@bongos/core 1.19.1080 → 1.20.1

package/scripts/gds/status.js

@@ -167,6 +167,14 @@ function shortTitle(title, max = 52) {
   return t.length > max ? t.slice(0, max - 1) + '…' : t;
 }
 
+// "area 6" for a working-area goal, else nothing (task 1004057). Read from the
+// goal's working_area FIELD, never parsed from its title and never taken from
+// sort_order or the id, which both look like it and are not.
+function areaTag(g) {
+  const n = g && g.working_area;
+  return Number.isInteger(n) && n > 0 ? 'area ' + n : '';
+}
+
 // "1 confirmed, 2 backlog" — non-shipped tasks grouped by status, ordered.
 function remainingSummary(remaining) {
   if (remaining.length === 0) return 'none — all shipped ✓';
@@ -283,7 +291,7 @@ function renderStatusWidget(data, criterion) {
   const rows = goals
     ? goals.map((g) => {
         const ach = g.status === 'achieved';
-        const head = `<tr><td class="st-td" colspan="5" style="background:var(--color-background-secondary);font-weight:500;"><i class="ti ti-target" aria-hidden="true"></i> ${sesc(g.title)} <span class="st-sub">· ${ach ? '<span class="st-ok">achieved</span>' : sesc(g.status)}${g.criteria.length ? '' : ' · no criteria yet'}</span></td></tr>`;
+        const head = `<tr><td class="st-td" colspan="5" style="background:var(--color-background-secondary);font-weight:500;"><i class="ti ti-target" aria-hidden="true"></i> ${sesc(g.title)} <span class="st-sub">· ${areaTag(g) ? sesc(areaTag(g)) + ' · ' : ''}${ach ? '<span class="st-ok">achieved</span>' : sesc(g.status)}${g.criteria.length ? '' : ' · no criteria yet'}</span></td></tr>`;
         return head + g.criteria.map(critRow).join('');
       }).join('')
     : data.criteria.map(critRow).join('');
@@ -336,7 +344,7 @@ function renderStatusMarkdown(data, criterion) {
   const tableHeader = () => { lines.push('| | Criterion | Pos | Shipped | Remaining |'); lines.push('|---|---|---|---|---|'); };
   if (goals) {
     for (const g of goals) {
-      lines.push(`**🎯 ${g.title}** — ${g.status === 'achieved' ? 'achieved ✓' : g.status}${g.criteria.length ? '' : ' · no criteria yet'}`);
+      lines.push(`**🎯 ${g.title}** — ${areaTag(g) ? areaTag(g) + ' · ' : ''}${g.status === 'achieved' ? 'achieved ✓' : g.status}${g.criteria.length ? '' : ' · no criteria yet'}`);
       if (g.criteria.length) { tableHeader(); for (const c of g.criteria) lines.push(critRow(c)); }
       lines.push('');
     }
@@ -383,7 +391,7 @@ function printAll(data) {
   };
   if (goals) {
     for (const g of goals) {
-      console.log(`  🎯 ${g.title}  [${g.status === 'achieved' ? 'achieved ✓' : g.status}]${g.criteria.length ? '' : '  (no criteria yet)'}`);
+      console.log(`  🎯 ${g.title}  [${areaTag(g) ? areaTag(g) + ' · ' : ''}${g.status === 'achieved' ? 'achieved ✓' : g.status}]${g.criteria.length ? '' : '  (no criteria yet)'}`);
       for (const c of g.criteria) printCrit(c);
       if (g.criteria.length) console.log('');
     }
@@ -523,4 +531,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { parseArgs, resolveVersion, defaultedVersionNote, positionalRefNote, renderStatusWidget, renderStatusMarkdown };
+module.exports = { parseArgs, resolveVersion, defaultedVersionNote, positionalRefNote, renderStatusWidget, renderStatusMarkdown, areaTag };

package/scripts/gds/upgrade.js

@@ -127,9 +127,9 @@ function restorePin(instanceDir, depString, fsImpl = fs) {
 
 // ---- steps (each injectable for tests) --------------------------------------
 
-// `ignore` is waived (it comes from — and is argued for in — claude-materialize.js materializeWillRewrite, task 1004122); every OTHER dirty path still halts the bump.
+// `ignore` is waived (it comes from — and is argued for in — claude-materialize.js materializeWillRewrite, task 1004122); every OTHER dirty path still halts the bump. -uall (task 1004188): a bare status collapses a NEW untracked dir to one '?? dir/' entry the file-path waiver never matches.
 function gitTreeClean(instanceDir, run = spawnSync, ignore = []) {
-  const r = run('git', ['status', '--porcelain'], { cwd: instanceDir, encoding: 'utf8' });
+  const r = run('git', ['status', '--porcelain', '-uall'], { cwd: instanceDir, encoding: 'utf8' });
   if (!r || r.error || r.status !== 0) return { ok: false, reason: 'git status failed (not a git repo?)' };
   const skip = new Set(ignore), all = (r.stdout || '').split('\n').filter((l) => l.trim());
   const kept = all.filter((l) => !skip.has(l.slice(3).trim()));

