@bongos/core 1.17.0

package/tests/publish_branch_route.mjs

@@ -0,0 +1,422 @@
+// tests/publish_branch_route.mjs
+//
+// Coverage for server-mediated branch publish (ADR 0055 / task 1025) — the path
+// that lets a dev-box builder (no GitHub push credential) ship: the box uploads a
+// thin git bundle, the server pushes it + opens the PR + auto-merges with the
+// server-side GITHUB_PUSH_TOKEN.
+//
+// Two layers, both with NO live DB / server / network:
+//   1. src/bongos/github-push.js — the push/PR/status logic, exercised through the
+//      injectable exec + fetch seams (deps.exec / deps.fetchImpl / deps.token /
+//      deps.repoInfo / deps.mkdtemp / deps.rmtmp).
+//   2. The route wiring — a STRUCTURAL guard that POST/GET publish* are
+//      requireBuilder and DO NOT carry auth.allowBoxScope. That absence is what
+//      makes a box-scoped session 403 (#919/ADR 0053). box_scope_session.mjs
+//      proves requireBuilder's box gate; this proves the publish routes never opt
+//      out of it — a future edit that added allowBoxScope would reintroduce the
+//      "a leaked box token can ship arbitrary code" hole, and this test fails first.
+//
+// Run:  node tests/publish_branch_route.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+
+const gp = require('../modules/lifecycle/github-push.js');
+const auth = require('../src/bongos/auth.js');
+const buildTasksRouter = require('../modules/lifecycle/routes/tasks.js');
+
+let pass = 0, fail = 0;
+const t = async (name, fn) => {
+  try { await fn(); pass++; console.log(`PASS  ${name}`); }
+  catch (e) { fail++; console.log(`FAIL  ${name}\n      ${e.stack || e.message}`); }
+};
+
+const REPO = { owner: 'someowner', repo: 'somerepo', branch: 'main' };
+const HEAD = 'a'.repeat(40);
+
+// A fake git exec that records argv and answers rev-parse with a chosen tip.
+function fakeExec({ tip = HEAD, failOn = null } = {}) {
+  const calls = [];
+  const exec = async (args) => {
+    calls.push(args);
+    if (failOn && args.join(' ').includes(failOn)) throw Object.assign(new Error('GIT_FAILED'), { code: 'GIT_FAILED' });
+    if (args.includes('rev-parse')) return `${tip}\n`;
+    return '';
+  };
+  return { exec, calls };
+}
+
+const noopTmp = { mkdtemp: () => '/tmp/fake-publish', rmtmp: () => {} };
+
+// ---- isSafeBranch: the injection guard ------------------------------------
+await t('isSafeBranch accepts a real worktree branch, rejects option/traversal/ref forms', async () => {
+  assert.equal(gp.isSafeBranch('claude/reverent-keller-9f82ad'), true);
+  assert.equal(gp.isSafeBranch('-rf'), false, 'leading dash (option injection) refused');
+  assert.equal(gp.isSafeBranch('a/../../etc'), false, 'path traversal refused');
+  assert.equal(gp.isSafeBranch('refs/heads/x'), false, 'fully-qualified ref refused');
+  assert.equal(gp.isSafeBranch(''), false);
+  assert.equal(gp.isSafeBranch(null), false);
+});
+
+// ---- setCommitStatus: the trustless server rank-attestation (task 1139, ADR 0058) ----
+await t('setCommitStatus POSTs state+context to /statuses/:sha; bad sha → false; no token → false', async () => {
+  let captured = null;
+  const fetchImpl = async (url, opts) => { captured = { url, body: JSON.parse(opts.body) }; return { ok: true }; };
+  const ok = await gp.setCommitStatus(
+    { sha: HEAD, state: 'success', context: 'gate-author-trust', description: 'Metic+ author (archon) — task 1' },
+    { token: 'T', repoInfo: REPO, fetchImpl }
+  );
+  assert.equal(ok, true);
+  assert.ok(captured.url.endsWith(`/repos/someowner/somerepo/statuses/${HEAD}`), captured.url);
+  assert.equal(captured.body.context, 'gate-author-trust');
+  assert.equal(captured.body.state, 'success');
+  // a non-hex sha is refused BEFORE any fetch (no spoofed-ref status write)
+  assert.equal(
+    await gp.setCommitStatus({ sha: 'nope', state: 'success', context: 'x' },
+      { token: 'T', repoInfo: REPO, fetchImpl: async () => { throw new Error('should not fetch'); } }),
+    false
+  );
+  // no credential → false (the gate-review check then sees no attestation → escalates)
+  assert.equal(await gp.setCommitStatus({ sha: HEAD, state: 'success', context: 'x' }, { token: null, repoInfo: REPO }), false);
+});
+
+// ---- rankAttestsGateTrust: the pure rank decision behind attest-gate (task 1169) ----
+// Metic+ (server-resolved tier >= MIN_TIER) earns a gate-author-trust attestation;
+// below Metic gets none, so the ADR-0058 gate escalates a gate-surface PR to an
+// owner review. The pure decision is what BOTH the publish-branch attestation and
+// the laptop ci-land /attest-gate endpoint gate on.
