@bongos/core 1.18.18 → 1.19.2

package/tests/fitness.mjs

@@ -4,11 +4,13 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { onDiskModuleKeys } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const fitness = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
 
+
 test('all fitness checks pass with no hard failures (the CI gate)', () => {
   const results = fitness.runAll();
   const failed = results.filter((r) => r.hardFail);
@@ -158,12 +160,26 @@ test('module boundary actually CATCHES violations when enforcing (ratchet flip)'
 test('core-carries-no-module-code: the live kernel machinery is clean', () => {
   const r = fitness.checkCoreCarriesNoModuleCode();
   assert.equal(r.hardFail, false, r.violations.join('\n'));
-  // the check is live, not vacuous — it discovered the real module keys
-  // (incl. the net-new `demo` proof module, BV1.R52 / task 1424, `ideas`, BV1.R78,
-  // `security`, BV1.R79, `builder-settings`, BV1.R80, `onboarding`, BV1.R81,
-  // `sessions`, BV1.R82, `autonomy`, BV1.R83, `status-ui`, BV1.R84,
-  // `hall-ui`, BV1.R85, and the net-new `provisioning` feature module, ADR 0111)
-  assert.deepEqual(fitness.discoveredModuleKeys().sort(), ['art-pipeline', 'autonomy', 'builder-settings', 'character-anim', 'demo', 'dev-box', 'discord', 'economy', 'game', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'provisioning', 'security', 'sessions', 'status-ui']);
+  // The check is live, not vacuous — it discovered the real module keys. This used to
+  // be a hardcoded 19-key roster that went stale at the CB→OTB split (it still named
+  // art-pipeline / character-anim / demo / game, and had never learned governance or
+  // platform-identity), so it asserted a topology that no longer existed — task 1002470.
+  // Derived from an INDEPENDENT readdir of modules/, so a discovery regression in
+  // fitness.js still diverges from disk and fails here.
+  assert.deepEqual(fitness.discoveredModuleKeys().sort(), onDiskModuleKeys());
+});
+
+test('the discovered-module roster is derived from a NON-EMPTY disk read (mutation check)', () => {
+  // Guards the check above against going vacuous: if modules/ read back empty, the
+  // deepEqual would compare [] to [] and pass while proving nothing.
+  const keys = onDiskModuleKeys();
+  assert.ok(keys.length >= 5, `expected a real on-disk module roster, found ${keys.length}: ${keys.join(', ')}`);
+  // And it still FAILS when discovery actually drops a module.
+  assert.throws(
+    () => assert.deepEqual(keys.slice(1), keys),
+    /Expected values to be strictly deep-equal/,
+    'a dropped module must still fail the roster comparison',
+  );
 });
 
 test('core-carries-no-module-code actually CATCHES a hardcoded key (and ignores comments)', () => {
@@ -407,6 +423,10 @@ test('hall zone budgets check actually CATCHES a breach (not a no-op)', () => {
 // (a sibling-module import, and an ungated module write route).
 
 test('demo proof module is live + clean (boundary + rank + migration green)', () => {
+  // modules/demo/ is the acceptance-proof module; an instance that does not install it
+  // has nothing to prove here (task 1002470). The RED-LINE tests below are pure-function
+  // checks on path strings and still run either way, so the one-way rules stay covered.
+  if (!onDiskModuleKeys().includes('demo')) return;
   // discovered with the other modules (asserted above) and clean on every gate.
   assert.ok(fitness.discoveredModuleKeys().includes('demo'), 'demo is a discovered module');
   assert.equal(fitness.checkModulesImportOnlyApi().hardFail, false, 'demo imports only the doorway');

package/tests/gate_approvals.mjs

@@ -438,11 +438,24 @@ await t('both routes are requireBuilder-gated and registered', async () => {
   }
 });
 
