@bongos/core 1.21.175 → 1.21.177

package/tests/claim_gate_rebase.mjs

@@ -54,15 +54,17 @@ const ok = (cond, msg) => { assert.ok(cond, msg); console.log(`  ok  ${msg}`); p
 
 try {
   await cleanup();
-  await q(`INSERT INTO versions (id,name,status,track) VALUES ($1,'cg','planning','internal') ON CONFLICT (id) DO NOTHING`, [VER]);
+  // 'building', not 'planning': at most one version may plan (versions_one_planning_idx,
+  // core_233) and the seeds already hold that slot, so a 'planning' row here fails setup (task 1004861).
+  await q(`INSERT INTO versions (id,name,status,track) VALUES ($1,'cg','building','internal') ON CONFLICT (id) DO NOTHING`, [VER]);
   // Archon so no rank/newcomer gate interferes; the gate under test is REBASE_REQUIRED.
   await q(`INSERT INTO builders (id,github_id,github_login,display_name,rank) VALUES ($1,'cg-w','cg-worker','CG Worker','archon')`, [WORKER]);
   // STALLED: a confirmed task owned by WORKER, flagged needs_rebase.
-  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,shipped_by) VALUES ($1,$2,'stalled','confirmed',10,'feature',$3)`, [STALLED, VER, WORKER]);
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,shipped_by,discipline) VALUES ($1,$2,'stalled','confirmed',10,'feature',$3,'engineer')`, [STALLED, VER, WORKER]);
   await q(`INSERT INTO claims (task_id,builder_id,claimed_at) VALUES ($1,$2, now())`, [STALLED, WORKER]);
   await db.flagTaskNeedsRebase(String(STALLED), 'strand:no_branch_no_tip');
   // FRESH: a ready, claimable task the worker will try to pick up.
-  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind) VALUES ($1,$2,'fresh','ready',10,'feature')`, [FRESH, VER]);
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline) VALUES ($1,$2,'fresh','ready',10,'feature','engineer')`, [FRESH, VER]);
 
   // 1) With STALLED flagged, claiming FRESH is refused with REBASE_REQUIRED.
   let threw = null;
@@ -88,7 +90,9 @@ try {
     'each owed row carries the fields the CLI + hall render');
 
   // 2) Landing the stalled task clears the flag → the gate opens.
-  await db.shipTask({ taskId: String(STALLED), builderId: String(WORKER) });
+  // shipTask is fail-closed on a land assurance since task 1002483 (ADR 0184); the test
+  // stands in for the land proof the real ship path supplies.
+  await db.shipTask({ taskId: String(STALLED), builderId: String(WORKER), landAssurance: { kind: 'proof', reason: 'test fixture: land proven' } });
   const stalledFlag = (await q(`SELECT needs_rebase FROM tasks WHERE id=$1`, [STALLED]))[0].needs_rebase;
   ok(stalledFlag === false, 'shipping the stalled task cleared needs_rebase');
 
@@ -112,13 +116,13 @@ try {
   await q(`UPDATE claims SET released_at = now() WHERE task_id = $1 AND released_at IS NULL`, [FRESH]);
 
   const seedStrand = async (id, reason, ageHours) => {
-    await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,shipped_by) VALUES ($1,$2,'aged','confirmed',10,'feature',$3)`, [id, VER, WORKER]);
+    await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,shipped_by,discipline) VALUES ($1,$2,'aged','confirmed',10,'feature',$3,'engineer')`, [id, VER, WORKER]);
     await q(`INSERT INTO claims (task_id,builder_id,claimed_at) VALUES ($1,$2, now())`, [id, WORKER]);
     await db.flagTaskNeedsRebase(String(id), reason);
     await q(`UPDATE tasks SET needs_rebase_at = now() - ($2::bigint * interval '1 hour') WHERE id = $1`, [id, ageHours]);
   };
 
-  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind) VALUES ($1,$2,'fresh2','ready',10,'feature')`, [FRESH2, VER]);
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline) VALUES ($1,$2,'fresh2','ready',10,'feature','engineer')`, [FRESH2, VER]);
 
   // 4) An unprovable strand AGED past the grace no longer refuses a claim.
   await seedStrand(AGED, 'strand:no_branch_no_tip', 48);
@@ -150,7 +154,7 @@ try {
   // 7) task 1004370 — the one task the gate lets through: a P1 kind=infra fix,
   //    the shape a CI-unblock is filed in. With AGED_OTHER still gating, claiming
   //    it succeeds; FRESH2 (a P1 feature) was refused in 6), so both halves count.
-  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,priority) VALUES ($1,$2,'ci fix','ready',10,'infra',1)`, [CIFIX, VER]);
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,priority,discipline) VALUES ($1,$2,'ci fix','ready',10,'infra',1,'engineer')`, [CIFIX, VER]);
   const ciClaim = await db.claimTask({ taskId: String(CIFIX), builderId: String(WORKER), worktreeName: 'cg-cifix' });
   ok(ciClaim && Number(ciClaim.task_id) === CIFIX,
     'a P1 infra task is claimable while a rebase is owed — the CI-unblock fix is never gated out');
@@ -167,7 +171,7 @@ try {
   await q(`UPDATE tasks SET status='shipped', needs_rebase=false WHERE id=$1`, [AGED_OTHER]);
   await q(`UPDATE claims SET released_at = now() WHERE task_id = ANY($1::bigint[]) AND released_at IS NULL`, [[CIFIX]]);
   await seedStrand(GUARDED, 'strand:branch_modifies_executed_code:.gitattributes', 1);
-  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind) VALUES ($1,$2,'fresh3','ready',10,'feature')`, [FRESH3, VER]);
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline) VALUES ($1,$2,'fresh3','ready',10,'feature','engineer')`, [FRESH3, VER]);
   const claim3 = await db.claimTask({ taskId: String(FRESH3), builderId: String(WORKER), worktreeName: 'cg-fresh3' });
   ok(claim3 && Number(claim3.task_id) === FRESH3, 'a confirmed task parked on a server-side guard does not refuse a new claim');
   ok((await db.needsRebaseTasksForBuilder(String(WORKER))).some((t) => Number(t.id) === GUARDED),

package/tests/claim_recall.mjs

@@ -18,7 +18,7 @@ const {
   rowKeys,
   formatRecallSources,
   RECALL_LIMIT,
-} = require('../scripts/gds/claim-recall.js');
+} = require('../scripts/bongos/claim-recall.js');
 
 let passed = 0;
 let failed = 0;
@@ -84,8 +84,8 @@ t('rowKeys: a row yields both a ref key and a title key', () => {
 
 t('rowKeys: a learning shape (related_files / source) also keys', () => {
   assert.deepEqual(
-    rowKeys({ related_files: ['scripts/gds/ship.js'], title: 'Ship gotcha' }).sort(),
-    ['ref:scripts/gds/ship.js', 'title:ship gotcha'].sort(),
+    rowKeys({ related_files: ['scripts/bongos/ship.js'], title: 'Ship gotcha' }).sort(),
+    ['ref:scripts/bongos/ship.js', 'title:ship gotcha'].sort(),
   );
 });
 
