@bongos/core 1.19.1072 → 1.19.1074

package/tests/box_auth_check.mjs

@@ -1,114 +0,0 @@
-// tests/box_auth_check.mjs
-//
-// Unit tests for the dev-box session-start auth gate (task 1712). The pure core
-// `decideBoxAuth` is the high-risk surface: it decides whether a box session is
-// told to STOP and re-auth before it can safely claim/ship. The truth table
-// must be exactly right — box-scoped (source='box', ADR 0053) is the incident
-// case and must be caught from the local file alone (no network), an expired
-// real token must still be caught via the bounded /me probe, and any inability
-// to verify must FAIL OPEN (silent) rather than cry wolf.
-//
-// Importing the helper must NOT run its main() (which reads the session file and
-// hits the network) — box-auth-check.js guards main() behind
-// `require.main === module`, and only require()s cli-lib inside main(), so this
-// import is side-effect free (no I/O, no fetch). This test proves that holds.
-//
-// Run:  node tests/box_auth_check.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-const { decideBoxAuth } = require('../scripts/gds/box-auth-check.js');
-
-let passed = 0;
-let failed = 0;
-function test(name, fn) {
-  try {
-    fn();
-    passed++;
-    console.log(`  ok  ${name}`);
-  } catch (err) {
-    failed++;
-    console.log(`  FAIL ${name}`);
-    console.log(`     ${err.message}`);
-  }
-}
-
-// A real, validated session on a box — the common clear-to-work case.
-const OK = { onBox: true, hasToken: true, isBoxScoped: false, meStatus: 200 };
-
-// ---------- skip: off a box, this check does nothing ----------
-
-test('not a box → skip (laptops are untouched, whatever the token looks like)', () => {
-  assert.equal(decideBoxAuth({ onBox: false, hasToken: false, isBoxScoped: false, meStatus: null }).action, 'skip');
-  assert.equal(decideBoxAuth({ onBox: false, hasToken: true, isBoxScoped: true, meStatus: 403 }).action, 'skip');
-});
-
-// ---------- setup: on a box with no session ----------
-
-test('box, no session → setup', () => {
-  const d = decideBoxAuth({ onBox: true, hasToken: false, isBoxScoped: false, meStatus: null });
-  assert.equal(d.action, 'setup');
-  assert.equal(d.reason, 'no-session');
-});
-
-// ---------- reauth: the box-scoped incident case (decided locally, no network) ----------
-
-test('box, box-scoped token → reauth (box-scoped), regardless of meStatus', () => {
-  const d = decideBoxAuth({ onBox: true, hasToken: true, isBoxScoped: true, meStatus: null });
-  assert.equal(d.action, 'reauth');
-  assert.equal(d.reason, 'box-scoped');
-});
-
-test('box-scoped is decided BEFORE meStatus — even a 200 stays reauth', () => {
-  // A box token can never legitimately 200 on /me, but the ordering guarantee is
-  // what keeps the incident case off the network path.