+await t('rankAttestsGateTrust: Metic+ → true; below Metic / unknown → false', async () => {
+  assert.equal(buildTasksRouter.rankAttestsGateTrust('archon'), true);
+  assert.equal(buildTasksRouter.rankAttestsGateTrust('metic'), true);
+  assert.equal(buildTasksRouter.rankAttestsGateTrust('thetes'), false);
+  assert.equal(buildTasksRouter.rankAttestsGateTrust('xenos'), false);
+  assert.equal(buildTasksRouter.rankAttestsGateTrust(null), false, 'no rank → never attests');
+  assert.equal(buildTasksRouter.rankAttestsGateTrust('nonesuch'), false, 'unknown rank → fail closed');
+});
+
+// ---- buildAuthUrl: token rides in the URL, never leaks via a thrown error --
+await t('buildAuthUrl embeds x-access-token + the token; GIT_FAILED never echoes argv', async () => {
+  const url = gp.buildAuthUrl('o', 'r', 'SECRET_TOKEN');
+  assert.ok(url.startsWith('https://x-access-token:SECRET_TOKEN@github.com/o/r.git'), url);
+  const { exec } = fakeExec({ failOn: 'push' });
+  await assert.rejects(
+    () => gp.pushBundle({ bundlePath: '/tmp/b', branch: 'claude/x', headSha: HEAD },
+      { ...noopTmp, exec, token: 'SECRET_TOKEN', repoInfo: REPO, repoRoot: '/repo' }),
+    (e) => e.code === 'GIT_FAILED' && !String(e.message).includes('SECRET_TOKEN'),
+    'a git failure must not surface the credentialed argv'
+  );
+});
+
+// ---- pushBundle: the happy-path git sequence ------------------------------
+await t('pushBundle: clone --local → fetch bundle → rev-parse → push to the auth URL', async () => {
+  const { exec, calls } = fakeExec({ tip: HEAD });
+  const out = await gp.pushBundle(
+    { bundlePath: '/tmp/branch.bundle', branch: 'claude/x', headSha: HEAD },
+    { ...noopTmp, exec, token: 'TT', repoInfo: REPO, repoRoot: '/repo' }
+  );
+  assert.equal(out.head_sha, HEAD);
+  const joined = calls.map((c) => c.join(' '));
+  assert.ok(joined.some((c) => /^clone --bare --local \/repo /.test(c)), 'fast local bare clone of the object source');
+  assert.ok(joined.some((c) => /fetch \/tmp\/branch\.bundle refs\/heads\/claude\/x:refs\/heads\/claude\/x/.test(c)), 'unbundle the thin branch bundle');
+  assert.ok(joined.some((c) => /push https:\/\/x-access-token:TT@github\.com\/someowner\/somerepo\.git refs\/heads\/claude\/x:refs\/heads\/claude\/x/.test(c)), 'push to the EXPLICIT auth URL, not an inherited remote');
+  // never --force
+  assert.ok(!joined.some((c) => /--force/.test(c)), 'must never force-push');
+});
+
+// ---- pushBundle: anti-spoof tip check -------------------------------------
+await t('pushBundle: bundle tip != claimed head_sha → TIP_MISMATCH (no push)', async () => {
+  const otherTip = 'b'.repeat(40);
+  const { exec, calls } = fakeExec({ tip: otherTip });
+  await assert.rejects(
+    () => gp.pushBundle({ bundlePath: '/tmp/b', branch: 'claude/x', headSha: HEAD },
+      { ...noopTmp, exec, token: 'TT', repoInfo: REPO, repoRoot: '/repo' }),
+    (e) => e.code === 'TIP_MISMATCH' && e.tip === otherTip
+  );
+  assert.ok(!calls.map((c) => c.join(' ')).some((c) => /push /.test(c)), 'must not push when the tip mismatches');
+});
+
+// ---- pushBundle: config + input guards ------------------------------------
+await t('pushBundle: no token → PUSH_UNCONFIGURED; unsafe branch → BAD_BRANCH', async () => {
+  const { exec } = fakeExec();
+  await assert.rejects(
+    () => gp.pushBundle({ bundlePath: '/tmp/b', branch: 'claude/x', headSha: HEAD },
+      { ...noopTmp, exec, token: '', repoInfo: REPO, repoRoot: '/repo' }),
+    (e) => e.code === 'PUSH_UNCONFIGURED'
+  );
+  await assert.rejects(
+    () => gp.pushBundle({ bundlePath: '/tmp/b', branch: '-rf', headSha: HEAD },
+      { ...noopTmp, exec, token: 'TT', repoInfo: REPO, repoRoot: '/repo' }),
+    (e) => e.code === 'BAD_BRANCH'
+  );
+});
+
+// ---- openOrFindPullRequest: reuse vs create -------------------------------
+function jsonRes(status, body) {
+  return { ok: status >= 200 && status < 300, status, json: async () => body, text: async () => JSON.stringify(body) };
