@bongos/core 1.21.175 → 1.21.177

package/tests/profile_fields.mjs

@@ -61,6 +61,13 @@ try {
   await q(migrationSql('platform_identity_009_profile_fields.sql'));
   // Idempotence is part of what this proves.
   await q(migrationSql('platform_identity_009_profile_fields.sql'));
+  // The two consent/visibility columns section 5's public read filters on
+  // (accountVisibleSql) — applied here, as handle_machinery does, so the file
+  // stays self-sufficient on a database migrate.sh never touched (task 1004864).
+  await q(migrationSql('platform_identity_012_account_privacy.sql'));
+  await q(migrationSql('platform_identity_019_terms_acceptance.sql'));
+  // upsertAccount (section 2's re-sync) writes terms_accepted_source.
+  await q(migrationSql('platform_identity_024_terms_grandfathered.sql'));
   await cleanup();
 
   // --- 1. INSERT branch: unseen builder fills their profile ahead of time ---
@@ -92,7 +99,10 @@ try {
   ok(a.display_name === 'GH New', 'a never-renamed account still follows GitHub renames');
 
   // --- 3. the UPDATE branch touches only what was sent ----------------------
-  await q(`UPDATE platform_identity_accounts SET profile_state = 'active', hide_stats = true WHERE github_id = $1`, [FRESH]);
+  // A publicly addressable account needs BOTH consent columns (ADR 0213, task
+  // 1002913 — accountActiveSql): profile_state='active' alone left section 5's
+  // public read resolving to null once that rule landed (task 1004864).
+  await q(`UPDATE platform_identity_accounts SET profile_state = 'active', terms_accepted_at = now(), hide_stats = true WHERE github_id = $1`, [FRESH]);
   await pi.setAccountProfileFields({ githubId: FRESH, githubLogin: 'p02fresh-renamed', fields: { bio: 'Just the bio.' } }, { pool });
   a = await acctOf(FRESH);
   ok(a.bio === 'Just the bio.', 'bio alone updates');

package/tests/profile_privacy_owner_view.mjs

@@ -527,7 +527,7 @@ test('the own-scope door is closed to an unauthenticated caller', async () => {
 // ===========================================================================
 
 test('this proof runs in the DB-free lane that executes on every PR', () => {
-  const runner = fs.readFileSync(join(ROOT, 'scripts', 'gds', 'run-unit-tests.js'), 'utf8');
+  const runner = fs.readFileSync(join(ROOT, 'scripts', 'bongos', 'run-unit-tests.js'), 'utf8');
   assert.ok(
     !/profile_privacy_owner_view/.test(runner),
     'named in run-unit-tests.js means parked into INTEGRATION or KNOWN_FAILING — where CI has no Postgres, this file would self-skip forever and gate nothing',

package/tests/profile_role_headline.mjs

@@ -35,7 +35,7 @@ const PAGE_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/profile
 const ENGINEER = FIX('builders__profile');
 const ARTIST = FIX('builders__2001__profile');
 const IDEATOR = FIX('builders__2002__profile');
-const OPTS = { fmt: (n) => Number(n).toLocaleString('en-US'), currency: 'credits', rank: 'Contributor' };
+const OPTS = { fmt: (n) => Number(n).toLocaleString('en-US'), currency: 'credits' };
 const words = (items) => items.map((t) => `${t.n} ${t.w}`);
 
 const { test, summary } = makeRunner();
@@ -46,7 +46,7 @@ await test('an engineer leads with works shipped, and keeps karma', () => {
   const v = headline(ENGINEER, OPTS);
   assert.deepEqual(words(v.tally), ['4,630 credits', '24 works shipped', '1 karma']);
   assert.deepEqual(words(v.tiles).slice(0, 4), ['24 works shipped', '4,630 credits', '1 karma', '2 achievements']);
-  assert.equal(v.sub, 'Builder 4 — Contributor · 24 works shipped');
+  assert.equal(`${v.tally[1].n} ${v.tally[1].w}`, '24 works shipped', 'the main craft leads the tally');
   assert.deepEqual(v.surfaces, [], 'the per-surface rows are the artist\'s');
 });
 
@@ -55,8 +55,9 @@ await test('an artist who never shipped a task leads with pages approved and the
   assert.deepEqual(words(v.tally), ['412 credits', '9 pages approved', '+38 this week']);
   assert.deepEqual(words(v.tiles), ['9 pages approved', '270 credits from pages', '+38 this week', '4 thoughts filed', '6 karma']);
   assert.equal(v.tiles[0].f, '3 surfaces');
-  assert.equal(v.sub, 'Builder 7 — Contributor · 9 pages approved');
-  assert.ok(!v.sub.includes('works shipped'), 'the subtitle no longer says works shipped for an artist');
+  assert.equal(`${v.tally[1].n} ${v.tally[1].w}`, '9 pages approved', 'the main craft leads the tally');
+  assert.ok(!v.tally.some((t) => t.w === 'works shipped'), 'an artist\'s tally never says works shipped');
+  assert.ok(!('sub' in v), 'no sub-line is computed: the page has none (task 1004827)');
   assert.deepEqual(v.surfaces.map((s) => s.line), ['6 of 12 tweaked', '2 of 19 tweaked', '1 of 6 tweaked']);
   assert.ok(!words(v.tiles).some((w) => /works shipped/.test(w)), 'no engineer figure on an artist\'s numbers');
   assert.equal(words(v.tiles).at(-1), '6 karma', 'karma ends every non-engineer set (the owner, 2026-10-01)');
@@ -68,7 +69,7 @@ await test('an ideator leads with thoughts, size and what is still alive', () =>
   assert.deepEqual(words(v.tiles), ['14 thoughts filed', '7 ignited', '3 Full Ideas', '186~ total size', '72% still alive', '3 karma']);
   assert.equal(v.tiles[2].f, '1 ratified by the board');
   assert.match(v.tiles[3].title, /Includes 24 credits of historical estimate/, 'the ~ says what it means');
-  assert.equal(v.sub, 'Builder 9 — Contributor · 14 thoughts filed');
+  assert.equal(`${v.tally[1].n} ${v.tally[1].w}`, '14 thoughts filed', 'the main craft leads the tally');
 });
 
