@bongos/core 1.21.175 → 1.21.177

package/.claude/skills/read-session-export/SKILL.md

@@ -13,8 +13,8 @@ cost: >-
 The user already has the zip — Claude Code's built-in `/export` made it. Read it with the reader rather than by hand: it prints a compact transcript (prompts + thinking + replies + one-line tool calls) to stdout and skips the megabytes of debug logs.
 
 ```bash
-node scripts/gds/read-session-export.js <export.zip>     # compact transcript → stdout
-node scripts/gds/read-session-export.js --latest         # newest session-export-*.zip in ~/Downloads
+node scripts/bongos/read-session-export.js <export.zip>     # compact transcript → stdout
+node scripts/bongos/read-session-export.js --latest         # newest session-export-*.zip in ~/Downloads
 ```
 
 Then **answer what the user actually asked** — summarize the session, pull out the reasoning behind a decision, find where something went wrong, list what was built. Don't paste the transcript back; that's the raw material, not the answer.
@@ -31,7 +31,7 @@ Then **answer what the user actually asked** — summarize the session, pull out
 **A long export is a file, not a dump.** Always open with `--meta`; if it reports hundreds of tool calls, redirect to your session's scratchpad directory and read it in slices, rather than pouring thousands of lines into context at once:
 
 ```bash
-node scripts/gds/read-session-export.js <zip> > <scratchpad>/transcript.md   # then sed -n '1,400p', '400,850p', …
+node scripts/bongos/read-session-export.js <zip> > <scratchpad>/transcript.md   # then sed -n '1,400p', '400,850p', …
 ```
 
 ## If the thinking is redacted

package/.claude/skills/recall/SKILL.md

@@ -30,12 +30,12 @@ So the loop is: search → read the cheap summaries + costs → expand the singl
 ## How to use
 
 ```bash
-node scripts/gds/recall.js <query…>            # STEP 1: ranked summary + per-hit token cost; query is the rest of the line, quotes optional
-node scripts/gds/recall.js trust boundary
-node scripts/gds/recall.js "grader bypass" --limit 5
-node scripts/gds/recall.js nightly backup --kind doc     # restrict to docs (vs --kind db for DB prose)
-node scripts/gds/recall.js --expand 1234       # STEP 2: full content of hit #1234
-node scripts/gds/recall.js <query…> --json     # raw JSON for further processing
+node scripts/bongos/recall.js <query…>            # STEP 1: ranked summary + per-hit token cost; query is the rest of the line, quotes optional
+node scripts/bongos/recall.js trust boundary
+node scripts/bongos/recall.js "grader bypass" --limit 5
+node scripts/bongos/recall.js nightly backup --kind doc     # restrict to docs (vs --kind db for DB prose)
+node scripts/bongos/recall.js --expand 1234       # STEP 2: full content of hit #1234
+node scripts/bongos/recall.js <query…> --json     # raw JSON for further processing
 ```
 
 Each summary result shows the hit id (`#NNN`, the handle for `--expand`), the title, the breadcrumb (`file > H1 > H2`), the source ref, a relevance score, which legs matched (`fts+trgm`), a snippet, and the **token cost** to expand it. Either `recall --expand <id>` for the full section in-band, or open the cited `source_ref` directly.
@@ -55,5 +55,5 @@ Each summary result shows the hit id (`#NNN`, the handle for `--expand`), the ti
 
 ## Files this skill touches
 
-- Calls: `POST /api/bongos/search` via `scripts/gds/recall.js` — twice over the same route: `{ q }` for the summary layer (step 1) and `{ expand: <id> }` for one hit's full content (step 2).
+- Calls: `POST /api/bongos/search` via `scripts/bongos/recall.js` — twice over the same route: `{ q }` for the summary layer (step 1) and `{ expand: <id> }` for one hit's full content (step 2).
 - Reads: `~/.config/otb/gds-session.json` (the session token, like every `/builder-*` CLI).

package/.claude/skills/scan-before-install/SKILL.md

@@ -101,11 +101,11 @@ Step by step:
 
 1. **Validate the target** (targets section above). Refuse early and plainly.
 2. **Quarantine + fetch.** `createQuarantine({ forbiddenRoots })` — list every workspace root; the pen refuses the repo, sync folders (OneDrive etc.), and workspace roots so an artifact's own `CLAUDE.md` can never auto-load. `fetchArtifact` hard-fails with a recordable abort code on timeout/caps/private hosts; record aborted scans too (step 7) — a scan that died must be visible as "died, here is why".
-3. **Prior-scan lookup.** `node scripts/gds/api.js GET "/api/bongos/security/scans?content_hash=<manifest.contentHash>"` — if these exact bytes were scanned before, surface that verdict before spending panel budget (any rank can read).
+3. **Prior-scan lookup.** `node scripts/bongos/api.js GET "/api/bongos/security/scans?content_hash=<manifest.contentHash>"` — if these exact bytes were scanned before, surface that verdict before spending panel budget (any rank can read).
 4. **Mirror, then floor.** `buildMirror` writes the scrubbed fenced reading room; `runFloor` persists `floor-report.json` inside the pen — pass `extraFindings: fetched.findings` so fetch-stage evidence is IN the arithmetic, not just in prose. Hard rule 4 applies between this step and the next.
 5. **Panel + verify per tier.** Spawn the lenses at the MIRROR. Collect the lens JSONs; run the verify pass; drop only cleanly-refuted panel findings.
 6. **Reduce + report.** `reduceVerdict({ floorReport, lenses, tier })`, then `assembleReport({ target: { url, sha, contentHash }, tier, reduced, floorReport, lenses, engineVersion })` with `engineVersion` = `sbi/1.0.0 floor/<floor_version>`. Write the markdown to `~/.config/otb/scan-reports/<UTC-stamp>-<host>-<sha7>.md`. (Fetch findings are already in `floorReport` from step 4 — do not re-add them here.)
-7. **Record the scan row.** POST `/api/bongos/security/scans` via `scripts/gds/api.js` with `--body-file` (never a shell heredoc). **Required on every row:** `target_url`, `artifact_kind` (`repo` | `plugin` | `marketplace`), `tier`, `completion`, `engine_version`. **`verdict` is required exactly when `completion` is `complete`, and must be absent otherwise** — the route enforces that coupling, so an aborted scan carries `completion: 'aborted'` + `abort_code` and NO verdict. Optional: `resolved_sha`, `content_hash`, `file_count`, `total_bytes`, the four `findings_<severity>` counts, `findings_summary` (one-line scrubbed claims only), `action_taken`. A successful scan therefore looks like:
+7. **Record the scan row.** POST `/api/bongos/security/scans` via `scripts/bongos/api.js` with `--body-file` (never a shell heredoc). **Required on every row:** `target_url`, `artifact_kind` (`repo` | `plugin` | `marketplace`), `tier`, `completion`, `engine_version`. **`verdict` is required exactly when `completion` is `complete`, and must be absent otherwise** — the route enforces that coupling, so an aborted scan carries `completion: 'aborted'` + `abort_code` and NO verdict. Optional: `resolved_sha`, `content_hash`, `file_count`, `total_bytes`, the four `findings_<severity>` counts, `findings_summary` (one-line scrubbed claims only), `action_taken`. A successful scan therefore looks like:
 
