@bongos/core 1.19.339 → 1.19.341

package/scripts/gds/redteam-patrol.js

@@ -24,6 +24,24 @@
 // to /api/gds/security/reports. --canary proves the end-to-end pipe: plants a
 // constructed token, asserts the scanner catches it, files a low "[canary]"
 // report, and dispute-closes it so the queue stays clean.
+//
+// UNATTENDED RUNS (task 1003209). The scheduler is .github/workflows/redteam-patrol.yml
+// — CI, not the always-on server, because all three checks read things only the
+// REPO has: full git history, .github/workflows/, and a package-lock npm can audit
+// (ADR 0188). A CI runner has no GDS session, so --file would otherwise hit
+// cli-lib's interactive re-auth wall and print "run /builder-reauth" into a cron
+// log. Instead --file preflights the session and, when there is none, follows the
+// main-audit.js --require-roster doctrine: report LOUDLY rather than green-and-
+// vacuous. The exit code says whether a finding was LOST, not whether findings
+// exist — findings are advisory (ADR 0162) and a patrol that goes red merely for
+// doing its job trains everyone to ignore it:
+//
+//   ran + filed                     → 0
+//   ran, nothing to file            → 0 (with or without a session)
+//   ran, has findings, cannot file  → 2 — the one state where evidence evaporates
+//
+// Findings are ALSO appended to $GITHUB_STEP_SUMMARY when set, so a scheduled run
+// is readable in the Actions UI without opening the log.
 
 'use strict';
 
@@ -211,6 +229,45 @@ function buildClassReport(className, findings, notes = []) {
   };
 }
 
+// Append markdown to the Actions job summary when running under GitHub Actions.
+// Best-effort and inert everywhere else — a patrol run must never fail because a
+// log surface was unavailable.
+function stepSummary(md) {
+  const dest = process.env.GITHUB_STEP_SUMMARY;
+  if (!dest) return;
+  try { fs.appendFileSync(dest, `${md}\n`); } catch { /* never fatal */ }
+}
+
+// Pure: what a completed sweep should DO with its findings, and the exit code
+// that disposition deserves. Extracted so the honest-exit contract is a table a
+// test can enumerate rather than branching buried in main().
+//
+// The load-bearing row is the last one. Findings are ADVISORY (ADR 0162), so a
+// run that finds three things and files them is a SUCCESS — going red merely for
+// doing its job is how a weekly lane becomes noise everyone filters. Red is
+// reserved for the single state where evidence EVAPORATES: findings exist,
+// filing was asked for, and it cannot happen.
+function disposition({ findingClasses = 0, doFile = false, blocker = null } = {}) {
+  if (!findingClasses) return { action: 'clean', exitCode: 0 };
+  if (!doFile) return { action: 'dry-run', exitCode: 0 };
+  if (blocker) return { action: 'not-filed', exitCode: 2 };
+  return { action: 'file', exitCode: 0 };
+}
+
+// Is there a GDS session this run could file with? Returns the reason it cannot,
+// or null when filing is possible. Read directly (readSessionToken) rather than
+// probing with apiCall, because apiCall's 401 path exits the process with
+// interactive re-auth guidance — useless in a cron log and indistinguishable from
+// a crash.
+function filingBlocker() {
+  try {
+    const { readSessionToken } = require('./cli-lib.js');
+    return readSessionToken() ? null : 'no GDS session on this runner';
+  } catch (e) {
+    return `session unreadable: ${e && e.message}`;
+  }
+}
+
 async function fileReport(report) {
   const { apiCall } = require('./cli-lib.js');
   const r = await apiCall('POST', '/api/gds/security/reports', report);
@@ -283,10 +340,30 @@ async function main() {
   const pins = actionPinCheck();
   if (pins.findings.length) classes.push(buildClassReport('action-pins', pins.findings));
 
+  if (secrets.degraded) stepSummary(`> **DEGRADED** — ${secrets.degraded}`);
+
   if (!classes.length) {
     console.log('patrol: clean sweep — nothing to file.');
+    stepSummary('## red-team patrol\n\nClean sweep — no findings to file.');
     return;
   }
+
+  stepSummary(['## red-team patrol', ...classes.map((c) =>
+    `### ${c.title}\n\nseverity: **${c.severity}**\n\n${c.repro_steps_md}`)].join('\n\n'));
+
+  // Preflight the session ONCE, before the first POST: a half-filed sweep (class
+  // one lands, class two hits the auth wall and exits) is worse than not starting.
+  const blocker = doFile ? filingBlocker() : null;
+  const { action, exitCode } = disposition({ findingClasses: classes.length, doFile, blocker });
+  if (action === 'not-filed') {
+    console.error(`patrol: DID NOT FILE — ${blocker}. ${classes.length} finding class(es) above are NOT in the adjudication queue.`);
+    console.error('patrol: sign in on this runner (or set the scheduler\'s session secret) and re-run — see docs/recipes/redteam-patrol.md.');
+    for (const report of classes) console.error(`  [${report.severity}] ${report.title}\n${report.repro_steps_md}`);
+    stepSummary(`\n> **NOT FILED** — ${blocker}. These findings exist only in this run's log.`);
+    process.exitCode = exitCode;
+    return;
+  }
+
   for (const report of classes) {
     if (doFile) {
       const id = await fileReport(report);
@@ -305,4 +382,5 @@ if (require.main === module) {
 module.exports = {
   parseGitleaksReport, unpinnedUses, ageDays, mapSeverity, maxSeverity,
   buildClassReport, lockedVersion, COOLDOWN_DAYS, YOUNG_PKG_DAYS,
+  stepSummary, filingBlocker, disposition,
 };

