@bongos/core 1.19.415 → 1.19.416

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.415",
-  "core_contract": "1.19.415",
-  "source_commit": "6e1130920b6477c117c5b10a7f2754db87ef558a",
+  "core_version": "1.19.416",
+  "core_contract": "1.19.416",
+  "source_commit": "1380d5372fffa712f955b0b7375a8b3a99089c8c",
   "source_ref": "HEAD",
-  "built_at": "2026-08-29T16:12:53.136Z",
+  "built_at": "2026-08-29T16:18:39.698Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 355,
     "agent_docs_stubbed": 23,
-    "functional_verbatim": 1698,
+    "functional_verbatim": 1699,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2076,
-  "tree_sha256": "992018f989d8c0b69b801d98f5bae82fb871101fb97f42f1dd43c3b4a63548cf",
+  "file_count": 2077,
+  "tree_sha256": "7e57eaed4b7d4afd8c45bd44503ead5fd9477a96aef101d6f04be3c23ff3bacc",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1902,7 +1902,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "0eda387feba9769e7bd939ec6072f2e562f54d896b56816272f351d8798cf125"
+      "sha256": "76febc87dd3d8b6641673093df2efa7c699a33428e6a53bc1cf595e0f3daf558"
     },
     {
       "path": "docs/handoff-template.md",
@@ -1912,7 +1912,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "728e49741b202322cb1e86147fd1a063e9421d094e6fa39ebbf11afa216ab23e"
+      "sha256": "d8522f28a0009d2a15f4f4ae69488855022aff8a7d6e17bc33ec2f5d2c95b9d1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5422,12 +5422,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5d5bd36ca85d6db8f0d37e036f6660c525eb07e49335f76d3fc23f33a4b56fe5"
+      "sha256": "56b89bb9c7f6bea14a6a8f9a5c2e90443950df52ae44aeb73a553ce0db9590ad"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b1bf9ff0d5e9155030c651fa5eea3e1ce81a683394b7090c5d48b1a87fc79ada"
+      "sha256": "cd9fe4e19f8f3642c0953f045fff13a8392ddd844da6e131d4a9b1a237fa372d"
     },
     {
       "path": "public-docs/index.html",
@@ -7542,7 +7542,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "85ade7dd85598993897af78be6cee56b8476a8bb1762866b3e6fc9586bad3694"
+      "sha256": "30e53d05c81c6182e0e58d7c14a5c5c7a053cd0fe818c1dfbba2bb9f77d9c860"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9227,7 +9227,7 @@
     {
       "path": "tests/memory_isolation.mjs",
       "mode": "0000644",
-      "sha256": "2982e61db8b1b3862dffa75d4cc3a9ce1a422b9070a9b84cc080247f4af1fa62"
+      "sha256": "92d1c3d8343b0e2742c4fbbcfa3276a0cc99767229c4eb628a4dfc10a4181d67"
     },
     {
       "path": "tests/memory_map.mjs",
@@ -9449,6 +9449,11 @@
       "mode": "0000644",
       "sha256": "dac9d9891eac706432aff97ce35e27692064a2791dc1e546215c74e68b81e8a8"
     },
+    {
+      "path": "tests/own_scope_guard.mjs",
+      "mode": "0000644",
+      "sha256": "694002ebe39755fd01bdba57bf70e7077201b81a6938df92fff09b44027a29cc"
+    },
     {
       "path": "tests/package_core.mjs",
       "mode": "0000644",

package/docs/file-map.md

@@ -347,6 +347,7 @@ tests/
 ├── linkify_refs.mjs              ← (#604): the doc-linkifier classifier — pins which `#NNN` rewrite (tasks) vs stay bare (heading anchors, link targets, idea/blocker/session/PR ids, code spans), incl. comma-list entity inheritance + idempotency.
 ├── sandbox_stage.mjs             ← (#927, ADR 0046): sandbox-first review gate — box detection, BOX_PREVIEW_HOSTNAME parsing, previewable-surface matching, decideShipGate table, tree-stamp freshness (temp git repo), runShipGate composition with injected fs/exec/prompt.
 ├── session_start_freshness.mjs   ← (#1277, ADR 0067): the SessionStart freshness decision (decideFreshness) — pull ONLY on a clean `main` full clone strictly behind origin/main; warn in every other behind case; skip when up to date.
