@bongos/core 1.18.19 → 1.19.3

package/tests/blocker_link.mjs

@@ -0,0 +1,88 @@
+// tests/blocker_link.mjs
+//
+// Task 1002559 — linking a blocker to a task must actually put that task in
+// 'blocked', so the resolve-side trigger (migration 009) has something to
+// promote. Before this, `linkBlockerToTask` was a bare INSERT and the whole
+// link → blocked → auto-ready loop was dead end-to-end.
+//
+// The SQL itself is exercised by the post-deploy smoke run (same convention as
+// tests/criterion_proposal.mjs). What is unit-tested here is the eligibility
+// predicate the SQL is built from — `blocksOnLink` and LINK_BLOCKABLE_STATUSES
+// are the single source of truth for the UPDATE's status guard, so a drift
+// between the two is not expressible.
+//
+// Run:  node tests/blocker_link.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const blockers = require('../modules/ideas/blockers.js');
+
+let passed = 0;
+let failed = 0;
+
+function test(name, fn) {
+  try {
+    fn();
+    passed += 1;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed += 1;
+    console.log(`  FAIL  ${name}\n      ${err.message}`);
+  }
+}
+
+// -- the eligibility predicate --------------------------------------------
+
+test('a ready task is blocked on link — the live trap this fixes', () => {
+  assert.equal(blockers.blocksOnLink('ready'), true);
+});
+
+test('backlog is NOT blocked on link — blocked→ready would launder the promote gate', () => {
+  // backlog is pre-workable and already unclaimable; migration 176 keeps a
+  // dep-ship from promoting it past an open blocker. Flipping it to 'blocked'
+  // would make the resolve trigger (009) promote it to 'ready', turning a
+  // blocker resolution into a promotion nobody authorised (promote is
+  // metic+archon).
+  assert.equal(blockers.blocksOnLink('backlog'), false);
+});
+
+test('an active task is not yanked out from under its claim holder', () => {
+  assert.equal(blockers.blocksOnLink('active'), false);
+});
+
+test('terminal states are never rewritten', () => {
+  for (const s of ['shipped', 'abandoned', 'completed', 'confirmed']) {
+    assert.equal(blockers.blocksOnLink(s), false, `${s} must not be re-blocked`);
+  }
+});
+
+test('re-linking an already-blocked task is a no-op, not a double-write', () => {
+  assert.equal(blockers.blocksOnLink('blocked'), false);
+});
+
+test('an unknown/null status is refused rather than assumed blockable', () => {
+  assert.equal(blockers.blocksOnLink('nonsense'), false);
+  assert.equal(blockers.blocksOnLink(null), false);
+  assert.equal(blockers.blocksOnLink(undefined), false);
+});
+
+// -- the constant the SQL is built from ------------------------------------
+
+test('LINK_BLOCKABLE_STATUSES is exported so the UPDATE guard cannot drift', () => {
+  assert.ok(Array.isArray(blockers.LINK_BLOCKABLE_STATUSES));
+  assert.deepEqual(blockers.LINK_BLOCKABLE_STATUSES, ['ready']);
+});
+
+test('every blockable status round-trips through the resolve trigger', () => {
+  // Migration 009 promotes `status='blocked'` → 'ready'. So every status we
+  // flip INTO blocked must be one that 'ready' is a correct destination for,
+  // or the link/resolve pair silently changes a task's standing.
+  for (const s of blockers.LINK_BLOCKABLE_STATUSES) {
+    assert.equal(s, 'ready', `${s} does not round-trip: resolve returns it to 'ready'`);
+  }
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/bongos_cli.mjs

