@bongos/core 1.19.315 → 1.19.317

package/scripts/gds/skill-preflight.js

@@ -0,0 +1,336 @@
+#!/usr/bin/env node
+// scripts/gds/skill-preflight.js — an ops skill declares the machine it needs,
+// and refuses early when this machine is not it (task 1003167 / G03, goal
+// 1000077; criterion guards-skill-declares-machine).
+//
+// THE INCIDENT. /merge-mode states in its own prose that it assumes the Archon's
+// Mac or the droplet. It was run on a dev box anyway. Worse, ship.js ALREADY knew:
+// strandNextStep() tells a box "/merge-mode is NOT available here — it needs gh +
+// a main checkout this machine doesn't have." So the knowledge existed in two
+// places and neither stopped the run, because prose cannot refuse and the one
+// executable copy was on a different code path. A capability a procedure needs
+// must be a declaration the machine can CHECK, not a sentence a reader can skim.
+//
+// THREE PARTS, matching that diagnosis:
+//   1. `requires:` in the skill's own YAML frontmatter — the declaration.
+//   2. this preflight — the check, naming the MISSING capability and nothing else.
+//   3. checkOpsSkillsDeclareMachine() in fitness.js — the assertion that a skill
+//      whose fenced commands touch main/deploy actually carries a declaration.
+//
+// TRI-STATE, deliberately. A probe returns true / false / null, and null means
+// "could not tell" (the context-pack isMainCheckout precedent). We REFUSE on
+// false and WARN on null: refusing on unknown would block legitimate machines,
+// and passing on unknown silently would rebuild the hole this closes.
+//
+// The preflight NEVER connects to anything. Proving an SSH key reaches a host
+// means using it, and a preflight with side effects is not a preflight.
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('node:child_process');
+const { resolveWorktreeRoot } = require('./context-pack.js');
+const { depsFinding } = require('./preflight.js');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const runGit = (args) => spawnSync('git', args, { cwd: process.cwd(), encoding: 'utf8' }).stdout || '';
+
+// Memoized for the life of the process. merge-mode declares BOTH `gh` and
+// `push-credential`, and push-credential's probe also consults gh — so without
+// this, one preflight spawned `gh auth status` twice, each with a 15s timeout.
+// A preflight slow enough to be worth skipping is a preflight nobody runs, which
+// would defeat the entire point of this task.
+let _ghAuthed = null;
+function ghAuthed({ fresh = false } = {}) {
+  if (!fresh && _ghAuthed !== null) return _ghAuthed;
+  _ghAuthed = ghAuthedUncached();
+  return _ghAuthed;
+}
+
+function ghAuthedUncached() {
+  try {
+    const a = spawnSync('gh', ['auth', 'status'], {
+      stdio: 'ignore', shell: process.platform === 'win32', windowsHide: true, timeout: 15000,
+    });
+    return !!a && !a.error && a.status === 0;
+  } catch { return false; }
+}
+
+function binaryPresent(name) {
+  try {
+    const probe = process.platform === 'win32' ? ['where', [name]] : ['which', [name]];
+    const r = spawnSync(probe[0], probe[1], { stdio: 'ignore', shell: process.platform === 'win32', timeout: 10000 });
+    return !!r && !r.error && r.status === 0;
+  } catch { return false; }
+}
+
+// The registry. `probe` returns true | false | null. `missing` is the sentence a
+// builder reads when it comes back false — it must name the remedy, because the
+// whole failure mode here was a reader who knew the rule and still had nowhere
+// to go with it.
+const CAPABILITIES = {
+  gh: {
+    what: 'an authenticated GitHub CLI',
+    probe: () => ghAuthed(),
+    missing: 'no authenticated `gh` on this machine. Run `gh auth login`, or use a machine that has it — '
+      + 'a dev box normally does not, by design (it publishes through the server instead, ADR 0055).',
+  },
+  'main-checkout': {
+    what: 'the main checkout, not a linked worktree',
+    // Tri-state on purpose: resolveWorktreeRoot cannot always tell.
+    probe: () => resolveWorktreeRoot({ runGit, cwd: process.cwd() }).isMainCheckout,
+    missing: 'this is a linked worktree, not the main checkout. Procedures that mutate `main` must run in the '
