@bongos/core 1.19.1041 → 1.19.1042

package/src/bongos/software-update.js

@@ -0,0 +1,127 @@
+'use strict';
+
+// src/bongos/software-update.js — Settings → Software update (task 1004296): this project's
+// running core, the newest release its update channel lets it take, and what is in the
+// versions between the two.
+//
+// The owner, 2026-09-25: "each builders hall settings has a version description where they
+// can pull the latest release. Just like iOS does." So this is the one place any project —
+// the platform included — reads its version and what an update would bring. It is the CORE's,
+// not a module's, because every project installs releases.
+//
+// WHAT'S NEW COMES FROM THE PACKAGE'S OWN RELEASE NOTES, never from the changelog. Every CI
+// version's changelog line reads "carrier for merges landed since X", which names no work;
+// release-notes.json (scripts/gds/release-notes.js, task 1004218) is the one per-version
+// list of what landed, and the newest package carries the whole history. The running core's
+// own copy stops at its own version, so an update's notes always come off the registry
+// (package-registry.js: streamed, cached, fail-soft).
+//
+// THE CHANNEL RULE IS NOT RESTATED HERE, as in core-update.js: `resolveChannelTarget` is the
+// upgrade runner's own function, so this never offers a version the runner would refuse.
+// No channel is passed, exactly as the banner passes none: an instance does not store its
+// own channel, and the runner's default is what it would get.
+//
+// A READING, NEVER A GUESS. `reading` is 'ok' only when the registry answered; "up to date"
+// is `offered: null` on an ok reading and nothing else. Notes that could not be read say so,
+// and a version whose notes are missing is shown as missing rather than as empty.
+
+const {
+  CORE_PKG,
+  DEFAULT_CHANNEL,
+  normalizeChannel,
+  resolveChannelTarget,
+  compareSemver,
+} = require('../../scripts/gds/update-channel.js');
+const { readRegistry } = require('./package-registry');
+
+const VERSION_RE = /^\d+\.\d+\.\d+$/;
+// The same bound the deploy page puts on a line: a release note is a sentence, and one that
+// came off the network is re-checked before it is drawn.
+const TEXT_MAX = 400;
+// A project months behind can be hundreds of versions short. The panel lists the newest
+// ones and counts the rest; every one of them is still in the update.
+const VERSIONS_MAX = 40;
+
+function boundText(text) {
+  const t = String(text || '').trim();
+  return t.length > TEXT_MAX ? `${t.slice(0, TEXT_MAX - 1)}…` : t;
+}
+
+/** One version's entries, re-checked; null when the notes do not list the version at all. */
+function entriesFor(notes, version) {
+  const list = notes && Object.prototype.hasOwnProperty.call(notes, version) ? notes[version] : undefined;
+  if (!Array.isArray(list)) return null;
+  const out = [];
+  for (const e of list) {
+    const text = boundText(e && e.text);
+    if (!text) continue;
+    const id = e && /^\d{1,12}$/.test(String(e.id == null ? '' : e.id)) ? String(e.id) : null;
+    out.push({ id, text });
+  }
+  return out;
+}
+
+/**
+ * The panel's whole answer, from one registry reading. PURE — no clock, no I/O.
+ *
+ * `registry` and `notes` are package-registry.js's `readRegistry` result. Versions in the
+ * update are the published ones above `running` and at or below `offered`, newest first.
+ */
+function softwareUpdateVerdict({ running, channel, registry, notes, checkedAt }) {
+  const ch = normalizeChannel(channel == null ? DEFAULT_CHANNEL : channel);
+  const base = { checked_at: checkedAt, running: running || null, channel: ch };
+  if (!running || !VERSION_RE.test(String(running))) {
+    return { ...base, reading: 'no_answer', error: 'this project could not name the version it runs', offered: null, newest: null, whats_new: null };
+  }
+  if (!registry || !registry.ok) {
+    return { ...base, reading: 'no_answer', error: (registry && registry.error) || 'the registry could not be read', offered: null, newest: null, whats_new: null };
+  }
+  const offered = resolveChannelTarget({ installed: running, channel: ch, available: registry.versions }) || null;
+  const published = registry.published || {};
+  const answer = {
+    ...base,
+    reading: 'ok',
+    error: null,
+    offered,
+    offered_published_at: offered ? published[offered] || null : null,
+    newest: registry.newest || null,
+    whats_new: null,
+  };
+  if (!offered) return answer;
+
+  const inUpdate = registry.versions
+    .filter((v) => compareSemver(v, running) > 0 && compareSemver(v, offered) <= 0)
+    .sort((a, b) => compareSemver(b, a));
+  const shown = inUpdate.slice(0, VERSIONS_MAX);
+  const ok = !!(notes && notes.ok);
+  answer.whats_new = {
+    ok,
+    error: ok ? null : ((notes && notes.error) || 'the release notes could not be read'),
+    count: inUpdate.length,
+    more: inUpdate.length - shown.length,
+    versions: shown.map((version) => ({
+      version,
+      published_at: published[version] || null,
+      entries: ok ? entriesFor(notes.notes, version) : null,
+    })),
+  };
+  return answer;
+}
+
+/**
+ * What GET /api/bongos/software-update answers — and this file's one export.
+ *
+ * `get`/`now`/`store` pass through to the registry reader, so a test drives the real
+ * packument parsing, the real tarball stream and the real cache rather than a stub.
+ */
+async function readSoftwareUpdate({ running, channel, get, now = Date.now, store } = {}) {
+  const t = now();
+  const { registry, notes } = await readRegistry({
+    pkg: CORE_PKG, get, now, store,
+    // Nothing to describe when nothing newer is published: skip the download.
+    haveNotesFor: (newest) => !VERSION_RE.test(String(running || '')) || compareSemver(newest, running) <= 0,
+  });
+  return softwareUpdateVerdict({ running, channel, registry, notes, checkedAt: new Date(t).toISOString() });
+}
+
+module.exports = { readSoftwareUpdate };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1041'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1042'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
@@ -494,6 +494,15 @@ module.exports = {
   responsibilityFor,
   ROLE_RESPONSIBILITIES,
 
