@bongos/core 1.17.0

package/tests/auth_inactive_builder.mjs

@@ -0,0 +1,94 @@
+// tests/auth_inactive_builder.mjs
+//
+// SECURITY regression guard for #871, two related auth-layer hardenings:
+//
+//   1. requireBuilder must reject a builder whose row is status='inactive'
+//      (offboarded/deactivated) even if a live, unrevoked session token
+//      survives. Before #871, deactivateBuilder never revoked sessions and
+//      requireBuilder never checked status, so an offboarded builder kept full
+//      API access until their (never-expiring CLI) token was manually revoked.
+//      The gate denies ONLY the known 'inactive' value, so an 'active' (or any
+//      unknown/missing) status is never locked out.
+//
+//   2. extractTokens must cap the number of candidate tokens tried per request,
+//      so a Cookie header stuffed with dozens of gds_session=<junk> values can't
+//      amplify into dozens of per-request DB lookups (DoS).
+//
+// lookupSession is stubbed on the db module BEFORE auth.js is required, because
+// auth.js destructures it at load time. No server/DB/network.
+//
+// Run:  node tests/auth_inactive_builder.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+const db = require('../src/bongos/db-kernel.js'); // lookupSession lives in db-kernel now (ADR 0102)
+let nextSession = null;
+db.lookupSession = async () => nextSession;
+const auth = require('../src/bongos/auth.js');
+
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+function fakeRes() {
+  const res = {
+    _status: null, _json: null,
+    status(c) { this._status = c; return this; },
+    json(b) { this._json = b; return this; },
+  };
+  attachFail({}, res, () => {}); // install res.fail() as the router does (task 1991)
+  return res;
+}
+
+let pass = 0, fail = 0;
+const t = async (name, fn) => {
+  try { await fn(); pass++; console.log(`PASS  ${name}`); }
+  catch (e) { fail++; console.log(`FAIL  ${name}\n      ${e.stack || e.message}`); }
+};
+
+// ---- requireBuilder status gate ---------------------------------------------
+await t('inactive builder with a live session → 403 builder_inactive, next() NOT called', async () => {
+  nextSession = { builder_id: 25, github_login: 'ghost', rank: 'xenos', status: 'inactive' };
+  const req = { headers: { authorization: 'Bearer deadbeef' } };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilder(req, res, () => { nexted = true; });
+  assert.equal(nexted, false, 'next() must not run for an inactive builder');
+  assert.equal(res._status, 403);
+  assert.equal(res._json.error.code, 'builder_inactive');
+});
+
+await t('active builder → next() called, req.builder populated (incl. status)', async () => {
+  nextSession = { builder_id: 1, github_login: 'lars589', rank: 'archon', status: 'active' };
+  const req = { headers: { authorization: 'Bearer abc123' } };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilder(req, res, () => { nexted = true; });
+  assert.equal(nexted, true, 'active builder must pass');
+  assert.equal(res._status, null, 'no error status');
+  assert.equal(req.builder.rank, 'archon');
+  assert.equal(req.builder.status, 'active');
+});
+
+await t('missing/unknown status fails OPEN (never lock out a real builder)', async () => {
+  nextSession = { builder_id: 2, github_login: 'metic1', rank: 'metic' }; // no status field
+  const req = { headers: { authorization: 'Bearer xyz' } };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilder(req, res, () => { nexted = true; });
+  assert.equal(nexted, true, 'a missing status must NOT block (availability-safe)');
+  assert.equal(res._status, null);
+});
+
+// ---- extractTokens candidate cap --------------------------------------------
+await t('extractTokens caps the candidates it returns (DoS amplification guard)', async () => {
+  // 30 distinct gds_session cookies + a bearer → must not return 31 candidates.
+  const many = Array.from({ length: 30 }, (_, i) => `gds_session=tok${i}`).join('; ');
+  const req = { headers: { authorization: 'Bearer realone', cookie: many } };
+  const tokens = auth.extractTokens(req);
+  assert.ok(tokens.length <= 6, `expected <=6 candidate tokens, got ${tokens.length}`);
+  assert.equal(tokens[0], 'realone', 'the Bearer token is tried first');
+});
+
+console.log(`\n${pass} passed, ${fail} failed`);
+process.exit(fail === 0 ? 0 : 1);

package/tests/auth_page_gate.mjs

@@ -0,0 +1,92 @@
+// tests/auth_page_gate.mjs
+//
+// Unit smoke for auth.requireBuilderPage (#488) — the server-side sign-in gate
+// for the citizen primer + system-maps pages. Unlike requireBuilder (which
+// returns JSON 401), it REDIRECTS an unauthenticated request into the web
+// sign-in flow, and it must fail CLOSED if the session lookup itself errors.