+      + 'main checkout — a worktree holding the branch has nowhere to merge INTO (task 1002572).',
+  },
+  'push-credential': {
+    // Mirrors ship.js pushVia(): the project's operative definition of "can push"
+    // is an authed gh (or an explicit token), and everything else routes through
+    // the server. Following that rather than inventing a stricter rule keeps one
+    // answer to the question instead of two that can disagree.
+    what: 'a credential that can push to origin',
+    probe: () => ghAuthed() || !!(process.env.GITHUB_TOKEN || process.env.GH_TOKEN),
+    missing: 'no push credential here. This machine lands work through the server-mediated publish '
+      + '(`node scripts/gds/ship.js <id>` resumes it) — it cannot push `main` directly.',
+  },
+  'droplet-ssh': {
+    what: 'SSH access to the deploy host',
+    // false when there is no ssh at all; null when there is, because proving the
+    // key and host actually work would mean connecting.
+    probe: () => (binaryPresent('ssh') ? null : false),
+    missing: 'no `ssh` binary on this machine, so a step that reaches the deploy host cannot run. '
+      + 'In `ci` deploy mode nothing should need it — check config/deploy.json before proceeding.',
+  },
+  tty: {
+    what: 'an interactive terminal',
+    probe: () => !!(process.stdin.isTTY && process.stdout.isTTY),
+    missing: 'no TTY — this procedure prompts, and a prompt with nobody to answer it hangs. '
+      + 'Use the non-interactive form (a --*-file flag or an explicit flag) instead.',
+  },
+  'node-modules': {
+    what: 'resolvable dependencies',
+    // DELEGATES to preflight.js rather than testing repoRoot/node_modules itself.
+    // Writing that test here is exactly the bug idea 1000788 reported against
+    // depsFinding: a worktree has no node_modules of its own, yet every require
+    // resolves fine because node walks up. Two copies of a probe are two chances
+    // to disagree, and this task exists because knowledge lived in two places.
+    probe: () => depsFinding().level === 'ok',
+    missing: 'dependencies are not resolvable from this tree — a step needing pg/express/pino will fail. '
+      + 'Run `npm ci` in the repo root.',
+  },
+};
+
+// ---- the declaration ------------------------------------------------------
+// Read `requires:` out of a skill's YAML frontmatter. Accepts the inline form
+// (`requires: [gh, main-checkout]`) and the dash-list form. Returns
+// { requires, declared, error }: `declared` distinguishes "declared nothing"
+// from "declared an empty list", which the fitness check needs to tell apart.
+function parseRequires(md) {
+  const m = /^---\n([\s\S]*?)\n---/.exec(String(md || ''));
+  if (!m) return { requires: [], declared: false, error: null };
+  const fm = m[1];
+  const inline = /^requires:[ \t]*\[(.*?)\][ \t]*$/m.exec(fm);
+  if (inline) {
+    const items = inline[1].split(',').map((s) => s.trim().replace(/^['"]|['"]$/g, '')).filter(Boolean);
+    return { requires: items, declared: true, error: null };
+  }
+  const block = /^requires:[ \t]*\n((?:[ \t]*-[ \t]*\S.*\n?)+)/m.exec(fm);
+  if (block) {
+    const items = block[1].split('\n')
+      .map((l) => /^[ \t]*-[ \t]*(.+?)[ \t]*$/.exec(l))
+      .filter(Boolean).map((x) => x[1].replace(/^['"]|['"]$/g, ''));
+    return { requires: items, declared: true, error: null };
+  }
+  if (/^requires:/m.test(fm)) {
+    // Present but unparseable — say so rather than reporting zero requirements,
+    // which would read as "declared, needs nothing" (the docs-entropy lesson: a
+    // scan that finds nothing must not be indistinguishable from a clean pass).
+    return { requires: [], declared: true, error: 'requires: is present but not a list ([a, b] or a dash list)' };
+  }
+  return { requires: [], declared: false, error: null };
+}
+
+// ---- what a skill's fenced commands imply it needs -------------------------
+// FENCED BLOCKS ONLY, and comments stripped. Prose that NAMES a command is
+// discussion — dev/SKILL.md forbids `git push origin main`, and an earlier draft
+// of this scan flagged it for saying so. A fenced line is an instruction to run.
