@bongos/core 1.17.0

package/tests/goal_abuse_matrix.mjs

@@ -0,0 +1,187 @@
+// tests/goal_abuse_matrix.mjs — the goal wall's ABUSE MATRIX (BV1.R61, ADR 0086 §7).
+//
+// "How the boundary holds," made executable. The goal-scoped work hierarchy lets a
+// lower-rank builder AUTHOR their own tasks under a goal (POST /goals/:id/tasks) —
+// the maneuverability grant. This file is the single DOCUMENTED enumeration of every
+// way a member might try to escape the wall and the exact server response that stops
+// them. It runs the PURE decision core (no DB, no network): the ordered gate
+// `authorizeGoalTaskCreate`, the auto-derived rank floor (ADR 0084), the route-source
+// contract, and the route-rank PINS that keep the wall from drifting.
+//
+// THE MATRIX (attacker = a joined sub-Metic member unless a row says otherwise; goal
+// open + version open unless the row overrides it):
+//
+//   #   attack vector                                        → server response
+//   ──  ─────────────────────────────────────────────────     ──────────────────────
+//   A   in-scope task, joined member (the grant)             → ALLOW
+//   B   out-of-scope touch (a module the goal doesn't own)   → 403 out_of_scope
+//   C   protected-core touch, in a protected-scope goal      → 403 protected_path
+//   D   author in a goal they never joined                   → 403 not_a_member
+//   E   self-raised-rank escape (claim past the floor)       → auto-floor to metic; unclaimable
+//   F   a closed / archived goal                             → 409 goal_not_open
+//   G   a shipped (closed) version                           → 409 version_closed
+//   H   a scopeless goal (authorizes nothing)                → 403 empty_scope
+//   I   a goal whose modules resolve to no territory         → 403 unknown_scope
+//   J   scope bounds EVERYONE — even an Archon out-of-scope  → 403 out_of_scope
+//   K   self-join a protected-scope goal (membership wall)   → blocked (Archon-mediated)
+//   N1  a goal that doesn't exist                            → 404 goal_not_found
+//   N2  a goal whose version vanished                        → 404 version_not_found
+//   O1  ordering: non-member + out-of-scope                  → not_a_member (no scope hint leaks)
+//   O2  ordering: a closed goal short-circuits first         → goal_not_open
+//   P   Metic+ on an in-scope protected path                 → ALLOW (rank clears the floor)
+//
+// Ordering is fail-closed (a missing/ambiguous input denies), and membership is
+// checked BEFORE scope so a non-member never learns the scope (O1 vs B). Per-branch
+// request-validation schemas live in tests/goal_routes.mjs; the pure two-wall
+// internals in tests/goal_scope_check.mjs; the pin-DRIFT catch-violation in
+// tests/module_route_rank.mjs. This file is the consolidated threat model that ties
+// them together.
+//
+// Run:  node tests/goal_abuse_matrix.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { makeRunner } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const buildGoalsRouter = require('../modules/lifecycle/routes/goals.js');
+// The pure, exported, ordered create gate — the one place the decision is made.
+const { authorizeGoalTaskCreate } = buildGoalsRouter;
+const { deriveRequiredRank, highestRank } = require('../modules/lifecycle/db.js');
+const { MODULE_EXPECTED_RANKS, checkRouteRanks } = require('../src/bongos/route-rank-check.js');
+const { scopeIncludesProtected, protectedModules, isModuleKey } = require('../src/bongos/module-scope-map.js');
+
+const goalsSrc = readFileSync(new URL('../modules/lifecycle/routes/goals.js', import.meta.url), 'utf8');
+const { test, summary } = makeRunner();
+
+// ---- fixtures: grounded in real module-map facts (anchored below) ----
+// `ideas` is a NON-protected module (globs modules/ideas/…); `lifecycle` is PROTECTED
+// (its globs include migrations/). Verified against the live module-scope-map +
+// goal-scope-check in the session log.
