@bongos/core 1.17.0

package/scripts/gds/search-ingest-db.js

@@ -0,0 +1,209 @@
+#!/usr/bin/env node
+// scripts/gds/search-ingest-db.js — DB-prose ingester for the GDS recall layer
+// (task 948, V4.R10 / ADR 0060 §4). The nightly companion to the repo-md
+// ingester (#947): indexes the prose that lives in the DB, not in git — task
+// descriptions + value summaries, learnings, session-log notes, idea inbox,
+// grade notes, done-when criteria, blockers, per-builder memory — plus recent
+// git commit subjects, so "has a parallel/past session already done this?" is
+// answerable (the redundant-work case). source_kind='db'.
+//
+// Runs on a NIGHTLY systemd timer on the droplet (infra/search-index-db.timer,
+// modeled on gds-db-backup) where the GDS Postgres is on the local socket. Idempotent
+// + delta by content_hash (re-runs are cheap), prunes vanished db sources.
+//
+// SECURITY (ADR 0060 §6 / ADR 0016 / ADR 0022):
+//   * builder_memory rows are OWNER-SCOPED (owner_builder_id = the builder), so a
+//     builder's private memory only ever surfaces to that builder.
+//   * security_sensitive tasks are tagged min_rank=metic.
+//   * vulnerability_reports + security_reports are EXCLUDED entirely — raw
+//     security findings don't belong in a broadly-searchable index.
+//   * session-derived + memory text is run through ship.js scrubSecrets (shape +
+//     high-entropy redaction) before storage — the index must never hold a
+//     leaked credential.
+//
+// Usage:
+//   node scripts/gds/search-ingest-db.js            # ingest (writes)
+//   node scripts/gds/search-ingest-db.js --dry-run  # query + report counts, no writes (needs DB)
+
+const crypto = require('node:crypto');
+const { execFileSync } = require('node:child_process');
+const path = require('node:path');
+const { chunkMarkdown } = require('../../modules/memory/search-chunker'); // carved in BV1.R72 (ADR 0091 §2)
+const { scrubSecrets } = require('./ship');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+
+function requirePool() {
+  // Pool lives in the root src/db.js (see search-ingest-md.js requirePool).
+  return require('../../src/bongos/pool').pool;
+}
+
+function sha256(s) {
+  return crypto.createHash('sha256').update(s, 'utf8').digest('hex');
+}
+
+// Turn one DB record's prose into chunk rows. The title becomes an H1 so the
+// chunker's breadcrumb + FTS title-weighting work the same as for docs. `scrub`
+// runs the body through scrubSecrets first (session/memory/grade text).
+function buildRows({ sourceRef, title, body, minRank = 'xenos', ownerBuilderId = null, scrub = false }) {
+  let text = typeof body === 'string' ? body : '';
+  if (scrub) text = scrubSecrets(text);
+  if (!text || !text.trim()) return [];
+  const content = (title ? `# ${title}\n\n` : '') + text;
+  const { chunks } = chunkMarkdown({ path: sourceRef, content });
+  return chunks.map((c) => ({
+    source_ref: sourceRef,
+    chunk_index: c.chunk_index,
+    heading_path: c.heading_path,
+    title: title || sourceRef,
+    body: c.body,
+    min_rank: minRank,
+    owner_builder_id: ownerBuilderId,
+    content_hash: sha256(c.body),
+  }));
+}
+
+// The prose sources. Each maps DB rows → buildRows() args. Pure given rows, so
+// the mapping is unit-testable without a DB (the queries run in main()).
+// vulnerability_reports + security_reports are deliberately ABSENT (excluded).