package/scripts/public-mirror-export.js

@@ -22,7 +22,13 @@
 //
 // The 6-month delay alone does NOT scrub secrets/topology — redaction is mandatory and
 // the gate is the backstop. Reuses the status-mirror-sync transport shape (--repo-dir /
-// --push + a scoped deploy key, see .github/workflows/sync-public-mirror.yml).
+// --push + a scoped deploy key).
+//
+// PUBLISHING IS A MANUAL STEP. No workflow or schedule runs this script (there is
+// no sync-public-mirror workflow) and nothing publishes the public mirror automatically.
+// A person runs it by hand, e.g.
+//   node scripts/public-mirror-export.js --repo-dir <mirror-checkout> --push
+// (a scheduled public release channel needs the owner's approval first).
 //
 // USAGE:
 //   node scripts/public-mirror-export.js --repo-dir <mirror-checkout> [--push]

package/src/bongos/module-scope-map.js

@@ -73,6 +73,16 @@ const MODULE_GLOBS = {
     // protected - ADR 0314 in a second costume. Ownership follows what the
     // file IS, and what it is is the core read facade over ten modules.
     'src/bongos/routes/me.js',
+    // The rest of the core route directory (task 1004116). It is a BLANKET
+    // protected glob, so every file in it is walled, but until now only the two
+    // entries above were authorable: sixteen live routes (auth, public,
+    // core-update, builders, ...) sat in no module's territory and no goal could
+    // author a task on them. They are the core HTTP surface that stayed in core
+    // while domain routes carved into modules/<key>/routes/, so they are kernel's.
+    // Kernel was already protected, so this changes no module's protected status;
+    // the me.js overlap the task feared is gone (task 1004110 moved it here too).
+    // The two explicit entries above stay for their reasons.
+    'src/bongos/routes/',
     'server.js', 'config/',
   
     // ADOPTED (task 1004111): a protected path owned by no module is authorable
@@ -340,6 +350,9 @@ const MODULE_GLOBS = {
   //     (tests/npm_release_*.mjs) because a default-off module's own tests/ is skipped
   //     by the unit runner. The /deploy page shell stays hall-ui's (one key per surface).
   'npm-release': ['modules/npm-release/', 'tests/npm_release_*.mjs'],
+  // --- the render-deploy module (task 1004270): a Render project's deploy page. Tests live at
+  //     the repo root (tests/render_deploy_*.mjs) for the same reason as npm-release above.
+  'render-deploy': ['modules/render-deploy/', 'tests/render_deploy_*.mjs'],
   // --- instance provisioning: the web-tier REQUEST + STATE surface (module home)
   //     plus the control-plane runner CLI — a command travels with its domain (the
   //     lifecycle precedent). Covers the projects-surface work (goal

package/src/bongos/serve-internal.js

@@ -986,7 +986,9 @@ function mountInternalSurfaces(app) {
     if (req.method !== 'GET' && req.method !== 'HEAD') return next();
     if (!DEPLOY_PAGE_RE.test(path.posix.normalize(req.path))) return next();
     let door = false;
-    try { door = isModuleEnabled('provisioning'); } catch { door = false; }
+    // The page also exists where the render-deploy module is on: a Render project's own deploy
+    // page (task 1004270). Neither module on and the page still answers with Settings.
+    try { door = isModuleEnabled('provisioning') || isModuleEnabled('render-deploy'); } catch { door = false; }
     if (door) return next();
     return res.redirect(302, `${isBuildersHost(req) ? '' : '/builders'}/settings#software-update`);
   });

