@bongos/core 1.21.175 → 1.21.177

package/tests/diagram_facts_offset.mjs

@@ -17,7 +17,7 @@ import path from 'node:path';
 const require = createRequire(import.meta.url);
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const REPO = path.join(__dirname, '..');
-const facts = require(path.join(REPO, 'scripts/gds/diagram-facts.js'));
+const facts = require(path.join(REPO, 'scripts/bongos/diagram-facts.js'));
 
 const ORIGIN_IDS = Object.keys({
   ...facts.CONCEPTUAL_TASK_IDS,

package/tests/diagram_repo_slug.mjs

@@ -54,7 +54,7 @@ function slugWith(pack) {
   try {
     const out = execFileSync(
       process.execPath,
-      ['-e', 'process.stdout.write(JSON.stringify(require("./scripts/gds/diagram-facts.js").repoSlug()))'],
+      ['-e', 'process.stdout.write(JSON.stringify(require("./scripts/bongos/diagram-facts.js").repoSlug()))'],
       { cwd: REPO, encoding: 'utf8', env: { ...process.env, BONGOS_BRANDING_FILE: file } },
     );
     return JSON.parse(out);

package/tests/diff_derived_signals.mjs

@@ -15,7 +15,7 @@ import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const ship = require('../scripts/gds/ship.js');
+const ship = require('../scripts/bongos/ship.js');
 // achievements carved into modules/economy/ (BV1.R77 / ADR 0093 §1-2).
 const achievements = require('../modules/economy/achievements.js');
 const learnings = require('../modules/memory/learnings.js');
@@ -40,7 +40,7 @@ test('deriveTagsFromPaths: empty / globby input falls back to "pms"', () => {
 
 test('deriveTagsFromPaths: art + scripts paths', () => {
   assert.deepEqual(
-    ship.deriveTagsFromPaths(['art/generated/tiles/x.png', 'scripts/gds/ship.js']).sort(),
+    ship.deriveTagsFromPaths(['art/generated/tiles/x.png', 'scripts/bongos/ship.js']).sort(),
     ['art', 'scripts'],
   );
 });

package/tests/dns_preflight.mjs

@@ -1,10 +1,10 @@
 // tests/dns_preflight.mjs — DB-free unit tests for the DNS token-scope preflight
-// (scripts/gds/provision.js classifyZoneScope + checkDnsTokenScope, task 1980).
+// (scripts/bongos/provision.js classifyZoneScope + checkDnsTokenScope, task 1980).
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
-const prov = require('../scripts/gds/provision.js');
+const prov = require('../scripts/bongos/provision.js');
 
 test('classifyZoneScope: a token that sees the zone is reachable', () => {
   const r = prov.classifyZoneScope({ status: 200, body: { success: true, result: [{ name: 'example.com', id: 'z1' }] }, zone: 'example.com' });

package/tests/do_api.mjs

@@ -1,7 +1,7 @@
-// tests/do_api.mjs — the control plane's DigitalOcean client (scripts/gds/do-api.js).
+// tests/do_api.mjs — the control plane's DigitalOcean client (scripts/bongos/do-api.js).
 //
 // Pins the dry-run/live contract and the droplet-settle poll that instance
-// provisioning (scripts/gds/provision.js) relies on — with NO network (an injected
+// provisioning (scripts/bongos/provision.js) relies on — with NO network (an injected
 // fetch) and NO real clock (an injected sleepFn). Given its own file by task
 // 1003893, when the suite it used to share was retired with its other subject.
 //
@@ -11,7 +11,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { DoApi, DoApiError } = require('../scripts/gds/do-api.js');
+const { DoApi, DoApiError } = require('../scripts/bongos/do-api.js');
 
 let passed = 0;
 let failed = 0;

package/tests/doc_cli_guard.mjs

@@ -18,7 +18,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const g = require(path.join(ROOT, 'scripts', 'gds', 'doc-cli-guard.js'));
+const g = require(path.join(ROOT, 'scripts', 'bongos', 'doc-cli-guard.js'));
 
