@bongos/core 1.19.527 → 1.19.529

package/modules/public-landing/public/projects.html

@@ -328,6 +328,14 @@ summary{min-height:24px;padding:3px 0;}
 .tpill:hover::before{border-color:var(--ink-faint);}
 .tpill[aria-pressed=true]{background:none;border-color:var(--rule-soft);color:var(--ink);}
 .tpill[aria-pressed=true]::before{background:var(--accent);border-color:var(--accent);outline:4px solid color-mix(in srgb,var(--accent) 22%,transparent);}
+/* Why the picker preselected what it did (task 1002341) — one line per rule that
+   moved something, between the band and the always-on clause. Wears .reassure's
+   weight on purpose: this is the panel explaining itself, never a thing to act on,
+   so it must not compete with the toggles it is explaining. */
+.modWhy{display:none;}
+.modWhy.on{display:grid;gap:6px;margin:0 0 14px;max-width:62ch;}
+.modWhy span{font-size:13.5px;font-weight:400;color:var(--ink-soft);line-height:1.5;}
+
 /* the module picker (task 1002339) wears the SAME band as the type and team
    questions — one hairline cell per choice, the dot on the chosen ones. The only
    difference is that a module carries a one-line summary under its name, so its
@@ -1017,11 +1025,12 @@ summary{min-height:24px;padding:3px 0;}
                to make, when in fact they were never choices. -->
           <section class="panel" id="panel-modules" aria-labelledby="mod-h">
             <h1 id="mod-h">What it comes with</h1>
-            <p class="lede">Optional — skip it and you get the suggested set below. These are extras on top of everything every project already has, and you can switch any of them on or off later.</p>
+            <p class="lede">Optional — skip it and you get the suggested set below, shaped by what you just told us. These are extras on top of everything every project already has, and you can switch any of them on or off later.</p>
             <form data-next="5">
               <div class="wizField"><span id="modLbl">Extras for this project</span>
                 <div class="typeCards" id="modCards" role="group" aria-labelledby="modLbl"></div>
               </div>
+              <div class="modWhy" id="modWhy" aria-live="polite"></div>
               <div class="reassure" id="modCoreNote"></div>
               <div class="hint" id="h-modules">&nbsp;</div>
               <div class="nav">
@@ -3204,10 +3213,39 @@ summary{min-height:24px;padding:3px 0;}
       if (state.step === 4) renderModules();
       else if (state.step === 7) renderReview();
     }
+    /* The row for the declared type, or null before the read lands / for a type
+       the table has no row for (including no type at all). */
+    function bundleRow() {
+      if (!starterBundles) return null;
+      return (starterBundles.bundles || []).filter(function (b) { return b.type === state.projType; })[0] || null;
+    }
+    /* The type's preselect AS THE ABOUT STEP'S ANSWER SHAPES IT (task 1002341,
+       BV1.R22). The server resolved every combination into byTeamShape, so
+       answering "just me" three panels back re-preselects here with no round trip
+       and no rule applied twice in two languages — the wizard reads the same
+       table `effectiveModules` falls back to (ADR 0243).