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.19.1080'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.1'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -255,6 +255,15 @@ module.exports = {
   // second protected list — so a module reaches it via the doorway, not a deep
   // core require (which the module-boundary fitness check would red). PERMANENT.
   get goalScopeCheck() { return require('./bongos/goal-scope-check'); },
+  // cascadeDispatch — the cheapest-model-first cascade router (src/bongos/
+  // cascade-dispatch.js, task 1001691 / ADR 0101 Part 1). KERNEL (it composes
+  // no domain state — a pure ladder + an injected runner), grandfathered
+  // dormant core since System 3 (grading/CLAUDE.md's own note: "stays in
+  // src/gds/... nothing calls it but its mock unit test"). The lifecycle
+  // module's relevance/anti-hack judge (goal-task-relevance-judge.js) is its
+  // FIRST real caller, injecting grade.runSubagent (resolved via the `grade`
+  // port, never required directly) as the runner — never a deep core require.
+  get cascadeDispatch() { return require('./bongos/cascade-dispatch'); },
 
   // === DOMAIN capabilities still on the doorway — SCHEDULED TO RELOCATE ======
   //     NOT kernel: these leak a domain's queries through the doorway (ADR 0091

package/src/platform-server.js

@@ -57,6 +57,7 @@ const { isModuleEnabled } = require('./modules');
 const { refreshOverrides } = require('./bongos/module-overrides');
 const { schemaPending } = require('./bongos/schema-lag');
 const { logger, requestIdMiddleware } = require('./bongos/logger');
+const seams = require('./module-seams');
 
 const PORT = Number(process.env.PORT) || 3000;
 const HOST = process.env.HOST || '127.0.0.1';
@@ -199,6 +200,32 @@ function buildPlatformApp() {
   // same reqId. Mounted before any surface so nothing logs uncorrelated.
   app.use(requestIdMiddleware);
 
+  // THE request.divert SEAM (task 1004300, ADR 0349). A module may register a provider that
+  // takes a request BEFORE any surface answers and either handles it or passes it on —
+  // today the npm-release module's version preview, which hands a browser holding its
+  // cookie to a second process. The provider is looked up on EVERY request, not once at
+  // build: modules mount inside mountInternalSurfaces below, after this line runs, so a
+  // lookup here at build time would always find nothing.
+  //
+  // WITH NO PROVIDER THIS IS ONE MAP LOOKUP AND next(): an instance that does not have such
+  // a module is served exactly as it was. A provider that throws is treated as absent for
+  // that request, never as a failed request — a broken preview must not take the live hall
+  // down with it — unless it had already started answering.
+  app.use((req, res, next) => {
+    const divert = seams.resolveOptional('request.divert');
+    if (!divert) return next();
+    let passed = false;
+    const pass = (e) => { passed = true; next(e); };
+    Promise.resolve()
+      .then(() => divert(req, res, pass))
+      .catch((err) => {
+        logger.error({ err }, 'request.divert provider failed — serving the request normally');
+        if (passed) return;
+        if (res.headersSent) { res.destroy(); return; }
+        pass();
+      });
+  });
+
   // The whole internal surface — shared verbatim with server.js (ADR 0062 R51).
   mountInternalSurfaces(app);
 
@@ -266,6 +293,18 @@ function buildPlatformApp() {
       res.type('html').send(html);
     });
   }
+  // THE ACCOUNT PAGE (task 1004259, ADR 0337 D4.3): where a person edits what
+  // belongs to their platform account rather than to one project — handle, name,
+  // bio, links, and who can find them. Hub-only, unlike the doors above: every
+  // read and write it makes is a platform-identity route, and that module IS the
+  // hub flag (the stripApexOnly note above), so a child instance serves no such
+  // page rather than one whose every request 404s.
+  app.get('/account', (req, res, next) => {
+    if (!isApexHost(req) || !isModuleEnabled('platform-identity')) return next();
+    const html = landingPage('account.html');
+    if (!html) return next();
+    res.type('html').send(html);
+  });
   // Assets fall through to the 404 tail when no module claims the apex root — the
   // handler is not mounted at all rather than pointed at a missing directory.
   const landingAssets = landingDir() && express.static(landingDir(), { index: false, fallthrough: true });

package/tests/account_privacy_flags.mjs

@@ -335,9 +335,13 @@ const GRANT_WORDS = {
   active_recently: /active in the last 30 days/,
 };
 
+// The toggles live on the hub's account page since task 1004259 (ADR 0337 D4.3) —
+// one inline-script page, so the copy and the markup are read from the same file.
+const ACCOUNT_PAGE = join(ROOT, 'modules/public-landing/public/account.html');
+
 test('the discoverable toggle names EXACTLY what it grants — checked against SLIVER_KEYS itself', () => {
-  const js = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.js'), 'utf8');
-  const html = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
+  const js = readFileSync(ACCOUNT_PAGE, 'utf8');
+  const html = js;
   // Privacy spec D3 makes this a MUST: "The discoverable toggle's settings copy
   // must state exactly this grant." It was checked against three transcribed
   // phrases, and the transcription had gone stale in the direction that matters:
@@ -363,13 +367,13 @@ test('the discoverable toggle names EXACTLY what it grants — checked against S
     'and the copy says what it does NOT grant');
   assert.match(js, /the one thing a recruiter can see while your profile page is private/,
     'a private account is told the sliver is the exception to "not found to every visitor" — the surprising half of D2/D3');
-  assert.match(html, /<section[^>]*id="privacy-scroll"[^>]*hidden>/,
-    'the section ships hidden — it reveals only where the hub module answers');
+  assert.match(html, /<div id="acctBody" hidden>/,
+    'the controls ship hidden — they reveal only once the hub module answers for this account');
 });
 
