@bongos/core 1.19.418 → 1.19.420

package/tests/connections_ownership.mjs

@@ -0,0 +1,313 @@
+// tests/connections_ownership.mjs — "a builder cannot act on someone else's
+// connection", EXECUTED rather than asserted against a string (task 1002295,
+// goal 1000045; ADR 0202 D2).
+//
+// Its sibling `connections_api.mjs` proves the SHAPE of every statement — which
+// parameters are bound, which caps are carried. That is necessary and not
+// sufficient: a shape assertion still passes if the WHERE clause is rewritten in
+// a way the regex happens to match. So this file does the other half.
+//
+// THE MECHANISM, copied from tests/own_session_revoke.mjs (task 1003341): the
+// pool below is a real in-memory `platform_identity_connections` table plus a
+// mini-interpreter that builds each statement's row filter FROM THAT STATEMENT'S
+// OWN WHERE CLAUSE. Drop `addressee_github_id = $2` from the accept and the
+// filter genuinely widens, so a stranger's row genuinely changes, and the test
+// genuinely fails. The interpreter REFUSES any statement whose placeholders it
+// did not all consume, so a predicate it cannot read is a loud error rather than
+// a silently weaker filter — the failure mode that makes a fake pool worthless.
+//
+// Everything above the pool is real: the real router, the real domain functions,
+// real HTTP. Only the storage is in memory.
+//
+// DB-free. Runs in the unit gate that executes on a PR.
+//
+// Run:  node tests/connections_ownership.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+const DAY = 24 * 60 * 60 * 1000;
+
+// Four accounts: the caller and three other people whose rows must be untouchable.
+const ME = 4242;
+const ADA = 9001;
+const BO = 9002;
+const CY = 9003;
+
+// ===========================================================================
+// The in-memory table + its statement interpreter
+// ===========================================================================
+
+let rows = [];
+function seed() {
+  const now = Date.now();
+  rows = [
+    // 1 — Ada asked ME. Mine to accept or decline.
+    { id: 1, requester_github_id: ADA, addressee_github_id: ME, status: 'pending', created_at: now - DAY, resolved_at: null },
+    // 2 — Cy asked Bo. None of my business, and I know its id.
+    { id: 2, requester_github_id: CY, addressee_github_id: BO, status: 'pending', created_at: now - DAY, resolved_at: null },
+    // 3 — ME and Cy are connected. Either of us may end it.
+    { id: 3, requester_github_id: ME, addressee_github_id: CY, status: 'accepted', created_at: now - 30 * DAY, resolved_at: now - 29 * DAY },
+    // 4 — Bo and Cy are connected. Not mine to end.
+    { id: 4, requester_github_id: BO, addressee_github_id: CY, status: 'accepted', created_at: now - 30 * DAY, resolved_at: now - 29 * DAY },
+    // 5 — I asked Ada and she has not answered. Mine to cancel.
+    { id: 5, requester_github_id: ME, addressee_github_id: ADA, status: 'pending', created_at: now - 2 * DAY, resolved_at: null },
+    // 6 — Ada asked me 40 days ago. Expired: gone from both queues, and it must
+    //     not be resurrectable into an acceptance or a fresh 90-day cooldown.
+    { id: 6, requester_github_id: ADA, addressee_github_id: ME, status: 'pending', created_at: now - 40 * DAY, resolved_at: null },
+  ];
+}
+const row = (id) => rows.find((r) => r.id === id);
+
+/**
+ * Build a row filter from a statement's own WHERE text. Every placeholder the
+ * clause mentions must be consumed by a fragment below; one that is not throws,
+ * so a predicate this cannot read can never degrade into "no constraint".
+ */
+function predicateFor(rawWhere, params) {
+  let where = rawWhere;
+  const tests = [];
+  const consumed = new Set();
+  const p = (n) => { consumed.add(String(n)); return params[Number(n) - 1]; };
+
+  // The either-side clause (remove) is matched and STRIPPED first, so the
+  // single-column matchers below cannot re-read half of it as a one-sided filter.
+  const either = /\(requester_github_id = \$(\d+)::bigint OR addressee_github_id = \$(\d+)::bigint\)/.exec(where);
+  if (either) {
+    const a = p(either[1]);
+    const b = p(either[2]);
+    tests.push((r) => String(r.requester_github_id) === String(a) || String(r.addressee_github_id) === String(b));
+    where = where.replace(either[0], ' TRUE ');
+  }
+
+  let m;
+  if ((m = /\bid = \$(\d+)\b/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.id) === String(v)); }