@@ -94,7 +94,7 @@ const SAMPLE = [
   { source_ref: 'task:956', title: 'V4.R18 — Claim-time recall hits' }, // self — must drop
   { source_ref: 'docs/session-logs/2026-06-16-recall.md', title: 'Recall layer built' },
   { source_ref: 'criterion:94', title: 'Criterion sessions-start-knowing' },
-  { source_ref: 'scripts/gds/CLAUDE.md', title: 'builder CLI notes' },
+  { source_ref: 'scripts/bongos/CLAUDE.md', title: 'builder CLI notes' },
   { source_ref: 'docs/recipes/README.md', title: 'recipes index' },
   { source_ref: 'docs/adr/0060.md', title: 'ADR 0060 retrieval' },
   { source_ref: 'docs/adr/0025.md', title: 'ADR 0025 criterion link' },

package/tests/claim_resolve_worktree_lock.mjs

@@ -203,7 +203,7 @@ test('no arguments at all does not throw and allows (nothing to scope to)', () =
 // server that has not learned it. This was not theoretical: the very ship of this
 // change was refused `validation_failed [HTTP 400]` by prod, which runs an older
 // core. The CLI drops the field and retries once; these pin that decision.
-const { isUnknownFieldRejection } = require('../scripts/gds/ship-io.js');
+const { isUnknownFieldRejection } = require('../scripts/bongos/ship-io.js');
 
 // The EXACT envelope prod returned on the refused ship (ADR 0116 shape, with
 // reason 'unknown_field' from validate()'s strict branch).

package/tests/claude_materialize.mjs

@@ -1,13 +1,13 @@
 // tests/claude_materialize.mjs
 //
 // ADR 0108 §3 (configurable-root W3 / task 1883) — materialize the .claude/ surface into an instance
-// and rewrite `node scripts/gds/<x>.js` invocations to the `bongos` bin. Pins:
-//   1. bongosify — dedicated verb where one exists (bongos ship), else `bongos exec scripts/gds/<x>.js`;
+// and rewrite `node scripts/bongos/<x>.js` invocations to the `bongos` bin. Pins:
+//   1. bongosify — dedicated verb where one exists (bongos ship), else `bongos exec scripts/bongos/<x>.js`;
 //      $CLAUDE_PROJECT_DIR/quotes stripped; args preserved; .claude/hooks/ refs left instance-local;
 //      idempotent.
 //   2. scriptToVerb — excludes prefixArgs verbs so dev.js never mis-maps to `bongos serve`.
-//   3. transformSettings — rewrites the scripts/gds hook commands AND permission rules, keeps .claude/hooks/ ones.
-//   4. materializeClaude — copies + transforms skills into a target dir (no leftover node scripts/gds),
+//   3. transformSettings — rewrites the scripts/bongos hook commands AND permission rules, keeps .claude/hooks/ ones.
+//   4. materializeClaude — copies + transforms skills into a target dir (no leftover node scripts/bongos),
 //      writes settings.json, copies hooks; and NO-OPS when the target IS the core root (self-copy guard).
 //   5. task 1003486 — a UI task brings its own tools: the `materializeModuleSkills` opt-in on a
 //      discipline-modes entry, the core-checkout probe that keeps it out of a scaffolded instance,
@@ -25,9 +25,9 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
-const m = require('../scripts/gds/claude-materialize.js');
-const claim = require('../scripts/gds/claim.js');
-const cliLib = require('../scripts/gds/cli-lib.js');
+const m = require('../scripts/bongos/claude-materialize.js');
+const claim = require('../scripts/bongos/claim.js');
+const cliLib = require('../scripts/bongos/cli-lib.js');
 const ic = require('../src/instance-config.js');
 // The live verb table, so a starter allow-rule naming a verb that does not exist
 // fails here rather than shipping as an inert permission (task 1003962).
@@ -42,24 +42,24 @@ function t(name, fn) {
 
 // ---- bongosify -------------------------------------------------------------
 t('bongosify: a script WITH a dedicated verb → bongos <verb> (args preserved)', () => {
-  assert.equal(m.bongosify('run `node scripts/gds/ship.js 1885 --force`'), 'run `npx bongos ship 1885 --force`');
-  assert.equal(m.bongosify('node scripts/gds/start.js --json'), 'npx bongos start --json');
+  assert.equal(m.bongosify('run `node scripts/bongos/ship.js 1885 --force`'), 'run `npx bongos ship 1885 --force`');
+  assert.equal(m.bongosify('node scripts/bongos/start.js --json'), 'npx bongos start --json');
 });
 
 t('bongosify: a script WITHOUT a dedicated verb → bongos exec (args preserved)', () => {
-  assert.equal(m.bongosify('node scripts/gds/api.js GET /api/gds/me'), 'npx bongos exec scripts/gds/api.js GET /api/gds/me');
-  assert.equal(m.bongosify('node scripts/gds/capture.js "x"'), 'npx bongos exec scripts/gds/capture.js "x"');
+  assert.equal(m.bongosify('node scripts/bongos/api.js GET /api/gds/me'), 'npx bongos exec scripts/bongos/api.js GET /api/gds/me');
+  assert.equal(m.bongosify('node scripts/bongos/capture.js "x"'), 'npx bongos exec scripts/bongos/capture.js "x"');
 });
 
 t('bongosify: $CLAUDE_PROJECT_DIR + surrounding quotes are stripped', () => {
-  assert.equal(m.bongosify('node "$CLAUDE_PROJECT_DIR/scripts/gds/session-cost.js"'), 'npx bongos exec scripts/gds/session-cost.js');
+  assert.equal(m.bongosify('node "$CLAUDE_PROJECT_DIR/scripts/bongos/session-cost.js"'), 'npx bongos exec scripts/bongos/session-cost.js');
 });
 