+
+       An older payload without byTeamShape, or a team shape no rule fires on,
+       falls through to the unadjusted bundle: the answer this panel showed before
+       R22, which is never wrong, only untailored. */
+    function tailoredRow() {
+      var row = bundleRow();
+      if (!row) return null;
+      var forShape = row.byTeamShape && state.teamShape ? row.byTeamShape[state.teamShape] : null;
+      return forShape || { bundle: row.bundle || [], adjustments: [] };
+    }
     function preselectedModules() {
-      if (!starterBundles) return [];
-      var forType = (starterBundles.bundles || []).filter(function (b) { return b.type === state.projType; })[0];
-      return forType ? forType.bundle.slice() : [];
+      var row = tailoredRow();
+      return row ? row.bundle.slice() : [];
+    }
+    /* Why the preselect is what it is, in the owner's own words — one sentence per
+       rule that ACTUALLY moved something. Empty when nothing did, and empty once
+       the owner has answered for themselves: a reason given back for a toggle they
+       flipped reads as the panel arguing with them. */
+    function preselectReasons() {
+      if (state.modules !== null) return [];
+      var row = tailoredRow();
+      return row ? (row.adjustments || []) : [];
     }
     /* What the panel paints and the review names: the owner's answer if they
        gave one, otherwise the type's preselect. */
@@ -3233,6 +3271,8 @@ summary{min-height:24px;padding:3px 0;}
            a moment; only a read that ANSWERED badly gets the clause, so a slow
            network never tells the owner something is broken when it isn't. */
         band.innerHTML = '';
+        $('modWhy').innerHTML = '';
+        $('modWhy').classList.remove('on');
         note.textContent = bundlesFailed
           ? 'We couldn’t load the list of extras just now. Your project is created with everything it needs either way, and you can add extras from its settings.'
           : '';
@@ -3245,6 +3285,17 @@ summary{min-height:24px;padding:3px 0;}
           + (on.indexOf(m.key) === -1 ? 'false' : 'true') + '"><span><b>' + esc(m.label)
           + '</b><small>' + esc(m.summary) + '</small></span></button>';
       }).join('');
+      /* The tailoring, said out loud (task 1002341). A preselect an owner cannot
+         see the reason for is one they have to audit, which is the thing ADR 0237
+         says is worse than no preselect at all. Rendered as its own block above the
+         core clause, because it is about THIS project's answers while the clause
+         below is about every project. */
+      var why = $('modWhy');
+      var reasons = preselectReasons();
+      why.innerHTML = reasons.length
+        ? reasons.map(function (a) { return '<span>' + esc(a.reason) + '</span>'; }).join('')
+        : '';
+      why.classList.toggle('on', reasons.length > 0);
       var core = (starterBundles.core || []).length;
       note.textContent = core
         ? 'Every project also starts with the same ' + core + ' core parts — the platform itself, the way it tracks work, and the builders’ hall. They are always on, so they are not part of this choice.'

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.527",
+  "version": "1.19.529",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.527",
+      "version": "1.19.529",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.527",
+  "version": "1.19.529",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.527'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.529'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/grader_root_outage.mjs

@@ -0,0 +1,109 @@
+// tests/grader_root_outage.mjs — a grader that could not START must say so, and it
+// must be able to start as root (task 1003574, goal 1000024).
+//
+// THE BUG THIS PINS. #943 added a 'unavailable' panel outcome for a total grader
+// outage, so a builder sees "grader unavailable" instead of a FAIL nobody produced.
+// It worked when every gating worker was an LLM subagent. Then the DETERMINISTIC
+// pseudo-workers (route-rank, permission-path) were appended to the panel — they
+// never spawn a subprocess, so an outage cannot touch them, and one of them passing
+// made `gating.every(isMissingSignal)` permanently false. The outage branch became
+// unreachable: a total subagent outage fell through to the securityLensErrored branch
+// and was recorded as `FAIL · 0/10` with zero issues and every rubric axis null.
+//
+// That shape is indistinguishable from a real rejection in a terminal, and it routes
+// a builder to /grade-recover Branch A — whose prescribed re-grade cannot clear an
+// outage that is deterministic. Observed end-to-end on task 1003280, whose ship was
+// blocked twice by a panel that never ran.
+//
+// Run:  node --test tests/grader_root_outage.mjs
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const grader = require(path.join(ROOT, 'modules', 'grading', 'grader.js'));
+const read = (...p) => fs.readFileSync(path.join(ROOT, ...p), 'utf8');
+
+// An LLM worker whose subprocess died — no signal at all.
+const errored = (kind) => ({
+  kind, name: kind, specialty: 'x', verdict: 'error', scores: {}, issues: [],
+  notes_md: '', confidence: 0, model: 'claude-sonnet-5', run_ms: 10,
+  error: 'SUBAGENT_NONZERO_EXIT',
+});
+// The deterministic pseudo-worker, exactly as route-rank-check.js stamps it.