+├── own_scope_guard.mjs           ← (task 1003343, goal 1000045 criterion own-scope-held-by-a-test): the OWN-SCOPE structural guard, generalised out of memory_isolation.mjs. An explicit inventory of own-scoped route files; inside them the route's declared PATH decides — a path naming no builder must never read a subject from the request (direct, optional-chained, destructured, aliased, computed-key or header), a path that DOES name one needs a per-route exemption whose gate the guard verifies is present. Repo-wide backstop: any file mounting a `/me` route must be in the inventory. Source-grepping, so it runs in the DB-free `unit` lane.
 └── public_task_resolver.mjs      ← (#604): the public `/public/tasks/:id` projection — title/value_summary exposed only for shipped|confirmed; withheld for in-flight so unshipped/security task names can't leak.
 ```
 

package/docs/module-api-changelog.md

@@ -1267,5 +1267,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.413 with no explicit bump. run 33260596712. (task 1002620)
   1.19.415 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.414 with no explicit bump. run 33262322596. (task 1002620)
+  1.19.416 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.415 with no explicit bump. run 33262582879. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.415",
+  "version": "1.19.416",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.415",
+      "version": "1.19.416",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.415",
+  "version": "1.19.416",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.415'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.416'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/memory_isolation.mjs

@@ -212,6 +212,10 @@ await t('production code contains no grader-system references', () => {
   assert.ok(!/hacker worker/i.test(rawSrc), 'memory.js route source must not mention grader workers');
 });
 
+// GENERALISED (task 1003343): this check now also exists — for memory.js AND for
+// every other own-scoped surface (/me, builder-settings, platform-identity) — in
+// tests/own_scope_guard.mjs, which runs in the DB-free unit lane. This file is in
+// the INTEGRATION set, so the copy below gates nothing in CI; keep them agreeing.
 await t('the SELF read endpoints never derive the owner from request input', () => {
   assert.ok(!/req\.query\.builder/i.test(codeOnly), 'no owner should come from req.query.builder*');
   assert.ok(!/req\.body\.builder/i.test(codeOnly), 'no owner should come from req.body.builder*');

package/tests/own_scope_guard.mjs

@@ -0,0 +1,472 @@
+// tests/own_scope_guard.mjs
+//
+// THE OWN-SCOPE STRUCTURAL GUARD — "an own-scoped route takes its subject from
+// the authenticated session, never from the request" (goal 1000045, criterion
+// own-scope-held-by-a-test; task 1003343).
+//
+// WHY THIS EXISTS. The 2026-08-28 account-security audit found the hole CLOSED:
+// no route on main derives acting identity from a URL, query, body or header
+// parameter. But it was closed BY CONSTRUCTION — held by convention and code
+// review, with nothing in CI to stop a future edit reopening it. One module
+// already held the line structurally (modules/memory, tests/memory_isolation.mjs)
+// and that guard covered exactly one file — and sits in the INTEGRATION set, so
+// it never runs in the DB-free PR lane. This file generalises it to every
+// own-scoped surface and lives in the lane that actually executes (task 1002282:
+// a proof that never runs is not a gate).
+//
+// THE MECHANISM — how an own-scoped route is told apart from a legitimate
+// cross-owner one, which takes an identifier DELIBERATELY and is rank-gated
+// instead (PATCH /builders/:id/rank, the /boxes/:builderId fleet routes,
+// POST /government/assignments, the goals membership routes, release-on-behalf):
+//
+//   1. An explicit INVENTORY of own-scoped surface FILES, one stated reason
+//      each. A blanket grep across all routes would break the cross-owner ones;
+//      the inventory is what keeps the guard off them entirely.
+//   2. Inside an inventoried file, THE ROUTE'S OWN DECLARED PATH decides. A
+//      route that means to act on somebody else NAMES them in its path
+//      (`:builderId`). A route whose path names no builder is own-scoped, full
+//      stop — that is the route's own public promise to its callers, it cannot
+//      be forgotten (you cannot declare a route without a path), and it is
+//      exactly the promise this guard enforces.
+//   3. A path that DOES name a builder is a cross-owner route, and is allowed
+//      only via a per-route exemption carrying a stated reason AND a required
+//      GATE PATTERN THE GUARD VERIFIES IS PRESENT. The exemption does not
+//      exempt — it substitutes a different, checked obligation. Drop the gate
+//      and the route fails here even though it is on the exemption list.