@@ -0,0 +1,91 @@
+// tests/bongos_cli.mjs
+//
+// The `bongos` dispatcher's --help contract (task 1002625). The regression that
+// motivates this file: `bongos init --help` used to FORWARD the flag to init.js,
+// which doesn't recognise it and dropped into its interactive interview —
+// printing "Project name?" and blocking forever (fatal in CI). The dispatcher
+// now answers --help/-h itself for every verb whose script has no usage printer
+// of its own; the five that do (selfHelp) keep their richer output, and `exec`
+// always forwards (the flag belongs to the child script).
+//
+// Run:  node tests/bongos_cli.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const cli = require('../bin/bongos.js');
+
+const BIN = join(dirname(fileURLToPath(import.meta.url)), '..', 'bin', 'bongos.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+// Every spawn gets a hard timeout — the exact failure this file guards against
+// is a verb BLOCKING on interactive input, and a hung test is that bug escaping.
+const run = (...args) => spawnSync(process.execPath, [BIN, ...args], {
+  encoding: 'utf8', timeout: 30_000, input: '',
+});
+
+// ---- pure: the help card + the selfHelp roster ----
+
+test('verbHelpText: names the verb, its summary, and the full-help pointer', () => {
+  const out = cli.verbHelpText('claim', cli.VERBS.claim);
+  assert.match(out, /^bongos claim — /);
+  assert.match(out, /Claim a task by id/);
+  assert.match(out, /bongos help/);
+});
+
+test('VERBS: selfHelp is only claimed by scripts that really print their own usage', () => {
+  // Verified by reading each script (they all branch on --help/-h to a usage()
+  // printer). If a verb is added here, verify its script first — a wrong
+  // selfHelp:true recreates the blocking-interview bug for that verb.
+  const selfHelp = Object.entries(cli.VERBS).filter(([, d]) => d.selfHelp).map(([v]) => v).sort();
+  assert.deepEqual(selfHelp, ['dev', 'module', 'status', 'task', 'upgrade']);
+});
+
+// ---- spawned: the dispatcher answers --help without touching the script ----
+
+test('bongos --help (first arg) prints the dispatcher help, exit 0', () => {
+  const r = run('--help');
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /bongos — the Cloud Bongos CLI/);
+});
+
+test('bongos init --help answers instantly — no interview, no blocking (the 1002625 regression)', () => {
+  const r = run('init', '--help');
+  assert.equal(r.signal, null, 'must not die on the spawn timeout — that means it blocked on input');
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /^bongos init — /);
+  assert.ok(!/Project name\?/.test(r.stdout + r.stderr), 'the interactive interview must not start');
+});
+
+test('bongos claim -h is answered by the dispatcher too (short flag, non-selfHelp verb)', () => {
+  const r = run('claim', '-h');
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /^bongos claim — /);
+});
+
+test('bongos task --help forwards to task.js (selfHelp) and gets its richer usage', () => {
+  const r = run('task', '--help');
+  assert.equal(r.status, 0, r.stderr);
+  assert.ok(!/^bongos task — .*\n\nForwards to/.test(r.stdout), 'must NOT be the dispatcher card');
+  assert.match(r.stdout + r.stderr, /new|usage/i, 'task.js prints its own usage');
+});
+
+test('bongos exec still refuses a missing path with exit 2 (--help interception must not swallow exec)', () => {
+  const r = run('exec');
+  assert.equal(r.status, 2);
+  assert.match(r.stderr, /package-relative script path/);
+});
+
+console.log('');
+console.log(`bongos CLI tests: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/bongos_downloads.mjs

@@ -9,10 +9,11 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { requireHostModule } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const { buildBongosDownloads } = require('../src/bongos-downloads.js');
-const committedConfig = require('../config/bongos-cli.json');
+const committedConfig = requireHostModule(require, '../config/bongos-cli.json');
 
 let passed = 0;
 let failed = 0;

package/tests/box_dns_repoint.mjs

@@ -20,6 +20,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { skipUnlessPresent } from './helpers.mjs';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -28,6 +29,7 @@ const require = createRequire(import.meta.url);
 const here = path.dirname(fileURLToPath(import.meta.url));
 const repo = path.resolve(here, '..');
 const HOOK = path.join(repo, 'infra', 'box-dns-cloudflare.sh');
+skipUnlessPresent('infra/box-dns-cloudflare.sh');
 
