@bongos/core 1.21.175 → 1.21.177

package/tests/gate_approvals.mjs

@@ -557,5 +557,55 @@ await t('closePullRequest (github-pr-close.js): one PATCH to state=closed, and a
     (e) => e.code === 'PR_PATCH_FAILED'
   );
 });
+// ===========================================================================
+// task 1004829 — viewer_may_approve: the hall draws the Approve card only on true,
+// so the list says whether THIS viewer's approval would be let through — the same
+// two checks the approve route mounts (gate_approval.decide, then act-alone at
+// release), fail-closed.
+// ===========================================================================
+{
+  const seams = require('../src/module-seams.js');
+  const gov = { held: true, actAlone: { ok: true }, throws: false };
+  if (!seams.hasProvider('government')) {
+    seams.registerProvider('government', {
+      builderHasPermissions: async (id, keys) => {
+        if (gov.throws) throw new Error('resolver down');
+        return gov.held && keys.every((k) => k === 'gate_approval.decide');
+      },
+      checkActAlone: async (area) => {
+        assert.equal(area, 'release', 'the approve route\'s building');
+        return gov.actAlone;
+      },
+    });
+  }
+  const listFor = async () => withStubs({
+    isConfigured: () => true,
+    listOpenPullRequests: async () => [pr({ number: 301 })],
+    getPullRequestFiles: async () => [{ path: 'src/bongos/route-rank-check.js', status: 'modified' }],
+  }, async () => {
+    const res = fakeRes();
+    await routeHandler(buildGateApprovalsRouter(), 'get', '/gate-approvals')({ builder: ARCHON, params: {}, body: {} }, res);
+    return res.body;
+  });
+  await t('GET /gate-approvals: viewer_may_approve is true for a holder of gate_approval.decide who may act alone', async () => {
+    Object.assign(gov, { held: true, actAlone: { ok: true }, throws: false });
+    assert.equal((await listFor()).viewer_may_approve, true);
+  });
+  await t('GET /gate-approvals: viewer_may_approve is false without gate_approval.decide', async () => {
+    Object.assign(gov, { held: false, actAlone: { ok: true }, throws: false });
+    assert.equal((await listFor()).viewer_may_approve, false);
+  });
+  await t('GET /gate-approvals: viewer_may_approve is false when the board decides at release', async () => {
+    Object.assign(gov, { held: true, actAlone: { ok: false, reason: 'decided_by_sitting' }, throws: false });
+    assert.equal((await listFor()).viewer_may_approve, false);
+  });
+  await t('GET /gate-approvals: viewer_may_approve is false (and the list still answers) when authority cannot be read', async () => {
+    Object.assign(gov, { held: true, actAlone: { ok: true }, throws: true });
+    const body = await listFor();
+    assert.equal(body.viewer_may_approve, false);
+    assert.equal(body.awaiting.length, 1, 'the read itself is unharmed');
+  });
+}
+
 console.log(`\n${pass} passed, ${fail} failed`);
 process.exit(fail === 0 ? 0 : 1);

package/tests/gate_review.mjs

@@ -14,7 +14,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const gk = require('../scripts/gds/gate-review.js');
+const gk = require('../scripts/bongos/gate-review.js');
 const permPath = require('../src/bongos/permission-path-check.js');
 
 let passed = 0, failed = 0;
@@ -41,9 +41,9 @@ test('adding a new test file → pass', () => {
 test('run-unit-tests.js REMOVING from INTEGRATION (un-mute) → pass (AUTO)', () => {
   const base = `const INTEGRATION = new Set(['a','b']);\nconst KNOWN_FAILING = new Set(['x']);\nconst Z=1;`;
   const head = `const INTEGRATION = new Set(['a']);\nconst KNOWN_FAILING = new Set(['x']);\nconst Z=1;`;
-  const r = classify([{ path: 'scripts/gds/run-unit-tests.js' }], { 'base:scripts/gds/run-unit-tests.js': base, 'head:scripts/gds/run-unit-tests.js': head });
+  const r = classify([{ path: 'scripts/bongos/run-unit-tests.js' }], { 'base:scripts/bongos/run-unit-tests.js': base, 'head:scripts/bongos/run-unit-tests.js': head });
   assert.equal(r.verdict, 'pass');
-  assert.deepEqual(r.autoPassed, ['scripts/gds/run-unit-tests.js']);
+  assert.deepEqual(r.autoPassed, ['scripts/bongos/run-unit-tests.js']);
 });
 test('secrets-allowlist.txt REMOVING a line (narrow) → pass (AUTO)', () => {
   const r = classify([{ path: '.husky/secrets-allowlist.txt' }], { 'base:.husky/secrets-allowlist.txt': 'aaa\nbbb\n', 'head:.husky/secrets-allowlist.txt': 'aaa\n' });
@@ -55,7 +55,7 @@ test('new migration → needs_trust', () => assert.equal(verdictOf([{ path: 'mig
 test('package.json bump → needs_trust', () => assert.equal(verdictOf([{ path: 'package.json' }]), 'needs_trust'));
 test('a route file → needs_trust', () => assert.equal(verdictOf([{ path: 'src/bongos/routes/tasks.js' }]), 'needs_trust'));
 test('server.js → needs_trust', () => assert.equal(verdictOf([{ path: 'server.js' }]), 'needs_trust'));
-test('ship.js → needs_trust', () => assert.equal(verdictOf([{ path: 'scripts/gds/ship.js' }]), 'needs_trust'));
+test('ship.js → needs_trust', () => assert.equal(verdictOf([{ path: 'scripts/bongos/ship.js' }]), 'needs_trust'));
 test('db.js change OUTSIDE the rank-tier region → needs_trust', () => {
   const base = `const REQUIRES_RANK_TIER = { foo: 1 };\nfunction q(){ return 1 }`;
   const head = `const REQUIRES_RANK_TIER = { foo: 1 };\nfunction q(){ return 2 }`;
@@ -68,9 +68,9 @@ test('shrinking a test file → needs_trust', () => {
 