+//   4. A DISCOVERY BACKSTOP over every route file in the repo: any file that
+//      declares a `/me`-mounted route must be in the inventory. `/me` is
+//      unambiguous — nothing cross-owner is ever mounted there — so a future
+//      own-scoped surface cannot appear without either joining the inventory or
+//      failing this test.
+//
+// Rejected alternatives, and why: a marker/annotation convention (`@own-scoped`)
+// is invisible to the guard exactly when the author forgets it, which is the
+// failure mode we exist to catch. An allowlist of exempt ROUTES with no gate
+// check is a free pass — the greenest fix for a red build becomes "add a line to
+// the allowlist". Detecting the adjacent rank gate ALONE cannot work either:
+// rank is a PRIVILEGE dimension, not an OWNERSHIP one (a cross-owner route can
+// be metic-gated and a self route archon-gated), which is precisely why
+// src/bongos/route-rank-check.js cannot catch an own-scoped route growing an
+// override parameter. Here the gate check is used only where ownership has
+// already been established from the path.
+//
+// DB-free by construction: this reads source text. No Postgres, no server.
+//
+// Run:  node tests/own_scope_guard.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
+
+const here = path.dirname(url.fileURLToPath(import.meta.url));
+const repo = path.join(here, '..');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ===========================================================================
+// The inventory — own-scoped surfaces, one stated reason each.
+// ===========================================================================
+
+const OWN_SCOPED_SURFACES = [
+  {
+    file: 'src/bongos/routes/me.js',
+    why: 'the /me aggregator: identity, rank, credits, streak, claims and prefs for the CALLER. Every slice keys on req.builder.id.',
+    crossOwner: [],
+  },
+  {
+    file: 'modules/builder-settings/routes/settings.js',
+    why: 'the per-builder preference domain (wandering, skill, sound, render, model-allocation, display name) carved out of /me — read and write, all keyed on req.builder.id.',
+    crossOwner: [],
+  },
+  {
+    file: 'modules/platform-identity/routes/profile.js',
+    why: "the builder's OWN cross-project profile controls (hide flag, handle, bio/links) — all keyed on req.builder.github_id.",
+    crossOwner: [],
+  },
+  {
+    file: 'modules/memory/routes/memory.js',
+    why: 'per-builder memory (ADR 0024 §4). The self endpoints are own-scoped; the five cross-builder endpoints name their target in the path and are gate-verified below.',
+    crossOwner: [
+      {
+        path: '/memory/builders/:builderId/files',
+        gate: /requirePermission\(\s*['"]memory\.read\.any['"]\s*\)/,
+        why: 'forensic LIST of another builder\'s memory metadata — permission-gated on the memory.read.any atom and audit-logged.',
+      },
+      {
+        path: '/memory/builders/:builderId/file',
+        gate: /requirePermission\(\s*['"]memory\.read\.any['"]\s*\)/,
+        why: 'forensic READ of another builder\'s memory file — permission-gated on the memory.read.any atom and audit-logged.',
+      },
+      {
+        path: '/memory/bfg/builders/:builderId/files',
+        gate: /requireBfgPrincipal/,
+        why: 'the BFG session-analysis LIST — gated on the BFG principal identity, stricter than any rank (ADR 0026 §6C).',
+      },
+      {
+        path: '/memory/bfg/builders/:builderId/file',
+        gate: /requireBfgPrincipal/,
+        why: 'the BFG session-analysis READ — gated on the BFG principal identity.',
+      },
+      {
+        path: '/memory/builders/:builderId/bfg-write',
+        gate: /requireBfgPrincipal/,
+        why: 'the BFG cross-builder WRITE — gated on the BFG principal identity plus a kill switch.',
+      },
+    ],
+  },
+];
+
+// Floors that keep this guard from going quietly vacuous (a regex that stops
+// matching would otherwise "pass" by checking nothing).
+const MIN_OWN_SCOPED_ROUTES_TOTAL = 28;
+const MIN_OWN_SCOPED_ROUTES_PER_FILE = 3;
+
+// ===========================================================================
+// Machinery
+// ===========================================================================
+
+/**
+ * Blank out comments while preserving every byte offset and newline, so route
+ * indices and line numbers stay true. Comment prose talks ABOUT req.body.builder
+ * constantly; only real code may be judged.