 t('bongosify: the run-node.sh resolver form (task 1003548) collapses to the same bongos form', () => {
   const wrap = 'sh "$CLAUDE_PROJECT_DIR/.claude/hooks/run-node.sh"';
-  assert.equal(m.bongosify(`${wrap} "$CLAUDE_PROJECT_DIR/scripts/gds/session-cost.js"`), 'npx bongos exec scripts/gds/session-cost.js');
-  assert.equal(m.bongosify(`${wrap} "$CLAUDE_PROJECT_DIR/scripts/gds/deploy-divergence.js" --line --timeout-ms 2500`), 'npx bongos exec scripts/gds/deploy-divergence.js --line --timeout-ms 2500');
-  assert.equal(m.bongosify(`${wrap} "$CLAUDE_PROJECT_DIR/scripts/gds/ship.js" 1885`), 'npx bongos ship 1885');
+  assert.equal(m.bongosify(`${wrap} "$CLAUDE_PROJECT_DIR/scripts/bongos/session-cost.js"`), 'npx bongos exec scripts/bongos/session-cost.js');
+  assert.equal(m.bongosify(`${wrap} "$CLAUDE_PROJECT_DIR/scripts/bongos/deploy-divergence.js" --line --timeout-ms 2500`), 'npx bongos exec scripts/bongos/deploy-divergence.js --line --timeout-ms 2500');
+  assert.equal(m.bongosify(`${wrap} "$CLAUDE_PROJECT_DIR/scripts/bongos/ship.js" 1885`), 'npx bongos ship 1885');
   // …and a resolver call whose target is a .claude/hooks/*.js stays instance-local, like the bare-node form.
   const hook = `${wrap} "$CLAUDE_PROJECT_DIR/.claude/hooks/secret-gate.js"`;
   assert.equal(m.bongosify(hook), hook);
@@ -72,7 +72,7 @@ t('bongosify: a .claude/hooks/ reference is LEFT untouched (instance-local after
 
 t('bongosify: idempotent + no-op on text with no invocation', () => {
   assert.equal(m.bongosify('just prose, no commands'), 'just prose, no commands');
-  const once = m.bongosify('node scripts/gds/ship.js');
+  const once = m.bongosify('node scripts/bongos/ship.js');
   assert.equal(m.bongosify(once), once, 'running it again changes nothing');
 });
 
@@ -86,12 +86,12 @@ t('scriptToVerb: dedicated verbs map; prefixArgs verbs (box/upgrade) are exclude
 });
 
 // ---- transformSettings -----------------------------------------------------
-t('transformSettings: rewrites scripts/gds hook commands, keeps .claude/hooks/ ones', () => {
+t('transformSettings: rewrites scripts/bongos hook commands, keeps .claude/hooks/ ones', () => {
   const dir = mkdtempSync(join(tmpdir(), 'w3-set-'));
   const settings = {
     hooks: {
       Stop: [{ hooks: [
-        { type: 'command', command: 'node "$CLAUDE_PROJECT_DIR/scripts/gds/session-cost.js"' },
+        { type: 'command', command: 'node "$CLAUDE_PROJECT_DIR/scripts/bongos/session-cost.js"' },
         { type: 'command', command: 'node "$CLAUDE_PROJECT_DIR/.claude/hooks/stop-sound.js"' },
       ] }],
     },
@@ -101,33 +101,33 @@ t('transformSettings: rewrites scripts/gds hook commands, keeps .claude/hooks/ o
   const out = JSON.parse(m.transformSettings(p));
   const cmds = out.hooks.Stop[0].hooks.map((h) => h.command);
   assert.deepEqual(cmds, [
-    'npx bongos exec scripts/gds/session-cost.js',
+    'npx bongos exec scripts/bongos/session-cost.js',
     'node "$CLAUDE_PROJECT_DIR/.claude/hooks/stop-sound.js"',
   ]);
   rmSync(dir, { recursive: true, force: true });
 });
 
 // task 1004012: the skills an instance receives run `bongos ship`, so a rule that still says
-// `node scripts/gds/ship.js` matches nothing and every blessed command meets the prompt.
+// `node scripts/bongos/ship.js` matches nothing and every blessed command meets the prompt.
 t('transformSettings: permission rules are rewritten to the form the instance\'s skills actually run', () => {
   const dir = mkdtempSync(join(tmpdir(), 'w3-perm-'));
   const p = join(dir, 'settings.json');
   writeFileSync(p, JSON.stringify({
     permissions: {
       // two spellings of one command, a script with no verb of its own, and a rule that names no script
-      allow: ['Bash(node scripts/gds/ship.js:*)', 'Bash(node ./scripts/gds/ship.js:*)', 'Bash(node scripts/gds/me.js:*)', 'Bash(git status:*)'],
-      deny: ['Bash(node scripts/gds/release.js:*)', 'Bash(node scripts/gds/me.js:*)', 'Read(./.env)'],
-      ask: ['Bash(node scripts/gds/claim.js:*)'],
+      allow: ['Bash(node scripts/bongos/ship.js:*)', 'Bash(node ./scripts/bongos/ship.js:*)', 'Bash(node scripts/bongos/me.js:*)', 'Bash(git status:*)'],
+      deny: ['Bash(node scripts/bongos/release.js:*)', 'Bash(node scripts/bongos/me.js:*)', 'Read(./.env)'],
+      ask: ['Bash(node scripts/bongos/claim.js:*)'],
       defaultMode: 'acceptEdits',
     },
   }, null, 2));
   const out = JSON.parse(m.transformSettings(p)).permissions;
-  assert.deepEqual(out.allow, ['Bash(npx bongos ship:*)', 'Bash(npx bongos exec scripts/gds/me.js:*)', 'Bash(git status:*)'],
+  assert.deepEqual(out.allow, ['Bash(npx bongos ship:*)', 'Bash(npx bongos exec scripts/bongos/me.js:*)', 'Bash(git status:*)'],
     'allow takes the ONE spelling the skills use, and two spellings of a command collapse to one rule');
-  // An instance can reach a script two ways — `bongos release` and `bongos exec scripts/gds/release.js` —
+  // An instance can reach a script two ways — `bongos release` and `bongos exec scripts/bongos/release.js` —
   // so a restrictive rule that named only one would still LOOK like a guard while guarding half.
-  assert.deepEqual(out.deny, ['Bash(npx bongos release:*)', 'Bash(npx bongos exec scripts/gds/release.js:*)', 'Bash(npx bongos exec scripts/gds/me.js:*)', 'Read(./.env)']);
-  assert.deepEqual(out.ask, ['Bash(npx bongos claim:*)', 'Bash(npx bongos exec scripts/gds/claim.js:*)']);
+  assert.deepEqual(out.deny, ['Bash(npx bongos release:*)', 'Bash(npx bongos exec scripts/bongos/release.js:*)', 'Bash(npx bongos exec scripts/bongos/me.js:*)', 'Read(./.env)']);
+  assert.deepEqual(out.ask, ['Bash(npx bongos claim:*)', 'Bash(npx bongos exec scripts/bongos/claim.js:*)']);
   assert.equal(out.defaultMode, 'acceptEdits', 'a non-list permission key passes through untouched');
   rmSync(dir, { recursive: true, force: true });
 });
@@ -146,19 +146,19 @@ t('transformSettings: run on the core\'s OWN settings.json, no list keeps a rule
 });
 
