@bongos/core 1.19.1073 → 1.19.1074

package/tests/government_session_scope.mjs

@@ -1,38 +1,28 @@
-// tests/government_session_scope.mjs — session-scopes as a first-class axis
-// (BV1.R99, ADR 0151 §3; the model behind ADR 0053). DB-free.
+// tests/government_session_scope.mjs — the session-source registry (BV1.R99,
+// ADR 0151 §3). DB-free.
 //
-// A session-scope is capability attached to the TOKEN, not to the builder: a
-// dev-box session is baked onto a machine OUTSIDE the ADR 0016 trust boundary
-// (#919/SR#2), so it must stay limited even when its builder is an Archon.
+// Every builder_sessions row carries a `source`. modules/government/session-scopes.json
+// declares the sources an instance accepts; the kernel (src/bongos/auth.js) DENIES a
+// session whose source it does not declare, on every route (requireBuilder) and every
+// page (runPageGate). Every declared source carries its builder's full rank authority.
 //
-// THE PROPERTY UNDER TEST IS "A SCOPE CAN ONLY EVER NARROW", and it fails in two
-// opposite directions, so both are proven separately:
-//   • UNION INSTEAD OF INTERSECTION ⇒ a box token ESCALATES. Proven by C1/C2 (the
-//     scope names a key the roles do not confer, and the answer must still be
-//     empty) and structurally by B4 (for every input, the narrowed set is a SUBSET
-//     of the unnarrowed role answer — a union cannot satisfy a subset assertion).
-//   • NO DENY-BY-DEFAULT ⇒ an unlisted permission LEAKS. Proven by D1/D2 (a builder
-//     holding the ENTIRE catalog resolves, on a box session, to a hand-written
-//     expected list — not to whatever the registry happens to say).
+// The registry used to be able to declare a NARROWING scope — a deny-by-default
+// allow-list for a machine-baked token. Its only user was the dev box's token (source
+// 'box'), retired by goal 1000120, and the allow-list machinery left with it in task
+// 1003894. What this file now proves:
+//   A — both loaders read the same registry, and it declares exactly cli/web/legacy;
+//   B — both loaders REFUSE a row that still declares a scope, and a malformed or
+//       empty registry, rather than degrading to "every source is accepted";
+//   C — requireBuilder denies an undeclared source (a leftover 'box' row included)
+//       with 403 session_scope and never calls next(); declared sources pass;
+//   D — the page gate agrees (tests/auth_page_gate.mjs holds the fuller page matrix).
 //
-// ORACLE DISCIPLINE. A test whose two sides read the same source of truth passes
-// while proving nothing, so nothing load-bearing here is driven by the registry:
-//   • the Archon-box assertions name Archon powers LITERALLY (builder.rank.set,
-//     government.manage, deploy.push_main …) and cross-check them against `floor`
-//     run through auth.rankMeetsThreshold — the REAL production rank gate, a
-//     pre-R99 oracle;
-//   • the deny-by-default assertions pin a hand-written expected set, so widening
-//     the registry reds this file instead of silently agreeing with it;
-//   • the subset property (B4) is checked against resolver.effectivePermissions —
-//     the unchanged R95 role answer.
-//
-// End-to-end reachability through the real requireBuilder chain lives in
-// tests/box_scope_session.mjs (the #919 regression guard, unchanged in substance by
-// R99); section G here adds the one case that file cannot express — a session
-// source the registry does not declare at all.
+// ORACLE DISCIPLINE: the expected source list is written by hand, not read from the
+// registry, so declaring a new source reds this file instead of silently agreeing.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -47,44 +37,11 @@ let nextSession = null;
 dbKernel.lookupSession = async () => nextSession;
 
 const auth = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
-const catalog = require(path.join(GOV, 'catalog.js'));
-const resolver = require(path.join(GOV, 'resolver.js'));
-const db = require(path.join(GOV, 'db.js'));
 const scopes = require(path.join(GOV, 'session-scopes.js'));
 const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
 