-  const d = decideBoxAuth({ onBox: true, hasToken: true, isBoxScoped: true, meStatus: 200 });
-  assert.equal(d.action, 'reauth');
-  assert.equal(d.reason, 'box-scoped');
-});
-
-// ---------- reauth: an expired/revoked real token (caught via the bounded /me) ----------
-
-test('box, real token, /me 401 → reauth (expired-or-revoked)', () => {
-  const d = decideBoxAuth({ ...OK, meStatus: 401 });
-  assert.equal(d.action, 'reauth');
-  assert.equal(d.reason, 'expired-or-revoked');
-});
-
-test('box, real token, /me 403 → reauth (expired-or-revoked)', () => {
-  const d = decideBoxAuth({ ...OK, meStatus: 403 });
-  assert.equal(d.action, 'reauth');
-  assert.equal(d.reason, 'expired-or-revoked');
-});
-
-// ---------- ok: a real, validated session ----------
-
-test('box, real token, /me 200 → ok (clear to work)', () => {
-  const d = decideBoxAuth(OK);
-  assert.equal(d.action, 'ok');
-  assert.equal(d.reason, 'validated');
-});
-
-// ---------- fail-open: couldn't verify → stay silent, never warn falsely ----------
-
-test('box, real token, /me not attempted (null) → skip (fail-open, no false alarm)', () => {
-  const d = decideBoxAuth({ ...OK, meStatus: null });
-  assert.equal(d.action, 'skip');
-  assert.equal(d.reason, 'unverified');
-});
-
-test('box, real token, /me 500 (server error) → skip (not a definitive auth failure)', () => {
-  const d = decideBoxAuth({ ...OK, meStatus: 500 });
-  assert.equal(d.action, 'skip');
-  assert.equal(d.reason, 'unverified');
-});
-
-test('box, real token, /me 502 (gateway) → skip (fail-open)', () => {
-  const d = decideBoxAuth({ ...OK, meStatus: 502 });
-  assert.equal(d.action, 'skip');
-});
-
-console.log(`\n${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);

package/tests/box_code_staleness.mjs

@@ -1,129 +0,0 @@
-// tests/box_code_staleness.mjs
-//
-// Unit smoke for boxes.computeCodeStaleness (idea 332 / task 1316, ADR 0072) —
-// the pure "is this dev box running stale code?" decision behind the hall's
-// "rebuild to update" flag. No DB, no network.
-//
-// Run:  node tests/box_code_staleness.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-const boxes = require('../modules/dev-box/boxes.js');
-
-let passed = 0;
-let failed = 0;
-function t(name, fn) {
-  try { fn(); passed++; console.log(`  PASS  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
-}
-
-const NOW = Date.UTC(2026, 5, 20, 12, 0, 0); // fixed "now" so cases are deterministic
-const iso = (ms) => new Date(ms).toISOString();
-const HOUR = 3600 * 1000;
-const DAY = 24 * HOUR;
-
-console.log('computeCodeStaleness:');
-
-t('a parked/destroyed box is never judged (not_active)', () => {
-  for (const state of ['parked', 'destroyed', 'provisioning', 'none']) {
-    const r = boxes.computeCodeStaleness({ state, now: NOW });
-    assert.equal(r.stale, false, state);
-    assert.equal(r.reason, 'not_active', state);
-  }
-});
-
-t('active + never reported + just provisioned → not stale (awaiting first report)', () => {
-  const r = boxes.computeCodeStaleness({
-    state: 'active', provisionedAt: iso(NOW - 5 * 60 * 1000), codeReportedAt: null, now: NOW,
-  });
-  assert.equal(r.stale, false);
-  assert.equal(r.reason, 'awaiting_first_report');
-});
-
-t('active + never reported + past the provision grace → NOT stale (never_reported is an unknown, task 1002698)', () => {
-  const r = boxes.computeCodeStaleness({
-    state: 'active', provisionedAt: iso(NOW - 13 * DAY), codeReportedAt: null, now: NOW,
-  });
-  assert.equal(r.stale, false);
-  assert.equal(r.reason, 'never_reported');
-});
-
-// Regression (task 1002698): the whole fleet reported never_reported because the
-// reporter ADR 0072 specified was never written (task 1002699). Silence must never
-// be enough on its own to tell a builder to destroy a working box.
