@bongos/core 1.19.332 → 1.19.334

package/src/bongos/routes/auth.js

@@ -21,6 +21,9 @@ function escapeHtml(s) {
 //   subtitle — replaces the default header sub-line
 //   cta      — { href, label } for the primary button (default: retry sign-in)
 //   note     — replaces the default troubleshooting footnote
+//   startHref — the retry sign-in URL (default: a bare /auth/web/start); the
+//              callback passes recoveryStartHref(req) so the founder's return
+//              target + repo-scope opt-in survive the error (task 1003234)
 // The instance's own word for the admitting rank, for per-branch error strings
 // (task 1002616, the 1439 follow-up): core error surfaces never hardcode
 // "Archon" — a non-OTB instance names its own role (branding rankLabels.archon;
@@ -51,7 +54,7 @@ function renderAuthErrorPage(heading, detail, opts = {}) {
     catch { return AUTH_ERROR_FALLBACK; }
   })();
   const subtitle = opts.subtitle || copy.subtitle;
-  const cta = opts.cta || { href: '/api/gds/auth/web/start', label: copy.ctaLabel };
+  const cta = opts.cta || { href: opts.startHref || '/api/gds/auth/web/start', label: copy.ctaLabel };
   const note = opts.note || "If this keeps happening, the GitHub OAuth app's authorized callback URL may be misconfigured. See docs/recipes/ops-gotchas.md (GitHub OAuth section).";
   // The instance name in the tab title comes from the branding pack, never a
   // hardcoded host brand — a non-OTB instance sees its own name (ADR 0062 §3).
@@ -100,7 +103,7 @@ function renderAuthErrorPage(heading, detail, opts = {}) {
 //
 // Branding resolves defensively, exactly as renderAuthErrorPage does — a
 // branding hiccup must degrade to neutral copy, never crash the page.
-function renderAccessPendingPage(login) {
+function renderAccessPendingPage(login, startHref) {
   const worldName = (() => { try { return branding().identity?.worldName || 'The city'; } catch { return 'The city'; } })();
   const epigraph = (() => { try { return branding().copy?.authError?.epigraph || '— access —'; } catch { return '— access —'; } })();
   // The probe takes the login as a query param; everything interpolated into
@@ -124,7 +127,7 @@ function renderAccessPendingPage(login) {
 </header>
 <main>
   <section class="scroll">
-    <div class="landing" id="pending" data-login="${safeLogin}">
+    <div class="landing" id="pending" data-login="${safeLogin}" data-start="${escapeHtml(startHref || '/api/gds/auth/web/start')}">
       <p>We're checking your access now. You'll be signed in automatically as soon as it clears — no need to refresh.</p>
       <p class="landing__note" id="pending-note">Checking…</p>
     </div>
@@ -135,11 +138,14 @@ function renderAccessPendingPage(login) {
   var el = document.getElementById('pending');
   var note = document.getElementById('pending-note');
   var login = el ? el.getAttribute('data-login') : '';
+  /* server-built from the still-valid handshake cookies (task 1003234): the
+     fresh sign-in keeps the wizard return + repo scope a founder started with */
+  var start = (el && el.getAttribute('data-start')) || '/api/gds/auth/web/start';
   var EVERY_MS = 3000;
   var GIVE_UP_MS = 5 * 60 * 1000;
   var started = Date.now();
 
-  function land() { window.location.href = '/api/gds/auth/web/start'; }
+  function land() { window.location.href = start; }
 
   function tick() {
     if (Date.now() - started > GIVE_UP_MS) {
@@ -180,6 +186,18 @@ const RETURN_COOKIE = 'gds_return';
 // include repo") means an ordinary hall sign-in never stores a token, even for a
 // user who previously granted the broader scope (task 1002099 / ADR 0143).
 const REPOS_COOKIE = 'gds_oauth_repos';
+// How long the three /auth/web/start handshake cookies live — the CSRF state,
+// the return target and the repo-scope opt-in — and they MUST move together:
+// a state that outlives its return cookie lands a founder on the default
+// landing with no repo scope, and a return that outlives its state lands them
+// on "State mismatch". They were 10 minutes each, the hall builder's
+// timescale; a founder's first sign-in can include a GitHub SIGNUP (email
+// verification and all) and came back past 10 minutes with all three gone
+// (walk finding, task 1003234). 30 minutes is a security-posture change,
+// deliberately modest: the state is still single-use (the callback clears it),
+// still httpOnly + sameSite=lax, and the code GitHub hands back is still the
+// bearer — only the window in which a legitimate handshake may complete grew.
+const HANDSHAKE_COOKIE_MS = 30 * 60 * 1000;
 
