@bongos/core 1.17.0

package/tests/module_loader.mjs

@@ -0,0 +1,286 @@
+// tests/module_loader.mjs — the module loader (BV1.R41 / task 1410, ADR 0083):
+// discovery + manifest validation + coreVersion gating + mount-behind-auth, all
+// against temp-dir fixtures (hermetic — no real modules/ needed).
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const loader = require(path.join(ROOT, 'src', 'module-loader', 'loader.js'));
+
+// Build a temp modules root with the given { dirName: manifestObjOrRaw, ...extraFiles }.
+function fixtureRoot(spec) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-mods-'));
+  for (const [dir, def] of Object.entries(spec)) {
+    const d = path.join(root, dir);
+    fs.mkdirSync(d, { recursive: true });
+    if (def.manifest !== undefined) {
+      fs.writeFileSync(path.join(d, 'module.json'),
+        typeof def.manifest === 'string' ? def.manifest : JSON.stringify(def.manifest, null, 2));
+    }
+    for (const [rel, content] of Object.entries(def.files || {})) {
+      const fp = path.join(d, rel);
+      fs.mkdirSync(path.dirname(fp), { recursive: true });
+      fs.writeFileSync(fp, content);
+    }
+  }
+  return root;
+}
+
+const validManifest = (key, extra = {}) => ({
+  key, title: key, description: 'd', coreVersion: '^1.0.0', contributes: {}, ...extra,
+});
+
+test('discoverModules: loads a valid module, ignores a dir without module.json', () => {
+  const root = fixtureRoot({
+    'dev-box': { manifest: validManifest('dev-box', { contributes: { routes: ['box'] } }) },
+    'not-a-module': { files: { 'readme.txt': 'hi' } },
+  });
+  const { loaded, errors, skipped } = loader.discoverModules({ roots: [root], core: '1.0.0' });
+  assert.equal(loaded.length, 1);
+  assert.equal(loaded[0].key, 'dev-box');
+  assert.deepEqual(errors, []);
+  assert.deepEqual(skipped, []);
+});
+
+test('discoverModules: an invalid manifest goes to errors, not loaded', () => {
+  const root = fixtureRoot({ bad: { manifest: { key: 'bad' } } }); // missing title/desc/coreVersion/contributes
+  const { loaded, errors } = loader.discoverModules({ roots: [root], core: '1.0.0' });
+  assert.equal(loaded.length, 0);
+  assert.equal(errors.length, 1);
+  assert.ok(errors[0].errors.length >= 1);
+});
+
+test('discoverModules: bad JSON is reported as an error', () => {
+  const root = fixtureRoot({ broken: { manifest: '{ not json' } });
+  const { errors } = loader.discoverModules({ roots: [root], core: '1.0.0' });
+  assert.equal(errors.length, 1);
+  assert.match(errors[0].errors[0], /not valid JSON/);
+});
+
+test('discoverModules: key must match the directory name', () => {
+  const root = fixtureRoot({ 'dir-name': { manifest: validManifest('other-key') } });
+  const { loaded, errors } = loader.discoverModules({ roots: [root], core: '1.0.0' });
+  assert.equal(loaded.length, 0);
+  assert.match(errors[0].errors[0], /must match directory name/);
+});
+
+test('discoverModules: a coreVersion mismatch is SKIPPED (not loaded, not an error)', () => {
+  const root = fixtureRoot({ future: { manifest: validManifest('future', { coreVersion: '^2.0.0' }) } });
+  const { loaded, skipped, errors } = loader.discoverModules({ roots: [root], core: '1.0.0' });
+  assert.equal(loaded.length, 0);
+  assert.equal(errors.length, 0);
+  assert.equal(skipped.length, 1);
+  assert.match(skipped[0].reason, /coreVersion/);
+});
+
+test('discoverModules: a missing modules/ root is empty, not an error', () => {
+  const r = loader.discoverModules({ roots: [path.join(os.tmpdir(), 'does-not-exist-xyz')], core: '1.0.0' });
+  assert.deepEqual(r, { loaded: [], skipped: [], errors: [] });
+});
+
+test('discoveredRegistry: shapes a loaded manifest like a MODULE_REGISTRY entry', () => {
+  loader._reset();
+  const root = fixtureRoot({ econ: { manifest: validManifest('econ', { default: true, provides: ['reward'], contributes: { disciplines: ['x'] } }) } });
+  const reg = loader.discoveredRegistry({ roots: [root], core: '1.0.0' });
+  assert.equal(reg.econ.default, true);
+  assert.equal(reg.econ._discovered, true);
+  assert.deepEqual(reg.econ.contributes.disciplines, ['x']);
+  assert.deepEqual(reg.econ._provides, ['reward']);
+  loader._reset();
+});
+
+test('mountModuleRoutes: mounts an enabled module router, skips a disabled one', () => {
+  loader._reset();
+  // a route factory returns a middleware fn (an express Router IS a function);
+  // we use a plain fn so the test needs no express in the temp dir.
