@bongos/core 1.19.424 → 1.19.426

package/tests/scouting_owner_access_and_reach.mjs

@@ -0,0 +1,544 @@
+// tests/scouting_owner_access_and_reach.mjs
+//
+// R14 (task 1002290, goal 1000045 C5; ADR 0210) — the two halves of graduating
+// the cross-project recruiting directory, proved as an EXECUTED boundary:
+//
+//   WHO MAY READ IT.  GET /scouting used to admit exactly one audience: a holder
+//     of `project.curate`. It now also admits a PROJECT OWNER — a caller whose
+//     own project reported them as its owner at check-in AND whose sign-in the
+//     hub itself witnessed. A builder who is neither still gets the unchanged
+//     403, and an owner claim the hub never witnessed is not an owner claim.
+//
+//   WHO APPEARS IN IT.  The recruiting opt-out (`recruiter_discoverable`, privacy
+//     spec D1) gated nothing until this task: a public account that had opted out
+//     still appeared. listScoutingRollup now joins scoutingListableSql, so an
+//     opted-out builder is absent from /scouting AND from the hall's /people —
+//     which is the SAME endpoint, proved from source below rather than asserted
+//     twice — and flipping the toggle back restores them.
+//
+//   AND NEITHER AXIS TOUCHES THE OTHER (ADR 0016).  Being scoutable is not
+//     authority and opting out is not a punishment: an opted-out builder who owns
+//     a project still READS the directory (200) while being absent from it,
+//     including from their own copy of it.
+//
+// WHY THE FAKE POOL IS SHAPED THE WAY IT IS. Every filter below is built FROM THE
+// STATEMENT'S OWN WHERE CLAUSE — the tests/own_session_revoke.mjs and
+// tests/effective_visibility_predicate.mjs pattern. So deleting the reach term
+// from listScoutingRollup genuinely stops the clause from carrying the COALESCE,
+// the opted-out row genuinely comes back, and the assertions below genuinely go
+// red. A statement carrying a placeholder or a literal comparison the
+// interpreter cannot read is a LOUD ERROR, never a silently absent filter — a
+// guard that degrades to "no WHERE at all" passes forever and protects nothing.
+//
+// Everything above the pool is real: the real route file, the real
+// requirePermission gate over the real government catalog, real HTTP. Only the
+// session layer is a double (there is no browser here to hold one), and it is
+// the one layer this task does not touch.
+//
+// DB-free by construction, so it runs in the lane that actually executes — CI has
+// no Postgres and a real-DB proof there would self-skip (task 1002282).
+//
+// Run:  node tests/scouting_owner_access_and_reach.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+// ESM-imported so knip credits the modules' exports (a createRequire import reads
+// as unused). Both are pure files with no doorway dependency, which is what makes
+// importing them here safe.
+import {
+  scoutingListableSql,
+  rollupVisibleSql,
+  isRecruiterDiscoverable,
+} from '../modules/platform-identity/account-visibility.js';
+import {
+  isProjectOwnerMembership,
+  OWNER_MEMBERSHIP_KIND,
+} from '../modules/platform-identity/scouting-authz.js';
+
+const require = createRequire(import.meta.url);
+const repo = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ===========================================================================
+// The fixtures — the privacy matrix crossed with the ownership matrix
+// ===========================================================================
+
+// Accounts. Only the columns the predicate reads matter; the rest is display.
+const ACCOUNTS = [
+  // The control: public, unhidden, reach unset (NULL = follow visibility = in).
+  { github_id: '4242', github_login: 'octo', display_name: 'Octo',
+    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+  // THE ROW THIS TASK EXISTS FOR: public, unhidden, and explicitly opted OUT.
+  // Before R14 this account appeared in /scouting anyway.
+  { github_id: '5000', github_login: 'optout', display_name: 'Opt Out',
+    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: false },
+  // Explicitly opted IN while public — the same effective answer as NULL, from
+  // the other side of the tri-state. Proves the column is read, not the default.
+  { github_id: '8000', github_login: 'optin', display_name: 'Opt In',
+    profile_state: 'active', account_visibility: 'public', hide_stats: false, recruiter_discoverable: true },
+  // Private AND discoverable — the spec's D2 "private / discoverable" row. Reach
+  // never buys addressability: the full rollup is never its disclosure.
