@bongos/core 1.19.1035 → 1.19.1037

package/tests/adr_0162_gate_citation.mjs

@@ -0,0 +1,167 @@
+// tests/adr_0162_gate_citation.mjs — "no new gates" is not what ADR 0162 decided; no surface
+// may cite 0162 as the reason something is a signal and not a gate (task 1004280).
+//
+// WHAT WENT WRONG. Task 1003573 corrected one slogan cited to ADR 0162 ("verdicts are advisory,
+// never self-executing" — ADR 0158 §2's rule; tests/adr_0162_citation.mjs pins that). A sibling
+// slogan rode along: "no new gates (ADR 0162)", "a signal, never a gate (ADR 0162)", "NOT A
+// PIPELINE GATE (ADR 0162)". It is broader than the ADR. 0162 retired REVIEW gates — a gate that
+// needs a particular person's approval before work can land — and its own table keeps four
+// automatic controls, three of which fail CLOSED (the grader among them). ADR 0241 ("What ADR 0162
+// actually forbids") states the test 0162 leaves behind: an automatic, state-read, rank-consistent
+// gate with a named escape hatch is admissible. So "this is not a gate because 0162" cites a rule
+// 0162 does not make, and it hides the surface's real reason for staying advisory.
+//
+// The surfaces keep their choice (most were right to stay advisory); only the reason changed:
+// 0162 for "no human approval in the land path", and the surface's own reason otherwise.
+//
+// WHAT THIS PINS. (1) The premise, read from the ADRs: 0162 keeps fail-closed automatic controls
+// and never says "no new gates"; 0241 says what 0162 forbids. (2) No tracked surface cites 0162
+// with the gate shorthand, in any of the shapes the 2026-09-25 sweep found.
+//
+// Run:  node --test tests/adr_0162_gate_citation.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => readFileSync(path.join(ROOT, rel), 'utf8');
+
+const ADR_0162 = 'docs/adr/0162-review-gates-retired-rank-consistent-ci-only.md';
+const ADR_0241 = 'docs/adr/0241-the-artist-gate-is-a-per-project-deploy-gate-that-reads-a-state.md';
+
+// A match is a line that gives 0162 as the reason something is not (or must not be) a gate.
+const GATE_SHORTHANDS = [
+  // The advisory claim, then 0162 as its source: "no new gates (ADR 0162)", "A SIGNAL, never a
+  // gate (ADR 0162)", "NOT A PIPELINE GATE (ADR 0162)", "no ship is newly gated (ADR 0162)",
+  // "WITHOUT adding a gate (ADR 0162)", "It gates NOTHING (ADR 0162 / ADR 0241)", "a new gate on
+  // the ship path (ADR 0162)", "It had to stay a signal (ADR 0162)", "never flips its exit (ADR 0162)".
+  /\b(?:no new gates?|never a gate|not a (?:pipeline )?gate|newly gated|adding a gate|gates nothing|new gate on the ship path|stay a signal|never flips its exit)\b[^\n()]{0,40}\(ADR 0162\b/i,
+  // 0162, then the shorthand as its gloss: "ADR 0162 — no new gates", "(ADR 0162: no new gates)",
+  // "[ADR 0162](…) (no new gates)".
+  /\b0162\b[\])]?\s*(?:\(|—|–|:)\s*no new gates?\b/i,
+  // A describe-only posture cited to 0162: "(describe, never confirm/flip — ADR 0162)". That is
+  // 0158 §2's rule — the sibling test's subject, in a shape it does not match.
+  /\bnever confirm\/flip\s*[—–-]\s*ADR 0162\b/i,
+];
+
+// Deliberately NOT corrected, each with its reason. Shrink-only: when one is fixed, delete its
+// row — the last test fails until you do, so a stale exemption cannot outlive what it excused.
+const KNOWN_DEFERRED = new Map([
+  // HARD-FLOOR surfaces (scripts/gds/gate-review.js HARD_FLOOR_GLOBS lists `.claude/hooks/`):
+  // even a comment-only edit escalates to the owner, which a citation fix does not justify on
+  // its own. Correct them with the next real edit (the redteam-patrol.yml precedent, task 1003573).
+  ['.claude/hooks/allow-rule-guard.js', 'hard-floor gate surface'],
+  ['.claude/hooks/git-guard.js', 'hard-floor gate surface'],
+  // A hall PAGE script: any edit under modules/*/public/ is UI work, so its ship files an artist
+  // review that holds the deploy (ADR 0241). A comment fix does not justify that; correct it
+  // with the next real edit to the page.