+const SOURCES = [
+  {
+    name: 'tasks',
+    query: `SELECT id, title, description, value_summary, security_sensitive FROM tasks`,
+    map: (r) => buildRows({
+      sourceRef: `task:${r.id}`,
+      title: r.title,
+      body: [r.description, r.value_summary].filter(Boolean).join('\n\n'),
+      minRank: r.security_sensitive ? 'metic' : 'xenos',
+    }),
+  },
+  { name: 'learnings', query: `SELECT id, title, body_md FROM learnings`,
+    map: (r) => buildRows({ sourceRef: `learning:${r.id}`, title: r.title, body: r.body_md }) },
+  { name: 'idea_inbox', query: `SELECT id, title, body_md FROM idea_inbox`,
+    map: (r) => buildRows({ sourceRef: `idea:${r.id}`, title: r.title, body: r.body_md }) },
+  { name: 'done_when_criteria', query: `SELECT id, version_id, criterion_id, criterion_md FROM done_when_criteria`,
+    map: (r) => buildRows({ sourceRef: `criterion:${r.id}`, title: `Criterion ${r.criterion_id} · ${r.version_id}`, body: r.criterion_md }) },
+  { name: 'blockers', query: `SELECT id, title, body_md, resolution_note FROM blockers`,
+    map: (r) => buildRows({ sourceRef: `blocker:${r.id}`, title: r.title, body: [r.body_md, r.resolution_note].filter(Boolean).join('\n\n') }) },
+  // Session-derived prose → SCRUB.
+  { name: 'session_logs', query: `SELECT id, task_id, notes_md FROM session_logs WHERE notes_md IS NOT NULL`,
+    map: (r) => buildRows({ sourceRef: `session_log:${r.id}`, title: `Session log ${r.id}${r.task_id ? ` · task ${r.task_id}` : ''}`, body: r.notes_md, scrub: true }) },
+  { name: 'task_grades', query: `SELECT id, task_id, notes_md FROM task_grades WHERE notes_md IS NOT NULL`,
+    map: (r) => buildRows({ sourceRef: `grade:${r.id}`, title: `Grade · task ${r.task_id}`, body: r.notes_md, scrub: true }) },
+  // Per-builder memory → OWNER-SCOPED + scrubbed.
+  { name: 'builder_memory', query: `SELECT builder_id, path, content FROM builder_memory`,
+    map: (r) => buildRows({ sourceRef: `memory:${r.builder_id}:${r.path}`, title: r.path, body: r.content, ownerBuilderId: r.builder_id, scrub: true }) },
+];
+
+// Recent git commit subjects — the "did a recent session already touch this?"
+// signal. Best-effort (no git / shallow clone → skip).
+function recentCommitRows(limit = 80) {
+  let out;
+  try {
+    out = execFileSync('git', ['-C', REPO_ROOT, 'log', `-${limit}`, '--no-merges', '--format=%H%x09%s'], { encoding: 'utf8' });
+  } catch { return []; }
+  const rows = [];
+  for (const line of out.split('\n')) {
+    const tab = line.indexOf('\t');
+    if (tab < 0) continue;
+    const sha = line.slice(0, tab).trim();
+    const subject = line.slice(tab + 1).trim();
+    if (!sha || !subject) continue;
+    rows.push(...buildRows({ sourceRef: `commit:${sha.slice(0, 12)}`, title: subject, body: subject }));
+  }
+  return rows;
+}
+
+async function ingestRows(client, rows, sourceRef) {
+  const stats = { inserted: 0, updated: 0, unchanged: 0, pruned: 0 };
+  for (const r of rows) {
+    const res = await client.query(
+      `INSERT INTO search_chunks
+         (source_kind, source_ref, chunk_index, heading_path, title, body, min_rank, owner_builder_id, content_hash, updated_at)
+       VALUES ('db', $1, $2, $3, $4, $5, $6, $7, $8, now())
+       ON CONFLICT (source_kind, source_ref, chunk_index) DO UPDATE
+         SET heading_path = EXCLUDED.heading_path, title = EXCLUDED.title, body = EXCLUDED.body,
+             min_rank = EXCLUDED.min_rank, owner_builder_id = EXCLUDED.owner_builder_id,
+             content_hash = EXCLUDED.content_hash, updated_at = now()
+         WHERE search_chunks.content_hash IS DISTINCT FROM EXCLUDED.content_hash
+            OR search_chunks.min_rank IS DISTINCT FROM EXCLUDED.min_rank
+            OR search_chunks.owner_builder_id IS DISTINCT FROM EXCLUDED.owner_builder_id
+       RETURNING (xmax = 0) AS inserted`,
+      [sourceRef, r.chunk_index, r.heading_path, r.title, r.body, r.min_rank, r.owner_builder_id, r.content_hash]
+    );
+    if (res.rowCount === 0) stats.unchanged += 1;
+    else if (res.rows[0].inserted) stats.inserted += 1;
+    else stats.updated += 1;
+  }
+  const prune = await client.query(
+    `DELETE FROM search_chunks WHERE source_kind='db' AND source_ref=$1 AND chunk_index >= $2`,
+    [sourceRef, rows.length]
+  );
+  stats.pruned = prune.rowCount || 0;
+  return stats;
+}
+
+async function main() {
+  const dryRun = process.argv.includes('--dry-run');
+  const pool = requirePool();
+  const client = await pool.connect();
+  const totals = { inserted: 0, updated: 0, unchanged: 0, pruned: 0, deleted: 0, sources: 0 };
+  const presentRefs = [];
+  try {
+    // Gather every source's rows first (read-only), grouped by source_ref.