-const { permissionKeys, seedForRank, RANK_ORDER, byKey } = catalog;
-const { narrowToSessionScope, resolveSessionPermissions, effectivePermissions } = resolver;
-
-const ME = 42;
-const EVERYTHING = permissionKeys();
-
-// What a box session is EXPECTED to be able to do — written by hand, deliberately
-// NOT read from the registry. Widening the registry must red this file.
-const EXPECTED_BOX_SCOPE = ['box.manage.own'];
-
-// Archon powers, named literally. If a box session ever resolves one of these the
-// #919 containment is gone.
-const ARCHON_POWERS = [
-  'builder.rank.set', 'government.manage', 'deploy.push_main', 'version.close',
-  'task.confirm.grade_bypass', 'path.protected.modify', 'infra.ssh',
-  'builder.roster.read', 'claim.release.any', 'memory.read.any', 'audit_log.read',
-];
-// Metic powers, named literally — the working rank's authority a box token must
-// not inherit either.
-const METIC_POWERS = ['idea.triage', 'task.create', 'task.edit', 'goal.create', 'box.source.full'];
-
-// Stub the ONE DB read the resolver makes, so the composition is exercised
-// end-to-end without Postgres (the tests/government_ownership_scope.mjs pattern).
-const realGetPermissionKeys = db.getPermissionKeysForBuilder;
-async function holding(keys, fn) {
-  db.getPermissionKeysForBuilder = async () => keys;
-  try {
-    return await fn();
-  } finally {
-    db.getPermissionKeysForBuilder = realGetPermissionKeys;
-  }
-}
+// Hand-written: the sources this instance accepts.
+const EXPECTED_SOURCES = ['cli', 'web', null];
 
 function fakeRes() {
   const res = {
@@ -97,338 +54,107 @@ function fakeRes() {
   return res;
 }
 
-// ═══ A — the axis is explicit, well-formed data, and BOTH loaders agree ════════
-
-test('A1: every scope declares unscoped XOR a permissions allow-list, over a real source', () => {
-  assert.ok(scopes.SESSION_SCOPES.length >= 2, 'expected at least an unscoped and a scoped source');
-  for (const scope of scopes.SESSION_SCOPES) {
-    assert.ok(scope.source === null || (typeof scope.source === 'string' && scope.source.length > 0),
-      `a scope's source must be a non-empty string or null, saw ${JSON.stringify(scope.source)}`);
-    assert.notEqual(scope.unscoped, scope.permissions.length > 0,
-      `${scope.source}: a scope either narrows nothing or names what it allows — never both/neither`);
-    assert.ok(Object.isFrozen(scope) && Object.isFrozen(scope.permissions));
-  }
-});
-
-test('A2: every allow-listed key is a real, operational, non-principal catalog key', () => {
-  for (const scope of scopes.SESSION_SCOPES) {
-    for (const key of scope.permissions) {
-      const permission = byKey(key);
-      assert.ok(permission, `${scope.source} allows "${key}", which the catalog does not define`);
-      assert.equal(catalog.isPrincipalKey(key), false,
-        `${scope.source} allows a machine-principal key — the identity axis never composes with a session scope`);
-      assert.equal(permission.system, false,
-        `${scope.source} allows a system:true key — a scoped token lives outside the trust boundary`);
-    }
-  }
-});
-
-test('A3: the kernel and the governance module read the SAME registry, identically', () => {
-  // The kernel loads it with fs (ADR 0083's one-way rule) while the module requires
-  // it as a sibling, so the two normalizations are the thing that could drift.
-  assert.deepEqual(auth.SESSION_SCOPES.map((s) => ({ ...s, permissions: [...s.permissions] })),
-    scopes.SESSION_SCOPES.map((s) => ({ ...s, permissions: [...s.permissions] })));
-  for (const source of scopes.sources()) {
-    assert.deepEqual(auth.sessionScopeFor(source), scopes.scopeFor(source));
-  }
-});
-
-test('A4: the declared box scope is exactly the hand-written expectation', () => {
-  // The pin that makes the deny-by-default tests below meaningful: widening the
-  // registry must be a conscious edit here, not a silent agreement.
-  assert.deepEqual([...scopes.allowedKeys('box')], EXPECTED_BOX_SCOPE);
-  assert.equal(scopes.isScoped('box'), true);
-  assert.equal(scopes.isScoped('cli'), false);
-  assert.equal(scopes.isScoped('web'), false);
-});
-
-// ═══ B — THE key test: a box session of an ARCHON ═════════════════════════════
-
-test('B1: an ARCHON on a box session resolves ONLY the allow-list, not Archon powers', async () => {
-  await holding(seedForRank('archon'), async () => {
-    const viaBox = await resolveSessionPermissions(ME, 'box');
-    assert.deepEqual([...viaBox], EXPECTED_BOX_SCOPE,
-      'a box token must carry the scope\'s allow-list and nothing else, however senior its builder');
-    for (const key of [...ARCHON_POWERS, ...METIC_POWERS]) {
-      assert.equal(viaBox.includes(key), false, `a box session reached ${key} — the #919 containment is gone`);
-    }
-  });
-});
+async function runRequireBuilder(session) {
+  nextSession = session;
+  const req = { headers: { authorization: 'Bearer anytoken' } };
+  const res = fakeRes();
+  let nexted = false;
+  await auth.requireBuilder(req, res, () => { nexted = true; });
+  return { res, nexted, req };
+}
 
