@bongos/core 1.18.0 → 1.18.18

package/tests/one_active_claim_per_session.mjs

@@ -107,5 +107,81 @@ t('refusal carries the canonical reason code', () => {
   assert.equal(d.reason, 'session_already_has_active_claim');
 });
 
+// =========================================================================
+// Worktree-keying fix — the real commingle boundary is the WORKING TREE, not
+// the shared auth session. A builder's concurrent worktrees share ONE auth
+// session_id (the CLI token lives in ~/.config), so keying on the session alone
+// wrongly blocked the second parallel worktree. Refusal must scope to the SAME
+// worktree_name; a different worktree is a different branch → allowed.
+// =========================================================================
+
+// (e) THE FIX: same auth session, DIFFERENT worktree → ALLOWED (the parallel
+//     worktrees the code's own comment promised "must keep working").
+t('same session, different worktree → ALLOWED (parallel worktrees)', () => {
+  const d = shouldRefuseSessionClaim({
+    creatorSessionId: 'sess-1',
+    worktreeName: 'wt-feature-b',
+    activeClaimsForSession: [
+      { claim_id: 40, task_id: 50, creator_session_id: 'sess-1', worktree_name: 'wt-feature-a', title: 'A' },
+    ],
+  });
+  assert.equal(d.refuse, false);
+  assert.equal(d.inFlightTaskId, null);
+});
+
+// (f) Same auth session, SAME worktree → refused (a real commingle: one tree,
+//     one branch, two tasks).
+t('same session, same worktree → refused', () => {
+  const d = shouldRefuseSessionClaim({
+    creatorSessionId: 'sess-1',
+    worktreeName: 'wt-feature-a',
+    activeClaimsForSession: [
+      { claim_id: 41, task_id: 51, creator_session_id: 'sess-1', worktree_name: 'wt-feature-a', title: 'A' },
+    ],
+  });
+  assert.equal(d.refuse, true);
+  assert.equal(d.inFlightTaskId, 51);
+  assert.equal(d.reason, 'session_already_has_active_claim');
+});
+
+// (g) Both worktree-less (a plain clone, no --worktree): the single branch really
+//     would commingle → still refused (the safe default, unchanged behaviour).
+t('same session, both worktree-less (null) → refused (shared clone)', () => {
+  const d = shouldRefuseSessionClaim({
+    creatorSessionId: 'sess-1',
+    worktreeName: null,
+    activeClaimsForSession: [
+      { claim_id: 42, task_id: 52, creator_session_id: 'sess-1', worktree_name: null, title: 'A' },
+    ],
+  });
+  assert.equal(d.refuse, true);
+  assert.equal(d.inFlightTaskId, 52);
+});
+
+// (h) A worktree-bound existing claim must NOT block a later worktree-less claim
+//     (they are genuinely different trees), and vice-versa.
+t('worktree-bound claim does not block a worktree-less claim (different trees)', () => {
+  const held = { claim_id: 43, task_id: 53, creator_session_id: 'sess-1', worktree_name: 'wt-x', title: 'X' };
+  assert.equal(shouldRefuseSessionClaim({ creatorSessionId: 'sess-1', worktreeName: null, activeClaimsForSession: [held] }).refuse, false);
+  const heldNull = { claim_id: 44, task_id: 54, creator_session_id: 'sess-1', worktree_name: null, title: 'N' };
+  assert.equal(shouldRefuseSessionClaim({ creatorSessionId: 'sess-1', worktreeName: 'wt-y', activeClaimsForSession: [heldNull] }).refuse, false);
+});
+
+// (i) Correct in-flight task is named when MULTIPLE claims exist across worktrees
+//     — the block points at the one in the SAME tree, not just the first row.
+t('names the in-flight task in the MATCHING worktree, not the first row', () => {
+  const d = shouldRefuseSessionClaim({
+    creatorSessionId: 'sess-1',
+    worktreeName: 'wt-two',
+    activeClaimsForSession: [
+      { claim_id: 45, task_id: 60, creator_session_id: 'sess-1', worktree_name: 'wt-one', title: 'One' },
+      { claim_id: 46, task_id: 61, creator_session_id: 'sess-1', worktree_name: 'wt-two', title: 'Two' },
+    ],
+  });
+  assert.equal(d.refuse, true);
+  assert.equal(d.inFlightTaskId, 61);
+  assert.equal(d.inFlightTitle, 'Two');
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/override_attribution.mjs