 // ── a fake `curl` that emulates the Cloudflare API per FAKE_CF_SCENARIO ─────────
 const FAKE_CURL = `#!/usr/bin/env node

package/tests/box_ship_permissions.mjs

@@ -12,9 +12,11 @@ import { strict as assert } from 'node:assert';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { skipUnlessPresent } from './helpers.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const settingsPath = path.join(__dirname, '..', '.claude', 'settings.json');
+skipUnlessPresent('.claude/settings.json');
 
 let passed = 0, failed = 0;
 function test(name, fn) {

package/tests/box_terminal_ssrf.mjs

@@ -5,7 +5,7 @@
 // the WEB TIER fetch it. The old guard (/^https:\/\/[^\s]+$/) accepted ANY https
 // host, so a builder could make the prod server probe internal/metadata
 // endpoints (SSRF). isSafeTerminalUrl(url, login) must allow ONLY the two real
-// tunnel shapes — `term-<login>.…amazonprimea.com` (bound to the caller's login)
+// tunnel shapes — `term-<login>.<apex>` (bound to the caller's login)
 // and `*.trycloudflare.com` — and reject everything else.
 //
 // Pure function, no server/DB/network.
@@ -25,19 +25,25 @@ const test = (name, fn) => {
 };
 
 const LOGIN = 'lars589';
+// The dev-box apex is INJECTED rather than taken from the live instance branding
+// (task 1002470). Two reasons: the neutral core has no amazonprimea.com apex, so the
+// three allow-cases could not pass; and every reject-case below was passing for the
+// WRONG reason — an apex mismatch, not the rule it names. With a pinned apex,
+// 'rejects another builder's term- host' really does prove the login binding.
+const APEX = 'apex.example';
 
 // ---- allowed: the two legitimate tunnel shapes -------------------------------
 test('allows the named-tunnel apex host bound to the caller login', () => {
-  assert.equal(isSafeTerminalUrl('https://term-lars589.amazonprimea.com', LOGIN), true);
+  assert.equal(isSafeTerminalUrl(`https://term-lars589.${APEX}`, LOGIN, APEX), true);
 });
-test('allows the named-tunnel dev-zone host (term-<login>.dev.amazonprimea.com)', () => {
-  assert.equal(isSafeTerminalUrl('https://term-lars589.dev.amazonprimea.com/', LOGIN), true);
+test(`allows the named-tunnel dev-zone host (term-<login>.dev.${APEX})`, () => {
+  assert.equal(isSafeTerminalUrl(`https://term-lars589.dev.${APEX}/`, LOGIN, APEX), true);
 });
 test('allows a Cloudflare quick-tunnel host (*.trycloudflare.com)', () => {
-  assert.equal(isSafeTerminalUrl('https://random-words-1234.trycloudflare.com', LOGIN), true);
+  assert.equal(isSafeTerminalUrl('https://random-words-1234.trycloudflare.com', LOGIN, APEX), true);
 });
 test('login match is case-insensitive (DNS is case-insensitive)', () => {
-  assert.equal(isSafeTerminalUrl('https://term-LarsCode.amazonprimea.com', 'larscode'), true);
+  assert.equal(isSafeTerminalUrl(`https://term-LarsCode.${APEX}`, 'larscode', APEX), true);
 });
 
 // ---- rejected: SSRF targets --------------------------------------------------
@@ -54,36 +60,36 @@ for (const bad of [
   'https://printer.local/',
 ]) {
   test(`rejects SSRF target ${bad}`, () => {
-    assert.equal(isSafeTerminalUrl(bad, LOGIN), false);
+    assert.equal(isSafeTerminalUrl(bad, LOGIN, APEX), false);
   });
 }
 
