@bongos/core 1.18.19 → 1.19.3

package/tests/currency_label.mjs

@@ -55,10 +55,19 @@ test('clientBranding is a SMALL allow-list — no server-only field leaks to the
     db: { database: 'amazonprimea' },
     envPrefix: 'OTB',
   });
-  assert.deepEqual(Object.keys(projected).sort(), ['copy', 'currency', 'identity', 'rankLabels', 'theme']);
+  // `reward` joined the projection in task 1002469 (ADR 0146 follow-up) — the resolved
+  // reward POLICY, so a builder on a cost-plus-only instance isn't shown a per-task
+  // estimate that will never pay. The allow-list was not updated with it, so this guard
+  // had been failing since that landed (task 1002470).
+  assert.deepEqual(Object.keys(projected).sort(), ['copy', 'currency', 'identity', 'rankLabels', 'reward', 'theme']);
   for (const leak of ['domains', 'repo', 'db', 'envPrefix', 'llmProjectName']) {
     assert.equal(projected[leak], undefined, `${leak} must not reach the client`);
   }
+  // The new member is itself held to the same small-surface rule — the point of this
+  // test is that every projected key is a reviewed one, not merely that it is listed.
+  assert.deepEqual(Object.keys(projected.reward).sort(), ['mode', 'perTaskCredit']);
+  assert.equal(typeof projected.reward.mode, 'string');
+  assert.equal(typeof projected.reward.perTaskCredit, 'boolean');
 });
 
 test('R56: injectBrandingGlobal inserts a synchronous window.__BRANDING__ before </head>', () => {

package/tests/deploy_instance.mjs

@@ -14,9 +14,11 @@ import { mkdtempSync, rmSync, existsSync, statSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { skipUnlessPresent } from './helpers.mjs';
 
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const SCRIPT = join(ROOT, 'scripts', 'deploy', 'deploy-instance.sh');
+skipUnlessPresent('scripts/deploy/deploy-instance.sh');
 
 let passed = 0;
 let failed = 0;

package/tests/devbox_downloads.mjs

@@ -9,10 +9,11 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { requireHostModule } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const { buildDevboxDownloads } = require('../src/devbox-downloads.js');
-const committedConfig = require('../config/devbox-app.json');
+const committedConfig = requireHostModule(require, '../config/devbox-app.json');
 
 let passed = 0;
 let failed = 0;

package/tests/display_name.mjs

@@ -1,11 +1,19 @@
 // tests/display_name.mjs
 //
-// Unit smoke for modules/builder-settings/display-name.js (task 1669) — the pure
-// validator behind GET/PATCH /me/display-name (the self-service display-name
-// editor). Covers the rules the route enforces: trim, reject empty /
-// whitespace-only, the length ceiling, and control-character rejection. The DB
-// write + route plumbing are exercised by the prod smoke; here we cover the
-// pure logic without touching pg.
+// Unit smoke for the self-service display-name editor (GET/PATCH
+// /me/display-name), in two parts:
+//
+//   1. modules/builder-settings/display-name.js (task 1669) — the pure
+//      validator. Trim, reject empty / whitespace-only, the length ceiling, and
+//      control-character rejection.
+//   2. The PERSISTENCE guard (task 1002568, ADR 0156) — "your name wins,
+//      always". Only covering the validator is why the bug shipped: the save
+//      worked and then upsertBuilder, which runs on EVERY sign-in, re-set
+//      display_name from the GitHub name. These tests read the REAL SQL both
+//      halves emit and check the conflict branch's behaviour, so deleting the
+//      guard fails here instead of in production.
+//
+// No pg: the shared pool's query() is stubbed to record the SQL.
 //
 // Run:  node tests/display_name.mjs
 
@@ -119,5 +127,86 @@ t('hasControlChar detects control chars and clears normal text', () => {
   assert.equal(d.hasControlChar(`with${BEL}bell`), true);
 });
 
