@bongos/core 1.19.340 → 1.19.342

package/scripts/gds/redteam-patrol.js

@@ -24,6 +24,24 @@
 // to /api/gds/security/reports. --canary proves the end-to-end pipe: plants a
 // constructed token, asserts the scanner catches it, files a low "[canary]"
 // report, and dispute-closes it so the queue stays clean.
+//
+// UNATTENDED RUNS (task 1003209). The scheduler is .github/workflows/redteam-patrol.yml
+// — CI, not the always-on server, because all three checks read things only the
+// REPO has: full git history, .github/workflows/, and a package-lock npm can audit
+// (ADR 0188). A CI runner has no GDS session, so --file would otherwise hit
+// cli-lib's interactive re-auth wall and print "run /builder-reauth" into a cron
+// log. Instead --file preflights the session and, when there is none, follows the
+// main-audit.js --require-roster doctrine: report LOUDLY rather than green-and-
+// vacuous. The exit code says whether a finding was LOST, not whether findings
+// exist — findings are advisory (ADR 0162) and a patrol that goes red merely for
+// doing its job trains everyone to ignore it:
+//
+//   ran + filed                     → 0
+//   ran, nothing to file            → 0 (with or without a session)
+//   ran, has findings, cannot file  → 2 — the one state where evidence evaporates
+//
+// Findings are ALSO appended to $GITHUB_STEP_SUMMARY when set, so a scheduled run
+// is readable in the Actions UI without opening the log.
 
 'use strict';
 
@@ -211,6 +229,45 @@ function buildClassReport(className, findings, notes = []) {
   };
 }
 
+// Append markdown to the Actions job summary when running under GitHub Actions.
+// Best-effort and inert everywhere else — a patrol run must never fail because a
+// log surface was unavailable.
+function stepSummary(md) {
+  const dest = process.env.GITHUB_STEP_SUMMARY;
+  if (!dest) return;
+  try { fs.appendFileSync(dest, `${md}\n`); } catch { /* never fatal */ }
+}
+
+// Pure: what a completed sweep should DO with its findings, and the exit code
+// that disposition deserves. Extracted so the honest-exit contract is a table a
+// test can enumerate rather than branching buried in main().
+//
+// The load-bearing row is the last one. Findings are ADVISORY (ADR 0162), so a
+// run that finds three things and files them is a SUCCESS — going red merely for
+// doing its job is how a weekly lane becomes noise everyone filters. Red is
+// reserved for the single state where evidence EVAPORATES: findings exist,
+// filing was asked for, and it cannot happen.
+function disposition({ findingClasses = 0, doFile = false, blocker = null } = {}) {
+  if (!findingClasses) return { action: 'clean', exitCode: 0 };
+  if (!doFile) return { action: 'dry-run', exitCode: 0 };
+  if (blocker) return { action: 'not-filed', exitCode: 2 };
+  return { action: 'file', exitCode: 0 };
+}
+
+// Is there a GDS session this run could file with? Returns the reason it cannot,
+// or null when filing is possible. Read directly (readSessionToken) rather than
+// probing with apiCall, because apiCall's 401 path exits the process with
+// interactive re-auth guidance — useless in a cron log and indistinguishable from
+// a crash.
+function filingBlocker() {
+  try {
+    const { readSessionToken } = require('./cli-lib.js');
+    return readSessionToken() ? null : 'no GDS session on this runner';
+  } catch (e) {
+    return `session unreadable: ${e && e.message}`;
+  }
+}
+
 async function fileReport(report) {
   const { apiCall } = require('./cli-lib.js');
   const r = await apiCall('POST', '/api/gds/security/reports', report);
@@ -283,10 +340,30 @@ async function main() {
   const pins = actionPinCheck();
   if (pins.findings.length) classes.push(buildClassReport('action-pins', pins.findings));
 
