@bongos/core 1.21.175 → 1.21.177

package/scripts/gds/seed-medusa-tasks.js

@@ -1,440 +0,0 @@
-#!/usr/bin/env node
-// Seed the 24 net-new "Medusa" tasks (R50–R73) added to GDS-V4 in the
-// 2026-06-17 Medusa Planning Session (meta task 1188 / claim 982).
-//
-// Medusa = decouple the GDS from the Example game into a standalone,
-// configurable, self-hostable, AGPL open-source, non-profit, AI-first build
-// platform. Example becomes instance 1.
-//
-// Companion migration 110_medusa_planning_seed.sql handles:
-//   - the 2 done_when_criteria rows (C8 = medusa-standalone-instance,
-//     C9 = medusa-open-and-protected) at sort_order 8/9
-//   - the Medusa clause appended to versions.GDS-V4 done_when
-//
-// This script handles the 24 net-new task creates (with their criterion_ids,
-// resolved positionally as "C8"/"C9" against GDS-V4) and the dependency edges.
-//
-// Idempotent: skips tasks whose source_ref already exists; criterion links are
-// inserted at create (idempotent on (task_id, criterion_id)); dependency wiring
-// is idempotent on (task_id, depends_on_task_id).
-//
-// Ranking convention: priority is 1-5 (CHECK constraint). Fine-grained order
-// lives in the V4.R## title prefix (zero-padded for sort). Tier→priority:
-// roots P5, main build P4, advanced P3, long-pole P2, proofs/lockdown P1.
-//
-// Usage:  node scripts/gds/seed-medusa-tasks.js [--dry-run]
-
-const { cliClient, requireSession } = require('./cli-lib');
-
-const DRY = process.argv.includes('--dry-run');
-
-// Each entry: { ref, title, description, kind, discipline, priority,
-//   est_minutes, manual_degree, credits_reward, touches, criteria: ['C8'|'C9'],
-//   deps: ['R##', ...] }
-// `ref` doubles as the V4.R## title prefix and (lowercased) as source_ref.
-
-const TASKS = [
-  // =========================================================================
-  // C8 — Medusa stands on its own, unbranded (instance model)
-  // ----- Foundation (P5 roots) --------------------------------------------
-  {
-    ref: 'R50',
-    title: 'SPIKE — Medusa decoupling + instance-model architecture ADR',
-    description: `Part of Medusa (C8). First-principles architecture pass; output an ADR before the structural epics build.
-
-Locks: the exact GDS/game boundary; the per-instance branding-contract schema (config/branding.json shape + resolution precedence + neutral starter); the feature-module selection mechanism (config-flag gating of route mounts, UI sections, skills, disciplines); the standalone entrypoint + GDS-owned DB-pool contract; the instance-config/upgrade contract; and the publishable-subtree boundary for the open mirror (C9). Confirms the decisions: one project per install, migrate-in-place (OTB = instance 1), keep Greek ranks, self-host canonical.
-
-**Done when:** ADR merged covering boundary, branding contract, feature modules, entrypoint/DB contract, upgrade contract, publishable boundary, and rejected alternatives (multi-tenant, fork, plugin-registry-now). Gates R51/R52/R53/R71.`,
-    kind: 'spike', discipline: 'engineer', priority: 5,
-    est_minutes: 240, manual_degree: 3, credits_reward: 50,
-    touches: ['docs/adr/'], criteria: ['C8'], deps: [],
-  },
-  {
-    ref: 'R51',
-    title: 'GDS-only entrypoint — boot Medusa with no game in the process',
-    description: `Part of Medusa (C8). Cross-ref: R50 design.
-
-A Medusa-only boot (sibling to src/preview-server.js) that builds the Express app, mounts buildGdsRouter() + public-builders/ + public-status/, and constructs NO Colyseus game server and NO Phaser/tile static mounts. The existing game boot (server.js) stays untouched.