 // ---- rejected: wrong scheme / shape / cross-login ----------------------------
 test('rejects http (must be https)', () => {
-  assert.equal(isSafeTerminalUrl('http://term-lars589.amazonprimea.com', LOGIN), false);
+  assert.equal(isSafeTerminalUrl(`http://term-lars589.${APEX}`, LOGIN, APEX), false);
 });
 test('rejects embedded credentials (user:pass@host)', () => {
-  assert.equal(isSafeTerminalUrl('https://user:pass@term-lars589.amazonprimea.com', LOGIN), false);
+  assert.equal(isSafeTerminalUrl(`https://user:pass@term-lars589.${APEX}`, LOGIN, APEX), false);
 });
 test('rejects another builder\'s term- host (login binding)', () => {
-  assert.equal(isSafeTerminalUrl('https://term-someoneelse.amazonprimea.com', LOGIN), false);
+  assert.equal(isSafeTerminalUrl(`https://term-someoneelse.${APEX}`, LOGIN, APEX), false);
 });
 test('rejects a non-tunnel host on the project domain', () => {
-  assert.equal(isSafeTerminalUrl('https://api.amazonprimea.com', LOGIN), false);
+  assert.equal(isSafeTerminalUrl(`https://api.${APEX}`, LOGIN, APEX), false);
 });
 test('rejects an arbitrary external host', () => {
-  assert.equal(isSafeTerminalUrl('https://evil.example.com', LOGIN), false);
+  assert.equal(isSafeTerminalUrl('https://evil.example.com', LOGIN, APEX), false);
 });
 test('rejects a lookalike suffix (…trycloudflare.com.evil.com)', () => {
-  assert.equal(isSafeTerminalUrl('https://x.trycloudflare.com.evil.com', LOGIN), false);
+  assert.equal(isSafeTerminalUrl('https://x.trycloudflare.com.evil.com', LOGIN, APEX), false);
 });
 test('rejects garbage / unparseable', () => {
-  assert.equal(isSafeTerminalUrl('not a url', LOGIN), false);
-  assert.equal(isSafeTerminalUrl('', LOGIN), false);
-  assert.equal(isSafeTerminalUrl(null, LOGIN), false);
+  assert.equal(isSafeTerminalUrl('not a url', LOGIN, APEX), false);
+  assert.equal(isSafeTerminalUrl('', LOGIN, APEX), false);
+  assert.equal(isSafeTerminalUrl(null, LOGIN, APEX), false);
 });
 test('rejects when login is empty (cannot bind the term- form)', () => {
-  assert.equal(isSafeTerminalUrl('https://term-lars589.amazonprimea.com', ''), false);
+  assert.equal(isSafeTerminalUrl(`https://term-lars589.${APEX}`, '', APEX), false);
 });
 
 console.log(`\n${pass} passed, ${fail} failed`);

package/tests/bump_version.mjs

@@ -0,0 +1,71 @@
+// tests/bump_version.mjs — the CI auto-patch bump is shape-preserving (task 1002620).
+//
+// bump-version.js rewrites the single most load-bearing literal in the repo.
+// These tests pin the three properties that must survive any refactor:
+//   1. the bumped literal keeps the exact `^const CORE_VERSION = '…';` shape
+//      deploy-divergence.js greps and regex-reads;
+//   2. a changelog entry lands inside the comment block, not after the const;
+//   3. unrecognizable input throws instead of silently mis-editing.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { bumpPatch, CONST_RE } = require(path.join(ROOT, 'scripts', 'gds', 'bump-version.js'));
+
+const SAMPLE = [
+  '// prologue',
+  '//   1.19.0 — some entry. (task 1)',
+  '//   1.19.1 — another entry. (task 2)',
+  '// ---------------------------------------------------------------------------',
+  "const CORE_VERSION = '1.19.1'; // carrier; see changelog above",
+  '',
+  'module.exports = { CORE_VERSION };',
+  '',
+].join('\n');
+
+test('bumps patch and keeps the exact const line shape', () => {
+  const { from, to, text } = bumpPatch(SAMPLE);
+  assert.equal(from, '1.19.1');
+  assert.equal(to, '1.19.2');
+  const m = text.match(CONST_RE);
+  assert.ok(m, 'bumped text must still match the canonical const regex');
+  assert.equal(m[0].startsWith("const CORE_VERSION = '1.19.2';"), true);
+  // exactly one const line survives
+  assert.equal([...text.matchAll(/^const CORE_VERSION = /gm)].length, 1);
+});
+
+test('inserts the changelog entry above the divider, mentioning both versions', () => {
+  const { text } = bumpPatch(SAMPLE, { note: 'run 42' });
+  const dividerAt = text.indexOf('// ------');
+  const entryAt = text.indexOf('1.19.2 — CI auto-patch');
+  assert.ok(entryAt !== -1, 'entry exists');
+  assert.ok(entryAt < dividerAt, 'entry sits inside the changelog block, above the divider');
+  assert.match(text, /landed since 1\.19\.1 with no explicit bump\. run 42\./);
+});
+
+test('a 9→10 patch rollover carries, not truncates', () => {
+  const src = SAMPLE.replace(/1\.19\.1/g, '1.19.9');
+  const { to } = bumpPatch(src);
+  assert.equal(to, '1.19.10');
+});
+
+test('unrecognizable input throws loudly instead of mis-editing', () => {
+  assert.throws(() => bumpPatch('nothing here'), /could not find the CORE_VERSION literal/);
+  assert.throws(
+    () => bumpPatch("const CORE_VERSION = '1.2.3'; // no divider above"),
+    /changelog closing divider/
+  );
+});
+
+test('the REAL src/module-api.js is bumpable right now (shape not drifted)', () => {
+  const real = fs.readFileSync(path.join(ROOT, 'src', 'module-api.js'), 'utf8');
+  const { from, to, text } = bumpPatch(real);
+  assert.match(from, /^\d+\.\d+\.\d+$/);
+  assert.ok(text.includes(`const CORE_VERSION = '${to}';`));
+});