package/scripts/gds/routine-schedule.js

@@ -0,0 +1,231 @@
+#!/usr/bin/env node
+// scripts/gds/routine-schedule.js — a declared cadence must have something that
+// fires it (task 1003209, goal 1000079; docs/audits/ai-dev-redteam-followup.md §7).
+//
+// THE GAP THIS CLOSES. Goal 1000076 shipped the redteam-weekly patrol, wired it
+// into the control manifest, and documented it — and then nothing ever ran it.
+// The follow-up audit's §7 named all three halves of the failure:
+//
+//   1. no committed scheduler for .claude/scheduled-tasks/ at all;
+//   2. the SKILL.md declared `mode` and `steps` but no cadence — "nothing for a
+//      scheduler to read even if one looked";
+//   3. control-manifest.js called the patrol "wired" on a substring (the SKILL.md
+//      mentions its own scanner), so the manifest was GREEN while the patrol was
+//      dormant.
+//
+// (2) is now a real frontmatter field (run-routine.js parseRoutineFrontmatter),
+// (1) is .github/workflows/redteam-patrol.yml, and THIS file is (3): the check
+// that refuses the combination of a declared cadence and nothing firing it.
+//
+// WHY A DEDICATED CHECK RATHER THAN ANOTHER MANIFEST ROW. The manifest's
+// predicates are deliberately shallow — file exists, one wiring substring. That
+// shape is exactly what let the patrol read as wired while dormant, and this goal
+// has now hit the same failure five times: an enforcement surface that NAMES a
+// file goes VACUOUS, not red, when the thing it names moves or stops. So the
+// predicate here is relational, not existential: it reads the cadence each
+// routine declares, reads the cron each scheduler actually carries, and fails
+// when the two disagree in EITHER direction —
+//
+//   • a routine declares `cadence:` and no scheduler fires it   → red
+//   • a scheduler fires a routine that no longer exists         → red (rename rot)
+//   • the cron's real period differs from the declared cadence  → red
+//
+// The third is the one a substring check can never catch: edit the cron from
+// weekly to yearly and every "is it wired?" predicate stays green.
+//
+// TWO-REPO TOLERANCE. Scheduled routines are TOPOLOGY — `bongos init/upgrade`
+// materializes .claude/scheduled-tasks/ into each instance (claude-materialize.js),
+// but .github/workflows/ is the CORE repo's and does not travel. So an instance
+// checkout legitimately has routines and no workflows directory. There, the
+// unscheduled routines are reported as WARNINGS (the instance's operator owns its
+// own scheduler); in a repo that HAS workflows, they are violations. That keeps
+// the check honest in the core without red-building every instance.
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const TASKS_DIR = path.join(ROOT, '.claude', 'scheduled-tasks');
+const WORKFLOWS_DIR = path.join(ROOT, '.github', 'workflows');
+
+const { parseRoutineFrontmatter } = require('./run-routine.js');
+
+// The cadences a routine may declare. The value is the period a cron expression
+// must resolve to for the two to agree. Add a name here and cronCadence() below
+// must be able to produce it, or the pair can never match.
+const CADENCES = new Set(['hourly', 'daily', 'weekly', 'monthly']);
+
+// Pure: classify a 5-field cron expression into the cadence it actually realizes.
+// Returns null for anything this vocabulary cannot describe (step values, lists,
+// ranges) — a cadence can then never "match" it, which is the safe direction: an
+// exotic cron must be described some other way rather than silently accepted.
+//
+//   min hour dom mon dow
+//   17   6    *   *   1   → weekly   (a specific day-of-week)
+//   17   6    *   *   *   → daily    (a specific hour, every day)
+//   17   6    3   *   *   → monthly  (a specific day-of-month)
+//   17   *    *   *   *   → hourly   (a specific minute, every hour)
+function cronCadence(expr) {
+  const f = String(expr == null ? '' : expr).trim().split(/\s+/);
+  if (f.length !== 5) return null;
+  const [min, hour, dom, mon, dow] = f;
+  const fixed = (v) => /^\d+$/.test(v);
+  const any = (v) => v === '*';
+  if (!fixed(min)) return null;          // every cadence below pins the minute
+  if (!any(mon)) return null;            // a specific month is a yearly shape
+  if (any(hour)) return any(dom) && any(dow) ? 'hourly' : null;
+  if (!fixed(hour)) return null;
+  if (fixed(dow) && any(dom)) return 'weekly';
+  if (fixed(dom) && any(dow)) return 'monthly';
+  if (any(dom) && any(dow)) return 'daily';
+  return null;
+}
+
+// Pure: every cron expression a workflow file declares under `on: schedule:`.
+// A focused subset of YAML (the repo has no js-yaml dep and the parser in
+// run-routine.js is the same shape): the `cron:` keys are unambiguous enough to
+// read directly, and a workflow that hides one behind an anchor would simply
+// read as unscheduled — the safe direction.
+function workflowCrons(yamlText) {
+  const out = [];
+  for (const line of String(yamlText == null ? '' : yamlText).split('\n')) {
+    const m = /^\s*-?\s*cron:\s*['"]?([^'"#\n]+?)['"]?\s*(?:#.*)?$/.exec(line);
+    if (m) out.push(m[1].trim());
+  }
+  return out;
+}
+
+// Pure: does `yamlText` actually invoke routine `name`? Either the canonical
+// dispatcher form (`run-routine.js <name>`) or one of the routine's own step
+// commands verbatim. Both are real invocations; a mere mention in prose is not,
+// which is the whole point — the substring predicate this replaces was satisfied
+// by a comment.
+function invokesRoutine(yamlText, name, steps = []) {
+  const hay = String(yamlText == null ? '' : yamlText);
