@bongos/core 1.19.1073 → 1.19.1075

package/tests/box_access.mjs

@@ -1,578 +0,0 @@
-// tests/box_access.mjs
-//
-// Hermetic unit smoke for the rank-gated SOURCE-access decision core of
-// modules/dev-box/box-access.js (ADR 0031 §6 + §9.2, task #600; extended for the
-// sandbox-for-everyone starter scope, ADR 0052 / #1001). Covers the PURE
-// functions the GET /box/source-access route and `box.js reconcile` both consume
-// — with NO database, NO DigitalOcean, NO network. The DB helpers
-// (listBoxesForReconcile / recordSourceEvent / flagBoxReconcileForBuilder) are
-// thin wrappers exercised on the control plane; the DECISIONS they rely on are
-// pinned here so the route and the reconciler can never drift from one rule.
-//
-// Re-added under #674 (the test was written + passing in #600 but deferred by
-// parallel-claim conflicts on tests/ and docs/file-map.md). Wired into
-// scripts/gds/smoke-box.sh step 1b.
-//
-// Run:  node tests/box_access.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-const access = require('../modules/dev-box/box-access.js');
-const boxes = require('../modules/dev-box/boxes.js');
-
-let passed = 0;
-let failed = 0;
-function t(name, fn) {
-  try { fn(); passed++; console.log(`  PASS  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
-}
-
-const FLOOR = boxes.DEFAULT_PROVISION_FLOOR; // 'xenos' — everyone meets the default
-
-console.log('boxCanHoldSource — only a live/becoming-live droplet holds a clone:');
-
-t('boxCanHoldSource: true for active / provisioning / waking', () => {
-  assert.equal(access.boxCanHoldSource('active'), true);
-  assert.equal(access.boxCanHoldSource('provisioning'), true);
-  assert.equal(access.boxCanHoldSource('waking'), true);
-});
-
-t('boxCanHoldSource: false for parked / destroyed / none / idle / unknown', () => {
-  assert.equal(access.boxCanHoldSource('parked'), false);
-  assert.equal(access.boxCanHoldSource('destroyed'), false);
-  assert.equal(access.boxCanHoldSource('none'), false);
-  assert.equal(access.boxCanHoldSource('idle'), false);
-  assert.equal(access.boxCanHoldSource(undefined), false);
-});
-
-console.log('\ncloneSpecForScope — full vs starter, fail-closed to least privilege:');
-
-t("cloneSpecForScope('full') → full clone, no sparse paths", () => {
-  assert.deepEqual(access.cloneSpecForScope('full'), { scope: 'full', mode: 'full', sparsePaths: null });
-});
-
-t("cloneSpecForScope('starter') → sparse clone of the starter surface", () => {
-  const spec = access.cloneSpecForScope('starter');
-  assert.equal(spec.scope, 'starter');
-  assert.equal(spec.mode, 'sparse');
-  assert.deepEqual(spec.sparsePaths, access.STARTER_SPARSE_PATHS);
-});
-
-t('cloneSpecForScope: unknown/missing scope FAILS CLOSED to starter (never full)', () => {
-  for (const bad of ['admin', '', undefined, null, 'FULL']) {
-    assert.equal(access.cloneSpecForScope(bad).scope, 'starter', `scope ${JSON.stringify(bad)} must collapse to starter`);
-  }
-});
-
-t('cloneSpecForScope: starter sparsePaths is a COPY (mutating it cannot poison the catalog)', () => {
-  const spec = access.cloneSpecForScope('starter');
-  spec.sparsePaths.push('SHOULD_NOT_PERSIST');
-  assert.ok(!access.STARTER_SPARSE_PATHS.includes('SHOULD_NOT_PERSIST'),
-    'the returned sparsePaths must not alias the shared STARTER_SPARSE_PATHS array');
-});
-
-console.log('\nSTARTER_SPARSE_PATHS — the scoped surface (ADR 0052 §9.2):');
-
-t('starter surface includes the build tooling + game runtime', () => {
-  for (const p of ['.claude', 'scripts', 'src/bongos', 'src/world', 'src/rooms', 'public', '.devcontainer', 'infra', 'tests']) {
-    assert.ok(access.STARTER_SPARSE_PATHS.includes(p), `starter scope must include ${p}`);
-  }
-});
-
-t('starter surface EXCLUDES migrations/ (degraded-DB preview needs no schema) and the hall', () => {
-  assert.ok(!access.STARTER_SPARSE_PATHS.includes('migrations'), 'migrations/ must stay out of the starter scope');
-  // the hall carved to modules/hall-ui/ in BV1.R85; it stays out of a starter box