 // A tiny injected world: doc text and script source, by path.
 const world = (docs, scripts) => ({
@@ -50,9 +50,9 @@ test('an empty enumeration FAILS rather than passing quietly', () => {
 // ---- the regression that motivated the check ------------------------------
 test('THE 1002931 CASE: a doc naming a flag the script does not have is caught', () => {
   const { violations } = g.scanDocs(['skill.md'], world(
-    { 'skill.md': 'Run `node scripts/gds/capture.js --full --fields-file f.json`.' },
+    { 'skill.md': 'Run `node scripts/bongos/capture.js --full --fields-file f.json`.' },
     // capture.js as it was on the OTHER machine: no --full, no --fields-file.
-    { 'scripts/gds/capture.js': "const text = process.argv.slice(2).join(' ');" },
+    { 'scripts/bongos/capture.js': "const text = process.argv.slice(2).join(' ');" },
   ));
   assert.equal(violations.length, 2, violations.join('\n'));
   assert.ok(violations.some((v) => v.includes('--full')));
@@ -62,15 +62,15 @@ test('THE 1002931 CASE: a doc naming a flag the script does not have is caught',
 
 test('the same doc PASSES once the script really carries the flags', () => {
   const { violations } = g.scanDocs(['skill.md'], world(
-    { 'skill.md': 'Run `node scripts/gds/capture.js --full --fields-file f.json`.' },
-    { 'scripts/gds/capture.js': "const full = args.includes('--full'); const ff = arg('--fields-file');" },
+    { 'skill.md': 'Run `node scripts/bongos/capture.js --full --fields-file f.json`.' },
+    { 'scripts/bongos/capture.js': "const full = args.includes('--full'); const ff = arg('--fields-file');" },
   ));
   assert.deepEqual(violations, []);
 });
 
 test('a doc naming a script that does not exist is caught', () => {
   const { violations } = g.scanDocs(['skill.md'], world(
-    { 'skill.md': 'run `node scripts/gds/art-stage.js` to publish' }, {},
+    { 'skill.md': 'run `node scripts/bongos/art-stage.js` to publish' }, {},
   ));
   assert.equal(violations.length, 1);
   assert.match(violations[0], /does not exist/);
@@ -86,12 +86,12 @@ test('every real argv idiom in this repo is accepted', () => {
     'argVal(args, x)': "const v = argVal(args, '--development');",
     'strict equality': "else if (a === '--development') on = true;",
     'Set.has': "const on = ARGS.has('--development');",
-    'usage text only': '//   node scripts/gds/x.js --development <path>',
+    'usage text only': '//   node scripts/bongos/x.js --development <path>',
   };
   for (const [label, src] of Object.entries(idioms)) {
     const { violations } = g.scanDocs(['d.md'], world(
-      { 'd.md': 'run `node scripts/gds/x.js --development p.json`' },
-      { 'scripts/gds/x.js': src },
+      { 'd.md': 'run `node scripts/bongos/x.js --development p.json`' },
+      { 'scripts/bongos/x.js': src },
     ));
     assert.deepEqual(violations, [], `${label} must be accepted`);
   }
@@ -104,8 +104,8 @@ test('a LONGER flag in the source does not satisfy a shorter documented one', ()
   // case passes with or without the guard, so it proves nothing — the first
   // draft of this test had it backwards and a mutation run caught it.
   const { violations } = g.scanDocs(['d.md'], world(
-    { 'd.md': 'run `node scripts/gds/x.js --client abc`' },
-    { 'scripts/gds/x.js': "const c = argVal(args, '--client-id');" },
+    { 'd.md': 'run `node scripts/bongos/x.js --client abc`' },
+    { 'scripts/bongos/x.js': "const c = argVal(args, '--client-id');" },
   ));
   assert.equal(violations.length, 1, 'a longer flag must not satisfy a shorter one');
   assert.match(violations[0], /--client\b/);
@@ -113,8 +113,8 @@ test('a LONGER flag in the source does not satisfy a shorter documented one', ()
 
 test('and the exact documented flag is still accepted alongside a longer sibling', () => {
   const { violations } = g.scanDocs(['d.md'], world(
-    { 'd.md': 'run `node scripts/gds/x.js --client abc`' },
-    { 'scripts/gds/x.js': "argVal(args, '--client-id'); argVal(args, '--client');" },
+    { 'd.md': 'run `node scripts/bongos/x.js --client abc`' },
+    { 'scripts/bongos/x.js': "argVal(args, '--client-id'); argVal(args, '--client');" },
   ));
   assert.deepEqual(violations, []);
 });
@@ -122,8 +122,8 @@ test('and the exact documented flag is still accepted alongside a longer sibling
 test('flags do not leak across two invocations in one doc', () => {
   // b.js carries --beta, a.js does not; only a.js/--alpha may be flagged.
   const { violations } = g.scanDocs(['d.md'], world(
-    { 'd.md': 'first `node scripts/gds/a.js --alpha`\nthen `node scripts/gds/b.js --beta`' },
-    { 'scripts/gds/a.js': 'nothing here', 'scripts/gds/b.js': "arg('--beta')" },
+    { 'd.md': 'first `node scripts/bongos/a.js --alpha`\nthen `node scripts/bongos/b.js --beta`' },
+    { 'scripts/bongos/a.js': 'nothing here', 'scripts/bongos/b.js': "arg('--beta')" },
   ));
   assert.equal(violations.length, 1, violations.join('\n'));
   assert.match(violations[0], /a\.js.*--alpha/);
@@ -131,17 +131,17 @@ test('flags do not leak across two invocations in one doc', () => {
 
