@bongos/core 1.17.0

package/tests/migration_namespace.mjs

@@ -0,0 +1,185 @@
+// tests/migration_namespace.mjs
+//
+// ADR 0108 §5 (configurable-root W5 / task 1885) — cross-repo migration numbering.
+// Pins the pure discipline helpers so the byte-identical-today / collision-proof-tomorrow
+// contract can't silently rot:
+//   1. parseMigrationName splits bare AND namespaced (core_/<key>_) basenames.
+//   2. filenameViolation enforces new core→core_, new module→<key>_, instance bare,
+//      while grandfathering the existing bare files (core ≤ 187; game/demo modules).
+//   3. stemCollisions catches the real bug: two sources sharing a schema_migrations stem.
+//   4. nextInNamespace / lineageReport count both forms so an allocator can't reuse a number.
+//
+// No fs/git — the helpers are pure. Run:  node tests/migration_namespace.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ns = require('../scripts/gds/migration-namespace.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ---- parseMigrationName ----------------------------------------------------
+t('parseMigrationName: bare NNN_slug.sql', () => {
+  const p = ns.parseMigrationName('018_pms_v3_planning_seed.sql');
+  assert.equal(p.ok, true);
+  assert.equal(p.bare, true);
+  assert.equal(p.prefix, null);
+  assert.equal(p.number, 18);
+  assert.equal(p.slug, 'pms_v3_planning_seed');
+});
+
+t('parseMigrationName: core_NNN_slug.sql', () => {
+  const p = ns.parseMigrationName('core_188_add_widget.sql');
+  assert.equal(p.ok, true);
+  assert.equal(p.bare, false);
+  assert.equal(p.prefix, 'core');
+  assert.equal(p.number, 188);
+  assert.equal(p.slug, 'add_widget');
+});
+
+t('parseMigrationName: multi-word module prefix splits at the number, not greedily', () => {
+  const p = ns.parseMigrationName('dev_box_003_add_col.sql');
+  assert.equal(p.prefix, 'dev_box', 'dev_box_003 → prefix dev_box, not dev');
+  assert.equal(p.number, 3);
+  assert.equal(p.slug, 'add_col');
+});
+
+t('parseMigrationName: existing economy/lifecycle files parse as prefixed', () => {
+  assert.deepEqual(
+    { prefix: ns.parseMigrationName('economy_001_fix.sql').prefix, number: ns.parseMigrationName('economy_001_fix.sql').number },
+    { prefix: 'economy', number: 1 });
+  assert.equal(ns.parseMigrationName('lifecycle_001_goal_first_leads.sql').prefix, 'lifecycle');
+});
+
+t('parseMigrationName: non-migration names are not migrations', () => {
+  for (const n of ['README.md', '.keep', 'notes.txt', 'schema.sql' /* no NNN_ */]) {
+    assert.equal(ns.parseMigrationName(n).ok, false, `${n} should not parse as a migration`);
+  }
+  assert.equal(ns.migrationNumberOf('README.md'), null);
+  assert.equal(ns.migrationNumberOf('core_188_x.sql'), 188);
+  assert.equal(ns.migrationNumberOf('188_x.sql'), 188);
+});
+
+// ---- filenameViolation: CORE -----------------------------------------------
+t('filenameViolation: legacy bare core (≤187) is grandfathered', () => {
+  assert.equal(ns.filenameViolation('core', '003_pms.sql'), null);
+  assert.equal(ns.filenameViolation('core', '187_goal_sort_order.sql'), null);
+});
+
+t('filenameViolation: a NEW bare core (>187) is flagged', () => {
+  const v = ns.filenameViolation('core', '188_add_thing.sql');
+  assert.ok(v && /core_-prefixed/.test(v), 'new bare core migration must be flagged as needing core_ prefix');
+  assert.ok(/core_188_add_thing\.sql/.test(v), 'the fix hint names the namespaced form');