-  assert.ok(!access.STARTER_SPARSE_PATHS.includes('modules/hall-ui'), 'modules/hall-ui (the hall) must stay out of the starter scope');
-  assert.ok(!access.STARTER_SPARSE_PATHS.includes('public-builders'), 'the old public-builders/ path must stay out of the starter scope');
-});
-
-console.log('\ndecideSourceAccess — the live per-fetch gate:');
-
-t('decideSourceAccess: active Xenos at the default floor → allowed, starter scope', () => {
-  const d = access.decideSourceAccess({ rank: 'xenos', status: 'active' });
-  assert.equal(d.allowed, true);
-  assert.equal(d.scope, 'starter');
-  assert.equal(d.spec.mode, 'sparse');
-});
-
-t('decideSourceAccess: active Metic → allowed, FULL scope (live rank, not stored scope)', () => {
-  const d = access.decideSourceAccess({ rank: 'metic', status: 'active' });
-  assert.equal(d.allowed, true);
-  assert.equal(d.scope, 'full');
-  assert.equal(d.spec.sparsePaths, null);
-});
-
-t('decideSourceAccess: Archon → full; Thetes → starter', () => {
-  assert.equal(access.decideSourceAccess({ rank: 'archon', status: 'active' }).scope, 'full');
-  assert.equal(access.decideSourceAccess({ rank: 'thetes', status: 'active' }).scope, 'starter');
-});
-
-t('decideSourceAccess: inactive builder → BUILDER_INACTIVE (checked BEFORE rank)', () => {
-  // A deactivated builder keeps a rank but loses access — and status is checked
-  // first, so even a Metic gets denied for inactivity, not a rank reason.
-  const d = access.decideSourceAccess({ rank: 'metic', status: 'inactive' });
-  assert.deepEqual(d, { allowed: false, reason: 'BUILDER_INACTIVE' });
-});
-
-t('decideSourceAccess: rank below an explicit floor → INSUFFICIENT_RANK with required+actual', () => {
-  const d = access.decideSourceAccess({ rank: 'xenos', status: 'active', floor: 'metic' });
-  assert.deepEqual(d, { allowed: false, reason: 'INSUFFICIENT_RANK', required: 'metic', actual: 'xenos' });
-});
-
-t('decideSourceAccess: unknown rank → INSUFFICIENT_RANK (fail closed), actual echoes the bad rank', () => {
-  const d = access.decideSourceAccess({ rank: 'wizard', status: 'active', floor: FLOOR });
-  assert.equal(d.allowed, false);
-  assert.equal(d.reason, 'INSUFFICIENT_RANK');
-  assert.equal(d.actual, 'wizard');
-});
-
-t('decideSourceAccess: missing rank → actual null (not undefined)', () => {
-  const d = access.decideSourceAccess({ status: 'active', floor: FLOOR });
-  assert.equal(d.allowed, false);
-  assert.equal(d.actual, null);
-});
-
-t('decideSourceAccess: status omitted (falsy) is treated as active — rank alone decides', () => {
-  const d = access.decideSourceAccess({ rank: 'metic' });
-  assert.equal(d.allowed, true);
-  assert.equal(d.scope, 'full');
-});
-
-console.log('\nreconcileSourceAccess — the slower droplet-level clawback/rescope:');
-
-t('reconcileSourceAccess: no box (none/destroyed/missing) → none/no-box', () => {
-  assert.deepEqual(access.reconcileSourceAccess({ boxState: 'none', rank: 'metic', status: 'active' }), { action: 'none', reason: 'no-box' });
-  assert.deepEqual(access.reconcileSourceAccess({ boxState: 'destroyed', rank: 'metic', status: 'active' }), { action: 'none', reason: 'no-box' });
-  assert.deepEqual(access.reconcileSourceAccess({ rank: 'metic', status: 'active' }), { action: 'none', reason: 'no-box' });
-});
-
-t('reconcileSourceAccess: inactive builder with a live box → deprovision (the clawback)', () => {
-  const d = access.reconcileSourceAccess({ boxScope: 'starter', boxState: 'active', rank: 'xenos', status: 'inactive' });
-  assert.deepEqual(d, { action: 'deprovision', reason: 'builder-inactive' });
-});
-
-t('reconcileSourceAccess: rank below floor → deprovision/below-floor', () => {
-  const d = access.reconcileSourceAccess({ boxScope: 'starter', boxState: 'active', rank: 'xenos', status: 'active', floor: 'metic' });
-  assert.deepEqual(d, { action: 'deprovision', reason: 'below-floor' });
-});
-
-t('reconcileSourceAccess: stored FULL box but live rank no longer Metic+ → deprovision (fresh box needed)', () => {
-  // A full box already holds the whole repo on disk; it cannot be safely
-  // downgraded in place, so the reconciler destroys it.