+  if ((m = /\baddressee_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.addressee_github_id) === String(v)); }
+  if ((m = /\brequester_github_id = \$(\d+)::bigint/.exec(where))) { const v = p(m[1]); tests.push((r) => String(r.requester_github_id) === String(v)); }
+  if ((m = /\bstatus = '(\w+)'/.exec(where))) { const v = m[1]; tests.push((r) => r.status === v); }
+  if ((m = /created_at > now\(\) - make_interval\(days => \$(\d+)::int\)/.exec(where))) {
+    const days = Number(p(m[1]));
+    tests.push((r) => r.created_at > Date.now() - days * DAY);
+  }
+
+  for (const ph of rawWhere.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(ph[1])) {
+      throw new Error(`fake pool: unread predicate on $${ph[1]} in "${rawWhere}" — the interpreter must never silently ignore a filter`);
+    }
+  }
+  return (r) => tests.every((fn) => fn(r));
+}
+
+const ACCOUNT = {
+  id: 1, github_id: String(ME), github_login: 'octo', display_name: 'Octo', avatar_url: null,
+  profile_state: 'active', hide_stats: false, account_visibility: 'public',
+  recruiter_discoverable: null, handle: 'octo', previous_handle: null,
+};
+
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+
+    // The caller's own account (the profile_state floor every route reads first).
+    if (/FROM platform_identity_accounts WHERE github_id = \$1$/.test(sql)) {
+      return { rows: [{ ...ACCOUNT }], rowCount: 1 };
+    }
+
+    // accept / decline — one UPDATE, one WHERE.
+    let m = /^UPDATE platform_identity_connections SET status = '(accepted|rejected)'.*? WHERE (.+?) RETURNING/.exec(sql);
+    if (m) {
+      const hit = rows.filter(predicateFor(m[2], params));
+      for (const r of hit) { r.status = m[1]; r.resolved_at = Date.now(); }
+      return { rows: hit.map((r) => ({ id: String(r.id) })), rowCount: hit.length };
+    }
+
+    // remove / cancel — a DELETE branch and an UPDATE branch in one statement.
+    if (/^WITH removed AS \( DELETE FROM platform_identity_connections/.test(sql)) {
+      const del = /DELETE FROM platform_identity_connections WHERE (.+?) RETURNING/.exec(sql);
+      const upd = /UPDATE platform_identity_connections SET status = 'cancelled'.*? WHERE (.+?) RETURNING/.exec(sql);
+      assert.ok(del && upd, 'the remove statement lost one of its two branches');
+      const out = [];
+      const removed = rows.filter(predicateFor(del[1], params));
+      for (const r of removed) { rows = rows.filter((x) => x !== r); out.push({ outcome: 'removed' }); }
+      const cancelled = rows.filter(predicateFor(upd[1], params));
+      for (const r of cancelled) { r.status = 'cancelled'; r.resolved_at = Date.now(); out.push({ outcome: 'cancelled' }); }
+      return { rows: out, rowCount: out.length };
+    }
+
+    throw new Error(`fake pool: unsupported statement — ${sql}`);
+  },
+};
+
+// ===========================================================================
+// The real router over that table
+// ===========================================================================
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool,
+    validateOrRespond: helpers.validateOrRespond,
+    parsePagination: helpers.parsePagination,
+    logger: () => ({ error() {}, warn() {}, info() {} }),
+    requireBuilder: (req, _res, next) => { req.builder = { github_id: ME, github_login: 'octo' }; next(); },
+  },
+};
+const buildConnectionRoutes = require('../modules/platform-identity/routes/connections.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', buildConnectionRoutes());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
+    const req = http.request({
+      host: '127.0.0.1', port, method, path,
+      headers: payload ? { 'content-type': 'application/json', 'content-length': payload.length } : {},
+    }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* 204 */ }
+        resolve({ status: res.statusCode, json });
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+// ===========================================================================
+// The interpreter is the instrument, so it gets calibrated first
+// ===========================================================================
+
+test('the interpreter refuses a predicate it cannot read, rather than ignoring it', () => {
+  assert.throws(
+    () => predicateFor("id = $1 AND some_new_column = $2", [1, 2]),
+    /unread predicate on \$2/,
+    'a filter the fake cannot model must be a loud error — otherwise a rewritten WHERE silently widens'
