@bongos/core 1.17.0

package/tests/streak.mjs

@@ -0,0 +1,175 @@
+// tests/streak.mjs
+//
+// Coverage for the reward-simplification change (V3.R93 #354):
+//   1. Streak math now COUNTS kind='cleanup' ships. The exclusion was removed
+//      from both the SQL (qualifyingShipDays) and the JS guard
+//      (wouldExtendStreak). We prove this without a live DB by driving those
+//      functions with a fake `client` that records the SQL and returns canned
+//      rows — the same no-DB style as tests/rank_gate.mjs.
+//   2. The net-negative ship bonus (credits.awardNetNegativeBonus): a ship that
+//      removes more lines than it adds writes a credit_log row whose
+//      description embeds the raw removed/added values and the reason, and
+//      crossing the threshold unlocks the seeded "subtractor" achievement.
+//
+// Run:  node tests/streak.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+// streak + the net-negative bonus carved into modules/economy/ (BV1.R77 / ADR
+// 0093 §1-2): streak.js → modules/economy/streak.js; netNegativeBonusAmount +
+// awardNetNegativeBonus → modules/economy/credits.js.
+const streak = require('../modules/economy/streak.js');
+const credits = require('../modules/economy/credits.js');
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try {
+    await fn();
+    console.log(`  ok  ${name}`);
+    passed++;
+  } catch (err) {
+    console.error(`  FAIL ${name}`);
+    console.error('    ', err.message);
+    failed++;
+  }
+}
+
+// A fake pg client: hand it an ordered list of responder fns. Each query()
+// call pops the next responder (matched loosely by a substring of the SQL) and
+// returns its rows. Records every SQL string for assertions.
+function fakeClient(responders) {
+  const sqls = [];
+  return {
+    sqls,
+    async query(sql, params) {
+      sqls.push({ sql, params });
+      for (let i = 0; i < responders.length; i++) {
+        const r = responders[i];
+        if (r.used) continue;
+        if (sql.includes(r.match)) {
+          r.used = true;
+          return { rows: r.rows || [], rowCount: (r.rows || []).length };
+        }
+      }
+      return { rows: [], rowCount: 0 };
+    },
+  };
+}
+
+await (async () => {
+  console.log('streak: cleanup no longer excluded');
+
+  await test('qualifyingShipDays SQL no longer filters out kind=cleanup', async () => {
+    const client = fakeClient([
+      // The qualifying-ships query (matched by its FROM claims c). Return one
+      // ship-day that came from a cleanup task — if the exclusion were still in
+      // the SQL it would never reach this responder shape, but the assertion
+      // below is on the SQL text itself, which is the load-bearing check.
+      { match: 'FROM claims c', rows: [{ local_date: '2026-05-27', cnt: 1, timezone: 'America/New_York' }] },
+    ]);
+    const out = await streak.qualifyingShipDays(client, 1);
+    const issued = client.sqls.map((q) => q.sql).join('\n');
+    assert.ok(
+      !/kind\s*<>\s*'cleanup'/.test(issued) && !/kind\s*!=\s*'cleanup'/.test(issued),
+      'qualifying-ships SQL must NOT exclude kind=cleanup'
+    );
+    assert.equal(out.ship_days.length, 1, 'the cleanup-derived ship-day should count');
+    assert.equal(out.ship_days[0].local_date, '2026-05-27');
+  });
+
+  await test('wouldExtendStreak qualifies a kind=cleanup task (no longer disqualified)', async () => {
+    // computeStreak runs first (two queries: qualifying ship-days + today),
+    // then wouldExtendStreak loads the task row.
