@bongos/core 1.18.19 → 1.19.2

package/tests/init.mjs

@@ -114,6 +114,33 @@ test('kickoffTasks: includes the load-bearing owner-manual steps', () => {
   assert.ok(t.every((x) => x.title && x.description), 'every step has a title + description');
 });
 
+// Every kickoff task must satisfy the DB CHECK constraints (tasks_kind_check /
+// tasks_discipline_check) or the insert is rejected — which is how the branding
+// step vanished on 1.18.18: kind:'ideator' (a discipline, not a kind) violated
+// tasks_kind_check and postTask absorbed the failure. Pin the vocabulary at the
+// source so this class of bug can't reach a user again.
+test('kickoffTasks: every kind/discipline satisfies the DB CHECK vocabulary', () => {
+  const { VALID_KINDS, VALID_DISCIPLINES } = require('../modules/lifecycle/task-classifier.js');
+  const all = [
+    ...init.kickoffTasks(init.normalizeSpec({ modules: ['art-pipeline', 'discord', 'dev-box', 'game'],
+      firstAdmin: 'x', repo: { owner: 'o', name: 'n' } })),
+    init.productionTopologyKickoff(),
+  ];
+  for (const t of all) {
+    assert.ok(VALID_KINDS.has(t.kind), `"${t.title}": kind '${t.kind}' violates tasks_kind_check`);
+    if (t.discipline !== undefined) {
+      assert.ok(VALID_DISCIPLINES.has(t.discipline), `"${t.title}": discipline '${t.discipline}' violates tasks_discipline_check`);
+    }
+  }
+});
+
+test('kickoffTasks: the branding step is a decision BY an ideator (kind vs discipline)', () => {
+  const look = init.kickoffTasks(fullSpec()).find((t) => /instance look/i.test(t.title));
+  assert.ok(look, 'the branding kickoff step exists');
+  assert.equal(look.kind, 'decision');
+  assert.equal(look.discipline, 'ideator');
+});
+
 // ---- validateSpec ----
 test('validateSpec: complete spec → no errors', () => {
   assert.deepEqual(init.validateSpec(fullSpec()), []);
@@ -158,6 +185,18 @@ test('versionPayload: explicit criterion_id is slugified', () => {
   assert.equal(init.versionPayload(spec).criteria[0].criterion_id, 'prove-the-loop');
 });
 
+// versions.track is NOT NULL with no DB default — leaving it off the payload is
+// exactly the 1.18.18 bug (every POST /versions 500ed, blocking init outright).
+test('versionPayload: always sends an explicit, valid track', () => {
+  assert.equal(init.versionPayload(fullSpec()).track, 'product'); // instance's first version = product
+  const internal = fullSpec();
+  internal.version.track = 'internal';
+  assert.equal(init.versionPayload(internal).track, 'internal');  // explicit internal respected
+  const junk = fullSpec();
+  junk.version.track = 'bogus';
+  assert.equal(init.versionPayload(junk).track, 'product');       // junk coerced, never forwarded
+});
+
 // ---- provisioning arm (ADR 0111 §3, task 1946) ----
 const provSpec = (over = {}) => init.normalizeSpec({
   identity: { productName: 'Cloud Bongos' },
@@ -543,6 +582,44 @@ async function runSeedTests() {
     assert.ok(findTaskPost(api, /Production topology/), 'filed the manual fallback task on error');
   });
 