+});
+
+t('filenameViolation: a correctly core_-prefixed migration passes', () => {
+  assert.equal(ns.filenameViolation('core', 'core_188_add_thing.sql'), null);
+  assert.equal(ns.filenameViolation('core', 'core_999_late.sql'), null);
+});
+
+t('filenameViolation: a core migration wearing another namespace is flagged', () => {
+  const v = ns.filenameViolation('core', 'instance_188_x.sql');
+  assert.ok(v && /must be core_-prefixed/.test(v));
+});
+
+// ---- filenameViolation: INSTANCE -------------------------------------------
+t('filenameViolation: instance stays bare (or instance_) — both pass', () => {
+  assert.equal(ns.filenameViolation('instance', '188_planning_seed.sql'), null, 'bare instance ok');
+  assert.equal(ns.filenameViolation('instance', 'instance_188_planning_seed.sql'), null, 'instance_ prefix ok');
+});
+
+t('filenameViolation: an instance file wearing the core namespace is flagged', () => {
+  const v = ns.filenameViolation('instance', 'core_188_x.sql');
+  assert.ok(v && /another source's namespace/.test(v));
+});
+
+// ---- filenameViolation: MODULE ---------------------------------------------
+t('filenameViolation: legacy bare module (game/demo) grandfathered', () => {
+  assert.equal(ns.filenameViolation('module', '001_initial.sql', { moduleKey: 'game' }), null);
+  assert.equal(ns.filenameViolation('module', '001_demo_pings.sql', { moduleKey: 'demo' }), null);
+});
+
+t('filenameViolation: NEW module migration must be <key>_-prefixed', () => {
+  const v = ns.filenameViolation('module', '001_first.sql', { moduleKey: 'security' });
+  assert.ok(v && /security_-prefixed|security_001_first/.test(v), 'a new non-legacy module bare migration is flagged');
+  assert.equal(ns.filenameViolation('module', 'security_001_first.sql', { moduleKey: 'security' }), null);
+});
+
+t('filenameViolation: hyphenated module key maps to underscore prefix', () => {
+  assert.equal(ns.sqlNamespace('dev-box'), 'dev_box');
+  assert.equal(ns.filenameViolation('module', 'dev_box_003_x.sql', { moduleKey: 'dev-box' }), null);
+  const v = ns.filenameViolation('module', '003_x.sql', { moduleKey: 'dev-box' });
+  assert.ok(v && /dev_box_-prefixed|dev_box_003_x/.test(v));
+});
+
+// ---- stemCollisions --------------------------------------------------------
+t('stemCollisions: none when sources are distinct (the live tree shape)', () => {
+  const files = [
+    { source: 'core', basename: '187_a.sql' },
+    { source: 'instance', basename: '186_b.sql' },
+    { source: 'module', moduleKey: 'game', basename: '001_initial.sql' },
+  ];
+  assert.deepEqual(ns.stemCollisions(files), []);
+});
+
+t('stemCollisions: catches two sources sharing a stem (the silent-skip bug)', () => {
+  // Core and instance BOTH allocate a bare 188_add_index → same schema_migrations stem →
+  // migrate.sh applies one, silently skips the other. This is the exact hazard.
+  const files = [
+    { source: 'core', basename: '188_add_index.sql' },
+    { source: 'instance', basename: '188_add_index.sql' },
+  ];
+  const c = ns.stemCollisions(files);
+  assert.equal(c.length, 1);
+  assert.equal(c[0].stem, '188_add_index');
+  assert.deepEqual(c[0].files, ['core/188_add_index.sql', 'instance/188_add_index.sql']);
+});
+
+t('stemCollisions: namespacing REMOVES the collision', () => {
+  // The cure: core_188_add_index vs 188_add_index → different stems → both apply.
