@bongos/core 1.19.491 → 1.19.493

package/tests/hall_record_world.mjs

@@ -38,6 +38,10 @@
 // Reproduce the renders these came from (the RECORD pages need a loaded record,
 // which the kit's own stub has no feed for — so they run against the hall's
 // fixture harness):
+//   * THE GRADE PANEL AND THE SESSION LOG (task 1003437) ride the one task read
+//     behind ?include=, draw nothing when absent, and wear the fixed verification
+//     vocabulary — never the accent. The claim block shows the whole ledger.
+//
 //   node scripts/hall-preview/server.js --port 4612 --fixture-me
 //   node modules/ui-design/kit/render.js --states modules/hall-ui/public/task.states.json \
 //     --base-in http://builders.localhost:4612 --base-out http://builders.localhost:4612
@@ -262,7 +266,11 @@ const TASK_SRC = read('task.js');
 // does the same: the description renders through it.
 const MD_SRC = read('md-reader.js');
 
-function renderTask(task, { lastClaim = null, viewer = null, goal = null, status = 200, search = '', referrer = '', withReader = true } = {}) {
+// grade / sessionLogs / claims (task 1003437): left undefined, the stub answers
+// like a client that never asked (the key is absent); null or an array answers
+// like the read did. `requests` records every path the page asked for.
+function renderTask(task, { lastClaim = null, viewer = null, goal = null, status = 200, search = '', referrer = '', withReader = true, grade, sessionLogs, claims } = {}) {
+  const requests = [];
   const els = new Map();
   const makeEl = () => ({
     dataset: {}, style: {}, textContent: '', hidden: false, disabled: false, _html: '',
@@ -287,7 +295,15 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, status
   };
   const client = {
     request: async (method, p) => {
-      if (/\/tasks\/\d+/.test(p)) return { status, ok: status === 200, data: status === 200 ? { task, last_claim: lastClaim } : null };
+      requests.push(p);
+      if (/\/tasks\/\d+/.test(p)) {
+        if (status !== 200) return { status, ok: false, data: null };
+        const data = { task, last_claim: lastClaim };
+        if (grade !== undefined) data.grade = grade;
+        if (sessionLogs !== undefined) data.session_logs = sessionLogs;
+        if (claims !== undefined) data.claims = claims;
+        return { status: 200, ok: true, data };
+      }
       if (/\/me$/.test(p)) return { status: 200, ok: true, data: { builder: viewer } };
       if (/\/goals\//.test(p)) return { status: 200, ok: true, data: { goal } };
       return { status: 404, ok: false, data: null };
@@ -322,6 +338,7 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, status
     html: () => documentObj.getElementById('task-body').innerHTML,
     sub: () => documentObj.getElementById('task-sub').textContent,
     el: (id) => documentObj.getElementById(id),
+    requests,
   };
 }
 
@@ -569,3 +586,167 @@ test('the description still reads when the reader is absent', async () => {
   assert.match(r.html(), /<div class="rec-desc rec-md"><p>plain &lt;b&gt;text&lt;\/b&gt;<\/p><\/div>/,
     'escaped into one paragraph — a missing script must never blank the record');
 });
+
+// ---- the grade panel and the session log (task 1003437) ----------------------
+// Two NET-NEW regions the owner approved at the hall composition round (direction
+// doc §6 decision 4). Both ride the task read's ?include= opt-in, so the page asks
+// once; both draw NOTHING when absent (the ship-visual precedent), and a verdict
+// wears the fixed verification vocabulary, never the accent.
