@bongos/core 1.17.0

package/tests/goal_scope_check.mjs

@@ -0,0 +1,167 @@
+// tests/goal_scope_check.mjs
+//
+// Unit suite for src/bongos/goal-scope-check.js — the pure scope wall the goal
+// task-author gate (BV1.R60 / POST /goals/:id/tasks) calls (BV1.R59, ADR 0086 §3).
+//
+// Pure module: no DB, no network. We verify both walls independently and the
+// combined gate: scope-subset (directional containment), the protected-path
+// delegate (sub-Metic block, Metic+ pass), the fail-closed edges (empty scope,
+// empty touches, unknown modules), and — critically — that the subset uses
+// directional `matchOne` semantics, NOT the looser symmetric `touchesOverlap`
+// (which would leak a task touching a path broader than the goal owns).
+//
+// Run:  node tests/goal_scope_check.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const gsc = require('../src/bongos/goal-scope-check.js');
+const { touchesOverlap } = require('../src/bongos/path-match.js');
+const { globsForModules, isModuleKey, protectedModules } = require('../src/bongos/module-scope-map.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ---------- fixtures: anchor the suite to real module-map facts ----------
+
+t('fixtures: art-pipeline + game are real, UNprotected modules; lifecycle is protected', () => {
+  assert.ok(isModuleKey('art-pipeline') && isModuleKey('game') && isModuleKey('lifecycle'));
+  const prot = protectedModules();
+  assert.ok(!prot.includes('art-pipeline'), 'art-pipeline must be unprotected for the maneuverability tests');
+  assert.ok(!prot.includes('game'), 'game must be unprotected');
+  assert.ok(prot.includes('lifecycle'), 'lifecycle owns migrations/ + routes/ so it must be protected');
+  // game owns a single specific file — needed for the directional-containment test.
+  assert.ok(globsForModules(['game']).includes('src/preview-server.js'));
+});
+
+// ---------- the four required cases (done-when) ----------
+
+t('in-scope pass: a touch inside a scoped module is allowed (Metic)', () => {
+  const r = gsc.check(['art-pipeline'], ['modules/art-pipeline/generated/tiles/olive.png'], 'metic');
+  assert.equal(r.ok, true, r.reason);
+  assert.equal(r.code, 'ok');
+  assert.equal(r.reason, null);
+});
+
+t('out-of-scope reject: a touch in a different module is rejected', () => {
+  const r = gsc.check(['art-pipeline'], ['modules/game/rooms/world.js'], 'metic');
+  assert.equal(r.ok, false);
+  assert.equal(r.code, 'out_of_scope');
+  assert.deepEqual(r.details.out_of_scope, ['modules/game/rooms/world.js']);
+});
+
+t('protected-path reject: a sub-Metic touching the protected core is rejected even in-scope', () => {
+  // 'lifecycle' owns migrations/ (in scope) AND migrations/ is protected.
+  const r = gsc.check(['lifecycle'], ['migrations/172_add_thing.sql'], 'thetes');
+  assert.equal(r.ok, false);
+  assert.equal(r.code, 'protected_path');
+  assert.equal(r.details.protected_hits[0].file, 'migrations/172_add_thing.sql');
+});
+
+t('empty-scope reject: a goal with no scope_modules authorizes nothing', () => {
+  const r = gsc.check([], ['art/x.png'], 'metic');
+  assert.equal(r.ok, false);
+  assert.equal(r.code, 'empty_scope');
+});
+
+// ---------- the maneuverability grant: lower ranks CAN author in unprotected scope ----------
+
+t('sub-Metic CAN author within an unprotected scoped module (the whole point of ADR 0086)', () => {
+  const r = gsc.check(['art-pipeline'], ['modules/art-pipeline/template/style_guide.md'], 'thetes');
+  assert.equal(r.ok, true, r.reason);
+});
+
+t('Metic+ is NOT blocked by the protected-path wall, even on a protected path in scope', () => {
+  const r = gsc.check(['lifecycle'], ['migrations/172_add_thing.sql'], 'metic');
+  assert.equal(r.ok, true, r.reason);
+  const ra = gsc.check(['lifecycle'], ['migrations/172_add_thing.sql'], 'archon');
+  assert.equal(ra.ok, true, ra.reason);
+});
+
+// ---------- directional containment: matchOne, NOT touchesOverlap ----------
+
+t('directional: an exact-file glob covers the exact touch, but NOT a broader parent dir', () => {
+  // game owns the single file src/preview-server.js.