 test('universal plumbing flags are not reported', () => {
   const { violations } = g.scanDocs(['d.md'], world(
-    { 'd.md': 'run `node scripts/gds/x.js --quiet --json --help --dry-run`' },
-    { 'scripts/gds/x.js': 'no flags at all' },
+    { 'd.md': 'run `node scripts/bongos/x.js --quiet --json --help --dry-run`' },
+    { 'scripts/bongos/x.js': 'no flags at all' },
   ));
   assert.deepEqual(violations, []);
 });
 
 // ---- the allowlist -------------------------------------------------------
 test('an allowlisted invocation is tolerated — and covers its own flags', () => {
-  const allow = new Map([['d.md::scripts/gds/gone.js', 'ships with an excluded host module']]);
+  const allow = new Map([['d.md::scripts/bongos/gone.js', 'ships with an excluded host module']]);
   const { violations } = g.scanDocs(['d.md'], {
-    readDoc: () => 'run `node scripts/gds/gone.js --whatever`',
+    readDoc: () => 'run `node scripts/bongos/gone.js --whatever`',
     readScript: () => null,
     allow,
   });
@@ -164,8 +164,8 @@ test('a flag surviving ONLY in a usage comment warns without failing', () => {
   // scripts legitimately name a flag only in their banner and handle it via a
   // helper, and failing on that is what sank the first draft.
   const { violations, warnings } = g.scanDocs(['d.md'], world(
-    { 'd.md': 'run `node scripts/gds/x.js --gone`' },
-    { 'scripts/gds/x.js': '// usage: x.js --gone <path>\nconst nothing = 1;' },
+    { 'd.md': 'run `node scripts/bongos/x.js --gone`' },
+    { 'scripts/bongos/x.js': '// usage: x.js --gone <path>\nconst nothing = 1;' },
   ));
   assert.deepEqual(violations, [], 'a comment-only mention must not fail the build');
   assert.equal(warnings.length, 1);
@@ -174,29 +174,29 @@ test('a flag surviving ONLY in a usage comment warns without failing', () => {
 
 test('a flag present in real code produces NO warning', () => {
   const { violations, warnings } = g.scanDocs(['d.md'], world(
-    { 'd.md': 'run `node scripts/gds/x.js --live`' },
-    { 'scripts/gds/x.js': "// usage: x.js --live\nconst on = args.includes('--live');" },
+    { 'd.md': 'run `node scripts/bongos/x.js --live`' },
+    { 'scripts/bongos/x.js': "// usage: x.js --live\nconst on = args.includes('--live');" },
   ));
   assert.deepEqual(violations, []);
   assert.deepEqual(warnings, []);
 });
 
-test('a scripts/gds/ shim is read together with the module CLI it forwards to (task 1003324)', () => {
-  // scripts/gds/validate-design.js is `require('../../modules/ui-design/scripts/validate-design.js')`
+test('a scripts/bongos/ shim is read together with the module CLI it forwards to (task 1003324)', () => {
+  // scripts/bongos/validate-design.js is `require('../../modules/ui-design/scripts/validate-design.js')`
   // plus a usage banner; `--strict` is parsed in the module file. Read alone, the shim
   // would only ever say "named in comments" for a flag that is genuinely honoured.
-  const src = g.readCliSource('scripts/gds/validate-design.js');
+  const src = g.readCliSource('scripts/bongos/validate-design.js');
   assert.ok(src, 'the shim exists');
   assert.ok(g.scriptMentionsFlag(g.stripLineComments(src), 'strict'),
     'the flag is found in CODE — the module CLI was followed, not just the shim banner');
   const { violations, warnings } = g.scanDocs(['d.md'], {
-    readDoc: () => 'run `node scripts/gds/validate-design.js --strict`',
+    readDoc: () => 'run `node scripts/bongos/validate-design.js --strict`',
     readScript: g.readCliSource, allow: new Map(),
   });
   assert.deepEqual(violations, []);
   assert.deepEqual(warnings, [], 'no "only in comments" warning for a shim-forwarded flag');
   // Bounded: a require into src/ is NOT followed (it is not a CLI phase).
-  assert.ok(!g.readCliSource('scripts/gds/fitness.js').includes('function requireBuilder'),
+  assert.ok(!g.readCliSource('scripts/bongos/fitness.js').includes('function requireBuilder'),
     'a core internal the CLI requires is not concatenated into its source');
 });
 