-t('silence alone never flags a box — a report is required to call it stale', () => {
-  for (const age of [31 * 60 * 1000, 13 * DAY, 400 * DAY]) {
-    const r = boxes.computeCodeStaleness({
-      state: 'active', provisionedAt: iso(NOW - age), codeReportedAt: null,
-      serverCommittedAt: iso(NOW - HOUR), now: NOW,
-    });
-    assert.equal(r.stale, false, `age=${age}`);
-  }
-});
-
-t('active + reported a commit within the lag window → current', () => {
-  const r = boxes.computeCodeStaleness({
-    state: 'active',
-    provisionedAt: iso(NOW - 30 * DAY),
-    codeReportedAt: iso(NOW - 5 * 60 * 1000),
-    codeCommittedAt: iso(NOW - 3 * HOUR),     // box code is 3h behind deployed
-    serverCommittedAt: iso(NOW - 1 * HOUR),   // deployed commit is 1h old
-    now: NOW,
-  });
-  assert.equal(r.stale, false);
-  assert.equal(r.reason, 'current');
-});
-
-t('active + reported a commit > 2 days behind deployed → STALE (behind)', () => {
-  const r = boxes.computeCodeStaleness({
-    state: 'active',
-    provisionedAt: iso(NOW - 30 * DAY),
-    codeReportedAt: iso(NOW - 5 * 60 * 1000),
-    codeCommittedAt: iso(NOW - 9 * DAY),      // box stuck 9 days behind (pull not ff)
-    serverCommittedAt: iso(NOW - 1 * HOUR),
-    now: NOW,
-  });
-  assert.equal(r.stale, true);
-  assert.equal(r.reason, 'behind');
-  assert.ok(r.lag_ms > 2 * DAY);
-});
-
-t('reported but no commit dates to compare → not stale (unknown, never false-alarm)', () => {
-  const r = boxes.computeCodeStaleness({
-    state: 'active', provisionedAt: iso(NOW - 30 * DAY),
-    codeReportedAt: iso(NOW - 60 * 1000), codeCommittedAt: null, serverCommittedAt: null, now: NOW,
-  });
-  assert.equal(r.stale, false);
-  assert.equal(r.reason, 'unknown');
-});
-
-t('accepts Date objects as well as ISO strings', () => {
-  const r = boxes.computeCodeStaleness({
-    state: 'active',
-    provisionedAt: new Date(NOW - 30 * DAY),
-    codeReportedAt: new Date(NOW - 60 * 1000),
-    codeCommittedAt: new Date(NOW - 10 * DAY),
-    serverCommittedAt: new Date(NOW - HOUR),
-    now: NOW,
-  });
-  assert.equal(r.stale, true);
-  assert.equal(r.reason, 'behind');
-});
-
-t('exactly at the 2-day lag boundary is NOT stale (strictly greater)', () => {
-  const r = boxes.computeCodeStaleness({
-    state: 'active',
-    provisionedAt: iso(NOW - 30 * DAY),
-    codeReportedAt: iso(NOW - 60 * 1000),
-    codeCommittedAt: iso(NOW - (2 * DAY + HOUR)),
-    serverCommittedAt: iso(NOW - HOUR), // lag exactly 2 days
-    now: NOW,
-  });
-  assert.equal(r.stale, false);
-  assert.equal(r.reason, 'current');
-});
-
-console.log(`\n${passed} passed, ${failed} failed`);
-process.exit(failed ? 1 : 0);

package/tests/box_connect_e2e.mjs

@@ -1,196 +0,0 @@
-// tests/box_connect_e2e.mjs
-//
-// END-TO-END smoke for the builder bootstrap (#685, ADR 0031 §1): runs the REAL
-// infra/box-connect.sh against a local stub server and asserts the whole flow.
-// NO production, NO Postgres, NO GitHub, NO real box — but the genuine shell
-// script, the genuine box router handlers (POST /box/ssh-key, GET
-// /box/managed-settings), and a stubbed device-flow.
-//
-// What it proves a real builder's `curl … | bash` would do:
-//   1. generates an SSH key at OTB_SSH_KEY (private half stays local),
-//   2. device-flow signs in and registers the PUBLIC key — and the fingerprint
-//      the server computes matches the key on disk,
-//   3. downloads + installs managed-settings.json at the install dir,
-//   4. exits 0.
-//
-// Hermetic + deterministic (the device-flow poll returns 'ok' immediately; a
-// PATH shim no-ops `open`/`xdg-open` so no browser pops). Requires bash, curl,
-// ssh-keygen — present on macOS and the CI ubuntu runner.
-//
-// Run:  node tests/box_connect_e2e.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-import http from 'node:http';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawn } from 'node:child_process';
-
-const require = createRequire(import.meta.url);
-const express = require('express');
-const auth = require('../src/bongos/auth.js');
-const o = require('../modules/dev-box/box-onboard.js');
-const gdsDb = require('../src/bongos/db.js');
-const boxes = require('../modules/dev-box/boxes.js');
-const boxAccess = require('../modules/dev-box/box-access.js');
-
-// Async spawn helper: run a real shell script against the in-process stub server
-// without blocking the event loop (spawnSync would deadlock the HTTP server).
