@bongos/core 1.21.176 → 1.21.177

package/modules/autonomy/rank-roles.js

@@ -0,0 +1,64 @@
+'use strict';
+
+// modules/autonomy/rank-roles.js — which builders hold a rank the governance
+// backfill cannot match? (task 1002873; moved here from
+// scripts/bongos/audit-rank-roles.js in task 1004878 so the server's daily check and
+// the CLI share ONE definition).
+//
+// Pure: no I/O, no core require. The live ladder is an ARGUMENT — the poller passes
+// api.LIVE_RANK_LADDER, the CLI passes db-kernel's — because a module file reaches
+// core only through the doorway.
+
+// findRanksWithoutRoles — given roster rows and the live ladder, which builders hold
+// a rank that `governance_002`'s INNER JOIN cannot match?
+//
+// A row with NO rank at all counts: NULL fails the INNER JOIN the same way a
+// legacy value does, and reads as "fine" in every UI that renders a blank.
+function findRanksWithoutRoles(rows, liveRanks) {
+  const live = new Set(liveRanks || []);
+  return (Array.isArray(rows) ? rows : [])
+    .filter((b) => b && !live.has(b.rank))
+    .map((b) => ({
+      id: b.id != null ? String(b.id) : null,
+      // The login is what an operator needs to act; it is already visible to any
+      // caller authorised to read the roster, so this adds no exposure.
+      github_login: b.github_login || null,
+      rank: b.rank === undefined ? null : b.rank,
+      status: b.status || null,
+    }));
+}
+
+// summarize — the rank histogram, so a CLEAN run still says what it looked at.
+// A green check that prints nothing is indistinguishable from one that read
+// nothing, which is the failure mode this whole check is about.
+function summarize(rows) {
+  const counts = new Map();
+  for (const b of Array.isArray(rows) ? rows : []) {
+    const key = b && b.rank ? b.rank : '(none)';
+    counts.set(key, (counts.get(key) || 0) + 1);
+  }
+  return [...counts.entries()].sort((a, b) => b[1] - a[1]);
+}
+
+// ideaFor — the one idea a finding becomes, filed by either caller.
+function ideaFor(offenders, { filedBy = 'scripts/bongos/audit-rank-roles.js' } = {}) {
+  return {
+    title: `[rank-roles] ${offenders.length} builder(s) on a rank with no governance role`,
+    bodyMd: [
+      `${offenders.length} builder(s) hold a rank with no matching governance_roles row.`,
+      '',
+      'They resolve to ZERO permissions — admitted by rank threshold under requireRank,',
+      'refused by the permission resolver, and given no reason (ADR 0151 fail-closed).',
+      '',
+      ...offenders.map((o) => `- builder ${o.id}${o.github_login ? ` (${o.github_login})` : ''} rank=${o.rank === null ? '(none)' : o.rank} status=${o.status || '?'}`),
+      '',
+      'Fix: move each to a live rank through the normal rank-change path, which rotates',
+      'the governance role in the same transaction. Not auto-repaired: changing a rank is',
+      'an authority decision, and a sweep is the wrong actor for it.',
+      '',
+      `Filed by ${filedBy} (task 1002873).`,
+    ].join('\n'),
+  };
+}
+
+module.exports = { findRanksWithoutRoles, summarize, ideaFor };