+
+const GRADE = {
+  passed: true, score: '8.5', threshold: '6.0', grader_kind: 'subagent', grader_version: 'v4.0',
+  rubric_scores: {}, notes_md: '', issues: [],
+  signals: {
+    grader_version: 'v4.0', threshold: 6, panel_outcome: 'pass',
+    workers: [
+      { kind: 'narc', name: 'Narc', verdict: 'pass', model: 'claude-sonnet-5' },
+      { kind: 'quality', name: 'Quality', verdict: 'pass', model: 'claude-sonnet-5' },
+      { kind: 'hacker', name: 'Hacker', verdict: 'pass', model: 'claude-sonnet-5' },
+      { kind: 'efficiency', name: 'Efficiency Monger', verdict: 'pass', model: 'claude-sonnet-5' },
+    ],
+  },
+};
+const SESSION = {
+  id: '1', builder_id: '95', github_login: 'jaxri', display_name: 'Percy Jackson',
+  started_at: '2026-08-30T17:41:00Z', ended_at: '2026-08-30T18:18:00Z', outcome: 'shipped',
+  notes_md: '**What shipped:**\n- the thing', confidence: 'verified-smoke',
+};
+
+test('the page asks the task feed for the grade, the session log and the claim ledger in the one read', async () => {
+  const r = renderTask(BASE_TASK);
+  await r.boot(); await settle();
+  const reads = r.requests.filter((p) => /\/tasks\/\d+/.test(p));
+  assert.equal(reads.length, 1, 'one read, not a fetch per region');
+  for (const k of ['last_claim', 'grade', 'session_logs', 'claims']) {
+    assert.match(reads[0], new RegExp(`include=[^&]*\\b${k}\\b`), `asks for ${k}`);
+  }
+});
+
+test('the grade panel: four workers as verification pills, the score out of ten, the verdict, the panel crumb', async () => {
+  const r = renderTask(BASE_TASK, { grade: GRADE });
+  await r.boot(); await settle();
+  const html = r.html();
+  const start = html.indexOf('id="task-grade"');
+  const end = html.indexOf('<p class="rec-sec__h">Actions');
+  assert.ok(start > 0 && end > start, 'the grade section renders, before the actions');
+  const sec = html.slice(start, end);
+  const axes = [...sec.matchAll(/<span class="tk-axis__n">([^<]+)<\/span><span class="rec-pill rec-pill--(\w+) rec-pill--sm">(\w+)<\/span>/g)].map((m) => [m[1], m[2], m[3]]);
+  assert.deepEqual(axes, [['narc', 'ok', 'pass'], ['quality', 'ok', 'pass'], ['hacker', 'ok', 'pass'], ['efficiency', 'ok', 'pass']],
+    'the four workers in the panel order, each a pass pill');
+  assert.match(sec, /<span class="tk-score__v">8\.5<small class="tk-score__of">\/10<\/small><\/span>/, 'the score out of ten');
+  assert.match(sec, /<span class="rec-pill rec-pill--ok">verdict pass<\/span>/, 'the verdict');
+  assert.match(sec, /<span class="tk-crumb">threshold 6 · panel v4\.0 · claude-sonnet-5<\/span>/, 'threshold, panel version, model');
+  assert.doesNotMatch(sec, /accent/, 'state never borrows the accent');
+});
+
+test('a failed or mixed panel wears warn and danger, never ok', async () => {
+  const grade = {
+    ...GRADE, passed: false, score: '4.5',
+    signals: {
+      ...GRADE.signals, panel_outcome: 'fail',
+      workers: [
+        { kind: 'narc', verdict: 'pass', model: 'claude-sonnet-5' },
+        { kind: 'quality', verdict: 'concerns', model: 'claude-sonnet-5' },
+        { kind: 'hacker', verdict: 'fail', model: 'claude-sonnet-5' },
+        { kind: 'efficiency', verdict: null, error: 'SUBAGENT_TIMEOUT', model: 'claude-sonnet-5' },
+      ],
+    },
+  };
+  const r = renderTask(BASE_TASK, { grade });
+  await r.boot(); await settle();
+  const html = r.html();
+  assert.match(html, /tk-axis__n">quality<\/span><span class="rec-pill rec-pill--warn rec-pill--sm">concerns</, 'concerns is amber');
+  assert.match(html, /tk-axis__n">hacker<\/span><span class="rec-pill rec-pill--danger rec-pill--sm">fail</, 'fail is red');
+  assert.match(html, /tk-axis__n">efficiency<\/span><span class="rec-pill rec-pill--danger rec-pill--sm">error</, 'an errored worker says so, in red');
+  assert.match(html, /<span class="rec-pill rec-pill--danger">verdict fail<\/span>/);
+  assert.match(html, /tk-score__v">4\.5</);
+});
+
+test('no grade draws no grade panel at all; an unavailable panel is one honest line', async () => {
+  for (const opts of [{}, { grade: null }]) {
+    const r = renderTask(BASE_TASK, opts);
+    await r.boot(); await settle();
+    assert.ok(!r.html().includes('id="task-grade"'), 'nothing — no placeholder, no "no grade yet"');
+    assert.ok(!/rec-sec__h">Grade</.test(r.html()), 'not even the heading');
+  }