+  if (secrets.degraded) stepSummary(`> **DEGRADED** — ${secrets.degraded}`);
+
   if (!classes.length) {
     console.log('patrol: clean sweep — nothing to file.');
+    stepSummary('## red-team patrol\n\nClean sweep — no findings to file.');
     return;
   }
+
+  stepSummary(['## red-team patrol', ...classes.map((c) =>
+    `### ${c.title}\n\nseverity: **${c.severity}**\n\n${c.repro_steps_md}`)].join('\n\n'));
+
+  // Preflight the session ONCE, before the first POST: a half-filed sweep (class
+  // one lands, class two hits the auth wall and exits) is worse than not starting.
+  const blocker = doFile ? filingBlocker() : null;
+  const { action, exitCode } = disposition({ findingClasses: classes.length, doFile, blocker });
+  if (action === 'not-filed') {
+    console.error(`patrol: DID NOT FILE — ${blocker}. ${classes.length} finding class(es) above are NOT in the adjudication queue.`);
+    console.error('patrol: sign in on this runner (or set the scheduler\'s session secret) and re-run — see docs/recipes/redteam-patrol.md.');
+    for (const report of classes) console.error(`  [${report.severity}] ${report.title}\n${report.repro_steps_md}`);
+    stepSummary(`\n> **NOT FILED** — ${blocker}. These findings exist only in this run's log.`);
+    process.exitCode = exitCode;
+    return;
+  }
+
   for (const report of classes) {
     if (doFile) {
       const id = await fileReport(report);
@@ -305,4 +382,5 @@ if (require.main === module) {
 module.exports = {
   parseGitleaksReport, unpinnedUses, ageDays, mapSeverity, maxSeverity,
   buildClassReport, lockedVersion, COOLDOWN_DAYS, YOUNG_PKG_DAYS,
+  stepSummary, filingBlocker, disposition,
 };