-test('B2: the same builder on a CLI session DOES hold those powers (the test is not vacuous)', async () => {
-  await holding(seedForRank('archon'), async () => {
-    const viaCli = await resolveSessionPermissions(ME, 'cli');
-    for (const key of [...ARCHON_POWERS, ...METIC_POWERS]) {
-      assert.ok(viaCli.includes(key), `an Archon's CLI session must still hold ${key} — B1 would prove nothing otherwise`);
-    }
-    assert.ok(viaCli.length > EXPECTED_BOX_SCOPE.length + 10,
-      'the box scope must be dramatically smaller than the builder\'s real authority');
-  });
-});
+// ═══ A — one registry, read identically by both loaders ═══════════════════════
 
-test('B3: EVERY seeded rank collapses to the same box scope — rank buys nothing on a box token', () => {
-  // Independent oracle: `floor` (an R94 field) through auth.rankMeetsThreshold, the
-  // REAL production rank gate. Anything the rank gate would admit for archon but not
-  // for xenos is rank-bought authority, and none of it may survive a box session.
-  const rankBought = catalog.PERMISSIONS
-    .filter((p) => p.floor !== null && auth.rankMeetsThreshold('archon', [p.floor]) && !auth.rankMeetsThreshold('xenos', [p.floor]))
-    .map((p) => p.key);
-  assert.ok(rankBought.length >= 30, `expected the archon/metic/thetes tiers, saw ${rankBought.length}`);
-  for (const rank of RANK_ORDER) {
-    const viaBox = narrowToSessionScope(seedForRank(rank), 'box');
-    for (const key of rankBought) {
-      assert.equal(viaBox.includes(key), false, `${rank}'s box session reached rank-bought ${key}`);
-    }
-  }
-  // ...and every rank's box session is identical, because the scope — not the rank —
-  // is what decides.
-  const perRank = RANK_ORDER.map((r) => [...narrowToSessionScope(seedForRank(r), 'box')]);
-  for (const resolved of perRank) assert.deepEqual(resolved, perRank[0]);
+test('A1: the registry declares exactly the hand-written sources', () => {
+  assert.deepEqual(scopes.sources(), EXPECTED_SOURCES);
+  assert.deepEqual(auth.SESSION_SCOPES.map((s) => s.source), EXPECTED_SOURCES);
 });
 
-test('B4: for EVERY source and EVERY input, narrowing returns a SUBSET of the role answer', () => {
-  // The structural statement of "can only narrow", against the unchanged R95 role
-  // answer. A union cannot satisfy a subset assertion, so this is the property that
-  // makes widening inexpressible rather than merely unintended.
-  const inputs = [
-    EVERYTHING, [], ['idea.triage'], ['box.manage.own'], seedForRank('xenos'),
-    seedForRank('thetes'), seedForRank('metic'), seedForRank('archon'),
-    ['not.a.real.permission'], ['principal.bfg', 'box.manage.own'],
-  ];
-  for (const source of [...scopes.sources(), 'ghost', undefined]) {
-    for (const input of inputs) {
-      const base = new Set(effectivePermissions(input));
-      for (const key of narrowToSessionScope(input, source)) {
-        assert.ok(base.has(key),
-          `source ${JSON.stringify(source)}: narrowing produced "${key}", which the roles never conferred — this is a WIDENING`);
-      }
-    }
+test('A2: the kernel and the governance module agree on every source, and on the retired one', () => {
+  for (const source of [...EXPECTED_SOURCES, 'box', 'ghost', undefined, 7]) {
+    assert.equal(!!auth.sessionScopeFor(source), !!scopes.scopeFor(source), `loaders disagree on ${String(source)}`);
   }
+  assert.equal(auth.sessionScopeFor('box'), null, 'the retired dev-box source must not be declared');
+  assert.ok(auth.sessionScopeFor(undefined), 'an absent source is the declared legacy row');
 });
 
-// ═══ C — intersection, NOT union: the scope cannot grant ══════════════════════
-
-test('C1: a session-scope cannot grant a permission the builder\'s roles lack', async () => {
-  // The scope names box.manage.own; this builder holds everything EXCEPT it. A
-  // union would hand it over; an intersection must return nothing.
-  const withoutTheKey = EVERYTHING.filter((k) => !EXPECTED_BOX_SCOPE.includes(k));
-  await holding(withoutTheKey, async () => {
-    assert.deepEqual([...await resolveSessionPermissions(ME, 'box')], [],
-      'the scope GRANTED a key the roles do not confer — this is a union, not an intersection');
-  });
-});
-
-test('C2: a builder with no roles at all gets nothing from any scope', async () => {
-  await holding([], async () => {
-    for (const source of [...scopes.sources(), 'ghost']) {
-      assert.deepEqual([...await resolveSessionPermissions(ME, source)], [],
-        `source ${JSON.stringify(source)}: an empty role set must stay empty — a scope is not a grant`);
-    }
-  });
-});
-
-test('C3: a null/blank builder resolves to nothing on every source', async () => {
-  for (const builderId of [null, undefined, '']) {
-    for (const source of scopes.sources()) {
-      assert.deepEqual([...await resolveSessionPermissions(builderId, source)], []);
-    }
+test('A3: no row declares a scope any more', () => {
+  const raw = JSON.parse(fs.readFileSync(path.join(GOV, 'session-scopes.json'), 'utf8'));
+  for (const row of raw.scopes) {
+    assert.equal(row.permissions, undefined, `${row.source}: an allow-list without enforcement would grant full authority`);
+    assert.equal(row.unscoped, undefined, `${row.source}: the scoped/unscoped distinction is gone`);
   }
 });
 