 // --- ESCALATE: HARD FLOOR (rank-independent) -----------------------------------------
 for (const p of [
-  'scripts/gds/gate-review.js', 'src/bongos/permission-path-check.js', 'src/bongos/auth.js',
+  'scripts/bongos/gate-review.js', 'src/bongos/permission-path-check.js', 'src/bongos/auth.js',
   'src/bongos/route-rank-check.js', 'modules/grading/grader.js', 'modules/grading/grader-workers/narc.js',
-  'scripts/gds/main-audit.js', 'scripts/migrate.sh', 'scripts/deploy/deploy-prod.sh',
+  'scripts/bongos/main-audit.js', 'scripts/migrate.sh', 'scripts/deploy/deploy-prod.sh',
   'config/deploy.json', 'infra/branch-protection.json', '.github/workflows/gate-review.yml',
   'CODEOWNERS', '.husky/pre-push', '.claude/hooks/stop-sound.js', '.claude/settings.json',
 ]) {
@@ -86,12 +86,12 @@ test('db.js with the rank-tier region CHANGED → escalate', () => {
 test('Hole(mute): run-unit-tests.js ADDING to KNOWN_FAILING → escalate (AUTO cert fails → floor)', () => {
   const base = `const INTEGRATION = new Set(['a']);\nconst KNOWN_FAILING = new Set(['x']);`;
   const head = `const INTEGRATION = new Set(['a']);\nconst KNOWN_FAILING = new Set(['x','grader_panel']);`;
-  assert.equal(verdictOf([{ path: 'scripts/gds/run-unit-tests.js' }], { 'base:scripts/gds/run-unit-tests.js': base, 'head:scripts/gds/run-unit-tests.js': head }), 'escalate');
+  assert.equal(verdictOf([{ path: 'scripts/bongos/run-unit-tests.js' }], { 'base:scripts/bongos/run-unit-tests.js': base, 'head:scripts/bongos/run-unit-tests.js': head }), 'escalate');
 });
 test('Hole(mute): run-unit-tests.js non-set code changed → escalate', () => {
   const base = `const INTEGRATION = new Set(['a']);\nconst KNOWN_FAILING = new Set([]);\nconst TIMEOUT=90000;`;
   const head = `const INTEGRATION = new Set(['a']);\nconst KNOWN_FAILING = new Set([]);\nconst TIMEOUT=1;`;
-  assert.equal(verdictOf([{ path: 'scripts/gds/run-unit-tests.js' }], { 'base:scripts/gds/run-unit-tests.js': base, 'head:scripts/gds/run-unit-tests.js': head }), 'escalate');
+  assert.equal(verdictOf([{ path: 'scripts/bongos/run-unit-tests.js' }], { 'base:scripts/bongos/run-unit-tests.js': base, 'head:scripts/bongos/run-unit-tests.js': head }), 'escalate');
 });
 test('Hole(allowlist): secrets-allowlist.txt ADDING a broadening line → escalate', () => {
   assert.equal(verdictOf([{ path: '.husky/secrets-allowlist.txt' }], { 'base:.husky/secrets-allowlist.txt': 'aaa\n', 'head:.husky/secrets-allowlist.txt': 'aaa\nLEAKED_KEY=.*\n' }), 'escalate');

package/tests/gating_review_retired.mjs

@@ -20,7 +20,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const GATING = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'gating.js'), 'utf8');
+const GATING = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'gating.js'), 'utf8');
 
 // The retirement invariant, as a checkable predicate over the source.
 function reviewGateRetired(src) {
@@ -43,7 +43,7 @@ test('cmdOn normalizes BOTH restore paths — a pre-retirement snapshot cannot r
 
 test('the CODEOWNERS file is gone; its GLOB guards remain where they enforce', () => {
   assert.ok(!fs.existsSync(path.join(ROOT, 'CODEOWNERS')), 'CODEOWNERS must not exist (ADR 0162)');
-  const gateReview = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'), 'utf8');
+  const gateReview = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'gate-review.js'), 'utf8');
   assert.match(gateReview, /'CODEOWNERS'/, 'the HARD_FLOOR glob stays — reintroducing the file is itself gate-flagged');
 });
 

package/tests/gen_freshness.mjs

@@ -21,7 +21,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const { sameContent, normalizeEol } = require(path.join(ROOT, 'scripts', 'gds', 'gen-freshness.js'));
+const { sameContent, normalizeEol } = require(path.join(ROOT, 'scripts', 'bongos', 'gen-freshness.js'));
 