+  const factory = "module.exports = () => function moduleRoute(req, res, next) { next(); };";
+  const root = fixtureRoot({
+    alpha: { manifest: validManifest('alpha', { contributes: { routes: ['main'] } }), files: { 'routes/main.js': factory } },
+    beta: { manifest: validManifest('beta', { contributes: { routes: ['main'] } }), files: { 'routes/main.js': factory } },
+  });
+  const used = [];
+  const fakeRouter = { use: (fn) => used.push(fn) };
+  const mounted = loader.mountModuleRoutes(fakeRouter, { isEnabled: (k) => k === 'alpha' }, { roots: [root], core: '1.0.0' });
+  assert.equal(mounted, 1, 'only the enabled module (alpha) is mounted');
+  assert.equal(used.length, 1);
+  assert.equal(typeof used[0], 'function', 'the mounted thing is a middleware function');
+  loader._reset();
+});
+
+test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49/R72)', () => {
+  // dev-box graduated first (modules/dev-box/, BV1.R43), art-pipeline next
+  // (BV1.R48 / task 1417), discord next (BV1.R47 / task 1416), game next
+  // (BV1.R49 / c9cb5ea1 — public/ + src/world|rooms → modules/game/), then the
+  // declaration-only character-anim module (ADR 0088 / task 1558), then memory —
+  // the first CORE-domain carve (modules/memory/, BV1.R72 / ADR 0091; memory/
+  // recall/search/learnings). The `demo` module is the NET-NEW acceptance proof
+  // (modules/demo/, BV1.R52 / task 1424) — scaffolded with `bongos module new
+  // demo`, one rank-gated route + one namespaced migration, zero core edits.
+  // economy (R77) + ideas (R78) + security (R79) + builder-settings (R80) +
+  // onboarding (R81) + sessions (R82) + autonomy (R83 — conductor/architect/gate
+  // + the routine-timers poller) are the tranche-2 core-domain carves (ADR 0093),
+  // then status-ui (R84) + hall-ui (R85) the two web-surface carves; and
+  // provisioning (ADR 0111 / task 1942) — a net-new feature module (instance hosting).
+  // All are discovered; none has validation errors or coreVersion mismatches.
+  // Membership stays byte-identical via src/modules.js (each leaves MODULE_REGISTRY
+  // and reappears here as discovered). Order is the readdir sort.