@@ -95,15 +95,17 @@ await test('approve: tasks.shipped_by is attributed to the REQUESTER, not the Ar
     'must not re-SELECT the requester row already locked by the UPDATE');
 });
 
-await test('approve: the task.confirmed credit_log row is for the REQUESTER', async () => {
+await test('approve: ADR 0120 pay-on-land — NO credit at override-approval; the reward waits for the land', async () => {
   const pool = fakePool({ requesterId: REQUESTER, decision: 'approve', task: TASK });
-  await decideOverrideRequest({ requestId: 1, archonId: ARCHON, decision: 'approve' }, { pool });
-
-  const credit = find(pool._client.queries, /INSERT INTO credit_log/);
-  assert.ok(credit, 'a credit_log INSERT must run');
-  assert.equal(credit.params[0], REQUESTER, 'credit_log.builder_id must be the requester');
-  assert.equal(credit.params[1], TASK.id, 'credit_log.task_id must be the task');
-  assert.ok(credit.params[2] > 0, 'credit delta must be positive');
+  const out = await decideOverrideRequest({ requestId: 1, archonId: ARCHON, decision: 'approve' }, { pool });
+
+  // The override-approval flips completed→confirmed and attributes shipped_by to
+  // the requester (asserted above), but the per-task credit now lands at the
+  // confirmed→shipped flip (shipTask → awardLandingCredit), NOT here — so a
+  // stranded override-confirmed task pays nothing until its code is on `main`.
+  assert.equal(out.confirmResult.creditsAwarded, 0, 'no per-task credit lands at override-approval');
+  assert.equal(all(pool._client.queries, /INSERT INTO credit_log/).length, 0,
+    'override-approval must run ZERO credit_log INSERTs — the reward waits for the land');
 });
 
 await test('approve: transaction commits (not rolls back)', async () => {

package/tests/override_request_ownership.mjs

@@ -183,10 +183,14 @@ await test('approve: credit + tasks.shipped_by go to the CLAIM HOLDER, not the r
   assert.deepEqual(taskUpdate.params, [TASK.id, WORKER],
     `shipped_by must bind to the claim holder ${WORKER}, got ${JSON.stringify(taskUpdate.params)}`);
 
-  const credit = find(pool._client.queries, /INSERT INTO credit_log/);
-  assert.ok(credit, 'a credit_log INSERT must run');
-  assert.equal(credit.params[0], WORKER, 'credit_log.builder_id must be the claim holder');
-  assert.ok(credit.params[2] > 0, 'credit delta must be positive');
+  // ADR 0120 pay-on-land: the per-task credit no longer lands at
+  // override-approval — it lands at the confirmed→shipped flip (shipTask). The
+  // credit-theft guard this test exists for is still intact: creditedBuilderId +
+  // shipped_by are the CLAIM HOLDER (asserted above), so when the credit DOES
+  // land at ship it lands on the worker, never the requester/Archon.
+  assert.equal(out.confirmResult.creditsAwarded, 0, 'no per-task credit lands at override-approval');
+  assert.equal(all(pool._client.queries, /INSERT INTO credit_log/).length, 0,
+    'override-approval must run ZERO credit_log INSERTs — the reward waits for the land');
 });
 
 await test('approve: the claim-holder lookup happens BEFORE the tasks UPDATE binds shipped_by', async () => {

package/tests/package_core.mjs

@@ -16,6 +16,9 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import zlib from 'node:zlib';
 import crypto from 'node:crypto';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
 
 const require = createRequire(import.meta.url);
 const m = require('../scripts/gds/package-core.js');
@@ -25,14 +28,22 @@ const {
   ARTIFACT_NAME, MANIFEST_SCHEMA, TAR_ROOT,
   // task 1824 — the consumer-core file-classification layer
   isDocPath, functionalSecretLeaks, processCoreFile,
+  // idea 1000543 — npm-never-installed files dropped from the pin
+  isNpmStripped,
   // task 2121 — agent-doc (CLAUDE.md/AGENTS.md) stub
   isAgentDoc, CORE_AGENT_DOC_STUB,
   // task 1882 (ADR 0108 §2) — the real installable npm package
   CORE_DEP_NAMES, buildPackageJson, resolveLockDep, lockfileClosure, prunePackageLock,
   // task 2089 (ADR 0134) — private-by-default npm publish
   publishArgs,
+  // task 1002218 (audit H3) — build-time self-verify pin reproduction
+  reproducePinFromTree,
+  // task 1002220 (audit H6) — post-build leak scan
+  scanArtifactForLeaks, PRIOR_INSTANCE_LITERALS,
+  // task 1002217 (audit H4) — the fixed neutral floor
+  PRIOR_INSTANCE_FLOOR,
 } = m;
-const { buildRedactionRules, collectSensitiveLiterals } = require('../scripts/gds/mirror-redact.js');
+const { buildRedactionRules, collectSensitiveLiterals, redactText, findLeaks } = require('../scripts/gds/mirror-redact.js');
 