 const LF = '# Title\n\n- one\n- two\n';
 const CRLF = '# Title\r\n\r\n- one\r\n- two\r\n';
@@ -68,7 +68,7 @@ const GENERATORS = ['gen-repo-map.js', 'gen-session-index.js', 'gen-file-map.js'
 
 test('every gated generator compares freshness through sameContent()', () => {
   for (const g of GENERATORS) {
-    const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', g), 'utf8');
+    const src = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', g), 'utf8');
     assert.match(src, /require\('\.\/gen-freshness'\)/, `${g} must import the shared comparison`);
     assert.match(src, /sameContent\(/, `${g} must use sameContent() for freshness`);
   }
@@ -79,7 +79,7 @@ test('no gated generator byte-compares a file read against rendered content', ()
   // (and the idx*/map* variants) directly on strings read from disk.
   const BYTEWISE = /\b(cur|next|idxCur|idxNext|mapCur|mapNext)\s*!==\s*(cur|next|idxCur|idxNext|mapCur|mapNext)\b/;
   for (const g of GENERATORS) {
-    const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', g), 'utf8');
+    const src = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', g), 'utf8');
     const offenders = src.split('\n')
       .map((line, i) => ({ line: line.trim(), n: i + 1 }))
       .filter(({ line }) => BYTEWISE.test(line));

package/tests/git_guard.mjs

@@ -63,7 +63,7 @@ test('blocks git worktree remove and points at the supported remover', () => {
   ]) {
     const r = bash(cmd);
     assert.equal(r.status, 2, `expected block for: ${cmd}`);
-    assert.match(r.stderr, /scripts\/gds\/worktree\.js remove/);
+    assert.match(r.stderr, /scripts\/(?:gds|bongos)\/worktree\.js remove/);
   }
 });
 
@@ -97,7 +97,7 @@ test('allows the read-only, the supported, and the ordinary', () => {
     'git push origin task-1003346',
     'git branch -d merged-branch',
     'git worktree list --porcelain',
-    'node scripts/gds/worktree.js remove wt-1003346',
+    'node scripts/bongos/worktree.js remove wt-1003346',
     'npm test',
   ]) {
     assert.equal(bash(cmd).status, 0, `false positive on: ${cmd}`);
@@ -178,7 +178,7 @@ test('the widened executable keeps the false-positive floor in every spelling',
     'git.exe worktree list --porcelain',
     'Github Actions rerun',
     'gitk --all',
-    'node scripts/gds/worktree.js remove wt-1',
+    'node scripts/bongos/worktree.js remove wt-1',
   ]) {
     for (const run of [bash, pwsh]) {
       assert.equal(run(cmd).status, 0, `false positive on: ${cmd}`);

package/tests/git_merge_regen.mjs

@@ -2,7 +2,7 @@
 //
 // Hermetic coverage for the generated-file merge-conflict auto-heal (task 1243 —
 // the prevention for the PR #167 repo-map churn). NO network, NO DB, NO real merge:
-// it drives the pure resolver in scripts/gds/git-merge-regen.js and the merge-driver
+// it drives the pure resolver in scripts/bongos/git-merge-regen.js and the merge-driver
 // entrypoint directly.
 //
 //   1. docs/repo-map.md (fully generated) → regenerates clean from the merged tree,
@@ -28,12 +28,10 @@
 //      the merge's OWNER must regenerate afterwards (conflict-resolve.js step 7b).
 //      Needs a real clone (the driver's __dirname must BE the merging tree), so it
 //      skips where the environment cannot host that.
-//  11. The generated API contract + client (task 1003537) — docs/api/openapi.json,
-//      docs/api-reference.md, docs/routes-permissions.md and the six
-//      clients/bongos-client files regenerate clean from the merged tree, the client
-//      heals even when the on-disk spec is the conflicted file, and the driver's file
-//      list still matches what gen-api-client actually writes. Also pins the ABSENCE of
-//      clients/bongos-client/examples/hello-world.mjs, which is hand-written.
+//  11. The generated API pointer stub (task 1003537) — docs/routes-permissions.md
+//      regenerates clean. The spec, reference and typed client are gitignored (task
+//      1004866) and must stay OUT of the driver, as must the hand-written
+//      clients/bongos-client/examples/hello-world.mjs.
 //
 // Run:  node tests/git_merge_regen.mjs
 
@@ -48,12 +46,12 @@ import path from 'node:path';
 const require = createRequire(import.meta.url);
 const here = path.dirname(fileURLToPath(import.meta.url));
 const repo = path.resolve(here, '..');
-const regen = require('../scripts/gds/git-merge-regen.js');
-const G = require('../scripts/gds/gen-repo-map.js');
-const CI = require('../scripts/gds/copy-inventory.js');
-const SI = require('../scripts/gds/gen-session-index.js'); // task 1001431 — the root CLAUDE.md's §13 snippet
-const AD = require('../scripts/gds/gen-api-docs.js');   // task 1003537 — the generated API contract
-const AC = require('../scripts/gds/gen-api-client.js'); // task 1003537 — the generated client
+const regen = require('../scripts/bongos/git-merge-regen.js');
+const G = require('../scripts/bongos/gen-repo-map.js');
+const CI = require('../scripts/bongos/copy-inventory.js');
+const SI = require('../scripts/bongos/gen-session-index.js'); // task 1001431 — the root CLAUDE.md's §13 snippet
+const AD = require('../scripts/bongos/gen-api-docs.js');   // task 1003537 — the generated API contract
+const { API_ARTIFACT_PATHS } = require('../scripts/bongos/api-artifacts.js'); // task 1004866 — gitignored, out of the driver
 
 const MARKERS = /^(<{7}|={7}|>{7})/m;
 