+const SIGNALS = [
+  [/(?:^|[\s|(])node\s+scripts\/gds\/push-main\.js\b/m, 'push-credential'],
+  [/(?:^|[\s|(])git\s+push\s+origin\s+main\b/m, 'push-credential'],
+  [/(?:^|[\s|(])node\s+scripts\/gds\/go-live\.js\b/m, 'push-credential'],
+  [/(?:^|[\s|(])ssh\s+(?:-o\s+\S+\s+)?\S+@/m, 'droplet-ssh'],
+  [/~\/deploy\.sh/m, 'droplet-ssh'],
+  [/(?:^|[\s|(])node\s+scripts\/gds\/merge-lock\.js\b/m, 'main-checkout'],
+  [/(?:^|[\s|(])bash\s+scripts\/gds\/smoke-write\.sh\b/m, 'main-checkout'],
+  [/(?:^|[\s|(])gh\s+(?:auth|pr|secret|api|run|repo|workflow)\b/m, 'gh'],
+];
+
+function fencedCode(md) {
+  const fences = String(md || '').match(/```[a-z]*\n[\s\S]*?```/g) || [];
+  return fences
+    .map((f) => f.replace(/^```[a-z]*\n/, '').replace(/```$/, ''))
+    .join('\n')
+    .split('\n')
+    .map((l) => l.replace(/(^|\s)#.*$/, '$1')) // a shell comment is discussion
+    .join('\n');
+}
+
+function inferRequired(md) {
+  const code = fencedCode(md);
+  const out = new Set();
+  for (const [rx, cap] of SIGNALS) if (rx.test(code)) out.add(cap);
+  return [...out].sort();
+}
+
+// ---- the check ------------------------------------------------------------
+// Returns { ok, missing, unknown, checked }. `missing` is what came back FALSE —
+// the only thing the CLI prints, because the task's own wording is that the
+// preflight must name the MISSING capability, not recite the list.
+function preflight(requires, caps = CAPABILITIES) {
+  const missing = [];
+  const unknown = [];
+  const checked = [];
+  for (const name of requires) {
+    const cap = caps[name];
+    if (!cap) {
+      missing.push({ name, why: `unknown capability "${name}" — not in the registry (typo in the skill's requires:?)` });
+      continue;
+    }
+    let verdict;
+    try { verdict = cap.probe(); } catch (err) { verdict = null; }
+    checked.push(name);
+    if (verdict === false) missing.push({ name, why: cap.missing });
+    else if (verdict === null) unknown.push({ name, why: `could not confirm ${cap.what} — proceeding, but verify before a destructive step.` });
+  }
+  return { ok: missing.length === 0, missing, unknown, checked };
+}
+
+// A skill name is one path SEGMENT. Containment is checked rather than assumed:
+// `skill-preflight.js ../../../etc` would otherwise read outside .claude/skills.
+// Harmless today (a local, read-only CLI the caller could equally well `cat`), but
+// this helper is exactly the kind that gets reused somewhere less trusting.
+// Returns null for anything that is not a plain segment.
+function skillPath(name) {
+  const n = String(name || '');
+  if (!n || n !== path.basename(n) || n === '.' || n === '..') return null;
+  const full = path.join(REPO_ROOT, '.claude', 'skills', n, 'SKILL.md');
+  const base = path.join(REPO_ROOT, '.claude', 'skills') + path.sep;
+  return full.startsWith(base) ? full : null;
+}
+
+function preflightSkill(name, caps = CAPABILITIES) {
+  const p = skillPath(name);
+  if (!p) {
+    return { ok: false, requires: [], missing: [{ name: 'skill', why: `"${name}" is not a skill name — it must be a single directory name under .claude/skills/.` }], unknown: [], checked: [] };
+  }
+  let md;
+  try { md = fs.readFileSync(p, 'utf8'); } catch {
+    return { ok: false, missing: [{ name: 'skill', why: `no skill named "${name}" at .claude/skills/${name}/SKILL.md` }], unknown: [], checked: [] };
+  }
+  const { requires, error } = parseRequires(md);
+  if (error) return { ok: false, missing: [{ name: 'requires', why: `${name}: ${error}` }], unknown: [], checked: [] };
+  return { ...preflight(requires, caps), requires };
+}
+
+// ---- the assertion (fitness check 23) --------------------------------------
+// A skill whose FENCED commands need a capability must DECLARE it. This is the
+// part that stops the contract rotting: without it, a new ops step gets added to
+// a skill years from now and the declaration silently falls behind the commands.
+//
+// It compares inferRequired() (what the fenced commands imply) against
+// parseRequires() (what the frontmatter claims) and reds the build on a gap. It
+// does NOT complain about a skill declaring MORE than its fences imply — a human
