@bongos/core 1.19.256 → 1.19.258

package/scripts/gds/audit-gate.js

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+// scripts/gds/audit-gate.js — the dependency vulnerability gate (task 1003127,
+// goal 1000076; ADR 0180, docs/audits/ai-dev-redteam-baseline.md §3).
+//
+// Ratchet semantics, matching the goal's other budgets: a committed BASELINE
+// (config/audit-baseline.json) records the advisories that predate the gate.
+// A HIGH or CRITICAL advisory NOT in the baseline fails CI; anything below
+// high warns; a baseline entry that no longer reproduces prints a shrink nudge
+// (removing it is an ordinary PR). Fixes are explicit tasks — a blanket
+// `npm audit fix` does not even run against this tree (workspace: protocol).
+//
+// Fail contract: CLOSED on findings, OPEN on infrastructure — a registry
+// outage or unparseable audit output warns and exits 0 rather than bricking
+// every PR (the gate's job is catching new advisories, not proving uptime).
+//
+// Run:            node scripts/gds/audit-gate.js
+// Refresh floor:  node scripts/gds/audit-gate.js --update-baseline
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const BASELINE_PATH = path.join(ROOT, 'config', 'audit-baseline.json');
+const GATE_SEVERITIES = new Set(['high', 'critical']);
+
+// npm audit JSON → flat advisory findings, one per (advisory, vulnerable pkg).
+// Identity is the advisory's numeric `source` id + the package it hits — stable
+// across runs, unlike the parent-package rollups npm prints.
+function extractFindings(auditJson) {
+  const out = new Map();
+  const vulns = (auditJson && auditJson.vulnerabilities) || {};
+  for (const entry of Object.values(vulns)) {
+    for (const via of entry.via || []) {
+      if (typeof via !== 'object' || via === null || via.source == null) continue;
+      const key = `${via.source}:${via.name}`;
+      if (!out.has(key)) {
+        out.set(key, {
+          id: String(via.source),
+          name: via.name,
+          severity: String(via.severity || entry.severity || 'unknown').toLowerCase(),
+          title: via.title || '',
+        });
+      }
+    }
+  }
+  return [...out.values()].sort((a, b) => (a.name + a.id).localeCompare(b.name + b.id));
+}
+
+// Pure gate decision — exported for the hermetic test.
+function compare(currentFindings, baselineFindings) {
+  const baseKeys = new Set((baselineFindings || []).map((f) => `${f.id}:${f.name}`));
+  const curKeys = new Set(currentFindings.map((f) => `${f.id}:${f.name}`));
+  const fresh = currentFindings.filter((f) => !baseKeys.has(`${f.id}:${f.name}`));
+  return {
+    newGating: fresh.filter((f) => GATE_SEVERITIES.has(f.severity)),
+    newAdvisory: fresh.filter((f) => !GATE_SEVERITIES.has(f.severity)),
+    resolved: (baselineFindings || []).filter((f) => !curKeys.has(`${f.id}:${f.name}`)),
+  };
+}
+
+function readBaseline() {
+  try {
+    return JSON.parse(fs.readFileSync(BASELINE_PATH, 'utf8')).findings || [];
+  } catch {
+    return [];
+  }
+}
+
+function runAudit() {
+  try {
+    return execSync('npm audit --omit=dev --json', { cwd: ROOT, maxBuffer: 32 * 1024 * 1024 }).toString();
+  } catch (e) {
+    // npm audit exits 1 when advisories exist — that IS the payload.
