@bongos/core 1.17.0

package/tests/fitness.mjs

@@ -0,0 +1,435 @@
+// tests/fitness.mjs — architecture fitness functions (task 1225 / Path C, ADR 0062 §9).
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const fitness = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
+
+test('all fitness checks pass with no hard failures (the CI gate)', () => {
+  const results = fitness.runAll();
+  const failed = results.filter((r) => r.hardFail);
+  assert.equal(failed.length, 0, 'hard failures:\n' + failed.map((r) => `  ${r.name}:\n` + r.violations.map((v) => '    - ' + v).join('\n')).join('\n'));
+});
+
+test('core↔host boundary holds — only grandfathered escapes present', () => {
+  const r = fitness.checkCoreHostBoundary();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+});
+
+test('core↔host boundary actually CATCHES a host-game import (not a no-op gate)', () => {
+  const coreFile = path.join(ROOT, 'src', 'bongos', 'routes', 'tasks.js');
+  // After BV1.R49 the game module lives in modules/game/ — a direct import from core is flagged.
+  // From src/bongos/routes/ (3 levels deep), '../../../' reaches the repo root.
+  assert.ok(fitness.resolvesToHostGame(coreFile, '../../../modules/game/rooms/WorldRoom'), 'importing a game room into the core must be flagged');
+  assert.ok(fitness.resolvesToHostGame(coreFile, '../../../modules/game/world/terrain'), 'importing game world code into the core must be flagged');
+  assert.ok(fitness.resolvesToHostGame(coreFile, '../../../modules/game/db'), 'game db helper is host-game code — flagged');
+  assert.equal(fitness.GRANDFATHERED.size, 0, 'zero grandfathered exceptions');
+  // intra-core import is fine
+  assert.equal(fitness.resolvesToHostGame(coreFile, '../auth'), null, 'intra-core import is allowed');
+});
+
+test('root CLAUDE.md budget: under the hard ceiling and charter present', () => {
+  const r = fitness.checkClaudeMdBudget();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+});
+
+test('CLAUDE.md char/token budget actually fires on within-line bloat (not a no-op)', () => {
+  // One enormous single line that contains the charter heading: it passes the LINE
+  // ceiling (1 line) and the charter check, so ONLY the char/token budget can flag
+  // it — proving the token guard is real (mirrors the boundary "actually catches" test).
+  const bloated = '## Working with this file (content charter) ' + 'x'.repeat(fitness.ROOT_CHAR_HARD_MAX + 1000);
+  const r = fitness.checkClaudeMdBudget({ text: bloated });
+  assert.equal(r.hardFail, true, 'a file over the char ceiling must hard-fail even with few lines');
+  assert.ok(r.violations.some((v) => /char/i.test(v) && /token/i.test(v)), 'the violation must name the char/token budget');
+});
+
+test('CLAUDE.md char budget is ratcheted and ordered (target < ceiling, live file under it)', () => {
+  assert.ok(fitness.ROOT_CHAR_TARGET < fitness.ROOT_CHAR_HARD_MAX, 'target must sit below the hard ceiling');
+  const r = fitness.checkClaudeMdBudget();
+  assert.equal(r.hardFail, false, 'the live CLAUDE.md must be under the char ceiling (ratchet locked in)');
+});
+
+test('nested CLAUDE.md present for every high-traffic dir', () => {
+  const r = fitness.checkNestedDocsPresent();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+  assert.deepEqual(fitness.HIGH_TRAFFIC, ['src/bongos', 'src/bongos/routes', 'scripts/gds']);
+});
+
+test('no route bypasses server-side rank checks (ADR 0016)', () => {
+  const r = fitness.checkRankGuards();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+});
+
+test('generated repo map is fresh (Path C enforces Path B)', () => {
+  const r = fitness.checkGeneratedArtifactsFresh();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+});
+
+test('deterministic cron routines: live routines are clean (no judgment instructions)', () => {
+  const r = fitness.checkDeterministicRoutines();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+});
+
+test('deterministic routine check actually CATCHES judgment + divergence (not a no-op)', () => {
+  const clean = fitness.scanDeterministicBody('clean', {
+    mode: 'deterministic',
+    steps: [{ command: 'node x.js', sink: 'none' }],
+    body: 'Runs the checker.\n```bash\nnode x.js\n```\nIt never pushes and does NOT edit files.',
+  });
+  assert.deepEqual(clean, [], 'clean body (negated boundaries) must pass: ' + clean.join('; '));
+
+  const push = fitness.scanDeterministicBody('bad', { mode: 'deterministic', steps: [{ command: 'node x.js' }], body: 'Then run git push origin main.' });
+  assert.ok(push.some((v) => /git push/.test(v)), 'a git push must be flagged');
+
+  const edit = fitness.scanDeterministicBody('bad', { mode: 'deterministic', steps: [{ command: 'node x.js' }], body: 'Use the `Edit` tool to fix the file.' });
+  assert.ok(edit.some((v) => /Edit\/Write/.test(v)), 'an Edit tool instruction must be flagged');
+
+  const diverge = fitness.scanDeterministicBody('bad', { mode: 'deterministic', steps: [{ command: 'node x.js' }], body: '```bash\nnode other.js --do\n```' });
+  assert.ok(diverge.some((v) => /diverge/.test(v)), 'a prose command not in steps must be flagged');
+
+  const nosteps = fitness.scanDeterministicBody('bad', { mode: 'deterministic', steps: [], body: 'nothing' });
+  assert.ok(nosteps.some((v) => /no steps/.test(v)), 'deterministic with no steps must be flagged');
+
+  // a non-deterministic routine is ignored entirely
+  assert.deepEqual(fitness.scanDeterministicBody('judg', { mode: 'judgment', steps: [], body: 'run git push' }), []);
+});
+
+// --- module boundary checks (BV1.R40 / task 1409, ADR 0083) ---
+
+test('module boundary: both checks pass (green) on the current tree', () => {
+  const a = fitness.checkCoreNeverImportsModule();
+  const b = fitness.checkModulesImportOnlyApi();
+  assert.equal(a.hardFail, false, a.violations.concat(a.warnings).join('\n'));
+  assert.equal(b.hardFail, false, b.violations.concat(b.warnings).join('\n'));
+  // modules/ now holds dev-box + art-pipeline (the M07/M08 moves); both import
+  // only the doorway and the core imports neither → zero findings even though
+  // the ratchet is now ENFORCING (BV1.R45).
