@bongos/core 1.19.256 → 1.19.258

package/scripts/gds/redteam-patrol.js

@@ -0,0 +1,308 @@
+#!/usr/bin/env node
+// scripts/gds/redteam-patrol.js — the weekly deterministic red-team patrol
+// (task 1003128, goal 1000076; ADR 0180 §3, docs/audits/ai-dev-redteam-baseline.md).
+//
+// The patrol is the third enforcement layer (prevent → gate → PATROL): checks
+// too slow, too networked, or too history-wide for the merge gate, run weekly
+// by the .claude/scheduled-tasks/redteam-weekly routine. It is ADVISORY by
+// doctrine (ADR 0162 — verdicts never self-execute): findings are FILED as
+// security reports for Archon adjudication, never turned into gates here.
+//
+// Checks (all deterministic — no model reads anything):
+//   1. history-secrets — full-git-history gitleaks scan (.gitleaks.toml config;
+//      the CI gate only scans the current tree, so a key deleted years ago but
+//      still live is THIS check's catch). Needs the gitleaks binary
+//      (GITLEAKS_BIN or on PATH) — absent means a loud degraded note.
+//   2. dependency-review — npm audit delta vs config/audit-baseline.json
+//      (reuses audit-gate.js), release-age cooldown (<7 days — ADR 0180 §3),
+//      young direct deps (<90 days — the slopsquat shape), stale overrides.
+//   3. action-pins — every workflow `uses:` must be pinned to a 40-hex SHA
+//      (the tj-actions lesson).
+//
+// Filing: DRY-RUN by default (prints what it would file). --file POSTs one
+// report PER CLASS (max severity within the class, details in repro_steps_md)
+// to /api/gds/security/reports. --canary proves the end-to-end pipe: plants a
+// constructed token, asserts the scanner catches it, files a low "[canary]"
+// report, and dispute-closes it so the queue stays clean.
+
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { execSync, execFileSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const COOLDOWN_DAYS = 7;   // ADR 0180 §3 — patrol-enforced until npm ≥ 11.10 in CI
+const YOUNG_PKG_DAYS = 90; // a very new package is the slopsquat/typosquat shape
+const MAX_ITEMS_PER_REPORT = 10;
+
+const SEV_ORDER = { low: 0, medium: 1, high: 2, critical: 3 };
+// npm audit says "moderate"; the bounty table says "medium".
+function mapSeverity(s) {
+  const v = String(s || '').toLowerCase();
+  return v === 'moderate' ? 'medium' : (SEV_ORDER[v] !== undefined ? v : 'low');
+}
+function maxSeverity(findings) {
+  return findings.reduce((m, f) => (SEV_ORDER[f.severity] > SEV_ORDER[m] ? f.severity : m), 'low');
+}
+
+// ---------- 1. full-history secret scan ----------
+
+function gitleaksBin() {
+  const explicit = process.env.GITLEAKS_BIN;
+  if (explicit && fs.existsSync(explicit)) return explicit;
+  try {
+    execFileSync(process.platform === 'win32' ? 'where' : 'which', ['gitleaks'], { stdio: 'pipe' });
+    return 'gitleaks';
+  } catch {
+    return null;
+  }
+}
+
+// Parse a gitleaks JSON report file into patrol findings.
+function parseGitleaksReport(raw) {
+  let rows;
+  try { rows = JSON.parse(raw); } catch { return []; }
+  if (!Array.isArray(rows)) return [];
+  return rows.map((r) => ({
+    severity: 'high',
+    item: `${r.RuleID || r.ruleID || 'secret'} in ${r.File || r.file || '?'}${r.Commit ? ` @ ${String(r.Commit).slice(0, 8)}` : ''}`,
+  }));
+}
+
+function historySecretScan() {
+  const bin = gitleaksBin();
+  if (!bin) {