+  assert.equal(gsc.check(['game'], ['src/preview-server.js'], 'metic').ok, true);
+  const broad = gsc.check(['game'], ['src/'], 'metic'); // touches the whole src/ tree
+  assert.equal(broad.ok, false);
+  assert.equal(broad.code, 'out_of_scope');
+});
+
+t('the subset does NOT use symmetric touchesOverlap (which would leak the broad touch)', () => {
+  // Prove the looser matcher WOULD have passed it, so our reject is a deliberate
+  // tightening, not an accident.
+  assert.equal(touchesOverlap(['src/'], ['src/preview-server.js']), true,
+    'symmetric overlap is loose here — exactly why goal-scope-check uses matchOne');
+  assert.equal(gsc.check(['game'], ['src/'], 'metic').ok, false,
+    'goal-scope-check must REJECT the broad touch despite the symmetric overlap');
+});
+
+// ---------- fail-closed edges ----------
+
+t('empty-touches reject: a task with no touches[] cannot be scope-checked', () => {
+  const r = gsc.check(['art-pipeline'], [], 'metic');
+  assert.equal(r.ok, false);
+  assert.equal(r.code, 'empty_touches');
+});
+
+t('unknown-scope reject: modules that resolve to zero territory fail closed', () => {
+  const r = gsc.check(['not-a-real-module'], ['art/x.png'], 'metic');
+  assert.equal(r.ok, false);
+  assert.equal(r.code, 'unknown_scope');
+});
+
+t('mixed in/out: one out-of-scope path among in-scope ones still rejects, naming the offender', () => {
+  const r = gsc.check(['art-pipeline'], ['modules/art-pipeline/a.png', 'modules/game/b.js', 'modules/art-pipeline/c.png'], 'metic');
+  assert.equal(r.ok, false);
+  assert.equal(r.code, 'out_of_scope');
+  assert.deepEqual(r.details.out_of_scope, ['modules/game/b.js']);
+});
+
+t('multi-module scope: a touch covered by ANY scoped module passes', () => {
+  const r = gsc.check(['art-pipeline', 'game'], ['modules/game/seats.js'], 'metic');
+  assert.equal(r.ok, true, r.reason);
+});
+
+t('ordering is fail-closed: out-of-scope is reported before the protected-path wall', () => {
+  // thetes, touch is BOTH out of an art-only scope AND protected — scope wins first.
+  const r = gsc.check(['art-pipeline'], ['migrations/9_x.sql'], 'thetes');
+  assert.equal(r.ok, false);
+  assert.equal(r.code, 'out_of_scope');
+});
+
+t('null/garbage inputs fail closed, never throw', () => {
+  assert.equal(gsc.check(null, null, null).ok, false);
+  assert.equal(gsc.check(undefined, ['art/x'], 'metic').code, 'empty_scope');
+  assert.equal(gsc.check(['art-pipeline'], [null, '', false], 'metic').code, 'empty_touches');
+});
+
+// ---------- the exposed delegates work standalone (the route may call them directly) ----------
+
+t('scopeSubset() delegate: reports ok + the offending paths + resolved globs', () => {
+  const s = gsc.scopeSubset(['art-pipeline'], ['modules/art-pipeline/x.png', 'modules/game/y.js']);
+  assert.equal(s.ok, false);
+  assert.deepEqual(s.out_of_scope, ['modules/game/y.js']);
+  assert.ok(s.goal_globs.includes('modules/art-pipeline/'));
+});
+
+t('protectedPathBlock() delegate: blocks sub-Metic, passes Metic, on the same path', () => {
+  assert.equal(gsc.protectedPathBlock(['migrations/1.sql'], 'thetes').ok, false);
+  assert.equal(gsc.protectedPathBlock(['migrations/1.sql'], 'metic').ok, true);
+  assert.equal(gsc.protectedPathBlock(['art/ok.png'], 'thetes').ok, true);
+});
+
+t('isCovered() helper: exact + subtree-prefix containment', () => {
+  const globs = globsForModules(['art-pipeline']); // ['modules/art-pipeline/']
+  assert.equal(gsc.isCovered('modules/art-pipeline/deep/nested.png', globs), true);
+  assert.equal(gsc.isCovered('modules/art-pipeline-extra/x.js', globs), false); // sibling dir sharing the name-prefix is NOT inside 'modules/art-pipeline/'
+  assert.equal(gsc.isCovered('modules/art-pipeline/loader.js', globs), true);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/goal_tier.mjs

@@ -0,0 +1,312 @@
+// tests/goal_tier.mjs
+//
+// Unit guard for the Goal-tier db helpers (ADR 0086 §2, BV1.R56 / task 1510):
+// createGoal / getGoal / listGoals / setGoalStatus / addGoalMember /
+// removeGoalMember / listGoalMembers. These are the SQL plumbing for the one new
+// tier in the goal-scoped work hierarchy; NO route references them yet (R57 adds
+// routes/goals.js, R58 the /status rollup), so this is the only coverage they get
+// until then.