+  ['modules/hall-ui/public/studio.js', 'page script — an edit files an artist review'],
+]);
+
+const HISTORICAL = /^docs\/session-logs\//;
+// This file and its sibling quote the shapes they hunt, as examples.
+const SELF = new Set(['tests/adr_0162_gate_citation.mjs', 'tests/adr_0162_citation.mjs']);
+const TEXT = /\.(?:md|js|mjs|cjs|json|ya?ml|sql|sh|html|txt)$/;
+// A line that NAMES the slogan as its subject is discussing it, not citing by it.
+const DISCUSSES_SLOGAN = /paraphrase|shorthand/i;
+// Markdown link targets carry the ADR's filename, which would sit between a citation and its gloss.
+const stripLinkTargets = (s) => s.replace(/\]\([^)\s]*\)/g, ']');
+const continuation = (s) => (s || '').replace(/^\s*(?:\/\/+|#+|--|\*|>|-)?\s*/, '');
+
+function offendersIn(rel, text) {
+  const lines = stripLinkTargets(text).split('\n');
+  const hits = [];
+  for (let i = 0; i < lines.length; i++) {
+    const here = lines[i];
+    if (DISCUSSES_SLOGAN.test(here)) continue;
+    // Join the next line so a citation wrapped mid-phrase still reads as one; only a match
+    // that STARTS on this line is this line's.
+    const window = `${here} ${continuation(lines[i + 1])}`;
+    if (!/0162/.test(window)) continue;
+    for (const re of GATE_SHORTHANDS) {
+      const m = re.exec(window);
+      if (m && m.index < here.length) { hits.push(`${rel}:${i + 1}: ${here.trim().slice(0, 140)}`); break; }
+    }
+  }
+  return hits;
+}
+
+function trackedTextFiles() {
+  const r = spawnSync('git', ['ls-files', '-z'], { cwd: ROOT, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+  if (r.status !== 0) return null; // a packaged core is not a git checkout
+  return r.stdout.split('\0').filter((f) => f && TEXT.test(f));
+}
+
+test('the premise: ADR 0162 keeps automatic gates that fail closed, and never says "no new gates"', () => {
+  const adr0162 = read(ADR_0162);
+  assert.match(adr0162, /Review requirements on `main` are \*\*retired permanently\*\*/, 'what 0162 retired');
+  const failsClosed = adr0162.split('\n').filter((l) => /^\|.*\|\s*closed\s*\|\s*$/.test(l));
+  assert.ok(failsClosed.length >= 3,
+    `0162's compensating-controls table should keep >=3 controls that fail CLOSED (found ${failsClosed.length}) — `
+    + 'if the ADR changed, re-ask whether "no new gates" became its rule before re-pointing these citations');
+  assert.doesNotMatch(adr0162, /no new gates?/i, 'ADR 0162 never says "no new gates"');
+  assert.match(read(ADR_0241), /^## What ADR 0162 actually forbids$/m, 'ADR 0241 is where the narrower rule is written');
+});
+
+test('the detector recognises every shape the sweep corrected, and passes the true citations', () => {
+  const flag = (line) => offendersIn('probe.md', line).length > 0;
+  for (const bad of [
+    '- **ADR 0162 — no new gates.** This skill describes and recovers; it never inserts a human-approval step',
+    '// A SIGNAL, never a gate (ADR 0162): /ship-check shows it as an advisory row; ship.js and the grader never',
+    '// step is a signal, never a gate (ADR 0162): a non-zero exit reads `warn` (3 = no browser reads `skipped`).',
+    '// A NUDGE, never a gate (ADR 0162). "Is this UI work" is the ONE predicate the',
+    '    // human\'s OK on the before/after. A nudge, never a gate (ADR 0162).',
+    '// guess. Report-only — it never changes the outcome (ADR 0162: no new gates).',
+    '  // happy path pays nothing and no ship is newly gated (ADR 0162).',
+    '- **Relates to:** [ADR 0162](0162-review-gates-retired-rank-consistent-ci-only.md) (no new gates), [ADR 0197](0197-the-ui-design-module.md) (the kit)',
+    'or both. It had to stay a signal (ADR 0162).',
+    '- **Block the fourth attempt.** That is a new gate on the ship path (ADR 0162), and a wrong',
+    'shows them as an ADVISORY row that never flips its exit (ADR 0162). Not a grader worker',
+    '// NOT A PIPELINE GATE (ADR 0162): it gates no merge, no CI check, no ship.',
+    '// It gates NOTHING (ADR 0162 / ADR 0241): nothing here holds a ship or a deploy.',