+const deterministicPass = (kind = 'route-rank') => ({
+  kind, name: kind, specialty: 'x', verdict: 'pass', scores: {}, issues: [],
+  notes_md: `${kind} pass`, confidence: 1, model: 'deterministic', run_ms: 0, error: null,
+});
+const llmPass = (kind) => ({
+  kind, name: kind, specialty: 'x', verdict: 'pass', scores: { code_quality: 8 }, issues: [],
+  notes_md: '', confidence: 0.8, model: 'claude-sonnet-5', run_ms: 10, error: null,
+});
+
+test('the exact task-1003280 shape: every subagent dead, route-rank passing → unavailable, not fail', () => {
+  const r = grader.aggregatePanel([
+    errored('narc'), errored('quality'), errored('hacker'), errored('efficiency'),
+    deterministicPass('route-rank'),
+  ]);
+  assert.equal(r.signals.panel_outcome, 'unavailable',
+    'a passing deterministic check is not evidence the panel ran');
+  assert.equal(r.passed, false, 'unavailable never auto-passes — it routes to manual-confirm');
+  assert.match(r.notes_md, /GRADER UNAVAILABLE/);
+  // The tell that made this so hard to read in a terminal: no findings at all.
+  assert.equal((r.issues || []).length, 0);
+});
+
+test('two deterministic pseudo-workers do not resurrect the fail either', () => {
+  const r = grader.aggregatePanel([
+    errored('narc'), errored('quality'), errored('hacker'), errored('efficiency'),
+    deterministicPass('route-rank'), deterministicPass('permission-path'),
+  ]);
+  assert.equal(r.signals.panel_outcome, 'unavailable');
+});
+
+test('a DETERMINISTIC FAIL still hard-blocks — the fix does not soften the gate', () => {
+  const detFail = { ...deterministicPass('route-rank'), verdict: 'fail',
+    issues: [{ severity: 'blocker', file: 'r.js', summary: 'ungated write route' }] };
+  const r = grader.aggregatePanel([
+    errored('narc'), errored('quality'), errored('hacker'), errored('efficiency'), detFail,
+  ]);
+  assert.equal(r.signals.panel_outcome, 'fail',
+    'gatingFail is the first branch and must still win over the outage branch');
+  assert.equal(r.passed, false);
+});
+
+test('a real security-lens outage with the rest of the panel alive still hard-blocks (#574 intact)', () => {
+  const r = grader.aggregatePanel([
+    llmPass('narc'), llmPass('quality'), errored('hacker'), llmPass('efficiency'),
+    deterministicPass('route-rank'),
+  ]);
+  assert.equal(r.signals.panel_outcome, 'fail', 'a missing Hacker among live workers is still a block');
+  assert.match(r.notes_md, /SECURITY LENS MISSING/);
+});
+
+test('a healthy panel is unaffected', () => {
+  const r = grader.aggregatePanel([
+    llmPass('narc'), llmPass('quality'), llmPass('hacker'), llmPass('efficiency'),
+    deterministicPass('route-rank'),
+  ]);
+  assert.equal(r.signals.panel_outcome, 'pass');
+  assert.equal(r.passed, true);
+});
+
+// ---- the spawn half -------------------------------------------------------
+
+test('the worker spawn picks a permission mode the CLI accepts as root', () => {
+  const src = read('modules', 'grading', 'grader-subagent.js');
+  // The refusal is euid-based, so the choice must be too.
+  assert.match(src, /process\.getuid\(\) === 0/);
+  assert.match(src, /isRoot \? 'acceptEdits' : 'bypassPermissions'/);
+  // The flag must be passed as the computed value, never the hardcoded wide one.
+  assert.match(src, /'--permission-mode', permissionMode/);
+  assert.doesNotMatch(src, /'--permission-mode', 'bypassPermissions'/);
+  // The tool list is what makes acceptEdits cost nothing: there are no edits.