+//
+// DB-free, same posture as abandon_task.mjs / confirm_attribution.mjs: each
+// helper honours the #538 deps.pool injection seam (ONLY when NODE_ENV==='test'),
+// so a SQL-aware fake client drives it with no live Postgres. We assert the
+// statement shape + bound params + returned row, since the wall (R57/R60) and the
+// /status rollup (R58) will build directly on these contracts.
+//
+// Run:  node tests/goal_tier.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const db = require('../modules/lifecycle/db.js');
+const {
+  createGoal, getGoal, listGoals, reorderGoals, setGoalStatus,
+  addGoalMember, removeGoalMember, listGoalMembers,
+  isGoalMember, addGoalScopeModules, setGoalSuccessor,
+} = db;
+
+const { test, summary } = makeRunner();
+
+// These helpers are single-statement (activePool.query directly, like getVersion
+// / createOverrideRequest), not pool.connect() transactions — so the fake pool
+// needs a top-level .query. makeSqlAwareClient's _client already records every
+// call into .queries; we expose its query as the pool's query (the same
+// per-caller fakePool shape abandon_task.mjs / override_attribution.mjs use, just
+// query-style instead of connect-style).
+function fakePool(handler) {
+  const c = makeSqlAwareClient(handler);
+  return { query: (sql, params) => c._client.query(sql, params), connect: c.connect, queries: c._client.queries };
+}
+
+const find = (queries, re) => queries.find((q) => re.test(String(q.sql).replace(/\s+/g, ' ')));
+
+const GOAL_ROW = {
+  id: 7, version_id: 'BONGOS-V1', title: 'Goal hierarchy', description: 'desc',
+  scope_modules: ['gds-core'], status: 'open', created_by: 42,
+  succeeded_by_goal_id: null, sort_order: 0, created_at: 'T0', updated_at: 'T0',
+};
+const MEMBER_ROW = { goal_id: 7, builder_id: 42, role: 'member', joined_at: 'T0' };
+
+// =========================================================================
+// createGoal
+// =========================================================================
+await test('createGoal: INSERT binds all six fields in order and returns the row', async () => {
+  const pool = fakePool((s) => {
+    if (/INSERT INTO goals/.test(s)) return { rows: [GOAL_ROW] };
+    return null;
+  });
+  const out = await createGoal(
+    { versionId: 'BONGOS-V1', title: 'Goal hierarchy', description: 'desc', scopeModules: ['gds-core'], status: 'open', createdBy: 42 },
+    { pool }
+  );
+  assert.deepEqual(out, GOAL_ROW, 'returns the inserted row');
+  const ins = find(pool.queries, /INSERT INTO goals/);
+  assert.deepEqual(ins.params, ['BONGOS-V1', 'Goal hierarchy', 'desc', ['gds-core'], 'open', 42],
+    'version_id, title, description, scope_modules, status, created_by — in that order');
+  assert.match(ins.sql, /RETURNING/, 'returns the row, not just inserts');
+});
+
+// task 1735: goal + first lead land in ONE statement — the creator's lead
+// membership rides as a CTE, guarded so a NULL creator inserts no member.
