@bongos/core 1.19.257 → 1.19.258

package/src/bongos/logger.js

@@ -0,0 +1,118 @@
+// src/bongos/logger.js — the core structured logger (task 1003130, goal 1000076;
+// docs/audits/ai-dev-redteam-baseline.md §5).
+//
+// The audit's logging finding: zero logging libraries, ~635 console.* calls in
+// server paths, no request correlation, and NO redaction — a key echoed into a
+// log line had no scrubber between it and journald. This is the fix for the
+// CORE server path: one pino instance, request-correlation via
+// AsyncLocalStorage, and redaction of the ADR 0022 secret-bearing header/field
+// shapes. Modules migrate off console incrementally under the no-console
+// ratchet (fitness-ratchets console_call_count); this module is what they
+// migrate ONTO.
+//
+// Why pino: the Node structured-logging standard — JSON to stdout, low
+// overhead, first-class redaction. It carries NO install scripts, so it is
+// safe under the `.npmrc ignore-scripts=true` policy (ADR 0180 §2).
+//
+// The logger writes newline-delimited JSON to stdout; the process manager
+// (systemd/journald) owns rotation and shipping. Level is LOG_LEVEL (default
+// 'info'); set 'debug' to see the request-start lines.
+
+'use strict';
+
+const { AsyncLocalStorage } = require('node:async_hooks');
+const crypto = require('node:crypto');
+const pino = require('pino');
+
+// One request-scoped store holding { reqId }. A pino mixin reads it so EVERY
+// line emitted while handling a request carries the id, without threading it
+// through call signatures.
+const requestContext = new AsyncLocalStorage();
+
+// Redaction — the secret-bearing shapes from ADR 0022 that realistically reach
+// a log line via a logged request/header/body object. pino's `redact` replaces
+// the value with "[Redacted]"; paths are static (never built from input — the
+// injection caveat in pino's docs). This is defense in depth behind the
+// scrubber and the prevent hook, not the only guard.
+const REDACT_PATHS = [
+  'req.headers.authorization',
+  'req.headers.cookie',
+  'req.headers["x-gds-session"]',
+  'req.headers["x-api-key"]',
+  'headers.authorization',
+  'headers.cookie',
+  // top-level field names (a bare path; pino's `*.x` matches one level DOWN, not the root)
+  'authorization',
+  'token',
+  'password',
+  'secret',
+  'apiKey',
+  'api_key',
+  'sessionToken',
+  'githubToken',
+  // …and the same names one level under any key
+  '*.authorization',
+  '*.token',
+  '*.password',
+  '*.secret',
+  '*.apiKey',
+  '*.api_key',
+  '*.sessionToken',
+  '*.githubToken',
+];
+
+// Exported so a test can build a logger with the IDENTICAL config onto a
+// capture stream — pino writes through sonic-boom straight to the fd, so the
+// config, not the singleton's stdout, is what a hermetic test asserts against.
+const pinoOptions = {
+  level: process.env.LOG_LEVEL || 'info',
+  // A leaked secret is a compromise; a redaction false-positive in a log is
+  // cosmetic — so redaction is broad, mirroring scrubSecrets' recall-first posture.
+  redact: { paths: REDACT_PATHS, censor: '[Redacted]' },
+  base: undefined, // drop pid/hostname noise; the process manager adds host context
+  timestamp: pino.stdTimeFunctions.isoTime,
+  mixin() {
+    const store = requestContext.getStore();
+    return store && store.reqId ? { reqId: store.reqId } : {};
+  },
+};
+
+const logger = pino(pinoOptions);
+
+// Run `fn` inside a fresh request context stamped with `reqId` (a caller-supplied
+// inbound id, or a fresh short hex). Everything logged inside — including the
+// error middleware — carries the same reqId.
+function runWithRequestId(reqId, fn) {
+  return requestContext.run({ reqId: reqId || crypto.randomBytes(8).toString('hex') }, fn);
+}
+
+function currentRequestId() {
+  const store = requestContext.getStore();
+  return store ? store.reqId : null;
+}
+
+// Express middleware: adopt an inbound correlation id (or mint one), expose it
+// on req/res + the `x-request-id` response header, and run the rest of the
+// request inside the AsyncLocalStorage context so every log line correlates.
+function requestIdMiddleware(req, res, next) {
+  const inbound = req.headers['x-request-id'];
+  const reqId = (typeof inbound === 'string' && inbound.length > 0 && inbound.length <= 128)
+    ? inbound
+    : crypto.randomBytes(8).toString('hex');
+  req.reqId = reqId;
+  res.setHeader('x-request-id', reqId);
+  requestContext.run({ reqId }, () => next());
+}
+
+// requestContext stays module-private (nothing outside needs the raw ALS).
+// pinoOptions/REDACT_PATHS/runWithRequestId/currentRequestId are the logging
+// toolkit — used by tests today (via dynamic require, invisible to knip's static
+// scan) and by future non-HTTP correlation callers.
+module.exports = {
+  logger,
+  pinoOptions,
+  requestIdMiddleware,
+  runWithRequestId,
+  currentRequestId,
+  REDACT_PATHS,
+};