+  loader._reset();
+  const snap = loader.loaderSnapshot();
+  assert.deepEqual(snap.loaded, ['art-pipeline', 'autonomy', 'builder-settings', 'character-anim', 'demo', 'dev-box', 'discord', 'economy', 'game', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'provisioning', 'security', 'sessions', 'status-ui']);
+  assert.deepEqual(snap.errors, []);
+  assert.deepEqual(snap.skipped, []);
+  loader._reset();
+});
+
+// --- hallWidgetScripts: enabled module's hall widget appears, disabled vanishes
+//     (BV1.R75 / task 1612, ADR 0062 §4) ---
+
+test('hallWidgetScripts: lists an enabled module that declares uiSections + ships public/hall-widget.js', () => {
+  loader._reset();
+  const widgetJs = "window.OTB.contributeHallWidget({ id: 'alpha-scroll', label: 'Alpha', module: 'alpha', mount(h){} });";
+  const root = fixtureRoot({
+    alpha: {
+      manifest: validManifest('alpha', { contributes: { uiSections: ['alpha'] } }),
+      files: { 'public/hall-widget.js': widgetJs },
+    },
+  });
+  const scripts = loader.hallWidgetScripts({ isEnabled: () => true }, { roots: [root], core: '1.0.0' });
+  assert.deepEqual(scripts, [{ key: 'alpha', src: '/modules/alpha/public/hall-widget.js' }]);
+  loader._reset();
+});
+
+test('hallWidgetScripts: a DISABLED module is never listed (its widget vanishes)', () => {
+  loader._reset();
+  const widgetJs = "window.OTB.contributeHallWidget({ id: 'a', label: 'A', module: 'alpha', mount(h){} });";
+  const root = fixtureRoot({
+    alpha: { manifest: validManifest('alpha', { contributes: { uiSections: ['a'] } }), files: { 'public/hall-widget.js': widgetJs } },
+  });
+  const scripts = loader.hallWidgetScripts({ isEnabled: (k) => k !== 'alpha' }, { roots: [root], core: '1.0.0' });
+  assert.deepEqual(scripts, [], 'a disabled module contributes no hall-widget script');
+  loader._reset();
+});
+
+test('hallWidgetScripts: declares uiSections but ships no client file → declarative-only, skipped', () => {
+  loader._reset();
+  const root = fixtureRoot({
+    alpha: { manifest: validManifest('alpha', { contributes: { uiSections: ['status-only'] } }) }, // no public/hall-widget.js
+  });
+  const scripts = loader.hallWidgetScripts({ isEnabled: () => true }, { roots: [root], core: '1.0.0' });
+  assert.deepEqual(scripts, [], 'a uiSections decl with no client script is not injected');
+  loader._reset();
+});
+
+test('hallWidgetScripts: a module with no uiSections is never listed', () => {
+  loader._reset();
+  const root = fixtureRoot({
+    alpha: { manifest: validManifest('alpha', { contributes: { routes: ['main'] } }), files: { 'public/hall-widget.js': '// stray' } },
+  });
+  const scripts = loader.hallWidgetScripts({ isEnabled: () => true }, { roots: [root], core: '1.0.0' });
+  assert.deepEqual(scripts, [], 'no uiSections → no hall-widget script even if a file exists');
+  loader._reset();
+});
+
+// --- moduleWebSurfaces: an enabled module's host-routed static surface resolves,
+//     a disabled one vanishes (BV1.R84 / task 1635, ADR 0093 §1 / 02-module-map §6) ---
+
+test('moduleWebSurfaces: lists an enabled module that declares webSurfaces + ships the static dir', () => {
+  loader._reset();
+  const root = fixtureRoot({
+    statusish: {
+      manifest: validManifest('statusish', { contributes: { webSurfaces: [{ host: 'status.', dir: 'public' }] } }),
+      files: { 'public/index.html': '<!doctype html><title>s</title>' },
+    },
+  });
+  const surfaces = loader.moduleWebSurfaces({ isEnabled: () => true }, { roots: [root], core: '1.0.0' });
+  assert.equal(surfaces.length, 1);
+  assert.equal(surfaces[0].key, 'statusish');