+  assert.match(src, /'--tools', 'Read'/);
+});

package/tests/projects_hub_module_picker.mjs

@@ -25,6 +25,17 @@ import path from 'node:path';
 import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
 
+// ESM named imports off the CJS module on purpose (the knip learning): the
+// cross-check test at the bottom runs the REAL declaration the route serves, so a
+// rule change cannot pass this file while breaking the panel.
+import {
+  ALWAYS_ON_CORE,
+  RULED_TEAM_SHAPES,
+  starterBundleAnswerTable,
+  optionalModules,
+  effectiveModules,
+} from '../modules/provisioning/starter-bundles.js';
+
 const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
 const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
 const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8');
@@ -59,6 +70,39 @@ const PAYLOAD = {
   ],
 };
 
+// The `byTeamShape` half of the same payload (BV1.R22, task 1002341): the bundle
+// re-resolved for each About-step answer, with the adjustments that got it there.
+//
+// Deliberately only TWO types carry it. The rest are left without so the
+// degradation path is exercised by the same fixture — a payload from a server that
+// predates R22, or a team shape no rule fires on, must fall through to the
+// unadjusted bundle rather than preselecting nothing. The real table for every
+// type is pinned against the real module further down ("the picker and the server
+// resolve the same set").
+const TAILORED = {
+  ...PAYLOAD,
+  bundles: PAYLOAD.bundles.map((b) => {
+    if (b.type === 'game') {
+      return { ...b, byTeamShape: {
+        // solo: the shared environment comes off
+        solo: { bundle: ['discord'], adjustments: [{ rule: 'building-alone-needs-no-shared-environment', effect: 'remove', module: 'dev-box', reason: 'You are building this alone, so the shared cloud environment is off.' }] },
+        // small-team: the rule wants dev-box, the bundle already has it — a rule
+        // that changed nothing claims nothing
+        'small-team': { bundle: ['dev-box', 'discord'], adjustments: [] },
+        community: { bundle: ['dev-box', 'discord'], adjustments: [] },
+      } };
+    }
+    if (b.type === 'research') {
+      return { ...b, byTeamShape: {
+        solo: { bundle: ['agents'], adjustments: [] },
+        'small-team': { bundle: ['agents', 'dev-box'], adjustments: [{ rule: 'a-team-shares-one-environment', effect: 'add', module: 'dev-box', reason: 'A small team gets one shared environment to build in.' }] },
+        community: { bundle: ['agents', 'discord'], adjustments: [{ rule: 'a-community-needs-somewhere-to-gather', effect: 'add', module: 'discord', reason: 'You said an open community is building this, so somewhere for it to gather is switched on.' }] },
+      } };
+    }
+    return b;
+  }),
+};
+
 function makeEl(id) {
   const classes = new Set();
   const attrs = new Map();
@@ -88,13 +132,26 @@ function rowsOf(html) {
   return out;
 }
 
+// The reason lines the panel painted, in order (task 1002341). Parsed out of the
+// markup for the same reason rowsOf is: a selector that resolves against markup
+// nobody wrote proves nothing.
+function whyOf(html) {
+  const out = [];
+  const re = /<span>([^<]*)<\/span>/g;
+  let m;
+  while ((m = re.exec(html))) out.push(m[1]);
+  return out;
+}
+
 // Boot the picker with a given draft state. `fetchOk: false` drives the
-// couldn't-load branch. Returns the handles the assertions drive it through.
-function boot({ state: seed = {}, fetchOk = true } = {}) {
+// couldn't-load branch; `payload` swaps in a different server answer (TAILORED
+// carries the R22 byTeamShape half). Returns the handles the assertions drive it
+// through.