-  const d = access.reconcileSourceAccess({ boxScope: 'full', boxState: 'active', rank: 'thetes', status: 'active' });
-  assert.deepEqual(d, { action: 'deprovision', reason: 'scope-downgrade-needs-fresh-box' });
-});
-
-t('reconcileSourceAccess: stored STARTER box but live rank now Metic+ → rescope to full (graduation)', () => {
-  const d = access.reconcileSourceAccess({ boxScope: 'starter', boxState: 'active', rank: 'metic', status: 'active' });
-  assert.deepEqual(d, { action: 'rescope', reason: 'graduation', newScope: 'full' });
-});
-
-t('reconcileSourceAccess: scope already matches live rank → none/in-sync', () => {
-  assert.deepEqual(access.reconcileSourceAccess({ boxScope: 'starter', boxState: 'active', rank: 'xenos', status: 'active' }), { action: 'none', reason: 'in-sync' });
-  assert.deepEqual(access.reconcileSourceAccess({ boxScope: 'full', boxState: 'active', rank: 'metic', status: 'active' }), { action: 'none', reason: 'in-sync' });
-});
-
-t('reconcileSourceAccess: inactivity outranks an otherwise in-sync full Metic box', () => {
-  // status is checked before the scope comparison, so a deactivated Metic with a
-  // matching full box is still torn down.
-  const d = access.reconcileSourceAccess({ boxScope: 'full', boxState: 'active', rank: 'metic', status: 'inactive' });
-  assert.deepEqual(d, { action: 'deprovision', reason: 'builder-inactive' });
-});
-
-// ===========================================================================
-// TASK-SCOPED source access (ADR 0148 / goal 1000051, R93). BASE_SPARSE_PATHS,
-// the pure sparsePathsForScopeKeys(scopeKeys, moduleScopeMap) cone-filter, and
-// the decideSourceAccess three-way branch. Uses the REAL module-scope-map (a pure
-// core module) as the map the route (R94) will pass in.
-// ===========================================================================
-const scopeMap = require('../src/bongos/module-scope-map.js');
-const BASE = access.BASE_SPARSE_PATHS;
-
-console.log('\nBASE_SPARSE_PATHS — the non-product base a task-scoped box layers on:');
-
-t('BASE carries the methodology + tooling, NOT the product/game', () => {
-  // clients/ is load-bearing: cli-lib.js hard-imports clients/bongos-client, so a
-  // cone without it has a fully dead builder CLI on the box (task 1002745).
-  // modules/lifecycle is load-bearing for the same reason (task 1003085):
-  // scripts/gds/context-pack.js reads the task enums from its task-classifier,
-  // and context-pack sits on BOTH /builder-start and /builder-claim. A box with
-  // no active claim put nothing in scope, so both commands died at import — and
-  // neither could fix it, because a CLAIM is what fetches the module.
-  for (const p of ['.devcontainer', '.claude', 'scripts', 'src/bongos', 'docs', 'infra', 'tests', 'clients', 'modules/lifecycle']) {
-    assert.ok(BASE.includes(p), `BASE must include ${p}`);
-  }
-  for (const p of ['src/world', 'src/rooms', 'public', 'art', 'modules/status-ui']) {
-    assert.ok(!BASE.includes(p), `BASE must NOT include the product surface ${p}`);
-  }
-});
-
-console.log('\nsparsePathsForScopeKeys — BASE ∪ the claims’ module DIRS (cone-mode):');
-
-t('no keys (empty array) → BASE only, in declared order', () => {
-  assert.deepEqual(access.sparsePathsForScopeKeys([], scopeMap), [...BASE]);
-});
-
-t('one key → BASE + that module’s directory (status-ui → modules/status-ui)', () => {
-  const out = access.sparsePathsForScopeKeys(['status-ui'], scopeMap);
-  assert.deepEqual(out, [...BASE, 'modules/status-ui']);
-});
-
-t('cone-filter: dev-box keeps its DIRS, DROPS its file globs (scripts/gds/box.js)', () => {
-  const out = access.sparsePathsForScopeKeys(['dev-box'], scopeMap);
-  assert.ok(out.includes('modules/dev-box'), 'the module dir is kept');
-  assert.ok(out.includes('devbox-app'), 'the app dir is kept');
-  assert.ok(!out.some((p) => p.endsWith('.js') || p.endsWith('.sh')), 'no file globs survive the cone filter');
-  assert.ok(!out.includes('scripts/gds/box.js'), 'the box CLI file is dropped (BASE scripts covers it)');
-  // …and its PARENT is not added either: BASE's `scripts` already covers it, so
-  // the ancestor check must stop `scripts/gds` from appearing. This is the half
-  // that keeps the file-glob rescue below from over-sharing.