+  await at('seedViaApi: version POST carries the explicit track (the NOT NULL column)', async () => {
+    const api = fakeApi();
+    await init.seedViaApi(provSpec({}), { log: () => {}, api });
+    const vpost = api.calls.find((c) => c.path.endsWith('/versions'));
+    assert.ok(vpost, 'POSTed the version');
+    assert.equal(vpost.body.track, 'product');
+  });
+
+  await at('seedViaApi: the ideator kickoff task POSTs kind=decision + discipline=ideator', async () => {
+    const api = fakeApi();
+    await init.seedViaApi(provSpec({}), { log: () => {}, api });
+    const look = findTaskPost(api, /instance look/i);
+    assert.ok(look, 'the branding kickoff task was POSTed');
+    assert.equal(look.body.kind, 'decision');
+    assert.equal(look.body.discipline, 'ideator');
+  });
+
+  await at('seedViaApi: a rejected task POST is LOUD — failures returned, counts reflect actual vs expected', async () => {
+    // Reject exactly one kickoff task (the way tasks_kind_check used to), leave the rest 200.
+    const calls = [];
+    const api = async (method, path, body) => {
+      calls.push({ method, path, body });
+      if (path.endsWith('/tasks') && /instance look/i.test((body && body.title) || '')) {
+        return { ok: false, status: 400, data: { error: 'validation_failed' } };
+      }
+      return { ok: true, status: 200, data: {} };
+    };
+    api.calls = calls;
+    const lines = [];
+    const out = await init.seedViaApi(provSpec({}), { log: (m) => lines.push(m), api });
+    assert.equal(out.failures.length, 1, 'the dropped task is reported, not absorbed');
+    assert.match(out.failures[0].title, /instance look/i);
+    assert.equal(out.created, out.attempted - 1, 'created reflects the real count');
+    const text = lines.join('\n');
+    assert.match(text, /FAILED to file/, 'per-failure report is printed');
+    assert.match(text, new RegExp(`⚠ filed ${out.created} of ${out.attempted}`), 'summary is a warning with actual-vs-expected counts, not a green check');
+  });
+
   await at('seedViaApi: no provisioning block → no provisioning POST, topo stays a normal kickoff task', async () => {
     const spec = init.normalizeSpec({ identity: { productName: 'X Co' }, repo: { owner: 'o', name: 'n' },
       firstAdmin: 'x', version: { id: 'V1', name: 'V1', done_when: 'ship' } });
@@ -604,6 +681,57 @@ async function runRegistryCoreTests() {
       assert.match(out, /mutually exclusive/);
     } finally { rmSync(dir, { recursive: true, force: true }); }
   });
+
+  // ---- --adopt now honors --vendor-core (task 1002562) --------------------------
+  // Adopt used to ALWAYS write the caret range, which resolves NOWHERE on npm — so an
+  // adopted repo could not `npm ci --omit=dev`, the exact command the provisioner runs on
+  // the box. The vendor-plan resolution moved ABOVE the adopt branch in main() so both
+  // paths share it.
+  await at('main --adopt --vendor-core --dry-run: pins the file: tarball, not the caret', async () => {
+    const { dir, p } = specFile();
+    const tgz = join(dir, 'bongos-core-1.17.0.tgz');
+    writeFileSync(tgz, 'x');
+    const target = join(dir, 'existing');
+    mkdirSync(target, { recursive: true });
+    writeFileSync(join(target, 'package.json'), JSON.stringify({ name: 'their-app', dependencies: { react: '^18' } }));
+    try {
+      const { code, out } = await capture(['--from', p, '--dir', target, '--no-seed', '--adopt', '--accept', '--vendor-core', tgz, '--dry-run']);
+      assert.equal(code, 0, out);
+      assert.match(out, /file:vendor\/bongos-core-1\.17\.0\.tgz/, 'the adopt layer pins the vendored tarball');
+      assert.match(out, /would vendor .* and run `npm install` to generate package-lock\.json/, 'plans the vendor + lockfile steps adopt previously skipped entirely');
+      assert.ok(!/\^1\./.test(out.split('would add').pop() || ''), 'not the caret range for the core dep');
+    } finally { rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  await at('main --adopt (no --vendor-core): unchanged — still the caret range, no vendor step', async () => {
+    const { dir, p } = specFile();
+    const target = join(dir, 'existing');
+    mkdirSync(target, { recursive: true });
+    writeFileSync(join(target, 'package.json'), JSON.stringify({ name: 'their-app' }));
+    try {
+      const { code, out } = await capture(['--from', p, '--dir', target, '--no-seed', '--adopt', '--accept', '--dry-run']);
+      assert.equal(code, 0, out);
+      assert.match(out, /would add @bongos\/core@\^/, 'a plain laptop adopt keeps the declared caret');
+      assert.ok(!/would vendor /.test(out), 'no vendoring without --vendor-core');
+    } finally { rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  await at('main --adopt: an ALREADY-declared core dep is never re-pinned over (adopt never overwrites)', async () => {
+    const { dir, p } = specFile();
+    const tgz = join(dir, 'bongos-core-1.17.0.tgz');
+    writeFileSync(tgz, 'x');
+    const target = join(dir, 'existing');
+    mkdirSync(target, { recursive: true });
+    // The owner already pins their own core range — re-pinning it to our tarball would be
+    // exactly the overwrite adopt promises never to do.
+    writeFileSync(join(target, 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': '^1.16.0' } }));
+    try {
+      const { code, out } = await capture(['--from', p, '--dir', target, '--no-seed', '--adopt', '--accept', '--vendor-core', tgz, '--dry-run']);
+      assert.equal(code, 0, out);
+      assert.match(out, /already a dependency — package\.json left untouched/);
+      assert.ok(!/would vendor /.test(out), 'and the tarball is NOT pinned over their declaration');
+    } finally { rmSync(dir, { recursive: true, force: true }); }
+  });
 }
 
 await runSeedTests();