package/tests/doc_comment_coverage.mjs

@@ -20,7 +20,7 @@ import path from 'node:path';
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const { checkDocCommentCoverage, scanHeaders, leadingComment, wordCount, MIN_WORDS } =
-  require(path.join(ROOT, 'scripts', 'gds', 'doc-comment-coverage.js'));
+  require(path.join(ROOT, 'scripts', 'bongos', 'doc-comment-coverage.js'));
 
 const FILES = {
   'src/no-header.js': "const x = require('y');\nmodule.exports = x;\n",

package/tests/doc_control_claims.mjs

@@ -10,7 +10,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const dcc = require(path.join(ROOT, 'scripts', 'gds', 'doc-control-claims.js'));
+const dcc = require(path.join(ROOT, 'scripts', 'bongos', 'doc-control-claims.js'));
 
 // A fake tree: docs maps path -> text; `present` is the set of artifacts on disk.
 function run(docs, present = [], allow = new Map()) {
@@ -40,7 +40,7 @@ test('the same sentence is clean once the artifact exists', () => {
 });
 
 test('each kind of enforcement artifact is recognised', () => {
-  for (const a of ['.claude/hooks/x-gate.js', '.github/workflows/x.yml', 'scripts/gds/x-guard.js', '.husky/x.sh', 'scripts/hooks/x.sh']) {
+  for (const a of ['.claude/hooks/x-gate.js', '.github/workflows/x.yml', 'scripts/bongos/x-guard.js', '.husky/x.sh', 'scripts/hooks/x.sh']) {
     const r = run({ 'docs/x.md': `The \`${a}\` hook blocks every bad write.\n` });
     assert.equal(r.violations.length, 1, `${a} should be a claim`);
   }
@@ -69,15 +69,15 @@ test('history is not a claim: a sentence about what was removed does not trip it
 });
 
 test('a mention without control vocabulary is not a claim', () => {
-  const r = run({ 'docs/x.md': 'See `scripts/gds/old-seed.js` for the shape of a TASKS array.\n' });
+  const r = run({ 'docs/x.md': 'See `scripts/bongos/old-seed.js` for the shape of a TASKS array.\n' });
   assert.deepEqual(r.violations, []);
 });
 
 test('a path\'s own NAME never decides the wording, in either direction', () => {
   // `x-guard.js` must not make a plain pointer read as a control claim...
-  assert.deepEqual(run({ 'docs/x.md': 'See `scripts/gds/x-guard.js` for the shape of a TASKS array.\n' }).violations, []);
+  assert.deepEqual(run({ 'docs/x.md': 'See `scripts/bongos/x-guard.js` for the shape of a TASKS array.\n' }).violations, []);
   // ...and `gone.yml` / `replaced.js` must not make a live claim read as history.
-  for (const a of ['.github/workflows/gone.yml', 'scripts/gds/replaced.js']) {
+  for (const a of ['.github/workflows/gone.yml', 'scripts/bongos/replaced.js']) {
     assert.equal(run({ 'docs/x.md': `The \`${a}\` gate blocks every PR.\n` }).violations.length, 1, a);
   }
 });
@@ -100,14 +100,14 @@ test('dated records describe a moment, not the tree, and are skipped', () => {
 });
 
 test('an allowlisted claim passes, and says so by being counted', () => {
-  const docs = { 'docs/adr/0996-x.md': 'The `scripts/gds/box.js` runner gates every box.\n' };
-  const r = run(docs, [], new Map([['docs/adr/0996-x.md::scripts/gds/box.js', 'retired by a later ADR']]));
+  const docs = { 'docs/adr/0996-x.md': 'The `scripts/bongos/box.js` runner gates every box.\n' };
+  const r = run(docs, [], new Map([['docs/adr/0996-x.md::scripts/bongos/box.js', 'retired by a later ADR']]));
   assert.deepEqual(r.violations, []);
   assert.equal(r.claims.length, 1);
 });
 
 test('a STALE allowance is itself a violation, so a fixed doc cannot leave a dead exception', () => {
-  const r = run({ 'docs/x.md': 'Nothing here.\n' }, [], new Map([['docs/x.md::scripts/gds/box.js', 'was true once']]));
+  const r = run({ 'docs/x.md': 'Nothing here.\n' }, [], new Map([['docs/x.md::scripts/bongos/box.js', 'was true once']]));
   assert.equal(r.violations.length, 1);
   assert.match(r.violations[0], /stale allowance/);
 });
@@ -126,8 +126,8 @@ test('an empty enumeration is a broken scan, not a clean result', () => {
 
