@bongos/core 1.21.176 → 1.21.178

package/scripts/bongos/gate-review.js

@@ -1,330 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-// scripts/bongos/gate-review.js — the automatic gate-surface gatekeeper (ADR 0058).
-//
-// WHY. In deploy mode 'ci' (config/deploy.json) PRs auto-merge on green checks and
-// main auto-deploys to prod. CODEOWNERS (owner review on gate surfaces) was the ONLY
-// human in that loop — and the bottleneck. The owner chose a RANK-BASED trust model
-// (2026-06-15): trust senior builders to auto-merge routine sensitive work, but keep a
-// HARD, rank-independent floor for the gate's own machinery + deploy switch.
-//
-// WHAT. This is a PURE, deterministic classifier over the PR diff-as-DATA. It runs in
-// CI (.github/workflows/gate-review.yml) from the TRUSTED BASE copy (the workflow
-// overlays scripts/+src/ from origin/main before running, so a PR cannot edit the
-// analyzer to pass itself). It emits one of three verdicts:
-//
-//   PASS         — no gate surface touched, OR only AUTO pure-removal surfaces
-//                  (un-mute a test, narrow the secret-scanner allowlist). Auto-merge.
-//   NEEDS_TRUST  — a sensitive-but-routine gate surface (migrations, deps, routes,
-//                  server, ship plumbing, boxes, auth-adjacent, doctrine docs). The
-//                  workflow auto-merges this IFF the author is Metic+ (rank trust) or
-//                  the owner approved; otherwise it escalates.
-//   ESCALATE     — the HARD FLOOR: the gate's own machinery, the deploy switch, branch
-//                  protection, CI workflows, the rank/permission enforcement, the
-//                  grader, the deploy-time audit, or the hooks the gate ships through.
-//                  Rank-trust does NOT apply — this ALWAYS pings the owner. Also any
-//                  pre-flight rejection (symlink / non-ASCII path / oversize / analyzer
-//                  error) → ESCALATE, fail-closed.
-//
-// The gate-surface SET is the authoritative src/bongos/permission-path-check.PROTECTED_GLOBS
-// (imported, NEVER hand-retyped — the red-team's #1 finding). The classifier only
-// decides, per touched surface, whether it is HARD-FLOOR, NEEDS_TRUST, or AUTO. Anything
-// matched-protected-but-unclassified defaults to ESCALATE (no allow-by-omission).
-//
-// The pure core (classifyChanges) takes diff data as arguments and is exhaustively
-// unit-tested (tests/gate_review.mjs) with the red-team evasion matrix. The CLI wrapper
-// (main) gathers the real diff via git and applies GATE_REPORT_ONLY / exit codes.
-
-const { execFileSync } = require('node:child_process');
-const fs = require('node:fs');
-// Destructured AT the require, not off a held module object: knip's static pass
-// cannot follow `const x = require(...); const { y } = x;` and reports `y` as an
-// unused export, which reds the CI knip step (this file's own CLAUDE.md records
-// the same trap for src/instance-config.js).
-const { PROTECTED_GLOBS, compileGlobMatcher } = require('../../src/bongos/permission-path-check');
-
-// --- HARD FLOOR (rank-independent ESCALATE) -------------------------------------------
-// A subset of PROTECTED_GLOBS: the surfaces that, if a compromised/injected senior
-// session auto-merged them, would DISABLE the safety system itself or the deploy gate.
-// Kept as globs so the matcher is identical to permission-path-check (trailing '/' =
-// subtree). The owner can promote a NEEDS_TRUST surface here with a one-line edit (which
-// is itself a hard-floor change to this file → escalates — correct).
-const HARD_FLOOR_GLOBS = [
-  'scripts/bongos/gate-review.js', // self
-  'src/bongos/permission-path-check.js', // defines the protected set this gate reads
-  'src/bongos/route-rank-check.js', // the route-gate auditor
-  'src/bongos/auth.js', // requireRank / requireBuilder — the enforcement point
-  'modules/grading/grader.js',       // BV1.R73: grading carved to modules/grading/
-  'modules/grading/grader-workers/',
-  'modules/grading/grader-rubric.json',
-  'scripts/bongos/ci-grade.js', // CI grade-gate driver (task 1143 — red-team #3)
-  'scripts/bongos/grade-smoke.js', // grade-smoke driver
-  'scripts/bongos/conductor-dispatch.js', // mid-flight grader dispatch
-  'scripts/bongos/main-audit.js', // the authoritative deploy-time audit (the backstop)
-  'scripts/bongos/push-main.js', // the sanctioned main-push carrying the override
-  'scripts/bongos/run-unit-tests.js', // the test selector (AUTO pure-removal handled first)
-  'scripts/bongos/install-git-hooks.js',
-  'scripts/bongos/hooks/',
-  'scripts/migrate.sh',
-  'scripts/deploy/',
-  'config/deploy.json', // the laptop/ci/bypass deploy switch
-  'infra/', // branch-protection.json + deploy substrate
-  '.github/', // CI gates: gate-review.yml, deploy-prod.yml, secret scan, grade gate
-  'CODEOWNERS',
-  '.husky/', // pre-push/pre-commit gate delivery (secrets-allowlist.txt is AUTO, checked first)
-  '.claude/hooks/',
-  '.claude/settings.json',
-];
-
-// db.js is HARD-FLOOR only for the rank-tier brain (REQUIRES_RANK_TIER); every other
-// db.js change is NEEDS_TRUST (it is a huge, routinely-edited module — file-level
-// hard-flooring it would ping the owner for ordinary query work). This is the one
-// content-level rule; everything else is path-level.