+  // --- readPackageRegistry({ pkg, haveNotesFor, get, now, store }) — what the npm
+  //     registry says about a package: its versions, their publish dates, the
+  //     `latest` label, and the release notes the newest version was packed with
+  //     (task 1004296). The core owns it because Settings → Software update needs
+  //     it in every hall; a module that publishes a package reads the same answer
+  //     and the same process-local cache through here. Fail-soft: it resolves
+  //     `{ registry, notes }` with `ok:false` and a sentence, never a throw.
+  readPackageRegistry: (...a) => require('./bongos/package-registry').readRegistry(...a),
+
   // --- logging
   logger,
 };

package/tests/core_upgrade_owner_door.mjs

@@ -342,8 +342,9 @@ await t('deploy_url is the hub origin plus this project\'s slug, and null withou
 const SHELL = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/shell.js'), 'utf8');
 
 // The real shell.js in a DOM stub (the tests/core_update_banner.mjs harness), with the
-// /core-update answer carrying a deploy_url and elements that remember their attributes.
-function boot({ provisioning, deployUrl }) {
+// /core-update answer optionally carrying a deploy_url — an older server still sends one —
+// and elements that remember their attributes.
+function boot({ provisioning, deployUrl, pathname = '/settings', hash = '' }) {
   const els = new Map();
   const inserted = [];
   const makeEl = () => ({
@@ -372,7 +373,7 @@ function boot({ provisioning, deployUrl }) {
     addEventListener() {}, dispatchEvent() {},
     get cookie() { return ''; }, set cookie(_v) {},
   };
-  const location = { hostname: 'h', origin: 'https://h', pathname: '/settings', hash: '', assign() {}, replace() {} };
+  const location = { hostname: 'h', origin: 'https://h', pathname, hash, assign() {}, replace() {} };
   const update = { running: '1.19.871', latest: '1.19.1033', behind: true, reading: 'ok' };
   const windowObj = {
     __BRANDING__: {}, __MODULES__: { enabled: { provisioning } },
@@ -401,40 +402,48 @@ function boot({ provisioning, deployUrl }) {
 const settle = () => new Promise((r) => setTimeout(r, 0));
 const HUB = 'https://cloudbongos.com/deploy?project=hoodify-finance';
 