+  assert.equal(a.violations.length + a.warnings.length, 0, 'core→module findings: ' + a.warnings.concat(a.violations).join('; '));
+  assert.equal(b.violations.length + b.warnings.length, 0, 'module→core findings: ' + b.warnings.concat(b.violations).join('; '));
+});
+
+test('module boundary ratchet is FLIPPED — enforcing by default (BV1.R45)', () => {
+  // the live default (nothing toggled) is enforcing: a new cross-boundary import
+  // is now a hard fail, not a warning. The note reflects the mode, and the clean
+  // post-M07 tree stays green.
+  const a = fitness.checkCoreNeverImportsModule();
+  const b = fitness.checkModulesImportOnlyApi();
+  assert.match(a.note, /ENFORCING/, 'core→module check must report ENFORCING');
+  assert.match(b.note, /ENFORCING/, 'module→core check must report ENFORCING');
+  assert.equal(a.hardFail, false, a.violations.join('\n'));
+  assert.equal(b.hardFail, false, b.violations.join('\n'));
+});
+
+test('resolvesToModule: a core require into modules/<key>/ is detected', () => {
+  const coreFile = path.join(ROOT, 'src', 'bongos', 'x.js');
+  assert.equal(fitness.resolvesToModule(coreFile, '../../modules/dev-box/box.js'), 'dev-box');
+  assert.equal(fitness.resolvesToModule(coreFile, './sibling.js'), null);
+});
+
+test('moduleImportViolation: doorway + intra-module OK; deep-core + sibling flagged', () => {
+  const f = path.join(ROOT, 'modules', 'demo', 'routes', 'x.js');
+  assert.equal(fitness.moduleImportViolation(f, '../../../src/module-api'), null, 'the doorway is allowed');
+  assert.equal(fitness.moduleImportViolation(f, '../db.js'), null, 'intra-module relative is allowed');
+  assert.equal(fitness.moduleImportViolation(f, 'express'), null, 'bare npm specs are allowed');
+  assert.match(fitness.moduleImportViolation(f, '../../../src/bongos/db') || '', /core internals/);
+  assert.match(fitness.moduleImportViolation(f, '../../dev-box/box') || '', /sibling module/);
+});
+
+test('module boundary actually CATCHES violations when enforcing (ratchet flip)', () => {
+  // prove the checks are not no-ops: with enforcing on, a synthetic violation hard-fails.