 // ---- materializeClaude -----------------------------------------------------
-t('materializeClaude: copies + rewrites skills into a fresh instance dir (no leftover node scripts/gds)', () => {
+t('materializeClaude: copies + rewrites skills into a fresh instance dir (no leftover node scripts/bongos)', () => {
   const dir = mkdtempSync(join(tmpdir(), 'w3-inst-'));
   const res = m.materializeClaude({ coreRoot: ROOT, instanceDir: dir, dryRun: false });
   assert.equal(res.skipped, false);
   assert.ok(res.skills > 0, 'at least one skill materialized');
   assert.ok(existsSync(join(dir, '.claude', 'skills')), '.claude/skills created in the instance');
-  // NO materialized skill may still say `node scripts/gds` — the transform must be total.
+  // NO materialized skill may still say `node scripts/bongos` — the transform must be total.
   const leftovers = [];
   const walk = (d) => {
     for (const name of readdirSync(d, { withFileTypes: true })) {
       const p = join(d, name.name);
       if (name.isDirectory()) walk(p);
-      else if (p.endsWith('.md') && readFileSync(p, 'utf8').includes('node scripts/gds')) leftovers.push(p);
+      else if (p.endsWith('.md') && readFileSync(p, 'utf8').includes('node scripts/bongos')) leftovers.push(p);
     }
   };
   walk(join(dir, '.claude', 'skills'));
@@ -177,31 +177,31 @@ t('materializeClaude: materializes scheduled-tasks — bodies→bongos, companio
   assert.ok(existsSync(rt), '.claude/scheduled-tasks created in the instance');
   // Every materialized routine's core invocation is bongosified — asserted over
   // WHATEVER routines the tree carries (the neutral core carries redteam-weekly;
-  // the founder core also carries stale-claim-release/diagram-drift). No routine
-  // body may keep a bare `node scripts/gds/…` core invocation.
+  // the founder core also carries rank-roles-audit/peer-vote-tally). No routine
+  // body may keep a bare `node scripts/bongos/…` core invocation.
   let sawBongosified = false;
   for (const name of readdirSync(rt)) {
     const skillPath = join(rt, name, 'SKILL.md');
     if (!existsSync(skillPath)) continue;
     const body = readFileSync(skillPath, 'utf8');
-    assert.ok(!/\bnode scripts\/gds\//.test(body), `${name}: bare relative node scripts/gds left in the body`);
-    if (body.includes('bongos exec scripts/gds/')) sawBongosified = true;
+    assert.ok(!/\bnode scripts\/(?:gds|bongos)\//.test(body), `${name}: bare relative node scripts/bongos left in the body`);
+    if (body.includes('bongos exec scripts/bongos/')) sawBongosified = true;
   }
   assert.ok(sawBongosified, 'at least one routine had its core invocation rewritten to bongos exec');
   // Founder-specific fixtures — assert their finer behavior only when present, so
   // this coverage stays live on the founder core without demanding those routines
   // exist in the neutral core (which carries a different routine set).
-  const stalePath = join(rt, 'stale-claim-release', 'SKILL.md');
-  if (existsSync(stalePath)) {
-    assert.ok(readFileSync(stalePath, 'utf8').includes('bongos exec scripts/gds/pulse.js'), 'body core-invocation rewritten to bongos exec');
-  }
-  const ddCheck = join(rt, 'diagram-drift', 'check.js');
-  if (existsSync(ddCheck)) {
-    const dd = readFileSync(join(rt, 'diagram-drift', 'SKILL.md'), 'utf8');
-    assert.ok(dd.includes('node .claude/scheduled-tasks/diagram-drift/check.js'), 'companion-path step command preserved');
-    const check = readFileSync(ddCheck, 'utf8');
-    assert.ok(check.includes("require('../../hooks/_core-resolve.js')"), 'companion resolves core via _core-resolve');
-    assert.ok(!check.includes("require('../../../scripts/gds/"), 'no bare ../../../scripts/gds require left in the companion');
+  // The companion-script case (task 1004878 moved this off the retired
+  // diagram-drift routine): a routine whose step runs a .js beside its SKILL.md.
+  const pvTally = join(rt, 'peer-vote-tally', 'tally.js');
+  if (existsSync(pvTally)) {
+    const pv = readFileSync(join(rt, 'peer-vote-tally', 'SKILL.md'), 'utf8');
+    assert.ok(pv.includes('node .claude/scheduled-tasks/peer-vote-tally/tally.js'), 'companion-path step command preserved');
+    const tally = readFileSync(pvTally, 'utf8');
+    assert.ok(tally.includes("require('../../hooks/_core-resolve.js')"), 'companion resolves core via _core-resolve');
+    // Code lines only: tally.js's own header QUOTES the bare form to explain why it is gone.
+    const code = tally.split('\n').filter((l) => !/^\s*\/\//.test(l)).join('\n');
+    assert.ok(!code.includes("require('../../../scripts/bongos/"), 'no bare ../../../scripts/bongos require left in the companion');
   }
   rmSync(dir, { recursive: true, force: true });
 });
@@ -216,8 +216,8 @@ t('materializeClaude: SELF-COPY guard — target === core root is a no-op (byte-
 t('copyTreeTransformed: overwrite:false LEAVES a pre-existing dest file (reports it in skipped[])', () => {
   const src = mkdtempSync(join(tmpdir(), 'w3-src-'));
   const dest = mkdtempSync(join(tmpdir(), 'w3-dst-'));
-  writeFileSync(join(src, 'a.md'), 'node scripts/gds/ship.js 1');
-  writeFileSync(join(src, 'b.md'), 'node scripts/gds/start.js');
+  writeFileSync(join(src, 'a.md'), 'node scripts/bongos/ship.js 1');
+  writeFileSync(join(src, 'b.md'), 'node scripts/bongos/start.js');
   const ownerB = 'OWNER CONTENT — do not clobber';
   writeFileSync(join(dest, 'b.md'), ownerB);         // b.md pre-exists at the destination
   const res = m.copyTreeTransformed(src, dest, { overwrite: false });
@@ -232,7 +232,7 @@ t('copyTreeTransformed: overwrite:false LEAVES a pre-existing dest file (reports
 t('copyTreeTransformed: overwrite defaults true → greenfield still clobbers (regression)', () => {
   const src = mkdtempSync(join(tmpdir(), 'w3-src-'));
   const dest = mkdtempSync(join(tmpdir(), 'w3-dst-'));
-  writeFileSync(join(src, 'a.md'), 'node scripts/gds/start.js');
+  writeFileSync(join(src, 'a.md'), 'node scripts/bongos/start.js');
   writeFileSync(join(dest, 'a.md'), 'OLD');
   const res = m.copyTreeTransformed(src, dest);       // default overwrite:true
   assert.equal(res.files, 1);
@@ -516,7 +516,7 @@ t('moduleSkillSources: declared names resolve from skills/<name> or skills/vendo
   mkdirSync(join(modDir, 'skills', 'vendor', 'undeclared'), { recursive: true });
   mkdirSync(join(modDir, 'skills', 'noskill'), { recursive: true });
   writeFileSync(join(modDir, 'module.json'), JSON.stringify({ key: 'foo', default: true, contributes: { skills: ['own', 'third', 'noskill', 'missing'] } }));
-  writeFileSync(join(modDir, 'skills', 'own', 'SKILL.md'), '---\nname: own\n---\nrun node scripts/gds/ship.js 1\n');
+  writeFileSync(join(modDir, 'skills', 'own', 'SKILL.md'), '---\nname: own\n---\nrun node scripts/bongos/ship.js 1\n');
   writeFileSync(join(modDir, 'skills', 'vendor', 'third', 'SKILL.md'), '---\nname: third\n---\nbody\n');
   writeFileSync(join(modDir, 'skills', 'vendor', 'third', 'PROVENANCE.md'), '---\nlicence: MIT\nscanVerdict: caution\n---\n');
   writeFileSync(join(modDir, 'skills', 'vendor', 'undeclared', 'SKILL.md'), '---\nname: undeclared\n---\n');
@@ -625,7 +625,7 @@ t('materializeClaude: copied hooks carry NO founder origin/config-dir; a disable
 });
 