+ */
+function blankComments(src) {
+  const out = src.split('');
+  let i = 0;
+  let state = 'code'; // code | line | block | sq | dq | tpl
+  while (i < src.length) {
+    const c = src[i];
+    const d = src[i + 1];
+    if (state === 'code') {
+      if (c === '/' && d === '/') { out[i] = ' '; out[i + 1] = ' '; i += 2; state = 'line'; continue; }
+      if (c === '/' && d === '*') { out[i] = ' '; out[i + 1] = ' '; i += 2; state = 'block'; continue; }
+      if (c === "'") { state = 'sq'; i++; continue; }
+      if (c === '"') { state = 'dq'; i++; continue; }
+      if (c === '`') { state = 'tpl'; i++; continue; }
+      i++; continue;
+    }
+    if (state === 'line') {
+      if (c === '\n') { state = 'code'; i++; continue; }
+      out[i] = ' '; i++; continue;
+    }
+    if (state === 'block') {
+      if (c === '*' && d === '/') { out[i] = ' '; out[i + 1] = ' '; i += 2; state = 'code'; continue; }
+      if (c !== '\n') out[i] = ' ';
+      i++; continue;
+    }
+    // inside a string literal — kept verbatim (literals are evidence, see below)
+    if (c === '\\') { i += 2; continue; }
+    if ((state === 'sq' && c === "'") || (state === 'dq' && c === '"') || (state === 'tpl' && c === '`')) { state = 'code'; i++; continue; }
+    i++;
+  }
+  return out.join('');
+}
+
+/**
+ * Does this identifier NAME A BUILDER — i.e. is it a subject selector rather
+ * than a payload field? This is the guard's contract, so it is a written list,
+ * not a vibe: anything containing "builder" or "owner", plus the explicit set of
+ * other ways one account points at another. Deliberately NOT here: `handle`,
+ * `display_name`, `anthropic_user_id` — payload the caller sets on THEMSELVES.
+ */
+const SUBJECT_NAMES = new Set([
+  'githubid', 'githublogin', 'githubuser', 'githubuserid', 'login',
+  'actas', 'asbuilder', 'onbehalf', 'onbehalfof', 'impersonate', 'impersonateas',
+  'targetid', 'targetlogin', 'targetbuilder', 'subject', 'subjectid',
+  'accountid', 'memberid', 'principal', 'principalid',
+]);
+function namesABuilder(name) {
+  const k = String(name).toLowerCase().replace(/[_-]/g, '');
+  if (k.includes('builder') || k.includes('owner')) return true;
+  return SUBJECT_NAMES.has(k);
+}
+
+const REQUEST_CONTAINERS = 'body|query|params|headers';
+const ROUTE_DECL = /\brouter\.(get|post|put|patch|delete|all)\(\s*(['"`])([^'"`\n]+)\2/g;
+const HANDLER_START = /(?:async\s*)?\(\s*_?req\s*,/;
+
+/** Split a route file into { verb, routePath, decl, body, line } records. */
+function parseRoutes(code) {
+  const decls = [...code.matchAll(ROUTE_DECL)];
+  return decls.map((m, i) => {
+    const start = m.index;
+    const end = i + 1 < decls.length ? decls[i + 1].index : code.length;
+    const window = code.slice(start, end);
+    const hIdx = window.search(HANDLER_START);
+    return {
+      verb: m[1],
+      routePath: m[3],
+      line: code.slice(0, start).split('\n').length,
+      // the middleware chain (where the gates live) vs the handler (where the
+      // subject is read). When the handler can't be located, both halves fall
+      // back to the whole window — conservative, never silently narrower.
+      decl: hIdx >= 0 ? window.slice(0, hIdx) : window,
+      body: hIdx >= 0 ? window.slice(hIdx) : window,
+    };
+  });
+}
+
+/**
+ * Every way this route pulls a named thing out of the request, as a flat list of
+ * { how, name } — direct reads, optional chaining, destructuring, aliases of a
+ * container, rest elements, literal bracket access, computed access (judged by
+ * the string literals in the route's array literals, which is where a copy-these
+ * -fields loop keeps its key list), and header lookups via req.get().
+ */
+function requestReads(routeBody) {
+  const reads = [];
+  const containerRe = String.raw`req\s*\??\.\s*(?:${REQUEST_CONTAINERS})`;
+
+  // Aliases: `const body = req.body` / `const { a, ...rest } = req.query`.
