@bongos/core 1.21.175 → 1.21.177

package/scripts/security/dep-audit.js

@@ -1,41 +1,33 @@
 #!/usr/bin/env node
-// Dependency vulnerability scan — single source of truth for both CI and the
-// droplet nightly cron (V3.R37 / #258).
+// Dependency vulnerability scan — single source of truth for the CLI and the
+// server's daily check (V3.R37 / #258; in-process since task 1004878).
 //
-// Two scans are run, in order:
-//   1. `npm audit --audit-level=high --json` against the root package.json.
-//   2. `python3 -m pip_audit -r art/pipeline/requirements.txt --format json`.
+// One scan: `npm audit --audit-level=high --json` against the root package.json.
+// (A second scan, pip-audit over art/pipeline/requirements.txt, went with the art
+// pipeline it audited — task 1004860 deleted that pipeline, task 1004878 the scan.)
 //
-// The script parses both outputs and emits ONE deterministic JSON report on
-// stdout containing every high/critical finding. A short, builder-readable
-// summary goes to stderr so a CI log is skim-able.
+// The script parses the output and emits ONE deterministic JSON report on stdout
+// containing every high/critical finding. A short, builder-readable summary goes
+// to stderr so a log is skim-able.
 //
 // Two modes:
 //
-//   --report-mode=ci         (default; used by .github/workflows/dep-audit.yml)
-//                            exit 1 if ANY finding is high or critical.
-//                            exit 0 if both scans clean.
+//   --report-mode=ci         (default) exit 1 if ANY finding is high or critical,
+//                            exit 0 if the scan is clean, exit 2 if npm is missing.
 //
-//   --report-mode=nightly    (used by .claude/scheduled-tasks/dep-audit-nightly)
-//                            ALWAYS exit 0 — a nightly cron must not block the
-//                            droplet's other routines. The skill consumes the
-//                            JSON, posts to the team chat-inbox, and creates a
-//                            vulnerability_report row in the Archon security
-//                            view via src/bongos/security.js.
+//   --report-mode=nightly    ALWAYS exit 0 — the report is the product.
 //
-// Tool resolution:
-//   - npm is required (CI image has it; droplet has it).
-//   - pip-audit is resolved as `python3 -m pip_audit` (works whether installed
-//     via pip, pipx, or pip --user — module form is the most portable).
-//     If neither is found, the script reports `tool_missing: pip-audit` and the
-//     mode decides whether to fail.
+// WHERE IT RUNS ON A SCHEDULE. Nowhere through this CLI: the always-on server runs
+// the same scan daily in-process (modules/autonomy/pollers/daily-checks.js), with an
+// ASYNC spawn — spawnSync here would freeze every request for the whole scan — and
+// hands the output to parseNpmAudit below, so the two cannot disagree about what a
+// finding is.
 //
 // Output schema (stdout, always valid JSON, even on failure):
 //   {
 //     "ran_at": "<ISO timestamp>",
 //     "mode": "ci" | "nightly",
 //     "npm": { "ok": true|false, "tool_missing": false|true, "findings": [...] },
-//     "pip": { "ok": true|false, "tool_missing": false|true, "findings": [...] },
 //     "high_or_critical_count": <int>,
 //     "exit_code": <int>
 //   }
@@ -46,10 +38,8 @@
 
 const { spawnSync } = require('node:child_process');
 const path = require('node:path');
-const fs = require('node:fs');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
-const PIP_REQUIREMENTS = path.join(REPO_ROOT, 'art', 'pipeline', 'requirements.txt');
 