package/src/bongos/middleware/audit.js

@@ -40,6 +40,7 @@
 // view useful; that information is lost at the SQL layer.
 
 const db = require('../db');
+const { logger } = require('../logger');
 
 const REDACTION_TOKENS = ['token', 'password', 'key', 'secret'];
 const REDACTED = '<redacted>';
@@ -205,7 +206,7 @@ function auditMiddleware(opts = {}) {
     } catch (err) {
       // redaction failures are themselves audit-failures: log + continue.
       // We still attach the finish handler so a row goes in WITH an empty body.
-      console.error('[audit] redact_failed', err);
+      logger.error({ err }, '[audit] redact_failed');
       snapshotBody = { _redact_failed: true };
     }
     const ip = clientIp(req);
@@ -251,12 +252,12 @@ function auditMiddleware(opts = {}) {
         .catch((err) => {
           // SWALLOW. Audit failures must not surface to the caller and must
           // not affect future requests. Console-error is the only effect.
-          console.error('[audit] insert_failed', {
+          logger.error({
             route,
             method,
             status,
             err: err && err.message ? err.message : String(err),
-          });
+          }, '[audit] insert_failed');
         });
     });
 

package/src/bongos/middleware/error-envelope.js

@@ -23,6 +23,7 @@
 'use strict';
 
 const { ApiError, isApiError, envelope, statusForCode } = require('../api-errors');
+const { logger } = require('../logger');
 
 // attachFail — decorate res with fail(). Mounted once, before the routers.
 function attachFail(req, res, next) {
@@ -83,10 +84,10 @@ function errorEnvelopeHandler(err, req, res, next) {
     return res.status(framework.status).json(envelope(framework.code));
   }
 
-  // Anything else is an unexpected server fault. Log with a stable tag (so it's
-  // greppable in prod logs) and answer a leak-free internal envelope — the raw
-  // message/stack is never sent to the client.
-  console.error('[gds] unhandled', req && req.method, req && req.originalUrl, err);
+  // Anything else is an unexpected server fault. Log structured (auto-correlated
+  // to the request via the logger's reqId mixin, redaction applied) and answer a
+  // leak-free internal envelope — the raw message/stack is never sent to the client.
+  logger.error({ method: req && req.method, url: req && req.originalUrl, err }, '[gds] unhandled');
   return res.status(500).json(envelope('internal_error'));
 }
 

package/src/bongos/module-scope-map.js

@@ -311,6 +311,7 @@ const MODULE_GLOBS = {
     'package.json', 'package-lock.json',
     'scripts/gds/fitness.js', 'scripts/gds/docs-entropy.js',
     'scripts/gds/redteam-patrol.js', 'scripts/gds/audit-gate.js',
+    'scripts/gds/fitness-ratchets.js', 'scripts/gds/control-manifest.js',
   ],
 };
 