+  const files = [
+    { source: 'core', basename: 'core_188_add_index.sql' },
+    { source: 'instance', basename: '188_add_index.sql' },
+  ];
+  assert.deepEqual(ns.stemCollisions(files), []);
+});
+
+// ---- nextInNamespace / lineageReport ---------------------------------------
+t('nextInNamespace: counts bare AND prefixed forms (no number reuse)', () => {
+  assert.equal(ns.nextInNamespace(['003_a.sql', 'core_188_b.sql', 'core_190_c.sql']), 191,
+    'a prefixed 190 must be counted → next is 191, not 4');
+  assert.equal(ns.nextInNamespace([]), 1, 'empty namespace starts at 1');
+});
+
+t('lineageReport: independent allocators are safe once namespaced', () => {
+  const r = ns.lineageReport({
+    core: ['187_x.sql', 'core_188_y.sql'],
+    instance: ['186_seed.sql'],
+    modulesByKey: { economy: ['economy_001_a.sql'] },
+  });
+  assert.equal(r.nextCore, 189, 'max(187,188)+1');
+  assert.equal(r.nextInstance, 187, 'max(186)+1');
+  assert.equal(r.nextByModule.economy, 2);
+  assert.deepEqual(r.collisions, []);
+  assert.deepEqual(r.violations, []);
+  assert.equal(r.consistent, true);
+});
+
+t('lineageReport: surfaces a real cross-source collision as NOT consistent', () => {
+  const r = ns.lineageReport({
+    core: ['188_dup.sql'],       // bare core >187 → also a filename violation
+    instance: ['188_dup.sql'],   // same stem as core → collision
+  });
+  assert.equal(r.consistent, false);
+  assert.ok(r.collisions.length >= 1, 'the shared stem is reported');
+  assert.ok(r.violations.some((v) => /core_-prefixed/.test(v)), 'the bare-core violation is reported');
+});
+
+console.log(`\nmigration_namespace: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/migrations_fresh_replay_guard.mjs

@@ -0,0 +1,38 @@
+// tests/migrations_fresh_replay_guard.mjs — core migrations must replay on a FRESH empty DB
+// (task 1238 / ADR 0062 §5+§8). The full proof is scripts/verify-gds-only-schema.sh (needs a live
+// Postgres, so it runs in a PG-present lane, not this DB-free unit gate). This is the cheap static
+// backstop: it locks in the one fix the verifier exposed and stops a future data-coupled
+// task_dependencies seed from silently re-breaking fresh-instance bringup.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync, readdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const MIG = path.join(ROOT, 'migrations');
+const GUARD = /IF NOT EXISTS \(\s*SELECT 1 FROM tasks\s*\)/; // the empty-tasks fresh-DB guard
+const coreMigrations = () => readdirSync(MIG).filter((n) => /^\d.*\.sql$/.test(n));
+
+test('migration 021 guards its task_dependencies seed against an empty tasks table (task 1238)', () => {
+  const sql = readFileSync(path.join(MIG, '021_v3_renumber_and_deps.sql'), 'utf8');
+  assert.match(sql, /INSERT INTO task_dependencies/, '021 still carries the dependency seed');
+  assert.match(sql, GUARD, '021 must guard the seed so an empty-tasks fresh DB no-ops it');
+  // the guard must PRECEDE the first dependency INSERT (otherwise the INSERTs run unguarded)
+  assert.ok(
+    sql.search(GUARD) < sql.indexOf('INSERT INTO task_dependencies'),
+    'the empty-tasks guard must come before the task_dependencies INSERTs'
+  );
+});
+
+test('no core migration seeds task_dependencies with literal ids WITHOUT a fresh-DB guard (task 1238)', () => {
+  // task_dependencies has an FK to tasks(id); seeding literal ids on a fresh DB FK-violates
+  // (ON CONFLICT does NOT suppress an FK violation). Any such seed must be empty-tasks guarded.
+  const SEED_RE = /INSERT INTO task_dependencies[^;]*VALUES\s*\(\s*\d/;
+  for (const f of coreMigrations()) {
+    const sql = readFileSync(path.join(MIG, f), 'utf8');
+    if (SEED_RE.test(sql)) {
+      assert.match(sql, GUARD, `${f} seeds task_dependencies with literal ids but lacks the empty-tasks fresh-DB guard (task 1238) — it would FK-violate on a fresh instance bringup`);
+    }
+  }
+});

package/tests/mirror_lineage_fulltree.mjs

@@ -0,0 +1,45 @@
+// tests/mirror_lineage_fulltree.mjs — the C9 proof's FULL-TREE acceptance, wired
+// into the DB-free unit gate (task 1703). The sibling tests/mirror_lineage_proof.mjs
+// only exercises the pure helpers (parseEnumChecks / numberingDivergence / …); the
+// actual "the redacted publishable mirror leaks nothing" invariant lived only in
+// mirror-lineage-check.js's runSimulation(), which nothing gated — so it could
+// silently rot (and did: a stray NUL byte made a source file publish UNREDACTED,
+// leaking an instance literal, and no CI check caught it). This test runs the real
+// simulation against the current tree so that regression fails the build.
