@bongos/core 1.18.0 → 1.18.18

package/tests/governance_resolver.mjs

@@ -0,0 +1,84 @@
+// tests/governance_resolver.mjs — the permission resolver (BV1.R95, ADR 0151).
+//
+// DB-free: exercises the resolver's PURE core (effectivePermissions) plus the
+// fail-closed short-circuits and the kernel-port shape. The live DB join is
+// covered by R103's parity test, which needs Postgres.
+//
+// The invariants that matter here are trust-boundary invariants: an unknown grant
+// key must not grant anything, a role-less builder must resolve to nothing, and
+// the resolver must not memoise (ADR 0016 — authority is read fresh per request).
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'governance');
+const resolver = require(path.join(GOV, 'resolver.js'));
+const catalog = require(path.join(GOV, 'catalog.js'));
+const { effectivePermissions, resolveBuilderPermissions, builderHasPermissions } = resolver;
+
+test('effectivePermissions unions, de-duplicates, and sorts', () => {
+  const out = effectivePermissions(['task.ship', 'idea.triage', 'task.ship', 'cost.log']);
+  assert.deepEqual(out, ['cost.log', 'idea.triage', 'task.ship']);
+});
+
+test('a grant naming a key the catalog does not define grants nothing', () => {
+  const out = effectivePermissions(['idea.triage', 'not.a.real.permission', 'deploy.everything']);
+  assert.deepEqual(out, ['idea.triage']);
+});
+
+test('no roles / no grants resolves to the empty set (fail-closed)', () => {
+  assert.deepEqual(effectivePermissions([]), []);
+  assert.deepEqual(effectivePermissions(null), []);
+  assert.deepEqual(effectivePermissions(undefined), []);
+});
+
+test('the result is frozen — a caller cannot mutate a resolved permission set', () => {
+  const out = effectivePermissions(['task.ship']);
+  assert.ok(Object.isFrozen(out));
+  assert.throws(() => out.push('deploy.push_main'), TypeError);
+});
+
+// R98 narrowed this: the role axis carries every catalog key EXCEPT the machine-
+// principal ones, which come from an identity and never from a role. The principal
+// axis has its own file (tests/governance_principals.mjs).
+test('every role-held catalog key survives resolution (the seed can grant anything defined)', () => {
+  const roleHeld = catalog.permissionKeys().filter((k) => !catalog.isPrincipalKey(k));
+  assert.deepEqual(effectivePermissions(catalog.permissionKeys()), [...roleHeld].sort());
+});
+
+test('a null/blank builder id resolves to empty without touching the DB', async () => {
+  assert.deepEqual(await resolveBuilderPermissions(null), []);
+  assert.deepEqual(await resolveBuilderPermissions(undefined), []);
+  assert.deepEqual(await resolveBuilderPermissions(''), []);
+});
+
+test('builderHasPermissions denies on an empty required list (a mis-authored gate must not open)', async () => {
+  assert.equal(await builderHasPermissions(1, []), false);
+  assert.equal(await builderHasPermissions(1, null), false);
+});
+
+test('the resolver holds no cache — authority is read fresh per request (ADR 0016)', () => {
+  // A structural guard, not a behavioural one: the failure mode is a cached grant
+  // outliving its revocation, so the rule is that this file introduces no store at
+  // all. Catches a well-meaning "let's memoise the join" edit in review.
+  const code = fs.readFileSync(path.join(GOV, 'resolver.js'), 'utf8')
+    .split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
+  for (const banned of ['new Map(', 'new WeakMap(', 'setTimeout(', 'cache']) {
+    assert.ok(!code.includes(banned), `resolver.js must not introduce "${banned}" — authority is uncached`);
+  }
+});
+
+test('the kernel port exposes the resolver without core importing the module', () => {
+  const { governancePort } = require(path.join(GOV, 'routes', 'governance.js'));
+  assert.equal(typeof governancePort.resolveBuilderPermissions, 'function');
+  assert.equal(typeof governancePort.builderHasPermissions, 'function');
+  assert.equal(typeof governancePort.isSystem, 'function');
+  const manifest = JSON.parse(fs.readFileSync(path.join(GOV, 'module.json'), 'utf8'));
+  assert.ok(manifest.provides.includes('governance'), 'module.json must declare the governance port');
+  assert.ok(manifest.contributes.routes.includes('governance'), 'the port registers from the route factory');
+});

package/tests/governance_role_sync.mjs

@@ -0,0 +1,231 @@
+// tests/governance_role_sync.mjs — rank→role assignment stays in sync (BV1.R95b, ADR 0151).