+  { github_id: '5151', github_login: 'scout', display_name: 'Scout',
+    profile_state: 'active', account_visibility: 'private', hide_stats: false, recruiter_discoverable: true },
+  // Hidden, and provisional — the two floors that already held before R14.
+  { github_id: '6060', github_login: 'shy', display_name: 'Shy',
+    profile_state: 'active', account_visibility: 'public', hide_stats: true, recruiter_discoverable: null },
+  { github_id: '7070', github_login: 'newbie', display_name: 'Newbie',
+    profile_state: 'provisional', account_visibility: 'public', hide_stats: false, recruiter_discoverable: null },
+];
+
+// Project memberships, as the hub holds them. `membership_kind` is what the
+// PROJECT reported at check-in; `signin_verified_at` is the hub's OWN witness
+// that the person really signed in (ADR 0205 D1/D2). Owner needs both.
+const MEMBERSHIPS = [
+  { client_id: 'proj-a', github_id: '9001', membership_kind: 'owner', signin_verified_at: 'T' },
+  { client_id: 'proj-b', github_id: '9002', membership_kind: 'member', signin_verified_at: 'T' },
+  // An owner claim the hub NEVER witnessed. touchMembership cannot write this
+  // shape today; it is here because the gate must refuse it if one ever appears.
+  { client_id: 'proj-c', github_id: '9003', membership_kind: 'owner', signin_verified_at: null },
+  { client_id: 'proj-d', github_id: '9004', membership_kind: 'pending', signin_verified_at: 'T' },
+  // The opted-out builder ALSO owns a project — the ADR 0016 cross-check below.
+  { client_id: 'proj-e', github_id: '5000', membership_kind: 'owner', signin_verified_at: 'T' },
+  // A perfectly good owner row on a SUSPENDED project. A membership never
+  // expires and nothing ages it out, so suspending the client is the operator's
+  // only revocation lever — the gate must answer to it.
+  { client_id: 'proj-x', github_id: '9008', membership_kind: 'owner', signin_verified_at: 'T' },
+];
+
+// The projects those memberships belong to. `status` is the platform's own
+// switch (migration platform_identity_001_tables.sql): 'active' | 'suspended'.
+const CLIENTS = [
+  { client_id: 'proj-a', status: 'active' },
+  { client_id: 'proj-b', status: 'active' },
+  { client_id: 'proj-c', status: 'active' },
+  { client_id: 'proj-d', status: 'active' },
+  { client_id: 'proj-e', status: 'active' },
+  { client_id: 'proj-x', status: 'suspended' },
+];
+
+// ===========================================================================
+// The fake pool — every filter read out of the statement's own WHERE clause
+// ===========================================================================
+
+const KNOWN_ACCOUNT_COLUMNS = new Set(['profile_state', 'account_visibility', 'hide_stats', 'recruiter_discoverable']);
+
+/**
+ * A row test for platform_identity_accounts, built from `where`. Literal
+ * comparisons count as much as placeholders: the effective-visibility predicate
+ * is made ENTIRELY of literals, so an interpreter that modelled only $N filters
+ * would score every privacy term as absent and pass no matter what.
+ */
+function accountFilter(where, params) {
+  const tests = [];
+  const consumed = new Set();
+
+  if (/\bprofile_state = 'active'/.test(where)) tests.push((r) => r.profile_state === 'active');
+  if (/\baccount_visibility = 'public'/.test(where)) tests.push((r) => r.account_visibility === 'public');
+  if (/\bNOT (?:[a-z_]+\.)?hide_stats\b/.test(where)) tests.push((r) => !r.hide_stats);
+  // The reach term, modelled through the SHARED JS twin rather than
+  // re-implemented — an interpreter that read the COALESCE its own way could
+  // agree with a WRONG query and still call it a pass.