+function boot({ state: seed = {}, fetchOk = true, payload = PAYLOAD } = {}) {
   const els = new Map();
   const $ = (id) => { if (!els.has(id)) els.set(id, makeEl(id)); return els.get(id); };
   const form = makeEl('panel-modules-form');
-  const state = { step: 4, projType: null, modules: null, ...seed };
+  const state = { step: 4, projType: null, teamShape: null, modules: null, ...seed };
   const shown = [];
   let saves = 0;
   let fetches = 0;
@@ -112,7 +169,7 @@ function boot({ state: seed = {}, fetchOk = true } = {}) {
     renderReview: () => { reviews++; },
     API: '/api/bongos',
     fetch: () => { fetches++; return Promise.resolve(fetchOk
-      ? { ok: true, json: () => Promise.resolve(PAYLOAD) }
+      ? { ok: true, json: () => Promise.resolve(payload) }
       : { ok: false, json: () => Promise.resolve(null) }); },
     Promise, JSON, Math, Object, Array, String, Number, console,
   };
@@ -134,6 +191,8 @@ function boot({ state: seed = {}, fetchOk = true } = {}) {
     render: () => sandbox.renderModules(),
     open: async function () { sandbox.renderModules(); for (let i = 0; i < 20; i++) await Promise.resolve(); },
     rows: () => rowsOf(band.innerHTML),
+    why: () => whyOf($('modWhy').innerHTML),
+    whyShown: () => $('modWhy').classList.contains('on'),
     coreNote: () => $('modCoreNote').textContent,
     coreShown: () => $('modCoreNote').classList.contains('on'),
     click: (key) => {
@@ -367,3 +426,157 @@ test('the review reads an answered picker back, empty included', async () => {
   await none.settle();
   assert.equal(none.extrasRow(), 'None — just the core', 'a deliberate "none" is stated as one');
 });
+
+// ─────────────────────────────────────────────────────────────────────────────
+// BV1.R22 (task 1002341) — the About step's answer reaches the preselect, and
+// the panel says why. ADR 0243.
+// ─────────────────────────────────────────────────────────────────────────────
+
+test('the team shape adjusts the type bundle, and the panel says why in the owner\'s words', async () => {
+  // Arrange — "a game", then "just me" one panel later
+  const h = boot({ state: { projType: 'game', teamShape: 'solo' }, payload: TAILORED });
+
+  // Act
+  await h.open();
+
+  // Assert — the shared environment came off, and the reason is on screen
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['discord'],
+    'solo drops the dev box the game bundle would have preselected');
+  assert.equal(h.whyShown(), true);
+  assert.deepEqual(h.why(), ['You are building this alone, so the shared cloud environment is off.']);
+});
+
+test('a rule that changed nothing claims nothing', async () => {
+  // small-team ADDS dev-box, and the game bundle already carries it. A reason
+  // shown for a change that did not happen is a claim the owner cannot check.
+  const h = boot({ state: { projType: 'game', teamShape: 'small-team' }, payload: TAILORED });
+  await h.open();
+
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['dev-box', 'discord']);
+  assert.deepEqual(h.why(), [], 'no adjustment, no sentence');
+  assert.equal(h.whyShown(), false, 'and no empty block sitting on the panel');
+});
+
+test('an added module is preselected and explained', async () => {
+  const h = boot({ state: { projType: 'research', teamShape: 'community' }, payload: TAILORED });
+  await h.open();
+
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['agents', 'discord']);
+  assert.deepEqual(h.why(), ['You said an open community is building this, so somewhere for it to gather is switched on.']);
+});
+
+test('answering the About step later re-preselects, with no second read', async () => {
+  // The two questions live on two earlier panels and are both changeable. The
+  // whole table arrived in one read precisely so going back costs nothing.
+  const h = boot({ state: { projType: 'research' }, payload: TAILORED });
+  await h.open();
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['agents'], 'unanswered: the raw bundle');
+
+  h.state.teamShape = 'small-team';
+  h.render();
+
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['agents', 'dev-box']);
+  assert.equal(h.fetches(), 1, 'and the answer cost no round trip');
+});
+
+test('Skip after an answered About step still yields the set the panel showed', async () => {
+  // ADR 0240 §2's property, extended to the interview's answer (ADR 0243): the
+  // preselect and the server's fallback are the same declaration, so skipping
+  // must still answer NOTHING and still land the tailored set.