package/tests/known_failing_ratchet.mjs

@@ -0,0 +1,89 @@
+// tests/known_failing_ratchet.mjs — the explicit, justified allowlist for the unit
+// gate's remaining failures, with the count ratcheted so it cannot grow (task 1002470).
+//
+// WHY THIS EXISTS, AND WHY IT IS NOT A MUTE
+//
+// `scripts/gds/run-unit-tests.js` already has a KNOWN_FAILING set, but gate-review.js
+// HARD-FLOORS that file (ADR 0058): adding an entry there is classified as muting a
+// test and escalates to the owner. It also genuinely hides the failure — a muted test
+// stops running. This file does the opposite:
+//
+//   - it does NOT change which tests run, and does NOT make the gate exit 0. The three
+//     files below still execute, still fail, and run-unit-tests.js still exits 1;
+//   - it RUNS each declared file and asserts it STILL fails. Fix one and this test goes
+//     red until the entry is removed — so the list cannot rot into a graveyard;
+//   - it caps the count, so a new failure cannot be quietly parked here.
+//
+// The value is the JUSTIFICATION: each entry names why it is not fixed and who owns it,
+// so "3 failing" is a reviewed position rather than unexplained red.
+//
+// DB-free, no network. Run: node tests/known_failing_ratchet.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const TESTS_DIR = path.dirname(fileURLToPath(import.meta.url));
+
+// The ceiling. Raising it is a deliberate, reviewable act — and should be rare.
+// (Ratcheted 3 → 2 when publish_manifest was FIXED under task 1002611: its
+// ">=7 host tests" non-vacuity floor had gone stale after ADR 0107 moved the
+// host-module tests to modules/<key>/tests/; it is a regex specimen self-test
+// now, and idea 1000542 — which owned it — is superseded.)
+const MAX_KNOWN_FAILING = 2;
+
+const KNOWN_FAILING = {
+  platform_boot: {
+    owner: 'task 1002617 (parked in run-unit-tests KNOWN_FAILING by task 1002611)',
+    why: 'GET / on the apex returns 302, not the 200 landing page the test expects. '
+       + 'Possibly a REAL product bug (the apex redirecting instead of serving the '
+       + 'landing) rather than a test problem, so it was deliberately not "fixed" by '
+       + 'relaxing the assertion. Diagnose the redirect first.',
+  },
+  served_paths_shipped: {
+    owner: 'task 1002617; collides with the ACTIVE claim "make the /docs/openapi.json endpoint self-healing"',
+    why: 'Asserts serve-internal.js reads docs/api/openapi.json. That exact path is what '
+       + 'the in-flight claim is changing, so touching it here would collide. Whoever lands '
+       + 'that claim should re-check this assertion and remove this entry.',
+  },
+};
+
+function runsRed(name) {
+  try {
+    execFileSync(process.execPath, [path.join(TESTS_DIR, `${name}.mjs`)], {
+      stdio: ['ignore', 'ignore', 'ignore'], timeout: 60_000,
+      env: { ...process.env, NODE_ENV: 'test' },
+    });
+    return false; // exited 0 — it PASSES now
+  } catch {
+    return true;
+  }
+}
+
+test('every known-failing entry still actually fails — a fixed one must be removed', () => {
+  const nowPassing = Object.keys(KNOWN_FAILING).sort().filter((name) => !runsRed(name));
+  assert.deepEqual(nowPassing, [],
+    'these are on the known-failing allowlist but now PASS. Delete their entries from '
+    + 'tests/known_failing_ratchet.mjs — an allowlist that outlives the failures it '
+    + 'documents is how a graveyard starts.');
+});
+
+test('the known-failing count is ratcheted and cannot grow silently', () => {
+  const n = Object.keys(KNOWN_FAILING).length;
+  assert.ok(n <= MAX_KNOWN_FAILING,
+    `${n} known-failing tests exceeds the ratchet of ${MAX_KNOWN_FAILING}. Fix the new `
+    + 'failure rather than parking it here; raising MAX_KNOWN_FAILING is a deliberate act.');
+});
+
+test('every known-failing entry carries a real justification and an owner', () => {
+  // A bare list is what this file exists to prevent — an entry with no reason and no
+  // owner is indistinguishable from a mute.
+  for (const [name, entry] of Object.entries(KNOWN_FAILING)) {
+    assert.ok(entry && typeof entry.why === 'string' && entry.why.trim().length >= 60,
+      `${name}: needs a substantive 'why', not a placeholder`);
+    assert.ok(entry && typeof entry.owner === 'string' && entry.owner.trim().length > 0,
+      `${name}: needs an owner (a task, an idea, or an explicit "unassigned")`);
+  }
+});