 // A synthetic instance brand for the classification tests (never the real OTB literals).
 const TEST_BRANDING = {
@@ -485,5 +496,239 @@ t('prunePackageLock: on the real repo lockfile, drops the vast majority of packa
   assert.ok(keptCount > 0);
 });
 
+// ---- task 1002218 (audit H3): build-time self-verify pin reproduction ----
+// Build a tiny unpacked tree + a matching sidecar manifest (same hash fns the packager uses),
+// then prove reproducePinFromTree accepts a faithful reproduction and rejects each tamper.
+function makeTreeAndSidecar() {
+  const root = mkdtempSync(join(tmpdir(), 'pc-selfverify-'));
+  const files = [
+    { path: 'src/a.js', content: 'module.exports = 1\n', mode: '0000644' },
+    { path: 'sub/dir/b.json', content: '{"k":2}\n', mode: '0000644' },
+    { path: 'bin/run.sh', content: '#!/bin/sh\necho hi\n', mode: '0000755' },
+  ];
+  for (const f of files) {
+    const abs = join(root, ...f.path.split('/'));
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, f.content);
+  }
+  const meta = files
+    .map((f) => ({ path: f.path, mode: normalizeMode(f.mode), sha256: sha256hex(Buffer.from(f.content)) }))
+    .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+  const sidecar = { core_version: '9.9.9', tree_sha256: canonicalTreeHash(meta), files: meta, tarball: { sha256: 'abc123', bytes: 0 } };
+  return { root, sidecar, files };
+}
+
+t('reproducePinFromTree: a faithful tree reproduces the pin (ok, no problems)', () => {
+  const { root, sidecar } = makeTreeAndSidecar();
+  try {
+    const r = reproducePinFromTree({ treeRoot: root, sidecar }); // no tgzPath → skip the tarball-bytes check
+    assert.equal(r.ok, true, r.problems.join('; '));
+    assert.equal(r.fileCount, 3);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+t('reproducePinFromTree: a tampered file content → not ok (content mismatch)', () => {
+  const { root, sidecar } = makeTreeAndSidecar();
+  try {
+    writeFileSync(join(root, 'src', 'a.js'), 'module.exports = 666 // tampered\n');
+    const r = reproducePinFromTree({ treeRoot: root, sidecar });
+    assert.equal(r.ok, false);
+    assert.ok(r.problems.some((p) => /content mismatch: src\/a\.js/.test(p)), r.problems.join('; '));
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+t('reproducePinFromTree: a missing file → not ok (missing in artifact)', () => {
+  const { root, sidecar } = makeTreeAndSidecar();
+  try {
+    rmSync(join(root, 'sub', 'dir', 'b.json'));
+    const r = reproducePinFromTree({ treeRoot: root, sidecar });
+    assert.equal(r.ok, false);
+    assert.ok(r.problems.some((p) => /missing in artifact: sub\/dir\/b\.json/.test(p)), r.problems.join('; '));
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+t('reproducePinFromTree: a manifest whose tree_sha256 lies → not ok (tree hash mismatch)', () => {
+  const { root, sidecar } = makeTreeAndSidecar();
+  try {
+    const lying = { ...sidecar, tree_sha256: 'f'.repeat(64) }; // every file matches, but the recorded hash is wrong
+    const r = reproducePinFromTree({ treeRoot: root, sidecar: lying });
+    assert.equal(r.ok, false);
+    assert.ok(r.problems.some((p) => /recomputed tree_sha256/.test(p)), r.problems.join('; '));
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+t('reproducePinFromTree: a .tgz whose bytes differ from manifest.tarball.sha256 → not ok', () => {
+  const { root, sidecar } = makeTreeAndSidecar();
+  const tgz = join(root, 'artifact.tgz');
+  try {
+    writeFileSync(tgz, Buffer.from('the actual tarball bytes'));
+    const withTb = { ...sidecar, tarball: { sha256: sha256hex(Buffer.from('DIFFERENT bytes')), bytes: 24 } };
+    const r = reproducePinFromTree({ treeRoot: root, sidecar: withTb, tgzPath: tgz });
+    assert.equal(r.ok, false);
+    assert.ok(r.problems.some((p) => /\.tgz sha256/.test(p)), r.problems.join('; '));
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+// ---- task 1002220 (audit H6): post-build leak scan ----
+t('scanArtifactForLeaks: flags a prior-instance literal in any shipped file', () => {
+  const files = [
+    { path: 'src/x.js', content: 'const base = "https://amazonprimea.com";\n' },
+    { path: 'docs/readme.md', content: 'Owned by lars589.\n' },
+    { path: 'src/clean.js', content: 'export const ok = true;\n' },
+  ];
+  const r = scanArtifactForLeaks(files);
+  const hitPaths = r.literalHits.map((h) => h.path);
+  assert.ok(hitPaths.includes('src/x.js'), 'amazonprimea in a functional file must be flagged');
+  assert.ok(hitPaths.includes('docs/readme.md'), 'owner login in a doc must be flagged too (literal scan spans all files)');
+  assert.ok(!hitPaths.includes('src/clean.js'), 'a clean file must not be flagged');