+//
+// DB-free. The decision the writer executes is a pure function (modules/governance/
+// rank-roles.js planRankRoleSync), so these exercise PRODUCTION logic directly rather
+// than a re-implementation: db.syncRankRole reads the two row sets, calls this exact
+// function, and executes its verdict. The SQL halves — the DELETE/INSERT the writer
+// issues and the repair migration — are asserted structurally.
+//
+// The invariant under test is a TRUST-BOUNDARY invariant, not a bookkeeping one: a
+// DEMOTION must REMOVE the higher seeded role. An additive-only sync would leave a
+// demoted Archon still holding `archon`, so the (correctly uncached) resolver would
+// keep returning Archon permissions — ADR 0016's "a demotion takes effect on the very
+// next request" promise broken one layer beneath the resolver. Every assertion about
+// `remove` below is that promise.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'governance');
+const { planRankRoleSync, isSeededRankRole } = require(path.join(GOV, 'rank-roles.js'));
+
+// The seeded rank-roles exactly as governance_002 writes them.
+const SEEDED = [
+  { role_key: 'xenos', seeded_rank: 'xenos', is_system: true },
+  { role_key: 'thetes', seeded_rank: 'thetes', is_system: true },
+  { role_key: 'metic', seeded_rank: 'metic', is_system: true },
+  { role_key: 'archon', seeded_rank: 'archon', is_system: true },
+];
+const seededRole = (rank) => ({ role_key: rank, seeded_rank: rank, is_system: true });
+// An Archon-authored custom role from the R110 tab: no seeded_rank, not a system role.
+const customRole = (key) => ({ role_key: key, seeded_rank: null, is_system: false });
+
+const plan = (rank, currentRoles) => planRankRoleSync({ rank, currentRoles, seededRoles: SEEDED });
+
+// ---------------------------------------------------------------------------
+// registration — a builder with no roles gets the one matching their rank
+// ---------------------------------------------------------------------------
+
+test('registration: a role-less builder is assigned the role matching their rank', () => {
+  const p = plan('xenos', []);
+  assert.equal(p.target, 'xenos');
+  assert.deepEqual([...p.add], ['xenos']);
+  assert.deepEqual([...p.remove], []);
+  assert.deepEqual([...p.next], ['xenos']);
+});
+
+test('registration: the firstAdmin bootstrap (seated straight to archon) assigns archon', () => {
+  const p = plan('archon', []);
+  assert.deepEqual([...p.add], ['archon']);
+  assert.deepEqual([...p.next], ['archon']);
+});
+
+// ---------------------------------------------------------------------------
+// promotion — the new role is held and the OLD one is gone
+// ---------------------------------------------------------------------------
+
+test('promotion xenos→thetes: the new role is added and the old one removed', () => {
+  const p = plan('thetes', [seededRole('xenos')]);
+  assert.equal(p.target, 'thetes');
+  assert.deepEqual([...p.add], ['thetes']);
+  assert.deepEqual([...p.remove], ['xenos'], 'the superseded rank-role must be removed');
+  assert.deepEqual([...p.next], ['thetes'], 'exactly one seeded rank-role is held afterwards');
+});
+
+test('promotion via the auto-graduation path leaves exactly one seeded role', () => {
+  // maybeAutoGraduateToThetes runs the same _applyRankChangeTx, so the same plan.
+  const p = plan('thetes', [seededRole('xenos')]);
+  const seededHeld = p.next.filter((k) => SEEDED.some((s) => s.role_key === k));
+  assert.equal(seededHeld.length, 1);
+});
+
+// ---------------------------------------------------------------------------
+// demotion — THE SECURITY CASE. Assert the REMOVAL explicitly.