-await t('on a hosted project, the banner\'s Upgrade goes to the hub door for THIS project', async () => {
+// Task 1004296 moved the hand-off: a hall without a door of its own sends its owner to
+// Settings → Software update, whose Update button carries the hub address (GET
+// /software-update's `door`). The banner and the rail no longer link off-site.
+await t('on a hosted project, the banner\'s Upgrade goes to Settings → Software update, not off-site', async () => {
   const b = boot({ provisioning: false, deployUrl: HUB });
   await settle();
   assert.ok(b.banner(), 'the banner renders');
-  assert.ok(b.banner().innerHTML.includes(`href="${HUB}"`), 'Upgrade links to the hub');
-  assert.doesNotMatch(b.banner().innerHTML, /href="\/deploy"/, 'never the dead local page');
+  assert.match(b.banner().innerHTML, /href="\/settings#software-update"/, 'Upgrade opens the Software update panel');
+  assert.ok(!b.banner().innerHTML.includes(HUB), 'never the hub address directly, even when an older server sends one');
+  assert.doesNotMatch(b.banner().innerHTML, /href="\/deploy"/, 'never the local /deploy, which this hall no longer has');
 });
 
-await t('on a hosted project, the rail\'s Deploy item is re-pointed at the hub', async () => {
+await t('on a hosted project, the rail\'s Deploy item stays hidden — it is the platform hall\'s page', async () => {
   const b = boot({ provisioning: false, deployUrl: HUB });
   await settle();
   const item = b.deployItem();
-  assert.equal(item.getAttribute('href'), HUB);
-  assert.equal('module' in item.dataset, false, 'its module gate is lifted so the access loop stops hiding it');
-  assert.equal(item.hidden, false, 'an Archon on their own project sees it');
+  assert.equal(item.getAttribute('href'), null, 'not re-pointed at the hub');
+  assert.equal(item.dataset.module, 'provisioning', 'its module gate stays, so a hall without the door hides it');
 });
 
-await t('a hosted project with no hub, or a hub address that is not plain http(s), offers no link', async () => {
-  for (const url of [null, 'javascript:alert(1)', 'https://x.test/"><img src=x onerror=alert(1)>', 42]) {
+await t('a hall with no door of its own and no hub still links to Software update', async () => {
+  for (const url of [null, 'javascript:alert(1)', 42]) {
     const b = boot({ provisioning: false, deployUrl: url });
     await settle();
-    assert.ok(b.banner(), 'the news is still told');
-    assert.doesNotMatch(b.banner().innerHTML, /core-update-notice__action/, `no action for ${JSON.stringify(url)}`);
-    const item = b.deployItem();
-    assert.equal(item.getAttribute('href'), null, `the rail is not re-pointed for ${JSON.stringify(url)}`);
-    assert.equal(item.dataset.module, 'provisioning', 'and it keeps its module gate, so a hosted project still hides it');
+    assert.match(b.banner().innerHTML, /href="\/settings#software-update"/, `Software update for ${JSON.stringify(url)}`);
+    assert.doesNotMatch(b.banner().innerHTML, /javascript:/);
   }
 });
 
-await t('on the platform, the local door wins: the hub address is ignored', async () => {
+await t('on the Software update panel itself, the banner points rather than linking to the page it is on', async () => {
+  const b = boot({ provisioning: false, pathname: '/settings', hash: '#software-update' });
+  await settle();
+  assert.doesNotMatch(b.banner().innerHTML, /core-update-notice__action/, 'no link to where you already are');
+  assert.match(b.banner().innerHTML, /core-update-notice__hint/);
+});
+
+await t('on the platform, the local door wins: the banner links /deploy and the rail keeps it', async () => {
   const b = boot({ provisioning: true, deployUrl: HUB });
   await settle();
   assert.match(b.banner().innerHTML, /href="\/deploy"/);
   assert.ok(!b.banner().innerHTML.includes(HUB));
+  assert.ok(!b.banner().innerHTML.includes('software-update'), 'the platform takes its update at its own door');
   const item = b.deployItem();
   assert.notEqual(item.getAttribute('href'), HUB, 'the rail keeps the local /deploy');
   assert.equal(item.dataset.module, 'provisioning', 'and its module gate, which the platform satisfies');

