@bongos/core 1.19.214 → 1.19.216

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.214",
-  "core_contract": "1.19.214",
-  "source_commit": "33a353b2b8d41b5d78870cf04e367ba35270db01",
+  "core_version": "1.19.216",
+  "core_contract": "1.19.216",
+  "source_commit": "332217b9ce9425651b7e9cc00f7c10370283a3c5",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T23:48:10.122Z",
+  "built_at": "2026-08-18T00:28:05.306Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1633,
-  "tree_sha256": "42e8f882bc77acfe1def79c56518e80678fb0bd4d4b635f94d013e55474b1ac1",
+  "tree_sha256": "ef48b6c7019bc69b448588ddba70fd4dad3efe642c319e131914d0719faa13a2",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1372,7 +1372,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "274bd57fc6c0b83aba02cedb5cc6daa2fca4a9d74ae5268e527a81ebc10b50e0"
+      "sha256": "675d873f35c886145c80d954b885692ef0608b4e5b1b843943611f59260eceed"
     },
     {
       "path": "docs/architecture.md",
@@ -3652,7 +3652,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "9e963e289039a6b1c64b17deae161895876831de20e4e06b947ea3b3f49afdf6"
+      "sha256": "8763c40223e27e9d6fc65ea76442e479301407ba70e77b9582c5ffcd09f17a11"
     },
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
@@ -4282,12 +4282,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "02845f76d2382f9e1568f039c838a34505297ae619cdb9cdbe5d8b583cd1dd40"
+      "sha256": "e3ec1b7c73d0f97c739441cbfb445bf1272ab8188908a40c5f5b20b503e0aecf"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6abe7a4d894357f207a16ab1735c642f46e2f5905d3845c436b6df438f66a3ac"
+      "sha256": "f6e3bf39a631c8a79e69291876119717c4f25acf8ad15144bfd845452e3a4ec2"
     },
     {
       "path": "public-docs/index.html",
@@ -5197,7 +5197,7 @@
     {
       "path": "scripts/gds/preflight.js",
       "mode": "0000644",
-      "sha256": "b56478bfcec12f59370cd019ee5e89f33300f50556327d389789446f17782f04"
+      "sha256": "bd57bb676f0ed6c426129a912727c4ecd363a1197373588fe24f4d48727a75dc"
     },
     {
       "path": "scripts/gds/provision.js",
@@ -5902,7 +5902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "53487d418120e292c09bc2f647581d2541fbf7966052420827b8d6c49c77940d"
+      "sha256": "1b0b819f43443acd16ef719721610c5eb1d4077a083f5b40f272b7e176ab203a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6797,7 +6797,7 @@
     {
       "path": "tests/goal_membership_requests.mjs",
       "mode": "0000644",
-      "sha256": "660dd4143c21de0fe81b4507f3cb9f0731e5722e6c77806de8327156b18198f6"
+      "sha256": "59253dac0064ae1a9c7dd67ef87c1d32ff924d3c3dadf7cdb9553dbc76f88eb0"
     },
     {
       "path": "tests/goal_routes.mjs",
@@ -7497,7 +7497,7 @@
     {
       "path": "tests/preflight_checks.mjs",
       "mode": "0000644",
-      "sha256": "dcf007165fa70a3ad4ebc3109fda78495af2482e7b5fb1ebfa713cf9f0cb4413"
+      "sha256": "9f16091a8feeaef9e4350104dbc9671fab6f2b53f99fd82f798c77800e780b61"
     },
     {
       "path": "tests/preview_server.mjs",

package/docs/api/openapi.json

@@ -4276,7 +4276,7 @@
           "goals"
         ],
         "summary": "POST /goals/:id/invitations/:reqId/respond",
-        "description": "POST /goals/:id/invitations/:reqId/respond { action: accept|decline } — ONLY the invited builder resolves their OWN pending invite (task 1952). accept → they're added as a member; decline → the row is rejected. A protected-scope goal still requires a Metic+ member, re-checked against the accepting builder's current rank (the goal could have been re-scoped after the invite). rank: any-builder (requireBuilder) + the in-handler authorizeInvitationResponse.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "POST /goals/:id/invitations/:reqId/respond { action: accept|decline } — ONLY the invited builder resolves their OWN pending invite (task 1952). accept → they're added as a member (only while the goal is still OPEN, and a protected-scope goal still requires a Metic+ member — both re-checked against the CURRENT goal row by authorizeInvitationAccept, task 1002887); decline → the row is rejected, allowed whatever the goal's state, since that is inbox cleanup rather than admission. rank: any-builder (requireBuilder) + the in-handler authorizeInvitationResponse.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/lifecycle/routes/goals.js",
         "parameters": [

package/modules/lifecycle/routes/goals.js

@@ -324,6 +324,44 @@ function authorizeInvitationResponse({ request, goalId, actorId }) {
   return { ok: true };
 }
 