+    return { degraded: 'gitleaks binary not found (set GITLEAKS_BIN or `brew install gitleaks`) — history scan SKIPPED', findings: [] };
+  }
+  const report = path.join(os.tmpdir(), `gitleaks-patrol-${process.pid}.json`);
+  try {
+    execFileSync(bin, ['git', '.', '--config', '.gitleaks.toml', '--redact', '--no-banner',
+      '--report-format', 'json', '--report-path', report], { cwd: ROOT, stdio: 'pipe' });
+  } catch {
+    /* non-zero exit = leaks found; the report file is still written */
+  }
+  let findings = [];
+  try { findings = parseGitleaksReport(fs.readFileSync(report, 'utf8')); } catch { /* no report = clean */ }
+  try { fs.unlinkSync(report); } catch { /* already gone */ }
+  return { degraded: null, findings };
+}
+
+// ---------- 2. dependency review ----------
+
+function npmViewJson(spec) {
+  try {
+    return JSON.parse(execSync(`npm view ${spec} --json`, { cwd: ROOT, stdio: 'pipe', timeout: 30000 }).toString());
+  } catch {
+    return null;
+  }
+}
+
+function ageDays(iso, now = Date.now()) {
+  const t = Date.parse(iso);
+  return Number.isFinite(t) ? (now - t) / 86400000 : null;
+}
+
+function lockedVersion(lock, name) {
+  const entry = lock.packages && lock.packages[`node_modules/${name}`];
+  return entry && entry.version;
+}
+
+function dependencyReview() {
+  const findings = [];
+  const notes = [];
+  const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
+  const lock = JSON.parse(fs.readFileSync(path.join(ROOT, 'package-lock.json'), 'utf8'));
+
+  // 2a — audit delta vs the committed baseline (same lens as the CI gate, but
+  // the patrol also reports RESOLVED entries so the baseline gets shrunk).
+  const auditGate = require('./audit-gate.js');
+  try {
+    let raw;
+    try { raw = execSync('npm audit --omit=dev --json', { cwd: ROOT, maxBuffer: 32 * 1024 * 1024, stdio: 'pipe' }).toString(); }
+    catch (e) { raw = e && e.stdout ? e.stdout.toString() : null; }
+    const current = auditGate.extractFindings(JSON.parse(raw));
+    const baseline = JSON.parse(fs.readFileSync(auditGate.BASELINE_PATH, 'utf8')).findings || [];
+    const verdict = auditGate.compare(current, baseline);
+    for (const f of [...verdict.newGating, ...verdict.newAdvisory]) {
+      findings.push({ severity: mapSeverity(f.severity), item: `new advisory: [${f.severity}] ${f.name} (${f.id}) ${f.title}` });
+    }
+    for (const f of verdict.resolved) notes.push(`baseline shrinkable: ${f.name} (${f.id}) no longer reproduces`);
+  } catch (e) {
+    notes.push(`audit delta SKIPPED (infra): ${e.message}`);
+  }
+
+  // 2b — release-age cooldown + young packages, direct deps only (9 today).
+  for (const name of Object.keys(pkg.dependencies || {})) {
+    const version = lockedVersion(lock, name);
+    if (!version) continue;
+    const meta = npmViewJson(`${name} time`);
+    const time = meta && (meta.time || meta);
+    if (!time) { notes.push(`npm view failed for ${name} — cooldown check skipped`); continue; }
+    const vAge = ageDays(time[version]);
+    if (vAge !== null && vAge < COOLDOWN_DAYS) {
+      findings.push({ severity: 'medium', item: `cooldown breach: ${name}@${version} published ${vAge.toFixed(1)}d ago (<${COOLDOWN_DAYS}d — ADR 0180 §3)` });
+    }
+    const cAge = ageDays(time.created);
+    if (cAge !== null && cAge < YOUNG_PKG_DAYS) {