    ```json
    { "target_url": "https://github.com/owner/repo", "artifact_kind": "repo",
@@ -156,7 +156,7 @@ For a dangerous verdict, failed sanitize gates, or a user who just wants the fun
 1. `selectDocFiles(entries)` — the ONLY files a model may read for this landing, via the mirror. Documentation only, never code: the spec describes WHAT to build, derived from the artifact's own docs.
 2. Spawn one doc-reader subagent at those mirror files → it returns one-line functional requirements (JSON array of strings).
 3. `assembleRebuildSpec({ target, docPaths, requirements })` — script-owned framing, every line scrubbed. Write `REBUILD-SPEC.md` next to the scan report in `~/.config/otb/scan-reports/`.
-4. Offer to file it as a Bongos task: `POST /api/bongos/tasks` (status `backlog`, body = the spec markdown; Metic+) or `node scripts/gds/capture.js` into the idea inbox otherwise. Record `rebuild_spec`.
+4. Offer to file it as a Bongos task: `POST /api/bongos/tasks` (status `backlog`, body = the spec markdown; Metic+) or `node scripts/bongos/capture.js` into the idea inbox otherwise. Record `rebuild_spec`.
 
 ## What this skill does NOT do
 

package/.claude/skills/session-handoff/SKILL.md

@@ -49,5 +49,5 @@ Keep it **short and curated** — a prompt, not a transcript. Include only what
 
 ## Files this skill touches
 
-- Reads (for grounding, optional): the current session context, `docs/handoff-template.md`, and — if useful — the active claim via `node scripts/gds/api.js GET /me`.
+- Reads (for grounding, optional): the current session context, `docs/handoff-template.md`, and — if useful — the active claim via `node scripts/bongos/api.js GET /me`.
 - Writes: nothing. Its only output is the handoff prompt printed in chat.

package/.claude/skills/ship-check/SKILL.md

@@ -15,7 +15,7 @@ cost: >-
 **Script skill (authoritative).** The whole action is one command, run from the worktree you will ship from:
 
 ```bash
-node scripts/gds/ship-check.js
+node scripts/bongos/ship-check.js
 ```
 
 Add `--tests` to also run the DB-free unit lane (slow; minutes). Add `--json` for machine output.
@@ -36,7 +36,7 @@ It changes nothing: every step is a `--check`; the **fix →** column is what to
 2. `fitness.js` failures name their own fix inline; warnings are advisory (budgets, ratchets).
    The `render-fit` row is advisory too (`!`, never a `✗`): when the branch changed a page, it renders
    it at 1280 + 390 and names any text past its box or overlapping siblings by element and page
-   (`scripts/gds/render-check.js`, ADR 0329). Look at the shots it names; fix the element, or say in the
+   (`scripts/bongos/render-check.js`, ADR 0329). Look at the shots it names; fix the element, or say in the
    ship notes why it is right. `·` means no Edge or Chrome on this machine, so nothing was rendered.
    A big page takes minutes; `--no-render` leaves the row out when you are iterating on something else.
 3. With `--tests`: a failing test is only "environmental" if the SAME test fails on an untouched
@@ -51,5 +51,5 @@ It changes nothing: every step is a `--check`; the **fix →** column is what to
   same gate run early, when fixing is cheap.
 - The PostToolUse hook `.claude/hooks/edit-hints.js` tells you the moment an edit makes a generated
   file stale; `/ship-check` is the sweep that catches whatever the hints did not.
-- `node scripts/gds/preflight.js` checks the MACHINE (node version, node_modules, `claude` auth);
+- `node scripts/bongos/preflight.js` checks the MACHINE (node version, node_modules, `claude` auth);
   this checks the TREE.

package/.claude/skills/status/SKILL.md

@@ -23,8 +23,8 @@ Delivery is deterministic (task 1288, same methodology as `/builder-start`). The
 1. **Normal path — follow the injected directive.** If that `[otb card …]` block is present, do exactly what it says: `show_widget` with the fenced HTML if you have `mcp__visualize` (call `mcp__visualize__read_me` once first, silently), otherwise output the fenced markdown **verbatim**. Render **once** — don't run `status.js`, don't lead with your own headline, don't rebuild the table, don't add a recommendation or recap. The card now owns the headline, the remaining-task list, and the unattributed-tasks note (this replaces the old freeform "interpret + relay" summary).
 