+    const client = fakeClient([
+      { match: 'FROM claims c', rows: [] }, // no prior ship-days
+      { match: "AT TIME ZONE timezone)::date", rows: [{ today: '2026-05-27' }] },
+      { match: 'SELECT timezone FROM builders', rows: [{ timezone: 'America/New_York' }] },
+      { match: 'SELECT id, kind, est_minutes FROM tasks', rows: [{ id: 99, kind: 'cleanup', est_minutes: 30 }] },
+    ]);
+    const out = await streak.wouldExtendStreak(1, 99, client);
+    assert.equal(out.qualifies, true, 'a cleanup task with est_minutes>=15 must now qualify');
+    assert.notEqual(out.reason, 'kind=cleanup', 'kind=cleanup must no longer be a disqualifier reason');
+  });
+
+  await test('wouldExtendStreak still disqualifies est_minutes < 15', async () => {
+    const client = fakeClient([
+      { match: 'FROM claims c', rows: [] },
+      { match: "AT TIME ZONE timezone)::date", rows: [{ today: '2026-05-27' }] },
+      { match: 'SELECT timezone FROM builders', rows: [{ timezone: 'America/New_York' }] },
+      { match: 'SELECT id, kind, est_minutes FROM tasks', rows: [{ id: 99, kind: 'cleanup', est_minutes: 5 }] },
+    ]);
+    const out = await streak.wouldExtendStreak(1, 99, client);
+    assert.equal(out.qualifies, false);
+    assert.equal(out.reason, 'est_minutes<15');
+  });
+
+  await test('pure streak math counts consecutive cleanup ship-days', () => {
+    const runs = streak.computeRunsFromShipDays(['2026-05-25', '2026-05-26', '2026-05-27'], '2026-05-27');
+    assert.equal(runs.current_streak, 3);
+    assert.equal(runs.longest_streak, 3);
+  });
+
+  console.log('net-negative ship bonus');
+
+  await test('netNegativeBonusAmount: removed > added → bonus; else 0', () => {
+    assert.equal(credits.netNegativeBonusAmount({ lines_added: 2, lines_removed: 40 }), 1);
+    assert.equal(credits.netNegativeBonusAmount({ lines_added: 10, lines_removed: 10 }), 0);
+    assert.equal(credits.netNegativeBonusAmount({ lines_added: 50, lines_removed: 1 }), 0);
+    assert.equal(credits.netNegativeBonusAmount(null), 0);
+  });
+
+  await test('awardNetNegativeBonus writes a credit_log row whose description has raw values × reason', async () => {
+    const client = fakeClient([
+      { match: "reason = 'ship.net_negative' LIMIT 1", rows: [] }, // not yet awarded
+      { match: 'INSERT INTO credit_log', rows: [] },               // the bonus insert
+      { match: 'SELECT 1 FROM builder_achievements', rows: [] },   // subtractor not unlocked
+      { match: "reason = 'ship.net_negative'", rows: [{ n: 1 }] }, // only 1 net-neg ship so far
+    ]);
+    const out = await credits.awardNetNegativeBonus(client, 1, 42, { lines_added: 3, lines_removed: 30 });
+    assert.equal(out.bonus, 1, 'a net-negative ship earns the flat bonus');
+    const insert = client.sqls.find((q) => q.sql.includes('INSERT INTO credit_log'));
+    assert.ok(insert, 'must insert a credit_log row');
+    const desc = insert.params[3];
+    assert.ok(/removed 30/.test(desc) && /added 3/.test(desc), `description must embed raw values; got: ${desc}`);
+    assert.ok(/net-negative/.test(desc), 'description must state the reason');
+    assert.equal(out.justUnlocked.length, 0, 'one net-negative ship is below the Subtractor threshold');
+  });
+
+  await test('awardNetNegativeBonus is a no-op (no double award) when already credited', async () => {
+    const client = fakeClient([
+      { match: "reason = 'ship.net_negative' LIMIT 1", rows: [{ '?column?': 1 }] }, // already awarded
+    ]);