+const V_OPEN = { id: 'BONGOS-V1', status: 'planning' };
+const V_SHIPPED = { id: 'V1', status: 'shipped' };
+const G_IDEAS = { id: 5, version_id: 'BONGOS-V1', status: 'open', scope_modules: ['ideas'] };
+const G_LIFECYCLE = { id: 6, version_id: 'BONGOS-V1', status: 'open', scope_modules: ['lifecycle'] };
+const G_ARCHIVED = { id: 7, version_id: 'BONGOS-V1', status: 'archived', scope_modules: ['ideas'] };
+const G_EMPTY = { id: 8, version_id: 'BONGOS-V1', status: 'open', scope_modules: [] };
+const G_UNKNOWN = { id: 9, version_id: 'BONGOS-V1', status: 'open', scope_modules: ['not-a-real-module'] };
+const IN_SCOPE = ['modules/ideas/routes/inbox.js'];
+const OUT_SCOPE = ['src/bongos/db.js'];
+const PROTECTED = ['migrations/999_goal_authored.sql'];
+
+await test('fixtures: ideas is a real UNprotected module; lifecycle is protected (anchors the matrix)', () => {
+  assert.ok(isModuleKey('ideas') && isModuleKey('lifecycle'), 'both fixture modules must be real');
+  assert.ok(!protectedModules().includes('ideas'), 'ideas must be unprotected for the maneuverability vectors');
+  assert.ok(protectedModules().includes('lifecycle'), 'lifecycle owns migrations/ + routes/ so it is protected');
+});
+
+// ---- the matrix: run every vector through the ordered gate ----
+const MATRIX = [
+  { id: 'A', desc: 'in-scope task, joined member — the maneuverability grant', goal: G_IDEAS, version: V_OPEN, isMember: true, rank: 'xenos', touches: IN_SCOPE, expect: { ok: true } },
+  { id: 'B', desc: 'out-of-scope touch (a module the goal does not own)', goal: G_IDEAS, version: V_OPEN, isMember: true, rank: 'xenos', touches: OUT_SCOPE, expect: { status: 403, error: 'out_of_scope' } },
+  { id: 'C', desc: 'sub-Metic authoring into the protected core (protected-scope goal)', goal: G_LIFECYCLE, version: V_OPEN, isMember: true, rank: 'xenos', touches: PROTECTED, expect: { status: 403, error: 'protected_path' } },
+  { id: 'D', desc: 'author in a goal they never joined', goal: G_IDEAS, version: V_OPEN, isMember: false, rank: 'xenos', touches: IN_SCOPE, expect: { status: 403, error: 'not_a_member' } },
+  { id: 'F', desc: 'a closed / archived goal takes no new work', goal: G_ARCHIVED, version: V_OPEN, isMember: true, rank: 'metic', touches: IN_SCOPE, expect: { status: 409, error: 'goal_not_open' } },
+  { id: 'G', desc: 'a shipped (closed) version takes no new work', goal: { ...G_IDEAS, version_id: 'V1' }, version: V_SHIPPED, isMember: true, rank: 'metic', touches: IN_SCOPE, expect: { status: 409, error: 'version_closed' } },
+  { id: 'H', desc: 'a scopeless goal authorizes nothing', goal: G_EMPTY, version: V_OPEN, isMember: true, rank: 'metic', touches: IN_SCOPE, expect: { status: 403, error: 'empty_scope' } },
+  { id: 'I', desc: 'a goal whose modules resolve to no territory fails closed', goal: G_UNKNOWN, version: V_OPEN, isMember: true, rank: 'metic', touches: IN_SCOPE, expect: { status: 403, error: 'unknown_scope' } },
+  { id: 'J', desc: 'scope bounds EVERYONE — even an Archon is blocked out-of-scope', goal: G_IDEAS, version: V_OPEN, isMember: true, rank: 'archon', touches: OUT_SCOPE, expect: { status: 403, error: 'out_of_scope' } },
+  { id: 'N1', desc: 'a goal that does not exist', goal: null, version: null, isMember: false, rank: 'xenos', touches: IN_SCOPE, expect: { status: 404, error: 'goal_not_found' } },
+  { id: 'N2', desc: 'a goal whose version vanished', goal: G_IDEAS, version: null, isMember: true, rank: 'xenos', touches: IN_SCOPE, expect: { status: 404, error: 'version_not_found' } },
+  { id: 'O1', desc: 'ordering: non-member + out-of-scope → not_a_member (no scope hint leaks)', goal: G_IDEAS, version: V_OPEN, isMember: false, rank: 'xenos', touches: OUT_SCOPE, expect: { status: 403, error: 'not_a_member' } },
+  { id: 'O2', desc: 'ordering: a closed goal short-circuits before membership/scope', goal: G_ARCHIVED, version: V_SHIPPED, isMember: false, rank: 'xenos', touches: OUT_SCOPE, expect: { status: 409, error: 'goal_not_open' } },
+  { id: 'P', desc: 'Metic+ clears the protected floor on an in-scope protected path', goal: G_LIFECYCLE, version: V_OPEN, isMember: true, rank: 'metic', touches: PROTECTED, expect: { ok: true } },
+];
+
+for (const row of MATRIX) {
+  await test(`[${row.id}] ${row.desc}`, () => {
+    const d = authorizeGoalTaskCreate({
+      goal: row.goal, version: row.version, isMember: row.isMember, builderRank: row.rank, touches: row.touches,
+    });
+    if (row.expect.ok) {
+      assert.equal(d.ok, true, `[${row.id}] expected ALLOW, got ${JSON.stringify(d)}`);
+    } else {
+      assert.equal(d.ok, false, `[${row.id}] expected a rejection`);
+      assert.equal(d.status, row.expect.status, `[${row.id}] HTTP status`);
+      assert.equal(d.body.error, row.expect.error, `[${row.id}] error code`);
+    }
+  });
+}
+
+await test('[B+] a mixed touch list rejects and names ONLY the out-of-scope offender', () => {
+  const d = authorizeGoalTaskCreate({
+    goal: G_IDEAS, version: V_OPEN, isMember: true, builderRank: 'xenos',
+    touches: ['modules/ideas/a.js', 'src/bongos/db.js', 'modules/ideas/b.js'],
+  });
+  assert.equal(d.body.error, 'out_of_scope');
+  assert.deepEqual(d.body.details.out_of_scope, ['src/bongos/db.js'], 'only the true out-of-scope path is named');
+});
+
+// ---- [E] no self-raised-rank escape (the floor is auto-derived, ADR 0084) ----
+// The gate never trusts a client rank; requires_rank is DERIVED and can only be
+// RAISED. So a sub-Metic cannot mint a task they could then claim past the boundary:
+// an in-scope non-protected task derives to their own floor (claimable), a
+// protected/sensitive one auto-floors to metic (NOT claimable by them), and an
+// explicit request only raises. The route never forwards a client rank or version.
