@bongos/core 1.19.1032 → 1.19.1034

package/tests/grader_unbacked_score.mjs

@@ -0,0 +1,194 @@
+// tests/grader_unbacked_score.mjs
+//
+// Task 1002903 — a low score no finding stands behind must reach the builder as
+// what it is, and must still not pass.
+//
+// THE SHAPE. The severity gate (task 1002663, worker-verdict.js
+// applySeverityGatePolicy) downgrades a worker's sub-threshold 'fail' to
+// 'concerns' when no major/blocker finding backs it. The worker keeps its low
+// score, so the grade still read "FAIL 5.5" — and the card said "Fix the issues
+// above" over an empty list. Three defects made that shape:
+//   1. runWorker rebuilt the worker row field by field and dropped the policy's
+//      marker, so the stored grade could not say which low score was unbacked;
+//   2. an ADVISORY Narc's unbacked low ff made the panel report PASS while the
+//      server's ff gate failed the ship — a PASS verdict inside a FAIL grade;
+//   3. the card had no branch for it, so it printed the ordinary FAIL block.
+// The constraint the task set: close it WITHOUT letting an unbacked low score
+// pass and WITHOUT adding a gate (ADR 0162). Every case below that has a low
+// score also asserts the server still refuses it.
+//
+// Run:  node tests/grader_unbacked_score.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const grader = require('../modules/grading/grader.js');
+const { aggregatePanel, validateAndScore, serverSideGuards, THRESHOLD, FALLTHROUGH_CONFIDENCE } = grader;
+const { unbackedLowScores, UNBACKED_SCORE_DOWNGRADE, failResult } = require('../modules/grading/grader-workers/worker-verdict.js');
+const { runWorker, quality, narc, hacker, efficiency } = require('../modules/grading/grader-workers/index.js');
+const { buildGradePayload, formatGradeOutcome } = require('../scripts/gds/ship-grade-steps.js');
+const { CARDS } = require('../scripts/gds/plain-cards.js');
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+// A REAL worker row: the real worker module's prompt, parser and verdict, run
+// through the real runWorker, with only the subprocess replaced by its output.
+// That is the point — defect 1 lived in runWorker's row assembly, so a
+// hand-built row would have hidden it.
+async function row(worker, output) {
+  return runWorker(worker, {
+    task: { id: 1002903, title: 't', description: 'd', kind: 'bug', discipline: 'engineer' },
+    valueSummary: 'v', diff: '+ const x = 1;', changedFiles: ['a.js'], diffStats: {},
+    model: 'claude-sonnet-5', runOpts: {},
+    runSubagentFn: async () => ({ stdout: JSON.stringify(output), run_ms: 5, cost_usd: 0 }),
+  });
+}
+const nit = { severity: 'nit', file: 'a.js', summary: 'comment style' };
+const major = { severity: 'major', file: 'a.js', summary: 'breaks the caller' };
+const ac = [{ ac: 'does the thing', status: 'satisfied', evidence: 'a.js:1' }];
+
+const OUT = {
+  narcPass: { functional_fidelity: 9, confidence: 0.9, issues: [], notes_md: 'ok', ac_checklist: ac },
+  narcUnbacked: { functional_fidelity: 4, confidence: 0.9, issues: [nit], notes_md: 'hm', ac_checklist: ac },
+  narcLowConf: { functional_fidelity: 7, confidence: 0.2, issues: [], notes_md: 'unsure', ac_checklist: ac },
+  qualityPass: { code_quality: 9, economy: 9, confidence: 0.9, issues: [], notes_md: 'fine' },
+  qualityUnbacked: { code_quality: 2, economy: 8, confidence: 0.9, issues: [nit], notes_md: 'meh' },
+  qualityBacked: { code_quality: 2, economy: 8, confidence: 0.9, issues: [major], notes_md: 'broken' },
+  hackerPass: { security_score: 9, confidence: 0.9, issues: [], notes_md: '', surfaces_checked: ['a.js'] },
+  hackerUnbacked: { security_score: 4, confidence: 0.9, issues: [nit], notes_md: '', surfaces_checked: ['a.js'] },
+  effPass: { efficiency_score: 9, confidence: 0.9, issues: [], notes_md: '', expensive_patterns_checked: ['loop'] },
+};
+
+// The server's half: what POST /tasks/:id/grade does to the body ship.js sends —