+//
+// Uses no synthetic fixtures and embeds no instance literal itself: it just invokes
+// runSimulation(), which redacts every publishable file exactly as the export does
+// and asserts zero residual leaks + private⇄public migration-numbering/enum stability.
+// Filesystem + git (git ls-files) are the only dependencies — no DB, no network.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { runSimulation } = require('../scripts/gds/mirror-lineage-check.js');
+
+test('C9 full-tree simulation: the redacted publishable mirror leaks nothing', () => {
+  const report = runSimulation();
+
+  const leakLines = report.leaks
+    .slice(0, 20)
+    .map((l) => `  ${l.path}: ${l.label}${l.sample ? ` (${l.sample})` : ''}`)
+    .join('\n');
+  assert.equal(
+    report.leaks.length,
+    0,
+    `residual instance-literal/secret/IP leak(s) in the redacted mirror — fix mirror-redact.js rules or publish-manifest.js exclusions:\n${leakLines}`
+  );
+
+  assert.equal(
+    report.numbering.consistent,
+    true,
+    `core migration numbering diverged private⇄mirror: missing=[${report.numbering.missing}] extra=[${report.numbering.extra}]`
+  );
+
+  assert.equal(
+    report.drift.length,
+    0,
+    `redaction altered enum value-list(s) in ${report.drift.length} migration(s): ${report.drift.map((d) => d.path).join(', ')}`
+  );
+});

package/tests/mirror_lineage_proof.mjs

@@ -0,0 +1,72 @@
+// tests/mirror_lineage_proof.mjs — the C9 lineage-proof pure helpers (V4.R73 /
+// task 1212). DB-free + network-free; picked up by run-unit-tests.js. Uses only
+// synthetic SQL/paths so the published test carries no real instance literal.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const {
+  migrationNumbersFromPaths, parseEnumChecks, numberingDivergence, enumDrift,
+} = require('../scripts/gds/mirror-lineage-check.js');
+
+test('migrationNumbersFromPaths picks CORE migrations only (not module/ADR numbers)', () => {
+  const set = migrationNumbersFromPaths([
+    'migrations/003_pms.sql',
+    'migrations/044_tasks_requires_rank.sql',
+    'migrations/060_access_requests.sql',
+    'modules/game/migrations/game_001_world.sql', // module migration — excluded
+    'docs/adr/0099-delayed-redacted-mirror-export.md', // ADR — excluded
+    'src/bongos/db.js', // not a migration
+  ]);
+  assert.deepEqual([...set].sort((a, b) => a - b), [3, 44, 60]);
+});
+
+test('parseEnumChecks extracts the quoted value-lists from CHECK (... IN (...))', () => {
+  const sql = `
+    CREATE TABLE tasks (
+      status TEXT NOT NULL CHECK (status IN ('backlog', 'ready', 'active')),
+      track  TEXT CHECK (track IN ('product', 'internal'))
+    );`;
+  const lists = parseEnumChecks(sql);
+  // Sorted lists, sorted set-of-lists — deterministic.
+  assert.deepEqual(lists, [
+    ["'active'", "'backlog'", "'ready'"],
+    ["'internal'", "'product'"],
+  ]);
+});
+
+test('parseEnumChecks ignores a non-enum IN (subquery, no string literals)', () => {
+  assert.deepEqual(parseEnumChecks('DELETE FROM t WHERE id IN (SELECT id FROM other)'), []);
+  assert.deepEqual(parseEnumChecks(''), []);
+  assert.deepEqual(parseEnumChecks(null), []);
+});
+
+test('enumDrift is EMPTY when redaction only touched a comment domain, not the enum', () => {
+  const original = `-- docs: https://widgetco.example/schema\nCHECK (status IN ('backlog', 'ready'))`;
+  // A faithful redaction neutralizes the domain but leaves the enum values intact.
