@bongos/core 1.18.19 → 1.19.3

package/src/module-api.js

@@ -348,20 +348,93 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         precisely because nothing compared live against main. The doorway surface
 //         is byte-identical to 1.18.17 (governance is reached through the kernel
 //         port, not a new export), so despite the size this is → PATCH. (task 1002521)
-//   1.18.19 — SINGLE-FIX patch cut from the core-v1.18.18 tag, not from main: core
-//         migrations were silently skipped on any checkout whose absolute path
-//         contains a space. `for f in $MIGRATIONS` word-split the newline-separated
-//         list on IFS, fragmenting every path; the `[ -e "$f" ]` guard then dropped
-//         all of them and schema_migrations stayed empty. The module loop is quoted,
-//         so module migrations ran against an empty schema and the operator saw a
-//         misleading `relation "achievements" does not exist` from modules/economy
-//         instead of the real cause. Now read with a newline-safe herestring, and a
-//         no-op guard makes the skip FATAL rather than silent. No doorway change, no
-//         schema change, one script + its test → PATCH. Deliberately does NOT carry
-//         the unreleased 1.19 tree on main, so a blocked instance can take the fix
-//         alone. (task 1002611)
+//   1.18.19 — NEVER PUBLISHED UNDER THIS NUMBER. This entry described a carrier bump
+//         that was never cut; the version 1.18.19 on the registry is something else
+//         entirely — a SINGLE-FIX patch published out-of-band on 2026-08-08 from a
+//         branch off the core-v1.18.18 tag (release/core-1.18.19), carrying only the
+//         space-in-path migration fix (`for f in $MIGRATIONS` word-split
+//         the migration list on IFS, so any checkout whose path contains a space
+//         applied ZERO core migrations, silently). It was cut off the TAG rather than
+//         off main precisely so a blocked instance could take that one fix without
+//         also taking the unreleased 1.19 tree. Everything the original note below
+//         describes is still unreleased and ships with 1.19.x — as does the migration
+//         fix itself, which is also on main. Original notes kept for the record:
+//         carrier bump for the 32 commits that landed on main between the
+//         1.18.18 bump (e25c7da, 2026-08-03) and 2026-08-04. Headline: the
+//         security-tooling line — the reading-room mirror with on-disk scrub +
+//         fence and realpath confinement, a hardened fetch with quarantine and a
+//         deterministic manifest, the SSRF hole closed, and the durable
+//         `security_tool_scans` record + its Metic+-write/all-ranks-read route
+//         (tasks 1002542/1002543/1002546/1002547, heavily grader-iterated). Also:
+//         the core unit suite went green (task 1002470 — 57 failing files down to
+//         3, and those 3 now sit behind an explicit ratchet that requires a
+//         justification and a named owner per entry, so a mute is no longer
+//         indistinguishable from a fix); the ship card can no longer report a
+//         bailed merge as landing (task 1002541); a user-set display name now
+//         survives sign-in (task 1002568) and the onboarding OAuth scope widened
+//         to `repo` so a private repo can be adopted; the hall profile shows the
+//         real reward instead of 0 (task 1002569); linking a blocker actually
+//         blocks the task (task 1002559); and the CLI box_scope detector was
+//         revived against the ADR 0116 envelope, which had silently dead-ended
+//         three call sites (task 1002162). The doorway surface is byte-identical
+//         to 1.18.18 — verified by diffing src/module-api.js across the range —
+//         so despite the volume this is → PATCH. (task 1002581)
+//   1.19.0 — requirePermission re-exported (BV1.R105, ADR 0151). A module route
+//         gated on an authority ATOM needs the same doorway access to the gate
+//         that requireRank has had since 1.0.0; without it the R104-R107
+//         migration could reach core routes only. Additive → MINOR. (task 1001847)
+//         Landed after 1.18.19, so this bump carries that carrier's contents too;
+//         the MINOR is owed solely to the added export. Instances pinned to a
+//         patch-only update channel will not take this automatically.
+//   1.19.1 — the release that actually carries 1.19.0. 1.19.0 was bumped by
+//         ad7a262 and never packaged, so ~104 non-merge commits sat on main
+//         reachable by no pin; this is the artifact that ships them. Headline:
+//         the governance permission system's second half (R110 roles/perms/
+//         assignments CRUD behind governance.manage, R113 the Roles nav +
+//         page gate, R114 the C6 live proof, ADR 0157 delegating the