package/tests/helpers.mjs

@@ -73,6 +73,9 @@ import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
 import { execFileSync } from 'node:child_process';
 import vm from 'node:vm';
+import zlib from 'node:zlib';
+import { EventEmitter } from 'node:events';
+import { Readable } from 'node:stream';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -1012,3 +1015,92 @@ export function macShapedTools(binDir) {
     '',
   ].join('\n'), { mode: 0o755 });
 }
+
+// ---- a fake npm registry (task 1002622; shared since task 1004296) -------------------
+//
+// A real gzipped tar built by hand, a packument, and an `https.get` stand-in that answers
+// in 777-byte chunks — so a reader under test runs its real gunzip, tar walk and JSON parse,
+// with headers landing across chunk boundaries. Used by tests/npm_release_work.mjs and
+// tests/software_update.mjs.
+
+function tarHeader(name, size, type = '0') {
+  const h = Buffer.alloc(512, 0);
+  h.write(name.slice(0, 100), 0, 'utf8');
+  h.write('0000644\0', 100, 'ascii');
+  h.write('0000000\0', 108, 'ascii');
+  h.write('0000000\0', 116, 'ascii');
+  h.write(`${size.toString(8).padStart(11, '0')}\0`, 124, 'ascii');
+  h.write('00000000000\0', 136, 'ascii');
+  h.write('        ', 148, 'ascii');
+  h.write(type, 156, 'ascii');
+  h.write('ustar\0', 257, 'ascii');
+  h.write('00', 263, 'ascii');
+  let sum = 0;
+  for (const b of h) sum += b;
+  h.write(`${sum.toString(8).padStart(6, '0')}\0 `, 148, 'ascii');
+  return h;
+}
+function tarEntry(name, data, type = '0') {
+  const body = Buffer.isBuffer(data) ? data : Buffer.from(data);
+  const pad = Buffer.alloc((512 - (body.length % 512)) % 512, 0);
+  return Buffer.concat([tarHeader(name, body.length, type), body, pad]);
+}
+function paxEntry(path) {
+  // A pax record is "<len> <key>=<value>\n", where <len> counts its own digits too.
+  const rec = (k, v) => {
+    const body = ` ${k}=${v}\n`;
+    let n = body.length + 1;
+    while (String(n).length + body.length !== n) n = String(n).length + body.length;
+    return `${n}${body}`;
+  };
+  return tarEntry('PaxHeader/x', rec('path', path), 'x');
+}
+/** A gzipped npm-shaped tarball. `notes` null leaves release-notes.json out. */
+export function npmTarball({ notes, padBytes = 40000, pax = false, pkg = '@bongos/core' } = {}) {
+  const parts = [
+    tarEntry('package/package.json', JSON.stringify({ name: pkg })),
+    // A large file BEFORE the notes, so the reader has to skip across many chunks.
+    tarEntry('package/big.js', Buffer.alloc(padBytes, 97)),
+  ];
+  if (notes) {
+    const json = JSON.stringify(notes);
+    if (pax) parts.push(paxEntry('package/release-notes.json'), tarEntry('package/SHORTNAME', json));
+    else parts.push(tarEntry('package/release-notes.json', json));
+  }
+  parts.push(Buffer.alloc(1024, 0));
+  return zlib.gzipSync(Buffer.concat(parts));
+}
+
+// ---- a fake registry -----------------------------------------------------------------
+
+export function npmPackument({ versions, latest, times, pkg = '@bongos/core', origin = 'https://registry.npmjs.org' }) {
+  const doc = { name: pkg, 'dist-tags': { latest }, versions: {}, time: {} };
+  for (const v of versions) {
+    doc.versions[v] = { version: v, dist: { tarball: `${origin}/${pkg}/-/${pkg.split('/').pop()}-${v}.tgz` } };
+    doc.time[v] = times[v];
+  }
+  return doc;
+}
+
+/** `get` answering from `routes` (url → { status, body }), recording every URL asked for. */
+export function fakeHttpsGet(routes) {
+  const asked = [];
+  const get = (url, opts, cb) => {
+    asked.push(url);
+    const req = new EventEmitter();
+    req.destroy = () => {};
+    setImmediate(() => {
+      const r = routes[url];
+      if (!r) { req.emit('error', new Error(`no route for ${url}`)); return; }
+      const body = Buffer.isBuffer(r.body) ? r.body : Buffer.from(typeof r.body === 'string' ? r.body : JSON.stringify(r.body));
+      // Small chunks, so a tar header lands across a chunk boundary.
+      const chunks = [];
+      for (let i = 0; i < body.length; i += 777) chunks.push(body.subarray(i, i + 777));
+      const res = Readable.from(chunks);
+      res.statusCode = r.status || 200;
+      cb(res);
+    });
+    return req;
+  };
+  return { get, asked };
+}

