@bongos/core 1.19.256 → 1.19.258

package/tests/claude_materialize.mjs

@@ -117,17 +117,34 @@ t('materializeClaude: materializes scheduled-tasks — bodies→bongos, companio
   assert.ok(res.scheduledTasks > 0, 'at least one scheduled-task file materialized');
   const rt = join(dir, '.claude', 'scheduled-tasks');
   assert.ok(existsSync(rt), '.claude/scheduled-tasks created in the instance');
-  // A prose/judgment body's core invocation is bongosified so a consumer-layout model can run it.
-  const stale = readFileSync(join(rt, 'stale-claim-release', 'SKILL.md'), 'utf8');
-  assert.ok(stale.includes('bongos exec scripts/gds/pulse.js'), 'body core-invocation rewritten to bongos exec');
-  assert.ok(!stale.includes('node scripts/gds/pulse.js'), 'no bare relative node scripts/gds left in the body');
-  // A deterministic routine's `.claude/...` companion-step command is NOT a core invocation → preserved.
-  const dd = readFileSync(join(rt, 'diagram-drift', 'SKILL.md'), 'utf8');
-  assert.ok(dd.includes('node .claude/scheduled-tasks/diagram-drift/check.js'), 'companion-path step command preserved');
-  // Companion .js resolves its core require()s via the materialized _core-resolve.js sibling (task 2139 pattern).
-  const check = readFileSync(join(rt, 'diagram-drift', 'check.js'), 'utf8');
-  assert.ok(check.includes("require('../../hooks/_core-resolve.js')"), 'companion resolves core via _core-resolve');
-  assert.ok(!check.includes("require('../../../scripts/gds/"), 'no bare ../../../scripts/gds require left in the companion');
+  // Every materialized routine's core invocation is bongosified — asserted over
+  // WHATEVER routines the tree carries (the neutral core carries redteam-weekly;
+  // the founder core also carries stale-claim-release/diagram-drift). No routine
+  // body may keep a bare `node scripts/gds/…` core invocation.
+  let sawBongosified = false;
+  for (const name of readdirSync(rt)) {
+    const skillPath = join(rt, name, 'SKILL.md');
+    if (!existsSync(skillPath)) continue;
+    const body = readFileSync(skillPath, 'utf8');
+    assert.ok(!/\bnode scripts\/gds\//.test(body), `${name}: bare relative node scripts/gds left in the body`);
+    if (body.includes('bongos exec scripts/gds/')) sawBongosified = true;
+  }
+  assert.ok(sawBongosified, 'at least one routine had its core invocation rewritten to bongos exec');
+  // Founder-specific fixtures — assert their finer behavior only when present, so
+  // this coverage stays live on the founder core without demanding those routines
+  // exist in the neutral core (which carries a different routine set).
+  const stalePath = join(rt, 'stale-claim-release', 'SKILL.md');
+  if (existsSync(stalePath)) {
+    assert.ok(readFileSync(stalePath, 'utf8').includes('bongos exec scripts/gds/pulse.js'), 'body core-invocation rewritten to bongos exec');
+  }
+  const ddCheck = join(rt, 'diagram-drift', 'check.js');
+  if (existsSync(ddCheck)) {
+    const dd = readFileSync(join(rt, 'diagram-drift', 'SKILL.md'), 'utf8');
+    assert.ok(dd.includes('node .claude/scheduled-tasks/diagram-drift/check.js'), 'companion-path step command preserved');
+    const check = readFileSync(ddCheck, 'utf8');
+    assert.ok(check.includes("require('../../hooks/_core-resolve.js')"), 'companion resolves core via _core-resolve');
+    assert.ok(!check.includes("require('../../../scripts/gds/"), 'no bare ../../../scripts/gds require left in the companion');
+  }
   rmSync(dir, { recursive: true, force: true });
 });
 

