@bongos/core 1.19.616 → 1.19.618

package/tests/government_config_roots.mjs

@@ -0,0 +1,159 @@
+// tests/government_config_roots.mjs — the constitution's two files come from two
+// different roots (task 1003739, ADR 0268).
+//
+// THE BUG THIS PINS, because it was silent for two weeks and cost a ratified
+// constitutional amendment. `modules/government/config.js` resolved BOTH the
+// neutral starter and the instance pack from `path.resolve(__dirname, '..',
+// '..')`, under a comment saying the two roots coincided "today". True in a
+// single checkout. False on cloudbongos.com, which runs a PINNED core: there
+// __dirname is inside node_modules/@cloudbongos/core, so the INSTANCE pack
+// resolved to a path inside the core package — one no host authors, and one
+// `npm ci` erases. The board ratified consent/metic+/1440 on 2026-08-25,
+// `applyBoardAmendment` wrote it into node_modules, the next core upgrade
+// deleted it, and GET /government/constitution went on answering the day-one
+// monarchy while its own history showed the amendment had passed.
+//
+// NOTHING THREW. Both paths exist, both are writable, and an absent instance
+// pack is a legal state (a vanilla instance has none), so the read fell through
+// to the neutral file exactly as designed. That is why this is a STRUCTURAL
+// test rather than a behavioural one: there is no error to assert on, only the
+// question of which root each path was built from.
+//
+// The single-checkout answers are asserted too, and deliberately: they are what
+// makes this fix byte-identical for a non-split instance, and a future "tidy-up"
+// that re-collapses the two roots must fail here rather than in production two
+// weeks later.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const CONFIG_PATH = path.join(GOV, 'config.js');
+const config = require(CONFIG_PATH);
+const api = require(path.join(ROOT, 'src', 'module-api.js'));
+
+// config.js resolves its two paths AT LOAD (deliberately — see its header), so
+// exercising a different instance root means re-loading it with the env set.
+// The cache delete is scoped to this one module; instance-config resolves the
+// env per call, so nothing else needs evicting.
+function loadWithInstanceRoot(dir) {
+  const KEY = 'CLOUDBONGOS_INSTANCE_ROOT';
+  const before = process.env[KEY];
+  process.env[KEY] = dir;
+  delete require.cache[require.resolve(CONFIG_PATH)];
+  try { return require(CONFIG_PATH); }
+  finally {
+    if (before === undefined) delete process.env[KEY]; else process.env[KEY] = before;
+    delete require.cache[require.resolve(CONFIG_PATH)];
+    require(CONFIG_PATH); // restore the module-cache entry every other test shares
+  }
+}
+
+// ── the doorway ─────────────────────────────────────────────────────────────
+
+test('the module doorway exposes BOTH roots — a module cannot tell them apart without it', () => {
+  // ADR 0083: a module never requires a core internal, so until this task the
+  // only way to reach a root from inside a module was to re-derive it from
+  // __dirname — which is precisely the derivation that was wrong.
+  assert.equal(typeof api.resolveCoreRoot, 'function');
+  assert.equal(typeof api.resolveInstanceRoot, 'function');
+  assert.equal(api.resolveCoreRoot(), ROOT, 'the core root is this checkout');
+});
+
+// ── the split ───────────────────────────────────────────────────────────────
+
+test('the NEUTRAL starter follows the CORE root and the INSTANCE pack follows the INSTANCE root', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gov-roots-'));
+  try {
+    const split = loadWithInstanceRoot(tmp);
+    assert.equal(split.NEUTRAL_PATH, path.join(ROOT, 'config', 'government.neutral.json'),
+      'the neutral starter is CORE content and must not follow the host');
+    assert.equal(split.INSTANCE_PATH, path.join(tmp, 'config', 'government.json'),
+      'the instance pack is HOST content — the bug was this landing inside the core package');
+    assert.notEqual(path.dirname(split.INSTANCE_PATH), path.dirname(split.NEUTRAL_PATH),
+      'a split instance must resolve the two to DIFFERENT directories');
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('in a single checkout the two roots coincide, exactly as before the fix', () => {
+  // The byte-identical claim for every non-split instance, asserted rather than
+  // asserted-in-prose. If this ever fails, the fix changed behaviour for the
+  // ordinary case and that is a regression, not a refinement.