+await test('createGoal: the creator becomes the first lead in the same statement', async () => {
+  const pool = fakePool((s) => (/INSERT INTO goals/.test(s) ? { rows: [GOAL_ROW] } : null));
+  await createGoal({ versionId: 'V1', title: 'g', createdBy: 42 }, { pool });
+  const ins = find(pool.queries, /INSERT INTO goals/);
+  assert.match(ins.sql, /INSERT INTO goal_members \(goal_id, builder_id, role\)/,
+    'the member insert is part of the createGoal statement');
+  assert.match(ins.sql, /'lead'/, 'the creator is inserted as lead, not member');
+  assert.match(ins.sql, /WHERE \$6::bigint IS NOT NULL/,
+    'a NULL creator (system goal) inserts no member row');
+});
+
+await test('createGoal: defaults — null description/createdBy, empty scope, open status', async () => {
+  const pool = fakePool((s) => (/INSERT INTO goals/.test(s) ? { rows: [GOAL_ROW] } : null));
+  await createGoal({ versionId: 'V1', title: 'general' }, { pool });
+  const ins = find(pool.queries, /INSERT INTO goals/);
+  assert.deepEqual(ins.params, ['V1', 'general', null, [], 'open', null],
+    'unspecified fields fall back to null / [] / open');
+});
+
+// =========================================================================
+// getGoal
+// =========================================================================
+await test('getGoal: SELECT by id returns the row', async () => {
+  const pool = fakePool((s) => (/^SELECT .* FROM goals WHERE id = \$1/.test(s) ? { rows: [GOAL_ROW] } : null));
+  const out = await getGoal(7, { pool });
+  assert.deepEqual(out, GOAL_ROW);
+  assert.equal(find(pool.queries, /FROM goals WHERE id = \$1/).params[0], 7);
+});
+
+await test('getGoal: unknown id returns null (not undefined)', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  const out = await getGoal(999, { pool });
+  assert.equal(out, null);
+});
+
+// =========================================================================
+// listGoals
+// =========================================================================
+await test('listGoals: no args binds [null, null] (both filters off)', async () => {
+  const pool = fakePool((s) => (/FROM goals/.test(s) ? { rows: [GOAL_ROW] } : null));
+  const out = await listGoals(undefined, { pool });
+  assert.deepEqual(out, [GOAL_ROW]);
+  const sel = find(pool.queries, /FROM goals/);
+  assert.deepEqual(sel.params, [null, null]);
+  assert.match(sel.sql, /ORDER BY version_id, sort_order, created_at, id/, 'priority-first, then stable ordering');
+});
+
+await test('listGoals: versionId + status flow through to the bound params', async () => {
+  const pool = fakePool((s) => (/FROM goals/.test(s) ? { rows: [] } : null));
+  await listGoals({ versionId: 'BONGOS-V1', status: 'open' }, { pool });
+  assert.deepEqual(find(pool.queries, /FROM goals/).params, ['BONGOS-V1', 'open']);
+});
+
+// =========================================================================
+// setGoalStatus
+// =========================================================================
+await test('setGoalStatus: UPDATE sets status + bumps updated_at, returns the row', async () => {
+  const pool = fakePool((s) => (/^UPDATE goals/.test(s) ? { rows: [{ ...GOAL_ROW, status: 'achieved' }] } : null));
+  const out = await setGoalStatus({ goalId: 7, status: 'achieved' }, { pool });
+  assert.equal(out.status, 'achieved');
+  const upd = find(pool.queries, /^UPDATE goals/);
+  assert.deepEqual(upd.params, [7, 'achieved']);
+  assert.match(upd.sql, /updated_at = now\(\)/, 'must bump updated_at');
+});
+
+await test('setGoalStatus: unknown goal returns null', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  assert.equal(await setGoalStatus({ goalId: 404, status: 'archived' }, { pool }), null);
+});
+
+// =========================================================================
+// addGoalMember
+// =========================================================================
+await test('addGoalMember: upserts on the PK (re-join changes role, no dup-key)', async () => {
+  const pool = fakePool((s) => (/^INSERT INTO goal_members/.test(s) ? { rows: [{ ...MEMBER_ROW, role: 'lead' }] } : null));
+  const out = await addGoalMember({ goalId: 7, builderId: 42, role: 'lead' }, { pool });
+  assert.equal(out.role, 'lead');
+  const ins = find(pool.queries, /^INSERT INTO goal_members/);
+  assert.deepEqual(ins.params, [7, 42, 'lead']);
+  assert.match(ins.sql, /ON CONFLICT \(goal_id, builder_id\) DO UPDATE SET role = EXCLUDED.role/, 'upsert, not plain insert');
+});
+