+// ---------------------------------------------------------------------------
+// Persistence: a user-set name survives the next sign-in (task 1002568)
+// ---------------------------------------------------------------------------
+
+// Stub the SHARED pool object before requiring anything that queries it — both
+// db-kernel.js and the module's db.js capture this exact singleton at load.
+const { pool } = require('../src/bongos/pool.js');
+let lastSql = null;
+pool.query = async (sql) => { lastSql = sql; return { rows: [{}] }; };
+
+const kernel = require('../src/bongos/db-kernel.js');
+const settingsDb = require('../modules/builder-settings/db.js');
+
+// Pull one assignment out of an ON CONFLICT ... DO UPDATE SET clause. None of
+// the assignments contain a comma, so splitting on commas is exact.
+function conflictAssignment(sql, column) {
+  const setClause = sql.slice(sql.indexOf('DO UPDATE'), sql.indexOf('RETURNING'));
+  for (const part of setClause.replace(/^[\s\S]*?SET/, '').split(',')) {
+    const [lhs, ...rhs] = part.split('=');
+    if (lhs.trim() === column) return rhs.join('=').trim();
+  }
+  throw new Error(`no "${column} = …" assignment in the conflict branch`);
+}
+
+// Evaluate the display_name assignment for one row, so the tests below read as
+// behaviour ("whose name ends up stored?") rather than string matching. An
+// unguarded assignment — the shape that shipped the bug — is a bare column
+// reference and evaluates to whatever GitHub just sent.
+function resolvedDisplayName(expr, { source, stored, incoming }) {
+  const ref = (token) => {
+    if (/^EXCLUDED\.display_name$/i.test(token)) return incoming;
+    if (/^builders\.display_name$/i.test(token)) return stored;
+    throw new Error(`unrecognised display_name reference: ${token}`);
+  };
+  const norm = expr.replace(/\s+/g, ' ').trim();
+  const m = /^CASE WHEN builders\.display_name_source = '(\w+)' THEN (\S+) ELSE (\S+) END$/i.exec(norm);
+  if (!m) return ref(norm);
+  return source === m[1] ? ref(m[2]) : ref(m[3]);
+}
+
+// Drive both halves once (they're async), then assert on the captured SQL with
+// the same synchronous `t` helper the validator tests use.
+await kernel.upsertBuilder({
+  githubId: 64553469, githubLogin: 'jaxri', displayName: 'GitHub Name', avatarUrl: null,
+});
+const upsertExpr = conflictAssignment(lastSql, 'display_name');
+
+await settingsDb.setBuilderDisplayName(1000095, 'Renée the Builder');
+const setNameSql = lastSql.replace(/\s+/g, ' ');
+
+console.log('\nsign-in persistence (upsertBuilder conflict branch):');
+
+t('the conflict branch keys display_name off display_name_source', () => {
+  assert.ok(
+    /display_name_source/.test(upsertExpr),
+    `upsertBuilder must not re-set display_name unconditionally; got: ${upsertExpr}`
+  );
+});
+
+t('a builder who set their own name keeps it when GitHub sends a different one', () => {
+  const kept = resolvedDisplayName(upsertExpr, {
+    source: 'user', stored: 'Renée the Builder', incoming: 'renee-gh',
+  });
+  assert.equal(kept, 'Renée the Builder');
+});
+
+t('a builder who never renamed still picks up a GitHub rename', () => {
+  const synced = resolvedDisplayName(upsertExpr, {
+    source: 'github', stored: 'Old GitHub Name', incoming: 'New GitHub Name',
+  });
+  assert.equal(synced, 'New GitHub Name');
+});
+
+t('setBuilderDisplayName stamps the name as user-set', () => {
+  assert.match(
+    setNameSql,
+    /display_name_source = 'user'/,
+    'without the stamp the saved name reverts at the next sign-in'
+  );
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/eviction_policy.mjs

@@ -4,8 +4,9 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { requireHostModule } from './helpers.mjs';
 const require = createRequire(import.meta.url);
-const { classifyEviction, estTokens, blockText, stubFor, normalize, readRange, isVolatileBash, salientTokens } = require('../.claude/hooks/eviction-policy.js');
+const { classifyEviction, estTokens, blockText, stubFor, normalize, readRange, isVolatileBash, salientTokens } = requireHostModule(require, '../.claude/hooks/eviction-policy.js');
 
