@bongos/core 1.19.1073 → 1.19.1075

package/tests/government_protected_surfaces.mjs

@@ -185,9 +185,11 @@ const ADDED_SINCE_R101 = [
   },
   // task 1002891 (from idea 1000692, raised by the grader's hacker worker). Group
   // 'box-access' protected who DECIDES box access but nothing that HOLDS the
-  // infrastructure credentials those decisions spend. The five readers below are the
+  // infrastructure credentials those decisions spend. The readers below are the
   // COMPUTED set — the credential-reader tripwire further down recomputes it from the
   // tracked tree on every run — plus do-api.js, which the credential is handed to.
+  // (Three more readers — the box control plane's box.js, box-infra.js and
+  // cf-tunnel.js — were deleted with it in task 1003893, entries and all.)
   {
     after: 'modules/dev-box/box-credential.js',
     glob: 'scripts/gds/provision-config.js',
@@ -205,29 +207,6 @@ const ADDED_SINCE_R101 = [
   },
   {
     after: 'scripts/gds/provision-net.js',
-    glob: 'scripts/gds/box-infra.js',
-    why: 'reads process.env.CLOUDFLARE_API_TOKEN and process.env.CLOUDFLARE_ACCOUNT_ID '
-       + 'into the Cloudflare config the box plane provisions tunnels and DNS against.',
-  },
-  {
-    after: 'scripts/gds/box-infra.js',
-    glob: 'scripts/gds/cf-tunnel.js',
-    why: 'defaults its token parameter to process.env.CLOUDFLARE_API_TOKEN, so it reads '
-       + 'the credential whenever a caller omits one. The recorded decision did not name '
-       + 'this file; the recomputation found it, which is the case for computing the set '
-       + 'rather than transcribing a list.',
-  },
-  {
-    after: 'scripts/gds/cf-tunnel.js',
-    glob: 'scripts/gds/box.js',
-    why: 'reads process.env.DO_API_TOKEN — the DigitalOcean control plane for the box '
-       + 'fleet, and also not named by the recorded decision. Adding it widens no module '
-       + 'wall: the dev-box key already lists this path and already derives protected '
-       + 'from the modules/dev-box/ entries, so the derived protected-module set is '
-       + 'unchanged (asserted below).',
-  },
-  {
-    after: 'scripts/gds/box.js',
     glob: 'scripts/gds/do-api.js',
     why: 'the DigitalOcean API client the token is handed TO. It reads no process.env '
        + 'value — the token arrives as a parameter and the constructor throws when a live '
@@ -281,9 +260,6 @@ const ADDED_SINCE_R101 = [
   ...carve('src/bongos/db.js', ['db-kernel'],
     'the kernel slice carved out of db.js: builder identity and the rank reads the '
     + 'SEC #863 entry exists for.'),
-  ...carve('scripts/gds/box.js', ['box-auth-check', 'box-sync'],
-    'the box.js family: the dev-box session-start auth gate and the box sync; box-infra.js '
-    + 'was already listed by name.'),
   ...carve('modules/grading/grader.js', ['grader-config', 'grader-model', 'grader-no-artifact',
     'grader-prompt', 'grader-score', 'grader-subagent'],
     'the grader.js carve: the deterministic permission-path pre-pass and the server-side '
@@ -338,8 +314,24 @@ const RENAMED_SINCE_R101 = [
   },
 ];
 
+// Surfaces RETIRED since R101 — the protected FILE itself was deleted from the
+// repo, so there is nothing left to protect. The third shape, and the narrowest: a
+// retirement is accepted only for a path the tracked tree no longer contains (the
+// test below checks the tree, not this prose), so it can never be used to drop
+// protection from code that still runs. Applied LAST, after renames and additions,
+// so an addition anchored on a retired entry still resolves.
+const RETIRED_SINCE_R101 = [
+  ...['boxes.js', 'box-access.js', 'box-credential.js'].map((f) => ({
+    glob: `modules/dev-box/${f}`,
+    why: 'task 1003892 (goal 1000120) deleted the dev-box module outright — the rank floor '
+       + 'and source-credential code these entries guarded no longer exists anywhere in '
+       + 'the tree, and the fleet it decided access to was already torn down.',
+  })),
+];
+
 // The list the registry must produce TODAY: the pre-R101 set with each
-// documented addition spliced in at its declared position.
+// documented addition spliced in at its declared position, then each documented
+// retirement removed.
 const EXPECTED_GLOBS = (() => {
   let out = [...EXPECTED_GLOBS_BEFORE_R101];
   for (const r of RENAMED_SINCE_R101) {
@@ -352,6 +344,11 @@ const EXPECTED_GLOBS = (() => {
     assert.notEqual(at, -1, `ADDED_SINCE_R101 anchors on '${a.after}', which is not in the list`);
     out.splice(at + 1, 0, a.glob);
   }
+  for (const r of RETIRED_SINCE_R101) {
+    const at = out.indexOf(r.glob);
+    assert.notEqual(at, -1, `RETIRED_SINCE_R101 retires '${r.glob}', which is not in the list`);
+    out.splice(at, 1);
+  }
   return out;
 })();
 