+  if (/COALESCE\((?:[a-z_]+\.)?recruiter_discoverable,/.test(where)) tests.push(isRecruiterDiscoverable);
+
+  for (const m of where.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(m[1])) {
+      throw new Error(`fake pool: unrecognised predicate on $${m[1]} in "${where}" — a filter this interpreter cannot read must never degrade to no filter`);
+    }
+  }
+  for (const m of where.matchAll(/\b([a-z_]+)\s*(?:=|<>|!=)\s*'/g)) {
+    if (!KNOWN_ACCOUNT_COLUMNS.has(m[1])) {
+      throw new Error(`fake pool: unrecognised literal comparison on ${m[1]} in "${where}"`);
+    }
+  }
+  assert.ok(tests.length > 0, `fake pool: the accounts predicate in "${where}" carried NO readable term — the boundary would be vacuous`);
+  return (r) => tests.every((fn) => fn(r));
+}
+
+/**
+ * The membership read behind the ownership gate, joined to its project. Its
+ * terms are all placeholders, so an unconsumed $N is the loud error: it means
+ * the gate grew a condition this interpreter is not applying — which is exactly
+ * how the client-status join announced itself when it was added.
+ */
+function membershipFilter(where, params) {
+  const tests = [];
+  const consumed = new Set();
+  const clientStatus = (clientId) => (CLIENTS.find((c) => c.client_id === clientId) || {}).status;
+
+  const byId = /\bgithub_id = \$(\d+)/.exec(where);
+  if (byId) { consumed.add(byId[1]); const v = params[Number(byId[1]) - 1]; tests.push((r) => String(r.github_id) === String(v)); }
+
+  const byKind = /\bmembership_kind = \$(\d+)/.exec(where);
+  if (byKind) { consumed.add(byKind[1]); const v = params[Number(byKind[1]) - 1]; tests.push((r) => r.membership_kind === v); }
+
+  if (/\bsignin_verified_at IS NOT NULL\b/.test(where)) tests.push((r) => !!r.signin_verified_at);
+
+  // The JOIN's own condition. Modelled as a real lookup against CLIENTS, so a
+  // membership whose project is not in the table drops out the way an INNER JOIN
+  // drops it — not as a term that quietly passes.
+  const byStatus = /\bc\.status = \$(\d+)/.exec(where);
+  if (byStatus) {
+    consumed.add(byStatus[1]);
+    const v = params[Number(byStatus[1]) - 1];
+    tests.push((r) => clientStatus(r.client_id) === v);
+  }
+
+  for (const m of where.matchAll(/\$(\d+)/g)) {
+    if (!consumed.has(m[1])) {
+      throw new Error(`fake pool: unrecognised predicate on $${m[1]} in "${where}"`);
+    }
+  }
+  assert.ok(tests.length > 0, `fake pool: the membership predicate in "${where}" carried NO readable term`);
+  return (r) => tests.every((fn) => fn(r));
+}
+
+let calls = [];
+let membershipQueryThrows = false;
+
+const pool = {
+  query: async (text, params = []) => {
+    const sql = String(text).replace(/\s+/g, ' ').trim();
+    calls.push({ sql, params });
+
+    if (/FROM platform_identity_project_memberships/.test(sql)) {
+      if (membershipQueryThrows) throw new Error('simulated membership read failure');
+      assert.match(sql, /JOIN platform_identity_sso_clients/,
+        'the ownership read must join the project — a membership with no live project behind it is not an ownership claim');
+      const where = sql.slice(sql.indexOf(' WHERE ') + 7).replace(/ ORDER BY .*| LIMIT .*/g, '');
+      const rows = MEMBERSHIPS.filter(membershipFilter(where, params));
+      return { rows: rows.slice(0, 1), rowCount: Math.min(rows.length, 1) };
+    }
+
+    // The scouting rollup. Its consent decision lives ENTIRELY in the EXISTS
+    // sub-select over the accounts table, so that is what is executed here: one
+    // result row per account the predicate admits. The aggregation above it is
+    // not the boundary and is not modelled.
