@bongos/core 1.21.175 → 1.21.177

package/tests/opt_in_skill_modules.mjs

@@ -21,9 +21,9 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const materialize = require(path.join(ROOT, 'scripts', 'gds', 'claude-materialize.js'));
-const lint = require(path.join(ROOT, 'scripts', 'gds', 'skill-lint.js'));
-const publish = require(path.join(ROOT, 'scripts', 'gds', 'publish-manifest.js'));
+const materialize = require(path.join(ROOT, 'scripts', 'bongos', 'claude-materialize.js'));
+const lint = require(path.join(ROOT, 'scripts', 'bongos', 'skill-lint.js'));
+const publish = require(path.join(ROOT, 'scripts', 'bongos', 'publish-manifest.js'));
 const readJson = (p) => JSON.parse(fs.readFileSync(p, 'utf8'));
 
 const PIXEL_ART = ['otb-tile-generate', 'otb-design-review', 'otb-character-review', 'otb-feedback-capture', 'otb-figma-sync'];

package/tests/own_scope_guard.mjs

@@ -524,7 +524,7 @@ t('the guard checks a real number of own-scoped routes overall', () => {
 });
 
 t('this guard runs in the DB-free unit lane (it is not parked as integration or known-failing)', () => {
-  const runner = fs.readFileSync(path.join(repo, 'scripts', 'gds', 'run-unit-tests.js'), 'utf8');
+  const runner = fs.readFileSync(path.join(repo, 'scripts', 'bongos', 'run-unit-tests.js'), 'utf8');
   assert.ok(
     !/own_scope_guard/.test(runner),
     'own_scope_guard is named in run-unit-tests.js — if it landed in INTEGRATION or KNOWN_FAILING it would stop gating anything (task 1002282)'

package/tests/own_session_revoke.mjs

@@ -140,6 +140,9 @@ function predicateFor(sql, params) {
   take(/(?<!_)\b(?:s\.)?id = \$(\d+)/, (v) => (r) => String(r.id) === String(v));
   take(/\bbuilder_id = \$(\d+)/, (v) => (r) => String(r.builder_id) === String(v));
   take(/\brevoked_at IS NULL/, () => (r) => r.revoked_at === null);
+  // ADR 0383: a session idle past the limit is left off the list.
+  take(/\blast_used_at > now\(\) - \(\$(\d+)::bigint \* INTERVAL '1 millisecond'\)/,
+    (v) => (r) => new Date(r.last_used_at).getTime() > Date.now() - Number(v));
 
   for (const m of raw.matchAll(/\$(\d+)/g)) {
     if (!consumed.has(m[1])) {
@@ -337,7 +340,7 @@ await t('a builder_id in the QUERY STRING changes nothing about whose list comes
   assert.equal(r.status, 200);
   assert.deepEqual(r.body.sessions.map((s) => s.id), ['101', '102'], 'still Ada\'s own list');
   const listQuery = calls.filter((c) => /FROM builder_sessions WHERE builder_id/.test(c.sql)).pop();
-  assert.deepEqual(listQuery.params, [1], 'the account queried is the SESSION\'s builder, never the one named in the URL');
+  assert.deepEqual(listQuery.params, [1, 10 * DAY], 'the account queried is the SESSION\'s builder, never the one named in the URL');
 });
 
 await t('guessing a stranger\'s session id revokes nothing and leaks nothing', async () => {

package/tests/package_core.mjs

@@ -1,7 +1,7 @@
 // tests/package_core.mjs
 //
 // GDS-V4 R84 (task 1688) — locks the pure logic of the Cloud Bongos core packager
-// (scripts/gds/package-core.js, ADR 0100 §1). Hermetic: no git, DB, or network —
+// (scripts/bongos/package-core.js, ADR 0100 §1). Hermetic: no git, DB, or network —
 // so the #856 pr-unit-tests gate auto-includes it. Guards four things:
 //   1. canonicalTreeHash is the stable, order-independent, content-sensitive PIN,
 //   2. the manifest carries the right pin coordinates + normalized file modes,
@@ -21,7 +21,7 @@ import { tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
 
 const require = createRequire(import.meta.url);
-const m = require('../scripts/gds/package-core.js');
+const m = require('../scripts/bongos/package-core.js');
 const {
   canonicalTreeHash, normalizeMode, buildCoreManifest, withTarballInfo,
   tarballName, manifestName, stageDirName, splitUstarName, buildTar, sha256hex,
@@ -45,8 +45,8 @@ const {
   // task 1003995 — --from-worktree's enumerator, for a core checkout with no git history
   walkWorktreeEntries,
 } = m;
-const { buildRedactionRules, collectSensitiveLiterals, redactText, findLeaks } = require('../scripts/gds/mirror-redact.js');
-const { isPublishable } = require('../scripts/gds/publish-manifest.js');
+const { buildRedactionRules, collectSensitiveLiterals, redactText, findLeaks } = require('../scripts/bongos/mirror-redact.js');
+const { isPublishable } = require('../scripts/bongos/publish-manifest.js');
 