+await test('addGoalMember: role defaults to member', async () => {
+  const pool = fakePool((s) => (/^INSERT INTO goal_members/.test(s) ? { rows: [MEMBER_ROW] } : null));
+  await addGoalMember({ goalId: 7, builderId: 42 }, { pool });
+  assert.equal(find(pool.queries, /^INSERT INTO goal_members/).params[2], 'member');
+});
+
+// =========================================================================
+// removeGoalMember
+// =========================================================================
+await test('removeGoalMember: a deleted row reports removed:true', async () => {
+  const pool = fakePool((s) => (/^DELETE FROM goal_members/.test(s) ? { rowCount: 1, rows: [] } : null));
+  const out = await removeGoalMember({ goalId: 7, builderId: 42 }, { pool });
+  assert.deepEqual(out, { removed: true });
+  assert.deepEqual(find(pool.queries, /^DELETE FROM goal_members/).params, [7, 42]);
+});
+
+await test('removeGoalMember: a non-member leave reports removed:false', async () => {
+  const pool = fakePool((s) => (/^DELETE FROM goal_members/.test(s) ? { rowCount: 0, rows: [] } : null));
+  assert.deepEqual(await removeGoalMember({ goalId: 7, builderId: 99 }, { pool }), { removed: false });
+});
+
+// =========================================================================
+// listGoalMembers
+// =========================================================================
+await test('listGoalMembers: SELECT by goal_id with builder identity, stable order', async () => {
+  // task 1734: builder identity rides along (LEFT JOIN builders) so the hall
+  // Goals page can render names + lead badges — additive columns only.
+  const pool = fakePool((s) => (/FROM goal_members gm\s+LEFT JOIN builders b ON b\.id = gm\.builder_id\s+WHERE gm\.goal_id = \$1/.test(s) ? { rows: [MEMBER_ROW] } : null));
+  const out = await listGoalMembers(7, { pool });
+  assert.deepEqual(out, [MEMBER_ROW]);
+  const sel = find(pool.queries, /FROM goal_members gm/);
+  assert.equal(sel.params[0], 7);
+  assert.match(sel.sql, /ORDER BY gm\.joined_at, gm\.builder_id/);
+  assert.match(sel.sql, /b\.github_login, b\.display_name, b\.avatar_url, b\.rank/);
+});
+
+// =========================================================================
+// isGoalMember (BV1.R64 — the membership predicate behind the widen/lifecycle gate)
+// =========================================================================
+await test('isGoalMember: a matching row → true; binds (goalId, builderId)', async () => {
+  const pool = fakePool((s) => (/SELECT 1 FROM goal_members WHERE goal_id = \$1 AND builder_id = \$2/.test(s) ? { rows: [{ '?column?': 1 }] } : null));
+  const out = await isGoalMember({ goalId: 7, builderId: 42 }, { pool });
+  assert.equal(out, true);
+  assert.deepEqual(find(pool.queries, /FROM goal_members/).params, [7, 42]);
+});
+
+await test('isGoalMember: no row → false (a non-member)', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  assert.equal(await isGoalMember({ goalId: 7, builderId: 99 }, { pool }), false);
+});
+
+// =========================================================================
+// addGoalScopeModules (BV1.R64 — "ask to widen": set-union append)
+// =========================================================================
+await test('addGoalScopeModules: UPDATE set-unions the new keys, binds (goalId, modules)', async () => {
+  const pool = fakePool((s) => (/^UPDATE goals/.test(s) ? { rows: [{ ...GOAL_ROW, scope_modules: ['art-pipeline', 'gds-core'] }] } : null));
+  const out = await addGoalScopeModules({ goalId: 7, modules: ['art-pipeline'] }, { pool });
+  assert.deepEqual(out.scope_modules, ['art-pipeline', 'gds-core']);
+  const upd = find(pool.queries, /^UPDATE goals/);
+  assert.deepEqual(upd.params, [7, ['art-pipeline']]);
+  assert.match(upd.sql, /array_agg\(DISTINCT m ORDER BY m\)/, 'dedupes existing + new keys');
+  assert.match(upd.sql, /unnest\(scope_modules \|\| \$2::text\[\]\)/, 'unions the requested keys onto the existing scope');
+  assert.match(upd.sql, /updated_at = now\(\)/);
+});
+
+await test('addGoalScopeModules: unknown goal returns null', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  assert.equal(await addGoalScopeModules({ goalId: 404, modules: ['x'] }, { pool }), null);
+});
+
+// =========================================================================
+// setGoalSuccessor (BV1.R64 — rescope carry-forward lineage)
+// =========================================================================