+await test('[E] floor: an in-scope non-protected task derives to xenos (author can claim their own work)', () => {
+  assert.equal(deriveRequiredRank(IN_SCOPE, false), 'xenos');
+});
+await test('[E] floor: a protected-path task auto-floors to metic — a sub-Metic author cannot claim it', () => {
+  assert.equal(deriveRequiredRank(PROTECTED, false), 'metic');
+});
+await test('[E] floor: an explicit requested rank can only RAISE, never drop below the derived floor', () => {
+  assert.equal(highestRank('metic', 'xenos'), 'metic'); // requesting xenos cannot escape a metic floor
+  assert.equal(highestRank('xenos', 'archon'), 'archon'); // an explicit value only raises
+});
+await test('[E] route contract: goals.js never forwards a client requiresRank into createTask', () => {
+  assert.ok(!/requiresRank\s*:/.test(goalsSrc), 'goals.js must not pass requiresRank to createTask — the floor auto-derives (ADR 0084)');
+});
+await test('[E] route contract: the authored task version is DERIVED from the goal, not client input', () => {
+  assert.ok(/versionId:\s*goal\.version_id/.test(goalsSrc), 'createTask must use goal.version_id — a member cannot author cross-version');
+});
+
+// ---- [K] the membership wall (distinct from task authoring) ----
+// A sub-Metic cannot SELF-JOIN a protected-scope goal: POST /goals/:id/join fires
+// `scopeIncludesProtected(scope) && rank !== 'archon' → 403`, and admission runs
+// through POST /goals/:id/members — widened from Archon-only to the goal's own
+// owner/manager (task 1762), but still Archon-only IN-HANDLER when the goal's
+// scope is protected (archon_required_for_protected_scope). We assert the pure
+// predicate the route branches on (the single protected roster, module-scope-map).
+await test('[K] a protected-scope goal is recognized as protected; a normal goal is open-join', () => {
+  assert.equal(scopeIncludesProtected(G_LIFECYCLE.scope_modules), true, 'lifecycle owns migrations/ → protected → Archon-mediated join');
+  assert.equal(scopeIncludesProtected(G_IDEAS.scope_modules), false, 'ideas is a normal, open-join module');
+});
+
+// ---- the pins that make a rank drift on a goal route a red build (BV1.R61) ----
+// The wall is only drift-proof if the goal routes are PINNED and the LIVE routes
+// classify to those pins. The catch-violation (a downgrade → blocker) is proven in
+// tests/module_route_rank.mjs; here we assert the pins exist and match reality.
+await test('[pin] every goal route is pinned in MODULE_EXPECTED_RANKS.lifecycle', () => {
+  const pins = MODULE_EXPECTED_RANKS.lifecycle || {};
+  assert.equal(pins['POST /goals/:id/tasks'], 'any-builder', 'the enforcement keystone must be pinned');
+  assert.equal(pins['POST /goals/:id/join'], 'any-builder');
+  assert.equal(pins['POST /goals/:id/leave'], 'any-builder');
+  assert.equal(pins['POST /goals/:id/archive'], 'metic+archon');
+  assert.equal(pins['POST /goals/:id/reopen'], 'metic+archon');
+  assert.equal(pins['POST /goals'], 'metic+archon');
+  assert.equal(pins['POST /goals/:id/members'], 'any-builder', 'task 1762: widened to owner|lead|archon, in-handler gate');
+  assert.equal(pins['POST /goals/:id/scope'], 'metic+archon');
+  assert.equal(pins['POST /goals/reorder'], 'archon', 'priority is an owner decision, never self-granted');
+});
+await test('[pin] LIVE: every pinned goal route classifies to its expected rank (a drift would mismatch)', () => {
+  const res = checkRouteRanks();
+  const byKey = new Map();
+  for (const r of res.routes) if (!byKey.has(r.key)) byKey.set(r.key, r);
+  const pins = MODULE_EXPECTED_RANKS.lifecycle || {};
+  for (const [key, expected] of Object.entries(pins)) {
+    if (!key.includes('/goals')) continue; // this suite owns the goal-route pins
+    const r = byKey.get(key);
+    assert.ok(r, `pinned goal route ${key} must exist in the live route set`);
+    assert.equal(r.rank, expected, `goal route ${key} must classify as '${expected}', got '${r.rank}'`);
+  }
+});
+
+summary();

package/tests/goal_achievement.mjs

@@ -0,0 +1,146 @@
+// tests/goal_achievement.mjs
+//
+// Unit guard for the criterion-confirm → goal-auto-achieve flow (ADR 0086 §6,
+// BV1.R63 / task 1517):
+//   - db.achieveGoalIfComplete — flips a goal open→achieved when its LAST
+//     criterion is confirmed; conservative on every other shape.
+//   - done-when.listPendingReviewCriteria — the review-queue read (the auto-flag
+//     SQL: ≥1 linked task, all shipped, not yet satisfied).