+// the same two calls the route makes, in the same order.
+function serverGrade(panelResult) {
+  const body = buildGradePayload(panelResult, ['a.js']);
+  const scored = validateAndScore(body.subagent_output, body.signals);
+  return serverSideGuards(scored, { committedFiles: ['a.js'], builderRank: 'archon', diffStats: null });
+}
+
+// ---- 1. the helper reads only the policy's own marker ---------------------
+
+await test('an unbacked low cq is listed; the axes that were fine are not', async () => {
+  const q = await row(quality, OUT.qualityUnbacked);
+  assert.equal(q.verdict, 'concerns');
+  assert.deepEqual(unbackedLowScores([q], { threshold: THRESHOLD }), [{ kind: 'quality', axis: 'code_quality', score: 2 }]);
+});
+
+await test('a low score BACKED by a major finding is not unbacked (the worker stays fail)', async () => {
+  const q = await row(quality, OUT.qualityBacked);
+  assert.equal(q.verdict, 'fail');
+  assert.deepEqual(unbackedLowScores([q], { threshold: THRESHOLD }), []);
+});
+
+await test('the exempt Hacker never appears: its unbacked low score stays a hard fail', async () => {
+  const h = await row(hacker, OUT.hackerUnbacked);
+  assert.equal(h.verdict, 'fail', 'the security lens is fail-closed (task 1002663)');
+  assert.deepEqual(unbackedLowScores([h], { threshold: THRESHOLD }), []);
+});
+
+await test('an errored worker and junk input yield []', () => {
+  assert.deepEqual(unbackedLowScores([failResult({ notesMd: 'x', error: 'parse_error' })], { threshold: THRESHOLD }), []);
+  assert.deepEqual(unbackedLowScores(null, { threshold: THRESHOLD }), []);
+  assert.deepEqual(unbackedLowScores('workers', { threshold: THRESHOLD }), []);
+  assert.deepEqual(unbackedLowScores([null, 'x', { policy_downgrade: UNBACKED_SCORE_DOWNGRADE, scores: 'junk' }], { threshold: THRESHOLD }), []);
+});
+
+// ---- 2. runWorker keeps the marker (defect 1) -----------------------------
+
+await test('runWorker carries policy_downgrade onto the worker row', async () => {
+  const q = await row(quality, OUT.qualityUnbacked);
+  assert.equal(q.policy_downgrade, UNBACKED_SCORE_DOWNGRADE);
+});
+
+await test('an ordinary worker row keeps its exact shape (no policy_downgrade key)', async () => {
+  const q = await row(quality, OUT.qualityPass);
+  assert.equal('policy_downgrade' in q, false);
+});
+
+// ---- 3. aggregatePanel records it, and never claims a PASS the server refuses
+
+await test('Quality unbacked: the panel records unbacked_scores and names it in the notes', async () => {
+  const r = aggregatePanel([await row(narc, OUT.narcPass), await row(quality, OUT.qualityUnbacked), await row(hacker, OUT.hackerPass), await row(efficiency, OUT.effPass)]);
+  assert.equal(r.signals.panel_outcome, 'concerns');
+  assert.equal(r.passed, false);
+  assert.deepEqual(r.signals.unbacked_scores, [{ kind: 'quality', axis: 'code_quality', score: 2 }]);
+  assert.match(r.notes_md, /unbacked score: quality code_quality 2\/10/);
+});
+
+await test('Narc unbacked low ff: the panel says CONCERNS, not a PASS the server will fail (defect 2)', async () => {
+  const r = aggregatePanel([await row(narc, OUT.narcUnbacked), await row(quality, OUT.qualityPass), await row(hacker, OUT.hackerPass), await row(efficiency, OUT.effPass)]);
+  assert.equal(r.signals.panel_outcome, 'concerns', 'every gating worker passed, but ff 4 fails the server gate');
+  assert.equal(r.passed, false);
+  assert.equal(r.signals.confidence, FALLTHROUGH_CONFIDENCE, 'concerns forwards the fall-through confidence');
+  assert.match(r.notes_md, /functional_fidelity 4 is below 6/);
+  assert.deepEqual(r.signals.unbacked_scores, [{ kind: 'narc', axis: 'functional_fidelity', score: 4 }]);
+});
+
+await test('negative control: a Narc concerns with ff at/above threshold still PASSES (the Narc is advisory, task 481)', async () => {