+}
+await t('openOrFindPullRequest: reuses an existing open PR (no create call)', async () => {
+  const seen = [];
+  const fetchImpl = async (url, opts) => {
+    seen.push({ url, method: (opts && opts.method) || 'GET' });
+    if (url.includes('/pulls?head=')) return jsonRes(200, [{ number: 7, html_url: 'http://pr/7', node_id: 'N7' }]);
+    throw new Error('should not create when one exists');
+  };
+  const pr = await gp.openOrFindPullRequest({ branch: 'claude/x', title: 't', body: 'b' },
+    { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.deepEqual(pr, { number: 7, url: 'http://pr/7', node_id: 'N7' });
+  assert.ok(!seen.some((s) => s.method === 'POST'), 'must not POST a new PR when one is open');
+});
+
+await t('openOrFindPullRequest: creates a PR when none is open', async () => {
+  const fetchImpl = async (url, opts) => {
+    if (url.includes('/pulls?head=')) return jsonRes(200, []);
+    if (url.endsWith('/pulls') && opts.method === 'POST') return jsonRes(201, { number: 9, html_url: 'http://pr/9', node_id: 'N9' });
+    throw new Error('unexpected call ' + url);
+  };
+  const pr = await gp.openOrFindPullRequest({ branch: 'claude/x', title: 't', body: 'b' },
+    { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(pr.number, 9);
+  assert.equal(pr.node_id, 'N9');
+});
+
+// ---- enableAutoMerge: graphql, best-effort --------------------------------
+await t('enableAutoMerge: posts the graphql mutation; false on a graphql error', async () => {
+  let body = null;
+  const okFetch = async (_u, opts) => { body = JSON.parse(opts.body); return jsonRes(200, { data: { enablePullRequestAutoMerge: {} } }); };
+  assert.equal(await gp.enableAutoMerge({ nodeId: 'N1' }, { token: 'TT', fetchImpl: okFetch }), true);
+  assert.ok(/enablePullRequestAutoMerge/.test(body.query));
+  assert.equal(body.variables.id, 'N1');
+  const errFetch = async () => jsonRes(200, { errors: [{ message: 'not allowed' }] });
+  assert.equal(await gp.enableAutoMerge({ nodeId: 'N1' }, { token: 'TT', fetchImpl: errFetch }), false);
+  assert.equal(await gp.enableAutoMerge({ nodeId: null }, { token: 'TT', fetchImpl: okFetch }), false, 'no node id → false');
+});
+
+// ---- getPublishStatus: the three states -----------------------------------
+await t('getPublishStatus: open PR → pending; merged + deploy success → success', async () => {
+  const mergeSha = 'c'.repeat(40);
+  // open, not merged
+  let fetchImpl = async (url) => {
+    if (url.includes('/pulls?head=')) return jsonRes(200, [{ state: 'open', merged_at: null, merge_commit_sha: null, html_url: 'http://pr/1' }]);
+    throw new Error('no runs call expected while open');
+  };
+  let s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.merged, false);
+  assert.equal(s.deploy_status, 'pending');
+
+  // merged + a successful deploy-prod run for the merge sha
+  fetchImpl = async (url) => {
+    if (url.includes('/pulls?head=')) return jsonRes(200, [{ state: 'closed', merged_at: '2026-06-13T00:00:00Z', merge_commit_sha: mergeSha, html_url: 'http://pr/1' }]);
+    if (url.includes('deploy-prod.yml/runs')) return jsonRes(200, { workflow_runs: [{ head_sha: mergeSha, status: 'completed', conclusion: 'success' }] });
+    throw new Error('unexpected ' + url);
+  };
+  s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.merged, true);
+  assert.equal(s.merge_sha, mergeSha);
+  assert.equal(s.deploy_status, 'success');
+});
+
+await t('getPublishStatus: no PR for the head → none', async () => {
+  const fetchImpl = async () => jsonRes(200, []);
+  const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.pr_state, 'none');
+  assert.equal(s.deploy_status, 'none');
+});
+
+// ===========================================================================
+// Layer 2 — STRUCTURAL guard: the publish routes are requireBuilder and carry
+// NO allowBoxScope (so a box-scoped session is denied — #919 regression guard).