+// This middleware is the SOLE access control for those pages, so it gets a
+// covering test even though the repo's other auth middleware historically
+// lacked one.
+//
+// Tested in isolation with a stubbed lookupSession — no DB, no network. The
+// stub is installed on the db-kernel module BEFORE auth.js is required, because
+// auth.js destructures lookupSession at load time
+// (const { lookupSession } = require('./db-kernel')) — carved there in ADR 0102.
+//
+// Run:  node tests/auth_page_gate.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+const db = require('../src/bongos/db-kernel.js'); // lookupSession lives in db-kernel now (ADR 0102)
+let nextSession = null;
+let lookupThrows = false;
+db.lookupSession = async () => {
+  if (lookupThrows) throw new Error('simulated db outage');
+  return nextSession;
+};
+const auth = require('../src/bongos/auth.js');
+
+// Minimal res double capturing redirect target + status.
+function fakeRes() {
+  return {
+    _status: null,
+    _redirect: null,
+    _ended: false,
+    status(c) { this._status = c; return this; },
+    redirect(a, b) {
+      this._redirect = b === undefined ? { code: 302, loc: a } : { code: a, loc: b };
+      return this;
+    },
+    json() { return this; },
+    end() { this._ended = true; return this; },
+  };
+}
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+console.log('requireBuilderPage middleware:');
+
+await t('unauthenticated request → 302 to sign-in, next() NOT called', async () => {
+  nextSession = null; lookupThrows = false;
+  const req = { headers: {} };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilderPage(req, res, () => { nexted = true; });
+  assert.equal(nexted, false, 'next() must not run for an unauthenticated request');
+  assert.ok(res._redirect, 'a redirect must be issued');
+  assert.equal(res._redirect.code, 302);
+  assert.equal(res._redirect.loc, '/api/gds/auth/web/start');
+});
+
+await t('authenticated request → next() called, no redirect', async () => {
+  nextSession = { builder_id: 1, github_login: 'someone', rank: 'xenos' };
+  lookupThrows = false;
+  const req = { headers: { cookie: 'gds_session=validtoken' } };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilderPage(req, res, () => { nexted = true; });
+  assert.equal(nexted, true, 'next() must run for an authenticated request');
+  assert.equal(res._redirect, null, 'no redirect for an authenticated request');
+});
+
+await t('session lookup error → fails CLOSED (redirect, next() NOT called)', async () => {
+  nextSession = null; lookupThrows = true;
+  const req = { headers: { cookie: 'gds_session=validtoken' } };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilderPage(req, res, () => { nexted = true; });
+  assert.equal(nexted, false, 'must not serve the page when the lookup errors');
+  assert.ok(res._redirect && res._redirect.loc === '/api/gds/auth/web/start',
+    'must redirect to sign-in on a lookup error (fail closed)');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/auth_session_ttl.mjs

@@ -0,0 +1,155 @@
+// tests/auth_session_ttl.mjs
+//
+// V3.R38 / task #259 — Auth token hygiene: short-lived sessions, refresh-on-
+// use, revocation. The DB-touching code (createSession, lookupSession,
+// revokeSessionById, revokeAllSessionsForBuilder, the demotion hook inside
+// setBuilderRank) is covered by code-review of the SQL plus this file's
+// pure-logic checks. We don't spin up a real PG instance; instead we:
+//
+//   1. Exercise the migration's backfill FORMULA in pure JS — every plausible
+//      "existing row" scenario produces a FUTURE expires_at (never past).
+//      This is the safety guarantee for the live supervisor's session.
+//   2. Exercise the demotion-detection logic against the live RANKS ladder —
+//      every "down the ladder" pair returns true (revoke), every "up the
+//      ladder" pair returns false (no revoke), every same-rank returns false.