+await test('setGoalSuccessor: UPDATE stamps succeeded_by_goal_id, binds (goalId, successorId)', async () => {
+  const pool = fakePool((s) => (/^UPDATE goals/.test(s) ? { rows: [{ ...GOAL_ROW, succeeded_by_goal_id: 12 }] } : null));
+  const out = await setGoalSuccessor({ goalId: 7, successorId: 12 }, { pool });
+  assert.equal(out.succeeded_by_goal_id, 12);
+  const upd = find(pool.queries, /^UPDATE goals/);
+  assert.deepEqual(upd.params, [7, 12]);
+  assert.match(upd.sql, /succeeded_by_goal_id = \$2/);
+  assert.match(upd.sql, /updated_at = now\(\)/);
+});
+
+await test('setGoalSuccessor: unknown goal returns null', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  assert.equal(await setGoalSuccessor({ goalId: 404, successorId: 12 }, { pool }), null);
+});
+
+// =========================================================================
+// reorderGoals (task 1760 — Archon drag-to-reorder)
+// =========================================================================
+await test('reorderGoals: full-set list SELECTs the version set, then UPDATEs sort_order by position', async () => {
+  const pool = fakePool((s) => {
+    if (/SELECT id FROM goals WHERE version_id/.test(s)) return { rows: [{ id: 7 }, { id: 8 }, { id: 9 }] };
+    if (/UPDATE goals g/.test(s)) return { rows: [
+      { ...GOAL_ROW, id: 9, sort_order: 0 },
+      { ...GOAL_ROW, id: 7, sort_order: 1 },
+      { ...GOAL_ROW, id: 8, sort_order: 2 },
+    ] };
+    return null;
+  });
+  const out = await reorderGoals({ versionId: 'BONGOS-V1', orderedIds: [9, 7, 8] }, { pool });
+  assert.deepEqual(out.map((g) => g.id), [9, 7, 8], 'returns rows in the requested order');
+  const upd = find(pool.queries, /UPDATE goals g/);
+  assert.deepEqual(upd.params, [[9, 7, 8], [0, 1, 2]], 'binds orderedIds + their 0-based positions');
+});
+
+// The UI only ever renders a status-filtered SLICE of a version's goals
+// (roadmap excludes archived; the Goals page defaults to open-only) — so a
+// scoped reorder of a subset must succeed, not fail-closed (this was the
+// task-1760 launch bug: any version with one archived goal could never be
+// reordered at all, since the client could never round-trip an id it never
+// rendered). The goal(s) not named keep their relative order, appended after.
+await test('reorderGoals: a partial list (a hidden/unrendered goal) succeeds, remainder appended after', async () => {
+  const pool = fakePool((s) => {
+    if (/SELECT id FROM goals WHERE version_id/.test(s)) return { rows: [{ id: 7 }, { id: 8 }, { id: 9 }] };
+    if (/UPDATE goals g/.test(s)) return { rows: [
+      { ...GOAL_ROW, id: 9, sort_order: 0 },
+      { ...GOAL_ROW, id: 7, sort_order: 1 },
+      { ...GOAL_ROW, id: 8, sort_order: 2 },
+    ] };
+    return null;
+  });
+  // Client only rendered/reordered [9, 7]; goal 8 (e.g. archived) was never shown.
+  const out = await reorderGoals({ versionId: 'BONGOS-V1', orderedIds: [9, 7] }, { pool });
+  assert.deepEqual(out.map((g) => g.id), [9, 7], 'returns only the touched subset, in the requested order');
+  const upd = find(pool.queries, /UPDATE goals g/);
+  assert.deepEqual(upd.params, [[9, 7, 8], [0, 1, 2]], 'the unrendered goal (8) is appended after the reordered slice');
+});
+
+await test('reorderGoals: an id from another version fails closed', async () => {
+  const pool = fakePool((s) => (/SELECT id FROM goals WHERE version_id/.test(s) ? { rows: [{ id: 7 }, { id: 8 }] } : null));
+  await assert.rejects(
+    () => reorderGoals({ versionId: 'BONGOS-V1', orderedIds: [7, 8, 999] }, { pool }),
+    (err) => err.code === 'SET_MISMATCH'
+  );
+});
+
+await test('reorderGoals: an empty list fails closed', async () => {
+  const pool = fakePool((s) => (/SELECT id FROM goals WHERE version_id/.test(s) ? { rows: [{ id: 7 }] } : null));
+  await assert.rejects(
+    () => reorderGoals({ versionId: 'BONGOS-V1', orderedIds: [] }, { pool }),
+    (err) => err.code === 'SET_MISMATCH'
+  );
+});
+
+await test('reorderGoals: a duplicated id in the list fails closed', async () => {
+  const pool = fakePool((s) => (/SELECT id FROM goals WHERE version_id/.test(s) ? { rows: [{ id: 7 }, { id: 8 }] } : null));
+  await assert.rejects(
+    () => reorderGoals({ versionId: 'BONGOS-V1', orderedIds: [7, 7] }, { pool }),
+    (err) => err.code === 'SET_MISMATCH'
+  );
+});
+
+// -------------------------------------------------------------------------
+summary();

package/tests/goal_wall_proof.mjs

@@ -0,0 +1,112 @@
+// tests/goal_wall_proof.mjs — the BONGOS-V1 C6 acceptance proof (BV1.R66, ADR 0086 §7).