-await t('route-rank auditor: both gate-approval routes classify to archon with no findings', async () => {
+// ADR 0157 SPLIT these two apart: reading the held-PR list is `gate_approval.read`
+// (metic — the Gate page opens to the working rank, and a page whose only data endpoint
+// 403s is a page that renders an error), while APPROVING still clears the gate-review
+// hard floor and stays `gate_approval.decide` (archon, system:true). Asserting the split
+// explicitly is the point — a future edit that re-merged them onto one atom would either
+// close the page again or hand out the approval, and both are caught here.
+await t('route-rank auditor: gate-approval READ is metic+, APPROVE stays archon, no findings', async () => {
   const res = checkRouteRanks();
   const mine = res.routes.filter((r) => r.route.includes('gate-approvals'));
   assert.equal(mine.length, 2, 'both routes seen by the auditor');
-  for (const r of mine) assert.equal(r.rank, 'archon', `${r.key} must classify archon`);
+  const byKey = new Map(mine.map((r) => [r.key, r]));
+  const read = byKey.get('GET /gate-approvals');
+  const approve = byKey.get('POST /gate-approvals/:pr/approve');
+  assert.ok(read && approve, 'both the list and the approve route must be present');
+  assert.deepEqual(read.perms, ['gate_approval.read'], 'the list route gates on the read atom');
+  assert.equal(read.rank, 'metic+archon', 'the list route is metic+ (ADR 0157)');
+  assert.deepEqual(approve.perms, ['gate_approval.decide'], 'approve gates on the decide atom');
+  assert.equal(approve.rank, 'archon', 'approving a held PR must stay archon');
   const myFindings = res.findings.filter((f) => (f.route || '').includes('gate-approvals'));
   assert.deepEqual(myFindings, [], 'no auditor findings on the gate-approval routes');
 });

package/tests/github_push_land_proof.mjs

@@ -77,10 +77,12 @@ test('landProvenForTask: published tip NOT in main → NOT proven (the false-shi
   assert.match(r.reason, /not in main/);
 });
 
-test('landProvenForTask: no published tip but matched PR references this task → proven (legacy fallback)', async () => {
+test('landProvenForTask: no published tip but matched MERGED PR references this task → proven (legacy fallback)', async () => {
   const r = await gh.landProvenForTask(
-    { taskId: 999, publishedSha: null, status: { pr_body: 'for task 999' } },
-    depsWithCompare('behind') // must NOT be consulted — no sha
+    // merged:true mirrors how real callers reach this fallback (post-landConfirmed);
+    // task 1002615 made it a hard requirement (see the open-PR test below).
+    { taskId: 999, publishedSha: null, status: { merged: true, pr_body: 'for task 999' } },
+    depsWithCompare('behind') // must NOT be consulted — no sha anywhere
   );
   assert.equal(r.proven, true);
   assert.match(r.reason, /references task 999/);
@@ -88,12 +90,56 @@ test('landProvenForTask: no published tip but matched PR references this task
 
 test('landProvenForTask: no published tip and matched PR references a DIFFERENT task → NOT proven', async () => {
   const r = await gh.landProvenForTask(
-    { taskId: 1299, publishedSha: null, status: { pr_title: 'task 1297: overlay', pr_body: 'for task 1297' } },
+    { taskId: 1299, publishedSha: null, status: { merged: true, pr_title: 'task 1297: overlay', pr_body: 'for task 1297' } },
     depsWithCompare('behind')
   );
   assert.equal(r.proven, false);
 });
 
+// --- task 1002615: the out-of-band / rewritten-history land proofs -----------
+
+// Per-sha compare responses, so the tip and the merge commit can answer differently.
+function depsWithCompareBySha(map) {
+  return {
+    token: 'x',
+    repoInfo: { owner: 'o', repo: 'r' },
+    fetchImpl: async (url) => {
+      const m = /compare\/[^.]+\.\.\.([0-9a-f]{7,64})/.exec(String(url));
+      return { ok: true, status: 200, json: async () => ({ status: (m && map[m[1]]) || 'ahead' }) };
+    },
+  };
+}
+
+const MERGE_SHA = 'f'.repeat(40);
+
+test('landProvenForTask (1002615): squash merge — tip NOT in main but the merged PR\'s merge_sha is → proven', async () => {
+  const r = await gh.landProvenForTask(
+    { taskId: 7, publishedSha: SHA,
+      status: { merged: true, merge_sha: MERGE_SHA, pr_title: 'task 7: thing' } },
+    depsWithCompareBySha({ [SHA]: 'ahead', [MERGE_SHA]: 'behind' })
+  );
+  assert.equal(r.proven, true, 'a squash/rebase land must not strand on the tip check');
+  assert.match(r.reason, /merged PR for task 7/);
+});
+
+test('landProvenForTask (1002615): an OPEN PR that references the task is NOT a land (merged:true required)', async () => {
+  const r = await gh.landProvenForTask(
+    { taskId: 8, publishedSha: null, status: { merged: false, pr_state: 'open', pr_body: 'for task 8' } },
+    depsWithCompare('behind')
+  );
+  assert.equal(r.proven, false, 'reference alone on an un-merged PR must never prove');
+});
+
+test('landProvenForTask (1002615): merged PR for a DIFFERENT task + tip not in main → NOT proven (reuse guard intact)', async () => {
+  const r = await gh.landProvenForTask(
+    { taskId: 7, publishedSha: SHA,
+      status: { merged: true, merge_sha: MERGE_SHA, pr_title: 'task 999: other' } },
+    depsWithCompareBySha({ [SHA]: 'ahead', [MERGE_SHA]: 'behind' })
+  );
+  assert.equal(r.proven, false);
+  assert.match(r.reason, /not in main/);
+});
+
 test('landProvenForTask: a non-sha published tip ("HEAD") falls back to the PR check, never the compare API', async () => {
   let compareCalled = false;
   const deps = {