+// authorizeInvitationAccept — the ORDERED, FAIL-CLOSED gate for the ACCEPT half of
+// POST /goals/:id/invitations/:reqId/respond, run against the GOAL after
+// authorizeInvitationResponse has cleared the request row (task 1002887).
+//
+// Accepting is an ADMISSION, so it needs the same goal-state floor every other
+// admission path already has: the create side requires an open goal
+// (authorizeGoalManagement) and the join-request approve side inherits that check
+// verbatim — only invitation-accept was missing it, so an invite issued while a
+// goal was open could still add a member AFTER the goal was achieved or archived.
+// DECLINE is deliberately NOT gated here: clearing a stale invitation out of your
+// inbox is cleanup, not admission (the route returns before calling this).
+// Ordering mirrors the sibling routes: goal_not_found → goal_not_open →
+// metic_required_for_protected_scope (the pre-existing protected-scope membership
+// floor, re-asserted against the ACCEPTING builder's current rank because the goal
+// may have been re-scoped since the invite; the actor-is-Archon half of
+// protectedScopeAdmissionBlock does not apply — the invitee is consenting).
+//
+// Unlike its {status, body} siblings this returns a res.fail SPEC ({ code, status,
+// message, details }) because the accept branch already answers through res.fail —
+// routing it through the envelope keeps the existing metic_required_for_protected_scope
+// response byte-identical while still being PURE + exported for DB-free tests.
+function authorizeInvitationAccept({ goal, scopeProtected, actorRank }) {
+  if (!goal) {
+    return { ok: false, code: 'goal_not_found', status: 404,
+      message: 'The goal behind this invitation no longer exists.' };
+  }
+  if (goal.status !== 'open') {
+    return { ok: false, code: 'goal_not_open', status: 409,
+      message: 'This goal is no longer open — an invitation can only be accepted while it is. You can still decline it.',
+      details: { status: goal.status } };
+  }
+  if (scopeProtected && !METIC_PLUS.includes(actorRank)) {
+    return { ok: false, code: 'metic_required_for_protected_scope', status: 403,
+      message: 'This goal is scoped to a protected module and requires a Metic+ member.' };
+  }
+  return { ok: true };
+}
+
 // authorizeJoinRequestResponse — the gate for POST /goals/:id/requests/:reqId/respond
 // (task 1952): an owner|manager|Archon approves/denies a pending join-request. The
 // authority prefix is authorizeGoalManagement VERBATIM (goal exists/open + owner|
@@ -789,9 +827,10 @@ module.exports = function buildGoalsRouter() {
 
   // POST /goals/:id/invitations/:reqId/respond { action: accept|decline } — ONLY the
   // invited builder resolves their OWN pending invite (task 1952). accept → they're
-  // added as a member; decline → the row is rejected. A protected-scope goal still
-  // requires a Metic+ member, re-checked against the accepting builder's current rank
-  // (the goal could have been re-scoped after the invite).
+  // added as a member (only while the goal is still OPEN, and a protected-scope goal
+  // still requires a Metic+ member — both re-checked against the CURRENT goal row by
+  // authorizeInvitationAccept, task 1002887); decline → the row is rejected, allowed
+  // whatever the goal's state, since that is inbox cleanup rather than admission.
   // rank: any-builder (requireBuilder) + the in-handler authorizeInvitationResponse.
   router.post('/goals/:id/invitations/:reqId/respond', auth.requireBuilder, async (req, res) => {
     const id = parseId(req, res, { code: 'bad_goal_id' });
@@ -814,13 +853,14 @@ module.exports = function buildGoalsRouter() {
         return res.json({ ok: true, action, request: resolved });
       }
 