+// knows things the scan cannot see, and punishing an over-declaration would train
+// people to declare less.
+const SKILLS_DIR = path.join(REPO_ROOT, '.claude', 'skills');
+
+function checkOpsSkillsDeclareMachine({ dir = SKILLS_DIR, read = null, names: injected = null } = {}) {
+  const violations = [];
+  const warnings = [];
+  let names = injected;
+  if (!names) {
+    try {
+      names = fs.readdirSync(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
+    } catch { names = []; }
+  }
+  // A scan that enumerates nothing must fail, not pass (the docs-entropy lesson).
+  if (!names.length) {
+    return {
+      name: 'ops skills declare the machine they need (G03)',
+      ok: false, hardFail: true,
+      violations: ['scan defect — enumerated 0 skills under .claude/skills/.'],
+      warnings: [], note: 'static scan of skill frontmatter vs the commands each skill actually fences.',
+    };
+  }
+  const readOne = read || ((n) => {
+    try { return fs.readFileSync(path.join(dir, n, 'SKILL.md'), 'utf8'); } catch { return null; }
+  });
+
+  let declaring = 0;
+  for (const n of names) {
+    const md = readOne(n);
+    if (md === null) continue;
+    const { requires, error } = parseRequires(md);
+    if (error) { violations.push(`${n}: ${error}`); continue; }
+    if (requires.length) declaring += 1;
+    for (const r of requires) {
+      if (!CAPABILITIES[r]) {
+        violations.push(`${n} declares an unknown capability "${r}" — it can never be probed, so the declaration is decorative. Registry: ${Object.keys(CAPABILITIES).join(', ')}.`);
+      }
+    }
+    // DECLARING is not ENFORCING. planning-session shipped a `requires:` with no
+    // preflight call, which is the same shape as the original bug: a contract
+    // stated where nothing checks it. If a skill names a machine, it must also
+    // run the check (the grader caught this one on the first pass).
+    if (requires.length && !/skill-preflight\.js\s+\S/.test(md)) {
+      violations.push(
+        `${n} declares requires: [${requires.join(', ')}] but never runs \`node scripts/gds/skill-preflight.js ${n}\`. `
+        + 'A declaration nothing enforces is prose, and prose cannot refuse — the exact failure this check exists for.'
+      );
+    }
+    const inferred = inferRequired(md);
+    const undeclared = inferred.filter((c) => !requires.includes(c));
+    if (undeclared.length) {
+      violations.push(
+        `${n} fences commands needing [${undeclared.join(', ')}] but does not declare them. `
+        + 'Add them to `requires:` in the frontmatter so the preflight can refuse early — '
+        + 'prose cannot refuse, which is how /merge-mode came to be run on a dev box (task 1003167).'
+      );
+    }
+  }
+  return {
+    name: 'ops skills declare the machine they need (G03)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings,
+    note: `${names.length} skill(s) scanned; ${declaring} declare a machine contract. A skill whose FENCED commands need gh / a main checkout / a push credential / the deploy host must name it in \`requires:\`, so \`node scripts/gds/skill-preflight.js <skill>\` can refuse before the procedure starts. Prose in a skill body cannot refuse.`,
+  };
+}
+
+function main() {
+  const name = process.argv[2];
+  if (!name || name.startsWith('--')) {
+    console.error('usage: node scripts/gds/skill-preflight.js <skill-name>');
+    console.error('  exits 1 naming the capability this machine is MISSING for that skill.');
+    process.exit(2);
+  }
+  const r = preflightSkill(name);
+  for (const u of r.unknown) console.error(`?  ${u.name}: ${u.why}`);
+  if (r.ok) {
+    console.log(`preflight OK — ${name}: ${r.checked.length ? r.checked.join(', ') : 'no machine requirements declared'}.`);
+    process.exit(0);
+  }
+  console.error(`STOP — /${name} cannot run on this machine.`);
+  for (const m of r.missing) console.error(`✗  ${m.name}: ${m.why}`);
+  process.exit(1);
+}
+
+if (require.main === module) main();
+
+module.exports = {
+  CAPABILITIES, SIGNALS,
+  parseRequires, inferRequired, fencedCode,
+  preflight, preflightSkill, skillPath, checkOpsSkillsDeclareMachine,
+  ghAuthed, binaryPresent,
+};