+  const r = aggregatePanel([await row(narc, OUT.narcLowConf), await row(quality, OUT.qualityPass), await row(hacker, OUT.hackerPass), await row(efficiency, OUT.effPass)]);
+  assert.equal(r.signals.panel_outcome, 'pass');
+  assert.equal(r.passed, true);
+  assert.equal('unbacked_scores' in r.signals, false, 'an ordinary grade keeps its signals shape');
+});
+
+// ---- 4. not loosened: the server still refuses every unbacked low score ----
+
+await test('the server still refuses both shapes — an unbacked low score never passes', async () => {
+  const qualityShape = aggregatePanel([await row(narc, OUT.narcPass), await row(quality, OUT.qualityUnbacked), await row(hacker, OUT.hackerPass), await row(efficiency, OUT.effPass)]);
+  const narcShape = aggregatePanel([await row(narc, OUT.narcUnbacked), await row(quality, OUT.qualityPass), await row(hacker, OUT.hackerPass), await row(efficiency, OUT.effPass)]);
+  for (const [label, r] of [['quality', qualityShape], ['narc', narcShape]]) {
+    const g = serverGrade(r);
+    assert.equal(g.passed, false, `${label}: the server gate must still fail it`);
+    assert.ok(Array.isArray(g.signals.unbacked_scores) && g.signals.unbacked_scores.length === 1, `${label}: the list rides into the stored signals`);
+  }
+});
+
+// ---- 5. the card tells the truth (defect 3) --------------------------------
+
+await test('the card reads UNBACKED LOW SCORE, names the reviewer, and never says "fix the issues"', async () => {
+  const g = serverGrade(aggregatePanel([await row(narc, OUT.narcPass), await row(quality, OUT.qualityUnbacked), await row(hacker, OUT.hackerPass), await row(efficiency, OUT.effPass)]));
+  const out = formatGradeOutcome(g, 1002903);
+  assert.match(out, /UNBACKED LOW SCORE/);
+  assert.match(out, /quality: code_quality 2\/10 — no major or blocker finding/);
+  assert.match(out, /nothing listed to fix/);
+  assert.match(out, /ship\.js 1002903 --regrade/);
+  assert.match(out, /override-request/);
+  assert.doesNotMatch(out, /Fix the issues above/);
+  assert.ok(out.includes(CARDS.grade_unbacked_score.happened), 'the plain-language card follows');
+});
+
+await test('the card falls back to signals.workers for a grade recorded before unbacked_scores', async () => {
+  const g = serverGrade(aggregatePanel([await row(narc, OUT.narcPass), await row(quality, OUT.qualityUnbacked), await row(hacker, OUT.hackerPass), await row(efficiency, OUT.effPass)]));
+  delete g.signals.unbacked_scores;
+  assert.match(formatGradeOutcome(g, 7), /quality: code_quality 2\/10/);
+});
+
+await test('the card steps aside when a finding IS substantive — the ordinary FAIL block lists it', async () => {
+  const g = serverGrade(aggregatePanel([await row(narc, OUT.narcPass), await row(quality, OUT.qualityUnbacked), await row(hacker, OUT.hackerPass), await row(efficiency, OUT.effPass)]));
+  g.issues = [...g.issues, { severity: 'blocker', file: 'b.js', summary: 'real problem', worker: 'hacker' }];
+  const out = formatGradeOutcome(g, 7);
+  assert.doesNotMatch(out, /UNBACKED LOW SCORE/);
+  assert.match(out, /Fix the issues above/);
+});
+
+await test('the card steps aside when a gating worker hard-failed the panel', async () => {
+  const g = serverGrade(aggregatePanel([await row(narc, OUT.narcPass), await row(quality, OUT.qualityUnbacked), await row(hacker, OUT.hackerUnbacked), await row(efficiency, OUT.effPass)]));
+  assert.equal(g.signals.panel_outcome, 'fail', 'the exempt Hacker hard-fails');
+  assert.doesNotMatch(formatGradeOutcome(g, 7), /UNBACKED LOW SCORE/);
+});
+
+await test('a passing grade never gets the branch', async () => {
+  const g = serverGrade(aggregatePanel([await row(narc, OUT.narcPass), await row(quality, OUT.qualityPass), await row(hacker, OUT.hackerPass), await row(efficiency, OUT.effPass)]));
+  assert.equal(g.passed, true);
+  assert.doesNotMatch(formatGradeOutcome(g, 7), /UNBACKED LOW SCORE/);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/hall_preview_scrub.mjs