 // CLI args ----------------------------------------------------------------
 
@@ -77,33 +67,47 @@ function printHelp() {
 
 // npm audit ---------------------------------------------------------------
 
-// npm audit emits a JSON document. `--audit-level=high` controls the EXIT CODE
-// only — the JSON still contains every level. We parse the full set, then we
-// filter to high+critical ourselves so the threshold is consistent across both
-// scanners.
-function runNpmAudit() {
-  const res = spawnSync('npm', ['audit', '--audit-level=high', '--json'], {
-    cwd: REPO_ROOT,
+// The npm invocation, shared with the server's async spawn. `--audit-level=high`
+// controls the EXIT CODE only — the JSON still contains every level, and
+// extractNpmFindings filters to high+critical itself.
+const NPM_AUDIT_ARGS = ['audit', '--audit-level=high', '--json'];
+
+function runNpmAudit({ cwd = REPO_ROOT } = {}) {
+  const res = spawnSync('npm', NPM_AUDIT_ARGS, {
+    cwd,
     encoding: 'utf8',
     maxBuffer: 32 * 1024 * 1024,
   });
-  // npm audit exits 1 when findings >= the threshold, 0 otherwise. Both cases
-  // still produce JSON on stdout. We don't trust the exit code; we read the
-  // JSON and decide for ourselves.
   if (res.error) {
     return { ok: false, tool_missing: true, findings: [], raw_error: String(res.error.message || res.error) };
   }
+  return parseNpmAudit(res.stdout, res.stderr);
+}
+
+// parseNpmAudit — npm audit's raw output → { ok, tool_missing, findings }. Pure.
+// npm audit exits 1 when findings >= the threshold, 0 otherwise, and both cases
+// still produce JSON on stdout — so the exit code is never read; the JSON decides.
+function parseNpmAudit(stdout, stderr = '') {
   let parsed;
   try {
-    parsed = JSON.parse(res.stdout || '{}');
+    parsed = JSON.parse(stdout || '{}');
   } catch (e) {
     return {
       ok: false, tool_missing: false, findings: [],
-      raw_error: `npm audit JSON parse failed: ${e.message}; stderr=${res.stderr.slice(0, 500)}`,
+      raw_error: `npm audit JSON parse failed: ${e.message}; stderr=${String(stderr || '').slice(0, 500)}`,
     };
   }
-  const findings = extractNpmFindings(parsed);
-  return { ok: true, tool_missing: false, findings };
+  // npm reports its own failures (no lockfile, registry unreachable) as JSON with
+  // an `error` object and no vulnerabilities. That is "could not audit", never a
+  // clean bill of health.
+  if (parsed && parsed.error && !parsed.vulnerabilities) {
+    const e = parsed.error;
+    return {
+      ok: false, tool_missing: false, findings: [],
+      raw_error: `npm audit failed: ${(e && (e.summary || e.code)) || 'unknown error'}`,
+    };
+  }
+  return { ok: true, tool_missing: false, findings: extractNpmFindings(parsed) };
 }
 
 // npm audit v7+ JSON shape: `vulnerabilities` is an object keyed by package
@@ -143,81 +147,6 @@ function extractNpmFindings(parsed) {
   return out;
 }
 
-// pip-audit ---------------------------------------------------------------
-
-function runPipAudit() {
-  if (!fs.existsSync(PIP_REQUIREMENTS)) {
-    return {
-      ok: false, tool_missing: false, findings: [],
-      raw_error: `requirements file not found: ${PIP_REQUIREMENTS}`,
-    };
-  }
-  const res = spawnSync('python3', [
-    '-m', 'pip_audit',
-    '-r', PIP_REQUIREMENTS,
-    '--format', 'json',
-    '--vulnerability-service', 'pypi',
-  ], {
-    cwd: REPO_ROOT,
-    encoding: 'utf8',
-    maxBuffer: 32 * 1024 * 1024,
-  });
-  if (res.error) {
-    return { ok: false, tool_missing: true, findings: [], raw_error: String(res.error.message || res.error) };
-  }
-  if (res.status !== 0 && res.status !== 1) {
-    // pip-audit exits 0 on clean, 1 on findings. Anything else (missing module,
-    // bad requirements file) is a tool problem.
-    const stderr = (res.stderr || '').slice(0, 1000);
-    const missing = /No module named ['"]?pip_audit/.test(stderr);
-    return {
-      ok: false, tool_missing: missing, findings: [],
-      raw_error: `pip-audit exit=${res.status}; stderr=${stderr}`,
-    };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(res.stdout || '{}');
-  } catch (e) {
-    return {
-      ok: false, tool_missing: false, findings: [],
-      raw_error: `pip-audit JSON parse failed: ${e.message}; stderr=${res.stderr.slice(0, 500)}`,
-    };
-  }
-  const findings = extractPipFindings(parsed);
-  return { ok: true, tool_missing: false, findings };
-}
-
-// pip-audit JSON shape: { "dependencies": [ { "name", "version",
-// "vulns": [ { "id", "fix_versions": [], "description", "aliases": [] } ] } ] }
-// pip-audit does NOT classify severity itself — PyPI/OSV advisories carry it
-// in `aliases` (CVE IDs) plus a `description` field. To stay conservative, we
-// treat EVERY pip-audit finding as high — by the time PyPI's advisory DB has
-// picked it up, the project's posture is "fix or document." This is the same
-// stance the GitHub `pip-audit-action` takes by default.
-function extractPipFindings(parsed) {
-  const out = [];
-  const deps = (parsed && parsed.dependencies) || [];
-  for (const dep of deps) {
-    const vulns = Array.isArray(dep.vulns) ? dep.vulns : [];
-    for (const v of vulns) {
-      out.push({
-        ecosystem: 'pypi',
-        package: dep.name,
-        version: dep.version,
-        severity: 'high', // see note above
-        id: v.id || (Array.isArray(v.aliases) && v.aliases[0]) || null,
-        summary: (v.description || '').split('\n')[0].slice(0, 240) || `${dep.name} ${dep.version}: ${v.id}`,
-        fix: Array.isArray(v.fix_versions) && v.fix_versions.length
-          ? `upgrade to ${v.fix_versions.join(' / ')}`
-          : 'no fix available',
-        url: v.id ? `https://osv.dev/vulnerability/${v.id}` : null,
-      });
-    }
-  }
-  return out;
-}
-
 // Main --------------------------------------------------------------------
 