+    if (e && e.stdout) return e.stdout.toString();
+    throw e;
+  }
+}
+
+function main() {
+  const update = process.argv.includes('--update-baseline');
+  let findings;
+  try {
+    findings = extractFindings(JSON.parse(runAudit()));
+  } catch (e) {
+    console.warn(`audit-gate: WARN — npm audit did not produce parseable JSON (${e.message}); failing OPEN (infra, not findings).`);
+    process.exit(0);
+  }
+
+  if (update) {
+    fs.writeFileSync(
+      BASELINE_PATH,
+      JSON.stringify({ _comment: 'audit-gate baseline (ADR 0180): pre-existing advisories the gate tolerates. Shrink-only — remove entries as fix tasks land; never add by hand to silence a NEW advisory.', updated: null, findings }, null, 2) + '\n',
+    );
+    console.log(`audit-gate: baseline updated — ${findings.length} finding(s) recorded at ${path.relative(ROOT, BASELINE_PATH)}.`);
+    return;
+  }
+
+  const verdict = compare(findings, readBaseline());
+  for (const f of verdict.resolved) {
+    console.log(`audit-gate: ratchet-down available — baseline entry no longer reproduces: [${f.severity}] ${f.name} (${f.id}) ${f.title}`);
+  }
+  for (const f of verdict.newAdvisory) {
+    console.warn(`audit-gate: WARN new ${f.severity} advisory (below the gate): ${f.name} (${f.id}) ${f.title}`);
+  }
+  if (verdict.newGating.length) {
+    console.error('audit-gate: FAIL — new high/critical advisories not in the baseline:');
+    for (const f of verdict.newGating) {
+      console.error(`  [${f.severity}] ${f.name} (advisory ${f.id}) ${f.title}`);
+    }
+    console.error('Fix or pin the dependency. The baseline only records PRE-GATE debt; do not add new entries to silence this.');
+    process.exit(1);
+  }
+  console.log(`audit-gate: PASS — ${findings.length} known finding(s), 0 new at high/critical.`);
+}
+
+if (require.main === module) main();
+
+module.exports = { extractFindings, compare, GATE_SEVERITIES, BASELINE_PATH };

package/scripts/gds/control-manifest.js

@@ -0,0 +1,123 @@
+#!/usr/bin/env node
+// scripts/gds/control-manifest.js — the assurance-of-assurance check (task
+// 1003131, goal 1000076; docs/audits/ai-dev-redteam-baseline.md §0).
+//
+// The audit's HEADLINE finding: ADR 0022 named three enforcement controls
+// (a pre-commit secret hook, a secrets-scan CI workflow, a security-baseline
+// doc) that DID NOT EXIST in this repo — they never survived the core
+// extraction, and nothing noticed for releases. A control that can silently
+// stop existing is not a control.
+//
+// This module is the manifest of controls goal 1000076 shipped, plus the
+// predicate each must satisfy. It runs as a fitness check (fitness.js): delete
+// or unwire any control and the merge gate goes red. The manifest is the ONE
+// list — a control added later without a manifest row, or a manifest row whose
+// file is gone, both fail.
+//
+// Predicates are deliberately shallow (existence + one wiring substring), not
+// deep behavior tests — the control's own unit test proves behavior; THIS proves
+// the control is still present and connected. Cheap, hermetic (fs only), and
+// exactly the check whose absence the audit flagged.
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const exists = (rel) => fs.existsSync(path.join(ROOT, rel));
+
+// Each control: a file that must exist, and optionally a `wiredIn` (file, needle)
+// proving it is CONNECTED, not just present on disk. `label` names it in failures.