+    const byRef = new Map(); // source_ref -> rows[]
+    const add = (rows) => {
+      for (const row of rows) {
+        if (!byRef.has(row.source_ref)) byRef.set(row.source_ref, []);
+        byRef.get(row.source_ref).push(row);
+      }
+    };
+    for (const src of SOURCES) {
+      const { rows } = await client.query(src.query);
+      for (const rec of rows) add(src.map(rec));
+    }
+    add(recentCommitRows());
+    for (const ref of byRef.keys()) presentRefs.push(ref);
+    totals.sources = byRef.size;
+    const totalChunks = [...byRef.values()].reduce((n, a) => n + a.length, 0);
+    console.log(`search-ingest-db: ${byRef.size} db source(s), ${totalChunks} chunk(s)`);
+
+    if (dryRun) {
+      console.log('--dry-run: no writes.');
+      const owned = [...byRef.values()].flat().filter((r) => r.owner_builder_id != null).length;
+      const metic = [...byRef.values()].flat().filter((r) => r.min_rank === 'metic').length;
+      console.log(`  owner-scoped chunks: ${owned}  ·  metic-tagged chunks: ${metic}`);
+      client.release(); await pool.end().catch(() => {});
+      return;
+    }
+
+    await client.query('BEGIN');
+    for (const [ref, rows] of byRef) {
+      const s = await ingestRows(client, rows, ref);
+      totals.inserted += s.inserted; totals.updated += s.updated;
+      totals.unchanged += s.unchanged; totals.pruned += s.pruned;
+    }
+    // Delete db chunks whose source no longer exists (a deleted task/idea/etc.).
+    const del = await client.query(
+      `DELETE FROM search_chunks WHERE source_kind='db' AND NOT (source_ref = ANY($1::text[]))`,
+      [presentRefs]
+    );
+    totals.deleted = del.rowCount || 0;
+    await client.query('COMMIT');
+  } catch (e) {
+    await client.query('ROLLBACK').catch(() => {});
+    console.error('search-ingest-db: FAILED, rolled back:', e.message);
+    process.exitCode = 1;
+    client.release(); await pool.end().catch(() => {});
+    return;
+  }
+  client.release();
+  await pool.end().catch(() => {});
+  console.log(`search-ingest-db: inserted=${totals.inserted} updated=${totals.updated} unchanged=${totals.unchanged} pruned=${totals.pruned} deleted=${totals.deleted} across ${totals.sources} sources`);
+}
+
+if (require.main === module) {
+  main().catch((e) => { console.error('search-ingest-db: error', e); process.exit(1); });
+}
+
+module.exports = { buildRows, recentCommitRows, SOURCES, requirePool };

package/scripts/gds/search-ingest-md.js

@@ -0,0 +1,225 @@
+#!/usr/bin/env node
+// scripts/gds/search-ingest-md.js — repo-markdown ingester for the GDS recall
+// layer (task 947, V4.R09 / ADR 0060 §4). Walks the repo's markdown, chunks each
+// file (src/bongos/search-chunker.js), and upserts into search_chunks — DELTA-DRIVEN
+// by content_hash so an unchanged chunk is never rewritten. Vanished sources are
+// deleted, so the index tracks the tree.