+  assert.equal(config.NEUTRAL_PATH, path.join(ROOT, 'config', 'government.neutral.json'));
+  assert.equal(config.INSTANCE_PATH, path.join(ROOT, 'config', 'government.json'));
+});
+
+test('a host instance pack at the INSTANCE root is actually READ', () => {
+  // The other half of the same bug, and the half a host would have hit first:
+  // before the fix, an instance that hand-authored config/government.json in its
+  // own repo — the documented way to set a constitution — was silently ignored,
+  // because the reader was looking inside node_modules.
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gov-roots-'));
+  try {
+    fs.mkdirSync(path.join(tmp, 'config'));
+    fs.writeFileSync(path.join(tmp, 'config', 'government.json'), JSON.stringify({
+      board: { membership: 'rank:metic+', pass_rule: 'unanimous', window_minutes: 1440, close_early_on_full_turnout: true },
+    }));
+    const split = loadWithInstanceRoot(tmp);
+    const { board } = split.loadGovernmentConfig({ instancePath: split.INSTANCE_PATH });
+    assert.equal(board.pass_rule, 'unanimous');
+    assert.equal(board.membership, 'rank:metic+');
+    assert.equal(board.window_minutes, 1440);
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+// ── the write ───────────────────────────────────────────────────────────────
+
+test('a ratified amendment creates the config directory rather than dying on ENOENT', () => {
+  // Now that the write targets the INSTANCE root, the directory genuinely may
+  // not exist: an instance that has never been branded and never amended has no
+  // config/ of its own. Before the fix the write always landed beside the core's
+  // own config/, which is why this never came up — and a ratified amendment
+  // lost to a missing directory is the same failure as the one being fixed.
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gov-roots-'));
+  try {
+    const target = path.join(tmp, 'nested', 'config', 'government.json');
+    assert.equal(fs.existsSync(path.dirname(target)), false, 'sanity: the directory is absent');
+    const applied = config.applyBoardAmendment(
+      { membership: 'rank:archon', pass_rule: 'unanimous', window_minutes: 1440, close_early_on_full_turnout: true },
+      { instancePath: target },
+    );
+    assert.equal(applied.pass_rule, 'unanimous');
+    assert.deepEqual(JSON.parse(fs.readFileSync(target, 'utf8')).board, applied,
+      'what was written back is what was returned');
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('applying an amendment preserves the rest of the instance pack', () => {
+  // Unchanged behaviour, re-pinned here because the write now happens in a
+  // directory the core does not own: an instance pack holds rank templates too,
+  // and a constitution change must not take them with it.
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gov-roots-'));
+  try {
+    const target = path.join(tmp, 'config', 'government.json');
+    fs.mkdirSync(path.dirname(target));
+    fs.writeFileSync(target, JSON.stringify({ ranks: { metic: { label: 'Trusted' } }, board: { pass_rule: 'consent' } }));
+    config.applyBoardAmendment(
+      { membership: 'rank:archon', pass_rule: 'majority', window_minutes: 1440, close_early_on_full_turnout: true },
+      { instancePath: target },
+    );
+    const after = JSON.parse(fs.readFileSync(target, 'utf8'));
+    assert.equal(after.board.pass_rule, 'majority');
+    assert.deepEqual(after.ranks, { metic: { label: 'Trusted' } }, 'the rank templates survive');
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('this checkout still ships NO instance pack — the vanilla-state guard', () => {
+  // The pre-existing guard (a test once wrote a real config/government.json into
+  // the checkout), kept because the write path moved. It is now doubly
+  // load-bearing: with the instance root defaulting to process.cwd(), a stray
+  // file here would be read by every test that follows.
+  assert.equal(fs.existsSync(path.join(ROOT, 'config', 'government.json')), false,
+    'config/government.json must not exist in the core checkout — a test wrote one once');
+});

package/tests/government_constitution_divergence.mjs

@@ -0,0 +1,123 @@
+// tests/government_constitution_divergence.mjs — the detector for a ratified
+// amendment that did not take (task 1003739, ADR 0268).
+//
+// The path bug that caused the live failure is fixed at its source, in
+// config.js, and pinned by tests/government_config_roots.mjs. THIS is the
+// detector for the CLASS: any future reason a ratified amendment fails to reach
+// the live constitution — a failed write, a rolled-back deploy, a hand edit that
+// reverts one — now surfaces on the constitution view instead of being invisible.