+    const out = await credits.awardNetNegativeBonus(client, 1, 42, { lines_added: 3, lines_removed: 30 });
+    assert.equal(out.bonus, 0);
+    assert.ok(!client.sqls.some((q) => q.sql.includes('INSERT INTO credit_log')), 'must not re-insert');
+  });
+
+  await test('awardNetNegativeBonus unlocks "subtractor" at the 3-ship threshold', async () => {
+    const client = fakeClient([
+      { match: "reason = 'ship.net_negative' LIMIT 1", rows: [] },  // not yet awarded for this task
+      { match: 'INSERT INTO credit_log', rows: [] },                // bonus insert
+      { match: 'SELECT 1 FROM builder_achievements', rows: [] },    // subtractor not unlocked yet
+      { match: "reason = 'ship.net_negative'", rows: [{ n: 3 }] },  // 3rd net-neg ship (threshold met)
+      { match: 'SELECT id, name, credit_bonus FROM achievements', rows: [{ id: 'subtractor', name: 'Subtractor', credit_bonus: 2 }] },
+      { match: 'INSERT INTO builder_achievements', rows: [] },      // unlock ledger
+      { match: 'INSERT INTO credit_log', rows: [] },                // achievement credit_bonus
+    ]);
+    const out = await credits.awardNetNegativeBonus(client, 1, 99, { lines_added: 1, lines_removed: 80 });
+    assert.equal(out.bonus, 1);
+    assert.equal(out.justUnlocked.length, 1, 'Subtractor should unlock at the 3rd net-negative ship');
+    assert.equal(out.justUnlocked[0].id, 'subtractor');
+  });
+
+  await test('awardNetNegativeBonus does NOT award a positive-diff ship', async () => {
+    const client = fakeClient([]);
+    const out = await credits.awardNetNegativeBonus(client, 1, 7, { lines_added: 40, lines_removed: 2 });
+    assert.equal(out.bonus, 0);
+    assert.equal(client.sqls.length, 0, 'a net-positive ship should short-circuit before any query');
+  });
+
+  console.log(`\n${passed} passed, ${failed} failed`);
+  if (failed > 0) process.exit(1);
+})();

package/tests/subdomain_auth.mjs

@@ -0,0 +1,58 @@
+// tests/subdomain_auth.mjs — the builders-subdomain auth helpers (#726).
+//
+// Locks down the two security-sensitive pure helpers added for the dedicated
+// builders.amazonprimea.com subdomain:
+//   - safeReturnTo: the open-redirect guard on the post-sign-in return target.
+//   - sessionCookieDomainOpts: which hosts get an apex-scoped session cookie
+//     (so one sign-in spans the subdomains) vs a host-only one (localhost,
+//     staging — which must NOT bleed a token across environments).
+// Pure functions, no DB — requiring the route module does not open a pool.
+
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const authRoute = require('../src/bongos/routes/auth.js');
+
+let pass = 0, fail = 0;
+function ok(cond, msg) {
+  if (cond) { pass++; console.log(`  ok  ${msg}`); }
+  else { fail++; console.log(`  FAIL ${msg}`); }
+}
+const { safeReturnTo, sessionCookieDomainOpts } = authRoute;
+
+// ---- safeReturnTo: open-redirect guard ------------------------------------
+console.log('\nsafeReturnTo — accepts safe same-city targets:');
+ok(safeReturnTo('/builders') === '/builders', 'relative /builders');
+ok(safeReturnTo('/watch') === '/watch', 'relative /watch');
+ok(safeReturnTo('/builders/settings?x=1') === '/builders/settings?x=1', 'relative path with query');
+ok(safeReturnTo('https://builders.amazonprimea.com/watch') === 'https://builders.amazonprimea.com/watch', 'absolute builders subdomain');
+ok(safeReturnTo('https://amazonprimea.com/builders') === 'https://amazonprimea.com/builders', 'absolute apex');