-      // accept — re-assert the protected-scope Metic+ membership invariant against
-      // the accepting builder's CURRENT rank (the goal may have been re-scoped since
-      // the invite). The invitee is consenting, so the actor-is-Archon half of the
-      // admission rule does NOT apply here — only the Metic+ membership floor does.
+      // accept — the goal-state + protected-scope floor, read against the goal's
+      // CURRENT row (fail-closed if it is gone). See authorizeInvitationAccept.
       const goal = await db.getGoal(id);
-      if (goal && scopeIncludesProtected(goal.scope_modules) && !METIC_PLUS.includes(req.builder.rank)) {
-        return res.fail('metic_required_for_protected_scope', { status: 403, message: 'This goal is scoped to a protected module and requires a Metic+ member.' });
+      const admit = authorizeInvitationAccept({
+        goal, scopeProtected: !!goal && scopeIncludesProtected(goal.scope_modules), actorRank: req.builder.rank,
+      });
+      if (!admit.ok) {
+        return res.fail(admit.code, { status: admit.status, message: admit.message, details: admit.details });
       }
       // Resolve + add atomically (one statement) — never an 'accepted' invite
       // with no membership (the task-1952 review fix).
@@ -1505,6 +1545,9 @@ module.exports.RESOLVE_ACTIONS = RESOLVE_ACTIONS;
 module.exports.protectedScopeAdmissionBlock = protectedScopeAdmissionBlock;
 module.exports.authorizeCreateJoinRequest = authorizeCreateJoinRequest;
 module.exports.authorizeInvitationResponse = authorizeInvitationResponse;
+// task 1002887: the goal-state floor on the ACCEPT half of the invitation-respond
+// route — exported for tests/goal_membership_requests.mjs, same precedent.
+module.exports.authorizeInvitationAccept = authorizeInvitationAccept;
 module.exports.authorizeJoinRequestResponse = authorizeJoinRequestResponse;
 // task 1953: the withdraw gate — exported for tests/goal_membership_requests.mjs,
 // same precedent as its siblings above.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.214",
+  "version": "1.19.216",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.214",
+      "version": "1.19.216",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.214",
+  "version": "1.19.216",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/preflight.js

@@ -8,8 +8,9 @@
 //                          on a bare machine it died with `node: command not found`.
 //   2. deps installed    — a missing node_modules is why a ship later blew up with
 //                          `Cannot find module 'pg'`.
-//   3. `claude` launchable — the grader spawns it per worker; without it every ship
-//                          failed grading with SUBAGENT_SPAWN_FAILED.
+//   3. `claude` usable    — the grader spawns it per worker. Not launchable ⇒ every
+//                          ship failed grading with SUBAGENT_SPAWN_FAILED; launchable
+//                          but LOGGED OUT ⇒ SUBAGENT_NONZERO_EXIT (task 1003080).
 // Each finding carries a copy-paste fix.
 //
 // Before this, those checks lived only inside `bongos doctor` (doctor.js) and were
@@ -31,6 +32,10 @@ const { spawnSync } = require('node:child_process');
 const REPO_ROOT = nodePath.resolve(__dirname, '..', '..');
 const MIN_NODE_MAJOR = 22;
 
+// Env that authenticates the CLI with no interactive login — a headless box or a
+// CI runner. ci-grade.js reads the same two to decide whether it can grade at all.
+const HEADLESS_AUTH_ENV = ['CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_API_KEY'];
+
 // The node_modules-present check, factored out (task 1002403) so a HOT-PATH
 // caller — /builder-start runs on every session open — can reuse THIS exact
 // finding without paying for the `claude --version` spawn the full
@@ -49,6 +54,55 @@ function depsFinding({ repoRoot = REPO_ROOT, fs = nodeFs } = {}) {
   };
 }
 