-// ═══ D — deny-by-default: an unlisted permission is denied ════════════════════
-
-test('D1: holding the ENTIRE catalog, a box session still resolves only the allow-list', async () => {
-  await holding(EVERYTHING, async () => {
-    assert.deepEqual([...await resolveSessionPermissions(ME, 'box')], EXPECTED_BOX_SCOPE,
-      'an unlisted permission leaked through — the allow-list is not deny-by-default');
-  });
-});
-
-test('D2: every catalog key outside the allow-list is denied on a box session', () => {
-  const resolved = new Set(narrowToSessionScope(EVERYTHING, 'box'));
-  const listed = new Set(EXPECTED_BOX_SCOPE);
-  const leaked = [...resolved].filter((k) => !listed.has(k));
-  assert.deepEqual(leaked, [], `these unlisted permissions survived a box session: ${leaked.join(', ')}`);
-  // and the coverage is real — the catalog is far bigger than the allow-list
-  assert.ok(EVERYTHING.length > EXPECTED_BOX_SCOPE.length + 50,
-    'the catalog should dwarf the box allow-list, or D1/D2 assert almost nothing');
-});
+// ═══ B — fail closed at load ══════════════════════════════════════════════════
 
-test('D3: route reachability is deny-by-default too — a route that declares nothing is out of reach', () => {
-  assert.equal(auth.sessionScopeAdmits('box', undefined), false, 'a route with no declaration must deny a box session');
-  assert.equal(auth.sessionScopeAdmits('box', []), false, 'an empty declaration is not an opt-in');
-  assert.equal(auth.sessionScopeAdmits('box', ['idea.triage']), false, 'a declaration outside the allow-list must deny');
-  assert.equal(auth.sessionScopeAdmits('box', [...EXPECTED_BOX_SCOPE, 'idea.triage']), false,
-    'every declared capability must be inside the scope — one unlisted key denies the whole route');
-  assert.equal(auth.sessionScopeAdmits('box', EXPECTED_BOX_SCOPE), true);
+test('B1: the kernel parser refuses a narrowing row, an empty registry, and duplicates', () => {
+  assert.throws(() => auth.parseSessionScopes({ scopes: [{ source: 'box', permissions: ['task.ship'] }] }), /Narrowing session scopes were removed/);
+  assert.throws(() => auth.parseSessionScopes({ scopes: [{ source: 'cli', unscoped: true }] }), /declares a scope/);
+  assert.throws(() => auth.parseSessionScopes({ scopes: [] }), /declares no session sources/);
+  assert.throws(() => auth.parseSessionScopes({}), /declares no session sources/);
+  assert.throws(() => auth.parseSessionScopes({ scopes: [{ source: 'cli' }, { source: 'cli' }] }), /duplicate/);
+  assert.throws(() => auth.parseSessionScopes({ scopes: [{ source: '' }] }), /non-empty session source/);
+  // …and the happy shape parses, so the refusals above are not a parser that refuses everything.
+  assert.equal(auth.parseSessionScopes({ scopes: [{ source: 'cli' }, { source: null }] }).size, 2);
 });
 