+  assert.equal(surfaces[0].host, 'status.');
+  assert.equal(surfaces[0].dir, path.join(root, 'statusish', 'public'), 'dir is the ABSOLUTE static path');
+  loader._reset();
+});
+
+test('moduleWebSurfaces: a DISABLED module is never listed (its host routes nowhere)', () => {
+  loader._reset();
+  const root = fixtureRoot({
+    statusish: {
+      manifest: validManifest('statusish', { contributes: { webSurfaces: [{ host: 'status.', dir: 'public' }] } }),
+      files: { 'public/index.html': '<!doctype html>' },
+    },
+  });
+  const surfaces = loader.moduleWebSurfaces({ isEnabled: (k) => k !== 'statusish' }, { roots: [root], core: '1.0.0' });
+  assert.deepEqual(surfaces, [], 'a disabled module contributes no web surface');
+  loader._reset();
+});
+
+test('moduleWebSurfaces: declares a webSurface but ships no dir → skipped (no host routed)', () => {
+  loader._reset();
+  const root = fixtureRoot({
+    statusish: { manifest: validManifest('statusish', { contributes: { webSurfaces: [{ host: 'status.', dir: 'public' }] } }) }, // no public/ dir
+  });
+  const surfaces = loader.moduleWebSurfaces({ isEnabled: () => true }, { roots: [root], core: '1.0.0' });
+  assert.deepEqual(surfaces, [], 'a webSurface decl with no on-disk dir is not served');
+  loader._reset();
+});
+
+test('moduleWebSurfaces: a module with no webSurfaces is never listed', () => {
+  loader._reset();
+  const root = fixtureRoot({
+    alpha: { manifest: validManifest('alpha', { contributes: { routes: ['main'] } }), files: { 'public/index.html': '<!doctype html>' } },
+  });
+  const surfaces = loader.moduleWebSurfaces({ isEnabled: () => true }, { roots: [root], core: '1.0.0' });
+  assert.deepEqual(surfaces, [], 'no webSurfaces → no surface even if a public/ dir exists');
+  loader._reset();
+});
+
+test('the live status-ui module declares its status. web surface (BV1.R84)', () => {
+  loader._reset();
+  const { isModuleEnabled } = require(path.join(ROOT, 'src', 'modules.js'));
+  const surfaces = loader.moduleWebSurfaces({ isEnabled: isModuleEnabled });
+  const statusUi = surfaces.find((s) => s.key === 'status-ui');
+  assert.ok(statusUi, 'status-ui contributes a web surface');
+  assert.equal(statusUi.host, 'status.');
+  assert.ok(fs.existsSync(path.join(statusUi.dir, 'index.html')), 'the served dir holds the status index.html');
+  loader._reset();
+});
+
+test('the live hall-ui module declares its builders. web surface (BV1.R85)', () => {
+  // The hall declares a webSurface like status-ui so the loader DISCOVERS it (it
+  // feeds the scope map, fitness keys, docs, and window.__MODULES__). serve-internal
+  // keeps the hall's DEDICATED serving block reading from this dir (it is partitioned
+  // out of the generic web-surface loop), but the manifest record is real + here.
+  loader._reset();
+  const { isModuleEnabled } = require(path.join(ROOT, 'src', 'modules.js'));
+  const surfaces = loader.moduleWebSurfaces({ isEnabled: isModuleEnabled });
+  const hallUi = surfaces.find((s) => s.key === 'hall-ui');
+  assert.ok(hallUi, 'hall-ui contributes a web surface');
+  assert.equal(hallUi.host, 'builders.');
+  assert.ok(fs.existsSync(path.join(hallUi.dir, 'index.html')), 'the served dir holds the hall index.html');
+  loader._reset();
+});
+
+test('the demo proof module mounts + serves through the loader (BV1.R52 / task 1424)', () => {
+  // BV1.R52 acceptance: the net-new scaffolded module is discovered, is enabled
+  // by config/modules.json, and its route factory builds a real router with the
+  // health read route + the rank-gated ping write route — all with NO core edit.