+// The AUTH half of the `claude CLI` row (task 1003080). Split out to keep
+// preflightChecks readable — the depsFinding precedent. Pure: spawn/env injected.
+//
+// WHY IT EXISTS. `claude --version` exits 0 while the CLI is LOGGED OUT, so the
+// launchable probe alone reported "the grader can spawn its workers" on a box
+// where every worker died on spawn. The grader runs one `claude -p` per panel
+// worker; logged out, each exits 1 in ~5s, so all four record
+// SUBAGENT_NONZERO_EXIT, the panel reports `unavailable`, and the builder gets a
+// 0/10 "grade failed" card with an empty issues[] — while doctor, the one tool
+// they're told to run, printed a green row. (Observed on task 1002459: two
+// consecutive outage rounds, cost_usd null on every worker, while the rest of the
+// fleet graded 21/21 the same day.)
+//
+// `claude auth status --json` answers `{ loggedIn: bool }` from local credentials
+// — no token spend, no model call. An unverifiable answer (an older CLI with no
+// `auth` subcommand, or any unparseable output) deliberately stays OK with the
+// caveat named: a working older box must never be turned red by a probe it can't
+// answer.
+function claudeAuthFinding({ bin, via, ver, env, spawn, platform }) {
+  const envVar = HEADLESS_AUTH_ENV.find((k) => env[k]);
+  if (envVar) {
+    return { level: 'ok', title: 'claude CLI', detail: `launches${via}: ${ver}; authenticated via ${envVar} — the grader can spawn its workers.` };
+  }
+
+  let a;
+  try {
+    a = spawn(bin, ['auth', 'status', '--json'], { encoding: 'utf8', shell: platform === 'win32', windowsHide: true, timeout: 15000 });
+  } catch (err) { a = { error: err }; }
+
+  let loggedIn = null; // null ⇒ the CLI didn't answer in a shape we understand
+  try {
+    const parsed = JSON.parse(String((a && a.stdout) || '').trim());
+    if (typeof parsed.loggedIn === 'boolean') loggedIn = parsed.loggedIn;
+  } catch (_) { /* older CLI without `auth status`, or non-JSON output */ }
+
+  if (loggedIn === false) {
+    return {
+      level: 'fail',
+      title: 'claude CLI',
+      detail: `launches${via} (${ver}) but is not logged in — the grader spawns one \`claude -p\` per panel worker and each exits 1 immediately, so every ship fails grading with SUBAGENT_NONZERO_EXIT and a 0/10 card carrying no findings.`,
+      fix: `Run \`${bin} auth login\` (or \`${bin}\`, then /login). On a headless box, set ${HEADLESS_AUTH_ENV.join(' or ')} instead.`,
+    };
+  }
+  if (loggedIn === true) {
+    return { level: 'ok', title: 'claude CLI', detail: `launches${via}: ${ver}, logged in — the grader can spawn its workers.` };
+  }
+  return { level: 'ok', title: 'claude CLI', detail: `launches${via}: ${ver} — the grader can spawn its workers (login state not verified: this CLI has no \`auth status\`).` };
+}
+
 // preflightChecks(deps) → [{ level:'ok'|'warn'|'fail', title, detail, fix? }]
 // No printing, no process.exit — callers (setup, doctor, the test) format it.
 function preflightChecks({
@@ -87,7 +141,10 @@ function preflightChecks({
   } catch (err) { r = { error: err }; }
   if (r && !r.error && r.status === 0) {
     const ver = String(r.stdout || '').trim().split('\n')[0] || 'present';
-    out.push({ level: 'ok', title: 'claude CLI', detail: `launches${via}: ${ver} — the grader can spawn its workers.` });
+    // task 1003080: launchable is only HALF this leg — `--version` exits 0 while
+    // the CLI is logged out, so this row used to go green at the exact moment
+    // the thing it checks is broken. claudeAuthFinding proves auth too.
+    out.push(claudeAuthFinding({ bin, via, ver, env, spawn, platform }));
   } else {
     const why = r && r.error ? (r.error.code || r.error.message) : `exited ${r ? r.status : '?'}`;
     out.push({
@@ -116,7 +173,7 @@ function formatPreflight(results, { color = false, heading = false } = {}) {
   return lines.join('\n');
 }
 
-module.exports = { preflightChecks, depsFinding, formatPreflight, REPO_ROOT, MIN_NODE_MAJOR };
+module.exports = { preflightChecks, depsFinding, claudeAuthFinding, formatPreflight, REPO_ROOT, MIN_NODE_MAJOR, HEADLESS_AUTH_ENV };
 
 // Standalone: `node scripts/gds/preflight.js` — exit 1 if any hard fail.
 if (require.main === module) {

package/src/module-api.js

@@ -855,8 +855,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.212 with no explicit bump. run 32081051255. (task 1002620)
 //   1.19.214 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.213 with no explicit bump. run 32081917908. (task 1002620)
+//   1.19.215 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.214 with no explicit bump. run 32084187695. (task 1002620)
+//   1.19.216 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.215 with no explicit bump. run 32084584347. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.214'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.216'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_membership_requests.mjs

@@ -15,6 +15,9 @@
 //   • listPendingRequestsForGoal — pending both-kinds for one goal.
 //   • addGoalMember (task 1002888) — arriving as a member by ANY route cancels
 //     that builder's still-pending ask, atomically and kind-agnostically.
+//   • authorizeInvitationAccept (task 1002887) — accepting an invite re-checks the
+//     goal is still OPEN (a stale invite can't admit to an achieved/archived goal);
+//     declining stays allowed, so the route declines before ever reading the goal.
 //   • the migration is additive + private-safe (default 'public', partial unique).
 