-const DB_JS = 'src/bongos/db.js';
-const RANK_TIER_RE = /REQUIRES_RANK_TIER\s*=\s*\{[\s\S]*?\}/;
-
-// AUTO pure-removal surfaces — a NARROWING-only edit can only STRENGTHEN the gate, so
-// it may auto-pass for ANY author. Any non-narrowing edit falls through to its glob
-// classification (run-unit-tests.js → HARD FLOOR; secrets-allowlist.txt → .husky/ HARD FLOOR).
-const AUTO_NARROWING = {
-  'scripts/bongos/run-unit-tests.js': certifyRunUnitTestsNarrowing,
-  '.husky/secrets-allowlist.txt': certifyAllowlistNarrowing,
-};
-
-// task 1002874: compile through the authoritative module's FOLDING matcher, not
-// globToRegExp directly. Both of these used to build their own byte-exact regexes
-// from the raw globs and test raw candidates, so after protected-path matching
-// gained NFC + case-folding, an uppercased spelling of a gate surface still walked
-// past THIS classifier — the CI auto-merge gate — which is the bypass the fix
-// exists to close. isCanonicalPath below rejects non-NFC and non-ASCII, but it
-// does not case-fold, so it never covered this.
-const matchesHardFloor = compileGlobMatcher(HARD_FLOOR_GLOBS);
-
-// A path is "protected" per the authoritative module.
-const matchesProtected = compileGlobMatcher(PROTECTED_GLOBS);
-
-// Only [\x20-\x7e] path chars, NFC-stable, no leading/trailing whitespace. Defeats the
-// unicode-homoglyph + whitespace-alias evasions (red-team Holes 6/8).
-function isCanonicalPath(p) {
-  return typeof p === 'string' && p.length > 0 && /^[\x20-\x7e]+$/.test(p)
-    && p === p.normalize('NFC') && p === p.trim();
-}
-
-// AUTO certifier: run-unit-tests.js may auto-pass ONLY if its sole semantic change is
-// REMOVING entries from INTEGRATION/KNOWN_FAILING (un-muting tests) — never adding, and
-// the rest of the file byte-identical modulo those two set literals.
-function certifyRunUnitTestsNarrowing(base, head) {
-  if (base == null || head == null) return { pass: false, reason: 'added/removed wholesale — not a narrowing edit' };
-  const setOf = (t, name) => {
-    const m = new RegExp(`const ${name} = new Set\\(\\[([\\s\\S]*?)\\]\\)`).exec(t);
-    if (!m) return null;
-    return new Set([...m[1].matchAll(/['"]([^'"]+)['"]/g)].map((x) => x[1]));
-  };
-  const strip = (t) => t.replace(/const (INTEGRATION|KNOWN_FAILING) = new Set\(\[[\s\S]*?\]\)/g, 'SET');
-  if (strip(base) !== strip(head)) return { pass: false, reason: 'non-set code changed in run-unit-tests.js' };
-  for (const name of ['INTEGRATION', 'KNOWN_FAILING']) {
-    const b = setOf(base, name), h = setOf(head, name);
-    if (!b || !h) return { pass: false, reason: `cannot parse ${name} set — fail-closed` };
-    for (const x of h) if (!b.has(x)) return { pass: false, reason: `${name} ADDED '${x}' (muting a test)` };
-  }
-  return { pass: true };
-}
-
-// AUTO certifier: secrets-allowlist.txt may auto-pass ONLY if its head line set is a
-// subset of the base (removing/narrowing allowlist entries) — never adding a new exclude.
-function certifyAllowlistNarrowing(base, head) {
-  if (base == null || head == null) return { pass: false, reason: 'added/removed wholesale — not a narrowing edit' };
-  const norm = (t) => new Set(t.split('\n').map((l) => l.trim()).filter((l) => l && !l.startsWith('#')));
-  const b = norm(base), h = norm(head);
-  for (const line of h) if (!b.has(line)) return { pass: false, reason: `allowlist ADDED/BROADENED: ${line}` };
-  return { pass: true };
-}
-
-// ----------------------------------------------------------------------------------------
-// PURE CORE. Inputs are diff DATA (no git, no fs) so the whole policy is unit-tested:
-//   files:  [{ path, mode, deleted }]  — changed paths + git new-mode + delete flag
-//   blobAt: (which:'base'|'head', path) => string|null   — file content at base/head
-//   diffBytes: number                                    — total textual diff size
-// Returns { verdict:'pass'|'needs_trust'|'escalate', escalations:[{path,reason}],
-//           needsTrust:[{path,reason}], autoPassed:[path], surfaces:[path] }.