package/src/module-api.js

@@ -1057,8 +1057,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.313 with no explicit bump. run 32668599111. (task 1002620)
 //   1.19.315 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.314 with no explicit bump. run 32668969037. (task 1002620)
+//   1.19.316 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.315 with no explicit bump. run 32669347711. (task 1002620)
+//   1.19.317 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.316 with no explicit bump. run 32669571610. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.315'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.317'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auto_satisfy_criteria.mjs

@@ -34,7 +34,7 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
-import { makeRunner } from './helpers.mjs';
+import { makeRunner, lifecycleDbSource } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
@@ -113,7 +113,8 @@ await test('EXEC: every write goes through the caller-supplied exec (so a ship t
 });
 
 await test('EXEC: shipTask passes its transaction CLIENT, and the reconciler passes the pool', () => {
-  const db = readFileSync(new URL('../modules/lifecycle/db.js', import.meta.url), 'utf8');
+  // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+  const db = lifecycleDbSource();
   // db.js is over the fitness oversize threshold, so the hook is ONE line there
   // and its body lives in done-when.closeCompletedWorkForShip. What must hold is
   // that the thing handed in is the txn client, not a pool.

package/tests/dependencies_migration.mjs

@@ -13,7 +13,7 @@ import { strict as assert } from 'node:assert';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
-import { makeRunner } from './helpers.mjs';
+import { makeRunner, lifecycleDbSource } from './helpers.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const repoRoot = join(__dirname, '..');
@@ -22,7 +22,8 @@ const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
 const mig = read('migrations', '163_polymorphic_dependencies.sql');
 const migN = mig.replace(/\s+/g, ' ');
 // the task-dependency CRUD + the claim-gate slice carved to the lifecycle module at BV1.R86.
-const dbSrc = read('modules', 'lifecycle', 'db.js');
+// task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+const dbSrc = lifecycleDbSource();
 
 const { test, summary } = makeRunner();
 

package/tests/fitness.mjs

@@ -542,6 +542,49 @@ test('identity gate skips comments + instance-injected tokens (no false positive
   assert.equal(scanPromptIdentity('x.html', '<title>{{worldName}} — the gate</title>').length, 0, 'a {{worldName}} token carries no literal');
 });
 