package/tests/main_audit_attestation.mjs

@@ -0,0 +1,238 @@
+// tests/main_audit_attestation.mjs — the main audit's attestation pass (task 1001433).
+//
+// The pass ties every permission-sensitive commit on main to the pull request that
+// brought it in, and requires that PR's head to carry the server's `gate-author-trust`
+// status, posted by the server's own GitHub identity. The author NAME the older pass
+// reads is typed text; the status creator is not. FLAG-ONLY by the owner's ruling
+// (2026-09-26): findings are 'review', never 'blocker'.
+//
+// Everything here runs on injected git + fetch seams — no repository, no network.
+//
+// Run:  node --test tests/main_audit_attestation.mjs
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const audit = require('../scripts/gds/main-audit.js');
+const {
+  ATTEST_CONTEXT, mapIntroducingHeads, isAttested, analyzeAttestation, attestationConfig,
+  fetchAttestations, runAttestationPass,
+} = audit;
+
+const sha = (c) => c.repeat(40);
+const PROTECTED = 'src/bongos/auth.js';  // floored in the real registry
+const PLAIN = 'docs/notes.md';           // not a protected surface
+const status = (login, state = 'success', context = ATTEST_CONTEXT) => ({ context, state, creator: { login } });
+
+// A tiny history. Mainline: R (release) ← M (merges PR head H over base B).
+// The PR carried two commits: A (protected) then H (the head, plain).
+const B = sha('b'); const A = sha('a'); const H = sha('h'); const M = sha('m'); const D = sha('d');
+const commitA = { sha: A, authorName: 'somemetic', parents: [B], files: [PROTECTED] };
+const commitH = { sha: H, authorName: 'somemetic', parents: [A], files: [PLAIN] };
+const mergeM = { sha: M, authorName: 'Lars', parents: [B, H], isMerge: true, files: [] };
+// D: a protected commit pushed straight onto main (no merge brought it in).
+const directD = { sha: D, authorName: 'IAMMASTERQUA', parents: [M], files: [PROTECTED] };
+const revRanges = { [`${B}..${H}`]: [H, A] };
+const revList = (r) => revRanges[r] || [];
+
+test('the real registry still floors the fixture paths the way these tests assume', () => {
+  const ppc = require('../src/bongos/permission-path-check.js');
+  assert.ok(ppc.matchProtected([PROTECTED]).length > 0, `${PROTECTED} must be protected`);
+  assert.equal(ppc.matchProtected([PLAIN]).length, 0, `${PLAIN} must not be protected`);
+});
+
+// ---- mapIntroducingHeads ----
+
+test('a mainline merge vouches for every commit its PR brought in, via its SECOND parent', () => {
+  const headOf = mapIntroducingHeads([mergeM], revList);
+  assert.equal(headOf.get(A), H);
+  assert.equal(headOf.get(H), H, 'a PR head vouches for itself');
+  assert.equal(headOf.has(D), false, 'a direct push has no introducing merge');
+});
+
+test('a commit keeps the FIRST merge that claims it; single-parent commits are ignored', () => {
+  const other = { sha: sha('n'), parents: [sha('x'), sha('y')] };
+  const headOf = mapIntroducingHeads([mergeM, other, commitA], (r) => (r === `${sha('x')}..${sha('y')}` ? [A] : revList(r)));
+  assert.equal(headOf.get(A), H);
+});
+
+// ---- isAttested: the creator is the part that cannot be faked ----
+
+test('a success from the trusted account attests; the login match ignores case', () => {
+  assert.equal(isAttested([status('owner-acct')], 'Owner-Acct'), true);
+});
+
+test('FORGERY: the same context posted by any other account attests nothing', () => {
+  assert.equal(isAttested([status('IAMMASTERQUA')], 'owner-acct'), false);
+  assert.equal(isAttested([status('github-actions[bot]')], 'owner-acct'), false);
+});
+
+test("only the trusted account's NEWEST status for the context decides", () => {
+  // newest first, as GitHub returns them
+  assert.equal(isAttested([status('owner-acct', 'failure'), status('owner-acct', 'success')], 'owner-acct'), false, 'a later failure withdraws');
+  assert.equal(isAttested([status('owner-acct', 'success'), status('owner-acct', 'failure')], 'owner-acct'), true, 'a later success restores');
+  // another account can neither attest nor revoke
+  assert.equal(isAttested([status('mallory', 'failure'), status('owner-acct', 'success')], 'owner-acct'), true);
+});
+
+test('another context, a pending state, or no trusted login attests nothing', () => {