 // A synthetic instance brand for the classification tests (never the real OTB literals).
 const TEST_BRANDING = {
@@ -290,7 +290,7 @@ t('functional brand/topology strings are a NON-FATAL advisory (ship verbatim, ne
 
 t('functional file with a live credential verbatim IS a fatal leak', () => {
   const secret = 'ghp_' + 'A'.repeat(36); // a github-token-shaped live value
-  const r = proc('scripts/gds/x.js', `const T = "${secret}";`, [secret]);
+  const r = proc('scripts/bongos/x.js', `const T = "${secret}";`, [secret]);
   assert.equal(r.kind, 'functional');
   assert.ok(r.leaks.some((l) => l.label === 'live-credential'));
   assert.equal(r.leaks[0].sample, undefined); // never echoes the secret value
@@ -317,7 +317,7 @@ t('DOCS are genericized: instance brand/owner redacted, output is clean', () =>
 // ── task 2121 — CLAUDE.md/AGENTS.md ship as a brand-free stub (demo-audit fix) ──────
 t('isAgentDoc: matches CLAUDE.md/AGENTS.md at root + any depth, nothing else', () => {
   assert.equal(isAgentDoc('CLAUDE.md'), true);
-  assert.equal(isAgentDoc('scripts/gds/CLAUDE.md'), true);
+  assert.equal(isAgentDoc('scripts/bongos/CLAUDE.md'), true);
   assert.equal(isAgentDoc('src/bongos/routes/CLAUDE.md'), true);
   assert.equal(isAgentDoc('modules/lifecycle/CLAUDE.md'), true);
   assert.equal(isAgentDoc('AGENTS.md'), true);
@@ -345,7 +345,7 @@ t('processCoreFile STUBS a CLAUDE.md — the core memory never ships (no auto-lo
 });
 
 t('processCoreFile STUBS nested + module CLAUDE.md too (all auto-load sites)', () => {
-  for (const p of ['scripts/gds/CLAUDE.md', 'src/bongos/CLAUDE.md', 'modules/economy/CLAUDE.md']) {
+  for (const p of ['scripts/bongos/CLAUDE.md', 'src/bongos/CLAUDE.md', 'modules/economy/CLAUDE.md']) {
     const r = proc(p, '# nested map\nsecret https://acme.example detail');
     assert.equal(r.kind, 'stub', `${p} stubbed`);
     assert.equal(r.buf.toString(), CORE_AGENT_DOC_STUB, `${p} → stub body`);
@@ -384,7 +384,6 @@ t('buildPackageJson: prunes to express+pg+pino, keeps the source ranges + the un
   // instance's own entrypoint (server.js) wires. The cutover codemod rewrites server.js's
   // relative ./src/* requires to exactly these subpaths, so they MUST be exported.
   assert.equal(pkg.exports['./bongos/api-path-404'], './src/bongos/api-path-404.js');
-  assert.equal(pkg.exports['./bongos/uptime-poller'], './src/bongos/uptime-poller.js');
   assert.equal(pkg.exports['./module-loader/loader'], './src/module-loader/loader.js');
   assert.equal(pkg.exports['./modules'], './src/modules.js');
   assert.equal(pkg.exports['./module-seams'], './src/module-seams.js');
@@ -795,7 +794,7 @@ function worktreeFixture() {
   };
   put('src/module-api.js');
   put('src/bongos/tasks.js');                       // nested, to prove the walk recurses
-  put('scripts/gds/package-core.js');
+  put('scripts/bongos/package-core.js');
   put('CLAUDE.md');                                  // an allowlisted FILE entry, not a subtree
   put('node_modules/@bongos/core/index.js');         // huge + never core: must never be descended
   put('dist/bongos-core-1.0.0.tgz');                 // this tool's own output
@@ -809,7 +808,7 @@ t('walkWorktreeEntries: offers the allowlisted tree and never descends node_modu
     const paths = walkWorktreeEntries(root).map((e) => e.path);
     assert.deepEqual(
       paths,
-      ['CLAUDE.md', 'scripts/gds/package-core.js', 'src/bongos/tasks.js', 'src/module-api.js'],
+      ['CLAUDE.md', 'scripts/bongos/package-core.js', 'src/bongos/tasks.js', 'src/module-api.js'],
       `unexpected set: ${paths.join(', ')}`,
     );
     assert.ok(!paths.some((p) => p.startsWith('node_modules/')), 'node_modules is never walked');
@@ -835,7 +834,7 @@ t('walkWorktreeEntries: a DENIED path inside an allowlisted subtree is still off
   try {
     // A host-feature script lives under the allowlisted scripts/ root and is denied by name.
     // If the walk pre-filtered it, the two enumeration paths would be applying different rules.
-    const denied = 'scripts/gds/art-stage.js';
+    const denied = 'scripts/bongos/art-stage.js';
     writeFileSync(join(root, denied), 'x');
     const offered = walkWorktreeEntries(root).map((e) => e.path);
     assert.ok(offered.includes(denied), 'the walk offers it…');

package/tests/page_inventory.mjs

@@ -26,7 +26,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const inv = require(path.join(ROOT, 'scripts', 'gds', 'page-inventory.js'));
+const inv = require(path.join(ROOT, 'scripts', 'bongos', 'page-inventory.js'));
 const { moduleWebSurfaces } = require(path.join(ROOT, 'src', 'module-loader', 'loader.js'));
 const { isModuleEnabled } = require(path.join(ROOT, 'src', 'modules.js'));
 