+  fitness._setModuleBoundaryEnforcing(true);
+  try {
+    const f = path.join(ROOT, 'modules', 'demo', 'x.js');
+    assert.ok(fitness.moduleImportViolation(f, '../../src/bongos/db'), 'deep-core import must be a violation');
+    // the live checks stay green (dev-box + art-pipeline are clean) even when enforcing
+    assert.equal(fitness.checkCoreNeverImportsModule().hardFail, false);
+    assert.equal(fitness.checkModulesImportOnlyApi().hardFail, false);
+  } finally {
+    fitness._setModuleBoundaryEnforcing(true); // restore the live default (ENFORCING, BV1.R45)
+  }
+});
+
+// --- core carries no module code (BV1.R45 / task 1414, ADR 0083 §Decision #4) ---
+
+test('core-carries-no-module-code: the live kernel machinery is clean', () => {
+  const r = fitness.checkCoreCarriesNoModuleCode();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+  // the check is live, not vacuous — it discovered the real module keys
+  // (incl. the net-new `demo` proof module, BV1.R52 / task 1424, `ideas`, BV1.R78,
+  // `security`, BV1.R79, `builder-settings`, BV1.R80, `onboarding`, BV1.R81,
+  // `sessions`, BV1.R82, `autonomy`, BV1.R83, `status-ui`, BV1.R84,
+  // `hall-ui`, BV1.R85, and the net-new `provisioning` feature module, ADR 0111)
+  assert.deepEqual(fitness.discoveredModuleKeys().sort(), ['art-pipeline', 'autonomy', 'builder-settings', 'character-anim', 'demo', 'dev-box', 'discord', 'economy', 'game', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'provisioning', 'security', 'sessions', 'status-ui']);
+});
+
+test('core-carries-no-module-code actually CATCHES a hardcoded key (and ignores comments)', () => {
+  // a key named in CODE is a violation
+  const hit = fitness.scanKernelForModuleKeys("if (key === 'dev-box') mountSpecially();", ['dev-box', 'art-pipeline']);
+  assert.ok(hit.some((v) => /dev-box/.test(v)), 'a hardcoded module key in code must be flagged');
+  // the same key in a comment / doc-example line is NOT a violation
+  const clean = fitness.scanKernelForModuleKeys("// e.g. logger('dev-box')\n * the dev-box doorway\nconst x = 1;", ['dev-box']);
+  assert.deepEqual(clean, [], 'a key on a comment line must be ignored: ' + clean.join('; '));
+  // token-delimited: `dev-box` must not fire inside the larger token `dev-boxes`
+  assert.deepEqual(fitness.scanKernelForModuleKeys("const x = 'dev-boxes';", ['dev-box']), [], 'a substring inside a larger token must not fire');
+  // no keys discovered → never fires (vacuous-safe before the first move)
+  assert.deepEqual(fitness.scanKernelForModuleKeys("mount('dev-box')", []), []);
+});
+
+// --- kernel imports no domain (BV1.R70, ADR 0091 §1) ---
+
+test('kernel-imports-no-domain: WARN-mode ratchet, the bounded roster is live', () => {
+  const r = fitness.checkKernelImportsNoDomain();
+  // It never reds the build (WARN-mode until tranche-2 carves clear the leaks)...
+  assert.equal(r.hardFail, false, 'must stay WARN-mode until the kernel is clean');
+  // ...and it is live, not vacuous — the roster is the real ~3.5k-LOC kernel, far
+  // wider than the original 6 machinery files.
+  assert.ok(fitness.KERNEL_FILES.length >= 15, `roster should be the full kernel, got ${fitness.KERNEL_FILES.length}`);
+  assert.ok(fitness.KERNEL_FILES.includes('src/bongos/db-kernel.js'), 'the R69 kernel db slice must be in the roster');
+  assert.ok(fitness.KERNEL_FILES.includes('src/bongos/auth.js'), 'the authz boundary must be in the roster');
+});
+
+test('kernel-imports-no-domain actually CATCHES a kernel→domain import (not a no-op)', () => {
+  const kset = new Set(fitness.KERNEL_FILES);
+  // a kernel file reaching a non-kernel core domain IS a leak
+  assert.equal(
+    fitness.kernelDomainImport('src/bongos/auth.js', './onboarding-state', kset),
+    'src/bongos/onboarding-state.js',
+    'a kernel→domain import must be flagged'
+  );
+  // kernel → kernel is clean
+  assert.equal(fitness.kernelDomainImport('src/bongos/auth.js', './pool', kset), null, 'kernel→kernel import must be clean');
+  assert.equal(fitness.kernelDomainImport('src/module-api.js', './bongos/db-kernel', kset), null, 'doorway→db-kernel must be clean');
+  // grandfathered infra/util is clean
+  assert.equal(fitness.kernelDomainImport('src/bongos/module-scope-map.js', './path-match', kset), null, 'kernel→path-match util must be clean');