 function main() {
@@ -226,14 +155,13 @@ function main() {
 
   const ranAt = new Date().toISOString();
   const npm = runNpmAudit();
-  const pip = runPipAudit();
 
-  const allFindings = [...npm.findings, ...pip.findings];
+  const allFindings = npm.findings;
   const highCount = allFindings.filter(f => f.severity === 'high' || f.severity === 'critical').length;
 
   // CI mode: a tool being entirely missing in a CI environment is a build
   // problem, not a security problem — fail loudly so we don't ship blind.
-  const toolProblem = (npm.tool_missing || pip.tool_missing) && args.mode === 'ci';
+  const toolProblem = npm.tool_missing && args.mode === 'ci';
 
   let exitCode = 0;
   if (toolProblem) exitCode = 2;
@@ -244,7 +172,6 @@ function main() {
     ran_at: ranAt,
     mode: args.mode,
     npm,
-    pip,
     high_or_critical_count: highCount,
     findings: allFindings,
     exit_code: exitCode,
@@ -253,8 +180,7 @@ function main() {
   // Human summary to stderr.
   const lines = [];
   lines.push(`dep-audit [${args.mode}] @ ${ranAt}`);
-  lines.push(`  npm:       ${npm.tool_missing ? 'TOOL MISSING' : (npm.ok ? `${npm.findings.length} high/critical` : `ERROR — ${npm.raw_error}`)}`);
-  lines.push(`  pip-audit: ${pip.tool_missing ? 'TOOL MISSING' : (pip.ok ? `${pip.findings.length} high/critical` : `ERROR — ${pip.raw_error}`)}`);
+  lines.push(`  npm: ${npm.tool_missing ? 'TOOL MISSING' : (npm.ok ? `${npm.findings.length} high/critical` : `ERROR — ${npm.raw_error}`)}`);
   if (allFindings.length) {
     lines.push(`  findings:`);
     for (const f of allFindings) {
@@ -271,6 +197,6 @@ function main() {
 
 if (require.main === module) main();
 
-// Exported for unit testing / for the nightly skill if it ever wants to drive
-// the scan in-process instead of via spawn.
-module.exports = { runNpmAudit, runPipAudit, extractNpmFindings, extractPipFindings };
+// Exported for unit testing and for the server's in-process daily check, which
+// spawns NPM_AUDIT_ARGS itself (asynchronously) and parses with parseNpmAudit.
+module.exports = { runNpmAudit, parseNpmAudit, extractNpmFindings, NPM_AUDIT_ARGS };