 test('the guard is wired: fitness runs it and the control manifest lists it', async () => {
   const fs = await import('node:fs');
-  const fitness = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'fitness.js'), 'utf8');
+  const fitness = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'fitness.js'), 'utf8');
   assert.match(fitness, /require\('\.\/doc-control-claims\.js'\)\.checkDocControlClaims/);
-  const cm = require(path.join(ROOT, 'scripts', 'gds', 'control-manifest.js'));
-  assert.ok(cm.CONTROLS.some((c) => c.file === 'scripts/gds/doc-control-claims.js'), 'listed in the manifest');
+  const cm = require(path.join(ROOT, 'scripts', 'bongos', 'control-manifest.js'));
+  assert.ok(cm.CONTROLS.some((c) => c.file === 'scripts/bongos/doc-control-claims.js'), 'listed in the manifest');
 });

package/tests/docs_entropy.mjs

@@ -18,7 +18,7 @@ import path from 'node:path';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const SCANNER = path.join(ROOT, 'scripts', 'gds', 'docs-entropy.js');
+const SCANNER = path.join(ROOT, 'scripts', 'bongos', 'docs-entropy.js');
 const { collectMarkdownFiles, parseFile, scanDuplicateProse } = require(SCANNER); // require.main-guarded → no scan on import
 
 test('collectMarkdownFiles passes the glob as an argv array, never a shell string', () => {
@@ -113,7 +113,7 @@ test('parseFile slugs a CRLF heading without a trailing carriage return', () =>
 
 test('parseFile ignores a leading BOM, so a BOM file is not one heading short', () => {
   // Same class, different byte: PowerShell writes UTF-8 WITH BOM by default
-  // (scripts/gds/CLAUDE.md warns about this for JSON bodies) and
+  // (scripts/bongos/CLAUDE.md warns about this for JSON bodies) and
   // readFileSync('utf8') does not strip it — the BOM would sit before the first
   // '#' and hide that heading.
   const withBom = parseString('' + DOC_LINES.join('\r\n'));

package/tests/docs_openapi_route.mjs

@@ -52,11 +52,13 @@ test('/docs/openapi.json serves a valid OpenAPI 3.1 spec with CORS', async () =>
     assert.equal(spec.openapi, '3.1.0');
     assert.ok(spec.paths && Object.keys(spec.paths).length > 0, 'spec advertises paths');
     assert.ok(spec.info && spec.info.title, 'spec carries an info.title');
-    // Zero behaviour change on a healthy deploy: when the committed spec is present
-    // (the common case) it is served verbatim — the committed file wins, generation
-    // is only the fallback tier.
-    const committed = fs.readFileSync(path.join(ROOT, 'docs/api/openapi.json'), 'utf8');
-    assert.equal(body, committed, 'served bytes equal the committed spec (committed file preferred over generation)');
+    // A packaged spec on disk (every core tarball carries one) is served verbatim; a fresh
+    // checkout has none — it is gitignored, task 1004866 — so the generated tier serves.
+    const onDisk = path.join(ROOT, 'docs/api/openapi.json');
+    const expected = fs.existsSync(onDisk)
+      ? fs.readFileSync(onDisk, 'utf8')
+      : JSON.stringify(require('../scripts/bongos/gen-api-docs.js').build().spec, null, 2) + '\n';
+    assert.equal(body, expected, 'served bytes equal the file on disk, else the spec generated from the routes');
   });
 });
 
@@ -102,7 +104,7 @@ test('resolveOpenapiJson: degrades to empty string (→ 404) instead of crashing
 test('the in-process generation tier really yields a structurally valid spec', () => {
   // This is the tier that heals a standalone/missing-file deploy: no file on disk,
   // spec built from the live route source. Prove it produces a valid OpenAPI 3.1.
-  const gen = require('../scripts/gds/gen-api-docs.js');
+  const gen = require('../scripts/bongos/gen-api-docs.js');
   const { spec } = gen.build();
   assert.equal(spec.openapi, '3.1.0');
   assert.ok(Object.keys(spec.paths).length > 0, 'generated spec advertises paths');

package/tests/doctor_hooks.mjs

@@ -25,7 +25,7 @@ import { createRequire } from 'node:module';
 import path from 'node:path';
 
 const require = createRequire(import.meta.url);
-const { classifyHooksState, classifyPreCommitState } = require('../scripts/gds/doctor.js');
+const { classifyHooksState, classifyPreCommitState } = require('../scripts/bongos/doctor.js');
 
 let passed = 0;
 let failed = 0;