+  const dispatched = new RegExp(`run-routine\\.js\\s+(?:--\\S+\\s+)*${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\w-])`);
+  if (dispatched.test(hay)) return true;
+  return steps.some((s) => s.command && hay.includes(s.command));
+}
+
+// Read every routine that declares a cadence, plus the ones that don't.
+function readRoutines(dir = TASKS_DIR) {
+  const withCadence = [];
+  const withoutCadence = [];
+  let names = [];
+  try {
+    names = fs.readdirSync(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch (_) { return { withCadence, withoutCadence }; }
+  for (const name of names.sort()) {
+    let md;
+    try { md = fs.readFileSync(path.join(dir, name, 'SKILL.md'), 'utf8'); } catch (_) { continue; }
+    const { cadence, steps } = parseRoutineFrontmatter(md);
+    if (cadence) withCadence.push({ name, cadence, steps });
+    else withoutCadence.push({ name });
+  }
+  return { withCadence, withoutCadence };
+}
+
+function readWorkflows(dir = WORKFLOWS_DIR) {
+  let files = [];
+  try { files = fs.readdirSync(dir).filter((f) => f.endsWith('.yml') || f.endsWith('.yaml')); }
+  catch (_) { return null; } // null = no workflows directory at all (instance repo)
+  return files.sort().map((f) => ({ file: f, text: fs.readFileSync(path.join(dir, f), 'utf8') }));
+}
+
+// Pure evaluation — exported for the test, which drives it with fixtures.
+// `workflows === null` means "this checkout has no CI to schedule with", which
+// downgrades unscheduled routines from violations to warnings (see the two-repo
+// note in the header).
+function evaluate({ withCadence, withoutCadence }, workflows) {
+  const violations = [];
+  const warnings = [];
+  const hasCI = workflows !== null;
+  const wf = workflows || [];
+
+  for (const r of withCadence) {
+    if (!CADENCES.has(r.cadence)) {
+      violations.push(`routine '${r.name}': unknown cadence "${r.cadence}" (want ${[...CADENCES].join('|')})`);
+      continue;
+    }
+    const firing = wf.filter((w) => invokesRoutine(w.text, r.name, r.steps));
+    if (!firing.length) {
+      const msg = `routine '${r.name}' declares cadence: ${r.cadence} but NOTHING fires it — no scheduled workflow invokes it`;
+      (hasCI ? violations : warnings).push(msg);
+      continue;
+    }
+    // It is invoked somewhere. At least one of those invocations must be on a
+    // schedule whose real period is the declared cadence. A workflow_dispatch-only
+    // lane is a human running it — exactly the state §7 called "decorative".
+    const seen = [];
+    let matched = false;
+    for (const w of firing) {
+      for (const expr of workflowCrons(w.text)) {
+        const actual = cronCadence(expr);
+        seen.push(`${w.file}: "${expr}" → ${actual || 'unclassifiable'}`);
+        if (actual === r.cadence) matched = true;
+      }
+    }
+    if (!matched) {
+      violations.push(
+        seen.length
+          ? `routine '${r.name}' declares cadence: ${r.cadence} but no scheduler fires it at that period — ${seen.join('; ')}`
+          : `routine '${r.name}' declares cadence: ${r.cadence} but ${firing.map((w) => w.file).join(', ')} carries no 'on: schedule:' cron (manual dispatch only)`
+      );
+    }
+  }
+
+  // Rename rot, the other direction: a scheduler that dispatches a routine name
+  // no longer on disk. run-routine.js exits 2 on a missing SKILL.md, so this
+  // would be a weekly red job nobody watches; catch it at merge time instead.
+  // Deduped: a workflow legitimately names its own invocation more than once (the
+  // step itself plus the header comment explaining why it dispatches rather than
+  // calling the script), and one rename should read as one problem.
+  const known = new Set([...withCadence, ...withoutCadence].map((r) => r.name));
+  const dangling = new Set();
+  for (const w of wf) {
+    for (const m of w.text.matchAll(/run-routine\.js\s+(?:--\S+\s+)*([A-Za-z0-9_-]+)/g)) {
+      if (!known.has(m[1])) dangling.add(`${w.file} dispatches routine '${m[1]}', which has no .claude/scheduled-tasks/${m[1]}/SKILL.md`);
+    }
+  }
+  violations.push(...dangling);
+
+  for (const r of withoutCadence) {
+    warnings.push(`routine '${r.name}' declares no cadence: — it can only ever be run by hand`);
+  }
+  return { violations, warnings };
+}
+
+// The fitness.js check.
+function checkRoutineCadencesScheduled() {
+  const routines = readRoutines();
+  const workflows = readWorkflows();
+  const { violations, warnings } = evaluate(routines, workflows);
+  const scheduled = routines.withCadence.length - violations.filter((v) => v.startsWith("routine '")).length;
+  return {
+    name: 'a declared cron cadence has something that fires it (task 1003209)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings,
+    note: violations.length
+      ? 'a scheduled routine is declared but dormant — add/repair the scheduler, or drop the cadence: field and stop claiming it runs'
+      : `${scheduled}/${routines.withCadence.length} cadence-declaring routine(s) fired by a committed scheduler at the declared period; ${routines.withoutCadence.length} manual-only.`,
+  };
+}
+
+function main() {
+  const r = checkRoutineCadencesScheduled();
+  for (const v of r.violations) console.error(`✗ ${v}`);
+  for (const w of r.warnings) console.warn(`⚠ ${w}`);
+  console.log(`${r.hardFail ? 'FAIL' : 'PASS'}  ${r.note}`);
+  process.exit(r.hardFail ? 1 : 0);
+}
+
+if (require.main === module) main();
+
+module.exports = {
+  checkRoutineCadencesScheduled, evaluate, cronCadence, workflowCrons,
+  invokesRoutine, readRoutines, readWorkflows, CADENCES,
+};