-// ═══ E — an unknown key on an allow-list is refused, and inert if it got through ══
-
-test('E1: an unknown, system, or principal key on an allow-list is REJECTED at load', () => {
-  // Exercises the SHIPPED assertion (the module exports the validator it runs on
-  // its own data), not a re-implementation of it.
-  const scoped = (permissions) => [scopes.normalizeScope({ source: 'box', permissions })];
-  assert.throws(() => scopes.validateAgainstCatalog(scoped(['not.a.real.permission'])),
-    /which the permission catalog does not define/);
-  assert.throws(() => scopes.validateAgainstCatalog(scoped(['principal.bfg'])),
-    /machine-principal permission/);
-  assert.throws(() => scopes.validateAgainstCatalog(scoped(['deploy.push_main'])),
-    /system:true permission/);
-  assert.throws(() => scopes.validateAgainstCatalog([scopes.normalizeScope({ source: 'box', unscoped: true, permissions: ['box.manage.own'] })]),
-    /never both\/neither/);
-  assert.throws(() => scopes.validateAgainstCatalog([scopes.normalizeScope({ source: 'box' })]),
-    /never both\/neither/);
-  // the real registry passes its own validator (the fixtures above are not the
-  // only thing keeping this green)
-  assert.doesNotThrow(() => scopes.validateAgainstCatalog(scopes.SESSION_SCOPES));
+test('B2: the governance validator refuses the same shapes', () => {
+  const v = (rows) => scopes.validateScopes(rows.map(scopes.normalizeScope));
+  assert.throws(() => v([{ source: 'box', permissions: ['task.ship'] }]), /Narrowing session scopes were removed/);
+  assert.throws(() => v([]), /declares no session sources/);
+  assert.throws(() => v([{ source: 'web' }, { source: 'web' }]), /declared twice/);
+  assert.equal(v([{ source: 'web' }]).length, 1);
 });
 
-test('E2: the kernel loader refuses a malformed registry rather than defaulting to unscoped', () => {
-  assert.throws(() => auth.parseSessionScopes({}), /declares no session scopes/);
-  assert.throws(() => auth.parseSessionScopes({ scopes: [] }), /declares no session scopes/);
-  assert.throws(() => auth.parseSessionScopes({ scopes: [{ source: 'box' }] }), /never both\/neither/);
-  assert.throws(() => auth.parseSessionScopes({ scopes: [{ source: 'box', unscoped: true, permissions: ['x'] }] }), /never both\/neither/);
-  assert.throws(() => auth.parseSessionScopes({ scopes: [{ source: 7, unscoped: true }] }), /non-empty session source string/);
-  assert.throws(() => auth.parseSessionScopes({ scopes: [{ source: 'box', permissions: [42] }] }), /non-string permission key/);
-  assert.throws(() => auth.parseSessionScopes({ scopes: [{ source: 'cli', unscoped: true }, { source: 'cli', unscoped: true }] }), /duplicate session source/);
-});
+// ═══ C — requireBuilder: undeclared ⇒ 403, declared ⇒ through ═════════════════
 
-test('E3: an unknown key that somehow reached an allow-list grants nothing', () => {
-  // Defence in depth behind E1: the intersection is taken against the CATALOG-
-  // FILTERED role answer, so a key the catalog does not define can never appear on
-  // both sides — it is inert as well as refused.
-  const stub = { source: 'x', label: null, unscoped: false, permissions: Object.freeze(['not.a.real.permission']) };
-  const held = effectivePermissions([...EVERYTHING, 'not.a.real.permission']);
-  assert.equal(held.includes('not.a.real.permission'), false, 'the role answer already drops unknown keys');
-  assert.deepEqual(held.filter((k) => stub.permissions.includes(k)), [],
-    'an unknown allow-list key cannot survive the intersection');
+test('C1: a leftover dev-box session (source box) is denied, whatever its rank', async () => {
+  const { res, nexted, req } = await runRequireBuilder({ builder_id: 3, github_login: 'boxbot', rank: 'archon', status: 'active', source: 'box' });
+  assert.equal(nexted, false, 'a retired source must not reach any route');
+  assert.equal(res._status, 403);
+  assert.equal(res._json.error.code, 'session_scope');
+  assert.equal(req.builder, undefined, 'no builder is attached to a denied request');
 });
 
-// ═══ F — a normal CLI/web session is unaffected ═══════════════════════════════
-
-test('F1: an unscoped session resolves EXACTLY the builder\'s role answer, for every rank', async () => {
-  for (const rank of RANK_ORDER) {
-    const roles = seedForRank(rank);
-    for (const source of ['cli', 'web', null, undefined]) {
-      assert.deepEqual([...narrowToSessionScope(roles, source)], [...effectivePermissions(roles)],
-        `${rank} on ${JSON.stringify(source)}: an unscoped session must narrow NOTHING`);
-    }
-  }
-  await holding(seedForRank('metic'), async () => {
-    assert.deepEqual([...await resolveSessionPermissions(ME, 'cli')],
-      [...await resolver.resolveBuilderPermissions(ME)]);
-  });
+test('C2: an unknown source is denied the same way', async () => {
+  const { res, nexted } = await runRequireBuilder({ builder_id: 4, github_login: 'mystery', rank: 'archon', status: 'active', source: 'not-a-source' });
+  assert.equal(nexted, false);
+  assert.equal(res._json.error.code, 'session_scope');
 });
 
