@bongos/core 1.21.175 → 1.21.177

package/src/bongos/module-listing.js

@@ -254,7 +254,99 @@ async function listCatalog({ db, floor = QUALITY_FLOOR, sort = null, maxPrice =
   return out;
 }
 
+// ---------------------------------------------------------------------------
+// Why a module is or is not listed (task 1003810, criterion wa5-curated-listing)
+// ---------------------------------------------------------------------------
+//
+// An author held out of the catalog must be able to see why, or they are silently
+// buried. "Below the bar" alone is not something they can act on, so the answer
+// names the reason in a sentence, says what would change it, and carries the same
+// parts reading the catalog shows (the weakest parts first). The reasons are
+// placeVersion's, plus two the catalog drops before it gets that far: `delisted`
+// and `no_version`. Being past the cap of ten per category is a reason of its own
+// once the cap exists (task 1003809); it is not one yet.
+function explainPlacement({ placement, reason }, { overall = null, floor = QUALITY_FLOOR, security = null, weaknesses = [] } = {}) {
+  const weakest = weaknesses.slice(0, 3).map((w) => `${w.title} (${w.score})`).join(', ');
+  const say = (why, nextStep) => ({ listed: placement !== 'excluded', placement, reason, why, next_step: nextStep });
+  switch (reason) {
+    case 'delisted':
+      return say('This module was taken out of the store by a Metic+ person. People who hold it keep it.',
+        'A delisted module takes no new versions and is not listed again.');
+    case 'no_version':
+      return say('This module has no published version the store can read.',
+        'Publish a version with `bongos module publish`.');
+    case 'not_assessed':
+      return say('This version has not been assessed yet. Every published version is checked automatically.',
+        'Wait for the check to finish. If it never does, a Metic+ person can run it again.');
+    case 'security_not_passed':
+      if (security && security.outcome === 'failed') {
+        return say(`This version failed the Security gate${security.reason ? `: ${security.reason}` : '.'} A version that fails it is never listed, whatever it scores.`,
+          'Fix what the Security gate found and publish a new version.');
+      }
+      return say('The Security gate has not finished for this version. Nothing is listed until it passes.',
+        'Wait for the check to finish. If it never does, a Metic+ person can run it again.');
+    case 'no_score':
+      return say('None of this version\'s parts could be scored yet, so it has no overall score to compare with the floor.',
+        'Add tests that run, and a how-to; installs and reliability are scored as projects use it.');
+    case 'below_floor':
+      return say(`This version scored ${overall} out of 100. The store lists modules that score at least ${floor}.${weakest ? ` Its weakest parts: ${weakest}.` : ''}`,
+        'Improve its weakest parts and publish a new version. The newest version is the one judged.');
+    case 'new':
+      return say('This version is listed with a New label. It is not ranked until it has real install and reliability data.',
+        'Nothing to do: it is ranked once projects have installed and used it.');
+    default:
+      return say(`This version is listed: it passed the Security gate and scored ${overall} out of 100, at or above the floor of ${floor}.`,
+        null);
+  }
+}
+
+// Where one module stands in the catalog, and why: null for a key the store does not
+// know, else { module_key, title, status, version, version_id, floor, overall,
+// listed, placement, reason, why, next_step, security, parts, strengths, weaknesses,
+// unmeasured }. Judges the same version the catalog does: the newest published one.
+// What the Security gate found is told only to the module's author (`viewerId`): to
+// anyone else it would point at a weakness the author has not fixed yet.
+async function readListing(key, { db, floor = QUALITY_FLOOR, viewerId = null } = {}) {
+  const pool = db || require('./pool').pool;
+  const { rows: mods } = await pool.query(
+    'SELECT module_key, title, status, author_id FROM store_modules WHERE module_key = $1', [key]);
+  const mod = mods[0];
+  if (!mod) return null;
+  const head = { module_key: mod.module_key, title: mod.title, status: mod.status, floor };
+  const { rows: versions } = await pool.query(
+    'SELECT module_key, id AS version_id, version, published_at FROM store_module_versions WHERE module_key = $1', [key]);
+  const newest = newestPerModule(versions)[0];
+  const empty = { security: null, ...readParts([], { floor }) };
+  if (mod.status === 'delisted' || !newest) {
+    const reason = mod.status === 'delisted' ? 'delisted' : 'no_version';
+    return { ...head, version: newest ? newest.version : null, version_id: newest ? newest.version_id : null, overall: null,
+      ...explainPlacement({ placement: 'excluded', reason }, { floor }), ...empty };
+  }
+  const { rows: scores } = await pool.query(
+    `SELECT DISTINCT ON (version_id) version_id, overall, security_passed, is_new
+       FROM module_assessment_scores
+      WHERE version_id = ANY($1)
+      ORDER BY version_id, computed_at DESC, id DESC`, [[newest.version_id]]);
+  const { rows: signals } = await pool.query(
+    `SELECT DISTINCT ON (version_id, part) version_id, part, outcome, score, sample_size, reason
+       FROM module_assessment_signals
+      WHERE version_id = ANY($1)
+      ORDER BY version_id, part, measured_at DESC, id DESC`, [[newest.version_id]]);
+  const score = scores[0] || null;
+  const sec = signals.find((s) => s.part === 'security');
+  const isAuthor = viewerId != null && String(mod.author_id) === String(viewerId);
+  const security = sec ? { outcome: sec.outcome, reason: (isAuthor && sec.reason) || null } : null;
+  const reading = readParts(signals, { floor });
+  const placed = placeVersion(score, floor);
+  const overall = score && placed.placement !== 'new' ? score.overall : null;
+  return {
+    ...head, version: newest.version, version_id: newest.version_id, overall,
+    ...explainPlacement(placed, { overall, floor, security, weaknesses: reading.weaknesses }),
+    security, ...reading,
+  };
+}
+
 module.exports = {
   QUALITY_FLOOR, STRONG_AT, SORT_PARTS, RANKING, placeVersion, readParts, sortByPart,
-  priceOf, withinMaxPrice, rankListed, listCatalog,
+  priceOf, withinMaxPrice, rankListed, listCatalog, explainPlacement, readListing,
 };