package/src/bongos/serve-internal.js

@@ -39,6 +39,7 @@ const express = require('express');
 const { buildGdsRouter } = require('./routes');
 const { attachFail } = require('./middleware/error-envelope');
 const metrics = require('./metrics');
+const { logger } = require('./logger');
 const gdsAuth = require('./auth');
 const { buildStampedHtml } = require('../asset-version');
 const { buildInfo } = require('../build-info');
@@ -289,7 +290,7 @@ function resolveOpenapiJson({ candidates = [], generate } = {}) {
       const out = generate();
       if (out) return out;
     } catch (e) {
-      console.error('[docs] in-process OpenAPI generation failed:', e && e.message);
+      logger.error({ err: e && e.message }, '[docs] in-process OpenAPI generation failed');
     }
   }
   return '';

package/src/module-api.js

@@ -941,8 +941,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.255 with no explicit bump. run 32208475455. (task 1002620)
 //   1.19.257 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.256 with no explicit bump. run 32209295358. (task 1002620)
+//   1.19.258 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.257 with no explicit bump. run 32284962866. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.257'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.258'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/platform-server.js

@@ -49,6 +49,7 @@ const { mountInternalSurfaces, isStatusHost, isBuildersHost, injectBrandingGloba
 const { isApiShapedPath, apiNotFoundBody } = require('./bongos/api-path-404');
 const moduleLoader = require('./module-loader/loader');
 const { isModuleEnabled } = require('./modules');
+const { logger, requestIdMiddleware } = require('./bongos/logger');
 
 const PORT = Number(process.env.PORT) || 3000;
 const HOST = process.env.HOST || '127.0.0.1';
@@ -157,6 +158,12 @@ function buildPlatformApp() {
   // the OAuth callbacks the GDS auth router performs.
   app.set('trust proxy', 1);
 
+  // Request correlation FIRST (task 1003130): adopt/mint an x-request-id and run
+  // the rest of the request inside the AsyncLocalStorage context, so every
+  // structured log line — including the central error handler's — carries the
+  // same reqId. Mounted before any surface so nothing logs uncorrelated.
+  app.use(requestIdMiddleware);
+
   // The whole internal surface — shared verbatim with server.js (ADR 0062 R51).
   mountInternalSurfaces(app);
 
@@ -263,7 +270,7 @@ if (require.main === module) {
   const app = buildPlatformApp();
   const httpServer = http.createServer(app);
   httpServer.listen(PORT, HOST, () => {
-    console.log(`Cloud Bongos platform (GDS-only, no game; ADR 0062 R51) listening on ${HOST}:${PORT}`);
+    logger.info({ host: HOST, port: PORT }, 'Cloud Bongos platform (GDS-only, no game; ADR 0062 R51) listening');
     startBackgroundServices();
   });
 
@@ -288,7 +295,7 @@ if (require.main === module) {
   // up with a logged error strictly dominates dying. A rejection that leaves genuinely
   // corrupt state is not a shape this codebase produces — the DB work is transactional.
   process.on('unhandledRejection', (reason) => {
-    console.error('[platform] unhandled promise rejection (staying up; this is a BUG — the owning await needs its own catch):', reason);
+    logger.error({ reason }, '[platform] unhandled promise rejection (staying up; this is a BUG — the owning await needs its own catch)');
   });
 }
 

package/tests/auth_resolve_failure.mjs

@@ -140,7 +140,7 @@ test('a process-level unhandledRejection backstop is registered and does not exi
   assert.match(src, /process\.on\('unhandledRejection'/, 'the backstop must exist');
   const handler = src.slice(src.indexOf("process.on('unhandledRejection'"));
   const body = handler.slice(0, handler.indexOf('});') + 3);
-  assert.match(body, /console\.error/, 'it must log');
+  assert.match(body, /console\.error|logger\.error/, 'it must log (console or the structured logger — task 1003130 moved this to logger.error)');
   assert.doesNotMatch(body, /process\.exit/,
     'it must NOT exit — one process serves every request, so staying up dominates dying');
 });