+});
+
+t('scanArtifactForLeaks: flags a public IP but not a private/localhost one', () => {
+  const r = scanArtifactForLeaks([
+    { path: 'a.js', content: 'host = 104.236.254.243\n' },   // public → flagged
+    { path: 'b.js', content: 'host = 127.0.0.1; lan = 10.0.0.5\n' }, // localhost + private → not
+  ]);
+  const byPath = Object.fromEntries(r.literalHits.map((h) => [h.path, h.label]));
+  assert.ok(byPath['a.js'] === 'public-ip', `expected a public-ip hit on a.js, got ${JSON.stringify(r.literalHits)}`);
+  assert.ok(!('b.js' in byPath), 'localhost/private IPs must not be flagged');
+});
+
+t('scanArtifactForLeaks: credential SHAPE warning fires on functional files, not docs', () => {
+  const key = `sk-ant-${'A1b2C3d4E5f6G7h8'}`; // a fake Anthropic-shaped token
+  const r = scanArtifactForLeaks([
+    { path: 'src/leak.js', content: `const k = "${key}";\n` },
+    { path: 'docs/guide.md', content: `example key: ${key}\n` }, // docs are redacted+gated elsewhere → not a shape warning here
+  ]);
+  const warnPaths = r.secretWarnings.map((w) => w.path);
+  assert.ok(warnPaths.includes('src/leak.js'), 'a credential shape in a functional file must warn');
+  assert.ok(!warnPaths.includes('docs/guide.md'), 'docs are out of scope for the credential-shape warning');
+  const w = r.secretWarnings.find((x) => x.path === 'src/leak.js');
+  assert.ok(w.shapes.includes('anthropic-key'), `expected anthropic-key shape, got ${JSON.stringify(w.shapes)}`);
+});
+
+t('scanArtifactForLeaks: ordinary long identifiers / base64 hashes do NOT warn (low false-positive)', () => {
+  const r = scanArtifactForLeaks([
+    { path: 'src/normal.js', content: 'const integrityHash = "sha512-Abc123Def456Ghi789Jkl012Mno345Pqr678";\nfunction reallyLongDescriptiveFunctionName() {}\n' },
+    { path: 'data.json', content: JSON.stringify({ sha256: 'a'.repeat(64), token: 'short' }) },
+  ]);
+  assert.equal(r.secretWarnings.length, 0, `no credential shapes expected, got ${JSON.stringify(r.secretWarnings)}`);
+});
+
+t('PRIOR_INSTANCE_LITERALS: carries the customer-zero tokens the neutral trunk must not ship', () => {
+  assert.ok(Array.isArray(PRIOR_INSTANCE_LITERALS) && PRIOR_INSTANCE_LITERALS.length >= 3);
+  // Case-insensitive: the floor tokens are lowercased for the redaction rules + findLeaks
+  // (both case-insensitive), so assert coverage, not exact case.
+  const lower = PRIOR_INSTANCE_LITERALS.map((s) => s.toLowerCase());
+  for (const lit of ['amazonprimea', 'off the boats', 'lars589']) {
+    assert.ok(lower.includes(lit), `floor list should cover ${lit}`);
+  }
+});
+
+// ---- task 1002217 (audit H4): the neutral floor gate (fails closed with no branding.json) ----
+t('neutral floor: with EMPTY branding + the floor as extra, docs de-brand and the gate covers the floor', () => {
+  // The F2 gap: with no branding.json, buildRedactionRules({})/collectSensitiveLiterals({}) are
+  // empty, so a doc keeps its prior-instance identity. Injecting PRIOR_INSTANCE_FLOOR as `extra`
+  // (exactly what package-core's main() now does) closes it.
+  const rules = buildRedactionRules({}, PRIOR_INSTANCE_FLOOR);
+  const lits = collectSensitiveLiterals({}, PRIOR_INSTANCE_FLOOR);
+  const doc = 'See https://amazonprimea.com, owned by lars589 — the Off the Boats world.';
+  const red = redactText(doc, rules);
+  assert.ok(!/amazonprimea/i.test(red), `amazonprimea survived: ${red}`);
+  assert.ok(!/lars589/i.test(red), `owner login survived: ${red}`);
+  assert.ok(!/off the boats/i.test(red), `product name survived: ${red}`);
+  assert.deepEqual(findLeaks(red, lits), [], `gate still sees a floor leak after redaction: ${JSON.stringify(findLeaks(red, lits))}`);
+});
+
+t('neutral floor: the fail-closed gate WOULD catch an un-redacted survivor (empty branding)', () => {
+  const lits = collectSensitiveLiterals({}, PRIOR_INSTANCE_FLOOR);
+  // If a doc reached the gate still carrying a floor literal, findLeaks (the fail-closed detector)
+  // flags it — which aborts the build in package-core (atomic, produces nothing).
+  assert.ok(findLeaks('leftover amazonprimea reference', lits).length > 0, 'floor token must be gated');
+  assert.ok(findLeaks('signed off by lars589', lits).length > 0, 'floor owner must be gated');
+});
+
+t('neutral floor: WITHOUT the floor, empty branding leaks (proves the floor is what closes F2)', () => {
+  // The counterfactual — the pre-H4 neutral-trunk behavior: empty branding + no floor = no rules,
+  // no gate literals, so the doc ships its prior-instance identity verbatim.
+  const rules = buildRedactionRules({});
+  const lits = collectSensitiveLiterals({});