 await test('several crafts each show, main first, in the server\'s order', () => {
@@ -98,7 +99,7 @@ await test('a response from before the roles block reads as the engineer it alwa
   const { roles, ...old } = ENGINEER;
   const v = headline(old, OPTS);
   assert.deepEqual(v.crafts.map((c) => c.label), ['Engineer, main role']);
-  assert.equal(v.sub, 'Builder 4 — Contributor · 24 works shipped');
+  assert.equal(`${v.tally[1].n} ${v.tally[1].w}`, '24 works shipped', 'the main craft leads the tally');
 });
 
 // ---- 2. the page ---------------------------------------------------------
@@ -152,7 +153,7 @@ const text = (html) => html.replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim()
 
 await test('the real page draws the artist\'s tally, chips, tiles and surface rows', async () => {
   const p = await boot(ARTIST);
-  assert.equal(p.sub, 'Builder 7 — Contributor · 9 pages approved');
+  assert.equal(p.sub, '', 'no sub-line: the head names the person, rank and headline (task 1004827)');
   assert.match(text(p.head), /Artist, main role Ideator/);
   assert.match(text(p.head), /412 credits 9 pages approved \+38 this week/);
   assert.match(p.head, /Answerable for:/, 'the responsibility line stays');
@@ -169,7 +170,7 @@ await test('the real page draws the ideator\'s and the engineer\'s own headlines
   assert.match(text(i.nums), /72% still alive/);
   assert.ok(!i.nums.includes('kit-bars'), 'no surface rows for an ideator');
   const e = await boot({ ...ENGINEER, recent_ships: [] }); // the works ledger is not this suite's
-  assert.equal(e.sub, 'Builder 4 — Contributor · 24 works shipped');
+  assert.equal(e.sub, '', 'no sub-line (task 1004827)');
   assert.match(text(e.head), /4,630 credits 24 works shipped 1 karma/);
 });
 
@@ -192,7 +193,7 @@ await test('the server\'s roles block, through JSON, renders the artist\'s headl
   seams._reset();
   const { roles: _fixture, ...rest } = ARTIST;
   const p = await boot({ ...rest, roles });
-  assert.equal(p.sub, 'Builder 7 — Contributor · 9 pages approved');
+  assert.equal(p.sub, '', 'no sub-line (task 1004827)');
   assert.match(text(p.head), /Artist, main role Ideator/);
   assert.match(text(p.head), /412 credits 9 pages approved \+38 this week/);
   assert.equal((p.nums.match(/kit-bars__row/g) || []).length, 3);

package/tests/project_admin_console_model.mjs

@@ -28,7 +28,7 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const ADR_DIR = path.join(ROOT, 'docs', 'adr');
 const ADR_SLUG = 'an-invite-is-a-pre-approved-row-on-the-projects-own-instance.md';
 const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
-const { stripComments } = require(path.join(ROOT, 'scripts', 'gds', 'category-advisory-guard.js'));
+const { stripComments } = require(path.join(ROOT, 'scripts', 'bongos', 'category-advisory-guard.js'));
 
 const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8');
 

package/tests/projects_hub.mjs

@@ -134,7 +134,7 @@ test('the hub carries the static mark; the self-typing wordmark lives on the lan
   // live on the landing page". Here the bongo-pair glyph and the product name
   // are plain type; the mark is the only way home and is labelled from the
   // product name a re-branded instance stamps, never from its visible text.
-  assert.match(HUB, /<a class="barMark" id="barMark" href="\/">\s*<svg viewBox="0 0 26 20" aria-hidden="true"/);
+  assert.match(HUB, /<a class="barMark" id="barMark" href="\/">\s*<svg class="bongosMark" viewBox="0 0 200 200" aria-hidden="true"/);
   assert.match(HUB, /<span data-brand-product-inline>Cloud Bongos<\/span>\s*<\/a>/);
   assert.doesNotMatch(HUB, /id="markLeft"|id="markPrefix"|id="markWord"|id="markMeasure"|class="caret"/, 'no typing apparatus on the hub');
   assert.doesNotMatch(SCRIPT, /function typeMark|var PREFIXES/, 'no typing loop on the hub');