+ok(safeReturnTo('https://status.amazonprimea.com/') === 'https://status.amazonprimea.com/', 'absolute status subdomain');
+
+console.log('\nsafeReturnTo — rejects everything else (→ null, caller falls back):');
+ok(safeReturnTo('//evil.com') === null, 'protocol-relative //evil.com');
+ok(safeReturnTo('https://evil.com/builders') === null, 'foreign https origin');
+ok(safeReturnTo('https://amazonprimea.com.evil.com/') === null, 'lookalike suffix host');
+ok(safeReturnTo('http://amazonprimea.com/builders') === null, 'http (non-https) apex');
+ok(safeReturnTo('javascript:alert(1)') === null, 'javascript: scheme');
+ok(safeReturnTo('/path\\with\\backslash') === null, 'backslash path');
+ok(safeReturnTo('') === null, 'empty');
+ok(safeReturnTo(null) === null, 'null');
+ok(safeReturnTo('/' + 'a'.repeat(600)) === null, 'over length cap');
+ok(safeReturnTo('builders') === null, 'bare word (no leading slash, not a URL)');
+
+// ---- sessionCookieDomainOpts: cross-subdomain scoping ----------------------
+const reqWith = (host) => ({ headers: { host } });
+console.log('\nsessionCookieDomainOpts — apex-scoped on production hosts:');
+ok(sessionCookieDomainOpts(reqWith('amazonprimea.com')).domain === '.amazonprimea.com', 'apex → .amazonprimea.com');
+ok(sessionCookieDomainOpts(reqWith('www.amazonprimea.com')).domain === '.amazonprimea.com', 'www → .amazonprimea.com');
+ok(sessionCookieDomainOpts(reqWith('builders.amazonprimea.com')).domain === '.amazonprimea.com', 'builders → .amazonprimea.com');
+ok(sessionCookieDomainOpts(reqWith('status.amazonprimea.com')).domain === '.amazonprimea.com', 'status → .amazonprimea.com');
+ok(sessionCookieDomainOpts(reqWith('amazonprimea.com:3000')).domain === '.amazonprimea.com', 'apex with port');
+
+console.log('\nsessionCookieDomainOpts — host-only elsewhere (no domain key):');
+ok(sessionCookieDomainOpts(reqWith('localhost:3000')).domain === undefined, 'localhost → host-only');
+ok(sessionCookieDomainOpts(reqWith('staging.amazonprimea.com')).domain === undefined, 'staging → host-only (no cross-env bleed)');
+ok(sessionCookieDomainOpts(reqWith('127.0.0.1')).domain === undefined, 'raw IP → host-only');
+
+console.log(`\nSubdomain-auth tests: ${pass} passed, ${fail} failed`);
+if (fail > 0) process.exit(1);

package/tests/task_classifier_vocab.mjs

@@ -0,0 +1,41 @@
+// tests/task_classifier_vocab.mjs — instance-vendor vocabulary in the task
+// classifier (R59 / task 1198). The core classifier must carry NO host-specific
+// vendor names (a vanilla Cloud Bongos instance integrates none); those move to
+// per-instance branding config (branding.vocab.blockerVendors). These tests
+// drive the pure builder + the generic core rule with no disk I/O.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import classifier from '../modules/lifecycle/task-classifier.js';
+
+const { classifyTaskKind, buildBlockerVendorRe } = classifier;
+
+test('buildBlockerVendorRe: empty / non-array → null (vanilla has no vendors)', () => {
+  assert.equal(buildBlockerVendorRe([]), null);
+  assert.equal(buildBlockerVendorRe(undefined), null);
+  assert.equal(buildBlockerVendorRe(['', '  ']), null);
+});
+
+test('buildBlockerVendorRe: word-bounded, case-insensitive, regex-safe', () => {
+  const re = buildBlockerVendorRe(['hermeslines', 'stripe']);
+  assert.ok(re.test('Waiting on the Hermeslines fulfillment API'));
+  assert.ok(re.test('STRIPE keys missing'));
+  assert.equal(re.test('pinstripe trousers'), false); // \b boundary, not a substring
+  // A vendor name with regex metacharacters must be escaped, not interpreted.