package/tests/control_manifest.mjs

@@ -0,0 +1,60 @@
+// tests/control_manifest.mjs — the assurance-of-assurance check (task 1003131,
+// goal 1000076). Proves the manifest passes on the real tree AND actually
+// CATCHES the two failure modes it exists to catch: a control file that
+// vanishes, and a control that comes unwired. The check is itself a control —
+// so it too must be provably able to fail.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const cm = require(path.join(ROOT, 'scripts', 'gds', 'control-manifest.js'));
+
+test('the live tree passes: every goal-1000076 control is present and wired', () => {
+  const r = cm.checkControlsExist();
+  assert.equal(r.hardFail, false, `unexpected violations:\n  ${r.violations.join('\n  ')}`);
+  assert.ok(cm.CONTROLS.length >= 8, 'the manifest covers the shipped controls');
+});
+
+test('a vanished control file is caught', () => {
+  const controls = [{ label: 'x', file: '.claude/hooks/secret-gate.js' }];
+  const gone = cm.evaluate(controls, { exists: () => false, read: () => '' });
+  assert.equal(gone.length, 1);
+  assert.match(gone[0], /control file missing/);
+});
+
+test('a present-but-UNWIRED control is caught (the settings.json un-hook case)', () => {
+  const controls = [{
+    label: 'secret-gate hook', file: '.claude/hooks/secret-gate.js',
+    wiredIn: { file: '.claude/settings.json', needle: 'secret-gate.js' },
+  }];
+  // file exists, but the settings no longer reference it
+  const unwired = cm.evaluate(controls, {
+    exists: (f) => f === '.claude/hooks/secret-gate.js' || f === '.claude/settings.json',
+    read: () => '{ "hooks": {} }',
+  });
+  assert.equal(unwired.length, 1);
+  assert.match(unwired[0], /not wired in/);
+});
+
+test('a missing companion file (baseline/config) is caught even when the main file exists', () => {
+  const controls = [{
+    label: 'audit gate', file: 'scripts/gds/audit-gate.js',
+    alsoExists: ['config/audit-baseline.json'],
+  }];
+  const v = cm.evaluate(controls, { exists: (f) => f === 'scripts/gds/audit-gate.js', read: () => '' });
+  assert.equal(v.length, 1);
+  assert.match(v[0], /companion file missing/);
+});
+
+test('all-present + all-wired yields zero violations', () => {
+  const controls = [{
+    label: 'ok', file: 'a', alsoExists: ['b'],
+    wiredIn: { file: 'c', needle: 'NEEDLE' },
+  }];
+  const v = cm.evaluate(controls, { exists: () => true, read: () => 'has NEEDLE inside' });
+  assert.deepEqual(v, []);
+});