package/tests/lifecycle-card.mjs

@@ -17,9 +17,10 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { requireHostModule } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
-const hook = require('../.claude/hooks/lifecycle-card.js');
+const hook = requireHostModule(require, '../.claude/hooks/lifecycle-card.js');
 
 let passed = 0;
 let failed = 0;

package/tests/main_audit.mjs

@@ -7,9 +7,10 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { execFileSync } from 'node:child_process';
 
 const require = createRequire(import.meta.url);
-const { analyzeCommits } = require('../scripts/gds/main-audit.js');
+const { analyzeCommits, clampWindow, defaultRange, firstParentDepth, rowsToMap } = require('../scripts/gds/main-audit.js');
 
 let passed = 0, failed = 0;
 function t(name, fn) {
@@ -133,5 +134,75 @@ t('#863-followup (finding #6): a sub-Metic author NAME still resolves and BLOCKS
   assert.equal(r.findings[0].rank, 'thetes');
 });
 
+// -- the default range window (task 1002566) -------------------------------
+//
+// Everything above tests the pure ANALYZER. Nothing tested what FEEDS it, which
+// is how the audit ran for months without producing a single verdict: the
+// default range was `origin/main~200..origin/main`, `~200` walks FIRST parents
+// 200 times, and this repo's first-parent chain is 186 deep (526 commits, but
+// nearly every land is a --no-ff merge). git rejected the range outright and the
+// failure surfaced as a generic "git log failed".
+
+t('a deep history uses the full window', () => {
+  assert.equal(clampWindow(500, 200), 200);
+});
+
+t('the regression: a 186-deep first-parent chain clamps instead of overrunning', () => {
+  assert.equal(clampWindow(186, 200), 185);
+});
+
+t('a two-commit history still audits its one reachable commit', () => {
+  assert.equal(clampWindow(2, 200), 1);
+});
+
+t('a single-commit history is not auditable and says so rather than guessing', () => {
+  assert.equal(clampWindow(1, 200), null);
+  assert.equal(clampWindow(0, 200), null);
+});
+
+t('a non-numeric depth is refused, not coerced into a bogus range', () => {
+  for (const bad of [NaN, undefined, null, 'twelve']) {
+    assert.equal(clampWindow(bad, 200), null, `${String(bad)} must not produce a range`);
+  }
+});
+
+t('defaultRange clamps to the ref it is given', () => {
+  assert.equal(defaultRange('origin/main', 186, 200), 'origin/main~185..origin/main');
+  assert.equal(defaultRange('HEAD', 500, 200), 'HEAD~200..HEAD');
+});
+
+t('defaultRange returns null (not a broken range string) when nothing is auditable', () => {
+  assert.equal(defaultRange('HEAD', 1, 200), null);
+});
+
+// The proof the unit assertions alone cannot give: resolve the range against
+// THIS repo's real history and confirm git accepts it. This is the assertion
+// that would have caught the original bug.
+t('the default range actually resolves against this repo', () => {
+  const ref = 'HEAD';
+  const depth = firstParentDepth(ref);
+  assert.ok(depth > 1, `expected a real history, got depth ${depth}`);
+  const range = defaultRange(ref, depth);
+  assert.ok(range, 'no range produced for a repo with real history');
+  // Throws if git cannot resolve the range — exactly the original failure.
+  execFileSync('git', ['rev-list', '--count', range], { stdio: ['ignore', 'pipe', 'pipe'] });
+});
+
+// rowsToMap feeds every roster source (authenticated roster, --db, and the
+// task-1002612 public-leaderboard fallback the CI caller relies on) — the
+// login-only keying is the #863-followup anti-aliasing rule.
+t('rowsToMap keys ONLY github_login — display_name is builder-controlled', () => {
+  const map = rowsToMap([
+    { github_login: 'SomeBuilder', display_name: 'somearchon', rank: 'metic' },
+    { display_name: 'no-login-row', rank: 'archon' },
+  ]);
+  assert.deepEqual(map, { somebuilder: 'metic' });
+});
+
+t('rowsToMap: empty or missing rows → empty map, never a throw', () => {
+  assert.deepEqual(rowsToMap([]), {});
+  assert.deepEqual(rowsToMap(null), {});
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/memory_isolation.mjs