package/scripts/gds/routine-schedule.js

@@ -0,0 +1,231 @@
+#!/usr/bin/env node
+// scripts/gds/routine-schedule.js — a declared cadence must have something that
+// fires it (task 1003209, goal 1000079; docs/audits/ai-dev-redteam-followup.md §7).
+//
+// THE GAP THIS CLOSES. Goal 1000076 shipped the redteam-weekly patrol, wired it
+// into the control manifest, and documented it — and then nothing ever ran it.
+// The follow-up audit's §7 named all three halves of the failure:
+//
+//   1. no committed scheduler for .claude/scheduled-tasks/ at all;
+//   2. the SKILL.md declared `mode` and `steps` but no cadence — "nothing for a
+//      scheduler to read even if one looked";
+//   3. control-manifest.js called the patrol "wired" on a substring (the SKILL.md
+//      mentions its own scanner), so the manifest was GREEN while the patrol was
+//      dormant.
+//
+// (2) is now a real frontmatter field (run-routine.js parseRoutineFrontmatter),
+// (1) is .github/workflows/redteam-patrol.yml, and THIS file is (3): the check
+// that refuses the combination of a declared cadence and nothing firing it.
+//
+// WHY A DEDICATED CHECK RATHER THAN ANOTHER MANIFEST ROW. The manifest's
+// predicates are deliberately shallow — file exists, one wiring substring. That
+// shape is exactly what let the patrol read as wired while dormant, and this goal
+// has now hit the same failure five times: an enforcement surface that NAMES a
+// file goes VACUOUS, not red, when the thing it names moves or stops. So the
+// predicate here is relational, not existential: it reads the cadence each
+// routine declares, reads the cron each scheduler actually carries, and fails
+// when the two disagree in EITHER direction —
+//
+//   • a routine declares `cadence:` and no scheduler fires it   → red
+//   • a scheduler fires a routine that no longer exists         → red (rename rot)
+//   • the cron's real period differs from the declared cadence  → red
+//
+// The third is the one a substring check can never catch: edit the cron from
+// weekly to yearly and every "is it wired?" predicate stays green.
+//
+// TWO-REPO TOLERANCE. Scheduled routines are TOPOLOGY — `bongos init/upgrade`
+// materializes .claude/scheduled-tasks/ into each instance (claude-materialize.js),
+// but .github/workflows/ is the CORE repo's and does not travel. So an instance
+// checkout legitimately has routines and no workflows directory. There, the
+// unscheduled routines are reported as WARNINGS (the instance's operator owns its
+// own scheduler); in a repo that HAS workflows, they are violations. That keeps
+// the check honest in the core without red-building every instance.
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const TASKS_DIR = path.join(ROOT, '.claude', 'scheduled-tasks');
+const WORKFLOWS_DIR = path.join(ROOT, '.github', 'workflows');
+
+const { parseRoutineFrontmatter } = require('./run-routine.js');
+
+// The cadences a routine may declare. The value is the period a cron expression
+// must resolve to for the two to agree. Add a name here and cronCadence() below
+// must be able to produce it, or the pair can never match.
+const CADENCES = new Set(['hourly', 'daily', 'weekly', 'monthly']);
+
+// Pure: classify a 5-field cron expression into the cadence it actually realizes.
+// Returns null for anything this vocabulary cannot describe (step values, lists,
+// ranges) — a cadence can then never "match" it, which is the safe direction: an
+// exotic cron must be described some other way rather than silently accepted.
+//
+//   min hour dom mon dow
+//   17   6    *   *   1   → weekly   (a specific day-of-week)
+//   17   6    *   *   *   → daily    (a specific hour, every day)
+//   17   6    3   *   *   → monthly  (a specific day-of-month)
+//   17   *    *   *   *   → hourly   (a specific minute, every hour)
+function cronCadence(expr) {
+  const f = String(expr == null ? '' : expr).trim().split(/\s+/);
+  if (f.length !== 5) return null;
+  const [min, hour, dom, mon, dow] = f;
+  const fixed = (v) => /^\d+$/.test(v);
+  const any = (v) => v === '*';
+  if (!fixed(min)) return null;          // every cadence below pins the minute
+  if (!any(mon)) return null;            // a specific month is a yearly shape
+  if (any(hour)) return any(dom) && any(dow) ? 'hourly' : null;
+  if (!fixed(hour)) return null;
+  if (fixed(dow) && any(dom)) return 'weekly';
+  if (fixed(dom) && any(dow)) return 'monthly';
+  if (any(dom) && any(dow)) return 'daily';
+  return null;
+}
+
+// Pure: every cron expression a workflow file declares under `on: schedule:`.
+// A focused subset of YAML (the repo has no js-yaml dep and the parser in
+// run-routine.js is the same shape): the `cron:` keys are unambiguous enough to
+// read directly, and a workflow that hides one behind an anchor would simply
+// read as unscheduled — the safe direction.
+function workflowCrons(yamlText) {
+  const out = [];
+  for (const line of String(yamlText == null ? '' : yamlText).split('\n')) {
+    const m = /^\s*-?\s*cron:\s*['"]?([^'"#\n]+?)['"]?\s*(?:#.*)?$/.exec(line);
+    if (m) out.push(m[1].trim());
+  }
+  return out;
+}
+
+// Pure: does `yamlText` actually invoke routine `name`? Either the canonical
+// dispatcher form (`run-routine.js <name>`) or one of the routine's own step
+// commands verbatim. Both are real invocations; a mere mention in prose is not,
+// which is the whole point — the substring predicate this replaces was satisfied
+// by a comment.
+function invokesRoutine(yamlText, name, steps = []) {
+  const hay = String(yamlText == null ? '' : yamlText);