@@ -142,12 +142,12 @@ test('DRIFT FAILS: --check reports both artifacts stale when the tree says other
 });
 
 test('DRIFT FAILS: the CLI --check exits 0 on this tree (the gate fitness.js and ship-check.js run)', () => {
-  const r = spawnSync(process.execPath, [path.join(ROOT, 'scripts', 'gds', 'page-inventory.js'), '--check'], { cwd: ROOT, encoding: 'utf8' });
+  const r = spawnSync(process.execPath, [path.join(ROOT, 'scripts', 'bongos', 'page-inventory.js'), '--check'], { cwd: ROOT, encoding: 'utf8' });
   assert.equal(r.status, 0, r.stderr);
-  const fitness = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'fitness.js'), 'utf8');
-  const shipCheck = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'ship-check.js'), 'utf8');
+  const fitness = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'fitness.js'), 'utf8');
+  const shipCheck = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'ship-check.js'), 'utf8');
   assert.match(fitness, /'page-inventory\.js'\), '--check'\]/, 'fitness.js runs the --check');
-  assert.match(shipCheck, /'scripts\/gds\/page-inventory\.js', '--check'\]/, 'ship-check.js runs the --check');
+  assert.match(shipCheck, /'scripts\/(?:gds|bongos)\/page-inventory\.js', '--check'\]/, 'ship-check.js runs the --check');
 });
 
 test('PORTABILITY: a disabled module\'s surface and pages are absent, with no edit to the generator', () => {

package/tests/page_reader.mjs

@@ -30,8 +30,8 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const reader = require(path.join(ROOT, 'scripts', 'gds', 'page-reader.js'));
-const shipCheck = require(path.join(ROOT, 'scripts', 'gds', 'ship-check.js'));
+const reader = require(path.join(ROOT, 'scripts', 'bongos', 'page-reader.js'));
+const shipCheck = require(path.join(ROOT, 'scripts', 'bongos', 'ship-check.js'));
 
 const REGISTRY = {
   entries: [
@@ -170,7 +170,7 @@ test('the committed readings cover every inventory page, in the D3 shape', () =>
     assert.equal(p.counts.lines, p.lines.length);
   }
   assert.ok(unplaced > 0, 'the real pages carry unplaced strings, and they are listed');
-  assert.deepEqual(reader.checkReadings(inv, doc), [], 'the committed readings match this tree (re-read: node scripts/gds/page-reader.js --stale)');
+  assert.deepEqual(reader.checkReadings(inv, doc), [], 'the committed readings match this tree (re-read: node scripts/bongos/page-reader.js --stale)');
 });
 
 test('--check needs no browser and names the re-read command', () => {
@@ -179,19 +179,19 @@ test('--check needs no browser and names the re-read command', () => {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'page-reader-nobrowser-'));
   const pre = path.join(dir, 'no-browser.cjs');
   fs.writeFileSync(pre, "const M=require('module');const o=M._load;M._load=function(r,...a){if(/playwright|ui-design[\\\\/]kit/.test(r))throw new Error('browser reached: '+r);return o.call(this,r,...a);};\n");
-  const r = spawnSync(process.execPath, ['--require', pre, path.join(ROOT, 'scripts', 'gds', 'page-reader.js'), '--check'], { cwd: ROOT, encoding: 'utf8' });
+  const r = spawnSync(process.execPath, ['--require', pre, path.join(ROOT, 'scripts', 'bongos', 'page-reader.js'), '--check'], { cwd: ROOT, encoding: 'utf8' });
   assert.equal(r.status, 0, r.stderr || r.stdout);
   assert.match(reader.REREAD_COMMAND, /page-reader\.js --stale/);
-  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'page-reader.js'), 'utf8');
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'page-reader.js'), 'utf8');
   assert.match(src, /Re-read them \(opens a browser\): \$\{REREAD_COMMAND\}/, 'a stale --check names the command');
 });
 
 test('ship-check runs the browser-free --check, and fitness does not render', () => {
   const step = shipCheck.STEPS.find((s) => s.key === 'page-readings');
   assert.ok(step, 'ship-check has a page-readings row');
-  assert.deepEqual(step.argv, ['scripts/gds/page-reader.js', '--check']);
+  assert.deepEqual(step.argv, ['scripts/bongos/page-reader.js', '--check']);
   assert.equal(step.fix, reader.REREAD_COMMAND);
-  const fitness = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'fitness.js'), 'utf8');
+  const fitness = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'fitness.js'), 'utf8');
   assert.doesNotMatch(fitness, /page-reader/, 'fitness never runs the reader (a render is the builder\'s own command)');
 });
 

package/tests/page_tweak_hold.mjs

@@ -153,9 +153,9 @@ server.close();
 