+const CONTROLS = [
+  {
+    label: 'prevent: secret-gate PreToolUse hook',
+    file: '.claude/hooks/secret-gate.js',
+    wiredIn: { file: '.claude/settings.json', needle: 'secret-gate.js' },
+  },
+  {
+    label: 'prevent: settings deny-rules for env/key lanes',
+    file: '.claude/settings.json',
+    wiredIn: { file: '.claude/settings.json', needle: '"deny"' },
+  },
+  {
+    label: 'gate: gitleaks secret scan in the unit workflow',
+    file: '.gitleaks.toml',
+    wiredIn: { file: '.github/workflows/unit.yml', needle: 'gitleaks' },
+  },
+  {
+    label: 'gate: dependency audit gate + baseline',
+    file: 'scripts/gds/audit-gate.js',
+    wiredIn: { file: '.github/workflows/unit.yml', needle: 'audit-gate.js' },
+    alsoExists: ['config/audit-baseline.json'],
+  },
+  {
+    label: 'gate: install-lifecycle scripts disabled',
+    file: '.npmrc',
+    wiredIn: { file: '.npmrc', needle: 'ignore-scripts=true' },
+  },
+  {
+    label: 'gate: quality ratchets registered in fitness',
+    file: 'scripts/gds/fitness-ratchets.js',
+    wiredIn: { file: 'scripts/gds/fitness.js', needle: 'fitness-ratchets' },
+    alsoExists: ['config/fitness-baselines.json'],
+  },
+  {
+    label: 'gate: knip dead-code ratchet step in the unit workflow',
+    file: 'scripts/gds/fitness-ratchets.js',
+    wiredIn: { file: '.github/workflows/unit.yml', needle: '--knip' },
+  },
+  {
+    label: 'patrol: weekly red-team routine wired to its scanner',
+    file: '.claude/scheduled-tasks/redteam-weekly/SKILL.md',
+    wiredIn: { file: '.claude/scheduled-tasks/redteam-weekly/SKILL.md', needle: 'redteam-patrol.js' },
+    alsoExists: ['scripts/gds/redteam-patrol.js'],
+  },
+];
+
+// Pure evaluation — exported for the test. deps.exists/deps.read override fs.
+function evaluate(controls = CONTROLS, deps = {}) {
+  const ex = deps.exists || exists;
+  const rd = deps.read || read;
+  const missing = [];
+  for (const c of controls) {
+    if (!ex(c.file)) { missing.push(`${c.label}: control file missing (${c.file})`); continue; }
+    for (const extra of c.alsoExists || []) {
+      if (!ex(extra)) missing.push(`${c.label}: companion file missing (${extra})`);
+    }
+    if (c.wiredIn) {
+      let hay = '';
+      try { hay = ex(c.wiredIn.file) ? rd(c.wiredIn.file) : ''; } catch { hay = ''; }
+      if (!hay.includes(c.wiredIn.needle)) {
+        missing.push(`${c.label}: not wired in — "${c.wiredIn.needle}" absent from ${c.wiredIn.file}`);
+      }
+    }
+  }
+  return missing;
+}
+
+// The fitness.js check.
+function checkControlsExist() {
+  const violations = evaluate();
+  return {
+    name: 'controls assert their own existence — goal 1000076 enforcement manifest (task 1003131)',
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: violations.length
+      ? 'a shipped security/quality control disappeared or came unwired — restore it or update control-manifest.js in the same change'
+      : `all ${CONTROLS.length} goal-1000076 controls present and wired (the assurance-of-assurance the ADR 0022 audit found missing)`,
+  };
+}
+
+function main() {
+  const r = checkControlsExist();
+  for (const v of r.violations) console.error(`✗ ${v}`);
+  console.log(`${r.hardFail ? 'FAIL' : 'PASS'}  ${r.note}`);
+  process.exit(r.hardFail ? 1 : 0);
+}
+
+if (require.main === module) main();
+
+module.exports = { checkControlsExist, evaluate, CONTROLS };

package/scripts/gds/fitness-ratchets.js

@@ -0,0 +1,328 @@
+#!/usr/bin/env node
+// scripts/gds/fitness-ratchets.js — quality budgets that only tighten (task
+// 1003129, goal 1000076; docs/audits/ai-dev-redteam-baseline.md §4).
+//
+// The audit's modularity finding was measurement without thresholds: sizes,
+// dead code, and doc entropy were all TRACKED and nothing failed when they
+// grew. This module gives each metric a committed BASELINE
+// (config/fitness-baselines.json) with RATCHET semantics:
+//   value > baseline  → violation (fitness hardFail — the number got worse)
+//   value < baseline  → warning nudge to lower the baseline (an ordinary PR)
+// GitClear's measured trend (AI-assisted code duplicates instead of reusing)
+// is the reason the gate exists; the baseline records today's debt without
+// bricking today's tree.