+  const r = renderTask(BASE_TASK, { grade: { passed: false, score: null, signals: { panel_outcome: 'unavailable', workers: [] } } });
+  await r.boot(); await settle();
+  const html = r.html();
+  assert.match(html, /id="task-grade"/);
+  assert.match(html, /could not run when this task was shipped/, 'an outage is data, and reads as one');
+  assert.ok(!html.includes('tk-axis'), 'no empty worker cells');
+  assert.ok(!html.slice(html.indexOf('id="task-grade"')).split('<p class="rec-sec__h">Actions')[0].includes('<span class="rec-pill'), 'and no verdict pill where none was reached');
+});
+
+test('the session log: when, who, how long, the outcome, what it paid, the handoff, the way to Sessions — newest first', async () => {
+  const older = { ...SESSION, id: '0', builder_id: '7', display_name: 'Someone Else', started_at: '2026-08-29T10:00:00Z', ended_at: '2026-08-29T12:05:00Z', outcome: 'partial', notes_md: '' };
+  const r = renderTask({ ...BASE_TASK, credits_awarded: 60 }, { sessionLogs: [SESSION, older] });
+  await r.boot(); await settle();
+  const html = r.html();
+  const start = html.indexOf('id="task-sessions"');
+  const end = html.indexOf('<p class="rec-sec__h">Actions');
+  assert.ok(start > 0 && end > start, 'the session log renders, before the actions');
+  const sec = html.slice(start, end);
+  assert.match(sec, /<p class="rec-sec__h">Session log <em>2 sessions<\/em><\/p>/);
+  const ledgers = sec.split('<div class="tk-ledger">').slice(1);
+  assert.equal(ledgers.length, 2);
+  assert.match(ledgers[0], /<span class="tk-lk">Session<\/span><span class="tk-lv">2026-08-30, <a class="rec-dep" href="\/profile\?id=95">Percy Jackson<\/a>, 37m<\/span>/,
+    'date, the builder as a link to their profile, the duration');
+  assert.match(ledgers[0], /<span class="rec-pill rec-pill--sm rec-pill--ok">shipped<\/span>/, 'the outcome in the state vocabulary');
+  assert.match(ledgers[0], /<span class="tk-lk">Credits awarded<\/span><span class="tk-lv">60<\/span>/, 'what the task paid, on the session that shipped it');
+  assert.match(ledgers[0], /<details class="tk-handoff"><summary>Read the handoff notes<\/summary><div class="rec-desc rec-md"><p><strong>What shipped:<\/strong><\/p>/,
+    'the handoff renders through the reader, behind a disclosure');
+  assert.match(ledgers[0], /<a class="rec-dep" href="\/sessions">Open in Sessions<\/a>/, 'the way to the full log');
+  assert.match(ledgers[1], /Someone Else<\/a>, 2h 05m/, 'the earlier session follows, with its own duration');
+  assert.match(ledgers[1], /rec-pill--sm rec-pill--warn">partial</, 'partial is amber');
+  assert.ok(!ledgers[1].includes('Credits awarded'), 'no pay row on a session that did not ship');
+  assert.ok(!ledgers[1].includes('tk-handoff'), 'no handoff row without a note');
+});
+
+test('no session log draws nothing', async () => {
+  for (const opts of [{}, { sessionLogs: null }, { sessionLogs: [] }]) {
+    const r = renderTask(BASE_TASK, opts);
+    await r.boot(); await settle();
+    assert.ok(!r.html().includes('id="task-sessions"'), 'nothing at all');
+    assert.ok(!/Session log/.test(r.html()));
+  }
+});
+
+test('the claim ledger lists the earlier claims under the current one, and the "most recent only" caveat is gone', async () => {
+  const last = { builder_id: '95', github_login: 'jaxri', claimed_at: '2026-08-30T17:41:00Z', released_at: '2026-08-30T18:18:00Z', outcome: 'shipped' };
+  const claims = [
+    { ...last, claim_id: '2', display_name: 'Percy Jackson' },
+    { claim_id: '1', builder_id: '7', github_login: 'other', display_name: 'Someone Else', claimed_at: '2026-08-29T10:00:00Z', released_at: '2026-08-29T12:05:00Z', outcome: 'abandoned' },
+  ];
+  const r = renderTask(BASE_TASK, { lastClaim: last, claims });
+  await r.boot(); await settle();
+  const html = r.html();
+  assert.match(html, /<p class="rec-sec__h">Claim <em>2 claims<\/em><\/p>/);
+  assert.match(html, /Last claimed by <b>jaxri<\/b>/);
+  assert.match(html, /<ul class="rec-files tk-claims"><li><a class="rec-dep" href="\/profile\?id=7">Someone Else<\/a> · 2026-08-29 · abandoned<\/li><\/ul>/,
+    'the earlier claim: who, when, how it ended');
+  assert.ok(!html.includes('never the full ledger'), 'the caveat no longer holds, so it is gone');
+  // Without the ledger on the read (an older stub), the section reads as it did.