package/src/bongos/module-scope-map.js

@@ -12,7 +12,7 @@
 //   1. `protected` is DERIVED, never hand-set — a module is protected iff its
 //      globs overlap PROTECTED_GLOBS, the SINGLE source in permission-path-check.js.
 //   2. We IMPORT PROTECTED_GLOBS; we never re-declare it. A fitness check
-//      (scripts/gds/fitness.js) reds the build if this file re-declares it.
+//      (scripts/bongos/fitness.js) reds the build if this file re-declares it.
 //
 // GLOB FORMAT = the touches[] convention (path-match.js): an exact path matches
 // one file; a trailing '/' covers the whole subtree. No '*'/'**' wildcards — the
@@ -89,7 +89,7 @@ const MODULE_GLOBS = {
     // by NO goal, because MODULE_GLOBS is the authoring territory and the shared
     // floor is only tests/. cli-lib.js is the CLI's own argv/session plumbing —
     // core library surface, so it sits with the rest of the kernel.
-    'scripts/gds/cli-lib.js',
+    'scripts/bongos/cli-lib.js',
   ],
   // --- the build state machine + ship/grade/deploy orchestration + schema ---
   // Carved into modules/lifecycle/ (BV1.R86 / ADR 0093 §1,§3): the task/claim/
@@ -103,20 +103,20 @@ const MODULE_GLOBS = {
   // goal-scope/task-affinity).
   lifecycle: [
     'modules/lifecycle/',
-    'scripts/gds/ship.js', 'scripts/gds/claim.js', 'scripts/gds/release.js',
-    'scripts/gds/ship-mode-manual.js', // task 1004631
+    'scripts/bongos/ship.js', 'scripts/bongos/claim.js', 'scripts/bongos/release.js',
+    'scripts/bongos/ship-mode-manual.js', // task 1004631
     // task 1004024: the 2026-08-23 ship.js carve, now protected (by name: no '*' here).
-    'scripts/gds/ship-check.js', 'scripts/gds/ship-deploy-target.js', 'scripts/gds/ship-escalation.js',
-    'scripts/gds/ship-finish.js', 'scripts/gds/ship-flow.js', 'scripts/gds/ship-git.js',
-    'scripts/gds/ship-grade-steps.js', 'scripts/gds/ship-grade.js', 'scripts/gds/ship-honesty.js',
-    'scripts/gds/ship-io.js', 'scripts/gds/ship-land.js', 'scripts/gds/ship-memory-sync.js',
-    'scripts/gds/ship-merge-gate.js', 'scripts/gds/ship-merge.js', 'scripts/gds/ship-mode-ask.js',
-    'scripts/gds/ship-preflight-steps.js',
-    'scripts/gds/ship-regen.js', 'scripts/gds/ship-resume.js', 'scripts/gds/ship-session-upload.js',
-    'scripts/gds/ship-state.js', 'scripts/gds/ship-surprise.js', 'scripts/gds/ship-visual.js',
-    'scripts/gds/merge-mode.js', 'scripts/gds/confirm.js', 'scripts/gds/main-audit.js',
-    'scripts/gds/gate-review.js', 'scripts/gds/push-main.js', 'scripts/gds/ci-grade.js',
-    'scripts/gds/merge-lock.js', 'scripts/gds/version-close.js',
+    'scripts/bongos/ship-check.js', 'scripts/bongos/ship-deploy-target.js', 'scripts/bongos/ship-escalation.js',
+    'scripts/bongos/ship-finish.js', 'scripts/bongos/ship-flow.js', 'scripts/bongos/ship-git.js',
+    'scripts/bongos/ship-grade-steps.js', 'scripts/bongos/ship-grade.js', 'scripts/bongos/ship-honesty.js',
+    'scripts/bongos/ship-io.js', 'scripts/bongos/ship-land.js', 'scripts/bongos/ship-memory-sync.js',
+    'scripts/bongos/ship-merge-gate.js', 'scripts/bongos/ship-merge.js', 'scripts/bongos/ship-mode-ask.js',
+    'scripts/bongos/ship-preflight-steps.js',
+    'scripts/bongos/ship-regen.js', 'scripts/bongos/ship-resume.js', 'scripts/bongos/ship-session-upload.js',
+    'scripts/bongos/ship-state.js', 'scripts/bongos/ship-surprise.js', 'scripts/bongos/ship-visual.js',
+    'scripts/bongos/merge-mode.js', 'scripts/bongos/confirm.js', 'scripts/bongos/main-audit.js',
+    'scripts/bongos/gate-review.js', 'scripts/bongos/push-main.js', 'scripts/bongos/ci-grade.js',
+    'scripts/bongos/merge-lock.js', 'scripts/bongos/version-close.js',
     'migrations/',
   
