@bongos/core 1.19.306 → 1.19.308

package/tests/route_rank_check.mjs

@@ -427,19 +427,127 @@ test('LIVE: checkRouteRanks() on src/bongos/routes/ has zero unknowns', () => {
   assert.equal(res.hardFail, false);
 });
 
-// The census invariant (BV1.R109b). Asserting that the 10 known multi-line paths parse
-// would prove nothing about the ELEVENTH — the next route someone declares in a form
-// this scanner doesn't handle. So count instead: every `router.<method>(` line in every
-// discovered route file must yield exactly one classified route.
+// The census invariant (BV1.R109b, re-derived in task 1002671). Asserting that the 10
+// known multi-line paths parse would prove nothing about the ELEVENTH — the next route
+// someone declares in a form this scanner doesn't handle. So count instead: every
+// `router.<method>(` call in every discovered route file must yield exactly one
+// classified route.
 //
-// The census regex below is HAND-WRITTEN here on purpose and NOT imported from the
-// module. Importing ROUTE_DECL_RE would move both sides of the comparison together and
-// prove nothing (the oracle trap tests/route_permission_check.mjs documents).
-const CENSUS_DECL_RE = /^\s*router\.(?:get|post|patch|put|delete)\s*\(/;
+// ORACLE INDEPENDENCE (the 2026-07-30 review's HIGH finding, confirmed): the first cut
+// of this census was a verbatim copy of the scanner's own ROUTE_DECL_RE — hand-written,
+// but shape-identical, so any widening of the scanner would be pasted into the census
+// and both sides would move together. The census below is derived on a structurally
+// different axis instead:
+//   • token-level, not line-level — comments and string/template/regex literals are
+//     stripped first by a tiny tokenizer, then calls are counted in the whole text;
+//   • not line-anchored — an inline/chained/mid-line declaration counts here even
+//     though the scanner's `^\s*` form cannot see it;
+//   • whitespace-tolerant across the member access (`router . get (` counts).
+// A unilateral change to the scanner's recognizer now shows up as a census mismatch
+// and forces a DELIBERATE census-side decision, instead of going green by paste.
+//
+// The tokenizer is deliberately small and fail-closed: if it ever misreads a future
+// route file, the equality below goes red and a human looks — that is the correct
+// failure mode for an audit oracle (never silently green).
+function stripNonCode(src) {
+  let out = '';
+  const n = src.length;
+  const tplBraceDepth = []; // one entry per open template-literal interpolation
+  let i = 0;
+  const KEYWORDS_BEFORE_REGEX = new Set(['return', 'typeof', 'case', 'in', 'of', 'instanceof', 'new', 'delete', 'void', 'do', 'else', 'yield', 'await']);
+  const regexCanFollow = () => {
+    const t = out.trimEnd();
+    if (t === '') return true;
+    const last = t[t.length - 1];
+    if ('(,=:[!&|?{};+-*%~^<>'.includes(last)) return true;
+    const word = /[A-Za-z_$][\w$]*$/.exec(t);
+    return !!(word && KEYWORDS_BEFORE_REGEX.has(word[0]));
+  };
+  // Consume string/template BODY starting at src[i] (opening quote already emitted
+  // and consumed). For templates, stops early at `${` and pushes an interpolation
+  // frame — the main loop then lexes the interpolation as code until its `}`.
+  const skipStringBody = (quote) => {
+    while (i < n && src[i] !== quote) {
+      if (src[i] === '\\') { out += '..'; i += 2; continue; }
+      if (quote === '`' && src[i] === '$' && src[i + 1] === '{') { out += '${'; i += 2; tplBraceDepth.push(0); return 'interp'; }
+      out += (src[i] === '\n' ? '\n' : '.'); i++;
+    }
+    out += quote; i++; // closing quote (or EOF)
+    return 'closed';
+  };
+  const skipString = (quote) => {
+    out += quote; i++;
+    return skipStringBody(quote);
+  };
+  while (i < n) {
+    const c = src[i], d = src[i + 1];
+    if (c === '/' && d === '/') { while (i < n && src[i] !== '\n') i++; continue; }
+    if (c === '/' && d === '*') { i += 2; while (i < n && !(src[i] === '*' && src[i + 1] === '/')) { if (src[i] === '\n') out += '\n'; i++; } i += 2; out += ' '; continue; }
+    if (c === '/' && regexCanFollow()) { // regex literal (handles quotes inside, e.g. /[&<>"']/)
+      out += '/'; i++;
+      let inClass = false;
+      while (i < n && (inClass || src[i] !== '/')) {
+        if (src[i] === '\\') { out += '..'; i += 2; continue; }
+        if (src[i] === '[') inClass = true;
+        else if (src[i] === ']') inClass = false;
+        out += '.'; i++;
+      }
+      out += '/'; i++;
+      while (i < n && /[a-z]/i.test(src[i])) { out += src[i]; i++; } // flags
+      continue;
+    }
+    if (c === '\'' || c === '"' || c === '`') { skipString(c); continue; }
+    if (tplBraceDepth.length) { // inside a template interpolation: brace-track back to the template
+      if (c === '{') tplBraceDepth[tplBraceDepth.length - 1]++;
+      if (c === '}') {
+        if (tplBraceDepth[tplBraceDepth.length - 1] === 0) {
+          tplBraceDepth.pop(); out += '}'; i++;
+          skipStringBody('`'); // resume the enclosing template's body (may re-enter an interpolation)
+          continue;
+        }
+        tplBraceDepth[tplBraceDepth.length - 1]--;
+      }
+    }
+    out += c; i++;
+  }
+  return out;
+}
+
+// HAND-WRITTEN on purpose and NOT imported from the module (the oracle trap
+// tests/route_permission_check.mjs documents) — and, unlike the pre-1002671 census,
+// deliberately NOT shape-identical to the scanner's ROUTE_DECL_RE either.
+const CENSUS_CALL_RE = /\brouter\s*\.\s*(?:get|post|patch|put|delete)\s*\(/g;
+// A computed member declaration (`router[method](…)`) is invisible to every static
+// recognizer on both sides. Fail loud instead of silently under-counting.
+const CENSUS_DYNAMIC_RE = /\brouter\s*\[/;
 // A floor, so a change that silently guts BOTH sides (e.g. discoverRouteFiles stops
 // finding module routes) reds instead of trivially "matching" at a smaller number.
 const ROUTE_CENSUS_FLOOR = 258;
 