package/scripts/gds/run-routine.js

@@ -47,12 +47,19 @@ function unquote(s) {
   return t;
 }
 
-// Pure: parse mode + steps[] from SKILL.md frontmatter. A focused YAML subset
-// (no js-yaml dep): scalar `mode:`/`description:` and a `steps:` list of
-// `- command: …` / `sink: …` items. Unknown keys are ignored. Exported + tested.
+// Pure: parse mode + cadence + steps[] from SKILL.md frontmatter. A focused YAML
+// subset (no js-yaml dep): scalar `mode:`/`cadence:`/`description:` and a `steps:`
+// list of `- command: …` / `sink: …` items. Unknown keys are ignored. Exported + tested.
+//
+// `cadence:` (task 1003209) is the field the follow-up audit found missing — the
+// routines declared HOW to run but never HOW OFTEN, so "there was nothing for a
+// scheduler to read even if one looked." It is declarative only: run-routine.js
+// still runs a routine exactly once per invocation. The cadence is the contract a
+// committed scheduler must honour, and scripts/gds/routine-schedule.js is the check
+// that refuses a cadence nothing fires.
 function parseRoutineFrontmatter(skillMd) {
   const norm = String(skillMd == null ? '' : skillMd).replace(/\r\n/g, '\n');
-  const empty = { mode: null, steps: [], description: null };
+  const empty = { mode: null, cadence: null, steps: [], description: null };
   if (!norm.startsWith('---\n')) return empty;
   const lines = norm.split('\n');
   let close = -1;
@@ -62,6 +69,7 @@ function parseRoutineFrontmatter(skillMd) {
   if (close === -1) return empty;
 
   let mode = null;
+  let cadence = null;
   let description = null;
   const steps = [];
   let inSteps = false;
@@ -96,12 +104,13 @@ function parseRoutineFrontmatter(skillMd) {
 
     if (!inSteps && isTopLevel && topKv) {
       if (topKv[1] === 'mode') mode = unquote(topKv[2]) || null;
+      else if (topKv[1] === 'cadence') cadence = unquote(topKv[2]) || null;
       else if (topKv[1] === 'description') description = topKv[2].trim();
       else if (topKv[1] === 'steps' && topKv[2].trim() === '') inSteps = true;
     }
   }
   pushCur();
-  return { mode, steps, description };
+  return { mode, cadence, steps, description };
 }
 
 // Pure: split a repo-authored command string into argv, honoring simple quotes.