 test('each toggle claims exactly what is enforced — and BOTH are now in force', () => {
-  const js = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.js'), 'utf8');
-  const html = readFileSync(join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
+  const js = readFileSync(ACCOUNT_PAGE, 'utf8');
+  const html = js;
   // A toggle may promise only what a read path actually enforces. The two rows
   // reached that point one task apart. Task 1002967 wired VISIBILITY into every
   // public read, so its row moved to the present tense — and it must also say

package/tests/agents_authoring.mjs

@@ -113,8 +113,10 @@ t('FAIL-CLOSED: a throwing matcher is a hit, and only an explicit false clears a
 
 t('this wall is STRICTER than the validator, which is the point', () => {
   // An Archon clears validate.js's Metic+ rank floor on a protected scope...
+  // Through mergeForValidation, as the PATCH route does: the validator refuses
+  // a stored row's server-owned columns as unknown fields (task 1004007).
   const verdict = validate.validateAgentDefinition(
-    { ...DB_ROW, scope_modules: ['government'] },
+    authoring.mergeForValidation(DB_ROW, { scope_modules: ['government'] }),
     { authorRank: 'archon', allowedModules: ['government'], protectedModules: PROTECTED_MODULES, isProtectedPath: () => false },
   );
   assert.equal(verdict.ok, true, 'the rank floor admits an Archon');
@@ -126,6 +128,18 @@ t('this wall is STRICTER than the validator, which is the point', () => {
   );
 });
 
+t('the fields the routes let through are exactly the fields the validator accepts (task 1004007)', () => {
+  // The validator refuses any key outside its list; the routes project onto
+  // AUTHORABLE_FIELDS. If the two drift, either an authorable field is refused
+  // on every write, or the validator's list names something no route can set.
+  const v = validate.validateAgentDefinition(
+    authoring.mergeForValidation(DB_ROW, {}),
+    { authorRank: 'metic', allowedModules: [], protectedModules: [] },
+  );
+  assert.equal(v.ok, true, JSON.stringify(v.errors));
+  assert.deepEqual([...Object.keys(v.value)].sort(), [...authoring.AUTHORABLE_FIELDS].sort());
+});
+
 console.log('\nrule 4 — the sync owns its own rows:');
 
 t('a file-sourced definition is not editable here, and the reason names the file', () => {

package/tests/agents_sync.mjs

@@ -140,12 +140,22 @@ t('a file claiming author_rank cannot promote itself', () => {
   const p = sync.planOne(claiming, {
     authorRank: 'xenos', allowedModules: ['government'], protectedModules: ['government'],
   });
-  assert.equal(p.action, 'flagged', 'the declared rank did not open the protected scope');
+  // Since task 1004007 the file is not even imported: author_rank is not a field
+  // of a definition, so the validator refuses it BY NAME rather than dropping it.
+  // That is a stronger form of this rule than the flagged import it used to be.
+  assert.equal(p.action, 'skip', 'a file claiming author_rank is refused, not imported');
+  assert.match(p.reason, /author_rank/);
   // NULL, not 'xenos': this definition reaches a protected module, so no
-  // git-derived rank is stamped at all (stampableAuthorRank). The file's claim
-  // loses, and so does the spoofable git value — both by the same rule.
-  assert.equal(p.authorRank, null, 'nothing git-derived is stamped on a protected-scope row');
-  assert.match(p.scopeViolation, /metic\+ author/i);
+  // git-derived rank is stamped at all (stampableAuthorRank).
+  assert.equal(p.authorRank ?? null, null, 'nothing git-derived is stamped on a protected-scope row');
+  // And without the claim, the same scope still imports only flagged: the
+  // protected wall is what holds, not the refusal above.
+  const plain = sync.planOne(
+    sync.parseAgentFile('---\nname: x\ntrigger: on-demand\nscope_modules: [government]\n---\nbody', {}),
+    { authorRank: 'xenos', allowedModules: ['government'], protectedModules: ['government'] },
+  );
+  assert.equal(plain.action, 'flagged');
+  assert.match(plain.scopeViolation, /metic\+ author/i);
 });
 
 t('THE ESCALATION PATH: a spoofed git identity cannot arm a protected scope', () => {
@@ -447,5 +457,96 @@ t('migrate.sh invokes agents-sync, module-gated and fail-open', () => {
   assert.doesNotMatch(call.slice(0, 200), /exit 1/, 'no exit 1 on the agents-sync path');
 });
 