 // The apex domain the instance is served under, read from the instance branding
 // pack's cookieDomain (".amazonprimea.com" → "amazonprimea.com",
@@ -253,6 +271,21 @@ function safeReturnTo(raw) {
   return null;
 }
 
+// The sign-in-again door on every OAuth error page (and the pending page's
+// auto-walk-in), rebuilt from the handshake cookies that are still valid: the
+// return target and the repo-scope opt-in that /auth/web/start stashed. A bare
+// /auth/web/start dropped both, so a founder who hit "State mismatch" from the
+// wizard came back with no repository access and landed on the default
+// landing (task 1003234). Same open-redirect allowlist as the callback.
+function recoveryStartHref(req) {
+  const params = new URLSearchParams();
+  const returnTo = safeReturnTo(parseCookie(req, RETURN_COOKIE));
+  if (returnTo) params.set('return', returnTo);
+  if (parseCookie(req, REPOS_COOKIE) === '1') params.set('repos', '1');
+  const q = params.toString();
+  return '/api/gds/auth/web/start' + (q ? '?' + q : '');
+}
+
 // The canonical sign-in origin, read from the instance branding pack (oauthOrigin,
 // else publicOrigin) so a non-OTB Cloud Bongos instance pins its OAuth redirects to
 // ITS OWN apex instead of a hardcoded "amazonprimea.com" (ADR 0062 §3/§5; the
@@ -422,7 +455,7 @@ module.exports = function buildAuthRouter() {
       httpOnly: true,
       sameSite: 'lax',
       secure: req.secure || req.headers['x-forwarded-proto'] === 'https',
-      maxAge: 10 * 60 * 1000,
+      maxAge: HANDSHAKE_COOKIE_MS,
       // Apex-scoped (#734) so the state survives the host switch: start may run
       // on the subdomain but the callback always lands on the apex.
       ...sessionCookieDomainOpts(req),
@@ -438,7 +471,7 @@ module.exports = function buildAuthRouter() {
         httpOnly: true,
         sameSite: 'lax',
         secure: req.secure || req.headers['x-forwarded-proto'] === 'https',
-        maxAge: 10 * 60 * 1000,
+        maxAge: HANDSHAKE_COOKIE_MS,
         ...sessionCookieDomainOpts(req),
       });
     }
@@ -453,7 +486,7 @@ module.exports = function buildAuthRouter() {
         httpOnly: true,
         sameSite: 'lax',
         secure: req.secure || req.headers['x-forwarded-proto'] === 'https',
-        maxAge: 10 * 60 * 1000,
+        maxAge: HANDSHAKE_COOKIE_MS,
         ...sessionCookieDomainOpts(req),
       });
     }
@@ -519,12 +552,14 @@ module.exports = function buildAuthRouter() {
       return res.status(400).type('text/html').send(renderAuthErrorPage(
         'GitHub refused the handshake',
         `GitHub returned the error code "${error}". This usually means the OAuth app's authorized callback URL doesn't include this server's /api/gds/auth/web/callback path.`,
+        { startHref: recoveryStartHref(req) },
       ));
     }
     if (!code || !state || state !== expectedState) {
       return res.status(400).type('text/html').send(renderAuthErrorPage(
         'State mismatch',
-        'The handshake-cookie did not match the state GitHub returned. This usually means the sign-in took too long (cookie expired after 10 minutes) or the request crossed an origin boundary. Start over and sign in again.',