 2. **Fallback — no directive present** (hook disabled/failed, or an older checkout). Run it yourself:
-   - **If you have `show_widget`**: `node scripts/gds/status.js --widget [--version ID] [--criterion REF]` → render the HTML verbatim with `title: "status_card"` (call `read_me` once first).
-   - **No widget renderer**: `node scripts/gds/status.js [--version ID] [--criterion REF]` → print its stdout verbatim.
+   - **If you have `show_widget`**: `node scripts/bongos/status.js --widget [--version ID] [--criterion REF]` → render the HTML verbatim with `title: "status_card"` (call `read_me` once first).
+   - **No widget renderer**: `node scripts/bongos/status.js [--version ID] [--criterion REF]` → print its stdout verbatim.
    - A criterion is named by its **slug** (`/status wa6-kernel-and-packs`) or, as an affordance, by position (`/status C8`); `--criterion REF` is the exact form for either. `--version` defaults to the live internal version; `--json` is the machine interface; `--hook` is the envelope the hook consumes — don't render those for the user unless asked.
 
 ## Constraints
@@ -36,5 +36,5 @@ Delivery is deterministic (task 1288, same methodology as `/builder-start`). The
 ## Files this skill touches
 
 - Calls: `GET /api/bongos/versions/:id/progress` (public)
-- Runs: `scripts/gds/status.js` (`--hook` / `--widget` render the card; default text + `--json` unchanged)
+- Runs: `scripts/bongos/status.js` (`--hook` / `--widget` render the card; default text + `--json` unchanged)
 - Delivered by: `.claude/hooks/session-cards.js` (the card-delivery hook, task 1288)

package/.claude/skills/strand-fix/SKILL.md

@@ -16,12 +16,12 @@ You are landing one stranded task. The reconciler is not coming back for it —
 ## Preflight (first, always)
 
 ```bash
-node scripts/gds/skill-preflight.js strand-fix   # exits 1 naming what is MISSING (gh)
+node scripts/bongos/skill-preflight.js strand-fix   # exits 1 naming what is MISSING (gh)
 ```
 
 ## Which shape is this? (read first)
 
-`node scripts/gds/strand-watch.js --json` — find the task. Three shapes, three owners:
+`node scripts/bongos/strand-watch.js --json` — find the task. Three shapes, three owners:
 
 | shape | status | reason | this skill? |
 |---|---|---|---|
@@ -39,20 +39,20 @@ node scripts/gds/skill-preflight.js strand-fix   # exits 1 naming what is MISSIN
    gh pr list --search "N" --state all --json number,state,mergeable,url
    ```
 2. **Pick the ONE matching case.** (Nothing here moves **main** by hand: landing is server-mediated (ADR 0031 §6 / ADR 0055), so the step that lands is always `ship.js`. `git fetch` always works.)
-   - **A. A main commit carries `(task N` and the post-merge `unit` + `main-audit` on main are green** (`gh run list --branch main --limit 4`): the land happened; only the proof failed. The proof is the claim's recorded tip (`claims.published_head_sha`, task 1547) being an ancestor of main — and a `no_branch_no_tip` claim has none (the work rode in on another branch, e.g. a cloud-agent batch, or a `--here` claim). **Record the tip first**: the owner (Archon) sets that column on the task's latest claim to the full 40-char SHA of the main commit — a direct DB write on the box as the DB owner, so it runs under this task's own ledger with the SQL in the ship note (`UPDATE claims SET published_head_sha = '<sha>' WHERE id = (SELECT id FROM claims WHERE task_id = N ORDER BY claimed_at DESC, id DESC LIMIT 1)`). Then the reconciler proves it within ≤5 min, or flip it yourself: `node scripts/gds/api.js POST /api/bongos/tasks/N/ship --body '{}'`. Never `no_artifact: true` here — the artifact exists, and the ledger would record a falsehood. Credits land on the flip (ADR 0120). (Before task 1003434 the manual POST refused even with a tip when the claim had no branch; the reconciler path always worked.)
+   - **A. A main commit carries `(task N` and the post-merge `unit` + `main-audit` on main are green** (`gh run list --branch main --limit 4`): the land happened; only the proof failed. The proof is the claim's recorded tip (`claims.published_head_sha`, task 1547) being an ancestor of main — and a `no_branch_no_tip` claim has none (the work rode in on another branch, e.g. a cloud-agent batch, or a `--here` claim). **Record the tip first**: the owner (Archon) sets that column on the task's latest claim to the full 40-char SHA of the main commit — a direct DB write on the box as the DB owner, so it runs under this task's own ledger with the SQL in the ship note (`UPDATE claims SET published_head_sha = '<sha>' WHERE id = (SELECT id FROM claims WHERE task_id = N ORDER BY claimed_at DESC, id DESC LIMIT 1)`). Then the reconciler proves it within ≤5 min, or flip it yourself: `node scripts/bongos/api.js POST /api/bongos/tasks/N/ship --body '{}'`. Never `no_artifact: true` here — the artifact exists, and the ledger would record a falsehood. Credits land on the flip (ADR 0120). (Before task 1003434 the manual POST refused even with a tip when the claim had no branch; the reconciler path always worked.)
    - **B. A local branch exists with commits ahead of `origin/main` and no PR**: the ship never pushed. From that worktree: `git push -u origin <branch>` then `gh pr create --base main --head <branch> --fill`. Green `unit` → server auto-merge → the reconciler flips it within ~5 min. If it merges but does not flip, do **A**.
    - **C. A PR exists but is `CONFLICTING`**: only the **branch owner** can resolve this, and **never with `--force`**. **Merge, never rebase** (task 1002788): the branch is already published and the server's publish is append-only, so rewriting its history makes every later push non-fast-forward and the task un-landable while the claim gate keeps the owner's queue shut.
      - **If you ARE the branch owner** (the usual case — it is your own strand), from that worktree:
        ```bash
        git fetch -q origin
        git merge origin/main      # resolve the conflicts, commit
-       node scripts/gds/ship.js <task-id>
+       node scripts/bongos/ship.js <task-id>
        ```
        **`ship.js` is the landing step, not `git push`.** Landing is **server-mediated** (ADR 0031 §6 / ADR 0055): `/builder-ship` uploads a bundle and the SERVER moves main. A push from your machine does not land the task even where it succeeds, and on the documented default machine a push to main has no credential at all. So "resolve and push" is not an exit — it leaves the task at `confirmed`, unpaid, with nothing named to do next. That is what stranded task 1003529.
        **The resume does NOT re-grade.** `ship.js` sees `confirmed` + "you last held the claim", prints `resuming the merge + deploy (no re-claim needed)`, and lands it. The standing caution about re-running `ship.js` on graded work is about `--regrade`, which pays for a second panel; a bare resume from `confirmed` does not. Verified end to end on task 1003529 → PR #745 merged as `e827063f`.
      - **If it is SOMEONE ELSE'S strand**: report the PR URL and stop. That exit is still correct — only the owner can resolve a real content conflict, and this skill does not resolve conflicts for them.
-   - **D. Nothing anywhere** — no branch, no PR, no commit: a codeless confirm. Ask what the task delivered. Work done outside this repo (on the box's instance checkout, a DB-only change captured in the ship note) is legitimately artifact-free → **A** with the reason in the ship body: `--body '{"note":"codeless: <where the work lives>"}'`. If the work was never done, release it instead so it returns to `ready`: `node scripts/gds/release.js N --reason "stranded codeless confirm; nothing delivered"`.
-3. **Verify**: `node scripts/gds/api.js GET /api/bongos/tasks/N` → `"status": "shipped"` (or `ready` after a release). Re-run `strand-watch.js --line` — the task must be gone from it. If the claim gate was the symptom, `claim.js` now succeeds.
+   - **D. Nothing anywhere** — no branch, no PR, no commit: a codeless confirm. Ask what the task delivered. Work done outside this repo (on the box's instance checkout, a DB-only change captured in the ship note) is legitimately artifact-free → **A** with the reason in the ship body: `--body '{"note":"codeless: <where the work lives>"}'`. If the work was never done, release it instead so it returns to `ready`: `node scripts/bongos/release.js N --reason "stranded codeless confirm; nothing delivered"`.
+3. **Verify**: `node scripts/bongos/api.js GET /api/bongos/tasks/N` → `"status": "shipped"` (or `ready` after a release). Re-run `strand-watch.js --line` — the task must be gone from it. If the claim gate was the symptom, `claim.js` now succeeds.
 