+//         operational block from Archon to Metic, and the permission resolve
+//         folded into the session load); the scan-before-install security
+//         line (deterministic zero-LLM floor, verdict reducer, reading-room
+//         mirror with on-disk scrub + realpath confinement, the scan-record
+//         route, and the SSRF fix — tasks 1002544-1002548); core_204
+//         re-keying the one-active-claim index per (session, worktree) so
+//         parallel worktrees can hold bound claims; the hall People tab and
+//         governance page; and the goal-board CLI. The doorway surface is
+//         byte-identical to 1.19.0 — verified by diffing src/module-api.js
+//         across ad7a262..HEAD — so despite the volume this is → PATCH.
+//         Cut as a fresh number rather than releasing HEAD as 1.19.0 so the
+//         changelog cannot claim 1.19.0's one-line entry describes 104
+//         commits. Note 1.18.x → 1.19.1 crosses a minor: a patch-only
+//         channel will not take it unattended. (task 1002602)
+//   1.19.2 — the init-blocker fixes: db.createVersion now sends the NOT NULL
+//         versions.track column (every POST /versions 500ed on a fresh DB,
+//         blocking bongos init outright — greenfield AND adopt), the route
+//         accepts + validates an optional `track`, init.js sends it explicitly,
+//         the 'instance look' kickoff task is kind:'decision' +
+//         discipline:'ideator' (kind:'ideator' violated tasks_kind_check and
+//         was silently dropped), and seed failures now report loudly with
+//         actual-vs-expected counts (task 1002623). Also carries the other
+//         unreleased commits since the 1.19.1 bump: the CI `unit` check +
+//         real CODEOWNERS/required-checks gating (tasks 1002610/1002611/
+//         1002619, ADR 0159), the repo-verifiable main-audit caller (1002612/
+//         1002618, ADR 0160), migrate.sh space-in-path fix, ship smoke-fail
+//         abort (1002605) + sandbox review-gate fix (1002607), strand
+//         notify-on-detect (1002606), reconciler out-of-band land (1002615),
+//         and the Metic-floor string sweep (1002604). The doorway surface is
+//         unchanged (an optional request field, no export change) → PATCH.
+//         (task 1002624)
+//   1.19.3 — CLI/init ergonomics carrier: `bongos <verb> --help` is answered by
+//         the dispatcher instead of blocking on init's interview (1002625),
+//         `bongos init` defaults branding configDir from the product slug so
+//         instances stop sharing ~/.config/cloudbongos and evicting each
+//         other's CLI sessions (1002626), versions.track gains DB DEFAULT
+//         'product' via core_205 so no insert path can reproduce the
+//         fresh-instance standup blocker (1002627). Also sweeps PATCH
+//         /tasks/:id gate atomicity (1002609) and the publish-on-merge lane
+//         (1002620, ADR 0161). git diff 1.19.2..main on this file was empty —
+//         the doorway surface is byte-identical → PATCH. (task 1002631)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.18.19'; // single-fix patch off the 1.18.18 tag: migrations skipped on a path with a space (task 1002611); see changelog above
+const CORE_VERSION = '1.19.3'; // CLI/init ergonomics carrier (task 1002631); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
@@ -381,6 +454,13 @@ module.exports = {
   //     routes; a module declares the rank it needs and never wires auth itself.
   requireBuilder: auth.requireBuilder,
   requireRank: auth.requireRank,
+  // requirePermission(...atoms) — the AUTHORITY-ATOM gate (ADR 0151), mounted
+  //     AFTER requireBuilder exactly like requireRank. Async, AND-semantics,
+  //     fail-closed; denies with `permission_forbidden` rather than
+  //     `rank_forbidden`. The rank-role compat seed makes it admit exactly who
+  //     the equivalent requireRank admitted, so a migrated module route is
+  //     behaviour-identical (BV1.R105).
+  requirePermission: auth.requirePermission,
   rankMeetsThreshold: auth.rankMeetsThreshold,
   requireBfgPrincipal: auth.requireBfgPrincipal,
   // allowBoxScope — opt a route in to box-scoped (dev-box bootstrap) session
@@ -418,6 +498,9 @@ module.exports = {
   getBuilderById: (...a) => require('./bongos/db-kernel').getBuilderById(...a),
   insertAuditLog: (...a) => require('./bongos/db-kernel').insertAuditLog(...a),
   get LIVE_RANK_LADDER() { return require('./bongos/db-kernel').LIVE_RANK_LADDER; },
+  // The ladder as the canonical 1-based rank → tier map (BV1.R108) — modules
+  // derive tier comparisons from this instead of hand-copying the map.
+  get RANK_TIER() { return require('./bongos/db-kernel').RANK_TIER; },
   // --- per-builder secrets at rest (AES-256-GCM box) — a kernel trust
   //     primitive; the full secretBox object is exposed so a module can call
   //     isConfigured/encrypt/decrypt/provisionMasterKey without reaching core.