+      findings.push({ severity: 'medium', item: `young package: ${name} created ${cAge.toFixed(0)}d ago (<${YOUNG_PKG_DAYS}d — verify it is the intended package)` });
+    }
+  }
+
+  // 2c — override staleness (the undici lesson: a pin nobody watches rots).
+  for (const [name, range] of Object.entries(pkg.overrides || {})) {
+    if (typeof range !== 'string') continue;
+    const latest = npmViewJson(`${name} dist-tags.latest`);
+    if (!latest) continue;
+    const pinnedMajor = parseInt(String(range).replace(/^[^0-9]*/, ''), 10);
+    const latestMajor = parseInt(String(latest), 10);
+    if (Number.isFinite(pinnedMajor) && Number.isFinite(latestMajor) && latestMajor > pinnedMajor) {
+      findings.push({ severity: 'medium', item: `stale override: ${name} pinned "${range}" while latest is ${latest} — re-justify or lift the pin` });
+    }
+  }
+  return { findings, notes };
+}
+
+// ---------- 3. workflow action pins ----------
+
+const USES_RE = /^\s*(?:-\s+)?uses:\s*(\S+)/;
+const SHA_PINNED_RE = /@[0-9a-f]{40}(\s|$)/;
+
+function unpinnedUses(yamlText) {
+  const out = [];
+  for (const line of yamlText.split('\n')) {
+    const m = USES_RE.exec(line);
+    if (!m) continue;
+    const ref = m[1];
+    if (ref.startsWith('./') || ref.startsWith('docker://')) continue; // local/composite + digest-pinnable images
+    if (!SHA_PINNED_RE.test(ref)) out.push(ref);
+  }
+  return out;
+}
+
+function actionPinCheck() {
+  const dir = path.join(ROOT, '.github', 'workflows');
+  const findings = [];
+  if (!fs.existsSync(dir)) return { findings };
+  for (const f of fs.readdirSync(dir).filter((n) => n.endsWith('.yml') || n.endsWith('.yaml'))) {
+    for (const ref of unpinnedUses(fs.readFileSync(path.join(dir, f), 'utf8'))) {
+      findings.push({ severity: 'medium', item: `unpinned action in ${f}: "${ref}" — pin to a 40-hex commit SHA (tj-actions lesson)` });
+    }
+  }
+  return { findings };
+}
+
+// ---------- report assembly + filing ----------
+
+function buildClassReport(className, findings, notes = []) {
+  const shown = findings.slice(0, MAX_ITEMS_PER_REPORT);
+  const body = [
+    ...shown.map((f) => `- [${f.severity}] ${f.item}`),
+    ...(findings.length > shown.length ? [`…and ${findings.length - shown.length} more`] : []),
+    ...(notes.length ? ['', 'Notes:', ...notes.map((n) => `- ${n}`)] : []),
+  ].join('\n');
+  return {
+    target: `redteam-patrol/${className}`,
+    severity: maxSeverity(findings),
+    title: `[patrol] ${className}: ${findings.length} finding(s)`,
+    description: `Weekly deterministic red-team patrol (task 1003128; advisory per ADR 0162 — adjudicate, then fix via ordinary tasks).`,
+    repro_steps_md: body,
+  };
+}
+
+async function fileReport(report) {
+  const { apiCall } = require('./cli-lib.js');
+  const r = await apiCall('POST', '/api/gds/security/reports', report);
+  const row = (r.data && r.data.report) || {};
+  return row.id || null;
+}
+
+async function disputeReport(id, note) {
+  const { apiCall } = require('./cli-lib.js');
+  return apiCall('POST', `/api/gds/security/reports/${id}/dispute`, { note });
+}
+
+// ---------- canary ----------
+
+async function runCanary(file) {
+  const bin = gitleaksBin();
+  if (!bin) { console.error('canary FAIL: gitleaks binary unavailable'); process.exit(1); }
+  const token = 'ghp_' + 'Ab1Cd2Ef3Gh4Ij5Kl6Mn7Op8Qr9St0Uv1Wx2Y'; // constructed, never a literal shape
