stored credential, so
-// the web tier only enqueues; scripts/gds/provision-repo-private.js is the runner leg that
+// the web tier only enqueues; scripts/bongos/provision-repo-private.js is the runner leg that
 // wires the key and THEN flips.
 //
 // Its own file because provisioning.js sits at the size ratchet. It reaches the queue

package/modules/provisioning/routes/callback-page.js

@@ -5,7 +5,7 @@
 // github-app/callback` in routes/provisioning.js — and it is ~135 lines of escaper,
 // palette, stylesheet, client script and template with no request, DB or auth logic
 // in it. Carrying it inside the route file pushed that file onto the 1500-line
-// OVERSIZE_LINES fitness ratchet (scripts/gds/fitness-ratchets.js), where the next
+// OVERSIZE_LINES fitness ratchet (scripts/bongos/fitness-ratchets.js), where the next
 // single added line failed `unit` and the only obvious escape — raising the baseline
 // — is the one thing the ratchet forbids (ADR 0243 §4/§5 for the argument that put
 // it there). Moved here verbatim so the route file has room to change again.

package/modules/provisioning/routes/core-upgrade.js

@@ -71,6 +71,25 @@ function contributeCoreDesk() {
 const notThisProjectsRelease = (req) => req.coreUpgradeAuthority === 'owner';
 const notADecision = (req) => notThisProjectsRelease(req) || (!!req.body && req.body.dry_run === true);
 
+// Would the move route let THIS viewer press Move (task 1004829)? Both previews are
+// gated by the move's own doors, so what is left is its last check: the release
+// building's act-alone rule, skipped where the move skips it (the project's owner).
+// The deploy page draws its "Move to X?" card only on true. An unreadable rule is
+// false, as the move would refuse; no government port at all passes, as the
+// requireActAlone gate does.
+async function viewerMayMove(req) {
+  if (notThisProjectsRelease(req)) return true;
+  try {
+    const government = api.resolveOptional('government');
+    if (!government || typeof government.checkActAlone !== 'function') return true;
+    const out = await government.checkActAlone('release', req.builder && req.builder.id);
+    return !!(out && out.ok === true);
+  } catch (err) {
+    log.error(`core-upgrade: act-alone read failed — no move offered: ${err && err.message}`);
+    return false;
+  }
+}
+
 module.exports = function buildCoreUpgradeRouter() {
   contributeCoreDesk();
   const router = express.Router();
@@ -98,7 +117,7 @@ module.exports = function buildCoreUpgradeRouter() {
   // channel policy admits it. Both need the registry, and the only tool that reads
   // it (update-channel.js `listAvailableVersions`) shells out synchronously — it
   // would block the event loop for every other request on this process. It also
-  // lives in scripts/gds/, which a module may not require (ADR 0083). The runner
+  // lives in scripts/bongos/, which a module may not require (ADR 0083). The runner
   // enforces both, where it is a CLI and both are free. See ../core-upgrade.js.
   router.post(
     '/provisioning/instances/:id/core-upgrade',
@@ -126,7 +145,7 @@ module.exports = function buildCoreUpgradeRouter() {
     '/provisioning/instances/:id/core-upgrade',
     api.requireBuilder,
     requireOwnProjectOrPin({ pinGate: api.requirePermission('core.pin.move'), provisioning, pool: api.pool, log }),
-    makeCoreUpgradePreviewHandler({ provisioning, pool: api.pool, parseId: api.parseId, log }),
+    makeCoreUpgradePreviewHandler({ provisioning, pool: api.pool, parseId: api.parseId, log, mayMove: viewerMayMove }),
   );
 
   // POST /provisioning/instances/:id/update-channel — set the project's update rule
@@ -158,10 +177,11 @@ module.exports = function buildCoreUpgradeRouter() {
     '/provisioning/control-plane',
     api.requireBuilder,
     api.requirePermission('core.pin.move'),
-    makeControlPlaneHandler({ provisioning, pool: api.pool, log }),
+    makeControlPlaneHandler({ provisioning, pool: api.pool, log, mayMove: viewerMayMove }),
   );
 
   return router;
 };
 
 module.exports.coreDeskRows = coreDeskRows;
+module.exports.viewerMayMove = viewerMayMove;