package/modules/autonomy/server-schedule.js

@@ -0,0 +1,37 @@
+'use strict';
+
+// modules/autonomy/server-schedule.js — which routines the always-on server fires
+// itself, and how often (task 1004878).
+//
+// ONE TABLE, TWO READERS THAT MUST AGREE. The pollers in ./pollers/ take their
+// periods from here, and scripts/bongos/routine-schedule.js reads the same rows to
+// decide whether a routine's declared `cadence:` has something that fires it. Before
+// this table the only scheduler that check could see was .github/workflows/, so a
+// routine fired in-process (peer-vote-tally) read as "manual only", and the routines
+// nothing fired at all read the same way — the two cases were indistinguishable.
+//
+// Deliberately dependency-free: the merge-gate check requires this file in a plain
+// checkout with no database and no module loader.
+
+const DAY_MS = 24 * 60 * 60_000;
+const WEEK_MS = 7 * DAY_MS;
+
+// The cadence names a server row may use, and the period each one means. A subset of
+// routine-schedule.js's vocabulary: nothing in-process runs more often than daily.
+const CADENCE_MS = Object.freeze({ daily: DAY_MS, weekly: WEEK_MS });
+
+const SERVER_ROUTINES = Object.freeze([
+  { routine: 'peer-vote-tally', cadence: 'weekly', poller: 'routine-timers' },
+  { routine: 'rank-roles-audit', cadence: 'daily', poller: 'daily-checks' },
+  { routine: 'dep-audit-nightly', cadence: 'daily', poller: 'daily-checks' },
+].map(Object.freeze));
+
+// periodMs('rank-roles-audit') → 86400000. Throws on a routine the table does not
+// carry, so a poller can never quietly fall back to a period nobody declared.
+function periodMs(routine) {
+  const row = SERVER_ROUTINES.find((r) => r.routine === routine);
+  if (!row) throw new Error(`server-schedule: '${routine}' is not a server-fired routine`);
+  return CADENCE_MS[row.cadence];
+}
+
+module.exports = { SERVER_ROUTINES, CADENCE_MS, periodMs, DAY_MS, WEEK_MS };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.176",
+  "version": "1.21.177",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.176",
+      "version": "1.21.177",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.176",
+  "version": "1.21.177",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10308,5 +10308,19 @@
       "id": "1004858",
       "text": "The status page no longer shows an uptime panel and a \"standing\" card that only ever said \"unknown\" — the checker behind them was never switched on. The dead checker and its data feed are gone too."
     }
+  ],
+  "1.21.177": [
+    {
+      "id": "1004887",
+      "text": "Main was failing one safety check after two cleanup changes landed together. The check's expected count now matches the files we deliberately removed, so main is green again."
+    },
+    {
+      "id": "1004878",
+      "text": "Two daily safety checks — builders on a broken rank and known-vulnerable dependencies — now run on the server by themselves and land in the ideas inbox; five dead routines were retired."
+    },
+    {
+      "id": "1004856",
+      "text": "Removed 30 old scripts that each did one job once (mostly creating batches of tasks) and were never used again — about 6,500 lines less to read and maintain. Nothing that runs today used them."
+    }
   ]
 }

package/scripts/bongos/api-alias-caller-scan.js

@@ -36,7 +36,7 @@
 //      Note fitness-ratchets.js belongs here too: it is the GATE, and its builder-facing hint has
 //      to spell the alias out to tell anyone what they tripped over.
 //   4. THE RENAME GUARDRAILS (path-excluded). rename-history-check.js, rename-ledger-prose.js,
-//      gds-literal-scan.js, codemod-rename-src-gds.js, fitness-ratchets.js and THIS FILE name the
+//      gds-literal-scan.js, fitness-ratchets.js and THIS FILE name the
 //      old path because that is what they are for. Same principle as GDS_RULE_FILES next door: a
 //      gate that cannot state its own rule cannot explain itself.
 //   5. tests/ (path-excluded). Tests are what keeps the alias exercised in CI. Moving them off it
@@ -110,7 +110,7 @@ const ALIAS_EXCLUDED_PATHS = [
   // 3. the live proof that the alias still answers
   /^scripts\/(?:gds|bongos)\/smoke-gds\.js$/,
   // 4. the rename guardrails — they name the old path on purpose
-  /^scripts\/(?:gds|bongos)\/(rename-history-check|rename-ledger-prose|gds-literal-scan|codemod-rename-src-gds|api-alias-caller-scan|fitness-ratchets)\.js$/,
+  /^scripts\/(?:gds|bongos)\/(rename-history-check|rename-ledger-prose|gds-literal-scan|api-alias-caller-scan|fitness-ratchets)\.js$/,
   /^config\/(fitness-baselines|rename-history-baseline)\.json$/,
   // 5. tests keep the alias exercised in CI — the repo's own two spellings, `tests/` at the root
   //    and a module's `tests/` or `test/` dir. Deliberately NOT a blanket `\.mjs$`: three .mjs

package/scripts/bongos/audit-authorship.sh

@@ -196,11 +196,6 @@ ALLOWLIST=(
   # instance's owner literal precisely so packaging can SCRUB it from every
   # published core — the anti-leak spec, not a runtime hardcode (task 1002640).
   'scripts/bongos/package-core.js'
-
-  # Frozen seed script — a task DESCRIPTION quotes migration 023's founding-
-  # Archon literal as the thing that task exists to remove (the
-  # seed-v3-tasks.js class: stripping it would lose the task history).
-  'scripts/bongos/seed-medusa-tasks.js'
 )
 