package/src/module-api.js

@@ -1108,8 +1108,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.337 with no explicit bump. run 32796733697. (task 1002620)
 //   1.19.339 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.338 with no explicit bump. run 32797325535. (task 1002620)
+//   1.19.340 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.339 with no explicit bump. run 32798342738. (task 1002620)
+//   1.19.341 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.340 with no explicit bump. run 32798507686. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.339'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.341'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -293,7 +293,7 @@ test('the new view balances its own tree — the map-only walkers never covered
   // lives there too; a lopsided div in the wizard block would be caught by
   // nothing else while silently reparenting the footer.
   const start = HUB.indexOf('<section id="view-new"');
-  const end = HUB.indexOf('<div class="foot"');
+  const end = HUB.indexOf('<footer class="foot"');
   assert.ok(start !== -1 && end > start, 'need the view-new span');
   const wiz = HUB.slice(start, end);
   assert.equal((wiz.match(/<div\b/g) || []).length, (wiz.match(/<\/div>/g) || []).length,

package/tests/projects_hub_pre_uat.mjs

@@ -69,14 +69,14 @@ test('a queued standup lights "Request filed", not "Standing it up" — on the c
   const strip = fn('stripFor');
   assert.match(strip, /if \(s === 'requested'\) \{[\s\S]*?stripMarkup\(revive \? 'revive' : 'standup', 0, 0,/, 'card: requested → stage 0 current');
   assert.match(strip, /if \(s === 'provisioning'\) \{[\s\S]*?stripMarkup\(revive \? 'revive' : 'standup', 1, 1,/, 'card: provisioning → stage 1 current');
-  assert.match(SCRIPT, /if \(s === 'requested'\) \{\n\s*el\.innerHTML = progressMarkup\(0, 0,/, 'done panel: requested → stage 0 current');
+  assert.match(SCRIPT, /if \(s === 'requested'\) \{\n\s*setProgress\(progressMarkup\(0, 0,/, 'done panel: requested → stage 0 current');
   assert.doesNotMatch(SCRIPT, /Waiting for a runner/, '"runner" is operator vocabulary');
   assert.doesNotMatch(SCRIPT, /a runner picks it up/, '"runner" is operator vocabulary (retry message)');
 });
 
 /* ── the done panel never lies at the end of its watch, and never opens a door early ── */
 test('the 33-minute hand-off keeps a snag honest and keeps its flow', () => {
-  assert.match(SCRIPT, /if \(ticks > 400\) \{[\s\S]*?if \(live\.instStatus !== 'error'\) \{[\s\S]*?Still working[\s\S]*?watchFlow\);/, 'no "still building" over an error; the strip keeps its vocabulary');
+  assert.match(SCRIPT, /if \(ticks > 400\) \{[\s\S]*?if \(live\.instStatus !== 'error'\) \{[\s\S]*?Still working[\s\S]*?watchFlow\)/, 'no "still building" over an error; the strip keeps its vocabulary');
   assert.doesNotMatch(SCRIPT, /Still building — this tab will stop watching now/);
   assert.match(SCRIPT, /progressMarkup\(1, 1, m\.slice\(5\), 'isErr', watchFlow\)/, 'the session-expiry message keeps its flow too');
 });
@@ -190,7 +190,7 @@ test('a live private-repo project is not told it is broken', () => {
 test('Back moves between views — a deliberate view change is a history entry', () => {
   assert.match(SCRIPT, /history\.pushState\(null, '', '\?view=' \+ v \+ idPart\)/);
   assert.match(SCRIPT, /history\.replaceState\(null, '', '\?view=' \+ v \+ idPart\)/, 'boot + background settles still rewrite in place');
-  assert.match(SCRIPT, /window\.addEventListener\('popstate', function \(\) \{ setView\(viewFromUrl\(\)\); \}\)/);
+  assert.match(SCRIPT, /window\.addEventListener\('popstate', function \(\) \{ closeCard\(\); setView\(viewFromUrl\(\)\); \}\)/);
   assert.match(SCRIPT, /else if \(v === 'manage' && a\.dataset\.nav === 'mine'\) a\.setAttribute\('aria-current', 'page'\)/, 'manage keeps the Your-projects pill lit');
 });
 
@@ -300,7 +300,7 @@ test('decision 9 — only mouse-driven focus on a wizard heading goes ringless',
 