+function censusCount(text) {
+  const code = stripNonCode(String(text));
+  assert.ok(!CENSUS_DYNAMIC_RE.test(code),
+    'route file uses a computed router[method](…) declaration — invisible to the rank auditor; declare it statically');
+  return (code.match(CENSUS_CALL_RE) || []).length;
+}
+
+test('census tokenizer: strips comments, strings, and quote-bearing regex literals', () => {
+  assert.equal(censusCount(`// router.get('/a', h)\nrouter.post('/b', h);`), 1);
+  assert.equal(censusCount(`const s = "router.get('/a'"; router.get('/b', h);`), 1);
+  assert.equal(censusCount(`s.replace(/[&<>"']/g, esc); router.get('/x', h);`), 1);
+  assert.equal(censusCount('const t = `x ${router.get(\'/live\', h)} y`;'), 1);
+});
+
+test('census independence: counts declarations the line-anchored scanner cannot see', () => {
+  // Inline (mid-line) declaration: census sees it, scanDeclarations does not. If the
+  // scanner ever learns this form, this fixture forces the census comparison to be
+  // revisited deliberately rather than drifting in lockstep.
+  const text = `if (flag) router.get('/inline', h);`;
+  assert.equal(censusCount(text), 1);
+  assert.equal(rrc.classifyText(text).length, 0,
+    'fixture stale: the scanner now classifies inline declarations — update the census comment');
+});
+
 test('LIVE census: every router.<method>( declaration classifies to exactly one route [BV1.R109b]', () => {
   const fs = require('node:fs');
   let declared = 0;
@@ -447,7 +555,7 @@ test('LIVE census: every router.<method>( declaration classifies to exactly one
   const shortfall = [];
   for (const { abs, rel } of rrc.discoverRouteFiles()) {
     const text = fs.readFileSync(abs, 'utf8');
-    const d = text.split('\n').filter((l) => CENSUS_DECL_RE.test(l)).length;
+    const d = censusCount(text);
     const c = rrc.classifyText(text).length;
     declared += d;
     classified += c;