+  const doc = 'amazonprimea + lars589';
+  assert.equal(redactText(doc, rules).includes('amazonprimea'), true, 'no-floor redaction is a no-op (the F2 gap)');
+  assert.equal(findLeaks(doc, lits).length, 0, 'no-floor gate sees nothing (the F2 gap)');
+});
+
+// ---- idea 1000543: npm-never-installed files are dropped from the pin ----
+// npm strips .gitignore/.npmignore/.npmrc from an installed package, so a pin that
+// LISTS one fails when a consumer recomputes the tree hash over node_modules/@bongos/core
+// (verifyInstalledPin, upgrade.js) -> the vendored `bongos upgrade` auto-rolls-back.
+t('isNpmStripped: matches .gitignore/.npmignore/.npmrc at root and any depth', () => {
+  assert.equal(isNpmStripped('.gitignore'), true);
+  assert.equal(isNpmStripped('.npmignore'), true);
+  assert.equal(isNpmStripped('.npmrc'), true);
+  assert.equal(isNpmStripped('modules/economy/.gitignore'), true); // npm strips nested ones too
+  assert.equal(isNpmStripped('a/b/c/.npmrc'), true);
+});
+
+t('isNpmStripped: does NOT match ordinary files or basename lookalikes', () => {
+  assert.equal(isNpmStripped('src/index.js'), false);
+  assert.equal(isNpmStripped('package.json'), false);
+  assert.equal(isNpmStripped('docs/.gitignore.md'), false); // .gitignore is not the basename here
+  assert.equal(isNpmStripped('gitignore'), false);          // no leading dot
+  assert.equal(isNpmStripped('src/.gitignoreignore'), false);
+  assert.equal(isNpmStripped(''), false);
+  assert.equal(isNpmStripped(null), false);
+});
+
+t('the packager selection drops the stripped files from the pinned set (models main())', () => {
+  const treePaths = ['.gitignore', 'src/a.js', 'migrations/001.sql', 'modules/x/.npmrc', 'README.md'];
+  const kept = treePaths.filter((p) => !isNpmStripped(p)); // exactly main()'s `publishable` filter
+  assert.deepEqual(kept, ['src/a.js', 'migrations/001.sql', 'README.md']);
+});
+
+// End-to-end proof against the consume-side recompute. reproducePinFromTree and upgrade.js's
+// verifyInstalledPin both iterate manifest.files[] and rebuild canonicalTreeHash, so a manifest
+// that LISTS .gitignore fails when npm has stripped it (the bug); a manifest built through the
+// isNpmStripped filter does not list it and reproduces cleanly (the fix).
+function buildManifestAndNpmInstalledTree({ includeGitignore }) {
+  const root = mkdtempSync(join(tmpdir(), 'pc-npmstrip-'));
+  const treeFiles = [ // the FULL git tree the packager enumerates, incl. a tracked .gitignore
+    { path: '.gitignore', content: 'dist/\nnode_modules/\n' },
+    { path: 'src/a.js', content: 'module.exports = 1\n' },
+    { path: 'package.json', content: '{"name":"@bongos/core"}\n' },
+  ];
+  // What the packager PINS: pre-fix keeps everything; post-fix drops the npm-stripped files.
+  const pinned = treeFiles.filter((f) => (includeGitignore ? true : !isNpmStripped(f.path)));
+  const files = pinned
+    .map((f) => ({ path: f.path, mode: normalizeMode('100644'), sha256: sha256hex(Buffer.from(f.content)) }))
+    .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+  const sidecar = { core_version: '9.9.9', tree_sha256: canonicalTreeHash(files), files };
+  // What `npm install` ACTUALLY materializes: everything EXCEPT the files npm strips.
+  for (const f of treeFiles) {
+    if (isNpmStripped(f.path)) continue; // npm never writes .gitignore into the installed package
+    const abs = join(root, ...f.path.split('/'));
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, f.content);
+  }
+  return { root, sidecar };
+}
+
+t('idea 1000543 (the bug): a manifest that PINS .gitignore FAILS against an npm-installed tree', () => {
+  const { root, sidecar } = buildManifestAndNpmInstalledTree({ includeGitignore: true });
+  try {
+    const r = reproducePinFromTree({ treeRoot: root, sidecar });
+    assert.equal(r.ok, false, 'pinning .gitignore must fail once npm has stripped it');
+    assert.ok(r.problems.some((p) => /\.gitignore/.test(p)), `expected a .gitignore problem, got: ${r.problems.join('; ')}`);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+t('idea 1000543 (the fix): the isNpmStripped filter makes the pin reproduce against the npm-installed tree', () => {
+  const { root, sidecar } = buildManifestAndNpmInstalledTree({ includeGitignore: false });
+  try {
+    assert.ok(!sidecar.files.some((f) => f.path === '.gitignore'), 'the fixed manifest must not list .gitignore');
+    const r = reproducePinFromTree({ treeRoot: root, sidecar });
+    assert.equal(r.ok, true, `the fixed manifest must reproduce; problems: ${r.problems.join('; ')}`);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/parse_cookie_decode.mjs