 # ----------------------------------------------------------------------------

package/scripts/bongos/audit-rank-roles.js

@@ -21,8 +21,10 @@
 // THIS IS THE RE-RUNNABLE HALF, and it is deliberately NOT fatal at boot. Idea
 // 1000622 records that trap: an assertion that throws on startup turns a data
 // problem on one instance into an outage. This is a standalone read-only script
-// for a nightly/deploy-time caller — it exits 1 so a caller can act, and nothing
-// in the server's boot path requires it.
+// for a by-hand or deploy-time caller — it exits 1 so a caller can act, and nothing
+// in the server's boot path requires it. The SCHEDULED run is in-process: the
+// server's daily-checks poller (task 1004878) reads the roster straight from its
+// database and files the same idea, so it needs no CLI session.
 //
 // It reports rather than repairs, and that is a decision, not an omission:
 // rewriting somebody's rank is an authority change, and it belongs to an operator
@@ -36,7 +38,7 @@
 //   2  could not read the roster (no session / network / route absent)
 //
 // `--file-idea` is what makes this a SURFACE rather than another thing nobody
-// runs — the same shape diagram-drift/check.js uses, spawning capture.js so idea
+// runs — spawning capture.js so idea
 // filing has one implementation. Without it a nightly deterministic run that exits
 // 1 reports into a log nobody reads, which is the exact criticism this task makes
 // of the status quo.
@@ -48,69 +50,26 @@ const os = require('node:os');
 const { cliClient, requireSession, cliExit } = require('./cli-lib');
 const { LIVE_RANK_LADDER } = require('../../src/bongos/db-kernel.js');
 
-// findRanksWithoutRoles — the PURE half. Given roster rows and the live ladder,
-// which builders hold a rank that `governance_002`'s INNER JOIN cannot match?
-//
-// Pure + exported because this is the only altitude the repo can test: the unit
-// gate has no Postgres, which is exactly why the gap this script closes went
-// unverified for so long. A DB-free test of the decision is not a consolation
-// prize here — it is the thing that can actually run in CI.
-//
-// A row with NO rank at all counts: NULL fails the INNER JOIN the same way a
-// legacy value does, and reads as "fine" in every UI that renders a blank.
-function findRanksWithoutRoles(rows, liveRanks = LIVE_RANK_LADDER) {
-  const live = new Set(liveRanks);
-  return (Array.isArray(rows) ? rows : [])
-    .filter((b) => b && !live.has(b.rank))
-    .map((b) => ({
-      id: b.id != null ? String(b.id) : null,
-      // The login is what an operator needs to act; it is already visible to any
-      // caller authorised to read the roster, so this adds no exposure.
-      github_login: b.github_login || null,
-      rank: b.rank === undefined ? null : b.rank,
-      status: b.status || null,
-    }));
-}
+// The pure half lives in modules/autonomy/rank-roles.js (task 1004878), shared with
+// the server's daily check (modules/autonomy/pollers/daily-checks.js) so the two
+// cannot disagree about what an offender is. This wrapper defaults the ladder.
+const rankRoles = require('../../modules/autonomy/rank-roles.js');
 
-// summarize — the rank histogram, so a CLEAN run still says what it looked at.
-// A green check that prints nothing is indistinguishable from one that read
-// nothing, which is the failure mode this whole task is about.
-function summarize(rows) {
-  const counts = new Map();
-  for (const b of Array.isArray(rows) ? rows : []) {
-    const key = b && b.rank ? b.rank : '(none)';
-    counts.set(key, (counts.get(key) || 0) + 1);
-  }
-  return [...counts.entries()].sort((a, b) => b[1] - a[1]);
-}
+const findRanksWithoutRoles = (rows, liveRanks = LIVE_RANK_LADDER) => rankRoles.findRanksWithoutRoles(rows, liveRanks);
+const { summarize } = rankRoles;
 