@@ -0,0 +1,214 @@
+// tests/hall_preview_scrub.mjs — the hall-preview fixtures carry stand-ins, never real
+// people (task 1003647).
+//
+// scripts/hall-preview/refresh-fixtures.js snapshots live API responses into COMMITTED
+// fixtures. Before this task it wrote them verbatim, so the repo held real builders'
+// GitHub logins, names, avatars and GitHub ids — and, in me.json, one builder's credit
+// balance and month-to-date spend. The fix lives in the writer (scrub-identity.js, run on
+// every snapshot before it is written), because a one-off clean-up of the output re-leaks
+// on the next refresh. These tests pin:
+//   1. the scheme — one stand-in per person, absence preserved, the account's own money
+//      figures fixed, everything that is not a person left alone;
+//   2. that it is a fixed point, which is what lets (4) work;
+//   3. that the WRITER applies it — driven with a fake API into a temp dir, no network;
+//   4. that every fixture checked in today is already scrubbed.
+//
+// Every "real" identity below is invented for the test.
+//
+// Run:  node --test tests/hall_preview_scrub.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const FIXTURES = path.join(ROOT, 'scripts', 'hall-preview', 'fixtures');
+const {
+  createScrubber, isOwnAccountFixture, highestStandIn, rewriteScalars, GHOST_AVATAR_URL,
+} = require('../scripts/hall-preview/scrub-identity.js');
+const { refreshFixtures, scrubFixturesOnDisk } = require('../scripts/hall-preview/refresh-fixtures.js');
+
+const REAL_AVATAR = 'https://avatars.githubusercontent.com/u/87654321?v=4';
+const liveMe = () => ({
+  builder: {
+    id: '95', github_id: '87654321', github_login: 'Real-Person', display_name: 'Real Person',
+    avatar_url: REAL_AVATAR, total_credits: 4321, karma: 7, rank: 'metic', monthly_budget_usd: null,
+    anthropic_email: null,
+  },
+  cost: { spend_mtd_usd: 123.45, budget_mtd_usd: null },
+  active_claims: [{ task_id: '2167', title: 'Check in the hall preview harness', worktree_name: 'frontend-redesign-ux' }],
+});
+const liveDirectory = () => ({
+  builders: [
+    { id: '95', github_login: 'real-person', display_name: 'Real Person', avatar_url: REAL_AVATAR },
+    { id: '7', github_login: 'other-human', display_name: '', avatar_url: null, total_credits: 900 },
+  ],
+});
+const liveRequests = () => ({
+  requests: [{
+    id: '3', requested_by: '7', requested_by_login: 'other-human', requested_by_name: 'Other Human',
+    requested_by_avatar_url: 'https://avatars.githubusercontent.com/u/1234567?v=4',
+    needs_builder_login: null, needs_builder_name: null, needs_builder_avatar_url: null,
+    created_by: '1000025', worktree_name: 'keep-this-name',
+  }],
+  tasks: [{ id: '9', credits_reward: 30, sandbox_review: { by: 'Real-Person', at: '2026-09-01T00:00:00Z' } }],
+  gate: [{ number: 12, author: 'other-human', head_sha: 'abc123' }],
+  modules: [{ key: 'ideas', author: 'Cloud Bongos' }],
+});
+
+// Every string anywhere in a value, for "does this identity survive anywhere" checks.
+function allStrings(v, out = []) {
+  if (typeof v === 'string') out.push(v);
+  else if (Array.isArray(v)) v.forEach((x) => allStrings(x, out));
+  else if (v && typeof v === 'object') Object.values(v).forEach((x) => allStrings(x, out));
+  return out;
+}
+
+test('a person becomes ONE stand-in everywhere: login, name, avatar and GitHub id together', () => {
+  const s = createScrubber();
+  const me = s.scrub(liveMe(), { ownAccount: true });
+  const dir = s.scrub(liveDirectory());
+  const req = s.scrub(liveRequests());
+
+  assert.equal(me.builder.github_login, 'builder-1');
+  assert.equal(me.builder.display_name, 'Builder 1', 'the name travels with the login beside it');
+  assert.equal(me.builder.avatar_url, GHOST_AVATAR_URL);
+  assert.equal(me.builder.github_id, '1', 'a GitHub id follows its person, and keeps its type');
+  // The same person in another file, spelled with different case, is still person 1.
+  assert.equal(dir.builders[0].github_login, 'builder-1');
+  assert.equal(dir.builders[0].display_name, 'Builder 1');
+  // A second person, first met as a directory row, then as a requester.
+  assert.equal(dir.builders[1].github_login, 'builder-2');
+  assert.equal(req.requests[0].requested_by_login, 'builder-2');
+  assert.equal(req.requests[0].requested_by_name, 'Builder 2', 'a <who>_name pairs with <who>_login');
+  assert.equal(req.requests[0].requested_by_avatar_url, GHOST_AVATAR_URL);
+  // A login in a `by` field (who approved a staged change) and a PR author.
+  assert.equal(req.tasks[0].sandbox_review.by, 'builder-1');
+  assert.equal(req.gate[0].author, 'builder-2');
+
+  const leftovers = [me, dir, req].flatMap((d) => allStrings(d))
+    .filter((v) => /real-person|real person|other-human|other human|87654321|1234567/i.test(v));
+  assert.deepEqual(leftovers, [], 'no real identity survives anywhere in the output');
+});
+
+test('absence is preserved: null stays null and "" stays ""', () => {
+  const dir = createScrubber().scrub(liveDirectory());
+  assert.equal(dir.builders[1].display_name, '', 'the pages fall back to the login when a name is empty');
+  assert.equal(dir.builders[1].avatar_url, null, 'the pages draw initials when there is no avatar');
+  const req = createScrubber().scrub(liveRequests());
+  assert.equal(req.requests[0].needs_builder_login, null);
+  assert.equal(req.requests[0].needs_builder_avatar_url, null);
+});
+
+test("the account's own balance and spend become fixed values; other builders keep their numbers", () => {
+  const s = createScrubber();
+  const me = s.scrub(liveMe(), { ownAccount: true });
+  assert.equal(me.builder.total_credits, 1000);
+  assert.equal(me.builder.karma, 10);
+  assert.equal(me.cost.spend_mtd_usd, 42, 'month-to-date spend is private wherever it appears');
+  assert.equal(me.cost.budget_mtd_usd, null, 'an unset budget stays unset');