+//
+// DEPLOY HOOK: a step in the prod deploy (scripts/deploy/deploy-prod.sh, mirrored
+// in the droplet's ~/deploy.sh) runs this AFTER the code update + migrate, where
+// the new markdown + the DB are both on disk. Best-effort there: an ingest hiccup
+// must never fail a deploy (the next deploy / a manual run catches up).
+//
+// SCOPING (ADR 0060 §6): a doc that documents a permission-core surface is tagged
+// min_rank='metic' so a sub-Metic search can never surface it (the search route's
+// SQL filter, #949/#950, enforces it). Everything else is 'xenos' (shared). Docs
+// are never owner-scoped (owner_builder_id stays NULL) — that's for DB-prose
+// memory (#948).
+//
+// Usage:
+//   node scripts/gds/search-ingest-md.js            # ingest (writes)
+//   node scripts/gds/search-ingest-md.js --dry-run  # report what WOULD change, no writes
+//   node scripts/gds/search-ingest-md.js --root DIR # override the repo root (tests)
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { chunkMarkdown } = require('../../modules/memory/search-chunker'); // carved in BV1.R72 (ADR 0091 §2)
+const { matchProtected } = require('../../src/bongos/permission-path-check');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+// Directories we never index: deps, git internals, parallel worktrees, and the
+// web front-ends (assets, not project knowledge). Both web surfaces now live under
+// modules/<key>/public/ — the status surface at modules/status-ui/public/ (BV1.R84)
+// and the hall at modules/hall-ui/public/ (BV1.R85) — so both are already covered
+// by the `public` basename below.
+const EXCLUDE_DIRS = new Set(['node_modules', '.git', 'public']);
+// .claude/worktrees holds throwaway parallel checkouts — skip by path fragment.
+const EXCLUDE_PATH_RE = /(^|\/)\.claude\/worktrees\//;
+
+// Permission-core / read-sensitive DOCUMENTATION surfaces → min_rank='metic'
+// (ADR 0060 §6 / ADR 0043 "sub-Metic must not read deeply into … trust-boundary
+// docs"). The PROTECTED_GLOBS in permission-path-check are WRITE-protection over
+// CODE paths; READ-gating in the index is a DIFFERENT axis, so we curate the doc
+// surfaces a sub-Metic search must not surface: the security/audit corpus, the
+// permissions authority doc, and the two trust-boundary ADRs. A trailing '/' is
+// a subtree. (CLAUDE.md is write-protected but READ-PUBLIC — see minRankForDoc.)
+const SENSITIVE_DOC_GLOBS = [
+  'docs/canonical-permissions.md',  // the rank-ladder / authority reference
+  'docs/security/',                 // threat models + red-team reports
+  'docs/audits/',                   // security + architecture audit findings
+  'docs/adr/0016-trust-boundary-server-enforced-permissions.md',
+  'docs/adr/0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md',
+];
+
+function relPath(abs) {
+  return path.relative(REPO_ROOT, abs).split(path.sep).join('/');
+}
+
+function minRankForDoc(rel) {
+  // CLAUDE.md is in permission-path-check's PROTECTED_GLOBS, but that's
+  // WRITE-protection (sub-Metic can't EDIT it). For RECALL it's the universal
+  // onboarding index every rank reads at session start — read-public. Carve it
+  // out so a Xenos search still surfaces it (it links to the gated detail docs,
+  // which stay metic via the curated list below).
+  if (rel === 'CLAUDE.md') return 'xenos';
+  // Curated read-sensitive documentation surfaces → metic.
+  for (const g of SENSITIVE_DOC_GLOBS) {
+    if (g.endsWith('/') ? rel.startsWith(g) : rel === g) return 'metic';
+  }
+  // Defensive: any OTHER markdown that physically lives under a protected CODE
+  // surface (e.g. a future README inside src/bongos/) → metic. matchProtected over
+  // an md path only ever matches CLAUDE.md today (carved out above) or such a
+  // nested doc, so this is a forward-looking guard, not a second CLAUDE.md hit.
+  if (matchProtected([rel]).length > 0) return 'metic';
+  return 'xenos';
+}
+
+// Recursively collect *.md files under root, honoring the exclusions.