+  const re2 = buildBlockerVendorRe(['acme.co']);
+  assert.ok(re2.test('blocked on acme.co'));
+  assert.equal(re2.test('acmexco'), false);
+});
+
+test('core classifier hardcodes no vendor names — only configured ones signal', () => {
+  // A vendor NOT in this instance's branding.vocab.blockerVendors must not be a
+  // blocker-resolution signal: it has no generic blocker word, so it falls to the
+  // optimistic 'feature' default. This proves the core RULES carry no baked-in
+  // vendor list — the only vendor path is the per-instance config (R59).
+  const v = classifyTaskKind('Set up shopify storefront', '');
+  assert.notEqual(v.kind, 'blocker-resolution');
+});
+
+test('generic blocker terms still classify without any vendor config', () => {
+  assert.equal(classifyTaskKind('Unblock the release', '').kind, 'blocker-resolution');
+  assert.equal(classifyTaskKind('Rotate the API key', '').kind, 'blocker-resolution');
+});

package/tests/task_create_idempotency.mjs

@@ -0,0 +1,96 @@
+// tests/task_create_idempotency.mjs
+//
+// Regression guard for task 386 (idea #85) — db.findTaskBySourceRef, the
+// app-level idempotency lookup behind the POST /tasks create-vector. Before
+// this, re-submitting the same create (a retried POST, a capture/promotion
+// re-run) silently minted a duplicate task (the #248-dup-of-#252 class of bug).
+//
+// Contract under test:
+//   - either half of the (source, source_ref) key missing → returns null and
+//     issues NO SQL (nothing to dedup on; the caller proceeds to create).
+//   - both present → exactly one SELECT keyed on (source, source_ref), ORDER BY
+//     id ASC LIMIT 1 (oldest-first, so a re-submit resolves to the ORIGINAL row),
+//     bound params [source, sourceRef], returning the matched row or null.
+//
+// findTaskBySourceRef reads via activePool.query() directly (no txn), and honors
+// the #538 deps.pool seam ONLY under NODE_ENV==='test' — so we drive it with a
+// minimal SQL-recording fake pool, no live DB (same posture as abandon_task.mjs).
+//
+// Run:  node tests/task_create_idempotency.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const db = require('../modules/lifecycle/db.js');
+const { findTaskBySourceRef } = db;
+
+const { test, summary } = makeRunner();
+
+// Minimal fake pool: records each .query() call (normalized SQL + params) and
+// returns canned rows. findTaskBySourceRef calls pool.query() directly, so a
+// top-level .query is all it needs (makeSqlAwareClient only exposes .connect()).
+function fakePool(rows = []) {
+  const queries = [];
+  return {
+    queries,
+    async query(sql, params) {
+      queries.push({ sql: String(sql).replace(/\s+/g, ' ').trim(), params });
+      return { rows };
+    },
+  };
+}
+
+// =========================================================================
+await test('missing source_ref → null, and NO SQL is issued', async () => {
+  for (const arg of [
+    { source: 'manual', sourceRef: null },
+    { source: 'manual', sourceRef: '' },
+    { source: 'manual' },
+  ]) {
+    const pool = fakePool([{ id: 1 }]);
+    assert.equal(await findTaskBySourceRef(arg, { pool }), null, `null for ${JSON.stringify(arg)}`);
+    assert.equal(pool.queries.length, 0, 'nothing to dedup on → no SELECT');
+  }
+});
+
+await test('missing source → null, and NO SQL is issued (both halves of the key required)', async () => {