 // Spawn capture.js rather than POSTing here, so idea filing keeps one
-// implementation (the diagram-drift/check.js precedent). Best-effort: a failure to
+// implementation. Best-effort: a failure to
 // file must not turn a successful audit into a crash — the exit code and stdout
 // still carry the finding.
 function fileIdea(offenders) {
-  const body = [
-    `${offenders.length} builder(s) hold a rank with no matching governance_roles row.`,
-    '',
-    'They resolve to ZERO permissions — admitted by rank threshold under requireRank,',
-    'refused by the permission resolver, and given no reason (ADR 0151 fail-closed).',
-    '',
-    ...offenders.map((o) => `- builder ${o.id}${o.github_login ? ` (${o.github_login})` : ''} rank=${o.rank === null ? '(none)' : o.rank} status=${o.status || '?'}`),
-    '',
-    'Fix: move each to a live rank through the normal rank-change path, which rotates',
-    'the governance role in the same transaction. Not auto-repaired: changing a rank is',
-    'an authority decision, and a sweep is the wrong actor for it.',
-    '',
-    'Filed by scripts/bongos/audit-rank-roles.js (task 1002873).',
-  ].join('\n');
+  const { title, bodyMd } = rankRoles.ideaFor(offenders);
   const tmp = path.join(os.tmpdir(), `rank-roles-audit-${process.pid}.md`);
   try {
-    fs.writeFileSync(tmp, body, 'utf8');
+    fs.writeFileSync(tmp, bodyMd, 'utf8');
     const r = spawnSync(
       process.execPath,
-      [path.join(__dirname, 'capture.js'),
-        `[rank-roles] ${offenders.length} builder(s) on a rank with no governance role`,
-        '--kind', 'bug', '--body-file', tmp],
+      [path.join(__dirname, 'capture.js'), title, '--kind', 'bug', '--body-file', tmp],
       { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 }
     );
     if (r.status !== 0) console.error('audit-rank-roles: capture.js failed to file the idea — the exit code above still carries the finding.');

package/scripts/bongos/codemod-rename-scripts-gds.js

@@ -81,7 +81,6 @@ const EXCLUDE = new Set([
   'tests/scripts_gds_forwarders.mjs',
   'modules/lifecycle/executed-closure.js',
   'scripts/bongos/rename-ledger-prose.js',
-  'scripts/bongos/codemod-rename-src-gds.js',
   '.bongos-core.json',
 ]);
 

package/scripts/bongos/diagram-facts.js

@@ -1,7 +1,7 @@
 // Shared fact-extractor for the onboarding diagrams (task #357).
 //
 // Single source of truth for "what the live system actually is", used by BOTH:
-//   - the drift checker (.claude/scheduled-tasks/diagram-drift/check.js), which
+//   - (formerly) the drift checker .claude/scheduled-tasks/diagram-drift/check.js, retired in task 1004878, which
 //     compares these facts against assertions.json and nudges on divergence; and
 //   - the generator (scripts/bongos/gen-diagrams.js), which regenerates the
 //     mechanical diagrams (.mmd) FROM these facts on every deploy.

package/scripts/bongos/do-api.js

@@ -15,7 +15,7 @@
 //     logs the call it WOULD make and returns a synthetic, clearly-marked
 //     result (`{ dryRun: true, ... }`) so the orchestrator's control flow runs
 //     end-to-end against a throwaway plan. This mirrors how provision-staging.sh
-//     and stale-claim-release ship runnable logic whose LIVE leg is a separate,
+//     ships runnable logic whose LIVE leg is a separate,
 //     explicit operator action.
 //   - Live mode requires a token (DO_API_TOKEN); the constructor throws clearly
 //     if asked to run live without one — it never silently no-ops a real call.