+  const dispatched = new RegExp(`run-routine\\.js\\s+(?:--\\S+\\s+)*${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\w-])`);
+  if (dispatched.test(hay)) return true;
+  return steps.some((s) => s.command && hay.includes(s.command));
+}
+
+// Read every routine that declares a cadence, plus the ones that don't.
+function readRoutines(dir = TASKS_DIR) {
+  const withCadence = [];
+  const withoutCadence = [];
+  let names = [];
+  try {
+    names = fs.readdirSync(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch (_) { return { withCadence, withoutCadence }; }
+  for (const name of names.sort()) {
+    let md;
+    try { md = fs.readFileSync(path.join(dir, name, 'SKILL.md'), 'utf8'); } catch (_) { continue; }
+    const { cadence, steps } = parseRoutineFrontmatter(md);
+    if (cadence) withCadence.push({ name, cadence, steps });
+    else withoutCadence.push({ name });
+  }
+  return { withCadence, withoutCadence };
+}
+
+function readWorkflows(dir = WORKFLOWS_DIR) {
+  let files = [];
+  try { files = fs.readdirSync(dir).filter((f) => f.endsWith('.yml') || f.endsWith('.yaml')); }
+  catch (_) { return null; } // null = no workflows directory at all (instance repo)
+  return files.sort().map((f) => ({ file: f, text: fs.readFileSync(path.join(dir, f), 'utf8') }));
+}
+
+// Pure evaluation — exported for the test, which drives it with fixtures.
+// `workflows === null` means "this checkout has no CI to schedule with", which
+// downgrades unscheduled routines from violations to warnings (see the two-repo
+// note in the header).
+function evaluate({ withCadence, withoutCadence }, workflows) {
+  const violations = [];
+  const warnings = [];
+  const hasCI = workflows !== null;
+  const wf = workflows || [];
+
+  for (const r of withCadence) {
+    if (!CADENCES.has(r.cadence)) {
+      violations.push(`routine '${r.name}': unknown cadence "${r.cadence}" (want ${[...CADENCES].join('|')})`);
+      continue;
+    }
+    const firing = wf.filter((w) => invokesRoutine(w.text, r.name, r.steps));
+    if (!firing.length) {
+      const msg = `routine '${r.name}' declares cadence: ${r.cadence} but NOTHING fires it — no scheduled workflow invokes it`;
+      (hasCI ? violations : warnings).push(msg);
+      continue;
+    }
+    // It is invoked somewhere. At least one of those invocations must be on a
+    // schedule whose real period is the declared cadence. A workflow_dispatch-only
+    // lane is a human running it — exactly the state §7 called "decorative".
+    const seen = [];
+    let matched = false;
+    for (const w of firing) {
+      for (const expr of workflowCrons(w.text)) {
+        const actual = cronCadence(expr);
+        seen.push(`${w.file}: "${expr}" → ${actual || 'unclassifiable'}`);
+        if (actual === r.cadence) matched = true;
+      }
+    }
+    if (!matched) {
+      violations.push(
+        seen.length
+          ? `routine '${r.name}' declares cadence: ${r.cadence} but no scheduler fires it at that period — ${seen.join('; ')}`
+          : `routine '${r.name}' declares cadence: ${r.cadence} but ${firing.map((w) => w.file).join(', ')} carries no 'on: schedule:' cron (manual dispatch only)`
+      );
+    }
+  }
+
+  // Rename rot, the other direction: a scheduler that dispatches a routine name
+  // no longer on disk. run-routine.js exits 2 on a missing SKILL.md, so this
+  // would be a weekly red job nobody watches; catch it at merge time instead.
+  // Deduped: a workflow legitimately names its own invocation more than once (the
+  // step itself plus the header comment explaining why it dispatches rather than
+  // calling the script), and one rename should read as one problem.
+  const known = new Set([...withCadence, ...withoutCadence].map((r) => r.name));
+  const dangling = new Set();
+  for (const w of wf) {
+    for (const m of w.text.matchAll(/run-routine\.js\s+(?:--\S+\s+)*([A-Za-z0-9_-]+)/g)) {
+      if (!known.has(m[1])) dangling.add(`${w.file} dispatches routine '${m[1]}', which has no .claude/scheduled-tasks/${m[1]}/SKILL.md`);
+    }
+  }
+  violations.push(...dangling);
+
+  for (const r of withoutCadence) {
+    warnings.push(`routine '${r.name}' declares no cadence: — it can only ever be run by hand`);
+  }
+  return { violations, warnings };
+}
+
+// The fitness.js check.
+function checkRoutineCadencesScheduled() {
+  const routines = readRoutines();
+  const workflows = readWorkflows();
+  const { violations, warnings } = evaluate(routines, workflows);
+  const scheduled = routines.withCadence.length - violations.filter((v) => v.startsWith("routine '")).length;
+  return {
+    name: 'a declared cron cadence has something that fires it (task 1003209)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings,
+    note: violations.length
+      ? 'a scheduled routine is declared but dormant — add/repair the scheduler, or drop the cadence: field and stop claiming it runs'
+      : `${scheduled}/${routines.withCadence.length} cadence-declaring routine(s) fired by a committed scheduler at the declared period; ${routines.withoutCadence.length} manual-only.`,
+  };
+}
+
+function main() {
+  const r = checkRoutineCadencesScheduled();
+  for (const v of r.violations) console.error(`✗ ${v}`);
+  for (const w of r.warnings) console.warn(`⚠ ${w}`);
+  console.log(`${r.hardFail ? 'FAIL' : 'PASS'}  ${r.note}`);
+  process.exit(r.hardFail ? 1 : 0);
+}
+
+if (require.main === module) main();
+
+module.exports = {
+  checkRoutineCadencesScheduled, evaluate, cronCadence, workflowCrons,
+  invokesRoutine, readRoutines, readWorkflows, CADENCES,
+};