@@ -105,7 +103,7 @@ function driverConfigValue(driverPath) {
 }
 
 // ── helpers to build nested-CLAUDE.md fixtures from the real committed file ─────
-const NESTED = 'src/bongos/CLAUDE.md'; // scripts/gds left NESTED_DIRS in task 1003548
+const NESTED = 'src/bongos/CLAUDE.md'; // scripts/bongos left NESTED_DIRS in task 1003548
 const realNested = fs.readFileSync(path.join(repo, NESTED), 'utf8');
 assert.ok(realNested.includes(G.BEGIN) && realNested.includes(G.END), 'fixture file must carry the generated block markers');
 // Replace the INNER block text (keep the BEGIN/END marker lines intact).
@@ -143,7 +141,7 @@ function withBlockBody(src, body) {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-mdrv-'));
   const O = path.join(tmp, 'O'), A = path.join(tmp, 'A'), B = path.join(tmp, 'B');
   fs.writeFileSync(O, 'base\n'); fs.writeFileSync(A, 'ours\n'); fs.writeFileSync(B, 'theirs\n');
-  const driver = path.join(repo, 'scripts/gds/git-merge-regen.js');
+  const driver = path.join(repo, 'scripts/bongos/git-merge-regen.js');
   const heal = spawnSync('node', [driver, O, A, B, 'docs/repo-map.md'], { encoding: 'utf8' });
   assert.equal(heal.status, 0, `driver must exit 0 on a healable file; got ${heal.status} :: ${heal.stderr}`);
   assert.equal(fs.readFileSync(A, 'utf8'), G.renderRepoMap(G.buildModel()),
@@ -161,8 +159,8 @@ function withBlockBody(src, body) {
 
 // ── 5) a non-generated path is never in scope ───────────────────────────────────
 {
-  assert.equal(regen.REGENERABLE.has('scripts/gds/box.js'), false, 'source files are never auto-healed');
-  const r = regen.regenerateResolved('scripts/gds/box.js', { base: 'a', ours: 'b', theirs: 'c' });
+  assert.equal(regen.REGENERABLE.has('scripts/bongos/box.js'), false, 'source files are never auto-healed');
+  const r = regen.regenerateResolved('scripts/bongos/box.js', { base: 'a', ours: 'b', theirs: 'c' });
   assert.equal(r.content, null, 'a non-generated path resolves to null content');
 
   // REVERSAL (task 1001431). This block used to assert the opposite —
@@ -208,7 +206,7 @@ function withBlockBody(src, body) {
 // ── 5c) the .gitattributes pattern for the root CLAUDE.md is ROOT-ANCHORED ───────
 // `/CLAUDE.md` vs `CLAUDE.md` is the whole ballgame: a gitattributes pattern with no
 // slash matches at ANY depth, so the bare spelling would also capture the 22
-// modules/*/CLAUDE.md files and scripts/gds/CLAUDE.md — none of which are in
+// modules/*/CLAUDE.md files and scripts/bongos/CLAUDE.md — none of which are in
 // NESTED_DIRS, so the driver has no rule for them, exits 1, and FORCES a conflict git
 // would otherwise merge cleanly. Asserted through git itself, not by reading the file,
 // because the pattern semantics are git's and not ours to restate.
@@ -218,7 +216,7 @@ function withBlockBody(src, body) {
     return (r.stdout || '').trim();
   };
   assert.match(attr('CLAUDE.md'), /otb-regen$/, 'the root CLAUDE.md must get the driver');
-  for (const p of ['modules/economy/CLAUDE.md', 'scripts/gds/CLAUDE.md']) {
+  for (const p of ['modules/economy/CLAUDE.md', 'scripts/bongos/CLAUDE.md']) {
     assert.doesNotMatch(attr(p), /otb-regen/,
       `${p} is not regenerable — the root pattern must be anchored so it is not captured`);
   }
@@ -229,7 +227,7 @@ function withBlockBody(src, body) {
 // regenerates from the REAL repo (its REPO_ROOT is fixed), so the temp repo's
 // docs/repo-map.md heals to the real map.
 {
-  const driver = path.join(repo, 'scripts/gds/git-merge-regen.js');
+  const driver = path.join(repo, 'scripts/bongos/git-merge-regen.js');
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-gitmerge-'));
   const g = (...a) => {
     const r = spawnSync('git', a, { cwd: tmp, encoding: 'utf8' });
@@ -386,7 +384,7 @@ function withBlockBody(src, body) {
 // exact PR 526/531 shape from task 1003543 (two hall PRs both ran copy-inventory.js
 // concurrently and conflicted as ordinary JSON/markdown). Mirrors test 6 above.
 {
-  const driver = path.join(repo, 'scripts/gds/git-merge-regen.js');
+  const driver = path.join(repo, 'scripts/bongos/git-merge-regen.js');
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-gitmerge-copyreg-'));
   const g = (...a) => {
     const r = spawnSync('git', a, { cwd: tmp, encoding: 'utf8' });
@@ -451,7 +449,7 @@ function withBlockBody(src, body) {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-regen-e2e-'));
   const work = path.join(root, 'w');
   const g = (...a) => spawnSync('git', a, { cwd: work, encoding: 'utf8' });
-  const gen = (...a) => spawnSync('node', [path.join(work, 'scripts/gds/copy-inventory.js'), ...a],
+  const gen = (...a) => spawnSync('node', [path.join(work, 'scripts/bongos/copy-inventory.js'), ...a],
     { cwd: work, encoding: 'utf8' });
   // "Does regeneration change tracked CONTENT?" — `git diff` applies .gitattributes
   // (`*.json text eol=lf`), so it ignores the worktree line endings that make a raw
@@ -470,7 +468,7 @@ function withBlockBody(src, body) {
       g('config', 'core.autocrlf', 'false');
       g('config', 'merge.otb-regen.name', 'regen');
       g('config', 'merge.otb-regen.driver',
-        driverConfigValue(path.join(work, 'scripts/gds/git-merge-regen.js')));
+        driverConfigValue(path.join(work, 'scripts/bongos/git-merge-regen.js')));
 