 test('decision 10 — both footers carry the open-source (AGPL-3.0) link, in link ink', () => {
   const AGPL = /<a href="https:\/\/www\.gnu\.org\/licenses\/agpl-3\.0\.html" target="_blank" rel="noopener">Open source \(AGPL-3\.0\)<\/a>\./;
-  const hubFoot = (HUB.match(/<div class="foot">[\s\S]*?<\/div>/) || [''])[0];
+  const hubFoot = (HUB.match(/<footer class="foot">[\s\S]*?<\/footer>/) || [''])[0];
   const indexFoot = (INDEX.match(/<div class="foot">[\s\S]*?<\/div>/) || [''])[0];
   assert.match(hubFoot, AGPL, 'projects.html');
   assert.match(indexFoot, AGPL, 'index.html');
@@ -362,3 +362,84 @@ test('card action results announce, nothing under the pointer is deleted, and fo
   assert.match(fn('focusKeyOf'), /data-teardown-yes'\) \|\| el\.hasAttribute\('data-teardown-no'\)\) return '\[data-teardown\]'/, 'Yes / Keep land back on the door that opened them');
   assert.match(fn('focusCardControl'), /li\.querySelector\('\.actions a, \.actions button'\) \|\|\n\s*li\.querySelector\('details\.attachFold summary'\)/, 'nearest control as the fallback');
 });
+
+/* ── accessibility follow-ups (task 1003246) ── */
+test('the done panel’s progress region is stable, change-only, and says each stage’s state', () => {
+  assert.match(HUB, /<div id="liveProgress" role="status" aria-live="polite"><\/div>/, 'the live region is the static wrapper');
+  assert.doesNotMatch(fn('progressMarkup'), /aria-live/, 'the rebuilt strip carries no live-region attributes');
+  assert.match(fn('progressMarkup'), /\(c === 'now' \? ' aria-current="step"' : ''\)/, 'the current stage is marked');
+  assert.match(fn('progressMarkup'), /<span class="vh">, ' \+ word \+ '<\/span>/, 'each stage says its state to a screen reader');
+  assert.match(fn('setProgress'), /if \(!el \|\| html === lastProgHtml\) return;/, 'an identical tick performs no DOM write');
+  assert.doesNotMatch(SCRIPT, /\$\('liveProgress'\)\.innerHTML =/, 'every write goes through setProgress');
+  assert.doesNotMatch(fn('renderProgress'), /el\.innerHTML =/, 'renderProgress included');
+  assert.match(SCRIPT, /lastStepsHtml = '';\n\s*lastProgHtml = '';/, 'starting another project resets both guards');
+  assert.match(COSMOS, /\.vh\{position:absolute;width:1px;height:1px;overflow:hidden;clip-path:inset\(50%\);white-space:nowrap;\}/, 'the visually-hidden utility is in cosmos');
+  assert.match(fn('stripMarkup'), /role="status" aria-live="polite"/, 'the mine-card strip is left alone this pass');
+});
+
+test('the map table sorts from the keyboard and an owned row’s name is a real link', () => {
+  assert.match(HUB, /<th class="colName" data-sort="name" aria-sort="ascending"><button type="button" class="thSort">Project<\/button><\/th>/);
+  assert.match(HUB, /<th class="right" data-sort="builders"><button type="button" class="thSort">Builders<\/button><\/th>/);
+  assert.match(SCRIPT, /var btn = th\.querySelector\('button'\);\n\s*if \(!btn\) return;\n\s*btn\.addEventListener\('click'/, 'the listener sits on the button, not the th');
+  assert.doesNotMatch(SCRIPT, /th\.style\.cursor/, 'no JS-set cursor on the th');
+  assert.match(COSMOS, /\.tbl th button\{all:unset;cursor:pointer;\}/);
+  assert.match(COSMOS, /\.tbl th button:focus-visible\{outline:2px solid var\(--accent\);outline-offset:2px;\}/, 'keyboard focus on the sort button is visible');
+  const generated = (SCRIPT.match(/return '<tr data-generated([\s\S]*?)'<\/tr>';/) || [, ''])[1];
+  assert.match(generated, /<a class="ptitle" data-manage="' \+ esc\(String\(p\._inst\.id\)\) \+ '" href="\?view=manage&id=' \+ esc\(String\(p\._inst\.id\)\) \+ '">/, 'an owned row’s title is a manage anchor');
+  const rows = SCRIPT.slice(SCRIPT.indexOf("$('mapRows').addEventListener('click'"));
+  const branch = rows.indexOf("closest('a[data-manage]')");
+  const bail = rows.indexOf("if (ev.target.closest && ev.target.closest('a')) return;");
+  assert.ok(branch > 0 && bail > branch, 'the manage branch runs before the anchor bail-out');
+  assert.match(HUB, /Sort by Project or Builders\./, 'the hint names the two sortable columns');
+  assert.match(COSMOS, /\.tbl \.ptitle\{[^}]*text-decoration:none;\}/, 'the link wears the title’s ink, not the UA underline');
+});
+
+test('the hub has one main landmark, a heading for the map, a footer, and a skip link', () => {
+  const main = HUB.indexOf('<main id="hubMain">');
+  const map = HUB.indexOf('<section id="view-map">');
+  const close = HUB.indexOf('\n</main>');
+  const foot = HUB.indexOf('<footer class="foot">');
+  assert.ok(main > 0 && main < map && close > HUB.indexOf('<section id="view-new"') && foot > close, 'the four views sit inside #hubMain, the footer after it');