-
-**Done when:** a smoke test boots Medusa, reaches /api/bongos/health + the hall, and asserts no game route/asset is reachable in the process.`,
-    kind: 'infra', discipline: 'engineer', priority: 5,
-    est_minutes: 240, manual_degree: 2, credits_reward: 40,
-    touches: ['server.js', 'src/'], criteria: ['C8'], deps: ['R50'],
-  },
-  {
-    ref: 'R52',
-    title: 'GDS-owned DB pool + migration carve-out + drop the track enum',
-    description: `Part of Medusa (C8). Cross-ref: R50 design.
-
-A GDS-owned pool reading DATABASE_URL/PG* (not hard-defaulting to the example DB name); a GDS-only migration sequence (game migrations 001/002 simply not applied on a fresh non-game instance); drop the product/internal 'track' distinction. Live prod keeps its existing DB. Zero cross-FKs exist between game and GDS tables, so the split is clean.
-
-**Done when:** a fresh-DB migration run produces only the build-system schema; a query asserts the game tables (world_events, players, seats) are absent; live prod unaffected.`,
-    kind: 'infra', discipline: 'engineer', priority: 5,
-    est_minutes: 240, manual_degree: 2, credits_reward: 40,
-    touches: ['src/db.js', 'src/bongos/db.js', 'migrations/'], criteria: ['C8'], deps: ['R50'],
-  },
-  {
-    ref: 'R53',
-    title: 'Instance config + branding-contract layer (neutral starter, owner-LLM-filled)',
-    description: `Part of Medusa (C8). Cross-ref: R50 design. The keystone of the de-brand work.
-
-A per-instance config layer (config/branding.json + a documented schema + a neutral starter + a fill-it-in prompt an owner's own LLM uses) supplying product name, domain/cookie apex, sign-in (OAuth) origin, repo binding, currency label, copy, fonts, palette, icons/favicon/cursors. Core reads identity + branding from this layer; defaults preserve live OTB exactly. NOT a vanilla strip — branding becomes per-instance config; OTB's look becomes instance 1's pack (extracted in R57).
-
-**Done when:** core resolves all identity + branding from config; booting under a non-example.com domain + a non-game name needs config only, no source edits. Gates most de-brand + self-host tasks.`,
-    kind: 'feature', discipline: 'engineer', priority: 5,
-    est_minutes: 360, manual_degree: 2, credits_reward: 60,
-    touches: ['config/', 'src/bongos/', 'public-builders/'], criteria: ['C8'], deps: ['R50'],
-  },
-  {
-    ref: 'R54',
-    title: 'Feature-module selection system — instances turn modules on/off',
-    description: `Part of Medusa (C8). Cross-ref: R50 design.
-
-A config-flag layer that gates feature mounts per instance: route mounts (routes.js), hall/status UI sections, skills, and discipline/achievement sets all become modules an instance enables. OTB's instance enables the game/art/Discord/dev-box modules; a fresh instance enables none of them. (Config-flag exclusion, not a full plugin registry — that is the cheaper near-term mechanism.)
-
-**Done when:** a fresh instance boots with a minimal default module set (vanilla = engineer discipline only); a module can be toggled via config and its routes/UI/skills appear or disappear accordingly.`,
-    kind: 'feature', discipline: 'engineer', priority: 5,
-    est_minutes: 300, manual_degree: 2, credits_reward: 60,
-    touches: ['src/bongos/routes.js', 'config/', 'src/bongos/'], criteria: ['C8'], deps: ['R51', 'R53'],
-  },
-  {
-    ref: 'R55',
-    title: 'Non-Colyseus live channel for the hall (WS/SSE over the pg NOTIFY relay)',
-    description: `Part of Medusa (C8). Cross-ref: R51.