+  const redacted = `-- docs: https://example.com/schema\nCHECK (status IN ('backlog', 'ready'))`;
+  assert.deepEqual(enumDrift([{ path: 'migrations/003_x.sql', original, redacted }]), []);
+});
+
+test('enumDrift CATCHES an enum value altered by redaction (the divergence it guards)', () => {
+  const original = `CHECK (owner IN ('zoltan', 'admin'))`;
+  // A (hypothetical) over-broad owner-redaction that ate an enum value → divergence.
+  const redacted = `CHECK (owner IN ('example-owner', 'admin'))`;
+  const drift = enumDrift([{ path: 'migrations/003_x.sql', original, redacted }]);
+  assert.equal(drift.length, 1);
+  assert.equal(drift[0].path, 'migrations/003_x.sql');
+});
+
+test('numberingDivergence flags a dropped migration and is otherwise consistent', () => {
+  assert.deepEqual(
+    numberingDivergence(new Set([1, 2, 3]), new Set([1, 2, 3])),
+    { missing: [], extra: [], consistent: true }
+  );
+  const dropped = numberingDivergence(new Set([1, 2, 3]), new Set([1, 3]));
+  assert.deepEqual(dropped.missing, [2]);
+  assert.equal(dropped.consistent, false);
+  const gained = numberingDivergence(new Set([1, 2]), new Set([1, 2, 9]));
+  assert.deepEqual(gained.extra, [9]);
+  assert.equal(gained.consistent, false);
+});

package/tests/mirror_redact.mjs

@@ -0,0 +1,193 @@
+// tests/mirror_redact.mjs
+//
+// GDS-V4 R72 (task 1211) — locks the public-mirror FILE-LEVEL redactor
+// (scripts/gds/mirror-redact.js, ADR 0098 §6). A silent leak from a publish boundary is
+// catastrophic, so this proves:
+//   1. instance literals (domain + subdomains, repo/db/world token, owner login + alias,
+//      company) are redacted; localhost/private/RFC-5737 IPs are KEPT, public IPv4/IPv6
+//      (the droplet) are redacted;
+//   2. the no-leak DETECTOR (findLeaks) is STRICTER than redaction — a raw literal
+//      substring is caught even where a word-bounded redaction rule would miss it (the
+//      `\bowner\b`-inside-a-regex-string gap that bit us during the build);
+//   3. redaction is a fixed point (idempotent) and the secret backstop fires;
+//   4. the SELF-LEAK INVARIANT: the redactor's own (published) source contains NO real
+//      instance literal — everything is derived at runtime from branding.
+//
+// Uses a SYNTHETIC instance ("widgetco"/"zoltan") for fixtures so this published test
+// file carries no real instance literal. The self-leak check sources the REAL literals
+// from config/branding.json at runtime (that file is excluded from the mirror), never
+// hard-coding them here.
+//
+// Run:  node tests/mirror_redact.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const R = require('../scripts/gds/mirror-redact.js');
+const {
+  buildRedactionRules, collectSensitiveLiterals, redactText, findLeaks, findSecretLeak,
+  deriveInstanceLiterals, isPublicRoutableIPv4, isPublicRoutableIPv6, parseIPv6, registrableLabel,
+} = R;
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(HERE, '..');
+
+// Synthetic instance — non-overlapping coined words so assertions are unambiguous.