+//
+// Metrics (all hermetic — git + fs only, no network):
+//   oversized_file_count / excess_lines_total — tracked first-party .js files
+//     over OVERSIZE_LINES lines, and their total excess (growth anywhere over
+//     the threshold trips the sum even when the count is flat)
+//   duplicate_window_count — normalized WINDOW-line blocks appearing in 2+
+//     distinct files (the in-house jscpd: cross-file copy/paste)
+//   require_cycle_count — strongly-connected components (size >1) in the
+//     relative-require graph (the in-house madge)
+//   console_call_count — console.* call sites in SERVER paths (src/ + modules/
+//     minus their browser public/ trees); task 1003130 converts the core path
+//     to structured logging and shrinks this baseline
+//   doc_stale_links / doc_broken_anchors / doc_duplicate_prose — the
+//     docs-entropy scanner's three counts, reused as a library
+//
+// The knip dead-code ratchet needs node_modules + ~seconds, so it is NOT part
+// of the in-suite check: CI runs `node scripts/gds/fitness-ratchets.js --knip`
+// as its own step (fail-open when knip cannot run, fail-closed on regression).
+//
+// Refresh floors: node scripts/gds/fitness-ratchets.js --update-baselines
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { execFileSync, execSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const BASELINE_PATH = path.join(ROOT, 'config', 'fitness-baselines.json');
+
+const OVERSIZE_LINES = 1500;
+const WINDOW = 30; // normalized lines per duplication window
+
+// Vendored / generated / third-party JS the budgets must not count.
+const EXCLUDE_RE = /(^|\/)(node_modules|public-docs)\/|\.min\.js$|redoc\.standalone\.js$|(^|\/)vendor\//;
+
+function trackedJsFiles() {
+  const out = execFileSync('git', ['ls-files', '*.js'], { cwd: ROOT, encoding: 'utf8' });
+  return out.split('\n').map((s) => s.trim()).filter(Boolean).filter((f) => !EXCLUDE_RE.test(f));
+}
+
+function readRepoFile(rel) {
+  return fs.readFileSync(path.join(ROOT, rel), 'utf8');
+}
+
+// ---------- size ----------
+
+function sizeMetrics(files, read = readRepoFile) {
+  let count = 0;
+  let excess = 0;
+  for (const f of files) {
+    const lines = read(f).split('\n').length;
+    if (lines > OVERSIZE_LINES) {
+      count++;
+      excess += lines - OVERSIZE_LINES;
+    }
+  }
+  return { oversized_file_count: count, excess_lines_total: excess };
+}
+
+// ---------- duplication (in-house jscpd) ----------
+
+function normalizeLines(text) {
+  return text
+    .split('\n')
+    .map((l) => l.trim())
+    .filter((l) => l.length > 0 && !l.startsWith('//') && !l.startsWith('*') && !l.startsWith('/*'));
+}
+
+// contentsByFile: Map(rel → text). Counts window-hashes seen in ≥2 DISTINCT files.
+function duplicateWindowCount(contentsByFile, window = WINDOW) {
+  const filesByHash = new Map();
+  for (const [file, text] of contentsByFile) {
+    const lines = normalizeLines(text);
+    for (let i = 0; i + window <= lines.length; i++) {
+      const h = crypto.createHash('sha1').update(lines.slice(i, i + window).join('\n')).digest('base64');
+      let set = filesByHash.get(h);
+      if (!set) filesByHash.set(h, (set = new Set()));
+      set.add(file);
+    }
+  }
+  let dupes = 0;
+  for (const set of filesByHash.values()) if (set.size >= 2) dupes++;
+  return dupes;
+}
+
+// ---------- require cycles (in-house madge) ----------
+
+const REQUIRE_RE = /require\(\s*(['"])(\.{1,2}\/[^'"]+)\1\s*\)/g;
+
+function resolveRelative(fromRel, spec, exists) {
+  const base = path.posix.normalize(path.posix.join(path.posix.dirname(fromRel), spec));
+  for (const cand of [base, `${base}.js`, `${base}/index.js`]) {
+    if (exists(cand)) return cand;
+  }
+  return null;
+}
+
+// edges: Map(rel → [rel...]). Returns the number of SCCs with size > 1 (Tarjan).