+//
+// DB-free, same posture as goal_tier.mjs: each helper honours the #538 deps.pool
+// injection seam (ONLY when NODE_ENV==='test'), so a SQL-aware fake client drives
+// it with no live Postgres. We assert the statement shapes, the bound params, and
+// — crucially for the auto-achieve — WHICH statements run on each goal shape (an
+// UPDATE must fire only when the goal actually completes).
+//
+// The pure auto-flag derivation (buildCriterionProgress → pending_review) is
+// covered alongside its siblings in criterion_progress.mjs.
+//
+// Run:  node tests/goal_achievement.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const { achieveGoalIfComplete } = require('../modules/lifecycle/db.js');
+const { listPendingReviewCriteria } = require('../modules/lifecycle/done-when.js');
+
+const { test, summary } = makeRunner();
+
+function fakePool(handler) {
+  const c = makeSqlAwareClient(handler);
+  return { query: (sql, params) => c._client.query(sql, params), connect: c.connect, queries: c._client.queries };
+}
+const find = (queries, re) => queries.find((q) => re.test(String(q.sql).replace(/\s+/g, ' ')));
+
+const GOAL = (over = {}) => ({
+  id: 7, version_id: 'BONGOS-V1', title: 'Goal hierarchy', description: null,
+  scope_modules: [], status: 'open', created_by: 42, succeeded_by_goal_id: null,
+  created_at: 'T0', updated_at: 'T0', ...over,
+});
+
+// A handler factory: respond to getGoal / the criteria count / setGoalStatus.
+// `counts` = { total, unsatisfied }; `goal` = the row getGoal returns (or null).
+function goalHandler({ goal, counts }) {
+  return (s) => {
+    if (/^SELECT .*FROM goals WHERE id = \$1/.test(s)) return { rows: goal ? [goal] : [] };
+    if (/FROM done_when_criteria WHERE goal_id = \$1/.test(s)) return { rows: [counts] };
+    if (/^UPDATE goals/.test(s)) return { rows: [{ ...goal, status: 'achieved', updated_at: 'T1' }] };
+    return null;
+  };
+}
+
+// =========================================================================
+// achieveGoalIfComplete — the happy path: last criterion confirmed → achieved
+// =========================================================================
+await test('achieveGoalIfComplete: open goal, all criteria satisfied → flips to achieved', async () => {
+  const pool = fakePool(goalHandler({ goal: GOAL(), counts: { total: 3, unsatisfied: 0 } }));
+  const out = await achieveGoalIfComplete({ goalId: 7 }, { pool });
+  assert.equal(out.achieved, true, 'a fully-satisfied open goal auto-achieves');
+  assert.equal(out.goal.status, 'achieved', 'returns the updated row');
+  const upd = find(pool.queries, /^UPDATE goals/);
+  assert.ok(upd, 'the status flip must be persisted');
+  assert.deepEqual(upd.params, [7, 'achieved'], 'UPDATE binds (goalId, "achieved")');
+});
+
+// =========================================================================
+// achieveGoalIfComplete — conservative on every non-completing shape
+// =========================================================================
+await test('achieveGoalIfComplete: an unsatisfied criterion remains → does NOT flip, no UPDATE', async () => {
+  const pool = fakePool(goalHandler({ goal: GOAL(), counts: { total: 3, unsatisfied: 1 } }));
+  const out = await achieveGoalIfComplete({ goalId: 7 }, { pool });
+  assert.equal(out.achieved, false, 'one criterion still open → goal stays open');
+  assert.equal(out.goal.status, 'open');
+  assert.equal(find(pool.queries, /^UPDATE goals/), undefined, 'must NOT touch the goal status');
+});
+
+await test('achieveGoalIfComplete: a goal with ZERO criteria never auto-achieves', async () => {
+  const pool = fakePool(goalHandler({ goal: GOAL(), counts: { total: 0, unsatisfied: 0 } }));
+  const out = await achieveGoalIfComplete({ goalId: 7 }, { pool });
+  assert.equal(out.achieved, false, 'an empty goal has nothing to complete it');
+  assert.equal(find(pool.queries, /^UPDATE goals/), undefined);
+});
+
+await test('achieveGoalIfComplete: an ALREADY-achieved goal is left untouched (no churn)', async () => {
+  const pool = fakePool(goalHandler({ goal: GOAL({ status: 'achieved' }), counts: { total: 3, unsatisfied: 0 } }));
+  const out = await achieveGoalIfComplete({ goalId: 7 }, { pool });
+  assert.equal(out.achieved, false, 're-confirming a criterion under an achieved goal must not re-flip');
+  assert.equal(out.goal.status, 'achieved', 'returns the existing row unchanged');
+  // Short-circuits right after getGoal — it must NOT even count the criteria.