package/scripts/setup-builder.js

@@ -17,7 +17,7 @@
 //   2. `npm ci` to install JS dependencies.
 //   3. Copy .env.local.example -> .env.local (if absent) + optionally prompt
 //      for the Google AI Studio key (--skip-keys / non-TTY takes placeholders).
-//   4. `node scripts/gds/setup.js` — GitHub Device Flow auth (--no-auth skips).
+//   4. `node scripts/bongos/setup.js` — GitHub Device Flow auth (--no-auth skips).
 //   5. Print the "ready" banner pointing at /builder-start.
 //
 // Audience: a brand-new builder with nothing else configured. Every error
@@ -226,22 +226,22 @@ function gdsAuth() {
   step('4/5  GDS session (GitHub Device Flow)');
   if (NO_AUTH) {
     skip('--no-auth set; skipping GDS Device Flow');
-    console.log('    Authenticate on first connect with:  node scripts/gds/setup.js   (or /builder-setup)');
+    console.log('    Authenticate on first connect with:  node scripts/bongos/setup.js   (or /builder-setup)');
     return;
   }
   // setup.js is idempotent (pre-flights GET /me, short-circuits if still valid).
   // process.execPath (not bare 'node') resolves on Windows cmd.exe regardless of PATH.
-  console.log('  Handing off to scripts/gds/setup.js ...');
+  console.log('  Handing off to scripts/bongos/setup.js ...');
   console.log('');
-  const setupArgs = [path.join(REPO_ROOT, 'scripts', 'gds', 'setup.js')];
+  const setupArgs = [path.join(REPO_ROOT, 'scripts', 'bongos', 'setup.js')];
   if (SKIP_KEYS) setupArgs.push('--skip-keys');
   const status = run(process.execPath, setupArgs); // shell defaults off
   if (status === 0) {
     ok('GDS session ready');
   } else {
-    fail(`scripts/gds/setup.js exited with status ${status}`);
-    console.error('  Re-run just this step with:  node scripts/gds/setup.js --force');
-    console.error('  Or run the doctor:           node scripts/gds/doctor.js');
+    fail(`scripts/bongos/setup.js exited with status ${status}`);
+    console.error('  Re-run just this step with:  node scripts/bongos/setup.js --force');
+    console.error('  Or run the doctor:           node scripts/bongos/doctor.js');
     process.exit(status || 1);
   }
 }

package/src/bongos/api-errors.js

@@ -88,6 +88,7 @@ const OVERRIDES = Object.freeze({
   bfg_cannot_write_self: 'forbidden',
   bfg_write_disabled: 'forbidden',
   target_is_system_principal: 'forbidden',
+  cannot_change_own_tester: 'forbidden',
   self_vote_forbidden: 'forbidden',
   self_dep: 'conflict',
   newcomer_must_ship_first: 'forbidden',

package/src/bongos/api-prefix.js

@@ -4,7 +4,7 @@
 // Introduced in task 1918 (BONGOS-V1) as the "chokepoint" the API surface was
 // missing: the prefix used to be a bare '/api/gds' literal duplicated in ~1,158
 // places. Everything that needs to know the canonical API base — the OpenAPI
-// generator (scripts/gds/gen-api-docs.js), the machine-discovery endpoint, and
+// generator (scripts/bongos/gen-api-docs.js), the machine-discovery endpoint, and
 // the served docs site — reads it from here.
 //
 // The URL rename (Part B / B1, task 1919) flipped the canonical here: the API is

package/src/bongos/auth-github.js

@@ -210,6 +210,12 @@ async function pollDeviceFlow(deviceCode, userAgent) {
       avatarUrl: ghUser.avatar_url,
     });
     builder = await maybeSeatFirstAdmin(builder);
+    // Same refusal as completeWebFlow: an offboarded builder gets no session.
+    if (builder.status === 'inactive') {
+      const err = new Error('builder_inactive');
+      err.code = 'BUILDER_INACTIVE';
+      throw err;
+    }
     await safeSyncRankRole(builder); // BV1.R95b — the seeded rank-role must exist from the first sign-in
     const token = newSessionToken();
     await createSession({
@@ -297,6 +303,16 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
     avatarUrl: ghUser.avatar_url,
   });
   builder = await maybeSeatFirstAdmin(builder);
+  // An offboarded builder still passes the gate above (it admits every existing
+  // row), but requireBuilder 403s every request their session would make — so
+  // minting one only signed them in to a blank hall. Refuse here instead, and
+  // let the callback say why.
+  if (builder.status === 'inactive') {
+    const err = new Error('builder_inactive');
+    err.code = 'BUILDER_INACTIVE';
+    err.login = ghUser.login;
+    throw err;
+  }
   await safeSyncRankRole(builder); // BV1.R95b — the seeded rank-role must exist from the first sign-in
   const token = newSessionToken();
   // Web sessions expire after 30 days; the user re-auths on the page
@@ -316,9 +332,9 @@ async function completeWebFlow({ code, redirectUri, userAgent, captureRepoToken
   // callback can persist it (encrypted, short-TTL) for the repo picker/creator.
   // auth.js stays kernel-clean — it never writes the token to the DB itself; the
   // token is surfaced ONLY on this opt-in path, so an ordinary hall sign-in never
-  // even returns it. Never for an offboarded builder: the gate admits every existing
-  // row, and this would re-seed the token deactivateBuilder deleted (ADR 0332, task 1004245).
-  const captured = captureRepoToken && builder.status !== 'inactive'
+  // even returns it. An offboarded builder never reaches here (refused above), so the
+  // token deactivateBuilder deleted is never re-seeded (ADR 0332, task 1004245).
+  const captured = captureRepoToken
     ? { githubToken: accessToken, githubScope: grantedScope } : {};
   return { token, builder, expiresAt, ...captured };
 }