 let passed = 0, failed = 0;
 function test(name, fn) {

package/tests/file_map.mjs

@@ -31,7 +31,12 @@ test('committed file-map sections are current (the Path-C CI gate)', () => {
 test('EVERY skill + scheduled-task dir on disk is listed AND has a note — no silent omission, no ghost', () => {
   const model = gen.buildModel();
   assert.ok(model.length === 2, 'two generated sections');
+  let checked = 0;
   for (const section of model) {
+    // .claude/skills + .claude/scheduled-tasks are INSTANCE-materialized; a neutral
+    // core checkout carries neither (task 1002470). Check the sections that exist.
+    if (!existsSync(path.join(ROOT, section.dir))) continue;
+    checked += 1;
     const onDisk = readdirSync(path.join(ROOT, section.dir), { withFileTypes: true })
       .filter((e) => e.isDirectory() && !e.name.startsWith('.'))
       .map((e) => e.name)
@@ -41,6 +46,11 @@ test('EVERY skill + scheduled-task dir on disk is listed AND has a note — no s
     assert.equal(section.missing.length, 0, `${section.dir}: dirs without a note: ${section.missing.join(', ')}`);
     assert.equal(section.stale.length, 0, `${section.dir}: notes with no dir (ghosts): ${section.stale.join(', ')}`);
   }
+  // Non-vacuity: on an instance that materializes .claude/, this must have checked
+  // something — a skipped-everything run would otherwise pass while asserting nothing.
+  if (existsSync(path.join(ROOT, '.claude'))) {
+    assert.ok(checked > 0, '.claude/ exists but no section was checked — the exhaustiveness guard went vacuous');
+  }
 });
 
 test('the generated blocks live between markers and carry one ← note per entry', () => {

package/tests/first_admin_bootstrap.mjs

@@ -6,16 +6,24 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import auth from '../src/bongos/auth.js';
+import brandingMod from '../src/branding.js';
 
 const { firstAdminLogin, maybeSeatFirstAdmin } = auth;
+const { branding } = brandingMod;
 
 function clearEnv() {
   for (const k of ['OTB_FIRST_ADMIN', 'GDS_FIRST_ADMIN', 'PMS_FIRST_ADMIN', 'CLOUDBONGOS_FIRST_ADMIN']) delete process.env[k];
 }
 
-test('firstAdminLogin: resolves from branding (OTB pack → lars589) when no env override', () => {
+test('firstAdminLogin: resolves from the branding pack when no env override', () => {
+  // Asserts the RESOLUTION, not one instance's owner. This used to hardcode the OTB
+  // founder's login, which both broke on any other instance (the neutral pack sets
+  // firstAdmin: "") and put a founder identity in a test — the thing
+  // scripts/gds/audit-authorship.sh exists to keep out (task 1002470).
   clearEnv();
-  assert.equal(firstAdminLogin(), 'lars589');
+  const configured = (branding().firstAdmin || '').trim() || null;
+  assert.equal(firstAdminLogin(), configured,
+    'with no env override, firstAdminLogin must be exactly what the branding pack configures');
 });
 
 test('firstAdminLogin: env override wins over branding (configured prefix)', () => {

package/tests/first_run_engine_check.mjs

@@ -10,12 +10,13 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { requireHostModule } from './helpers.mjs';
 import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 const require = createRequire(import.meta.url);
-const { firstRunEngineCheck } = require('../.claude/hooks/session-start.js');
+const { firstRunEngineCheck } = requireHostModule(require, '../.claude/hooks/session-start.js');
 
 let passed = 0, failed = 0;
 function t(name, fn) {

package/tests/fitness.mjs

@@ -4,11 +4,13 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { onDiskModuleKeys } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const fitness = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
 