+    '// pass and WITHOUT adding a gate (ADR 0162). Every case below that has a low',
+    '// read-only (describe, never confirm/flip — ADR 0162).',
+  ]) assert.ok(flag(bad), `should flag: ${bad}`);
+
+  for (const good of [
+    '- **Related:** ADR 0162 (no new human gates on the ship path)',
+    'No review requirement — gates are CI checks, not human approvals (ADR 0162).',
+    '- **Relates to:** [ADR 0162](0162-review-gates-retired-rank-consistent-ci-only.md) (review gates retired: no human approval in the land path)',
+    'no confirms, no status flips, and no new approval step on anyone\'s ship (ADR 0162). The remediation lines',
+    '// A NUDGE, never a gate: as a gate, the human\'s OK would be a person\'s approval in\n// the land path, which ADR 0162 retired.',
+    '// A SIGNAL, never a gate (ADR 0329, decisions 3-4): /ship-check shows it as an advisory row',
+    'It never holds a builder\'s ship, which is what keeps it compatible with ADR 0162.',
+    'This matters, because the shorthand "no new gates (ADR 0162)" is broader than the ADR',
+  ]) assert.ok(!flag(good), `should pass: ${good}`);
+});
+
+test('no tracked surface cites ADR 0162 as the reason something is not a gate', (t) => {
+  const files = trackedTextFiles();
+  if (!files) return t.skip('not a git checkout — nothing tracked to scan');
+  const offenders = [];
+  for (const rel of files) {
+    if (SELF.has(rel) || HISTORICAL.test(rel) || KNOWN_DEFERRED.has(rel)) continue;
+    let text;
+    try { text = readFileSync(path.join(ROOT, rel), 'utf8'); } catch { continue; }
+    if (!text.includes('0162')) continue;
+    offenders.push(...offendersIn(rel, text));
+  }
+  assert.deepEqual(offenders, [],
+    'these cite ADR 0162 for "no new gates" / "a signal, never a gate". 0162 retired gates that need a '
+    + 'particular person\'s approval in the land path, and keeps automatic gates that fail closed (ADR 0241). '
+    + 'Cite 0162 for "no human approval in the land path", and name the surface\'s own reason for staying advisory.');
+});
+
+test('every deferred exemption still has something to excuse (shrink-only)', (t) => {
+  if (!trackedTextFiles()) return t.skip('not a git checkout');
+  for (const [rel, why] of KNOWN_DEFERRED) {
+    let text = '';
+    try { text = read(rel); } catch { /* deleted: the exemption is stale too */ }
+    assert.ok(offendersIn(rel, text).length > 0,
+      `${rel} (${why}) no longer cites 0162 for the gate shorthand — delete its KNOWN_DEFERRED row`);
+  }
+});

package/tests/core_upgrade_owner_door.mjs

@@ -0,0 +1,444 @@
+// tests/core_upgrade_owner_door.mjs — a project's owner may move ITS core (task 1004174, ADR 0339).
+//
+// The owner's ruling (2026-09-26): only a project's owner upgrades it. The deploy door was
+// `core.pin.move` alone, so the owner of a hosted project below Archon could see they were
+// behind and never act. This file proves the widening is exactly that wide and no wider:
+//
+//   1. the owner of a TENANT row is admitted, to the preview and the move, for that row only;
+//   2. everyone else meets the unmodified atom gate, and a non-owner is refused byte-for-byte
+//      as before, whether or not the id exists;
+//   3. the platform's own row stays atom-only, even for the caller who owns it;
+//   4. the intent's actor names which door was used, and the runner's parse accepts both and
+//      nothing else (the id is interpolated into a shell command);
+//   5. the /deploy page shell admits a project owner and still refuses a stranger;
+//   6. a hosted project's hall hands its owner to the hub's door and never trusts a bad URL.
+//
+// These EXECUTE the real gate, router, page gate and shell.js; none of them reads source text.
+//
+// Run:  node tests/core_upgrade_owner_door.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// The session double must be installed BEFORE auth.js loads: auth.js destructures
+// lookupSession at require time (the tests/scouting_page_gate.mjs precedent).