package/src/bongos/auth-idp.js

@@ -102,6 +102,13 @@ async function completeIdpFlow({ code, redirectUri, userAgent: ua }) {
     avatarUrl: identity.avatar_url,
   });
   builder = await maybeSeatFirstAdmin(builder);
+  // Same refusal as completeWebFlow: an offboarded builder gets no session.
+  if (builder.status === 'inactive') {
+    const err = new Error('builder_inactive');
+    err.code = 'BUILDER_INACTIVE';
+    err.login = ghLogin;
+    throw err;
+  }
   await safeSyncRankRole(builder); // BV1.R95b — the seeded rank-role must exist from the first sign-in
   const token = newSessionToken();
   const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);

package/src/bongos/claim-attribution.js

@@ -2,7 +2,7 @@
 // src/bongos/claim-attribution.js — which of a builder's open claims does THIS
 // working tree belong to? (task 1003837)
 //
-// WHY. Two things answer that question — `scripts/gds/conductor-dispatch.js`,
+// WHY. Two things answer that question — `scripts/bongos/conductor-dispatch.js`,
 // which briefs a reviewer on the claim a diff belongs to, and
 // `.claude/hooks/conductor.js`, which measures "changed files outside your
 // claim's declared touches[]" on every prompt. They must not answer it
@@ -38,7 +38,7 @@ function claimForWorktree(claims, worktreeName) {
 // `path.basename` is the platform's: on POSIX it splits only on `/`, so a
 // Windows path arrives back whole — `C:\…\task-1003837` would BE the worktree
 // name, matching nothing. This repo keeps finding that same defect (task
-// 1003821 was two CI-invisible instances of it), and `scripts/gds/worktree.js`
+// 1003821 was two CI-invisible instances of it), and `scripts/bongos/worktree.js`
 // already normalizes backslashes first for exactly this reason.
 function worktreeNameFor(dir) {
   const d = String(dir || '').trim().replace(/\\/g, '/').replace(/\/+$/, '');

package/src/bongos/core-moves.js

@@ -27,7 +27,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { notesBetween, RELEASE_NOTES_FILE } = require('../../scripts/gds/release-notes.js');
+const { notesBetween, RELEASE_NOTES_FILE } = require('../../scripts/bongos/release-notes.js');
 
 const VERSION_RE = /^\d{1,4}\.\d{1,5}\.\d{1,6}$/;
 const ROLLED_BACK_RE = /^rolled_back:/;

package/src/bongos/core-update.js

@@ -22,7 +22,7 @@
 // than a wrong one.
 //
 // THE CHANNEL RULE IS NOT RESTATED HERE. `resolveChannelTarget` is the runner's
-// OWN function (scripts/gds/update-channel.js) and is imported, not copied: the
+// OWN function (scripts/bongos/update-channel.js) and is imported, not copied: the
 // banner must never offer a version the runner would then refuse, and ADR 0280
 // is the record of what a second copy of this contract costs when it drifts.
 //
@@ -39,7 +39,7 @@ const {
   normalizeChannel,
   resolveChannelTarget,
   versionsForFollow,
-} = require('../../scripts/gds/update-channel.js');
+} = require('../../scripts/bongos/update-channel.js');
 