package/tests/edit_hints.mjs

@@ -24,7 +24,6 @@ test('each generator input maps to its generator; unrelated paths map to nothing
     ['modules/hall-ui/public/roster.js', 'copy-inventory.js'],
     ['modules/status-ui/public/index.html', 'copy-inventory.js'],
     ['src/bongos/auth.js', 'gen-repo-map.js'],
-    ['modules/lifecycle/routes/claims.js', 'gen-api-docs.js'],
     ['.claude/skills/status/SKILL.md', 'gen-file-map.js'],
     ['docs/session-logs/2026-09-03-x.md', 'gen-session-index.js'],
     ['docs/adr/0236-something.md', 'fitness.js'],
@@ -33,7 +32,9 @@ test('each generator input maps to its generator; unrelated paths map to nothing
     const h = hints.generatorHint(p);
     assert.ok(h && h.includes(gen), `${p} → expected ${gen}, got ${h}`);
   }
-  for (const p of ['README.md', 'tests/foo.mjs', 'modules/hall-ui/CLAUDE.md', 'scripts/gds/ship.js']) {
+  // task 1004866: a route edit stales no TRACKED file any more (the API spec, reference and
+  // client are gitignored), so a hint to regenerate and commit them would be wrong advice.
+  for (const p of ['README.md', 'tests/foo.mjs', 'modules/hall-ui/CLAUDE.md', 'scripts/bongos/ship.js', 'modules/lifecycle/routes/claims.js']) {
     assert.equal(hints.generatorHint(p), null, `${p} should be silent`);
   }
 });

package/tests/effective_visibility_predicate.mjs

@@ -145,24 +145,6 @@ const SPELLING_EXEMPTIONS = [
     obligation: (code) => !/\.query\s*\(/.test(code) && !/require\(\s*'pg'\s*\)/.test(code),
     demands: 'issues no database query and loads no database driver — it answers from fixtures only',
   },
-  {
-    file: 'scripts/gds/seed-bv1-privacy-invites-tasks.js',
-    allow: [
-      { text: "profile_state='", count: 1, why: 'a one-shot historical seeder: this sits inside a task DESCRIPTION string, quoting the predicate as prose describing the work to be done. Its subject IS this predicate.' },
-      { text: 'NOT hide_stats', count: 1, why: 'the second half of that same quoted sentence in that same task description — prose, not a query.' },
-    ],
-    obligation: (code) => !/\.query\s*\(/.test(code),
-    demands: 'issues no database query at all — it posts task rows over HTTP',
-  },
-  {
-    file: 'scripts/gds/seed-bv1-r01-delta-tasks.js',
-    allow: [
-      { text: "profile_state='", count: 1, why: 'the ADR 0171 R01 seeder: the predicate is quoted as prose inside the task briefs this script files, the same shape as the privacy seeder above.' },
-      { text: 'NOT hide_stats', count: 1, why: 'the second half of that same quoted sentence in that same brief — prose describing work, never executed.' },
-    ],
-    obligation: (code) => !/\.query\s*\(/.test(code),
-    demands: 'issues no database query at all — it posts task rows over HTTP',
-  },
 ];
 
 // Every SELECT against platform_identity_accounts that is deliberately NOT a
@@ -1150,7 +1132,7 @@ server.close();
 console.log('\ncoverage:');
 
 t('this guard runs in the DB-free unit lane (it is not parked as integration or known-failing)', () => {
-  const runner = fs.readFileSync(path.join(repo, 'scripts', 'gds', 'run-unit-tests.js'), 'utf8');
+  const runner = fs.readFileSync(path.join(repo, 'scripts', 'bongos', 'run-unit-tests.js'), 'utf8');
   assert.ok(
     !/effective_visibility_predicate/.test(runner),
     'effective_visibility_predicate is named in run-unit-tests.js — parked into INTEGRATION or KNOWN_FAILING it would gate nothing (task 1002282)'

package/tests/env_knobs_neutral_prefix.mjs

@@ -74,7 +74,7 @@ test('DEPLOY_MODE: <PREFIX>_DEPLOY_MODE pins the mode, with no gh probe', () =>
   // 'laptop' from the env is honoured as-is. Ignored, the same run would probe gh
   // (absent here), find no credential and fall back to 'ci'.
   const out = runNode(
-    "console.log(require('./scripts/gds/ship-deploy-target.js').resolveDeployMode())",
+    "console.log(require('./scripts/bongos/ship-deploy-target.js').resolveDeployMode())",
     { ...envWith('DEPLOY_MODE', 'laptop'), PATH: EMPTY_BIN },
   );
   assert.equal(out.split('\n').pop(), 'laptop');
@@ -82,18 +82,18 @@ test('DEPLOY_MODE: <PREFIX>_DEPLOY_MODE pins the mode, with no gh probe', () =>
 