+  );
+});
+
+test('the interpreter really does narrow on the owner column', () => {
+  seed();
+  const mine = rows.filter(predicateFor("id = $1 AND addressee_github_id = $2::bigint AND status = 'pending'", [1, ME]));
+  const wide = rows.filter(predicateFor("id = $1 AND status = 'pending'", [2]));
+  assert.equal(mine.length, 1);
+  assert.equal(wide.length, 1, 'without the owner column the same shape matches a stranger row');
+  assert.equal(wide[0].addressee_github_id, BO);
+});
+
+// ===========================================================================
+// The proof: another builder's row does not move
+// ===========================================================================
+
+test('accept: my own incoming request really is accepted', async () => {
+  seed();
+  const res = await call('POST', '/api/bongos/connections/1/accept');
+  assert.equal(res.status, 200);
+  assert.equal(row(1).status, 'accepted');
+});
+
+test("accept: a STRANGER'S request is 404 and the row is byte-for-byte untouched", async () => {
+  seed();
+  const before = { ...row(2) };
+  const res = await call('POST', '/api/bongos/connections/2/accept');
+  assert.equal(res.status, 404);
+  assert.deepEqual(row(2), before, 'Cy asked Bo — nothing I send may move that row');
+});
+
+test('accept: an EXPIRED request of mine cannot be accepted', async () => {
+  seed();
+  const before = { ...row(6) };
+  const res = await call('POST', '/api/bongos/connections/6/accept');
+  assert.equal(res.status, 404);
+  assert.deepEqual(row(6), before);
+});
+
+test('decline: mine flips to rejected — the row that IS the 90-day cooldown', async () => {
+  seed();
+  const res = await call('POST', '/api/bongos/connections/1/decline');
+  assert.equal(res.status, 204);
+  assert.equal(row(1).status, 'rejected');
+  assert.ok(row(1).resolved_at, 'resolved_at is what the cooldown window is measured from');
+});
+
+test("decline: a stranger's request is 404 and unmoved", async () => {
+  seed();
+  const before = { ...row(2) };
+  const res = await call('POST', '/api/bongos/connections/2/decline');
+  assert.equal(res.status, 404);
+  assert.deepEqual(row(2), before);
+});
+
+test('decline: an EXPIRED request cannot be turned into a fresh cooldown', async () => {
+  seed();
+  const before = { ...row(6) };
+  const res = await call('POST', '/api/bongos/connections/6/decline');
+  assert.equal(res.status, 404);
+  assert.deepEqual(row(6), before, 'a request ADR 0202 D2 §3 considers gone must not silently block the requester for 90 days');
+});
+
+test('remove: my own accepted connection is HARD-DELETED, leaving no tombstone', async () => {
+  seed();
+  const res = await call('DELETE', '/api/bongos/connections/3');
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.json, { outcome: 'removed' });
+  assert.equal(row(3), undefined, 'no "ME removed CY" row survives — neither party consented to keep one');
+});
+
+test("remove: two strangers' connection is 404 and still there", async () => {
+  seed();
+  const before = { ...row(4) };
+  const res = await call('DELETE', '/api/bongos/connections/4');
+  assert.equal(res.status, 404);
+  assert.deepEqual(row(4), before, 'Bo and Cy know each other and I am not in that pair');
+});
+
+test('remove: a request I SENT is cancelled, not deleted', async () => {
+  seed();
+  const res = await call('DELETE', '/api/bongos/connections/5');
+  assert.equal(res.status, 200);
+  assert.deepEqual(res.json, { outcome: 'cancelled' });
+  assert.equal(row(5).status, 'cancelled');
+});
+
+test('remove: a request SENT TO ME cannot be deleted — that route is decline, which arms the cooldown', async () => {
+  seed();
+  const before = { ...row(1) };
+  const res = await call('DELETE', '/api/bongos/connections/1');
+  assert.equal(res.status, 404);
+  assert.deepEqual(row(1), before, 'otherwise an addressee dodges the 90-day cooldown by calling a decline a delete');
+});
+
+test('an id nobody owns changes nothing at all', async () => {
+  seed();
+  const snapshot = JSON.stringify(rows);
+  for (const [method, path] of [
+    ['POST', '/api/bongos/connections/999/accept'],
+    ['POST', '/api/bongos/connections/999/decline'],
+    ['DELETE', '/api/bongos/connections/999'],
+  ]) {
+    const res = await call(method, path);
+    assert.equal(res.status, 404, `${method} ${path}`);
+  }
+  assert.equal(JSON.stringify(rows), snapshot, 'the table is bit-identical after three misses');
+});