package/src/platform-server.js

@@ -207,6 +207,20 @@ if (require.main === module) {
       moduleLoader.stopModulePollers().finally(() => process.exit(0));
     });
   }
+
+  // Last-resort backstop. Node >=22 defaults to --unhandled-rejections=throw, and
+  // Express 4 discards a middleware's returned promise — so before this, one rejected
+  // await in any async middleware terminated the single process and dropped every
+  // in-flight request. The real cure is that each such middleware catches its own
+  // rejection (requireBuilder / runPageGate now do); this exists so the NEXT one
+  // anybody forgets degrades into a logged error instead of an outage.
+  //
+  // Deliberately does NOT exit: this is one process serving every request, so staying
+  // up with a logged error strictly dominates dying. A rejection that leaves genuinely
+  // corrupt state is not a shape this codebase produces — the DB work is transactional.
+  process.on('unhandledRejection', (reason) => {
+    console.error('[platform] unhandled promise rejection (staying up; this is a BUG — the owning await needs its own catch):', reason);
+  });
 }
 
 module.exports = { buildPlatformApp, startBackgroundServices };

package/tests/api_client.mjs

@@ -130,6 +130,10 @@ test('devbox vendored client is byte-identical to the canonical CJS build (run d
   // separately, ADR 0045), so scripts/vendor-client.js copies index.cjs into
   // devbox-app/src/vendor/. Guard that the vendored copy never drifts from the
   // canonical build — CI catches a forgotten `npm run vendor` after a spec change.
+  // devbox-app/ is instance content the neutral core does not carry (task 1002470).
+  // Absent APP => nothing to vendor into; absent VENDORED FILE inside a present app
+  // is the real "forgot to run vendor" drift this guards, and still fails.
+  if (!fs.existsSync(path.join(ROOT, 'devbox-app'))) return;
   const vendored = path.join(ROOT, 'devbox-app/src/vendor/bongos-client.cjs');
   if (!fs.existsSync(vendored)) throw new assert.AssertionError({ message: 'devbox-app/src/vendor/bongos-client.cjs missing — run `npm run vendor` in devbox-app/' });
   const canonical = fs.readFileSync(path.join(ROOT, 'clients/bongos-client/index.cjs'), 'utf8');
@@ -183,8 +187,20 @@ test('generated .d.ts types success responses (task 2061)', () => {
   // the shared pagination block, wired into paginated list responses
   assert.match(dts, /export interface PageInfo \{ limit: number; offset: number; total\?: number \}/, 'PageInfo emitted');
   assert.match(dts, /export interface Get\w*Response \{ [^}]*page: PageInfo\b/, 'a list response wires page: PageInfo');
-  // a real response interface: keys concrete, values unknown (the shape is the win)
-  assert.match(dts, /export interface PostClaimsResponse \{ claim: unknown; task: unknown; just_unlocked: unknown; overlap_warning: unknown \}/, 'response shape has concrete keys');
+  // A real response interface: keys concrete, values unknown (the shape is the win).
+  // Asserted as that PROPERTY rather than as one exact field list — the exact list went
+  // stale the moment POST /claims gained `reward` (task 1002469), even though the client
+  // had been correctly regenerated and the freshness check above was green (task 1002470).
+  const postClaims = /export interface PostClaimsResponse \{ ([^}]*) \}/.exec(dts);
+  assert.ok(postClaims, 'PostClaimsResponse emitted');
+  const members = postClaims[1].split(';').map((s) => s.trim()).filter(Boolean);
+  for (const key of ['claim', 'task', 'just_unlocked', 'overlap_warning']) {
+    assert.ok(members.includes(`${key}: unknown`), `response shape has concrete key '${key}': ${postClaims[1]}`);
+  }
+  // ...and EVERY member keeps that form, so a mistyped value still fails here.
+  for (const m of members) {
+    assert.match(m, /^[A-Za-z_$][\w$]*\??: unknown$/, `member '${m}' must be a concrete key with an unknown value`);
+  }
   // the { tasks } shorthand is captured
   assert.match(dts, /export interface GetTasksResponse \{ tasks: unknown \}/, 'shorthand key captured');
   assert.match(dts, /getTasks\(args\?: RequestArgs\): Promise<GetTasksResponse>;/, 'GET method returns its shape');