+//
+// WHY A DETECTOR AND NOT JUST THE FIX. On 2026-08-25 this board ratified an
+// amendment and the constitution went on answering the day-one monarchy. The API
+// had BOTH facts in ONE payload the whole time — a passed amendment in `history`,
+// a contradicting `board` beside it — and simply never compared them. Two weeks
+// of sittings were decided under a rule the board had voted to replace, and the
+// only reason anyone noticed was someone reading the JSON by hand.
+//
+// IT REPORTS, IT NEVER HEALS, and that is a decision rather than an omission.
+// The instance pack is also the file a human editing the constitution touches
+// (config.js §applyBoardAmendment), so a silent re-apply would revert a
+// legitimate hand edit with no way to tell the two apart — trading a visible
+// wrong constitution for an unstoppable one.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const board = require(path.join(GOV, 'board.js'));
+const db = require(path.join(GOV, 'db.js'));
+
+const { constitutionDivergence, constitutionView } = board;
+
+const MONARCHY = { membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true };
+// The REAL proposal from cloudbongos.com's amendment 1, item 11 — the sitting
+// that passed and never took. Kept verbatim so this test is the live failure
+// rather than a sketch of it.
+const PASSED_2026_08_25 = {
+  item_id: '11', amendment_id: '1', outcome: 'passed', closed_at: '2026-08-25T16:53:45.655Z',
+  proposed: { pass_rule: 'consent', membership: 'rank:metic+', window_minutes: 1440, close_early_on_full_turnout: true },
+};
+
+test('THE LIVE FAILURE: a passed amendment beside a contradicting constitution is named', () => {
+  const d = constitutionDivergence(MONARCHY, [PASSED_2026_08_25]);
+  assert.ok(d, 'the divergence must be reported, not null');
+  assert.equal(d.item_id, '11');
+  assert.equal(d.amendment_id, '1');
+  const byField = Object.fromEntries(d.fields.map((f) => [f.field, f]));
+  assert.deepEqual(Object.keys(byField).sort(), ['membership', 'pass_rule', 'window_minutes']);
+  assert.deepEqual(byField.pass_rule, { field: 'pass_rule', ratified: 'consent', in_force: 'first_ratifier' });
+  assert.deepEqual(byField.membership, { field: 'membership', ratified: 'rank:metic+', in_force: 'rank:archon' });
+  assert.deepEqual(byField.window_minutes, { field: 'window_minutes', ratified: 1440, in_force: null });
+  assert.equal(d.fields.some((f) => f.field === 'close_early_on_full_turnout'), false,
+    'a field that AGREES is not reported — the report is the delta, not the whole block');
+});
+
+test('a constitution that IS the last ratified one reports nothing', () => {
+  // The healthy answer, and the one the hall renders nothing for. A detector
+  // that fires on a working system is a detector people learn to ignore.
+  const inForce = { membership: 'rank:metic+', pass_rule: 'consent', window_minutes: 1440, close_early_on_full_turnout: true };
+  assert.equal(constitutionDivergence(inForce, [PASSED_2026_08_25]), null);
+});
+
+test('a RETURNED amendment is not a decision and never diverges', () => {
+  // The whole meaning of 'returned'. Comparing against it would report a
+  // divergence on every rejected proposal — i.e. on the system working.
+  const returned = { ...PASSED_2026_08_25, outcome: 'returned' };
+  assert.equal(constitutionDivergence(MONARCHY, [returned]), null);
+  // …and the newest PASSED one still stands, with later returns above it.
+  const d = constitutionDivergence(MONARCHY, [returned, PASSED_2026_08_25]);
+  assert.ok(d);
+  assert.equal(d.item_id, '11');
+});
+
+test('a board that has never amended anything reports nothing', () => {
+  assert.equal(constitutionDivergence(MONARCHY, []), null);
+  assert.equal(constitutionDivergence(MONARCHY, null), null);
+  assert.equal(constitutionDivergence(MONARCHY, [{ outcome: 'passed' }]), null, 'a row with no proposal is not a claim');
+});
+
+test('the comparison is against the SANITIZED proposal, not the raw one', () => {
+  // applyBoardAmendment sanitizes on write, so comparing the RAW proposal would
+  // report a phantom divergence on any field the sanitizer legitimately
+  // normalises — and a warning that can never be cleared is worse than none.