package/scripts/bongos/fitness-checks-identity.js

@@ -79,10 +79,8 @@ const IDENTITY_SCAN_EXTRA_FILES = [];
 //   * backfill-sessions.js / version-close.js — one-time operator runbook text
 //     naming the actual prod DB + a historical local directory. Describing what
 //     an operator must literally type is the correct content.
-//   * seed-*.js — the hits are PROSE INSIDE seeded task descriptions: historical
-//     records of what those tasks said when they were filed. Rewriting them would
-//     falsify the record; deleting the files would destroy it. They are inert
-//     (idempotent on source_ref) and referenced only by generated manifests.
+//   * seed-*.js — the nine one-shot seeders once listed here (prose inside seeded
+//     task descriptions) were deleted by task 1004856; the repo history keeps them.
 //   * the four *.sh entries — surfaced when `.sh` joined the extension set (task
 //     1002567). Each is a HOST-PINNED OPS script, not portable code: they name the
 //     live box's actual Postgres database/role and its actual /etc secrets dir, and
@@ -94,7 +92,7 @@ const IDENTITY_SCAN_EXTRA_FILES = [];
 //     NEW literal in any of them fails exactly like one in an unlisted file.
 //   * fitness-checks-identity.js / package-core.js — THE DETECTORS THEMSELVES: Check 13's regexes
 //     and package-core's PRIOR_INSTANCE_FLOOR name the brand because hunting it is
-//     their job. * seed-v3-tasks.js — the seeded-task-prose rationale above. All
+//     their job. (seed-v3-tasks.js was the third; it is gone.) All
 //     three passed pre-1002756 only by the old stripper's accidents (phantom
 //     blocks + regex-blindness); now they are seen and counted.
 const IDENTITY_SCAN_ALLOWED = {
@@ -113,19 +111,10 @@ const IDENTITY_SCAN_ALLOWED = {
   'scripts/bongos/seed-staging.sh': 4,
   'scripts/bongos/backfill-sessions.js': 2,
   'scripts/bongos/publish-manifest.js': 3,
-  'scripts/bongos/seed-bongos-coreB-tranche1-tasks.js': 1,
-  'scripts/bongos/seed-bongos-coreB-tranche2-tasks.js': 1,
-  'scripts/bongos/seed-bongos-goal-hierarchy-tasks.js': 1,
-  'scripts/bongos/seed-bongos-tasks.js': 1,
-  'scripts/bongos/seed-gds-v4-tasks.js': 1,
-  'scripts/bongos/seed-medusa-tasks.js': 7,
-  'scripts/bongos/seed-module-upstreaming.js': 1,
-  'scripts/bongos/seed-productization-tasks.js': 6,
-  'scripts/bongos/seed-provisioning-tasks.js': 2,
   'scripts/bongos/version-close.js': 1,
   // task 1002853 (the company literal joined the list): audit-authorship.sh is itself a
   // detector — its ops allowlist names the founder's commit address so it can exempt it; grade-smoke.js
-  // is a protected grader probe whose fixture task prose names the company, the seed-*.js rationale.
+  // is a protected grader probe whose fixture task prose names the company.
   'scripts/bongos/audit-authorship.sh': 1,
   'scripts/bongos/grade-smoke.js': 1,
 };

package/scripts/bongos/gen-diagrams.js

@@ -488,7 +488,7 @@ function rebuildAssertions(prev, f) {
     next.architecture = {
       diagram: '04-architecture',
       _comment:
-        "Pieces of 04-architecture gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/bongos/gen-diagrams.js in lockstep with the diagram, so this is the drift checker's backstop. The machine/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. Ship flow: 1025 (server-mediated publish, for a checkout with no push credential), 1028 (GitHub App push credential). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent.",
+        "Pieces of 04-architecture gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'; live_tasks must ALL be shipped, pending_tasks must NOT yet be. Rebuilt by scripts/bongos/gen-diagrams.js in lockstep with the diagram. The machine/server/GitHub topology is structural (not task-gated); these are the LIVE/PLANNED markers. MEMORY layer (ADR 0024): 273 schema / 274 sync-on-ship / 275 pull-on-start / 276 isolation. Ship flow: 1025 (server-mediated publish, for a checkout with no push credential), 1028 (GitHub App push credential). The deploy leg is the standalone AUTO-PULL (ADR 0108/0129), not a task-gated GitHub-Actions CI job, so 859 is intentionally absent.",
       live_tasks: arch.live_tasks,
       pending_tasks: arch.pending_tasks,
     };
@@ -499,7 +499,7 @@ function rebuildAssertions(prev, f) {
       ...next.drachmae_karma,
       diagram: '03-drachmae-karma',
       _comment:
-        "Pieces of 03-drachmae-karma that are gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'. live_tasks must ALL be shipped live; pending_tasks must NOT yet be shipped. Rebuilt automatically by scripts/bongos/gen-diagrams.js from the authenticated /tasks/:id status; the diagram is regenerated in lockstep, so this slice is a redundant backstop the drift checker verifies. D_SHIP (credit_log trigger) and D_ACH (achievement bonuses) have no task gate and are always LIVE. achievements_seeded mirrors 03's 'N seeded' label, counted from the achievements seed INSERTs in migrations/.",
+        "Pieces of 03-drachmae-karma that are gated on a backing Bongos task. A piece is LIVE iff its task is 'shipped'. live_tasks must ALL be shipped live; pending_tasks must NOT yet be shipped. Rebuilt automatically by scripts/bongos/gen-diagrams.js from the authenticated /tasks/:id status; the diagram is regenerated in lockstep. D_SHIP (credit_log trigger) and D_ACH (achievement bonuses) have no task gate and are always LIVE. achievements_seeded mirrors 03's 'N seeded' label, counted from the achievements seed INSERTs in migrations/.",
     };
     next.drachmae_karma.live_tasks = dk.live_tasks;
     next.drachmae_karma.pending_tasks = dk.pending_tasks;
@@ -589,7 +589,7 @@ const CONCEPTUAL_TARGETS = [
       // r.error (ENOENT) and r.status is null. The .mmd sources are already
       // written above and the caller (ship.js regenerateDiagrams) will commit
       // them; PNGs get re-rendered on the Linux droplet at deploy time, and the
-      // diagram-drift routine backstops any staleness. So skip the render
+      // next render-capable ship refreshes them. So skip the render
       // NON-FATALLY rather than hard-failing the whole ship on a missing bash.
       console.warn(
         `gen-diagrams: could not run the render step (${r.error.code || r.error.message}). ` +