-// ----------------------------------------------------------------------------------------
-const MAX_DIFF_BYTES = Number(process.env.GATE_MAX_DIFF_BYTES || 2 * 1024 * 1024);
-
-function classifyChanges({ files, blobAt, diffBytes = 0 } = {}) {
-  const escalations = [];
-  const needsTrust = [];
-  const autoPassed = [];
-  const surfaces = [];
-
-  // --- Pre-flight, fail-closed (whole changed set) ---
-  for (const f of files || []) {
-    if (f.mode === '120000') escalations.push({ path: f.path, reason: 'symlink in diff — refused (alias evasion)' });
-    if (!isCanonicalPath(f.path)) escalations.push({ path: String(f.path), reason: 'non-ASCII/whitespace path — refused' });
-  }
-  if (diffBytes > MAX_DIFF_BYTES) {
-    escalations.push({ path: '<diff>', reason: `diff ${diffBytes}B exceeds ${MAX_DIFF_BYTES}B — too large to certify` });
-  }
-
-  for (const f of files || []) {
-    const p = f.path;
-    if (!isCanonicalPath(p)) continue; // already escalated above
-    // A gate surface = the authoritative PROTECTED_GLOBS, OR a hard-floor glob (some
-    // floor paths — gate-review.js itself, config/deploy.json, CODEOWNERS — are also
-    // added to PROTECTED_GLOBS, but OR-ing keeps the gatekeeper correct even if a
-    // future hard-floor entry isn't yet in the shared list), OR a tests/*.mjs file.
-    const isProtected = matchesProtected(p) || matchesHardFloor(p);
-    const isTest = /^tests\/.+\.mjs$/.test(p);
-    if (!isProtected && !isTest) continue; // not a gate surface
-
-    surfaces.push(p);
-
-    // tests/*.mjs: deleting or shrinking a test silently weakens the suite → NEEDS_TRUST
-    // (rank-trustable per the owner's model); adding/expanding is fine → PASS.
-    if (isTest && !isProtected) {
-      if (f.deleted) { needsTrust.push({ path: p, reason: 'test file DELETED — suite shrink' }); continue; }
-      const base = blobAt('base', p), head = blobAt('head', p);
-      if (base != null && head != null && head.length < base.length) {
-        needsTrust.push({ path: p, reason: 'test file SHRANK — possible muting' });
-      }
-      continue;
-    }
-
-    // AUTO pure-removal surfaces: certify a narrowing-only edit (any author).
-    if (Object.prototype.hasOwnProperty.call(AUTO_NARROWING, p)) {
-      const cert = AUTO_NARROWING[p](blobAt('base', p), blobAt('head', p));
-      if (cert.pass) { autoPassed.push(p); continue; }
-      // not a narrowing edit → fall through to HARD FLOOR (both AUTO files are floor globs)
-      escalations.push({ path: p, reason: `AUTO surface failed narrowing cert (${cert.reason}) — root-of-trust` });
-      continue;
-    }
-
-    // db.js: HARD FLOOR only when the rank-tier brain changed; else NEEDS_TRUST.
-    if (p === DB_JS) {
-      const base = blobAt('base', p), head = blobAt('head', p);
-      const region = (t) => { const m = t == null ? null : RANK_TIER_RE.exec(t); return m ? m[0] : (t == null ? '<absent>' : '<no-region>'); };
-      if (base == null || head == null) { needsTrust.push({ path: p, reason: 'db.js added/removed' }); continue; }
-      if (region(base) !== region(head)) {
-        escalations.push({ path: p, reason: 'db.js REQUIRES_RANK_TIER (rank brain) changed — root-of-trust' });
-      } else {
-        needsTrust.push({ path: p, reason: 'db.js change outside the rank-tier region' });
-      }
-      continue;
-    }
-
-    // HARD FLOOR globs → ESCALATE regardless of rank.
-    if (matchesHardFloor(p)) { escalations.push({ path: p, reason: 'gate machinery / deploy switch (hard floor) — owner review required' }); continue; }
-
-    // Any other protected surface → NEEDS_TRUST (rank-trustable).
-    needsTrust.push({ path: p, reason: 'sensitive gate surface — auto-merges for Metic+ (rank trust)' });
-  }
-
-  const verdict = escalations.length ? 'escalate' : (needsTrust.length ? 'needs_trust' : 'pass');
-  return { verdict, escalations, needsTrust, autoPassed, surfaces };
-}
-
-// Resolve the merge action from the verdict + the two trust signals (both injected by
-// the workflow, never read by the pure classifier). RANK trust (server-attested Metic+)
-// clears NEEDS_TRUST only; the HARD FLOOR (escalate) is cleared ONLY by an explicit
-// owner review — rank never bypasses it. An owner approval clears anything.
-//   pass        → 'pass'
-//   needs_trust → 'pass' iff (rank-trusted OR owner-approved)
-//   escalate    → 'pass' iff owner-approved
-function resolveAction({ verdict, trusted, ownerApproved }) {
-  if (verdict === 'pass') return 'pass';
-  if (verdict === 'escalate') return ownerApproved ? 'pass' : 'block';
-  return trusted || ownerApproved ? 'pass' : 'block';
-}
-
-// ----------------------------------------------------------------------------------------
-// CLI wrapper — gather the real diff and apply report-only / exit codes. Never returns 0
-// on an analyzer error (fail-closed). The rank/owner-approval resolution for NEEDS_TRUST
-// is provided by the workflow via GATE_AUTHOR_TRUSTED (set from the server-resolved rank /
-// owner approval); the pure core never reads rank.