+// ===========================================================================
+function findRouteLayer(router, routePath, method) {
+  return router.stack.find(
+    (l) => l.route && l.route.path === routePath && l.route.methods && l.route.methods[method]
+  );
+}
+function handlesOf(layer) {
+  return layer.route.stack.map((s) => s.handle);
+}
+
+await t('POST /tasks/:id/publish-branch: requireBuilder present, allowBoxScope ABSENT', async () => {
+  const router = buildTasksRouter();
+  const layer = findRouteLayer(router, '/tasks/:id/publish-branch', 'post');
+  assert.ok(layer, 'the publish-branch POST route must be registered');
+  const handles = handlesOf(layer);
+  assert.ok(handles.includes(auth.requireBuilder), 'must be requireBuilder-gated');
+  assert.ok(!handles.includes(auth.allowBoxScope), 'must NOT carry allowBoxScope — a box session must be denied (#919)');
+});
+
+await t('GET /tasks/:id/publish-status: requireBuilder present, allowBoxScope ABSENT', async () => {
+  const router = buildTasksRouter();
+  const layer = findRouteLayer(router, '/tasks/:id/publish-status', 'get');
+  assert.ok(layer, 'the publish-status GET route must be registered');
+  const handles = handlesOf(layer);
+  assert.ok(handles.includes(auth.requireBuilder), 'must be requireBuilder-gated');
+  assert.ok(!handles.includes(auth.allowBoxScope), 'must NOT carry allowBoxScope');
+});
+
+// task 1169 (ADR 0058): the laptop ci-land attest endpoint. It posts the trustless
+// gate-author-trust commit status for a Metic+ author, so the SAME #919 box-scope
+// guard the publish routes carry applies here — a box session must reauth, never
+// self-attest. The structural guard proves it never opts out of requireBuilder's
+// box gate (no allowBoxScope), matching publish-branch / publish-status exactly.
+await t('POST /tasks/:id/attest-gate: requireBuilder present, allowBoxScope ABSENT', async () => {
+  const router = buildTasksRouter();
+  const layer = findRouteLayer(router, '/tasks/:id/attest-gate', 'post');
+  assert.ok(layer, 'the attest-gate POST route must be registered');
+  const handles = handlesOf(layer);
+  assert.ok(handles.includes(auth.requireBuilder), 'must be requireBuilder-gated');
+  assert.ok(!handles.includes(auth.allowBoxScope), 'must NOT carry allowBoxScope — a box session must reauth, never self-attest (#919)');
+});
+
+// ===========================================================================
+// GitHub App credential (task 1028 / ADR 0055 hardening): the server mints a
+// short-lived installation token from the App private key instead of holding a
+// standing PAT. PAT stays as the cutover fallback.
+// ===========================================================================
+const crypto = require('node:crypto');
+const { publicKey: APP_PUBKEY, privateKey: APP_PRIVKEY } = crypto.generateKeyPairSync('rsa', {
+  modulusLength: 2048,
+  publicKeyEncoding: { type: 'spki', format: 'pem' },
+  privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+});
+
+function decodeJwtPart(part) {
+  return JSON.parse(Buffer.from(part.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8'));
+}
+function jwtSignatureVerifies(jwt, pubPem) {
+  const [h, p, s] = jwt.split('.');
+  const v = crypto.createVerify('RSA-SHA256');
+  v.update(`${h}.${p}`);
+  v.end();
+  return v.verify(pubPem, Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/'), 'base64'));
+}
+// Hermetic env swap + cache reset around an async body.