+  const canaryPath = path.join(ROOT, 'src', `patrol-canary-${process.pid}.js`);
+  fs.writeFileSync(canaryPath, `const t = "${token}";\n`);
+  let caught = false;
+  try {
+    const report = path.join(os.tmpdir(), `gitleaks-canary-${process.pid}.json`);
+    try {
+      execFileSync(bin, ['dir', '.', '--config', '.gitleaks.toml', '--redact', '--no-banner',
+        '--report-format', 'json', '--report-path', report], { cwd: ROOT, stdio: 'pipe' });
+    } catch { /* leaks found → non-zero, expected */ }
+    try {
+      caught = parseGitleaksReport(fs.readFileSync(report, 'utf8')).some((f) => f.item.includes('patrol-canary'));
+      fs.unlinkSync(report);
+    } catch { caught = false; }
+  } finally {
+    fs.unlinkSync(canaryPath);
+  }
+  if (!caught) { console.error('canary FAIL: planted token was not detected'); process.exit(1); }
+  console.log('canary: planted token detected by the scanner ✓');
+  if (file) {
+    const id = await fileReport({
+      target: 'redteam-patrol/canary',
+      severity: 'low',
+      title: '[canary] patrol self-test — planted token detected end-to-end',
+      description: 'Seeded finding proving the patrol can detect and FILE (task 1003128 done-when). Dispute-closed by the patrol itself; no action needed.',
+      repro_steps_md: '- plant constructed ghp_ token in src/ → gitleaks dir catches it → report filed → dispute-closed.',
+    });
+    if (!id) { console.error('canary FAIL: report did not file'); process.exit(1); }
+    console.log(`canary: filed security report ${id} ✓`);
+    await disputeReport(id, 'canary self-test (task 1003128) — auto-closed by the patrol');
+    console.log('canary: dispute-closed ✓ — end-to-end pipe proven');
+  }
+}
+
+// ---------- main ----------
+
+async function main() {
+  if (process.argv.includes('--canary')) {
+    await runCanary(process.argv.includes('--file'));
+    return;
+  }
+  const doFile = process.argv.includes('--file');
+
+  const classes = [];
+  const secrets = historySecretScan();
+  if (secrets.findings.length) classes.push(buildClassReport('history-secrets', secrets.findings));
+  if (secrets.degraded) console.warn(`patrol: DEGRADED — ${secrets.degraded}`);
+
+  const deps = dependencyReview();
+  if (deps.findings.length) classes.push(buildClassReport('dependency-review', deps.findings, deps.notes));
+  else if (deps.notes.length) console.log(`patrol: dependency notes:\n${deps.notes.map((n) => `  - ${n}`).join('\n')}`);
+
+  const pins = actionPinCheck();
+  if (pins.findings.length) classes.push(buildClassReport('action-pins', pins.findings));
+
+  if (!classes.length) {
+    console.log('patrol: clean sweep — nothing to file.');
+    return;
+  }
+  for (const report of classes) {
+    if (doFile) {
+      const id = await fileReport(report);
+      console.log(`patrol: filed [${report.severity}] ${report.title} → report ${id}`);
+    } else {
+      console.log(`patrol (dry-run): would file [${report.severity}] ${report.title}\n${report.repro_steps_md}\n`);
+    }
+  }
+  if (!doFile) console.log('patrol: dry run — pass --file to POST these as security reports.');
+}
+
+if (require.main === module) {
+  main().catch((e) => { console.error(`patrol: ERROR ${e.message}`); process.exit(1); });
+}
+
+module.exports = {
+  parseGitleaksReport, unpinnedUses, ageDays, mapSeverity, maxSeverity,
+  buildClassReport, lockedVersion, COOLDOWN_DAYS, YOUNG_PKG_DAYS,
+};