-// ----------------------------------------------------------------------------------------
-function git(args) { return execFileSync('git', args, { encoding: 'utf8', maxBuffer: 128 * 1024 * 1024 }); }
-
-function gatherDiff(baseRef) {
-  const mb = git(['merge-base', baseRef, 'HEAD']).trim();
-  const raw = git(['diff', '--raw', `${mb}...HEAD`]).split('\n').filter(Boolean);
-  const files = [];
-  for (const line of raw) {
-    // ":100644 100644 sha sha M\tpath"  (status D = delete; mode 120000 = symlink)
-    const m = /^:(\d{6}) (\d{6}) \S+ \S+ (\S+)\t(.+)$/.exec(line);
-    if (!m) { files.push({ path: '<unparseable>', mode: '000000', deleted: false, parseError: true }); continue; }
-    const [, , newMode, status, rawPath] = m;
-    files.push({ path: rawPath, mode: newMode, deleted: status.startsWith('D') });
-  }
-  const diffBytes = Buffer.byteLength(git(['diff', `${mb}...HEAD`]), 'utf8');
-  const blobAt = (which, p) => {
-    const ref = which === 'base' ? mb : 'HEAD';
-    try { return git(['show', `${ref}:${p}`]); } catch { return null; }
-  };
-  return { files, blobAt, diffBytes };
-}
-
-async function main() {
-  const baseRef = process.env.GATE_BASE_REF || 'origin/main';
-  const reportOnly = process.env.GATE_REPORT_ONLY === '1';
-  const trusted = process.env.GATE_AUTHOR_TRUSTED === '1'; // set by the workflow from server-resolved rank / owner approval
-
-  let result;
-  try {
-    if ((process.env.GATE_FILES_JSON || '').trim()) {
-      // test/dry-run injection: {files, blobs:{ 'base:path':..., 'head:path':... }, diffBytes}
-      const inj = JSON.parse(process.env.GATE_FILES_JSON);
-      const blobAt = (which, p) => (inj.blobs && Object.prototype.hasOwnProperty.call(inj.blobs, `${which}:${p}`)) ? inj.blobs[`${which}:${p}`] : null;
-      result = classifyChanges({ files: inj.files, blobAt, diffBytes: inj.diffBytes || 0 });
-    } else {
-      const { files, blobAt, diffBytes } = gatherDiff(baseRef);
-      if (files.some((f) => f.parseError)) throw new Error('unparseable --raw diff line (fail-closed)');
-      result = classifyChanges({ files, blobAt, diffBytes });
-    }
-  } catch (e) {
-    console.error(`gate-review: analyzer error (fail-closed): ${e && e.stack ? e.stack : e}`);
-    process.exit(reportOnly ? 0 : 1);
-    return;
-  }
-
-  // Resolve the final action.
-  const ownerApproved = process.env.GATE_OWNER_APPROVED === '1';
-  const action = resolveAction({ verdict: result.verdict, trusted, ownerApproved });
-
-  const lines = [`## gate-review: ${result.verdict.toUpperCase()}${reportOnly ? ' (report-only)' : ''} → would ${action === 'pass' ? 'PASS' : 'BLOCK + ping owner'}`, ''];
-  if (result.surfaces.length) lines.push(`Gate surfaces touched: ${result.surfaces.length}`);
-  for (const e of result.escalations) lines.push(`- ESCALATE \`${e.path}\` — ${e.reason}`);
-  for (const n of result.needsTrust) lines.push(`- NEEDS-TRUST \`${n.path}\` — ${n.reason} → ${action === 'pass' ? 'PASS' : 'BLOCK (needs Metic+ attestation or owner approval)'}`);
-  for (const a of result.autoPassed) lines.push(`- AUTO-PASS \`${a}\` — pure narrowing (strengthens the gate)`);
-  if (!result.surfaces.length) lines.push('No gate surface touched — auto-merge.');
-
-  const out = lines.join('\n');
-  console.log(out);
-  if (process.env.GITHUB_STEP_SUMMARY) { try { fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, out + '\n'); } catch (_) { /* best-effort */ } }
-
-  if (action === 'block' && !reportOnly) {
-    await pingOwner(result).catch(() => {});
-    process.exit(1);
-  }
-  process.exit(0);
-}
-
-async function pingOwner(result) {
-  const url = process.env.DISCORD_GATE_APPROVALS_WEBHOOK;
-  const pr = process.env.GATE_PR_NUMBER;
-  if (!url || !pr) return;
-  const surfaces = [...new Set([...result.escalations, ...result.needsTrust].map((x) => x.path))].slice(0, 10).join(', ');
-  const body = { content: `gate-pr #${pr} — gate-surface change needs your review: ${surfaces}\nReview + approve the PR to land it.`, allowed_mentions: { parse: [] } };
-  await fetch(url, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) });
-}
-
-module.exports = {
-  classifyChanges,
-  resolveAction,
-  certifyRunUnitTestsNarrowing,
-  certifyAllowlistNarrowing,
-  isCanonicalPath,
-  matchesHardFloor,
-  HARD_FLOOR_GLOBS,
-};
-
-if (require.main === module) main();

package/scripts/bongos/goal-names.js

@@ -1,102 +0,0 @@
-#!/usr/bin/env node
-// scripts/bongos/goal-names.js — give every open goal a NAME, and move its
-// explanation into `subtitle` (task 1003225, goal 1000072, criterion
-// legibility-goal-names-and-claude-text).