+  for (const arg of [{ sourceRef: 'idea:85' }, { source: null, sourceRef: 'idea:85' }]) {
+    const pool = fakePool([{ id: 1 }]);
+    assert.equal(await findTaskBySourceRef(arg, { pool }), null);
+    assert.equal(pool.queries.length, 0);
+  }
+});
+
+await test('no-arg call is a safe null (defaults), no SQL', async () => {
+  const pool = fakePool([{ id: 1 }]);
+  assert.equal(await findTaskBySourceRef(undefined, { pool }), null);
+  assert.equal(pool.queries.length, 0);
+});
+
+await test('both present → one SELECT on (source, source_ref), oldest-first, returns the row', async () => {
+  const existing = { id: 252, source: 'manual', source_ref: 'idea:85', needs_migration: false };
+  const pool = fakePool([existing]);
+  const out = await findTaskBySourceRef({ source: 'manual', sourceRef: 'idea:85' }, { pool });
+
+  assert.equal(out, existing, 'returns the existing task row');
+  assert.equal(pool.queries.length, 1, 'exactly one SELECT');
+  const q = pool.queries[0];
+  assert.match(q.sql, /SELECT \* FROM tasks WHERE source = \$1 AND source_ref = \$2/, 'keyed on the pair');
+  assert.match(q.sql, /ORDER BY id ASC LIMIT 1/, 'oldest-first so re-submits resolve to the original');
+  assert.deepEqual(q.params, ['manual', 'idea:85'], 'binds [source, sourceRef]');
+});
+
+await test('no match → null (caller then creates a fresh task)', async () => {
+  const pool = fakePool([]);
+  const out = await findTaskBySourceRef({ source: 'idea_inbox', sourceRef: '999' }, { pool });
+  assert.equal(out, null);
+  assert.equal(pool.queries.length, 1, 'it did query — just found nothing');
+  assert.deepEqual(pool.queries[0].params, ['idea_inbox', '999']);
+});
+
+// -------------------------------------------------------------------------
+summary();

package/tests/task_goal_link.mjs

@@ -0,0 +1,93 @@
+// tests/task_goal_link.mjs
+//
+// Regression guard for task 1763 (goal clean-up: every task belongs to a goal).
+// Two DB-free contracts:
+//
+//   db.generalGoalIdForVersion(versionId, {pool}) — the fallback resolver that
+//     createTask uses so a goal-less new task defaults into its version's
+//     catch-all "<version> — general" goal (migration 160). It honors the #538
+//     deps.pool seam under NODE_ENV==='test', so we drive it with a minimal
+//     SQL-recording fake pool, no live DB (same posture as task_create_idempotency).
+//     Contract:
+//       - null versionId → null and NO SQL (nothing to resolve).
+//       - a version id → exactly one SELECT keyed on (version_id, the spaced
+//         em-dash title match), bound param [versionId], returning the id or null.
+//
+//   routes/tasks.js — the router still BUILDS after the PATCH /tasks/:id goal_id
+//     extension (imports resolve; the factory returns a router). The SQL + the
+//     version-match 409 are verified against a live Postgres (see the session log),
+//     the way the other write paths are.
+//
+// Run:  node tests/task_goal_link.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const db = require('../modules/lifecycle/db.js');
+const { generalGoalIdForVersion } = db;
+const buildTasksRouter = require('../modules/lifecycle/routes/tasks.js');
+
+const { test, summary } = makeRunner();
+
+// Minimal fake pool: records each .query() call (normalized SQL + params) and
+// returns canned rows. generalGoalIdForVersion calls pool.query() directly.