package/tests/api_path_404.mjs

@@ -83,6 +83,9 @@ t('taskNotReadyHint: a backlog task names the promote route', () => {
   const h = taskNotReadyHint(953, 'backlog');
   assert.match(h, /POST \/api\/bongos\/tasks\/953\/promote/);
   assert.match(h, /backlog/);
+  // task.promote is metic-floored (ADR 0157) — the hint must not send builders to an Archon.
+  assert.match(h, /Metic\+/);
+  assert.doesNotMatch(h, /Archon/);
 });
 
 t('taskNotReadyHint: a non-backlog status is explained + still names promote', () => {

package/tests/art_stage.mjs

@@ -9,12 +9,13 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { requireHostModule } from './helpers.mjs';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
 const require = createRequire(import.meta.url);
-const art = require('../scripts/gds/art-stage.js');
+const art = requireHostModule(require, '../scripts/gds/art-stage.js');
 
 let passed = 0, failed = 0;
 function t(name, fn) { try { fn(); passed++; console.log(`  PASS  ${name}`); } catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.stack || e.message}`); } }

package/tests/atlas.mjs

@@ -11,6 +11,7 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { onDiskModuleKeys } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -61,9 +62,36 @@ for (const view of ['context', 'modules']) {
   });
 }
 
-test('atlas modules view: the 7 real on-disk modules are all present', () => {
-  const labels = new Set(VIEWS.modules.nodes.filter((n) => n.kind === 'module').map((n) => n.label));
-  for (const key of ['game', 'dev-box', 'discord', 'art-pipeline', 'grading', 'memory', 'character-anim']) {
-    assert.ok(labels.has(key), `module '${key}' is rendered (real on-disk module must never be dropped)`);
+// The expectation is DERIVED FROM DISK via the shared helper, not hardcoded: the old
+// 7-key roster named game / art-pipeline / character-anim (gone at the CB→OTB split)
+// and silently missed governance / platform-identity, so it asserted a topology that no
+// longer existed (tasks 1002449, 1002470). See onDiskModuleKeys() in helpers.mjs for why
+// reading disk directly is what keeps this a real check rather than a tautology.
+
+function assertEveryModuleRendered(renderedLabels, expectedKeys) {
+  for (const key of expectedKeys) {
+    assert.ok(renderedLabels.has(key), `module '${key}' is rendered (real on-disk module must never be dropped)`);
   }
+}
+
+test('atlas modules view: every real on-disk module is present', () => {
+  const expected = onDiskModuleKeys();
+  // Non-vacuity floor: a readdir that returned nothing would make the loop below
+  // pass while asserting nothing at all.
+  assert.ok(expected.length >= 5, `expected a real on-disk module roster, found ${expected.length}`);
+  const labels = new Set(VIEWS.modules.nodes.filter((n) => n.kind === 'module').map((n) => n.label));
+  assertEveryModuleRendered(labels, expected);
+});
+
+test('atlas modules view: the roster check CATCHES a dropped module (mutation check)', () => {
+  // Proves the retargeted assertion still FAILS when the thing it guards actually
+  // breaks — i.e. it was not made green by weakening it (task 1002470 done-when).
+  const expected = onDiskModuleKeys();
+  const mutated = new Set(expected);
+  mutated.delete(expected[0]); // simulate the generator silently dropping a real module
+  assert.throws(
+    () => assertEveryModuleRendered(mutated, expected),
+    /must never be dropped/,
+    'a dropped on-disk module must still fail this check',
+  );
 });