+
 test('all fitness checks pass with no hard failures (the CI gate)', () => {
   const results = fitness.runAll();
   const failed = results.filter((r) => r.hardFail);
@@ -158,12 +160,26 @@ test('module boundary actually CATCHES violations when enforcing (ratchet flip)'
 test('core-carries-no-module-code: the live kernel machinery is clean', () => {
   const r = fitness.checkCoreCarriesNoModuleCode();
   assert.equal(r.hardFail, false, r.violations.join('\n'));
-  // the check is live, not vacuous — it discovered the real module keys
-  // (incl. the net-new `demo` proof module, BV1.R52 / task 1424, `ideas`, BV1.R78,
-  // `security`, BV1.R79, `builder-settings`, BV1.R80, `onboarding`, BV1.R81,
-  // `sessions`, BV1.R82, `autonomy`, BV1.R83, `status-ui`, BV1.R84,
-  // `hall-ui`, BV1.R85, and the net-new `provisioning` feature module, ADR 0111)
-  assert.deepEqual(fitness.discoveredModuleKeys().sort(), ['art-pipeline', 'autonomy', 'builder-settings', 'character-anim', 'demo', 'dev-box', 'discord', 'economy', 'game', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'provisioning', 'security', 'sessions', 'status-ui']);
+  // The check is live, not vacuous — it discovered the real module keys. This used to
+  // be a hardcoded 19-key roster that went stale at the CB→OTB split (it still named
+  // art-pipeline / character-anim / demo / game, and had never learned governance or
+  // platform-identity), so it asserted a topology that no longer existed — task 1002470.
+  // Derived from an INDEPENDENT readdir of modules/, so a discovery regression in
+  // fitness.js still diverges from disk and fails here.
+  assert.deepEqual(fitness.discoveredModuleKeys().sort(), onDiskModuleKeys());
+});
+
+test('the discovered-module roster is derived from a NON-EMPTY disk read (mutation check)', () => {
+  // Guards the check above against going vacuous: if modules/ read back empty, the
+  // deepEqual would compare [] to [] and pass while proving nothing.
+  const keys = onDiskModuleKeys();
+  assert.ok(keys.length >= 5, `expected a real on-disk module roster, found ${keys.length}: ${keys.join(', ')}`);
+  // And it still FAILS when discovery actually drops a module.
+  assert.throws(
+    () => assert.deepEqual(keys.slice(1), keys),
+    /Expected values to be strictly deep-equal/,
+    'a dropped module must still fail the roster comparison',
+  );
 });
 
 test('core-carries-no-module-code actually CATCHES a hardcoded key (and ignores comments)', () => {
@@ -407,6 +423,10 @@ test('hall zone budgets check actually CATCHES a breach (not a no-op)', () => {
 // (a sibling-module import, and an ungated module write route).
 
 test('demo proof module is live + clean (boundary + rank + migration green)', () => {
+  // modules/demo/ is the acceptance-proof module; an instance that does not install it
+  // has nothing to prove here (task 1002470). The RED-LINE tests below are pure-function
+  // checks on path strings and still run either way, so the one-way rules stay covered.
+  if (!onDiskModuleKeys().includes('demo')) return;
   // discovered with the other modules (asserted above) and clean on every gate.
   assert.ok(fitness.discoveredModuleKeys().includes('demo'), 'demo is a discovered module');
   assert.equal(fitness.checkModulesImportOnlyApi().hardFail, false, 'demo imports only the doorway');

package/tests/gate_approvals.mjs

@@ -438,11 +438,24 @@ await t('both routes are requireBuilder-gated and registered', async () => {
   }
 });
 
-await t('route-rank auditor: both gate-approval routes classify to archon with no findings', async () => {
+// ADR 0157 SPLIT these two apart: reading the held-PR list is `gate_approval.read`
+// (metic — the Gate page opens to the working rank, and a page whose only data endpoint
+// 403s is a page that renders an error), while APPROVING still clears the gate-review
+// hard floor and stays `gate_approval.decide` (archon, system:true). Asserting the split
+// explicitly is the point — a future edit that re-merged them onto one atom would either
+// close the page again or hand out the approval, and both are caught here.
+await t('route-rank auditor: gate-approval READ is metic+, APPROVE stays archon, no findings', async () => {
   const res = checkRouteRanks();
   const mine = res.routes.filter((r) => r.route.includes('gate-approvals'));
   assert.equal(mine.length, 2, 'both routes seen by the auditor');
-  for (const r of mine) assert.equal(r.rank, 'archon', `${r.key} must classify archon`);
+  const byKey = new Map(mine.map((r) => [r.key, r]));
+  const read = byKey.get('GET /gate-approvals');
+  const approve = byKey.get('POST /gate-approvals/:pr/approve');
+  assert.ok(read && approve, 'both the list and the approve route must be present');
+  assert.deepEqual(read.perms, ['gate_approval.read'], 'the list route gates on the read atom');
+  assert.equal(read.rank, 'metic+archon', 'the list route is metic+ (ADR 0157)');
+  assert.deepEqual(approve.perms, ['gate_approval.decide'], 'approve gates on the decide atom');
+  assert.equal(approve.rank, 'archon', 'approving a held PR must stay archon');
   const myFindings = res.findings.filter((f) => (f.route || '').includes('gate-approvals'));
   assert.deepEqual(myFindings, [], 'no auditor findings on the gate-approval routes');
 });

package/tests/github_push_land_proof.mjs

@@ -77,10 +77,12 @@ test('landProvenForTask: published tip NOT in main → NOT proven (the false-shi
   assert.match(r.reason, /not in main/);
 });
 