package/tests/github_repos_helpers.mjs

@@ -17,12 +17,34 @@ const auth = require(path.join(ROOT, 'src/bongos/auth.js'));
 const routesAuth = require(path.join(ROOT, 'src/bongos/routes/auth.js'));
 const gh = require(path.join(ROOT, 'src/bongos/github-repos.js'));
 
-test('scopeForWebFlow: identity-only by default, adds public_repo ONLY when repos=true', () => {
+test('scopeForWebFlow: identity-only by default, adds repo ONLY when repos=true', () => {
   assert.equal(auth.scopeForWebFlow(), 'read:user');
   assert.equal(auth.scopeForWebFlow({ repos: false }), 'read:user');
-  assert.equal(auth.scopeForWebFlow({ repos: true }), 'read:user public_repo');
-  // Never the all-or-nothing `repo` scope (ADR 0141) — public_repo only.
-  assert.ok(!auth.scopeForWebFlow({ repos: true }).split(' ').includes('repo'));
+  // ADR 0155 (task 1002561): `repo`, not `public_repo` — public_repo grants write to
+  // PUBLIC repos only, so adopting an existing PRIVATE repo 403'd at the scaffold push.
+  assert.equal(auth.scopeForWebFlow({ repos: true }), 'read:user repo');
+  // The widening is opt-in and MUST stay opt-in: an ordinary hall sign-in / the CLI
+  // device flow must never carry a repo-acting scope.
+  assert.ok(!auth.scopeForWebFlow().split(' ').includes('repo'));
+});
+
+test('grantedScopeCoversRepos: a stale pre-0155 public_repo token is NOT sufficient', () => {
+  // The exact shape GitHub stored for the live failure (github_oauth_tokens.scope):
+  // comma-separated, GitHub's own order, and `public_repo` CONTAINS the substring
+  // "repo" — a naive match would wrongly accept it and reintroduce the silent
+  // "private repos missing from the picker" degrade.
+  assert.equal(auth.grantedScopeCoversRepos('public_repo,read:user'), false);
+  assert.equal(auth.grantedScopeCoversRepos('read:user'), false);
+  assert.equal(auth.grantedScopeCoversRepos(''), false);
+  assert.equal(auth.grantedScopeCoversRepos(null), false);
+  assert.equal(auth.grantedScopeCoversRepos(undefined), false);
+  // Sufficient: `repo` present, in either order / separator GitHub might use.
+  assert.equal(auth.grantedScopeCoversRepos('read:user,repo'), true);
+  assert.equal(auth.grantedScopeCoversRepos('repo,read:user'), true);
+  assert.equal(auth.grantedScopeCoversRepos('read:user repo'), true);
+  assert.equal(auth.grantedScopeCoversRepos('repo'), true);
+  // `repo` implies public_repo, so a token carrying both is fine too.
+  assert.equal(auth.grantedScopeCoversRepos('public_repo,repo,read:user'), true);
 });
 
 test('safeReturnTo still guards after the ?repos change: relative ok, cross-origin/protocol-relative blocked', () => {
@@ -77,7 +99,10 @@ test('createUserRepo: sends auto_init:false + private:false, returns full_name/h
   };
   const out = await gh.createUserRepo('tok', { name: 'mercury', fetchImpl });
   assert.equal(sentBody.auto_init, false, 'empty repo — no README/first commit');
-  assert.equal(sentBody.private, false, 'public_repo scope → public');
+  // Still public AFTER the ADR 0155 scope widen: `repo` COULD create a private repo,
+  // but a repo Cloud Bongos creates stays public by product choice (open-source /
+  // capture-resistant by design). Guards against the widen silently changing what we make.
+  assert.equal(sentBody.private, false, 'a repo WE create is public by product choice');
   assert.equal(sentBody.name, 'mercury');
   assert.deepEqual(out, { full_name: 'me/mercury', html_url: 'https://github.com/me/mercury' });
 });