@@ -0,0 +1,42 @@
+// tests/parse_cookie_decode.mjs — regression for the post-login redirect landing
+// on /gate/ instead of the requested page (task 1002241).
+//
+// The onboarding wizard's "Connect GitHub" button hits /auth/web/start?return=/create,
+// which stores the return target via `res.cookie(RETURN_COOKIE, '/create', …)`. Express
+// `res.cookie` percent-ENCODES the value, so the wire cookie is `gds_return=%2Fcreate`.
+// parseCookie() must DECODE symmetrically on read — else the callback runs
+// safeReturnTo('%2Fcreate'), which (not starting with '/') is parsed as a URL, throws,
+// returns null, and the post-login redirect silently falls through to the default
+// landing (cloudbongos.com → /gate/). Decoding is a no-op for hex/simple values, so it
+// can't regress the state/session/repos cookies.
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const { parseCookie } = require('../src/bongos/routes/_helpers.js');
+
+let pass = 0, fail = 0;
+const ok = (cond, msg) => { if (cond) { pass++; console.log('  ok ', msg); } else { fail++; console.log('  FAIL', msg); } };
+const req = (cookie) => ({ headers: { cookie } });
+
+console.log('parseCookie — decodes percent-encoded values (task 1002241):');
+ok(parseCookie(req('gds_return=%2Fcreate'), 'gds_return') === '/create',
+   '"%2Fcreate" → "/create" (the Connect-GitHub return bug)');
+ok(parseCookie(req('gds_return=https%3A%2F%2Fbuilders.cloudbongos.com%2Fx'), 'gds_return')
+     === 'https://builders.cloudbongos.com/x',
+   'encoded full https URL round-trips (the #726 subdomain return, same latent bug)');
+
+console.log('\nparseCookie — no-op / safe for the other cookies:');
+ok(parseCookie(req('gds_oauth_state=03e92dd24cad3219c637e50fc9f115ef'), 'gds_oauth_state')
+     === '03e92dd24cad3219c637e50fc9f115ef', 'hex state value unchanged');
+ok(parseCookie(req('gds_session=' + 'a'.repeat(64)), 'gds_session') === 'a'.repeat(64),
+   'hex session token unchanged');
+ok(parseCookie(req('gds_oauth_repos=1'), 'gds_oauth_repos') === '1', 'repos "1" unchanged');
+
+console.log('\nparseCookie — misc:');
+ok(parseCookie(req(''), 'gds_return') === null, 'no cookies → null');
+ok(parseCookie(req('other=x; gds_return=%2Fcreate'), 'gds_return') === '/create',
+   'finds the named cookie among several');
+ok(parseCookie(req('gds_return=%E0%A4%A'), 'gds_return') === '%E0%A4%A',
+   'malformed percent-escape falls back to the raw value (no throw)');
+
+console.log(`\nparseCookie decode tests: ${pass} passed, ${fail} failed`);
+if (fail) process.exit(1);