+// ---------------------------------------------------------------------------
+
+test('demotion archon→metic REMOVES the archon role (not merely adds metic)', () => {
+  const p = plan('metic', [seededRole('archon')]);
+  assert.deepEqual([...p.remove], ['archon'], 'the higher rank-role must be REMOVED on demotion');
+  assert.deepEqual([...p.add], ['metic']);
+  // The absence assertion is the one that matters: an additive-only sync would
+  // still hold `archon` here and the resolver would keep granting Archon powers.
+  assert.ok(!p.next.includes('archon'), 'a demoted Archon must NOT still hold the archon role');
+  assert.deepEqual([...p.next], ['metic']);
+});
+
+test('demotion archon→xenos (a multi-rung drop) removes archon just the same', () => {
+  const p = plan('xenos', [seededRole('archon')]);
+  assert.ok(p.remove.includes('archon'));
+  assert.ok(!p.next.includes('archon'));
+  assert.deepEqual([...p.next], ['xenos']);
+});
+
+test('a builder holding several stale seeded roles is reduced to exactly one', () => {
+  // Defence in depth: if drift ever left two seeded roles on one builder, the sync
+  // must not pick one and leave the other — every non-matching seeded role goes.
+  const p = plan('thetes', [seededRole('archon'), seededRole('metic'), seededRole('xenos')]);
+  assert.deepEqual([...p.remove].sort(), ['archon', 'metic', 'xenos']);
+  assert.deepEqual([...p.next], ['thetes']);
+});
+
+// ---------------------------------------------------------------------------
+// custom roles survive; legacy ranks resolve to nothing
+// ---------------------------------------------------------------------------
+
+test('an Archon-assigned custom role survives a rank change', () => {
+  const p = plan('metic', [seededRole('archon'), customRole('release-manager')]);
+  assert.deepEqual([...p.remove], ['archon'], 'only the seeded rank-role rotates');
+  assert.ok(!p.remove.includes('release-manager'), 'a custom role must never be revoked by a rank change');
+  assert.deepEqual([...p.next], ['metic', 'release-manager']);
+});
+
+test('a custom role is not mistaken for the rank-role even when its key matches a rank name', () => {
+  // role_key is UNIQUE so this cannot happen today, but the predicate must key on
+  // is_system + seeded_rank rather than on the key's spelling.
+  const impostor = { role_key: 'archon', seeded_rank: null, is_system: false };
+  assert.equal(isSeededRankRole(impostor), false);
+  const p = plan('metic', [impostor]);
+  assert.deepEqual([...p.remove], [], 'a non-system role is never rotated away');
+});
+
+test('a builder on a non-seeded legacy rank resolves to zero seeded roles', () => {
+  // migration 023's CHECK still admits twelve reserved ranks. governance_002's INNER
+  // JOIN gives them no row BY DESIGN (ADR 0151's fail-closed divergence) — preserve
+  // it, and strip any seeded role they were carrying.
+  const p = plan('hippeis', [seededRole('archon')]);
+  assert.equal(p.target, null, 'no seeded role exists for a legacy rank — invent none');
+  assert.deepEqual([...p.add], []);
+  assert.deepEqual([...p.remove], ['archon'], 'a legacy rank must not retain a seeded rank-role');
+  assert.deepEqual([...p.next], []);
+});
+
+test('a legacy-rank builder still keeps their custom roles', () => {
+  const p = plan('hippeis', [seededRole('metic'), customRole('release-manager')]);
+  assert.deepEqual([...p.next], ['release-manager']);
+});
+
+// ---------------------------------------------------------------------------
+// idempotence
+// ---------------------------------------------------------------------------
+
+test('the sync is idempotent — running it twice changes nothing the second time', () => {
+  const first = plan('metic', [seededRole('archon')]);
+  assert.ok(first.add.length + first.remove.length > 0, 'the first run must do work');
+  const after = first.next.map((key) => (SEEDED.find((s) => s.role_key === key) || customRole(key)));