 ## Rules
 

package/.claude/skills/worktree-clean/SKILL.md

@@ -14,14 +14,14 @@ cost: >-
 
 ## What this skill does
 
-1. `node scripts/gds/stale-worktrees.js` — the list. A worktree is **stale** when its branch is an ancestor of `origin/main` (the land happened) or the branch is gone (the ship deleted it). Detached worktrees, unmerged branches, and branches sitting exactly at `origin/main` (a claim worktree with no commits yet — task 1003912) are **live** and never touched. Run `git fetch origin` first so "merged into main" reflects today's main, not the last fetch. The same call also names **husks** — directories under `.claude/worktrees/` that git does not list as worktrees at all (step 6).
+1. `node scripts/bongos/stale-worktrees.js` — the list. A worktree is **stale** when its branch is an ancestor of `origin/main` (the land happened) or the branch is gone (the ship deleted it). Detached worktrees, unmerged branches, and branches sitting exactly at `origin/main` (a claim worktree with no commits yet — task 1003912) are **live** and never touched. Run `git fetch origin` first so "merged into main" reflects today's main, not the last fetch. The same call also names **husks** — directories under `.claude/worktrees/` that git does not list as worktrees at all (step 6).
 2. Show the stale list to the builder (names + why). A worktree holding a **live claim** should not appear: an unmerged branch is live, and since task 1003912 so is a branch still sitting exactly at `origin/main` — the window between `worktree.js add` and the builder's first commit, during which a live claim's tree really did read as "merged into main".
    - Do not treat that as a guarantee. This list is derived from git alone, with no knowledge of who holds what, so **if a name on it looks like someone's live claim, ask before removing it.** The assurance this replaced — that a current claim could not possibly be listed — is exactly what would stop an agent double-checking.
-3. For each stale name: `node scripts/gds/worktree.js remove <name>`. That helper unlinks any node_modules junction BEFORE `git worktree remove`, which is the whole reason raw git is off-limits here (learning in `scripts/gds/CLAUDE.md` → "Gotchas / invariants"; the `git-guard.js` PreToolUse hook blocks the raw form).
+3. For each stale name: `node scripts/bongos/worktree.js remove <name>`. That helper unlinks any node_modules junction BEFORE `git worktree remove`, which is the whole reason raw git is off-limits here (learning in `scripts/bongos/CLAUDE.md` → "Gotchas / invariants"; the `git-guard.js` PreToolUse hook blocks the raw form).
    - A worktree with untracked leftovers (`.playwright-mcp/`, a stray screenshot) refuses without `--force`. Show the `git -C <path> status --porcelain` output; if it is only untracked junk, re-run with `--force`. If it shows **modified tracked files**, skip it and report — someone's uncommitted work is not this skill's to delete.
 4. `git worktree prune` — clears any registrations whose directory is already gone.
 5. Print the tally: removed / skipped (with why) / still live. Stale branches stay — a merged branch is harmless and `git branch -d` is the ship's business, not a cleanup chore.
-6. `node scripts/gds/worktree.js prune-husks` — the **husks**: directories still under `.claude/worktrees/` that git no longer lists. They are the residue of an OneDrive-locked `git worktree remove`, which deregisters the worktree but cannot delete the directory (task 1002594). Nothing else can see them: a deregistered husk is absent from `git worktree list`, which is all step 1's stale scan reads. The sweep deletes only an **empty** husk that this session is not standing in and that has not been touched in 24h — the harness parks live session directories in the same folder and a fresh one looks exactly like residue. It prints the reason for every skip; `--force` waives only the 24h rule.
+6. `node scripts/bongos/worktree.js prune-husks` — the **husks**: directories still under `.claude/worktrees/` that git no longer lists. They are the residue of an OneDrive-locked `git worktree remove`, which deregisters the worktree but cannot delete the directory (task 1002594). Nothing else can see them: a deregistered husk is absent from `git worktree list`, which is all step 1's stale scan reads. The sweep deletes only an **empty** husk that this session is not standing in and that has not been touched in 24h — the harness parks live session directories in the same folder and a fresh one looks exactly like residue. It prints the reason for every skip; `--force` waives only the 24h rule.
 