-function runScript(scriptArgs, extraEnv) {
-  return new Promise((resolve) => {
-    const child = spawn('bash', scriptArgs, { env: { ...process.env, ...extraEnv } });
-    let stdout = '';
-    let stderr = '';
-    child.stdout.on('data', (d) => { stdout += d; });
-    child.stderr.on('data', (d) => { stderr += d; });
-    const killer = setTimeout(() => child.kill('SIGKILL'), 60000);
-    child.on('close', (status) => { clearTimeout(killer); resolve({ status, stdout, stderr }); });
-  });
-}
-
-let passed = 0;
-let failed = 0;
-function t(name, fn) {
-  try { fn(); passed++; console.log(`  PASS  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
-}
-
-// ── stub the trust boundary + the DB write the connect flow hits ────────────
-let registered = null;
-let CURRENT_DB_BUILDER = { rank: 'metic', status: 'active' };  // flipped to test the clawback
-auth.requireBuilder = (req, _res, next) => { req.builder = { id: 1, github_login: 'e2etester', rank: 'metic' }; next(); };
-auth.requireRank = () => (_req, _res, next) => next();
-o.registerSshKey = async (_db, _id, k) => { registered = k; return { id: 1, key_type: k.keyType, fingerprint: k.fingerprint, label: k.label }; };
-// Stubs for the GET /box/authorized-keys path (box-side sync test below).
-gdsDb.getBuilderById = async () => CURRENT_DB_BUILDER;
-boxes.getBoxByBuilderId = async () => ({ id: 1, builder_id: 1, state: 'active', scope: 'full' });
-boxAccess.recordSourceEvent = async () => {};
-o.listSshKeys = async () => ([{ public_key: 'ssh-ed25519 BUILDERKEYAAA', label: 'laptop' }]);
-o.touchSshKeysUsed = async () => {};
-
-const buildBoxRouter = require('../modules/dev-box/routes/box.js');
-const app = express();
-app.use(express.json());
-// Stub device-flow: start hands back a code, poll immediately approves.
-app.post('/api/gds/auth/device/start', (_req, res) =>
-  res.json({ device_code: 'dc-e2e', user_code: 'WXYZ-1234', verification_uri: 'http://127.0.0.1:9/device', interval: 1, expires_in: 30 }));
-app.post('/api/gds/auth/device/poll', (_req, res) => res.json({ state: 'ok', token: 'e2e-token' }));
-app.use('/api/gds', buildBoxRouter());
-
-const server = http.createServer(app);
-await new Promise((r) => server.listen(0, r));
-const port = server.address().port;
-
-// ── run the REAL bootstrap with test overrides ──────────────────────────────
-const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-e2e-'));
-const keyPath = path.join(tmp, 'otb_builder');
-const settingsDir = path.join(tmp, 'claude');
-// PATH shim so the script's best-effort `open <url>` doesn't launch a browser.
-const shimDir = path.join(tmp, 'bin');
-fs.mkdirSync(shimDir);
-for (const cmd of ['open', 'xdg-open']) {
-  fs.writeFileSync(path.join(shimDir, cmd), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
-}
-
-// Async spawn (NOT spawnSync): the stub server runs in THIS process's event
-// loop, so a synchronous spawn would block it and the child's HTTP calls would
-// hang. spawn + await-on-close keeps the loop free to answer the bootstrap.