+  const totals = s.scrub({ handle: 'real-person', cross_project: { totals: { credits: 4890, karma: 6, projects: 2 } } }, { ownAccount: true });
+  assert.deepEqual(totals.cross_project.totals, { credits: 1000, karma: 10, projects: 2 });
+  // Not the account's own file: a stand-in's balance is nobody's, and the leaderboard
+  // preview needs real magnitudes to be worth looking at.
+  assert.equal(createScrubber().scrub(liveDirectory()).builders[1].total_credits, 900);
+});
+
+test('what is not a person is left exactly alone', () => {
+  const s = createScrubber();
+  const me = s.scrub(liveMe(), { ownAccount: true });
+  const req = s.scrub(liveRequests());
+  assert.equal(me.builder.id, '95', 'instance-local ids stay — the harness routes on them');
+  assert.equal(me.builder.rank, 'metic');
+  assert.deepEqual(me.active_claims, liveMe().active_claims, 'task ids, titles and worktree names are project content');
+  assert.equal(req.requests[0].worktree_name, 'keep-this-name', 'a <x>_name with no <x>_login is not a person');
+  assert.equal(req.requests[0].created_by, '1000025', 'a numeric *_by is a builder id, not a login');
+  assert.equal(req.tasks[0].credits_reward, 30, "a task's bounty is not anyone's balance");
+  assert.equal(req.modules[0].author, 'Cloud Bongos', "a module's author credit names an organisation");
+});
+
+test('scrubbing is a fixed point, and a new run numbers above the stand-ins already in use', () => {
+  const s = createScrubber();
+  const once = [s.scrub(liveMe(), { ownAccount: true }), s.scrub(liveDirectory()), s.scrub(liveRequests())];
+  const again = createScrubber();
+  const twice = [again.scrub(once[0], { ownAccount: true }), again.scrub(once[1]), again.scrub(once[2])];
+  assert.deepEqual(twice, once);
+
+  const texts = once.map((d) => JSON.stringify(d));
+  assert.equal(highestStandIn(texts), 2);
+  const later = createScrubber({ firstNumber: highestStandIn(texts) + 1 }).scrub({ github_login: 'a-newcomer' });
+  assert.equal(later.github_login, 'builder-3', 'a newcomer never collides with a stand-in on disk');
+});
+
+test('rewriteScalars replaces only the changed values and keeps a hand-written layout', () => {
+  const text = '{\n  "rows": [ { "github_login": "real-person", "tags": ["a", "b"] },\n            { "github_login": null } ],\n  "n": 3\n}\n';
+  const next = rewriteScalars(text, createScrubber().scrub(JSON.parse(text)));
+  assert.equal(next, text.replace('"real-person"', '"builder-1"'));
+});
+
+test('isOwnAccountFixture names the snapshotting account\'s own files', () => {
+  assert.equal(isOwnAccountFixture('me'), true);
+  assert.equal(isOwnAccountFixture('me__credits'), true);
+  assert.equal(isOwnAccountFixture('members'), false);
+  assert.equal(isOwnAccountFixture('leaderboard'), false);
+});
+
+test('the WRITER scrubs: refreshFixtures never puts the live identity on disk', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'hall-fixtures-'));
+  try {
+    const responses = { '/me': liveMe(), '/builders/directory': liveDirectory(), '/help-requests': liveRequests() };
+    const api = { request: async (_m, p) => (p in responses ? { ok: true, status: 200, data: responses[p] } : { ok: false, status: 404 }) };
+    const snapshots = [['me', 'me'], ['builders/directory', 'builders__directory'], ['help-requests', 'help-requests'], ['audit-log', 'audit-log']];
+    const wrote = await refreshFixtures({ api, dir, snapshots, log: () => {} });
+    assert.equal(wrote, 3, 'the 404 is skipped, as before');
+
+    const onDisk = fs.readdirSync(dir).map((f) => fs.readFileSync(path.join(dir, f), 'utf8')).join('\n');
+    for (const real of ['Real-Person', 'real-person', 'Real Person', 'other-human', 'Other Human', '87654321', '1234567', '4321', '123.45']) {
+      assert.ok(!onDisk.includes(real), `${real} must never reach the fixture directory`);
+    }
+    const me = JSON.parse(fs.readFileSync(path.join(dir, 'me.json'), 'utf8'));
+    assert.equal(me.builder.github_login, 'builder-1');
+    assert.equal(me.builder.total_credits, 1000, 'me.json is the account\'s own file');
+    const directory = JSON.parse(fs.readFileSync(path.join(dir, 'builders__directory.json'), 'utf8'));
+    assert.equal(directory.builders[0].github_login, 'builder-1', 'one run, one registry: the same person across files');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('--scrub-only rewrites a hand-written fixture in place, once', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'hall-fixtures-'));
+  try {
+    const file = path.join(dir, 'connections.json');
+    fs.writeFileSync(file, '{ "connections": [ { "handle": "other-human", "display_name": "Other Human", "avatar_url": "https://avatars.githubusercontent.com/u/1234567?v=4" } ] }\n');
+    assert.equal(scrubFixturesOnDisk({ dir, log: () => {} }), 1);
+    assert.equal(fs.readFileSync(file, 'utf8'),
+      `{ "connections": [ { "handle": "builder-1", "display_name": "Builder 1", "avatar_url": "${GHOST_AVATAR_URL}" } ] }\n`);
+    assert.equal(scrubFixturesOnDisk({ dir, log: () => {} }), 0, 'a second pass finds nothing to change');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('every committed fixture is already scrubbed — no real person is checked in', () => {
+  const files = fs.readdirSync(FIXTURES).filter((f) => f.endsWith('.json')).sort();
+  const texts = files.map((f) => fs.readFileSync(path.join(FIXTURES, f), 'utf8'));
+  const s = createScrubber({ firstNumber: highestStandIn(texts) + 1 });
+  const dirty = files.filter((file, i) => {
+    const data = JSON.parse(texts[i]);
+    try {
+      assert.deepEqual(s.scrub(data, { ownAccount: isOwnAccountFixture(file.slice(0, -5)) }), data);
+      return false;
+    } catch {
+      return true;
+    }
+  });
+  assert.deepEqual(dirty, [],
+    'these fixtures carry a real login, name, avatar, GitHub id or private figure — run '
+    + '`node scripts/hall-preview/refresh-fixtures.js --scrub-only` and commit the result');
+});