@@ -185,9 +185,18 @@ await t('the two Archon forensic endpoints are both rank-gated to archon', () =>
     const idx = src.indexOf(route);
     assert.ok(idx >= 0, `route ${route} should be declared`);
     const window = src.slice(idx, idx + 200);
+    // BV1.R105 migrated these two onto `requirePermission('memory.read.any')`, and
+    // ADR 0157 lowered that atom's floor archon→metic. So neither the old literal
+    // `requireRank('archon')` nor any rank name is the invariant any more.
+    //
+    // What this test protects is UNCHANGED in substance: a cross-builder read must
+    // require an EXPLICIT privileged gate that no ordinary builder passes. Asserting
+    // the atom (rather than a rank) states exactly that, and keeps stating it if the
+    // floor moves again — while still failing loudly if the gate is dropped, widened
+    // to bare `requireBuilder`, or swapped for an own-scoped permission.
     assert.ok(
-      /requireRank\('archon'\)/.test(window),
-      `route ${route} must be gated by requireRank('archon')`
+      /requirePermission\('memory\.read\.any'\)/.test(window),
+      `route ${route} must be gated by requirePermission('memory.read.any')`
     );
   }
 });
@@ -208,16 +217,20 @@ await t('the SELF read endpoints never derive the owner from request input', ()
   assert.ok(!/req\.body\.builder/i.test(codeOnly), 'no owner should come from req.body.builder*');
   assert.ok(!/req\.body\.owner/i.test(codeOnly), 'no owner should come from req.body.owner');
   // An input-supplied owner (req.params.builderId) may ONLY appear inside a
-  // PRIVILEGED cross-builder endpoint: either the Archon-rank-gated forensic
-  // READS (requireRank('archon')) or the BFG-principal-gated WRITE
-  // (requireBfgPrincipal — an identity gate stricter than any rank; 6C.1 /
-  // ADR 0026 §6C). Both are audited. No SELF endpoint reads it.
+  // PRIVILEGED cross-builder endpoint: either the permission-gated forensic READS
+  // (`memory.read.any` — floor metic since ADR 0157, archon before it) or the
+  // BFG-principal-gated WRITE (requireBfgPrincipal — an identity gate stricter than
+  // any rank; 6C.1 / ADR 0026 §6C). Both are audited. No SELF endpoint reads it.
+  //
+  // Matched on the ATOM, not a rank, for the same reason as the gate check above: the
+  // isolation invariant is "an explicit cross-builder permission was required", which
+  // is exactly what the atom names.
   const paramUses = [...codeOnly.matchAll(/req\.params\.builderId/g)].map((m) => m.index);
   for (const i of paramUses) {
     const window = codeOnly.slice(Math.max(0, i - 700), i);
     assert.ok(
-      /requireRank\('archon'\)/.test(window) || /requireBfgPrincipal/.test(window),
-      'req.params.builderId may only be read inside an archon-gated forensic read OR the BFG-principal-gated write'
+      /requirePermission\('memory\.read\.any'\)/.test(window) || /requireBfgPrincipal/.test(window),
+      "req.params.builderId may only be read inside a memory.read.any-gated forensic read OR the BFG-principal-gated write"
     );
   }
 });
@@ -309,6 +322,27 @@ db.insertAuditLog = async function stubAudit(row) {
 const express = require('express');
 const app = express();
 app.use(express.json());
+// Install res.fail() as the real app does (the tests/search_isolation.mjs idiom, task 1991).
+// Required since BV1.R105 swapped these routes' gate to requirePermission, whose denial
+// path calls res.fail() — without it a 403 threw "res.fail is not a function" and killed
+// the whole HTTP layer below, so the cross-builder isolation assertions never ran.
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+app.use(attachFail);
+
+// requirePermission resolves authority through the `governance` kernel port and fails
+// CLOSED when it is absent — correct in production (a missing authority system must not
+// admit), but it means an unstubbed port 403s every rank including archon. Register a
+// provider that answers from the real catalog seed for whatever rank the auth stub is
+// currently impersonating, so the cases below exercise the PERMISSION decision rather
+// than the port-missing fallback.
+const seams = require('../src/module-seams.js');
+const catalog = require('../modules/governance/catalog.js');
+seams.registerProvider('governance', {
+  resolveBuilderPermissions: async () => catalog.seedForRank(
+    (fixture.session && fixture.session.rank) || 'xenos',
+  ),
+});
+
 app.use('/api/gds', buildMemoryRouter());
 
 const server = http.createServer(app);
@@ -333,10 +367,23 @@ try {
     assert.equal(fixture.storeCalls.length, 0, 'no store call may happen when the rank gate refuses');
   });
 