package/tests/projects_hub_cloud_hop.mjs

@@ -80,7 +80,7 @@ test('the game opens in place only when asked, and its link says so', () => {
   assert.equal(h.link.textContent, 'Play cloud hop while you wait');
   assert.equal(h.sandbox.hop.target, '');
   assert.equal(h.calls.stop, 1);
-  assert.match(HUB, /<button type="button" class="hopLink" id="hopLink" aria-expanded="false" aria-controls="hop">Play cloud hop while you wait<\/button>\s*<div class="hop" id="hop" hidden>/,
+  assert.match(HUB, /<button type="button" class="btn small ghost hopLink" id="hopLink" aria-expanded="false" aria-controls="hop">Play cloud hop while you wait<\/button>\s*<\/div>\s*<div class="hop" id="hop" hidden>/,
     'baked shut, behind the mockup\'s link');
   assert.match(SCRIPT, /\$\('hopLink'\)\.addEventListener\('click', function \(\) \{ hopOpen\(\$\('hop'\)\.hidden\); \}\);/, 'the link is the only way in');
   assert.match(fn('hopStart'), /if \(!hop \|\| !hopEl \|\| hopEl\.hidden\) return;/, 'a closed game never starts, not on a resize nor a tab coming back');

package/tests/promote_goal_id.mjs

@@ -35,11 +35,11 @@ const { test, summary } = makeRunner();
 // to be in place BEFORE the module loads. Dropping both from the require cache
 // and re-requiring is what makes that possible per-test.
 function freshTriage() {
-  delete require.cache[require.resolve('../scripts/gds/triage.js')];
-  return require('../scripts/gds/triage.js');
+  delete require.cache[require.resolve('../scripts/bongos/triage.js')];
+  return require('../scripts/bongos/triage.js');
 }
 
-const TRIAGE = readFileSync(new URL('../scripts/gds/triage.js', import.meta.url), 'utf8');
+const TRIAGE = readFileSync(new URL('../scripts/bongos/triage.js', import.meta.url), 'utf8');
 const HALL = readFileSync(new URL('../modules/hall-ui/public/task-detail.js', import.meta.url), 'utf8');
 const SKILL = readFileSync(new URL('../.claude/skills/idea-triage/SKILL.md', import.meta.url), 'utf8');
 
@@ -49,7 +49,7 @@ const SKILL = readFileSync(new URL('../.claude/skills/idea-triage/SKILL.md', imp
 // not stand in for actually running it.
 // ==========================================================================
 
-const triage = require('../scripts/gds/triage.js');
+const triage = require('../scripts/bongos/triage.js');
 
 // A stub of the generated typed client: records the call, answers from a script.
 function stubClient(answer) {
@@ -181,7 +181,7 @@ await test('BEHAVIOUR: createTask puts goal_id on the body, and REFUSES when it
   const fakeClient = {
     tasks: { postTasks: async (req) => { seen.push(req.body); return { ok: true, data: { task: { id: 7 } } }; } },
   };
-  const cliLib = require('../scripts/gds/cli-lib.js');
+  const cliLib = require('../scripts/bongos/cli-lib.js');
   const realCliClient = cliLib.cliClient;
   cliLib.cliClient = async () => fakeClient;
   try {
@@ -207,7 +207,7 @@ await test('BEHAVIOUR: createTask puts goal_id on the body, and REFUSES when it
 });
 
 await test('BEHAVIOUR: a failed create throws with the status, it does not return a phantom task', async () => {
-  const cliLib = require('../scripts/gds/cli-lib.js');
+  const cliLib = require('../scripts/bongos/cli-lib.js');
   const realCliClient = cliLib.cliClient;
   cliLib.cliClient = async () => ({
     tasks: { postTasks: async () => ({ ok: false, status: 422, data: { error: 'NO_SUCH_GOAL' } }) },

package/tests/promotion_sweep.mjs

@@ -12,7 +12,7 @@
 // stuck the same way: the ship event already happened.
 //
 // HOW THESE TESTS PROVE A GUARD, and where that proof stops. CI runs a DB-free
-// unit gate (scripts/gds/run-unit-tests.js excludes anything needing Postgres,
+// unit gate (scripts/bongos/run-unit-tests.js excludes anything needing Postgres,
 // and no workflow provides a Postgres service), so a fixture-in-a-real-database
 // test would run nowhere. Instead the fake pool below answers the way the
 // database would GIVEN THE GUARDS THE STATEMENT ACTUALLY CARRIES: a blocked row

package/tests/provision.mjs

@@ -1,7 +1,7 @@
 // tests/provision.mjs
 //
 // Hermetic unit smoke for the instance-provisioning control-plane runner
-// (scripts/gds/provision.js, ADR 0111 §2/§3, task #1944). Covers the PURE runbook
+// (scripts/bongos/provision.js, ADR 0111 §2/§3, task #1944). Covers the PURE runbook
 // step-command generators, port allocation, and the dry-run COMPOSITION of
 // provisionInstance / teardownInstance / cmdRunIntents — all with NO database, NO
 // DigitalOcean, NO shell, NO network (exec + writeFile + db are recording fakes).
@@ -17,10 +17,10 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 const require = createRequire(import.meta.url);
-const P = require('../scripts/gds/provision.js');
-const PR = require('../scripts/gds/provision-repo.js'); // task 1004735: dbOwnershipSql/Cmd are not re-exported through provision.js
-const AP = require('../scripts/gds/instance-apex.js');
-const RP = require('../scripts/gds/provision-repo.js');
+const P = require('../scripts/bongos/provision.js');
+const PR = require('../scripts/bongos/provision-repo.js'); // task 1004735: dbOwnershipSql/Cmd are not re-exported through provision.js
+const AP = require('../scripts/bongos/instance-apex.js');
+const RP = require('../scripts/bongos/provision-repo.js');
 