package/tests/claude_materialize.mjs

@@ -117,17 +117,34 @@ t('materializeClaude: materializes scheduled-tasks — bodies→bongos, companio
   assert.ok(res.scheduledTasks > 0, 'at least one scheduled-task file materialized');
   const rt = join(dir, '.claude', 'scheduled-tasks');
   assert.ok(existsSync(rt), '.claude/scheduled-tasks created in the instance');
-  // A prose/judgment body's core invocation is bongosified so a consumer-layout model can run it.
-  const stale = readFileSync(join(rt, 'stale-claim-release', 'SKILL.md'), 'utf8');
-  assert.ok(stale.includes('bongos exec scripts/gds/pulse.js'), 'body core-invocation rewritten to bongos exec');
-  assert.ok(!stale.includes('node scripts/gds/pulse.js'), 'no bare relative node scripts/gds left in the body');
-  // A deterministic routine's `.claude/...` companion-step command is NOT a core invocation → preserved.
-  const dd = readFileSync(join(rt, 'diagram-drift', 'SKILL.md'), 'utf8');
-  assert.ok(dd.includes('node .claude/scheduled-tasks/diagram-drift/check.js'), 'companion-path step command preserved');
-  // Companion .js resolves its core require()s via the materialized _core-resolve.js sibling (task 2139 pattern).
-  const check = readFileSync(join(rt, 'diagram-drift', 'check.js'), 'utf8');
-  assert.ok(check.includes("require('../../hooks/_core-resolve.js')"), 'companion resolves core via _core-resolve');
-  assert.ok(!check.includes("require('../../../scripts/gds/"), 'no bare ../../../scripts/gds require left in the companion');
+  // Every materialized routine's core invocation is bongosified — asserted over
+  // WHATEVER routines the tree carries (the neutral core carries redteam-weekly;
+  // the founder core also carries stale-claim-release/diagram-drift). No routine
+  // body may keep a bare `node scripts/gds/…` core invocation.
+  let sawBongosified = false;
+  for (const name of readdirSync(rt)) {
+    const skillPath = join(rt, name, 'SKILL.md');
+    if (!existsSync(skillPath)) continue;
+    const body = readFileSync(skillPath, 'utf8');
+    assert.ok(!/\bnode scripts\/gds\//.test(body), `${name}: bare relative node scripts/gds left in the body`);
+    if (body.includes('bongos exec scripts/gds/')) sawBongosified = true;
+  }
+  assert.ok(sawBongosified, 'at least one routine had its core invocation rewritten to bongos exec');
+  // Founder-specific fixtures — assert their finer behavior only when present, so
+  // this coverage stays live on the founder core without demanding those routines
+  // exist in the neutral core (which carries a different routine set).
+  const stalePath = join(rt, 'stale-claim-release', 'SKILL.md');
+  if (existsSync(stalePath)) {
+    assert.ok(readFileSync(stalePath, 'utf8').includes('bongos exec scripts/gds/pulse.js'), 'body core-invocation rewritten to bongos exec');
+  }
+  const ddCheck = join(rt, 'diagram-drift', 'check.js');
+  if (existsSync(ddCheck)) {
+    const dd = readFileSync(join(rt, 'diagram-drift', 'SKILL.md'), 'utf8');
+    assert.ok(dd.includes('node .claude/scheduled-tasks/diagram-drift/check.js'), 'companion-path step command preserved');
+    const check = readFileSync(ddCheck, 'utf8');
+    assert.ok(check.includes("require('../../hooks/_core-resolve.js')"), 'companion resolves core via _core-resolve');
+    assert.ok(!check.includes("require('../../../scripts/gds/"), 'no bare ../../../scripts/gds require left in the companion');
+  }
   rmSync(dir, { recursive: true, force: true });
 });
 