+  assert.equal(find(pool.queries, /FROM done_when_criteria/), undefined, 'a non-open goal short-circuits before the count');
+  assert.equal(find(pool.queries, /^UPDATE goals/), undefined);
+});
+
+await test('achieveGoalIfComplete: an archived goal is left untouched', async () => {
+  const pool = fakePool(goalHandler({ goal: GOAL({ status: 'archived' }), counts: { total: 1, unsatisfied: 0 } }));
+  const out = await achieveGoalIfComplete({ goalId: 7 }, { pool });
+  assert.equal(out.achieved, false);
+  assert.equal(out.goal.status, 'archived');
+  assert.equal(find(pool.queries, /^UPDATE goals/), undefined);
+});
+
+await test('achieveGoalIfComplete: unknown goal id → { achieved:false, goal:null }', async () => {
+  const pool = fakePool(goalHandler({ goal: null, counts: { total: 0, unsatisfied: 0 } }));
+  const out = await achieveGoalIfComplete({ goalId: 999 }, { pool });
+  assert.deepEqual(out, { achieved: false, goal: null });
+  assert.equal(find(pool.queries, /^UPDATE goals/), undefined);
+});
+
+// =========================================================================
+// listPendingReviewCriteria — the review-queue read
+// =========================================================================
+const PENDING_ROW = {
+  id: 10, version_id: 'BONGOS-V1', criterion_id: 'c-one', criterion_md: 'md',
+  goal_id: 7, sort_order: 1, task_total: 2, goal_title: 'Goal hierarchy',
+  goal_status: 'open', is_last_in_goal: true,
+};
+
+await test('listPendingReviewCriteria: returns the queue rows; no version → param [null]', async () => {
+  const pool = fakePool((s) => (/WITH pending AS/.test(s) ? { rows: [PENDING_ROW] } : null));
+  const out = await listPendingReviewCriteria({}, { pool });
+  assert.deepEqual(out, [PENDING_ROW]);
+  const q = find(pool.queries, /WITH pending AS/);
+  assert.deepEqual(q.params, [null], 'an unscoped call binds versionId=null (no filter)');
+});
+
+await test('listPendingReviewCriteria: versionId flows through to the bound param', async () => {
+  const pool = fakePool((s) => (/WITH pending AS/.test(s) ? { rows: [] } : null));
+  await listPendingReviewCriteria({ versionId: 'BONGOS-V1' }, { pool });
+  assert.deepEqual(find(pool.queries, /WITH pending AS/).params, ['BONGOS-V1']);
+});
+
+await test('listPendingReviewCriteria: SQL encodes the auto-flag (all shipped) + is_last_in_goal', async () => {
+  const pool = fakePool((s) => (/WITH pending AS/.test(s) ? { rows: [] } : null));
+  await listPendingReviewCriteria({}, { pool });
+  const sql = String(find(pool.queries, /WITH pending AS/).sql).replace(/\s+/g, ' ');
+  // The derivation: satisfied=false AND every linked task shipped (zero non-shipped).
+  assert.match(sql, /c\.satisfied = false/, 'only unconfirmed criteria are pending');
+  assert.match(sql, /HAVING count\(\*\) FILTER \(WHERE t\.status <> 'shipped'\) = 0/, 'all linked tasks must be shipped');
+  assert.match(sql, /is_last_in_goal/, 'surfaces whether confirming completes the goal');
+});
+
+// -------------------------------------------------------------------------
+summary();

package/tests/goal_conflicts.mjs

@@ -0,0 +1,305 @@
+// tests/goal_conflicts.mjs — server-side goal task-conflict detection +
+// owner/manager resolution actions (task 1736).
+//
+// GET /goals/:id/conflicts computes overlaps among a goal's OPEN tasks (and
+// against other open goals sharing scope_modules) from their DECLARED touches[]
+// — glob-aware via the canonical path-match machinery — with claim-aware
+// severity. POST /goals/:id/conflicts/resolve is the owner/manager toolset:
+// sequence (ADR 0015 dependency edge), flag_release (nudge the claim holder),
+// rescope (ADR 0049 advisory touches rewrite, planning-time only). This file
+// pins, in the goal_routes pattern:
+//
+//   1. the PURE detector (goal-conflicts.js): overlap semantics (exact,
+//      dir-prefix, glob tail), open-task filtering, severity, cross-goal pairs,
+//      ordering — all DB-free;
+//   2. the PURE management gate (authorizeGoalManagement) ordering;
+//   3. the request-validation schema of the resolve route + the action wall;
+//   4. the db helpers' SQL contracts via the SQL-aware fake pool —
+//      listActiveClaimsForTasks / requestClaimRelease / rescopeTaskTouches;
+//   5. the route-rank PIN: resolve stays 'any-builder' (the wall is in-handler).