 // The env-var prefix a provisioned instance resolves = the envPrefix an instance INHERITS from
 // the neutral pack (task 1003740: webEnvBody no longer pins a branding pack anywhere — the
@@ -224,9 +224,9 @@ t('backupScriptPath resolves the CONSUMER LAYOUT, never the old /home/lars/examp
   const standalone = { ...coTenant, hosting_shape: 'cloud-host' };
   const sPath = P.backupScriptPath(standalone);
   assert.ok(sPath.startsWith(P.standaloneRoot(standalone) + '/'), 'under the instance root');
-  assert.match(sPath, /node_modules\/@bongos\/core\/scripts\/gds\/db-backup-nightly\.sh$/);
-  // co-tenant → this control-plane checkout's scripts/gds (mirrors serviceUnit's REPO_ROOT split)
-  assert.match(P.backupScriptPath(coTenant), /\/scripts\/gds\/db-backup-nightly\.sh$/);
+  assert.match(sPath, /node_modules\/@bongos\/core\/scripts\/(?:gds|bongos)\/db-backup-nightly\.sh$/);
+  // co-tenant → this control-plane checkout's scripts/bongos (mirrors serviceUnit's REPO_ROOT split)
+  assert.match(P.backupScriptPath(coTenant), /\/scripts\/(?:gds|bongos)\/db-backup-nightly\.sh$/);
   // the regression this whole task fixes: NEVER the hardcoded old monorepo path
   assert.doesNotMatch(P.backupService(standalone), /\/home\/lars\/example/);
   assert.doesNotMatch(P.backupService(coTenant), /\/home\/lars\/example/);
@@ -267,7 +267,7 @@ t('webEnvBody: an instance is never pinned to the neutral pack, so it serves its
 });
 
 t('identityVerdict: a live instance serving the PLATFORM name is caught, not shrugged at (task 1003740)', () => {
-  const N = require('../scripts/gds/provision-net.js');
+  const N = require('../scripts/bongos/provision-net.js');
   const neutralName = 'Cloud Bongos';
 
   // The bug's exact live shape — healthz was green the whole time this was true.
@@ -291,7 +291,7 @@ t('identityVerdict: a live instance serving the PLATFORM name is caught, not shr
 });
 
 t('identityCmd: probes the manifest over loopback, like healthzCmd', () => {
-  const N = require('../scripts/gds/provision-net.js');
+  const N = require('../scripts/bongos/provision-net.js');
   assert.match(N.identityCmd({ port: 3011 }), /127\.0\.0\.1:3011\/api\/bongos\/instance/);
 });
 
@@ -478,7 +478,7 @@ await ta('provisionInstance(standalone): the backup unit ExecStart points at the
   const svc = bodies[P.backupServicePath(inst)];
   assert.ok(svc, 'wrote the backup service unit');
   const root = P.standaloneRoot(inst);
-  assert.match(svc, new RegExp('ExecStart=/bin/bash ' + reEsc(root) + '/node_modules/@bongos/core/scripts/gds/db-backup-nightly\\.sh'));
+  assert.match(svc, new RegExp('ExecStart=/bin/bash ' + reEsc(root) + '/node_modules/@bongos/core/scripts/bongos/db-backup-nightly\\.sh'));
   assert.match(svc, /Environment=GDS_BACKUP_DB=mercury/);
 });
 
@@ -505,7 +505,7 @@ await ta('provisionInstance(standalone) SCAFFOLDS its repo, then syncs (pull + n
   // scaffold leg (task 2055): git init → package-core → init --vendor-core → push
   assert.match(joined, /git -C \S+ init -q/, 'inits the instance working tree (empty repo — nothing to clone)');
   assert.match(joined, /git -C \S+ remote add origin git@github-deploy:example-owner\/mercury\.git/, 'sets the instance repo as origin');
-  assert.match(joined, /node scripts\/gds\/package-core\.js/, 'builds the core tarball');
+  assert.match(joined, /node scripts\/(?:gds|bongos)\/package-core\.js/, 'builds the core tarball');
   assert.match(joined, /init\.js --from .* --dir .* --no-seed --force --vendor-core /, 'materializes + file:-pins the core');
   assert.match(joined, /git -C .* push -u origin main/, 'pushes the scaffold');
   // then the code sync + migrate
@@ -568,7 +568,7 @@ t('instanceRepoRemote: the deploy alias only where it RESOLVES, else github.com
 });
 
 t('instanceRepoRemotes: the accept-set a stored remote is validated against, probe-free', () => {
-  const { instanceRepoRemotes } = createRequire(import.meta.url)('../scripts/gds/provision-repo-auth.js');
+  const { instanceRepoRemotes } = createRequire(import.meta.url)('../scripts/bongos/provision-repo-auth.js');
   const urls = instanceRepoRemotes({ owner: 'o', name: 'r' });
   // github-deploy is in the set even here, where it does NOT resolve: upgrade.js must keep
   // recognising a remote an alias-carrying box wrote.
@@ -582,7 +582,7 @@ t('instanceRepoRemotes: the accept-set a stored remote is validated against, pro
 });
 
 // ── the process-manager seam (task 1003997, ADR 0306) ───────────────────────
-const PM = createRequire(import.meta.url)('../scripts/gds/provision-process.js');
+const PM = createRequire(import.meta.url)('../scripts/bongos/provision-process.js');
 