+const dbKernel = require('../src/bongos/db-kernel.js');
+let nextSession = null;
+dbKernel.lookupSession = async () => nextSession;
+
+const auth = require('../src/bongos/auth.js');
+const seams = require('../src/module-seams.js');
+const catalog = require('../modules/government/catalog.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const AZ = require('../modules/provisioning/core-upgrade-authz.js');
+const { requestedByOf } = require('../scripts/gds/provision-core-upgrade.js');
+const { hubDeployUrl } = require('../src/bongos/routes/core-update.js');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed += 1; console.log(`  PASS  ${name}`); }
+  catch (e) { failed += 1; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// The cast. Builder 7 owns the hosted project hoodify-finance (a xenos on the hub, as
+// erikwils is); 8 is a stranger; 42 is an Archon. Builder 7 is also recorded as owning the
+// platform row here, which is the case the ruling must NOT open.
+const OWNER = { id: 7, rank: 'xenos' };
+const STRANGER = { id: 8, rank: 'xenos' };
+const ARCHON = { id: 42, rank: 'archon' };
+const TENANT = Object.freeze({ id: 41, slug: 'hoodify-finance', status: 'active', hosting_shape: 'cloud-host', owner_builder_id: 7 });
+const COTENANT = Object.freeze({ id: 43, slug: 'mercury', status: 'active', hosting_shape: 'co-tenant', owner_builder_id: 7 });
+const PLATFORM = Object.freeze({ id: 1, slug: 'cloudbongos', status: 'active', hosting_shape: 'control-plane', owner_builder_id: 7 });
+const ROWS = new Map([[41, TENANT], [43, COTENANT], [1, PLATFORM]]);
+
+// ── 1. the predicate ──────────────────────────────────────────────────────────
+
+console.log('\nwho owns an upgradable project:');
+
+await t('the owner of a cloud-host or co-tenant row owns it', () => {
+  assert.equal(AZ.ownsUpgradableProject(TENANT, OWNER), true);
+  assert.equal(AZ.ownsUpgradableProject(COTENANT, OWNER), true);
+  assert.equal(AZ.ownsUpgradableProject(TENANT, { id: '7' }), true, 'ids compare as ids, not as types');
+});
+
+await t('the platform row is never an owner-movable project, even for its recorded owner', () => {
+  assert.equal(AZ.ownsUpgradableProject(PLATFORM, OWNER), false);
+  assert.equal(AZ.OWNER_SHAPES.has('control-plane'), false);
+});
+
+await t('it fails closed on every missing piece', () => {
+  assert.equal(AZ.ownsUpgradableProject(TENANT, STRANGER), false, 'someone else');
+  assert.equal(AZ.ownsUpgradableProject(null, OWNER), false, 'no row');
+  assert.equal(AZ.ownsUpgradableProject(TENANT, null), false, 'no builder');
+  assert.equal(AZ.ownsUpgradableProject(TENANT, { id: null }), false, 'a builder with no id');
+  assert.equal(AZ.ownsUpgradableProject({ ...TENANT, owner_builder_id: null }, { id: null }), false, 'null never equals null');
+  assert.equal(AZ.ownsUpgradableProject({ ...TENANT, hosting_shape: 'something-new' }, OWNER), false, 'a later shape is excluded by omission');
+});
+
+// ── 2. the middleware ─────────────────────────────────────────────────────────
+
+console.log('\nthe OR gate:');
+
+// The atom gate as a spy: admits an Archon, refuses everyone else with the ONE body the
+// door has always sent. Nothing about the refusal depends on the id.