-  assert.ok(!out.includes('scripts/gds'), 'a covered parent is not re-emitted');
-});
-
-// A file glob whose parent is NOT already covered must contribute that parent.
-// Regression for the live failure that released task 1003018 (R05 of goal
-// 1000069): the `government` key's config/government*.json globs were dropped on
-// the reasoning that every file glob sits under a BASE directory — true when
-// written, false once ADR 0174 added them, since `config` is not in BASE. The box
-// could not see two files inside its own scope wall.
-t('file-glob rescue: government contributes `config` for its config/*.json globs', () => {
-  const out = access.sparsePathsForScopeKeys(['government'], scopeMap);
-  assert.ok(out.includes('modules/government'), 'the module dir is kept');
-  assert.ok(out.includes('config'), 'config/government.neutral.json must reach the box via its parent');
-  assert.ok(!out.some((p) => p.endsWith('.json')), 'still no file paths — cone mode would reject one');
-});
-
-t('file-glob rescue holds for EVERY key in the map — no module can silently lose one', () => {
-  // Enumerated, never sampled: a module that gains a file glob under a new parent
-  // is covered the day it lands, which is exactly how this bug escaped before.
-  for (const key of scopeMap.moduleKeys()) {
-    const out = access.sparsePathsForScopeKeys([key], scopeMap);
-    for (const glob of scopeMap.scopeForModule(key).globs) {
-      if (glob.endsWith('/')) continue;
-      const cut = glob.lastIndexOf('/');
-      if (cut < 0) continue; // a root file — cone mode includes it automatically
-      const parent = glob.slice(0, cut);
-      const reachable = out.some((p) => parent === p || parent.startsWith(`${p}/`));
-      assert.ok(reachable, `${key}: no cone path materializes ${glob} (parent ${parent})`);
-    }
-  }
-});
-
-t('the emitted set stays directories only, for every key', () => {
-  // A leading dot is a DIRECTORY here ('.devcontainer', '.claude'), so the
-  // extension test must require a non-dot character before the dot — otherwise
-  // every BASE dotfile-dir reads as a file and this assertion fires on healthy
-  // input. (It did, on first write.)
-  const looksLikeFile = (seg) => /[^.]\.[a-z0-9]+$/i.test(seg);
-  for (const key of scopeMap.moduleKeys()) {
-    for (const p of access.sparsePathsForScopeKeys([key], scopeMap)) {
-      assert.ok(!looksLikeFile(p.split('/').pop()),
-        `${key}: ${p} looks like a file — git sparse-checkout set would abort on it`);
-    }
-  }
-});
-
-t('cone-filter: the kernel key materializes its real DIR globs (config, src/module-loader)', () => {
-  const out = access.sparsePathsForScopeKeys(['kernel'], scopeMap);
-  // kernel is mostly individual src/bongos/*.js FILES (dropped — BASE src/bongos
-  // covers them via cone ancestor-inclusion) + a few genuine DIR globs.
-  assert.ok(out.includes('config'), 'config/ is a real dir the task needs, not in BASE');
-  // src/module-loader/ is a real dir not in BASE, but it is NOT emitted verbatim:
-  // kernel also carries the file globs src/instance-config.js, src/branding.js,
-  // src/modules.js and src/module-api.js, whose rescued parent is `src` — and once
-  // `src` is emitted the ancestor check absorbs every path beneath it, this one
-  // included. Asserting literal membership would be asserting emission ORDER, not
-  // reachability. What the box must actually get is the DIRECTORY's contents, so
-  // assert that, using the same idiom as the enumerated rescue test above.