-test('landProvenForTask: no published tip but matched PR references this task → proven (legacy fallback)', async () => {
+test('landProvenForTask: no published tip but matched MERGED PR references this task → proven (legacy fallback)', async () => {
   const r = await gh.landProvenForTask(
-    { taskId: 999, publishedSha: null, status: { pr_body: 'for task 999' } },
-    depsWithCompare('behind') // must NOT be consulted — no sha
+    // merged:true mirrors how real callers reach this fallback (post-landConfirmed);
+    // task 1002615 made it a hard requirement (see the open-PR test below).
+    { taskId: 999, publishedSha: null, status: { merged: true, pr_body: 'for task 999' } },
+    depsWithCompare('behind') // must NOT be consulted — no sha anywhere
   );
   assert.equal(r.proven, true);
   assert.match(r.reason, /references task 999/);
@@ -88,12 +90,56 @@ test('landProvenForTask: no published tip but matched PR references this task
 
 test('landProvenForTask: no published tip and matched PR references a DIFFERENT task → NOT proven', async () => {
   const r = await gh.landProvenForTask(
-    { taskId: 1299, publishedSha: null, status: { pr_title: 'task 1297: overlay', pr_body: 'for task 1297' } },
+    { taskId: 1299, publishedSha: null, status: { merged: true, pr_title: 'task 1297: overlay', pr_body: 'for task 1297' } },
     depsWithCompare('behind')
   );
   assert.equal(r.proven, false);
 });
 
+// --- task 1002615: the out-of-band / rewritten-history land proofs -----------
+
+// Per-sha compare responses, so the tip and the merge commit can answer differently.
+function depsWithCompareBySha(map) {
+  return {
+    token: 'x',
+    repoInfo: { owner: 'o', repo: 'r' },
+    fetchImpl: async (url) => {
+      const m = /compare\/[^.]+\.\.\.([0-9a-f]{7,64})/.exec(String(url));
+      return { ok: true, status: 200, json: async () => ({ status: (m && map[m[1]]) || 'ahead' }) };
+    },
+  };
+}
+
+const MERGE_SHA = 'f'.repeat(40);
+
+test('landProvenForTask (1002615): squash merge — tip NOT in main but the merged PR\'s merge_sha is → proven', async () => {
+  const r = await gh.landProvenForTask(
+    { taskId: 7, publishedSha: SHA,
+      status: { merged: true, merge_sha: MERGE_SHA, pr_title: 'task 7: thing' } },
+    depsWithCompareBySha({ [SHA]: 'ahead', [MERGE_SHA]: 'behind' })
+  );
+  assert.equal(r.proven, true, 'a squash/rebase land must not strand on the tip check');
+  assert.match(r.reason, /merged PR for task 7/);
+});
+
+test('landProvenForTask (1002615): an OPEN PR that references the task is NOT a land (merged:true required)', async () => {
+  const r = await gh.landProvenForTask(
+    { taskId: 8, publishedSha: null, status: { merged: false, pr_state: 'open', pr_body: 'for task 8' } },
+    depsWithCompare('behind')
+  );
+  assert.equal(r.proven, false, 'reference alone on an un-merged PR must never prove');
+});
+
+test('landProvenForTask (1002615): merged PR for a DIFFERENT task + tip not in main → NOT proven (reuse guard intact)', async () => {
+  const r = await gh.landProvenForTask(
+    { taskId: 7, publishedSha: SHA,
+      status: { merged: true, merge_sha: MERGE_SHA, pr_title: 'task 999: other' } },
+    depsWithCompareBySha({ [SHA]: 'ahead', [MERGE_SHA]: 'behind' })
+  );
+  assert.equal(r.proven, false);
+  assert.match(r.reason, /not in main/);
+});
+
 test('landProvenForTask: a non-sha published tip ("HEAD") falls back to the PR check, never the compare API', async () => {
   let compareCalled = false;
   const deps = {

package/tests/github_repos_helpers.mjs

@@ -17,12 +17,34 @@ const auth = require(path.join(ROOT, 'src/bongos/auth.js'));
 const routesAuth = require(path.join(ROOT, 'src/bongos/routes/auth.js'));
 const gh = require(path.join(ROOT, 'src/bongos/github-repos.js'));
 