+  const aliases = new Set();
+  for (const m of routeBody.matchAll(new RegExp(String.raw`(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*${containerRe}\b`, 'g'))) {
+    aliases.add(m[1]);
+  }
+  // Re-derived on every use: the destructuring pass below can discover MORE
+  // aliases (rest elements), and each later pass must see them.
+  const containers = () => `(?:${containerRe}${aliases.size ? `|\\b(?:${[...aliases].join('|')})` : ''})`;
+
+  // Destructuring — `const { builder_id } = req.body`. A rest element becomes an
+  // alias itself: an object spread off the request IS the request.
+  for (const m of routeBody.matchAll(new RegExp(String.raw`(?:const|let|var)\s*\{([^}]*)\}\s*=\s*${containers()}\b`, 'g'))) {
+    for (const part of m[1].split(',')) {
+      const rest = part.match(/\.\.\.\s*([A-Za-z_$][\w$]*)/);
+      if (rest) { aliases.add(rest[1]); continue; }
+      const key = part.split(':')[0].split('=')[0].trim();
+      if (key) reads.push({ how: 'destructured from the request', name: key });
+    }
+  }
+
+  // Direct member reads — `req.query.builder_id`, `body?.owner`.
+  for (const m of routeBody.matchAll(new RegExp(String.raw`${containers()}\s*\??\.\s*([A-Za-z_$][\w$]*)`, 'g'))) {
+    reads.push({ how: 'read from the request', name: m[1] });
+  }
+
+  // Literal bracket access — `req.body['builder_id']`. Exact, so judged exactly.
+  for (const m of routeBody.matchAll(new RegExp(String.raw`${containers()}\s*\[\s*(['"])([^'"]+)\1`, 'g'))) {
+    reads.push({ how: 'read from the request', name: m[2] });
+  }
+
+  // Variable bracket access — `req.body[k]`. The key is unknowable statically, so
+  // the string literals in the route's ARRAY literals are the candidate key set:
+  // that is exactly how the copy-these-fields loops in these files are written.
+  // Scoped to array literals so ordinary message/error strings can't false-positive.
+  if (new RegExp(String.raw`${containers()}\s*\[\s*[A-Za-z_$]`).test(routeBody)) {
+    for (const arr of routeBody.matchAll(/\[([^\][]*)\]/g)) {
+      for (const m of arr[1].matchAll(/(['"])([A-Za-z_][\w-]*)\1/g)) {
+        reads.push({ how: 'a candidate computed request key', name: m[2] });
+      }
+    }
+  }
+
+  // Header lookups by name.
+  for (const m of routeBody.matchAll(/\breq\s*\.\s*get\(\s*(['"])([^'"]+)\1/g)) {
+    reads.push({ how: 'read from a request header', name: m[2] });
+  }
+
+  return reads;
+}
+
+/** The `:name` segments a route declares — the route saying out loud what it takes. */
+function pathParams(routePath) {
+  return [...routePath.matchAll(/:([A-Za-z_][\w]*)/g)].map((m) => m[1]);
+}
+
+// ===========================================================================
+// Self-tests — the machinery above is the guard, so it gets proved too.
+// ===========================================================================
+
+console.log('guard machinery:');
+
+t('blankComments erases comment prose but keeps offsets and string literals', () => {
+  const src = "const a = 1; // req.body.builder_id\n/* req.query.owner */ const s = 'builder_id';\n";
+  const out = blankComments(src);
+  assert.equal(out.length, src.length, 'offsets must be preserved');
+  assert.ok(!/req\.body\.builder_id/.test(out), 'line comments must be erased');
+  assert.ok(!/req\.query\.owner/.test(out), 'block comments must be erased');
+  assert.ok(/'builder_id'/.test(out), 'string literals are evidence and must survive');
+});
+
+t('namesABuilder separates subject selectors from self-payload fields', () => {
+  for (const n of ['builder_id', 'builderId', 'owner', 'target_builder', 'github_id', 'githubLogin', 'as_builder', 'login']) {
+    assert.equal(namesABuilder(n), true, `${n} names a builder`);
+  }
+  for (const n of ['handle', 'display_name', 'bio', 'links', 'limit', 'anthropic_user_id', 'anthropic_email', 'files', 'path', 'hide_stats', 'preferred_disciplines', 'user-agent']) {
+    assert.equal(namesABuilder(n), false, `${n} is self-payload, not a subject`);
+  }
+});
+
+t('requestReads sees direct, optional-chained, destructured and aliased reads', () => {
+  const reads = (s) => requestReads(s).map((r) => r.name);
+  assert.ok(reads('const x = req.query.builder_id;').includes('builder_id'));
+  assert.ok(reads('const x = req.body?.owner;').includes('owner'));
+  assert.ok(reads('const { builder_id, y } = req.body;').includes('builder_id'));
+  assert.ok(reads('const b = req.body;\nconst v = b.builder_id;').includes('builder_id'));
+  assert.ok(reads('const { a, ...rest } = req.body;\nconst v = rest.owner_id;').includes('owner_id'));
+  assert.ok(reads("const v = req.body['builder_id'];").includes('builder_id'));
+  assert.ok(reads("for (const k of ['builder_id']) f[k] = req.body[k];").includes('builder_id'));
+  assert.ok(reads("const v = req.get('x-builder-id');").includes('x-builder-id'));
+  // ...but an ordinary message string is not a candidate key: no bracket read, no scan.