 ## Safety
 
@@ -33,4 +33,4 @@ cost: >-
 
 ## Calls
 
-`node scripts/gds/stale-worktrees.js [--json]` · `node scripts/gds/worktree.js remove <name> [--force]` · `node scripts/gds/worktree.js prune-husks [--force]` · `git worktree prune`.
+`node scripts/bongos/stale-worktrees.js [--json]` · `node scripts/bongos/worktree.js remove <name> [--force]` · `node scripts/bongos/worktree.js prune-husks [--force]` · `git worktree prune`.

package/.gitattributes

@@ -59,7 +59,7 @@
 
 # Windows-only wrappers must be CRLF — cmd.exe/PowerShell expect it. Declared up
 # front before there were any; the first two arrived with task 1003905
-# (scripts/gds/autobongos-service.{cmd,ps1}), and they are also kept pure ASCII:
+# (scripts/bongos/autobongos-service.{cmd,ps1}), and they are also kept pure ASCII:
 # Windows PowerShell 5.1 reads a BOM-less file as ANSI rather than UTF-8, and
 # cmd.exe reads a batch file in the OEM codepage, so a stray em-dash renders as
 # mojibake in text the owner is meant to read.
@@ -83,9 +83,9 @@
 # Generated files (task 1243 — auto-heal merge conflicts). These are regenerated
 # from code by gen-repo-map.js (ADR 0063) / gen-file-map.js (ADR 0066) /
 # gen-session-index.js (ADR 0062 §8), so two parallel branches reliably conflict
-# on them. The `otb-regen` merge driver (scripts/gds/git-merge-regen.js)
+# on them. The `otb-regen` merge driver (scripts/bongos/git-merge-regen.js)
 # regenerates them from the merged tree instead of conflicting. It is registered
-# per-clone by scripts/gds/install-git-hooks.js; where it is NOT registered git
+# per-clone by scripts/bongos/install-git-hooks.js; where it is NOT registered git
 # falls back to a normal conflict (harmless), and ship.js's pre-stage merge
 # self-heals the same set. task 1385 (ADR 0082): the SERVER also self-heals — the
 # publish-reconciler runs a temp-clone merge with this driver registered, so a PR
@@ -97,7 +97,7 @@
 # file conflicted there on every merge with nothing to heal it. It is the same shape as
 # docs/file-map.md (hand-written prose + a generated block), not the whole-file shape, so
 # the driver 3-way-merges the prose and re-renders only the snippet; a genuine conflict in
-# the prose still falls through to a normal git conflict. scripts/gds/CLAUDE.md
+# the prose still falls through to a normal git conflict. scripts/bongos/CLAUDE.md
 # LEFT that set in task 1003548 (its ~40k-char block was 76% of a file loaded on every
 # visit to that directory; docs/repo-map.md still carries the full index), so its entry
 # came out with it — a path listed here whose generator no longer owns it would route a
@@ -113,7 +113,7 @@
 # once none remain they can be dropped. The other four entries stay load-bearing.
 # The LEADING SLASH is load-bearing: a gitattributes pattern with no slash matches at ANY
 # depth, so a bare `CLAUDE.md` would also capture all 22 modules/*/CLAUDE.md and
-# scripts/gds/CLAUDE.md — files the driver does NOT know (they are not in NESTED_DIRS, so
+# scripts/bongos/CLAUDE.md — files the driver does NOT know (they are not in NESTED_DIRS, so
 # REGENERABLE has no rule for them). The driver would then exit 1 on each and FORCE a
 # conflict git would otherwise have merged cleanly — the exact 'routed through a driver
 # that cannot regenerate it' failure this file warns about above. `/CLAUDE.md` anchors to
@@ -126,7 +126,7 @@ src/bongos/CLAUDE.md          merge=otb-regen
 src/bongos/routes/CLAUDE.md   merge=otb-regen
 
 # docs/copy-registry.json + docs/copy-inventory.md (task 1003543): the copy
-# registry's committed pair (scripts/gds/copy-inventory.js) — fully generated from
+# registry's committed pair (scripts/bongos/copy-inventory.js) — fully generated from
 # a tree scan, nothing hand-authored in either, so two branches that each touch
 # hall/status/landing copy regenerate them differently and conflict like ordinary
 # files. Same otb-regen shape as docs/session-log-index.md above (whole-file
@@ -155,33 +155,13 @@ docs/copy-inventory.md     merge=otb-regen text eol=lf
 # sides (page-reader.js mergeReadingDocs) and recomputes the counts.
 docs/page-readings.json    merge=otb-regen
 
-# Generated API contract + client (task 1003537). gen-api-docs.js writes the first
-# three of these wholesale from a scan of the route files; gen-api-client.js writes the
-# six client files wholesale from that spec. Nothing is hand-authored in any of the
-# nine, so they are the same whole-file shape as docs/session-log-index.md above — and
-# any branch that adds or changes a route regenerates all nine differently and conflicts
-# on ordinary text. Measured on task 1002334: main took 41 commits in 3 hours and four
-# consecutive merge -> regenerate -> reship cycles each lost the race to a fresh conflict
-# in exactly these files, with a PASSING grade the whole time. REGENERABLE in
-# git-merge-regen.js carries the matching rules, and tests/git_merge_regen.mjs pins the
-# two lists as one set.
-#
-# EVERY PATH IS LISTED EXPLICITLY -- deliberately no `clients/bongos-client/*` glob, for
-# two independent reasons. The lockstep test compares these tokens against REGENERABLE as
-# literal path strings, and the driver is handed git's %P, so a glob would match nothing
-# on either side. And clients/bongos-client/examples/hello-world.mjs is HAND-WRITTEN (the
-# generator owns only the six files below): a glob that captured it would route it through
-# a driver that has no rule for it, forcing a conflict git would otherwise merge cleanly --
-# the same trap the leading slash on /CLAUDE.md above exists to avoid.
-docs/api/openapi.json         merge=otb-regen
-docs/api-reference.md         merge=otb-regen
+# Generated API pointer stub (task 1003537). gen-api-docs.js writes it wholesale, so it
+# keeps the whole-file otb-regen shape. The spec, the reference and the six typed-client
+# files it used to sit beside are no longer committed at all (task 1004866: gitignored,
+# rebuilt from the routes by package-core / serve-internal / the unit suite), so they need
+# no merge driver. REGENERABLE in git-merge-regen.js carries the matching rule, and
+# tests/git_merge_regen.mjs pins the two lists as one set.
 docs/routes-permissions.md    merge=otb-regen
-clients/bongos-client/index.mjs               merge=otb-regen
-clients/bongos-client/index.cjs               merge=otb-regen
-clients/bongos-client/bongos-client.global.js merge=otb-regen
-clients/bongos-client/index.d.ts              merge=otb-regen
-clients/bongos-client/package.json            merge=otb-regen
-clients/bongos-client/README.md               merge=otb-regen
 