+function pinGateSpy() {
+  const spy = (req, res, next) => {
+    spy.calls += 1;
+    if (req.builder && req.builder.rank === 'archon') return next();
+    res.statusCode = 403;
+    res.body = { ok: false, error: 'forbidden', permission: 'core.pin.move' };
+    return undefined;
+  };
+  spy.calls = 0;
+  return spy;
+}
+
+async function runGate({ id, builder, getInstanceById, log }) {
+  const pinGate = pinGateSpy();
+  const lookups = [];
+  const provisioning = {
+    getInstanceById: getInstanceById || (async (_db, n) => { lookups.push(n); return ROWS.get(n) || null; }),
+  };
+  const gate = AZ.requireOwnProjectOrPin({ pinGate, provisioning, pool: {}, log });
+  const req = { params: { id }, builder };
+  const res = {};
+  let admitted = false;
+  await gate(req, res, () => { admitted = true; });
+  return { admitted, pinCalls: pinGate.calls, authority: req.coreUpgradeAuthority, res, lookups };
+}
+
+await t('the owner is admitted to THEIR project without meeting the atom', async () => {
+  const r = await runGate({ id: '41', builder: OWNER });
+  assert.equal(r.admitted, true);
+  assert.equal(r.pinCalls, 0, 'ownership answered first');
+  assert.equal(r.authority, 'owner');
+});
+
+await t('a stranger meets the atom and is refused', async () => {
+  const r = await runGate({ id: '41', builder: STRANGER });
+  assert.equal(r.admitted, false);
+  assert.equal(r.pinCalls, 1);
+  assert.equal(r.authority, 'pin');
+  assert.equal(r.res.statusCode, 403);
+});
+
+await t('the refusal is byte-identical whether the id exists or not', async () => {
+  const real = await runGate({ id: '41', builder: STRANGER });
+  const ghost = await runGate({ id: '999', builder: STRANGER });
+  assert.deepEqual(ghost.res, real.res, 'a stranger learns nothing about which ids exist');
+});
+
+await t('the owner of the platform row is NOT admitted by ownership', async () => {
+  const r = await runGate({ id: '1', builder: OWNER });
+  assert.equal(r.admitted, false);
+  assert.equal(r.pinCalls, 1, 'the platform row stays on the atom');
+});
+
+await t('an Archon is admitted by the atom, on a project they do not own', async () => {
+  const r = await runGate({ id: '41', builder: ARCHON });
+  assert.equal(r.admitted, true);
+  assert.equal(r.pinCalls, 1);
+  assert.equal(r.authority, 'pin', 'so the actor records the Archon door');
+});
+
+await t('an id that is not a plain positive integer is never looked up', async () => {
+  for (const id of ['abc', '0', '-1', '1e3', '41; DROP TABLE x', '', ' 41', '041x']) {
+    const r = await runGate({ id, builder: OWNER });
+    assert.deepEqual(r.lookups, [], `"${id}" reached the database`);
+    assert.equal(r.admitted, false, `"${id}" admitted a xenos`);
+    assert.equal(r.pinCalls, 1, `"${id}" skipped the atom`);
+  }
+});
+
+await t('a failing ownership read falls to the atom: it can deny an owner, never admit anyone', async () => {
+  const logged = [];
+  const log = { error: (m) => logged.push(m) };
+  const boom = async () => { throw new Error('connection reset (row: secret-owner-data)'); };
+  const owner = await runGate({ id: '41', builder: OWNER, getInstanceById: boom, log });
+  assert.equal(owner.admitted, false, 'an outage denies the owner');
+  assert.equal(owner.pinCalls, 1);
+  const archon = await runGate({ id: '41', builder: ARCHON, getInstanceById: boom, log });
+  assert.equal(archon.admitted, true, 'and leaves the Archon path working');
+  assert.ok(logged.length >= 1 && logged.every((m) => /falling back to core\.pin\.move/.test(m)), 'the fallback is logged');
+});
+
+// ── 3. the actor and the runner's parse ───────────────────────────────────────
+
+console.log('\nthe actor says which door was used:');
+
+await t('owner and Archon moves are labelled apart, and both carry the builder id', () => {
+  assert.equal(AZ.coreUpgradeActor({ coreUpgradeAuthority: 'owner', builder: { id: 7 } }), 'api:owner:7');
+  assert.equal(AZ.coreUpgradeActor({ coreUpgradeAuthority: 'pin', builder: { id: 42 } }), 'api:archon:42');
+  assert.equal(AZ.coreUpgradeActor({ builder: { id: 42 } }), 'api:archon:42', 'no recorded door is the Archon door');
+});
+
+await t('the runner attributes both, and passes nothing but digits into its command', () => {
+  assert.equal(requestedByOf({ requested_by: 'api:archon:42' }), '42');
+  assert.equal(requestedByOf({ requested_by: 'api:owner:7' }), '7');
+  for (const bad of ['api:owner:7; rm -rf /', 'api:owner:', 'api:self', 'api:owner:7 ', 'owner:7', 'api:root:1']) {
+    assert.equal(requestedByOf({ requested_by: bad }), '', `"${bad}" must not pass`);
+  }
+  assert.equal(requestedByOf({ requested_by: 42 }), '');
+  assert.equal(requestedByOf(null), '');
+  assert.equal(requestedByOf({}), '');
+});
+
+// ── 4. the assembled router, driven by real requests ──────────────────────────
+
+console.log('\nthe routes, end to end:');
+
+await t('POST: the owner queues a move on their project; a stranger and the platform row are refused', async () => {
+  const api = require('../src/module-api.js');
+  const prov = require('../modules/provisioning/provisioning.js');
+  const routePath = require.resolve('../modules/provisioning/routes/core-upgrade.js');
+  const saved = {};
+  const stub = (key, value) => {
+    saved[key] = Object.getOwnPropertyDescriptor(api, key);
+    Object.defineProperty(api, key, { value, configurable: true, writable: true });
+  };
+  // The caller rides a test header; the atom gate is the spy's rule (Archon only) with
+  // the door's own refusal shape. Everything between them is the real code.