+// task 1002756 — the two holes that let migrate.sh's founder DB default survive:
+// (1) the stripper could be OPENED by a `/*` inside a `//` line comment (a real
+// `*/` hundreds of lines later then swallowed everything between — provision.js
+// lost ~330 lines from the scanned text), and (2) whole file classes were never
+// scanned. These lock the stripper; the root widening is pinned by the note test.
+test('identity gate: a /* inside a line comment cannot open a phantom block (task 1002756)', () => {
+  const { scanPromptIdentity } = fitness;
+  const src = [
+    '// glob note: import <dir>/*.caddy',        // the phantom opener shape
+    'const leak = "amazonprimea.example";',      // must STILL be seen
+    'doThing();',
+    '/* a real block */ const ok = 1;',
+  ].join('\n');
+  assert.equal(scanPromptIdentity('x.js', src).length, 1, 'the literal after a /*-bearing line comment must be caught');
+});
+
+test('identity gate: a // inside a block comment does not truncate the block', () => {
+  const { scanPromptIdentity } = fitness;
+  const src = [
+    '/* rationale: see https://amazonprimea.com — historical // note',
+    'still inside the block, amazonprimea again',
+    '*/',
+    'const clean = 1;',
+  ].join('\n');
+  assert.equal(scanPromptIdentity('x.js', src).length, 0, 'comment prose naming the brand must not trip the scan');
+});
+
+test('identity gate: comment markers inside strings and regex literals are inert', () => {
+  const { scanPromptIdentity } = fitness;
+  // A string containing /* must not open a comment that hides a later literal…
+  assert.equal(scanPromptIdentity('x.js', 'const g = "src/*.js";\nconst leak = "amazonprimea";').length, 1);
+  // …a regex containing the brand is code and IS caught (the detectors carve out their own hits)…
+  assert.equal(scanPromptIdentity('x.js', 'const re = /amazonprimea/i;').length, 1);
+  // …and a division sign is not mistaken for a regex opener that swallows code.
+  assert.equal(scanPromptIdentity('x.js', 'const x = a / b / c;\nconst leak = "amazonprimea";').length, 1);
+});
+
+test('identity gate scans the WHOLE scripts/ root, not just scripts/gds (task 1002756)', () => {
+  const r = fitness.checkKernelPromptsNoHardcodedIdentity();
+  assert.match(r.note, /scripts\/\*\* \(whole root/, 'note must document the widened root');
+  assert.equal(r.hardFail, false, 'live tree must be clean under the widened scan:\n' + r.violations.join('\n'));
+});
+
 // --- write-route validation build check (BV1.R12 / task 1999, ADR 0118) ---
 
 test('write-route validation check: the live tree is clean (R11 sweep reached 100%)', () => {

package/tests/goal_abuse_matrix.mjs

@@ -46,7 +46,7 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
-import { makeRunner } from './helpers.mjs';
+import { makeRunner, lifecycleDbSource } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 
@@ -201,7 +201,8 @@ await test('[Q6] non-member on a public PROTECTED-scope goal → action=apply (s
   assert.equal(r.action, 'apply', 'a protected-scope goal is never offered as open-join');
 });
 await test('[Q7] source contract: BOTH INSERT INTO claims sites run the extracted gate (batch cannot bypass)', () => {
-  const dbSrc = readFileSync(new URL('../modules/lifecycle/db.js', import.meta.url), 'utf8');
+  // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+  const dbSrc = lifecycleDbSource();
   const insertSites = dbSrc.match(/INSERT INTO claims \(/g) || [];
   assert.equal(insertSites.length, 2, 'exactly two claim-insert sites (claimTask + claimTasksBatch) — a third needs the gate too');
   const gateCalls = dbSrc.match(/await goalMembershipFailures\(/g) || [];

package/tests/goal_advisory.mjs

@@ -17,7 +17,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
 import http from 'node:http';
-import { makeRunner } from './helpers.mjs';
+import { makeRunner, lifecycleDbSource } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 
@@ -25,7 +25,8 @@ const require = createRequire(import.meta.url);
 const { adviseGoal, candidateGoals, generalGoalTitle, buildGoalAdvisory } = require('../modules/lifecycle/goal-advisory.js');
 