-
-The hall's only realtime feature is a Colyseus room (BuildersHallRoom). A Medusa-only boot has no Colyseus, so the hall's live updates would be dead. Build a minimal standalone WS or SSE endpoint over the existing pg NOTIFY relay (src/bongos/live-channel.js) and rewire the hall client (public-builders/builders.js). REQUIRED for v1 — not a graceful static fallback.
-
-**Done when:** the hall receives live updates on a Medusa-only boot with no game server in the process.`,
-    kind: 'feature', discipline: 'engineer', priority: 4,
-    est_minutes: 240, manual_degree: 2, credits_reward: 40,
-    touches: ['src/bongos/live-channel.js', 'public-builders/builders.js'], criteria: ['C8'], deps: ['R51'],
-  },
-
-  // ----- Instance-ize / de-brand (P4) -------------------------------------
-  {
-    ref: 'R56',
-    title: 'Currency → configurable label (drachmae becomes instance 1 config)',
-    description: `Part of Medusa (C8). Cross-ref: R53.
-
-Make the reward currency a configurable label (neutral default; OTB's instance = "drachmae"). Touches the columns + UI copy that name the unit; keep the cost-plus reward MATH unchanged. Mind the idempotent per-session reward path (migration 091) and the credit_log restatement history — rename the label, do not disturb the idempotency key or the ledger math.
-
-**Done when:** the currency label everywhere resolves from instance config; OTB still shows "drachmae"; reward math + idempotency untouched (existing reward tests green).`,
-    kind: 'refactor', discipline: 'engineer', priority: 4,
-    est_minutes: 240, manual_degree: 2, credits_reward: 40,
-    touches: ['migrations/', 'src/bongos/', 'public-builders/'], criteria: ['C8'], deps: ['R53'],
-  },
-  {
-    ref: 'R57',
-    title: "Extract OTB's look into instance 1's branding pack (not a vanilla strip)",
-    description: `Part of Medusa (C8). Cross-ref: R53, R56.
-
-Move the ~272 archaic strings, the Greek fonts, the parchment palette, favicon/cursors/SVG sigils, and the page copy out of the hall + status code and into instance 1's branding pack; core renders from the R53 branding layer with a neutral starter as the fallback. status.example.com + builders.example.com look IDENTICAL afterward — their look just comes from config now. Add a rank display-label map so the Greek rank LABELS are presentation (the enum stays Greek by decision).
-
-**Done when:** no project branding is hard-coded in public-builders/ or public-status/; OTB's surfaces render unchanged from instance 1's pack; a fresh instance renders the neutral starter.`,
-    kind: 'refactor', discipline: 'engineer', priority: 4,
-    est_minutes: 360, manual_degree: 2, credits_reward: 60,
-    touches: ['public-builders/', 'public-status/', 'config/'], criteria: ['C8'], deps: ['R53', 'R56'],
-  },
-  {
-    ref: 'R58',
-    title: 'Diagram generator reads instance branding (no re-brand on deploy)',
-    description: `Part of Medusa (C8). Cross-ref: R53.
-
-scripts/gds/gen-diagrams.js auto-generates the onboarding diagrams + assertions.json on every deploy. Make its template strings + assertions read the instance branding config so deploy-time regeneration emits neutral (instance-correct) branding. Rank names stay Greek by decision. This prevents the "we de-branded but Greek text reappeared after the next deploy" regression.
-
-**Done when:** running gen-diagrams.js under a neutral instance config produces diagrams + assertions.json with no hard-coded OTB/Example tokens; OTB's instance still renders its own branding.`,
-    kind: 'refactor', discipline: 'engineer', priority: 4,
-    est_minutes: 180, manual_degree: 2, credits_reward: 30,
-    touches: ['scripts/gds/gen-diagrams.js'], criteria: ['C8'], deps: ['R53'],
-  },
-  {
-    ref: 'R59',
-    title: 'Game + art pipeline become OTB-enabled feature modules (kept, not deleted)',
-    description: `Part of Medusa (C8). Cross-ref: R54.