 // A recording io: the same { exec, writeFile, sudoP, log } shape the runbook hands over.
 function recordIo({ sudoP = '' } = {}) {
@@ -701,7 +701,7 @@ t('instanceInitSpec: builds a VALID greenfield init spec from the row + owner lo
   assert.equal(spec.firstAdmin, 'example-owner');
   assert.equal(spec.domains.publicOrigin, 'https://demo.cloudbongos.com');
   // it must satisfy init.validateSpec (greenfield) — the scaffold feeds it to `bongos init`
-  const init = require('../scripts/gds/init.js');
+  const init = require('../scripts/bongos/init.js');
   assert.deepEqual(init.validateSpec(init.normalizeSpec(spec)), [], 'spec passes greenfield validation');
 });
 
@@ -832,7 +832,7 @@ async function scaffoldWithEnv(env) {
 // a test that merely stopped mentioning them would pass whether or not the fork came back.
 await ta('scaffoldStandaloneRepo: the retired PROVISION_CORE_FROM_REGISTRY env no longer diverts to the registry', async () => {
   const joined = await scaffoldWithEnv({ PROVISION_CORE_FROM_REGISTRY: '1', NPM_TOKEN: 'npm_readonly' });
-  assert.match(joined, /node scripts\/gds\/package-core\.js/, 'still vendors — the env var is inert');
+  assert.match(joined, /node scripts\/(?:gds|bongos)\/package-core\.js/, 'still vendors — the env var is inert');
   assert.match(joined, /init\.js --from .* --dir .* --no-seed --force --vendor-core /, 'file:-pins the vendored tarball');
   assert.ok(!/--registry-core/.test(joined), 'the retired env var must not resurrect the registry path');
 });
@@ -862,7 +862,7 @@ await ta('scaffoldStandaloneRepo: a token in env changes NOTHING about the insta
 
 await ta('scaffoldStandaloneRepo: default (no registry env) stays on the vendored tarball path', async () => {
   const joined = await scaffoldWithEnv({});
-  assert.match(joined, /node scripts\/gds\/package-core\.js/, 'vendored is the default');
+  assert.match(joined, /node scripts\/(?:gds|bongos)\/package-core\.js/, 'vendored is the default');
   assert.match(joined, /--vendor-core /);
   assert.ok(!/--registry-core/.test(joined));
 });
@@ -1034,13 +1034,13 @@ t('resolveVendorableCoreTarball: the ladder picks file: pin → registry pack
   // Rung 3 — a source checkout WITH history rebuilds reproducibly from the ref.
   const source = mkdtempSync(join(tmpdir(), 'rvct-src-'));
   const r3 = run(source, gitRoot);
-  assert.deepEqual(r3.cmds, ['node scripts/gds/package-core.js'], 'history present → the ref build, NOT --from-worktree');
+  assert.deepEqual(r3.cmds, ['node scripts/bongos/package-core.js'], 'history present → the ref build, NOT --from-worktree');
   assert.equal(r3.tgz, join(gitRoot, 'dist', 'bongos-core-9.9.9.tgz'));
   assert.equal(r3.packDest, null);
 
   // Rung 4 — the same source checkout with its history stripped: the self-host image.
   const r4 = run(source, bareRoot);
-  assert.deepEqual(r4.cmds, ['node scripts/gds/package-core.js --from-worktree'], 'no history → pack the working tree');
+  assert.deepEqual(r4.cmds, ['node scripts/bongos/package-core.js --from-worktree'], 'no history → pack the working tree');
   assert.equal(r4.tgz, join(bareRoot, 'dist', 'bongos-core-9.9.9.tgz'), 'the child still pins the running CORE_VERSION');
 
   [gitRoot, bareRoot, filePinned, reg, source].forEach((d) => rmSync(d, { recursive: true, force: true }));
@@ -1358,7 +1358,7 @@ async function adoptWithPack(packText, mode = 'adopt') {
     rmSync(base, { recursive: true, force: true });
   }
 }
-const U2 = require('../scripts/gds/provision-units.js');
+const U2 = require('../scripts/bongos/provision-units.js');
 
 // The write path comes from path.join, so it carries `\` on Windows: every match below
 // takes either separator. Slash-only, the positive case failed there and the two
@@ -1578,7 +1578,7 @@ await ta('cmdRunIntents opens with the runner core version + path, so a journal
       exec: () => ({ ok: true }), writeFile: () => ({ ok: true }),
     };
     await P.cmdRunIntents(deps);
-    const { REPO_ROOT } = require('../scripts/gds/provision-config.js');
+    const { REPO_ROOT } = require('../scripts/bongos/provision-config.js');
     assert.equal(lines[0], `runner core ${P.coreVersionSafe()} from ${REPO_ROOT} (no installed core at /no/such/instance)`, `apply=${apply}`);
   }
 });
@@ -1776,9 +1776,9 @@ await ta('the sign-in check reads the JSON health answer, never the root /health
   // and a plain "ok" is no verdict either way: it never reads as configured
   const plain = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, { ...deps, exec: () => ({ ok: true, stdout: 'ok' }) });
   assert.equal(plain.ok, false, 'a bare "ok" never confirms sign-in');
-  const oauthSecret = require('../scripts/gds/oauth-secret.js');
+  const oauthSecret = require('../scripts/bongos/oauth-secret.js');
   assert.deepEqual(oauthSecret.parseHealthzAuth('ok'), { ok: false, authConfigured: false, parseError: true });
-  assert.match(readFileSync(new URL('../scripts/gds/oauth-secret.js', import.meta.url), 'utf8'), /127\.0\.0\.1:\$\{port\}\/api\/bongos\/healthz/, 'the manual placement probes the same JSON answer');
+  assert.match(readFileSync(new URL('../scripts/bongos/oauth-secret.js', import.meta.url), 'utf8'), /127\.0\.0\.1:\$\{port\}\/api\/bongos\/healthz/, 'the manual placement probes the same JSON answer');
 });
 