+//
+// C6 done-when item 5: a sub-Metic builder demonstrably AUTHORS + CLAIMS + SHIPS a
+// task inside an assigned goal, while being BLOCKED server-side from authoring one
+// that touches a protected path OR a module outside scope — the proof the goal wall
+// holds END-TO-END. The LIVE deployed-gate transcript (a real goal + a real 403 on
+// prod) is in docs/reviews/bongos-v1-c6-goal-wall-proof.md; this file is the
+// permanent, re-runnable assertion of the same story, using the SAME pure code the
+// deployed server runs.
+//
+// The wall is TWO independent layers (ADR 0086 §7), and this proves BOTH + the linkage:
+//   CREATE-TIME (first filter, ADVISORY — sees only DECLARED touches):
+//     authorizeGoalTaskCreate + goal-scope-check — bounds the author to the goal's
+//     modules and blocks a sub-Metic from the protected core.
+//   SHIP-TIME (authoritative — runs on the REAL committed diff):
+//     checkPermissionPaths (the grader permissionPathPrePass + the post-push
+//     main-audit, SEC #863) — catches a MIS-DECLARED task whose real diff reaches
+//     protected paths even if it slipped the create gate.
+//
+// The EXHAUSTIVE create-time vector table lives in tests/goal_abuse_matrix.mjs (R61);
+// this file proves the END-TO-END story the matrix doesn't: the ship-time backstop
+// and the create->ship linkage.
+//
+// Run:  node tests/goal_wall_proof.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { authorizeGoalTaskCreate } = require('../modules/lifecycle/routes/goals.js');
+const { deriveRequiredRank } = require('../modules/lifecycle/db.js');
+const { checkPermissionPaths } = require('../src/bongos/permission-path-check.js');
+const { checkRouteRanks, MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
+const { test, summary } = makeRunner();
+
+// A sub-Metic member working an `ideas`-scoped (non-protected) goal — the exact shape
+// of the live proof goal on prod (see the doc for the real transcript).
+const SUBMETIC = 'xenos';
+const GOAL = { id: 42, version_id: 'BONGOS-V1', status: 'open', scope_modules: ['ideas'] };
+const GOAL_PROTECTED = { id: 43, version_id: 'BONGOS-V1', status: 'open', scope_modules: ['lifecycle'] };
+const VERSION = { id: 'BONGOS-V1', status: 'planning' };
+const IN_SCOPE = ['modules/ideas/routes/inbox.js'];
+const OUTSIDE_MODULE = ['modules/game/rooms/world.js'];
+const PROTECTED = ['migrations/999_goal_authored.sql'];
+
+// ---- 1. CREATE-TIME: the maneuverability grant + the two blocks ----
+await test('create-time: a sub-Metic member CAN author an in-scope task (the grant)', () => {
+  const d = authorizeGoalTaskCreate({ goal: GOAL, version: VERSION, isMember: true, builderRank: SUBMETIC, touches: IN_SCOPE });
+  assert.equal(d.ok, true, JSON.stringify(d));
+});
+await test('create-time: a sub-Metic is BLOCKED authoring OUTSIDE the goal modules -> 403 out_of_scope', () => {
+  const d = authorizeGoalTaskCreate({ goal: GOAL, version: VERSION, isMember: true, builderRank: SUBMETIC, touches: OUTSIDE_MODULE });
+  assert.equal(d.status, 403); assert.equal(d.body.error, 'out_of_scope');
+});
+await test('create-time: a sub-Metic is BLOCKED authoring into the PROTECTED core -> 403 protected_path', () => {
+  // Even inside a protected-scope goal: scope-subset passes, the rank floor blocks.