+  loader._reset();
+  const { isModuleEnabled } = require(path.join(ROOT, 'src', 'modules.js'));
+  assert.equal(isModuleEnabled('demo'), true, 'config/modules.json enables demo');
+
+  const used = [];
+  const fakeRouter = { use: (fn) => used.push(fn) };
+  const mounted = loader.mountModuleRoutes(fakeRouter, { isEnabled: isModuleEnabled });
+  assert.ok(mounted >= 1, 'at least the demo router mounted');
+
+  // The factory builds a real express Router carrying exactly the two routes.
+  const demoRouter = require(path.join(ROOT, 'modules', 'demo', 'routes', 'demo.js'))();
+  assert.equal(typeof demoRouter, 'function', 'a route factory returns an express Router (a function)');
+  const routes = demoRouter.stack.filter((l) => l.route).map((l) => `${Object.keys(l.route.methods)[0].toUpperCase()} ${l.route.path}`);
+  assert.deepEqual(routes.sort(), ['GET /demo/health', 'POST /demo/ping']);
+  loader._reset();
+});

package/tests/module_manifest.mjs

@@ -0,0 +1,194 @@
+// tests/module_manifest.mjs — module.json manifest schema + validator + the
+// tiny semver checker (BV1.R38 / task 1407, ADR 0083).
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { satisfies, isValidRange, parseVersion } = require(path.join(ROOT, 'src', 'module-loader', 'semver.js'));
+const { validateManifest, assertValidManifest } = require(path.join(ROOT, 'src', 'module-loader', 'manifest-schema.js'));
+
+const baseManifest = () => ({
+  key: 'dev-box',
+  title: 'Dev boxes',
+  description: 'Per-builder cloud dev environments.',
+  coreVersion: '^1.0.0',
+  contributes: { routes: ['box'], pollers: ['box-lifecycle'], uiSections: ['boxes'] },
+});
+
+// --- semver ---
+
+test('parseVersion accepts X.Y.Z and rejects junk', () => {
+  assert.deepEqual(parseVersion('1.2.3'), [1, 2, 3]);
+  assert.equal(parseVersion('1.2'), null);
+  assert.equal(parseVersion('v1.2.3'), null);
+  assert.equal(parseVersion(''), null);
+});
+
+test('satisfies — caret', () => {
+  assert.equal(satisfies('1.0.0', '^1.0.0'), true);
+  assert.equal(satisfies('1.4.9', '^1.0.0'), true);
+  assert.equal(satisfies('2.0.0', '^1.0.0'), false);
+  assert.equal(satisfies('0.9.9', '^1.0.0'), false);
+  assert.equal(satisfies('0.2.5', '^0.2.3'), true);
+  assert.equal(satisfies('0.3.0', '^0.2.3'), false);
+});
+
+test('satisfies — tilde, comparators, any', () => {
+  assert.equal(satisfies('1.2.9', '~1.2.3'), true);
+  assert.equal(satisfies('1.3.0', '~1.2.3'), false);
+  assert.equal(satisfies('1.5.0', '>=1.0.0'), true);
+  assert.equal(satisfies('0.9.0', '>=1.0.0'), false);
+  assert.equal(satisfies('1.0.0', '>=1.0.0 <2.0.0'), true);
+  assert.equal(satisfies('2.0.0', '>=1.0.0 <2.0.0'), false);
+  assert.equal(satisfies('1.0.0', '1.0.0'), true);
+  assert.equal(satisfies('9.9.9', '*'), true);
+  assert.equal(satisfies('9.9.9', ''), true);
+  assert.equal(satisfies('not-a-version', '^1.0.0'), false);
+});
+
+test('isValidRange', () => {
+  for (const ok of ['^1.0.0', '~1.2.3', '>=1.0.0', '>=1.0.0 <2.0.0', '1.0.0', '*', '', '^1.0.0 || ^2.0.0']) {
+    assert.equal(isValidRange(ok), true, `${ok} should be valid`);
+  }
+  for (const bad of ['garbage', '^1.2', '>>1.0.0', null, '1', 'v1.0.0']) {
+    assert.equal(isValidRange(bad), false, `${bad} should be invalid`);
+  }
+});
+
+// --- manifest validation ---
+
+test('a minimal valid manifest passes', () => {
+  const r = validateManifest({ key: 'x', title: 'X', description: 'd', coreVersion: '^1.0.0', contributes: {} });
+  assert.equal(r.valid, true, r.errors.join('; '));
+});
+
+test('a full valid manifest passes (provides/consumes/prerequisites/migrations)', () => {