@@ -363,8 +360,10 @@ test('nothing protected before R101 has been unprotected since', () => {
   // replacement must actually be present — otherwise "it was renamed" becomes a
   // way to unprotect a trust surface with a comment.
   const renamedFrom = new Map(RENAMED_SINCE_R101.map((r) => [r.from, r.to]));
+  const retired = new Set(RETIRED_SINCE_R101.map((r) => r.glob));
   for (const glob of EXPECTED_GLOBS_BEFORE_R101) {
     if (registry.PROTECTED_GLOBS.includes(glob)) continue;
+    if (retired.has(glob)) continue; // proven gone from the tree by the test below
     const to = renamedFrom.get(glob);
     assert.ok(to,
       `'${glob}' was protected before R101 and is no longer in the registry — `
@@ -376,6 +375,20 @@ test('nothing protected before R101 has been unprotected since', () => {
   }
 });
 
+test('a surface is retired only once its path is gone from the tracked tree', () => {
+  // The whole guarantee of RETIRED_SINCE_R101: "the file was deleted" is checked
+  // against git, so a retirement cannot unprotect a live path with a comment.
+  const tracked = execFileSync('git', ['ls-files'], { cwd: ROOT, encoding: 'utf8' })
+    .split('\n').map((f) => f.trim()).filter(Boolean);
+  for (const r of RETIRED_SINCE_R101) {
+    assert.ok(r.why && r.why.length > 40, `${r.glob} must record WHY it was retired`);
+    assert.ok(!registry.PROTECTED_GLOBS.includes(r.glob), `${r.glob} is declared retired but is still registered`);
+    const prefix = r.glob.endsWith('/') ? r.glob : null;
+    const live = tracked.filter((f) => (prefix ? f.startsWith(prefix) : f === r.glob));
+    assert.deepEqual(live, [], `${r.glob} is declared retired but the tree still tracks it — a live path cannot be unprotected this way`);
+  }
+});
+
 test('every rename since R101 carries a documented reason', () => {
   for (const r of RENAMED_SINCE_R101) {
     assert.ok(r.why && r.why.length > 40,
@@ -452,7 +465,8 @@ test('every execution root in the closure is a protected surface (MIT1 drift tri
 //
 // task 1004024. Splitting a protected file into `<name>-<phase>.js` siblings is this repo's
 // carve convention, and every carve so far left only the facade registered: ship.js (21
-// files), grader.js (6), auth.js (5), db.js, box.js. A require()-graph rule was measured and
+// files), grader.js (6), auth.js (5), db.js (and one more family since deleted outright,
+// task 1003893). A require()-graph rule was measured and
 // rejected — from the protected scripts it reaches 52 unprotected files (upgrade.js, login.js,
 // package-core.js…), floor-gating ordinary work. The name rule is the shape a carve leaves.
 function stemSiblings(entry, tracked) {
@@ -494,7 +508,7 @@ test('every file split out of a protected file is itself protected (1004024 carv
         `${rel} is floored at '${surface.floor}', below the ${entry} it was carved from.`);
     }
   }
-  assert.ok(checked >= 35, `fixture sanity: expected the five known carves (35 files), saw ${checked}`);
+  assert.ok(checked >= 35, `fixture sanity: expected the four known carves (35 files), saw ${checked}`);
 });
 
 // ---------- the credential tripwire: every credential READER is a protected surface ----------
@@ -612,10 +626,13 @@ test('credentialReadsIn does not fire on a near-miss', () => {
 