+function countCycles(edges) {
+  let index = 0;
+  const idx = new Map();
+  const low = new Map();
+  const onStack = new Set();
+  const stack = [];
+  let cycles = 0;
+
+  function strongconnect(v) {
+    idx.set(v, index); low.set(v, index); index++;
+    stack.push(v); onStack.add(v);
+    for (const w of edges.get(v) || []) {
+      if (!edges.has(w)) continue;
+      if (!idx.has(w)) { strongconnect(w); low.set(v, Math.min(low.get(v), low.get(w))); }
+      else if (onStack.has(w)) low.set(v, Math.min(low.get(v), idx.get(w)));
+    }
+    if (low.get(v) === idx.get(v)) {
+      let size = 0; let w;
+      do { w = stack.pop(); onStack.delete(w); size++; } while (w !== v);
+      if (size > 1) cycles++;
+    }
+  }
+  for (const v of edges.keys()) if (!idx.has(v)) strongconnect(v);
+  return cycles;
+}
+
+function requireGraph(contentsByFile) {
+  const known = new Set(contentsByFile.keys());
+  const exists = (rel) => known.has(rel);
+  const edges = new Map();
+  for (const [file, text] of contentsByFile) {
+    const deps = [];
+    for (const m of text.matchAll(REQUIRE_RE)) {
+      const target = resolveRelative(file, m[2], exists);
+      if (target && target !== file) deps.push(target);
+    }
+    edges.set(file, deps);
+  }
+  return edges;
+}
+
+// ---------- console.* in server paths ----------
+
+const CONSOLE_RE = /console\.(log|error|warn|info|debug)\s*\(/g;
+
+function isServerPath(rel) {
+  if (!(rel.startsWith('src/') || rel.startsWith('modules/') || rel === 'server.js')) return false;
+  if (rel.includes('/public/')) return false; // browser surfaces are a different concern
+  if (rel.includes('/test')) return false;
+  return true;
+}
+
+function consoleCallCount(contentsByFile) {
+  let n = 0;
+  for (const [file, text] of contentsByFile) {
+    if (!isServerPath(file)) continue;
+    n += (text.match(CONSOLE_RE) || []).length;
+  }
+  return n;
+}
+
+// ---------- doc entropy (reuse the scanner as a library) ----------
+
+function docMetrics() {
+  const de = require('./docs-entropy.js');
+  const relFiles = de.collectMarkdownFiles();
+  const linkFindings = de.scanStaleLinks(relFiles);
+  return {
+    doc_stale_links: linkFindings.filter((f) => f.issue === 'missing_file').length,
+    doc_broken_anchors: linkFindings.filter((f) => f.issue === 'missing_anchor').length,
+    doc_duplicate_prose: de.scanDuplicateProse(relFiles).length,
+  };
+}
+
+// ---------- knip (CI-only, fail-open on infra) ----------
+
+function knipIssueCount() {
+  let raw;
+  try {
+    raw = execSync('npx --no-install knip --reporter json --no-exit-code', {
+      cwd: ROOT, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'],
+    });
+  } catch (e) {
+    if (e && e.stdout) raw = e.stdout.toString(); else return null; // knip unavailable → skip
+  }
+  try {
+    const j = JSON.parse(raw);
+    // knip's json reporter: { files: [...], issues: [{ file, owners, exports:[], types:[], ... }] }
+    const files = Array.isArray(j.files) ? j.files.length : 0;
+    let items = 0;
+    for (const issue of j.issues || []) {
+      for (const key of ['dependencies', 'devDependencies', 'optionalPeerDependencies', 'unlisted', 'binaries', 'unresolved', 'exports', 'types', 'nsExports', 'nsTypes', 'duplicates']) {
+        const v = issue[key];
+        items += Array.isArray(v) ? v.length : 0;
+      }
+    }
+    return files + items;
+  } catch {
+    return null;
+  }
+}
+
+// ---------- baseline + ratchet ----------
+
+function readBaselines() {
+  try {
+    return JSON.parse(fs.readFileSync(BASELINE_PATH, 'utf8')).metrics || {};
+  } catch {
+    return {};
+  }
+}
+
+// Pure ratchet verdict — exported for the hermetic test.