 await ta('the slug is recorded only AFTER the credentials are placed (task 1004649)', async () => {
@@ -1881,7 +1881,7 @@ await ta('a failure BEFORE GitHub handed over credentials claims no App (task 10
 // envPrefix CLOUDBONGOS while the platform wrote BONGOS_*, so the project never saw
 // its credentials — and the only thing anyone was told was "did not report sign-in
 // ready". When the check fails, the runner now reads the pack and names a mismatch.
-const U = require('../scripts/gds/provision-units.js');
+const U = require('../scripts/bongos/provision-units.js');
 
 await ta('envPrefixMismatch names a pack that reads other names, and nothing else (task 1004573)', async () => {
   const m = U.envPrefixMismatch(JSON.stringify({ envPrefix: 'CLOUDBONGOS' }), 'BONGOS');

package/tests/provision_account_identity.mjs

@@ -9,8 +9,8 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const P = require('../scripts/gds/provision.js');
-const { accountPlaneGap, accountPreflight } = require('../scripts/gds/provision-repo.js');
+const P = require('../scripts/bongos/provision.js');
+const { accountPlaneGap, accountPreflight } = require('../scripts/bongos/provision-repo.js');
 
 // The app user is derived from whoever runs the suite unless pinned (task 1002719).
 process.env.PROVISION_APP_USER = 'appsvc';

package/tests/provision_byo_host.mjs

@@ -16,7 +16,7 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const P = require('../scripts/gds/provision.js');
+const P = require('../scripts/bongos/provision.js');
 
 const byoHost = {
   id: 42, slug: 'mercury', hosting_shape: 'byo-host', status: 'requested',

package/tests/provision_caddy_wiring.mjs

@@ -8,8 +8,8 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const P = require('../scripts/gds/provision.js');
-const { caddyWiringGap, checkCaddyWiring, ingressPlaneGap } = require('../scripts/gds/provision-net.js');
+const P = require('../scripts/bongos/provision.js');
+const { caddyWiringGap, checkCaddyWiring, ingressPlaneGap } = require('../scripts/bongos/provision-net.js');
 
 const DOMAIN = 'mercury.example.com';
 // What `caddy adapt` prints: 2.7 writes the ask as a string, 2.8+ as a permission module.

package/tests/provision_disconnect.mjs

@@ -25,8 +25,8 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const P = require('../scripts/gds/provision.js');
-const D = require('../scripts/gds/provision-disconnect.js');
+const P = require('../scripts/bongos/provision.js');
+const D = require('../scripts/bongos/provision-disconnect.js');
 
 // The assertions below pin the supervision verbs as `systemctl …` (task 1003997, ADR 0306).
 // The manager is PROBED from /run/systemd/system when nothing pins it, so a CI runner that

package/tests/provision_dns_first.mjs

@@ -27,7 +27,7 @@ const require = createRequire(import.meta.url);
 // The app-user preflight reads the account this runs as; pin a valid one so the run
 // reaches the steps under test on any machine.
 process.env.PROVISION_APP_USER = 'bongos';
-const P = require('../scripts/gds/provision.js');
+const P = require('../scripts/bongos/provision.js');
 
 let passed = 0, failed = 0;
 async function ta(name, fn) {

package/tests/provision_render.mjs

@@ -1,6 +1,6 @@
 // tests/provision_render.mjs — the Render standup leg (task 1004183; ADR 0327).
 //
-// scripts/gds/provision-render.js driven over the REAL Render client (render-api.js) and a
+// scripts/bongos/provision-render.js driven over the REAL Render client (render-api.js) and a
 // recording fake of Render's API, so the workspace guard is exercised end to end rather
 // than stubbed away. db and the secret box are fakes. No network, no DB.
 //
@@ -25,9 +25,9 @@ import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
-const { RenderApi } = require('../scripts/gds/render-api.js');
-const { renderStandupInstance, forgetRenderApp, KEY_TTL_MS } = require('../scripts/gds/provision-render.js');
-const P = require('../scripts/gds/provision.js');
+const { RenderApi } = require('../scripts/bongos/render-api.js');
+const { renderStandupInstance, forgetRenderApp, KEY_TTL_MS } = require('../scripts/bongos/provision-render.js');
+const P = require('../scripts/bongos/provision.js');
 
 let passed = 0, failed = 0;
 async function ta(name, fn) {
@@ -278,7 +278,7 @@ await ta('a failure is retired on its FIRST attempt, never re-queued', async ()
 });
 