+  assert.equal(fitness.kernelDomainImport('src/bongos/pool.js', '../db', kset), null, 'pool→raw base pool must be clean');
+  // a bare npm/node spec is never our concern
+  assert.equal(fitness.kernelDomainImport('src/bongos/auth.js', 'node:os', kset), null, 'a bare spec must be ignored');
+  // the still-fused db.js monolith IS a tracked leak (not allowlisted)
+  assert.equal(fitness.kernelDomainImport('src/module-api.js', './bongos/db', kset), 'src/bongos/db.js', 'reaching the db.js monolith must be flagged');
+});
+
+// --- module migrations additive + namespaced (BV1.R45 / task 1414, ADR 0083 §Decision #5) ---
+
+test('module-migrations-additive: the live tree is clean (no module migrations yet)', () => {
+  const r = fitness.checkModuleMigrationsAdditive();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+});
+
+test('module-migrations-additive actually CATCHES destructive + non-namespaced DDL', () => {
+  // the SQL namespace prefix derives from the key: dev-box → dev_box
+  assert.equal(fitness.moduleNamespace('dev-box'), 'dev_box');
+
+  // additive + namespaced → clean (table, index-on-own-table, additive ALTER)
+  const good = fitness.moduleMigrationViolations('dev-box',
+    'CREATE TABLE IF NOT EXISTS dev_box_runs (id serial primary key);\n' +
+    'CREATE INDEX idx_dev_box_runs_id ON dev_box_runs (id);\n' +
+    'ALTER TABLE dev_box_runs ADD COLUMN note text;');
+  assert.deepEqual(good, [], 'an additive, namespaced migration must pass: ' + good.join('; '));
+
+  // destructive DDL is rejected
+  assert.ok(fitness.moduleMigrationViolations('dev-box', 'DROP TABLE dev_box_runs;').some((v) => /destructive/i.test(v)), 'DROP TABLE must be flagged');
+  assert.ok(fitness.moduleMigrationViolations('dev-box', 'ALTER TABLE dev_box_runs DROP COLUMN note;').some((v) => /destructive/i.test(v)), 'ALTER … DROP must be flagged');
+  assert.ok(fitness.moduleMigrationViolations('dev-box', 'TRUNCATE dev_box_runs;').some((v) => /destructive/i.test(v)), 'TRUNCATE must be flagged');
+
+  // a CHECK-enum WIDENING (drop-if-exists + re-add the SAME-named constraint) is
+  // additive-in-spirit and ALLOWED (task 1978: provisioning gains 'standalone')
+  const widen = fitness.moduleMigrationViolations('dev-box',
+    'ALTER TABLE dev_box_runs DROP CONSTRAINT IF EXISTS dev_box_runs_shape_check;\n' +
+    "ALTER TABLE dev_box_runs ADD CONSTRAINT dev_box_runs_shape_check CHECK (shape IN ('a','b','c'));");
+  assert.deepEqual(widen, [], 'a CHECK-enum widening (drop+re-add same constraint) must pass: ' + widen.join('; '));
+  // but a BARE drop constraint (no matching re-add) is STILL destructive
+  assert.ok(fitness.moduleMigrationViolations('dev-box', 'ALTER TABLE dev_box_runs DROP CONSTRAINT dev_box_runs_shape_check;').some((v) => /destructive/i.test(v)), 'a bare DROP CONSTRAINT (no re-add) must still be flagged');
+
+  // a created object outside the <key>_ namespace is rejected
+  assert.ok(fitness.moduleMigrationViolations('dev-box', 'CREATE TABLE runs (id int);').some((v) => /namespace/i.test(v)), 'a table outside dev_box_ must be flagged');
+  // a module migration altering a CORE table is rejected (reach core via the seam)
+  assert.ok(fitness.moduleMigrationViolations('dev-box', 'ALTER TABLE builders ADD COLUMN x int;').some((v) => /namespace/i.test(v)), 'altering a core table must be flagged');
+
+  // a commented-out destructive line is ignored
+  assert.deepEqual(
+    fitness.moduleMigrationViolations('dev-box', '-- DROP TABLE dev_box_runs;\nCREATE TABLE dev_box_runs (id int);'),
+    [], 'a commented-out DROP must be ignored',
+  );
+});
+
+// --- Check 11b: migration filenames namespaced + no stem collision (ADR 0108 §5 / task 1885) ---
+
+test('migration-namespacing: the live tree is clean (all bare files grandfathered)', () => {
+  const r = fitness.checkMigrationNamespacing();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+  assert.ok(/core \+ /.test(r.note), 'note reports the per-source counts');
+});
+
+test('migration-namespacing actually CATCHES a new bare core migration (not a no-op gate)', () => {
+  // The pure helper the check is built on: a bare core migration ABOVE the legacy cutoff
+  // must be flagged as needing the core_ prefix (else it could collide with an instance/
+  // module migration across repos). Proves the gate has teeth without polluting the tree.