package/tests/auth_admission_gate.mjs

@@ -107,11 +107,23 @@ console.log('\nfirstTimeAdmissionBlocked — first-admin bootstrap bypass (R62 /
 
 t('configured firstAdmin WITHOUT invite, enrollment OFF → ALLOWED (so the owner can be seated)', () => {
   withOpenEnrollmentEnv(undefined, () => {
-    const fa = auth.firstAdminLogin();
-    assert.ok(fa, 'the test branding pack configures a firstAdmin');
-    assert.equal(auth.firstTimeAdmissionBlocked({ existing: null, approved: false, login: fa }), false);
-    // case-insensitive match (GitHub logins compare case-insensitively)
-    assert.equal(auth.firstTimeAdmissionBlocked({ existing: null, approved: false, login: fa.toUpperCase() }), false);
+    // The neutral pack sets firstAdmin: "" (an unclaimed instance has no owner yet),
+    // so this used to depend on an INSTANCE branding pack being present. Configure one
+    // through the documented env override instead — the bypass under test is
+    // "the configured firstAdmin gets in", regardless of where that config came
+    // from (task 1002470).
+    const prevFa = process.env.CLOUDBONGOS_FIRST_ADMIN;
+    process.env.CLOUDBONGOS_FIRST_ADMIN = auth.firstAdminLogin() || 'configured-owner';
+    try {
+      const fa = auth.firstAdminLogin();
+      assert.ok(fa, 'a firstAdmin is configured');
+      assert.equal(auth.firstTimeAdmissionBlocked({ existing: null, approved: false, login: fa }), false);
+      // case-insensitive match (GitHub logins compare case-insensitively)
+      assert.equal(auth.firstTimeAdmissionBlocked({ existing: null, approved: false, login: fa.toUpperCase() }), false);
+    } finally {
+      if (prevFa === undefined) delete process.env.CLOUDBONGOS_FIRST_ADMIN;
+      else process.env.CLOUDBONGOS_FIRST_ADMIN = prevFa;
+    }
   });
 });
 

package/tests/auth_error_brand.mjs

@@ -11,10 +11,11 @@
 //      values must win over the neutral code fallback.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
+import { existsSync } from 'node:fs';
 import brandingMod from '../src/branding.js';
 import authMod from '../src/bongos/routes/auth.js';
 
-const { loadBranding } = brandingMod;
+const { loadBranding, INSTANCE_PATH } = brandingMod;
 const { renderAuthErrorPage } = authMod;
 
 const KEYS = ['titleSuffix', 'epigraph', 'heading', 'subtitle', 'ctaLabel'];
@@ -38,13 +39,15 @@ test('authError: both packs carry a complete block, and the neutral pack is lore
     }
   }
 
-  // OTB keeps its own flavor (regression lock — a future edit must not neutralize
-  // OTB's OWN page while making the platform brand-aware).
-  assert.equal(otb.heading, 'The Gate is Closed');
-  assert.equal(otb.titleSuffix, 'the gate is closed');
-  assert.match(otb.subtitle, /seek the Archon/);
-  assert.match(otb.epigraph, /chronicles of the city/);
-  assert.equal(otb.ctaLabel, 'Try the gate again');
+  // The instance keeps its OWN flavor (regression lock — a future edit must not
+  // neutralize an instance's own page while making the platform brand-aware). Only
+  // meaningful where an INSTANCE pack exists; the neutral core ships config/
+  // branding.neutral.json alone, and comparing its copy against OTB's lore made this
+  // assert one instance's content (task 1002470). The lore-free check below is the
+  // half that must hold everywhere, and it still runs unconditionally.
+  if (existsSync(INSTANCE_PATH)) {
+    assert.notDeepEqual(otb, neutral, 'an instance pack must be able to override the neutral authError copy');
+  }
 