package/scripts/gds/run-routine.js

@@ -47,12 +47,19 @@ function unquote(s) {
   return t;
 }
 
-// Pure: parse mode + steps[] from SKILL.md frontmatter. A focused YAML subset
-// (no js-yaml dep): scalar `mode:`/`description:` and a `steps:` list of
-// `- command: …` / `sink: …` items. Unknown keys are ignored. Exported + tested.
+// Pure: parse mode + cadence + steps[] from SKILL.md frontmatter. A focused YAML
+// subset (no js-yaml dep): scalar `mode:`/`cadence:`/`description:` and a `steps:`
+// list of `- command: …` / `sink: …` items. Unknown keys are ignored. Exported + tested.
+//
+// `cadence:` (task 1003209) is the field the follow-up audit found missing — the
+// routines declared HOW to run but never HOW OFTEN, so "there was nothing for a
+// scheduler to read even if one looked." It is declarative only: run-routine.js
+// still runs a routine exactly once per invocation. The cadence is the contract a
+// committed scheduler must honour, and scripts/gds/routine-schedule.js is the check
+// that refuses a cadence nothing fires.
 function parseRoutineFrontmatter(skillMd) {
   const norm = String(skillMd == null ? '' : skillMd).replace(/\r\n/g, '\n');
-  const empty = { mode: null, steps: [], description: null };
+  const empty = { mode: null, cadence: null, steps: [], description: null };
   if (!norm.startsWith('---\n')) return empty;
   const lines = norm.split('\n');
   let close = -1;
@@ -62,6 +69,7 @@ function parseRoutineFrontmatter(skillMd) {
   if (close === -1) return empty;
 
   let mode = null;
+  let cadence = null;
   let description = null;
   const steps = [];
   let inSteps = false;
@@ -96,12 +104,13 @@ function parseRoutineFrontmatter(skillMd) {
 
     if (!inSteps && isTopLevel && topKv) {
       if (topKv[1] === 'mode') mode = unquote(topKv[2]) || null;
+      else if (topKv[1] === 'cadence') cadence = unquote(topKv[2]) || null;
       else if (topKv[1] === 'description') description = topKv[2].trim();
       else if (topKv[1] === 'steps' && topKv[2].trim() === '') inSteps = true;
     }
   }
   pushCur();
-  return { mode, steps, description };
+  return { mode, cadence, steps, description };
 }
 
 // Pure: split a repo-authored command string into argv, honoring simple quotes.