 const REGISTRY_ORIGIN = 'https://registry.npmjs.org';
 // Six hours. The core publishes many times a day, but a banner is not a deploy
@@ -156,7 +156,7 @@ async function readCoreUpdate({ running, channel, get, ...deps } = {}) {
 // readCoreUpgrades — the instance's own core-upgrade ledger, newest first: when the
 // core pin last moved, from which version to which, and who or what moved it (task
 // 1002669). `core_upgrades` is written by `bongos upgrade` on every successful move and
-// rollback (scripts/gds/upgrade.js), including the unattended patch sweep's, and no
+// rollback (scripts/bongos/upgrade.js), including the unattended patch sweep's, and no
 // route read it — so "when did the pin last move" needed an SSH session. The pool is
 // injectable so the test runs with no database; the default is the instance's own.
 async function readCoreUpgrades({ limit = 20, pool = null } = {}) {

package/src/bongos/craft-mode.js

@@ -1,7 +1,7 @@
 // src/bongos/craft-mode.js — a claimed task's craft, as the pointer a session
 // follows to its playbook (task 1002992).
 //
-// WHY. The role registry (scripts/gds/discipline-modes.json) says which role
+// WHY. The role registry (scripts/bongos/discipline-modes.json) says which role
 // pack or skill each craft works from. claim.js used to PRINT that as a directive
 // block, which reaches the session only if someone reads the claim scroll by —
 // and a role pack skipped that way is invisible. This turns an entry into the same
@@ -22,7 +22,7 @@ const path = require('path');
 const { resolveCoreRoot } = require('../instance-config');
 
 function registryPath() {
-  return path.join(resolveCoreRoot(), 'scripts', 'gds', 'discipline-modes.json');
+  return path.join(resolveCoreRoot(), 'scripts', 'bongos', 'discipline-modes.json');
 }
 
 // The `modes` map, or {} for a missing / unparsable file.

package/src/bongos/db-kernel.js

@@ -83,12 +83,16 @@ async function getFoundingBuilder() {
 // onboarding/stale-claim/box/audit data (that stays behind GET /builders/roster,
 // Archon-only); id/login/name/avatar/rank is no more sensitive than what
 // GET /leaderboard already exposes publicly, just without the credits cutoff.
-async function listActiveBuilders() {
+// Accounts tagged is_tester (migration core_278) stay out unless the caller is a
+// management read that has to see them to untag them (includeTesters).
+async function listActiveBuilders({ includeTesters = false } = {}) {
   const { rows } = await pool.query(
     `SELECT id, github_login, display_name, avatar_url, rank
        FROM builders
       WHERE status = 'active'
-      ORDER BY COALESCE(display_name, github_login)`
+        AND (is_tester = false OR $1::boolean)
+      ORDER BY COALESCE(display_name, github_login)`,
+    [includeTesters]
   );
   return rows;
 }
@@ -280,6 +284,12 @@ async function accessStateByLogin(login) {
 // code agree on one number.
 const SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
 
+// SESSION_IDLE_LIMIT_MS — a session of any source, CLI included, that has not
+// been used for this long is dead (ADR 0383, superseding ADR 0294's "CLI
+// sessions never expire"). Measured on last_used_at, so a session in use never
+// hits it; the own-sessions list hides the same rows.
+const SESSION_IDLE_LIMIT_MS = 10 * 24 * 60 * 60 * 1000; // 10 days
+
 // sessionTokenHash — the ONE place a bearer becomes the value this table stores
 // (task 1003372, audit A1, migration core_249). SHA-256 hex, matching the
 // migration's `encode(sha256(token::bytea), 'hex')` byte for byte, so a row
@@ -376,7 +386,7 @@ function sessionPermsSelect() {
 async function lookupSession(token) {
   if (!token) return null;
   const { rows } = await pool.query(
-    `SELECT s.id AS session_id, s.builder_id, s.expires_at, s.revoked_at, s.source,
+    `SELECT s.id AS session_id, s.builder_id, s.expires_at, s.revoked_at, s.source, s.last_used_at,
             b.github_id, b.github_login, b.display_name, b.avatar_url, b.total_credits,
             b.rank, b.status, b.system_role, b.anthropic_user_id${sessionPermsSelect()}
        FROM builder_sessions s
@@ -388,6 +398,7 @@ async function lookupSession(token) {
   if (!row) return null;
   if (row.revoked_at) return null;
   if (row.expires_at && row.expires_at < new Date()) return null;
+  if (row.last_used_at && Date.now() - new Date(row.last_used_at).getTime() > SESSION_IDLE_LIMIT_MS) return null;
   // Refresh-on-use. last_used_at always moves — the own-sessions list (ADR 0206)
   // is how a person spots a session they don't recognise, and that reading is the
   // whole remedy now that CLI rows never lapse. expires_at only rolls forward for
@@ -422,6 +433,7 @@ module.exports = {
   RANK_TIER,
   RANKS,
   SESSION_TTL_MS,
+  SESSION_IDLE_LIMIT_MS,
   upsertBuilder,
   seatFirstAdminIfUnclaimed,
   archonExists,