+//
+// Run:  node tests/goal_conflicts.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const { validate, LIMITS } = require('../src/bongos/routes/_helpers.js');
+const {
+  RESOLVED_STATUSES, isOpenWithTouches, normalizeEntry, overlappingPaths,
+  severityFor, computeGoalConflicts,
+} = require('../modules/lifecycle/goal-conflicts.js');
+const { authorizeGoalManagement, RESOLVE_ACTIONS } = require('../modules/lifecycle/routes/goals.js');
+const { listActiveClaimsForTasks, requestClaimRelease, rescopeTaskTouches } = require('../modules/lifecycle/db.js');
+const { MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
+
+const { test, summary } = makeRunner();
+
+function fakePool(handler) {
+  const c = makeSqlAwareClient(handler);
+  return { query: (sql, params) => c._client.query(sql, params), connect: c.connect, queries: c._client.queries };
+}
+const find = (queries, re) => queries.find((q) => re.test(String(q.sql).replace(/\s+/g, ' ')));
+
+const task = (id, touches, status = 'ready', title = `t${id}`) => ({ id, title, status, touches });
+
+// =========================================================================
+// 1a. overlap semantics — the glob-aware pairwise matcher
+// =========================================================================
+
+await test('overlappingPaths: exact match, dir-prefix both directions, keeps the more specific side', () => {
+  assert.deepEqual(overlappingPaths(['src/bongos/db.js'], ['src/bongos/db.js']), ['src/bongos/db.js']);
+  assert.deepEqual(overlappingPaths(['src/bongos/'], ['src/bongos/db.js']), ['src/bongos/db.js'],
+    'dir entry covers the file → the file is reported');
+  assert.deepEqual(overlappingPaths(['src/bongos/db.js'], ['src/bongos']), ['src/bongos/db.js'],
+    'bare dir (no trailing slash) covers too — matchOne semantics');
+  assert.deepEqual(overlappingPaths(['a/b.js'], ['c/d.js']), [], 'disjoint paths do not overlap');
+});
+
+await test('overlappingPaths: glob tails trim to their directory prefix', () => {
+  assert.deepEqual(normalizeEntry('src/bongos/*'), 'src/bongos');
+  assert.deepEqual(normalizeEntry('modules/hall-ui/**'), 'modules/hall-ui');
+  assert.deepEqual(overlappingPaths(['src/bongos/*'], ['src/bongos/routes/goals.js']), ['src/bongos/routes/goals.js']);
+  assert.deepEqual(overlappingPaths(['modules/hall-ui/**'], ['modules/hall-ui/public/work.js']),
+    ['modules/hall-ui/public/work.js']);
+});
+
+await test('overlappingPaths: sibling files under a shared dir do NOT overlap (prefix, not ancestor-merge)', () => {
+  assert.deepEqual(overlappingPaths(['src/bongos/a.js'], ['src/bongos/b.js']), [],
+    'two different files in one dir are parallel-safe — only a covering entry conflicts');
+});
+
+await test('overlappingPaths: dedupes and sorts; empty/junk entries skipped', () => {
+  const out = overlappingPaths(['src/', 'src/x.js', ''], ['src/x.js', 'src/y.js']);
+  assert.deepEqual(out, ['src/x.js', 'src/y.js']);
+});
+
+// =========================================================================
+// 1b. the detector — filtering, severity, cross-goal, ordering
+// =========================================================================
+
+await test('open-task filter: resolved statuses and empty touches are excluded', () => {
+  for (const s of ['completed', 'confirmed', 'shipped', 'abandoned']) {
+    assert.ok(RESOLVED_STATUSES.has(s), `${s} is resolved`);
+    assert.equal(isOpenWithTouches(task(1, ['a.js'], s)), false);
+  }
+  assert.equal(isOpenWithTouches(task(1, [], 'ready')), false, 'no touches → nothing to intersect');
+  assert.equal(isOpenWithTouches(task(1, ['a.js'], 'active')), true);
+  assert.equal(isOpenWithTouches(task(1, ['a.js'], 'blocked')), true);
+});
+
+await test('severity: both claimed high, one claimed medium, none low', () => {
+  assert.equal(severityFor(true, true), 'high');
+  assert.equal(severityFor(true, false), 'medium');
+  assert.equal(severityFor(false, true), 'medium');
+  assert.equal(severityFor(false, false), 'low');
+});
+
+await test('detector: in-goal pair with overlap, claim-aware severity, client shape', () => {
+  const conflicts = computeGoalConflicts({
+    goalTasks: [
+      task(10, ['src/bongos/db.js'], 'active', 'alpha'),
+      task(11, ['src/bongos/'], 'ready', 'beta'),
+      task(12, ['docs/'], 'ready'),                    // disjoint — no pair
+      task(13, ['src/bongos/db.js'], 'shipped'),          // resolved — excluded
+    ],
+    activeClaimTaskIds: new Set(['10']),
+  });
+  assert.equal(conflicts.length, 1);
+  const c = conflicts[0];
+  assert.equal(c.task_a, 10);
+  assert.equal(c.task_b, 11);
+  assert.equal(c.title_a, 'alpha');
+  assert.deepEqual(c.overlapping_paths, ['src/bongos/db.js']);
+  assert.equal(c.severity, 'medium', 'one active claim → medium');
+  assert.equal(c.has_active_claims, true);
+  assert.equal(c.cross_goal, false);
+});
+
+await test('detector: cross-goal pairs are marked and carry the sibling goal', () => {
+  const conflicts = computeGoalConflicts({