-
-Move the game world/rooms, the art/ pixel-art pipeline, the 4 otb-* skills, the game-preview sandbox gate, and the game-flavored disciplines/achievements behind the R54 feature-module system as modules OTB's instance ENABLES. Strip "hermeslines" from the core task-classifier (becomes module config). Game tests run only when the game module is enabled. A fresh instance carries none of this.
-
-**Done when:** OTB's instance enables the game/art modules and behaves as today; a fresh instance has no game/art routes, skills, disciplines, or tests active.`,
-    kind: 'refactor', discipline: 'engineer', priority: 4,
-    est_minutes: 300, manual_degree: 2, credits_reward: 50,
-    touches: ['src/bongos/', 'art/', '.claude/skills/'], criteria: ['C8'], deps: ['R54'],
-  },
-  {
-    ref: 'R60',
-    title: 'Discord + dev-box become instance modules (off by default)',
-    description: `Part of Medusa (C8). Cross-ref: R54.
-
-Gate the Discord integration (routes.js mounts + the discord-*.js modules + channels.json/webhooks) and the DigitalOcean dev-box provisioning behind the R54 feature-module flags. Vanilla Medusa = no chat integration and no managed dev boxes (BYO-machine + server-mediated publish remains the default path). OTB's instance keeps both enabled.
-
-**Done when:** a fresh instance boots with Discord + dev-box modules off and no related routes/config required; OTB's instance keeps them on.`,
-    kind: 'refactor', discipline: 'engineer', priority: 4,
-    est_minutes: 240, manual_degree: 2, credits_reward: 40,
-    touches: ['src/bongos/routes.js', 'src/bongos/discord-bot.js', 'src/bongos/boxes.js'], criteria: ['C8'], deps: ['R54'],
-  },
-  {
-    ref: 'R61',
-    title: 'Config-namespace + env-var rename (~/.config/otb + OTB_*/PMS_*/GDS_*)',
-    description: `Part of Medusa (C8). Cross-ref: R53.
-
-The CLI config root (~/.config/otb/: gds-session.json, env, discord-webhooks.json, cost_ledger) and the OTB_*/PMS_*/GDS_* env-var prefixes are an instance-identity leak. Consolidate to a neutral product namespace driven by instance config, keeping back-compat shims for existing local sessions (the pms_session / PMS_* / ~/.config/otb read-side shims already set the precedent).
-
-**Done when:** a fresh instance uses the neutral config dir + env prefix; existing OTB local sessions keep working via shims; docs + scripts updated.`,
-    kind: 'refactor', discipline: 'engineer', priority: 4,
-    est_minutes: 240, manual_degree: 2, credits_reward: 40,
-    touches: ['scripts/gds/', 'src/bongos/'], criteria: ['C8'], deps: ['R53'],
-  },
-
-  // ----- Self-host + adopt -------------------------------------------------
-  {
-    ref: 'R62',
-    title: 'Config-driven owner bootstrap + per-instance repo/OAuth binding',
-    description: `Part of Medusa (C8). Cross-ref: R52, R53.
-
-Replace migration 023's hard-coded founding-Archon literal (UPDATE builders SET rank='archon' WHERE github_login='example-owner') with an install-time first-admin bootstrap from instance config. Make the GitHub repo binding (repo-info.js — the OTB_GITHUB_OWNER/REPO seam already exists) and the OAuth/App config per-instance. Single-project model keeps the global economy fine — only the owner literal + repo/OAuth need to generalize.
-
-**Done when:** grep over migrations/ returns zero login literals; a fresh install seats the configured first admin; repo + OAuth resolve from instance config.`,
-    kind: 'feature', discipline: 'engineer', priority: 4,
-    est_minutes: 300, manual_degree: 2, credits_reward: 50,
-    touches: ['migrations/', 'src/bongos/repo-info.js', 'src/bongos/auth.js'], criteria: ['C8'], deps: ['R52', 'R53'],
-  },
-  {
-    ref: 'R63',
-    title: 'Containerized self-host instance (Dockerfile + docker-compose)',
-    description: `Part of Medusa (C8). Cross-ref: R51, R52.