package/tests/hall_records.mjs

@@ -0,0 +1,85 @@
+// tests/hall_records.mjs — the hall's page records live one file per family (task 1003499).
+//
+// WHY. modules/hall-ui/CLAUDE.md used to carry every page family's "**The X landed
+// next (task N)**" record, each appended immediately above the same heading. So every
+// concurrent hall task inserted at the SAME line and collided with every other one —
+// the file needed five hand-resolved merges in September 2026 alone, and each new
+// record made the next collision likelier. Git cannot conflict on two branches that
+// each ADD a file, so the records moved to modules/hall-ui/records/, one per family,
+// and CLAUDE.md keeps a pointer. This pins the convention, so the next record lands
+// as a file rather than as a fifteenth section of the one file every hall task edits.
+//
+// Run:  node tests/hall_records.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const DOC = path.join(ROOT, 'modules/hall-ui/CLAUDE.md');
+const DIR = path.join(ROOT, 'modules/hall-ui/records');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+const doc = fs.readFileSync(DOC, 'utf8').replace(/\r\n/g, '\n');
+const records = fs.existsSync(DIR) ? fs.readdirSync(DIR).filter((f) => f.endsWith('.md')).sort() : [];
+
+// The shape every record took: a bold lead-in naming a page family and saying it
+// "landed" (first / next / last / at / on). Anchored to a line start so prose that
+// merely uses the word stays legal.
+const RECORD_LEAD = /^\*\*(?:The|THE)\b[^*\n]*\blanded\b/gm;
+
+test('the hall doc carries no page record of its own', () => {
+  const leads = doc.match(RECORD_LEAD) || [];
+  assert.deepEqual(leads, [],
+    'a page record was added to modules/hall-ui/CLAUDE.md — give it its own file in modules/hall-ui/records/ instead (task 1003499)');
+});
+
+test('the hall doc points at the records, and says a new one is a new file', () => {
+  const at = doc.indexOf('### Page records');
+  assert.ok(at > 0, 'the "### Page records" pointer is gone, so nothing tells an agent the records exist');
+  const pointer = doc.slice(at, doc.indexOf('\n### ', at + 1));
+  assert.match(pointer, /\]\(records\/\)/, 'the pointer links the records directory');
+  assert.match(pointer, /head -n 1 modules\/hall-ui\/records\/\*\.md/, 'and says how to find the record for a page');
+  assert.match(pointer, /adds a NEW file/, 'and says a new record is a new file, not a new section here');
+});
+
+test('the records directory holds the records', () => {
+  assert.ok(records.length >= 11, `expected the moved records in modules/hall-ui/records/, found ${records.length}`);
+});
+
+test('every record opens with a one-line title naming its pages and its task', () => {
+  // `head -n 1 records/*.md` is the index — there is deliberately no hand-kept list,
+  // because a list every record appends to would be the same collision in a new place.
+  for (const f of records) {
+    const text = fs.readFileSync(path.join(DIR, f), 'utf8').replace(/\r\n/g, '\n');
+    const [first, blank, ...rest] = text.split('\n');
+    assert.match(first, /^# \S/, `${f}: line 1 must be the "# " title that head -n 1 lists`);
+    assert.match(first, /\btasks? \d{7}\b/, `${f}: the title names the task(s) the record belongs to`);
+    assert.equal(blank, '', `${f}: a blank line follows the title`);
+    assert.ok(rest.join('\n').trim().length > 200, `${f}: the record has a body`);
+    assert.equal((text.match(/^# /gm) || []).length, 1, `${f}: one title per file — a second one is a second record`);
+  }
+});
+
+test('every relative link in a record resolves from records/', () => {
+  // records/ sits one folder below CLAUDE.md, so a section copied out of it with its
+  // `../../docs/...` links intact points one level short — the trap this move met.
+  for (const f of records) {
+    const text = fs.readFileSync(path.join(DIR, f), 'utf8');
+    for (const [, href] of text.matchAll(/\]\(([^)\s]+)\)/g)) {
+      if (/^(?:[a-z]+:|#|\/)/i.test(href)) continue;
+      const target = path.resolve(DIR, href.split('#')[0]);
+      assert.ok(fs.existsSync(target), `${f}: link ${href} resolves to nothing (${path.relative(ROOT, target)})`);
+    }
+  }
+});
+
+console.log(`\nhall page records (task 1003499) tests: ${passed} passed, ${failed} failed`);
+process.exitCode = failed > 0 ? 1 : 0;