+  assert.equal((HUB.match(/<main\b/g) || []).length, 1, 'exactly one main');
+  assert.match(HUB, /<section id="view-map">\n\s*<h1 class="vh">The project map<\/h1>/, 'the map view has a heading');
+  assert.match(HUB, /<a class="skip vh" href="#hubMain">Skip to content<\/a>\n<header class="shell">/, 'the skip link is the first thing before the shell');
+  assert.match(HUB, /\.skip:focus\{position:fixed;top:8px;left:8px;/, 'it becomes a real pill on focus');
+  assert.doesNotMatch(HUB, /<main class="card">/, 'the old inner main is a div');
+});
+
+test('completed rail steps are a way back, the repo picker is honest ARIA, the card inerts the page', () => {
+  assert.match(fn('paintRail'), /if \(step < 6 && n < cur\) \{\n\s*li\.setAttribute\('role', 'button'\);\n\s*li\.setAttribute\('tabindex', '0'\);\n\s*li\.setAttribute\('data-goto', String\(n\)\);/, 'only answered steps become buttons, and none once the project is filed');
+  assert.match(SCRIPT, /railEl\.addEventListener\('click'/);
+  assert.match(SCRIPT, /railEl\.addEventListener\('keydown'/);
+  assert.match(SCRIPT, /show\(Number\(li\.getAttribute\('data-goto'\)\), true\)/, 'a deliberate step: focus moves');
+  assert.match(COSMOS, /\.steps li\[role=button\]\{cursor:pointer;\}/);
+  assert.match(COSMOS, /\.steps li\[role=button\]:focus-visible\{outline:2px solid var\(--accent\);/);
+  assert.doesNotMatch(HUB, /role="listbox"/);
+  assert.doesNotMatch(SCRIPT, /role="option"/);
+  assert.match(HUB, /<div id="ghList" class="ghlist" role="group" aria-label="Your repositories"><\/div>/, 'the label survives the listbox role');
+  assert.match(SCRIPT, /class="ghrow" data-full="' \+ esc\(r\.full_name\) \+ '" aria-current="' \+ \(r\.full_name === sel\) \+ '"/, 'the chosen row is aria-current');
+  assert.match(HUB, /\.ghrow\[aria-current=true\]\{/, 'and painted through it');
+  assert.doesNotMatch(HUB, /aria-selected/, 'aria-selected went with the option role');
+  assert.match(SCRIPT, /if \(ev\.key !== 'Escape' \|\| \$\('ghList'\)\.hidden\) return;\n\s*ev\.stopPropagation\(\);\n\s*\$\('ghSearch'\)\.focus\(\);\n\s*closeRepoList\(\);/, 'Escape closes the list after handing focus back');
+  assert.match(SCRIPT, /if \(ev\.relatedTarget && !\$\('ghAdopt'\)\.contains\(ev\.relatedTarget\)\) closeRepoList\(\);/, 'focus leaving the picker closes it; a null relatedTarget is left alone');
+  assert.match(fn('openCard'), /\$\('cardScrim'\)\.hidden = false;\n\s*pageInert\(true\);\n\s*\$\('cardClose'\)\.focus\(\);/);
+  assert.match(fn('closeCard'), /pageInert\(false\);[^\n]*\n\s*if \(cardReturn && cardReturn\.focus\) cardReturn\.focus\(\);/, 'inert is lifted before focus is handed back');
+  assert.match(fn('pageInert'), /'a\.skip, header\.shell, footer\.foot, #view-mine, #view-new, #view-manage, #view-map > :not\(#cardScrim\)'/, 'the map is inerted a child at a time — the card is its child; the skip link sits outside the shell and goes too');
+  assert.match(SCRIPT, /'popstate', function \(\) \{ closeCard\(\); setView\(viewFromUrl\(\)\); \}/, 'Back closes the card, so the page is never left inert');
+  assert.equal((HUB.match(/aria-controls="projectsList"/g) || []).length, 5, 'the five state filters name the list they filter');
+});
+
+test('control nits: orb cursor, caret under reduced motion, mode label, home label, held reduce-motion query, target sizes', () => {
+  assert.doesNotMatch(COSMOS, /\.orb\{flex:0 0 54px;[^}]*cursor:pointer/, 'the base orb is not a pointer');
+  assert.match(COSMOS, /\na\.orb\{cursor:pointer;\}/, 'only the linked orb is');
+  assert.doesNotMatch(COSMOS, /\.orb\.ghost\{[^}]*cursor:default/);
+  assert.match(HUB, /@media \(prefers-reduced-motion:reduce\)\{\.shell \.caret\{display:none;\}\}/, 'the caret hides instead of freezing solid');
+  assert.match(fn('paintModeToggle'), /el\.setAttribute\('aria-label', dark \? 'Switch to light mode' : 'Switch to dark mode'\);/);
+  assert.doesNotMatch(fn('paintModeToggle'), /aria-pressed/);
+  assert.match(SCRIPT, /\$\('markLeft'\)\.parentNode\.setAttribute\('aria-label', productName \+ ' — home'\);\n\s*if \(REDUCED \|\|/, 'the home link is labelled before the typing loop’s early return');
+  assert.match(SCRIPT, /var REDUCED_MQ = window\.matchMedia \? window\.matchMedia\('\(prefers-reduced-motion: reduce\)'\) : null;/);
+  assert.match(SCRIPT, /if \(REDUCED\) stopSky\(\); else startSky\(\);/, 'a mid-session flip stops or restarts the sky');
+  assert.match(SCRIPT, /REDUCED_MQ\.addEventListener\('change', onReducedChange\)/);
+  assert.match(HUB, /\.again\{[^}]*padding:6px 2px;min-height:24px;/);
+  assert.match(HUB, /\nsummary\{min-height:24px;padding:3px 0;\}/, 'every fold is a 24px target; the disclosure marker stays');
+});