+  stub('requireBuilder', (req, _res, next) => { req.builder = JSON.parse(req.headers['x-test-builder']); next(); });
+  stub('requirePermission', (atom) => (req, res, next) => {
+    if (req.builder.rank === 'archon') return next();
+    return res.status(403).json({ ok: false, error: 'forbidden', permission: atom });
+  });
+  stub('pool', {});
+  const queued = [];
+  const savedProv = { get: prov.getInstanceById, enq: prov.enqueueIntent, rec: prov.recordEvent };
+  prov.getInstanceById = async (_db, n) => ROWS.get(Number(n)) || null;
+  prov.enqueueIntent = async (_db, id, action, requestedBy, targetVersion) => {
+    queued.push({ id, action, requestedBy, targetVersion });
+    return { intent: { id: queued.length, action, state: 'pending', target_version: targetVersion }, created: true };
+  };
+  prov.recordEvent = async () => {};
+  delete require.cache[routePath];
+
+  const express = require('express');
+  const app = express();
+  app.use(express.json());
+  app.use(require(routePath)());
+  const server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  const post = (id, who) => fetch(`${base}/provisioning/instances/${id}/core-upgrade`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'x-test-builder': JSON.stringify(who) },
+    body: JSON.stringify({ to: '1.19.1033', dry_run: true }),
+  });
+  try {
+    const own = await post(41, OWNER);
+    assert.notEqual(own.status, 403, 'the owner is not refused on their own project');
+    assert.deepEqual(queued.map((q) => [q.id, q.requestedBy]), [[41, 'api:owner:7']], 'queued, and attributed to the owner door');
+
+    const strangerReal = await post(41, STRANGER);
+    const strangerGhost = await post(999, STRANGER);
+    assert.equal(strangerReal.status, 403);
+    assert.equal(strangerGhost.status, 403);
+    assert.deepEqual(await strangerReal.json(), await strangerGhost.json(), 'the same refusal for a real and a missing id');
+
+    const platform = await post(1, OWNER);
+    assert.equal(platform.status, 403, 'owning the platform row does not open the platform to a non-Archon');
+
+    const archon = await post(41, ARCHON);
+    assert.notEqual(archon.status, 403);
+    assert.deepEqual(queued.map((q) => q.requestedBy), ['api:owner:7', 'api:archon:42'], 'nothing else was queued');
+
+    const preview = await fetch(`${base}/provisioning/instances/41/core-upgrade`, { headers: { 'x-test-builder': JSON.stringify(STRANGER) } });
+    assert.equal(preview.status, 403, 'the preview is gated like the move');
+
+    const cp = await fetch(`${base}/provisioning/control-plane`, { headers: { 'x-test-builder': JSON.stringify(OWNER) } });
+    assert.equal(cp.status, 403, 'the platform entrance keeps the atom alone');
+  } finally {
+    server.close();
+    for (const [k, d] of Object.entries(saved)) Object.defineProperty(api, k, d);
+    prov.getInstanceById = savedProv.get;
+    prov.enqueueIntent = savedProv.enq;
+    prov.recordEvent = savedProv.rec;
+    delete require.cache[routePath];
+  }
+});
+
+// ── 5. the /deploy page shell ─────────────────────────────────────────────────
+
+console.log('\nthe /deploy page shell:');
+
+function fakeRes() {
+  const res = {
+    _redirect: null,
+    status() { return this; },
+    json() { return this; },
+    redirect(a, b) { this._redirect = b === undefined ? { code: 302, loc: a } : { code: a, loc: b }; return this; },
+    end() { return this; },
+  };
+  attachFail({}, res, () => {});
+  return res;
+}
+
+async function runPage(session, hub) {
+  nextSession = session;
+  seams._reset();
+  seams.registerProvider('government', {
+    resolveBuilderPermissions: async () => catalog.seedForRank(session ? session.rank : 'xenos'),
+  });
+  if (hub) seams.registerProvider('platform-identity.hub', hub);