 // ---- 3. ship.js ------------------------------------------------------------
 
-const shipMerge = require('../scripts/gds/ship-merge.js');
-const shipFinish = require('../scripts/gds/ship-finish.js');
-const shipLand = require('../scripts/gds/ship-land.js');
+const shipMerge = require('../scripts/bongos/ship-merge.js');
+const shipFinish = require('../scripts/bongos/ship-finish.js');
+const shipLand = require('../scripts/bongos/ship-land.js');
 
 await test('publishHeld publishes through the PR path with hold:true, after the same regeneration a land runs', async () => {
   const calls = [];
@@ -200,19 +200,19 @@ await test('finishHeld says the page is WAITING FOR THE ARTIST, syncs the sessio
 
 await test('finishShip routes a held pass away from mergeAndDeploy (the source says so, and only when held)', async () => {
   const fs = require('node:fs');
-  const src = fs.readFileSync(require.resolve('../scripts/gds/ship-finish.js'), 'utf8');
+  const src = fs.readFileSync(require.resolve('../scripts/bongos/ship-finish.js'), 'utf8');
   const body = src.slice(src.indexOf('async function finishShip('));
   const holdAt = body.indexOf('if (held) return finishHeld(');
   const mergeAt = body.indexOf('await mergeAndDeploy(');
   assert.ok(holdAt > 0 && mergeAt > holdAt, 'the hold is decided BEFORE any merge is attempted');
-  const flow = fs.readFileSync(require.resolve('../scripts/gds/ship-flow.js'), 'utf8');
+  const flow = fs.readFileSync(require.resolve('../scripts/bongos/ship-flow.js'), 'utf8');
   assert.equal((flow.match(/\bheld = gradePost\.data\.held === true/g) || []).length, 2, 'shipMain and regradeMain both read the hold off the grade response');
   assert.match(flow, /tweakHold\.isHeldForArtist\(task, tRes\.data\.grade/, 'a re-run of a held task re-publishes instead of re-grading');
 });
 
 // ---- 4. strand-watch -------------------------------------------------------
 
-const sw = require('../scripts/gds/strand-watch.js');
+const sw = require('../scripts/bongos/strand-watch.js');
 const OLD = new Date(Date.now() - 3 * 86400000).toISOString();
 
 function fakeCall({ completed, grades, throwFor = new Set() }) {

package/tests/parallel-load.mjs

@@ -262,7 +262,7 @@ async function runWorker({ id, server, token, deadline, stats }) {
     // run the full ship/grade/merge chain under load — that mutates main and
     // isn't what the claim-concurrency smoke is exercising). The real release
     // is POST /claims/:id/resolve with outcome 'abandoned' (returns the task to
-    // ready), matching scripts/gds/release.js.
+    // ready), matching scripts/bongos/release.js.
     await sleep(WORK_MS);
     try {
       const rel = server

package/tests/paste_token_api_base.mjs

@@ -23,7 +23,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const { parseArgs, resolveBaseForPaste } = require(path.join(ROOT, 'scripts', 'gds', 'paste-token.js'));
+const { parseArgs, resolveBaseForPaste } = require(path.join(ROOT, 'scripts', 'bongos', 'paste-token.js'));
 
 const STALE = 'https://some-other-instance.example';
 const stale = () => STALE;

package/tests/paste_token_session_store.mjs

@@ -1,7 +1,7 @@
 // tests/paste_token_session_store.mjs — a paste must not destroy the OTHER instance's
 // session (task 1004003, ADR 0269).
 //
-// THE BUG. `scripts/gds/paste-token.js` wrote the session with a bare
+// THE BUG. `scripts/bongos/paste-token.js` wrote the session with a bare
 // `fs.writeFileSync(SESSION_PATH, ...)`. SESSION_PATH is the ACTIVE POINTER and nothing
 // else. Under ADR 0269 a machine has several instances, and `saveSession()` in cli-lib is
 // the only writer that knows it: it archives the OUTGOING session into the host-keyed
@@ -34,7 +34,7 @@ import { spawn, spawnSync } from 'node:child_process';
 const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
 const require = createRequire(import.meta.url);
 const ic = require(path.join(REPO_ROOT, 'src', 'instance-config.js'));
-const PASTE_TOKEN = path.join(REPO_ROOT, 'scripts', 'gds', 'paste-token.js');
+const PASTE_TOKEN = path.join(REPO_ROOT, 'scripts', 'bongos', 'paste-token.js');
 
 // SETTING `HOME` ALONE IS NOT ISOLATION (task 1003760, learned the expensive way in
 // tests/cli_sessions.mjs): on Windows os.homedir() reads USERPROFILE and never consults

package/tests/pending_invite_purge_db.mjs

@@ -12,7 +12,7 @@
 // table-wide DELETE can never touch a shared database's rows.
 //
 // Real-DB integration test: self-skips without a reachable Postgres; in the
-// INTEGRATION set (scripts/gds/run-unit-tests.js) so the default DB-free lane
+// INTEGRATION set (scripts/bongos/run-unit-tests.js) so the default DB-free lane
 // never runs it.
 //
 // Run:  DATABASE_URL=... node tests/pending_invite_purge_db.mjs