package/tests/fitness_ratchets.mjs

@@ -0,0 +1,91 @@
+// tests/fitness_ratchets.mjs — the quality-ratchet mechanics (task 1003129,
+// goal 1000076). Hermetic: exercises the pure metric + compare functions on
+// synthetic inputs; the repo-wide sweep runs via checkQualityRatchets inside
+// tests/fitness.mjs, and the knip half is a CI-only step by design.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const rat = require(path.join(ROOT, 'scripts', 'gds', 'fitness-ratchets.js'));
+
+test('ratchet compare: worse fails, equal passes, better nudges, unknown warns', () => {
+  const base = { a: 10, b: 5 };
+  assert.equal(rat.compareToBaselines({ a: 10, b: 5 }, base).violations.length, 0, 'equal passes');
+  const worse = rat.compareToBaselines({ a: 11, b: 5 }, base);
+  assert.equal(worse.violations.length, 1);
+  assert.match(worse.violations[0], /a regressed: 11 > baseline 10/);
+  const better = rat.compareToBaselines({ a: 9, b: 5 }, base);
+  assert.equal(better.violations.length, 0);
+  assert.match(better.warnings[0], /ratchet-down available/);
+  const unknown = rat.compareToBaselines({ c: 1 }, base);
+  assert.equal(unknown.violations.length, 0, 'uninitialized metric warns, never fails');
+  assert.match(unknown.warnings[0], /no baseline for "c"/);
+  assert.equal(rat.compareToBaselines({ a: null }, base).warnings.length, 0, 'a skipped metric (null) is silent');
+});
+
+test('duplication: identical 30-line blocks in TWO files count; one file alone does not', () => {
+  const block = Array.from({ length: rat.WINDOW }, (_, i) => `const v${i} = compute(${i});`).join('\n');
+  const one = new Map([['a.js', block]]);
+  assert.equal(rat.duplicateWindowCount(one), 0, 'same-file windows are not cross-file duplication');
+  const two = new Map([['a.js', block], ['b.js', `// header\n${block}`]]);
+  assert.ok(rat.duplicateWindowCount(two) >= 1, 'the shared block registers');
+  const clean = new Map([['a.js', block], ['b.js', block.replaceAll('compute', 'derive')]]);
+  assert.equal(rat.duplicateWindowCount(clean), 0, 'a changed body is not a duplicate');
+});
+
+test('normalizeLines drops blanks and comment lines so cosmetic edits cannot dodge the hash', () => {
+  const lines = rat.normalizeLines('a();\n\n  // comment\n  b();\n/* block */\n * cont\n');
+  assert.deepEqual(lines, ['a();', 'b();']);
+});
+
+test('cycle counting: a 2-node loop is one SCC; a diamond is none; self-requires ignored', () => {
+  const loop = new Map([['a.js', ['b.js']], ['b.js', ['a.js']]]);
+  assert.equal(rat.countCycles(loop), 1);
+  const diamond = new Map([['a.js', ['b.js', 'c.js']], ['b.js', ['d.js']], ['c.js', ['d.js']], ['d.js', []]]);
+  assert.equal(rat.countCycles(diamond), 0);
+  const tri = new Map([['a.js', ['b.js']], ['b.js', ['c.js']], ['c.js', ['a.js']], ['x.js', []]]);
+  assert.equal(rat.countCycles(tri), 1, 'a 3-cycle is one component, not three');
+});
+
+test('requireGraph resolves ./x, ./x.js and ./x/index.js and skips unknown targets', () => {
+  const contents = new Map([
+    ['src/a.js', "const b = require('./b'); const i = require('./lib'); const gone = require('./nope');"],
+    ['src/b.js', ''],
+    ['src/lib/index.js', ''],
+  ]);
+  const edges = rat.requireGraph(contents);
+  assert.deepEqual(edges.get('src/a.js').sort(), ['src/b.js', 'src/lib/index.js']);
+});
+
+test('size metrics: count and excess ratchet independently', () => {
+  const files = ['big.js', 'small.js'];
+  const read = (f) => (f === 'big.js' ? 'x\n'.repeat(rat.OVERSIZE_LINES + 100) : 'x\n');
+  const m = rat.sizeMetrics(files, read);
+  assert.equal(m.oversized_file_count, 1);
+  assert.ok(m.excess_lines_total >= 100, `excess tracks growth over the threshold (got ${m.excess_lines_total})`);
+});
+
+test('console counting only sees server paths', () => {
+  assert.equal(rat.isServerPath('src/bongos/auth.js'), true);
+  assert.equal(rat.isServerPath('modules/lifecycle/db.js'), true);
+  assert.equal(rat.isServerPath('modules/hall-ui/public/builders.js'), false, 'browser surfaces excluded');
+  assert.equal(rat.isServerPath('scripts/gds/ship.js'), false, 'CLI stdout is legitimate UX');
+  assert.equal(rat.isServerPath('modules/security/tests/floor.mjs'), false);
+  const n = rat.consoleCallCount(new Map([
+    ['src/x.js', 'console.log(1); console.error(2);'],
+    ['scripts/gds/y.js', 'console.log(1);'],
+  ]));
+  assert.equal(n, 2);
+});
+
+test('the committed baseline file parses and covers every hermetic metric', () => {
+  const b = require(path.join(ROOT, 'config', 'fitness-baselines.json'));
+  for (const key of ['oversized_file_count', 'excess_lines_total', 'duplicate_window_count',
+    'require_cycle_count', 'console_call_count', 'doc_stale_links', 'doc_broken_anchors', 'doc_duplicate_prose']) {
+    assert.ok(Number.isInteger(b.metrics[key]), `baseline missing ${key}`);
+  }
+});