-  const reaches = (dir) => out.some((p) => dir === p || dir.startsWith(`${p}/`));
-  assert.ok(reaches('src/module-loader'), 'src/module-loader must be materialized (here via the rescued `src`)');
-  assert.ok(!out.includes('src/bongos/db.js'), 'the kernel FILE globs are dropped');
-  assert.ok(!out.includes('server.js'), 'top-level files never enter the sparse set (cone auto-includes them)');
-});
-
-t('N keys → union, deduped + sorted; unknown keys contribute nothing', () => {
-  const out = access.sparsePathsForScopeKeys(['status-ui', 'hall-ui'], scopeMap);
-  assert.deepEqual(out, [...BASE, 'modules/hall-ui', 'modules/status-ui'], 'union of both dirs, sorted');
-  assert.deepEqual(access.sparsePathsForScopeKeys(['status-ui', 'status-ui'], scopeMap), [...BASE, 'modules/status-ui'], 'dedup');
-  assert.deepEqual(access.sparsePathsForScopeKeys(['bogus'], scopeMap), [...BASE], 'unknown key → no extra paths');
-});
-
-t('missing/!scopeForModule moduleScopeMap → BASE only (guards the missing map)', () => {
-  assert.deepEqual(access.sparsePathsForScopeKeys(['dev-box'], null), [...BASE]);
-  assert.deepEqual(access.sparsePathsForScopeKeys(['dev-box'], {}), [...BASE]);
-});
-
-console.log('\ndecideSourceAccess — the ADR 0148 three-way (rank still gates ALLOW/DENY):');
-
-t('scopeKeys present + non-empty → TASK scope, BASE ∪ the module dirs (rank no longer caps breadth)', () => {
-  const d = access.decideSourceAccess({ rank: 'xenos', status: 'active', scopeKeys: ['status-ui'], moduleScopeMap: scopeMap });
-  assert.equal(d.allowed, true);
-  assert.equal(d.scope, 'task');
-  assert.equal(d.spec.mode, 'sparse');
-  assert.deepEqual(d.spec.sparsePaths, [...BASE, 'modules/status-ui'], 'even a Xenos with a claim gets the claim’s module scope');
-});
-
-t('scopeKeys present + EMPTY → BASE-only (a live box with no active claim)', () => {
-  const d = access.decideSourceAccess({ rank: 'metic', status: 'active', scopeKeys: [], moduleScopeMap: scopeMap });
-  assert.equal(d.allowed, true);
-  assert.equal(d.scope, 'base');
-  assert.deepEqual(d.spec.sparsePaths, [...BASE], 'idle Metic+ now gets BASE-only, not the whole repo (ADR 0148 flagged change)');
-});
-
-t('scopeKeys ABSENT → the pre-ADR-0148 RANK fallback is preserved EXACTLY (R93-before-R94 safety)', () => {
-  assert.equal(access.decideSourceAccess({ rank: 'metic', status: 'active' }).scope, 'full', 'no claim signal → rank fallback (full)');
-  assert.equal(access.decideSourceAccess({ rank: 'xenos', status: 'active' }).scope, 'starter', 'no claim signal → rank fallback (starter)');
-});
-
-t('the ALLOW/DENY gates run BEFORE scope selection', () => {
-  const inactive = access.decideSourceAccess({ rank: 'metic', status: 'inactive', scopeKeys: ['status-ui'], moduleScopeMap: scopeMap });
-  assert.equal(inactive.allowed, false);
-  assert.equal(inactive.reason, 'BUILDER_INACTIVE');
-  const belowFloor = access.decideSourceAccess({ rank: 'xenos', status: 'active', floor: 'metic', scopeKeys: ['status-ui'], moduleScopeMap: scopeMap });
-  assert.equal(belowFloor.allowed, false);
-  assert.equal(belowFloor.reason, 'INSUFFICIENT_RANK');
-});
-
-console.log('\nscopeMetadata — the credential-FREE projection for GET /box/scope (BV1.R100):');
-
-t('task scope → modules deduped+sorted, sparse_paths carried, NO credential fields', () => {
-  const scopeKeys = ['dev-box', 'onboarding', 'dev-box']; // dup on purpose
-  const decision = access.decideSourceAccess({ rank: 'metic', status: 'active', scopeKeys, moduleScopeMap: scopeMap });
-  const meta = access.scopeMetadata({ decision, scopeKeys });
-  assert.equal(meta.scope, 'task');
-  assert.equal(meta.mode, 'sparse');
-  assert.deepEqual(meta.modules, ['dev-box', 'onboarding'], 'deduped + sorted');