 // ---- CLAUDE.md scaffold (task 2104) ----------------------------------------
-const tmpl = require('../scripts/gds/claude-md-template.js');
+const tmpl = require('../scripts/bongos/claude-md-template.js');
 
 t('renderInstanceClaudeMd: brand-substituted — names the instance + its hall/currency, no founder literal', () => {
   const md = tmpl.renderInstanceClaudeMd({ identity: { productName: 'Acme', worldName: 'Acmeland', company: { name: 'Widgets Inc' } }, domains: { publicOrigin: 'https://acme.example.org', buildersOrigin: 'https://builders.acme.example.org', statusOrigin: 'https://status.acme.example.org' }, currency: { label: 'coins' } });
@@ -678,7 +678,7 @@ t('materializeClaude: NEVER clobbers an existing CLAUDE.md (init / adopt / upgra
 function fakeCore() {
   const core = mkdtempSync(join(tmpdir(), 'cm-core-'));
   const mod = (key, dflt, skills) => { mkdirSync(join(core, 'modules', key, 'skills'), { recursive: true }); writeFileSync(join(core, 'modules', key, 'module.json'), JSON.stringify({ key, default: dflt, contributes: { skills } })); };
-  const skill = (key, name, body = 'run `node scripts/gds/ship.js 1`') => { mkdirSync(join(core, 'modules', key, 'skills', name, 'reference'), { recursive: true }); writeFileSync(join(core, 'modules', key, 'skills', name, 'SKILL.md'), `---\nname: ${name}\n---\n${body}\n`); writeFileSync(join(core, 'modules', key, 'skills', name, 'reference', 'x.md'), 'a playbook\n'); };
+  const skill = (key, name, body = 'run `node scripts/bongos/ship.js 1`') => { mkdirSync(join(core, 'modules', key, 'skills', name, 'reference'), { recursive: true }); writeFileSync(join(core, 'modules', key, 'skills', name, 'SKILL.md'), `---\nname: ${name}\n---\n${body}\n`); writeFileSync(join(core, 'modules', key, 'skills', name, 'reference', 'x.md'), 'a playbook\n'); };
   mod('m1', true, ['alpha', 'shared']); skill('m1', 'alpha'); skill('m1', 'shared');
   mod('m2', false, ['beta']); skill('m2', 'beta');
   mkdirSync(join(core, '.claude', 'skills', 'shared'), { recursive: true }); writeFileSync(join(core, '.claude', 'skills', 'shared', 'SKILL.md'), 'the core\'s own shared\n');
@@ -690,7 +690,7 @@ t('--module-skills-only: an enabled module\'s skills land in the core\'s own .cl
   const core = fakeCore();
   const res = m.materializeModuleSkillsIntoCore({ coreRoot: core });
   assert.deepEqual(res.materialized, ['alpha']); assert.deepEqual(res.excluded, ['beta']); assert.deepEqual(res.keptCore, ['shared']);
-  assert.equal(readFileSync(join(core, '.claude', 'skills', 'alpha', 'SKILL.md'), 'utf8'), '---\nname: alpha\n---\nrun `node scripts/gds/ship.js 1`\n', 'verbatim: no bongosify in the checkout');
+  assert.equal(readFileSync(join(core, '.claude', 'skills', 'alpha', 'SKILL.md'), 'utf8'), '---\nname: alpha\n---\nrun `node scripts/bongos/ship.js 1`\n', 'verbatim: no bongosify in the checkout');
   assert.ok(existsSync(join(core, '.claude', 'skills', 'alpha', 'reference', 'x.md')), 'the tree is copied');
   assert.equal(readFileSync(join(core, '.claude', 'skills', 'shared', 'SKILL.md'), 'utf8'), 'the core\'s own shared\n', 'the core copy is untouched');
   const manifest = JSON.parse(readFileSync(join(core, '.claude', 'skills', m.MODULE_SKILLS_MANIFEST), 'utf8'));
@@ -739,17 +739,17 @@ t('--module-skills-only: an instance materialised FROM a core that carries mater
 