       if (!fs.existsSync(scannedFile())) skip = `${SCANNED} is gone — repoint this fixture at another scanned surface`;
       else if (fs.readFileSync(scannedFile(), 'utf8').split('\n').length < 420) skip = `${SCANNED} is too short for two distant edits`;
@@ -530,56 +528,34 @@ function withBlockBody(src, body) {
   }
 }
 
-// ── 11) the generated API contract + client (task 1003537) ─────────────────────
-// gen-api-docs.js and gen-api-client.js write nine fully generated files that used to
-// merge textually, so any branch touching a route conflicted with every concurrent land
-// (task 1002334: four merge → reship cycles, each beaten by a fresh conflict). They heal
-// like docs/repo-map.md — all three merge sides ignored, rebuilt from the merged tree.
+// ── 11) the generated API pointer stub (task 1003537; narrowed by task 1004866) ──
+// gen-api-docs.js writes docs/routes-permissions.md wholesale, so it heals like
+// docs/repo-map.md — all three merge sides ignored, rebuilt from the tree. The spec, the
+// reference and the six client files are no longer committed (task 1004866), so git never
+// hands them to the driver: they must be OUT of REGENERABLE and must not resolve.
 {
   const conflicted = (a, b) => `<<<<<<< ours\n${a}\n=======\n${b}\n>>>>>>> theirs\n`;
 
-  // (a) the three doc artifacts rebuild to exactly what the generator would write.
+  // (a) the committed stub rebuilds to exactly what the generator would write.
   const fresh = new Map(AD.build().files.map((f) => [f.rel, f.content]));
-  for (const rel of ['docs/api/openapi.json', 'docs/api-reference.md', 'docs/routes-permissions.md']) {
-    const r = regen.regenerateResolved(rel, {
-      base: 'base\n', ours: conflicted('{"a":1}', '{"b":2}'), theirs: 'nonsense\n',
-    });
-    assert.equal(r.ok, true, `${rel} heal must succeed`);
-    assert.ok(!MARKERS.test(r.content), `${rel} heal must leave no conflict markers`);
-    assert.equal(r.content, fresh.get(rel), `${rel} heal must equal a fresh generation`);
-  }
-
-  // (b) the six client files do too. The driver rebuilds the spec in memory rather than
-  // reading docs/api/openapi.json, so this must hold no matter what is on disk.
-  const freshClient = AC.build().files;
-  for (const [name, content] of Object.entries(freshClient)) {
-    const rel = `clients/bongos-client/${name}`;
-    const r = regen.regenerateResolved(rel, {
-      base: 'base\n', ours: conflicted('one', 'two'), theirs: 'nonsense\n',
-    });
-    assert.equal(r.ok, true, `${rel} heal must succeed`);
-    assert.ok(!MARKERS.test(r.content), `${rel} heal must leave no conflict markers`);
-    assert.equal(r.content, content, `${rel} heal must equal a fresh generation`);
+  const r = regen.regenerateResolved('docs/routes-permissions.md', {
+    base: 'base\n', ours: conflicted('{"a":1}', '{"b":2}'), theirs: 'nonsense\n',
+  });
+  assert.equal(r.ok, true, 'routes-permissions.md heal must succeed');
+  assert.ok(!MARKERS.test(r.content), 'routes-permissions.md heal must leave no conflict markers');
+  assert.equal(r.content, fresh.get('docs/routes-permissions.md'), 'heal must equal a fresh generation');
+
+  // (b) every gitignored API artifact is OUT of the driver: listing one would route a path
+  // git no longer tracks through a rule that no longer exists.
+  for (const rel of API_ARTIFACT_PATHS) {
+    assert.ok(!regen.REGENERABLE.has(rel), `${rel} is gitignored (task 1004866) and must not be in REGENERABLE`);
+    assert.equal(regen.regenerateResolved(rel, { base: 'a\n', ours: 'b\n', theirs: 'c\n' }).content, null,
+      `${rel} must not resolve through the driver`);
   }
 