package/tests/module_api.mjs

@@ -24,6 +24,7 @@ const PUBLISHED_SURFACE = [
   'requirePermission', // BV1.R105: the authority-atom gate module routes migrate onto (1.19.0; ADR 0151)
   'pool', 'getPool', 'instanceDbName', 'withTx', 'getBuilderById',
   'secretBox', // Gemini-key storage relocated to modules/art-pipeline + its 'art.getBuilderGeminiKeyRow' port (ADR 0102)
+  'accountExistenceReadRateLimit', // task 1003339 (ADR 0209): the shared per-IP budget both account-existence probes spend from — one instance, not a factory, so the budget is genuinely shared
   'routeRankCheck', 'permissionPathCheck', // BV1.R73: kernel trust classifiers (1.6.0)
   'repoInfo', 'moduleScopeMap', 'pathMatch', // BV1.R86: kernel repo-identity + scope-wall + touches-overlap for the carved lifecycle (1.12.0)
   'goalScopeCheck', // BV1.R60: kernel scope wall for the goal-authored-task create gate (1.13.0; ADR 0086 §3)

package/tests/onboard.mjs

@@ -31,6 +31,62 @@ test('onboardPlan is the canonical sequence: name+address first, the builders ha
   assert.ok(keys.indexOf('device-flow') < keys.indexOf('first-sign-in'), 'checkbox prompted before sign-in');
 });
 