package/tests/control_manifest.mjs

@@ -0,0 +1,60 @@
+// tests/control_manifest.mjs — the assurance-of-assurance check (task 1003131,
+// goal 1000076). Proves the manifest passes on the real tree AND actually
+// CATCHES the two failure modes it exists to catch: a control file that
+// vanishes, and a control that comes unwired. The check is itself a control —
+// so it too must be provably able to fail.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const cm = require(path.join(ROOT, 'scripts', 'gds', 'control-manifest.js'));
+
+test('the live tree passes: every goal-1000076 control is present and wired', () => {
+  const r = cm.checkControlsExist();
+  assert.equal(r.hardFail, false, `unexpected violations:\n  ${r.violations.join('\n  ')}`);
+  assert.ok(cm.CONTROLS.length >= 8, 'the manifest covers the shipped controls');
+});
+
+test('a vanished control file is caught', () => {
+  const controls = [{ label: 'x', file: '.claude/hooks/secret-gate.js' }];
+  const gone = cm.evaluate(controls, { exists: () => false, read: () => '' });
+  assert.equal(gone.length, 1);
+  assert.match(gone[0], /control file missing/);
+});
+
+test('a present-but-UNWIRED control is caught (the settings.json un-hook case)', () => {
+  const controls = [{
+    label: 'secret-gate hook', file: '.claude/hooks/secret-gate.js',
+    wiredIn: { file: '.claude/settings.json', needle: 'secret-gate.js' },
+  }];
+  // file exists, but the settings no longer reference it
+  const unwired = cm.evaluate(controls, {
+    exists: (f) => f === '.claude/hooks/secret-gate.js' || f === '.claude/settings.json',
+    read: () => '{ "hooks": {} }',
+  });
+  assert.equal(unwired.length, 1);
+  assert.match(unwired[0], /not wired in/);
+});
+
+test('a missing companion file (baseline/config) is caught even when the main file exists', () => {
+  const controls = [{
+    label: 'audit gate', file: 'scripts/gds/audit-gate.js',
+    alsoExists: ['config/audit-baseline.json'],
+  }];
+  const v = cm.evaluate(controls, { exists: (f) => f === 'scripts/gds/audit-gate.js', read: () => '' });
+  assert.equal(v.length, 1);
+  assert.match(v[0], /companion file missing/);
+});
+
+test('all-present + all-wired yields zero violations', () => {
+  const controls = [{
+    label: 'ok', file: 'a', alsoExists: ['b'],
+    wiredIn: { file: 'c', needle: 'NEEDLE' },
+  }];
+  const v = cm.evaluate(controls, { exists: () => true, read: () => 'has NEEDLE inside' });
+  assert.deepEqual(v, []);
+});