+  const second = planRankRoleSync({ rank: 'metic', currentRoles: after, seededRoles: SEEDED });
+  assert.deepEqual([...second.add], []);
+  assert.deepEqual([...second.remove], []);
+  assert.deepEqual([...second.next], [...first.next]);
+});
+
+test('a builder already holding the right role produces no write at all', () => {
+  const p = plan('metic', [seededRole('metic'), customRole('release-manager')]);
+  assert.deepEqual([...p.add], []);
+  assert.deepEqual([...p.remove], []);
+});
+
+test('the plan is frozen — a caller cannot widen it after the decision', () => {
+  const p = plan('metic', [seededRole('archon')]);
+  assert.ok(Object.isFrozen(p) && Object.isFrozen(p.add) && Object.isFrozen(p.remove));
+  assert.throws(() => p.add.push('archon'), TypeError);
+});
+
+// ---------------------------------------------------------------------------
+// the SQL halves — asserted structurally
+// ---------------------------------------------------------------------------
+
+const dbSrc = fs.readFileSync(path.join(GOV, 'db.js'), 'utf8');
+const migDir = path.join(GOV, 'migrations');
+const repairSql = fs.readFileSync(path.join(migDir, 'governance_005_resync_builder_rank_roles.sql'), 'utf8');
+const stripSqlComments = (sql) => sql.replace(/--[^\n]*/g, '');
+
+test('the writer DELETEs the superseded assignments, not just INSERTs the new one', () => {
+  assert.match(dbSrc, /DELETE FROM governance_builder_roles/,
+    'syncRankRole must delete superseded rank-roles — an additive-only writer preserves privilege retention');
+  assert.match(dbSrc, /INSERT INTO governance_builder_roles[\s\S]*ON CONFLICT \(builder_id, role_key\) DO NOTHING/,
+    'the assignment insert must be idempotent');
+});
+
+test('the writer runs on the CALLER\'s transaction client when given one', () => {
+  assert.match(dbSrc, /async function syncRankRole\(client,/,
+    'syncRankRole must take the caller\'s client so the rotation is atomic with the rank write');
+  assert.match(dbSrc, /const q = client \|\| pool;/,
+    'and fall back to the pool only when there is no surrounding transaction');
+});
+
+test('both rank-change twins rotate the role inside their transaction', () => {
+  for (const rel of ['src/bongos/db.js', 'modules/lifecycle/db.js']) {
+    const src = fs.readFileSync(path.join(ROOT, rel), 'utf8');
+    const body = src.slice(src.indexOf('async function _applyRankChangeTx'));
+    const upd = body.indexOf('UPDATE builders SET rank');
+    const sync = body.indexOf('await syncGovernanceRankRole(client');
+    assert.ok(upd !== -1, `${rel}: expected the rank UPDATE in _applyRankChangeTx`);
+    assert.ok(sync !== -1, `${rel}: the rank write must rotate the seeded rank-role`);
+    assert.ok(sync > upd, `${rel}: the rotation must follow the rank write inside the same transaction`);
+    assert.match(src, /resolveOptional\('governance\.roleSync'\)/,
+      `${rel}: must reach governance through the kernel port, never by importing the module`);
+  }
+});
+
+test('the repair migration removes stale seeded roles and is idempotent', () => {
+  const code = stripSqlComments(repairSql);
+  assert.match(code, /DELETE FROM governance_builder_roles/,
+    'the repair must DELETE stale rank-roles — otherwise a demoted Archon keeps Archon permissions');
+  assert.match(code, /r\.is_system = true/, 'the delete must be keyed on the SEEDED roles only');
+  assert.match(code, /seeded_rank IS DISTINCT FROM b\.rank/,
+    'only assignments disagreeing with the builder\'s current rank may be removed');
+  assert.match(code, /ON CONFLICT \(builder_id, role_key\) DO NOTHING/, 'must be idempotent');
+  assert.ok(/BEGIN;/.test(code) && /COMMIT;/.test(code), 'must be transactional');
+});
+
+test('the repair migration touches ASSIGNMENTS, never GRANTS', () => {
+  // tests/governance_seed.mjs builds RANK_ROLE_SEED as the UNION of every grant
+  // migration and fails loudly if one ever revokes. This migration must stay out of
+  // that model entirely: it never writes governance_role_permissions.