+  assert.equal(isAttested([status('owner-acct', 'success', 'unit-report')], 'owner-acct'), false);
+  assert.equal(isAttested([status('owner-acct', 'pending')], 'owner-acct'), false);
+  assert.equal(isAttested([status('owner-acct')], ''), false);
+  assert.equal(isAttested(null, 'owner-acct'), false);
+});
+
+// ---- analyzeAttestation ----
+
+test('an attested PR head clears every protected commit it brought in', () => {
+  const headOf = mapIntroducingHeads([mergeM], revList);
+  const r = analyzeAttestation([commitA, commitH], { headOf, attested: new Set([H]), trustedLogin: 'owner-acct' });
+  assert.equal(r.checked, 1, 'only the protected commit is checked');
+  assert.deepEqual(r.findings, []);
+});
+
+test('an unattested PR head is a REVIEW finding naming the head — never a blocker', () => {
+  const headOf = mapIntroducingHeads([mergeM], revList);
+  const r = analyzeAttestation([commitA], { headOf, attested: new Set(), trustedLogin: 'owner-acct' });
+  assert.equal(r.findings.length, 1);
+  const f = r.findings[0];
+  assert.equal(f.severity, 'review', 'flag-only: the owner ruled this pass must not gate');
+  assert.equal(f.kind, 'unattested');
+  assert.equal(f.head, H);
+  assert.match(f.summary, /pull request that brought it in \(head hhhhhhhhh\)/);
+  assert.match(f.summary, /gate-author-trust' status from 'owner-acct'/);
+});
+
+test('a direct push to main is flagged as having no pull request at all', () => {
+  const r = analyzeAttestation([directD], { headOf: new Map(), attested: new Set(), trustedLogin: 'owner-acct' });
+  assert.equal(r.findings.length, 1);
+  assert.equal(r.findings[0].severity, 'review');
+  assert.equal(r.findings[0].head, D);
+  assert.match(r.findings[0].summary, /without passing through a pull request/);
+});
+
+test('a ONE-commit pull request (head === the commit) still reads as a pull request', () => {
+  const lone = { sha: H, authorName: 'somemetic', parents: [B], files: [PROTECTED] };
+  const r = analyzeAttestation([lone], { headOf: new Map([[H, H]]), attested: new Set(), trustedLogin: 'owner-acct' });
+  assert.match(r.findings[0].summary, /pull request that brought it in/);
+  assert.doesNotMatch(r.findings[0].summary, /without passing through a pull request/);
+});
+
+test('a direct push that carries the attestation ITSELF is cleared', () => {
+  const r = analyzeAttestation([directD], { headOf: new Map(), attested: new Set([D]), trustedLogin: 'owner-acct' });
+  assert.deepEqual(r.findings, []);
+});
+
+// ---- attestationConfig ----
+
+test('config: Actions env first, GH_TOKEN as the laptop fallback, owner as the default login', () => {
+  assert.deepEqual(attestationConfig({ env: { GITHUB_TOKEN: 't1', GITHUB_REPOSITORY: 'owner-acct/core' } }),
+    { token: 't1', repo: 'owner-acct/core', trustedLogin: 'owner-acct' });
+  assert.equal(attestationConfig({ env: { GH_TOKEN: 't2' } }).token, 't2');
+  assert.equal(attestationConfig({ env: {} }).token, null);
+});
+
+test('config: the repo is read from the origin remote without ever capturing a credential in it', () => {
+  const https = attestationConfig({ env: {}, remoteUrl: 'https://x-access-token:SECRET@github.com/owner/repo.git' });
+  assert.equal(https.repo, 'owner/repo');
+  assert.ok(!JSON.stringify(https).includes('SECRET'));
+  assert.equal(attestationConfig({ env: {}, remoteUrl: 'git@github.com:owner/repo.git' }).repo, 'owner/repo');
+  assert.equal(attestationConfig({ env: {}, remoteUrl: 'https://example.com/x/y.git' }).repo, null);
+});
+
+test('config: --attest-login overrides the owner default (an App-posting instance)', () => {
+  const c = attestationConfig({ env: { GITHUB_REPOSITORY: 'o/r' }, loginArg: 'bongos-app[bot]' });
+  assert.equal(c.trustedLogin, 'bongos-app[bot]');
+});
+
+// ---- fetchAttestations ----
+
+function stubFetch(bySha) {
+  const calls = [];
+  const impl = async (url, init) => {
+    calls.push({ url, init });
+    const s = Object.keys(bySha).find((k) => url.includes(`/commits/${k}/`));
+    const r = bySha[s];
+    if (r instanceof Error) throw r;
+    if (typeof r === 'number') return { ok: false, status: r, json: async () => ({}) };
+    return { ok: true, status: 200, json: async () => r };
+  };
+  return { impl, calls };
+}
+