+  const migNs = require(path.join(ROOT, 'scripts', 'gds', 'migration-namespace.js'));
+  const v = migNs.filenameViolation('core', '188_new_bare.sql');
+  assert.ok(v && /core_-prefixed/.test(v), 'a new bare core migration must be flagged');
+  assert.equal(migNs.filenameViolation('core', 'core_188_new_bare.sql'), null, 'the namespaced form passes');
+});
+
+test('migration-namespacing actually CATCHES a cross-source stem collision (the silent-skip bug)', () => {
+  const migNs = require(path.join(ROOT, 'scripts', 'gds', 'migration-namespace.js'));
+  const collisions = migNs.stemCollisions([
+    { source: 'core', basename: '188_x.sql' },
+    { source: 'instance', basename: '188_x.sql' },
+  ]);
+  assert.equal(collisions.length, 1, 'a stem shared by two sources must be reported');
+  assert.equal(collisions[0].stem, '188_x');
+});
+
+// --- goal scope map imports PROTECTED_GLOBS (BV1.R54 / task 1508, ADR 0086 §7) ---
+
+test('scope map import check: the live module-scope-map.js passes', () => {
+  const r = fitness.checkScopeMapImportsProtected();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+});
+
+test('scope map import check actually CATCHES a re-declared / un-imported PROTECTED_GLOBS (not a no-op)', () => {
+  // clean: imports the single source + derives, no second list
+  const clean = fitness.scanScopeMapSource(
+    "const { PROTECTED_GLOBS } = require('./permission-path-check');\nconst p = PROTECTED_GLOBS;",
+  );
+  assert.deepEqual(clean, [], 'an importing source must pass: ' + clean.join('; '));
+
+  // re-declares the list (the SEC #863 second-list drift) → flagged
+  const copied = fitness.scanScopeMapSource(
+    "const { touchesOverlap } = require('./path-match');\nconst PROTECTED_GLOBS = ['migrations/'];",
+  );
+  assert.ok(copied.some((v) => /re-declares PROTECTED_GLOBS/.test(v)), 'a copied second list must be flagged');
+
+  // does not import permission-path-check at all → flagged
+  const missing = fitness.scanScopeMapSource("const x = require('./path-match');\n// no protected source");
+  assert.ok(missing.some((v) => /must IMPORT PROTECTED_GLOBS/.test(v)), 'a missing import must be flagged');
+});
+
+// --- hall widgets are registry-owned, not hardcoded (BV1.R75 / ADR 0062 §4) ---
+
+test('hall section registry check: the live index.html passes (no hardcoded sections)', () => {
+  const r = fitness.checkHallSectionRegistry();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+});
+
+test('hall section registry check actually CATCHES a hardcoded <section class="scroll"> (not a no-op)', () => {
+  // clean: an empty <main> — every widget comes from the registry.
+  const clean = fitness.scanHallSectionRegistry('<body><main></main></body>');
+  assert.deepEqual(clean, [], 'an empty <main> must pass: ' + clean.join('; '));
+
+  // a hardcoded hall section back in <main> → flagged.
+  const hardcoded = fitness.scanHallSectionRegistry(
+    '<main>\n  <section class="scroll" id="profile-scroll"><h2>Standing</h2></section>\n</main>',
+  );
+  assert.equal(hardcoded.length, 1, 'one inline hall section must be caught');
+
+  // a comment that merely MENTIONS the markup is NOT a violation (the carve note).
+  const commented = fitness.scanHallSectionRegistry(
+    '<!-- no <section class="scroll"> may be hardcoded into <main> -->\n<main></main>',
+  );
+  assert.deepEqual(commented, [], 'a comment mentioning the markup must not trip the scan');
+
+  // a non-scroll <section> in <main> (e.g. a future layout wrapper) is fine.
+  const otherSection = fitness.scanHallSectionRegistry('<main><section class="hero"></section></main>');
+  assert.deepEqual(otherSection, [], 'a non-widget <section> must not be flagged');
+});
+
+// --- the demo proof module: BV1.R52 / task 1424 (ADR 0083) ----------------------
+// The net-new `modules/demo/` module is the live acceptance proof for the module
+// system. These tests lock in BOTH directions: the live demo module is clean, AND
+// fitness REJECTS the two one-way-rule violations against the REAL demo paths
+// (a sibling-module import, and an ungated module write route).
+
+test('demo proof module is live + clean (boundary + rank + migration green)', () => {
+  // discovered with the other modules (asserted above) and clean on every gate.
+  assert.ok(fitness.discoveredModuleKeys().includes('demo'), 'demo is a discovered module');
+  assert.equal(fitness.checkModulesImportOnlyApi().hardFail, false, 'demo imports only the doorway');
+  assert.equal(fitness.checkCoreNeverImportsModule().hardFail, false, 'core never imports demo');
+  assert.equal(fitness.checkRankGuards().hardFail, false, 'demo write route is rank-gated');
+  assert.equal(fitness.checkModuleMigrationsAdditive().hardFail, false, 'demo migration is additive + namespaced');
+});
+
+test('demo RED-LINE (a): a cross-module import (demo → dev-box internals) is REJECTED', () => {
+  // the exact violation the BV1.R52 transcript injects: demo deep-importing a
+  // sibling module. moduleImportViolation runs on the real demo route path.
+  const demoRoute = path.join(ROOT, 'modules', 'demo', 'routes', 'demo.js');
+  const v = fitness.moduleImportViolation(demoRoute, '../../dev-box/box');
+  assert.ok(v && /sibling module "dev-box"/.test(v), 'demo importing dev-box internals must be flagged: ' + v);
+  // the doorway is still allowed (the legitimate single core import)
+  assert.equal(fitness.moduleImportViolation(demoRoute, '../../../src/module-api'), null, 'the doorway import is allowed');
+});
+
+test('demo RED-LINE (b): an ungated demo write route is REJECTED (hard fail)', () => {
+  // the route-rank classifier on an ungated POST → 'unknown' → blocker. (The
+  // classifier anchors on a `router.<method>(` declaration, so the router var
+  // must be named `router` — exactly as the real route file declares it.)