+  const m = {
+    ...baseManifest(),
+    default: false,
+    contributes: { ...baseManifest().contributes, migrations: true, disciplines: ['artist'], skills: ['otb-x'], rooms: ['WorldRoom'] },
+    provides: ['reward'],
+    consumes: ['grade'],
+    prerequisites: { modules: ['economy'] },
+  };
+  const r = validateManifest(m);
+  assert.equal(r.valid, true, r.errors.join('; '));
+  assert.equal(r.manifest, m);
+});
+
+test('missing required fields each produce an error', () => {
+  for (const field of ['key', 'title', 'description', 'coreVersion']) {
+    const m = baseManifest();
+    delete m[field];
+    const r = validateManifest(m);
+    assert.equal(r.valid, false, `${field} missing should fail`);
+    assert.ok(r.errors.some((e) => e.startsWith(field)), `error should mention ${field}: ${r.errors}`);
+  }
+});
+
+test('bad key format is rejected', () => {
+  const r = validateManifest({ ...baseManifest(), key: 'Dev_Box' });
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.some((e) => e.startsWith('key')));
+});
+
+test('invalid coreVersion range is rejected', () => {
+  const r = validateManifest({ ...baseManifest(), coreVersion: 'whenever' });
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.some((e) => e.startsWith('coreVersion')));
+});
+
+test('unknown contributes key is rejected (typo guard)', () => {
+  const r = validateManifest({ ...baseManifest(), contributes: { routs: ['box'] } });
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.some((e) => e.includes('contributes.routs')));
+});
+
+test('non-array contributes.routes is rejected', () => {
+  const r = validateManifest({ ...baseManifest(), contributes: { routes: 'box' } });
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.some((e) => e.includes('contributes.routes')));
+});
+
+// contributes.webSurfaces — the host-routed static surface seam (BV1.R84 / task 1635).
+test('a valid contributes.webSurfaces passes', () => {
+  const r = validateManifest({ ...baseManifest(), contributes: { webSurfaces: [{ host: 'status.', dir: 'public' }] } });
+  assert.equal(r.valid, true, r.errors.join('; '));
+});
+
+test('contributes.webSurfaces rejects a bad entry (missing dir, traversal, or wrong shape)', () => {
+  for (const bad of [
+    'public',                              // not an array
+    [{ host: 'status.' }],                 // missing dir
+    [{ dir: 'public' }],                   // missing host
+    [{ host: 'status.', dir: '/etc' }],    // absolute dir escapes the module
+    [{ host: 'status.', dir: '../x' }],    // traversal escapes the module
+    [{ host: '', dir: 'public' }],         // empty host
+    ['status.'],                           // string entry, not an object
+  ]) {
+    const r = validateManifest({ ...baseManifest(), contributes: { webSurfaces: bad } });
+    assert.equal(r.valid, false, `webSurfaces ${JSON.stringify(bad)} should fail`);
+    assert.ok(r.errors.some((e) => e.includes('contributes.webSurfaces')), `error should mention webSurfaces: ${r.errors}`);
+  }
+});
+
+test('missing contributes object is rejected', () => {
+  const m = baseManifest();
+  delete m.contributes;
+  const r = validateManifest(m);
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.some((e) => e.startsWith('contributes')));
+});
+
+test('bad provides/consumes are rejected', () => {
+  assert.equal(validateManifest({ ...baseManifest(), provides: 'reward' }).valid, false);
+  assert.equal(validateManifest({ ...baseManifest(), consumes: [1, 2] }).valid, false);
+});
+