+function collectMarkdown(dir, root, out = []) {
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return out; }
+  for (const e of entries) {
+    const abs = path.join(dir, e.name);
+    if (e.isDirectory()) {
+      if (EXCLUDE_DIRS.has(e.name)) continue;
+      const rel = relPath(abs);
+      if (EXCLUDE_PATH_RE.test(rel + '/')) continue;
+      collectMarkdown(abs, root, out);
+    } else if (e.isFile() && e.name.toLowerCase().endsWith('.md')) {
+      const rel = relPath(abs);
+      if (EXCLUDE_PATH_RE.test(rel)) continue;
+      out.push(abs);
+    }
+  }
+  return out;
+}
+
+function sha256(s) {
+  return crypto.createHash('sha256').update(s, 'utf8').digest('hex');
+}
+
+// The pg Pool lives in the ROOT src/db.js — src/bongos/db.js USES it but does NOT
+// re-export it (src/bongos/search.js requires '../db' for the same reason). Pulled
+// into an exported helper so a unit test pins the path: the original
+// require('../../src/bongos/db') returned no `pool`, crashing only on the DB path
+// (which the pure tests + --dry-run never exercised). task 1156.
+function requirePool() {
+  const { pool } = require('../../src/bongos/pool');
+  return pool;
+}
+
+// Build the per-file chunk rows (pure — no DB). Exported for the dry-run report
+// + tests.
+function chunkFile(abs) {
+  const rel = relPath(abs);
+  const content = fs.readFileSync(abs, 'utf8');
+  const { title, chunks } = chunkMarkdown({ path: rel, content });
+  const min_rank = minRankForDoc(rel);
+  return chunks.map((c) => ({
+    source_kind: 'doc',
+    source_ref: rel,
+    chunk_index: c.chunk_index,
+    heading_path: c.heading_path,
+    title: title || rel,
+    body: c.body,
+    min_rank,
+    content_hash: sha256(c.body),
+  }));
+}
+
+// Upsert one file's chunks in a transaction: delta-update changed chunks, prune
+// any trailing chunks (file shrank). Returns { inserted, updated, unchanged, pruned }.
+async function ingestFile(client, rows, sourceRef) {
+  const stats = { inserted: 0, updated: 0, unchanged: 0, pruned: 0 };
+  for (const r of rows) {
+    const res = await client.query(
+      `INSERT INTO search_chunks
+         (source_kind, source_ref, chunk_index, heading_path, title, body, min_rank, owner_builder_id, content_hash, updated_at)
+       VALUES ('doc', $1, $2, $3, $4, $5, $6, NULL, $7, now())
+       ON CONFLICT (source_kind, source_ref, chunk_index) DO UPDATE
+         SET heading_path = EXCLUDED.heading_path,
+             title        = EXCLUDED.title,
+             body         = EXCLUDED.body,
+             min_rank     = EXCLUDED.min_rank,
+             content_hash = EXCLUDED.content_hash,
+             updated_at   = now()
+         WHERE search_chunks.content_hash IS DISTINCT FROM EXCLUDED.content_hash
+            OR search_chunks.min_rank    IS DISTINCT FROM EXCLUDED.min_rank
+       RETURNING (xmax = 0) AS inserted`,
+      [sourceRef, r.chunk_index, r.heading_path, r.title, r.body, r.min_rank, r.content_hash]
+    );
+    if (res.rowCount === 0) stats.unchanged += 1;        // WHERE skipped the update (no change)
+    else if (res.rows[0].inserted) stats.inserted += 1;  // fresh row
+    else stats.updated += 1;                             // changed row rewritten
+  }
+  // Prune chunks beyond the new count (file shrank / sections removed).