package/tests/logger.mjs

@@ -0,0 +1,89 @@
+// tests/logger.mjs — the core structured logger (task 1003130, goal 1000076).
+// Proves the three done-when properties without a live server: request-id
+// correlation via AsyncLocalStorage, secret redaction on the logged shapes,
+// and the middleware's adopt-or-mint + x-request-id echo. Hermetic — captures
+// pino's stdout stream, no network.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const log = require(path.join(ROOT, 'src', 'bongos', 'logger.js'));
+const pino = require(path.join(ROOT, 'node_modules', 'pino'));
+const { Writable } = require('node:stream');
+
+// pino writes through sonic-boom directly to the fd, so we can't intercept the
+// singleton's stdout. Instead build a logger with the IDENTICAL exported config
+// onto a capture stream — same redact paths + same reqId mixin (the mixin closes
+// over the module's ALS, so runWithRequestId still correlates).
+function capture(fn) {
+  const lines = [];
+  const stream = new Writable({ write(chunk, _enc, cb) { lines.push(chunk.toString()); cb(); } });
+  const testLogger = pino(log.pinoOptions, stream);
+  fn(testLogger);
+  return lines.filter((l) => l.trim().startsWith('{')).map((l) => JSON.parse(l));
+}
+
+test('every line emitted inside runWithRequestId carries the same reqId', () => {
+  const out = capture((l) => {
+    log.runWithRequestId('req-abc', () => {
+      l.info('first');
+      l.warn('second');
+      assert.equal(log.currentRequestId(), 'req-abc');
+    });
+    l.info('outside'); // no context → no reqId
+  });
+  const inside = out.filter((l) => l.msg === 'first' || l.msg === 'second');
+  assert.equal(inside.length, 2);
+  assert.ok(inside.every((l) => l.reqId === 'req-abc'), 'correlated lines share the id');
+  const outside = out.find((l) => l.msg === 'outside');
+  assert.equal(outside.reqId, undefined, 'a line with no request context carries no reqId');
+});
+
+test('a secret in a logged header/field is redacted, not emitted', () => {
+  const out = capture((l) => {
+    l.error({
+      req: { headers: { authorization: 'Bearer sk-ant-verysecretvalue012345', cookie: 'gds_session=abc' } },
+      token: 'ghp_shouldnotappear0000000000000000000000',
+      note: 'this stays',
+    }, 'boom');
+  });
+  const line = out.find((l) => l.msg === 'boom');
+  const blob = JSON.stringify(line);
+  assert.ok(!blob.includes('sk-ant-verysecretvalue'), 'authorization header redacted');
+  assert.ok(!blob.includes('ghp_shouldnotappear'), 'token field redacted');
+  assert.ok(!blob.includes('gds_session=abc'), 'cookie redacted');
+  assert.ok(blob.includes('[Redacted]'), 'redaction marker present');
+  assert.ok(blob.includes('this stays'), 'non-secret fields survive');
+});
+
+test('REDACT_PATHS covers the ADR 0022 header/field shapes', () => {
+  for (const p of ['req.headers.authorization', 'req.headers.cookie', 'token', '*.token', '*.password']) {
+    assert.ok(log.REDACT_PATHS.includes(p), `expected redact path ${p}`);
+  }
+});
+
+test('requestIdMiddleware adopts a valid inbound id and echoes it; mints otherwise', () => {
+  const mk = (headers) => {
+    const req = { headers };
+    const res = { _h: {}, setHeader(k, v) { this._h[k.toLowerCase()] = v; } };
+    let ran = false;
+    log.requestIdMiddleware(req, res, () => { ran = true; });
+    return { req, res, ran };
+  };
+  const adopted = mk({ 'x-request-id': 'inbound-123' });
+  assert.equal(adopted.req.reqId, 'inbound-123');
+  assert.equal(adopted.res._h['x-request-id'], 'inbound-123');
+  assert.ok(adopted.ran);
+
+  const minted = mk({});
+  assert.match(minted.req.reqId, /^[0-9a-f]{16}$/, 'mints a 16-hex id when none supplied');
+  assert.equal(minted.res._h['x-request-id'], minted.req.reqId);
+
+  // an absurdly long inbound id is rejected in favor of a minted one (header-injection guard)
+  const huge = mk({ 'x-request-id': 'x'.repeat(500) });
+  assert.match(huge.req.reqId, /^[0-9a-f]{16}$/, 'over-long inbound id is not adopted');
+});

package/tests/publish_reconciler.mjs

@@ -1547,6 +1547,148 @@ test('1002723 a shipped task appears in the dispositions line as shipped', async
 });
 