     // ADOPTED (task 1004111): the deploy half of the ship pipeline lifecycle
@@ -140,15 +140,15 @@ const MODULE_GLOBS = {
     // System 3; its deps are lifecycle + builder-settings, not the grader — see
     // modules/grading/CLAUDE.md "NOT in this module"); grade-smoke is its CLI.
     'modules/grading/',
-    'src/bongos/cascade-dispatch.js', 'scripts/gds/grade-smoke.js',
+    'src/bongos/cascade-dispatch.js', 'scripts/bongos/grade-smoke.js',
   ],
   // --- memory, recall, search, learnings ---
   memory: [
     // Carved into modules/memory/ (BV1.R72 / ADR 0091 §2); the memory-owned CLIs
-    // stay under scripts/gds/ (a command travels with its domain — design 02§1).
+    // stay under scripts/bongos/ (a command travels with its domain — design 02§1).
     'modules/memory/',
-    'scripts/gds/recall.js', 'scripts/gds/learning-capture.js',
-    'scripts/gds/search-ingest-md.js', 'scripts/gds/search-ingest-db.js',
+    'scripts/bongos/recall.js', 'scripts/bongos/learning-capture.js',
+    'scripts/bongos/search-ingest-md.js', 'scripts/bongos/search-ingest-db.js',
   ],
   // --- admission, setup, newcomer floor ---
   // Carved into modules/onboarding/ (BV1.R81 / ADR 0093 §1): the friction
@@ -160,13 +160,13 @@ const MODULE_GLOBS = {
   // The onboarding-domain CLIs travel with the domain but stay under scripts/.
   onboarding: [
     'modules/onboarding/',
-    'scripts/gds/setup.js', 'scripts/gds/onboarding-config.js',
-    'scripts/gds/onboarding-analyze.js', 'scripts/gds/newcomer-floor.js',
+    'scripts/bongos/setup.js', 'scripts/bongos/onboarding-config.js',
+    'scripts/bongos/onboarding-analyze.js', 'scripts/bongos/newcomer-floor.js',
   ],
   // --- inbox, capture, triage, blockers (carved → modules/ideas/, BV1.R78) ---
   ideas: [
     'modules/ideas/',
-    'scripts/gds/capture.js', 'scripts/gds/triage.js', 'scripts/gds/render-ideas.js',
+    'scripts/bongos/capture.js', 'scripts/bongos/triage.js', 'scripts/bongos/render-ideas.js',
   ],
   // Role sub-specialities (task 1003855, ADR 0296). Carved into modules/specialities/
   // but never given a key here, so every file it owns — module.json, db.js, routes,
@@ -174,7 +174,7 @@ const MODULE_GLOBS = {
   // `specialities` was denied out_of_scope for touching the module it is named after
   // (found by task 1004132). Every OTHER on-disk module owns its own directory; this
   // was the only one that did not, and checkEveryModuleDirIsScoped in
-  // scripts/gds/scope-map-guard.js now fails CI if a new carve repeats it.
+  // scripts/bongos/scope-map-guard.js now fails CI if a new carve repeats it.
   specialities: [
     'modules/specialities/',
   ],
@@ -182,6 +182,10 @@ const MODULE_GLOBS = {
   'page-notes': [
     'modules/page-notes/',
   ],
+  // The /raise investor page (task 1004847, ADR 0384): hub-only.
+  raise: [
+    'modules/raise/',
+  ],
   // --- builder prefs (wandering/skill/sound/render) + builder-needs ---
   // Carved into modules/builder-settings/ (BV1.R80 / ADR 0093 §1): the five pref
   // libs + builder-needs + their db slice + the `/me/*-prefs` routes + the
@@ -192,7 +196,7 @@ const MODULE_GLOBS = {
   // comment itself said was core. The pref-mirroring CLIs travel with the
   // domain but stay under scripts/.
   'builder-settings': [
-    'scripts/gds/fetch-sound-prefs.js',
+    'scripts/bongos/fetch-sound-prefs.js',
     'modules/builder-settings/',
   ],
   // --- session records, cost/eval/digest, transcript corpus, BFG ---
@@ -203,10 +207,10 @@ const MODULE_GLOBS = {
   // modules/builder-settings/wandering-prefs — scripts are outside the kernel
   // boundary, so it's not a cross-module import).
   sessions: [
-    'scripts/gds/session.js', 'scripts/gds/session-cost.js', 'scripts/gds/session-eval.js',
-    'scripts/gds/session-digest.js', 'scripts/gds/backfill-sessions.js',
-    'scripts/gds/bfg-principal-token.js', 'scripts/gds/pulse.js',
-    'scripts/gds/repo-metrics.js',
+    'scripts/bongos/session.js', 'scripts/bongos/session-cost.js', 'scripts/bongos/session-eval.js',
+    'scripts/bongos/session-digest.js', 'scripts/bongos/backfill-sessions.js',
+    'scripts/bongos/bfg-principal-token.js', 'scripts/bongos/pulse.js',
+    'scripts/bongos/repo-metrics.js',
     'modules/sessions/',
   ],
   // --- conductor dispatch, architect audits, autonomy gate, routine timers ---
@@ -217,9 +221,9 @@ const MODULE_GLOBS = {
   // with its domain — design 02§1), as do the scheduled-task SKILL.md files.
   autonomy: [
     'modules/autonomy/',
-    'scripts/gds/autonomy-gate.js',
-    'scripts/gds/conductor-dispatch.js', 'scripts/gds/architect-audit.js',
-    'scripts/gds/run-routine.js', '.claude/scheduled-tasks/',
+    'scripts/bongos/autonomy-gate.js',
+    'scripts/bongos/conductor-dispatch.js', 'scripts/bongos/architect-audit.js',
+    'scripts/bongos/run-routine.js', '.claude/scheduled-tasks/',
   ],
   // --- red-team reports + bounty (rank-gated Metic+) ---
   security: [
@@ -279,7 +283,7 @@ const MODULE_GLOBS = {
   //     library (the design-style skills are the design-styles key since task
   //     1004470). default-on,
   //     declaration-only (three skills, no routes/port/migrations). The three
-  //     scripts/gds/ shims are core-side entry points over the module's CLIs —
+  //     scripts/bongos/ shims are core-side entry points over the module's CLIs —
   //     listed for task affinity (the memory/ideas precedent: a command travels with
   //     its domain). The contributed skill dirs follow the devsecops note above
   //     ('.claude/skills/' stays with whichever module ships the skill); the two
@@ -296,8 +300,8 @@ const MODULE_GLOBS = {
     // protected module: ui-design is unprotected, so a ui builder keeps reach over
     // their own working directory.
     '.impeccable/',
-    'scripts/gds/design-sync.js', 'scripts/gds/figma-design-sync.js', 'scripts/gds/validate-design.js',
-    'scripts/gds/ui-kit-transform.js', // the kit's stub reaches the real serving transforms through this command (task 1003320)
+    'scripts/bongos/design-sync.js', 'scripts/bongos/figma-design-sync.js', 'scripts/bongos/validate-design.js',
+    'scripts/bongos/ui-kit-transform.js', // the kit's stub reaches the real serving transforms through this command (task 1003320)
     '.claude/skills/design/', '.claude/skills/design-sync/', '.claude/skills/figma-design-sync/',
     'docs/recipes/claude-design-loop.md', 'docs/recipes/figma-design-loop.md',
   ],
@@ -319,7 +323,7 @@ const MODULE_GLOBS = {
   //     truth; text had none. R01 built the inventory (the copy-inventory
   //     generator + its committed registry under docs/), R02 the flag + queue on
   //     top of it. The generator travels with the domain but stays under
-  //     scripts/gds/ — the memory/ideas precedent (a command travels with its
+  //     scripts/bongos/ — the memory/ideas precedent (a command travels with its