+  const pruneRes = await client.query(
+    `DELETE FROM search_chunks WHERE source_kind='doc' AND source_ref=$1 AND chunk_index >= $2`,
+    [sourceRef, rows.length]
+  );
+  stats.pruned = pruneRes.rowCount || 0;
+  return stats;
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const dryRun = args.includes('--dry-run');
+  const rootIdx = args.indexOf('--root');
+  const root = rootIdx >= 0 ? path.resolve(args[rootIdx + 1]) : REPO_ROOT;
+
+  const files = collectMarkdown(root, root).sort();
+  const allRows = [];
+  let metic = 0;
+  for (const abs of files) {
+    const rows = chunkFile(abs);
+    if (rows.some((r) => r.min_rank === 'metic')) metic += 1;
+    allRows.push({ sourceRef: relPath(abs), rows });
+  }
+  const totalChunks = allRows.reduce((n, f) => n + f.rows.length, 0);
+  console.log(`search-ingest-md: ${files.length} markdown file(s), ${totalChunks} chunk(s), ${metic} file(s) tagged min_rank=metic`);
+
+  if (dryRun) {
+    console.log('--dry-run: no writes. Sample of metic-tagged sources:');
+    for (const f of allRows.filter((f) => f.rows[0] && f.rows[0].min_rank === 'metic').slice(0, 10)) {
+      console.log(`  metic  ${f.sourceRef} (${f.rows.length} chunk(s))`);
+    }
+    return;
+  }
+
+  const pool = requirePool();
+  const client = await pool.connect();
+  const totals = { inserted: 0, updated: 0, unchanged: 0, pruned: 0, deleted: 0 };
+  try {
+    await client.query('BEGIN');
+    for (const f of allRows) {
+      const s = await ingestFile(client, f.rows, f.sourceRef);
+      totals.inserted += s.inserted; totals.updated += s.updated;
+      totals.unchanged += s.unchanged; totals.pruned += s.pruned;
+    }
+    // Delete chunks for doc sources that no longer exist in the tree.
+    const present = allRows.map((f) => f.sourceRef);
+    const del = await client.query(
+      `DELETE FROM search_chunks WHERE source_kind='doc' AND NOT (source_ref = ANY($1::text[]))`,
+      [present]
+    );
+    totals.deleted = del.rowCount || 0;
+    await client.query('COMMIT');
+  } catch (e) {
+    await client.query('ROLLBACK').catch(() => {});
+    console.error('search-ingest-md: FAILED, rolled back:', e.message);
+    process.exitCode = 1;
+    client.release();
+    await pool.end().catch(() => {});
+    return;
+  }
+  client.release();
+  await pool.end().catch(() => {});
+  console.log(`search-ingest-md: inserted=${totals.inserted} updated=${totals.updated} unchanged=${totals.unchanged} pruned=${totals.pruned} deleted_sources_chunks=${totals.deleted}`);
+}
+
+if (require.main === module) {
+  main().catch((e) => { console.error('search-ingest-md: error', e); process.exit(1); });
+}
+
+module.exports = { chunkFile, minRankForDoc, collectMarkdown, ingestFile, requirePool, SENSITIVE_DOC_GLOBS };

package/scripts/gds/security-baseline-check.sh

@@ -0,0 +1,180 @@
+#!/usr/bin/env bash
+# scripts/gds/security-baseline-check.sh — V3.R44 (#253).
+#
+# The enforceable read of docs/security-baseline.md. Walks eight categories
+# and prints PASS / FAIL / pending for each. Exit 0 if no FAILs (pendings are
+# OK); exit 1 if any FAIL.
+#
+# Intended caller: the /merge-mode skill, before landing a non-Archon claim.
+# Also runs cleanly by hand: `bash scripts/gds/security-baseline-check.sh`.
+#
+# Pure check — no writes, no network calls. The point is to be cheap enough to
+# run on every merge.
+
+set -uo pipefail
+
+# Anchor to repo root regardless of where the script was invoked from.
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$REPO_ROOT"
+
+PASS_COUNT=0
+FAIL_COUNT=0
+PENDING_COUNT=0
+FAILED_ITEMS=()
+
+# emit <status> <label> <detail>
+emit() {
+  local status=$1; shift
+  local label=$1;  shift
+  local detail=$*
+  case "$status" in
+    PASS)    PASS_COUNT=$((PASS_COUNT+1));    printf '  \033[32mPASS\033[0m    %s — %s\n' "$label" "$detail" ;;
+    FAIL)    FAIL_COUNT=$((FAIL_COUNT+1));    FAILED_ITEMS+=("$label"); printf '  \033[31mFAIL\033[0m    %s — %s\n' "$label" "$detail" ;;
+    PENDING) PENDING_COUNT=$((PENDING_COUNT+1)); printf '  \033[33mpending\033[0m %s — %s\n' "$label" "$detail" ;;
+  esac
+}
+
+echo "security-baseline-check — walking 8 categories"
+echo "(repo: $REPO_ROOT)"
+echo ""
+
+# ---- 1. input validation on every write route -------------------------------
+# Every router file that defines POST/PATCH/PUT/DELETE must reference
+# validateOrRespond. A router with only GETs is exempt.