+// ---- task 1004007: a file-declared filter and sink SURVIVE the round trip ----
+//
+// Tested at the round-trip altitude on purpose: file text in, the VALIDATOR's
+// normalized row out, and then the event router's own reading of that row. A
+// test over parseAgentFile alone stayed green through the whole bug, because
+// the parser kept `touches` — it was the validator that dropped it.
+{
+  const router = require('../modules/agents/pollers/event-router.js');
+  const compile = (globs) => (file) => globs.some((g) => file.startsWith(g.replace(/\*\*.*$/, '')));
+  const roundTrip = (text, name = 'review-lens') => validate.validateAgentDefinition(
+    sync.parseAgentFile(text, { name }),
+    { authorRank: 'archon', allowedModules: [], protectedModules: [], isProtectedPath: () => false },
+  );
+  const LINES = [
+    '---', 'title: Review lens', 'trigger: event', 'event: task.shipped',
+    'touches:', '  - docs/**', '  - modules/hall-ui/**', 'sink: discord', '---',
+    'You review what shipped.', '',
+  ];
+  const FILE = LINES.join('\n');
+  const without = (...drop) => LINES.filter((l) => !drop.includes(l)).join('\n');
+
+  t('a file-declared touches[] filter reaches trigger_spec and the router reads it (task 1004007)', () => {
+    const v = roundTrip(FILE);
+    assert.equal(v.ok, true, JSON.stringify(v.errors));
+    assert.deepEqual(v.value.trigger_spec.touches, ['docs/**', 'modules/hall-ui/**']);
+    assert.deepEqual(router.declaredGlobs(v.value), ['docs/**', 'modules/hall-ui/**']);
+    // The point: a ship that touched nothing in scope must NOT fire.
+    assert.equal(router.matchesTouches(v.value, ['src/bongos/db.js'], compile).match, false);
+    assert.equal(router.matchesTouches(v.value, ['docs/voice.md'], compile).match, true);
+  });
+
+  t('a file-declared sink reaches trigger_spec and the router routes to it (task 1004007)', () => {
+    const v = roundTrip(FILE);
+    assert.equal(v.value.trigger_spec.sink, 'discord');
+    assert.equal(router.sinkNameFor(v.value), 'discord');
+  });
+
+  t('touches_globs is the same filter as touches (the router reads both spellings)', () => {
+    const v = roundTrip(FILE.replace('touches:', 'touches_globs:'));
+    assert.equal(v.ok, true, JSON.stringify(v.errors));
+    assert.deepEqual(router.declaredGlobs(v.value), ['docs/**', 'modules/hall-ui/**']);
+  });
+
+  t('a file-declared cadence reaches trigger_spec, so a cron agent can be written as a file', () => {
+    const v = roundTrip(['---', 'trigger: cron', 'cadence: daily', '---', 'A digest.'].join('\n'), 'digest');
+    assert.equal(v.ok, true, JSON.stringify(v.errors));
+    assert.equal(v.value.trigger_spec.cadence, 'daily');
+  });
+
+  t('a definition with no filter still means every ship: the default is unchanged', () => {
+    const v = roundTrip(without('touches:', '  - docs/**', '  - modules/hall-ui/**'));
+    assert.equal(v.ok, true, JSON.stringify(v.errors));
+    assert.equal(v.value.trigger_spec.touches, undefined);
+    assert.equal(router.matchesTouches(v.value, ['src/bongos/db.js'], compile).reason, 'no_filter_declared');
+  });
+
+  t('a malformed filter is REFUSED, never widened silently to fire on every ship', () => {
+    // A scalar is what "touches: docs/**" parses to. The router treats a non-list
+    // as ABSENT, i.e. every ship, so it has to be caught at authoring time.
+    const text = without('  - docs/**', '  - modules/hall-ui/**').replace('touches:', 'touches: docs/**');
+    const v = roundTrip(text);
+    assert.equal(v.ok, false);
+    assert.ok(v.errors.some((e) => e.code === 'trigger_touches_invalid'), JSON.stringify(v.errors));
+  });
+
+  t('an unknown top-level key is refused, not dropped: a typo is an error, not a default', () => {
+    const v = roundTrip(FILE.replace('sink: discord', 'sink: discord\ntouchess: [docs/**]'));
+    assert.equal(v.ok, false);
+    const e = v.errors.find((x) => x.code === 'unknown_field');
+    assert.ok(e, JSON.stringify(v.errors));
+    assert.match(e.message, /touchess/);
+    // and the exact probe from the task: a top-level touches on a row handed to
+    // the validator directly no longer returns ok with the filter gone.
+    const direct = validate.validateAgentDefinition(
+      { name: 'x', persona: 'p', trigger_type: 'event', trigger_spec: { event: 'task.shipped' }, touches: ['src/**'] },
+      { authorRank: 'archon', allowedModules: [], protectedModules: [] },
+    );
+    assert.equal(direct.ok, false, 'a touches that lands nowhere must not pass silently');
+  });
+
+  t('every agent file this repo ships still validates under the stricter check', () => {
+    const dir = path.join(process.cwd(), '.claude', 'agents');
+    const files = fs.readdirSync(dir).filter((x) => x.endsWith('.md'));
+    assert.ok(files.length >= 3, 'expected the shipped agent files');
+    for (const x of files) {
+      const v = roundTrip(fs.readFileSync(path.join(dir, x), 'utf8'), x.replace(/\.md$/, ''));
+      assert.equal(v.ok, true, x + ': ' + JSON.stringify(v.errors));
+    }
+  });
+}
+
 console.log(`\nagents_sync: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/agents_validate.mjs