 # Append-only index tables (task 1385 / ADR 0082). docs/adr/README.md is a
 # hand-maintained ADR index whose ONLY recurring conflict is two branches each

package/GOVERNMENT.md

@@ -256,7 +256,7 @@ We don't take our own word for it. There's a walk: one repeatable run over a thr
 Run it yourself:
 
 ```sh
-node scripts/gds/government-walk.js
+node scripts/bongos/government-walk.js
 ```
 
 The full pass/fail table is in [`docs/governance/government-walk.md`](docs/governance/government-walk.md). CI re-runs the walk on every change, so if any row flips, the build goes red.

package/README.md

@@ -12,7 +12,7 @@ The durable framing for AI agents — methodology, working rules, session protoc
 
 ## What's in here
 
-- **The GDS** (`src/`, `modules/`, `scripts/gds/`) — the build state machine: tasks, claims, versions, goals, dependencies, the claim→ship→grade→credit lifecycle, and the `/builder-*` CLI.
+- **The GDS** (`src/`, `modules/`, `scripts/bongos/`) — the build state machine: tasks, claims, versions, goals, dependencies, the claim→ship→grade→credit lifecycle, and the `/builder-*` CLI.
 - **Platform modules** (`modules/`) — lifecycle, grading, economy, memory, onboarding, ideas, sessions, autonomy, security, the builders' hall + status dashboard, and Discord integration. Each is configurable (and most are toggleable) per instance.
 - **Neutral branding template** (`config/*.neutral.json`, `docs/project-context.template.md`) — the identity scaffold a new instance fills in ([`docs/branding-contract.md`](./docs/branding-contract.md)). The vanilla pack in `config/branding.neutral.json` is the identity Cloud Bongos itself runs on.
 - **Methodology + decisions** (`CLAUDE.md`, `docs/adr/`, `docs/recipes/`, `.claude/skills/`).
@@ -44,7 +44,7 @@ One command bootstraps a fresh clone end-to-end — toolchain checks, JS deps, l
 node scripts/setup-builder.js
 ```
 
-It checks Node ≥ 22 and Python ≥ 3.10 (prints the install command if either is missing), runs `npm ci`, copies `.env.local.example` to `.env.local`, and hands off to `node scripts/gds/setup.js` to authenticate against the GDS via the GitHub Device Flow. The script is idempotent: re-running on an already-set-up checkout reports "already done" rather than clobbering.
+It checks Node ≥ 22 and Python ≥ 3.10 (prints the install command if either is missing), runs `npm ci`, copies `.env.local.example` to `.env.local`, and hands off to `node scripts/bongos/setup.js` to authenticate against the GDS via the GitHub Device Flow. The script is idempotent: re-running on an already-set-up checkout reports "already done" rather than clobbering.
 
 When it finishes, open Claude Code and run `/builder-start` to see what tasks are claimable.
 
@@ -54,9 +54,9 @@ We keep secrets (`.env` files, API keys, private keys) out of the repo with thre
 
 - **Prevent — the secret-gate hook** (`.claude/hooks/secret-gate.js`, wired in `.claude/settings.json`). A Claude Code PreToolUse hook that refuses to write secret-shaped content (provider-prefixed tokens, PEM blocks) into the working tree or a shell. It is the cooperative layer: it fails open on any error, so the two gates below are what actually hold.
 - **Gate — the CI secret scan** (the `Secret scan` step in `.github/workflows/unit.yml`). Every PR runs a pinned, checksum-verified gitleaks over the checked-out tree against `.gitleaks.toml`. This must pass before merge. It scans current files, not history.
-- **Patrol — the weekly history scan** (`scripts/gds/redteam-patrol.js`, run by `.github/workflows/redteam-patrol.yml`). Scans the full git history with the same config, which is how a secret committed and later deleted is still caught.
+- **Patrol — the weekly history scan** (`scripts/bongos/redteam-patrol.js`, run by `.github/workflows/redteam-patrol.yml`). Scans the full git history with the same config, which is how a secret committed and later deleted is still caught.
 
-A local pre-commit hook is optional and an instance addition: this repo tracks `.husky/pre-push` (the ADR 0043 permission gate, a separate wall) but no secrets pre-commit hook. If your instance adds hooks under `.husky/`, activate them once per clone with `node scripts/gds/install-git-hooks.js` (it no-ops on a checkout without a `.husky/`; `node scripts/gds/doctor.js` reports which case you're in).
+A local pre-commit hook is optional and an instance addition: this repo tracks `.husky/pre-push` (the ADR 0043 permission gate, a separate wall) but no secrets pre-commit hook. If your instance adds hooks under `.husky/`, activate them once per clone with `node scripts/bongos/install-git-hooks.js` (it no-ops on a checkout without a `.husky/`; `node scripts/bongos/doctor.js` reports which case you're in).
 
 ### If a scan blocks you, here's how to investigate
 
@@ -66,14 +66,14 @@ A local pre-commit hook is optional and an instance addition: this repo tracks `
 
 ## If your CLI starts 401'ing
 
-GDS CLI calls (`node scripts/gds/start.js`, `claim.js`, `ship.js`, etc.) authenticate against your instance's GDS host using a session token stored under `~/.config/<configDir>/` (the neutral core uses `cloudbongos`; an instance may pin its own). CLI sessions do not expire — they last until revoked ([ADR 0294](docs/adr/0294-cli-sessions-do-not-expire.md)) — so a 401 means the token was revoked (by you from Settings → Active sessions, or by an Archon), swept by a rank demotion, or invalidated by an auth-changing deploy.