   //     domain, design 02§1). The generated artifacts are listed as exact paths
   //     so a copy task's touches[] can name them without claiming all of docs/.
   //     KEY IS 'copy-desk', NOT 'copy': the branding contract already owns a
@@ -328,7 +332,7 @@ const MODULE_GLOBS = {
   //     fitness check on the English word alone.
   'copy-desk': [
     'modules/copy-desk/',
-    'scripts/gds/copy-inventory.js',
+    'scripts/bongos/copy-inventory.js',
     'docs/copy-registry.json', 'docs/copy-inventory.md',
   ],
   // --- the declarative agent registry (goal 1000038, ADR 0083 default:false):
@@ -338,11 +342,11 @@ const MODULE_GLOBS = {
   //     (files-are-source — the committed definitions ARE the input agents-sync
   //     upserts), listed alongside it on the autonomy precedent, which likewise
   //     owns its '.claude/scheduled-tasks/' definition dir. The sync CLI travels
-  //     with the domain but stays under scripts/gds/ (the provisioning
+  //     with the domain but stays under scripts/bongos/ (the provisioning
   //     precedent). Without this key the three Agents goals (1000038/39/40) could
   //     declare no wall at all (task 1002736).
   agents: [
-    'modules/agents/', '.claude/agents/', 'scripts/gds/agents-sync.js',
+    'modules/agents/', '.claude/agents/', 'scripts/bongos/agents-sync.js',
   ],
   // --- the hub identity provider + the PROJECTS CATALOG it owns (ADR 0141): platform
   //     accounts, the SSO client registry, project memberships/invites, and the
@@ -372,7 +376,7 @@ const MODULE_GLOBS = {
   //     them (task 1002690). ---
   provisioning: [
     'modules/provisioning/',
-    'scripts/gds/provision.js',
+    'scripts/bongos/provision.js',
   ],
   discord: [
     // The bot, broadcast, link/role seams, channels, and bug-attachments graduated
@@ -389,9 +393,9 @@ const MODULE_GLOBS = {
   //     the effect tests/government_protected_surfaces.mjs pins against. Given this key
   //     by task 1003892 (their previous owner was retired).
   'control-plane': [
-    'scripts/gds/provision-config.js',
-    'scripts/gds/provision-net.js',
-    'scripts/gds/do-api.js',
+    'scripts/bongos/provision-config.js',
+    'scripts/bongos/provision-net.js',
+    'scripts/bongos/do-api.js',
     'infra/',
   ],
   // --- the dev-hygiene enforcement surfaces: CI workflows, the agent permission/
@@ -423,58 +427,59 @@ const MODULE_GLOBS = {
     // scanner config above (task 1004146).
     '.gitignore', '.env.local.example',
     'package.json', 'package-lock.json',
-    'scripts/gds/fitness.js', 'scripts/gds/docs-entropy.js',
-    'scripts/gds/redteam-patrol.js', 'scripts/gds/audit-gate.js',
-    'scripts/gds/fitness-ratchets.js', 'scripts/gds/control-manifest.js',
+    'scripts/bongos/fitness.js', 'scripts/bongos/docs-entropy.js',
+    'scripts/bongos/redteam-patrol.js', 'scripts/bongos/audit-gate.js',
+    'scripts/bongos/fitness-ratchets.js', 'scripts/bongos/control-manifest.js',
     // Every file fitness.js actually requires (task 1003949). Since fitness.js hit
     // its line ratchet, the house style is that each new check lands in its OWN file
     // beside it — and none of them was listed here, so scopeSubset() resolved them to
     // no territory and a goal scoped to devsecops was denied out_of_scope for touching
     // the very tooling it owns (the 1002690 / 1002736 / 1003124 / 1003655 class).
     //
-    // This list is kept honest by scripts/gds/scope-map-guard.js rather than by
+    // This list is kept honest by scripts/bongos/scope-map-guard.js rather than by
     // remembering: it derives the same set from fitness.js's own requires and fails
     // CI when one is missing. That guard exists because appending is not a fix — the
     // task that filed this named FOURTEEN unowned files and there were twenty-two.
-    'scripts/gds/scope-map-guard.js',
+    'scripts/bongos/scope-map-guard.js',
     // Landed from task 1003763 while this branch was in flight, and the guard below
     // caught it unowned on the merge - which is the drift it exists to stop.
-    'scripts/gds/home-isolation-guard.js',
+    'scripts/bongos/home-isolation-guard.js',
     // Required WITHOUT the .js extension by fitness.js, which is how they stayed
     // invisible to the first cut of scope-map-guard (grade round 1): Node resolves
     // require('./skill-lint') fine, but a pattern anchored on '.js' matched none of them.
-    'scripts/gds/gen-api-docs.js', 'scripts/gds/migration-namespace.js',
-    'scripts/gds/skill-lint.js', 'scripts/gds/run-routine.js',
-    'scripts/gds/adr-namespace.js', 'scripts/gds/baseline-staleness.js',
-    'scripts/gds/category-advisory-guard.js', 'scripts/gds/client-baseurl-guard.js',
-    'scripts/gds/doc-cli-guard.js', 'scripts/gds/doc-control-claims.js', 'scripts/gds/doc-comment-coverage.js',
-    'scripts/gds/exec-path-guard.js', 'scripts/gds/fitness-lib.js',
-    'scripts/gds/fitness-checks-error-envelope.js', 'scripts/gds/fitness-checks-identity.js',
-    'scripts/gds/fitness-checks-packaging.js', 'scripts/gds/fitness-checks-route-pins.js',
-    'scripts/gds/fitness-checks-vocabulary.js', 'scripts/gds/fitness-checks-write-validation.js',
-    'scripts/gds/fitness-migration-contraction.js', 'scripts/gds/role-pack-guard.js',
-    'scripts/gds/scope-roster-guard.js',
-    'scripts/gds/route-shadow-guard.js', 'scripts/gds/routine-schedule.js',
-    'scripts/gds/seam-wiring-guard.js', 'scripts/gds/skill-preflight.js',
-    'scripts/gds/test-path-guard.js', 'scripts/gds/version-literal-guard.js', 'scripts/gds/dev-box-guard.js',
+    'scripts/bongos/gen-api-docs.js', 'scripts/bongos/migration-namespace.js',
+    'scripts/bongos/skill-lint.js', 'scripts/bongos/run-routine.js',
+    'scripts/bongos/adr-namespace.js', 'scripts/bongos/baseline-staleness.js',
+    'scripts/bongos/category-advisory-guard.js', 'scripts/bongos/client-baseurl-guard.js',
+    'scripts/bongos/doc-cli-guard.js', 'scripts/bongos/doc-control-claims.js', 'scripts/bongos/doc-comment-coverage.js',
+    'scripts/bongos/exec-path-guard.js', 'scripts/bongos/fitness-lib.js',
+    'scripts/bongos/fitness-checks-error-envelope.js', 'scripts/bongos/fitness-checks-identity.js',
+    'scripts/bongos/fitness-checks-packaging.js', 'scripts/bongos/fitness-checks-route-pins.js',
+    'scripts/bongos/fitness-checks-vocabulary.js', 'scripts/bongos/fitness-checks-write-validation.js',
+    'scripts/bongos/fitness-migration-contraction.js', 'scripts/bongos/role-pack-guard.js',
+    'scripts/bongos/scope-roster-guard.js',
+    'scripts/bongos/route-shadow-guard.js', 'scripts/bongos/routine-schedule.js',
+    'scripts/bongos/seam-wiring-guard.js', 'scripts/bongos/skill-preflight.js',
+    'scripts/bongos/test-path-guard.js', 'scripts/bongos/version-literal-guard.js', 'scripts/bongos/dev-box-guard.js',
   