@@ -477,6 +477,51 @@ await test('a hostile getter cannot escape the validator', () => {
   assert.equal(r.ok, false);
 });
 
+await test('an unknown top-level key is refused by name, not dropped (task 1004007)', () => {
+  // The validator's normalized row names a fixed set of fields, so an extra key
+  // used to pass with ok:true and vanish, which is how a file's top-level
+  // touches: filter became "fires on every ship".
+  const r = validateAgentDefinition(
+    { name: 'historian', persona: 'x', trigger_type: 'event', trigger_spec: { event: 'task.shipped' }, touches: ['src/**'] },
+    OPTS,
+  );
+  assert.equal(r.ok, false);
+  const e = r.errors.find((x) => x.code === 'unknown_field');
+  assert.ok(e, JSON.stringify(codes(r)));
+  assert.equal(e.field, 'touches');
+  assert.equal(r.value, null);
+});
+
+await test('a malformed touches filter is refused, because the router reads it as "every ship" (task 1004007)', () => {
+  for (const bad of ['docs/**', [], [''], [3], { a: 1 }]) {
+    const r = validateAgentDefinition(
+      { name: 'historian', persona: 'x', trigger_type: 'event', trigger_spec: { event: 'task.shipped', touches: bad } },
+      OPTS,
+    );
+    assert.equal(r.ok, false, JSON.stringify(bad));
+    assert.ok(codes(r).includes('trigger_touches_invalid'), JSON.stringify(bad) + ' ' + JSON.stringify(codes(r)));
+  }
+  const good = validateAgentDefinition(
+    { name: 'historian', persona: 'x', trigger_type: 'event', trigger_spec: { event: 'task.shipped', touches_globs: ['docs/**'] } },
+    OPTS,
+  );
+  assert.equal(good.ok, true, JSON.stringify(codes(good)));
+});
+
+await test('a Proxy whose ownKeys trap throws cannot escape the validator (task 1004007)', () => {
+  // The unknown-field check is the one place the validator enumerates the
+  // definition, so it is the one place a throwing ownKeys trap could escape.
+  const hostile = new Proxy(
+    { name: 'historian', persona: 'x', trigger_type: 'on-demand' },
+    { ownKeys() { throw new Error('boom'); } },
+  );
+  let r;
+  assert.doesNotThrow(() => { r = validateAgentDefinition(hostile, OPTS); });
+  assert.equal(r.ok, false);
+  assert.ok(codes(r).includes('keys_unreadable'), JSON.stringify(codes(r)));
+  assert.equal(r.value, null);
+});
+
 await test('EVERY error carries a code, a field and a human message', () => {
   const r = validateAgentDefinition(
     { name: 'BAD NAME', trigger_type: 'webhook', trigger_spec: 'nope', scope_modules: ['government'] },

package/tests/api_path_404.mjs

@@ -172,5 +172,11 @@ t('rebaseRequiredHint: still leads with /strand-fix — merge is the manual fall
     'the command that works on any machine must still come first (task 1003768)');
 });
 