+  assert.ok(!reads("return res.fail('builder_not_found', 404);").includes('builder_not_found'));
+});
+
+// ===========================================================================
+// The guard
+// ===========================================================================
+
+console.log('\nown-scope guard (every own-scoped route keys on the session):');
+
+let totalOwnScoped = 0;
+let totalCrossOwner = 0;
+
+for (const surface of OWN_SCOPED_SURFACES) {
+  const abs = path.join(repo, surface.file);
+  const raw = fs.existsSync(abs) ? fs.readFileSync(abs, 'utf8') : null;
+
+  t(`${surface.file} — inventoried own-scoped surface exists and declares routes`, () => {
+    assert.ok(raw !== null, `${surface.file} is in the own-scoped inventory but does not exist — update the inventory or restore the file`);
+    const rawDecls = (raw.match(/\brouter\.(?:get|post|put|patch|delete|all)\(/g) || []).length;
+    const parsed = parseRoutes(blankComments(raw)).length;
+    assert.ok(parsed > 0, 'no routes parsed — the route-declaration regex has rotted');
+    assert.equal(parsed, rawDecls, `parsed ${parsed} routes but the file declares ${rawDecls} — the guard is not seeing every route`);
+  });
+  if (raw === null) continue;
+
+  const code = blankComments(raw);
+  const routes = parseRoutes(code);
+  const exemptions = surface.crossOwner || [];
+  const usedExemptions = new Set();
+  let ownScopedHere = 0;
+
+  for (const r of routes) {
+    const id = `${surface.file}:${r.line} ${r.verb.toUpperCase()} ${r.routePath}`;
+    const subjectParams = pathParams(r.routePath).filter(namesABuilder);
+
+    if (subjectParams.length > 0) {
+      // Cross-owner: names its target in the path. Allowed only with a stated
+      // reason AND a gate the guard confirms is really there.
+      totalCrossOwner++;
+      t(`${id} — cross-owner route is exempted with a reason AND carries its gate`, () => {
+        const ex = exemptions.find((e) => e.path === r.routePath);
+        assert.ok(
+          ex,
+          `takes a builder from the path (:${subjectParams.join(', :')}) but is not on the cross-owner exemption list for this file. `
+          + 'If it is deliberately cross-owner, add it with a stated reason and the gate that protects it; otherwise it must not name a builder.'
+        );
+        usedExemptions.add(ex.path);
+        assert.ok(ex.why && ex.why.length > 20, 'a cross-owner exemption must carry a stated reason');
+        // The exemption is only as strong as what it demands, so the demand
+        // itself is constrained: it must name a real privilege atom, not a
+        // regex that matches anything the author happens to have written.
+        assert.match(
+          ex.gate.source, /require(?:Permission|Rank|BfgPrincipal|Archon)/,
+          'a cross-owner exemption must require a real gate (requirePermission / requireRank / requireBfgPrincipal / requireArchon)'
+        );
+        assert.ok(
+          ex.gate.test(r.decl),
+          `the exemption requires ${ex.gate} on the middleware chain and it is NOT there — a cross-owner route without its gate is the hole this guard exists to catch`
+        );
+      });
+      continue;
+    }
+
+    // Own-scoped: the path names no builder, so the subject can only be the session.