package/tests/helpers.mjs

@@ -987,3 +987,28 @@ export function namesFieldKey(src, key) {
     || new RegExp(`\\.${k}\\b`).test(src)
     || new RegExp(`=\\s*${k}\\b`).test(src);
 }
+
+// macShapedTools — write BSD/macOS-shaped `stat` and `wc` into binDir, for a shell
+// script under test to meet first on PATH (task 1004170).
+//
+// The backup scripts died on every Mac builder's machine and passed on CI's Linux, so
+// the red was invisible to anyone reading Actions. These bring the two differences to
+// any platform: BSD stat refuses GNU's `-c` outright, and BSD wc pads the number it
+// prints ("      11"). Only the stdin forms the scripts use are modelled (`wc -c < f`,
+// `... | wc -l`); any stat call other than `-c` fails loudly rather than pretend to be
+// BSD. Shared because both backup suites need the same pair.
+export function macShapedTools(binDir) {
+  const realWc = execFileSync('bash', ['-c', 'command -v wc'], { encoding: 'utf8' }).trim();
+  fs.writeFileSync(path.join(binDir, 'stat'), [
+    '#!/bin/bash',
+    'if [ "$1" = -c ]; then echo "stat: illegal option -- c" >&2; exit 1; fi',
+    'echo "macShapedTools: only the -c refusal is modelled, not BSD stat itself" >&2; exit 1',
+    '',
+  ].join('\n'), { mode: 0o755 });
+  fs.writeFileSync(path.join(binDir, 'wc'), [
+    '#!/bin/bash',
+    `n=$("${realWc}" "$@") || exit $?`,
+    'printf "%8s\\n" "${n//[[:space:]]/}"',
+    '',
+  ].join('\n'), { mode: 0o755 });
+}