+//   3. Confirm SESSION_TTL_MS is exactly 24 hours (criterion C9; widened
+//      from 1h in V3.R90 / #400 — see src/bongos/db.js comment block).
+//
+// Run:  node tests/auth_session_ttl.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const db = require('../src/bongos/db.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ---------------------------------------------------------------------------
+// 1. Migration backfill formula
+// ---------------------------------------------------------------------------
+// Mirrors the SQL in migrations/035_auth_token_hygiene.sql:
+//     expires_at = GREATEST(NOW() + 24h, last_used_at + 24h)
+// In JS terms:
+//     new Date(Math.max(now + 24h, last_used_at + 24h))
+function backfillExpiresAt(nowMs, lastUsedAtMs) {
+  const TWENTY_FOUR_H = 24 * 60 * 60 * 1000;
+  return new Date(Math.max(nowMs + TWENTY_FOUR_H, lastUsedAtMs + TWENTY_FOUR_H));
+}
+
+console.log('migration 035 backfill formula:');
+
+t('an idle pre-migration session (last_used_at = 1h ago) gets a FUTURE expires_at', () => {
+  const now = Date.now();
+  const lastUsed = now - 60 * 60 * 1000; // 1h ago
+  const out = backfillExpiresAt(now, lastUsed);
+  assert.ok(out.getTime() > now, 'must be in the future');
+  // Should be ~24h ahead, not 23h.
+  const delta = out.getTime() - now;
+  assert.ok(delta >= 24 * 60 * 60 * 1000, `expected >=24h ahead, got ${delta / 3_600_000}h`);
+});
+
+t('a freshly-used session (last_used_at = now) gets ~24h future expires_at', () => {
+  const now = Date.now();
+  const out = backfillExpiresAt(now, now);
+  const delta = out.getTime() - now;
+  assert.ok(delta >= 24 * 60 * 60 * 1000 - 1, `expected ~24h ahead, got ${delta / 3_600_000}h`);
+});
+
+t('a long-idle session (last_used_at = 30 days ago) still gets >=24h future', () => {
+  const now = Date.now();
+  const lastUsed = now - 30 * 24 * 60 * 60 * 1000;
+  const out = backfillExpiresAt(now, lastUsed);
+  assert.ok(out.getTime() > now, 'must be in the future');
+  // GREATEST(now+24h, lastUsed+24h) — here lastUsed+24h is 29d ago, so we get now+24h.
+  const delta = out.getTime() - now;
+  assert.ok(delta >= 24 * 60 * 60 * 1000, 'NOW()+24h branch must win when last_used is old');
+});
+
+t('clock-skew scenario (last_used_at = now + 5min) yields >24h ahead (never shortens)', () => {
+  const now = Date.now();
+  const lastUsed = now + 5 * 60 * 1000; // 5 min in the future (clock-skew)
+  const out = backfillExpiresAt(now, lastUsed);
+  // last_used + 24h wins; should be ~24h05m ahead.
+  const delta = out.getTime() - now;
+  assert.ok(delta > 24 * 60 * 60 * 1000, 'last_used+24h branch must win');
+});
+
+t('the supervisor scenario (last_used_at ~recent) gets a future expires_at', () => {
+  // The live overnight supervisor's session was used within the last hour.
+  // After this migration runs, its expires_at moves to ~now+24h. The supervisor
+  // then continues to make requests, each one refresh-on-use bumping
+  // expires_at to NOW()+1h on a rolling basis. It survives.
+  const now = Date.now();
+  const lastUsed = now - 15 * 60 * 1000; // 15 min ago
+  const out = backfillExpiresAt(now, lastUsed);
+  assert.ok(out.getTime() > now, 'supervisor session must survive the migration');
+});
+
+// ---------------------------------------------------------------------------
+// 2. Demotion-detection logic (mirrors setBuilderRank's hook)
+// ---------------------------------------------------------------------------
+// Live ranks per ADR 0018 / migration 029: 'archon' > 'metic' > 'xenos'.
+// Position later in db.RANKS = lower authority.