+test('fetch: reads each head once, keeps only the trusted attestations, sends the token', async () => {
+  const { impl, calls } = stubFetch({ [H]: [status('owner-acct')], [D]: [status('mallory')] });
+  const r = await fetchAttestations([H, D, H], { repo: 'o/r', token: 'tok', trustedLogin: 'owner-acct', fetchImpl: impl });
+  assert.deepEqual([...r.attested], [H]);
+  assert.deepEqual(r.unreadable, []);
+  assert.equal(calls.length, 2, 'a head shared by several commits is read once');
+  assert.equal(calls[0].url, `https://api.github.com/repos/o/r/commits/${H}/statuses?per_page=100`);
+  assert.equal(calls[0].init.headers.Authorization, 'Bearer tok');
+});
+
+test('fetch: an unreadable head is reported, never counted as attested or unattested', async () => {
+  const { impl } = stubFetch({ [H]: 404, [D]: new Error('network down') });
+  const r = await fetchAttestations([H, D], { repo: 'o/r', token: 'tok', trustedLogin: 'owner-acct', fetchImpl: impl });
+  assert.equal(r.attested.size, 0);
+  assert.deepEqual(r.unreadable.map((u) => u.reason), ['HTTP 404', 'network down']);
+});
+
+// ---- runAttestationPass: the whole pass on fake git + fetch ----
+
+function fakeGit({ mainline, ranges, remote = 'https://github.com/o/r.git' }) {
+  return (args) => {
+    if (args === 'remote get-url origin') return `${remote}\n`;
+    if (args.startsWith('rev-list --first-parent ')) return mainline.join('\n');
+    if (args.startsWith('rev-list ')) return (ranges[args.slice('rev-list '.length)] || []).join('\n');
+    throw new Error(`unexpected git ${args}`);
+  };
+}
+const history = [directD, mergeM, commitH, commitA];
+const gitImpl = fakeGit({ mainline: [D, M], ranges: revRanges });
+
+test('pass: nothing protected in range → it ran, checked nothing, needed no token', async () => {
+  const r = await runAttestationPass([commitH], 'x..y', { env: {}, gitImpl: () => { throw new Error('git must not be called'); } });
+  assert.deepEqual(r, { ran: true, checked: 0, findings: [] });
+});
+
+test('pass: no token → DID NOT RUN with the reason, never a clean pass', async () => {
+  const r = await runAttestationPass(history, 'x..y', { env: {}, gitImpl });
+  assert.equal(r.ran, false);
+  assert.match(r.reason, /no GitHub token/);
+});
+
+test('pass: end to end — the attested PR clears, the direct push is flagged', async () => {
+  const { impl } = stubFetch({ [H]: [status('o')], [D]: [] });
+  const r = await runAttestationPass(history, 'x..y', { env: { GH_TOKEN: 'tok' }, gitImpl, fetchImpl: impl });
+  assert.equal(r.ran, true);
+  assert.equal(r.checked, 2);
+  assert.deepEqual(r.findings.map((f) => f.sha), [D]);
+  assert.equal(r.trustedLogin, 'o', 'the owner of the origin remote');
+});
+
+test('pass: a FORGED mark on the PR head (right name, wrong account) is flagged', async () => {
+  const { impl } = stubFetch({ [H]: [status('IAMMASTERQUA')], [D]: [status('o')] });
+  const r = await runAttestationPass(history, 'x..y', { env: { GH_TOKEN: 'tok' }, gitImpl, fetchImpl: impl });
+  assert.deepEqual(r.findings.map((f) => f.sha), [A]);
+  assert.ok(r.findings.every((f) => f.severity === 'review'));
+});
+
+test('pass: a head it could not read makes the whole pass DID NOT RUN', async () => {
+  const { impl } = stubFetch({ [H]: 502, [D]: [status('o')] });
+  const r = await runAttestationPass(history, 'x..y', { env: { GH_TOKEN: 'tok' }, gitImpl, fetchImpl: impl });
+  assert.equal(r.ran, false);
+  assert.match(r.reason, /could not read the commit statuses of 1 pull-request head/);
+});
+
+test('pass: a merge INSIDE a pull request never vouches — only mainline merges do', async () => {
+  // I: a branch's "merge main into me" whose second parent is a main commit P.
+  const P = sha('p'); const I = sha('i');
+  const inner = { sha: I, authorName: 'x', parents: [A, P], isMerge: true, files: [] };
+  const mainP = { sha: P, authorName: 'x', parents: [B], files: [PROTECTED] };
+  const g = fakeGit({ mainline: [P], ranges: { [`${A}..${P}`]: [P] } });
+  const { impl } = stubFetch({ [P]: [] });
+  const r = await runAttestationPass([inner, mainP], 'x..y', { env: { GH_TOKEN: 'tok' }, gitImpl: g, fetchImpl: impl });
+  assert.equal(r.findings.length, 1);
+  assert.equal(r.findings[0].head, P, 'P answers for itself; the inner merge did not claim it');
+});