-
-A Dockerfile + docker-compose (app + Postgres) that brings a Medusa instance up from clean state with ZERO hard-coded droplet IP, instance-specific systemd unit, or hand-maintained ~/deploy.sh. This is the self-host artifact; it does not touch prod's existing laptop/CI deploy path.
-
-**Done when:** \`docker compose up\` on a machine that has never seen our droplet brings up Medusa + Postgres and the hall is reachable; no prod topology referenced anywhere in the path.`,
-    kind: 'infra', discipline: 'engineer', priority: 4,
-    est_minutes: 300, manual_degree: 2, credits_reward: 50,
-    touches: ['Dockerfile', 'docker-compose.yml', 'infra/'], criteria: ['C8'], deps: ['R51', 'R52'],
-  },
-  {
-    ref: 'R64',
-    title: 'Platform-version + `medusa upgrade` path (config survives updates)',
-    description: `Part of Medusa (C8). Cross-ref: R63. This is what delivers "instances receive platform updates".
-
-A core-version stamp per instance + an upgrade path (\`medusa upgrade\`) that pulls a new release and applies new migrations + code while PRESERVING the instance's config (branding pack, feature flags, identity, data). Pull-based by default (can be automated); managed/push hosting is a deferred optional layer on the same artifact.
-
-**Done when:** an instance on core vN upgrades to vN+1 (migrations + code) with its branding + feature config + data intact.`,
-    kind: 'feature', discipline: 'engineer', priority: 3,
-    est_minutes: 300, manual_degree: 2, credits_reward: 50,
-    touches: ['scripts/', 'migrations/'], criteria: ['C8'], deps: ['R63'],
-  },
-  {
-    ref: 'R65',
-    title: 'Generic `medusa init` project onboarding (scaffold a new instance)',
-    description: `Part of Medusa (C8). Cross-ref: R53, R62.
-
-A scaffold flow that stands up a new instance: identity + branding pack (via the owner's-own-LLM fill-it-in prompt) + feature-module selection + the project's first version, criteria, and invariants — replacing the bespoke 35–83KB seed-*.js-per-version pattern with a self-serve init. Enables the C8 dogfood proof (R67).
-
-**Done when:** \`medusa init\` produces a working instance config + first version/criteria for a new project with no hand-written seed script.`,
-    kind: 'feature', discipline: 'engineer', priority: 3,
-    est_minutes: 360, manual_degree: 2, credits_reward: 60,
-    touches: ['scripts/gds/'], criteria: ['C8'], deps: ['R53', 'R62'],
-  },
-  {
-    ref: 'R66',
-    title: 'CLAUDE.md split — portable methodology core vs host-project context',
-    description: `Part of Medusa (C8). Cross-ref: R53.
-
-Separate the portable methodology core Medusa ships (the working rules, the session protocol, the claim->ship lifecycle) from a host-project-authored project-context template (what CLAUDE.md is today for OTB). Fold in the AI-first documented norm (AI always writes the code) here. A new project authors its own context file against the template; Medusa ships the core.
-
-**Done when:** Medusa ships a generic methodology core + a project-context template; OTB's CLAUDE.md becomes "instance 1's context" composed with the core; the AI-first norm is stated.`,
-    kind: 'refactor', discipline: 'engineer', priority: 3,
-    est_minutes: 240, manual_degree: 3, credits_reward: 40,
-    touches: ['CLAUDE.md', 'docs/'], criteria: ['C8'], deps: ['R53'],
-  },
-  {
-    ref: 'R67',
-    title: 'PROOF — Medusa dogfood: a second, differently-branded non-game instance ships a task',
-    description: `Part of Medusa (C8) — the proof-task that satisfies C8 ("the GDS builds itself"). Customer 0 = Medusa itself, running on the vanilla brand pack (R74); customer 1 = Example.