-  // (c) LOCKSTEP: the driver's hardcoded client list must be exactly what the generator
-  // writes. Without this, a seventh generated client file would be added to
-  // gen-api-client.js and silently fall back to a textual merge — the original defect.
-  const declared = [...regen.REGENERABLE]
-    .filter((f) => f.startsWith('clients/bongos-client/'))
-    .map((f) => f.slice('clients/bongos-client/'.length))
-    .sort();
-  assert.deepEqual(declared, Object.keys(freshClient).sort(),
-    'REGENERABLE\'s clients/bongos-client entries must match gen-api-client build().files exactly');
-
-  // (d) the hand-written example must stay OUT. A `clients/bongos-client/*` glob would
-  // have swept it in, and the driver has no rule for it — so git would be forced into a
-  // conflict on a file it can merge by itself (the /CLAUDE.md leading-slash trap again).
+  // (c) the hand-written example stays out too.
   assert.ok(!regen.REGENERABLE.has('clients/bongos-client/examples/hello-world.mjs'),
     'the hand-written example must never be routed through the regenerating driver');
-  assert.equal(regen.regenerateResolved('clients/bongos-client/examples/hello-world.mjs',
-    { base: 'a\n', ours: 'b\n', theirs: 'c\n' }).content, null,
-    'a non-generated path under the client dir must not resolve');
 }
 
 console.log('git_merge_regen: all assertions passed');

package/tests/github_one_trip.mjs

@@ -4,7 +4,7 @@
 // Four layers, DB-free and network-free:
 //   1. modules/provisioning/github-setup.js — each checklist step's state from server facts,
 //      the honest "not yet" states included; the install link; the verify window (PURE).
-//   2. scripts/gds/provision-github-setup.js — the runner's check, asked of GitHub with the
+//   2. scripts/bongos/provision-github-setup.js — the runner's check, asked of GitHub with the
 //      app's OWN key: the creds read back out of a REAL webEnvBody, a JWT that verifies,
 //      installed / not installed / cannot tell, device flow on / off / cannot tell, and the
 //      tick recording only what GitHub confirmed — never a secret in a log line.
@@ -26,8 +26,8 @@ import { fileURLToPath } from 'node:url';
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const GS = require(path.join(ROOT, 'modules', 'provisioning', 'github-setup.js'));
-const RUN = require(path.join(ROOT, 'scripts', 'gds', 'provision-github-setup.js'));
-const UNITS = require(path.join(ROOT, 'scripts', 'gds', 'provision-units.js'));
+const RUN = require(path.join(ROOT, 'scripts', 'bongos', 'provision-github-setup.js'));
+const UNITS = require(path.join(ROOT, 'scripts', 'bongos', 'provision-units.js'));
 const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
 const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
 
@@ -182,7 +182,7 @@ test('the window query takes each project\'s LATEST attempt, past placement, sti
   assert.match(sql, /l\.app_id IS NOT NULL AND l\.status IN \('done', 'error'\) AND i\.status = 'active'/);
   assert.match(sql, /LIMIT 20/);
   assert.deepEqual(params, [GS.VERIFY_WINDOW_MS / 1000, ['github-app-install-reported', 'github-app-check-requested']], 'an install report or a check request (task 1004652) re-opens it');
-  assert.match(fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'provision.js'), 'utf8'), /require\('\.\/provision-github-setup\.js'\)\.verifyGithubAppSetups\(deps\)/, 'it runs on every runner tick, after the conversions');
+  assert.match(fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'provision.js'), 'utf8'), /require\('\.\/provision-github-setup\.js'\)\.verifyGithubAppSetups\(deps\)/, 'it runs on every runner tick, after the conversions');
 });
 
 // ── 3. the real projection into the real page facts ─────────────────────────

package/tests/github_pick_up.mjs

@@ -32,8 +32,8 @@ import { fileURLToPath } from 'node:url';
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const GS = require(path.join(ROOT, 'modules', 'provisioning', 'github-setup.js'));
-const RUN = require(path.join(ROOT, 'scripts', 'gds', 'provision-github-setup.js'));
-const P = require(path.join(ROOT, 'scripts', 'gds', 'provision.js'));
+const RUN = require(path.join(ROOT, 'scripts', 'bongos', 'provision-github-setup.js'));
+const P = require(path.join(ROOT, 'scripts', 'bongos', 'provision.js'));
 const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
 const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
 

package/tests/github_push_merge_driver.mjs

@@ -203,7 +203,7 @@ test('1004666 every red conclusion still names its check, past a pending one', (
 