+miss=()
+for f in src/bongos/routes/*.js; do
+  if grep -qE "router\.(post|patch|put|delete)\b" "$f"; then
+    if ! grep -q "validateOrRespond" "$f"; then
+      miss+=("$f")
+    fi
+  fi
+done
+if [ ${#miss[@]} -eq 0 ]; then
+  emit PASS "1. input-validation" "every write-bearing router uses validateOrRespond"
+else
+  emit FAIL "1. input-validation" "missing in: ${miss[*]}"
+fi
+
+# ---- 2. auth-token hygiene --------------------------------------------------
+# Schema migration 035 is the floor. db.js must export the revocation helpers.
+if [ -f migrations/035_auth_token_hygiene.sql ] && \
+   grep -q "revokeSessionById" src/bongos/db.js && \
+   grep -q "revokeAllSessionsForBuilder" src/bongos/db.js; then
+  emit PASS "2. auth-token-hygiene" "migration 035 present, revocation helpers exported"
+else
+  emit FAIL "2. auth-token-hygiene" "migration 035 or revocation helpers missing"
+fi
+
+# ---- 3. rate limits on write paths ------------------------------------------
+# Caddy directive + Express middleware file (V3.R34 / #255 — still in flight
+# at the time this script was written; emit pending if not yet shipped).
+caddy_ok=0; mw_ok=0
+[ -f infra/Caddyfile ] && grep -q "rate_limit" infra/Caddyfile && caddy_ok=1
+[ -d src/bongos/middleware ] && find src/bongos/middleware -name "*rate*.js" -print -quit | grep -q . && mw_ok=1
+if [ "$caddy_ok" = "1" ] && [ "$mw_ok" = "1" ]; then
+  emit PASS "3. rate-limits" "Caddyfile + middleware/*rate*.js both present"
+elif [ "$caddy_ok" = "0" ] && [ "$mw_ok" = "0" ]; then
+  emit PENDING "3. rate-limits" "V3.R34 (#255) not yet shipped — neither Caddy directive nor middleware present"
+else
+  emit FAIL "3. rate-limits" "partial implementation (caddy=$caddy_ok middleware=$mw_ok); finish or revert"
+fi
+
+# ---- 4. audit logging on every authenticated write --------------------------
+if [ -f migrations/033_audit_log.sql ] && [ -f src/bongos/middleware/audit.js ]; then
+  emit PASS "4. audit-logging" "migration 033 + middleware/audit.js present"
+elif [ -f migrations/033_audit_log.sql ]; then
+  emit FAIL "4. audit-logging" "migration 033 present but src/bongos/middleware/audit.js missing"
+else
+  emit FAIL "4. audit-logging" "migration 033 missing"
+fi
+
+# ---- 5. dependency scanning in CI + nightly ---------------------------------
+ci_ok=0; cron_ok=0; scan_ok=0
+[ -f .github/workflows/dep-audit.yml ] && ci_ok=1
+[ -f .claude/scheduled-tasks/dep-audit-nightly/SKILL.md ] && cron_ok=1
+[ -f scripts/security/dep-audit.js ] && scan_ok=1
+if [ "$ci_ok" = "1" ] && [ "$cron_ok" = "1" ] && [ "$scan_ok" = "1" ]; then
+  emit PASS "5. dep-scanning" "CI workflow + nightly cron + scan script all present"
+else
+  emit FAIL "5. dep-scanning" "missing: ci=$ci_ok cron=$cron_ok scan=$scan_ok"
+fi
+
+# ---- 6. no secrets in repo --------------------------------------------------
+hook_ok=0
+[ -f .husky/pre-commit ] && grep -qE "secret|trufflehog|gitleaks|secrets-scan" .husky/pre-commit && hook_ok=1
+[ "$hook_ok" = "0" ] && [ -f .git/hooks/pre-commit ] && grep -qE "secret|trufflehog|gitleaks|secrets-scan" .git/hooks/pre-commit && hook_ok=1
+# .env.local must be in .gitignore so it can't be staged accidentally.