-
-Stand Medusa up as customer 0 (its own database, vanilla brand, no game code) and take one real task through the full lifecycle on it: claim -> grade -> merge -> ship with credits awarded. Medusa building Medusa, on Medusa. (A separate non-game third project is an acceptable alternative proof, but customer-0 self-build is the truest.)
-
-**Done when:** a task reaches 'shipped' with credits on the customer-0 Medusa instance carrying zero game code; documented as the C8 acceptance.`,
-    kind: 'spike', discipline: 'engineer', priority: 1,
-    est_minutes: 240, manual_degree: 3, credits_reward: 60,
-    touches: ['docs/'], criteria: ['C8'], deps: ['R63', 'R64', 'R65', 'R74'],
-  },
-
-  // =========================================================================
-  // C9 — Medusa is open, free, and protected from capture
-  // =========================================================================
-  {
-    ref: 'R68',
-    title: 'DECISION/ADR — AGPL-3.0 license + non-profit, AI-first governance model',
-    description: `Part of Medusa (C9). Foundational decision for the open-source track.
-
-Record the rationale: AGPL-3.0 (closes the hosted-closed-fork loophole; the only license consistent with the anti-monopoly goal), the non-profit posture (not monetized from contributors), and the AI-first norm (AI always writes the code — a documented expectation, not a technical gate, per this session's decision). Defines the publishable-subtree boundary jointly with R50.
-
-**Done when:** ADR merged covering license choice + rejected alternatives (MIT/Apache/GPL), non-profit governance, AI-first norm, and the public-mirror boundary.`,
-    kind: 'decision', discipline: 'engineer', priority: 5,
-    est_minutes: 120, manual_degree: 3, credits_reward: 30,
-    touches: ['docs/adr/'], criteria: ['C9'], deps: [],
-  },
-  {
-    ref: 'R69',
-    title: 'AGPL-3.0 LICENSE file',
-    description: `Part of Medusa (C9). Cross-ref: R68.
-
-Add the AGPL-3.0 LICENSE to the repo (and to the public mirror's publishable subtree). Add SPDX headers / NOTICE as the ADR specifies.
-
-**Done when:** LICENSE present and correct; any required attribution/NOTICE in place.`,
-    kind: 'infra', discipline: 'engineer', priority: 4,
-    est_minutes: 30, manual_degree: 1, credits_reward: 15,
-    touches: ['LICENSE'], criteria: ['C9'], deps: ['R68'],
-  },
-  {
-    ref: 'R70',
-    title: 'Governance docs — GOVERNANCE + CONTRIBUTING + CODE_OF_CONDUCT',
-    description: `Part of Medusa (C9). Cross-ref: R68.
-
-Author the non-profit, AI-first, anti-monopoly governance: GOVERNANCE.md (how decisions are made, who can do what — maps to the rank ladder), CONTRIBUTING.md (how a builder contributes AI-first via the GDS itself; how a new project adopts Medusa), CODE_OF_CONDUCT.md.
-
-**Done when:** the three docs exist, state the non-profit + AI-first + anti-monopoly stance, and reference the rank ladder + claim->ship flow.`,
-    kind: 'feature', discipline: 'engineer', priority: 3,
-    est_minutes: 180, manual_degree: 3, credits_reward: 30,
-    touches: ['GOVERNANCE.md', 'CONTRIBUTING.md', 'CODE_OF_CONDUCT.md'], criteria: ['C9'], deps: ['R68'],
-  },
-  {
-    ref: 'R71',
-    title: 'Public mirror repo + publishable-subtree carve-out',
-    description: `Part of Medusa (C9). Cross-ref: R50 (boundary), R59 (game excised to a module).