+  const d = authorizeGoalTaskCreate({ goal: GOAL_PROTECTED, version: VERSION, isMember: true, builderRank: SUBMETIC, touches: PROTECTED });
+  assert.equal(d.status, 403); assert.equal(d.body.error, 'protected_path');
+});
+await test('create-time: a NON-member is BLOCKED -> 403 not_a_member (membership before scope)', () => {
+  const d = authorizeGoalTaskCreate({ goal: GOAL, version: VERSION, isMember: false, builderRank: SUBMETIC, touches: IN_SCOPE });
+  assert.equal(d.status, 403); assert.equal(d.body.error, 'not_a_member');
+});
+
+// ---- 2. NO SELF-ESCALATION: the auto-derived rank floor (ADR 0084) ----
+await test('no self-escalation: an in-scope task derives to xenos — the author can claim their OWN work', () => {
+  assert.equal(deriveRequiredRank(IN_SCOPE, false), 'xenos');
+});
+await test('no self-escalation: a protected task auto-floors to metic — the sub-Metic author CANNOT claim it', () => {
+  assert.equal(deriveRequiredRank(PROTECTED, false), 'metic');
+});
+
+// ---- 3. SHIP-TIME: the authoritative defense on the REAL committed diff ----
+// Even if a task's DECLARED touches slip the create gate, the ship-time gates (grader
+// permissionPathPrePass + post-push main-audit) run checkPermissionPaths on the REAL
+// diff. A sub-Metic diff hitting a protected path fails closed; a Metic+ clears it.
+await test('ship-time: a sub-Metic REAL diff touching a protected path fails closed (hardFail)', () => {
+  const r = checkPermissionPaths({ changedFiles: PROTECTED, builderRank: SUBMETIC });
+  assert.equal(r.hardFail, true);
+  assert.deepEqual(r.protectedHits.map((h) => h.file), PROTECTED);
+});
+await test('ship-time: the same protected diff by a Metic+ clears the floor', () => {
+  assert.equal(checkPermissionPaths({ changedFiles: PROTECTED, builderRank: 'metic' }).hardFail, false);
+});
+await test('ship-time: a sub-Metic in-scope real diff is clean (the happy path ships)', () => {
+  assert.equal(checkPermissionPaths({ changedFiles: IN_SCOPE, builderRank: SUBMETIC }).hardFail, false);
+});
+
+// ---- 4. THE GATE CANNOT SILENTLY DRIFT: the route-rank pins (BV1.R61) ----
+await test('drift-proof: the bounded-authoring keystone is pinned + classifies to its pin (live)', () => {
+  assert.equal((MODULE_EXPECTED_RANKS.lifecycle || {})['POST /goals/:id/tasks'], 'any-builder');
+  const res = checkRouteRanks();
+  const r = res.routes.find((x) => x.key === 'POST /goals/:id/tasks');
+  assert.ok(r, 'the keystone route must exist live');
+  assert.equal(r.rank, 'any-builder', 'a drift here would red the build (R61 pin)');
+});
+
+// ---- 5. THE LINKAGE: create-time is advisory, ship-time is authoritative ----
+// The two layers are INDEPENDENT and COMPLEMENTARY: the create gate sees only the
+// DECLARED touches (a mis-declaration can slip it), but the ship gate re-checks the
+// REAL diff and fails closed. A mis-declared protected task therefore passes create
+// yet dies at ship — the wall holds even when the first filter is fooled.
+await test('linkage: a MIS-DECLARED task (declares in-scope, real diff protected) passes create but DIES at ship', () => {
+  const create = authorizeGoalTaskCreate({ goal: GOAL, version: VERSION, isMember: true, builderRank: SUBMETIC, touches: IN_SCOPE });
+  assert.equal(create.ok, true, 'the advisory create gate is fooled by a mis-declaration (sees only declared touches)');
+  const ship = checkPermissionPaths({ changedFiles: PROTECTED, builderRank: SUBMETIC });
+  assert.equal(ship.hardFail, true, 'the authoritative ship gate catches the real protected diff');
+});
+
+summary();