+async function withEnv(vars, fn) {
+  const keys = Object.keys(vars);
+  const saved = keys.map((k) => [k, process.env[k]]);
+  for (const k of keys) {
+    if (vars[k] === undefined) delete process.env[k];
+    else process.env[k] = vars[k];
+  }
+  gp._resetAppTokenCacheForTests();
+  try {
+    return await fn();
+  } finally {
+    for (const [k, v] of saved) {
+      if (v === undefined) delete process.env[k];
+      else process.env[k] = v;
+    }
+    gp._resetAppTokenCacheForTests();
+  }
+}
+const APP_ENV = { GITHUB_APP_ID: '123', GITHUB_APP_INSTALLATION_ID: '456', GITHUB_APP_PRIVATE_KEY: APP_PRIVKEY };
+const NO_APP = { GITHUB_APP_ID: undefined, GITHUB_APP_INSTALLATION_ID: undefined, GITHUB_APP_PRIVATE_KEY: undefined };
+
+await t('appConfigured / isConfigured: true only with App (all 3 vars) or PAT', async () => {
+  await withEnv({ ...NO_APP, GITHUB_PUSH_TOKEN: undefined }, async () => {
+    assert.equal(gp.appConfigured(), false);
+    assert.equal(gp.isConfigured(), false);
+  });
+  await withEnv({ ...NO_APP, GITHUB_PUSH_TOKEN: 'pat' }, async () => {
+    assert.equal(gp.appConfigured(), false);
+    assert.equal(gp.isConfigured(), true, 'PAT alone configures it');
+  });
+  await withEnv({ ...APP_ENV, GITHUB_PUSH_TOKEN: undefined }, async () => {
+    assert.equal(gp.appConfigured(), true);
+    assert.equal(gp.isConfigured(), true, 'App alone configures it');
+  });
+  await withEnv({ GITHUB_APP_ID: '123', GITHUB_APP_INSTALLATION_ID: undefined, GITHUB_APP_PRIVATE_KEY: APP_PRIVKEY, GITHUB_PUSH_TOKEN: undefined }, async () => {
+    assert.equal(gp.appConfigured(), false, 'partial App config (no installation id) is NOT configured');
+    assert.equal(gp.isConfigured(), false);
+  });
+});
+
+await t('mintAppJwt: RS256 JWT verifies against the App public key; iss/iat/exp correct', async () => {
+  const nowSec = 1_700_000_000;
+  const jwt = gp.mintAppJwt({ appId: 42, privateKeyPem: APP_PRIVKEY, nowSec });
+  assert.equal(jwt.split('.').length, 3, 'three-part JWT');
+  assert.ok(jwtSignatureVerifies(jwt, APP_PUBKEY), 'signature verifies with the App public key');
+  const header = decodeJwtPart(jwt.split('.')[0]);
+  const payload = decodeJwtPart(jwt.split('.')[1]);
+  assert.equal(header.alg, 'RS256');
+  assert.equal(payload.iss, '42', 'iss is the stringified app id');
+  assert.equal(payload.iat, nowSec - 60, 'iat backdated 60s for clock skew');
+  assert.equal(payload.exp, nowSec + 540, 'exp = +9min (< GitHub 10min cap)');
+  // a swapped payload breaks the signature
+  const [h, , s] = jwt.split('.');
+  const otherPayload = gp.mintAppJwt({ appId: 999, privateKeyPem: APP_PRIVKEY, nowSec }).split('.')[1];
+  assert.equal(jwtSignatureVerifies(`${h}.${otherPayload}.${s}`, APP_PUBKEY), false, 'tampered payload fails verification');
+});
+
+await t('getInstallationToken: mints via JWT, hits the right endpoint, caches; null when unconfigured', async () => {
+  await withEnv(NO_APP, async () => {
+    assert.equal(
+      await gp.getInstallationToken({ fetchImpl: async () => { throw new Error('should not fetch'); } }),
+      null,
+      'App unconfigured → null (so resolveToken falls through to the PAT)'
+    );
+  });
+  await withEnv(APP_ENV, async () => {
+    let calls = 0, seenUrl = null, seenAuth = null;
+    const fetchImpl = async (url, opts) => {
+      calls++; seenUrl = url; seenAuth = opts.headers.Authorization;
+      return jsonRes(201, { token: 'ghs_install_xyz', expires_at: '2999-01-01T00:00:00Z' });
+    };
+    const now = () => 1_700_000_000 * 1000;
+    const tok1 = await gp.getInstallationToken({ fetchImpl, now });
+    assert.equal(tok1, 'ghs_install_xyz');
+    assert.equal(calls, 1);