-
-Define the publishable boundary (the build system: src/bongos, scripts/gds, public-builders, migrations, skills, docs — EXCLUDING the game, art, infra/, scripts/deploy/, and trust-boundary/security internals) reusing the existing PROTECTED_GLOBS / SENSITIVE_DOC_GLOBS inventory, and create the public 'medusa' mirror repo. Extends the off-repo publish precedents (status mirror, devbox releases).
-
-**Done when:** a public 'medusa' repo exists; a documented carve-out lists exactly what is publishable vs permanently excluded.`,
-    kind: 'infra', discipline: 'engineer', priority: 3,
-    est_minutes: 300, manual_degree: 3, credits_reward: 50,
-    touches: ['scripts/', '.github/'], criteria: ['C9'], deps: ['R50', 'R59'],
-  },
-  {
-    ref: 'R72',
-    title: 'Time-delayed (6-month) export pipeline + source-level redaction',
-    description: `Part of Medusa (C9). Cross-ref: R71. The XL long-pole of C9.
-
-An automated pipeline that publishes commits/snapshots >= ~180 days old to the public mirror, with a redaction layer that strips secrets + prod topology (droplet IP, scripts/deploy/*, infra/, security internals) even from old commits — the 6-month delay alone does NOT scrub secrets. Reuse the scoped-deploy-key + status-mirror-sync precedent.
-
-**Done when:** the pipeline publishes a redacted, ~6-month-lagged snapshot to the mirror on a schedule; a check proves no secret/topology string reaches the public repo.`,
-    kind: 'feature', discipline: 'engineer', priority: 2,
-    est_minutes: 480, manual_degree: 2, credits_reward: 80,
-    touches: ['scripts/', '.github/'], criteria: ['C9'], deps: ['R71'],
-  },
-  {
-    ref: 'R73',
-    title: 'PROOF — private<->public lineage consistency + no-leak check',
-    description: `Part of Medusa (C9) — the proof-task that satisfies C9.
-
-Verify the private and public lineages stay consistent: migration numbering (the claim-time next_number allocator state) and enum values do not diverge between the private repo and the delayed public mirror. Add the no-leak assertion on the published mirror (no secrets, no prod topology).
-
-**Done when:** a check confirms numbering/enum consistency private<->public AND the published mirror contains zero secret/topology strings; documented as the C9 acceptance.`,
-    kind: 'infra', discipline: 'engineer', priority: 1,
-    est_minutes: 180, manual_degree: 2, credits_reward: 40,
-    touches: ['scripts/', 'tests/'], criteria: ['C9'], deps: ['R72'],
-  },
-
-  // =========================================================================
-  // C8 (added 2026-06-17, task 1215) — the Medusa vanilla brand pack (customer 0)
-  // =========================================================================
-  {
-    ref: 'R74',
-    title: 'Medusa vanilla brand pack — the plain "customer 0" identity (Substack-like)',
-    description: `Part of Medusa (C8). Cross-ref: R53 (branding-contract layer), R57 (customer 1 / OTB pack).
-
-Design + build the canonical Medusa VANILLA brand pack — the identity Medusa itself runs on as **customer 0** (Example is customer 1). Deliberately PLAIN, clean, modern, professional — restrained palette, clean sans-serif type, minimal wordmark, plain-English product copy, simple favicon/icons. Aesthetic touchstone: Substack-plain; take INSPIRATION from planetscale.com's simplicity (do NOT copy). Delivered as a branding pack against the R53 contract; it is the default the hall + status render under when no other pack is supplied, and the brand Medusa ships on. Distinct from R57 (extracting customer 1 / OTB's Greek look) — this is customer 0's identity. No game/Greek flavor.