     // ADOPTED (task 1004111): the enforcement surfaces this module already IS.
-    // install-git-hooks.js + scripts/gds/hooks/ are the pre-push hook beside the
+    // install-git-hooks.js + scripts/bongos/hooks/ are the pre-push hook beside the
     // .husky/ it owns; git-merge-regen.js + .gitattributes are the merge-driver
     // PAIR and must not straddle a module boundary; run-unit-tests.js is the CI
     // runner; gen-api-client.js is the sibling of the gen-api-docs.js above.
     // CODEOWNERS is review routing, which is this module's job.
-    'scripts/gds/install-git-hooks.js',
-    'scripts/gds/hooks/',
-    'scripts/gds/git-merge-regen.js',
+    'scripts/bongos/install-git-hooks.js',
+    'scripts/bongos/hooks/',
+    'scripts/gds/', // task 1004848: the @bongos-forwarder files the move left; protected, so a goal must own them
+    'scripts/bongos/git-merge-regen.js',
     '.gitattributes',
-    'scripts/gds/run-unit-tests.js',
-    'scripts/gds/gen-api-client.js',
+    'scripts/bongos/run-unit-tests.js',
+    'scripts/bongos/gen-api-client.js',
     'CODEOWNERS',
   ],
   // --- the METHODOLOGY surfaces: the instruction core an agent session actually
   //     reads — the always-loaded root CLAUDE.md, the docs library it indexes, the
-  //     slash-command skills, and the two scripts/gds files that compose a session's
+  //     slash-command skills, and the two scripts/bongos files that compose a session's
   //     opening context (start.js and the discipline→mode table it routes on).
   //     Added by task 1002989 (goal 1000095, working area 6) as PREP for the
   //     kernel↔pack split (task 1002990): that work rewrites CLAUDE.md, authors the
@@ -495,7 +500,7 @@ const MODULE_GLOBS = {
   //       there for task affinity — overlap is legal (touchesOverlap is prefix-aware
   //       both directions) and it keeps those walls standing on their own.
   //       KNOWN CONSEQUENCE: docs/ was previously owned by nobody, which the ship-time
-  //       module-drift advisory (scripts/gds/ship-flow.js, BV1.R53) read as
+  //       module-drift advisory (scripts/bongos/ship-flow.js, BV1.R53) read as
   //       "cross-cutting, allowed". A module_key-labelled task that also writes a
   //       session log / ADR / regenerated doc now trips that WARNING (advisory only —
   //       it refuses solely under --enforce-module). Filed as an idea to teach the
@@ -509,7 +514,7 @@ const MODULE_GLOBS = {
   //     • '.claude/rules/' is pre-carved territory for task 1003687 (move the
   //       CLAUDE.md content charter to a paths-scoped rule file) — the carve precedes
   //       the feature, ADR 0086 §4, on the devsecops '.npmrc' precedent.
-  //     NOT here: scripts/gds/fitness.js. Task 1002989's brief named it as uncovered,
+  //     NOT here: scripts/bongos/fitness.js. Task 1002989's brief named it as uncovered,
   //     but that brief predates task 1003124, which gave devsecops the fitness/entropy
   //     tooling. One owner per enforcement tool — the CLAUDE.md budget check is
   //     enforcement, not methodology prose. ---
@@ -517,14 +522,14 @@ const MODULE_GLOBS = {
     'CLAUDE.md',
     'docs/',
     '.claude/skills/', '.claude/rules/',
-    'scripts/gds/start.js', 'scripts/gds/discipline-modes.json',
+    'scripts/bongos/start.js', 'scripts/bongos/discipline-modes.json',
   