-  await t('(a2) a metic is ALSO refused the forensic route (archon-only)', async () => {
+  // ADR 0157 lowered `memory.read.any` archon→metic, so a Metic is now ADMITTED here
+  // where it was previously refused. The isolation invariant this file protects is
+  // unchanged: a cross-builder read still requires an explicit privileged permission and
+  // is still audited — it is the set of ranks holding that permission that the owner
+  // widened. The sub-Metic refusal in (a) is the assertion that still guards the wall.
+  await t('(a2) a metic is now ADMITTED to the forensic route (ADR 0157) and is audited', async () => {
     reset();
     fixture.session = { id: 5, rank: 'metic' };
     const res = await fetch(`${base}/memory/builders/99/file?path=MEMORY.md`);
+    assert.notEqual(res.status, 403);
+    assert.equal(fixture.auditCalls.length, 1, 'a metic forensic read must still be audited');
+  });
+
+  await t('(a3) a thetes is STILL refused the forensic route (the wall held below metic)', async () => {
+    reset();
+    fixture.session = { id: 6, rank: 'thetes' };
+    const res = await fetch(`${base}/memory/builders/99/file?path=MEMORY.md`);
     assert.equal(res.status, 403);
     assert.equal(fixture.storeCalls.length, 0);
   });

package/tests/migrate_root_resolution.mjs

@@ -96,7 +96,7 @@ t('CORE_ROOT is always the script-relative repo root, independent of the invocat
 });
 
 // ==========================================================================
-// A CORE ROOT WHOSE PATH CONTAINS A SPACE (task 1002611)
+// A CORE ROOT WHOSE PATH CONTAINS A SPACE (fixed in 1.18.19)
 // ==========================================================================
 // `for f in $MIGRATIONS` word-split the newline-separated migration list on IFS — which includes
 // space — so a checkout at "/Users/.../Hermeslines Marketing/..." fragmented every path, the

package/tests/mirror_redact.mjs

@@ -31,6 +31,7 @@ const R = require('../scripts/gds/mirror-redact.js');
 const {
   buildRedactionRules, collectSensitiveLiterals, redactText, findLeaks, findSecretLeak,
   deriveInstanceLiterals, isPublicRoutableIPv4, isPublicRoutableIPv6, parseIPv6, registrableLabel,
+  firstPublicIP,
 } = R;
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
@@ -116,6 +117,24 @@ t('isPublicRoutableIPv6 + a "12:34:56" timestamp is NOT treated as an IP', () =>
   assert.equal(parseIPv6('2001:db8::1')[0], 0x2001);
 });
 
+t('reserved ::/8 is NOT a public IP — degenerate shorthand in binary is not a leak', () => {
+  // Two-to-three-character forms like `5::` parse as valid IPv6 and used to classify
+  // public, so random bytes inside committed .png/.webp assets tripped the C9 full-tree
+  // mirror gate with 7 phantom "public-ip" leaks (task 1002470). ::/8 is IETF-reserved
+  // (RFC 4291 §2.4) — nothing is reachable there, so it can never be a real leak.
+  for (const s of ['5::', 'b::', 'c9::', 'd::', '4::', '8::', 'a::', '00ff::1']) {
+    assert.equal(isPublicRoutableIPv6(s), false, `${s} is in reserved ::/8 and must not be flagged`);
+  }
+  // ...and the narrowing did NOT blunt the gate: real global unicast still fires, in
+  // both the detector and the redactor.
+  for (const s of ['2000::1', '2001:db8::1', '2606:4700:4700::1111', '3fff::1']) {
+    assert.equal(isPublicRoutableIPv6(s), true, `${s} is a real public address and must still be flagged`);
+  }
+  assert.equal(firstPublicIP('sprite bytes :: more bytes'), null, 'binary-ish shorthand is not reported');
+  assert.equal(firstPublicIP('origin 2606:4700:4700::1111'), '2606:4700:4700::1111');
+  assert.ok(!redactText('host 2606:4700:4700::1111', []).includes('2606:4700'), 'a real public IPv6 is still redacted');
+});
+
 // ── the DETECTOR is stricter than redaction ───────────────────────────────────────────
 t('findLeaks catches a raw literal substring a bounded rule would miss', () => {
   // "azoltanb" has no word boundary around zoltan; a \bzoltan\b rule misses it, the