+    if (/platform_identity_builder_project_activity/.test(sql) && /EXISTS \( SELECT 1 FROM platform_identity_accounts/.test(sql)) {
+      const inner = /EXISTS \( SELECT 1 FROM platform_identity_accounts pa WHERE (.+?)\) GROUP BY/.exec(sql);
+      assert.ok(inner, `the rollup EXISTS clause changed shape — the interpreter must be updated, not bypassed: ${sql.slice(0, 160)}`);
+      const match = accountFilter(inner[1].replace(/pa\.github_id = a\.github_id AND /, ''), params);
+      const rows = ACCOUNTS.filter(match).map((a) => ({
+        github_id: a.github_id, github_login: a.github_login, display_name: a.display_name,
+        avatar_url: null, project_count: 1, total_credits: 1, total_tasks_shipped: 1,
+        total_karma: 0, last_active: 'T', disciplines: null,
+      }));
+      return { rows, rowCount: rows.length };
+    }
+
+    throw new Error(`fake pool: unhandled statement — ${sql.slice(0, 120)}`);
+  },
+};
+
+// ===========================================================================
+// The real route, the real permission gate, over real HTTP
+// ===========================================================================
+
+const auth = require('../src/bongos/auth.js');
+const seams = require('../src/module-seams.js');
+const catalog = require('../modules/government/catalog.js');
+
+// The caller a request speaks for. requireBuilder is the SESSION layer — the one
+// layer this task does not touch, and the one a DB-free test cannot have — so it
+// is the double; every authorization decision below is made by real code.
+let currentCaller = null;
+
+const moduleApiPath = require.resolve('../src/module-api.js');
+const helpers = require('../src/bongos/routes/_helpers.js');
+require.cache[moduleApiPath] = {
+  id: moduleApiPath, filename: moduleApiPath, loaded: true,
+  exports: {
+    pool,
+    parsePagination: helpers.parsePagination,
+    // THE REAL GATE. Not a stub: the 403 a non-owner gets below is produced by
+    // production code resolving production permission atoms.
+    requirePermission: auth.requirePermission,
+    requireBuilder: (req, res, next) => {
+      if (!currentCaller) return res.fail('unauthenticated', 401);
+      req.builder = { ...currentCaller };
+      next();
+    },
+    logger: () => ({ error: () => {}, info: () => {}, warn: () => {} }),
+  },
+};
+
+const express = require('express');
+const buildScoutingRoutes = require('../modules/platform-identity/routes/scouting.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(attachFail);
+app.use('/api/gds', buildScoutingRoutes());
+const server = app.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+
+// The real government port, answering the seeded permission set for the caller's
+// rank — the same rows migration governance_002 gives that rank.
+seams._reset();
+seams.registerProvider('government', {
+  resolveBuilderPermissions: async () => catalog.seedForRank(currentCaller ? currentCaller.rank : 'xenos'),
+});
+
+// One request AS a caller. `caller` null = no session.
+function getScouting(caller, query = '') {
+  currentCaller = caller;
+  calls = [];
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path: `/api/gds/scouting${query}` }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => resolve({ status: res.statusCode, text: Buffer.concat(chunks).toString('utf8') }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+const logins = (res) => JSON.parse(res.text).builders.map((b) => b.github_login).sort();
+
+// The cast. `rank` is the caller's rank on the HUB; `github_id` is the hub
+// account whose project memberships decide the ownership door.
+const OWNER = { id: 1, github_id: '9001', github_login: 'owner', rank: 'xenos' };
+const PLAIN_MEMBER = { id: 2, github_id: '9002', github_login: 'plain', rank: 'xenos' };
+const UNWITNESSED = { id: 3, github_id: '9003', github_login: 'unwitnessed', rank: 'xenos' };
+const PENDING = { id: 4, github_id: '9004', github_login: 'pending', rank: 'thetes' };
+const OPERATOR = { id: 5, github_id: '9005', github_login: 'operator', rank: 'metic' };
+const ARCHON = { id: 6, github_id: '9006', github_login: 'archon', rank: 'archon' };
+const OPTED_OUT_OWNER = { id: 7, github_id: '5000', github_login: 'optout', rank: 'xenos' };
+const PRINCIPAL = { id: 8, github_id: 'system:bfg', github_login: 'bfg', rank: 'xenos' };
+const SUSPENDED_OWNER = { id: 9, github_id: '9008', github_login: 'suspended', rank: 'xenos' };
+
+// ===========================================================================
+// 1. WHO MAY READ IT — the authz widening
+// ===========================================================================
+
+console.log('authz — who may read the recruiting directory:');
+
+await t('CONTROL: the operator door is untouched — a `project.curate` holder still reads it', async () => {
+  // Without this, every refusal below could be a broken harness rather than a gate.