+  const code = stripSqlComments(repairSql);
+  assert.ok(!/governance_role_permissions/i.test(code),
+    'the rank-role repair must not touch the grant table (it would break the seed union model)');
+});
+
+test('every governance migration keeps its objects namespaced and additive', () => {
+  const code = stripSqlComments(repairSql);
+  assert.ok(!/\bDROP\s+(TABLE|COLUMN|CONSTRAINT|INDEX)\b/i.test(code), 'module migrations are additive — no destructive DDL');
+  for (const m of code.matchAll(/CREATE (?:TABLE|INDEX)(?: IF NOT EXISTS)? (\w+)/gi)) {
+    assert.ok(m[1].startsWith('governance_'), `object ${m[1]} is not governance_-namespaced`);
+  }
+});

package/tests/governance_seed.mjs

@@ -0,0 +1,127 @@
+// tests/governance_seed.mjs — the compat-seed migration drift guard (BV1.R93, ADR 0151).
+//
+// The seed migration (governance_002_seed_and_backfill.sql) MATERIALISES the role→
+// permission grants as SQL. This parses that file and asserts the four role arrays
+// equal the code catalog's RANK_ROLE_SEED exactly — so the SQL snapshot can never
+// silently drift from the catalog (the "no second list that drifts" discipline). If
+// you change catalog.js, this goes red until the migration is regenerated (a NEW
+// migration for a NEW grant — migrations are run-once).
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { RANK_ROLE_SEED, RANK_ORDER } = require(path.join(ROOT, 'modules', 'governance', 'catalog.js'));
+
+const MIG_DIR = path.join(ROOT, 'modules', 'governance', 'migrations');
+const seedSql = fs.readFileSync(path.join(MIG_DIR, 'governance_002_seed_and_backfill.sql'), 'utf8');
+const tablesSql = fs.readFileSync(path.join(MIG_DIR, 'governance_001_tables.sql'), 'utf8');
+
+// The grant SQL is the UNION of the compat seed (002) and every LATER governance_*
+// grant migration. Migrations are run-once, so a floor change in catalog.js can never
+// be made by editing 002 — an already-migrated database would keep the old grant. It
+// arrives as a follow-on migration instead (governance_003 = task.abandon → metic,
+// ADR 0152), and what must equal RANK_ROLE_SEED is the union of them all, not any one
+// file. Read in filename order; every file is scanned for `SELECT '<role>', unnest(…)`
+// blocks, so a new grant migration needs no change here.
+const grantMigrationFiles = fs.readdirSync(MIG_DIR)
+  .filter((f) => f.endsWith('.sql') && f !== 'governance_001_tables.sql')
+  .sort();
+const grantSqlByFile = grantMigrationFiles.map((f) => [f, fs.readFileSync(path.join(MIG_DIR, f), 'utf8')]);
+
+// Extract, per role, every permission key granted across the grant migrations, plus
+// the per-file blocks (so a duplicate WITHIN one block is still catchable).
+function grantBlocksForRole(role) {
+  const re = new RegExp(`SELECT '${role}', unnest\\(ARRAY\\[([\\s\\S]*?)\\]\\)`, 'g');
+  const blocks = [];
+  for (const [file, sql] of grantSqlByFile) {
+    for (const m of sql.matchAll(re)) {
+      blocks.push({ file, keys: [...m[1].matchAll(/'([^']+)'/g)].map((x) => x[1]) });
+    }
+  }
+  return blocks;
+}
+
+test('the union of every grant migration matches RANK_ROLE_SEED exactly (no drift)', () => {
+  for (const role of RANK_ORDER) {
+    const blocks = grantBlocksForRole(role);
+    assert.ok(blocks.length > 0, `no grant block for ${role} in any governance migration`);
+    for (const b of blocks) {
+      assert.equal(b.keys.length, new Set(b.keys).size, `${role}: duplicate permission in the ${b.file} array`);
+    }
+    const granted = blocks.flatMap((b) => b.keys);
+    // set-equality (order in SQL is illustrative; the grant set is what matters)
+    assert.deepEqual(new Set(granted), new Set(RANK_ROLE_SEED[role]),
+      `${role}: grant migrations drift from catalog RANK_ROLE_SEED`);
+    // no key re-granted in a LATER migration (a no-op INSERT that muddies the ledger)
+    assert.equal(granted.length, new Set(granted).size, `${role}: the same permission is granted twice across migrations`);
+    assert.equal(new Set(granted).size, RANK_ROLE_SEED[role].length, `${role}: grant count mismatch`);
+  }
+});
+
+// The union model above is only faithful while grant migrations are ADDITIVE. A future
+// migration that REVOKES (raising a floor) would make the union overstate what the DB
+// holds, so fail loudly here rather than let the guard quietly go wrong.