package/tests/permission_path.mjs

@@ -104,7 +104,7 @@ t('sub-Metic (thetes) touching a protected path → hardFail blocker', () => {
 });
 
 t('sub-Metic (xenos) touching a protected path → hardFail', () => {
-  const r = ppc.checkPermissionPaths({ changedFiles: ['scripts/gds/ship.js'], builderRank: 'xenos' });
+  const r = ppc.checkPermissionPaths({ changedFiles: ['scripts/bongos/ship.js'], builderRank: 'xenos' });
   assert.equal(r.hardFail, true);
 });
 

package/tests/pin_replay.mjs

@@ -18,7 +18,7 @@ import { spawnSync } from 'node:child_process';
 import { mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { pushUpgradePin } from '../scripts/gds/provision-core-upgrade.js';
+import { pushUpgradePin } from '../scripts/bongos/provision-core-upgrade.js';
 
 let passed = 0, failed = 0;
 const t = async (name, fn) => {

package/tests/pin_write_key.mjs

@@ -21,15 +21,15 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
 // ESM named imports: knip credits a CJS export only when a test imports it this way.
-import { pushUpgradePin } from '../scripts/gds/provision-core-upgrade.js';
-import { ensurePinWriteKey, pinKeyDir, pinKeyPath, pinKeyTitle } from '../scripts/gds/provision-pin-key.js';
+import { pushUpgradePin } from '../scripts/bongos/provision-core-upgrade.js';
+import { ensurePinWriteKey, pinKeyDir, pinKeyPath, pinKeyTitle } from '../scripts/bongos/provision-pin-key.js';
 
 const require = createRequire(import.meta.url);
 process.env.PROVISION_APP_USER = 'appsvc';
 process.env.PROVISION_PROCESS_MANAGER = 'systemd';
-const RP = require('../scripts/gds/provision-repo.js');
-const R = require('../scripts/gds/provision-core-upgrade.js');
-const P = require('../scripts/gds/provision.js');
+const RP = require('../scripts/bongos/provision-repo.js');
+const R = require('../scripts/bongos/provision-core-upgrade.js');
+const P = require('../scripts/bongos/provision.js');
 
 let passed = 0, failed = 0;
 const t = async (name, fn) => {
@@ -376,7 +376,7 @@ await t('teardown with NO token still removes the local write key and names it f
 });
 
 await t('DISCONNECT runs the teardown first, so the write key goes with it', async () => {
-  const D = require('../scripts/gds/provision-disconnect.js');
+  const D = require('../scripts/bongos/provision-disconnect.js');
   const r = teardownRig();
   r.deps.catalog = { forget: async () => ({ ok: true }) };
   await D.disconnectInstance(inst({ status: 'torn_down' }), r.deps).catch(() => {});
@@ -385,7 +385,7 @@ await t('DISCONNECT runs the teardown first, so the write key goes with it', asy
 });
 
 await t('provisioning a project mints the key at standup, after the scaffold and the pull-key wiring', async () => {
-  const src = readFileSync(new URL('../scripts/gds/provision.js', import.meta.url), 'utf8');
+  const src = readFileSync(new URL('../scripts/bongos/provision.js', import.meta.url), 'utf8');
   const i = src.indexOf('await ensurePrivateRepoAccess(inst, deps);');
   const j = src.indexOf('ensurePinWriteKey(inst, deps)');
   assert.ok(i > 0 && j > i && j - i < 400, 'ensurePinWriteKey follows ensurePrivateRepoAccess in the standalone branch');

package/tests/plain_cards.mjs

@@ -4,7 +4,7 @@
 // WHY. The CLIs explain a refusal in engineer prose and the lifecycle skills said
 // "relay verbatim", so a non-technical builder met REBASE_REQUIRED or
 // strand:pr_not_landed raw, at exactly the moment they were stuck. The registry in
-// scripts/gds/plain-cards.js says the same thing in plain words. This file holds
+// scripts/bongos/plain-cards.js says the same thing in plain words. This file holds
 // three lines: a new failure code cannot ship without a card, a card cannot drift
 // back into jargon, and the deliberate restrictions stay marked as deliberate.
 //
@@ -13,13 +13,13 @@
 import { strict as assert } from 'node:assert';
 import fs from 'node:fs';
 import { createRequire } from 'node:module';
-import { CARDS, cardFor, plainCardLines, PLAIN_MARKER } from '../scripts/gds/plain-cards.js';
-import * as shipLand from '../scripts/gds/ship-land.js';
+import { CARDS, cardFor, plainCardLines, PLAIN_MARKER } from '../scripts/bongos/plain-cards.js';
+import * as shipLand from '../scripts/bongos/ship-land.js';
 
 const require = createRequire(import.meta.url);
 const { JARGON_TERMS } = require('../modules/sessions/accessibility.js');
-const { formatClaimFailure, QUEUE_GATED_EXIT } = require('../scripts/gds/claim.js');
-const { formatGradeOutcome } = require('../scripts/gds/ship-grade-steps.js');
+const { formatClaimFailure, QUEUE_GATED_EXIT } = require('../scripts/bongos/claim.js');
+const { formatGradeOutcome } = require('../scripts/bongos/ship-grade-steps.js');
 