-test('F2: an unscoped session reaches every route, declared or not', () => {
+test('C3: cli, web and legacy sessions pass untouched', async () => {
   for (const source of ['cli', 'web', null, undefined]) {
-    assert.equal(auth.sessionScopeAdmits(source, undefined), true);
-    assert.equal(auth.sessionScopeAdmits(source, []), true);
-    assert.equal(auth.sessionScopeAdmits(source, ['box.manage.own']), true);
-    assert.equal(auth.sessionScopeAdmits(source, ['government.manage']), true);
+    const session = { builder_id: 1, github_login: 'someone', rank: 'xenos', status: 'active' };
+    if (source !== undefined) session.source = source;
+    const { nexted, res } = await runRequireBuilder(session);
+    assert.equal(nexted, true, `a ${String(source)} session must reach the route`);
+    assert.equal(res._status, null);
   }
 });
 
-// ═══ G — an unrecognised session source denies ════════════════════════════════
-
-test('G1: an unrecognised source resolves to NOTHING and reaches NO route', async () => {
-  const unrecognised = ['ghost', 'BOX', 'Box', 'box ', ' cli', 'admin', 0, 1, {}, [], true, false, NaN];
-  await holding(EVERYTHING, async () => {
-    for (const source of unrecognised) {
-      assert.equal(auth.sessionScopeFor(source), null, `${String(source)} must not resolve to a scope`);
-      assert.deepEqual([...await resolveSessionPermissions(ME, source)], [],
-        `${String(source)} must resolve to no authority at all, never to "full"`);
-      assert.equal(auth.sessionScopeAdmits(source, ['box.manage.own']), false);
-      assert.equal(auth.sessionScopeAdmits(source, undefined), false);
-    }
-  });
-});
-
-test('G2: requireBuilder DENIES a session whose source the registry does not declare', async () => {
-  nextSession = { builder_id: 3, github_login: 'ghost', rank: 'archon', status: 'active', source: 'ghost' };
-  const req = { headers: { authorization: 'Bearer ghosttoken' } };
+test('C4: the retired doorway alias admits nothing extra', async () => {
+  // src/module-api.js keeps `allowBoxScope` as a no-op until the next MAJOR. Mounting
+  // it ahead of requireBuilder must not let a box session through.
+  const api = require(path.join(ROOT, 'src', 'module-api.js'));
+  nextSession = { builder_id: 3, github_login: 'boxbot', rank: 'archon', status: 'active', source: 'box' };
+  const req = { headers: { authorization: 'Bearer boxtoken' } };
   const res = fakeRes();
   let nexted = false;
+  api.allowBoxScope(req, res, () => {});
   await auth.requireBuilder(req, res, () => { nexted = true; });
-  assert.equal(nexted, false, 'an unclassifiable session must never be treated as unscoped');
-  assert.equal(res._status, 403);
-  assert.equal(res._json.error.code, 'box_scope');
-  // ...and it stays denied even on a route that opted in, because the DENIAL is the
-  // session's, not the route's.
-  const optedIn = { headers: { authorization: 'Bearer ghosttoken' } };
-  auth.allowBoxScope(optedIn, fakeRes(), () => {});
-  const res2 = fakeRes();
-  let nexted2 = false;
-  await auth.requireBuilder(optedIn, res2, () => { nexted2 = true; });
-  assert.equal(nexted2, false);
-  assert.equal(res2._status, 403);
-  nextSession = null;
-});
-
-// ═══ H — the earlier axes are undisturbed ════════════════════════════════════
-
-test('H1: R95/R98/R100 invariants still hold — the role answer is untouched', async () => {
-  // R99 composes ON TOP of effectivePermissions; widening INSIDE it would red
-  // tests/government_parity.mjs Parts A and C.
-  assert.deepEqual(effectivePermissions(['principal.bfg', 'box.manage.own']), ['box.manage.own']);
-  assert.deepEqual(effectivePermissions(['idea.triage', 'not.a.real.permission']), ['idea.triage']);
-  for (const rank of RANK_ORDER) {
-    assert.deepEqual([...effectivePermissions(seedForRank(rank))].sort(),
-      [...seedForRank(rank)].filter((k) => !catalog.isPrincipalKey(k)).sort());
-  }
-  await holding(EVERYTHING, async () => {
-    // principals are still the other axis
-    assert.deepEqual([...resolver.resolvePrincipalPermissions('bfg')], ['principal.bfg']);
-    assert.deepEqual([...resolver.resolvePrincipalPermissions(null)], []);
-    // ownership is still a conjunction the plain resolve refuses to answer
-    assert.equal(await resolver.builderHasPermissions(ME, ['box.manage.own']), false);
-    assert.equal(await resolver.authorizeOwned(ME, 'box.manage.own', { ownerId: 99 }), false);
-    assert.equal(await resolver.authorizeOwned(ME, 'box.manage.own', { ownerId: ME }), true);
-  });
-});
-
-test('H2: a box session narrows to an OWNERSHIP-SCOPED key, which still is not an unconditional grant', async () => {
-  // The two axes compose without either swallowing the other: the session-scope
-  // says WHICH keys survive; the ownership axis still demands the row be yours.
-  await holding(seedForRank('archon'), async () => {
-    assert.deepEqual([...await resolveSessionPermissions(ME, 'box')], ['box.manage.own']);
-    assert.equal(await resolver.authorizeOwned(ME, 'box.manage.own', { ownerId: 99 }), false,
-      'surviving the session scope must not turn .own into an unconditional grant');
-    // the cross-owner escalation an Archon holds by role is NOT in the box scope
-    assert.equal(narrowToSessionScope(seedForRank('archon'), 'box').includes('box.fleet.manage'), false);
-  });
-});
-
-test('H3: the resolve is still per-request and frozen — no memoised session authority', async () => {
-  let calls = 0;
-  let keys = ['box.manage.own'];
-  db.getPermissionKeysForBuilder = async () => { calls += 1; return keys; };
-  try {
-    assert.deepEqual([...await resolveSessionPermissions(ME, 'box')], ['box.manage.own']);
-    keys = [];
-    assert.deepEqual([...await resolveSessionPermissions(ME, 'box')], []);
-    assert.equal(calls, 2, 'a revoked grant must take effect on the very next resolve (ADR 0016)');
-  } finally {
-    db.getPermissionKeysForBuilder = realGetPermissionKeys;
-  }
-  assert.ok(Object.isFrozen(narrowToSessionScope(EVERYTHING, 'box')));
-  assert.ok(Object.isFrozen(narrowToSessionScope(EVERYTHING, 'ghost')));
+  assert.equal(nexted, false);
+  assert.equal(res._json.error.code, 'session_scope');
 });
 