package/tests/claim_error_surface.mjs

@@ -33,6 +33,7 @@ const text = (r) => r.lines.join('\n');
 t('never dumps [object Object] for any known code', () => {
   const codes = [
     'stage_required', 'session_already_has_active_claim', 'session_claim_check_failed',
+    'session_already_has_bound_claim',
     'newcomer_must_ship_first', 'ALREADY_CLAIMED', 'MODULE_CONFLICT',
     'TOUCHES_CONFLICT', 'TASK_NOT_READY', 'TASK_NOT_FOUND', 'DEPS_NOT_SHIPPED',
     'some_unmapped_future_code',
@@ -96,6 +97,28 @@ t('MODULE_CONFLICT + TOUCHES_CONFLICT: list conflicting task titles', () => {
   assert.match(tc, /Baz/);
 });
 
+// task 1002589: migration 180's one-bound-claim-per-session DB index tripped
+// (claimTask now maps that 23505 by err.constraint instead of collapsing it
+// onto ALREADY_CLAIMED). The honest render: the TARGET task is still free —
+// the SESSION holds a bound claim elsewhere. Never blame a phantom rival.
+t('session_already_has_bound_claim: names the in-flight claim, not "another session"', () => {
+  const out = text(formatClaimFailure(
+    envelope('session_already_has_bound_claim', {
+      active_task_id: 77, active_task_title: 'Held elsewhere', what_to_do: 'ship 77 or claim unbound',
+    }), 12));
+  assert.match(out, /#77/, 'should name the in-flight task id');
+  assert.match(out, /Held elsewhere/, 'should name the in-flight task title');
+  assert.match(out, /ship 77 or claim unbound/, 'should relay the server what_to_do');
+  assert.match(out, /still free/i, 'should say the target task is not actually taken');
+  assert.ok(!/claimed by another session/i.test(out), 'must not blame a phantom builder');
+});
+
+t('session_already_has_bound_claim without details still renders honest guidance', () => {
+  const out = text(formatClaimFailure(envelope('session_already_has_bound_claim', {}), 12));
+  assert.match(out, /bound claim/i);
+  assert.match(out, /bind_session|builder-ship|builder-release/, 'fallback should name a way out');
+});
+
 t('unknown code: fallback carries code + message, exit 1', () => {
   const r = formatClaimFailure(envelope('weird_thing', {}, 'boom', 500), 1);
   assert.equal(r.exit, 1);

package/tests/claude_materialize.mjs

@@ -109,6 +109,9 @@ t('materializeClaude: copies + rewrites skills into a fresh instance dir (no lef
 });
 
 t('materializeClaude: materializes scheduled-tasks — bodies→bongos, companions keep _core-resolve (task 2138)', () => {
+  // There is nothing to materialize FROM when the core checkout carries no
+  // .claude/ source tree (package-excluded — task 1002470).
+  if (!existsSync(join(ROOT, '.claude', 'scheduled-tasks'))) return;
   const dir = mkdtempSync(join(tmpdir(), 'w3-rt-'));
   const res = m.materializeClaude({ coreRoot: ROOT, instanceDir: dir, dryRun: false });
   assert.ok(res.scheduledTasks > 0, 'at least one scheduled-task file materialized');
@@ -204,6 +207,7 @@ t('disabledModuleSkills: only skills of DISABLED modules are collected (default
 