+        `The handshake-cookie did not match the state GitHub returned. This usually means the sign-in took too long (the cookie expires after ${HANDSHAKE_COOKIE_MS / 60000} minutes) or the request crossed an origin boundary. Start over and sign in again.`,
+        { startHref: recoveryStartHref(req) },
       ));
     }
     try {
@@ -604,15 +639,21 @@ module.exports = function buildAuthRouter() {
           console.error('[gds] web/callback admission classify', probeErr);
         }
         if (expectedSoon) {
-          return res.status(202).type('text/html').send(renderAccessPendingPage(err.login));
+          return res.status(202).type('text/html').send(renderAccessPendingPage(err.login, recoveryStartHref(req)));
         }
+        // The founder-shaped branch (only reachable with open enrollment OFF):
+        // a stranger who was on their way to create a project is told the
+        // approval brings them back to it — the return cookie says where.
+        const founderReturn = safeReturnTo(parseCookie(req, RETURN_COOKIE)) || '';
+        const onWayToProject = founderReturn.startsWith('/projects');
         return res.status(403).type('text/html').send(renderAuthErrorPage(
           'This account is not approved yet',
           `Signing in with GitHub is only for builders the ${admitterLabel()} has already approved. If you are new, request access at the builders’ hall — once the ${admitterLabel()} approves you, this sign-in will let you in. If you were just approved, it may take a moment to be marked invited; try again shortly.`,
           {
             subtitle: 'Sign-in is for approved builders. New here? Request access first.',
             cta: { href: '/builders', label: 'Go to the hall & request access' },
-            note: `Already approved and still blocked? Ask the ${admitterLabel()} to confirm your request was marked “invited.”`,
+            note: (onWayToProject ? 'You were on your way to creating a project — once approved, sign in again and you land back in it. ' : '') +
+              `Already approved and still blocked? Ask the ${admitterLabel()} to confirm your request was marked “invited.”`,
           },
         ));
       }
@@ -620,6 +661,7 @@ module.exports = function buildAuthRouter() {
       res.status(500).type('text/html').send(renderAuthErrorPage(
         'The handshake threw an error',
         `The server tried to exchange the auth code for a session and something went wrong: ${err.message}. Try again; if it persists, ask the ${admitterLabel()} to investigate the server logs.`,
+        { startHref: recoveryStartHref(req) },
       ));
     }
   });
@@ -1080,6 +1122,8 @@ module.exports = function buildAuthRouter() {
 // cookie-domain decision — worth locking down independently of a running server.
 module.exports.safeReturnTo = safeReturnTo;
 module.exports.postLoginLanding = postLoginLanding;
+module.exports.recoveryStartHref = recoveryStartHref;
+module.exports.HANDSHAKE_COOKIE_MS = HANDSHAKE_COOKIE_MS;
 module.exports.sessionCookieDomainOpts = sessionCookieDomainOpts;
 module.exports.reqHost = reqHost;
 // The auth-error page renderer (task 1439): pure over the branding pack, so a