 test('every credential reader in the tree is a protected surface (1002891 tripwire)', () => {
   const readers = credentialReaders();
-  assert.ok(readers.length >= 5,
+  // The floor was five from task 1002891 until task 1003893 deleted three of the
+  // readers (the box control plane's box.js, box-infra.js and cf-tunnel.js), leaving
+  // provision-config.js and provision-net.js.
+  assert.ok(readers.length >= 2,
     'fixture sanity: the scan found '
-    + `${readers.length} credential reader(s), and the tree has had at least five since `
-    + 'task 1002891. A scan that finds nothing passes every assertion below without '
+    + `${readers.length} credential reader(s), and the tree has had at least two since `
+    + 'task 1003893. A scan that finds nothing passes every assertion below without '
     + 'checking anything — treat this as the scanner being broken, not as good news.');
   for (const rel of readers) {
     const surface = ppc.surfaceFor(rel);
@@ -623,7 +640,7 @@ test('every credential reader in the tree is a protected surface (1002891 tripwi
       `${rel} READS an infrastructure credential off process.env `
       + `(${credentialReadsIn(fs.readFileSync(path.join(ROOT, rel), 'utf8')).join(', ')}) `
       + 'but no protected surface covers it. Add it to '
-      + 'modules/government/protected-surfaces.json (group "box-access") and declare it '
+      + 'modules/government/protected-surfaces.json (group "control-plane") and declare it '
       + 'in ADDED_SINCE_R101 above.');
     assert.ok(ppc.RANK_TIER[surface.floor] >= ppc.RANK_TIER.metic,
       `${rel} holds an infrastructure credential but is floored at '${surface.floor}' — `
@@ -698,9 +715,11 @@ test('registering the credential readers widened no module wall', () => {
     'the provisioning module derived protected:true — a credential-reader entry reached '
     + 'modules/provisioning/ or scripts/gds/provision.js, which walls goals 1000032, '
     + '1000046 and 1000059 behind an Archon join. Keep the entries file-level.');
-  assert.ok(protectedNow.includes('dev-box'),
-    'dev-box was already protected via its modules/dev-box/ globs before 1002891; if it '
-    + 'is not, the premise of the box.js entry has changed.');
+  // Since task 1003892 the readers are owned by their own control-plane scope, which
+  // is protected BY them — that is where the wall belongs, not on provisioning.
+  assert.ok(protectedNow.includes('control-plane'),
+    'the control-plane scope owns the credential readers and must derive protected:true; '
+    + 'if it does not, a reader lost its registry entry or its owner.');
 });
 
 // ---------- the routine-switch tripwire: every SWITCHBOARD is a protected surface ----------

package/tests/government_require_permission.mjs

@@ -255,7 +255,7 @@ test('over the four seeded ranks, requirePermission admits exactly who requireRa
   // means a floor moving without an owner decision reds the build, which is the whole
   // point of keeping parity as an assertion instead of prose.
   const DELEGATED_TO_METIC_BY_ADR_0155 = [
-    'autonomy.precheck', 'box.fleet.manage', 'discord.channels.manage', 'idea.ratify',
+    'autonomy.precheck', 'discord.channels.manage', 'idea.ratify',
     'claim.release.any', 'criterion.unsatisfy', 'goal.reorder', 'task.newcomer_restock',
     'task.peer_votes.tally', 'override_request.decide', 'memory.read.any',
     'project.curate', 'provisioning.fleet.manage', 'security.report.adjudicate',
@@ -439,7 +439,7 @@ test('every modules/*/routes gate is migrated, bar the one documented holdout',
 // the OWNERSHIP axis cannot gate a route (task 1003197 (C))
 // ---------------------------------------------------------------------------
 //
-// `held.has('box.manage.own')` is true for anyone whose rank carries the atom, so a
+// `held.has('task.abandon.own')` is true for anyone whose rank carries the atom, so a
 // gate mounted on an ownership-scoped key would admit UNCONDITIONALLY — `.own`
 // collapsed into `.any`, the exact degradation the axis exists to prevent, because
 // the gate is never handed the row whose owner is the other half of the question.
@@ -463,7 +463,7 @@ const OWNED_KEY = catalog.permissionKeys().find((k) => catalog.isOwnershipScoped
 
 test('the catalog still declares at least one ownership-scoped key', () => {
   // If the axis were ever emptied, the assertions below would pass vacuously.
-  assert.ok(OWNED_KEY, 'expected an ownership-scoped atom in the catalog (e.g. box.manage.own)');
+  assert.ok(OWNED_KEY, 'expected an ownership-scoped atom in the catalog (e.g. task.abandon.own)');
 });
 
 test('an ownership-scoped key 403s even when the builder HOLDS it', async () => {

package/tests/government_seed.mjs

@@ -91,6 +91,13 @@ function grantBlocksForRole(role) {
 // not a guard.
 const REVOKE_RE =
   /DELETE\s+FROM\s+govern(?:ance_role|ment_rank)_permissions\s+WHERE\s+(?:rank_key|role_key)\s*=\s*'([^']+)'\s+AND\s+permission_key\s*=\s*'([^']+)'/gi;
+// The EVERY-RANK form (task 1003894): a key RETIRED from the catalog is revoked
+// from every rank at once, custom ranks included, so the statement names no rank:
+//   DELETE FROM government_rank_permissions WHERE permission_key IN ('a', 'b');
+// government_019 is the first. Read as "gone from every role" by the fold below.
+const REVOKE_ALL_RE =
+  /DELETE\s+FROM\s+govern(?:ance_role|ment_rank)_permissions\s+WHERE\s+permission_key\s+IN\s*\(([^)]*)\)\s*;/gi;
+const keysIn = (list) => [...list.matchAll(/'([^']+)'/g)].map((x) => x[1]);
 