 // Drain the microtask queue, then report + exit with the right code.
+
+// ===========================================================================
+// task 1001427 — PHANTOM SHIP: `shipped` must mean the code is on main.
+//
+// The task described two vectors that left a task status=shipped with its PR
+// still open:
+//   (1) the reconciler flipping confirmed->shipped on mergeIfGreen alone,
+//       without confirming the commit is an ancestor of origin/main;
+//   (2) under GRADER_BYPASS_ENABLED, shipped_at stamped at CONFIRM time,
+//       before any merge.
+//
+// Both were closed by later work — the per-task land proof (1313 / 1547 /
+// 1002615 / 1002724) and ADR 0120's move of the payout and the shipped_at stamp
+// to the land. Neither was pinned by a test keyed on THIS invariant, though, so
+// nothing would catch a regression that reopened either one. These do.
+//
+// The invariant, stated once: THE SWEEP CALLS db.shipTask ONLY WHEN THE LAND IS
+// PROVEN. Not when a merge was attempted, not when a merge was reported, not
+// when a PR looks green — proven.
+// ===========================================================================
+
+// EVERY assertion below reads deps._calls.ship, not out.reconciled.
+//
+// That is deliberate and was learned the hard way while writing these: a first
+// draft used a shipTask stub that THREW on any call, on the theory that a
+// phantom ship should be impossible to miss. It is exactly backwards — the sweep
+// isolates per-row failures on purpose (one bad row must not stop the rest), so
+// the throw was swallowed, counted as an error, and `reconciled` stayed 0. The
+// test passed while a phantom ship happened. `reconciled` is a summary of what
+// the sweep BELIEVES it did; the recorded call is what it actually did to the
+// ledger, and only the second one can answer this question.
+
+test('vector 1: a green merge is NOT a land — mergeIfGreen alone never ships', async () => {
+  // The exact 1409/1410 shape: the server merges the PR itself (auto-merge
+  // stall), but the status still reports not-landed and no ancestry proof
+  // exists. A merge ATTEMPT is not evidence the commit reached main.
+  const deps = mkDeps({
+    rows: [{ task_id: 4001, builder_id: 7, worktree_name: 'wt-4001', published_head_sha: NOT_ON_MAIN }],
+    statusByBranch: { 'claude/wt-4001': PENDING },
+    mergeByBranch: { 'claude/wt-4001': { merged_now: true, number: 900 } },
+    ancestryBySha: { [NOT_ON_MAIN]: false },
+  });
+  await reconciler.runSweep(deps);
+  assert.deepEqual(deps._calls.ship, [],
+    'a merged-now PR with no ancestry proof must never reach db.shipTask');
+  assert.ok(deps._calls.merge.includes('claude/wt-4001'),
+    'the sweep still nudges the merge — it just does not treat the nudge as evidence');
+});
+
+test('vector 1: the SAME row ships once the tip is provably on main', async () => {
+  // The control for the test above. Identical inputs except the ancestry answer,
+  // so the assertion isolates exactly the proof — not some unrelated refusal.
+  const deps = mkDeps({
+    rows: [{ task_id: 4002, builder_id: 7, worktree_name: 'wt-4002', published_head_sha: ON_MAIN }],
+    statusByBranch: { 'claude/wt-4002': PENDING },
+    mergeByBranch: { 'claude/wt-4002': { merged_now: true, number: 901 } },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const out = await reconciler.runSweep(deps);
+  assert.equal(out.reconciled, 1);
+  assert.deepEqual(deps._calls.ship, [{ taskId: 4002, builderId: 7 }]);
+});
+
+test('vector 1: an OPEN PR with no proof strands rather than ships', async () => {
+  // "shipped while the PR was still open" was the reported symptom. A row the
+  // sweep cannot prove must leave the ledger alone and be counted unprovable.
+  const deps = mkDeps({
+    rows: [{ task_id: 4003, builder_id: 7, worktree_name: 'wt-4003', published_head_sha: NOT_ON_MAIN }],
+    statusByBranch: { 'claude/wt-4003': PENDING },
+    ancestryBySha: { [NOT_ON_MAIN]: false },
+  });
+  const out = await reconciler.runSweep(deps);
+  assert.deepEqual(deps._calls.ship, [], 'an open PR with no proof must never reach db.shipTask');