 let passed = 0;
 let failed = 0;
@@ -34,7 +34,7 @@ const missing = (codes) => [...new Set(codes)].filter((c) => !cardFor(c)).sort()
 // ── completeness: the codes are read out of the code that raises them ──────────
 
 test('every refusal claim.js renders has a card', () => {
-  const src = read('scripts/gds/claim.js');
+  const src = read('scripts/bongos/claim.js');
   const body = src.slice(src.indexOf('function claimFailureGuidance'), src.indexOf('function goalMembershipOfferPlan'));
   const codes = [...body.matchAll(/code === '([A-Za-z_]+)'/g)].map((m) => m[1]);
   assert.ok(codes.length >= 12, `expected the claim ladder, found ${codes.length}`);
@@ -164,11 +164,11 @@ test('a person at a terminal gets no card — it is written in the agent\'s voic
 
 test('the sign-in printers, the release refusals and the claim guard each print their card', () => {
   const wired = {
-    'scripts/gds/cli-lib.js': ['session_invalid', 'no_session'],
-    'scripts/gds/release.js': ['no_active_claim', 'CLAIM_SESSION_MISMATCH'],
-    'scripts/gds/claim.js': ['main_checkout_claim'],
-    'scripts/gds/ship-land.js': ['land_pending', 'reconcile_blocked', 'merge_conflict'], // merge_conflict: task 1003499
-    'scripts/gds/push-path-brief.js': ['no_push_credential'],
+    'scripts/bongos/cli-lib.js': ['session_invalid', 'no_session'],
+    'scripts/bongos/release.js': ['no_active_claim', 'CLAIM_SESSION_MISMATCH'],
+    'scripts/bongos/claim.js': ['main_checkout_claim'],
+    'scripts/bongos/ship-land.js': ['land_pending', 'reconcile_blocked', 'merge_conflict'], // merge_conflict: task 1003499
+    'scripts/bongos/push-path-brief.js': ['no_push_credential'],
   };
   for (const [file, codes] of Object.entries(wired)) {
     const src = read(file);
@@ -180,7 +180,7 @@ test('the sign-in printers, the release refusals and the claim guard each print
 });
 
 test('every way start.js can refuse or fail prints a card', () => {
-  const src = read('scripts/gds/start.js');
+  const src = read('scripts/bongos/start.js');
   // BOTH spellings, or this assertion pins the bug it was written above: ADR 0116
   // nests the slug as `{ error: { code } }`, so the flat `.error === 'slug'` compares
   // an object to a string and is never true. Task 1003658 moved the live site to
@@ -195,12 +195,12 @@ test('every way start.js can refuse or fail prints a card', () => {
 });
 
 test('no card is an orphan — each is printed by name, or belongs to a family a seam prints by code', () => {
-  const scripts = fs.readdirSync(new URL('../scripts/gds/', import.meta.url)).filter((f) => f.endsWith('.js') && f !== 'plain-cards.js');
+  const scripts = fs.readdirSync(new URL('../scripts/bongos/', import.meta.url)).filter((f) => f.endsWith('.js') && f !== 'plain-cards.js');
   const printed = new Set();
-  for (const f of scripts) for (const m of read(`scripts/gds/${f}`).matchAll(/plainCardLines\('([^']+)'\)/g)) printed.add(m[1]);
+  for (const f of scripts) for (const m of read(`scripts/bongos/${f}`).matchAll(/plainCardLines\('([^']+)'\)/g)) printed.add(m[1]);
   // Families reach plainCardLines through a variable: the claim refusal code, the
   // flagged strand reason, the merge reason on a red pull request, `ship:${d.id}`.
-  const claimSrc = read('scripts/gds/claim.js') + read('modules/lifecycle/db-claims.js') + read('modules/lifecycle/routes/claims.js') + read('modules/lifecycle/goal-authz.js');
+  const claimSrc = read('scripts/bongos/claim.js') + read('modules/lifecycle/db-claims.js') + read('modules/lifecycle/routes/claims.js') + read('modules/lifecycle/goal-authz.js');
   const mergeSrc = read('modules/lifecycle/github-push.js');
   const byFamily = (code) => code.startsWith('strand:') || code.startsWith('ship:')
     || claimSrc.includes(`'${code}'`) || mergeSrc.includes(`'${code}'`) || mergeSrc.includes(`\`${code}:`);

package/tests/pr_assign.mjs

@@ -19,7 +19,7 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import http from 'node:http';
-import { prAssigneeLine } from '../scripts/gds/ship-land.js';
+import { prAssigneeLine } from '../scripts/bongos/ship-land.js';
 
 process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);