 t('--module-skills-only: the CLI entry refuses without the flag (usage, exit 2) and gen-file-map skips materialised names by the manifest', () => {
   const { spawnSync } = require('node:child_process');
-  const bare = spawnSync(process.execPath, [join(ROOT, 'scripts', 'gds', 'claude-materialize.js')], { encoding: 'utf8' });
+  const bare = spawnSync(process.execPath, [join(ROOT, 'scripts', 'bongos', 'claude-materialize.js')], { encoding: 'utf8' });
   assert.equal(bare.status, 2); assert.match(bare.stderr, /--module-skills-only/);
   // end to end through the real entry point, on the real checkout, writing nothing: --dry-run
   // reports what it would land, --clean --dry-run what it would remove, both exit 0
-  const cli = join(ROOT, 'scripts', 'gds', 'claude-materialize.js');
+  const cli = join(ROOT, 'scripts', 'bongos', 'claude-materialize.js');
   const dry = spawnSync(process.execPath, [cli, '--module-skills-only', '--dry-run'], { encoding: 'utf8' });
   assert.equal(dry.status, 0, dry.stderr); assert.match(dry.stdout, /\[dry-run\] would materialize \d+ module-owned skill/); assert.match(dry.stdout, /module skills → \.claude\/skills\//);
   const dryClean = spawnSync(process.execPath, [cli, '--module-skills-only', '--clean', '--dry-run'], { encoding: 'utf8' });
   assert.equal(dryClean.status, 0, dryClean.stderr); assert.match(dryClean.stdout, /\[dry-run\] would remove \d+ materialised module skill dir/);
   assert.ok(!existsSync(join(ROOT, '.claude', 'skills', m.MODULE_SKILLS_MANIFEST)) || readFileSync(join(ROOT, '.claude', 'skills', m.MODULE_SKILLS_MANIFEST), 'utf8').length > 0, 'a dry run never wrote or emptied the real manifest');
-  const gen = require('../scripts/gds/gen-file-map.js');
+  const gen = require('../scripts/bongos/gen-file-map.js');
   const dir = mkdtempSync(join(tmpdir(), 'cm-fm-'));
   for (const n of ['real', 'copy']) { mkdirSync(join(dir, n)); writeFileSync(join(dir, n, 'SKILL.md'), 'x'); }
   writeFileSync(join(dir, m.MODULE_SKILLS_MANIFEST), JSON.stringify({ skills: { copy: { module: 'm1' } } }));
@@ -761,7 +761,7 @@ t('--module-skills-only: the CLI entry refuses without the flag (usage, exit 2)
 // ---- task 1003486: claiming a ui task lands /design's tools in the checkout ----
 
 t('the materialise-at-claim trigger is DATA: the ui mode opts in, every other discipline claims exactly as before', () => {
-  const modes = JSON.parse(readFileSync(join(ROOT, 'scripts', 'gds', 'discipline-modes.json'), 'utf8')).modes;
+  const modes = JSON.parse(readFileSync(join(ROOT, 'scripts', 'bongos', 'discipline-modes.json'), 'utf8')).modes;
   assert.equal(modes.ui.materializeModuleSkills, true, 'a ui claim brings the skills /design names');
   assert.equal(modes.ui.skill, 'design', 'and still routes to /design');
   for (const d of ['engineer', 'ideator', 'artist']) {
@@ -784,7 +784,7 @@ t('materializeModeSkills: a discipline that did not opt in does nothing, and a m
   const lines = [];
   const realLog = console.log;
   console.log = (...a) => lines.push(a.join(' '));
-  const mPath = require.resolve('../scripts/gds/claude-materialize.js');
+  const mPath = require.resolve('../scripts/bongos/claude-materialize.js');
   const realExports = require.cache[mPath].exports;
   try {
     for (const mode of [null, undefined, {}, { skill: 'dev' }, { materializeModuleSkills: false }, { materializeModuleSkills: 'yes' }]) {
@@ -870,7 +870,7 @@ t('the escape hatch is NOT blanket-allowed', () => {
     'bongos exec must never be allowed bare — under any shell tool');
   const execRules = m.STARTER_ALLOW.filter((r) => r.includes('bongos exec'));
   for (const r of execRules) {
-    assert.match(r, /bongos exec scripts\/gds\/[a-z-]+\.js/,
+    assert.match(r, /bongos exec scripts\/(?:gds|bongos)\/[a-z-]+\.js/,
       `an exec rule must name its script in full, got: ${r}`);
   }
 });
@@ -1142,12 +1142,12 @@ t('a checkout-materialized instance gets allow-rules in the bongos form, end to
   const inst = mkdtempSync(join(tmpdir(), 'w3-checkout-inst-'));
   mkdirSync(join(core, '.claude', 'skills'), { recursive: true });
   writeFileSync(join(core, '.claude', 'settings.json'), JSON.stringify({
-    permissions: { allow: ['Bash(node scripts/gds/claim.js:*)', 'Bash(node scripts/gds/api.js:*)', 'Bash(gh pr list:*)'] },
+    permissions: { allow: ['Bash(node scripts/bongos/claim.js:*)', 'Bash(node scripts/bongos/api.js:*)', 'Bash(gh pr list:*)'] },
   }));
   const res = m.materializeClaude({ coreRoot: core, instanceDir: inst, dryRun: false });
   assert.equal(res.settings, true);
   const allow = JSON.parse(readFileSync(join(inst, '.claude', 'settings.json'), 'utf8')).permissions.allow;
-  assert.deepEqual(allow, ['Bash(npx bongos claim:*)', 'Bash(npx bongos exec scripts/gds/api.js:*)', 'Bash(gh pr list:*)']);
+  assert.deepEqual(allow, ['Bash(npx bongos claim:*)', 'Bash(npx bongos exec scripts/bongos/api.js:*)', 'Bash(gh pr list:*)']);
   for (const rule of allow) assert.ok(m.STARTER_ALLOW.includes(rule), `${rule} is the starter's spelling too — one form, two sources`);
   rmSync(core, { recursive: true, force: true });
   rmSync(inst, { recursive: true, force: true });
@@ -1184,7 +1184,7 @@ t("an instance's OWN settings.json keeps every rule it has — only deny rules a
 // with its strings running into each other. The load-bearing assertion is therefore the
 // BYTE-EQUALITY one: the fix is not "rewrite it better", it is "do not rewrite what you
 // could not parse".
-const BROKEN_SETTINGS = '{"command": "node scripts/gds/strand-watch.js", }'; // one trailing comma from valid
+const BROKEN_SETTINGS = '{"command": "node scripts/bongos/strand-watch.js", }'; // one trailing comma from valid
 