package/modules/provisioning/routes/provisioning.js

@@ -5,7 +5,7 @@
 // THE TRUST BOUNDARY (ADR 0111 §2 / ADR 0016). The
 // internet-facing web process NEVER calls a cloud API and holds NO provider tokens.
 // A mutation route only ENQUEUES an intent (provision | teardown) into
-// provisioning_intents and returns; the control-plane runner (scripts/gds/
+// provisioning_intents and returns; the control-plane runner (scripts/bongos/
 // provision.js, task P3) is the sole token-holder that drains the queue and does
 // the real infra work. A stolen builder token can never spin up or tear down
 // infrastructure — it can only ask.
@@ -1308,7 +1308,7 @@ module.exports = function provisioningRoutes() {
   // onboarding step sequence (task 2085; goal 35 / criterion 165: "the canonical step
   // sequence is the source of truth; skill/CLI/hall are forms over it"). The hub's
   // ?view=new wizard fetches it so its human-steps checklist can't drift
-  // from the CLI's (scripts/gds/onboard.js reads the same
+  // from the CLI's (scripts/bongos/onboard.js reads the same
   // modules/provisioning/onboard-plan.js). `domain` relabels the terminal enter-hall
   // step with the instance's own hall address (task 1002703); a non-hostname is dropped
   // — clients render these labels, so unvalidated input must never be echoed back.

package/modules/provisioning/routes/render-standup.js

@@ -5,7 +5,7 @@
 // a service they already run for this repository (adopt) or create a new one for their app
 // (greenfield: how it is built and started, and whether it needs a database — task 1004350). This route checks
 // the shape, encrypts the key with the secret box, and queues a `render-standup` intent;
-// the runner (scripts/gds/provision-render.js) spends the key in one drain and clears it.
+// the runner (scripts/bongos/provision-render.js) spends the key in one drain and clears it.
 // This process never calls Render (ADR 0111 §2).
 //
 // What the encryption buys, said plainly: protection from a database dump or a backup

package/modules/provisioning/routes/repo-private.js

@@ -3,7 +3,7 @@
 //
 // WHY. A project stood up while its repository was public reads its code with the shared key,
 // which cannot read a private repository, so a plain flip would break its next deploy. This
-// route only ENQUEUES the `repo-private` intent; the runner (scripts/gds/provision-repo-private.js)
+// route only ENQUEUES the `repo-private` intent; the runner (scripts/bongos/provision-repo-private.js)
 // wires the project's own read-only deploy key FIRST and flips SECOND. Going public stays the
 // direct core call (POST /github/repo/visibility) — it needs no wiring.
 //

package/modules/provisioning/soft-limits.js

@@ -53,7 +53,7 @@ const SOFT_LIMIT_RULES = Object.freeze([
   }),
   Object.freeze({
     id: 'equity-needs-a-company',
-    when: { entity: { in: ['intent-company', 'intent-nonprofit', 'intent-solo', 'intent-unsure', 'university-project', 'social-group', 'private-individual'] } },
+    when: { entity: { in: ['intent-company', 'intent-nonprofit', 'intent-solo', 'intent-unsure', 'intent-group', 'university-project', 'social-group', 'private-individual'] } },
     options: ['reward_intents:equity'],
     effect: 'grey',
     reason: 'Equity is off until you form a company — there are no shares to give yet.',

package/modules/provisioning/starter-bundles.js

@@ -76,8 +76,10 @@ const ALWAYS_ON_CORE = Object.freeze([
 // own npm package is a later, deliberate removal from this list — with picker copy.
 // `render-deploy` (task 1004270) is the deploy page of a project whose app deploys through
 // Render: it is turned on by the connect-Render step, never chosen in this picker, so it is
-// kept out of the opt-in catalog by the same list.
-const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release', 'render-deploy']);
+// kept out of the opt-in catalog by the same list. `raise` (task 1004847) is the hub's own
+// investor page: its copy is Cloud Bongos's raise, so offering it to a new project would hand
+// that project someone else's fundraise (task 1004852).
+const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release', 'render-deploy', 'raise']);
 
 // The OPT-IN catalog as the creation picker renders it (BV1.R20, task 1002339):
 // every module an owner may actually choose, in the order the picker lists them,

package/modules/provisioning/tests/provisioning.mjs

@@ -4,7 +4,7 @@
 // the P4 (#1945) Caddy on-demand-TLS ALLOW-LIST helpers — normalizeHostname (pure)
 // and isProvisionedHostname (a fake { query }) — plus a sanity check of the P1 pure
 // helpers. No DB, no network: `db` is a recording fake. Auto-discovered + run by
-// scripts/gds/run-unit-tests.js when the `provisioning` module is enabled (it is on
+// scripts/bongos/run-unit-tests.js when the `provisioning` module is enabled (it is on
 // OTB). Run standalone: node modules/provisioning/tests/provisioning.mjs
 
 import { strict as assert } from 'node:assert';