package/tests/pre_push_hook.mjs

@@ -2,7 +2,7 @@
 //
 // Pins three facts the 2026-08-06 choke-point map litigated:
 //   1. G-17 refutation: pre-push.js's dependency path resolves INSIDE the repo
-//      (three `..` from scripts/gds/hooks/ is the root, not one above it).
+//      (three `..` from scripts/bongos/hooks/ is the root, not one above it).
 //   2. The hook actually blocks a direct push to refs/heads/main (exit 13, the
 //      reserved block code the wrapper turns into git's exit 1), and allows a
 //      branch deletion (exit 0) — both offline-deterministic.
@@ -27,7 +27,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const HOOK = path.join(ROOT, 'scripts', 'gds', 'hooks', 'pre-push.js');
+const HOOK = path.join(ROOT, 'scripts', 'bongos', 'hooks', 'pre-push.js');
 const WRAPPER = path.join(ROOT, '.husky', 'pre-push');
 const SHA = 'a'.repeat(40);
 const ZEROS = '0'.repeat(40);
@@ -96,7 +96,7 @@ test('G-2 fixed: tracked .husky/pre-push wrapper invokes the real gate', () => {
   assert.ok(fs.existsSync(WRAPPER), '.husky/pre-push must be tracked (ADR 0043 Layer 1 delivery)');
   const body = fs.readFileSync(WRAPPER, 'utf8');
   assert.ok(body.startsWith('#!/bin/sh'), 'wrapper must start with a sh shebang');
-  assert.match(body, /scripts\/gds\/hooks\/pre-push\.js/, 'wrapper must invoke the real gate');
+  assert.match(body, /scripts\/(?:gds|bongos)\/hooks\/pre-push\.js/, 'wrapper must invoke the real gate');
   assert.ok(!body.includes('\r'), 'wrapper must be LF-only (CRLF breaks the shebang on Unix)');
 });
 

package/tests/preflight_checks.mjs

@@ -1,6 +1,6 @@
 // tests/preflight_checks.mjs
 //
-// Unit test for scripts/gds/preflight.js `preflightChecks()` (task 1002401,
+// Unit test for scripts/bongos/preflight.js `preflightChecks()` (task 1002401,
 // onboarding-audit area 4) — the pure onboarding environment preflight shared by
 // /builder-setup and `bongos doctor`. DB-free and does zero real I/O: node
 // version, fs, and child_process are all injected, so we assert the real
@@ -11,7 +11,7 @@ import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { preflightChecks, formatPreflight } = require('../scripts/gds/preflight.js');
+const { preflightChecks, formatPreflight } = require('../scripts/bongos/preflight.js');
 
 const okSpawn = () => ({ status: 0, stdout: '1.2.3 (Claude Code)\n' });
 const badSpawn = () => ({ error: Object.assign(new Error('spawn claude ENOENT'), { code: 'ENOENT' }) });

package/tests/prelaunch_gate.mjs

@@ -313,7 +313,7 @@ test('the wire format did NOT move — renaming it would log everyone out', () =
 // load-bearing tests are the MUTATION tests. A rule that cannot be made to fail
 // is not a rule.
 
-const fitness = require('../scripts/gds/fitness.js');
+const fitness = require('../scripts/bongos/fitness.js');
 
 test('the pre-launch surface is clean today', () => {
   const r = fitness.checkPrelaunchVocabulary();

package/tests/privacy_matrix.mjs

@@ -885,7 +885,7 @@ test('an expired invite refuses sign-in through the real admission read; a live
 // ===========================================================================
 
 test('this proof runs in the DB-free unit lane', () => {
-  const runner = fs.readFileSync(path.join(ROOT, 'scripts/gds/run-unit-tests.js'), 'utf8');
+  const runner = fs.readFileSync(path.join(ROOT, 'scripts/bongos/run-unit-tests.js'), 'utf8');
   assert.ok(!/privacy_matrix/.test(runner),
     'named in run-unit-tests.js it would be parked into INTEGRATION or KNOWN_FAILING and gate nothing (learning 1000218)');
 });

package/tests/probe_cache.mjs

@@ -23,7 +23,7 @@ import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const pc = require('../scripts/gds/probe-cache.js');
+const pc = require('../scripts/bongos/probe-cache.js');
 
 // fileURLToPath, never URL.pathname (fitness check 30 / task 1002889): a %20 or a
 // Windows drive slash makes require() throw at load, and CI's spaceless checkout
@@ -89,10 +89,10 @@ test('a producer that throws is NOT cached, and the error reaches the caller', a
 test('four concurrent PROCESSES on a cold cache produce ONE call, and all four get the answer', async () => {
   const counter = path.join(os.tmpdir(), `bongos-probe-test-${Date.now()}.txt`);
   try { fs.rmSync(counter, { force: true }); } catch { /* not there */ }
-  execFileSync(process.execPath, [path.join(REPO_ROOT, 'scripts', 'gds', 'probe-cache.js'), '--clear'], { encoding: 'utf8' });
+  execFileSync(process.execPath, [path.join(REPO_ROOT, 'scripts', 'bongos', 'probe-cache.js'), '--clear'], { encoding: 'utf8' });
 
   const child = `
-    const pc = require(${JSON.stringify(path.join(REPO_ROOT, 'scripts', 'gds', 'probe-cache.js'))});
+    const pc = require(${JSON.stringify(path.join(REPO_ROOT, 'scripts', 'bongos', 'probe-cache.js'))});
     const fs = require('fs');
     (async () => {
       const r = await pc.cached('probe-cache-concurrency-test', async () => {
@@ -132,7 +132,7 @@ test('four concurrent PROCESSES on a cold cache produce ONE call, and all four g
 test('four processes in DIFFERENT worktrees of one checkout still share the answer', async () => {
   const counter = path.join(os.tmpdir(), `bongos-probe-wt-${Date.now()}.txt`);
   try { fs.rmSync(counter, { force: true }); } catch { /* not there */ }
-  execFileSync(process.execPath, [path.join(REPO_ROOT, 'scripts', 'gds', 'probe-cache.js'), '--clear'], { encoding: 'utf8' });
+  execFileSync(process.execPath, [path.join(REPO_ROOT, 'scripts', 'bongos', 'probe-cache.js'), '--clear'], { encoding: 'utf8' });
 