package/src/bongos/db.js

@@ -41,7 +41,7 @@ const {
   // Auth/identity/admission + the rank vocabulary carved to db-kernel (ADR 0102,
   // finishing ADR 0091 §1). Re-exported below so db.js's other importers + its own
   // internal uses (setBuilderRank's RANKS.indexOf, etc.) stay byte-identical.
-  RANKS, SESSION_TTL_MS, upsertBuilder, seatFirstAdminIfUnclaimed,
+  RANKS, SESSION_TTL_MS, SESSION_IDLE_LIMIT_MS, upsertBuilder, seatFirstAdminIfUnclaimed,
   getBuilderByGithubId, hasInvitedAccessRequest, createSession, lookupSession,
   // The bearer → stored-value transform (task 1003372, core_249). revokeSession
   // below is the one helper here still handed a raw bearer rather than an id.
@@ -115,7 +115,7 @@ async function linkAnthropicAccount(builderId, { email, userId }) {
 
 // recordAutonomyRun() + lastAutonomyHead() (the autonomy_runs slice) carved into
 // modules/autonomy/db.js (BV1.R83 / ADR 0093 §1). The MAS autonomy gate
-// (scripts/gds/autonomy-gate.js, a CLI) reads them directly from the module; core
+// (scripts/bongos/autonomy-gate.js, a CLI) reads them directly from the module; core
 // never calls them. The autonomy_runs TABLE (migration 126) stays in core
 // migrations/ (the shared-schema additive rule).
 
@@ -666,6 +666,28 @@ async function deactivateBuilder({ builderId, reason, actorBuilderId }) {
 }
 
 
+// setBuilderTester — mark or unmark a builder account as a tester (migration core_278,
+// task 1004845). A tester keeps its credits, history and sign-in; it only drops out of
+// the public leaderboard and the any-builder directory. Returns the updated row, or
+// null when no such builder exists; a machine principal throws TARGET_IS_SYSTEM_PRINCIPAL
+// and is never changed. The request audit middleware records the write.
+async function setBuilderTester({ builderId, isTester }) {
+  return withTx(async (client) => {
+    const { rows: found } = await client.query(
+      `SELECT id, system_role FROM builders WHERE id = $1 FOR UPDATE`,
+      [builderId]
+    );
+    if (!found[0]) return null;
+    if (found[0].system_role) throw { code: 'TARGET_IS_SYSTEM_PRINCIPAL' };
+    const { rows } = await client.query(
+      `UPDATE builders SET is_tester = $2 WHERE id = $1
+       RETURNING id, github_login, display_name, rank, status, is_tester`,
+      [builderId, !!isTester]
+    );
+    return rows[0];
+  });
+}
+
 async function reactivateBuilder({ builderId, actorBuilderId }) {
   return withTx(async (client) => {
     const { rows } = await client.query(
@@ -832,7 +854,9 @@ async function revokeAllSessionsForBuilder(builderId) {
 // account, newest-used first. Returns only what a person needs to RECOGNISE a
 // session — where it came from, when it was minted, when it was last used, what
 // client held it. The `token` column is deliberately never selected: a list that
-// returned tokens would turn one stolen session into all of them.
+// returned tokens would turn one stolen session into all of them. A session
+// idle past SESSION_IDLE_LIMIT_MS no longer authenticates (ADR 0383), so it is
+// left off the list too.
 