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireCorePinPage({ headers: { cookie: 'gds_session=t' } }, res, () => { nexted = true; });
+  return { res, nexted };
+}
+
+const OWNER_SESSION = { builder_id: 7, github_id: '9001', rank: 'xenos' };
+const STRANGER_SESSION = { builder_id: 8, github_id: '9002', rank: 'xenos' };
+const ARCHON_SESSION = { builder_id: 42, github_id: '9042', rank: 'archon' };
+const owns = { isProjectOwner: async (githubId) => String(githubId) === '9001' };
+
+await t('a project owner holding no atom reaches the shell', async () => {
+  const { nexted } = await runPage(OWNER_SESSION, owns);
+  assert.ok(nexted, 'without this the widening is real in the API and unreachable in the product');
+});
+
+await t('a stranger gets exactly the redirect the page sent before the second door existed', async () => {
+  const withDoor = await runPage(STRANGER_SESSION, owns);
+  const noDoor = await runPage(STRANGER_SESSION, null);
+  assert.equal(withDoor.nexted, false);
+  assert.deepEqual(withDoor.res._redirect, noDoor.res._redirect);
+  assert.match(withDoor.res._redirect.loc, /denied=core\.pin\.move/, 'and it still names the atom');
+});
+
+await t('an Archon is admitted by the atom without the second door being asked', async () => {
+  const spy = { isProjectOwner: () => { throw new Error('must not be consulted for an atom holder'); } };
+  const { nexted } = await runPage(ARCHON_SESSION, spy);
+  assert.ok(nexted);
+});
+
+seams._reset();
+nextSession = null;
+
+// ── 6. the hand-off address, and the hall that uses it ────────────────────────
+
+console.log('\nthe hand-off to the hub:');
+
+await t('deploy_url is the hub origin plus this project\'s slug, and null without a hub', () => {
+  assert.equal(hubDeployUrl({ origin: 'https://cloudbongos.com', clientId: 'hoodify-finance' }),
+    'https://cloudbongos.com/deploy?project=hoodify-finance');
+  assert.equal(hubDeployUrl({ origin: 'https://cloudbongos.com/', clientId: 'mercury' }),
+    'https://cloudbongos.com/deploy?project=mercury', 'a trailing slash is not doubled');
+  assert.equal(hubDeployUrl({ origin: 'https://h.test', clientId: 'a b&c' }), 'https://h.test/deploy?project=a%20b%26c');
+  assert.equal(hubDeployUrl({ origin: 'https://cloudbongos.com' }), null, 'no client id: not federated');
+  assert.equal(hubDeployUrl({ origin: 'javascript:alert(1)', clientId: 'x' }), null);
+  assert.equal(hubDeployUrl({ origin: 'https://h.test/"><script>', clientId: 'x' }), null);
+  assert.equal(hubDeployUrl(null), null);
+});
+
+const SHELL = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/shell.js'), 'utf8');
+
+// The real shell.js in a DOM stub (the tests/core_update_banner.mjs harness), with the
+// /core-update answer carrying a deploy_url and elements that remember their attributes.
+function boot({ provisioning, deployUrl }) {
+  const els = new Map();
+  const inserted = [];
+  const makeEl = () => ({
+    dataset: {}, style: {}, textContent: '', hidden: false, _html: '', _attrs: {},
+    classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
+    setAttribute(k, v) { this._attrs[k] = String(v); }, getAttribute(k) { return k in this._attrs ? this._attrs[k] : null; }, removeAttribute(k) { delete this._attrs[k]; },
+    addEventListener() {},
+    querySelector() { return { addEventListener() {} }; },
+    querySelectorAll() { return []; },
+    appendChild() {}, focus() {}, click() {}, scrollIntoView() {}, remove() {},
+    insertAdjacentElement(_pos, el) { inserted.push(el); },
+    set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+  });
+  // The rail's Deploy item as the rendered markup makes it: data-gate="archon"
+  // data-module="provisioning" (shell.js renders both attributes onto the <a>).