+function isDemotion(oldRank, newRank) {
+  const oldIdx = db.RANKS.indexOf(oldRank);
+  const newIdx = db.RANKS.indexOf(newRank);
+  if (oldIdx === -1 || newIdx === -1) return false;
+  return newIdx > oldIdx;
+}
+
+console.log('\ndemotion-detection (revoke-all hook in setBuilderRank):');
+
+t('archon → metic is a demotion (revoke triggers)', () => {
+  assert.equal(isDemotion('archon', 'metic'), true);
+});
+
+t('archon → xenos is a demotion (revoke triggers)', () => {
+  assert.equal(isDemotion('archon', 'xenos'), true);
+});
+
+t('metic → xenos is a demotion (revoke triggers)', () => {
+  assert.equal(isDemotion('metic', 'xenos'), true);
+});
+
+t('xenos → metic is a PROMOTION (no revoke)', () => {
+  assert.equal(isDemotion('xenos', 'metic'), false);
+});
+
+t('metic → archon is a PROMOTION (no revoke)', () => {
+  assert.equal(isDemotion('metic', 'archon'), false);
+});
+
+t('archon → archon (impossible at the call site, but defensive) is not a demotion', () => {
+  assert.equal(isDemotion('archon', 'archon'), false);
+});
+
+t('an unknown rank string does not crash and returns false', () => {
+  assert.equal(isDemotion('archon', 'not-a-rank'), false);
+  assert.equal(isDemotion('not-a-rank', 'archon'), false);
+});
+
+// ---------------------------------------------------------------------------
+// 3. TTL constant (criterion C9: idle-session hygiene)
+// ---------------------------------------------------------------------------
+// V3.R90 / #400: widened from 1h to 24h. Refresh-on-use is unchanged, so an
+// actively-used session is still indefinite — the constant only governs how
+// long an idle session lives. 1h kicked builders out over lunch; 24h still
+// kills idle sessions overnight. C7 (rank-change-near-instant) is unaffected
+// because demotion calls revokeAllSessionsForBuilder synchronously.
+
+console.log('\nSESSION_TTL_MS constant:');
+
+t('SESSION_TTL_MS is exactly 24 hours (86,400,000 ms)', () => {
+  assert.equal(db.SESSION_TTL_MS, 24 * 60 * 60 * 1000);
+});
+
+// ---------------------------------------------------------------------------
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/autonomous_fit_protected_paths.mjs

@@ -0,0 +1,115 @@
+// tests/autonomous_fit_protected_paths.mjs
+//
+// Unit smoke for the SR-12 / finding G2 hardening (task 994): the autonomous
+// overnight-builder's --fit claimable feed must EXCLUDE any task whose declared
+// touches[] reach the permission / methodology / deploy core (the ADR 0043
+// protected-path set). The runner ships as Archon straight to main, and every
+// write-side gate keys on the AUTHOR's rank — so a high-rank automated author
+// acting on attacker-seeded task text (idea_inbox.body_md → promoted task
+// description) would otherwise sail through. Keeping protected-path tasks out of
+// the autonomous pool is the HARD control that closes that path.
+//
+// We exercise the PURE, exported helper db.taskTouchesProtectedPath (no DB, no
+// network) and assert it shares the SINGLE canonical matcher with
+// permission-path-check.js (no second source of truth to drift).
+//
+// Run:  node tests/autonomous_fit_protected_paths.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+// taskTouchesProtectedPath carved to the lifecycle module at BV1.R86 (it wraps the
+// kernel matchProtected); permission-path-check (the matcher) stays core.