+  const ungated = "const express = require('express');\nmodule.exports = () => {\n  const router = express.Router();\n  router.post('/demo/ping', (req, res) => res.json({}));\n  return router;\n};\n";
+  const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
+  const ping = rrc.classifyText(ungated).find((c) => c.key === 'POST /demo/ping');
+  assert.ok(ping && ping.rank === 'unknown', 'an ungated POST must classify as unknown (→ blocker)');
+  // and the gated form the live module ships classifies to a known rank
+  const gated = "const api = require('../../../src/module-api');\nconst express = require('express');\nmodule.exports = () => {\n  const router = express.Router();\n  router.post('/demo/ping', api.requireRank('metic', 'archon'), (req, res) => res.json({}));\n  return router;\n};\n";
+  const gping = rrc.classifyText(gated).find((c) => c.key === 'POST /demo/ping');
+  assert.equal(gping.rank, 'metic+archon', 'the rank-gated write route classifies to a known rank');
+});
+
+// --- no hardcoded host identity in portable code (BV1.R76 / task 1705) ---
+
+test('identity gate: the live portable tree is clean (widened directory scan)', () => {
+  const r = fitness.checkKernelPromptsNoHardcodedIdentity();
+  assert.equal(r.hardFail, false, r.violations.join('\n'));
+  assert.equal(r.violations.length, 0, 'unexpected brand leaks: ' + r.violations.join('; '));
+  // prove it's a WIDE scan, not the old 9-file allowlist.
+  assert.match(r.note, /src\/bongos\/\*\* \+ modules\/\*\*/, 'the note must describe the directory-wide scan');
+  assert.ok(/(\d+) portable source/.exec(r.note)[1] > 50, 'a directory scan covers many files, not nine');
+});
+
+test('identity gate actually CATCHES a re-hardcode (code, URL, HTML) — not a no-op', () => {
+  const { scanPromptIdentity } = fitness;
+  assert.equal(scanPromptIdentity('x.js', 'const t = "Amazonprimea";').length, 1, 'a bare code literal must be caught');
+  // the ://-safe comment strip must NOT hide a literal inside a URL
+  assert.equal(scanPromptIdentity('x.js', 'const u = "https://amazonprimea.com/x";').length, 1, 'a leak inside a URL must be caught');
+  assert.equal(scanPromptIdentity('x.html', '<title>Amazonprimea</title>').length, 1, 'an HTML title leak must be caught');
+  assert.equal(scanPromptIdentity('x.js', 'const p = "Off the Boats";').length, 1, 'the product name must be caught');
+});
+
+test('identity gate skips comments + instance-injected tokens (no false positives)', () => {
+  const { scanPromptIdentity } = fitness;
+  assert.equal(scanPromptIdentity('x.js', '// see amazonprimea.com for context').length, 0, 'a full-line comment is skipped');
+  assert.equal(scanPromptIdentity('x.js', 'doThing(); // amazonprimea note').length, 0, 'a trailing comment is skipped');
+  assert.equal(scanPromptIdentity('x.js', '/* Amazonprimea history */\nconst ok = 1;').length, 0, 'a block comment is skipped');
+  assert.equal(scanPromptIdentity('x.html', '<!-- Amazonprimea note -->').length, 0, 'an HTML comment is skipped');
+  assert.equal(scanPromptIdentity('x.html', '<title>{{worldName}} — the gate</title>').length, 0, 'a {{worldName}} token carries no literal');
+});
+
+// --- write-route validation build check (BV1.R12 / task 1999, ADR 0118) ---
+
+test('write-route validation check: the live tree is clean (R11 sweep reached 100%)', () => {
+  const r = fitness.checkWriteRoutesValidated();
+  assert.equal(r.hardFail, false, 'unvalidated write routes:\n' + r.violations.join('\n'));
+  assert.ok(/dynamic-key prefs routes validate by lib/.test(r.note), 'note explains the exemption');
+});
+
+test('write-route validation check actually CATCHES an unvalidated write route (not a no-op)', () => {
+  const { scanUnvalidatedWriteRoutes } = fitness;
+  const model = [
+    { method: 'POST',  route: '/widgets',       body: { readsBody: true,  validated: false }, file: 'x.js' }, // BAD
+    { method: 'POST',  route: '/gadgets',       body: { readsBody: true,  validated: true  }, file: 'x.js' }, // ok — validated
+    { method: 'POST',  route: '/pings',         body: { readsBody: false, validated: false }, file: 'x.js' }, // ok — reads no body
+    { method: 'GET',   route: '/widgets',       body: { readsBody: true,  validated: false }, file: 'x.js' }, // ok — not a write
+    { method: 'PATCH', route: '/me/render',     body: { readsBody: true,  validated: false }, file: 'x.js' }, // ok — exempt (dynamic-key)
+    { method: 'PUT',   route: '/things/:id',    body: null,                                    file: 'x.js' }, // ok — no body model
+  ];
+  const flagged = scanUnvalidatedWriteRoutes(model);
+  assert.equal(flagged.length, 1, 'exactly the one unvalidated body-reading write route is flagged: ' + JSON.stringify(flagged));
+  assert.ok(/POST \/widgets/.test(flagged[0]), 'the offending route is named');
+});
+
+test('write-route validation exemptions are the known dynamic-key prefs routes only', () => {
+  const exempt = [...fitness.WRITE_VALIDATION_EXEMPT];
+  assert.ok(exempt.length >= 1 && exempt.every((e) => e.startsWith('PATCH /me/')), 'exemptions are all /me/* prefs patches: ' + exempt.join(', '));
+});

package/tests/fitness_two_root.mjs

@@ -0,0 +1,104 @@
+// tests/fitness_two_root.mjs
+//
+// ADR 0108 §Consequences #4 (configurable-root W6 / task 1886) — prove the guardrails resolve
+// INSTANCE content through resolveInstanceRoot(), not a hardcoded repo root. If the split were a
+// no-op (still `__dirname/../..`), pointing OTB_INSTANCE_ROOT at a different tree would change
+// NOTHING. These tests DIVERGE the roots (real core root, temp instance root) and assert the
+// instance-owned reads follow the instance root — impossible with the old single hardcoded root.