 console.log('\nthe wizard path — the app straight after the project, in the same run (task 1004352):');
-const { afterProvision } = require('../scripts/gds/provision-render.js');
+const { afterProvision } = require('../scripts/bongos/provision-render.js');
 function afterHarness({ keyOnRow = 'v1.enc', host = {} } = {}) {
   const h = harness({ host });
   const base = h.deps.db.query;
@@ -325,7 +325,7 @@ await ta('no key on the run → the provision result is untouched and Render is
   assert.equal(h.cleared(), 0);
 });
 await ta('the runner reaches afterProvision on every provision run', () => {
-  const src = readFileSync(new URL('../scripts/gds/provision.js', import.meta.url), 'utf8');
+  const src = readFileSync(new URL('../scripts/bongos/provision.js', import.meta.url), 'utf8');
   assert.match(src, /intent\.action === 'provision'\) result = await require\('\.\/provision-render\.js'\)\.afterProvision\(inst, deps, intent, await provisionInstance\(inst, deps\)\)/);
 });
 await ta('a link needs a repository to check the service against (1004350 review)', async () => {
@@ -347,7 +347,7 @@ await ta('an app saved with no build command gets its runtime\'s default, as Ren
 });
 await ta('every native runtime has a default build command; docker still sends none (task 1004464)', () => {
   const { RUNTIMES, BUILD_DEFAULTS } = require('../modules/provisioning/render-standup.js');
-  const { buildFor } = require('../scripts/gds/render-payload.js');
+  const { buildFor } = require('../scripts/bongos/render-payload.js');
   for (const rt of RUNTIMES.filter((r) => r !== 'docker')) {
     assert.ok(BUILD_DEFAULTS[rt], `${rt} has a default`);
     assert.equal(buildFor({ runtime: rt, startCommand: 'x' }).buildCommand, BUILD_DEFAULTS[rt]);
@@ -373,9 +373,9 @@ await ta('forgetRenderApp records the disconnect and calls nothing', async () =>
   await forgetRenderApp({ id: 19, app_host: null }, { db: { query: async () => { throw new Error('must not write'); } }, log: () => {}, apply: true });
 });
 await ta('the teardown leg reaches forgetRenderApp, and the leg has no path to a Render delete', () => {
-  const src = readFileSync(new URL('../scripts/gds/provision-teardown.js', import.meta.url), 'utf8');
+  const src = readFileSync(new URL('../scripts/bongos/provision-teardown.js', import.meta.url), 'utf8');
   assert.match(src, /forgetRenderApp\(inst/);
-  const leg = readFileSync(new URL('../scripts/gds/provision-render.js', import.meta.url), 'utf8');
+  const leg = readFileSync(new URL('../scripts/bongos/provision-render.js', import.meta.url), 'utf8');
   assert.doesNotMatch(leg, /'DELETE'|\.delete[A-Z]/);
 });
 

package/tests/provision_repo_private.mjs

@@ -2,7 +2,7 @@
 //
 // Split (b) of task 1003078 (task 1004193, ADR 0176): the `repo-private` provisioning
 // intent — its queue seam (modules/provisioning/repo-private.js), its runner leg
-// (scripts/gds/provision-repo-private.js) and the run-intents dispatch that reaches it.
+// (scripts/bongos/provision-repo-private.js) and the run-intents dispatch that reaches it.
 // Hermetic — exec, db and GitHub are recording fakes; no shell, no DB, no network.
 //
 // The load-bearing assertions:
@@ -26,8 +26,8 @@ import { execSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
-const P = require('../scripts/gds/provision.js');
-const { repoPrivateInstance } = require('../scripts/gds/provision-repo-private.js');
+const P = require('../scripts/bongos/provision.js');
+const { repoPrivateInstance } = require('../scripts/bongos/provision-repo-private.js');
 const provisioning = require('../modules/provisioning/provisioning.js');
 const { enqueueRepoPrivate } = require('../modules/provisioning/repo-private.js');
 

package/tests/provision_resource_caps.mjs

@@ -21,14 +21,14 @@ import { test } from 'node:test';
 import { spawnSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 // ESM named imports, so knip credits these exports to their test (a createRequire read is not)
-import { RESOURCE_CAPS, capDirectives, setCapsCmd, cmdApplyCaps } from '../scripts/gds/provision-caps.js';
+import { RESOURCE_CAPS, capDirectives, setCapsCmd, cmdApplyCaps } from '../scripts/bongos/provision-caps.js';
 
 const require = createRequire(import.meta.url);
 const CAPS = { RESOURCE_CAPS, capDirectives, setCapsCmd, cmdApplyCaps };
-const { serviceUnit } = require('../scripts/gds/provision-units.js');
-const PM = require('../scripts/gds/provision-process.js');
+const { serviceUnit } = require('../scripts/bongos/provision-units.js');
+const PM = require('../scripts/bongos/provision-process.js');
 // the REAL shape makeExec answers an allowFail'd failure with: ok:true, softFailed:true
-const { softFailResult } = require('../scripts/gds/provision-config.js');
+const { softFailResult } = require('../scripts/bongos/provision-config.js');
 
 const CLOUD = { id: 18, slug: 'mercury', hosting_shape: 'cloud-host', port: 4100, db_name: 'mercury', target_ref: 'owner/mercury' };
 const OWNER_NUMBERS = ['MemoryHigh=160M', 'MemoryMax=256M', 'CPUQuota=50%', 'TasksMax=256'];
@@ -100,7 +100,7 @@ test('apply-caps on an empty fleet does nothing and succeeds', async () => {
 });
 
 test('provision.js lists apply-caps as a command', () => {
-  const r = spawnSync(process.execPath, ['scripts/gds/provision.js', 'help'], { encoding: 'utf8' });
+  const r = spawnSync(process.execPath, ['scripts/bongos/provision.js', 'help'], { encoding: 'utf8' });
   assert.equal(r.status, 0, r.stderr);
   assert.match(r.stdout, /apply-caps/);
 });