+test('assertValidManifest throws on invalid, returns the object on valid', () => {
+  assert.throws(() => assertValidManifest({ key: 'x' }), /invalid/);
+  const m = baseManifest();
+  assert.equal(assertValidManifest(m), m);
+});
+
+test('non-object manifest is rejected cleanly', () => {
+  assert.equal(validateManifest(null).valid, false);
+  assert.equal(validateManifest('nope').valid, false);
+  assert.equal(validateManifest([]).valid, false);
+});
+
+// --- attribution fields (ADR 0107 §2) ---
+
+test('a manifest with all four attribution fields passes', () => {
+  const r = validateManifest({
+    ...baseManifest(),
+    author: 'A. Builder',
+    origin: 'off-the-boats',
+    license: 'AGPL-3.0',
+    maintainer: 'A. Builder',
+  });
+  assert.equal(r.valid, true, r.errors.join('; '));
+});
+
+test('attribution fields are optional — a manifest without them still passes', () => {
+  const r = validateManifest(baseManifest());
+  assert.equal(r.valid, true, r.errors.join('; '));
+});
+
+test('a non-string attribution field is rejected', () => {
+  for (const field of ['author', 'origin', 'license', 'maintainer']) {
+    const r = validateManifest({ ...baseManifest(), [field]: 123 });
+    assert.equal(r.valid, false, `${field}: 123 should fail`);
+    assert.ok(r.errors.some((e) => e.startsWith(field)), `error should mention ${field}: ${r.errors}`);
+  }
+});
+
+test('an empty-string attribution field is rejected', () => {
+  const r = validateManifest({ ...baseManifest(), author: '' });
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.some((e) => e.startsWith('author')));
+});

package/tests/module_owned_tests.mjs

@@ -0,0 +1,105 @@
+// tests/module_owned_tests.mjs — module-owned test discovery in the unit gate
+// (ADR 0107, task 1768). run-unit-tests.js globbed only repo-root tests/, so a
+// contributed module's own tests never ran in core CI — this pins the fix:
+// discoverModuleTests() finds modules/<key>/tests/*.mjs by directory (no
+// allowlist), includes an enabled module's tests, and skips a disabled
+// module's tests with the same semantics as the curated MODULE_DISABLED set.
+// Hermetic: every fixture is a temp dir + an injected isEnabled(), so no real
+// modules/ tree or config/modules.json is touched. DB-free -> picked up by
+// run-unit-tests.js itself (the gate it's testing).
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { discoverModuleTests } = require(path.join(ROOT, 'scripts', 'gds', 'run-unit-tests.js'));
+
+function writeFixtureModule(root, key, { hasTests = true } = {}) {
+  const dir = path.join(root, key);
+  fs.mkdirSync(dir, { recursive: true });
+  if (hasTests) {
+    const testsDir = path.join(dir, 'tests');
+    fs.mkdirSync(testsDir, { recursive: true });
+    fs.writeFileSync(path.join(testsDir, 'sample.mjs'), "console.log('ok');\n");
+  }
+}
+
+function tmpModulesRoot() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-modtests-'));
+}
+
+test('discoverModuleTests: an enabled module contributes its tests', () => {
+  const root = tmpModulesRoot();
+  writeFixtureModule(root, 'enabled-mod');
+  const { included, skippedDisabled } = discoverModuleTests({
+    modulesDir: root,
+    isEnabled: (key) => key === 'enabled-mod',
+  });
+  assert.equal(included.length, 1);
+  assert.equal(included[0].key, 'enabled-mod');
+  assert.equal(included[0].name, 'sample');
+  assert.ok(fs.existsSync(included[0].file));
+  assert.deepEqual(skippedDisabled, []);
+});
+
+test('discoverModuleTests: a disabled module\'s tests are skipped, not run', () => {
+  const root = tmpModulesRoot();
+  writeFixtureModule(root, 'disabled-mod');