     // ADOPTED (task 1004111): the three freshness generators that write the docs
     // this module owns — repo-map, file-map and the session index all emit into
     // docs/ (and CLAUDE.md), so the generator belongs with its output.
-    'scripts/gds/gen-repo-map.js',
-    'scripts/gds/gen-file-map.js',
-    'scripts/gds/gen-session-index.js',
+    'scripts/bongos/gen-repo-map.js',
+    'scripts/bongos/gen-file-map.js',
+    'scripts/bongos/gen-session-index.js',
   ],
 };
 
@@ -569,7 +574,7 @@ const SHARED_GLOBS = Object.freeze(
 // ── Roots no module glob touches, and why (task 1004132) ────────────────────────
 //
 // This is the RECORDED DECISION behind "the core is owned by nobody", not a note
-// about it. `checkNoNewUnownedRoot` in scripts/gds/scope-map-guard.js reads this
+// about it. `checkNoNewUnownedRoot` in scripts/bongos/scope-map-guard.js reads this
 // map and fails CI BOTH ways: a tracked root that appears here-less is new unowned
 // territory, and an entry whose root became owned (or stopped existing) is stale.
 //
@@ -590,8 +595,8 @@ const SHARED_GLOBS = Object.freeze(
 // filed to avoid; freezing the set and naming the arguable ones is the cheap half.
 const UNOWNED_ROOTS = Object.freeze({
   // Generated packaging manifests — written by package-core.js, never hand-edited.
-  '.bongos-core.json': 'generated package manifest (scripts/gds/package-core.js)',
-  '.cloudbongos-core.json': 'generated package manifest (scripts/gds/package-core.js)',
+  '.bongos-core.json': 'generated package manifest (scripts/bongos/package-core.js)',
+  '.cloudbongos-core.json': 'generated package manifest (scripts/bongos/package-core.js)',
   // Governance + legal. Deliberately not methodology: methodology owns docs/, and
   // these are the project's constitutional documents rather than its handbook.
   'LICENSE': 'project legal text',
@@ -604,18 +609,18 @@ const UNOWNED_ROOTS = Object.freeze({
   'DESIGN.md': 'top-level design statement',
   'PRODUCT.md': 'top-level product statement',
   // The core itself. bin/ is the CLI entrypoint and clients/ is the GENERATED API
-  // client (scripts/gds/gen-api-client.js); public-docs/ is the published site.
+  // client (scripts/bongos/gen-api-client.js); public-docs/ is the published site.
   // These are core, and core is Archon territory by ADR 0086 — the primary case
   // this list exists to record.
   'bin/': 'core CLI entrypoint — Archon territory (ADR 0086)',
-  'clients/': 'generated API client (scripts/gds/gen-api-client.js)',
+  'clients/': 'generated API client (scripts/bongos/gen-api-client.js)',
   'public-docs/': 'published docs site — core',
 });
 