+gitignore_ok=0
+[ -f .gitignore ] && grep -qE "^\.env\.local$|^\.env\.local\b" .gitignore && gitignore_ok=1
+if [ "$hook_ok" = "1" ] && [ "$gitignore_ok" = "1" ]; then
+  emit PASS "6. no-secrets-in-repo" "pre-commit secrets scan present + .env.local gitignored"
+elif [ "$gitignore_ok" = "1" ]; then
+  emit FAIL "6. no-secrets-in-repo" ".env.local gitignored OK, but no pre-commit secrets scan detected"
+else
+  emit FAIL "6. no-secrets-in-repo" "missing: pre-commit=$hook_ok gitignore=$gitignore_ok"
+fi
+
+# ---- 7. observability dashboards --------------------------------------------
+# The status dashboard surface moved to modules/status-ui/public/ in BV1.R84.
+status_ok=0; grafana_ok=0
+[ -d modules/status-ui/public ] && status_ok=1
+[ -d docs/grafana ] && find docs/grafana -name "*.json" -print -quit 2>/dev/null | grep -q . && grafana_ok=1
+if [ "$status_ok" = "1" ] && [ "$grafana_ok" = "1" ]; then
+  emit PASS "7. observability" "modules/status-ui/public/ + docs/grafana/*.json present"
+elif [ "$status_ok" = "1" ]; then
+  emit PENDING "7. observability" "V3.R42 (#263) not yet shipped — status dashboard OK, no provisioned grafana JSON yet"
+else
+  emit FAIL "7. observability" "modules/status-ui/public/ missing"
+fi
+
+# ---- 8. rank-check audit on every route -------------------------------------
+# Each router.<verb> declaration must EITHER have a 'rank:' comment within 5
+# lines above OR reference requireBuilder/requireRank in the middleware chain
+# of that declaration line. Routes that fail this surface explicitly so the
+# fix is local to the offending router file.
+ungated=()
+while read -r line; do
+  file="${line%%:*}"
+  rest="${line#*:}"
+  lineno="${rest%%:*}"
+  # capture the verb declaration line
+  decl=$(sed -n "${lineno}p" "$file")
+  # check the declaration line itself for auth.* middleware
+  if echo "$decl" | grep -qE "auth\.(requireBuilder|requireRank)"; then
+    continue
+  fi
+  # otherwise check the 5 lines above for a `rank:` comment OR a multi-line
+  # router definition where the middleware chain spans lines (the closing
+  # paren of router.<verb>(... can be many lines down). Search up to 20 lines
+  # forward for auth.require* in the same router(...) block.
+  start=$((lineno > 5 ? lineno - 5 : 1))
+  before=$(sed -n "${start},${lineno}p" "$file")
+  if echo "$before" | grep -qE "rank:|RANK:"; then
+    continue
+  fi
+  end=$((lineno + 20))
+  after=$(sed -n "${lineno},${end}p" "$file")
+  if echo "$after" | grep -qE "auth\.(requireBuilder|requireRank)"; then
+    continue
+  fi
+  ungated+=("$file:$lineno")
+done < <(grep -nE "router\.(get|post|patch|put|delete)\(" src/bongos/routes/*.js)
+if [ ${#ungated[@]} -eq 0 ]; then
+  emit PASS "8. rank-check-audit" "every route either rank-commented or uses requireBuilder/requireRank"
+else
+  emit FAIL "8. rank-check-audit" "ungated routes: ${ungated[*]}"
+fi
+
+# ---- summary ----------------------------------------------------------------
+echo ""
+echo "summary: PASS=$PASS_COUNT  pending=$PENDING_COUNT  FAIL=$FAIL_COUNT"
+if [ "$FAIL_COUNT" -gt 0 ]; then
+  echo "FAILED items:"
+  for it in "${FAILED_ITEMS[@]}"; do echo "  - $it"; done
+  echo ""
+  echo "Fix the FAILED items (or escalate to Archon for an audit-logged override) before /merge-mode lands a non-Archon claim."
+  exit 1
+fi
+echo ""
+echo "OK — baseline green. Non-Archon merges may proceed."
+exit 0