+GDS CLI calls (`node scripts/bongos/start.js`, `claim.js`, `ship.js`, etc.) authenticate against your instance's GDS host using a session token stored under `~/.config/<configDir>/` (the neutral core uses `cloudbongos`; an instance may pin its own). CLI sessions do not expire — they last until revoked ([ADR 0294](docs/adr/0294-cli-sessions-do-not-expire.md)) — so a 401 means the token was revoked (by you from Settings → Active sessions, or by an Archon), swept by a rank demotion, or invalidated by an auth-changing deploy.
 
-`apiCall` in `scripts/gds/cli-lib.js` detects HTTP 401 and exits with a clear recovery message rather than letting the failure cascade. When you see it:
+`apiCall` in `scripts/bongos/cli-lib.js` detects HTTP 401 and exits with a clear recovery message rather than letting the failure cascade. When you see it:
 
 1. **Re-auth via Device Flow:**
 
    ```sh
-   node scripts/gds/setup.js --force
+   node scripts/bongos/setup.js --force
    ```
 
    It pre-flights `GET /api/gds/me` against your existing session first. If the token is valid, it tells you who you're authenticated as and exits. If the token is dead (401), it falls through to the Device Flow automatically — browser opens to `github.com/login/device`; paste the printed code, authorize as the right GitHub account, you're back.
@@ -81,7 +81,7 @@ GDS CLI calls (`node scripts/gds/start.js`, `claim.js`, `ship.js`, etc.) authent
 2. **If something feels off and you're not sure what,** run the doctor:
 
    ```sh
-   node scripts/gds/doctor.js
+   node scripts/bongos/doctor.js
    ```
 
    It checks session validity (`/me` returns 200, identity + rank), git plumbing (`core.hooksPath` resolves), repo state (on a branch, working-tree status), and environment files. Green/red checklist, no arguments. Exits 0 if every check passes, 1 if any red.

package/bin/bongos.js

@@ -3,13 +3,13 @@
 //
 // GDS-V4 · V4.R79 · task 1246 (Phase 1 of the `bongos` toolkit; epic 1245).
 //
-// A single `bongos <verb>` front door over the existing scripts/gds/* scripts —
+// A single `bongos <verb>` front door over the existing scripts/bongos/* scripts —
 // the same actions the /builder-* slash-commands run inside Claude Code, now
 // usable from any terminal, VS Code, a Chromebook, or CI. This is deliberately a
 // THIN dispatcher: it spawns the target script with `process.execPath` (the one
 // guaranteed cross-platform runtime — no bash, #686) and forwards argv + exit
 // code. No auth/API logic lives here; the target scripts already share
-// scripts/gds/cli-lib.js.
+// scripts/bongos/cli-lib.js.
 //
 // Phases 2-4 extend this same CLI with a one-line installer + standalone binary
 // and instance-agnostic `login`/`init`/`upgrade`.
@@ -20,7 +20,7 @@ const path = require('node:path');
 const { spawnSync } = require('node:child_process');
 
 const REPO_ROOT = path.join(__dirname, '..');
-const GDS_DIR = path.join(REPO_ROOT, 'scripts', 'gds');
+const GDS_DIR = path.join(REPO_ROOT, 'scripts', 'bongos');
 
 // Two runtimes, one dispatcher (V4.R81 / task 1248):
 //  • repo checkout / `npm i -g` → we run under `node`, and the sibling scripts
@@ -43,16 +43,16 @@ const COMPILED = !['node', 'node.exe', 'bun', 'bun.exe'].includes(EXEC_BASENAME)
 // bundling their heavy, repo-coupled trees would bloat the binary, and they need
 // a repo to run anyway.
 const BUNDLED_RUNNERS = {
-  'login.js': () => require('../scripts/gds/login.js'),
-  'setup.js': () => require('../scripts/gds/setup.js'),
-  'reauth.js': () => require('../scripts/gds/reauth.js'),
+  'login.js': () => require('../scripts/bongos/login.js'),
+  'setup.js': () => require('../scripts/bongos/setup.js'),
+  'reauth.js': () => require('../scripts/bongos/reauth.js'),
   // Bundled for the same reason as reauth: they are two halves of one on-ramp
   // (mint the token, then store it), and a builder recovering a dead session on a
   // bare laptop has the standalone binary and nothing else (task 1003961).
-  'paste-token.js': () => require('../scripts/gds/paste-token.js'),
-  'api.js': () => require('../scripts/gds/api.js'),
-  'init.js': () => require('../scripts/gds/init.js'),
-  'onboard.js': () => require('../scripts/gds/onboard.js'),
+  'paste-token.js': () => require('../scripts/bongos/paste-token.js'),
+  'api.js': () => require('../scripts/bongos/api.js'),
+  'init.js': () => require('../scripts/bongos/init.js'),
+  'onboard.js': () => require('../scripts/bongos/onboard.js'),
 };
 
 // The bongos CLI's OWN release version is config/bongos-cli.json's `version` (the
@@ -64,7 +64,7 @@ try { VERSION = require('../config/bongos-cli.json').version || VERSION; } catch
 if (VERSION === '0.0.0') { try { VERSION = require('../package.json').version || VERSION; } catch { /* best-effort */ } }
 
 // verb -> { script, prefixArgs?, group, summary, selfHelp? }
-//   `script`     a file under scripts/gds/ (or api.js for actions with no
+//   `script`     a file under scripts/bongos/ (or api.js for actions with no
 //                dedicated builder script yet).
 //   `prefixArgs` inserted before the user's args — used to drive the generic
 //                api.js caller for an action with no dedicated script.
@@ -89,8 +89,8 @@ const VERBS = {
   reauth:  { script: 'reauth.js', group: 'account', summary: 'Refresh your session' },
   // The second half of `reauth`: the hall mints a token, this stores it. A VERB
   // rather than a path because the string is emitted by the SERVER and pasted on
-  // an INSTANCE, where `scripts/gds/` does not exist — the core is a dependency