package/tests/redteam_patrol.mjs

@@ -65,3 +65,66 @@ test('buildClassReport caps the item list, counts the remainder, and takes max s
   assert.match(r.repro_steps_md, /…and 3 more/);
   assert.match(r.repro_steps_md, /Notes:/);
 });
+
+// ---------------------------------------------------------------------------
+// Unattended-run behaviour (task 1003209): the patrol now runs on CI, which has
+// no GDS session. These pin the two things that turns on — an exit code that
+// means "a finding was LOST" rather than "a finding exists", and a job-summary
+// surface so a scheduled run is readable without opening the log.
+// ---------------------------------------------------------------------------
+import fs from 'node:fs';
+import os from 'node:os';
+import { spawnSync } from 'node:child_process';
+
+test('disposition: red is reserved for findings that could not be recorded', () => {
+  // A clean sweep is green even if filing was impossible — nothing was lost.
+  assert.deepEqual(p.disposition({ findingClasses: 0, doFile: true, blocker: 'no session' }),
+    { action: 'clean', exitCode: 0 });
+  // A dry run prints; it never claims to have filed, so it never fails.
+  assert.deepEqual(p.disposition({ findingClasses: 3, doFile: false, blocker: null }),
+    { action: 'dry-run', exitCode: 0 });
+  // Findings filed for adjudication = the patrol working as designed (ADR 0162).
+  // If this ever became a failure, a weekly red would train everyone to ignore it.
+  assert.deepEqual(p.disposition({ findingClasses: 3, doFile: true, blocker: null }),
+    { action: 'file', exitCode: 0 });
+  // The ONE red state: findings exist, filing was asked for, and it cannot happen.
+  assert.deepEqual(p.disposition({ findingClasses: 3, doFile: true, blocker: 'no GDS session on this runner' }),
+    { action: 'not-filed', exitCode: 2 });
+  assert.deepEqual(p.disposition(), { action: 'clean', exitCode: 0 });
+});
+
+test('stepSummary appends markdown for the Actions UI, and is inert off-CI', () => {
+  const f = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'patrol-')), 'summary.md');
+  const prev = process.env.GITHUB_STEP_SUMMARY;
+  try {
+    process.env.GITHUB_STEP_SUMMARY = f;
+    p.stepSummary('## one');
+    p.stepSummary('## two');
+    assert.equal(fs.readFileSync(f, 'utf8'), '## one\n## two\n');
+    delete process.env.GITHUB_STEP_SUMMARY;
+    p.stepSummary('## three'); // must not throw, must not write anywhere
+    assert.equal(fs.readFileSync(f, 'utf8'), '## one\n## two\n');
+  } finally {
+    if (prev === undefined) delete process.env.GITHUB_STEP_SUMMARY;
+    else process.env.GITHUB_STEP_SUMMARY = prev;
+  }
+});
+
+test('filingBlocker reports a sessionless runner instead of exiting with re-auth guidance', () => {
+  // The regression guarded here: cli-lib's apiCall answers 401 by PRINTING
+  // "run /builder-reauth" and calling process.exit(2). In a cron log that is
+  // indistinguishable from a crash, and it kills the run before the findings are
+  // ever printed. A subprocess with an empty HOME is the only honest way to
+  // simulate a runner with no session file — the suite's own machine has one.
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'patrol-home-'));
+  const r = spawnSync(process.execPath, ['-e',
+    `const p = require(${JSON.stringify(path.join(ROOT, 'scripts', 'gds', 'redteam-patrol.js'))});
+     console.log(JSON.stringify({ blocker: p.filingBlocker() }));`,
+  ], { env: { ...process.env, HOME: home, USERPROFILE: home }, encoding: 'utf8' });
+  assert.equal(r.status, 0, `expected a clean return, not an exit: ${r.stderr}`);
+  const out = JSON.parse(r.stdout.trim().split('\n').pop());
+  assert.equal(typeof out.blocker, 'string');
+  assert.match(out.blocker, /no GDS session|session unreadable/);
+  assert.doesNotMatch(r.stdout + r.stderr, /builder-reauth/,
+    'the sessionless path must not print interactive re-auth guidance into a cron log');
+});