package/tests/github_token_store.mjs

@@ -119,3 +119,26 @@ test('GET /github/repos → 403 repo_scope_required when configured but no store
     db.getGithubToken = orig;
   }
 });
+
+// ADR 0155 / task 1002561. Widening scopeForWebFlow to `repo` does NOT upgrade rows
+// already in github_oauth_tokens. A surviving pre-0155 `public_repo` token can still
+// list + create PUBLIC repos, so WITHOUT the scope check the route 200s while silently
+// omitting the user's private repos — and the real failure resurfaces minutes later as
+// an opaque 403 on the provisioner's push. It must take the reconnect path instead.
+// (No 200-path test here: `repo`-scoped tokens fall through to a real GitHub call, and
+// this file is deliberately network-free. The positive direction is covered exhaustively
+// by grantedScopeCoversRepos in tests/github_repos_helpers.mjs.)
+test('GET /github/repos → 403 repo_scope_required for a STALE pre-0155 public_repo token', async () => {
+  const orig = db.getGithubToken;
+  db.getGithubToken = async () => ({ token: 'gho_stale', scope: 'public_repo,read:user' });
+  try {
+    const handler = finalHandler(buildGithubRouter(), 'get', '/github/repos');
+    const res = fakeRes();
+    await handler({ builder: { id: 1 }, query: {} }, res);
+    assert.equal(res._status, 403, 'a public_repo-only token must not be treated as sufficient');
+    assert.equal(res._body.error.code, 'repo_scope_required');
+    assert.match(res._body.error.message, /private/i, 'tells the user WHY reconnecting is needed');
+  } finally {
+    db.getGithubToken = orig;
+  }
+});

package/tests/goal_abuse_matrix.mjs

@@ -51,7 +51,7 @@ const buildGoalsRouter = require('../modules/lifecycle/routes/goals.js');
 // The pure, exported, ordered create gate — the one place the decision is made.
 const { authorizeGoalTaskCreate } = buildGoalsRouter;
 const { deriveRequiredRank, highestRank } = require('../modules/lifecycle/db.js');
-const { MODULE_EXPECTED_RANKS, checkRouteRanks } = require('../src/bongos/route-rank-check.js');
+const { MODULE_EXPECTED_RANKS, checkRouteRanks, pinMismatch } = require('../src/bongos/route-rank-check.js');
 const { scopeIncludesProtected, protectedModules, isModuleKey } = require('../src/bongos/module-scope-map.js');
 
 const goalsSrc = readFileSync(new URL('../modules/lifecycle/routes/goals.js', import.meta.url), 'utf8');
@@ -169,7 +169,12 @@ await test('[pin] every goal route is pinned in MODULE_EXPECTED_RANKS.lifecycle'
   assert.equal(pins['POST /goals'], 'metic+archon');
   assert.equal(pins['POST /goals/:id/members'], 'any-builder', 'task 1762: widened to owner|lead|archon, in-handler gate');
   assert.equal(pins['POST /goals/:id/scope'], 'metic+archon');
-  assert.equal(pins['POST /goals/reorder'], 'archon', 'priority is an owner decision, never self-granted');
+  // ADR 0157 lowered `goal.reorder` archon→metic and re-pinned it by atom. Ordering the
+  // queue is prioritisation, not an authority grant — the "never self-granted" property
+  // that matters here is that reorder is NOT reachable through a goal's own
+  // owner/manager authority, and that still holds: it needs a global permission no
+  // member role confers.
+  assert.equal(pins['POST /goals/reorder'], 'perm:goal.reorder', 'reorder needs a global permission, never a goal-member grant');
 });
 await test('[pin] LIVE: every pinned goal route classifies to its expected rank (a drift would mismatch)', () => {
   const res = checkRouteRanks();
@@ -180,7 +185,12 @@ await test('[pin] LIVE: every pinned goal route classifies to its expected rank
     if (!key.includes('/goals')) continue; // this suite owns the goal-route pins
     const r = byKey.get(key);
     assert.ok(r, `pinned goal route ${key} must exist in the live route set`);
-    assert.equal(r.rank, expected, `goal route ${key} must classify as '${expected}', got '${r.rank}'`);
+    // A pin is either a rank label or `perm:<atom>[,<atom>]` (ADR 0151 / ADR 0157). For an
+    // atom pin the live row carries the ATOMS, and its rank label is derived from the
+    // catalog floor — so compare atoms to atoms, ranks to ranks. Reusing the checker's own
+    // pinMismatch keeps this suite from re-implementing (and drifting from) that rule.
+    const mismatch = pinMismatch(expected, r);
+    assert.equal(mismatch, null, `goal route ${key} ${mismatch}`);
   }
 });
 