+// task 1004370: when main's CI is red for a reason outside every branch, the gated
+// builder must learn from the refusal itself that the fix is still claimable.
+t('rebaseRequiredHint: names the CI-unblock exit the gate lets through', () => {
+  assert.match(rebaseRequiredHint([{ id: 7 }]), /P1 kind=infra task passes this gate/);
+});
+
 console.log(`\napi_path_404: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/autobongos_cadence.mjs

@@ -270,6 +270,13 @@ function loopHarness({ rows, maxLoops = 6 }) {
     // network call is not a unit suite, it is a flake waiting for a slow day.
     writeHeartbeat: () => true,
     postHeartbeat: async () => true,
+    // These tests drive the BACKOFF LADDER, not the upgrade path (task 1004374).
+    // forever() checks for code drift once a loop, and the generic run() stub
+    // above answers rev-parse and ls-remote with different output — which reads
+    // as "main moved" and exits the loop before it can ever reach probing.
+    // Declaring no drift keeps each test about the one thing it is testing;
+    // tests/autobongos_loop.mjs covers the drift exit itself.
+    codeDrifted: async () => false,
   };
   return { deps, waits: emitted, recorded, opts: { goals: [], maxTasks: 3, maxLoops } };
 }

package/tests/autobongos_loop.mjs

@@ -664,7 +664,7 @@ test('workerEnv passes Claude auth through, and still refuses the rest', () => {
 // cap has to work, and it has to survive a restart: the count comes from the
 // run log, not from memory.
 