package/tests/pay_on_land.mjs

@@ -0,0 +1,129 @@
+// tests/pay_on_land.mjs
+//
+// ADR 0120 part 1 (pay-on-land) — the per-task credit + idea-promotion bonus
+// are booked at the confirmed→SHIPPED flip (db.shipTask → awardLandingCredit),
+// NOT at confirm. This is the mirror of confirm_attribution.mjs / override_
+// attribution.mjs / grade_attribution.mjs, which now assert NO credit at their
+// (confirm-time) transition; here we assert the credit lands at ship.
+//
+// The contract this pins:
+//   • ship awards a positive per-task credit, reason='task.shipped'
+//   • the credit is attributed to the CLAIM HOLDER (the builder who did the
+//     work), even when a DIFFERENT builder (the reconciler / a supervisor)
+//     triggers the ship
+//   • idempotent on (task_id, 'task.shipped'): a re-ship / reconciler re-sweep
+//     books nothing a second time
+//   • credits_reward = 0 → no credit_log INSERT
+//   • a task not in 'confirmed' state throws TASK_NOT_CONFIRMED, awards nothing
+//
+// shipTask honors the #538 `deps.pool` seam under NODE_ENV==='test', so we drive
+// it with a SQL-aware fakeClient — no live DB.
+//
+// Run:  node tests/pay_on_land.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+// shipTask resolves the `reward` port for the credit grant + achievement
+// reconcile. Register it; stub the gamification hooks to no-ops so the test
+// isolates the credit path (the real credits.js SQL still runs against the fake).
+const achievements = require('../modules/economy/achievements.js');
+achievements.evaluateAfterShip = async () => [];
+achievements.evaluateAfterCreditAward = async () => [];
+achievements.reconcileBuilderAchievements = async () => [];
+const seams = require('../src/module-seams.js');
+if (!seams.hasProvider('reward')) seams.registerProvider('reward', require('../modules/economy/reward.js'));
+const db = require('../modules/lifecycle/db.js');
+const { shipTask } = db;
+
+const { test, summary } = makeRunner();
+
+// SQL-aware fake covering shipTask's transaction. Knobs:
+//   claimHolderId       → who mostRecentClaimHolderId resolves (null = none)
+//   shippedBy           → tasks.shipped_by on the returned shipped row
+//   creditsReward, kind → the task's reward inputs
+//   confirmed=false     → the UPDATE tasks matches nothing (TASK_NOT_CONFIRMED)
+//   priorShipCredit     → a 'task.shipped' credit_log row already exists (idempotent)
+function fakePool({ claimHolderId, shippedBy, creditsReward = 15, kind = 'feature', confirmed = true, priorShipCredit = false }) {
+  return makeSqlAwareClient((s) => {
+      if (/^UPDATE tasks/.test(s)) {
+        return {
+          rows: confirmed
+            ? [{ id: TASK.id, title: TASK.title, status: 'shipped', shipped_at: new Date(0).toISOString(),
+                 shipped_by: shippedBy, security_sensitive: false, value_summary: null,
+                 credits_reward: creditsReward, kind }]
+            : [],
+        };
+      }
+      if (/^UPDATE claims/.test(s)) return { rows: [] };                 // no open claims to heal
+      if (/UPDATE builders SET first_ship_at/.test(s)) return { rows: [] };
+      if (/SELECT rank FROM builders/.test(s)) return { rows: [{ rank: 'thetes' }] }; // not xenos → no graduation
+      if (/SELECT builder_id FROM claims/.test(s)) {
+        return { rows: claimHolderId == null ? [] : [{ builder_id: claimHolderId }] };
+      }
+      if (/SELECT 1 FROM credit_log .* 'task\.shipped'/.test(s)) {
+        return { rows: priorShipCredit ? [{ '?column?': 1 }] : [] };
+      }
+      if (/SELECT 1 FROM credit_log .* 'idea_promotion_bonus'/.test(s)) return { rows: [] };