-//
-// Owner directive: a goal's subtitle should not sit on its title. 28 open goals
-// carried theirs after a dash and 3 more after a colon — the punctuation is not
-// the point, the jamming is. Task 1003224 gave `goals` a `subtitle` column and
-// taught the hall to render name / subtitle / Claude's prose at three weights;
-// this moves the existing text into that shape.
-//
-// WHY A MAPPING FILE AND NOT 31 AD-HOC PATCHES. A rename is a judgment call, and
-// judgment that lives only in a shell history cannot be reviewed, re-run, or
-// argued with. The table below IS the decision: it can be read in a diff, its
-// invariants are unit-tested (no duplicate names, no name still carrying its own
-// explanation, nothing dropped), and re-running is a no-op.
-//
-// IT IS NOT A MECHANICAL SPLIT, which is the whole reason this is its own task.
-// Splitting on the separator works where the head already names the thing
-// ("Findability — the grep path"). It FAILS where the head is not distinctive:
-// goals 1000038/1000039/1000040 all head "Agents module" and differ ONLY in the
-// tail, so a split would leave three identically-named goals — strictly worse
-// than today. Those three, the version catch-all, and three wordy heads get
-// written names; the rest keep theirs verbatim.
-//
-// SAFETY. Dry-run by DEFAULT (`--apply` to write). Every write goes through
-// PATCH /goals/:id, which is authorized (owner|manager|Archon) and records
-// prose-edit deltas — so the rename is audit-trailed, unlike the prod SQL UPDATE
-// that would otherwise be the only channel. It REFUSES to run at all if the
-// server does not yet return `subtitle`, because renaming titles against a
-// server that cannot store the subtitle would DELETE the explanations.
-
-'use strict';
-
-// id → { title, subtitle, why? }. `why` is recorded only where the name is
-// NEW rather than the existing head — i.e. where judgment was applied.
-const GOAL_NAMES = Object.freeze({
-  // ── names written, because the head was not usable ───────────────────────
-  1000003: { title: 'Work with no goal yet',
-    subtitle: 'The version catch-all. Tasks land here when nothing else fits — and nothing here can satisfy a criterion (ADR 0183), so it is a holding pen, not a home.',
-    why: 'was "BONGOS-V1 — general": a version id and the word general name nothing. Named for what it actually is.' },
-  1000038: { title: 'Agent framework & registry',
-    subtitle: 'The foundation — the plugin surface an agent is written against, and the registry that holds the roster.',
-    why: 'one of THREE goals heading "Agents module"; a mechanical split would have left three identically-named goals. Written without a colon on purpose: "Agents: framework" is the same name-plus-qualifier shape this task exists to remove, and the test flagged it.' },
-  1000039: { title: 'Agent authoring & first roster',
-    subtitle: 'Owner and builder authoring, plus the first real roster — event-driven and on-demand agents.',
-    why: 'second of the three "Agents module" goals. Named for what it adds — authoring and the first roster — rather than by a tail no list ever showed.' },
-  1000040: { title: 'Agent scheduling & spend limits',
-    subtitle: 'Scheduled agents, and the guardrails on what they are allowed to spend.',
-    why: 'third of the three "Agents module" goals. Scheduling and spend are what separate it from the framework and authoring goals.' },
-  1000053: { title: 'Sessions start knowing',
-    subtitle: 'Front-load auth, environment and instance facts so a session does not spend its first minutes rediscovering them.',
-    why: 'was "Session efficiency: sessions start knowing" — the head restated the tail. Kept the half that is a name.' },
-  1000064: { title: 'The hall as the room',
-    subtitle: 'Agora, Monitor & Contribute, and chat that does not care which channel it came from.',
-    why: 'colon-separated rather than dashed; same jamming, so treated identically.' },
-  1000075: { title: 'Collaboration & the social hall',
-    subtitle: 'Ask for help by craft, and let the hall become a mode rather than a page.',
-    why: 'was "Collab, then the social hall" — an ordering, not a name.' },
-  1000077: { title: 'Guards, not notes',
-    subtitle: 'The four failure modes that prose already documented and nothing refused.',
-    why: 'colon-separated; the head is already a good name, the tail is the explanation.' },
-  1000078: { title: 'Project money out',
-    subtitle: 'A funded balance, real builder payouts, visible outflows, and work that cannot outrun the money.',
-    why: 'colon-separated rather than dashed. The head is already the name; the tail is a four-part explanation that belongs underneath it.' },
-
-  // ── heads kept verbatim; only the tail moves ─────────────────────────────
-  1000025: { title: 'Builder experience', subtitle: 'Hall, dev box, and skills.' },