 // ---- materializeClaude end-to-end: rebrand + skill-exclude (from the REAL repo) --
 t('materializeClaude: copied hooks carry NO founder origin/config-dir; a disabled-module skill is excluded', () => {
+  if (!existsSync(join(ROOT, '.claude', 'hooks'))) return;
   const dir = mkdtempSync(join(tmpdir(), 'rb-e2e-'));
   // Target instance: demo-branded, art-pipeline OFF (so its otb-* skills must be dropped).
   mkdirSync(join(dir, 'config'), { recursive: true });

package/tests/cli_box_scope.mjs

@@ -9,12 +9,20 @@
 //
 // Run:  node tests/cli_box_scope.mjs
 
+// task 1002162: the detector originally compared `res.data.error` to the STRING
+// 'box_scope'. The live server emits the ADR 0116 (R01) envelope, so that field
+// is an OBJECT and the test never matched — both call sites in cli-lib were dead
+// code. The envelope cases below import the server's REAL `envelope()` formatter
+// rather than hand-typing the shape, so if the wire contract changes again this
+// test fails instead of silently drifting back into a no-op.
+
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const lib = require('../scripts/gds/cli-lib.js');
 const { isBoxScope } = lib;
+const { envelope } = require('../src/bongos/api-errors.js');
 
 let passed = 0, failed = 0;
 function test(name, fn) {
@@ -47,6 +55,38 @@ test('isBoxScope: false on missing/empty data (no crash)', () => {
   assert.equal(isBoxScope(undefined), false);
 });
 
+// ---------------------------------------------------------------------------
+// task 1002162 — the ADR 0116 envelope. THE REGRESSION: these are the shapes the
+// live server actually sends, built by the server's own formatter.
+// ---------------------------------------------------------------------------
+
+test('isBoxScope: true for the REAL server envelope (the shape that was missed)', () => {
+  assert.equal(isBoxScope({ status: 403, data: envelope('box_scope') }), true);
+});
+
+test('isBoxScope: true for an envelope carrying message + details', () => {
+  const body = envelope('box_scope', 'box-scoped session', { what_to_do: 're-auth' });
+  assert.equal(body.error.code, 'box_scope', 'guard: envelope() still nests under .error.code');
+  assert.equal(isBoxScope({ status: 403, data: body }), true);
+});
+
+test('isBoxScope: false for a DIFFERENT code in envelope form — must not hijack', () => {
+  assert.equal(isBoxScope({ status: 403, data: envelope('not_your_task') }), false);
+  assert.equal(isBoxScope({ status: 403, data: envelope('forbidden') }), false);
+  assert.equal(isBoxScope({ status: 403, data: envelope('rank_forbidden') }), false);
+});
+
+test('isBoxScope: false for the envelope on the WRONG status', () => {
+  assert.equal(isBoxScope({ status: 401, data: envelope('box_scope') }), false);
+  assert.equal(isBoxScope({ status: 200, data: envelope('box_scope') }), false);
+});
+
+test('isBoxScope: no crash on a null/odd error field', () => {
+  assert.equal(isBoxScope({ status: 403, data: { error: null } }), false);
+  assert.equal(isBoxScope({ status: 403, data: { error: {} } }), false);
+  assert.equal(isBoxScope({ status: 403, data: {} }), false);
+});
+
 console.log('');
 console.log(`cli_box_scope: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/cloud_bongos_pack.mjs

@@ -5,11 +5,15 @@
 // the customer-0 pack Cloud Bongos itself runs on.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
+import { existsSync, writeFileSync, rmSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import brandingMod from '../src/branding.js';
 import serveInternal from '../src/bongos/serve-internal.js';
 