+    goalTasks: [task(10, ['modules/lifecycle/db.js'], 'ready')],
+    activeClaimTaskIds: new Set(['77']),
+    crossGoal: [{
+      goal: { id: 5, title: 'sibling goal' },
+      tasks: [
+        task(77, ['modules/lifecycle/'], 'active'),
+        task(78, ['modules/lifecycle/db.js'], 'shipped'),  // resolved — excluded
+      ],
+    }],
+  });
+  assert.equal(conflicts.length, 1);
+  const c = conflicts[0];
+  assert.equal(c.cross_goal, true);
+  assert.equal(c.goal_b, 5);
+  assert.equal(c.goal_b_title, 'sibling goal');
+  assert.equal(c.task_b, 77);
+  assert.equal(c.severity, 'medium');
+});
+
+await test('detector: ordering — most severe first, then task ids', () => {
+  const conflicts = computeGoalConflicts({
+    goalTasks: [
+      task(1, ['x/'], 'active'), task(2, ['x/a.js'], 'active'),   // high pair
+      task(3, ['y/'], 'ready'), task(4, ['y/b.js'], 'ready'),     // low pair
+    ],
+    activeClaimTaskIds: new Set(['1', '2']),
+  });
+  assert.deepEqual(conflicts.map((c) => c.severity), ['high', 'low']);
+  assert.deepEqual(conflicts.map((c) => [c.task_a, c.task_b]), [[1, 2], [3, 4]]);
+});
+
+await test('detector: no inputs → no conflicts (and never throws)', () => {
+  assert.deepEqual(computeGoalConflicts(), []);
+  assert.deepEqual(computeGoalConflicts({ goalTasks: [task(1, ['a.js'])] }), []);
+});
+
+// =========================================================================
+// 2. authorizeGoalManagement — the shared prefix gate
+// =========================================================================
+
+const OPEN_GOAL = { id: 7, status: 'open', created_by: '1' };
+const manager = (builderId) => ({ goal_id: 7, builder_id: builderId, role: 'lead' });
+const member = (builderId) => ({ goal_id: 7, builder_id: builderId, role: 'member' });
+
+await test('gate: owner / manager / archon pass; ordering goal_not_found → goal_not_open → not_owner_or_manager', () => {
+  for (const actor of [
+    { actorId: 1, actorRank: 'metic', actorMembership: manager(1) },   // owner
+    { actorId: 3, actorRank: 'metic', actorMembership: manager(3) },   // manager
+    { actorId: 99, actorRank: 'archon', actorMembership: null },       // archon
+  ]) {
+    assert.deepEqual(authorizeGoalManagement({ goal: OPEN_GOAL, ...actor }), { ok: true });
+  }
+  assert.equal(authorizeGoalManagement({ goal: null, actorId: 99, actorRank: 'archon', actorMembership: null }).body.error,
+    'goal_not_found');
+  assert.equal(authorizeGoalManagement({ goal: { id: 7, status: 'archived', created_by: '1' }, actorId: 1, actorRank: 'metic', actorMembership: manager(1) }).body.error,
+    'goal_not_open', 'closed goal short-circuits even for the owner');
+  const denied = authorizeGoalManagement({ goal: OPEN_GOAL, actorId: 2, actorRank: 'metic', actorMembership: member(2) });
+  assert.equal(denied.status, 403);
+  assert.equal(denied.body.error, 'not_owner_or_manager', 'a plain member cannot manage');
+});
+
+await test('gate: owner authority is created_by, not the role row', () => {
+  const d = authorizeGoalManagement({ goal: OPEN_GOAL, actorId: 1, actorRank: 'metic', actorMembership: member(1) });
+  assert.deepEqual(d, { ok: true });
+});
+
+// =========================================================================
+// 3. resolve-route contracts — schema + action wall (in-handler checks)
+// =========================================================================
+
+const RESOLVE_SCHEMA = {
+  action: { required: true, type: 'string' },
+  note: { type: 'string', maxLength: LIMITS.NOTES },
+  touches: { type: 'array', maxItems: 500, itemsType: 'string' },
+};
+
+await test('resolve schema: action required; touches must be an array of strings', () => {
+  const r = validate({}, RESOLVE_SCHEMA);
+  assert.ok(r && r.details.some((d) => d.field === 'action' && d.reason === 'missing'));
+  const r2 = validate({ action: 'rescope', touches: 'src/x.js' }, RESOLVE_SCHEMA);
+  assert.ok(r2 && r2.details.some((d) => d.field === 'touches' && d.reason === 'wrong_type'));
+  assert.equal(validate({ action: 'flag_release', note: 'please wrap up' }, RESOLVE_SCHEMA), null);
+});
+
+await test('resolve actions: exactly sequence | flag_release | rescope', () => {
+  assert.deepEqual(RESOLVE_ACTIONS, ['sequence', 'flag_release', 'rescope']);
+});
+
+await test('task-id coercion contract: int + numeric string pass, junk rejected (containment reads)', () => {
+  const ok = (x) => Number.isInteger(Number(x)) && Number(x) > 0;
+  assert.ok(ok(42) && ok('42'));
+  assert.ok(!ok('42; DROP') && !ok('') && !ok(undefined) && !ok(0));
+});
+
+// =========================================================================
+// 4. db helpers — SQL contracts via the SQL-aware fake pool
+// =========================================================================
+
+await test('listActiveClaimsForTasks: ANY($1) over ids, active = released_at IS NULL, [] on empty input', async () => {
+  const ROW = { claim_id: 9, task_id: 10, builder_id: 3, claimed_at: 'T0', github_login: 'x' };
+  const pool = fakePool((s) => (/FROM claims c/.test(s) ? { rows: [ROW] } : null));