 test('1004666 the server and the laptop read red from ONE set', () => {
   const rollup = require('../modules/lifecycle/check-rollup.js');
-  const land = fs.readFileSync(new URL('../scripts/gds/ship-land.js', import.meta.url), 'utf8');
+  const land = fs.readFileSync(new URL('../scripts/bongos/ship-land.js', import.meta.url), 'utf8');
   const push = fs.readFileSync(new URL('../modules/lifecycle/github-push.js', import.meta.url), 'utf8');
   assert.ok(land.includes("RED_CONCLUSIONS } = require('../../modules/lifecycle/check-rollup.js')"), 'ship-land imports the shared set');
   assert.doesNotMatch(land, /const RED_CONCLUSIONS\s*=/, 'and no longer declares its own');

package/tests/go_live.mjs

@@ -31,7 +31,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const G = require('../scripts/gds/go-live.js');
+const G = require('../scripts/bongos/go-live.js');
 
 const okTarget = {
   ssh: 'my-box',
@@ -200,7 +200,8 @@ test('the path it requests is the one the server actually mounts', () => {
   // The spec's paths are relative to its server base, and apiCall prepends
   // nothing — so the URL go-live builds must be base + path, assembled from the
   // spec rather than retyped. A rename on either side reds this.
-  const spec = JSON.parse(fs.readFileSync(new URL('../docs/api/openapi.json', import.meta.url), 'utf8'));
+  // The spec is gitignored (task 1004866): build it from the routes.
+  const spec = require('../scripts/bongos/gen-api-docs.js').build().spec;
   const bases = (spec.servers || []).map((s) => s.url);
   const full = new Set(bases.flatMap((b) => Object.keys(spec.paths || {}).map((p) => `${b}${p}`)));
   assert.ok(full.has(G.ARTIST_GATE_PATH),

package/tests/goal_category.mjs

@@ -12,7 +12,7 @@
 //    category can refuse a write, the label has become a gate — which is the exact
 //    failure the goal's own prose predicts ("a second thing that LOOKS like a
 //    hierarchy will be mistaken for one within a release"). The
-//    scripts/gds/category-advisory-guard.js check covers the gates; these cover
+//    scripts/bongos/category-advisory-guard.js check covers the gates; these cover
 //    the write paths.
 //
 // Run:  node --test tests/goal_category.mjs   (or: node tests/goal_category.mjs)

package/tests/goal_cli.mjs

@@ -1,6 +1,6 @@
 // tests/goal_cli.mjs
 //
-// Unit test for the PURE helpers exported from scripts/gds/goal.js (the goal
+// Unit test for the PURE helpers exported from scripts/bongos/goal.js (the goal
 // board CLI): rollup(), criterionGlyph(), criterionState(), bucketTasks(),
 // liveTasks(). All are deterministic with no DB, network, or live server —
 // requiring the script must NOT run the CLI (main is require.main-guarded).
@@ -10,7 +10,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const goal = require('../scripts/gds/goal.js');
+const goal = require('../scripts/bongos/goal.js');
 
 let passed = 0;
 let failed = 0;

package/tests/goal_create_spec_entry.mjs

@@ -55,7 +55,7 @@ test('the strict-fields note lists spec_task and the validator accepts it', () =
 
 test('skill-lint passes on the edited skill (the same lint fitness runs in CI)', async () => {
   const { spawnSync } = await import('node:child_process');
-  const r = spawnSync(process.execPath, [path.join(ROOT, 'scripts/gds/skill-lint.js')], { cwd: ROOT, encoding: 'utf8' });
+  const r = spawnSync(process.execPath, [path.join(ROOT, 'scripts/bongos/skill-lint.js')], { cwd: ROOT, encoding: 'utf8' });
   assert.equal(r.status, 0, `skill-lint failed:\n${r.stdout}\n${r.stderr}`);
   assert.match(r.stdout, /0 error\(s\)/);
 });

package/tests/goal_invite_consent.mjs

@@ -171,7 +171,9 @@ function harness({ pendingRequests = [] } = {}) {
   vm.createContext(sandbox);
   // task 1003458: claim-action.js sits between task-lib and goals-render on the
   // real page (goals.html); the stub mirrors that order.
-  for (const f of ['hall-kit.js', 'task-lib.js', 'claim-action.js', 'bulk-toolbar.js', 'goals-lib.js', 'goal-forest-render.js', 'goals-render.js']) {
+  // task 1004823: hall-ask.js (window.OTBAsk) renders the join-request card;
+  // goals.html loads it before goals-render.
+  for (const f of ['hall-kit.js', 'hall-ask.js', 'task-lib.js', 'claim-action.js', 'bulk-toolbar.js', 'goals-lib.js', 'goal-forest-render.js', 'goals-render.js']) {
     vm.runInContext(read(P + f), sandbox, { filename: f });
   }
 

package/tests/goal_move.mjs

@@ -239,7 +239,7 @@ test('a crossing criterion link surfaces as 409 with the pairs', async () => {
 // ---- the CLI wrapper ----------------------------------------------------------
 
 test('goal.js move parses a real goal id and version id, and refuses junk', () => {
-  const { parseMoveArgs } = require('../scripts/gds/goal.js');
+  const { parseMoveArgs } = require('../scripts/bongos/goal.js');
   assert.deepEqual(parseMoveArgs(['1000122', '--to', 'BONGOS-V3']), { id: 1000122, body: { version_id: 'BONGOS-V3' } });
   assert.deepEqual(parseMoveArgs(['7', '--to=V3.1', '--admit-reason', 'owner call']),
     { id: 7, body: { version_id: 'V3.1', admit_reason: 'owner call' } });

package/tests/goal_working_area.mjs

@@ -27,7 +27,7 @@ const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8');
 const { test, summary } = makeRunner();
 
 const { buildGoals } = require('../modules/lifecycle/done-when.js');
-const status = require('../scripts/gds/status.js');
+const status = require('../scripts/bongos/status.js');
 