+  const res = await getScouting(OPERATOR);
+  assert.equal(res.status, 200, 'ADR 0157 put project.curate at the metic floor; R14 did not move it');
+  assert.ok(JSON.parse(res.text).builders.length > 0, 'and the read really returns the directory');
+  assert.equal((await getScouting(ARCHON)).status, 200, 'an Archon holds the atom too');
+});
+
+await t('a PROJECT OWNER reads it — with no rank at all (goal 1000045 C5)', async () => {
+  const res = await getScouting(OWNER);
+  assert.equal(res.status, 200,
+    'the registrant of a project holds no hub rank; the ownership door is the whole point of R14');
+  assert.ok(calls.some((c) => /platform_identity_project_memberships/.test(c.sql)),
+    'and the admission came from the membership READ, not from a rank the caller happens to hold');
+});
+
+await t('a builder who is neither owner nor operator CANNOT — and gets the unchanged 403', async () => {
+  const res = await getScouting(PLAIN_MEMBER);
+  assert.equal(res.status, 403, 'building on a project is not owning one');
+  const body = JSON.parse(res.text);
+  assert.equal(body.error.code, 'permission_forbidden', 'the refusal is the permission gate, unmodified');
+  assert.deepEqual(body.error.details.required, ['project.curate'],
+    'naming the atom it lacked — the widening must not swallow or reshape a refusal');
+  assert.equal((await getScouting(PENDING)).status, 403, 'a thetes without the atom is refused too');
+});
+
+await t('an owner claim the hub never WITNESSED is not an owner claim (ADR 0205 D4)', async () => {
+  const res = await getScouting(UNWITNESSED);
+  assert.equal(res.status, 403,
+    'membership_kind=owner without signin_verified_at is a client’s unproven self-report');
+  assert.ok(isProjectOwnerMembership({ membership_kind: OWNER_MEMBERSHIP_KIND, signin_verified_at: 'T' }));
+  assert.ok(!isProjectOwnerMembership({ membership_kind: OWNER_MEMBERSHIP_KIND, signin_verified_at: null }),
+    'the pure predicate agrees with the query — the two forms cannot drift');
+  assert.ok(!isProjectOwnerMembership(null), 'and an absent row is fail-closed');
+  // BOTH layers must carry the witness, and only one of them is visible to the
+  // assertions above: the JS predicate rejects an unwitnessed row after the fact,
+  // so deleting the SQL term alone leaves every test green. Pin it from source.
+  // (Order matters for a reason worth stating: the query filters first, so
+  // `LIMIT 1` can only ever pick a witnessed row. Were the SQL term dropped, the
+  // JS check would still refuse — the worst case is a false DENIAL, never a
+  // false admission.)
+  const authzSrc = fs.readFileSync(path.join(repo, 'modules/platform-identity/scouting-authz.js'), 'utf8');
+  assert.match(authzSrc, /signin_verified_at IS NOT NULL/,
+    'the ownership query must filter on the hub witness in SQL too — the JS predicate is the second layer, not the only one');
+});
+
+await t('SUSPENDING the project shuts the door — the derived read has a revocation lever', async () => {
+  // A membership row never expires and nothing ages it out, so without this the
+  // owner of a rogue project would keep reading every builder on the platform
+  // forever. Suspending the client already stops that project signing anyone in;
+  // the read derived from it must answer to the same switch.