   // The neutral pack — what cloudbongos.com actually renders — carries NO OTB lore.
   for (const k of KEYS) {
@@ -54,24 +57,41 @@ test('authError: both packs carry a complete block, and the neutral pack is lore
   }
 });
 
+// The renderer HTML-escapes every interpolated value (XSS safety), so the page carries
+// the ESCAPED form. Comparing raw pack strings worked only while the ambient pack
+// happened to contain no escapable character; the neutral pack's subtitle has an
+// apostrophe ("The sign-in didn't complete…") and rendered as `didn't`, so this
+// test failed against the very pack cloudbongos.com serves (task 1002470). Mirrors
+// escapeHtml() in src/bongos/routes/auth.js.
+const escapeHtml = (s) => String(s ?? '').replace(/[&<>"']/g, (c) => ({
+  '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
+}[c]));
+
 test('renderAuthErrorPage interpolates the branding pack, not hardcoded lore', () => {
-  // Ambient branding in this checkout is the OTB pack, so the rendered page must
-  // carry the OTB authError values AND the branded worldName.
-  const otb = loadBranding({ env: {} });
-  const a = otb.copy.authError;
+  // Whatever pack is ambient in this checkout, the rendered page must carry ITS
+  // authError values and ITS worldName — that is the pack-driven property.
+  const pack = loadBranding({ env: {} });
+  const a = pack.copy.authError;
   const html = renderAuthErrorPage('State mismatch', 'the detail line');
 
-  assert.match(html, new RegExp(otb.identity.worldName)); // Amazonprimea, from the pack
-  assert.ok(html.includes(a.heading), 'page heading comes from the pack');
-  assert.ok(html.includes(a.epigraph), 'epigraph comes from the pack');
-  assert.ok(html.includes(a.subtitle), 'sub-line comes from the pack');
-  assert.ok(html.includes(a.ctaLabel), 'retry button label comes from the pack');
-  assert.ok(html.includes(`${otb.identity.worldName} — ${a.titleSuffix}`), 'tab title = worldName + pack suffix');
+  assert.ok(html.includes(escapeHtml(pack.identity.worldName)), 'worldName comes from the pack');
+  assert.ok(html.includes(escapeHtml(a.heading)), 'page heading comes from the pack');
+  assert.ok(html.includes(escapeHtml(a.epigraph)), 'epigraph comes from the pack');
+  assert.ok(html.includes(escapeHtml(a.subtitle)), 'sub-line comes from the pack');
+  assert.ok(html.includes(escapeHtml(a.ctaLabel)), 'retry button label comes from the pack');
+  assert.ok(html.includes(`${escapeHtml(pack.identity.worldName)} — ${escapeHtml(a.titleSuffix)}`),
+    'tab title = worldName + pack suffix');
   // The per-branch args still render (they are passed in, not pack-owned).
   assert.ok(html.includes('State mismatch') && html.includes('the detail line'));
 
   // The pack must have WON over the neutral code fallback — otherwise the render
-  // wasn't actually pack-driven.
-  assert.ok(!html.includes('— access —'), 'neutral fallback epigraph must not appear under the OTB pack');
-  assert.ok(!html.includes('Try signing in again'), 'neutral fallback cta must not appear under the OTB pack');
+  // wasn't actually pack-driven. Only checkable when an INSTANCE pack is what's
+  // ambient; under the neutral pack those strings ARE the correct output.
+  const neutral = vanilla().copy.authError;
+  if (a.epigraph !== neutral.epigraph) {
+    assert.ok(!html.includes(escapeHtml(neutral.epigraph)), 'neutral fallback epigraph must not appear under an instance pack');
+  }
+  if (a.ctaLabel !== neutral.ctaLabel) {
+    assert.ok(!html.includes(escapeHtml(neutral.ctaLabel)), 'neutral fallback cta must not appear under an instance pack');
+  }
 });