package/scripts/bongos/pulse.js

@@ -8,9 +8,11 @@
 //        node scripts/bongos/pulse.js --claim-id <N>
 //
 //   2) Release-stale mode (V3.R49 / #268) — scan for active claims with
-//      no pulse in N hours and auto-release them. Used by the
-//      `stale-claim-release` scheduled task (runs every 15 min on the
-//      droplet) and runnable by hand for ops.
+//      no pulse in N hours and auto-release them. Runnable by hand for ops
+//      ONLY: the scheduled `stale-claim-release` routine was retired unscheduled
+//      in task 1004878, because nothing records pulses yet (no POST /pulse route,
+//      no hook sends one), so a timed sweep would release every claim older
+//      than the threshold.
 //        node scripts/bongos/pulse.js --release-stale [--threshold-hours 6] [--dry-run]
 //
 // -------------------------------------------------------------------------

package/scripts/bongos/routine-schedule.js

@@ -51,6 +51,9 @@ const TASKS_DIR = path.join(ROOT, '.claude', 'scheduled-tasks');
 const WORKFLOWS_DIR = path.join(ROOT, '.github', 'workflows');
 
 const { parseRoutineFrontmatter } = require('./run-routine.js');
+// The routines the always-on server fires itself (task 1004878) — the second
+// scheduler this check reads, beside .github/workflows/.
+const { SERVER_ROUTINES } = require('../../modules/autonomy/server-schedule.js');
 
 // The NAMED cadences a routine may declare. The value is the period a cron
 // expression must resolve to for the two to agree. Add a name here and
@@ -189,17 +192,32 @@ function readWorkflows(dir = WORKFLOWS_DIR) {
 // `workflows === null` means "this checkout has no CI to schedule with", which
 // downgrades unscheduled routines from violations to warnings (see the two-repo
 // note in the header).
-function evaluate({ withCadence, withoutCadence }, workflows) {
+//
+// `server` is the in-process scheduler (modules/autonomy/server-schedule.js): rows
+// of { routine, cadence } the always-on server fires itself. A row there IS a
+// scheduler, at exactly its cadence — and it travels with the core, so it fires in
+// an instance checkout too, where there are no workflows. It is held to the same
+// rules as a cron: the routine must declare the cadence the server realizes, and
+// must still exist.
+function evaluate({ withCadence, withoutCadence }, workflows, server = []) {
   const violations = [];
   const warnings = [];
   const hasCI = workflows !== null;
   const wf = workflows || [];
+  const serverRow = new Map(server.map((s) => [s.routine, s]));
 
   for (const r of withCadence) {
     if (!isCadence(r.cadence)) {
       violations.push(`routine '${r.name}': unknown cadence "${r.cadence}" (want ${[...CADENCES].join('|')}, or <N>min where N divides 60)`);
       continue;
     }
+    const srv = serverRow.get(r.name);
+    if (srv) {
+      if (srv.cadence !== r.cadence) {
+        violations.push(`routine '${r.name}' declares cadence: ${r.cadence} but the server fires it ${srv.cadence} (modules/autonomy/server-schedule.js)`);
+      }
+      continue;
+    }
     const firing = wf.filter((w) => invokesRoutine(w.text, r.name, r.steps));
     if (!firing.length) {
       const msg = `routine '${r.name}' declares cadence: ${r.cadence} but NOTHING fires it — no scheduled workflow invokes it`;
@@ -242,7 +260,24 @@ function evaluate({ withCadence, withoutCadence }, workflows) {
   }
   violations.push(...dangling);
 