-  assert.ok(Array.isArray(meta.sparse_paths) && meta.sparse_paths.includes('modules/dev-box'));
-  assert.ok(!('credential' in meta) && !('repo_url' in meta), 'never carries credential fields');
-});
-
-t('empty claims → base scope, modules is [] (not null) — a live box with no active claim', () => {
-  const decision = access.decideSourceAccess({ rank: 'metic', status: 'active', scopeKeys: [], moduleScopeMap: scopeMap });
-  const meta = access.scopeMetadata({ decision, scopeKeys: [] });
-  assert.equal(meta.scope, 'base');
-  assert.deepEqual(meta.modules, []);
-  assert.deepEqual(meta.sparse_paths, [...BASE]);
-});
-
-t('rank fallback (scopeKeys absent) → modules is null (breadth is rank-driven, not per-module)', () => {
-  const decision = access.decideSourceAccess({ rank: 'metic', status: 'active' });
-  const meta = access.scopeMetadata({ decision, scopeKeys: undefined });
-  assert.equal(meta.scope, 'full');
-  assert.equal(meta.mode, 'full');
-  assert.equal(meta.modules, null);
-});
-
-t('a DENIED decision projects to null (the route returns 403, never a scope body)', () => {
-  const denied = access.decideSourceAccess({ rank: 'xenos', status: 'inactive', scopeKeys: [], moduleScopeMap: scopeMap });
-  assert.equal(denied.allowed, false);
-  assert.equal(access.scopeMetadata({ decision: denied, scopeKeys: [] }), null);
-  assert.equal(access.scopeMetadata({}), null, 'no decision → null');
-  assert.equal(access.scopeMetadata(), null, 'no args → null');
-});
-
-// ---------- task 1003227: config/ must be in the box's BASE slice ----------
-//
-// Without it a box cannot run its own quality gate: fitness.js compares against
-// config/fitness-baselines.json, and with the file absent the ratchet used to report
-// PASS (a planted 5,000-line + 94-cycle regression sailed through). So a boxed builder
-// shipped believing they were clean and learned otherwise from red CI, with nothing on
-// the box to reproduce it. Precedent for the same class: ADR 0174 put
-// config/government.json in the `government` globs, config/ was not in BASE, and task
-// 1003018 was RELEASED because its box could never see its own deliverable.
-
-t('1003227 BASE includes config/ so a box can read its own fitness baselines', () => {
-  const spec = access.decideSourceAccess({
-    rank: 'archon', status: 'active', scopeKeys: [], hasActiveClaims: false, moduleScopeMap: {},
-  });
-  assert.equal(spec.scope, 'base');
-  assert.ok(spec.spec.sparsePaths.includes('config'),
-    `base scope must carry config/; got ${spec.spec.sparsePaths.join(',')}`);
-});
-
-t('1003227 a TASK-scoped box carries config/ too (the common case — a claim is held)', () => {
-  // The REAL scope map, not a hand-rolled object — the shape matters here.
-  const scopeMap = require('../src/bongos/module-scope-map.js');
-  const spec = access.decideSourceAccess({
-    rank: 'xenos', status: 'active', scopeKeys: ['economy'], hasActiveClaims: true,
-    moduleScopeMap: scopeMap,
-  });
-  assert.equal(spec.scope, 'task');
-  assert.ok(spec.spec.sparsePaths.includes('config'), 'task scope must carry config/ as well');
-  assert.ok(spec.spec.sparsePaths.includes('modules/economy'),
-    `and still layer the claimed module on top; got ${spec.spec.sparsePaths.join(',')}`);
-});
-
-t('1003227 config/ is a cone-mode DIRECTORY entry (a file path aborts the whole set)', () => {
-  // ADR 0148: `git sparse-checkout set` rejects a file path, which kills the entire
-  // checkout — so every BASE entry must be a bare directory, no trailing slash.
-  for (const p of access.BASE_SPARSE_PATHS) {
-    assert.ok(!p.endsWith('/'), `${p} must not carry a trailing slash`);
-    // A dotted DIRECTORY (.claude, .devcontainer) is fine; what cone mode rejects is
-    // a file, so only test for an extension on the FINAL segment of a non-dotfile.