package/tests/provision_restart.mjs

@@ -1,7 +1,7 @@
 // tests/provision_restart.mjs
 //
 // The RUNNER half of the restart path for an unreachable ACTIVE project (task
-// 1003238, goal 1000058): scripts/gds/provision.js restartInstance and the
+// 1003238, goal 1000058): scripts/bongos/provision.js restartInstance and the
 // run-intents dispatch that reaches it. Hermetic — exec / db are recording
 // fakes; no shell, no DB, no network (the tests/provision_settings_apply.mjs
 // pattern).
@@ -29,8 +29,8 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const P = require('../scripts/gds/provision.js');
-const { MANIFEST_VERIFY_TRIES } = require('../scripts/gds/provision-config.js');
+const P = require('../scripts/bongos/provision.js');
+const { MANIFEST_VERIFY_TRIES } = require('../scripts/bongos/provision-config.js');
 
 // The assertions below pin the supervision verbs as `systemctl …` (task 1003997, ADR 0306).
 // The manager is PROBED from /run/systemd/system when nothing pins it, so a CI runner that

package/tests/provision_settings_apply.mjs

@@ -1,7 +1,7 @@
 // tests/provision_settings_apply.mjs
 //
 // The runner half of the live settings push (task 1003140, goal 1000058):
-// scripts/gds/provision.js settingsApplyInstance + the in-place env patch it
+// scripts/bongos/provision.js settingsApplyInstance + the in-place env patch it
 // rides on (provision-units.js upsertEnvVars), the read-back (settingsConsumed),
 // and the run-intents dispatch. Hermetic — exec / writeFile / db are recording
 // fakes; no shell, no DB, no network (the tests/provision.mjs pattern).
@@ -25,8 +25,8 @@ import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
 
 const require = createRequire(import.meta.url);
-const P = require('../scripts/gds/provision.js');
-const { MANIFEST_VERIFY_TRIES } = require('../scripts/gds/provision-config.js');
+const P = require('../scripts/bongos/provision.js');
+const { MANIFEST_VERIFY_TRIES } = require('../scripts/bongos/provision-config.js');
 
 // The assertions below pin the supervision verbs as `systemctl …` (task 1003997, ADR 0306).
 // The manager is PROBED from /run/systemd/system when nothing pins it, so a CI runner that
@@ -51,7 +51,7 @@ async function ta(name, fn) {
 console.log('upsertEnvVars — the in-place patch:');
 
 const LIVE_ENV = `# /etc/spike/web.env — per-instance secrets (chmod 600, OUTSIDE the repo).
-# Provisioned by scripts/gds/provision.js (ADR 0111). OAuth app creds placed via the
+# Provisioned by scripts/bongos/provision.js (ADR 0111). OAuth app creds placed via the
 # GitHub App Manifest flow (ADR 0133) — the owner clicked one link; no secret was pasted.
 ${NEUTRAL_PREFIX}_GITHUB_CLIENT_ID=Iv1.0123456789abcdef
 ${NEUTRAL_PREFIX}_GITHUB_CLIENT_SECRET=0123456789abcdef0123456789abcdef01234567
@@ -324,7 +324,7 @@ await ta('the state gate: any non-active status is a clean no-op — ok:true noo
 
 console.log('\nthe control plane\'s own row — the platform pushes a setting to itself (task 1004334):');
 
-const U = require('../scripts/gds/provision-units.js');
+const U = require('../scripts/bongos/provision-units.js');
 const { FALLBACK_ENV_PREFIX } = require('../src/instance-config.js');
 
 t('selfEnvPrefix: the web.env BRANDING_FILE line wins, then the instance pack, then the neutral pack, then the fallback', () => {
@@ -645,12 +645,12 @@ t('both tenant shapes get the hub door for THEIR slug; no other shape gets the k
     const key = `${NEUTRAL_PREFIX}_HUB_UPGRADE_URL`;
     for (const shape of ['cloud-host', 'co-tenant']) {
       const inst = { slug: 'mercury', port: 3009, hosting_shape: shape, target_ref: 'will/mercury' };
-      assert.deepEqual(require('../scripts/gds/provision-units.js').hubUpgradeEnvVarsFor(inst), { [key]: 'https://hub.example.com/deploy?project=mercury' }, shape);
+      assert.deepEqual(require('../scripts/bongos/provision-units.js').hubUpgradeEnvVarsFor(inst), { [key]: 'https://hub.example.com/deploy?project=mercury' }, shape);
       assert.equal(P.settingsEnvVarsFor(inst)[key], 'https://hub.example.com/deploy?project=mercury', `${shape} push`);
       assert.match(P.webEnvBody(inst, {}), new RegExp(`^${key}=https://hub\\.example\\.com/deploy\\?project=mercury$`, 'm'), `${shape} standup`);
     }
     for (const shape of ['byo-host', 'control-plane']) {
-      assert.deepEqual(require('../scripts/gds/provision-units.js').hubUpgradeEnvVarsFor({ slug: 'x', hosting_shape: shape }), {}, shape);
+      assert.deepEqual(require('../scripts/bongos/provision-units.js').hubUpgradeEnvVarsFor({ slug: 'x', hosting_shape: shape }), {}, shape);
     }
   } finally {
     if (saved === undefined) delete process.env.PROVISION_HUB_ORIGIN; else process.env.PROVISION_HUB_ORIGIN = saved;