package/tests/auth_resolve_failure.mjs

@@ -0,0 +1,155 @@
+// tests/auth_resolve_failure.mjs — a session-lookup failure must DENY, not crash.
+//
+// The defect (found by the 2026-07-30 adversarial review, survived refutation):
+// `requireBuilder` awaited `resolveSession` with no try/catch. Express 4 discards a
+// middleware's returned promise — `Layer.handle_request` wraps only SYNCHRONOUS
+// throws — so a rejected lookup reached no error handler at all: the caller got no
+// response, and node's default `--unhandled-rejections=throw` killed the single
+// process, dropping every other in-flight request with it. A routine Postgres
+// restart was a full outage instead of a burst of 500s.
+//
+// DB-free: the session lookup is stubbed to reject. These assertions are about
+// CONTROL FLOW (does the rejection escape?), not about Postgres.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// A minimal res double: records what the gate did without needing express.
+function makeRes() {
+  const res = { _status: null, _json: null, _redirect: null };
+  res.status = (s) => { res._status = s; return res; };
+  res.json = (b) => { res._json = b; return res; };
+  res.redirect = (s, u) => { res._redirect = [s, u]; return res; };
+  res.fail = (code, statusOrOpts) => {
+    res._status = typeof statusOrOpts === 'number' ? statusOrOpts : (statusOrOpts && statusOrOpts.status) || 500;
+    res._json = { error: { code } };
+    return res;
+  };
+  return res;
+}
+
+// Force resolveSession to THROW deterministically, with no DB and no stubbing
+// framework: `req.headers` is the first thing it touches, so a throwing getter
+// raises inside resolveSession exactly as a rejecting pool.query would.
+//
+// This matters. An earlier draft of this test passed a plain `req` and asserted
+// "denied OR next(err)" — which, against a live Postgres in CI, would have been
+// satisfied by the ordinary 401-for-an-invalid-token path and would NEVER have
+// entered the catch this fix adds. A test whose meaning depends on whether a DB
+// happens to be reachable is not a regression guard.
+// Slice one function body by brace-balance rather than by looking for a blank line
+// after the closing brace — the latter silently mis-slices the moment a function is
+// moved next to another with no gap between them.
+function sliceFn(src) {
+  const open = src.indexOf('{');
+  let depth = 0;
+  for (let i = open; i < src.length; i++) {
+    if (src[i] === '{') depth += 1;
+    else if (src[i] === '}') { depth -= 1; if (depth === 0) return src.slice(0, i + 1); }
+  }
+  throw new Error('unbalanced braces — could not slice the function body');
+}
+
+function throwingReq(message = 'simulated session-store failure') {
+  return {
+    get headers() { throw new Error(message); },
+    cookies: {},
+    get: () => undefined,
+  };
+}
+
+test('requireBuilder catches a THROWING session lookup instead of letting it escape', async () => {
+  const auth = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
+  const res = makeRes();
+  let nexted = false; let nextErr;
+  await assert.doesNotReject(
+    () => auth.requireBuilder(throwingReq(), res, (e) => { nexted = true; nextErr = e; }),
+    'the middleware must not reject — an escaping rejection is the outage',
+  );
+  assert.equal(nexted, true, 'the failure must reach next()');
+  assert.ok(nextErr instanceof Error, 'next() must receive the error, not be called cleanly');
+  assert.match(nextErr.message, /simulated session-store failure/,
+    'the ORIGINAL error must be forwarded, not swallowed and replaced');
+  assert.equal(res._json, null, 'the gate must not write its own body — the envelope handler owns that');
+});
+
+test('a failing lookup NEVER falls through to the route handler', async () => {
+  const auth = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
+  const res = makeRes();
+  let cleanNext = false;
+  await auth.requireBuilder(throwingReq(), res, (e) => { if (e === undefined) cleanNext = true; });
+  assert.equal(cleanNext, false,
+    'next() with no error would run the handler UNAUTHENTICATED — the one outcome that must be impossible');
+});
+
+test('AUDIT: every async middleware mounted directly on a router owns its rejection', () => {