+  const h = boot({ state: { projType: 'game', teamShape: 'solo' }, payload: TAILORED });
+  await h.open();
+
+  h.skip();
+
+  assert.deepEqual(h.shown, [5]);
+  assert.equal(h.state.modules, null, 'skipping answers nothing, tailored or not');
+  assert.equal(h.forCreate(), undefined, 'so the create request still carries no modules key');
+  assert.deepEqual(h.picked(), ['discord'], 'while the set they were shown is still the set they get');
+});
+
+test('once the owner has answered, the reasons go — the panel stops arguing', async () => {
+  const h = boot({ state: { projType: 'game', teamShape: 'solo' }, payload: TAILORED });
+  await h.open();
+  assert.equal(h.why().length, 1);
+
+  h.click('dev-box');
+
+  assert.deepEqual(h.state.modules, ['dev-box', 'discord'], 'their toggle stands over the rule');
+  assert.deepEqual(h.why(), [], 'and the rule stops explaining a set that is no longer its own');
+  assert.equal(h.whyShown(), false);
+});
+
+test('a payload with no byTeamShape degrades to the untailored bundle, never to nothing', async () => {
+  // A server that predates R22 still serves `bundles[].bundle`. The panel must
+  // preselect that rather than empty out — untailored is never wrong, only less.
+  const h = boot({ state: { projType: 'game', teamShape: 'solo' }, payload: PAYLOAD });
+  await h.open();
+
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['dev-box', 'discord']);
+  assert.deepEqual(h.why(), []);
+});
+
+test('an off-vocabulary team shape adjusts nothing', async () => {
+  // A value that was valid when the draft was stored and has since left the
+  // vocabulary reads as no answer, exactly as normalizeProjectDetail drops one.
+  const h = boot({ state: { projType: 'game', teamShape: 'a-huge-corporation' }, payload: TAILORED });
+  await h.open();
+
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['dev-box', 'discord']);
+  assert.deepEqual(h.why(), []);
+});
+
+test('a couldn\'t-load read clears any reasons it had already painted', async () => {
+  const h = boot({ state: { projType: 'game', teamShape: 'solo' }, payload: TAILORED });
+  await h.open();
+  assert.equal(h.why().length, 1);
+
+  h.sandbox.starterBundles = null;
+  h.render();
+
+  assert.deepEqual(h.why(), [], 'a stale reason for a set no longer on screen is a lie');
+  assert.equal(h.whyShown(), false);
+});
+
+test('a reason goes through the page escaper like every other rendered value', async () => {
+  const h = boot({ state: { projType: 'game', teamShape: 'solo' }, payload: TAILORED });
+  await h.open();
+  h.sandbox.starterBundles = {
+    core: [], optional: [],
+    bundles: [{ type: 'game', bundle: [], byTeamShape: { solo: { bundle: [], adjustments: [{ reason: '<img src=x onerror=alert(1)>' }] } } }],
+  };
+  h.render();
+
+  const html = h.sandbox.$('modWhy').innerHTML;
+  assert.ok(!html.includes('<img'), 'a hostile reason cannot inject markup');
+  assert.ok(html.includes('&lt;img src=x onerror=alert(1)&gt;'), 'it is shown escaped');
+});
+
+// The pin that makes the two ends of ADR 0243 unable to drift. Everything above
+// runs the picker against a FIXTURE; this one runs it against the REAL payload the
+// route serves, and asserts the panel's preselect is the same set the server would
+// resolve for a row with those answers and a skipped picker. If a rule is ever
+// added, changed or moved, one of these twenty combinations fails here rather than
+// silently handing an owner a project that is not the one they were shown.