+  const proj = CLIENTS.find((c) => c.client_id === 'proj-x');
+  assert.equal(proj.status, 'suspended', 'fixture check');
+  assert.equal((await getScouting(SUSPENDED_OWNER)).status, 403,
+    'an owner membership on a suspended project is not a live ownership claim');
+  try {
+    proj.status = 'active';
+    assert.equal((await getScouting(SUSPENDED_OWNER)).status, 200,
+      'CONTROL: the very same row admits once the project is active again — the refusal was the STATUS, not a broken fixture');
+  } finally {
+    proj.status = 'suspended';
+  }
+});
+
+await t('a non-numeric principal answers false rather than throwing a bigint cast mid-request', async () => {
+  const res = await getScouting(PRINCIPAL);
+  assert.equal(res.status, 403, "core's 'system:bfg' shape must be refused, not 500");
+  assert.ok(!calls.some((c) => /platform_identity_project_memberships/.test(c.sql)),
+    'and the guard stops it BEFORE the bigint column ever sees it');
+});
+
+await t('a broken ownership read falls CLOSED onto the permission gate — never 500s, never admits', async () => {
+  membershipQueryThrows = true;
+  try {
+    assert.equal((await getScouting(OWNER)).status, 403,
+      'a database blip on the new door must deny, not admit — the failure mode is the OLD door');
+    assert.equal((await getScouting(OPERATOR)).status, 200,
+      'and the operator door keeps working through it: the outage is scoped to the question it broke');
+  } finally {
+    membershipQueryThrows = false;
+  }
+});
+
+await t('an unauthenticated caller never reaches either door', async () => {
+  assert.equal((await getScouting(null)).status, 401, 'requireBuilder still fronts the whole route');
+});
+
+// ===========================================================================
+// 2. WHO APPEARS IN IT — the recruiting opt-out
+// ===========================================================================
+
+console.log('\nreach — the recruiting opt-out finally gates something:');
+
+await t('an opted-out builder is ABSENT, while public, unhidden and active', async () => {
+  const res = await getScouting(OPERATOR);
+  const shown = logins(res);
+  assert.ok(!shown.includes('optout'),
+    `a public account that opted out of recruiting must not appear — got ${JSON.stringify(shown)}`);
+  assert.ok(!res.text.includes('Opt Out'), 'and nothing about them may appear in the body');
+  // The ownership door is asked first, so the rollup is not calls[0]. Find it.
+  const rollup = calls.find((c) => /platform_identity_builder_project_activity/.test(c.sql));
+  assert.ok(rollup, 'the directory read must have happened at all');
+  assert.match(rollup.sql, /COALESCE\(pa\.recruiter_discoverable/,
+    'the exclusion came from the DATABASE predicate, not from a caller remembering to check');
+});
+
+await t('and the whole matrix lands exactly where the specs put it', async () => {
+  const shown = logins(await getScouting(OPERATOR));
+  assert.deepEqual(shown, ['octo', 'optin'],
+    'in: reach-unset-and-public (octo) + explicitly-opted-in (optin). '
+    + 'out: optout (opted out), scout (private, and reach never buys addressability), '
+    + `shy (hidden), newbie (provisional) — got ${JSON.stringify(shown)}`);
+});
+
+await t('opting back IN restores them — the toggle is a toggle, not a tombstone', async () => {
+  const row = ACCOUNTS.find((a) => a.github_login === 'optout');
+  const before = row.recruiter_discoverable;
+  try {
+    row.recruiter_discoverable = null; // back to "follow visibility" = discoverable
+    assert.ok(logins(await getScouting(OPERATOR)).includes('optout'),
+      'resetting to NULL follows the public visibility setting and puts them back');
+    row.recruiter_discoverable = true; // and the explicit opt-in
+    assert.ok(logins(await getScouting(OPERATOR)).includes('optout'), 'as does an explicit true');
+  } finally {
+    row.recruiter_discoverable = before;
+  }
+});
+
+await t('MUTATION CHECK: drop the reach half and the opted-out builder comes straight back', async () => {
+  // The assertions above are only worth something if they can FAIL. This runs the
+  // rollup's own predicate with the reach term removed — exactly what deleting
+  // recruiterReachSql from scoutingListableSql would produce — and shows the
+  // interpreter genuinely readmits the row. A guard that passes with the guard
+  // deleted is worthless, so this is the assertion that makes the rest real.