+//
+// The roots are captured at module-require time, so each case runs fitness/the generators in a
+// CHILD process with OTB_INSTANCE_ROOT set (OTB_ is an accepted legacy env prefix; ADR 0108 §1).
+//
+// Run:  node tests/fitness_two_root.mjs
+
+import { strict as assert } from 'node:assert';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, mkdirSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// Run a snippet of node with OTB_INSTANCE_ROOT set, returning parsed stdout JSON.
+function runWith(instanceRoot, snippet) {
+  const out = execFileSync(process.execPath, ['-e', snippet], {
+    encoding: 'utf8',
+    env: { ...process.env, OTB_INSTANCE_ROOT: instanceRoot },
+    cwd: ROOT,
+  });
+  return JSON.parse(out);
+}
+
+// ---- fitness: the CLAUDE.md-budget check reads the INSTANCE's CLAUDE.md --------------------
+t('checkClaudeMdBudget reads the CLAUDE.md at resolveInstanceRoot(), not a hardcoded root', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'w6-inst-'));
+  // Oversized CLAUDE.md WITH the charter heading, so ONLY the char/token budget can fire. This
+  // violation can appear only if the check read THIS fixture (the real repo CLAUDE.md is well under
+  // the ceiling), which proves the read followed OTB_INSTANCE_ROOT.
+  writeFileSync(join(dir, 'CLAUDE.md'), '## Working with this file (content charter)\n' + 'x'.repeat(60000));
+  const r = runWith(dir, `
+    const f = require(${JSON.stringify(join(ROOT, 'scripts/gds/fitness.js'))});
+    process.stdout.write(JSON.stringify(f.checkClaudeMdBudget()));
+  `);
+  assert.equal(r.hardFail, true, 'the fixture CLAUDE.md is over the char ceiling → must hard-fail');
+  assert.ok(r.violations.some((v) => /char/i.test(v)), 'the char/token budget violation must fire');
+});
+
+t('checkClaudeMdBudget still PASSES when the instance root is the real repo (byte-identical default)', () => {
+  const r = runWith(ROOT, `
+    const f = require(${JSON.stringify(join(ROOT, 'scripts/gds/fitness.js'))});
+    process.stdout.write(JSON.stringify(f.checkClaudeMdBudget()));
+  `);
+  assert.equal(r.hardFail, false, 'the live CLAUDE.md is under the ceiling');
+});
+
+// ---- fitness: core checks stay on the CORE root regardless of instance root ------------------
+t('checkNestedDocsPresent stays clean even with a divergent (empty) instance root', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'w6-inst-'));
+  // HIGH_TRAFFIC nested docs (src/bongos, scripts/gds, …) are CORE — they must still resolve against
+  // the real core root even though the instance root is an empty temp dir. If they wrongly used the
+  // instance root, all three would be "missing" → hard fail.