-const { loadBranding, clientBranding } = brandingMod;
+const { loadBranding, clientBranding, INSTANCE_PATH } = brandingMod;
 const { themeMarkup, injectBrandingGlobal } = serveInternal;
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 
 // A standalone/vanilla boot has NO instance config — point the loader at a
 // nonexistent instance path so it resolves the neutral starter alone (the
@@ -65,6 +69,10 @@ test('customer-0: GDS_BRANDING_FILE selects the cloudbongos.com instance pack (t
   // The live dogfood instance runs from the SAME checkout as OTB; the env knob
   // points this process at its own pack (deltas over neutral) instead of OTB's
   // config/branding.json. Proves the brand-switch + the cloudbongos pack content.
+  // Both packs are INSTANCE content — the neutral core ships neither, so this
+  // asserts one deployment's config (task 1002470). The selector MECHANISM is
+  // proven unconditionally by the fixture test below.
+  if (!existsSync(join(ROOT, 'config/branding.cloudbongos.json'))) return;
   const b = loadBranding({ env: { GDS_BRANDING_FILE: 'config/branding.cloudbongos.json' } });
   assert.equal(b.identity.productName, 'Cloud Bongos'); // from neutral
   assert.equal(b.currency.label, 'credits');            // from neutral, not "drachmae"
@@ -77,9 +85,31 @@ test('customer-0: GDS_BRANDING_FILE selects the cloudbongos.com instance pack (t
   assert.equal(b.firstAdmin, 'lars589');
 });
 
-test('customer-0: no GDS_BRANDING_FILE still resolves OTB (default unchanged)', () => {
+test('customer-0: no GDS_BRANDING_FILE still resolves the instance pack (default unchanged)', () => {
   // The OTB process (server.js) sets no GDS_BRANDING_FILE → config/branding.json.
+  // Same instance-content caveat as above: with no instance pack the correct default
+  // IS the neutral starter, which is what the vanilla tests in this file already pin.
+  if (!existsSync(INSTANCE_PATH)) return;
   const b = loadBranding({ env: {} });
-  assert.equal(b.identity.worldName, 'Amazonprimea');
-  assert.equal(b.currency.label, 'drachmae');
+  assert.notDeepEqual(b.identity, vanilla().identity, 'the instance pack must win over neutral by default');
+});
+
+test('GDS_BRANDING_FILE selects a named pack over the default (the selector mechanism)', () => {
+  // The half of the two tests above that must hold on EVERY instance, proven against a
+  // throwaway fixture instead of one deployment's committed pack (task 1002470).
+  const rel = 'config/branding.__fixture-selector-test.json';
+  const abs = join(ROOT, rel);
+  writeFileSync(abs, JSON.stringify({ identity: { productName: 'Fixture Product' }, currency: { label: 'zorkmids' } }));
+  try {
+    const picked = loadBranding({ env: { GDS_BRANDING_FILE: rel } });
+    assert.equal(picked.identity.productName, 'Fixture Product', 'the named pack was selected');
+    assert.equal(picked.currency.label, 'zorkmids', 'its deltas won over neutral');
+    // ...and unspecified keys still fall through to the neutral starter (it is a MERGE,
+    // not a replace) — so a partial pack can never blank out the platform defaults.
+    assert.equal(picked.copy.hallName, vanilla().copy.hallName, 'unspecified keys fall through to neutral');
+    // Counterfactual: without the env knob the fixture must NOT be in play.
+    assert.notEqual(loadBranding({ env: {} }).currency.label, 'zorkmids', 'the selector is what chose it');
+  } finally {
+    rmSync(abs, { force: true });
+  }
 });

package/tests/conductor.mjs

@@ -10,9 +10,10 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { requireHostModule } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
-const conductor = require('../.claude/hooks/conductor.js');
+const conductor = requireHostModule(require, '../.claude/hooks/conductor.js');
 
 let passed = 0;
 let failed = 0;

package/tests/criterion_authoring_gate.mjs

@@ -29,6 +29,7 @@ const buildDoneWhenRouter = require('../modules/lifecycle/routes/done-when.js');
 const { authorizeCriterionCreate } = buildDoneWhenRouter;
 const { authorizeGoalManagement, isGoalOwnerOrManager } = require('../modules/lifecycle/goal-authz.js');
 const { MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
+const catalog = require('../modules/governance/catalog.js');
 
 const doneWhenSrc = readFileSync(new URL('../modules/lifecycle/routes/done-when.js', import.meta.url), 'utf8');
 const { test, summary } = makeRunner();
@@ -239,12 +240,19 @@ await test('the gate reuses the SAME owner|manager predicate as routes/goals.js
 