-const run = await new Promise((resolve) => {
-  const child = spawn('bash', ['infra/box-connect.sh'], {
-    env: {
-      ...process.env,
-      PATH: `${shimDir}:${process.env.PATH}`,
-      GDS_API_BASE: `http://127.0.0.1:${port}`,
-      OTB_SSH_KEY: keyPath,
-      OTB_MANAGED_SETTINGS_DIR: settingsDir,
-    },
-  });
-  let stdout = '';
-  let stderr = '';
-  child.stdout.on('data', (d) => { stdout += d; });
-  child.stderr.on('data', (d) => { stderr += d; });
-  const killer = setTimeout(() => child.kill('SIGKILL'), 60000);
-  child.on('close', (status) => { clearTimeout(killer); resolve({ status, stdout, stderr }); });
-});
-
-console.log('box-connect.sh end-to-end (real script, stub server):');
-
-t('exits 0', () => {
-  assert.equal(run.status, 0, `non-zero exit. stdout:\n${run.stdout}\nstderr:\n${run.stderr}`);
-});
-
-t('generated an SSH keypair at OTB_SSH_KEY (private + public)', () => {
-  assert.ok(fs.existsSync(keyPath), 'private key missing');
-  assert.ok(fs.existsSync(`${keyPath}.pub`), 'public key missing');
-});
-
-t('registered the public key, and the server-computed fingerprint matches the key on disk', () => {
-  assert.ok(registered, 'registerSshKey was never called');
-  const pub = fs.readFileSync(`${keyPath}.pub`, 'utf8');
-  const expected = o.validateSshPublicKey(pub);
-  assert.equal(registered.fingerprint, expected.fingerprint, 'fingerprint mismatch');
-  // The script trims the comment before sending; stored normalized = "<type> <base64>".
-  assert.equal(registered.publicKey, expected.normalized);
-});
-
-t('installed managed-settings.json at the override dir, keyed off the session login', () => {
-  const f = path.join(settingsDir, 'managed-settings.json');
-  assert.ok(fs.existsSync(f), 'managed-settings.json not written');
-  const s = JSON.parse(fs.readFileSync(f, 'utf8'));
-  assert.equal(s.sshConfigs[0].sshHost, 'root@box-e2etester.dev.example.com');
-  assert.deepEqual(s.sshHostAllowlist, ['*.dev.example.com']);
-});
-
-t('did NOT leak the GDS token into stdout/stderr', () => {
-  assert.ok(!`${run.stdout}${run.stderr}`.includes('e2e-token'), 'token leaked to output');
-});
-
-// ── box-side: box-authorized-keys-fetch.sh against the real route ───────────
-console.log('\nbox-authorized-keys-fetch.sh end-to-end (real script, stub server):');
-
-const sessionFile = path.join(tmp, 'gds-session.json');
-fs.writeFileSync(sessionFile, JSON.stringify({ token: 'e2e-token' }));
-const akFile = path.join(tmp, 'authorized_keys');
-const OPERATOR_LINE = 'ssh-ed25519 OPERATORKEYZZZ operator@control-plane';
-fs.writeFileSync(akFile, OPERATOR_LINE + '\n');  // pre-seed operator key (must survive)
-
-const akEnv = {
-  GDS_BASE: `http://127.0.0.1:${port}/api/gds`,
-  GDS_SESSION: sessionFile,
-  AUTHORIZED_KEYS: akFile,
-};
-
-// Scenario A — active builder: managed block synced, operator key preserved.
-CURRENT_DB_BUILDER = { rank: 'metic', status: 'active' };
-const sync = await runScript(['infra/box-authorized-keys-fetch.sh'], akEnv);
-
-t('active builder: fetch exits 0', () => {
-  assert.equal(sync.status, 0, `stdout:\n${sync.stdout}\nstderr:\n${sync.stderr}`);
-});
-t('active builder: managed block holds the builder key AND the operator key survives', () => {
-  const ak = fs.readFileSync(akFile, 'utf8');
-  assert.ok(ak.includes('BUILDERKEYAAA'), 'builder key not synced');
-  assert.ok(ak.includes(OPERATOR_LINE), 'operator key clobbered');
-  assert.ok(ak.includes(o.MANAGED_BLOCK_BEGIN) && ak.includes(o.MANAGED_BLOCK_END), 'markers missing');
-});
-
-// Scenario B — deactivated builder: 403 clawback empties the block, operator stays.