+const BRANDING = {
+  domains: {
+    publicOrigin: 'https://widgetco.com',
+    statusOrigin: 'https://status.widgetco.com',
+    cookieDomain: '.widgetco.com',
+  },
+  repo: { owner: 'zoltan', name: 'widgetco' },
+  firstAdmin: 'zoltan',
+  identity: { worldName: 'Widgetco', company: { name: 'WidgetCorp', site: 'https://widgetcorp.com' } },
+};
+const rules = buildRedactionRules(BRANDING, { owners: ['zoltan-real-name'] });
+const literals = collectSensitiveLiterals(BRANDING, { owners: ['zoltan-real-name'] });
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── domains + subdomains ────────────────────────────────────────────────────────────
+t('domain + subdomains → example.com (subdomain label preserved)', () => {
+  const out = redactText('go to https://widgetco.com or https://status.widgetco.com today', rules);
+  assert.ok(!/widgetco/i.test(out), `still leaks: ${out}`);
+  assert.ok(out.includes('example.com'), out);
+  assert.ok(out.includes('status.example.com'), out);
+});
+
+// ── owner login: UNBOUNDED — catches the \bowner\b-in-a-regex gap + home paths ─────────
+t('owner login redacted even preceded by a word char (the audit-authorship.sh gap)', () => {
+  const out = redactText("pattern='(\\bzoltan\\b)'; path /Users/zoltan/repo; by zoltan", rules);
+  assert.ok(!/zoltan/i.test(out), `still leaks owner: ${out}`);
+  assert.ok(out.includes('example-owner'), out);
+});
+t('owner ALIAS (real name / home-dir username) redacted, covering /Users/<alias>', () => {
+  const out = redactText('/Users/zoltan-real-name/dev and author zoltan-real-name', rules);
+  assert.ok(!/zoltan-real-name/i.test(out), out);
+});
+
+// ── world + company tokens ────────────────────────────────────────────────────────────
+t('world name + company name redacted (case-insensitive)', () => {
+  const out = redactText('The Widgetco world, fulfilled by WidgetCorp (widgetcorp.com)', rules);
+  assert.ok(!/widgetco/i.test(out), out);
+});
+
+// ── IPv4 floor: public redacted, private/loopback/RFC-5737 kept ───────────────────────
+t('public IPv4 redacted; private/loopback/CGNAT/TEST-NET kept', () => {
+  const out = redactText('pub 8.8.8.8 / 104.20.5.9 ; keep 127.0.0.1 10.0.0.1 192.168.1.1 172.16.0.1 169.254.1.1 203.0.113.7 198.51.100.2 192.0.2.9', rules);
+  assert.ok(!out.includes('8.8.8.8') && !out.includes('104.20.5.9'), `public IP leaked: ${out}`);
+  for (const keep of ['127.0.0.1', '10.0.0.1', '192.168.1.1', '172.16.0.1', '169.254.1.1', '203.0.113.7', '198.51.100.2', '192.0.2.9']) {
+    assert.ok(out.includes(keep), `wrongly redacted ${keep}: ${out}`);
+  }
+});
+t('isPublicRoutableIPv4 classifier boundaries', () => {
+  assert.equal(isPublicRoutableIPv4(104, 236, 254, 243), true);
+  assert.equal(isPublicRoutableIPv4(8, 8, 8, 8), true);
+  assert.equal(isPublicRoutableIPv4(127, 0, 0, 1), false);
+  assert.equal(isPublicRoutableIPv4(10, 1, 2, 3), false);
+  assert.equal(isPublicRoutableIPv4(172, 16, 0, 1), false);
+  assert.equal(isPublicRoutableIPv4(172, 32, 0, 1), true); // 172.32 is public (outside 16-31)
+  assert.equal(isPublicRoutableIPv4(192, 168, 0, 1), false);
+  assert.equal(isPublicRoutableIPv4(255, 255, 255, 0), false); // netmask (>=224)
+  assert.equal(isPublicRoutableIPv4(203, 0, 113, 1), false); // TEST-NET-3
+});
+
+// ── IPv6 floor: global unicast redacted, loopback/link-local/ULA kept ─────────────────
+t('public IPv6 (the droplet) redacted; loopback/link-local/ULA kept', () => {
+  const out = redactText('v6 2604:a880:800:14:0:2:ee66:b000 keep fe80::1 fc00::5 ::1', rules);
+  assert.ok(!out.includes('2604:a880'), `public IPv6 leaked: ${out}`);
+  assert.ok(out.includes('fe80::1') && out.includes('fc00::5') && out.includes('::1'), out);
+});
+t('isPublicRoutableIPv6 + a "12:34:56" timestamp is NOT treated as an IP', () => {
+  assert.equal(isPublicRoutableIPv6('2604:a880:800:14:0:2:ee66:b000'), true);
+  assert.equal(isPublicRoutableIPv6('fe80::1'), false);
+  assert.equal(isPublicRoutableIPv6('fc00::5'), false);
+  assert.equal(isPublicRoutableIPv6('::1'), false);
+  assert.equal(isPublicRoutableIPv6('12:34:56'), false); // only 3 groups, no "::" → not an IPv6
+  assert.equal(parseIPv6('2001:db8::1')[0], 0x2001);
+});
+
+// ── the DETECTOR is stricter than redaction ───────────────────────────────────────────
+t('findLeaks catches a raw literal substring a bounded rule would miss', () => {
+  // "azoltanb" has no word boundary around zoltan; a \bzoltan\b rule misses it, the
+  // substring detector does NOT.