package/tests/fitness_ratchets.mjs

@@ -0,0 +1,91 @@
+// tests/fitness_ratchets.mjs — the quality-ratchet mechanics (task 1003129,
+// goal 1000076). Hermetic: exercises the pure metric + compare functions on
+// synthetic inputs; the repo-wide sweep runs via checkQualityRatchets inside
+// tests/fitness.mjs, and the knip half is a CI-only step by design.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const rat = require(path.join(ROOT, 'scripts', 'gds', 'fitness-ratchets.js'));
+
+test('ratchet compare: worse fails, equal passes, better nudges, unknown warns', () => {
+  const base = { a: 10, b: 5 };
+  assert.equal(rat.compareToBaselines({ a: 10, b: 5 }, base).violations.length, 0, 'equal passes');
+  const worse = rat.compareToBaselines({ a: 11, b: 5 }, base);
+  assert.equal(worse.violations.length, 1);
+  assert.match(worse.violations[0], /a regressed: 11 > baseline 10/);
+  const better = rat.compareToBaselines({ a: 9, b: 5 }, base);
+  assert.equal(better.violations.length, 0);
+  assert.match(better.warnings[0], /ratchet-down available/);
+  const unknown = rat.compareToBaselines({ c: 1 }, base);
+  assert.equal(unknown.violations.length, 0, 'uninitialized metric warns, never fails');
+  assert.match(unknown.warnings[0], /no baseline for "c"/);
+  assert.equal(rat.compareToBaselines({ a: null }, base).warnings.length, 0, 'a skipped metric (null) is silent');
+});
+
+test('duplication: identical 30-line blocks in TWO files count; one file alone does not', () => {
+  const block = Array.from({ length: rat.WINDOW }, (_, i) => `const v${i} = compute(${i});`).join('\n');
+  const one = new Map([['a.js', block]]);
+  assert.equal(rat.duplicateWindowCount(one), 0, 'same-file windows are not cross-file duplication');
+  const two = new Map([['a.js', block], ['b.js', `// header\n${block}`]]);
+  assert.ok(rat.duplicateWindowCount(two) >= 1, 'the shared block registers');
+  const clean = new Map([['a.js', block], ['b.js', block.replaceAll('compute', 'derive')]]);
+  assert.equal(rat.duplicateWindowCount(clean), 0, 'a changed body is not a duplicate');
+});
+
+test('normalizeLines drops blanks and comment lines so cosmetic edits cannot dodge the hash', () => {
+  const lines = rat.normalizeLines('a();\n\n  // comment\n  b();\n/* block */\n * cont\n');
+  assert.deepEqual(lines, ['a();', 'b();']);
+});
+
+test('cycle counting: a 2-node loop is one SCC; a diamond is none; self-requires ignored', () => {
+  const loop = new Map([['a.js', ['b.js']], ['b.js', ['a.js']]]);
+  assert.equal(rat.countCycles(loop), 1);
+  const diamond = new Map([['a.js', ['b.js', 'c.js']], ['b.js', ['d.js']], ['c.js', ['d.js']], ['d.js', []]]);
+  assert.equal(rat.countCycles(diamond), 0);
+  const tri = new Map([['a.js', ['b.js']], ['b.js', ['c.js']], ['c.js', ['a.js']], ['x.js', []]]);
+  assert.equal(rat.countCycles(tri), 1, 'a 3-cycle is one component, not three');
+});
+
+test('requireGraph resolves ./x, ./x.js and ./x/index.js and skips unknown targets', () => {
+  const contents = new Map([
+    ['src/a.js', "const b = require('./b'); const i = require('./lib'); const gone = require('./nope');"],
+    ['src/b.js', ''],
+    ['src/lib/index.js', ''],
+  ]);
+  const edges = rat.requireGraph(contents);
+  assert.deepEqual(edges.get('src/a.js').sort(), ['src/b.js', 'src/lib/index.js']);
+});
+
+test('size metrics: count and excess ratchet independently', () => {
+  const files = ['big.js', 'small.js'];
+  const read = (f) => (f === 'big.js' ? 'x\n'.repeat(rat.OVERSIZE_LINES + 100) : 'x\n');
+  const m = rat.sizeMetrics(files, read);
+  assert.equal(m.oversized_file_count, 1);
+  assert.ok(m.excess_lines_total >= 100, `excess tracks growth over the threshold (got ${m.excess_lines_total})`);
+});
+
+test('console counting only sees server paths', () => {
+  assert.equal(rat.isServerPath('src/bongos/auth.js'), true);
+  assert.equal(rat.isServerPath('modules/lifecycle/db.js'), true);
+  assert.equal(rat.isServerPath('modules/hall-ui/public/builders.js'), false, 'browser surfaces excluded');
+  assert.equal(rat.isServerPath('scripts/gds/ship.js'), false, 'CLI stdout is legitimate UX');
+  assert.equal(rat.isServerPath('modules/security/tests/floor.mjs'), false);
+  const n = rat.consoleCallCount(new Map([
+    ['src/x.js', 'console.log(1); console.error(2);'],
+    ['scripts/gds/y.js', 'console.log(1);'],
+  ]));
+  assert.equal(n, 2);
+});
+
+test('the committed baseline file parses and covers every hermetic metric', () => {
+  const b = require(path.join(ROOT, 'config', 'fitness-baselines.json'));
+  for (const key of ['oversized_file_count', 'excess_lines_total', 'duplicate_window_count',
+    'require_cycle_count', 'console_call_count', 'doc_stale_links', 'doc_broken_anchors', 'doc_duplicate_prose']) {
+    assert.ok(Number.isInteger(b.metrics[key]), `baseline missing ${key}`);
+  }
+});