 const tasksSrc = readFileSync(new URL('../modules/lifecycle/routes/tasks.js', import.meta.url), 'utf8');
-const dbSrc = readFileSync(new URL('../modules/lifecycle/db.js', import.meta.url), 'utf8');
+// task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+const dbSrc = lifecycleDbSource();
 const { test, summary } = makeRunner();
 
 const V = 'BONGOS-V1';

package/tests/government_claim_eligibility.mjs

@@ -37,6 +37,7 @@ const LIFECYCLE = path.join(ROOT, 'modules', 'lifecycle');
 const eligibility = require(path.join(LIFECYCLE, 'claim-eligibility.js'));
 const db = require(path.join(LIFECYCLE, 'db.js'));
 const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
+import { lifecycleDbSource } from './helpers.mjs';
 
 const { CLAIM_ANY, CLAIM_NEWCOMER, permissionAllowsClaim, claimEligibilityAllows } = eligibility;
 
@@ -147,7 +148,8 @@ test('the permission predicate cannot see requires_rank at all (structural)', ()
 });
 
 test('every claim path in db.js still gates on requires_rank as its own check', () => {
-  const src = fs.readFileSync(path.join(LIFECYCLE, 'db.js'), 'utf8');
+  // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+  const src = lifecycleDbSource();
   // claimTask, claimTasksBatch, validateClaimBatch — three call sites, three
   // separate rankAllowsTask conjuncts. If a refactor ever folds the floor into the
   // permission predicate, this count drops and the test reds.

package/tests/government_rank_sync.mjs

@@ -18,6 +18,7 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { lifecycleDbSource } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -189,8 +190,14 @@ test('the writer runs on the CALLER\'s transaction client when given one', () =>
 });
 
 test('both rank-change twins rotate the role inside their transaction', () => {
-  for (const rel of ['src/bongos/db.js', 'modules/lifecycle/db.js']) {
-    const src = fs.readFileSync(path.join(ROOT, rel), 'utf8');
+  // task 1003204: the lifecycle twin moved out of db.js into db-rank-authz.js
+  // when the monolith was carved up. Read the whole lifecycle family so the
+  // assertion follows the code instead of a filename.
+  const twins = [
+    ['src/bongos/db.js', fs.readFileSync(path.join(ROOT, 'src/bongos/db.js'), 'utf8')],
+    ['modules/lifecycle/db-*.js', lifecycleDbSource()],
+  ];
+  for (const [rel, src] of twins) {
     const body = src.slice(src.indexOf('async function _applyRankChangeTx'));
     const upd = body.indexOf('UPDATE builders SET rank');
     const sync = body.indexOf('await syncGovernanceRankRole(client');

package/tests/helpers.mjs

@@ -123,3 +123,22 @@ export function requireHostModule(require, spec, note) {
     throw err;
   }
 }
+
+// lifecycleDbSource — the LIFECYCLE data layer as one source string.
+//
+// task 1003204 (goal 1000079) split the 5,748-line modules/lifecycle/db.js into
+// db.js (a pure re-export facade) + twelve cohesive db-*.js units. A pile of
+// tests assert things about "the data layer" by regexing its source — that the
+// claim paths gate on requires_rank, that a literal appears in exactly one
+// place, that dependency CRUD points at the right table. Those assertions were
+// always about the LAYER, not about one filename, so they read the whole family
+// here. Reading the family (rather than repointing each test at whichever db-*
+// unit happens to hold the code today) also means a future re-carve moves code
+// between units without silently disarming the assertion.
+export function lifecycleDbSource(modulesDir = path.join(ROOT, 'modules')) {
+  const dir = path.join(modulesDir, 'lifecycle');
+  const files = fs.readdirSync(dir)
+    .filter((f) => f === 'db.js' || (f.startsWith('db-') && f.endsWith('.js')))
+    .sort();
+  return files.map((f) => fs.readFileSync(path.join(dir, f), 'utf8')).join('\n');
+}