+  const r2 = renderTask(BASE_TASK, { lastClaim: last });
+  await r2.boot(); await settle();
+  assert.match(r2.html(), /<p class="rec-sec__h">Claim<\/p>/);
+  assert.ok(!r2.html().includes('tk-claims'));
+});
+
+test('task.css declares the new shapes with tokens only — no literal colour, no accent', () => {
+  const css = decomment(read('task.css'));
+  for (const sel of ['.tk-axes', '.tk-axis__n', '.tk-score__v', '.tk-crumb', '.tk-ledger', '.tk-lrow', '.tk-lk', '.tk-lv', '.tk-handoff > summary']) {
+    assert.ok(css.includes(sel), `${sel} is styled`);
+  }
+  assert.doesNotMatch(css, /#[0-9a-fA-F]{3,8}\b|rgba?\(|hsla?\(/, 'every colour is a token');
+  assert.doesNotMatch(css.slice(css.indexOf('.tk-axes')), /--accent/, 'the grade and session shapes never borrow the accent (the lifecycle rail above them lights its one beat with it, by design)');
+  assert.match(css, /\.tk-handoff > summary \{[^}]*min-height: 24px/, 'the disclosure is a 24px control');
+});
+
+test('the mocks no longer mark the two regions proposed — they are built', () => {
+  for (const v of ['v1', 'v3']) {
+    const mock = fs.readFileSync(path.join(ROOT, 'docs', 'design', 'mocks', 'hall', 'task', `${v}.html`), 'utf8');
+    assert.ok(!/class="(panel|sec) proposed"/.test(mock), `${v}: no dashed proposed panel`);
+    assert.ok(!mock.includes('<em>proposed</em>'), `${v}: no proposed eyebrow`);
+  }
+});

package/tests/task_detail_includes.mjs

@@ -0,0 +1,108 @@
+// tests/task_detail_includes.mjs — the task read's two new opt-in siblings
+// (task 1003437, goal 1000081): ?include=session_logs and ?include=claims on
+// GET /tasks/:id, and the two reads behind them.
+//
+// WHY. The hall's task page grew a grade panel and a session log (the owner's
+// two net-new regions), and the claim block finally shows the whole ledger. The
+// grade already rode the read behind ?include=grade; the session log and the
+// claim ledger had NO read surface at all — session_logs was write-only from
+// the API's point of view, and claims exposed only the most recent holder. The
+// endpoint is a CRITICAL §4 supervisor hot path, so every sibling is opt-in:
+// a caller that does not ask pays for nothing.
+//
+// What it locks:
+//   * THE ROUTE honours both include keys, calls the two reads, and sets each
+//     sibling only when asked (an unasked key is ABSENT, not null).
+//   * THE READS are keyed by task_id, newest first, joined to builders for the
+//     name — and, like getLastClaimHolder (#678), never return a rank.