+test('the picker and the server resolve the same set for every answer an owner can give', async () => {
+  const LIVE = { core: [...ALWAYS_ON_CORE], bundles: starterBundleAnswerTable(), optional: optionalModules() };
+  const shapes = [null, ...RULED_TEAM_SHAPES];
+
+  for (const preset of LIVE.bundles) {
+    for (const teamShape of shapes) {
+      const h = boot({ state: { projType: preset.type, teamShape }, payload: LIVE });
+      await h.open();
+
+      // what the server gives a project that answered the interview and then
+      // skipped the picker — `modules: null`, resolved at read time
+      const server = effectiveModules({ type: preset.type, modules: null, detail: teamShape ? { team_shape: teamShape } : {} });
+
+      assert.deepEqual(h.picked(), server.selected,
+        `type=${preset.type} team_shape=${teamShape}: the panel preselects what the server resolves`);
+      assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), server.selected,
+        `type=${preset.type} team_shape=${teamShape}: and the toggles show it`);
+      assert.deepEqual(h.why().length, server.adjustments.length,
+        `type=${preset.type} team_shape=${teamShape}: one sentence per adjustment the server made`);
+    }
+  }
+});

package/tests/provisioning_starter_bundles.mjs

@@ -37,8 +37,11 @@ import {
   OPTIONAL_MODULES,
   STARTER_BUNDLES,
   HUB_ONLY_MODULES,
+  RULED_TEAM_SHAPES,
   bundleForProjectType,
   allStarterBundles,
+  adjustBundle,
+  starterBundleAnswerTable,
   normalizeModuleSelection,
   effectiveModules,
 } from '../modules/provisioning/starter-bundles.js';
@@ -259,8 +262,60 @@ test('GET /provisioning/starter-bundles is public and serves the resolved bundle
   // Assert
   assert.equal(res.status, 200, `readable with no session (got ${res.status} ${res.raw})`);
   assert.deepEqual(res.body.core, [...ALWAYS_ON_CORE]);
-  assert.deepEqual(res.body.bundles, allStarterBundles());
+  // `starterBundleAnswerTable` since R22 (task 1002341): every bundle, plus the
+  // same bundle re-resolved for each About-step answer. It is a superset of
+  // `allStarterBundles()` — the untailored keys are byte-for-byte what they were.
+  assert.deepEqual(res.body.bundles, starterBundleAnswerTable());
   assert.equal(res.body.bundles.length, provisioning.PROJECT_TYPES.length);
+  for (const [i, plain] of allStarterBundles().entries()) {
+    const { byTeamShape, ...rest } = res.body.bundles[i];
+    assert.deepEqual(rest, plain, `bundle ${plain.type} kept its pre-R22 shape`);
+    assert.ok(byTeamShape, `bundle ${plain.type} carries the tailored table`);
+  }
+});
+
+test('every bundle carries a resolution for every team shape a rule can fire on', async () => {
+  // The picker preselects straight out of this table with no second read (ADR
+  // 0243), so a missing row is a panel that silently preselects the untailored
+  // set for an answer the owner did give.
+  const res = await get('/api/bongos/provisioning/starter-bundles');
+
+  for (const row of res.body.bundles) {
+    assert.deepEqual(Object.keys(row.byTeamShape).sort(), [...RULED_TEAM_SHAPES].sort(),
+      `${row.type} answers every team shape`);
+    for (const [shape, tailored] of Object.entries(row.byTeamShape)) {
+      assert.ok(Array.isArray(tailored.bundle), `${row.type}/${shape} names a module list`);
+      assert.ok(Array.isArray(tailored.adjustments), `${row.type}/${shape} names its adjustments`);
+      // never the always-on core, never a key off the catalog
+      for (const key of tailored.bundle) {
+        assert.ok(OPTIONAL_MODULES.some((m) => m.key === key),
+          `${row.type}/${shape} preselects "${key}", which is not a choice the picker offers`);
+      }
+      // an adjustment is a DELTA: it only claims what it actually changed
+      for (const adj of tailored.adjustments) {
+        const inBase = row.bundle.includes(adj.module);
+        const inNow = tailored.bundle.includes(adj.module);
+        assert.notEqual(inBase, inNow, `${row.type}/${shape}: "${adj.rule}" claims a change it did not make`);
+        assert.ok(adj.reason && adj.reason.length > 20, `${row.type}/${shape}: "${adj.rule}" needs an owner-facing reason`);
+      }
+    }
+  }
+});
+
+test('an adjusted bundle is in CATALOG order, like every other module list', () => {
+  // normalizeModuleSelection stores a chosen set in catalog order and the picker
+  // re-derives its toggles that way, so an appended adjustment would make one set
+  // of modules read as two different lists depending on whether the owner
+  // answered the picker or skipped it.