+  const deploy = makeEl();
+  deploy.dataset.gate = 'archon';
+  deploy.dataset.module = 'provisioning';
+  els.set('nav-deploy', deploy);
+  const documentObj = {
+    body: { dataset: { page: 'settings' } },
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } } },
+    getElementById(id) { if (!els.has(id)) els.set(id, makeEl()); return els.get(id); },
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(); },
+    addEventListener() {}, dispatchEvent() {},
+    get cookie() { return ''; }, set cookie(_v) {},
+  };
+  const location = { hostname: 'h', origin: 'https://h', pathname: '/settings', hash: '', assign() {}, replace() {} };
+  const update = { running: '1.19.871', latest: '1.19.1033', behind: true, reading: 'ok' };
+  const windowObj = {
+    __BRANDING__: {}, __MODULES__: { enabled: { provisioning } },
+    BongosClient: {
+      createClient: () => ({
+        request: (_method, p) => (p === '/api/bongos/core-update'
+          ? Promise.resolve({ status: 200, data: { ok: true, update, deploy_url: deployUrl } })
+          : new Promise(() => {})),
+      }),
+    },
+    matchMedia: () => ({ matches: false, addEventListener() {} }),
+    localStorage: { getItem: () => null, setItem() {} },
+    requestAnimationFrame() {}, scrollTo() {}, location, addEventListener() {},
+  };
+  const sandbox = { window: windowObj, document: documentObj, location, console, setTimeout, clearTimeout, queueMicrotask,
+    CustomEvent: class { constructor(ty, i) { this.type = ty; Object.assign(this, i); } } };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SHELL, sandbox, { filename: 'shell.js' });
+  windowObj.OTBShell.applyAccess({ authed: true, rank: 'archon', permissions: { 'core.pin.move': true } });
+  return {
+    banner: () => inserted.find((e) => String(e._html).includes('is available')),
+    deployItem: () => els.get('nav-deploy'),
+  };
+}
+const settle = () => new Promise((r) => setTimeout(r, 0));
+const HUB = 'https://cloudbongos.com/deploy?project=hoodify-finance';
+
+await t('on a hosted project, the banner\'s Upgrade goes to the hub door for THIS project', async () => {
+  const b = boot({ provisioning: false, deployUrl: HUB });
+  await settle();
+  assert.ok(b.banner(), 'the banner renders');
+  assert.ok(b.banner().innerHTML.includes(`href="${HUB}"`), 'Upgrade links to the hub');
+  assert.doesNotMatch(b.banner().innerHTML, /href="\/deploy"/, 'never the dead local page');
+});
+
+await t('on a hosted project, the rail\'s Deploy item is re-pointed at the hub', async () => {
+  const b = boot({ provisioning: false, deployUrl: HUB });
+  await settle();
+  const item = b.deployItem();
+  assert.equal(item.getAttribute('href'), HUB);
+  assert.equal('module' in item.dataset, false, 'its module gate is lifted so the access loop stops hiding it');
+  assert.equal(item.hidden, false, 'an Archon on their own project sees it');
+});
+
+await t('a hosted project with no hub, or a hub address that is not plain http(s), offers no link', async () => {
+  for (const url of [null, 'javascript:alert(1)', 'https://x.test/"><img src=x onerror=alert(1)>', 42]) {
+    const b = boot({ provisioning: false, deployUrl: url });
+    await settle();
+    assert.ok(b.banner(), 'the news is still told');
+    assert.doesNotMatch(b.banner().innerHTML, /core-update-notice__action/, `no action for ${JSON.stringify(url)}`);
+    const item = b.deployItem();
+    assert.equal(item.getAttribute('href'), null, `the rail is not re-pointed for ${JSON.stringify(url)}`);
+    assert.equal(item.dataset.module, 'provisioning', 'and it keeps its module gate, so a hosted project still hides it');
+  }
+});
+
+await t('on the platform, the local door wins: the hub address is ignored', async () => {
+  const b = boot({ provisioning: true, deployUrl: HUB });
+  await settle();
+  assert.match(b.banner().innerHTML, /href="\/deploy"/);
+  assert.ok(!b.banner().innerHTML.includes(HUB));
+  const item = b.deployItem();
+  assert.notEqual(item.getAttribute('href'), HUB, 'the rail keeps the local /deploy');
+  assert.equal(item.dataset.module, 'provisioning', 'and its module gate, which the platform satisfies');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);