+    assert.ok(seenUrl.includes('/app/installations/456/access_tokens'), 'POSTs to the installation token endpoint');
+    assert.ok(/^Bearer /.test(seenAuth) && jwtSignatureVerifies(seenAuth.slice(7), APP_PUBKEY), 'authenticates with a valid App JWT');
+    const tok2 = await gp.getInstallationToken({ fetchImpl, now });
+    assert.equal(tok2, 'ghs_install_xyz');
+    assert.equal(calls, 1, 'cached — no second exchange while the token is fresh');
+  });
+});
+
+await t('getInstallationToken: App configured but the exchange fails → APP_TOKEN_FAILED', async () => {
+  await withEnv(APP_ENV, async () => {
+    const fetchImpl = async () => jsonRes(401, { message: 'bad jwt' });
+    await assert.rejects(
+      () => gp.getInstallationToken({ fetchImpl, now: () => 1_700_000_000 * 1000 }),
+      (e) => e.code === 'APP_TOKEN_FAILED' && e.status === 401
+    );
+  });
+});
+
+await t('resolveToken precedence: deps.token > App installation token > PAT > null', async () => {
+  await withEnv({ ...APP_ENV, GITHUB_PUSH_TOKEN: 'pat' }, async () => {
+    assert.equal(
+      await gp.resolveToken({ token: 'INJECTED', fetchImpl: async () => { throw new Error('no'); } }),
+      'INJECTED',
+      'deps.token short-circuits everything (the test seam)'
+    );
+  });
+  await withEnv({ ...APP_ENV, GITHUB_PUSH_TOKEN: 'pat' }, async () => {
+    const fetchImpl = async () => jsonRes(201, { token: 'app_tok', expires_at: '2999-01-01T00:00:00Z' });
+    assert.equal(await gp.resolveToken({ fetchImpl, now: () => 1_700_000_000 * 1000 }), 'app_tok', 'App beats PAT');
+  });
+  await withEnv({ ...NO_APP, GITHUB_PUSH_TOKEN: 'pat_only' }, async () => {
+    assert.equal(await gp.resolveToken({}), 'pat_only', 'PAT used when no App');
+  });
+  await withEnv({ ...NO_APP, GITHUB_PUSH_TOKEN: undefined }, async () => {
+    assert.equal(await gp.resolveToken({}), null, 'nothing configured → null');
+  });
+});
+
+// ---- landConfirmed: the publish-status reconcile-on-read trigger (task 1049) ----
+// The publish-status route flips the task confirmed→shipped iff this is true, so
+// a successful publish never strands at confirmed (the #1027 retrospective).
+await t('landConfirmed: true ONLY when merged AND deploy-prod succeeded', async () => {
+  assert.equal(gp.landConfirmed({ merged: true, deploy_status: 'success' }), true);
+  assert.equal(gp.landConfirmed({ merged: true, deploy_status: 'pending' }), false, 'merged but deploy not confirmed → no flip');
+  assert.equal(gp.landConfirmed({ merged: false, deploy_status: 'success' }), false, 'not merged → no flip');
+  assert.equal(gp.landConfirmed({ pr_state: 'open', merged: false, deploy_status: 'pending' }), false);
+  assert.equal(gp.landConfirmed(null), false, 'null status never reconciles');
+  assert.equal(gp.landConfirmed({}), false);
+});
+
+console.log(`\n${pass} passed, ${fail} failed`);
+process.exit(fail === 0 ? 0 : 1);

package/tests/publish_manifest.mjs

@@ -0,0 +1,184 @@
+// tests/publish_manifest.mjs
+//
+// GDS-V4 R71 (task 1210) — locks the Cloud Bongos public-mirror publish boundary
+// (scripts/gds/publish-manifest.js, ADR 0098 / ADR 0065 §4). A silent leak from a
+// publish boundary is catastrophic, so this guards three things:
+//   1. representative publishable / excluded paths classify correctly,
+//   2. default-deny + deny-wins-over-allow hold,
+//   3. the manifest stays consistent with the LIVE trust inventory it reuses — the
+//      topology denylist is a verbatim subset of PROTECTED_GLOBS, and every protected
+//      surface that is NOT topology stays publishable (the methodology machinery the
+//      AGPL mirror is supposed to ship). If PROTECTED_GLOBS changes incompatibly, this
+//      fails — forcing the carve-out to be re-decided rather than drifting silently.