+    ownScopedHere++;
+    totalOwnScoped++;
+
+    t(`${id} — own-scoped route never takes its subject from the request`, () => {
+      const offenders = requestReads(r.body).filter((x) => namesABuilder(x.name));
+      assert.equal(
+        offenders.length, 0,
+        `${offenders.map((o) => `"${o.name}" (${o.how})`).join(', ')} — this route's path names no builder, so its subject MUST come from req.builder. `
+        + 'If it is genuinely meant to act on someone else, name them in the path, gate it, and add a cross-owner exemption.'
+      );
+    });
+
+    t(`${id} — own-scoped route derives its subject from the authenticated session`, () => {
+      assert.ok(/\brequireBuilder\b/.test(r.decl), 'an own-scoped route must sit behind requireBuilder');
+      const readsSession = /\breq\s*\.\s*builder\b/.test(r.body) || /\bassertSelf\s*\(\s*req\b/.test(r.body);
+      const ignoresRequest = /\(\s*_req\s*,/.test(r.body);
+      assert.ok(
+        readsSession || ignoresRequest,
+        'neither reads req.builder nor declares its request unused (_req) — it is scoped to nobody, which is not own-scope'
+      );
+    });
+  }
+
+  t(`${surface.file} — contributes a real number of own-scoped routes (not vacuous)`, () => {
+    assert.ok(
+      ownScopedHere >= MIN_OWN_SCOPED_ROUTES_PER_FILE,
+      `only ${ownScopedHere} own-scoped routes found (floor ${MIN_OWN_SCOPED_ROUTES_PER_FILE}) — either routes moved out or the parser stopped seeing them`
+    );
+  });
+
+  t(`${surface.file} — every listed cross-owner exemption still names a real route`, () => {
+    const stale = exemptions.filter((e) => !usedExemptions.has(e.path)).map((e) => e.path);
+    assert.equal(stale.length, 0, `stale exemption(s) for route(s) that no longer exist: ${stale.join(', ')} — an exemption for a deleted route silently widens the guard`);
+  });
+}
+
+// ===========================================================================
+// Discovery backstop + lane proof
+// ===========================================================================
+
+console.log('\ncoverage (the guard cannot be dodged by adding a new file, or parked out of CI):');
+
+function routeFiles() {
+  const out = [];
+  const walk = (dir) => {
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      const p = path.join(dir, e.name);
+      if (e.isDirectory()) { if (e.name !== 'node_modules') walk(p); }
+      else if (e.name.endsWith('.js')) out.push(p);
+    }
+  };
+  walk(path.join(repo, 'src'));
+  walk(path.join(repo, 'modules'));
+  return out;
+}
+
+t('every file in the repo that mounts a /me route is in the own-scoped inventory', () => {
+  const inventory = new Set(OWN_SCOPED_SURFACES.map((s) => s.file.split('/').join(path.sep)));
+  const missing = [];
+  for (const abs of routeFiles()) {
+    const code = blankComments(fs.readFileSync(abs, 'utf8'));
+    const declaresMe = parseRoutes(code).some((r) => r.routePath === '/me' || r.routePath.startsWith('/me/'));
+    if (!declaresMe) continue;
+    const rel = path.relative(repo, abs);
+    if (!inventory.has(rel)) missing.push(rel.split(path.sep).join('/'));
+  }
+  assert.equal(
+    missing.length, 0,
+    `these files mount /me routes but are not in OWN_SCOPED_SURFACES: ${missing.join(', ')}. `
+    + 'Nothing cross-owner is ever mounted at /me, so add them to the inventory.'
+  );
+});
+
+t('the guard checks a real number of own-scoped routes overall', () => {
+  assert.ok(
+    totalOwnScoped >= MIN_OWN_SCOPED_ROUTES_TOTAL,
+    `only ${totalOwnScoped} own-scoped routes checked (floor ${MIN_OWN_SCOPED_ROUTES_TOTAL})`
+  );
+  assert.ok(totalCrossOwner > 0, 'no cross-owner route was exercised — the gate-verification path is untested');
+});
+
+t('this guard runs in the DB-free unit lane (it is not parked as integration or known-failing)', () => {
+  const runner = fs.readFileSync(path.join(repo, 'scripts', 'gds', 'run-unit-tests.js'), 'utf8');
+  assert.ok(
+    !/own_scope_guard/.test(runner),
+    'own_scope_guard is named in run-unit-tests.js — if it landed in INTEGRATION or KNOWN_FAILING it would stop gating anything (task 1002282)'
+  );
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);