+  assert.ok((out.unprovable ?? 0) >= 1, 'an unprovable row must be COUNTED, not silently skipped (blocker 47)');
+});
+
+test('vector 1: a transient proof error never resolves to "landed"', async () => {
+  // The compare API throwing is indistinguishable from "no proof yet", and the
+  // fail direction must be to wait. An exception that fell through to a ship
+  // would be the phantom-ship bug wearing an error handler.
+  const deps = mkDeps({
+    rows: [{ task_id: 4004, builder_id: 7, worktree_name: 'wt-4004', published_head_sha: ON_MAIN }],
+    statusByBranch: { 'claude/wt-4004': PENDING },
+    ancestryBySha: { [ON_MAIN]: new Error('compare API 502') },
+  });
+  await reconciler.runSweep(deps);
+  assert.deepEqual(deps._calls.ship, [],
+    'a throwing proof is indistinguishable from no proof — it must wait, never ship');
+});
+
+test('vector 2: shipped_at is stamped ONLY by shipTask, and shipTask requires confirmed', async () => {
+  // ADR 0120 moved the payout and the stamp to the land. The structural claim —
+  // that no other write path can stamp shipped_at on a task, and that the one
+  // that can refuses anything not already confirmed — is what closes the
+  // grader-bypass vector, so it is asserted against the SOURCE rather than
+  // re-argued in prose.
+  const fs = await import('node:fs');
+  const url = await import('node:url');
+  const path = await import('node:path');
+  const ROOT = path.dirname(path.dirname(url.fileURLToPath(import.meta.url)));
+  const dbSrc = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/db.js'), 'utf8');
+
+  // Every statement that writes shipped_at, ignoring SELECT projections and comments.
+  const writes = [...dbSrc.matchAll(/shipped_at\s*=\s*now\(\)/g)];
+  assert.equal(writes.length, 1,
+    `shipped_at is written in ${writes.length} places — a second stamp site is how the grader-bypass vector reopens`);
+
+  // …and that one site is guarded on the confirmed state.
+  const stampIdx = dbSrc.indexOf('shipped_at = now()');
+  const window = dbSrc.slice(stampIdx, stampIdx + 500);
+  assert.match(window, /WHERE id = \$1 AND status = 'confirmed'/,
+    'the stamp must refuse any task not already confirmed — that is what stops a confirm-time ship');
+});
+
+test('vector 2: the grader-bypass confirm path lands at CONFIRMED, never shipped', async () => {
+  // The bypass relaxes WHO may confirm and whether a panel ran. It must not
+  // change WHERE the task lands: the route calls confirmTask, and only the
+  // proven-land path may call shipTask.
+  const fs = await import('node:fs');
+  const url = await import('node:url');
+  const path = await import('node:path');
+  const ROOT = path.dirname(path.dirname(url.fileURLToPath(import.meta.url)));
+  const routeSrc = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/routes/tasks.js'), 'utf8');
+
+  // Anchor on the ROUTE, not on `graderBypassEnabled()`. That identifier appears
+  // three times — the function definition, a rank-gate relaxation, and the
+  // handler's log line — so an indexOf anchor measures whichever comes first and
+  // then reads the wrong window. Slice the confirm handler itself: from its
+  // registration to the next route registration.
+  const confirmIdx = routeSrc.indexOf("router.post('/tasks/:id/confirm'");
+  assert.ok(confirmIdx > -1, 'the confirm route must exist — update this test if it moved');
+  const afterIdx = routeSrc.indexOf('router.', confirmIdx + 20);
+  const handler = routeSrc.slice(confirmIdx, afterIdx > -1 ? afterIdx : confirmIdx + 3000);
+
+  assert.match(handler, /db\.confirmTask\(/,
+    'the confirm route must land the task at CONFIRMED via confirmTask');
+  assert.ok(!/db\.shipTask\(/.test(handler),
+    'a shipTask call on the confirm path IS the grader-bypass phantom-ship vector, reopened');
+  assert.ok(!/shipped_at/.test(handler),
+    'the confirm path must never touch shipped_at — that stamp belongs to the proven land');
+});
+
 setTimeout(() => {
   console.log(`\npublish reconciler (task 1134 + 1915) tests: ${passed} passed, ${failed} failed`);
   process.exit(failed > 0 ? 1 : 0);