-// ═══ I — the ONE governance port carries the axis ════════════════════════════
+// ═══ D — the auth exports carry no narrowing machinery ════════════════════════
 
-test('I1: the session-scope axis lands on the single governance port', () => {
-  const { governmentPort } = require(path.join(GOV, 'routes', 'government.js'));
-  for (const name of ['resolveSessionPermissions', 'narrowToSessionScope', 'sessionScopeFor', 'listSessionScopes']) {
-    assert.equal(typeof governmentPort[name], 'function', `the port must expose ${name}`);
+test('D1: the narrowing helpers are gone from auth and the resolver', () => {
+  for (const name of ['allowBoxScope', 'sessionScope', 'sessionScopeAdmits']) {
+    assert.equal(auth[name], undefined, `auth.${name} should be gone`);
   }
-  // still the same one object port the earlier slices registered
-  for (const name of ['resolveBuilderPermissions', 'resolvePrincipalPermissions', 'authorizeOwned']) {
-    assert.equal(typeof governmentPort[name], 'function');
+  const resolver = require(path.join(GOV, 'resolver.js'));
+  for (const name of ['narrowToSessionScope', 'resolveSessionPermissions']) {
+    assert.equal(resolver[name], undefined, `resolver.${name} should be gone`);
   }
-  assert.deepEqual([...governmentPort.sessionScopeFor('box').permissions], EXPECTED_BOX_SCOPE);
-  assert.equal(governmentPort.sessionScopeFor('ghost'), null);
-  assert.deepEqual([...governmentPort.narrowToSessionScope(seedForRank('archon'), 'box')], EXPECTED_BOX_SCOPE);
-  assert.ok(governmentPort.listSessionScopes().length >= 2);
 });

package/tests/hall_error_envelope.mjs

@@ -212,6 +212,10 @@ async function bootTaskPage({ task, failWith }) {
   const realToast = sandbox.window.OTB.toast;
   sandbox.window.OTB = { ...sandbox.window.OTB, toast: (m) => { toasts.push(String(m)); } };
   void realToast;
+  // task 1003459: task.js now destructures window.OTBClaimAction at eval time
+  // (its Claim it button) — load claim-action.js first, exactly the real
+  // page's script order (task.html loads it before task.js).
+  vm.runInContext(fs.readFileSync(path.join(HALL, 'claim-action.js'), 'utf8'), sandbox, { filename: 'claim-action.js' });
   vm.runInContext(fs.readFileSync(path.join(HALL, 'task.js'), 'utf8'), sandbox, { filename: 'task.js' });
   assert.ok(document._ready, 'task.js registered a DOMContentLoaded handler');
   await document._ready();