-import { mkdtempSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, writeFileSync, readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
@@ -768,3 +768,138 @@ test('countWorkedSince stops at the first row older than the mark', () => {
   assert.equal(runner.countWorkedSince(8000), 1);
   delete process.env.AUTOBONGOS_LOG_FILE;
 });
+
+// --- a --forever runner must be able to take a fix (task 1004374) -----------
+//
+// autobongos-service.cmd refreshes the checkout only BEFORE launching node, and
+// --forever never returns (task 1003904). Together: a process never re-reads its
+// code, a shipped fix never reaches the runner, and nothing restarts it. On the
+// host this ran week-old code for four days across three landed fixes while the
+// heartbeat reported it alive and the hall showed a healthy runner.
+
+test('codeDrifted reports a drift when main has moved past the loaded head', async () => {
+  const calls = [];
+  const run = async (bin, args) => {
+    calls.push(args.join(' '));
+    if (args[0] === 'rev-parse') return { ok: true, stdout: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n' };
+    return { ok: true, stdout: 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\trefs/heads/main\n' };
+  };
+  const d = await runner.codeDrifted({ run });
+  assert.ok(d, 'a moved main is a drift');
+  assert.equal(d.from, 'aaaaaaaa');
+  assert.equal(d.to, 'bbbbbbbb');
+});
+
+test('codeDrifted is false when the loaded head IS the tip', async () => {
+  const loadedHead = async () => 'cccccccccccccccccccccccccccccccccccccccc';
+  const run = async (bin, args) => (args[0] === 'rev-parse'
+    ? { ok: true, stdout: 'cccccccccccccccccccccccccccccccccccccccc\n' }
+    : { ok: true, stdout: 'cccccccccccccccccccccccccccccccccccccccc\trefs/heads/main\n' });
+  assert.equal(await runner.codeDrifted({ run, loadedHead }), false);
+});
+
+test('codeDrifted returns null when the LOCAL head cannot be read', async () => {
+  // Injected rather than stubbed through run(): loadedHead caches into a
+  // module-level, and an earlier test in this file already populated it — so a
+  // run() stub that fails rev-parse is never consulted, and the case passes for
+  // an unrelated reason. That is exactly what the first cut of this test did.
+  const okTip = async () => ({ ok: true, stdout: 'dddddddddddddddddddddddddddddddddddddddd refs/heads/main' });
+  assert.equal(await runner.codeDrifted({ loadedHead: async () => null, run: okTip }), null,
+    'no local head means we cannot tell, and cannot-tell must never cycle the runner');
+});
+
+test('codeDrifted returns null when ORIGIN cannot be reached', async () => {
+  assert.equal(await runner.codeDrifted({ loadedHead: async () => 'eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee', run: async () => ({ ok: false }) }), null);
+});
+
+test('codeDrifted returns null when the git call throws outright', async () => {
+  const thrown = async () => { throw new Error('no network'); };
+  assert.equal(await runner.codeDrifted({ loadedHead: async () => 'eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee', run: thrown }), null);
+});
+
+test('forever EXITS with the upgrade code on drift, and logs why', async () => {
+  const rows = [];
+  const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 3 }, {
+    iteration: async () => ({ event: 'hold', reason: 'test' }),
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true }),
+    waitOrJump: async () => ({ waited: 0, jumped: false }),
+    writeHeartbeat: () => true,
+    postHeartbeat: async () => true,
+    emit: () => {},
+    record: (r) => { rows.push(r); return r; },
+    now: () => Date.now() + runner.MIN_UPTIME_BEFORE_UPGRADE_MS + 1000,
+    codeDrifted: async () => ({ from: '1111aaaa', to: '2222bbbb' }),
+  });
+  assert.equal(code, runner.UPGRADE_EXIT_CODE, 'the wrapper loops on exactly this code');
+  const exit = rows.find((r) => r.event === 'upgrade_exit');
+  assert.ok(exit, 'a silent exit is the failure mode task 1003904 forbids — it must say why');
+  assert.match(exit.reason, /main moved from 1111aaaa to 2222bbbb/);
+});
+
+test('forever does NOT exit while the code is current', async () => {
+  const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 2 }, {
+    iteration: async () => ({ event: 'hold', reason: 'test' }),
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true }),
+    waitOrJump: async () => ({ waited: 0, jumped: false }),
+    writeHeartbeat: () => true,
+    postHeartbeat: async () => true,
+    emit: () => {},
+    record: (r) => r,
+    codeDrifted: async () => false,
+  });
+  assert.equal(code, 0, 'the no-terminal-stop rule still holds for every other case');
+});
+
+test('the wrapper loops on the upgrade code and only on that code', () => {
+  const raw = readFileSync(new URL('../scripts/gds/autobongos-service.cmd', import.meta.url), 'utf8');
+  // LIVE lines only, and no regex here on purpose. A first cut of this test
+  // matched the raw file text and passed happily against a commented-out
+  // "REM goto run" — which is precisely the regression it exists to catch.
+  const live = raw
+    .split('\n')
+    .map((l) => l.replace('\r', '').trim())
+    .filter((l) => l && !l.toUpperCase().startsWith('REM ') && !l.startsWith('::'));
+  const joined = live.join('\n');
+  assert.ok(live.includes(':run'), 'there must be a live label to go back to');
+  assert.ok(live.some((l) => l.startsWith('if "%EXITCODE%"=="75"')), 'and a live branch on the upgrade code');
+  assert.ok(live.includes('goto run'), 'and a live relaunch, not a commented-out one');
+  // Ordering: the relaunch must precede the final exit, or it can never run.
+  assert.ok(joined.indexOf('goto run') < joined.indexOf('exit /b %EXITCODE%'));
+  // And the refresh must sit INSIDE the loop, or a relaunch re-runs the old code,
+  // which is the entire bug.
+  assert.ok(joined.indexOf(':run') < joined.indexOf('git reset --quiet --hard origin/main'));
+});
+
+test('a runner that just started will NOT upgrade-exit, so a failed fetch cannot spin', async () => {
+  // The wrapper's reset is best-effort by design. Without this guard, starting
+  // behind means: see drift, exit, relaunch into the same state, forever.
+  let askedForDrift = false;
+  const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 2 }, {
+    iteration: async () => ({ event: 'hold', reason: 'test' }),
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true }),
+    waitOrJump: async () => ({ waited: 0, jumped: false }),
+    writeHeartbeat: () => true,
+    postHeartbeat: async () => true,
+    emit: () => {},
+    record: (r) => r,
+    now: () => Date.now(),   // uptime is ~0, well under the floor
+    codeDrifted: async () => { askedForDrift = true; return { from: 'aaaa1111', to: 'bbbb2222' }; },
+  });
+  assert.equal(code, 0, 'it must keep running rather than bounce');
+  assert.equal(askedForDrift, false, 'and not even ask — the check costs a network call');
+});
+
+test('past the uptime floor, a drift still exits', async () => {
+  const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 2 }, {
+    iteration: async () => ({ event: 'hold', reason: 'test' }),
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true }),
+    waitOrJump: async () => ({ waited: 0, jumped: false }),
+    writeHeartbeat: () => true,
+    postHeartbeat: async () => true,
+    emit: () => {},
+    record: (r) => r,
+    now: () => Date.now() + runner.MIN_UPTIME_BEFORE_UPGRADE_MS + 1000,
+    codeDrifted: async () => ({ from: 'aaaa1111', to: 'bbbb2222' }),
+  });
+  assert.equal(code, runner.UPGRADE_EXIT_CODE);
+});