+//   * THE FACADE (modules/lifecycle/db.js) re-exports both, so the route's
+//     `db.getTaskSessionLogs` / `db.getTaskClaims` resolve.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8').replace(/\r\n/g, '\n');
+const require = createRequire(import.meta.url);
+
+const routeSrc = read('modules/lifecycle/routes/tasks.js');
+const handler = routeSrc.slice(routeSrc.indexOf("router.get('/tasks/:id',"), routeSrc.indexOf("// GET /tasks/:id/dependencies"));
+
+test('GET /tasks/:id honours ?include=session_logs and ?include=claims as opt-in siblings', () => {
+  assert.ok(handler.length > 0, 'the handler is where it was');
+  assert.match(handler, /includes\.includes\('session_logs'\)/);
+  assert.match(handler, /includes\.includes\('claims'\)/);
+  assert.match(handler, /wantSessionLogs \? db\.getTaskSessionLogs\(id\) : Promise\.resolve\(null\)/, 'the read runs only when asked');
+  assert.match(handler, /wantClaims \? db\.getTaskClaims\(id\) : Promise\.resolve\(null\)/);
+  assert.match(handler, /if \(wantSessionLogs\) body\.session_logs = sessionLogs;/, 'set only when asked — absent otherwise');
+  assert.match(handler, /if \(wantClaims\) body\.claims = claims;/);
+  assert.match(handler, /auth\.requireBuilder/, 'the gate is unchanged: any signed-in builder');
+});
+
+test('the lifecycle facade re-exports both reads', () => {
+  const db = require('../modules/lifecycle/db.js');
+  assert.equal(typeof db.getTaskSessionLogs, 'function');
+  assert.equal(typeof db.getTaskClaims, 'function');
+  const reads = require('../modules/lifecycle/db-claim-reads.js');
+  assert.equal(db.getTaskSessionLogs, reads.getTaskSessionLogs);
+  assert.equal(db.getTaskClaims, reads.getTaskClaims);
+});
+
+// The reads run against the module-api pool the module destructured at load; the
+// pool OBJECT is shared, so swapping its query for the test's duration is enough.
+async function withQuery(fn, body) {
+  const api = require('../src/module-api');
+  const orig = api.pool.query;
+  const calls = [];
+  api.pool.query = async (sql, params) => { calls.push({ sql: String(sql).replace(/\s+/g, ' '), params }); return fn(sql, params); };
+  try { return await body(calls); } finally { api.pool.query = orig; }
+}
+
+test('getTaskSessionLogs: by task_id, newest first, the builder joined for a name, no rank', async () => {
+  const reads = require('../modules/lifecycle/db-claim-reads.js');
+  const rows = [{ id: '2', outcome: 'shipped' }, { id: '1', outcome: 'partial' }];
+  await withQuery(async () => ({ rows }), async (calls) => {
+    const out = await reads.getTaskSessionLogs(1003437);
+    assert.deepEqual(out, rows, 'rows pass through untouched');
+    assert.equal(calls.length, 1);
+    const { sql, params } = calls[0];
+    assert.deepEqual(params, [1003437]);
+    assert.match(sql, /FROM session_logs s/);
+    assert.match(sql, /JOIN builders b ON b\.id = s\.builder_id/);
+    assert.match(sql, /WHERE s\.task_id = \$1/);
+    assert.match(sql, /ORDER BY s\.ended_at DESC, s\.id DESC/);
+    for (const col of ['s.started_at', 's.ended_at', 's.outcome', 's.notes_md', 's.confidence', 'b.github_login', 'b.display_name']) {
+      assert.ok(sql.includes(col), `selects ${col}`);
+    }
+    assert.doesNotMatch(sql, /\brank\b/, 'rank is sensitive metadata and stays off this read (#678)');
+  });
+});
+
+test('getTaskClaims: the whole ledger by task_id, newest first, the builder joined, no rank', async () => {
+  const reads = require('../modules/lifecycle/db-claim-reads.js');
+  const rows = [{ claim_id: '2' }, { claim_id: '1' }];
+  await withQuery(async () => ({ rows }), async (calls) => {
+    const out = await reads.getTaskClaims(1003437);
+    assert.deepEqual(out, rows);
+    const { sql, params } = calls[0];
+    assert.deepEqual(params, [1003437]);
+    assert.match(sql, /FROM claims c/);
+    assert.match(sql, /JOIN builders b ON b\.id = c\.builder_id/);
+    assert.match(sql, /WHERE c\.task_id = \$1/);
+    assert.match(sql, /ORDER BY c\.claimed_at DESC, c\.id DESC/);
+    assert.doesNotMatch(sql, /LIMIT/, 'the ledger, not the last holder');
+    assert.doesNotMatch(sql, /\brank\b/);
+  });
+});
+
+test('an empty ledger is an empty array, never null — the page tells "none" from "not asked"', async () => {
+  const reads = require('../modules/lifecycle/db-claim-reads.js');
+  await withQuery(async () => ({ rows: [] }), async () => {
+    assert.deepEqual(await reads.getTaskSessionLogs(1), []);
+    assert.deepEqual(await reads.getTaskClaims(1), []);
+  });
+});