-    const last = p.split('/').pop();
-    if (!last.startsWith('.')) {
-      assert.ok(!/\.[a-z0-9]+$/i.test(last), `${p} looks like a FILE — cone mode would abort the set`);
-    }
-  }
-});
-
-// ---------------------------------------------------------------------------
-// task 1003087 / idea 1000793 — builder widening that SURVIVES the */10 tick
-//
-// The bug: the cron re-applies the server-computed sparse set, so a builder's
-// own `git sparse-checkout add` is deleted — sometimes mid-command (a live suite
-// died with MODULE_NOT_FOUND that read exactly like a code bug). The widen set is
-// therefore recorded server-side and unioned in HERE, on the same path the cron
-// asks every tick. These pin the two halves that matter: it actually widens, and
-// it cannot be used to climb past the rank scope.
-// ---------------------------------------------------------------------------
-
-console.log('\nnormalizeWidenPath — a repo-relative directory, or nothing:');
-
-t('accepts a plain repo-relative dir and strips the noise around it', () => {
-  assert.equal(access.normalizeWidenPath('docs'), 'docs');
-  assert.equal(access.normalizeWidenPath('  docs  '), 'docs');
-  assert.equal(access.normalizeWidenPath('./docs/'), 'docs');
-  assert.equal(access.normalizeWidenPath('docs//adr'), 'docs/adr');
-});
-
-t('folds a Windows separator rather than judging the path on it', () => {
-  const BS = String.fromCharCode(92);
-  assert.equal(access.normalizeWidenPath(`modules${BS}game`), 'modules/game');
-});
-
-t('REFUSES traversal, absolute paths and drive letters outright', () => {
-  // Refused, never "cleaned up into something that still works" — this string
-  // reaches `git sparse-checkout set` on a real box.
-  for (const bad of ['../etc', 'a/../../b', '/etc/passwd', 'C:/Windows', '..', '.', '']) {
-    assert.equal(access.normalizeWidenPath(bad), null, `${JSON.stringify(bad)} must be refused`);
-  }
-});
-
-t('refuses a non-string, an over-long path, and odd characters', () => {
-  assert.equal(access.normalizeWidenPath(null), null);
-  assert.equal(access.normalizeWidenPath(42), null);
-  assert.equal(access.normalizeWidenPath({}), null);
-  assert.equal(access.normalizeWidenPath('a'.repeat(500)), null);
-  assert.equal(access.normalizeWidenPath('modules/ga me'), null);
-  assert.equal(access.normalizeWidenPath('modules/rm -rf'), null);
-});
-
-console.log('\nadmissibleWidenPaths — rank is the ceiling, and it is the whole point:');
-
-t('a Metic (full rank scope) may widen anywhere', () => {
-  assert.deepEqual(access.admissibleWidenPaths(['modules/game'], 'metic'), ['modules/game']);
-  assert.deepEqual(access.admissibleWidenPaths(['migrations'], 'archon'), ['migrations']);
-});
-
-t('a Xenos may NOT widen past the starter surface — that would be rank escalation', () => {
-  // The security property of this feature stated as a test: if an arbitrary widen
-  // were honored, a convenience flag would hand a starter-scoped builder the whole
-  // repo, which is the rank gate defeated rather than a checkout preference.
-  assert.deepEqual(access.admissibleWidenPaths(['modules/game'], 'xenos'), []);
-  assert.deepEqual(access.admissibleWidenPaths(['migrations'], 'xenos'), []);
-  assert.deepEqual(access.admissibleWidenPaths(['modules/lifecycle'], 'thetes'), []);
-});
-
-t('a Xenos MAY widen INSIDE starter — a task box is narrower than their rank allows', () => {
-  // Not a null grant: task scope is BASE union modules, which is narrower than
-  // starter, so this is the room to climb back to what rank already permitted.