+  assert.ok(findLeaks('azoltanb', literals).length > 0);
+  assert.ok(findLeaks('inline widgetco reference', literals).length > 0);
+});
+t('findLeaks is clean on fully-redacted output (fixed point)', () => {
+  const dirty = 'https://widgetco.com by zoltan at 8.8.8.8 and 2604:a880:800:14:0:2:ee66:b000';
+  const clean = redactText(dirty, rules);
+  assert.deepEqual(findLeaks(clean, literals), [], `residual leaks: ${JSON.stringify(findLeaks(clean, literals))}`);
+});
+t('findLeaks flags a public IP even with an empty literal list', () => {
+  assert.ok(findLeaks('reach 8.8.8.8', []).some((l) => l.label === 'public-ip'));
+  assert.deepEqual(findLeaks('reach 127.0.0.1', []), []);
+});
+
+// ── idempotence + secret backstop ─────────────────────────────────────────────────────
+t('redactText is idempotent', () => {
+  const once = redactText('https://widgetco.com zoltan 8.8.8.8', rules);
+  assert.equal(redactText(once, rules), once);
+});
+t('findSecretLeak detects a secret shape, clean text passes', () => {
+  assert.equal(findSecretLeak('token ghp_' + 'a'.repeat(36)), true);
+  assert.equal(findSecretLeak('just ordinary prose here'), false);
+});
+
+// ── vanilla instance (empty branding) — IP floor still works, no token/owner rules ────
+t('empty branding derives no tokens/owners but the IP floor still redacts', () => {
+  const { tokens, owners } = deriveInstanceLiterals({});
+  assert.equal(tokens.size, 0);
+  assert.equal(owners.size, 0);
+  assert.equal(redactText('ip 8.8.8.8', buildRedactionRules({})).includes('8.8.8.8'), false);
+});
+
+// ── SELF-LEAK INVARIANT: the redactor source carries no REAL instance literal ─────────
+t('mirror-redact.js source contains none of THIS instance\'s literals (sourced at runtime)', () => {
+  const brandingPath = path.join(REPO_ROOT, 'config/branding.json');
+  if (!fs.existsSync(brandingPath)) { console.log('       (no config/branding.json — vanilla instance, skipping)'); return; }
+  const branding = JSON.parse(fs.readFileSync(brandingPath, 'utf8'));
+  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts/gds/mirror-redact.js'), 'utf8').toLowerCase();
+  const reals = collectSensitiveLiterals(branding);
+  // Also check the registrable domain label explicitly.
+  const domLabel = registrableLabel(branding?.domains?.publicOrigin);
+  if (domLabel) reals.push(domLabel);
+  for (const lit of reals) {
+    if (typeof lit === 'string' && lit.length >= 4) {
+      assert.ok(!src.includes(lit.toLowerCase()), `redactor source LEAKS instance literal "${lit}" — derive it at runtime instead`);
+    }
+  }
+});
+
+// ── IPv6 boundary guard (task 1688) ─────────────────────────────────────────────────
+// The core packager (scripts/gds/package-core.js) redacts 900+ SOURCE files, exposing
+// a code-vs-prose false positive the prose-heavy mirror rarely hit: a Postgres cast
+// like `$9::bigint` was misread as the address 9:: and CORRUPTED to `$REDACTED_IPbigint`.
+// The guard must kill that false positive with ZERO recall loss on a genuine IPv6.