+  const out = await listActiveClaimsForTasks([10, 11], { pool });
+  assert.deepEqual(out, [ROW]);
+  const sel = find(pool.queries, /FROM claims c/);
+  assert.deepEqual(sel.params, [[10, 11]]);
+  const sql = String(sel.sql).replace(/\s+/g, ' ');
+  assert.match(sql, /c\.task_id = ANY\(\$1::bigint\[\]\)/);
+  assert.match(sql, /c\.released_at IS NULL/, 'active-claim convention (no status column on claims)');
+
+  const empty = fakePool(() => ({ rows: [] }));
+  assert.deepEqual(await listActiveClaimsForTasks([], { pool: empty }), []);
+  assert.equal(empty.queries.length, 0, 'no query for an empty id list');
+});
+
+await test('requestClaimRelease: flags only the ACTIVE claim; null when none (route answers 409)', async () => {
+  const ROW = { claim_id: 9, task_id: 10, builder_id: 3, release_requested_by: 1, release_requested_at: 'T1', release_requested_note: 'n' };
+  const pool = fakePool((s) => (/UPDATE claims/.test(s) ? { rows: [ROW] } : null));
+  const out = await requestClaimRelease({ taskId: 10, requestedBy: 1, note: 'n' }, { pool });
+  assert.deepEqual(out, ROW);
+  const upd = find(pool.queries, /UPDATE claims/);
+  assert.deepEqual(upd.params, [10, 1, 'n']);
+  const sql = String(upd.sql).replace(/\s+/g, ' ');
+  assert.match(sql, /WHERE task_id = \$1 AND released_at IS NULL/, 'only an active claim can be flagged');
+  assert.match(sql, /RETURNING id AS claim_id/);
+
+  const none = fakePool(() => ({ rows: [] }));
+  assert.equal(await requestClaimRelease({ taskId: 10, requestedBy: 1 }, { pool: none }), null);
+});
+
+await test('rescopeTaskTouches: dedupes/trims entries, bumps updated_at, null on unknown task', async () => {
+  const ROW = { id: 10, touches: ['a.js', 'b/'], requires_rank: 'xenos' };
+  const pool = fakePool((s) => (/UPDATE tasks SET touches/.test(s) ? { rows: [ROW] } : null));
+  const out = await rescopeTaskTouches({ taskId: 10, touches: [' a.js ', 'a.js', 'b/', ''] }, { pool });
+  assert.deepEqual(out, ROW);
+  const upd = find(pool.queries, /UPDATE tasks SET touches/);
+  assert.deepEqual(upd.params, [10, ['a.js', 'b/'], 'xenos'], 'trimmed, deduped, empties dropped; innocuous floor stays xenos');
+  assert.match(String(upd.sql), /updated_at = now\(\)/);
+
+  const none = fakePool(() => ({ rows: [] }));
+  assert.equal(await rescopeTaskTouches({ taskId: 999, touches: ['x'] }, { pool: none }), null);
+});
+
+await test('rescopeTaskTouches: the ADR 0084 floor re-derives and RATCHETS UP, never down', async () => {
+  // protected touches → the derived floor is metic even though the task sat at xenos
+  const pool = fakePool((s) => (/UPDATE tasks SET touches/.test(s) ? { rows: [{ id: 10 }] } : null));
+  await rescopeTaskTouches({ taskId: 10, touches: ['migrations/999_x.sql'], currentRequiresRank: 'xenos' }, { pool });
+  assert.equal(find(pool.queries, /UPDATE tasks SET touches/).params[2], 'metic',
+    'protected-path touches raise the floor (deriveRequiredRank via matchProtected)');
+
+  // innocuous touches on a task already floored at metic → floor is KEPT
+  const pool2 = fakePool((s) => (/UPDATE tasks SET touches/.test(s) ? { rows: [{ id: 10 }] } : null));
+  await rescopeTaskTouches({ taskId: 10, touches: ['docs/x.md'], currentRequiresRank: 'metic' }, { pool: pool2 });
+  assert.equal(find(pool2.queries, /UPDATE tasks SET touches/).params[2], 'metic',
+    'rescoping to innocuous paths never LOWERS an existing floor');
+
+  // security_sensitive flag alone floors at metic regardless of paths
+  const pool3 = fakePool((s) => (/UPDATE tasks SET touches/.test(s) ? { rows: [{ id: 10 }] } : null));
+  await rescopeTaskTouches({ taskId: 10, touches: ['docs/x.md'], securitySensitive: true }, { pool: pool3 });
+  assert.equal(find(pool3.queries, /UPDATE tasks SET touches/).params[2], 'metic');
+});
+
+await test('rescope wall: the route runs goal-scope-check verbatim (source contract)', async () => {
+  // The create-time wall (R60) must also bound the rescope surface — otherwise
+  // touches could be rewritten out of the goal's territory after passing the
+  // wall once. Pin the route source: the rescope branch calls
+  // goalScopeCheck.check(...) before the write, exactly like the create gate.
+  const fs = await import('node:fs');
+  const src = fs.readFileSync(new URL('../modules/lifecycle/routes/goals.js', import.meta.url), 'utf8');
+  const rescopeBranch = src.split("action === 'rescope'")[1] || '';
+  assert.match(rescopeBranch, /goalScopeCheck\.check\(goal\.scope_modules,\s*touches,\s*req\.builder\.rank\)/,
+    'the rescope branch re-runs the scope wall on the new touches');
+});
+
+// =========================================================================
+// 5. the route-rank pin
+// =========================================================================
+
+await test('route-rank pin: POST /goals/:id/conflicts/resolve stays any-builder (in-handler wall)', () => {
+  assert.equal(MODULE_EXPECTED_RANKS.lifecycle['POST /goals/:id/conflicts/resolve'], 'any-builder');
+});
+
+summary();