+test('no grant migration revokes — the union model stays faithful', () => {
+  for (const [file, sql] of grantSqlByFile) {
+    const code = sql.replace(/--[^\n]*/g, '');
+    assert.ok(!/DELETE\s+FROM\s+governance_role_permissions/i.test(code),
+      `${file} revokes a grant — teach grantBlocksForRole to subtract before allowing this`);
+  }
+});
+
+test('the seed inserts exactly the four seeded rank-roles', () => {
+  const roleRows = [...seedSql.matchAll(/\('(xenos|thetes|metic|archon)',\s*'[^']+',/g)].map((m) => m[1]);
+  assert.deepEqual(new Set(roleRows), new Set(RANK_ORDER));
+});
+
+// strip `-- ...` line comments so prose ("ON CONFLICT DO NOTHING throughout") is not
+// counted as SQL.
+const stripComments = (sql) => sql.replace(/--[^\n]*/g, '');
+
+test('seed + tables are idempotent (ON CONFLICT / IF NOT EXISTS) and transactional', () => {
+  const seedCode = stripComments(seedSql);
+  const tablesCode = stripComments(tablesSql);
+  // every INSERT in the seed carries ON CONFLICT ... DO NOTHING
+  const inserts = seedCode.match(/INSERT INTO/g) || [];
+  const onConflict = seedCode.match(/ON CONFLICT/g) || [];
+  assert.equal(inserts.length, 6, 'expected 6 seed INSERTs (1 roles + 4 grant blocks + 1 backfill)');
+  assert.equal(inserts.length, onConflict.length, 'every seed INSERT must be ON CONFLICT DO NOTHING (idempotent)');
+  assert.ok(/BEGIN;/.test(seedCode) && /COMMIT;/.test(seedCode), 'seed must be transactional');
+  // tables use CREATE TABLE IF NOT EXISTS
+  const creates = tablesCode.match(/CREATE TABLE/g) || [];
+  const ifNotExists = tablesCode.match(/CREATE TABLE IF NOT EXISTS/g) || [];
+  assert.equal(creates.length, 3, 'expected 3 governance_* tables');
+  assert.equal(creates.length, ifNotExists.length, 'every CREATE TABLE must be IF NOT EXISTS');
+});
+
+test('the backfill assigns each builder their rank-role (join on a seeded role)', () => {
+  assert.match(seedSql, /INSERT INTO governance_builder_roles[\s\S]*FROM builders b[\s\S]*JOIN governance_roles r ON r\.role_key = b\.rank/,
+    'backfill must join builders.rank to a seeded governance_role');
+  assert.match(seedSql, /governance_builder_roles[\s\S]*ON CONFLICT \(builder_id, role_key\) DO NOTHING/,
+    'backfill must be idempotent');
+});
+
+test('later grant migrations are idempotent + transactional', () => {
+  for (const [file, sql] of grantSqlByFile) {
+    if (file === 'governance_002_seed_and_backfill.sql') continue; // covered above
+    const code = stripComments(sql);
+    const inserts = code.match(/INSERT INTO/g) || [];
+    const onConflict = code.match(/ON CONFLICT/g) || [];
+    assert.ok(inserts.length > 0, `${file}: a grant migration must INSERT something`);
+    assert.equal(inserts.length, onConflict.length, `${file}: every INSERT must be ON CONFLICT DO NOTHING`);
+    assert.ok(/BEGIN;/.test(code) && /COMMIT;/.test(code), `${file}: must be transactional`);
+  }
+});
+
+test('migration objects are all governance_-namespaced (ADR 0083 §5)', () => {
+  for (const sql of [tablesSql, seedSql]) {
+    for (const m of sql.matchAll(/CREATE (?:TABLE|INDEX)(?: IF NOT EXISTS)? (\w+)/g)) {
+      assert.ok(m[1].startsWith('governance_'), `object ${m[1]} is not governance_-namespaced`);
+    }
+  }
+});