package/src/module-api.js

@@ -1091,8 +1091,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.330 with no explicit bump. run 32791877167. (task 1002620)
 //   1.19.332 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.331 with no explicit bump. run 32793033453. (task 1002620)
+//   1.19.333 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.332 with no explicit bump. run 32793666555. (task 1002620)
+//   1.19.334 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.333 with no explicit bump. run 32794305277. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.332'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.334'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_admission_gate.mjs

@@ -13,6 +13,7 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
+import { authSource } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const auth = require('../src/bongos/auth.js');
@@ -150,7 +151,8 @@ t('no login passed (legacy callers) behaves exactly as before — BLOCKED', () =
 console.log('\nfirstTimeAdmissionBlocked — every call-site passes `login` (SR-19 non-drift, #1970):');
 
 t('completeWebFlow + pollDeviceFlow both pass `login` to the gate', () => {
-  const src = readFileSync(new URL('../src/bongos/auth.js', import.meta.url), 'utf8');
+  // task 1003206: the auth flows are auth.js + auth-*.js now — read the family.
+  const src = authSource();
   const re = /firstTimeAdmissionBlocked\s*\(\s*\{[^}]*\}/g;
   const callSites = [];
   for (let m = re.exec(src); m; m = re.exec(src)) {

package/tests/auth_web_recovery.mjs

@@ -0,0 +1,63 @@
+// tests/auth_web_recovery.mjs — founder-shaped OAuth recovery (task 1003234,
+// goal 1000058). The walk found that every OAuth error page's "try again" door
+// was a bare /auth/web/start — dropping the wizard's return target and the
+// repo-scope opt-in — and that the three handshake cookies expired at 10
+// minutes, i.e. mid GitHub signup. Both are pinned here: the pure helper by
+// value, the call sites and the shared lifetime by reading the source.
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const authRoutes = require(path.join(ROOT, 'src/bongos/routes/auth.js'));
+const { recoveryStartHref, HANDSHAKE_COOKIE_MS } = authRoutes;
+const SRC = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/auth.js'), 'utf8').replace(/\r\n/g, '\n');
+const req = (cookie) => ({ headers: cookie ? { cookie } : {} });
+
+test('the retry door carries the wizard return and the repo-scope opt-in while their cookies are valid', () => {
+  assert.equal(recoveryStartHref(req('gds_return=%2Fprojects%3Fview%3Dnew; gds_oauth_repos=1')),
+    '/api/gds/auth/web/start?return=%2Fprojects%3Fview%3Dnew&repos=1');
+  assert.equal(recoveryStartHref(req('gds_return=%2Fprojects%3Fview%3Dnew')),
+    '/api/gds/auth/web/start?return=%2Fprojects%3Fview%3Dnew', 'a hall sign-in never asks for repos');
+  assert.equal(recoveryStartHref(req('gds_oauth_repos=1')), '/api/gds/auth/web/start?repos=1');
+});
+
+test('with nothing left to rebuild from, the door is the bare start — never a guess', () => {
+  assert.equal(recoveryStartHref(req('')), '/api/gds/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_session=abc')), '/api/gds/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_oauth_repos=0')), '/api/gds/auth/web/start', 'only the literal opt-in counts');
+});
+
+test('the door is under the same open-redirect allowlist as the callback', () => {
+  assert.equal(recoveryStartHref(req('gds_return=https%3A%2F%2Fevil.example%2Fx')), '/api/gds/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_return=%2F%2Fevil.example')), '/api/gds/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_return=javascript%3Aalert(1)')), '/api/gds/auth/web/start');
+});
+
+test('every OAuth error page and the pending page rebuild their door from the cookies', () => {
+  const start = SRC.indexOf("router.get('/auth/web/callback'");
+  const end = SRC.indexOf("router.get('/auth/discord/start'");
+  const callback = SRC.slice(start, end);
+  assert.equal((callback.match(/\{ startHref: recoveryStartHref\(req\) \}/g) || []).length, 3,
+    'GitHub refused · State mismatch · handshake threw — three pages, three doors');
+  assert.match(callback, /renderAccessPendingPage\(err\.login, recoveryStartHref\(req\)\)/, 'the auto-walk-in lands where the founder was going');
+  assert.match(callback, /const onWayToProject = founderReturn\.startsWith\('\/projects'\);/, 'the founder-shaped NOT_APPROVED note');
+  assert.match(SRC, /const cta = opts\.cta \|\| \{ href: opts\.startHref \|\| '\/api\/gds\/auth\/web\/start', label: copy\.ctaLabel \};/);
+  assert.match(SRC, /data-start="\$\{escapeHtml\(startHref \|\| '\/api\/gds\/auth\/web\/start'\)\}"/, 'the pending page reads its start from a data attribute, never string-built into script');
+  assert.match(SRC, /function land\(\) \{ window\.location\.href = start; \}/);
+});
+
+test('the three handshake cookies share one lifetime, long enough for a GitHub signup', () => {
+  assert.equal(HANDSHAKE_COOKIE_MS, 30 * 60 * 1000);
+  const start = SRC.indexOf("router.get('/auth/web/start'");
+  const end = SRC.indexOf("router.get('/auth/web/admission-status'");
+  const block = SRC.slice(start, end);
+  assert.equal((block.match(/maxAge: HANDSHAKE_COOKIE_MS,/g) || []).length, 3, 'state · return · repos');
+  assert.doesNotMatch(block, /maxAge: 10 \* 60 \* 1000/, 'no handshake cookie is left on the old clock');
+  assert.match(SRC, /the cookie expires after \$\{HANDSHAKE_COOKIE_MS \/ 60000\} minutes/, 'the State-mismatch copy reads the same constant');
+});