package/src/bongos/logger.js

@@ -0,0 +1,118 @@
+// src/bongos/logger.js — the core structured logger (task 1003130, goal 1000076;
+// docs/audits/ai-dev-redteam-baseline.md §5).
+//
+// The audit's logging finding: zero logging libraries, ~635 console.* calls in
+// server paths, no request correlation, and NO redaction — a key echoed into a
+// log line had no scrubber between it and journald. This is the fix for the
+// CORE server path: one pino instance, request-correlation via
+// AsyncLocalStorage, and redaction of the ADR 0022 secret-bearing header/field
+// shapes. Modules migrate off console incrementally under the no-console
+// ratchet (fitness-ratchets console_call_count); this module is what they
+// migrate ONTO.
+//
+// Why pino: the Node structured-logging standard — JSON to stdout, low
+// overhead, first-class redaction. It carries NO install scripts, so it is
+// safe under the `.npmrc ignore-scripts=true` policy (ADR 0180 §2).
+//
+// The logger writes newline-delimited JSON to stdout; the process manager
+// (systemd/journald) owns rotation and shipping. Level is LOG_LEVEL (default
+// 'info'); set 'debug' to see the request-start lines.
+
+'use strict';
+
+const { AsyncLocalStorage } = require('node:async_hooks');
+const crypto = require('node:crypto');
+const pino = require('pino');
+
+// One request-scoped store holding { reqId }. A pino mixin reads it so EVERY
+// line emitted while handling a request carries the id, without threading it
+// through call signatures.
+const requestContext = new AsyncLocalStorage();
+
+// Redaction — the secret-bearing shapes from ADR 0022 that realistically reach
+// a log line via a logged request/header/body object. pino's `redact` replaces
+// the value with "[Redacted]"; paths are static (never built from input — the
+// injection caveat in pino's docs). This is defense in depth behind the
+// scrubber and the prevent hook, not the only guard.
+const REDACT_PATHS = [
+  'req.headers.authorization',
+  'req.headers.cookie',
+  'req.headers["x-gds-session"]',
+  'req.headers["x-api-key"]',
+  'headers.authorization',
+  'headers.cookie',
+  // top-level field names (a bare path; pino's `*.x` matches one level DOWN, not the root)
+  'authorization',
+  'token',
+  'password',
+  'secret',
+  'apiKey',
+  'api_key',
+  'sessionToken',
+  'githubToken',
+  // …and the same names one level under any key
+  '*.authorization',
+  '*.token',
+  '*.password',
+  '*.secret',
+  '*.apiKey',
+  '*.api_key',
+  '*.sessionToken',
+  '*.githubToken',
+];
+
+// Exported so a test can build a logger with the IDENTICAL config onto a
+// capture stream — pino writes through sonic-boom straight to the fd, so the
+// config, not the singleton's stdout, is what a hermetic test asserts against.
+const pinoOptions = {
+  level: process.env.LOG_LEVEL || 'info',
+  // A leaked secret is a compromise; a redaction false-positive in a log is
+  // cosmetic — so redaction is broad, mirroring scrubSecrets' recall-first posture.
+  redact: { paths: REDACT_PATHS, censor: '[Redacted]' },
+  base: undefined, // drop pid/hostname noise; the process manager adds host context
+  timestamp: pino.stdTimeFunctions.isoTime,
+  mixin() {
+    const store = requestContext.getStore();
+    return store && store.reqId ? { reqId: store.reqId } : {};
+  },
+};
+
+const logger = pino(pinoOptions);
+
+// Run `fn` inside a fresh request context stamped with `reqId` (a caller-supplied
+// inbound id, or a fresh short hex). Everything logged inside — including the
+// error middleware — carries the same reqId.
+function runWithRequestId(reqId, fn) {
+  return requestContext.run({ reqId: reqId || crypto.randomBytes(8).toString('hex') }, fn);
+}
+
+function currentRequestId() {
+  const store = requestContext.getStore();
+  return store ? store.reqId : null;
+}
+
+// Express middleware: adopt an inbound correlation id (or mint one), expose it
+// on req/res + the `x-request-id` response header, and run the rest of the
+// request inside the AsyncLocalStorage context so every log line correlates.
+function requestIdMiddleware(req, res, next) {
+  const inbound = req.headers['x-request-id'];
+  const reqId = (typeof inbound === 'string' && inbound.length > 0 && inbound.length <= 128)
+    ? inbound
+    : crypto.randomBytes(8).toString('hex');
+  req.reqId = reqId;
+  res.setHeader('x-request-id', reqId);
+  requestContext.run({ reqId }, () => next());
+}
+
+// requestContext stays module-private (nothing outside needs the raw ALS).
+// pinoOptions/REDACT_PATHS/runWithRequestId/currentRequestId are the logging
+// toolkit — used by tests today (via dynamic require, invisible to knip's static
+// scan) and by future non-HTTP correlation callers.
+module.exports = {
+  logger,
+  pinoOptions,
+  requestIdMiddleware,
+  runWithRequestId,
+  currentRequestId,
+  REDACT_PATHS,
+};