package/tests/module_api.mjs

@@ -21,12 +21,14 @@ const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
 const PUBLISHED_SURFACE = [
   'CORE_VERSION',
   'requireBuilder', 'requireRank', 'rankMeetsThreshold', 'requireBfgPrincipal', 'allowBoxScope', 'resolveSession',
+  'requirePermission', // BV1.R105: the authority-atom gate module routes migrate onto (1.19.0; ADR 0151)
   'pool', 'getPool', 'instanceDbName', 'withTx', 'getBuilderById',
   'secretBox', // Gemini-key storage relocated to modules/art-pipeline + its 'art.getBuilderGeminiKeyRow' port (ADR 0102)
   'routeRankCheck', 'permissionPathCheck', // BV1.R73: kernel trust classifiers (1.6.0)
   'repoInfo', 'moduleScopeMap', 'pathMatch', // BV1.R86: kernel repo-identity + scope-wall + touches-overlap for the carved lifecycle (1.12.0)
   'goalScopeCheck', // BV1.R60: kernel scope wall for the goal-authored-task create gate (1.13.0; ADR 0086 §3)
   'insertAuditLog', 'LIVE_RANK_LADDER', // createTask + VOTABLE_TASK_STATUSES + tallyPeerVotes RETIRED at 1.12.0 (BV1.R86 → lifecycle port); captureIdea retired at 1.8.0 (BV1.R78 → ideas.capture port)
+  'RANK_TIER', // BV1.R108: the canonical 1-based rank→tier map, derived from LIVE_RANK_LADDER (tests/rank_tier_single_source.mjs)
   'llmCache', // BV1.R73: shared LLM-cost cache (1.6.0; tracked domain leak)
   'llmPricing', // BV1.R77: shared token→USD pricing (1.7.0; tracked domain leak — economy carve)
   'branding', 'clientBranding', 'userAgent', 'resolveEnv', 'readConfigFileSync', 'configHome', 'configPath', // userAgent added 1.12.0 (BV1.R86; github-push UA)
@@ -51,7 +53,7 @@ test('CORE_VERSION is a semver string', () => {
 });
 
 test('auth gates are re-exported as functions', () => {
-  for (const k of ['requireBuilder', 'requireRank', 'rankMeetsThreshold', 'requireBfgPrincipal']) {
+  for (const k of ['requireBuilder', 'requireRank', 'requirePermission', 'rankMeetsThreshold', 'requireBfgPrincipal']) {
     assert.equal(typeof api[k], 'function', `${k} should be a function`);
   }
 });

package/tests/module_loader.mjs

@@ -315,6 +315,10 @@ test('the demo proof module mounts + serves through the loader (BV1.R52 / task 1
   // BV1.R52 acceptance: the net-new scaffolded module is discovered, is enabled
   // by config/modules.json, and its route factory builds a real router with the
   // health read route + the rank-gated ping write route — all with NO core edit.
+  // modules/demo/ is content-excluded from the published core (ADR 0098), exactly as
+  // the roster comment above already notes — so on a core checkout there is nothing
+  // to mount and this acceptance proof does not apply (task 1002470).
+  if (!fs.existsSync(path.join(ROOT, 'modules', 'demo'))) return;
   loader._reset();
   const { isModuleEnabled } = require(path.join(ROOT, 'src', 'modules.js'));
   assert.equal(isModuleEnabled('demo'), true, 'config/modules.json enables demo');

package/tests/modules.mjs

@@ -1,6 +1,7 @@
 // tests/modules.mjs — the feature-module selection resolver (task 1193 / V4.R54, ADR 0062 §4).
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
+import { existsSync } from 'node:fs';
 import modulesMod from '../src/modules.js';
 
 const {
@@ -17,6 +18,14 @@ const OTB = { modules: { game: true, 'art-pipeline': true, discord: true, 'dev-b
 // loadModules() does in production. Membership across the move is preserved here.
 const EFFECTIVE = modulesMod.effectiveRegistry();
 
+// Sample feature-module keys for the PURE resolver tests below. `game` and
+// `art-pipeline` left the core at the CB→OTB split, so the effective registry no
+// longer knows them and passing them made resolveModules throw `cannot enable
+// unknown module` — the tests were asserting a topology, not the resolver (task
+// 1002470). Synthesized here so the precedence/merge/freeze semantics stay under
+// test on any instance, whatever it happens to have installed.
+const SAMPLE_REG = { ...EFFECTIVE, game: { default: false }, 'art-pipeline': { default: false } };
+
 test('vanilla (no config) resolves every module OFF — fail-to-vanilla, never fail-to-OTB', () => {
   const m = resolveModules({});
   for (const k of KNOWN_MODULES) assert.equal(m[k], false, `${k} should default off`);
@@ -28,7 +37,7 @@ test('every registry module has an explicit default of false', () => {
 });
 