package/tests/est_advisory.mjs

@@ -30,6 +30,7 @@
 import { strict as assert } from 'node:assert';
 import fs from 'node:fs';
 import { createRequire } from 'node:module';
+import { taskRoutesSource } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const { adviseEstimate, pickRatio, buildEstAdvisory, MIN_MATERIAL_DELTA, SCALE_OK_RATIO } =
@@ -171,7 +172,8 @@ await t('the route attaches est_advisory to the 201 body, non-blocking', () => {
   // literal because modules/lifecycle/routes/tasks.js is over the size ratchet's
   // cap and main sits exactly AT the baseline — so this feature had to land at
   // net-zero lines in that file. Asserting the shape keeps the fold honest.
-  const src = fs.readFileSync(new URL('../modules/lifecycle/routes/tasks.js', import.meta.url), 'utf8');
+  // task 1003206: the task router is tasks.js + task-*.js now — read the family.
+  const src = taskRoutesSource();
   const body201 = (src.match(/res\.status\(201\)\.json\(\{[\s\S]*?\}\);/) || [''])[0];
   assert.ok(body201, 'found the 201 response body');
   assert.match(body201, /est_advisory:/, 'est_advisory rides the create response');

package/tests/goal_advisory.mjs

@@ -17,14 +17,15 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
 import http from 'node:http';
-import { makeRunner, lifecycleDbSource } from './helpers.mjs';
+import { makeRunner, lifecycleDbSource, taskRoutesSource } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 
 const require = createRequire(import.meta.url);
 const { adviseGoal, candidateGoals, generalGoalTitle, buildGoalAdvisory } = require('../modules/lifecycle/goal-advisory.js');
 
-const tasksSrc = readFileSync(new URL('../modules/lifecycle/routes/tasks.js', import.meta.url), 'utf8');
+// task 1003206: the task router is tasks.js + task-*.js now — read the family.
+const tasksSrc = taskRoutesSource();
 // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
 const dbSrc = lifecycleDbSource();
 const { test, summary } = makeRunner();

package/tests/goal_criterion_confirm_ui.mjs

@@ -40,6 +40,11 @@ const TASK_LIB_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/tas
 // task 1003135: the page's pure presentational helpers moved to goals-lib.js
 // (window.OTBGoalsLib) — run the REAL file too, same reasoning as task-lib above.
 const GOALS_LIB_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/goals-lib.js'), 'utf8');
+// task 1003206: the page's view painters moved to goals-render.js
+// (window.OTBGoalsRender) — the second half of the same carve. Run the REAL file
+// too, for the same reason: this is the only test that executes either board, so
+// stubbing the renderers would let them rot unwatched.
+const GOALS_RENDER_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/goals-render.js'), 'utf8');
 
 const { test, summary } = makeRunner();
 
@@ -136,6 +141,7 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
   vm.createContext(sandbox);
   vm.runInContext(TASK_LIB_SRC, sandbox, { filename: 'task-lib.js' });
   vm.runInContext(GOALS_LIB_SRC, sandbox, { filename: 'goals-lib.js' });
+  vm.runInContext(GOALS_RENDER_SRC, sandbox, { filename: 'goals-render.js' });
   vm.runInContext(SRC, sandbox, { filename: 'goals-page.js' });
 
   // Let boot()'s promise chain settle (me → goals → details → route → render).

package/tests/goal_subtitle.mjs

@@ -18,6 +18,7 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { goalsPageSource } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -179,9 +180,11 @@ test('an unset subtitle is hidden; a set one is shown trimmed', () => {
 });
 
 test('on a LIST the subtitle is a tooltip, never a second visible line', () => {
-  const js = read('modules', 'hall-ui', 'public', 'goals-page.js');
+  // task 1003206: the row/card painters moved to goals-render.js — the second half
+  // of the carve goals-lib.js began — so read the family, not one filename.
+  const js = goalsPageSource();
   // The helper lives in goals-lib.js — the file that exists because
-  // goals-page.js is over the excess-lines ratchet (task 1003135).
+  // goals-page.js was over the excess-lines ratchet (task 1003135).
   const lib = read('modules', 'hall-ui', 'public', 'goals-lib.js');
   assert.match(lib, /function subtitleAttr/);
   assert.match(lib, /escapeHtml\(t\)/, 'escaped, since it lands in an attribute');

package/tests/goals_card_view.mjs

@@ -12,10 +12,11 @@ import { strict as assert } from 'node:assert';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { makeRunner } from './helpers.mjs';
+import { makeRunner, goalsPageSource } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/goals-page.js'), 'utf8');
+// task 1003206: the view painters moved to goals-render.js — read the family.
+const SRC = goalsPageSource();
 const CSS = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/goals.css'), 'utf8');
 const { test, summary } = makeRunner();
 