package/src/bongos/middleware/audit.js

@@ -40,6 +40,7 @@
 // view useful; that information is lost at the SQL layer.
 
 const db = require('../db');
+const { logger } = require('../logger');
 
 const REDACTION_TOKENS = ['token', 'password', 'key', 'secret'];
 const REDACTED = '<redacted>';
@@ -205,7 +206,7 @@ function auditMiddleware(opts = {}) {
     } catch (err) {
       // redaction failures are themselves audit-failures: log + continue.
       // We still attach the finish handler so a row goes in WITH an empty body.
-      console.error('[audit] redact_failed', err);
+      logger.error({ err }, '[audit] redact_failed');
       snapshotBody = { _redact_failed: true };
     }
     const ip = clientIp(req);
@@ -251,12 +252,12 @@ function auditMiddleware(opts = {}) {
         .catch((err) => {
           // SWALLOW. Audit failures must not surface to the caller and must
           // not affect future requests. Console-error is the only effect.
-          console.error('[audit] insert_failed', {
+          logger.error({
             route,
             method,
             status,
             err: err && err.message ? err.message : String(err),
-          });
+          }, '[audit] insert_failed');
         });
     });
 

package/src/bongos/middleware/error-envelope.js

@@ -23,6 +23,7 @@
 'use strict';
 
 const { ApiError, isApiError, envelope, statusForCode } = require('../api-errors');
+const { logger } = require('../logger');
 
 // attachFail — decorate res with fail(). Mounted once, before the routers.
 function attachFail(req, res, next) {
@@ -83,10 +84,10 @@ function errorEnvelopeHandler(err, req, res, next) {
     return res.status(framework.status).json(envelope(framework.code));
   }
 
-  // Anything else is an unexpected server fault. Log with a stable tag (so it's
-  // greppable in prod logs) and answer a leak-free internal envelope — the raw
-  // message/stack is never sent to the client.
-  console.error('[gds] unhandled', req && req.method, req && req.originalUrl, err);
+  // Anything else is an unexpected server fault. Log structured (auto-correlated
+  // to the request via the logger's reqId mixin, redaction applied) and answer a
+  // leak-free internal envelope — the raw message/stack is never sent to the client.
+  logger.error({ method: req && req.method, url: req && req.originalUrl, err }, '[gds] unhandled');
   return res.status(500).json(envelope('internal_error'));
 }
 

package/src/bongos/module-scope-map.js

@@ -310,7 +310,8 @@ const MODULE_GLOBS = {
     '.npmrc', '.gitleaks.toml',
     'package.json', 'package-lock.json',
     'scripts/gds/fitness.js', 'scripts/gds/docs-entropy.js',
-    'scripts/gds/redteam-patrol.js',
+    'scripts/gds/redteam-patrol.js', 'scripts/gds/audit-gate.js',
+    'scripts/gds/fitness-ratchets.js', 'scripts/gds/control-manifest.js',
   ],
 };
 