 test('PUSH_VIA_SERVER: <PREFIX>_PUSH_VIA_SERVER=0 forces the local push path', () => {
   const out = runNode(
-    "console.log(require('./scripts/gds/ship-deploy-target.js').pushVia())",
+    "console.log(require('./scripts/bongos/ship-deploy-target.js').pushVia())",
     { ...envWith('PUSH_VIA_SERVER', '0'), PATH: EMPTY_BIN },
   );
   assert.equal(out, 'local', 'with no gh on PATH, only the override can answer local');
 });
 
 test('ALLOW_MAIN_PUSH: push-main.js writes the canonical spelling, and the hook obeys it', () => {
-  const { pushEnv } = require('../scripts/gds/push-main.js');
+  const { pushEnv } = require('../scripts/bongos/push-main.js');
   const env = pushEnv({ PATH: process.env.PATH, HOME: process.env.HOME });
   assert.equal(env[canonical('ALLOW_MAIN_PUSH')], '1', 'the writer uses this instance\'s own prefix');
 
-  const hook = path.join(ROOT, 'scripts', 'gds', 'hooks', 'pre-push.js');
+  const hook = path.join(ROOT, 'scripts', 'bongos', 'hooks', 'pre-push.js');
   const sha = 'a'.repeat(40);
   const push = (e) => spawnSync(process.execPath, [hook, 'origin', 'https://example.invalid/repo.git'], {
     cwd: ROOT, input: `refs/heads/main ${sha} refs/heads/main ${sha}\n`, encoding: 'utf8', env: e,
@@ -105,7 +105,7 @@ test('ALLOW_MAIN_PUSH: push-main.js writes the canonical spelling, and the hook
 });
 
 test('CLAUDE_BIN: the preflight probe, the Autobongos worker and its env allowlist', () => {
-  const { preflightChecks } = require('../scripts/gds/preflight.js');
+  const { preflightChecks } = require('../scripts/bongos/preflight.js');
   let seen = null;
   const spy = (bin) => { seen = bin; return { status: 0, stdout: 'x\n' }; };
   const fsOk = { existsSync: () => true };
@@ -114,7 +114,7 @@ test('CLAUDE_BIN: the preflight probe, the Autobongos worker and its env allowli
   const row = r.find((x) => x.title === 'claude CLI');
   assert.match(row.detail, new RegExp(`via ${canonical('CLAUDE_BIN')}`), 'the label names the spelling that supplied it');
 
-  const runner = require('../scripts/gds/autobongos-run.js');
+  const runner = require('../scripts/bongos/autobongos-run.js');
   assert.equal(runner.resolveWorkerBin({ [canonical('CLAUDE_BIN')]: '/x/claude' }, 'linux').bin, '/x/claude');
   const wenv = runner.workerEnv({ [canonical('CLAUDE_BIN')]: '/x/claude', DATABASE_URL: 'postgres://secret' });
   assert.equal(wenv[canonical('CLAUDE_BIN')], '/x/claude', 'the worker receives the canonical spelling');
@@ -143,8 +143,8 @@ test('CLAUDE_BIN: the grader spawns the binary <PREFIX>_CLAUDE_BIN names', async
 });
 
 test('COST_CRON_ROUTINE: run-routine.js writes the canonical name and session-cost.js reads it', () => {
-  const { stepEnv } = require('../scripts/gds/run-routine.js');
-  const { cronRoutineFromEnv } = require('../scripts/gds/session-cost.js');
+  const { stepEnv } = require('../scripts/bongos/run-routine.js');
+  const { cronRoutineFromEnv } = require('../scripts/bongos/session-cost.js');
   const env = stepEnv('bfg', {});
   assert.equal(env[canonical('COST_CRON_ROUTINE')], 'bfg', 'the writer uses this instance\'s own prefix');
   assert.equal(cronRoutineFromEnv(env), 'bfg', 'the reader finds what the writer wrote');
@@ -153,13 +153,13 @@ test('COST_CRON_ROUTINE: run-routine.js writes the canonical name and session-co
 });
 
 test('ROUTINE_ALERT_CHANNEL: <PREFIX>_ROUTINE_ALERT_CHANNEL picks the alert channel', () => {
-  const { alertChannel } = require('../scripts/gds/run-routine.js');
+  const { alertChannel } = require('../scripts/bongos/run-routine.js');
   assert.equal(alertChannel({ [canonical('ROUTINE_ALERT_CHANNEL')]: 'ops' }), 'ops');
   assert.equal(alertChannel({}), 'ship_feed');
 });
 
 test('COST_LEDGER: <PREFIX>_COST_LEDGER is the first place a ledger is looked for', () => {
-  const { knownLedgerPaths } = require('../scripts/gds/backfill-cost.js');
+  const { knownLedgerPaths } = require('../scripts/bongos/backfill-cost.js');
   assert.equal(knownLedgerPaths({ [canonical('COST_LEDGER')]: '/data/cost_ledger.jsonl' })[0], '/data/cost_ledger.jsonl');
 });
 