 
 // The EFFECTIVE grant set: walk the migrations in filename order, adding each
@@ -109,6 +116,9 @@ function effectiveKeysForRole(role) {
     for (const m of code.matchAll(new RegExp(REVOKE_RE.source, 'gi'))) {
       if (m[1] === role) held.delete(RENAMED_KEYS.get(m[2]) || m[2]);
     }
+    for (const m of code.matchAll(new RegExp(REVOKE_ALL_RE.source, 'gi'))) {
+      for (const k of keysIn(m[1])) held.delete(RENAMED_KEYS.get(k) || k);
+    }
   }
   return held;
 }
@@ -152,14 +162,37 @@ test('every revoking migration is in the shape the union model subtracts', () =>
     const deletes = [...code.matchAll(/DELETE\s+FROM\s+(govern(?:ance_role|ment_rank)_permissions)\b/gi)];
     if (deletes.length === 0) continue;
     const parsed = [...code.matchAll(new RegExp(REVOKE_RE.source, 'gi'))];
-    assert.equal(parsed.length, deletes.length,
-      `${file}: ${deletes.length} DELETE(s) but only ${parsed.length} parseable by REVOKE_RE — `
+    const parsedAll = [...code.matchAll(new RegExp(REVOKE_ALL_RE.source, 'gi'))];
+    assert.equal(parsed.length + parsedAll.length, deletes.length,
+      `${file}: ${deletes.length} DELETE(s) but only ${parsed.length + parsedAll.length} parseable by REVOKE_RE / REVOKE_ALL_RE — `
       + 'the union model would silently overstate the grant set. Match the '
-      + "`DELETE FROM government_rank_permissions WHERE rank_key = '…' AND permission_key = '…'` shape.");
+      + "`DELETE FROM government_rank_permissions WHERE rank_key = '…' AND permission_key = '…'` shape, "
+      + "or `… WHERE permission_key IN ('…')` to revoke from every rank.");
     for (const m of parsed) {
       assert.ok(RANK_ORDER.includes(m[1]), `${file}: revokes from unknown rank '${m[1]}'`);
     }
+    for (const m of parsedAll) {
+      assert.ok(keysIn(m[1]).length > 0, `${file}: an every-rank revoke names no key`);
+    }
+  }
+});
+
+test('an every-rank revocation removes a retired key from EVERY rank', () => {
+  // government_019 (task 1003894) retires the three dev-box keys with one statement
+  // and no rank predicate. governance_002 granted box.manage.own to all four seeded
+  // ranks, so all four must come out without it — and the raw union must still
+  // hold it, or the historical grant was edited away rather than superseded.
+  for (const role of RANK_ORDER) {
+    for (const key of ['box.source.full', 'box.fleet.manage', 'box.manage.own']) {
+      assert.equal(effectiveKeysForRole(role).has(key), false, `${role} still holds ${key}`);
+    }
   }
+  const rawUnion = applyRenames(grantBlocksForRole('xenos').flatMap((b) => b.keys));
+  assert.ok(rawUnion.includes('box.manage.own'),
+    'the historical grant must remain in governance_002 — migrations are run-once and are never rewritten');
+  // The shape the fold reads must be the shape the migration was written in.
+  const sql = fs.readFileSync(path.join(MIG_DIR, 'government_019_retire_box_permissions.sql'), 'utf8');
+  assert.equal([...stripComments(sql).matchAll(new RegExp(REVOKE_ALL_RE.source, 'gi'))].length, 1);
 });
 
 test('a revocation actually removes the key from the effective set', () => {
@@ -217,7 +250,7 @@ test('later grant migrations are idempotent + transactional', () => {
     const code = stripComments(sql);
     const inserts = code.match(/INSERT INTO/g) || [];
     const onConflict = code.match(/ON CONFLICT/g) || [];
-    const revokes = [...code.matchAll(new RegExp(REVOKE_RE.source, 'gi'))];
+    const revokes = [...code.matchAll(new RegExp(REVOKE_RE.source, 'gi')), ...code.matchAll(new RegExp(REVOKE_ALL_RE.source, 'gi'))];
     // A migration must DO something to the grant set — but since BV1.R21 (task
     // 1003608) "something" includes taking a permission away, not only adding
     // one. A REVOKE-only migration inserts nothing by design and needs no ON