+      if (/FROM idea_inbox/.test(s)) return { rows: [] };                // no idea lineage
+      if (/INSERT INTO credit_log/.test(s)) return { rows: [] };
+      return { rows: [] };                                              // BEGIN/COMMIT/SAVEPOINT/etc.
+  });
+}
+
+const find = (queries, re) => queries.find((q) => re.test(String(q.sql).replace(/\s+/g, ' ')));
+const all = (queries, re) => queries.filter((q) => re.test(String(q.sql).replace(/\s+/g, ' ')));
+
+const RECONCILER = 999;  // the builder_id the reconciler passes to shipTask
+const WORKER = 25;       // the claim holder who actually did the work
+const TASK = { id: 660, title: 'fixture task' };
+
+// =========================================================================
+await test('ship: the per-task credit lands at SHIP (reason=task.shipped), attributed to the claim holder', async () => {
+  // shipped_by was set to the claim holder at confirm; the reconciler triggers
+  // the ship with its own builderId — attribution must still be the worker.
+  const pool = fakePool({ claimHolderId: WORKER, shippedBy: WORKER, creditsReward: 15, kind: 'feature' });
+  const out = await shipTask({ taskId: TASK.id, builderId: RECONCILER }, { pool });
+
+  assert.equal(out.status, 'shipped', 'task flips to shipped');
+  assert.equal(out.creditedBuilderId, WORKER, 'credit attributed to the claim holder, not the reconciler');
+  assert.ok(out.creditsAwarded > 0, 'a positive per-task credit must be awarded at ship');
+
+  const insert = find(pool._client.queries, /INSERT INTO credit_log/);
+  assert.ok(insert, 'a credit_log INSERT must run at ship');
+  assert.equal(insert.params[0], WORKER, 'credit_log.builder_id = claim holder');
+  assert.notEqual(insert.params[0], RECONCILER, 'credit must NOT go to the ship trigger');
+  assert.equal(insert.params[1], TASK.id, 'credit_log.task_id = the task');
+  assert.equal(insert.params[3], 'task.shipped', "reason must be 'task.shipped' (ADR 0120), not 'task.confirmed'");
+});
+
+await test('ship: idempotent — a prior task.shipped credit means no second INSERT', async () => {
+  const pool = fakePool({ claimHolderId: WORKER, shippedBy: WORKER, priorShipCredit: true });
+  const out = await shipTask({ taskId: TASK.id, builderId: RECONCILER }, { pool });
+  assert.equal(out.creditsAwarded, 0, 'no fresh credit on a re-ship / reconciler re-sweep');
+  assert.equal(all(pool._client.queries, /INSERT INTO credit_log/).length, 0, 'must not double-insert credit');
+});
+
+await test('ship: credits_reward = 0 → no credit_log INSERT', async () => {
+  const pool = fakePool({ claimHolderId: WORKER, shippedBy: WORKER, creditsReward: 0 });
+  const out = await shipTask({ taskId: TASK.id, builderId: RECONCILER }, { pool });
+  assert.equal(out.creditsAwarded, 0, 'a zero-reward task pays nothing');
+  assert.equal(all(pool._client.queries, /INSERT INTO credit_log/).length, 0, 'no INSERT for a 0-reward task');
+});
+
+await test('ship: not in confirmed state → throws TASK_NOT_CONFIRMED, awards nothing', async () => {
+  const pool = fakePool({ claimHolderId: WORKER, shippedBy: WORKER, confirmed: false });
+  await assert.rejects(
+    () => shipTask({ taskId: TASK.id, builderId: RECONCILER }, { pool }),
+    (err) => err.code === 'TASK_NOT_CONFIRMED',
+    'must throw TASK_NOT_CONFIRMED when the UPDATE matches no confirmed row'
+  );
+  assert.equal(all(pool._client.queries, /INSERT INTO credit_log/).length, 0, 'must not award credit on a failed ship');
+});
+
+// -------------------------------------------------------------------------
+summary();