-
-**Done when:** a complete Medusa vanilla brand pack (name/wordmark, restrained palette, clean type, plain copy, favicon/icons) renders the hall + status as a plain, professional dev toolkit; it is the pack customer 0 (Medusa) runs on; verified on the standalone boot.`,
-    kind: 'feature', discipline: 'artist', priority: 4,
-    est_minutes: 360, manual_degree: 3, credits_reward: 60,
-    touches: ['config/', 'public-builders/', 'public-status/'], criteria: ['C8'], deps: ['R53'],
-  },
-];
-
-async function main() {
-  await requireSession();
-  const api = await cliClient();
-
-  const list = await api.tasks.getTasks({ query: { version: 'GDS-V4' } });
-  const bySourceRef = {};
-  for (const t of list.data?.tasks || []) {
-    if (t.source_ref) bySourceRef[t.source_ref] = t;
-  }
-
-  const idByRef = {};
-  let created = 0, skipped = 0, errors = 0;
-
-  for (const def of TASKS) {
-    const source_ref = `gds-v4-${def.ref.toLowerCase()}`;
-    if (bySourceRef[source_ref]) {
-      idByRef[def.ref] = Number(bySourceRef[source_ref].id);
-      console.log(`SKIP  ${def.ref} (already exists: id=${bySourceRef[source_ref].id})`);
-      skipped++;
-      continue;
-    }
-    const body = {
-      version_id: 'GDS-V4',
-      title: `V4.${def.ref} — ${def.title}`,
-      description: def.description,
-      kind: def.kind,
-      discipline: def.discipline,
-      status: 'backlog',
-      priority: def.priority,
-      est_minutes: def.est_minutes,
-      manual_degree: def.manual_degree,
-      credits_reward: def.credits_reward,
-      touches: def.touches || [],
-      criterion_ids: def.criteria || [],
-      source: 'planning-session',
-      source_ref,
-    };
-    if (DRY) {
-      console.log(`DRY   ${def.ref}  P${def.priority}  ${def.kind}  crit=${(def.criteria || []).join('/')}  deps=[${(def.deps || []).join(',')}]  ${def.title.slice(0, 56)}`);
-      continue;
-    }
-    const res = await api.tasks.postTasks({ body });
-    if (res.status !== 201) {
-      console.error(`FAIL  ${def.ref}: status=${res.status} ${JSON.stringify(res.data).slice(0, 220)}`);
-      errors++;
-      continue;
-    }
-    idByRef[def.ref] = Number(res.data.task.id);
-    console.log(`OK    ${def.ref} → task id=${idByRef[def.ref]}  (crit ${(def.criteria || []).join('/')})`);
-    created++;
-  }
-
-  // Dependency wiring (skipped in dry-run).
-  let depsWired = 0, depErrors = 0;
-  if (!DRY) {
-    for (const def of TASKS) {
-      const deps = def.deps || [];
-      if (deps.length === 0) continue;
-      const taskId = idByRef[def.ref];
-      if (!taskId) { console.error(`DEPS  ${def.ref}: no task id resolved, skipping`); depErrors++; continue; }
-      const depIds = deps.map((r) => idByRef[r]).filter((n) => Number.isFinite(n));
-      if (depIds.length !== deps.length) {
-        console.error(`DEPS  ${def.ref}: unresolved refs in [${deps.join(',')}]`);
-        depErrors++;
-        continue;
-      }
-      const res = await api.tasks.postTasksIdDependencies({ id: taskId, body: {
-        depends_on_task_ids: depIds,
-      } });
-      if (res.status === 200) {
-        console.log(`DEPS  ${def.ref} ← [${deps.join(',')}]`);
-        depsWired++;
-      } else {
-        console.error(`DEPS FAIL ${def.ref}: ${res.status} ${JSON.stringify(res.data).slice(0, 220)}`);
-        depErrors++;
-      }
-    }
-  }
-
-  console.log(`\nDONE  created=${created} skipped=${skipped} errors=${errors} deps_wired=${depsWired} dep_errors=${depErrors}  (manifest: ${TASKS.length})`);
-  process.exit(errors === 0 && depErrors === 0 ? 0 : 1);
-}
-
-main().catch((err) => {
-  console.error('FATAL', err);
-  process.exit(1);
-});