@@ -28,7 +29,13 @@ await test('both views render from ONE fact source (goalRenderFacts) so they can
 });
 
 await test('renderList forks on the f-goal-view toggle AFTER grouping/filter/sort (both views share them)', () => {
-  const body = SRC.slice(SRC.indexOf('function renderList'), SRC.indexOf('drag-to-reorder: RETIRED'));
+  // task 1003206: renderList moved to goals-render.js while the 'drag-to-reorder:
+  // RETIRED' marker that used to bound it stayed in goals-page.js, so slicing
+  // between the two now spans two files (or inverts). Bound the body by the next
+  // top-level function instead — that IS what 'renderList's body' means.
+  const start = SRC.indexOf('function renderList');
+  const nextFn = SRC.indexOf('\n  function ', start + 1);
+  const body = SRC.slice(start, nextFn > start ? nextFn : undefined);
   assert.match(body, /#f-goal-view/, 'the fork reads the toggle');
   const sortIdx = body.indexOf('sortGoals(');
   const forkIdx = body.indexOf('#f-goal-view');

package/tests/grader_generated_provenance.mjs

@@ -36,6 +36,7 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { fitnessSource } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -44,7 +45,8 @@ const prov = require(path.join(ROOT, 'modules/grading/generated-provenance.js'))
 // ---- 1. lockstep with the fitness gate ----
 
 test('the generator roster matches fitness.js checkGeneratedArtifactsFresh exactly', () => {
-  const src = fs.readFileSync(path.join(ROOT, 'scripts/gds/fitness.js'), 'utf8');
+  // task 1003206: the gate is fitness.js + fitness-*.js now — read the family.
+  const src = fitnessSource();
   const fn = src.slice(src.indexOf('function checkGeneratedArtifactsFresh'));
   const body = fn.slice(0, fn.indexOf('\nfunction ', 1));
 

package/tests/hall_palette.mjs

@@ -18,6 +18,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
+import { hallSource } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
@@ -90,7 +91,8 @@ function declaredHrefs(prefixTest) {
 }
 
 test('Standing section anchors exist in builders.js and are routable in shell.js', () => {
-  const groups = [...read('builders.js').matchAll(/\{ key: '([a-z]+)', label: '[^']+' \}/g)].map((m) => m[1]);
+  // task 1003206: STANDING_GROUPS moved to hall-render.js — read the family.
+  const groups = [...hallSource().matchAll(/\{ key: '([a-z]+)', label: '[^']+' \}/g)].map((m) => m[1]);
   assert.ok(groups.length >= 4, `sanity: found STANDING_GROUPS (${groups})`);
   const declared = declaredHrefs((h) => h.startsWith('/#standing-')).map((h) => h.replace('/#', ''));
   assert.ok(declared.length, 'palette declares Standing sections');

package/tests/helpers.mjs

@@ -124,34 +124,67 @@ export function requireHostModule(require, spec, note) {
   }
 }
 