package/tests/instance_db_migrated_on_code_move.mjs

@@ -24,6 +24,8 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { upgradeInvocation } from '../scripts/gds/provision-core-upgrade.js';
 import { migrateCmd, standaloneMigrateCmd, dbName } from '../scripts/gds/provision-repo.js';
+import { CORE_MIGRATE_SCRIPT } from '../scripts/gds/upgrade-migrate.js';
+import { INSTANCE_MIGRATE_SCRIPT } from '../scripts/gds/init.js';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const tenant = { slug: 'charter', db_name: 'charter_db', hosting_shape: 'co-tenant', port: 3107, status: 'active' };
@@ -35,7 +37,12 @@ test('bongos upgrade migrates before it restarts, and only --skip-migrate opts o
   assert.ok(migrate > 0, 'the upgrade flow runs migrate');
   assert.ok(restart > migrate, 'the restart that makes new code live comes AFTER migrate');
   assert.match(src.slice(migrate - 200, migrate), /if \(!opts\.skipMigrate\)/, 'the only way past migrate is the explicit flag');
-  assert.match(src, /run\('npm', \['run', 'migrate'\]/, 'migrate is the instance scaffold script, i.e. the core migrate.sh');
+  // WHICH command is upgrade-migrate.js's call (task 1004274): the instance's declared script,
+  // else the one a scaffold declares — the core migrate.sh either way, so an adopted project with
+  // no scripts is migrated rather than rolled back. tests/upgrade_migrate.mjs exercises both.
+  assert.match(src, /function runMigrate\([^)]*\) \{\n\s*const \{ cmd, args, env \} = require\('\.\/upgrade-migrate'\)\.migratePlan\(instanceDir\)/,
+    'the migrate step spawns what migratePlan decides');
+  assert.equal(`bash ${CORE_MIGRATE_SCRIPT}`, INSTANCE_MIGRATE_SCRIPT, 'migrate is the instance scaffold script, i.e. the core migrate.sh');
 });
 
 test('the control-plane runner targets the instance database, not its own', () => {

package/tests/integration_parked_ratchet.mjs

@@ -41,7 +41,18 @@ const { INTEGRATION, INTEGRATION_PARKED, KNOWN_FAILING } = require('../scripts/g
 // Two later readings — 2/2 locally on a clean database, and the first CI run after
 // the parking landed — showed the pass was the anomaly. No new breakage was parked
 // here; one straggler joined the cohort it always belonged to.
-const MAX_PARKED = 24;
+//
+// LOWERED 24 → 23 by task 1002863: consumer_layout_boot was fixed and un-parked, and the
+// ceiling follows it down so the freed slot cannot quietly be spent on a new failure.
+const MAX_PARKED = 23;
+
+// The one test that proves the PUBLISHED package works end to end: packaged, installed into
+// a consumer, installed again from its own shipped lockfile, migrated onto EMPTY databases,
+// and serving a database-backed route (tasks 2142 + 1002863 — "PROVE PUBLISH"). Every other
+// test runs the source tree; none installs the package and runs it. So while this one is
+// parked or unselected that guarantee silently does not exist — which is exactly how it sat,
+// parked, from task 1004034 until task 1002863 found out why it failed.
+const PUBLISH_PROOF = 'consumer_layout_boot';
 
 test('every parked entry names a test file that exists', () => {
   const ghosts = [...INTEGRATION_PARKED]
@@ -71,6 +82,18 @@ test('no test is parked in both INTEGRATION_PARKED and KNOWN_FAILING', () => {
     'parked in two places at once — pick the mechanism that owns each test.');
 });
 
+test('the packaged-core proof is selected by the integration lane and parked nowhere', () => {
+  assert.ok(fs.existsSync(path.join(TESTS_DIR, `${PUBLISH_PROOF}.mjs`)),
+    `tests/${PUBLISH_PROOF}.mjs is gone — nothing proves the published package installs, migrates and serves any more.`);
+  assert.ok(INTEGRATION.has(PUBLISH_PROOF),
+    `${PUBLISH_PROOF} is not in the INTEGRATION set, so either the DB-free unit gate would try to run it `
+    + '(it needs npm, a network and a Postgres) or no lane selects it at all.');
+  assert.ok(!INTEGRATION_PARKED.has(PUBLISH_PROOF) && !KNOWN_FAILING.has(PUBLISH_PROOF),
+    `${PUBLISH_PROOF} is parked. It is the only proof that the PUBLISHED core installs, migrates an `
+    + 'empty database and serves from it; parking it re-opens that gap without a single red check. '
+    + 'Fix the failure instead — or, if parking is truly the call, make it deliberately by editing this guard.');
+});
+
 test('the parked count is ratcheted and cannot grow silently', () => {
   const n = INTEGRATION_PARKED.size;
   assert.ok(n <= MAX_PARKED,

package/tests/plain_cards.mjs

@@ -167,7 +167,7 @@ test('the sign-in printers, the release refusals and the claim guard each print
     'scripts/gds/cli-lib.js': ['session_invalid', 'no_session'],
     'scripts/gds/release.js': ['no_active_claim', 'CLAIM_SESSION_MISMATCH'],
     'scripts/gds/claim.js': ['main_checkout_claim'],
-    'scripts/gds/ship-land.js': ['land_pending', 'reconcile_blocked'],
+    'scripts/gds/ship-land.js': ['land_pending', 'reconcile_blocked', 'merge_conflict'], // merge_conflict: task 1003499
     'scripts/gds/push-path-brief.js': ['no_push_credential'],
   };
   for (const [file, codes] of Object.entries(wired)) {