package/tests/redteam_patrol.mjs

@@ -0,0 +1,67 @@
+// tests/redteam_patrol.mjs — the patrol's pure helpers (task 1003128, goal 1000076).
+// Hermetic: parsing, severity mapping, pin detection, report assembly. The live
+// scans (gitleaks/npm/network) and the --canary end-to-end pipe are exercised by
+// hand + the weekly cron, never in the DB-free suite.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const p = require(path.join(ROOT, 'scripts', 'gds', 'redteam-patrol.js'));
+
+test('parseGitleaksReport maps rows to high-severity findings; junk → []', () => {
+  const rows = JSON.stringify([{ RuleID: 'aws-key', File: 'x.js', Commit: 'abcdef1234567890' }]);
+  const f = p.parseGitleaksReport(rows);
+  assert.equal(f.length, 1);
+  assert.equal(f[0].severity, 'high');
+  assert.match(f[0].item, /aws-key in x\.js @ abcdef12/);
+  assert.deepEqual(p.parseGitleaksReport('not json'), []);
+  assert.deepEqual(p.parseGitleaksReport('{}'), []);
+});
+
+test('severity mapping: npm "moderate" → "medium"; unknowns floor to low; order respected', () => {
+  assert.equal(p.mapSeverity('moderate'), 'medium');
+  assert.equal(p.mapSeverity('HIGH'), 'high');
+  assert.equal(p.mapSeverity('weird'), 'low');
+  assert.equal(p.maxSeverity([{ severity: 'low' }, { severity: 'high' }, { severity: 'medium' }]), 'high');
+  assert.equal(p.maxSeverity([{ severity: 'low' }]), 'low');
+});
+
+test('unpinnedUses flags tags/branches, accepts 40-hex SHAs, skips local + docker refs', () => {
+  const yaml = [
+    '      - uses: actions/checkout@v4',
+    '      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0',
+    '      - uses: ./.github/actions/local',
+    '        uses: actions/cache@main',
+  ].join('\n');
+  const bad = p.unpinnedUses(yaml);
+  assert.ok(bad.includes('actions/checkout@v4'));
+  assert.ok(bad.includes('actions/cache@main'));
+  assert.ok(!bad.some((r) => r.includes('setup-node')), 'a 40-hex SHA pin is accepted');
+  assert.ok(!bad.some((r) => r.includes('local')), 'local ./ ref skipped');
+});
+
+test('ageDays computes against a fixed now; bad dates → null', () => {
+  const now = Date.parse('2026-08-19T00:00:00Z');
+  assert.equal(Math.round(p.ageDays('2026-08-12T00:00:00Z', now)), 7);
+  assert.equal(p.ageDays('not-a-date', now), null);
+});
+
+test('lockedVersion reads the npm v3 lock shape', () => {
+  const lock = { packages: { 'node_modules/undici': { version: '6.27.0' } } };
+  assert.equal(p.lockedVersion(lock, 'undici'), '6.27.0');
+  assert.equal(p.lockedVersion(lock, 'absent'), undefined);
+});
+
+test('buildClassReport caps the item list, counts the remainder, and takes max severity', () => {
+  const findings = Array.from({ length: 13 }, (_, i) => ({ severity: i === 0 ? 'high' : 'low', item: `f${i}` }));
+  const r = p.buildClassReport('dependency-review', findings, ['a note']);
+  assert.equal(r.severity, 'high');
+  assert.equal(r.target, 'redteam-patrol/dependency-review');
+  assert.match(r.title, /13 finding/);
+  assert.match(r.repro_steps_md, /…and 3 more/);
+  assert.match(r.repro_steps_md, /Notes:/);
+});