+  const { included, skippedDisabled } = discoverModuleTests({
+    modulesDir: root,
+    isEnabled: () => false,
+  });
+  assert.deepEqual(included, []);
+  assert.equal(skippedDisabled.length, 1);
+  assert.equal(skippedDisabled[0].key, 'disabled-mod');
+  assert.equal(skippedDisabled[0].name, 'sample');
+});
+
+test('discoverModuleTests: a module dir with no tests/ contributes nothing either way', () => {
+  const root = tmpModulesRoot();
+  writeFixtureModule(root, 'no-tests-mod', { hasTests: false });
+  const { included, skippedDisabled } = discoverModuleTests({
+    modulesDir: root,
+    isEnabled: () => true,
+  });
+  assert.deepEqual(included, []);
+  assert.deepEqual(skippedDisabled, []);
+});
+
+test('discoverModuleTests: an unresolvable module key (isEnabled throws) is treated as disabled', () => {
+  const root = tmpModulesRoot();
+  writeFixtureModule(root, 'unknown-mod');
+  const { included, skippedDisabled } = discoverModuleTests({
+    modulesDir: root,
+    isEnabled: () => { throw new Error('unknown module'); },
+  });
+  assert.deepEqual(included, []);
+  assert.equal(skippedDisabled.length, 1);
+  assert.equal(skippedDisabled[0].key, 'unknown-mod');
+});
+
+test('discoverModuleTests: mixed enabled/disabled modules are partitioned independently, sorted by key', () => {
+  const root = tmpModulesRoot();
+  writeFixtureModule(root, 'zeta-mod');
+  writeFixtureModule(root, 'alpha-mod');
+  const { included, skippedDisabled } = discoverModuleTests({
+    modulesDir: root,
+    isEnabled: (key) => key === 'alpha-mod',
+  });
+  assert.equal(included.length, 1);
+  assert.equal(included[0].key, 'alpha-mod');
+  assert.equal(skippedDisabled.length, 1);
+  assert.equal(skippedDisabled[0].key, 'zeta-mod');
+});
+
+test('discoverModuleTests: a missing modules/ dir is a no-op (repo-root tests still run alone)', () => {
+  const root = path.join(tmpModulesRoot(), 'does-not-exist');
+  const { included, skippedDisabled } = discoverModuleTests({ modulesDir: root, isEnabled: () => true });
+  assert.deepEqual(included, []);
+  assert.deepEqual(skippedDisabled, []);
+});

package/tests/module_provenance.mjs

@@ -0,0 +1,34 @@
+// tests/module_provenance.mjs — the "who built this module" classifier
+// (ADR 0107 §9, task 1776). Pure, no I/O — src/module-loader/provenance.js is
+// the honest-pre-split rule the atlas + the hall's Modules tab both use.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { deriveProvenance } = require(path.join(ROOT, 'src', 'module-loader', 'provenance.js'));
+
+test('no origin declared → own-built (the honest pre-split default)', () => {
+  assert.equal(deriveProvenance(undefined, 'Off the Boats'), 'own');
+  assert.equal(deriveProvenance(null, 'Off the Boats'), 'own');
+  assert.equal(deriveProvenance('', 'Off the Boats'), 'own');
+  assert.equal(deriveProvenance('   ', 'Off the Boats'), 'own');
+});
+
+test('origin equal to this instance (any case) → own-built, not a false core-loaded', () => {
+  assert.equal(deriveProvenance('Off the Boats', 'Off the Boats'), 'own');
+  assert.equal(deriveProvenance('off the boats', 'Off the Boats'), 'own');
+  assert.equal(deriveProvenance('OFF THE BOATS', 'Off the Boats'), 'own');
+});
+
+test('origin naming a different project → core-loaded', () => {
+  assert.equal(deriveProvenance('Mercury', 'Off the Boats'), 'core');
+});
+
+test('no own project name resolvable → falls back to own-built rather than guessing', () => {
+  assert.equal(deriveProvenance('Mercury', null), 'own');
+  assert.equal(deriveProvenance('Mercury', ''), 'own');
+});