package/tests/logger.mjs

@@ -0,0 +1,89 @@
+// tests/logger.mjs — the core structured logger (task 1003130, goal 1000076).
+// Proves the three done-when properties without a live server: request-id
+// correlation via AsyncLocalStorage, secret redaction on the logged shapes,
+// and the middleware's adopt-or-mint + x-request-id echo. Hermetic — captures
+// pino's stdout stream, no network.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const log = require(path.join(ROOT, 'src', 'bongos', 'logger.js'));
+const pino = require(path.join(ROOT, 'node_modules', 'pino'));
+const { Writable } = require('node:stream');
+
+// pino writes through sonic-boom directly to the fd, so we can't intercept the
+// singleton's stdout. Instead build a logger with the IDENTICAL exported config
+// onto a capture stream — same redact paths + same reqId mixin (the mixin closes
+// over the module's ALS, so runWithRequestId still correlates).
+function capture(fn) {
+  const lines = [];
+  const stream = new Writable({ write(chunk, _enc, cb) { lines.push(chunk.toString()); cb(); } });
+  const testLogger = pino(log.pinoOptions, stream);
+  fn(testLogger);
+  return lines.filter((l) => l.trim().startsWith('{')).map((l) => JSON.parse(l));
+}
+
+test('every line emitted inside runWithRequestId carries the same reqId', () => {
+  const out = capture((l) => {
+    log.runWithRequestId('req-abc', () => {
+      l.info('first');
+      l.warn('second');
+      assert.equal(log.currentRequestId(), 'req-abc');
+    });
+    l.info('outside'); // no context → no reqId
+  });
+  const inside = out.filter((l) => l.msg === 'first' || l.msg === 'second');
+  assert.equal(inside.length, 2);
+  assert.ok(inside.every((l) => l.reqId === 'req-abc'), 'correlated lines share the id');
+  const outside = out.find((l) => l.msg === 'outside');
+  assert.equal(outside.reqId, undefined, 'a line with no request context carries no reqId');
+});
+
+test('a secret in a logged header/field is redacted, not emitted', () => {
+  const out = capture((l) => {
+    l.error({
+      req: { headers: { authorization: 'Bearer sk-ant-verysecretvalue012345', cookie: 'gds_session=abc' } },
+      token: 'ghp_shouldnotappear0000000000000000000000',
+      note: 'this stays',
+    }, 'boom');
+  });
+  const line = out.find((l) => l.msg === 'boom');
+  const blob = JSON.stringify(line);
+  assert.ok(!blob.includes('sk-ant-verysecretvalue'), 'authorization header redacted');
+  assert.ok(!blob.includes('ghp_shouldnotappear'), 'token field redacted');
+  assert.ok(!blob.includes('gds_session=abc'), 'cookie redacted');
+  assert.ok(blob.includes('[Redacted]'), 'redaction marker present');
+  assert.ok(blob.includes('this stays'), 'non-secret fields survive');
+});
+
+test('REDACT_PATHS covers the ADR 0022 header/field shapes', () => {
+  for (const p of ['req.headers.authorization', 'req.headers.cookie', 'token', '*.token', '*.password']) {
+    assert.ok(log.REDACT_PATHS.includes(p), `expected redact path ${p}`);
+  }
+});
+
+test('requestIdMiddleware adopts a valid inbound id and echoes it; mints otherwise', () => {
+  const mk = (headers) => {
+    const req = { headers };
+    const res = { _h: {}, setHeader(k, v) { this._h[k.toLowerCase()] = v; } };
+    let ran = false;
+    log.requestIdMiddleware(req, res, () => { ran = true; });
+    return { req, res, ran };
+  };
+  const adopted = mk({ 'x-request-id': 'inbound-123' });
+  assert.equal(adopted.req.reqId, 'inbound-123');
+  assert.equal(adopted.res._h['x-request-id'], 'inbound-123');
+  assert.ok(adopted.ran);
+
+  const minted = mk({});
+  assert.match(minted.req.reqId, /^[0-9a-f]{16}$/, 'mints a 16-hex id when none supplied');
+  assert.equal(minted.res._h['x-request-id'], minted.req.reqId);
+
+  // an absurdly long inbound id is rejected in favor of a minted one (header-injection guard)
+  const huge = mk({ 'x-request-id': 'x'.repeat(500) });
+  assert.match(huge.req.reqId, /^[0-9a-f]{16}$/, 'over-long inbound id is not adopted');
+});