 import { strict as assert } from 'node:assert';
@@ -42,6 +45,7 @@ const {
   protectedScopeAdmissionBlock,
   authorizeCreateJoinRequest,
   authorizeInvitationResponse,
+  authorizeInvitationAccept,
   authorizeJoinRequestResponse,
   authorizeWithdrawJoinRequest,
   decorateGoalScope,
@@ -370,6 +374,54 @@ await test('authorizeInvitationResponse: the invitee (string vs number id) → A
   assert.deepEqual(authorizeInvitationResponse({ request: INVITE, goalId: '5', actorId: 2 }), { ok: true });
 });
 
+// authorizeInvitationAccept (task 1002887) — the goal-state floor on ACCEPT only.
+const OPEN_GOAL = { id: 5, status: 'open', scope_modules: null };
+await test('authorizeInvitationAccept: open, unprotected goal → ALLOW', () => {
+  assert.deepEqual(authorizeInvitationAccept({ goal: OPEN_GOAL, scopeProtected: false, actorRank: 'thetes' }), { ok: true });
+});
+await test('authorizeInvitationAccept: the goal is gone → 404 (fail-closed, never a member of nothing)', () => {
+  const d = authorizeInvitationAccept({ goal: null, scopeProtected: false, actorRank: 'archon' });
+  assert.equal(d.ok, false); assert.equal(d.status, 404); assert.equal(d.code, 'goal_not_found');
+});
+for (const status of ['achieved', 'archived']) {
+  await test(`authorizeInvitationAccept: ${status} goal → 409 goal_not_open (a stale invite can't admit)`, () => {
+    const d = authorizeInvitationAccept({ goal: { ...OPEN_GOAL, status }, scopeProtected: false, actorRank: 'archon' });
+    assert.equal(d.ok, false); assert.equal(d.status, 409); assert.equal(d.code, 'goal_not_open');
+    assert.deepEqual(d.details, { status }, 'carries the blocking status, like every sibling goal_not_open');
+  });
+}
+await test('authorizeInvitationAccept: goal-state is checked BEFORE scope (ordering, like the join route)', () => {
+  const d = authorizeInvitationAccept({ goal: { ...OPEN_GOAL, status: 'archived' }, scopeProtected: true, actorRank: 'thetes' });
+  assert.equal(d.code, 'goal_not_open', 'a closed goal refuses on state, not on the scope floor');
+});
+await test('authorizeInvitationAccept: open + protected + sub-Metic invitee → 403 metic_required (unchanged)', () => {
+  const d = authorizeInvitationAccept({ goal: OPEN_GOAL, scopeProtected: true, actorRank: 'thetes' });
+  assert.equal(d.status, 403); assert.equal(d.code, 'metic_required_for_protected_scope');
+  assert.equal(d.message, 'This goal is scoped to a protected module and requires a Metic+ member.');
+  assert.equal(d.details, undefined, 'no details — the res.fail envelope stays byte-identical to the pre-1002887 response');
+});
+await test('authorizeInvitationAccept: open + protected + Metic invitee → ALLOW (consent, no Archon actor needed)', () => {
+  assert.deepEqual(authorizeInvitationAccept({ goal: OPEN_GOAL, scopeProtected: true, actorRank: 'metic' }), { ok: true });
+});
+
+// DECLINE stays allowed on a closed goal — clearing a stale invitation out of your
+// inbox is cleanup, not admission. The route's decline branch must therefore return
+// BEFORE the goal is ever fetched; pinned at the source level (the addGoalMember
+// resolvedBy precedent above), since the live route is exercised in goal_routes.mjs.
+await test('routes: invitation-respond declines before the goal-state gate', () => {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const src = readFileSync(join(here, '..', 'modules', 'lifecycle', 'routes', 'goals.js'), 'utf8');
+  const handler = src.slice(src.indexOf("router.post('/goals/:id/invitations/:reqId/respond'"));
+  const body = handler.slice(0, handler.indexOf('\n  });'));
+  const declineAt = body.indexOf("if (action === 'decline')");
+  const gateAt = body.indexOf('authorizeInvitationAccept({');
+  assert.ok(declineAt > 0 && gateAt > 0, 'both branches present in the respond handler');
+  assert.ok(declineAt < gateAt, 'decline resolves and returns before the accept-only goal gate');
+  assert.ok(body.indexOf('db.getGoal(') > declineAt, 'decline never even reads the goal');
+  assert.ok(gateAt < body.indexOf('db.acceptMembershipRequestAndAddMember('),
+    'the gate runs before the membership add');
+});
+
 // authorizeJoinRequestResponse — owner|manager|Archon resolves a join-request.
 const OWNER_GOAL = { id: 5, status: 'open', created_by: '1', visibility: 'private' };
 const REQUEST = { id: 8, goal_id: '5', builder_id: '2', kind: 'request', status: 'pending' };