-test('scopeForWebFlow: identity-only by default, adds public_repo ONLY when repos=true', () => {
+test('scopeForWebFlow: identity-only by default, adds repo ONLY when repos=true', () => {
   assert.equal(auth.scopeForWebFlow(), 'read:user');
   assert.equal(auth.scopeForWebFlow({ repos: false }), 'read:user');
-  assert.equal(auth.scopeForWebFlow({ repos: true }), 'read:user public_repo');
-  // Never the all-or-nothing `repo` scope (ADR 0141) — public_repo only.
-  assert.ok(!auth.scopeForWebFlow({ repos: true }).split(' ').includes('repo'));
+  // ADR 0155 (task 1002561): `repo`, not `public_repo` — public_repo grants write to
+  // PUBLIC repos only, so adopting an existing PRIVATE repo 403'd at the scaffold push.
+  assert.equal(auth.scopeForWebFlow({ repos: true }), 'read:user repo');
+  // The widening is opt-in and MUST stay opt-in: an ordinary hall sign-in / the CLI
+  // device flow must never carry a repo-acting scope.
+  assert.ok(!auth.scopeForWebFlow().split(' ').includes('repo'));
+});
+
+test('grantedScopeCoversRepos: a stale pre-0155 public_repo token is NOT sufficient', () => {
+  // The exact shape GitHub stored for the live failure (github_oauth_tokens.scope):
+  // comma-separated, GitHub's own order, and `public_repo` CONTAINS the substring
+  // "repo" — a naive match would wrongly accept it and reintroduce the silent
+  // "private repos missing from the picker" degrade.
+  assert.equal(auth.grantedScopeCoversRepos('public_repo,read:user'), false);
+  assert.equal(auth.grantedScopeCoversRepos('read:user'), false);
+  assert.equal(auth.grantedScopeCoversRepos(''), false);
+  assert.equal(auth.grantedScopeCoversRepos(null), false);
+  assert.equal(auth.grantedScopeCoversRepos(undefined), false);
+  // Sufficient: `repo` present, in either order / separator GitHub might use.
+  assert.equal(auth.grantedScopeCoversRepos('read:user,repo'), true);
+  assert.equal(auth.grantedScopeCoversRepos('repo,read:user'), true);
+  assert.equal(auth.grantedScopeCoversRepos('read:user repo'), true);
+  assert.equal(auth.grantedScopeCoversRepos('repo'), true);
+  // `repo` implies public_repo, so a token carrying both is fine too.
+  assert.equal(auth.grantedScopeCoversRepos('public_repo,repo,read:user'), true);
 });
 
 test('safeReturnTo still guards after the ?repos change: relative ok, cross-origin/protocol-relative blocked', () => {
@@ -77,7 +99,10 @@ test('createUserRepo: sends auto_init:false + private:false, returns full_name/h
   };
   const out = await gh.createUserRepo('tok', { name: 'mercury', fetchImpl });
   assert.equal(sentBody.auto_init, false, 'empty repo — no README/first commit');
-  assert.equal(sentBody.private, false, 'public_repo scope → public');
+  // Still public AFTER the ADR 0155 scope widen: `repo` COULD create a private repo,
+  // but a repo Cloud Bongos creates stays public by product choice (open-source /
+  // capture-resistant by design). Guards against the widen silently changing what we make.
+  assert.equal(sentBody.private, false, 'a repo WE create is public by product choice');
   assert.equal(sentBody.name, 'mercury');
   assert.deepEqual(out, { full_name: 'me/mercury', html_url: 'https://github.com/me/mercury' });
 });