+  const withReach = scoutingListableSql('pa');
+  const withoutReach = rollupVisibleSql('pa');
+  assert.notEqual(withReach, withoutReach, 'the two predicates must differ, or nothing was wired');
+
+  const admits = (clause) => ACCOUNTS.filter(accountFilter(clause, [])).map((a) => a.github_login).sort();
+  assert.deepEqual(admits(withReach), ['octo', 'optin'], 'with the reach term: the opt-out holds');
+  assert.deepEqual(admits(withoutReach), ['octo', 'optin', 'optout'],
+    'WITHOUT it: optout is readmitted — so the passing assertions above are load-bearing, not decorative');
+});
+
+await t('/people is the SAME endpoint, so "absent from /people" is true by construction', async () => {
+  const page = fs.readFileSync(path.join(repo, 'modules/hall-ui/public/people.js'), 'utf8');
+  assert.match(page, /fetch\('\/api\/gds\/scouting/,
+    'the hall directory reads GET /scouting; if it ever grows its own query, this proof stops covering it');
+  const source = fs.readFileSync(path.join(repo, 'modules/platform-identity/platform-identity.js'), 'utf8');
+  assert.match(source, /scoutingListableSql\('pa'\)/,
+    'and listScoutingRollup — the one reader behind both surfaces — joins the composed predicate');
+});
+
+// ===========================================================================
+// 3. THE TWO AXES NEVER TOUCH (ADR 0016)
+// ===========================================================================
+
+console.log('\nboundary — reach is not authority, in either direction:');
+
+await t('opting out of recruiting grants and denies NO permission', async () => {
+  // The opted-out builder also owns a project. Being unfindable must not make
+  // them unable to find: they read the directory exactly as any owner does.
+  const res = await getScouting(OPTED_OUT_OWNER);
+  assert.equal(res.status, 200,
+    'opting out of being FOUND is not opting out of FINDING — the axes are independent');
+  const shown = logins(res);
+  assert.ok(!shown.includes('optout'),
+    'and their own copy of the directory omits them too: the read is viewer-independent, '
+    + 'so a reader can never infer a privacy setting from whose list they got');
+  assert.deepEqual(shown, logins(await getScouting(OPERATOR)),
+    'byte-for-byte the same population an operator sees');
+});
+
+await t('being scoutable buys nothing either — the response is the same descriptive whitelist', async () => {
+  const res = await getScouting(OWNER);
+  for (const leak of ['recruiter_discoverable', 'account_visibility', 'profile_state', 'hide_stats', 'client_id']) {
+    assert.ok(!res.text.includes(leak), `${leak} must never serialize into the directory body`);
+  }
+  const row = JSON.parse(res.text).builders[0];
+  assert.deepEqual(Object.keys(row).sort(),
+    ['avatar_url', 'disciplines', 'display_name', 'github_id', 'github_login', 'last_active',
+      'project_count', 'total_credits', 'total_karma', 'total_tasks_shipped'],
+    'the projection stays an explicit whitelist — widening WHO reads it did not widen WHAT is read');
+});
+
+await t('the route names its atom in the MIDDLEWARE LIST, so the auditor cannot be lied to', () => {
+  // The ownership door is invisible to a static scanner. If the permission gate
+  // were hidden inside the helper too, route-rank-check.js and the generated API
+  // docs would record this privileged route as any-builder — wrong in the
+  // dangerous direction. The atom is therefore spelled at the mount point.
+  const src = fs.readFileSync(path.join(repo, 'modules/platform-identity/routes/scouting.js'), 'utf8');
+  assert.match(src, /api\.requirePermission\('project\.curate'\)/,
+    'the atom must be spelled where the route-rank auditor reads it');
+  const rrc = require('../src/bongos/route-rank-check.js');
+  const lines = src.split('\n');
+  const at = lines.findIndex((l) => /router\.get\(/.test(l));
+  const { rank, perms } = rrc.classifyGate(lines, at);
+  assert.equal(rank, 'metic+archon', `the auditor must still record the privileged floor, got ${rank}`);
+  assert.deepEqual(perms, ['project.curate']);
+});
+
+server.close();
+seams._reset();
+
+// ===========================================================================
+// 4. Lane proof
+// ===========================================================================
+
+console.log('\ncoverage:');
+
+await t('this proof runs in the DB-free unit lane (not parked as integration or known-failing)', () => {
+  const runner = fs.readFileSync(path.join(repo, 'scripts', 'gds', 'run-unit-tests.js'), 'utf8');
+  assert.ok(!/scouting_owner_access_and_reach/.test(runner),
+    'named in run-unit-tests.js it would be parked into a lane CI does not run — and a proof that never runs is not a gate (task 1002282)');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);