-  1000027: { title: 'Findability', subtitle: 'The grep path (ADR 0095).' },
-  1000029: { title: 'Module upstreaming & catalog', subtitle: 'Instances contribute modules back into core.' },
-  1000032: { title: 'Instance hosting + domains', subtitle: 'The `provisioning` module.' },
-  1000044: { title: 'Living project sky', subtitle: 'A shared, persistent, data-driven orb gate.' },
-  1000045: { title: 'Public builder profiles', subtitle: 'Track record, apply-to-project, and owner recruiting.' },
-  1000046: { title: 'Project creation', subtitle: 'Visibility and customization.' },
-  1000048: { title: 'SEO & public discoverability', subtitle: 'Rankable per-project profiles.' },
-  1000049: { title: 'Orb Physics', subtitle: 'Orb motion and space-whale flight.' },
-  1000052: { title: 'First-run onboarding', subtitle: 'From a bare machine to a first ship.' },
-  1000054: { title: 'Public distribution', subtitle: 'CLI installer and Claude plugin.' },
-  1000057: { title: 'Rank blocker matrix', subtitle: 'Empirically verify intended vs unintended blockers across xenos, thetes and metic.' },
-  1000058: { title: 'Non-cloudbongos project lifecycle', subtitle: 'Creation, governance, planning, building — the whole flow works and feels right.' },
-  1000063: { title: 'The front door', subtitle: 'Enter the Future: hero-only landing, wormhole transit, About on the map.' },
-  1000065: { title: 'Community surface', subtitle: 'Builder discovery on the hub.' },
-  1000067: { title: 'Ideator compensation', subtitle: 'The idea credit stream, separate from cost-plus.' },
-  1000068: { title: 'Government, not governance', subtitle: 'Ranks are ranks, and "role" belongs to the crafts.' },
-  1000070: { title: 'Scan-before-install', subtitle: 'First-real-run hardening.' },
-  1000071: { title: 'Idea routing', subtitle: 'Work that has a home lands in it.' },
-  1000072: { title: 'Human legibility', subtitle: 'Seeing, sorting and steering an AI-run project.' },
-  1000073: { title: 'Finish the GDS→Bongos rename', subtitle: 'Retire a legacy Primea term without rewriting history.' },
-  1000074: { title: "The artist's loop", subtitle: 'Review authority, copy an artist can change, and a place to do it.' },
-  // 1000080 already carried a subtitle, so the tail is PREPENDED to it rather than
-  // replacing it — overwriting would delete text, the exact loss this task guards.
-  1000080: { title: 'Apex UI pass 2', subtitle: 'One top bar, two dropdowns, and a project card worth opening — the chrome and the card on cloudbongos.com and /projects.' },
-});
-
-// A name must not carry its own explanation — that is the whole point.
-const SEPARATOR = / [—-] |: /;
-
-// Goals deliberately untouched: their titles are already names. Listed so the
-// coverage test can tell "already fine" from "forgotten".
-const ALREADY_NAMES = Object.freeze([1000009, 1000024, 1000028, 1000037, 1000047, 1000050]);
-
-module.exports = { GOAL_NAMES, ALREADY_NAMES, SEPARATOR };

package/scripts/bongos/rename-goals.js

@@ -1,109 +0,0 @@
-#!/usr/bin/env node
-// scripts/bongos/rename-goals.js — apply the goal-names.js mapping (task 1003225).
-//
-// Usage:
-//   node scripts/bongos/rename-goals.js            # DRY RUN — prints the diff, writes nothing
-//   node scripts/bongos/rename-goals.js --apply    # writes, via PATCH /goals/:id
-//
-// Writes go through PATCH /goals/:id, never SQL: that route is authorized
-// (owner|manager|Archon) and records prose-edit deltas, so a rename of somebody's
-// goal is audit-trailed. A prod UPDATE would be invisible.
-//
-// THE GUARD THAT MATTERS: it refuses to run when the server does not return
-// `subtitle`. Renaming a title against a server that cannot store the subtitle
-// would DELETE the explanation — the exact data loss this task exists to avoid.
-// core_224 ships the column; a live instance one release behind does not have it.
-
-'use strict';
-
-const { cliClient, requireSession, hasFlag } = require('./cli-lib');
-const { GOAL_NAMES, SEPARATOR } = require('./goal-names.js');
-
-// Nothing to do when the goal already reads the way the mapping wants.
-function planFor(goal, want) {
-  const patch = {};
-  if ((goal.title || '') !== want.title) patch.title = want.title;
-  if ((goal.subtitle || '') !== want.subtitle) patch.subtitle = want.subtitle;
-  return patch;
-}
-
-async function main() {
-  await requireSession();
-  const apply = hasFlag('--apply');
-  const api = await cliClient();
-
-  const res = await api.goals.getGoals({ query: { version: 'BONGOS-V1' } });
-  if (!res.ok) {
-    console.error(`could not list goals: ${res.status}`);
-    process.exit(1);
-  }
-  const goals = (res.data.goals || []).filter((g) => g.status === 'open');
-  if (!goals.length) {
-    console.error('no open goals returned — refusing to act on an empty read.');
-    process.exit(1);
-  }
-
-  // The refusal above all others.