-// lifecycleDbSource — the LIFECYCLE data layer as one source string.
+// ── carved-family source readers (tasks 1003204–1003206, goal 1000079) ────────
 //
-// task 1003204 (goal 1000079) split the 5,748-line modules/lifecycle/db.js into
-// db.js (a pure re-export facade) + twelve cohesive db-*.js units. A pile of
-// tests assert things about "the data layer" by regexing its source — that the
-// claim paths gate on requires_rank, that a literal appears in exactly one
-// place, that dependency CRUD points at the right table. Those assertions were
-// always about the LAYER, not about one filename, so they read the whole family
-// here. Reading the family (rather than repointing each test at whichever db-*
-// unit happens to hold the code today) also means a future re-carve moves code
-// between units without silently disarming the assertion.
+// The de-monolith work split four big files into a facade plus siblings:
+// modules/lifecycle/db.js, scripts/gds/ship.js, scripts/gds/fitness.js and
+// modules/lifecycle/routes/tasks.js. A pile of tests assert things about one of
+// those SUBJECTS by regexing its source — that every claim path gates on
+// requires_rank, that a literal appears in exactly one place, that a gate
+// precedes the first write. Those assertions were always about the subject, not
+// about a filename, so they read the whole family.
+//
+// Reading the family (rather than repointing each test at whichever sibling
+// happens to hold the code today) also means a future re-carve can move code
+// between siblings without silently disarming the assertion.
+function familySource(dir, matches) {
+  return fs.readdirSync(dir).filter(matches).sort()
+    .map((f) => fs.readFileSync(path.join(dir, f), 'utf8')).join('\n');
+}
+
+// The LIFECYCLE data layer: db.js (a re-export facade) + the twelve db-*.js units.
 export function lifecycleDbSource(modulesDir = path.join(ROOT, 'modules')) {
-  const dir = path.join(modulesDir, 'lifecycle');
-  const files = fs.readdirSync(dir)
-    .filter((f) => f === 'db.js' || (f.startsWith('db-') && f.endsWith('.js')))
-    .sort();
-  return files.map((f) => fs.readFileSync(path.join(dir, f), 'utf8')).join('\n');
+  return familySource(path.join(modulesDir, 'lifecycle'),
+    (f) => f === 'db.js' || (f.startsWith('db-') && f.endsWith('.js')));
 }
 
-// shipCliSource — the ship CLI as one source string.
-//
-// The companion to lifecycleDbSource above, for the same reason: task 1003205
-// carved the 4,613-line scripts/gds/ship.js into ship.js (a re-export facade +
-// the CLI entry point) plus ship-*.js phase modules. Tests that assert "the ship
-// CLI does X" by regexing its source mean the CLI as a whole, not one file.
+// The SHIP CLI: ship.js (facade + entry point) + the ship-*.js phase modules.
 export function shipCliSource(scriptsDir = path.join(ROOT, 'scripts', 'gds')) {
-  const files = fs.readdirSync(scriptsDir)
-    .filter((f) => f === 'ship.js' || (f.startsWith('ship-') && f.endsWith('.js')))
-    .sort();
-  return files.map((f) => fs.readFileSync(path.join(scriptsDir, f), 'utf8')).join('\n');
+  return familySource(scriptsDir,
+    (f) => f === 'ship.js' || (f.startsWith('ship-') && f.endsWith('.js')));
+}
+
+// The architecture-fitness GATE: fitness.js (registry + runner), fitness-lib.js
+// and the fitness-checks-*.js clusters. fitness-ratchets.js is deliberately in —
+// it has always been a registered check module of the same gate.
+export function fitnessSource(scriptsDir = path.join(ROOT, 'scripts', 'gds')) {
+  return familySource(scriptsDir,
+    (f) => f === 'fitness.js' || (f.startsWith('fitness-') && f.endsWith('.js')));
+}
+
+// The BUILDERS' HALL page script: builders.js (state, data loading, wiring) plus
+// hall-render.js, the view painters task 1003206 carved out of it.
+export function hallSource(pubDir = path.join(ROOT, 'modules', 'hall-ui', 'public')) {
+  return familySource(pubDir, (f) => f === 'builders.js' || f === 'hall-render.js');
+}
+
+// The GOALS page script: goals-page.js plus its two carved siblings — goals-lib.js
+// (pure helpers, task 1003135) and goals-render.js (view painters, task 1003206).
+export function goalsPageSource(pubDir = path.join(ROOT, 'modules', 'hall-ui', 'public')) {
+  return familySource(pubDir, (f) => ['goals-page.js', 'goals-lib.js', 'goals-render.js'].includes(f));
+}
+
+// The KERNEL IDENTITY surface: auth.js (session resolution, the middleware and the
+// page gates) plus the auth-*.js flow modules (config, admission, GitHub, IdP,
+// Discord).
+export function authSource(srcDir = path.join(ROOT, 'src', 'bongos')) {
+  return familySource(srcDir,
+    (f) => f === 'auth.js' || (f.startsWith('auth-') && f.endsWith('.js')));
+}
+
+// The TASK ROUTER: routes/tasks.js plus the task-*.js route modules it registers
+// (task-write-routes.js holds POST /tasks and PATCH /tasks/:id).
+export function taskRoutesSource(modulesDir = path.join(ROOT, 'modules')) {
+  return familySource(path.join(modulesDir, 'lifecycle', 'routes'),
+    (f) => f === 'tasks.js' || (f.startsWith('task-') && f.endsWith('.js')));
 }