+const db = require('../modules/lifecycle/db.js');
+const ppc = require('../src/bongos/permission-path-check.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const isProtected = db.taskTouchesProtectedPath;
+
+t('the helper is exported and callable', () => {
+  assert.equal(typeof isProtected, 'function', 'db.taskTouchesProtectedPath must be exported');
+});
+
+// ---------- protected-path tasks are excluded ----------
+
+t('a task touching migrations/ is protected (never autonomous)', () => {
+  assert.equal(isProtected({ touches: ['migrations/099_thing.sql'] }), true);
+});
+
+t('a task touching the rank/auth machinery is protected', () => {
+  assert.equal(isProtected({ touches: ['src/bongos/auth.js'] }), true);
+  assert.equal(isProtected({ touches: ['src/bongos/db.js'] }), true);
+  assert.equal(isProtected({ touches: ['src/bongos/permission-path-check.js'] }), true);
+});
+
+t('a task touching the ship/grade/deploy pipeline is protected', () => {
+  assert.equal(isProtected({ touches: ['scripts/gds/ship.js'] }), true);
+  assert.equal(isProtected({ touches: ['modules/grading/grader.js'] }), true); // BV1.R73: grading carved to modules/grading/
+  assert.equal(isProtected({ touches: ['scripts/gds/push-main.js'] }), true);
+});
+
+t('a task touching the routes/ subtree (gates live here) is protected', () => {
+  assert.equal(isProtected({ touches: ['src/bongos/routes/inbox.js'] }), true);
+});
+
+t('a task touching the trust-boundary docs / methodology core is protected', () => {
+  assert.equal(isProtected({ touches: ['docs/canonical-permissions.md'] }), true);
+  assert.equal(isProtected({ touches: ['CLAUDE.md'] }), true);
+  assert.equal(isProtected({ touches: ['.github/workflows/deploy-prod.yml'] }), true);
+  assert.equal(isProtected({ touches: ['infra/builder-box-cloud-init.yaml'] }), true);
+});
+
+t('a MIX of one safe + one protected touch is still protected (any match wins)', () => {
+  assert.equal(isProtected({ touches: ['public/game/world/terrain.js', 'scripts/gds/ship.js'] }), true);
+});
+
+// ---------- ordinary builder work is NOT excluded ----------
+
+t('a pure game-surface task is NOT protected (autonomous-eligible)', () => {
+  assert.equal(isProtected({ touches: ['public/game/world/terrain.js'] }), false);
+  assert.equal(isProtected({ touches: ['public/game/main.js'] }), false);
+});
+
+t('an art-pipeline task is NOT protected', () => {
+  assert.equal(isProtected({ touches: ['art/generated/tiles/olive_tree.png'] }), false);
+});
+
+t('a builders-hall UI task is NOT protected', () => {
+  // the hall carved to modules/hall-ui/ in BV1.R85
+  assert.equal(isProtected({ touches: ['modules/hall-ui/public/app.js'] }), false);
+});
+
+// ---------- empty / missing touches fail SAFE for the feed ----------
+// touches[] is advisory at ship time (ADR 0049); an empty list is the common
+// honest case for a small game/doc task, not a danger signal. The exclusion
+// fires only on a POSITIVE match — and the fit pool is already overnight-safe +
+// manual_degree<=2 + unblocked, so an undeclared-touches task still goes through
+// the smoke + (server-guarded) grade gate.
+
+t('no declared touches[] is NOT excluded (advisory-touches, ADR 0049)', () => {
+  assert.equal(isProtected({ touches: [] }), false);
+  assert.equal(isProtected({}), false);
+  assert.equal(isProtected({ touches: null }), false);
+  assert.equal(isProtected(null), false);
+});
+
+// ---------- single source of truth (no drift) ----------
+
+t('the helper delegates to permission-path-check.matchProtected (single matcher)', () => {
+  // Anything matchProtected flags must be flagged by the task helper, and the
+  // helper must add nothing of its own — exercise both directions on a sample.