-CURRENT_DB_BUILDER = { rank: 'metic', status: 'inactive' };
-const claw = await runScript(['infra/box-authorized-keys-fetch.sh'], akEnv);
-
-t('deactivated builder: fetch exits 3 (revoked)', () => {
-  assert.equal(claw.status, 3, `stdout:\n${claw.stdout}\nstderr:\n${claw.stderr}`);
-});
-t('deactivated builder: managed block emptied (login cut), operator key STILL present', () => {
-  const ak = fs.readFileSync(akFile, 'utf8');
-  assert.ok(!ak.includes('BUILDERKEYAAA'), 'builder key NOT revoked — still in authorized_keys!');
-  assert.ok(ak.includes(OPERATOR_LINE), 'operator key clobbered by the clawback');
-  assert.ok(ak.includes(o.MANAGED_BLOCK_BEGIN), 'managed block markers should remain (empty)');
-});
-
-await new Promise((r) => server.close(r));
-fs.rmSync(tmp, { recursive: true, force: true });
-
-console.log(`\nbox_connect_e2e.mjs: ${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);

package/tests/box_cost.mjs

@@ -1,70 +0,0 @@
-// tests/box_cost.mjs — pure-function coverage for the container cost ledger
-// (#602): storageCostUsd (parked-interval cost) + summarizeBoxCost (bucket
-// cost_log rows into spinup/compute/storage/total). The DB writers
-// (recordSpinupCost/recordStorageCost) and the per-builder summary queries take a
-// `db` param and are exercised by the integration smoke, not here. No DB, no clock.
-//
-// Run:  node tests/box_cost.mjs   (also runs in the unit gate)
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-const boxes = require('../modules/dev-box/boxes.js');
-
-let passed = 0, failed = 0;
-const t = (n, f) => { try { f(); passed++; console.log(`  PASS  ${n}`); } catch (e) { failed++; console.log(`  FAIL  ${n}\n        ${e.message}`); } };
-
-t('storageCostUsd: hours parked × snapshot hourly rate (monthly/730)', () => {
-  const hourly = boxes.SNAPSHOT_MONTHLY_USD / 730;
-  // 730h parked ≈ one month
-  const month = boxes.storageCostUsd({ parkedSinceMs: 0, untilMs: 730 * 3_600_000 });
-  assert.ok(Math.abs(month - boxes.SNAPSHOT_MONTHLY_USD) < 0.001, `~monthly: got ${month}`);
-  // 10h parked
-  const ten = boxes.storageCostUsd({ parkedSinceMs: 0, untilMs: 10 * 3_600_000 });
-  assert.ok(Math.abs(ten - hourly * 10) < 0.0001, `10h: got ${ten}`);
-});
-
-t('storageCostUsd: zero/negative/invalid interval → 0', () => {
-  assert.equal(boxes.storageCostUsd({ parkedSinceMs: 100, untilMs: 100 }), 0);
-  assert.equal(boxes.storageCostUsd({ parkedSinceMs: 200, untilMs: 100 }), 0);
-  assert.equal(boxes.storageCostUsd({}), 0);
-  assert.equal(boxes.storageCostUsd({ parkedSinceMs: NaN, untilMs: 1 }), 0);
-});
-
-t('summarizeBoxCost: buckets by source into spinup/compute/storage + total', () => {
-  const rows = [
-    { source: 'box-spinup', amount_usd: 0 },
-    { source: 'box-spinup', amount_usd: 0.02 },
-    { source: 'box-lifecycle', amount_usd: 1.50 },
-    { source: 'box-lifecycle', amount_usd: 0.25 },
-    { source: 'box-storage', amount_usd: 0.30 },
-  ];
-  const s = boxes.summarizeBoxCost(rows);
-  assert.equal(s.spinup_usd, 0.02);
-  assert.equal(s.compute_usd, 1.75);
-  assert.equal(s.storage_usd, 0.30);
-  assert.equal(s.total_usd, 2.07);
-});
-
-t('summarizeBoxCost: empty / null → all zeros', () => {
-  assert.deepEqual(boxes.summarizeBoxCost([]), { spinup_usd: 0, compute_usd: 0, storage_usd: 0, total_usd: 0 });
-  assert.deepEqual(boxes.summarizeBoxCost(null), { spinup_usd: 0, compute_usd: 0, storage_usd: 0, total_usd: 0 });
-});
-
-t('summarizeBoxCost: an unknown source still counts toward total (no silent drop)', () => {
-  const s = boxes.summarizeBoxCost([{ source: 'box-mystery', amount_usd: 0.5 }]);
-  assert.equal(s.total_usd, 0.5);