package/src/module-api.js

@@ -1110,8 +1110,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.338 with no explicit bump. run 32797325535. (task 1002620)
 //   1.19.340 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.339 with no explicit bump. run 32798342738. (task 1002620)
+//   1.19.341 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.340 with no explicit bump. run 32798507686. (task 1002620)
+//   1.19.342 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.341 with no explicit bump. run 32799103427. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.340'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.342'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/push_path_brief.mjs

@@ -0,0 +1,90 @@
+// tests/push_path_brief.mjs
+//
+// Task 1003259 / idea 1000838 — a dev-box agent, unable to see WHY its git probes were
+// failing, asked the owner to mint a PAT and store it on the box. push-path-brief.js is
+// the SessionStart line that states the credential model natively so that request never
+// gets made again. These tests pin BOTH halves: the line fires on the server-publish
+// path with the load-bearing phrases intact, and it is SILENT everywhere else — the
+// silence is half the design (a line firing on every healthy laptop becomes wallpaper).
+//
+// DB-free + network-free: briefLine is pure, and the CLI cases force the path with
+// OTB_PUSH_VIA_SERVER so pushVia() never spawns gh. Run:  node tests/push_path_brief.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const brief = require('../scripts/gds/push-path-brief.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ---- the pure core -----------------------------------------------------------
+
+t('server path gets the brief, with every load-bearing phrase', () => {
+  const l = brief.briefLine('server');
+  assert.ok(typeof l === 'string' && l.length > 0, 'expected a line on the server path');
+  // Each phrase is one of the three facts the 2026-08-24 incident showed an agent
+  // cannot infer from inside a box. Losing any of them re-opens the gap.
+  for (const must of [
+    'NO GitHub push credential',
+    'BY DESIGN',
+    '/builder-ship',
+    'NEVER ask the owner for a PAT',
+    'publish-status',
+  ]) {
+    assert.ok(l.includes(must), `line must state: ${must}`);
+  }
+});
+
+t('local path is SILENT — null, not an empty string', () => {
+  assert.equal(brief.briefLine('local'), null);
+});
+
+t('undetermined path stays silent (fail-open, exact vocabulary only)', () => {
+  assert.equal(brief.briefLine(null), null);
+  assert.equal(brief.briefLine(undefined), null);
+  assert.equal(brief.briefLine('SERVER'), null);
+  assert.equal(brief.briefLine('ci'), null);
+});
+
+t('the line is the exported static constant — nothing is interpolated', () => {
+  // Trust boundary: this string is injected into every box session's context. Pinning
+  // it to the constant proves no builder-authored text can ever ride along.
+  assert.equal(brief.briefLine('server'), brief.BRIEF);
+});
+
+// ---- the CLI, end-to-end through the pushVia() override -----------------------
+
+const script = path.join(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '..', 'scripts', 'gds', 'push-path-brief.js',
+);
+function runCli(env) {
+  return spawnSync(process.execPath, [script, '--line'], {
+    env: { ...process.env, ...env },
+    encoding: 'utf8',
+    timeout: 15000,
+  });
+}
+
+t('--line on the forced server path prints the brief and exits 0', () => {
+  const r = runCli({ OTB_PUSH_VIA_SERVER: '1' });
+  assert.equal(r.status, 0, `expected exit 0, got ${r.status} (stderr: ${r.stderr})`);
+  assert.ok(r.stdout.includes('publish-status'), 'expected the brief on stdout');
+});
+
+t('--line on the forced local path prints NOTHING and still exits 0', () => {
+  const r = runCli({ OTB_PUSH_VIA_SERVER: '0' });
+  assert.equal(r.status, 0, `expected exit 0, got ${r.status} (stderr: ${r.stderr})`);
+  assert.equal(r.stdout.trim(), '', 'the laptop case must be silent');
+});
+
+console.log(`\npush_path_brief: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/redteam_patrol.mjs