-  // there, so the old `node scripts/gds/paste-token.js <token>` named a file the
+  // an INSTANCE, where `scripts/bongos/` does not exist — the core is a dependency
+  // there, so the old `node scripts/bongos/paste-token.js <token>` named a file the
   // builder did not have (task 1003961). A verb also makes it allow-listable by
   // name, the way claim/ship/release already are (ADR 0104).
   'paste-token': { script: 'paste-token.js', group: 'account', summary: 'Finish re-auth: store the token copied from Settings  (bongos paste-token <token>)' },
@@ -106,13 +106,13 @@ const VERBS = {
   module:  { script: 'module.js', group: 'instance', summary: 'Scaffold a new module  (bongos module new <key>)', selfHelp: true },
   upgrade: { script: 'upgrade.js', group: 'instance', summary: 'Pull the core to a new version (bump pin→install→migrate→materialize→restart); bare = module-compat pre-check', selfHelp: true },
   'package-core': { script: 'package-core.js', group: 'instance', summary: 'Package the core as a versioned, installable artifact (+ pin manifest)' },
-  exec:    { script: null, group: 'instance', summary: 'Run a core script inside the package  (bongos exec scripts/gds/<x>.js [args])' },
+  exec:    { script: null, group: 'instance', summary: 'Run a core script inside the package  (bongos exec scripts/bongos/<x>.js [args])' },
 };
 
 // `bongos exec <relpath> [args]` — resolve a script by its repo-relative path INSIDE the core
 // package and run it. This is what lets a materialized skill/hook reach a core CLI that has no
-// dedicated verb (ADR 0108 §3 / W3): once the core installs from node_modules, `node scripts/gds/x.js`
-// from the instance root can't find the script (it's in the package), but `bongos exec scripts/gds/x.js`
+// dedicated verb (ADR 0108 §3 / W3): once the core installs from node_modules, `node scripts/bongos/x.js`
+// from the instance root can't find the script (it's in the package), but `bongos exec scripts/bongos/x.js`
 // resolves it under the package root. Constrained to paths that stay within the package (no `..`
 // escape, no absolute paths) so it can only run core code.
 function resolveExecTarget(relpath) {
@@ -155,7 +155,7 @@ function verbHelpText(verb, def) {
   return [
     `bongos ${verb} — ${def.summary}`,
     '',
-    `Forwards to scripts/gds/${def.script}; extra arguments are passed through.`,
+    `Forwards to scripts/bongos/${def.script}; extra arguments are passed through.`,
     'Run `bongos help` to see every command.',
   ].join('\n');
 }
@@ -194,12 +194,12 @@ function main(argv) {
   // Run the core the checkout PINS (task 1004632). A task worktree has no node_modules
   // of its own, so after a core update lands it resolves the main checkout's older core
   // and the ship fails on a bug the pin already fixed. `ship` installs the pinned core
-  // into the checkout and re-runs under it; scripts/gds/core-pin-sync.js.
+  // into the checkout and re-runs under it; scripts/bongos/core-pin-sync.js.
   // First, both `ship` and `start` (an instance's session start) follow a core move the
   // hub pushed to GitHub: one line saying so, and on a clean main a fast-forward plus
-  // install (task 1004732; scripts/gds/core-origin-follow.js).
+  // install (task 1004732; scripts/bongos/core-origin-follow.js).
   if (!COMPILED && (verb === 'ship' || verb === 'start')) {
-    const synced = require('../scripts/gds/core-origin-follow.js').ensureCurrentCore({ coreRoot: REPO_ROOT, argv, verb });
+    const synced = require('../scripts/bongos/core-origin-follow.js').ensureCurrentCore({ coreRoot: REPO_ROOT, argv, verb });
     if (synced != null) return synced;
   }
 
@@ -211,7 +211,7 @@ function main(argv) {
     }
     const target = resolveExecTarget(args[1]);
     if (!target) {
-      process.stderr.write('bongos: exec needs a package-relative script path, e.g. `bongos exec scripts/gds/api.js GET /api/gds/me` (no absolute paths, no `..`).\n');
+      process.stderr.write('bongos: exec needs a package-relative script path, e.g. `bongos exec scripts/bongos/api.js GET /api/gds/me` (no absolute paths, no `..`).\n');
       return 2;
     }
     const res = spawnSync(process.execPath, [target, ...args.slice(2)], { stdio: 'inherit' });
@@ -226,8 +226,8 @@ function main(argv) {
 
   // A person typed `bongos <verb>`, so this output is for a person: no `[otb-card]` directives
   // addressed to a model, no `/builder-*` slash commands that exist only inside Claude Code
-  // (task 1003680, scripts/gds/surface.js). The skills and the card-delivery hook run
-  // `node scripts/gds/<verb>.js` DIRECTLY and never pass through here, so the agent card shape
+  // (task 1003680, scripts/bongos/surface.js). The skills and the card-delivery hook run
+  // `node scripts/bongos/<verb>.js` DIRECTLY and never pass through here, so the agent card shape
   // is untouched. `bongos exec` above is deliberately left alone — it is the agent's escape
   // hatch into a core script.
   const res = spawnSync(process.execPath, [scriptPath, ...forwarded], {

package/clients/bongos-client/README.md

@@ -1,11 +1,11 @@
 # @bongos/client
 
 A **generated**, zero-dependency typed client for the Bongos API — produced from
-`docs/api/openapi.json` by `scripts/gds/gen-api-client.js` (ADR 0118). Do not edit
+`docs/api/openapi.json` by `scripts/bongos/gen-api-client.js` (ADR 0118). Do not edit
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 572 operations across 76 resource groups
+- 580 operations across 77 resource groups
 
 ## Use it from your project