package/tests/ship_cannot_lie.mjs

@@ -0,0 +1,168 @@
+// tests/ship_cannot_lie.mjs — G04, task 1003168, goal 1000077, criterion
+// guards-ship-cannot-lie.
+//
+// TWO fixes, one incident, so one test file.
+//
+// (1) Prose reaches ship.js through a FILE, never only through the shell.
+//     Backticks in handoff notes are command-substituted by bash BEFORE node
+//     runs: the span executes, its output replaces it, and the remaining
+//     arguments are truncated. That shipped a task with empty notes and no
+//     summary — the ledger recorded nothing about a session that happened
+//     (learning 1000197).
+//
+// (2) A ship that dies mid-pipeline must say where it stopped. resolveClaim
+//     lands the task at 'completed' before the grade runs, and 'completed' is
+//     ALSO what a grade-failed task looks like — so a bare `fatal: <stack>`
+//     left nobody able to tell how far it got.
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { argText } = require('../scripts/gds/cli-lib.js');
+const { fatalRecoveryLines, markShipProgress, _peekForTest } = require('../scripts/gds/ship-honesty.js');
+
+// Injected IO so no case touches the filesystem.
+const io = {
+  readFile: (f) => {
+    if (f === 'notes.md') return 'real notes with `backticks` in them';
+    if (f === 'bom.md') return 'after a BOM';
+    throw new Error('ENOENT: no such file');
+  },
+  readStdin: () => 'from stdin',
+};
+
+// ---- (1) prose from a file -------------------------------------------------
+test('THE INCIDENT: a file argument carries backticks through untouched', () => {
+  // The shell never sees this content, so the backticks survive verbatim —
+  // that is the entire point of the flag.
+  const r = argText('--notes', ['--notes-file', 'notes.md'], io);
+  assert.equal(r.source, 'file');
+  assert.match(r.value, /`backticks`/);
+  assert.equal(r.error, null);
+});
+
+test('inline still works, for a short summary with no awkward characters', () => {
+  const r = argText('--summary', ['--summary', 'one line'], io);
+  assert.deepEqual([r.value, r.source, r.error], ['one line', 'inline', null]);
+});
+
+test('BOTH given is REFUSED, never silently resolved', () => {
+  // Precedence would mean one of the caller's two inputs vanished with no word
+  // said — the same quiet loss the flag exists to end.
+  const r = argText('--notes', ['--notes', 'a', '--notes-file', 'notes.md'], io);
+  assert.ok(r.error, 'both-given must be an error');
+  assert.match(r.error, /both/i);
+  assert.equal(r.value, '', 'a refusal must not hand back a half-resolved value');
+});
+
+test('a dash reads stdin', () => {
+  const r = argText('--notes', ['--notes-file', '-'], io);
+  assert.deepEqual([r.value, r.source], ['from stdin', 'stdin']);
+});
+
+test('an unreadable file is an error, not silently empty', () => {
+  // Silently-empty is precisely how the original incident hid itself.
+  const r = argText('--notes', ['--notes-file', 'gone.md'], io);
+  assert.ok(r.error);
+  assert.match(r.error, /could not read/);
+});
+
+test('a missing value for the file flag is caught, including a following flag', () => {
+  for (const args of [['--notes-file'], ['--notes-file', '--summary', 'x']]) {
+    const r = argText('--notes', args, io);
+    assert.ok(r.error, `${JSON.stringify(args)} must error`);
+    assert.match(r.error, /needs a path/);
+  }
+});
+
+test('a PowerShell BOM is stripped', () => {
+  // PS 5.1's `>` redirection writes a UTF-8 BOM; without stripping it the first
+  // character of every note would be U+FEFF.
+  const r = argText('--notes', ['--notes-file', 'bom.md'], io);
+  assert.equal(r.value, 'after a BOM');
+});
+
+test('neither flag yields empty string, not null — callers concatenate it', () => {
+  const r = argText('--notes', [], io);
+  assert.deepEqual([r.value, r.source, r.error], ['', 'none', null]);
+});
+
+// ---- (2) the ship cannot lie about how far it got --------------------------
+test('every stage names the task, its real status, and a recovery command', () => {
+  for (const stage of ['preflight', 'resolved', 'graded', 'landed']) {
+    const lines = fatalRecoveryLines({ stage, taskId: 4242 });
+    assert.ok(Array.isArray(lines) && lines.length >= 3, `${stage} must say something`);
+    for (const l of lines) assert.equal(typeof l, 'string', `${stage} lines are printable as-is`);
+    assert.ok(lines.some((l) => l.includes('4242')), `${stage} must name the task`);