 // ---- route-source + pin contracts (drift catchers) ----
 
+// BV1.R105 migrated this middleware from requireRank('metic','archon') to the
+// `criterion.create` ATOM. The audience assertion did not weaken — it got stricter:
+// the spelling check now runs THROUGH the catalog, so a floor change on the atom
+// reds this test even though the route source is untouched. (Pinning the atom name
+// alone would let `criterion.create` quietly drop to xenos and still pass.)
 await test('the route is gated metic+archon and calls the pure gate', () => {
   assert.match(
     doneWhenSrc,
-    /router\.post\('\/versions\/:id\/done-when',\s*auth\.requireBuilder,\s*auth\.requireRank\('metic',\s*'archon'\)/,
-    'the middleware must be requireRank(metic, archon)'
+    /router\.post\('\/versions\/:id\/done-when',\s*auth\.requireBuilder,\s*auth\.requirePermission\('criterion\.create'\)/,
+    'the middleware must be requirePermission(criterion.create)'
   );
+  assert.equal(catalog.byKey('criterion.create').floor, 'metic',
+    'criterion.create must floor at metic — that floor IS what makes this route metic+archon');
   assert.match(doneWhenSrc, /authorizeCriterionCreate\(\{/, 'the handler must call the pure gate, not inline the decision');
 });
 
@@ -256,13 +264,28 @@ await test('the `// rank:` annotation matches the middleware (gen-api-docs reads
   );
 });
 
-await test('unsatisfy stays ARCHON — the backward ratchet is not part of this grant', () => {
+// ADR 0154 made "unsatisfy stays ARCHON" its safety argument for delegating criterion
+// CREATE to Metic: the forward ratchet moved, the backward one did not. ADR 0157 (owner
+// decision, 2026-08-05) overrides that specific carve-out — `criterion.unsatisfy` is
+// neither rank/identity nor one of the four escalation keys, so it delegated with the rest
+// of the operational block.
+//
+// What this test still guards is the part that never depended on the rank: unsatisfy must
+// remain gated on its OWN dedicated atom, distinct from `criterion.satisfy`. If the two
+// were ever merged, confirming a criterion would silently confer the power to un-confirm
+// one — and THAT is the asymmetry ADR 0154 actually cared about.
+await test('unsatisfy is gated on its OWN atom — the backward ratchet is a separate grant', () => {
   assert.match(
     doneWhenSrc,
-    /router\.post\('\/done-when\/:criterionId\/unsatisfy',\s*auth\.requireBuilder,\s*auth\.requireRank\('archon'\)/,
+    /router\.post\('\/done-when\/:criterionId\/unsatisfy',\s*auth\.requireBuilder,\s*auth\.requirePermission\('criterion\.unsatisfy'\)/,
     'un-flipping a confirmed criterion rewrites shipped scope-truth'
   );
-  assert.equal(MODULE_EXPECTED_RANKS.lifecycle['POST /done-when/:criterionId/unsatisfy'], 'archon');
+  assert.equal(catalog.byKey('criterion.unsatisfy').floor, 'metic',
+    'ADR 0157 delegated the backward ratchet to the working rank');
+  assert.notEqual(catalog.byKey('criterion.unsatisfy').key, catalog.byKey('criterion.satisfy').key,
+    'satisfy and unsatisfy must stay separate atoms, whatever their floors');
+  assert.equal(MODULE_EXPECTED_RANKS.lifecycle['POST /done-when/:criterionId/unsatisfy'],
+    'perm:criterion.unsatisfy');
 });
 
 await test('the route-rank PIN records metic+archon (fitness reds the build on drift)', () => {