package/tests/hall_landing_boot.mjs

@@ -91,7 +91,7 @@ async function boot({ meStatus }) {
       wirePager: () => {},
     },
     OTBHallRender: () => ({
-      SETUP_CONFIG_KEY: 'k', analyticsState: {}, lbState: {},
+      analyticsState: {}, lbState: {},
       shipState: {}, shipsPager: { page: 1 }, welcomeDismissalKey: () => 'k',
       mountHallWidgets: spy('mountHallWidgets'),
       renderLanding: spy('renderLanding'),
@@ -99,6 +99,9 @@ async function boot({ meStatus }) {
       renderNav: spy('renderNav'), renderOnboarding: spy('renderOnboarding'),
       renderProfile: spy('renderProfile'), renderRecentShips: spy('renderRecentShips'),
       renderWelcomeCore: spy('renderWelcomeCore'),
+      // task 1003459 — wireEvents() calls this unconditionally now (the Home
+      // Next-up Claim button), so an incomplete stub throws mid-wire.
+      wireNextUpClaim: spy('wireNextUpClaim'),
     }),
     matchMedia: () => ({ matches: false, addEventListener() {} }),
     localStorage: { getItem() { return null; }, setItem() {}, removeItem() {} },

package/tests/hall_palette.mjs

@@ -28,7 +28,7 @@ const SHELL_SRC = read('shell.js');
 
 // Boot palette.js against a DOM stub whose sidebar carries `navItems`, and whose
 // `visibleIds` decide which section groups are on offer. Returns window.OTBPalette.
-function bootPalette({ navItems = [], visibleIds = ['nav-standing', 'nav-work', 'shell-user'], modules = null } = {}) {
+function bootPalette({ navItems = [], visibleIds = ['nav-standing', 'nav-work', 'shell-user'] } = {}) {
   const makeNav = (it) => ({
     hidden: !!it.hidden,
     target: it.external ? '_blank' : '',
@@ -60,7 +60,6 @@ function bootPalette({ navItems = [], visibleIds = ['nav-standing', 'nav-work',
     activeElement: null,
   };
   const windowObj = { location: { hash: '', assign() {} }, addEventListener() {}, open() {} };
-  if (modules) windowObj.__MODULES__ = { enabled: modules };
   const sandbox = {
     window: windowObj, document: documentObj, navigator: { platform: 'Win32', userAgent: 'test' },
     console,
@@ -143,20 +142,6 @@ test('Settings panel anchors exist in settings.js RAIL_GROUPS', () => {
   }
 });
 
-test('the Dev box panel jump carries settings.js own dev-box module condition', () => {
-  // settings.js builds that panel only when moduleOn('dev-box'); offering the
-  // jump regardless would land on a panel that was never rendered.
-  assert.match(read('settings.js'), /moduleOn\('dev-box'\)\s*\?\s*\[\{ id: 'devbox'/,
-    'settings.js still gates the devbox panel on the module');
-  assert.match(PALETTE_SRC, /href: '\/settings#devbox', module: 'dev-box'/,
-    'so the palette entry must declare the same module');
-
-  const on = bootPalette({ navItems: NAV_FIXTURE, modules: { 'dev-box': true } }).compute('dev box');
-  assert.ok(on.some((r) => r.href === '/settings#devbox'), 'offered when the module is on');
-  const off = bootPalette({ navItems: NAV_FIXTURE, modules: { 'dev-box': false } }).compute('dev box');
-  assert.ok(!off.some((r) => r.href === '/settings#devbox'), 'withheld when the module is off');
-});
-
 test('the anchor guard actually CATCHES a declared id that does not exist', () => {
   const groups = ['work', 'karma', 'progress', 'achievements'];
   assert.equal(groups.includes('standing-nope'.replace('standing-', '')), false,

package/tests/hall_record_world.mjs

@@ -286,6 +286,11 @@ const TASK_SRC = read('task.js');
 // task.html loads md-reader.js ahead of task.js (task 1003465), so the sandbox
 // does the same: the description renders through it.
 const MD_SRC = read('md-reader.js');
+// task 1003459: task.js now destructures window.OTBClaimAction at eval time
+// (its Claim it button) — task.html loads claim-action.js ahead of task.js,
+// so the sandbox does too. Real file, not a stub: it is dependency-free and
+// DOM-free, so running it is exactly as cheap as stubbing it.
+const CLAIM_ACTION_SRC = read('claim-action.js');
 
 // grade / sessionLogs / claims (task 1003437): left undefined, the stub answers
 // like a client that never asked (the key is absent); null or an array answers
@@ -400,6 +405,7 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   if (withReader) vm.runInContext(MD_SRC, sandbox, { filename: 'md-reader.js' });
+  vm.runInContext(CLAIM_ACTION_SRC, sandbox, { filename: 'claim-action.js' });
   vm.runInContext(TASK_SRC, sandbox, { filename: 'task.js' });
   assert.ok(onReady, 'task.js registers its DOMContentLoaded boot');
   return {