-  assert.deepEqual(access.admissibleWidenPaths(['docs/adr'], 'xenos'), ['docs/adr']);
-  assert.deepEqual(access.admissibleWidenPaths(['src/world'], 'xenos'), ['src/world']);
-});
-
-t('normalizes, dedupes and sorts, and drops the invalid without failing the rest', () => {
-  const got = access.admissibleWidenPaths(['./docs/', 'docs', '../etc', 'art'], 'metic');
-  assert.deepEqual(got, ['art', 'docs'], 'one invalid entry must not discard the valid ones');
-});
-
-t('is capped, so a widen set can never become a second scope system', () => {
-  const many = Array.from({ length: access.MAX_WIDEN_PATHS + 20 }, (_, i) => `docs/d${i}`);
-  assert.equal(access.admissibleWidenPaths(many, 'metic').length, access.MAX_WIDEN_PATHS);
-});
-
-t('a missing / non-array widen set is simply no widening', () => {
-  for (const v of [undefined, null, 'docs', 42, {}]) {
-    assert.deepEqual(access.admissibleWidenPaths(v, 'metic'), []);
-  }
-});
-
-console.log('\nwithWidenPaths — union into the computed set, without redundancy:');
-
-t('adds a dir the set does not already cover', () => {
-  assert.deepEqual(access.withWidenPaths(['src/bongos'], ['docs']), ['src/bongos', 'docs']);
-});
-
-t('skips a dir an ANCESTOR already covers — cone mode pulls the whole subtree', () => {
-  assert.deepEqual(access.withWidenPaths(['scripts'], ['scripts/gds']), ['scripts'],
-    'adding scripts/gds under scripts is noise in the git command and in the scope readout');
-});
-
-t('passes a null sparse set (the full clone) straight through', () => {
-  assert.equal(access.withWidenPaths(null, ['docs']), null,
-    'a full clone already holds everything — there is nothing to widen INTO');
-});
-
-t('an empty widen set returns the computed set untouched', () => {
-  const base = ['src/bongos', 'scripts'];
-  assert.deepEqual(access.withWidenPaths(base, []), base);
-});
-
-console.log('\ndecideSourceAccess — the widen reaches the spec the box actually fetches:');
-
-t('a task-scoped box gets its widen unioned into the sparse set', () => {
-  const d = access.decideSourceAccess({
-    rank: 'metic', status: 'active', scopeKeys: [], hasActiveClaims: false,
-    moduleScopeMap: {}, widenPaths: ['modules/game'],
-  });
-  assert.equal(d.allowed, true);
-  assert.ok(d.spec.sparsePaths.includes('modules/game'),
-    'the widen must reach the SPEC — this is the value the cron writes into sparse-checkout');
-});
-
-t('an out-of-scope widen never reaches the spec for a starter-scoped builder', () => {
-  const d = access.decideSourceAccess({
-    rank: 'xenos', status: 'active', scopeKeys: [], hasActiveClaims: false,
-    moduleScopeMap: {}, widenPaths: ['modules/game'],
-  });
-  assert.ok(!d.spec.sparsePaths.includes('modules/game'));
-});
-
-t('no widenPaths leaves every scope byte-identical to before the feature', () => {
-  const withArg = access.decideSourceAccess({
-    rank: 'metic', status: 'active', scopeKeys: [], hasActiveClaims: false, moduleScopeMap: {}, widenPaths: [],
-  });
-  const without = access.decideSourceAccess({
-    rank: 'metic', status: 'active', scopeKeys: [], hasActiveClaims: false, moduleScopeMap: {},
-  });
-  assert.deepEqual(withArg.spec, without.spec, 'a box that asked for nothing must fetch exactly what it always did');
-});
-
-t('a full-clone builder is unaffected — sparsePaths stays null', () => {
-  const d = access.decideSourceAccess({ rank: 'metic', status: 'active', widenPaths: ['docs'] });
-  assert.equal(d.spec.sparsePaths, null);
-  assert.equal(d.spec.mode, 'full');
-});
-
-t('widening cannot resurrect access for an inactive or below-floor builder', () => {
-  // The widen set is read from the box row, so it must not become a way around
-  // the ALLOW/DENY gate that runs before any scope is computed.
-  const inactive = access.decideSourceAccess({ rank: 'metic', status: 'inactive', widenPaths: ['docs'] });
-  assert.equal(inactive.allowed, false);
-  assert.equal(inactive.reason, 'BUILDER_INACTIVE');
-  assert.equal(inactive.spec, undefined);
-});
-
-t('every admitted widen path is still a DIRECTORY — cone mode aborts on a file', () => {
-  for (const p of access.admissibleWidenPaths(['docs/adr', 'src/world'], 'metic')) {
-    assert.ok(!p.endsWith('/'), `${p} must not carry a trailing slash`);
-    const last = p.split('/').pop();
-    assert.ok(!/\.[a-z0-9]+$/i.test(last), `${p} looks like a FILE — cone mode would abort the set`);
-  }
-});
-
-console.log(`\nbox_access.mjs: ${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);