package/tests/lib_sh_resolution.mjs

@@ -28,6 +28,7 @@ import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { fitnessSource } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -122,7 +123,8 @@ test('gds_api_base falls back to the instance, never a foreign host', (t) => {
 // ---- 3. the guard can now SEE a .sh re-hardcode ----------------------------
 
 test('the host-identity fitness scan covers .sh', () => {
-  const src = fs.readFileSync(path.join(GDS, 'fitness.js'), 'utf8');
+  // task 1003206: the gate is fitness.js + fitness-*.js now — read the family.
+  const src = fitnessSource();
   assert.match(src, /IDENTITY_SCAN_EXTS = new Set\(\[[^\]]*'\.sh'/,
     'the scan extension set must include .sh, or no shell script is ever checked');
 });

package/tests/membership_kind_lockstep.mjs

@@ -36,6 +36,7 @@ import { test } from 'node:test';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { authSource } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
@@ -101,7 +102,8 @@ test('the value mapping is one shared function, not repeated inline', () => {
 });
 
 test('the sender writes BOTH spellings, computing the kind once (the cross-version window)', () => {
-  const auth = read('src/bongos/auth.js');
+  // task 1003206: the auth flows are auth.js + auth-*.js now — read the family.
+  const auth = authSource();
   const body = auth.slice(auth.indexOf('async function reportMembershipCheckIn'), auth.indexOf('async function reportMembershipCheckIn') + 2400);
   assert.match(body, /membership_kind: kind/, 'the new field goes on the wire');
   assert.match(body, /role: kind === 'member' \? 'builder' : kind/,

package/tests/migration_allocation.mjs

@@ -28,7 +28,7 @@ import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 import { createRequire } from 'node:module';
-import { lifecycleDbSource } from './helpers.mjs';
+import { lifecycleDbSource, taskRoutesSource } from './helpers.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const repoRoot = join(__dirname, '..');
@@ -52,7 +52,8 @@ const migrationSql = read('migrations', '081_tasks_needs_migration.sql');
 // the tasks db slice + the tasks route carved to modules/lifecycle/ at BV1.R86.
 // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
 const dbSrc = lifecycleDbSource();
-const routesSrc = read('modules', 'lifecycle', 'routes', 'tasks.js');
+// task 1003206: the task router is tasks.js + task-*.js now — read the family.
+const routesSrc = taskRoutesSource();
 const captureSrc = read('scripts', 'gds', 'capture.js');
 
 // The allocator's trigger, reproduced as a pure predicate. This is the exact
@@ -148,6 +149,8 @@ function shouldReserveMigrationNumber(task) {
   // "migration"/"schema" compounds, and a wrong verdict must be correctable
   // via PATCH. Behavioral tests use the real exported detectsMigration.
   const require = createRequire(import.meta.url);
+  // task 1003206: detectsMigration moved to task-route-helpers.js; tasks.js still
+  // re-exports it, so this keeps exercising the router's own public surface.
   const { detectsMigration } = require('../modules/lifecycle/routes/tasks.js');
 
   await test('classifier ignores code-migration and API-schema phrasing (task 1002648)', () => {

package/tests/patch_gate_ordering.mjs

@@ -18,8 +18,10 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { readFileSync } from 'node:fs';
+import { taskRoutesSource } from './helpers.mjs';
 
-const src = readFileSync(new URL('../modules/lifecycle/routes/tasks.js', import.meta.url), 'utf8');
+// task 1003206: PATCH /tasks/:id now lives in task-write-routes.js — read the family.
+const src = taskRoutesSource();
 
 // The PATCH handler slice: router.patch('/tasks/:id' … up to the next route.
 function patchSlice(source) {