package/src/bongos/serve-internal.js

@@ -39,6 +39,7 @@ const express = require('express');
 const { buildGdsRouter } = require('./routes');
 const { attachFail } = require('./middleware/error-envelope');
 const metrics = require('./metrics');
+const { logger } = require('./logger');
 const gdsAuth = require('./auth');
 const { buildStampedHtml } = require('../asset-version');
 const { buildInfo } = require('../build-info');
@@ -289,7 +290,7 @@ function resolveOpenapiJson({ candidates = [], generate } = {}) {
       const out = generate();
       if (out) return out;
     } catch (e) {
-      console.error('[docs] in-process OpenAPI generation failed:', e && e.message);
+      logger.error({ err: e && e.message }, '[docs] in-process OpenAPI generation failed');
     }
   }
   return '';

package/src/module-api.js

@@ -939,8 +939,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.254 with no explicit bump. run 32207967928. (task 1002620)
 //   1.19.256 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.255 with no explicit bump. run 32208475455. (task 1002620)
+//   1.19.257 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.256 with no explicit bump. run 32209295358. (task 1002620)
+//   1.19.258 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.257 with no explicit bump. run 32284962866. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.256'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.258'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/platform-server.js

@@ -49,6 +49,7 @@ const { mountInternalSurfaces, isStatusHost, isBuildersHost, injectBrandingGloba
 const { isApiShapedPath, apiNotFoundBody } = require('./bongos/api-path-404');
 const moduleLoader = require('./module-loader/loader');
 const { isModuleEnabled } = require('./modules');
+const { logger, requestIdMiddleware } = require('./bongos/logger');
 
 const PORT = Number(process.env.PORT) || 3000;
 const HOST = process.env.HOST || '127.0.0.1';
@@ -157,6 +158,12 @@ function buildPlatformApp() {
   // the OAuth callbacks the GDS auth router performs.
   app.set('trust proxy', 1);
 
+  // Request correlation FIRST (task 1003130): adopt/mint an x-request-id and run
+  // the rest of the request inside the AsyncLocalStorage context, so every
+  // structured log line — including the central error handler's — carries the
+  // same reqId. Mounted before any surface so nothing logs uncorrelated.
+  app.use(requestIdMiddleware);
+
   // The whole internal surface — shared verbatim with server.js (ADR 0062 R51).
   mountInternalSurfaces(app);
 
@@ -263,7 +270,7 @@ if (require.main === module) {
   const app = buildPlatformApp();
   const httpServer = http.createServer(app);
   httpServer.listen(PORT, HOST, () => {
-    console.log(`Cloud Bongos platform (GDS-only, no game; ADR 0062 R51) listening on ${HOST}:${PORT}`);
+    logger.info({ host: HOST, port: PORT }, 'Cloud Bongos platform (GDS-only, no game; ADR 0062 R51) listening');
     startBackgroundServices();
   });
 
@@ -288,7 +295,7 @@ if (require.main === module) {
   // up with a logged error strictly dominates dying. A rejection that leaves genuinely
   // corrupt state is not a shape this codebase produces — the DB work is transactional.
   process.on('unhandledRejection', (reason) => {
-    console.error('[platform] unhandled promise rejection (staying up; this is a BUG — the owning await needs its own catch):', reason);
+    logger.error({ reason }, '[platform] unhandled promise rejection (staying up; this is a BUG — the owning await needs its own catch)');
   });
 }
 