+  // The server-side rename rot, and a label that lies the other way: a routine the
+  // server fires on a schedule its own SKILL.md says nothing about. Skipped where
+  // there is no routine tree at all (an instance before materialization) — there
+  // every row would read as dangling, and none of them is.
+  const serverFired = new Set();
+  if (known.size) {
+    for (const s of server) {
+      if (!known.has(s.routine)) {
+        violations.push(`modules/autonomy/server-schedule.js fires routine '${s.routine}', which has no .claude/scheduled-tasks/${s.routine}/SKILL.md`);
+      } else if (withoutCadence.some((r) => r.name === s.routine)) {
+        violations.push(`routine '${s.routine}' is fired ${s.cadence} by the server but its SKILL.md declares no cadence: — add \`cadence: ${s.cadence}\``);
+        serverFired.add(s.routine);
+      }
+    }
+  }
+
   for (const r of withoutCadence) {
+    if (serverFired.has(r.name)) continue;
     warnings.push(`routine '${r.name}' declares no cadence: — it can only ever be run by hand`);
   }
   return { violations, warnings };
@@ -252,7 +287,7 @@ function evaluate({ withCadence, withoutCadence }, workflows) {
 function checkRoutineCadencesScheduled() {
   const routines = readRoutines();
   const workflows = readWorkflows();
-  const { violations, warnings } = evaluate(routines, workflows);
+  const { violations, warnings } = evaluate(routines, workflows, SERVER_ROUTINES);
   const scheduled = routines.withCadence.length - violations.filter((v) => v.startsWith("routine '")).length;
   return {
     name: 'a declared cron cadence has something that fires it (task 1003209)',
@@ -262,7 +297,7 @@ function checkRoutineCadencesScheduled() {
     warnings,
     note: violations.length
       ? 'a scheduled routine is declared but dormant — add/repair the scheduler, or drop the cadence: field and stop claiming it runs'
-      : `${scheduled}/${routines.withCadence.length} cadence-declaring routine(s) fired by a committed scheduler at the declared period; ${routines.withoutCadence.length} manual-only.`,
+      : `${scheduled}/${routines.withCadence.length} cadence-declaring routine(s) fired by a committed scheduler (a workflow or the server) at the declared period; ${routines.withoutCadence.length} manual-only.`,
   };
 }
 

package/scripts/bongos/ship-regen.js

@@ -22,7 +22,7 @@ function currentBranch() {
 // Task #357: keep the 3 mechanical onboarding diagrams current on every deploy.
 // Regenerate them from live facts; if any changed, commit the refresh on this
 // branch so it ships with the deploy. Non-fatal — a render/network hiccup must
-// never block a ship; the diagram-drift routine will flag any miss.
+// never block a ship; the next render-capable ship refreshes any miss.
 //
 // Returns a status string ('skipped-server' | 'regen-failed' | 'current' |
 // 'committed' | 'committed-nofatal') so the regression test (task 1046) can
@@ -35,8 +35,7 @@ function regenerateDiagrams() {
   // leaving those files UNCOMMITTED in the builder's tree (had to be reverted by
   // hand). That path must not attempt the regen at all: skip here and let a
   // render-capable ship (the laptop path, which CAN render the PNGs) refresh them
-  // as a matched .mmd+.png+assertions set; the diagram-drift routine backstops any
-  // staleness in the meantime. Skipping entirely (vs --no-render) avoids committing
+  // as a matched .mmd+.png+assertions set. Skipping entirely (vs --no-render) avoids committing
   // a .mmd/.png mismatch to main. Mirrors gen-diagrams.js's own non-fatal skip when
   // bash itself is absent (ENOENT).
   if (pushVia() === 'server') {