+    assert.ok(
+      lines.some((l) => l.includes('node scripts/gds/ship.js 4242')),
+      `${stage} must name the command that recovers it`,
+    );
+  }
+});
+
+test('pre-resolve says the claim is INTACT — the opposite of the post-resolve case', () => {
+  const text = fatalRecoveryLines({ stage: 'preflight', taskId: 7 }).join('\n');
+  assert.match(text, /NOT resolved/);
+  assert.match(text, /still active/);
+});
+
+test("post-resolve names 'completed' AND that the grade did not record", () => {
+  // The distinction the status itself cannot make.
+  const text = fatalRecoveryLines({ stage: 'resolved', taskId: 7 }).join('\n');
+  assert.match(text, /'completed'/);
+  assert.match(text, /grade did NOT record/);
+  assert.match(text, /No credits/i);
+});
+
+test("post-grade names 'confirmed' and that the grade PASSED", () => {
+  const text = fatalRecoveryLines({ stage: 'graded', taskId: 7 }).join('\n');
+  assert.match(text, /'confirmed'/);
+  assert.match(text, /PASSED/);
+});
+
+test('the landed stage does NOT claim the ship failed', () => {
+  // It reached 'shipped'; only the after-work broke. Saying "the ship did not
+  // finish" there would be the same lying-status problem in reverse.
+  const lines = fatalRecoveryLines({ stage: 'landed', taskId: 7 });
+  assert.match(lines[0], /LANDED/);
+  assert.ok(!/did NOT finish/.test(lines.join('\n')));
+});
+
+test('NO stage recommends --regrade as the recovery', () => {
+  // A plain re-run routes by the task's CURRENT status, so it resumes whichever
+  // leg stalled. --regrade accepts only 'completed' and refuses a task that got
+  // to 'confirmed' — and the builder reading a crash cannot know which it is.
+  for (const stage of ['preflight', 'resolved', 'graded', 'landed']) {
+    const text = fatalRecoveryLines({ stage, taskId: 7 });
+    for (const l of text) {
+      assert.ok(
+        !/^\s*Resume:?\s+node .*--regrade/.test(l) && !/re-run:\s+node .*--regrade/.test(l),
+        `${stage} must not prescribe --regrade: ${l}`,
+      );
+    }
+  }
+});
+
+test('an unknown stage degrades to the safe pre-resolve message', () => {
+  // A future leg added without a case here must not produce a confident wrong
+  // claim about credits or status.
+  const text = fatalRecoveryLines({ stage: 'something-new', taskId: 7 }).join('\n');
+  assert.match(text, /NOT resolved/);
+});
+
+test('a missing taskId still yields a usable command', () => {
+  const text = fatalRecoveryLines({ stage: 'resolved', taskId: null }).join('\n');
+  assert.match(text, /ship\.js <task-id>/);
+});
+
+test('markShipProgress is the single writer, and ship.js re-exports the reader', () => {
+  // Wiring proof: the extraction must not have left ship.js reading a stale copy.
+  markShipProgress('graded', 99);
+  assert.deepEqual(_peekForTest(), { stage: 'graded', taskId: 99 });
+  assert.match(fatalRecoveryLines().join('\n'), /#99/, 'the default arg reads live progress');
+  const shipCli = require('../scripts/gds/ship.js');
+  assert.equal(typeof shipCli.fatalRecoveryLines, 'function', 'ship.js still exposes it');
+  assert.equal(shipCli.fatalRecoveryLines, fatalRecoveryLines, 'same function, not a copy');
+});

package/tests/ship_smoke_gate.mjs

@@ -14,7 +14,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { smokeGateMessages } = require('../scripts/gds/ship.js');
+const { smokeGateMessages } = require('../scripts/gds/ship-honesty.js');
 
 let passed = 0;
 let failed = 0;
@@ -61,8 +61,14 @@ t('parked: names the deliberate stop, the exact status, and that nothing was pai
   assert.match(parkedText, /no credits/i);
 });
 
-t('parked: names the resume path (--regrade)', () => {
-  assert.match(parkedText, /ship\.js 1234 --regrade/);
+t('parked: names the resume path (a plain re-run, not --regrade)', () => {
+  // task 1003168 (G04): this used to say --regrade. A plain re-run routes by the
+  // task's CURRENT status, so it resumes whichever leg stalled; --regrade accepts
+  // only 'completed' and refuses a task that got as far as 'confirmed'. Since the
+  // builder reading this cannot know which leg died, the advice must be the
+  // command that works from either.
+  assert.match(parkedText, /ship\.js 1234$|ship\.js 1234\s/m);
+  assert.ok(!/ship\.js 1234 --regrade/.test(parkedText), 'must not recommend --regrade');
 });
 
 t('both message sets are non-empty arrays of strings (printable as-is)', () => {