package/tests/audit_gate.mjs

@@ -0,0 +1,89 @@
+// tests/audit_gate.mjs — the dependency audit gate's pure core (task 1003127,
+// goal 1000076; ADR 0180). Hermetic: exercises extractFindings + compare on
+// fixture JSON — the npm/network half is CI-only by design (fail-open there).
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const gate = require(path.join(ROOT, 'scripts', 'gds', 'audit-gate.js'));
+
+const AUDIT_FIXTURE = {
+  vulnerabilities: {
+    // parent rollup whose via is a STRING (another package) — contributes nothing
+    'discord.js': { severity: 'moderate', via: ['undici'] },
+    // real advisory objects — these are the findings
+    undici: {
+      severity: 'moderate',
+      via: [
+        { source: 101, name: 'undici', severity: 'moderate', title: 'CRLF injection' },
+        { source: 102, name: 'undici', severity: 'moderate', title: 'response desync' },
+      ],
+    },
+    sharp: {
+      severity: 'high',
+      via: [{ source: 200, name: 'sharp', severity: 'high', title: 'libvips CVEs' }],
+    },
+    nanoid: {
+      severity: 'high',
+      // duplicate of the same advisory via two chains — must dedupe
+      via: [
+        { source: 300, name: 'nanoid', severity: 'high', title: 'predictable ids' },
+        { source: 300, name: 'nanoid', severity: 'high', title: 'predictable ids' },
+      ],
+    },
+  },
+};
+
+test('extractFindings flattens advisory objects, skips string vias, dedupes by advisory×package', () => {
+  const f = gate.extractFindings(AUDIT_FIXTURE);
+  assert.equal(f.length, 4, `expected 4 unique findings, got ${JSON.stringify(f)}`);
+  assert.ok(f.every((x) => typeof x.id === 'string' && x.name && x.severity));
+  assert.equal(f.filter((x) => x.name === 'nanoid').length, 1, 'duplicate advisory chains collapse');
+});
+
+test('a baseline-covered tree passes: no newGating, no newAdvisory', () => {
+  const f = gate.extractFindings(AUDIT_FIXTURE);
+  const v = gate.compare(f, f);
+  assert.equal(v.newGating.length, 0);
+  assert.equal(v.newAdvisory.length, 0);
+  assert.equal(v.resolved.length, 0);
+});
+
+test('a NEW high advisory gates; a new moderate only advises', () => {
+  const baseline = gate.extractFindings(AUDIT_FIXTURE);
+  const current = [
+    ...baseline,
+    { id: '999', name: 'express', severity: 'high', title: 'fresh high' },
+    { id: '998', name: 'pg', severity: 'moderate', title: 'fresh moderate' },
+  ];
+  const v = gate.compare(current, baseline);
+  assert.deepEqual(v.newGating.map((f) => f.id), ['999']);
+  assert.deepEqual(v.newAdvisory.map((f) => f.id), ['998']);
+});
+
+test('a fixed advisory surfaces as a ratchet-down nudge, never a failure', () => {
+  const baseline = gate.extractFindings(AUDIT_FIXTURE);
+  const current = baseline.filter((f) => f.name !== 'sharp');
+  const v = gate.compare(current, baseline);
+  assert.equal(v.newGating.length, 0);
+  assert.deepEqual(v.resolved.map((f) => f.name), ['sharp']);
+});
+
+test('empty/missing baseline means every high gates (the fresh-repo case)', () => {
+  const v = gate.compare(gate.extractFindings(AUDIT_FIXTURE), []);
+  assert.equal(v.newGating.length, 2, 'sharp + nanoid gate');
+  assert.equal(v.newAdvisory.length, 2, 'the two undici moderates advise');
+});
+
+test('the committed baseline file parses and only carries known severities', () => {
+  const b = require(path.join(ROOT, 'config', 'audit-baseline.json'));
+  assert.ok(Array.isArray(b.findings) && b.findings.length > 0);
+  for (const f of b.findings) {
+    assert.ok(['low', 'moderate', 'high', 'critical', 'info', 'unknown'].includes(f.severity), `odd severity ${f.severity}`);
+    assert.ok(f.id && f.name, 'baseline entries carry advisory id + package');
+  }
+});

package/tests/auth_resolve_failure.mjs

@@ -140,7 +140,7 @@ test('a process-level unhandledRejection backstop is registered and does not exi
   assert.match(src, /process\.on\('unhandledRejection'/, 'the backstop must exist');
   const handler = src.slice(src.indexOf("process.on('unhandledRejection'"));
   const body = handler.slice(0, handler.indexOf('});') + 3);
-  assert.match(body, /console\.error/, 'it must log');
+  assert.match(body, /console\.error|logger\.error/, 'it must log (console or the structured logger — task 1003130 moved this to logger.error)');
   assert.doesNotMatch(body, /process\.exit/,
     'it must NOT exit — one process serves every request, so staying up dominates dying');
 });