package/tests/module_api.mjs

@@ -56,6 +56,7 @@ const PUBLISHED_SURFACE = [
   'buildInfo', 'validateOrRespond', 'LIMITS', 'parseId', 'asyncHandler', 'corsPublicGet', // parseId added 1.8.0 (BV1.R78); asyncHandler + corsPublicGet added 1.12.0 (BV1.R86; lifecycle routes)
   'parsePagination', 'pageMeta', 'PAGINATION', // R14 (#2001, 1.17.0): shared pagination contract for module list routes (ADR 0119)
   'responsibilityFor', 'ROLE_RESPONSIBILITIES', // added by task 1003732 (ADR 0275; criterion wa6-written-responsibilities): the ONE source for the sentence each craft is answerable for. It rides the doorway because two modules need the same text — grading judges role-shaped work against it, the hall shows it to the person being judged — and modules never import each other. Declared here deliberately: this list is what makes adding to the doorway a decision rather than a side effect
+  'readPackageRegistry', // added by task 1004296 (ADR 0340 D5): the npm registry reader moved into the core, because Settings → Software update needs it in every hall; the module that publishes a package reads the same answer and cache through here rather than keeping a second copy
   'logger',
 ];
 

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = '983282a83fd5aa71';
+const SHELL_SHA = 'ff2017aa9bbbc507';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/npm_release_page.mjs

@@ -22,6 +22,8 @@ const DEPLOY_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/deplo
 const FIXTURE = JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts/hall-preview/fixtures/npm-release__work.json'), 'utf8'));
 
 const escapeHtml = (s) => String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+// Voice rule V4: quoted data renders with its dashes as commas (docs/voice.md).
+const unDash = (raw) => String(raw == null ? '' : raw).replace(/\s*[—–]\s*/g, ', ').replace(/,\s*,/g, ',').trim();
 
 function makeEl() {
   return { hidden: true, _html: '', set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; } };
@@ -67,7 +69,7 @@ test('every recent task is named, by title, linked to its page', async () => {
     // Stages longer than the fold show their first rows; the rest sit behind "Show all".
     for (const t of rows.slice(0, 8)) {
       assert.ok(html.includes(`href="/task/${t.id}"`), `${stage}: task ${t.id} is linked`);
-      assert.ok(html.includes(escapeHtml(t.title)), `${stage}: task ${t.id} is named`);
+      assert.ok(html.includes(escapeHtml(unDash(t.title))), `${stage}: task ${t.id} is named`);
     }
   }
   assert.match(html, /Show all 15/);
@@ -171,3 +173,11 @@ test('the deploy page loads the module script only for its own view, and only wi
   assert.deepEqual(bootDeploy({ modules: undefined }), [], 'no module record at all');
   assert.deepEqual(bootDeploy({ modules: on, search: '?project=mercury' }), [], 'another project\'s view is not this package\'s');
 });
+
+test('a task title and a note line are quoted ledger data: their dashes render as commas (V4)', async () => {
+  const stages = { ...FIXTURE.stages, not_merged: [{ ...FIXTURE.stages.not_merged[0], title: 'Deploy page — where the work is – phase 1' }] };
+  const b = bootWork(() => ok({ ...FIXTURE, stages }));
+  await b.settle();
+  assert.ok(b.work().innerHTML.includes('>Deploy page, where the work is, phase 1</a>'));
+  assert.doesNotMatch(b.work().innerHTML, /Deploy page [—–]/);
+});