 async function listActiveSessionsForBuilder(builderId) {
   const { rows } = await pool.query(
@@ -841,8 +865,9 @@ async function listActiveSessionsForBuilder(builderId) {
       WHERE builder_id = $1
         AND revoked_at IS NULL
         AND (expires_at IS NULL OR expires_at > now())
+        AND last_used_at > now() - ($2::bigint * INTERVAL '1 millisecond')
       ORDER BY last_used_at DESC, id DESC`,
-    [builderId]
+    [builderId, SESSION_IDLE_LIMIT_MS]
   );
   return rows;
 }
@@ -1119,6 +1144,7 @@ module.exports = {
   getBuilderRoleChoices,
   RANKS,
   setBuilderRank,
+  setBuilderTester,
   getLatestRankChangeForBuilder,
   deactivateBuilder,
   reactivateBuilder,

package/src/bongos/github-repos.js

@@ -298,7 +298,7 @@ async function makeRepoPublic(token, ref = {}) {
 // Flip one repo PRIVATE. Only the control-plane runner may call this, and only AFTER
 // ensurePrivateRepoAccess has wired the project's own read-only deploy key: the
 // shared key cannot read a private repo, so flipping first breaks the next deploy
-// pull (walk finding N4, ADR 0176). scripts/gds/provision-repo-private.js is that
+// pull (walk finding N4, ADR 0176). scripts/bongos/provision-repo-private.js is that
 // caller (task 1004193); no web route calls it. Returns the same shape as getUserRepo.
 async function makeRepoPrivate(token, ref = {}) {
   return setRepoPrivate(token, ref, true);

package/src/bongos/llm-cache.js

@@ -29,7 +29,7 @@ const { pool } = require('./pool');
 // the pool is unreachable — so before this, every cache op silently degraded to
 // miss/no-store and the cache could never hit. Fix: keep the pool as the server
 // fast path; fall back to the GDS API when the pool is unavailable. The core
-// NEVER statically requires the CLI layer (scripts/gds/cli-lib.js) — that would
+// NEVER statically requires the CLI layer (scripts/bongos/cli-lib.js) — that would
 // drag session/fetch plumbing into the always-on server and cross the core↔host
 // boundary the fitness gate guards. Instead the consumer (which already imports
 // cli-lib) INJECTS apiCall via setApiFallback(). If it's never set, behaviour is

package/src/bongos/llm-pricing.js

@@ -6,7 +6,7 @@
 // only TOKEN counts. This module is the small, auditable table + pure function
 // that turns those tokens into dollars.
 //
-// Pure: no I/O, no Date.now(), no network. Imported by scripts/gds/session-cost.js
+// Pure: no I/O, no Date.now(), no network. Imported by scripts/bongos/session-cost.js
 // (and available as the grader's envelope-absent fallback). Unit-tested in
 // tests/llm-pricing.mjs.
 //

package/src/bongos/metrics.js

@@ -7,7 +7,7 @@
 // keeps package.json deps minimal, and the format is small + easy to test.
 //
 // CORE-SAFE: lives under src/bongos/ so it's held to the core↔host import boundary
-// (scripts/gds/fitness.js §1) — it imports only ./pool + ../build-info, nothing
+// (scripts/bongos/fitness.js §1) — it imports only ./pool + ../build-info, nothing
 // from the game runtime, so a non-game Cloud Bongos instance runs it unchanged.
 //
 // WHAT IT EXPOSES

package/src/bongos/middleware/rate-limit.js

@@ -20,7 +20,7 @@
 //                            unauthenticated /public/* surface (mounted there by
 //                            routes/public.js, NOT globally — the two write
 //                            limiters above bypass reads by design). It exists
-//                            because /public/uptime + /public/repo-health run
+//                            because /public/repo-health runs
 //                            multi-row 90-day aggregates on every uncached call,
 //                            so the surface is a DoS / cost-amplification target
 //                            (red-team #604 / task 1035). 120/min clears a legit
@@ -451,7 +451,7 @@ module.exports = {
   selfMeteredRoutes,
   DEFAULT_READ_LIMIT,
   DEFAULT_READ_MAX_TRACKED_IPS,
-  // exported for tests + the security-baseline-check script
+  // exported for tests
   PER_IP_WINDOW_MS,
   PER_IP_LIMIT,
   PER_SESSION_WINDOW_MS,