 test('instance config turns modules on', () => {
-  const m = resolveModules({ neutral: VANILLA, instance: OTB, registry: EFFECTIVE });
+  const m = resolveModules({ neutral: VANILLA, instance: OTB, registry: SAMPLE_REG });
   assert.equal(m.game, true);
   assert.equal(m['dev-box'], true);
   assert.equal(isModuleEnabled('discord', m), true);
@@ -41,19 +50,31 @@ test('instance config turns modules on', () => {
   // gate + builder economy + idea inbox + red-team intake + prefs + onboarding +
   // session corpus + the MAS autonomy machinery + the status dashboard + the
   // builders' hall ship to every instance — see each module.json).
-  assert.deepEqual(enabledModules(m).sort(), ['art-pipeline', 'autonomy', 'builder-settings', 'dev-box', 'discord', 'economy', 'game', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'security', 'sessions', 'status-ui']);
+  // Asserted as a PROPERTY rather than a frozen 16-key list (which named modules the
+  // core no longer carries — task 1002470).
+  // Everything the instance switched on resolves on...
+  for (const k of Object.keys(OTB.modules)) assert.equal(m[k], true, `instance-enabled '${k}' must resolve on`);
+  // ...every `default: true` core-domain module resolves on WITHOUT being listed...
+  const coreDefaults = Object.keys(SAMPLE_REG).filter((k) => SAMPLE_REG[k].default);
+  assert.ok(coreDefaults.length >= 5, `expected a real core-domain roster, found ${coreDefaults.length}`);
+  for (const k of coreDefaults) assert.equal(m[k], true, `default-on core module '${k}' must resolve on unlisted`);
+  // ...and a registry key that is neither listed nor default-on stays off.
+  for (const k of Object.keys(SAMPLE_REG)) {
+    if (SAMPLE_REG[k].default || k in OTB.modules) continue;
+    assert.equal(m[k], false, `unlisted opt-in module '${k}' must stay off`);
+  }
 });
 
 test('instance config overrides the neutral starter per-flag (deep merge of the modules map)', () => {
   const neutral = { modules: { game: false, discord: false, 'dev-box': false, 'art-pipeline': false } };
   const instance = { modules: { discord: true } }; // only flip one
-  const m = resolveModules({ neutral, instance, registry: EFFECTIVE });
+  const m = resolveModules({ neutral, instance, registry: SAMPLE_REG });
   assert.equal(m.discord, true);
   assert.equal(m.game, false); // neutral value survives
 });
 
 test('env override beats instance config (precedence), with prefix + snake-casing', () => {
-  const m = resolveModules({ instance: OTB, env: { OTB_MODULE_DEV_BOX: '0' }, envPrefix: 'OTB', registry: EFFECTIVE });
+  const m = resolveModules({ instance: OTB, env: { OTB_MODULE_DEV_BOX: '0' }, envPrefix: 'OTB', registry: SAMPLE_REG });
   assert.equal(m['dev-box'], false); // env off beat instance on
   assert.equal(m.game, true);        // others untouched
 });
@@ -111,19 +132,23 @@ test('disciplines: vanilla offers engineer + ideator (core); art-pipeline adds a
   // instance), so it is offered with no modules on; only 'artist' is module-gated.
   // art-pipeline is now a DISCOVERED module (BV1.R48), so pass EFFECTIVE registry.
   assert.deepEqual(enabledDisciplines(resolveModules({})), ['engineer', 'ideator']);
-  const m = resolveModules({ instance: { modules: { 'art-pipeline': true } }, registry: EFFECTIVE });
+  // The 'artist' leg reads art-pipeline's OWN module.json contributes, so it only
+  // means anything where that module is installed (task 1002470). The core half
+  // above — ideation ships to every instance — is asserted unconditionally.
+  if (!EFFECTIVE['art-pipeline']) return;
+  const m = resolveModules({ instance: { modules: { 'art-pipeline': true } }, registry: SAMPLE_REG });
   assert.deepEqual(enabledDisciplines(m), ['engineer', 'ideator', 'artist']);
 });
 
 test('clientModules is a safe boolean projection covering every known module + disciplines', () => {
-  const c = clientModules(resolveModules({ instance: OTB, registry: EFFECTIVE }));
+  const c = clientModules(resolveModules({ instance: OTB, registry: SAMPLE_REG }));
   for (const k of KNOWN_MODULES) assert.equal(typeof c.enabled[k], 'boolean');
   assert.ok(Array.isArray(c.disciplines));
   assert.ok(c.disciplines.includes('engineer'));
 });
 
 test('the resolved set is frozen (callers cannot mutate the singleton)', () => {
-  const m = resolveModules({ instance: OTB, registry: EFFECTIVE });
+  const m = resolveModules({ instance: OTB, registry: SAMPLE_REG });
   assert.throws(() => { m.game = false; }, TypeError);
 });
 
@@ -131,6 +156,9 @@ test('the committed config files resolve: OTB enables all four, on disk', () =>
   // loadModules reads config/modules.json over config/modules.neutral.json.
   // No GDS_BRANDING_FILE → still the default OTB instance pack (regression guard
   // for the GDS_MODULES_FILE selector below).
+  // config/modules.json is INSTANCE content — the neutral core ships only
+  // config/modules.neutral.json, so there is no instance pack to assert (task 1002470).
+  if (!existsSync(new URL('../config/modules.json', import.meta.url))) return;
   const m = loadModules({ env: {} });
   assert.equal(m.game, true);
   assert.equal(m['art-pipeline'], true);