package/tests/github_token_store.mjs

@@ -119,3 +119,26 @@ test('GET /github/repos → 403 repo_scope_required when configured but no store
     db.getGithubToken = orig;
   }
 });
+
+// ADR 0155 / task 1002561. Widening scopeForWebFlow to `repo` does NOT upgrade rows
+// already in github_oauth_tokens. A surviving pre-0155 `public_repo` token can still
+// list + create PUBLIC repos, so WITHOUT the scope check the route 200s while silently
+// omitting the user's private repos — and the real failure resurfaces minutes later as
+// an opaque 403 on the provisioner's push. It must take the reconnect path instead.
+// (No 200-path test here: `repo`-scoped tokens fall through to a real GitHub call, and
+// this file is deliberately network-free. The positive direction is covered exhaustively
+// by grantedScopeCoversRepos in tests/github_repos_helpers.mjs.)
+test('GET /github/repos → 403 repo_scope_required for a STALE pre-0155 public_repo token', async () => {
+  const orig = db.getGithubToken;
+  db.getGithubToken = async () => ({ token: 'gho_stale', scope: 'public_repo,read:user' });
+  try {
+    const handler = finalHandler(buildGithubRouter(), 'get', '/github/repos');
+    const res = fakeRes();
+    await handler({ builder: { id: 1 }, query: {} }, res);
+    assert.equal(res._status, 403, 'a public_repo-only token must not be treated as sufficient');
+    assert.equal(res._body.error.code, 'repo_scope_required');
+    assert.match(res._body.error.message, /private/i, 'tells the user WHY reconnecting is needed');
+  } finally {
+    db.getGithubToken = orig;
+  }
+});

package/tests/goal_abuse_matrix.mjs

@@ -51,7 +51,7 @@ const buildGoalsRouter = require('../modules/lifecycle/routes/goals.js');
 // The pure, exported, ordered create gate — the one place the decision is made.
 const { authorizeGoalTaskCreate } = buildGoalsRouter;
 const { deriveRequiredRank, highestRank } = require('../modules/lifecycle/db.js');
-const { MODULE_EXPECTED_RANKS, checkRouteRanks } = require('../src/bongos/route-rank-check.js');
+const { MODULE_EXPECTED_RANKS, checkRouteRanks, pinMismatch } = require('../src/bongos/route-rank-check.js');
 const { scopeIncludesProtected, protectedModules, isModuleKey } = require('../src/bongos/module-scope-map.js');
 
 const goalsSrc = readFileSync(new URL('../modules/lifecycle/routes/goals.js', import.meta.url), 'utf8');
@@ -169,7 +169,12 @@ await test('[pin] every goal route is pinned in MODULE_EXPECTED_RANKS.lifecycle'
   assert.equal(pins['POST /goals'], 'metic+archon');
   assert.equal(pins['POST /goals/:id/members'], 'any-builder', 'task 1762: widened to owner|lead|archon, in-handler gate');
   assert.equal(pins['POST /goals/:id/scope'], 'metic+archon');
-  assert.equal(pins['POST /goals/reorder'], 'archon', 'priority is an owner decision, never self-granted');
+  // ADR 0157 lowered `goal.reorder` archon→metic and re-pinned it by atom. Ordering the
+  // queue is prioritisation, not an authority grant — the "never self-granted" property
+  // that matters here is that reorder is NOT reachable through a goal's own
+  // owner/manager authority, and that still holds: it needs a global permission no
+  // member role confers.
+  assert.equal(pins['POST /goals/reorder'], 'perm:goal.reorder', 'reorder needs a global permission, never a goal-member grant');
 });
 await test('[pin] LIVE: every pinned goal route classifies to its expected rank (a drift would mismatch)', () => {
   const res = checkRouteRanks();
@@ -180,7 +185,12 @@ await test('[pin] LIVE: every pinned goal route classifies to its expected rank
     if (!key.includes('/goals')) continue; // this suite owns the goal-route pins
     const r = byKey.get(key);
     assert.ok(r, `pinned goal route ${key} must exist in the live route set`);
-    assert.equal(r.rank, expected, `goal route ${key} must classify as '${expected}', got '${r.rank}'`);
+    // A pin is either a rank label or `perm:<atom>[,<atom>]` (ADR 0151 / ADR 0157). For an
+    // atom pin the live row carries the ATOMS, and its rank label is derived from the
+    // catalog floor — so compare atoms to atoms, ranks to ranks. Reusing the checker's own
+    // pinMismatch keeps this suite from re-implementing (and drifting from) that rule.
+    const mismatch = pinMismatch(expected, r);
+    assert.equal(mismatch, null, `goal route ${key} ${mismatch}`);
   }
 });
 