-  assert.equal(s.compute_usd, 0);
-});
-
-t('BOX_COST_SOURCES covers exactly the three box ledger sources', () => {
-  assert.deepEqual([...boxes.BOX_COST_SOURCES].sort(), ['box-lifecycle', 'box-spinup', 'box-storage']);
-});
-
-t('SPINUP_COST_USD defaults to 0 (DO charges no provision fee; the row is an event marker)', () => {
-  assert.equal(boxes.SPINUP_COST_USD, 0);
-});
-
-console.log(`\nbox_cost: ${passed} passed, ${failed} failed`);
-process.exit(failed ? 1 : 0);

package/tests/box_credential.mjs

@@ -1,125 +0,0 @@
-// tests/box_credential.mjs
-//
-// R102 (goal 1000051, ADR 0148 C4) — VERIFY the server-side-token posture holds
-// once source scope is CLAIM-based (R92–R94). The security property task-scoping
-// must not weaken: the GitHub credential is server-issued per fetch from the prod
-// ENV (never the repo — ADR 0022), the box never receives a fabricated token, and
-// the claim-scoped ACCESS DECISION carries NO secret — the token is minted
-// SEPARATELY, so changing what the box materializes (sparse paths) never touches
-// the token model.
-//
-// Pure + hermetic: makeEnvCredentialProvider takes an injected env; decideSourceAccess
-// is pure. NO env, NO network, NO box. The DEFERRED hardening (short-lived per-claim
-// credential + hard "can't over-pull" isolation) is documented in ADR 0148 C4 /
-// Consequences — this test pins the posture that ships TODAY.
-//
-// Run:  node tests/box_credential.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-const cred = require('../modules/dev-box/box-credential.js');
-const access = require('../modules/dev-box/box-access.js');
-const scopeMap = require('../src/bongos/module-scope-map.js');
-
-let passed = 0;
-let failed = 0;
-function t(name, fn) {
-  try { fn(); passed++; console.log(`  PASS  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
-}
-
-const REPO = 'https://github.com/acme/portable-core.git';
-const STARTER_REPO = 'https://github.com/acme/starter-surface.git';
-
-console.log('box-credential — the token is SERVER-ENV sourced, never fabricated (ADR 0022):');
-
-t('no env configured → configured:false + token:null (the box gets guidance, not a token)', () => {
-  const p = cred.makeEnvCredentialProvider({});
-  for (const scope of ['full', 'starter']) {
-    const c = p.issue(scope, { nowMs: 0 });
-    assert.equal(c.configured, false, `${scope}: unconfigured`);
-    assert.equal(c.token, null, `${scope}: NO token is ever fabricated`);
-    assert.equal(c.repoUrl, null, `${scope}: no repo without env`);
-    assert.match(c.guidance || '', /env/i, `${scope}: guidance points at the prod env`);
-  }
-});
-
-t('repo set but token unset → still configured:false (no partial/empty-token leak)', () => {
-  const c = cred.makeEnvCredentialProvider({ BOX_SOURCE_REPO_URL: REPO }).issue('full', { nowMs: 0 });
-  assert.equal(c.configured, false);
-  assert.equal(c.token, null);
-});
-
-t('token comes STRAIGHT from the env var — and lands ONLY in .token, no other field', () => {
-  const p = cred.makeEnvCredentialProvider({
-    BOX_SOURCE_REPO_URL: REPO,
-    BOX_SOURCE_FULL_TOKEN: 'FULL-SECRET-abc',
-    BOX_SOURCE_STARTER_TOKEN: 'STARTER-SECRET-xyz',
-  });
-  const full = p.issue('full', { nowMs: 0 });
-  assert.equal(full.token, 'FULL-SECRET-abc', 'full scope → the FULL env token, verbatim');
-  const starter = p.issue('starter', { nowMs: 0 });
-  assert.equal(starter.token, 'STARTER-SECRET-xyz', 'starter scope → the STARTER env token, verbatim');
-  // The secret must appear in NO field other than `token` (scope/repoUrl/guidance/
-  // expiresAt/ttl are safe to log + audit — see the source_grant audit).