+  // The enumeration, kept as an executable assertion rather than prose so it cannot
+  // rot: a NEW bare `async function require*` added later fails this test.
+  //   requireBuilder            — the API gate. Guarded here (BV1.R109-follow-up).
+  //   requireBuilderPage         \
+  //   requireGovernancePage       \
+  //   requireGovernanceManagePage  > all five delegate to runPageGate, guarded by BV1.R107.
+  //   requireNonXenosPage         /  (the R113 roles-tab gate; the /people curate gate)
+  //   requireProjectCuratePage   /
+  // Anything else async and router-mounted must be added with its own try/catch.
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth.js'), 'utf8');
+  const asyncMw = [...src.matchAll(/^async function (require\w+|allow\w+)\s*\(req, res, next\)/gm)].map((m) => m[1]);
+  assert.deepEqual(asyncMw.sort(), ['requireBuilder', 'requireBuilderPage', 'requireGovernanceManagePage', 'requireGovernancePage', 'requireNonXenosPage', 'requireProjectCuratePage'],
+    'a new async router middleware appeared — give it a try/catch and add it here');
+  // The page gates must actually delegate (that is WHY they are safe).
+  for (const name of ['requireBuilderPage', 'requireGovernancePage', 'requireGovernanceManagePage', 'requireNonXenosPage', 'requireProjectCuratePage']) {
+    const fn = src.slice(src.indexOf(`async function ${name}`));
+    assert.match(sliceFn(fn), /runPageGate\(/, `${name} must delegate to the guarded runPageGate`);
+  }
+});
+
+test('the catch hands the error onward rather than swallowing it', () => {
+  // Swallowing would be worse than crashing: the request would hang with no
+  // response and no log. Assert the structure explicitly.
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth.js'), 'utf8');
+  const fn = src.slice(src.indexOf('async function requireBuilder'));
+  const body = sliceFn(fn);
+  assert.match(body, /try\s*{[\s\S]*await resolveSession\(req\)[\s\S]*}\s*catch/,
+    'requireBuilder must wrap resolveSession in try/catch');
+  assert.match(body, /catch[\s\S]*next\(err\)/, 'the catch must call next(err)');
+  // NB deliberately NOT asserting a console.error here: errorEnvelopeHandler already
+  // logs what next(err) hands it, so logging in the catch too would double-write.
+});
+
+test('a valid session still authenticates — the success path is unchanged', () => {
+  // The fix only ADDS an error path. Guard that the success path was not reshaped:
+  // the post-try body must still run the same status/scope checks in order.
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth.js'), 'utf8');
+  const fn = src.slice(src.indexOf('async function requireBuilder'));
+  const body = sliceFn(fn);
+  assert.match(body, /if \(!session\)[\s\S]*unauthenticated/, 'no-session → 401 preserved');
+  assert.match(body, /session\.status === 'inactive'[\s\S]*builder_inactive/, 'inactive check preserved');
+  assert.match(body, /sessionScopeFor\(session\.source\)/, 'session-scope check preserved');
+  assert.ok(body.indexOf('unauthenticated') < body.indexOf("'inactive'"),
+    'checks stay in their original order');
+});
+
+test('a process-level unhandledRejection backstop is registered and does not exit', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'platform-server.js'), 'utf8');
+  assert.match(src, /process\.on\('unhandledRejection'/, 'the backstop must exist');
+  const handler = src.slice(src.indexOf("process.on('unhandledRejection'"));
+  const body = handler.slice(0, handler.indexOf('});') + 3);
+  assert.match(body, /console\.error/, 'it must log');
+  assert.doesNotMatch(body, /process\.exit/,
+    'it must NOT exit — one process serves every request, so staying up dominates dying');
+});
+
+test('the page gates already guard the same call — the two auth paths agree', () => {
+  // The original asymmetry (runPageGate guarded, requireBuilder bare) is what let
+  // this sit unnoticed. Pin that they now match so it cannot drift apart again.
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth.js'), 'utf8');
+  const page = src.slice(src.indexOf('async function runPageGate'));
+  assert.match(sliceFn(page), /try\s*{[\s\S]*await resolveSession\(req\)[\s\S]*}\s*catch/,
+    'runPageGate must keep its guard');
+});