+test('the OPTIONAL project-detail step sits in the canonical sequence, and optional means skippable (task 1002334)', () => {
+  const plan = ob.onboardPlan();
+  const keys = plan.map((s) => s.key);
+  const step = plan.find((s) => s.key === 'project-detail');
+  assert.ok(step, 'the interview is a real step in the sequence, not a wizard-only flourish');
+  assert.equal(keys.indexOf('project-detail'), keys.indexOf('name-address') + 1,
+    'it follows the name interview — the project is described before its repo and address are decided');
+  assert.equal(step.optional, true, 'the flag is what tells a form it may be walked past');
+  assert.equal(step.kind, 'auto',
+    "'auto' like name-address: the FORM collects it, so a done panel of outstanding human steps must not list it");
+  // one optional step keeps the flag meaningful; a second would need its own rule
+  assert.deepEqual(plan.filter((s) => s.optional).map((s) => s.key), ['project-detail']);
+  // and the adopt branch carries it identically — the sequence branches only at scaffold
+  assert.ok(ob.onboardPlan('adopt').some((s) => s.key === 'project-detail' && s.optional === true));
+});
+
+test('every form OFFERS the optional step and names what skipping costs — skill / CLI / wizard / route (task 1002334)', () => {
+  const { readFileSync } = require('node:fs');
+  const path = require('node:path');
+  const read = (rel) => readFileSync(path.join(import.meta.dirname, '..', rel), 'utf8');
+
+  // the skill — the source of truth for the sequence
+  const skill = read('.claude/skills/new-project/SKILL.md');
+  assert.match(skill, /OPTIONAL/, 'the canonical runbook marks the step optional');
+  assert.match(skill, /team_shape/, 'and names the answers that ride the request');
+  assert.match(skill, /dark matter/i, 'and states what skipping costs');
+
+  // the CLI form
+  const cli = read('scripts/gds/onboard.js');
+  assert.match(cli, /Press Enter to skip/, 'the terminal form offers the skip in the prompt itself');
+  assert.match(cli, /off the public map/, 'and says what a missing description means');
+
+  // the web form
+  const hub = read('public-landing/projects.html');
+  assert.match(hub, /id="panel-detail"/, 'the wizard ships the panel');
+  assert.match(hub, /id="skipDetail"/, 'with a skip control of its own');
+
+  // the route that receives it
+  const route = read('modules/provisioning/routes/provisioning.js');
+  assert.match(route, /description: \{ type: 'string', maxLength: provisioning\.DESCRIPTION_MAX \}/,
+    'the create route accepts the description');
+  assert.match(route, /\/provisioning\/instances\/:id\/detail/,
+    'and there is a way back, or "optional" would mean permanently unpublishable');
+});
+
+test('the answers the CLI collects are the same body the web form files (buildProjectDetail)', () => {
+  assert.deepEqual(ob.buildProjectDetail({ description: '  a   b ', teamShape: 'Community' }),
+    { description: 'a b', detail: { team_shape: 'community' } });
+  // a skip files nothing — absent means skipped, and an empty string would read
+  // to the publish gate as an answered-but-blank description
+  assert.deepEqual(ob.buildProjectDetail({}), {});
+  assert.deepEqual(ob.buildProjectDetail({ description: '   ', teamShape: '' }), {});
+  // an off-vocabulary answer is dropped, never guessed into a recommendation
+  assert.deepEqual(ob.buildProjectDetail({ teamShape: 'a big guild' }), {});
+});
+
 test('onboardPlan(adopt): same sequence + human steps, but the scaffold-leg labels branch (task 2046)', () => {
   const green = ob.onboardPlan();
   const adopt = ob.onboardPlan('adopt');

package/tests/own_scope_guard.mjs

@@ -94,6 +94,11 @@ const OWN_SCOPED_SURFACES = [
     why: "the builder's OWN cross-project profile controls (hide flag, handle, bio/links) — all keyed on req.builder.github_id.",
     crossOwner: [],
   },
+  {
+    file: 'modules/platform-identity/routes/connections.js',
+    why: 'the connection graph (ADR 0202, task 1002295). The ACTING account is always the session; a counterparty is named by public handle or by the connection row id, never by an account identifier — and the degree label is a viewer-relative own-scope read (D4 §4).',
+    crossOwner: [],
+  },
   {
     file: 'modules/memory/routes/memory.js',
     why: 'per-builder memory (ADR 0024 §4). The self endpoints are own-scoped; the five cross-builder endpoints name their target in the path and are gate-verified below.',

package/tests/projects_hub.mjs

@@ -613,6 +613,75 @@ test('every table column has a source — Type is declared, never guessed', () =
   assert.match(SCRIPT, /type: state\.projType/, 'the create request carries the declared type');
 });
 