   // Four real directories inside this checkout — different cwds, one git common dir,
   // which is exactly the shape of four claim worktrees.
@@ -141,7 +141,7 @@ test('four processes in DIFFERENT worktrees of one checkout still share the answ
   assert.equal(cwds.length, 4, 'need four real directories in this checkout to model four worktrees');
 
   const child = `
-    const pc = require(${JSON.stringify(path.join(REPO_ROOT, 'scripts', 'gds', 'probe-cache.js'))});
+    const pc = require(${JSON.stringify(path.join(REPO_ROOT, 'scripts', 'bongos', 'probe-cache.js'))});
     const fs = require('fs');
     (async () => {
       const r = await pc.cached('probe-cache-worktree-test', async () => {
@@ -192,7 +192,7 @@ test('clear() with no argument actually empties the cache', async () => {
 test('the three SessionStart hooks that call the server all go through the cache', () => {
   // The wiring is the deliverable; the cache alone changes nothing. These are the three
   // that make network calls — the other three SessionStart hooks are local git.
-  for (const rel of ['scripts/gds/strand-watch.js', 'scripts/gds/deploy-divergence.js', 'scripts/gds/fetch-sound-prefs.js']) {
+  for (const rel of ['scripts/bongos/strand-watch.js', 'scripts/bongos/deploy-divergence.js', 'scripts/bongos/fetch-sound-prefs.js']) {
     const src = fs.readFileSync(path.join(REPO_ROOT, rel), 'utf8');
     assert.match(src, /require\('\.\/probe-cache\.js'\)/, `${rel} must share its answer with concurrent sessions`);
     assert.match(src, /cached\(/, `${rel} must actually call cached(), not merely import it`);

package/tests/profile_connections_ui.mjs

@@ -496,6 +496,7 @@ function boot({ transport, hub = HUB } = {}) {
   const sandbox = {
     console: { error() {}, warn() {}, log() {} },
     window: {
+      OTBAsk: require('../modules/hall-ui/public/hall-ask.js'),
       BongosClient: { createClient: () => api },
       OTB: { $, escapeHtml, fmtDate: (d) => String(d).slice(0, 10), toast: (m) => toasts.push(m), hubOrigin: () => hub },
       OTBKit: {
@@ -842,7 +843,7 @@ test('an incoming request turns the connect button into a decision, not a second
   edge(NEW, ME, 'pending', { created_at: Date.now() - DAY, note: 'hello' });
   const page = boot();
   await page.render(profileOf('newbie', 18), 99);
-  assert.match(page.html(), /They have asked to connect\./);
+  assert.match(page.html(), /class="hask"[^]*Connect with @[a-z]+\?/, 'an incoming request is the ask card (task 1004827)');
   assert.match(page.html(), /data-act="accept"/);
   assert.match(page.html(), /data-act="decline"/);
   assert.doesNotMatch(page.html(), /data-act="connect"/, 'asking back would be a duplicate the database refuses anyway');
@@ -874,7 +875,7 @@ test('seen_at never reaches the screen, on either side of a request', async () =
   edges = edges.filter((r) => !(r.status === 'accepted' && r.requester_github_id === ME && r.addressee_github_id === ADA));
   const page = boot();
   await page.render(profileOf('ada', 11), 99); // ADA's profile: her request is the decision there
-  assert.match(page.html(), /They have asked to connect\./);
+  assert.match(page.html(), /class="hask"[^]*Connect with @[a-z]+\?/, 'an incoming request is the ask card (task 1004827)');
   assert.doesNotMatch(page.html(), /seen/i);
   assert.doesNotMatch(page.html(), new RegExp(new Date(stamped.seen_at).toISOString().slice(0, 10) + 'T'));
   // and the API never even hands the requester one
@@ -1108,7 +1109,7 @@ test('a signed-out visitor is offered no connect affordance', async () => {
 // ===========================================================================
 
 test('this proof runs in the DB-free lane that executes on every PR', () => {
-  const runner = readFileSync(join(ROOT, 'scripts', 'gds', 'run-unit-tests.js'), 'utf8');
+  const runner = readFileSync(join(ROOT, 'scripts', 'bongos', 'run-unit-tests.js'), 'utf8');
   assert.ok(
     !/profile_connections_ui/.test(runner),
     'named in run-unit-tests.js means parked into INTEGRATION or KNOWN_FAILING — where CI has no Postgres, this file would self-skip forever and gate nothing',