+  const order = OPTIONAL_MODULES.map((m) => m.key);
+  const sorted = (list) => [...list].sort((a, b) => order.indexOf(a) - order.indexOf(b));
+
+  for (const preset of allStarterBundles()) {
+    for (const shape of RULED_TEAM_SHAPES) {
+      const { modules } = adjustBundle(preset.bundle, shape);
+      assert.deepEqual(modules, sorted(modules), `${preset.type}/${shape} is in catalog order`);
+    }
+  }
 });
 
 test('the route never reaches the database — the bundles are a declaration, not a query', async () => {
@@ -355,6 +410,40 @@ test('effectiveModules: an answered picker wins over the bundle, including "none
   assert.equal(none.source, 'chosen');
 });
 
+test('effectiveModules: a skipped picker after an ANSWERED interview yields the TAILORED bundle', () => {
+  // BV1.R22 / ADR 0243 — the property ADR 0240 §2 leans the skip on ("the
+  // preselect and the fallback are the same declaration"), now that the panel
+  // preselects the team-shape-adjusted set. Without this the picker would show a
+  // solo owner one thing and the project would quietly get another.
+  const eff = effectiveModules({ type: 'game', modules: null, detail: { team_shape: 'solo' } });
+
+  assert.deepEqual(eff.selected, ['discord'], 'the shared environment the rule removes is not silently restored');
+  assert.equal(eff.source, 'bundle', 'and it is still an UNANSWERED set, not a stored one');
+  assert.deepEqual(eff.adjustments.map((a) => a.module), ['dev-box']);
+  assert.match(eff.adjustments[0].reason, /building this alone/, 'carrying the reason the panel showed');
+});
+
+test("effectiveModules: the owner's own answer is never re-adjusted by a rule", () => {
+  // A rule corrects a PRESELECT the owner did not make. Once they have toggled,
+  // re-applying it would overrule them with an answer they had already refused.
+  const eff = effectiveModules({ type: 'game', modules: ['dev-box'], detail: { team_shape: 'solo' } });
+
+  assert.deepEqual(eff.selected, ['dev-box'], 'solo removes dev-box, and the owner put it back');
+  assert.equal(eff.source, 'chosen');
+  assert.deepEqual(eff.adjustments, [], 'and no reason is handed back for a choice they made themselves');
+});
+
+test('effectiveModules: a detail that says nothing usable adjusts nothing', () => {
+  // {} (skipped), a shape that has left the vocabulary, and a non-object column
+  // value all read as NO ANSWER — normalizeProjectDetail's rule, reached without
+  // importing it.
+  for (const detail of [undefined, null, {}, { team_shape: null }, { team_shape: 'a-huge-corporation' }, 'not-an-object', []]) {
+    const eff = effectiveModules({ type: 'game', modules: null, detail });
+    assert.deepEqual(eff.selected, ['dev-box', 'discord'], `detail=${JSON.stringify(detail)} falls back to the type's bundle`);
+    assert.deepEqual(eff.adjustments, []);
+  }
+});
+
 test('effectiveModules: an undeclared type resolves to the core, never a guess', () => {
   for (const row of [{ type: null, modules: null }, { type: 'not-sure', modules: null }, {}]) {
     const eff = effectiveModules(row);