+//
+// Run:  node tests/publish_manifest.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const m = require('../scripts/gds/publish-manifest.js');
+const {
+  isPublishable,
+  matchesDeny,
+  partitionPaths,
+  PROTECTED_TOPOLOGY_EXCLUDE,
+  SENSITIVE_DOC_EXCLUDE,
+  PUBLISH_ALLOWLIST,
+  PUBLISH_DENYLIST,
+  PROTECTED_GLOBS,
+  SENSITIVE_DOC_GLOBS,
+} = m;
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── publishable: the portable core + platform (ADR 0065 §4 "Published") ─────────────
+const PUBLISH = [
+  'src/bongos/auth.js',                       // the rank/permission machinery IS the methodology
+  'src/bongos/permission-path-check.js',
+  'scripts/gds/ship.js',                   // the ship/grade pipeline publishes (sans secrets)
+  'scripts/gds/publish-manifest.js',
+  'scripts/migrate.sh',
+  'server.js',
+  'migrations/182_some_change.sql',
+  'tests/publish_manifest.mjs',
+  'modules/lifecycle/db.js',
+  'modules/grading/grader.js',
+  'modules/hall-ui/public/work.js',
+  'modules/dev-box/boxes.js',
+  // served-at-runtime surfaces a standalone must carry (task 2078) — their absence
+  // from the packaged core 404'd the hall UI + /docs on demo.cloudbongos.com
+  'clients/bongos-client/bongos-client.global.js', // /lib/bongos-client.js (window.BongosClient)
+  'public-docs/index.html',                        // the /docs Redoc host page
+  'docs/api/openapi.json',                         // /docs/openapi.json (the generated spec)
+  'docs/onboarding/primer.md',                     // /builders/primer (portable onboarding doc)
+  'config/branding.neutral.json',          // the customer-0 neutral starter
+  'config/modules.neutral.json',
+  'CLAUDE.md',
+  'LICENSE',
+  'GOVERNANCE.md',
+  'CONTRIBUTING.md',
+  'docs/adr/0065-agpl-nonprofit-ai-first-governance.md',
+  'docs/canonical-permissions.md',         // rank-ladder reference = methodology (sanitized)
+  'docs/architecture.md',
+  'docs/handoff-template.md',              // portable session-handoff format
+  'docs/project-context.template.md',      // the neutral scaffold (NOT the OTB-filled one)
+  'config/design-tokens.schema.json',      // generic contract schema
+  '.claude/skills/dev/SKILL.md',
+  'package.json',
+  'Dockerfile',
+  '.env.local.example',
+];
+for (const p of PUBLISH) t(`publishable: ${p}`, () => assert.equal(isPublishable(p), true));
+
+// ── excluded: content/copyright, instance identity, topology/secrets ────────────────
+const EXCLUDE = [
+  // deny-wins: a gitignored build artifact INSIDE the allowlisted client subtree (task 2078)
+  'clients/bongos-client/dist/browser-global.js',
+  // content / copyright
+  'modules/game/server.js',
+  'modules/art-pipeline/orchestrator.py',
+  'modules/art-pipeline/references/pokemon-firered/Berry_Forest.png', // the 83 ripped maps — hard copyright
+  'modules/character-anim/rig.js',
+  'art/brand/logo.png',
+  'brand/cloud-bongos/assets/references/whale-reference.png',          // customer-0 brand pack: deferred
+  'public/game/index.html',
+  'src/world/terrain.js',
+  'src/rooms/WorldRoom.js',
+  'src/preview-server.js',
+  'scripts/art/orchestrate.js',            // art-feature tooling under scripts/ (legacy location)
+  'scripts/tile-add.js',
+  // instance identity + history
+  'config/branding.json',
+  'config/modules.json',
+  'config/devbox-app.json',
+  'CODEOWNERS',
+  'docs/project-context.md',
+  'docs/lore/founding-myth.md',
+  'docs/TRACKS.md',
+  'docs/session-logs/2026-06-30-x.md',
+  'docs/discord/channels.json',
+  'blockers/blockers.md',
+  'limitations/v1-shipped.md',
+  'generative-ideas.md',
+  '.env.local',
+  // topology / deploy / CI / local gate hooks / secrets — read-sensitive docs