package/tests/goal_cli.mjs

@@ -0,0 +1,89 @@
+// tests/goal_cli.mjs
+//
+// Unit test for the PURE helpers exported from scripts/gds/goal.js (the goal
+// board CLI): rollup(), criterionGlyph(), criterionState(), bucketTasks(),
+// liveTasks(). All are deterministic with no DB, network, or live server —
+// requiring the script must NOT run the CLI (main is require.main-guarded).
+// Run: node tests/goal_cli.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const goal = require('../scripts/gds/goal.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+// All EIGHT statuses of migration 012's CHECK constraint.
+const ALL_STATUSES = ['backlog', 'ready', 'active', 'blocked', 'completed', 'confirmed', 'shipped', 'abandoned'];
+const t = (status) => ({ status });
+
+test('rollup: counts shipped over total', () => {
+  assert.equal(goal.rollup([t('shipped'), t('shipped'), t('ready')]), '2/3 shipped · 1 ready');
+});
+
+test('rollup: in-flight covers active/completed/confirmed', () => {
+  assert.equal(goal.rollup([t('active'), t('completed'), t('confirmed')]), '0/3 shipped · 3 in flight');
+});
+
+test('rollup: omits zero segments (backlog-only goal shows only shipped fraction)', () => {
+  assert.equal(goal.rollup([t('backlog'), t('backlog')]), '0/2 shipped');
+});
+
+test('rollup: abandoned is excluded from the denominator (migration 017 rule)', () => {
+  // Without the exclusion this would read "2/3 shipped" for a goal with no live work left.
+  assert.equal(goal.rollup([t('shipped'), t('shipped'), t('abandoned')]), '2/2 shipped');
+});
+
+test('liveTasks: filters only abandoned', () => {
+  const live = goal.liveTasks(ALL_STATUSES.map(t));
+  assert.equal(live.length, ALL_STATUSES.length - 1);
+  assert.ok(live.every((x) => x.status !== 'abandoned'));
+});
+
+test('bucketTasks: partitions all 8 lifecycle statuses into exactly one bucket', () => {
+  const tasks = ALL_STATUSES.map(t);
+  const b = goal.bucketTasks(tasks);
+  assert.equal(b.shipped.length, 1);
+  assert.equal(b.inFlight.length, 3);
+  assert.equal(b.ready.length, 1);
+  assert.equal(b.gated.length, 2); // backlog + blocked
+  assert.equal(b.abandoned.length, 1);
+  const total = b.shipped.length + b.inFlight.length + b.ready.length + b.gated.length + b.abandoned.length;
+  assert.equal(total, tasks.length, 'no status may fall through the buckets');
+});
+
+test('criterionGlyph: satisfied wins over pending_review', () => {
+  assert.equal(goal.criterionGlyph({ satisfied: true, pending_review: true }), '✓');
+  assert.equal(goal.criterionGlyph({ satisfied: false, pending_review: true }), '◇');
+  assert.equal(goal.criterionGlyph({ satisfied: false, pending_review: false }), '○');
+});
+
+test('criterionState: pending review names the /goal-review queue', () => {
+  assert.match(goal.criterionState({ satisfied: false, pending_review: true }), /pending review/);
+});
+
+test('criterionState: open criterion reports unshipped-of-linked counts (string API ids)', () => {
+  // The API returns counts as strings — the formatter must not NaN on them.
+  const s = goal.criterionState({ satisfied: false, pending_review: false, unshipped_tasks: '3', linked_tasks: '3' });
+  assert.equal(s, '3 of 3 linked tasks unshipped');
+});
+
+test('criterionState: singular linked task reads grammatically', () => {
+  const s = goal.criterionState({ satisfied: false, pending_review: false, unshipped_tasks: '1', linked_tasks: '1' });
+  assert.equal(s, '1 of 1 linked task unshipped');
+});
+
+test('criterionState: zero linked tasks must NOT read as complete', () => {
+  const s = goal.criterionState({ satisfied: false, pending_review: false, unshipped_tasks: '0', linked_tasks: '0' });
+  assert.equal(s, 'no linked tasks yet');
+});
+
+console.log('');
+console.log(`${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);