+  // 999999 is past MAX_WINDOW_MINUTES, so it sanitizes to the default (null),
+  // which is what is in force: nothing to report.
+  const junkWindow = { ...PASSED_2026_08_25, proposed: { ...PASSED_2026_08_25.proposed, window_minutes: 999999 } };
+  const inForce = { membership: 'rank:metic+', pass_rule: 'consent', window_minutes: null, close_early_on_full_turnout: true };
+  assert.equal(constitutionDivergence(inForce, [junkWindow]), null);
+});
+
+test('the newest passed amendment wins — one it superseded is not compared', () => {
+  const older = {
+    item_id: '4', amendment_id: '2', outcome: 'passed', closed_at: '2026-08-01T00:00:00Z',
+    proposed: { pass_rule: 'majority', membership: 'rank:archon', window_minutes: 90, close_early_on_full_turnout: true },
+  };
+  // listAmendmentHistory returns newest-first, so the 08-25 row is the standing
+  // decision and the older one is history, not a claim on the present.
+  const d = constitutionDivergence(MONARCHY, [PASSED_2026_08_25, older]);
+  assert.equal(d.item_id, '11');
+  assert.equal(d.ratified.pass_rule, 'consent', 'not the older majority proposal');
+});
+
+test('the constitution view carries it, and this checkout is healthy', async () => {
+  // Wired end to end: the view computes the divergence from the history it
+  // already read, so there is no second query that could disagree with the rows
+  // shown beside it.
+  const originals = { listAmendmentHistory: db.listAmendmentHistory, countActiveBuilders: db.countActiveBuilders };
+  try {
+    Object.assign(db, { listAmendmentHistory: async () => [], countActiveBuilders: async () => 4 });
+    const clean = await constitutionView();
+    assert.equal(clean.divergence, null, 'a board with no amendments has nothing to warn about');
+
+    Object.assign(db, { listAmendmentHistory: async () => [PASSED_2026_08_25] });
+    const diverged = await constitutionView();
+    assert.ok(diverged.divergence, 'the live failure, reproduced through the real view');
+    assert.equal(diverged.divergence.item_id, '11');
+    assert.equal(diverged.board.pass_rule, 'first_ratifier', 'the view still reports what is actually in force');
+    assert.equal(diverged.divergence.ratified.pass_rule, 'consent', 'beside what was ratified');
+  } finally { Object.assign(db, originals); }
+});

package/tests/module_api.mjs

@@ -34,6 +34,7 @@ const PUBLISHED_SURFACE = [
   'llmCache', // BV1.R73: shared LLM-cost cache (1.6.0; tracked domain leak)
   'llmPricing', // BV1.R77: shared token→USD pricing (1.7.0; tracked domain leak — economy carve)
   'branding', 'clientBranding', 'userAgent', 'resolveEnv', 'readConfigFileSync', 'configHome', 'configPath', // userAgent added 1.12.0 (BV1.R86; github-push UA)
+  'resolveCoreRoot', 'resolveInstanceRoot', // added by task 1003739 (ADR 0268): the two ADR 0108 §1 roots. A module reading a HOST-owned file could not tell them apart without these, and re-deriving one from __dirname is right in a single checkout and silently wrong on a standalone instance — which is how a RATIFIED constitutional amendment came to be written into node_modules and erased by the next core upgrade. Core content → resolveCoreRoot(); host content → resolveInstanceRoot(); src/branding.js is the pattern
   'resolveStaleClaimHours', 'staleClaimMinutes', // added by task 1003476 (ADR 0226; goal 1000072): the PROJECT's stale-claim timer — the sweep that releases a silent claim and the Archon roster that reports one read the same number through here, after eighteen hours of disagreeing (6 vs 24)
   'resolveRotDays', 'projectSettings', // added by task 1003279 (ADR 0232; goal 1000072): the ROT timer + the live knob store behind it. A DIFFERENT question from the stale-claim timer above — days not hours, DB not env, work nobody picked up rather than a builder who went quiet, and it only ever ASKS a human where that one ACTS. Both ride the doorway so no module hardcodes either.
   'joinabilityMode', // added by task 1003044 (ADR 0194; the carrier after 1.19.374): the project's membership door, one reader for the sign-in gate AND the onboarding module's public POST