+function compareToBaselines(metrics, baselines) {
+  const violations = [];
+  const warnings = [];
+  for (const [name, value] of Object.entries(metrics)) {
+    if (value === null || value === undefined) continue; // metric skipped (e.g. knip off-CI)
+    const floor = baselines[name];
+    if (floor === undefined) {
+      warnings.push(`no baseline for "${name}" (value ${value}) — run --update-baselines`);
+    } else if (value > floor) {
+      violations.push(`${name} regressed: ${value} > baseline ${floor} — fix the regression; never raise the baseline to pass`);
+    } else if (value < floor) {
+      warnings.push(`ratchet-down available: ${name} improved to ${value} (baseline ${floor}) — lower the baseline in config/fitness-baselines.json`);
+    }
+  }
+  return { violations, warnings };
+}
+
+function computeMetrics({ withDocs = true } = {}) {
+  const files = trackedJsFiles();
+  const contents = new Map(files.map((f) => [f, readRepoFile(f)]));
+  return {
+    ...sizeMetrics(files, (f) => contents.get(f)),
+    duplicate_window_count: duplicateWindowCount(contents),
+    require_cycle_count: countCycles(requireGraph(contents)),
+    console_call_count: consoleCallCount(contents),
+    ...(withDocs ? docMetrics() : {}),
+  };
+}
+
+// The fitness.js check (in-suite, hermetic — everything except knip).
+function checkQualityRatchets() {
+  const metrics = computeMetrics();
+  const { violations, warnings } = compareToBaselines(metrics, readBaselines());
+  return {
+    name: 'quality ratchets — size, duplication, cycles, console, doc entropy only tighten (task 1003129)',
+    hardFail: violations.length > 0,
+    violations,
+    warnings,
+    note: `budgets: ${Object.entries(metrics).map(([k, v]) => `${k}=${v}`).join(' · ')} vs config/fitness-baselines.json (knip runs as its own CI step)`,
+  };
+}
+
+function main() {
+  const update = process.argv.includes('--update-baselines');
+  const knipOnly = process.argv.includes('--knip');
+
+  if (update) {
+    const metrics = computeMetrics();
+    const knip = knipIssueCount();
+    if (knip !== null) metrics.knip_issue_count = knip;
+    const existing = readBaselines();
+    if (knip === null && existing.knip_issue_count !== undefined) metrics.knip_issue_count = existing.knip_issue_count;
+    fs.writeFileSync(
+      BASELINE_PATH,
+      JSON.stringify({ _comment: 'fitness-ratchets baselines (task 1003129): quality debt recorded at gate-adoption. Shrink-only — lower a value when the metric improves; raising one to pass CI is out of policy.', metrics }, null, 2) + '\n',
+    );
+    console.log(`fitness-ratchets: baselines written — ${Object.entries(metrics).map(([k, v]) => `${k}=${v}`).join(' · ')}`);
+    return;
+  }
+
+  if (knipOnly) {
+    const value = knipIssueCount();
+    if (value === null) {
+      console.warn('fitness-ratchets: WARN — knip not runnable here (no node_modules / npx failure); failing OPEN.');
+      process.exit(0);
+    }
+    const { violations, warnings } = compareToBaselines({ knip_issue_count: value }, readBaselines());
+    for (const w of warnings) console.warn(`fitness-ratchets: ${w}`);