+test('every per-step hook in show() still points at the panel it belongs to (renumbering guard)', () => {
+  // The renumbering risk is NOT the data-next attributes (guarded above) — it is
+  // show()'s side-effect hooks, which key off bare integers. Point one at the
+  // wrong panel and the wizard still navigates perfectly while silently never
+  // probing repo access, never re-checking the handle, or rendering a stale
+  // review. Derived from the panels map so this survives the next renumbering.
+  const map = SCRIPT.match(/var panels = \{([^}]*)\}/)[1];
+  const STEP = {};
+  for (const m of map.matchAll(/(\d+):\s*'([a-z-]+)'/g)) STEP[m[2]] = Number(m[1]);
+  const show = SCRIPT.slice(SCRIPT.indexOf('function show(step, moveFocus)'));
+  const body = show.slice(0, show.search(/\n\s*\/\* One delegated pair on the rail/));
+
+  assert.ok(body.includes(`if (step === ${STEP['panel-home']}) { syncHome();`),
+    'the repo probe fires on the Home panel');
+  assert.ok(body.includes(`if (step === ${STEP['panel-address']}) { checkSlugAvailable(); renderAddrPanel(); }`),
+    'the handle re-check fires on the Address panel');
+  assert.ok(body.includes(`if (step === ${STEP['panel-review']}) renderReview();`),
+    'the review is rendered on the Review panel');
+  assert.ok(body.includes(`'wizDone', step === ${STEP['panel-done']}`),
+    'the done panel is the one that takes the whole card');
+  // and the About panel claims no hook of its own — it has nothing to fetch
+  assert.ok(!body.includes(`if (step === ${STEP['panel-detail']})`),
+    'the optional step needs no side effect; adding one would give it a way to fail');
+});
+
+test('the About step is OFFERED by every form and can be walked past — the skip is a real control (task 1002334)', () => {
+  const about = (HUB.match(/<section class="panel" id="panel-detail"[\s\S]*?<\/section>/) || [''])[0];
+  assert.ok(about, '#panel-detail ships as real markup');
+  assert.match(about, /id="f-desc"/, 'it asks what the owner is building — the publish gate half');
+  assert.match(about, /id="teamCards"/, 'and who is building it — what the recommendations read');
+  // the skip must be its OWN button: "leave it blank and press Next" is an
+  // escape hatch the visitor has to infer, which is not an optional step
+  assert.match(about, /id="skipDetail"/, 'the skip is a control, not an inference');
+  assert.match(about, /Optional/, 'and the panel says so before it asks');
+  // the consequence of skipping is stated where the choice is made
+  assert.match(SCRIPT, /stays off the public map until it has one/,
+    'skipping names its cost (ADR 0182 D4), never leaves it to be discovered later');
+  // nothing in validateStep may gate the About step
+  const validate = SCRIPT.slice(SCRIPT.indexOf('function validateStep('));
+  const map = SCRIPT.match(/var panels = \{([^}]*)\}/)[1];
+  const aboutStep = Number((map.match(/(\d+):\s*'panel-detail'/) || [, 0])[1]);
+  assert.ok(aboutStep > 0, 'the About panel is in the map');
+  assert.ok(!validate.slice(0, validate.indexOf('function ', 1)).includes(`if (step === ${aboutStep}) {`),
+    'the optional step has no validation clause — Next past an empty answer is the point');
+});
+
+test('the About answers travel on the create request, and an empty one is OMITTED not blanked', () => {
+  assert.match(SCRIPT, /description: String\(state\.description \|\| ''\)\.trim\(\) \|\| undefined/,
+    'a skipped description is absent from the body — an empty string would read as answered');
+  assert.match(SCRIPT, /detail: state\.teamShape \? \{ team_shape: state\.teamShape \} : undefined/,
+    'and an unanswered team shape is never guessed into the request');
+  // the review is the last screen before Create, so the skip's cost is restated there
+  const review = (SCRIPT.match(/function renderReview\(\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.match(review, /off the public map until you add it/,
+    'the review row states the consequence rather than a bare dash');
+  assert.match(review, /\['About',/, 'and the About answer has a row of its own');
+});
+
+test('a renumbering of the wizard invalidates old drafts — the key carries the version', () => {
+  // task 1002772 renumbered once and bumped to -v2; task 1002334 renumbered again.
+  // A draft replayed under a different numbering lands on the wrong panel with the
+  // rail already marking the skipped steps done.
+  const key = (SCRIPT.match(/var DRAFT_KEY = '([^']+)'/) || [, ''])[1];
+  assert.match(key, /-v\d+$/, 'the draft key is versioned');
+  const panels = (SCRIPT.match(/var panels = \{([^}]*)\}/) || [, ''])[1];
+  const count = [...panels.matchAll(/\d+:\s*'panel-/g)].length;
+  assert.equal(count, 8, 'gate + six numbered steps + done — bump DRAFT_KEY when this changes');
+});
+
 test('header and body agree on the column count', () => {
   // a stray <td> shifts every cell after it — silent, and only visible on screen
   const n = ((HUB.match(/<thead>([\s\S]*?)<\/thead>/) || [, ''])[1].match(/<th/g) || []).length;