package/tests/goal_cli.mjs

@@ -0,0 +1,89 @@
+// tests/goal_cli.mjs
+//
+// Unit test for the PURE helpers exported from scripts/gds/goal.js (the goal
+// board CLI): rollup(), criterionGlyph(), criterionState(), bucketTasks(),
+// liveTasks(). All are deterministic with no DB, network, or live server —
+// requiring the script must NOT run the CLI (main is require.main-guarded).
+// Run: node tests/goal_cli.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const goal = require('../scripts/gds/goal.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+// All EIGHT statuses of migration 012's CHECK constraint.
+const ALL_STATUSES = ['backlog', 'ready', 'active', 'blocked', 'completed', 'confirmed', 'shipped', 'abandoned'];
+const t = (status) => ({ status });
+
+test('rollup: counts shipped over total', () => {
+  assert.equal(goal.rollup([t('shipped'), t('shipped'), t('ready')]), '2/3 shipped · 1 ready');
+});
+
+test('rollup: in-flight covers active/completed/confirmed', () => {
+  assert.equal(goal.rollup([t('active'), t('completed'), t('confirmed')]), '0/3 shipped · 3 in flight');
+});
+
+test('rollup: omits zero segments (backlog-only goal shows only shipped fraction)', () => {
+  assert.equal(goal.rollup([t('backlog'), t('backlog')]), '0/2 shipped');
+});
+
+test('rollup: abandoned is excluded from the denominator (migration 017 rule)', () => {
+  // Without the exclusion this would read "2/3 shipped" for a goal with no live work left.
+  assert.equal(goal.rollup([t('shipped'), t('shipped'), t('abandoned')]), '2/2 shipped');
+});
+
+test('liveTasks: filters only abandoned', () => {
+  const live = goal.liveTasks(ALL_STATUSES.map(t));
+  assert.equal(live.length, ALL_STATUSES.length - 1);
+  assert.ok(live.every((x) => x.status !== 'abandoned'));
+});
+
+test('bucketTasks: partitions all 8 lifecycle statuses into exactly one bucket', () => {
+  const tasks = ALL_STATUSES.map(t);
+  const b = goal.bucketTasks(tasks);
+  assert.equal(b.shipped.length, 1);
+  assert.equal(b.inFlight.length, 3);
+  assert.equal(b.ready.length, 1);
+  assert.equal(b.gated.length, 2); // backlog + blocked
+  assert.equal(b.abandoned.length, 1);
+  const total = b.shipped.length + b.inFlight.length + b.ready.length + b.gated.length + b.abandoned.length;
+  assert.equal(total, tasks.length, 'no status may fall through the buckets');
+});
+
+test('criterionGlyph: satisfied wins over pending_review', () => {
+  assert.equal(goal.criterionGlyph({ satisfied: true, pending_review: true }), '✓');
+  assert.equal(goal.criterionGlyph({ satisfied: false, pending_review: true }), '◇');
+  assert.equal(goal.criterionGlyph({ satisfied: false, pending_review: false }), '○');
+});
+
+test('criterionState: pending review names the /goal-review queue', () => {
+  assert.match(goal.criterionState({ satisfied: false, pending_review: true }), /pending review/);
+});
+
+test('criterionState: open criterion reports unshipped-of-linked counts (string API ids)', () => {
+  // The API returns counts as strings — the formatter must not NaN on them.
+  const s = goal.criterionState({ satisfied: false, pending_review: false, unshipped_tasks: '3', linked_tasks: '3' });
+  assert.equal(s, '3 of 3 linked tasks unshipped');
+});
+
+test('criterionState: singular linked task reads grammatically', () => {
+  const s = goal.criterionState({ satisfied: false, pending_review: false, unshipped_tasks: '1', linked_tasks: '1' });
+  assert.equal(s, '1 of 1 linked task unshipped');
+});
+
+test('criterionState: zero linked tasks must NOT read as complete', () => {
+  const s = goal.criterionState({ satisfied: false, pending_review: false, unshipped_tasks: '0', linked_tasks: '0' });
+  assert.equal(s, 'no linked tasks yet');
+});
+
+console.log('');
+console.log(`${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);