+    if (violations.length) {
+      for (const v of violations) console.error(`fitness-ratchets: FAIL — ${v}`);
+      process.exit(1);
+    }
+    console.log(`fitness-ratchets: PASS — knip_issue_count=${value}.`);
+    return;
+  }
+
+  const r = checkQualityRatchets();
+  for (const w of r.warnings) console.warn(`! ${w}`);
+  for (const v of r.violations) console.error(`✗ ${v}`);
+  console.log(`${r.hardFail ? 'FAIL' : 'PASS'}  ${r.note}`);
+  process.exit(r.hardFail ? 1 : 0);
+}
+
+if (require.main === module) main();
+
+module.exports = {
+  checkQualityRatchets,
+  computeMetrics,
+  compareToBaselines,
+  duplicateWindowCount,
+  normalizeLines,
+  countCycles,
+  requireGraph,
+  resolveRelative,
+  sizeMetrics,
+  consoleCallCount,
+  isServerPath,
+  knipIssueCount,
+  OVERSIZE_LINES,
+  WINDOW,
+  BASELINE_PATH,
+};

package/scripts/gds/fitness.js

@@ -1881,6 +1881,8 @@ const CHECKS = [
   checkVocabularyWall, // Check 19 — ADR 0174 / goal 1000068 R07: "role" is a craft, never a rank
   checkGoalMembershipVocabulary, // Check 19b — ADR 0177 / task 1003013: the FOURTH "role" (goal membership)
   checkWriteRoutesValidated, // Check 18 — BV1 R12 / task 1999: every body-reading write route validates (ADR 0118)
+  require('./fitness-ratchets.js').checkQualityRatchets, // Check 20 — task 1003129: quality budgets only tighten (mechanics + knip CI step live in fitness-ratchets.js)
+  require('./control-manifest.js').checkControlsExist, // Check 21 — task 1003131: goal-1000076 controls assert their own existence (the ADR 0022 assurance-of-assurance)
 ];
 
 function runAll() {
@@ -1909,10 +1911,8 @@ function main() {
 if (require.main === module) main();
 
 module.exports = {
-  checkVocabularyWall,
-  VOCAB_ALLOW,
-  checkGoalMembershipVocabulary,
-  GOAL_VOCAB_SURFACE,
+  checkVocabularyWall, VOCAB_ALLOW,
+  checkGoalMembershipVocabulary, GOAL_VOCAB_SURFACE,
   runAll,
   resolvesToHostGame,
   checkCoreHostBoundary,

package/scripts/gds/gen-session-index.js

@@ -128,7 +128,14 @@ function renderSnippet(entries, count = SNIPPET_COUNT) {
   const recent = entries.slice(0, count);
   const L = [];
   L.push(BEGIN);
-  L.push(`**Recent sessions** (newest ${recent.length} — full history in [\`docs/session-log-index.md\`](docs/session-log-index.md)):`);
+  // NOT A MARKDOWN LINK, deliberately. docs/session-log-index.md is GITIGNORED
+  // (ADR 0110 — deploy-regenerated, never committed), so a repo-relative link to
+  // it dangles in every fresh checkout. This snippet is written into the TRACKED
+  // CLAUDE.md, so linking it here minted a stale link in CI on every run: that is
+  // what pushed doc_stale_links past the fitness ratchet baseline and turned the
+  // required `unit` check red on main, blocking all PR merges and (via publish.yml's
+  // workflow_run trigger) all releases. Name the file in a code span; never re-link it.
+  L.push(`**Recent sessions** (newest ${recent.length} — full history in \`docs/session-log-index.md\`):`);
   L.push('');
   for (const e of recent) L.push(line(e, 'docs/session-logs/'));
   L.push(END);