package/tests/projects_hub_pre_uat.mjs

@@ -28,6 +28,20 @@ const fn = (name) => {
   return next < 0 ? rest : rest.slice(0, next);
 };
 
+// The step indices are DERIVED from the panels map, not typed (task 1002334
+// renumbered them a second time and every literal below broke). What these
+// blocks actually claim is "the DONE panel" and "the step before it" — say
+// that, and the next renumbering costs nothing.
+const PANELS = (() => {
+  const m = SCRIPT.match(/var panels = \{([^}]*)\}/);
+  assert.ok(m, 'the panels map must exist');
+  const map = {};
+  for (const p of m[1].matchAll(/(\d+):\s*'([a-z-]+)'/g)) map[Number(p[1])] = p[2];
+  return map;
+})();
+const STEP = Object.fromEntries(Object.entries(PANELS).map(([n, id]) => [id, Number(n)]));
+const DONE = STEP['panel-done'];
+
 /* ── the gate says why GitHub will ask for repository access ── */
 test('the gate explains the repo scope BEFORE GitHub does — on the path every founder takes', () => {
   const gate = (HUB.match(/<section class="panel" id="panel-gate"[\s\S]*?<\/section>/) || [''])[0];
@@ -203,7 +217,9 @@ test('the wizard’s 401 recoveries keep the repo scope they already granted', (
 });
 
 test('a resumed draft past Home still probes repo access before Create', () => {
-  assert.match(SCRIPT, /else if \(step > 3 && step < 6 && authKnown && repoAccess === null\) ensureRepoAccess\(\);/);
+  assert.ok(SCRIPT.includes(
+    `else if (step > ${STEP['panel-home']} && step < ${DONE} && authKnown && repoAccess === null) ensureRepoAccess();`),
+    'every step between Home and the done panel re-probes');
 });
 
 test('a half-typed custom domain says why Next is dead; a taken handle silences the format cheer', () => {
@@ -447,13 +463,16 @@ test('a manifest error says a plain sentence, folds the route text, and sends a
 