-  for (const c of [full, starter]) {
-    for (const [k, v] of Object.entries(c)) {
-      if (k === 'token') continue;
-      assert.ok(!String(v).includes(c.token), `secret must not leak into .${k}`);
-    }
-  }
-});
-
-console.log('\nbox-credential — the credential SCOPE is rank-based; scope can never over-reach the repo:');
-
-t('a separate starter repo is a HARD boundary: only "full" reaches the full repo', () => {
-  const p = cred.makeEnvCredentialProvider({
-    BOX_SOURCE_REPO_URL: REPO,
-    BOX_SOURCE_STARTER_REPO_URL: STARTER_REPO,
-    BOX_SOURCE_FULL_TOKEN: 'F',
-    BOX_SOURCE_STARTER_TOKEN: 'S',
-  });
-  assert.equal(p.issue('full', { nowMs: 0 }).repoUrl, REPO, 'full → the full repo');
-  const starter = p.issue('starter', { nowMs: 0 });
-  assert.equal(starter.repoUrl, STARTER_REPO, 'starter → the SEPARATE starter repo, cannot reach the full one');
-  assert.equal(starter.separateStarterRepo, true);
-});
-
-t('fail-closed: an UNEXPECTED scope label ("task"/"base") never escalates to the full repo', () => {
-  // R94 passes only rank scopes ('starter'|'full') to issue(); this pins the safety
-  // margin if a task/base label ever reached it — it takes the NON-full (starter)
-  // branch, so on a separate-starter-repo instance it can't reach the crown jewels.
-  const p = cred.makeEnvCredentialProvider({
-    BOX_SOURCE_REPO_URL: REPO,
-    BOX_SOURCE_STARTER_REPO_URL: STARTER_REPO,
-    BOX_SOURCE_FULL_TOKEN: 'F',
-    BOX_SOURCE_STARTER_TOKEN: 'S',
-  });
-  for (const label of ['task', 'base', 'wizard', undefined]) {
-    const c = p.issue(label, { nowMs: 0 });
-    assert.equal(c.repoUrl, STARTER_REPO, `scope='${label}' must NOT reach the full repo`);
-    assert.notEqual(c.token, 'F', `scope='${label}' must NOT get the full-only token`);
-  }
-});
-
-console.log('\ntask-scoping decoupling — the claim-scoped ACCESS DECISION carries NO secret:');
-
-t('decideSourceAccess returns scope/mode/sparsePaths only — the token is minted separately', () => {
-  const d = access.decideSourceAccess({ rank: 'metic', status: 'active', scopeKeys: ['dev-box'], moduleScopeMap: scopeMap });
-  assert.equal(d.allowed, true);
-  assert.deepEqual(Object.keys(d.spec).sort(), ['mode', 'scope', 'sparsePaths'], 'the spec is scope/mode/sparsePaths — NO credential field');
-  const blob = JSON.stringify(d);
-  assert.ok(!/token|credential|secret|ghp_|github_pat/i.test(blob), 'the decision blob holds no secret-shaped field');
-});
-
-t('revocation scrubs at the credential layer: an inactive/below-floor builder is denied BEFORE any credential', () => {
-  const inactive = access.decideSourceAccess({ rank: 'metic', status: 'inactive', scopeKeys: ['dev-box'], moduleScopeMap: scopeMap });
-  assert.equal(inactive.allowed, false, 'inactive → denied (the route never reaches issue())');
-  const belowFloor = access.decideSourceAccess({ rank: 'xenos', status: 'active', floor: 'metic', scopeKeys: ['dev-box'], moduleScopeMap: scopeMap });
-  assert.equal(belowFloor.allowed, false, 'below floor → denied (no credential path)');
-});
-
-console.log(`\nbox_credential.mjs: ${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);