+function fakePool(rows = []) {
+  const queries = [];
+  return {
+    queries,
+    async query(sql, params) {
+      queries.push({ sql: String(sql).replace(/\s+/g, ' ').trim(), params });
+      return { rows };
+    },
+  };
+}
+
+// =========================================================================
+await test('null / undefined versionId → null, and NO SQL is issued', async () => {
+  for (const v of [null, undefined]) {
+    const pool = fakePool([{ id: 3 }]);
+    assert.equal(await generalGoalIdForVersion(v, { pool }), null, `null for ${JSON.stringify(v)}`);
+    assert.equal(pool.queries.length, 0, 'no version → nothing to resolve → no SELECT');
+  }
+});
+
+await test('a version with a general goal → returns its id via one SELECT on the em-dash title', async () => {
+  const pool = fakePool([{ id: 3 }]);
+  const out = await generalGoalIdForVersion('BONGOS-V1', { pool });
+
+  assert.equal(out, 3, 'returns the general goal id');
+  assert.equal(pool.queries.length, 1, 'exactly one SELECT');
+  const q = pool.queries[0];
+  assert.match(q.sql, /SELECT id FROM goals WHERE version_id = \$1 AND title = \$1 \|\| ' — general'/,
+    'keyed on version_id + the spaced em-dash "<version> — general" (must match migration 160)');
+  assert.match(q.sql, /LIMIT 1/, 'single row');
+  assert.deepEqual(q.params, ['BONGOS-V1'], 'binds [versionId] — title is built in SQL, not interpolated');
+});
+
+await test('a version with no general goal → null (caller leaves goal_id NULL, never fails the create)', async () => {
+  const pool = fakePool([]);
+  const out = await generalGoalIdForVersion('SOME-VERSION', { pool });
+  assert.equal(out, null, 'no general goal → null fallback');
+  assert.equal(pool.queries.length, 1, 'it did query — just found nothing');
+  assert.deepEqual(pool.queries[0].params, ['SOME-VERSION']);
+});
+
+await test('the em-dash in the title match is U+2014 (not a hyphen/en-dash) — or the backfill silently matches nothing', async () => {
+  const pool = fakePool([{ id: 9 }]);
+  await generalGoalIdForVersion('V2', { pool });
+  assert.ok(pool.queries[0].sql.includes('—'), 'SQL contains an em-dash (U+2014)');
+  assert.ok(!pool.queries[0].sql.includes(" - general"), 'not a hyphen');
+});
+
+// -------------------------------------------------------------------------
+await test('routes/tasks.js still builds after the goal_id PATCH extension', () => {
+  assert.equal(typeof buildTasksRouter, 'function', 'module exports the router factory');
+  assert.equal(typeof buildTasksRouter(), 'function', 'express.Router() is a function');
+});
+
+// -------------------------------------------------------------------------
+summary();

package/tests/task_ownership_gate.mjs

@@ -0,0 +1,125 @@
+// tests/task_ownership_gate.mjs
+//
+// SECURITY regression guard for #871 — the claim-ownership gate that protects
+// the lifecycle-advancing routes (/tasks/:id/grade, /confirm, /ship).
+//
+// Before #871, POST /tasks/:id/grade was requireBuilder-only with no ownership
+// check, so any authenticated builder could POST a fabricated passing grade on
+// ANOTHER builder's `completed` task (capturing the credits + ship attribution
+// + bypassing the quality grader). The GRADER_BYPASS killswitch likewise relaxed
+// /confirm to any-builder. gateTaskOwnership must allow ONLY: an Archon; the
+// task's most-recent claim holder; and (for /ship's allowSupervisor) a Metic.
+// Everyone else gets a 403.
+//
+// L2 residual (red-team 2026-06-12, #999): the old gate also fell back to ALLOW
+// for ANYONE on a never-claimed task ("don't wedge a degenerate edge"). Combined
+// with the GRADER_BYPASS relaxation on /confirm, that let any builder confirm a
+// claimless `completed` task (status SQL-set) and have the credit fall to
+// themselves. The fix is FAIL-CLOSED: a claimless task is landable only by the
+// actors the Archon/supervisor early-returns already cover; a non-Archon caller
+// on a claimless task is now 403'd just like a non-owner.
+//
+// gateTaskOwnership calls db.getLastClaimHolder, which we stub — no server/DB.
+//
+// Run:  node tests/task_ownership_gate.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+// getLastClaimHolder carved to the lifecycle module at BV1.R86 — the moved tasks
+// router resolves it from the module db, so stub it there (not core db).