@@ -65,3 +65,66 @@ test('buildClassReport caps the item list, counts the remainder, and takes max s
   assert.match(r.repro_steps_md, /…and 3 more/);
   assert.match(r.repro_steps_md, /Notes:/);
 });
+
+// ---------------------------------------------------------------------------
+// Unattended-run behaviour (task 1003209): the patrol now runs on CI, which has
+// no GDS session. These pin the two things that turns on — an exit code that
+// means "a finding was LOST" rather than "a finding exists", and a job-summary
+// surface so a scheduled run is readable without opening the log.
+// ---------------------------------------------------------------------------
+import fs from 'node:fs';
+import os from 'node:os';
+import { spawnSync } from 'node:child_process';
+
+test('disposition: red is reserved for findings that could not be recorded', () => {
+  // A clean sweep is green even if filing was impossible — nothing was lost.
+  assert.deepEqual(p.disposition({ findingClasses: 0, doFile: true, blocker: 'no session' }),
+    { action: 'clean', exitCode: 0 });
+  // A dry run prints; it never claims to have filed, so it never fails.
+  assert.deepEqual(p.disposition({ findingClasses: 3, doFile: false, blocker: null }),
+    { action: 'dry-run', exitCode: 0 });
+  // Findings filed for adjudication = the patrol working as designed (ADR 0162).
+  // If this ever became a failure, a weekly red would train everyone to ignore it.
+  assert.deepEqual(p.disposition({ findingClasses: 3, doFile: true, blocker: null }),
+    { action: 'file', exitCode: 0 });
+  // The ONE red state: findings exist, filing was asked for, and it cannot happen.
+  assert.deepEqual(p.disposition({ findingClasses: 3, doFile: true, blocker: 'no GDS session on this runner' }),
+    { action: 'not-filed', exitCode: 2 });
+  assert.deepEqual(p.disposition(), { action: 'clean', exitCode: 0 });
+});
+
+test('stepSummary appends markdown for the Actions UI, and is inert off-CI', () => {
+  const f = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'patrol-')), 'summary.md');
+  const prev = process.env.GITHUB_STEP_SUMMARY;
+  try {
+    process.env.GITHUB_STEP_SUMMARY = f;
+    p.stepSummary('## one');
+    p.stepSummary('## two');
+    assert.equal(fs.readFileSync(f, 'utf8'), '## one\n## two\n');
+    delete process.env.GITHUB_STEP_SUMMARY;
+    p.stepSummary('## three'); // must not throw, must not write anywhere
+    assert.equal(fs.readFileSync(f, 'utf8'), '## one\n## two\n');
+  } finally {
+    if (prev === undefined) delete process.env.GITHUB_STEP_SUMMARY;
+    else process.env.GITHUB_STEP_SUMMARY = prev;
+  }
+});
+
+test('filingBlocker reports a sessionless runner instead of exiting with re-auth guidance', () => {
+  // The regression guarded here: cli-lib's apiCall answers 401 by PRINTING
+  // "run /builder-reauth" and calling process.exit(2). In a cron log that is
+  // indistinguishable from a crash, and it kills the run before the findings are
+  // ever printed. A subprocess with an empty HOME is the only honest way to
+  // simulate a runner with no session file — the suite's own machine has one.
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'patrol-home-'));
+  const r = spawnSync(process.execPath, ['-e',
+    `const p = require(${JSON.stringify(path.join(ROOT, 'scripts', 'gds', 'redteam-patrol.js'))});
+     console.log(JSON.stringify({ blocker: p.filingBlocker() }));`,
+  ], { env: { ...process.env, HOME: home, USERPROFILE: home }, encoding: 'utf8' });
+  assert.equal(r.status, 0, `expected a clean return, not an exit: ${r.stderr}`);
+  const out = JSON.parse(r.stdout.trim().split('\n').pop());
+  assert.equal(typeof out.blocker, 'string');
+  assert.match(out.blocker, /no GDS session|session unreadable/);
+  assert.doesNotMatch(r.stdout + r.stderr, /builder-reauth/,
+    'the sessionless path must not print interactive re-auth guidance into a cron log');
+});