-  if (!Object.prototype.hasOwnProperty.call(goals[0], 'subtitle')) {
-    console.error('REFUSING: this server does not return `subtitle`, so it cannot store one.');
-    console.error('Renaming titles now would drop every explanation on the floor.');
-    console.error('core_224 adds the column — wait for the release carrying it to DEPLOY, then re-run.');
-    process.exit(2);
-  }
-
-  let changed = 0; let already = 0; let missing = 0; let failed = 0;
-  for (const g of goals.sort((a, b) => Number(a.id) - Number(b.id))) {
-    const want = GOAL_NAMES[Number(g.id)];
-    if (!want) {
-      // Not an error: goals whose titles were already names are deliberately absent.
-      if (SEPARATOR.test(g.title || '')) {
-        console.error(`!  ${g.id} has a jammed title but no mapping entry: ${g.title}`);
-        missing += 1;
-      }
-      continue;
-    }
-    const patch = planFor(g, want);
-    if (!Object.keys(patch).length) { already += 1; continue; }
-    console.log(`${apply ? '→' : '·'}  ${g.id}`);
-    if (patch.title) console.log(`     title    ${JSON.stringify(g.title)}  ->  ${JSON.stringify(patch.title)}`);
-    if (patch.subtitle !== undefined) console.log(`     subtitle ${JSON.stringify(g.subtitle || '')}  ->  ${JSON.stringify(patch.subtitle)}`);
-    if (!apply) { changed += 1; continue; }
-    const r = await api.goals.patchGoalsId({ id: g.id, body: patch });
-    if (!r.ok) {
-      console.error(`     FAILED ${r.status} ${JSON.stringify(r.data)}`);
-      failed += 1;
-    } else {
-      changed += 1;
-    }
-  }
-
-  console.log('');
-  console.log(`${apply ? 'applied' : 'would change'}: ${changed} · already correct: ${already}`
-    + `${missing ? ` · UNMAPPED jammed titles: ${missing}` : ''}${failed ? ` · FAILED: ${failed}` : ''}`);
-  if (!apply) console.log('dry run — re-run with --apply to write.');
-
-  // THE POST-CONDITION, CHECKED AGAINST REAL DATA — not against the mapping.
-  // The task's deliverable is a STATE of the live goal set ("no open goal's title
-  // contains a dash-appended subtitle"), and unit tests over the mapping's internal
-  // consistency cannot witness that: they would pass just as happily if --apply had
-  // never been run. This re-reads what the server actually holds now and reports it,
-  // so the claim is falsifiable by anyone re-running the command.
-  //
-  // SCOPED TO THIS VERSION, deliberately. The read above is `version: BONGOS-V1`;
-  // CB-V1 carries jammed titles of its own (id 4, 1000043, 1000066, 1000079) which
-  // are ANOTHER version's work, and sweeping them in here would rename goals this
-  // task never reviewed.
-  const stillJammed = goals.filter((g) => SEPARATOR.test(g.title || ''));
-  console.log('');
-  console.log(`post-condition (BONGOS-V1 open goals): ${goals.length} checked · `
-    + `${stillJammed.length} still carrying an explanation in the title`);
-  for (const g of stillJammed) console.log(`  ! ${g.id} ${JSON.stringify(g.title)}`);
-
-  process.exit(failed || missing ? 1 : 0);
-}
-
-if (require.main === module) {
-  main().catch((err) => { console.error('fatal:', err); process.exit(1); });
-}
-
-module.exports = { planFor };

package/scripts/bongos/seed-adopt-tasks.js

@@ -1,75 +0,0 @@
-#!/usr/bin/env node
-// seed-adopt-tasks.js
-// Seeds the brownfield adopt-mode task breakdown for BONGOS-V1 goal 35
-// ("Project creation flow"), criterion `adopt-existing-repo`, per ADR 0121
-// (task 1986). Scope-only deliverable: these are the BUILD tasks for
-// `bongos init --adopt`; they are seeded as `backlog` (NOT promoted) so the
-// owner schedules the adopt build deliberately. See ADR 0121 §Consequences.
-//
-// Idempotent: task create on source_ref (`BONGOS-V1-adopt-A0N`), criterion
-// links on (task_id, criterion_id), dependency edges on (task_id,
-// depends_on_task_id). Safe to re-run. Run: node scripts/bongos/seed-adopt-tasks.js
-const { apiCall } = require('./cli-lib.js');
-
-const GOAL_ID = 35;
-const CRIT = 'adopt-existing-repo';
-const RUNBOOK_TASK = 1981; // goal-35 canonical runbook; A05 depends on it (external edge)
-
-// ref → task spec. `deps` are local A0N refs; `extDeps` are literal task ids.