@@ -177,7 +177,7 @@ test('MEMORY_DIR: <PREFIX>_MEMORY_DIR is where memory-map.js reads MEMORY.md', (
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'knobs-memory-'));
   try {
     fs.writeFileSync(path.join(dir, 'MEMORY.md'), '# Memory index\n\n- [a note](a.md) — one line\n');
-    const r = spawnSync(process.execPath, ['scripts/gds/memory-map.js'], { cwd: ROOT, env: envWith('MEMORY_DIR', dir), encoding: 'utf8' });
+    const r = spawnSync(process.execPath, ['scripts/bongos/memory-map.js'], { cwd: ROOT, env: envWith('MEMORY_DIR', dir), encoding: 'utf8' });
     assert.equal(r.status, 0, r.stderr);
     assert.match(r.stdout, /^map: \d+ bytes/m, 'it measured the map in that directory (ignored, it prints usage and exits 2)');
   } finally {
@@ -186,7 +186,7 @@ test('MEMORY_DIR: <PREFIX>_MEMORY_DIR is where memory-map.js reads MEMORY.md', (
 });
 
 test('AUDIT_RANGE: <PREFIX>_AUDIT_RANGE is the range main-audit.js audits, and --range still wins', () => {
-  const { requestedRange } = require('../scripts/gds/main-audit.js');
+  const { requestedRange } = require('../scripts/bongos/main-audit.js');
   assert.equal(requestedRange(undefined, { [canonical('AUDIT_RANGE')]: 'abc123..HEAD' }), 'abc123..HEAD');
   assert.equal(requestedRange('def456..HEAD', { [canonical('AUDIT_RANGE')]: 'abc123..HEAD' }), 'def456..HEAD',
     'the flag the deploy gate and CI pass beats any env value');
@@ -196,7 +196,7 @@ test('AUDIT_RANGE: <PREFIX>_AUDIT_RANGE is the range main-audit.js audits, and -
 
 test('ONBOARDING_WINDOW_DAYS: <PREFIX>_ONBOARDING_WINDOW_DAYS sets the window', () => {
   const out = runNode(
-    "console.log(require('./scripts/gds/onboarding-config.js').windowDays())",
+    "console.log(require('./scripts/bongos/onboarding-config.js').windowDays())",
     envWith('ONBOARDING_WINDOW_DAYS', '3'),
   );
   assert.equal(out, '3');

package/tests/exec_path_guard.mjs

@@ -19,10 +19,10 @@ import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 
 // fileURLToPath, not URL.pathname. Both a test (tests/test_path_guard.mjs) and a
-// fitness check (scripts/gds/test-path-guard.js, Check 30) reject the pathname form.
+// fitness check (scripts/bongos/test-path-guard.js, Check 30) reject the pathname form.
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
-const g = require(path.join(ROOT, 'scripts', 'gds', 'exec-path-guard.js'));
+const g = require(path.join(ROOT, 'scripts', 'bongos', 'exec-path-guard.js'));
 
 const scan = (src, rel = 'modules/probe/x.js') => g.scanFile(rel, src);
 const CP = "const { execFile, execFileSync, spawn, execSync } = require('node:child_process');\n";
@@ -127,8 +127,8 @@ test('a template rooted at __dirname is still static', () => {
 test('an UNBOUND require(...).execFileSync(runtimePath) is caught', () => {
   // The gap that failed the first grade. This form binds no name, and the first draft
   // short-circuited the whole file on "no bindings" — so a file spawning this way was
-  // skipped entirely. Not hypothetical: scripts/gds/autonomy-gate.js and
-  // scripts/gds/ship-land.js already use exactly this shape.
+  // skipped entirely. Not hypothetical: scripts/bongos/autonomy-gate.js and
+  // scripts/bongos/ship-land.js already use exactly this shape.
   const f = scan("require('node:child_process').execFileSync(process.execPath, [path.join(work, rel)]);");
   assert.equal(f.length, 1, 'the unbound spawner form must not escape the scan');
   assert.equal(f[0].role, 'script');