+  const r = runWith(dir, `
+    const f = require(${JSON.stringify(join(ROOT, 'scripts/gds/fitness.js'))});
+    process.stdout.write(JSON.stringify(f.checkNestedDocsPresent()));
+  `);
+  assert.equal(r.hardFail, false, 'core nested docs resolve against the core root, not the instance root');
+});
+
+// ---- gen-file-map: resolves entirely against the INSTANCE root ------------------------------
+t('gen-file-map lists the INSTANCE root .claude/skills, not the core repo', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'w6-inst-'));
+  mkdirSync(join(dir, '.claude', 'skills', 'only-one-skill'), { recursive: true });
+  mkdirSync(join(dir, '.claude', 'scheduled-tasks'), { recursive: true });
+  const model = runWith(dir, `
+    const path = require('node:path');
+    const g = require(${JSON.stringify(join(ROOT, 'scripts/gds/gen-file-map.js'))});
+    process.stdout.write(JSON.stringify(g.buildModel()));
+  `);
+  const skills = model.find((s) => s.id === 'skills');
+  assert.ok(skills, 'a skills section is present');
+  assert.deepEqual(skills.entries.map((e) => e.name), ['only-one-skill'],
+    'gen-file-map read the temp instance .claude/skills (one dir), not the real repo (~30 skills)');
+});
+
+// ---- gen-repo-map: still maps CORE code when the instance root diverges ----------------------
+t('gen-repo-map maps CORE files (fitness.js) regardless of a divergent instance root', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'w6-inst-')); // empty instance root
+  const model = runWith(dir, `
+    const g = require(${JSON.stringify(join(ROOT, 'scripts/gds/gen-repo-map.js'))});
+    const m = g.buildModel();
+    process.stdout.write(JSON.stringify({ files: m.files.length, hasFitness: m.byFile.some((f) => f.rel === 'scripts/gds/fitness.js') }));
+  `);
+  assert.ok(model.files > 50, `core scan should still find many files (got ${model.files})`);
+  assert.equal(model.hasFitness, true, 'the core file scripts/gds/fitness.js is mapped from the core root');
+});
+
+console.log(`\nfitness_two_root: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/fixtures/session-506-digest.json

@@ -0,0 +1,34 @@
+{
+  "_comment": "Hand-built #506-shaped session digest (6D.5, ADR 0027). The real 2026-06-01 #506 transcript is not retained locally, so this is a faithful reconstruction of the post-mortem's documented shape: a one-line welcome-copy fix (2 work turns) drowned in GDS plumbing + footgun recovery (~94% overhead), with the three hand-labelled footguns that became #513/#514/#468. Identity is generic per V3.R12. This is the regression gate's INPUT — session-eval.js must keep reproducing the findings the test asserts.",
+  "session_id": "fixture506-0000-0000-0000-000000000506",
+  "github_login": "session-506-builder",
+  "rank": "archon",
+  "task_ids": [506],
+  "total_tokens": 28670,
+  "duration_seconds": 5400,
+  "metrics": {
+    "assistant_turns": 9,
+    "user_turns": 6,
+    "tool_use_count": 9,
+    "tool_result_count": 6,
+    "tool_error_count": 3
+  },
+  "detail": [
+    { "i": 0, "role": "assistant", "tools": ["Bash"], "snippet": "node scripts/gds/start.js — survey claimable", "in": 4000, "out": 150, "cache_read": 0, "cache_creation": 0 },
+    { "i": 1, "role": "assistant", "tools": ["Bash"], "snippet": "node scripts/gds/claim.js 506", "in": 3500, "out": 120, "cache_read": 0, "cache_creation": 0 },
+    { "i": 2, "role": "user", "tool_results": 1 },
+    { "i": 3, "role": "assistant", "tools": ["Read"], "snippet": "read the welcome copy string in public/", "in": 1000, "out": 80, "cache_read": 0, "cache_creation": 0 },
+    { "i": 4, "role": "assistant", "tools": ["Edit"], "snippet": "change the one welcome-copy line", "in": 500, "out": 60, "cache_read": 0, "cache_creation": 0 },
+    { "i": 5, "role": "user", "tool_results": 1 },
+    { "i": 6, "role": "assistant", "tools": ["Bash"], "snippet": "node scripts/gds/ship.js 506 --kind chore", "in": 5000, "out": 200, "cache_read": 0, "cache_creation": 0 },
+    { "i": 7, "role": "user", "tool_results": 1, "tool_errors": 1, "snippet": "error: bad_kind — kind must be one of: feature, bug, infra, refactor" },
+    { "i": 8, "role": "assistant", "tools": ["Bash"], "snippet": "retry node scripts/gds/ship.js 506 --kind feature", "in": 3000, "out": 150, "cache_read": 0, "cache_creation": 0 },
+    { "i": 9, "role": "user", "tool_results": 1, "tool_errors": 1, "snippet": "status_not_patchable: status is not editable via PATCH; use POST /tasks/:id/promote" },
+    { "i": 10, "role": "assistant", "tools": ["Bash"], "snippet": "try PATCH status then the promote route", "in": 2800, "out": 130, "cache_read": 0, "cache_creation": 0 },
+    { "i": 11, "role": "user", "tool_results": 1, "tool_errors": 1, "snippet": "smoke-write.sh: FAIL 4c assertion expected confirmed got completed — 1 failed" },
+    { "i": 12, "role": "assistant", "tools": ["Bash"], "snippet": "node scripts/gds/ship.js 506 — subagent grader v4: panel of 4 workers", "in": 4500, "out": 300, "cache_read": 0, "cache_creation": 0 },
+    { "i": 13, "role": "user", "tool_results": 1 },
+    { "i": 14, "role": "assistant", "tools": ["Bash"], "snippet": "psql realign description; git merge --no-ff; push; deploy", "in": 3000, "out": 180, "cache_read": 0, "cache_creation": 0 },
+    { "i": 15, "role": "user", "tool_results": 1 }
+  ]
+}