 // A CLI ENTRYPOINT — a single executable script under scripts/, e.g.
-// 'scripts/gds/setup.js'. Structural, not a list: it is a path test, so no roster
+// 'scripts/bongos/setup.js'. Structural, not a list: it is a path test, so no roster
 // is hand-maintained here and nothing has to be kept in step with PROTECTED_GLOBS.
-// Directories ('scripts/deploy/', 'scripts/gds/hooks/') are territory, not
+// Directories ('scripts/deploy/', 'scripts/bongos/hooks/') are territory, not
 // commands, and are deliberately NOT matched.
 function isCommandPath(glob) {
   return /^scripts\/.*\.js$/.test(glob);
@@ -635,7 +640,7 @@ function protectingGlobs(globs) {
 // WHY THIS IS NOT JUST touchesOverlap(globs, PROTECTED_GLOBS) ANY MORE.
 //   That asked "does this module touch the trust core", and three modules answered
 //   yes because of exactly one CLI they own that happens to sit on a protected
-//   path: onboarding (scripts/gds/setup.js), autonomy (conductor-dispatch.js),
+//   path: onboarding (scripts/bongos/setup.js), autonomy (conductor-dispatch.js),
 //   copy-desk (copy-inventory.js). Owning the command is not owning the authority
 //   — modules/government/ IS government, but setup.js merely lives near
 //   onboarding — so the whole module became Archon-only to scope a goal to on the
@@ -652,7 +657,7 @@ function protectingGlobs(globs) {
 //
 // THE WALL THAT MATTERS DOES NOT MOVE. This decides who may CREATE a goal whose
 // territory includes a protected path. It does not decide who may WRITE one: a
-// sub-Metic builder touching scripts/gds/setup.js is still refused by
+// sub-Metic builder touching scripts/bongos/setup.js is still refused by
 // checkPermissionPaths (goal-scope-check.js wall 2), exactly as before.
 function isProtected(globs) {
   return protectingGlobs(globs).some((g) => !isCommandPath(g));
@@ -745,7 +750,7 @@ function isCrossCuttingModule(key) {
 }
 
 // Pure: of `files`, the ones that stray into a DIFFERENT module's territory for a
-// task scoped to `moduleKey`. Extracted from scripts/gds/ship-flow.js (BV1.R53,
+// task scoped to `moduleKey`. Extracted from scripts/bongos/ship-flow.js (BV1.R53,
 // task 1422) so the rule is testable without running a ship.
 //
 // A file is drift only if it is (a) outside the declared module's own globs and

package/src/bongos/module-store.js

@@ -2,7 +2,7 @@
 // module version's tarball and record it in the registry (task 1004271, ADR 0338 D1).
 //
 // The route (POST /store/modules/:key/versions in routes/modules.js) verifies the
-// upload with scripts/gds/module-artifact.js first; this file only persists what has
+// upload with scripts/bongos/module-artifact.js first; this file only persists what has
 // already passed. Two halves, in this order:
 //
 //   1. stageArtifact — write the tarball under the store dir (a temp name first;

package/src/bongos/module-submissions.js

@@ -6,7 +6,7 @@
 // lives in THIS instance's own DB rather than a live cross-repo call.
 //
 // Pure DB access — the packaging (pre-check, file read, sign-off) is
-// scripts/gds/module.js's job (build tooling, fs-only); the route wires the
+// scripts/bongos/module.js's job (build tooling, fs-only); the route wires the
 // two together.
 
 const { pool } = require('./pool');

package/src/bongos/optimizer.js

@@ -180,7 +180,7 @@ ${OPEN_BLOCKER_GUARD}${UNSHIPPED_DEPS_GUARD}
     for (const t of touches) chosenTouches.push(t);
   }
 