 // The eleven area goals as they stand on prod (task 1004057's table, re-read
 // 2026-09-28): the title, the area number the ADR gives it, and the sort_order

package/tests/government_agent_asks.mjs

@@ -11,7 +11,7 @@
 //   2. An agent that files prose is refused and rewrites: through the real
 //      routers, a blocker an AI (CLI) session files by hand without an ask
 //      answers 400 `ask_required`; prose sent as the ask answers `ask_refused`
-//      naming every fix; the helper (scripts/gds/ask.js check) shows the same
+//      naming every fix; the helper (scripts/bongos/ask.js check) shows the same
 //      fixes; the rewritten card passes the helper and files, stored. A person on
 //      the hall (a web session) and the unattended scripts still file without one.
 //   3. The scripts that file templated blockers send a card that has the shape,
@@ -42,10 +42,10 @@ const CARDS = JSON.parse(fs.readFileSync(path.join(ROOT, 'tests', 'fixtures', 'g
 
 const asks = require(path.join(GOV, 'asks.js'));
 const asksDb = require(path.join(GOV, 'asks-db.js'));
-const askCli = require(path.join(ROOT, 'scripts', 'gds', 'ask.js'));
-const shipEscalation = require(path.join(ROOT, 'scripts', 'gds', 'ship-escalation.js'));
-const artifactAudit = require(path.join(ROOT, 'scripts', 'gds', 'artifact-audit.js'));
-const autobongosVerify = require(path.join(ROOT, 'scripts', 'gds', 'autobongos-verify.js'));
+const askCli = require(path.join(ROOT, 'scripts', 'bongos', 'ask.js'));
+const shipEscalation = require(path.join(ROOT, 'scripts', 'bongos', 'ship-escalation.js'));
+const artifactAudit = require(path.join(ROOT, 'scripts', 'bongos', 'artifact-audit.js'));
+const autobongosVerify = require(path.join(ROOT, 'scripts', 'bongos', 'autobongos-verify.js'));
 const conductor = require(path.join(ROOT, '.claude', 'hooks', 'conductor.js'));
 
 const words = (t) => asks.words(t).length;
@@ -182,7 +182,7 @@ test('an agent that files prose is refused, rewrites with the helper, and files
   assert.equal(bare.data.error.code, 'ask_required');
   assert.equal(bare.data.error.message, asks.ASK_REQUIRED_MESSAGE);
   assert.match(bare.data.error.message, /at most 12 words/);
-  assert.match(bare.data.error.message, /node scripts\/gds\/ask\.js check/);
+  assert.match(bare.data.error.message, /node scripts\/(?:gds|bongos)\/ask\.js check/);
 
   // 2. the prose sent as the ask: refused, every fix named
   const prose = { question: OVERRIDE_PROSE, options: [], waits_on: '', if_nobody_answers: '' };
@@ -318,5 +318,5 @@ test('the reminder states the ask\'s own numbers', () => {
   assert.match(conductor.ASK_SHAPE_TEXT, new RegExp(`at most ${R.question_words} words`));
   assert.match(conductor.ASK_SHAPE_TEXT, new RegExp(`${R.options_min} or ${R.options_max} tap answers`));
   assert.match(asks.ASK_REQUIRED_MESSAGE, new RegExp(`at most ${R.question_words} words, ${R.options_min} or ${R.options_max} tap answers`));
-  assert.match(conductor.ASK_SHAPE_TEXT, /node scripts\/gds\/ask\.js check/);
+  assert.match(conductor.ASK_SHAPE_TEXT, /node scripts\/(?:gds|bongos)\/ask\.js check/);
 });

package/tests/government_board_room_copy.mjs

@@ -167,9 +167,14 @@ test('each room frames itself in one line, not a paragraph', () => {
   // page's own <h1> rather than a panel <h2> — a second "Board Room" heading
   // under the page head would be the copy-that-explains-the-UI-to-itself this
   // file exists to keep out. So the landmark differs per room; the RULE does not.
+  //
+  // Task 1004825 (no top block, owner 2026-10-23): the Board Room carries NO
+  // framing line at all now — the sittings are the page — so only the
+  // Constitution keeps one, and the room is held to having none.
+  assert.ok(!/<p class="gov-grid-note">/.test(BOARD_HTML), 'the Board Room has no intro line above its sittings');
+  assert.ok(!/id="board-sub"/.test(BOARD_HTML), 'nor a page sub-line');
   const rooms = [
     { heading: 'Constitution', src: HTML, at: '<h2 class="gov-h">Constitution</h2>' },
-    { heading: 'Board Room', src: BOARD_HTML, at: '<h1 class="page-head__h">Board Room</h1>' },
   ];
   for (const { heading, src, at } of rooms) {
     const i = src.indexOf(at);