+  'infra/Caddyfile',
+  'scripts/deploy/deploy-prod.sh',
+  'config/deploy.json',
+  '.github/workflows/deploy-prod.yml',
+  '.husky/pre-push',
+  '.claude/hooks/stop-sound.js',
+  '.claude/settings.json',
+  'docs/security/threat-model.md',
+  'docs/audits/unused-code-audit-2026-06-09.md',
+];
+for (const p of EXCLUDE) t(`excluded: ${p}`, () => assert.equal(isPublishable(p), false));
+
+// ── default-deny: an unclassified path never leaks by omission ──────────────────────
+t('default-deny: unclassified top-level file', () => {
+  assert.equal(isPublishable('some-new-file.txt'), false);
+});
+t('default-deny: a module not on the platform-core allowlist (modules/demo)', () => {
+  assert.equal(isPublishable('modules/demo/index.js'), false);
+});
+
+// ── deny wins over allow: scripts/ is broadly allowed, scripts/deploy/ is carved out ─
+t('deny wins: scripts/deploy/ is excluded even though scripts/ is allowlisted', () => {
+  assert.equal(isPublishable('scripts/deploy/provision.sh'), false);
+});
+t('deny wins: src/ is allowed but the game residue under it is excluded', () => {
+  assert.equal(isPublishable('src/world/map.js'), false);
+});
+
+// ── path normalization ──────────────────────────────────────────────────────────────
+t('normalizes backslashes + leading ./', () => {
+  assert.equal(isPublishable('./src\\bongos\\auth.js'), true);
+  assert.equal(isPublishable(''), false);
+});
+
+// ── partitionPaths splits a mixed list ──────────────────────────────────────────────
+t('partitionPaths splits publish vs exclude', () => {
+  const { publish, exclude } = partitionPaths(['src/bongos/auth.js', 'modules/game/x.js', 'CLAUDE.md', '.env.local']);
+  assert.deepEqual(publish, ['src/bongos/auth.js', 'CLAUDE.md']);
+  assert.deepEqual(exclude, ['modules/game/x.js', '.env.local']);
+});
+
+// ── anti-drift invariants vs the LIVE trust inventory it reuses ─────────────────────
+t('PROTECTED_TOPOLOGY_EXCLUDE is a verbatim subset of PROTECTED_GLOBS (no stale/typo entry)', () => {
+  for (const g of PROTECTED_TOPOLOGY_EXCLUDE) {
+    assert.ok(PROTECTED_GLOBS.includes(g), `topology-exclude "${g}" is not a current PROTECTED_GLOB`);
+  }
+});
+t('SENSITIVE_DOC_EXCLUDE is a non-empty subset of SENSITIVE_DOC_GLOBS', () => {
+  assert.ok(SENSITIVE_DOC_EXCLUDE.length > 0, 'expected docs/security + docs/audits to be excluded');
+  for (const g of SENSITIVE_DOC_EXCLUDE) {
+    assert.ok(SENSITIVE_DOC_GLOBS.includes(g), `sensitive-doc-exclude "${g}" is not a current SENSITIVE_DOC_GLOB`);
+  }
+});
+t('every PROTECTED_GLOB is either topology-excluded or publishable (the methodology machinery ships; no protected surface is default-denied by accident)', () => {
+  for (const g of PROTECTED_GLOBS) {
+    if (matchesDeny(g)) continue;            // excluded for topology/instance reasons — fine
+    assert.ok(isPublishable(g), `protected surface "${g}" is neither denied nor publishable — re-decide the carve-out`);
+  }
+});
+t('the topology subset of the protected surfaces is never publishable', () => {
+  for (const g of PROTECTED_TOPOLOGY_EXCLUDE) {
+    assert.equal(isPublishable(g), false, `topology surface "${g}" must not publish`);
+  }
+});
+
+// ── the lists are well-formed ───────────────────────────────────────────────────────
+t('allowlist + denylist are non-empty arrays of strings', () => {
+  assert.ok(Array.isArray(PUBLISH_ALLOWLIST) && PUBLISH_ALLOWLIST.length > 0);
+  assert.ok(Array.isArray(PUBLISH_DENYLIST) && PUBLISH_DENYLIST.length > 0);
+  for (const g of [...PUBLISH_ALLOWLIST, ...PUBLISH_DENYLIST]) assert.equal(typeof g, 'string');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);