+const db = require('../modules/lifecycle/db.js');
+const tasksRouter = require('../modules/lifecycle/routes/tasks.js');
+const { gateTaskOwnership } = tasksRouter;
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const { test, summary } = makeRunner();
+
+const WORKER = 25;   // the claim holder who did the work
+const OTHER = 99;    // an unrelated builder
+
+// Stub the claim-holder lookup. holderId === null → no claim on record.
+function stubHolder(holderId) {
+  db.getLastClaimHolder = async () => (holderId == null ? null : { builder_id: holderId });
+}
+
+function mkReq(id, rank) {
+  return { builder: { id, rank, github_login: `b${id}` } };
+}
+function mkRes() {
+  const res = {
+    statusCode: null, body: null,
+    status(c) { this.statusCode = c; return this; },
+    json(b) { this.body = b; return this; },
+  };
+  attachFail({}, res, () => {}); // install res.fail() as the router does (task 1991)
+  return res;
+}
+
+await test('Archon may act on ANY task (e.g. --regrade)', async () => {
+  stubHolder(WORKER);
+  const res = mkRes();
+  assert.equal(await gateTaskOwnership(mkReq(OTHER, 'archon'), res, 123), true);
+  assert.equal(res.statusCode, null, 'no 403 written');
+});
+
+await test('the claim holder may act on their own task', async () => {
+  stubHolder(WORKER);
+  const res = mkRes();
+  assert.equal(await gateTaskOwnership(mkReq(WORKER, 'thetes'), res, 123), true);
+});
+
+await test('a non-owner non-Archon is 403 not_your_task (the credit-theft block)', async () => {
+  stubHolder(WORKER);
+  const res = mkRes();
+  assert.equal(await gateTaskOwnership(mkReq(OTHER, 'thetes'), res, 123), false);
+  assert.equal(res.statusCode, 403);
+  assert.equal(res.body.error.code, 'not_your_task');
+});
+
+await test('a Metic is NOT a supervisor by default (grade/confirm) — blocked on others\' tasks', async () => {
+  stubHolder(WORKER);
+  const res = mkRes();
+  assert.equal(await gateTaskOwnership(mkReq(OTHER, 'metic'), res, 123), false);
+  assert.equal(res.statusCode, 403);
+});
+
+await test('a Metic CAN ship across builders with allowSupervisor (the /merge-mode path)', async () => {
+  stubHolder(WORKER);
+  const res = mkRes();
+  assert.equal(await gateTaskOwnership(mkReq(OTHER, 'metic'), res, 123, { allowSupervisor: true }), true);
+  assert.equal(res.statusCode, null);
+});
+
+await test('a Thetes still cannot ship someone else\'s task even with allowSupervisor', async () => {
+  stubHolder(WORKER);
+  const res = mkRes();
+  assert.equal(await gateTaskOwnership(mkReq(OTHER, 'thetes'), res, 123, { allowSupervisor: true }), false);
+  assert.equal(res.statusCode, 403);
+});
+
+await test('L2: a never-claimed task FAILS CLOSED for a non-Archon (the bypass-confirm credit grab)', async () => {
+  stubHolder(null);
+  const res = mkRes();
+  assert.equal(await gateTaskOwnership(mkReq(OTHER, 'thetes'), res, 123), false);
+  assert.equal(res.statusCode, 403);
+  assert.equal(res.body.error.code, 'not_your_task');
+});
+
+await test('L2: a never-claimed task is still landable by an Archon (legit /confirm /grade path)', async () => {
+  stubHolder(null);
+  const res = mkRes();
+  assert.equal(await gateTaskOwnership(mkReq(OTHER, 'archon'), res, 123), true);
+  assert.equal(res.statusCode, null);
+});
+
+await test('L2: a never-claimed task is still shippable by a supervisor Metic (the /merge-mode sweep)', async () => {
+  stubHolder(null);
+  const res = mkRes();
+  assert.equal(await gateTaskOwnership(mkReq(OTHER, 'metic'), res, 123, { allowSupervisor: true }), true);
+  assert.equal(res.statusCode, null);
+});
+
+summary();