-  // CLI (scripts/gds/session.js printPlan) expects this exact shape, matching
+  // CLI (scripts/bongos/session.js printPlan) expects this exact shape, matching
   // the local-fallback contract: { recommended, long_tail, rationale_for,
   // time_used_min, time_budget_min }. The local fallback was written first
   // and is the canonical contract — this endpoint was diverging in field

package/src/bongos/package-registry.js

@@ -12,7 +12,7 @@
 // needs would have been inside the one module only one hall runs.
 //
 // WHY THE NEWEST PACKAGE'S NOTES. package-core writes release-notes.json from the WHOLE
-// history at pack time (scripts/gds/release-notes.js, task 1004218), so the newest version
+// history at pack time (scripts/bongos/release-notes.js, task 1004218), so the newest version
 // alone lists every version before it. One file answers every reader. The copy the
 // running core carries stops at its own version, which is exactly the range both readers
 // are asked about most: what is published but not running yet.

package/src/bongos/path-match.js

@@ -5,7 +5,7 @@
 // gone — git merge + /merge-mode are the ground-truth collision detector — but
 // matchOne itself is a small, pure "does any path/dir-prefix entry cover this
 // file?" helper still used by the conductor for diff→claim attribution
-// (scripts/gds/conductor-dispatch.js, .claude/hooks/conductor.js). It lives
+// (scripts/bongos/conductor-dispatch.js, .claude/hooks/conductor.js). It lives
 // here, on its own, so those consumers don't depend on a scanner that no longer
 // exists.
 //

package/src/bongos/permission-path-check.js

@@ -11,11 +11,11 @@
 //
 // This module is PURE and dependency-free (no pg, no network, no require of any
 // other repo module) so it can run in three places with identical logic:
-//   1. the LOCAL pre-push git hook (scripts/gds/hooks/pre-push.js) — fast,
+//   1. the LOCAL pre-push git hook (scripts/bongos/hooks/pre-push.js) — fast,
 //      cooperative, blocks the honest builder before the push leaves the box;
 //   2. the GRADER pre-pass (modules/grading/grader.js) — folds a finding into the panel
 //      so a sub-Metic permission-path ship hard-fails the grade;
-//   3. the post-push main AUDIT (scripts/gds/main-audit.js) — the authoritative
+//   3. the post-push main AUDIT (scripts/bongos/main-audit.js) — the authoritative
 //      net that reads the REAL git history + REAL builder ranks server-side and
 //      flags/reverts what slipped past 1 and 2 (the only layer that catches a
 //      raw `git push origin main`, since a free-plan private repo can't forbid
@@ -56,7 +56,7 @@ const RANK_TIER = { xenos: 1, thetes: 2, metic: 3, archon: 4 };
 //
 // WHY `fs` AND NOT `require`: ADR 0083's one-way rule forbids core from
 // require-ing a MODULE's code (a module's behavior + enable/disable state must
-// never be something the kernel depends on), and scripts/gds/fitness.js enforces
+// never be something the kernel depends on), and scripts/bongos/fitness.js enforces
 // that on `require` edges. This is not code — it is a static declarative data
 // file that ships inside the core package next to this file (modules/ ships with
 // @bongos/core, ADR 0108 §1). The sibling trust primitive route-rank-check.js

package/src/bongos/platform-visibility-gate.js

@@ -199,10 +199,8 @@ body{margin:0;min-height:100vh;display:grid;place-items:center;padding:24px;
   background:#edecee;color:#17181a}
 @media(prefers-color-scheme:dark){body{background:#000000;color:#ffffff}}
 .box{width:min(380px,100%);text-align:center}
-.dots{display:flex;gap:10px;justify-content:center;margin-bottom:22px}
-.dots i{display:block;border-radius:50%;background:#fb9569}
-.dots i:first-child{width:38px;height:38px}
-.dots i:last-child{width:28px;height:28px;background:#c9512c;align-self:flex-end}
+.mark{display:block;width:48px;height:48px;margin:0 auto 22px}
+@media(prefers-color-scheme:dark){.mark .mr{stroke:#e2e1e4}.mark .mp{fill:#e2e1e4}}
 h1{font-size:20px;font-weight:700;margin:0 0 6px}
 p{margin:0 0 20px;opacity:.72;font-size:14px}
 /* dark ink on the accent fill: the chrome world's salmon carries white at 2.19:1 */
@@ -210,7 +208,7 @@ a.btn{display:inline-block;padding:11px 22px;border-radius:999px;background:#fb9
   font:700 14px/1 inherit;text-decoration:none}
 a.btn:focus{outline:2px solid #a3481a;outline-offset:2px}
 </style></head><body><div class="box">
-<div class="dots"><i></i><i></i></div>
+<svg class="mark" viewBox="0 0 200 200" aria-hidden="true"><path class="mr" d="M137 31 A78 78 0 1 0 170 66" fill="none" stroke="#17181a" stroke-width="15" stroke-linecap="round"/><circle class="mp" cx="100" cy="100" r="55" fill="#17181a"/><circle cx="156" cy="46" r="12" fill="#fb9569"/></svg>
 <h1>${safe}</h1>
 <p>This project’s pages are open to its members. Sign in to continue.</p>
 <a class="btn" href="${escAttr(signIn)}">Sign in</a>