 t('readSettingsTransform: malformed JSON is reported, not rewritten', () => {
   const dir = mkdtempSync(join(tmpdir(), 'w3-bad-'));
@@ -1204,7 +1204,7 @@ t('readSettingsTransform: malformed JSON is reported, not rewritten', () => {
 t('readSettingsTransform: valid JSON still gets the full rewrite', () => {
   const dir = mkdtempSync(join(tmpdir(), 'w3-good-'));
   const p = join(dir, 'settings.json');
-  writeFileSync(p, JSON.stringify({ permissions: { allow: ['Bash(node scripts/gds/ship.js:*)'] } }, null, 2));
+  writeFileSync(p, JSON.stringify({ permissions: { allow: ['Bash(node scripts/bongos/ship.js:*)'] } }, null, 2));
   const out = m.readSettingsTransform(p);
   assert.equal(out.parsed, true);
   assert.ok(out.text.includes('bongos'), 'the parseable path must still rewrite to the bongos bin');
@@ -1246,11 +1246,11 @@ const BARE_VERB = new RegExp(String.raw`(?<![\w@/.\-])(?<!npx )bongos (${Object.
 t('bongosify: a hand-written bare `bongos <verb>` takes the npx spelling too', () => {
   assert.equal(m.bongosify('paste `bongos paste-token <token>` back'), 'paste `npx bongos paste-token <token>` back');
   assert.equal(m.bongosify('run bongos upgrade --to 1.2.3'), 'run npx bongos upgrade --to 1.2.3');
-  assert.equal(m.bongosify('`bongos exec scripts/gds/api.js GET /x`'), '`npx bongos exec scripts/gds/api.js GET /x`');
+  assert.equal(m.bongosify('`bongos exec scripts/bongos/api.js GET /x`'), '`npx bongos exec scripts/bongos/api.js GET /x`');
 });
 
 t('bongosify: never double-prefixes, and is idempotent over its own output', () => {
-  for (const s of ['npx bongos ship 1', 'node scripts/gds/ship.js 1', 'bongos ship 1', '`bongos dev` then `node scripts/gds/start.js`']) {
+  for (const s of ['npx bongos ship 1', 'node scripts/bongos/ship.js 1', 'bongos ship 1', '`bongos dev` then `node scripts/bongos/start.js`']) {
     const once = m.bongosify(s);
     assert.ok(!once.includes('npx npx'), `double prefix from: ${s}`);
     assert.equal(m.bongosify(once), once, `a second run changed: ${s}`);
@@ -1284,9 +1284,9 @@ t('every core skill + routine, as a project receives it, carries no bare `bongos
   assert.deepEqual(offenders, []);
 });
 
-t('the core checkout\'s OWN skills are not rewritten: they still run node scripts/gds/*.js', () => {
+t('the core checkout\'s OWN skills are not rewritten: they still run node scripts/bongos/*.js', () => {
   const ship = readFileSync(join(ROOT, '.claude', 'skills', 'builder-ship', 'SKILL.md'), 'utf8');
-  assert.match(ship, /node scripts\/gds\/ship\.js/, 'the source skill keeps the checkout spelling');
+  assert.match(ship, /node scripts\/(?:gds|bongos)\/ship\.js/, 'the source skill keeps the checkout spelling');
   assert.ok(!ship.includes('npx bongos ship'), 'npx only appears on the way INTO a project');
 });
 
@@ -1337,14 +1337,14 @@ t('refreshStarterCliLines: an owner-reworded sentence and the rest of the file a
 });
 
 // The upgrade path. `bongos upgrade` calls materializeClaude({ coreRoot, instanceDir, log }) —
-// default overwrite — after moving the pin (scripts/gds/upgrade.js), so an EXISTING project picks
+// default overwrite — after moving the pin (scripts/bongos/upgrade.js), so an EXISTING project picks
 // all of this up on its next upgrade. This drives exactly that call against a project scaffolded
 // before task 1004621: old CLAUDE.md, the bare-`bongos` starter settings.json, old skills.
 function oldProjectFixture() {
   const core = mkdtempSync(join(tmpdir(), 'npx-core-'));
   const inst = mkdtempSync(join(tmpdir(), 'npx-inst-'));
   mkdirSync(join(core, '.claude', 'skills', 'alpha'), { recursive: true }); // package-only: no settings.json at the core root
-  writeFileSync(join(core, '.claude', 'skills', 'alpha', 'SKILL.md'), '---\nname: alpha\n---\nrun `node scripts/gds/ship.js 1`, or paste `bongos paste-token <token>`\n');
+  writeFileSync(join(core, '.claude', 'skills', 'alpha', 'SKILL.md'), '---\nname: alpha\n---\nrun `node scripts/bongos/ship.js 1`, or paste `bongos paste-token <token>`\n');
   mkdirSync(join(inst, '.claude', 'skills', 'alpha'), { recursive: true });
   writeFileSync(join(inst, '.claude', 'skills', 'alpha', 'SKILL.md'), '---\nname: alpha\n---\nrun `bongos ship 1`\n'); // what the old materialize wrote
   writeFileSync(join(inst, 'CLAUDE.md'), legacyStarter({ identity: { productName: 'Acme' } }));

package/tests/clawback_confirmed_backlog.mjs

@@ -52,14 +52,17 @@ const ok = (cond, msg) => { assert.ok(cond, msg); console.log(`  ok  ${msg}`); p
 
 try {
   await cleanup();
-  await q(`INSERT INTO versions (id,name,status,track) VALUES ($1,'cb','planning','internal') ON CONFLICT (id) DO NOTHING`, [VER]);
+  // 'building', not 'planning': at most one version may plan (versions_one_planning_idx,
+  // core_233) and the seeds already hold that slot, so a 'planning' row here fails setup (task 1004861).
+  await q(`INSERT INTO versions (id,name,status,track) VALUES ($1,'cb','building','internal') ON CONFLICT (id) DO NOTHING`, [VER]);
   await q(`INSERT INTO builders (id,github_id,github_login,display_name,rank) VALUES
            ($1,'cb-a','cb-a','CB A','thetes'), ($2,'cb-b','cb-b','CB B','thetes')`, [A, B]);
   // Two still-confirmed tasks (unlanded) + one legitimately shipped task.
-  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,shipped_by) VALUES
-           ($1,$4,'confirmed A','confirmed',20,'feature',$2),
-           ($5,$4,'confirmed B','confirmed',15,'feature',$3),
-           ($6,$4,'shipped legit','shipped',30,'feature',$2)`, [T_A, A, B, VER, T_B, T_S]);
+  // discipline is required since core_247 (the column default 'unclassified' fails its CHECK).
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,shipped_by,discipline) VALUES
+           ($1,$4,'confirmed A','confirmed',20,'feature',$2,'engineer'),
+           ($5,$4,'confirmed B','confirmed',15,'feature',$3,'engineer'),
+           ($6,$4,'shipped legit','shipped',30,'feature',$2,'engineer')`, [T_A, A, B, VER, T_B, T_S]);
   // Seed the credits the OLD confirm-time rule would have paid (credit_log INSERT
   // fires the total_credits trigger, exactly like a real award).
   await q(`INSERT INTO credit_log (builder_id,task_id,delta,reason,description) VALUES