-const TASKS = [
-  { ref: 'A01', kind: 'feature', priority: 4, est: 180, crit: [CRIT], deps: [], extDeps: [],
-    title: 'bongos init --adopt: mode skeleton + additive config layering (no clobber)',
-    description: 'Add an `--adopt` mode to `scripts/bongos/init.js` (ADR 0121 §Decision 1-2). Instead of the greenfield "stand up a NEW instance" path (which refuses where config/branding.json exists and whose --force OVERWRITES), --adopt LAYERS onto the existing tree: add the pinned @bongos/core dependency + the lean config/ overrides + .claude/ ADDITIVELY. For any pre-existing file (package.json, an existing .claude/, a CI workflow) it MERGES or LEAVES-AND-REPORTS — it never overwrites, and it must NOT reuse the --force code path. Writes only the lean branding.json overrides (rest resolves from *.neutral.json). Serves criterion adopt-existing-repo. deps: none (the ADR-0108 configurable-root substrate is shipped).' },
-  { ref: 'A02', kind: 'feature', priority: 4, est: 150, crit: [CRIT], deps: [], extDeps: [],
-    title: 'bongos init --adopt: detect the existing stack + layout',
-    description: 'Before writing anything, --adopt inspects the existing tree — language/runtime, package manager, test + CI setup, directory layout — so the enabled modules, the generated repo-map, and the core<->host fitness boundary (ADR 0062 §1) fit what is already there instead of assuming the reference layout (ADR 0121 §Decision 4). Output: a detected-stack summary consumed by A03 (real-state capture) and A04 (pre-flight). Serves criterion adopt-existing-repo. deps: none.' },
-  { ref: 'A03', kind: 'feature', priority: 3, est: 180, crit: [CRIT], deps: ['A01'], extDeps: [],
-    title: 'bongos init --adopt: reflect REAL state — capture version/goal + import backlog',
-    description: 'Replace the synthetic "V1 — Prove the loop" seed with the repo\'s ACTUAL current version/milestone + open goal (by interview + detection), and IMPORT the existing backlog into GDS tasks — GitHub issues (via the auth the flow already establishes), a TODO/ROADMAP/BACKLOG.md, or an interview fallback — so the ledger starts truthful rather than empty (ADR 0121 §Decision 3). Serves criterion adopt-existing-repo. deps: A01.' },
-  { ref: 'A04', kind: 'feature', priority: 3, est: 150, crit: [CRIT], deps: ['A01', 'A02'], extDeps: [],
-    title: 'bongos init --adopt: conflict pre-flight report (--dry-run default, accept-gated)',
-    description: 'Produce the pre-flight report the owner must ACCEPT before anything is written (ADR 0121 §Decision 5): migration-namespace collisions (ADR 0108 §5), core<->host fitness-boundary violations in existing imports (ADR 0062 §1), incoming files that land on protected paths (ADR 0043), and CI collisions between core\'s expected unit/gate check and the repo\'s own workflows. --dry-run is the default first pass; nothing is written until accepted. Serves criterion adopt-existing-repo. deps: A01, A02.' },
-  { ref: 'A05', kind: 'feature', priority: 3, est: 120, crit: [CRIT], deps: ['A01', 'A03', 'A04'], extDeps: [RUNBOOK_TASK],
-    title: 'bongos init --adopt: wire greenfield-vs-adopt into the runbook + both forms',
-    description: 'Offer the greenfield-vs-adopt choice at the SCAFFOLD leg of goal 35\'s canonical step sequence, across all three forms: the /new-project skill (task 1981), the `bongos onboard` CLI (task 1982), and the hall "start a project" wizard (task 1983). Since --adopt is a branch of the same init, the forms inherit it (ADR 0121 §Decision 1). Serves criterion adopt-existing-repo. deps: A01, A03, A04, and the runbook task 1981.' },
-];
-
-(async () => {
-  const idByRef = {};
-  // Phase 1: create tasks (idempotent on source_ref) + link the criterion.
-  for (const t of TASKS) {
-    const create = await apiCall('POST', '/api/bongos/tasks', {
-      version_id: 'BONGOS-V1',
-      goal_id: GOAL_ID,
-      title: t.title,
-      description: t.description,
-      kind: t.kind,
-      discipline: 'engineer',
-      priority: t.priority,
-      est_minutes: t.est,
-      source: 'planning',
-      source_ref: `BONGOS-V1-adopt-${t.ref}`,
-    });
-    const task = create.data && (create.data.task || create.data);
-    const id = task && task.id;
-    if (!id) { console.log(`  ${t.ref}: CREATE FAILED — ${create.status} ${JSON.stringify(create.data).slice(0, 160)}`); continue; }
-    idByRef[t.ref] = id;
-    const link = await apiCall('POST', `/api/bongos/tasks/${id}/criteria`, { criterion_ids: t.crit });
-    console.log(`  ${t.ref} -> task ${id} (${t.kind}, P${t.priority}, goal ${task.goal_id}) · criterion ${link.status === 200 ? 'ok' : (JSON.stringify(link.data).slice(0, 120))}`);
-  }
-  // Phase 2: dependency edges (idempotent on (task_id, depends_on_task_id)).
-  console.log('--- dependencies ---');
-  for (const t of TASKS) {
-    const id = idByRef[t.ref];
-    if (!id) continue;
-    const localDepIds = t.deps.map((d) => idByRef[d]).filter(Boolean);
-    const allDeps = [...localDepIds, ...t.extDeps];
-    for (const depId of allDeps) {
-      const r = await apiCall('POST', `/api/bongos/tasks/${id}/dependencies`, { depends_on_task_id: depId });
-      console.log(`  ${t.ref}(${id}) -> ${depId} ${r.status === 200 || r.status === 201 ? 'ok' : (JSON.stringify(r.data).slice(0, 120))}`);
-    }
-  }
-  // NOTE: intentionally NO promote step — these are backlog until the owner
-  // schedules the adopt build (ADR 0121; task 1986 is scope-only).
-  console.log('refs:', JSON.stringify(idByRef));
-})().catch((e) => console.log('ERR ' + (e && e.message)));