+  const sample = ['src/bongos/auth.js', 'public/game/main.js', 'migrations/x.sql'];
+  const expectProtected = ppc.matchProtected(sample).length > 0;
+  assert.equal(isProtected({ touches: sample }), expectProtected);
+  assert.equal(isProtected({ touches: ['public/game/main.js'] }), ppc.matchProtected(['public/game/main.js']).length > 0);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/autonomy_gate.mjs

@@ -0,0 +1,85 @@
+// tests/autonomy_gate.mjs — System 3 (task 1351). Pure decision logic of the
+// autonomy precheck. DB-free. BUILT DISABLED: the headline test is that while
+// the flag is off the gate is inert (always GO). Run: node tests/autonomy_gate.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const { decide, autofixAllowed, isEnabled, ceilingUsd, AUTONOMY_FLAG, DEFAULT_CEILING_USD } = require('../scripts/gds/autonomy-gate.js');
+
+let passed = 0, failed = 0;
+function test(name, fn) {
+  try { fn(); console.log(`  ok  ${name}`); passed++; }
+  catch (err) { console.error(`  FAIL ${name}`); console.error('    ', err.message); failed++; }
+}
+
+test('DISABLED → always GO (inert), regardless of signals', () => {
+  const r = decide({ enabled: false, routine: 'overnight-builder', claimableCount: 0, mtdSpendUsd: 9999, headSha: 'a', lastHeadSha: 'a' });
+  assert.equal(r.decision, 'go');
+  assert.match(r.reason, /disabled/);
+});
+
+test('isEnabled reads the master flag', () => {
+  assert.equal(isEnabled({}), false);
+  assert.equal(isEnabled({ [AUTONOMY_FLAG]: '0' }), false);
+  assert.equal(isEnabled({ [AUTONOMY_FLAG]: '1' }), true);
+});
+
+test('ENABLED + spend over ceiling → NO-GO (spend brake), even with signal', () => {
+  const r = decide({ enabled: true, routine: 'overnight-builder', claimableCount: 5, mtdSpendUsd: 40, ceiling: 30 });
+  assert.equal(r.decision, 'no-go');
+  assert.match(r.reason, /spend brake/);
+});
+
+test('ENABLED + builder routine, no claimable + main unchanged → NO-GO (no signal)', () => {
+  const r = decide({ enabled: true, routine: 'overnight-builder', claimableCount: 0, mtdSpendUsd: 1, ceiling: 30, headSha: 'abc', lastHeadSha: 'abc' });
+  assert.equal(r.decision, 'no-go');
+  assert.match(r.reason, /no signal/);
+});
+
+test('ENABLED + builder routine, main CHANGED since last run → GO (new work landed)', () => {
+  const r = decide({ enabled: true, routine: 'overnight-builder', claimableCount: 0, mtdSpendUsd: 1, ceiling: 30, headSha: 'new', lastHeadSha: 'old' });
+  assert.equal(r.decision, 'go');
+});
+
+test('ENABLED + builder routine, claimable work present → GO', () => {
+  const r = decide({ enabled: true, routine: 'overnight-builder', claimableCount: 3, mtdSpendUsd: 1, ceiling: 30, headSha: 'a', lastHeadSha: 'a' });
+  assert.equal(r.decision, 'go');
+});
+
+test('ENABLED + triage routine, no open ideas → NO-GO; with ideas → GO', () => {
+  assert.equal(decide({ enabled: true, routine: 'idea-triage-nightly', openIdeasCount: 0, mtdSpendUsd: 1, ceiling: 30 }).decision, 'no-go');
+  assert.equal(decide({ enabled: true, routine: 'idea-triage-nightly', openIdeasCount: 4, mtdSpendUsd: 1, ceiling: 30 }).decision, 'go');
+});
+
+test('ceilingUsd defaults + env override', () => {
+  assert.equal(ceilingUsd({}), DEFAULT_CEILING_USD);
+  assert.equal(ceilingUsd({ OTB_AUTONOMY_CEILING_USD: '50' }), 50);
+  assert.equal(ceilingUsd({ OTB_AUTONOMY_CEILING_USD: 'junk' }), DEFAULT_CEILING_USD);
+});
+
+// --- task 1354: safe_autofix lane gate -------------------------------------
+
+test('autofixAllowed: default (no args) is OFF — refuses', () => {
+  assert.equal(autofixAllowed(), false);
+  assert.equal(autofixAllowed({}), false);
+});
+
+test('autofixAllowed: all-green case allows', () => {
+  assert.equal(autofixAllowed({ enabled: true, graderBypassOn: false, isProtected: false, confidence: 'high', fileCount: 1 }), true);
+});
+
+test('autofixAllowed: NEVER while grader bypass is on (auto-ship w/o quality gate)', () => {
+  assert.equal(autofixAllowed({ enabled: true, graderBypassOn: true, isProtected: false, confidence: 'high', fileCount: 1 }), false);
+});
+
+test('autofixAllowed: never for a protected path, low confidence, or multi-file', () => {
+  const base = { enabled: true, graderBypassOn: false, isProtected: false, confidence: 'high', fileCount: 1 };
+  assert.equal(autofixAllowed({ ...base, isProtected: true }), false);
+  assert.equal(autofixAllowed({ ...base, confidence: 'low' }), false);
+  assert.equal(autofixAllowed({ ...base, fileCount: 2 }), false);
+  assert.equal(autofixAllowed({ ...base, enabled: false }), false);
+});
+
+console.log(`\nautonomy_gate: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);