package/tests/preflight_checks.mjs

@@ -70,3 +70,77 @@ test('formatPreflight renders glyphs + fixes and stays plain (no ANSI) by defaul
   assert.match(s, /→ .*npm ci/);
   assert.doesNotMatch(s, /\x1b\[/); // color:false ⇒ no ANSI escapes
 });
+
+// --------------------------------------------------------------------------
+// claude CLI AUTHENTICATION (task 1003080)
+// --------------------------------------------------------------------------
+// `--version` exits 0 while the CLI is logged out, so the launchable probe
+// alone false-greened the exact failure it exists to catch: every grader worker
+// exits 1 on spawn (SUBAGENT_NONZERO_EXIT) and the builder gets a 0/10 card with
+// no findings. These cover the four auth shapes.
+
+// A spawn stub that answers `--version` and `auth status --json` differently.
+// authJson === null ⇒ the CLI has no `auth` subcommand (older build): non-JSON
+// on stdout, non-zero exit.
+const spawnWithAuth = (authJson) => (_bin, args) => {
+  if (args && args[0] === 'auth') {
+    return authJson === null
+      ? { status: 1, stdout: '', stderr: "error: unknown command 'auth'\n" }
+      : { status: 0, stdout: `${JSON.stringify(authJson)}\n` };
+  }
+  return { status: 0, stdout: '2.1.234 (Claude Code)\n' };
+};
+
+test('claude launches but is LOGGED OUT → fail naming SUBAGENT_NONZERO_EXIT + the login fix', () => {
+  const r = preflightChecks({
+    nodeVersion: 'v22.0.0', fs: fsWith(true), env: {},
+    spawn: spawnWithAuth({ loggedIn: false }),
+  });
+  const claude = find(r, 'claude CLI');
+  assert.equal(claude.level, 'fail');
+  assert.match(claude.detail, /not logged in/i);
+  assert.match(claude.detail, /SUBAGENT_NONZERO_EXIT/);
+  assert.match(claude.fix, /auth login/);
+});
+
+test('claude logged in → ok', () => {
+  const r = preflightChecks({
+    nodeVersion: 'v22.0.0', fs: fsWith(true), env: {},
+    spawn: spawnWithAuth({ loggedIn: true, authMethod: 'claude.ai' }),
+  });
+  const claude = find(r, 'claude CLI');
+  assert.equal(claude.level, 'ok');
+  assert.match(claude.detail, /2\.1\.234/);
+});
+
+test('a headless auth token in env → ok, and the auth probe is never spawned', () => {
+  const seen = [];
+  const spy = (_bin, args) => { seen.push((args || []).join(' ')); return { status: 0, stdout: '2.1.234\n' }; };
+  const r = preflightChecks({
+    nodeVersion: 'v22.0.0', fs: fsWith(true), spawn: spy,
+    env: { CLAUDE_CODE_OAUTH_TOKEN: 'sk-ant-oat-xxx' },
+  });
+  const claude = find(r, 'claude CLI');
+  assert.equal(claude.level, 'ok');
+  assert.match(claude.detail, /CLAUDE_CODE_OAUTH_TOKEN/);
+  assert.deepEqual(seen, ['--version']);
+});
+
+test('an older CLI without `auth status` stays ok, but says auth was not verified', () => {
+  const r = preflightChecks({
+    nodeVersion: 'v22.0.0', fs: fsWith(true), env: {},
+    spawn: spawnWithAuth(null),
+  });
+  const claude = find(r, 'claude CLI');
+  assert.equal(claude.level, 'ok');
+  assert.match(claude.detail, /not verif/i);
+});
+
+test('a thrown auth spawn is treated as unverifiable, never crashes', () => {
+  const spawnThrows = (_bin, args) => {
+    if (args && args[0] === 'auth') throw new Error('boom');
+    return { status: 0, stdout: '2.1.234\n' };
+  };
+  const r = preflightChecks({ nodeVersion: 'v22.0.0', fs: fsWith(true), env: {}, spawn: spawnThrows });
+  assert.equal(find(r, 'claude CLI').level, 'ok');
+});