 test('the rail at the done panel keeps its marker on Create until the project answers', () => {
   const rail = fn('paintRail');
-  assert.match(rail, /var landed = step === 6 && !!\(live && live\.instStatus === 'active'\);/);
-  assert.match(rail, /var cur = step === 6 \? 5 : step;/);
+  assert.ok(rail.includes(`var landed = step === ${DONE} && !!(live && live.instStatus === 'active');`),
+    'the rail only finishes on the done panel');
+  assert.ok(rail.includes(`var cur = step === ${DONE} ? ${DONE - 1} : step;`),
+    'the done panel keeps the marker on the last numbered beat');
   assert.match(rail, /li\.classList\.toggle\('done', landed \|\| n < cur\);/);
   assert.match(rail, /if \(now\) li\.setAttribute\('aria-current', 'step'\); else li\.removeAttribute\('aria-current'\);/);
   assert.match(fn('show'), /paintRail\(step\);/, 'show() paints through it');
   assert.doesNotMatch(fn('show'), /classList\.toggle\('done'/, 'and no longer marks the rail on its own');
-  assert.match(SCRIPT, /live\.instStatus = inst\.status; renderSteps\(\);\n\s*if \(state\.step === 6\) paintRail\(6\);/, 'the done-panel poll repaints when the status moves');
+  assert.ok(SCRIPT.includes(`if (state.step === ${DONE}) paintRail(${DONE});`),
+    'the done-panel poll repaints when the status moves');
   assert.match(HUB, /<li class="now" data-step="1" aria-current="step">/, 'the static rail starts with the same marker');
 });
 
@@ -560,7 +579,10 @@ test('the hub has one main landmark, a heading for the map, a footer, and a skip
 });
 
 test('completed rail steps are a way back, the repo picker is honest ARIA, the card inerts the page', () => {
-  assert.match(fn('paintRail'), /if \(step < 6 && n < cur\) \{\n\s*li\.setAttribute\('role', 'button'\);\n\s*li\.setAttribute\('tabindex', '0'\);\n\s*li\.setAttribute\('data-goto', String\(n\)\);/, 'only answered steps become buttons, and none once the project is filed');
+  assert.ok(fn('paintRail').includes(`if (step < ${DONE} && n < cur) {`),
+    'only answered steps become buttons, and none once the project is filed');
+  assert.ok(fn('paintRail').includes("li.setAttribute('data-goto', String(n));"),
+    'and an answered step carries the goto the delegated handler reads');
   assert.match(SCRIPT, /railEl\.addEventListener\('click'/);
   assert.match(SCRIPT, /railEl\.addEventListener\('keydown'/);
   assert.match(SCRIPT, /show\(Number\(li\.getAttribute\('data-goto'\)\), true\)/, 'a deliberate step: focus moves');

package/tests/provision.mjs

@@ -1673,6 +1673,26 @@ await ta('federateInstance(--apply): registers the client on the hub bound to th
   });
 });
 
+await ta('federateInstance: the project-detail answers ride to the catalog row — and a SKIP stays skipped (task 1002334)', async () => {
+  await withEnv(HUB_ENV, async () => {
+    // The instance row holds what the owner said at creation; the catalog row is
+    // where the publish gate reads it (ADR 0182 D4). Dropping the answer on this
+    // one hop would leave a project that DID describe itself in dark matter,
+    // which would make the whole optional step decorative.
+    const told = { ...coTenantWithDomain, type: 'game', description: 'A co-op farming game.' };
+    const pi = fakePI();
+    const deps = { apply: true, log: () => {}, platformIdentity: pi, hubKeys: hubKeysOn, db: { query: async () => ({ rows: [{ github_id: 'gh-owner-1' }] }) } };
+    await P.federateInstance(told, deps);
+    assert.equal(pi.calls[0].description, 'A co-op farming game.', 'the description reaches the hub registration');
+    assert.equal(pi.calls[0].type, 'game', 'alongside the declared type it follows');
+
+    // the skipped case: absent, never an empty string invented on the way
+    const skipped = fakePI();
+    await P.federateInstance(coTenantWithDomain, { ...deps, platformIdentity: skipped });
+    assert.equal(skipped.calls[0].description, undefined, 'a skipped interview passes nothing — upsertProject COALESCEs, so it nulls nothing either');
+  });
+});
+
 await ta('federateInstance(dry-run): registers NOTHING, returns a placeholder block (so webEnvBody can still compose)', async () => {
   await withEnv(HUB_ENV, async () => {
     const pi = fakePI();