package/tests/cli_allowlist_permissions.mjs

@@ -3,7 +3,7 @@
 // task 1051 (D): the blessed methodology CLI scripts must stay pre-allowed in the
 // project .claude/settings.json so a Claude session in auto permission mode
 // does not hard-DENY the very command it exists to run. The #1027 nightmare
-// dead-ended on `node scripts/gds/ship.js` at the auto classifier; this guards
+// dead-ended on `node scripts/bongos/ship.js` at the auto classifier; this guards
 // against that allow-rule being silently dropped.
 //
 // task 1004014: every check below runs once per SHELL TOOL. Claude Code's shell tool is
@@ -27,7 +27,7 @@ skipUnlessPresent('.claude/settings.json');
 const require = createRequire(import.meta.url);
 const guard = requireHostModule(require, '../.claude/hooks/git-guard.js');
 const { SHELL_TOOLS } = requireHostModule(require, '../.claude/hooks/shell-tools.js');
-const { STARTER_ALLOW, bongosify } = require('../scripts/gds/claude-materialize.js');
+const { STARTER_ALLOW, bongosify } = require('../scripts/bongos/claude-materialize.js');
 
 let passed = 0, failed = 0;
 function test(name, fn) {
@@ -49,11 +49,11 @@ const allowList = () => (settings.permissions && settings.permissions.allow) ||
 perTool('permissions.allow pre-allows the blessed ship/claim/reauth scripts (auto-mode would deny them otherwise)', (tool) => {
   const allow = allowList();
   // The exact command the #1027 nightmare hard-stopped on:
-  assert.ok(allow.includes(`${tool}(node scripts/gds/ship.js:*)`),
+  assert.ok(allow.includes(`${tool}(node scripts/bongos/ship.js:*)`),
     'ship.js MUST be pre-allowed — a session cannot complete a ship if its own classifier denies the command');
   // The rest of the core ship loop a session runs hands-free:
   for (const s of ['claim', 'reauth', 'release', 'paste-token']) {
-    assert.ok(allow.includes(`${tool}(node scripts/gds/${s}.js:*)`), `${s}.js should be pre-allowed`);
+    assert.ok(allow.includes(`${tool}(node scripts/bongos/${s}.js:*)`), `${s}.js should be pre-allowed`);
   }
 });
 
@@ -61,24 +61,24 @@ perTool('permissions.allow pre-allows the generic GDS API channel api.js (auto-m
   // task 1716 (completes 1051): every GDS operation without a dedicated script —
   // idea-triage promote, create-task, blocker-resolve, criterion ratify, goal
   // create, cost-via-API, security reports — rides the generic caller
-  // `node scripts/gds/api.js <METHOD> /api/gds/...`. If it is not pre-allowed, a
+  // `node scripts/bongos/api.js <METHOD> /api/gds/...`. If it is not pre-allowed, a
   // session in AUTO permission mode has the classifier
   // hard-DENY those writes as "[External System Writes] ... beyond the user's
   // request" — mistaking a sanctioned idea-triage session for scope creep. The
   // GDS server enforces builders.rank on every request (ADR 0016), so this rule
   // grants nothing beyond the caller's rank; it removes a redundant, weaker,
   // wrong harness prompt (owner-decided 2026-07-02, ADR 0104).
-  assert.ok(allowList().includes(`${tool}(node scripts/gds/api.js:*)`),
+  assert.ok(allowList().includes(`${tool}(node scripts/bongos/api.js:*)`),
     'api.js MUST be pre-allowed — the autonomous GDS loop (promote/create-task/blocker-resolve/cost) rides this generic channel; auto-mode denies it otherwise');
 });
 
-const SCRIPT_RULE = new RegExp(String.raw`^(${SHELL_TOOLS.join('|')})\(node scripts\/gds\/([a-z-]+)\.js:\*\)$`);
+const SCRIPT_RULE = new RegExp(String.raw`^(${SHELL_TOOLS.join('|')})\(node scripts\/(?:gds|bongos)\/([a-z-]+)\.js:\*\)$`);
 
 test('every allow-rule points at a script that actually exists (no inert rules)', () => {
   for (const rule of allowList()) {
     const m = rule.match(SCRIPT_RULE);
     if (!m) continue; // only audit the gds-script rules
-    const p = path.join(__dirname, '..', 'scripts', 'gds', `${m[2]}.js`);
+    const p = path.join(__dirname, '..', 'scripts', 'bongos', `${m[2]}.js`);
     assert.ok(fs.existsSync(p), `allow-rule references a missing script: ${m[2]}.js`);
   }
 });
@@ -217,7 +217,7 @@ const GIT_GH_COMMANDS = [
   // EXACT form, no `:*` (task 1004631, ADR 0369): with no argument shipping-mode.js only
   // READS the ship mode, which the agent must know before it ships. With `auto|manual` it
   // WRITES the project setting, so a prefix rule would pre-allow that write.
-  'node scripts/gds/shipping-mode.js',
+  'node scripts/bongos/shipping-mode.js',
 ];
 // gds CLIs audited read-only under EVERY flag they take — a prefix rule allows them all.
 // Audited and left OUT: backlog-review.js (POSTs from its default walk) and
@@ -307,12 +307,12 @@ test('every gds-script allow-rule is a blessed writer or an audited read-only CL
 perTool('the read-only subset is pre-allowed', (tool) => {
   for (const cmd of ['git status', 'git status --short', 'git branch --list', 'git fetch origin',
     'gh pr view 922', 'gh pr checks 922', 'gh pr list', 'gh run view 1 --log-failed', 'gh run list --limit 5',
-    ...READ_ONLY_CLIS.map((s) => `node scripts/gds/${s}.js`)]) {
+    ...READ_ONLY_CLIS.map((s) => `node scripts/bongos/${s}.js`)]) {
     assert.ok(allowCovers(allowList(), cmd, tool), `should run without a prompt: ${cmd}`);
   }
 });
 
-// Compared as SETS: the core carries both `node scripts/gds/paste-token.js:*` (what its skills
+// Compared as SETS: the core carries both `node scripts/bongos/paste-token.js:*` (what its skills
 // run) and `npx bongos paste-token:*` (what Settings → CLI access hands out, task 1004575), and
 // in a project both are the one `npx bongos paste-token:*` rule (task 1004621).
 test('the instance starter mirrors this list in its `npx bongos` form (claude-materialize.js STARTER_ALLOW)', () => {