package/tests/migration_allocation.mjs

@@ -28,6 +28,7 @@ import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 import { createRequire } from 'node:module';
+import { lifecycleDbSource } from './helpers.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const repoRoot = join(__dirname, '..');
@@ -49,7 +50,8 @@ async function test(name, fn) {
 const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
 const migrationSql = read('migrations', '081_tasks_needs_migration.sql');
 // the tasks db slice + the tasks route carved to modules/lifecycle/ at BV1.R86.
-const dbSrc = read('modules', 'lifecycle', 'db.js');
+// task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+const dbSrc = lifecycleDbSource();
 const routesSrc = read('modules', 'lifecycle', 'routes', 'tasks.js');
 const captureSrc = read('scripts', 'gds', 'capture.js');
 

package/tests/publish_reconciler.mjs

@@ -16,6 +16,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const reconciler = require('../modules/lifecycle/publish-reconciler.js');
+import { lifecycleDbSource } from './helpers.mjs';
 
 let passed = 0;
 let failed = 0;
@@ -1647,7 +1648,8 @@ test('vector 2: shipped_at is stamped ONLY by shipTask, and shipTask requires co
   const url = await import('node:url');
   const path = await import('node:path');
   const ROOT = path.dirname(path.dirname(url.fileURLToPath(import.meta.url)));
-  const dbSrc = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/db.js'), 'utf8');
+  // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+  const dbSrc = lifecycleDbSource();
 
   // Every statement that writes shipped_at, ignoring SELECT projections and comments.
   const writes = [...dbSrc.matchAll(/shipped_at\s*=\s*now\(\)/g)];

package/tests/rank_gate.mjs

@@ -26,6 +26,7 @@ const require = createRequire(import.meta.url);
 const auth = require('../src/bongos/auth.js');
 const db = require('../modules/lifecycle/db.js');
 const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+import { lifecycleDbSource } from './helpers.mjs';
 
 let passed = 0;
 let failed = 0;
@@ -319,7 +320,8 @@ console.log('\nlistClaimableTasks SQL rank-tier CASE (regression: thetes drift):
 
 const __dir = dirname(fileURLToPath(import.meta.url));
 // listClaimableTasks carved to the lifecycle module at BV1.R86 — read the SQL there.
-const dbSrc = readFileSync(join(__dir, '..', 'modules', 'lifecycle', 'db.js'), 'utf8');
+// task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+const dbSrc = lifecycleDbSource();
 
 t('every live rank appears in the claimable CASE at its REQUIRES_RANK_TIER value', () => {
   // Isolate the listClaimableTasks function body so we don't match CASE

package/tests/reward_gate.mjs

@@ -25,6 +25,7 @@ const db = require('../modules/lifecycle/db.js');
 // the SAME singleton object db.js captured, so mutating its .query stubs the INSERT
 // createTask runs — no database needed.
 const sharedPool = require('../src/module-api.js').pool;
+import { lifecycleDbSource } from './helpers.mjs';
 
 const __dir = dirname(fileURLToPath(import.meta.url));
 const root = join(__dir, '..');
@@ -132,7 +133,8 @@ t('null task is a no-op (no throw, no assignment)', () => {
 console.log('\nenforcement points (source-wiring — AUTO-ASSIGN):');
 
 const tasksRouteSrc = readFileSync(join(root, 'modules/lifecycle/routes/tasks.js'), 'utf8');
-const dbSrc = readFileSync(join(root, 'modules/lifecycle/db.js'), 'utf8');
+// task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
+const dbSrc = lifecycleDbSource();
 const migration178 = readFileSync(join(root, 'migrations/178_reward_gate_auto_assign_revert_autopromote.sql'), 'utf8');
 
 t('promote route AUTO-ASSIGNS then proceeds (no 409 refusal for missing reward)', () => {