+t('IPv6 guard: SQL/code `::` casts are neither redacted nor flagged', () => {
+  const sql = "now() + ($9::bigint * interval '1 millisecond')";
+  assert.equal(R.redactPublicIPs(sql), sql);          // no corruption of the cast
+  assert.equal(R.firstPublicIP(sql), null);           // not flagged as a public IP
+  const casts = 'value::int, other::text, beef::json';
+  assert.equal(R.redactPublicIPs(casts), casts);
+  assert.equal(R.firstPublicIP(casts), null);
+});
+t('IPv6 guard: a genuine public IPv6 is STILL redacted + flagged (no recall loss)', () => {
+  const line = 'server = 2606:4700:4700::1111; # dns';
+  assert.ok(R.firstPublicIP(line), 'a real public IPv6 must still be detected');
+  const red = R.redactPublicIPs(line);
+  assert.ok(red.includes(R.REDACTED_IP), 'a real public IPv6 must still be redacted');
+  assert.ok(!red.includes('2606:4700'), 'the real address must not survive');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/model_alloc_prefs.mjs

@@ -0,0 +1,63 @@
+// tests/model_alloc_prefs.mjs — per-builder/instance model allocation (task 2011).
+// Pure-shaper unit tests (no DB), mirroring tests/wandering_prefs.mjs.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const m = require('../modules/builder-settings/model-alloc-prefs.js');
+
+test('code defaults when nothing set: main/subagentDefault=opus, routine=haiku', () => {
+  const eff = m.effectiveAllocation({}, {});
+  assert.deepEqual(eff, { main: 'opus', subagentDefault: 'opus', subagentRoutine: 'haiku' });
+});
+
+test('instance default overrides code default', () => {
+  const eff = m.effectiveAllocation({}, { subagentRoutine: 'sonnet' });
+  assert.equal(eff.subagentRoutine, 'sonnet');
+  assert.equal(eff.main, 'opus'); // untouched → code default
+});
+
+test('builder override wins over instance default', () => {
+  const prefs = { model_allocation: { main: 'sonnet' } };
+  const eff = m.effectiveAllocation(prefs, { main: 'opus', subagentDefault: 'haiku' });
+  assert.equal(eff.main, 'sonnet'); // builder override
+  assert.equal(eff.subagentDefault, 'haiku'); // instance default
+  assert.equal(eff.subagentRoutine, 'haiku'); // code default
+});
+
+test('invalid tiers/slots are dropped (fall through to lower precedence)', () => {
+  const prefs = { model_allocation: { main: 'gpt5', bogus: 'opus' } };
+  assert.deepEqual(m.storedOverride(prefs), {}, 'bad tier + unknown slot dropped');
+  assert.equal(m.effectiveAllocation(prefs, {}).main, 'opus');
+});
+
+test('contract line names all three effective tiers', () => {
+  const c = m.contractFor({ model_allocation: { subagentRoutine: 'sonnet' } }, {});
+  assert.match(c, /main session: opus/);
+  assert.match(c, /subagents default: opus/);
+  assert.match(c, /routine plumbing: sonnet/);
+});
+
+test('validatePatch: good tier passes, null clears, unknown slot / bad tier → 422', () => {
+  assert.deepEqual(m.validatePatch({ main: 'sonnet' }), { ok: true, patch: { main: 'sonnet' } });
+  assert.deepEqual(m.validatePatch({ main: null }), { ok: true, patch: { main: null } });
+  assert.equal(m.validatePatch({ main: 'gpt5' }).ok, false);
+  assert.equal(m.validatePatch({ nope: 'opus' }).ok, false);
+  assert.equal(m.validatePatch(42).ok, false);
+});
+
+test('applyPatch merges + null clears', () => {
+  const base = { main: 'sonnet', subagentRoutine: 'sonnet' };
+  assert.deepEqual(m.applyPatch(base, { subagentDefault: 'haiku' }), { main: 'sonnet', subagentRoutine: 'sonnet', subagentDefault: 'haiku' });
+  assert.deepEqual(m.applyPatch(base, { main: null }), { subagentRoutine: 'sonnet' });
+});
+
+test('describeForApi exposes catalog + defaults + effective + contract', () => {
+  const d = m.describeForApi({ model_allocation: { main: 'sonnet' } }, { subagentRoutine: 'sonnet' });
+  assert.ok(Array.isArray(d.slots) && d.slots.length === 3);
+  assert.deepEqual(d.code_defaults, { main: 'opus', subagentDefault: 'opus', subagentRoutine: 'haiku' });
+  assert.equal(d.instance_default.subagentRoutine, 'sonnet');
+  assert.equal(d.override.main, 'sonnet');
+  assert.equal(d.effective.main, 'sonnet');
+  assert.equal(d.effective.subagentRoutine, 'sonnet');
+});