@bongos/core 1.19.617 → 1.19.619

package/tests/backlog_review.mjs

@@ -0,0 +1,183 @@
+// tests/backlog_review.mjs — the /backlog-review bucket rules and the
+// status-derived verb offer (task 1003746).
+//
+// These are the two claims the skill rests on, so they are the two things a test
+// has to execute rather than paraphrase: (1) a row waiting on a live TRIGGER is
+// never presented as waiting on a PERSON, and (2) the walk never offers a verb
+// the route will refuse. The `skill names a command it never runs` learning
+// (r155-documented-nonfunctional-command) is why the last test here actually
+// requires and calls the module the SKILL.md tells a builder to run.
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const br = require('../scripts/gds/backlog-review.js');
+
+const task = (over = {}) => ({
+  id: 1, status: 'backlog', kind: 'feature', title: 't', created_at: '2026-01-01T00:00:00Z',
+  blocked_by: [], ...over,
+});
+
+test('a row with no unsatisfied dependency is awaiting a nod', () => {
+  const p = br.partitionBacklog([task({ id: 7 })]);
+  assert.deepEqual(p.nod.map((t) => t.id), [7]);
+  assert.equal(p.depGated.length, 0);
+  assert.equal(p.stranded.length, 0);
+});
+
+test('a satisfied dependency does NOT make a row dep-gated', () => {
+  const p = br.partitionBacklog([task({ id: 8, blocked_by: [{ id: 2, status: 'shipped', satisfied: true }] })]);
+  assert.deepEqual(p.nod.map((t) => t.id), [8], 'a shipped dep is not a gate');
+  assert.equal(p.depGated.length, 0);
+});
+
+test('a live unsatisfied dependency is dep-gated and is NOT walked as a nod', () => {
+  const p = br.partitionBacklog([task({ id: 9, blocked_by: [{ id: 3, status: 'ready', satisfied: false }] })]);
+  assert.deepEqual(p.depGated.map((t) => t.id), [9]);
+  assert.equal(p.nod.length, 0, 'the migration-163 trigger owns this row, not a human');
+});
+
+test('an ABANDONED dependency makes a row stranded, not merely dep-gated', () => {
+  const p = br.partitionBacklog([task({ id: 10, blocked_by: [{ id: 4, status: 'abandoned', satisfied: false }] })]);
+  assert.deepEqual(p.stranded.map((t) => t.id), [10]);
+  assert.equal(p.depGated.length, 0, 'stranded wins: "your gate is dead" is the actionable fact');
+  assert.deepEqual(p.stranded[0].dead_deps.map((d) => d.id), [4], 'the dead edges ride along for the hint');
+});
+
+test('stranded wins over spike too — a dead gate outranks the backlog-by-convention rule', () => {
+  const p = br.partitionBacklog([task({ id: 11, kind: 'spike', blocked_by: [{ id: 5, status: 'abandoned', satisfied: false }] })]);
+  assert.deepEqual(p.stranded.map((t) => t.id), [11]);
+  assert.equal(p.spikes.length, 0);
+});
+
+test('a spike lives at backlog by convention and is never walked', () => {
+  const p = br.partitionBacklog([task({ id: 12, kind: 'spike' })]);
+  assert.deepEqual(p.spikes.map((t) => t.id), [12]);
+  assert.equal(p.nod.length, 0, 'migration 020: spikes stay in backlog by convention');
+});
+
+test('rows that are not at backlog are ignored entirely', () => {
+  const p = br.partitionBacklog([task({ id: 13, status: 'ready' }), task({ id: 14, status: 'shipped' }), task({ id: 15, status: 'blocked' })]);
+  assert.equal(p.nod.length + p.depGated.length + p.stranded.length + p.spikes.length, 0);
+});
+
+test('partitionBacklog tolerates junk without throwing', () => {
+  assert.doesNotThrow(() => br.partitionBacklog(null));
+  assert.doesNotThrow(() => br.partitionBacklog([null, undefined, {}]));
+  const p = br.partitionBacklog([task({ id: 16, blocked_by: null })]);
+  assert.deepEqual(p.nod.map((t) => t.id), [16], 'a null blocked_by is no gate, not a crash');
+});
+
+test('both walked buckets are ordered oldest-first so an interrupted walk resumes in place', () => {
+  const p = br.partitionBacklog([
+    task({ id: 30, created_at: '2026-03-01T00:00:00Z' }),
+    task({ id: 31, created_at: '2026-01-01T00:00:00Z' }),
+    task({ id: 32, created_at: '2026-02-01T00:00:00Z' }),
+  ]);
+  assert.deepEqual(p.nod.map((t) => t.id), [31, 32, 30]);
+});
+
+// --- goal grouping --------------------------------------------------------
+
+test('rows are clustered by goal, not left interleaved', () => {
+  const g = br.groupByGoal([
+    task({ id: 40, goal_id: 1, created_at: '2026-01-01T00:00:00Z' }),
+    task({ id: 41, goal_id: 2, created_at: '2026-01-02T00:00:00Z' }),
+    task({ id: 42, goal_id: 1, created_at: '2026-01-03T00:00:00Z' }),
+  ]);
+  assert.equal(g.length, 2, 'two goals, two groups');
+  assert.deepEqual(g[0].rows.map((t) => t.id), [40, 42], 'goal 1 rows are adjacent');
+  assert.deepEqual(g[1].rows.map((t) => t.id), [41]);
+});
+
+test('goals are ordered by their OWN oldest row, so the longest-ignored goal comes first', () => {
+  const g = br.groupByGoal([
+    task({ id: 50, goal_id: 'new', created_at: '2026-05-01T00:00:00Z' }),
+    task({ id: 51, goal_id: 'old', created_at: '2026-01-01T00:00:00Z' }),
+    task({ id: 52, goal_id: 'new', created_at: '2026-05-02T00:00:00Z' }),
+  ]);
+  assert.deepEqual(g.map((x) => x.goal_id), ['old', 'new']);
+});
+
+test('rows inside a group stay oldest-first', () => {
+  const g = br.groupByGoal([
+    task({ id: 60, goal_id: 1, created_at: '2026-03-01T00:00:00Z' }),
+    task({ id: 61, goal_id: 1, created_at: '2026-01-01T00:00:00Z' }),
+    task({ id: 62, goal_id: 1, created_at: '2026-02-01T00:00:00Z' }),
+  ]);
+  assert.deepEqual(g[0].rows.map((t) => t.id), [61, 62, 60]);
+});
+
+test('a goal-less row is walkable in its own group, never dropped', () => {
+  const g = br.groupByGoal([task({ id: 70, goal_id: null }), task({ id: 71, goal_id: 5 })]);
+  const total = g.reduce((n, x) => n + x.rows.length, 0);
+  assert.equal(total, 2, 'every input row reaches a group');
+  assert.ok(g.some((x) => x.goal_id === '(no goal)'));
+});
+
+test('grouping loses no rows and duplicates none, on a mixed batch', () => {
+  const rows = [];
+  for (let i = 0; i < 25; i++) rows.push(task({ id: 100 + i, goal_id: i % 4, created_at: `2026-01-${String((i % 28) + 1).padStart(2, '0')}T00:00:00Z` }));
+  const g = br.groupByGoal(rows);
+  const ids = g.flatMap((x) => x.rows.map((t) => t.id)).sort((a, b) => a - b);
+  assert.equal(new Set(ids).size, 25);
+  assert.deepEqual(ids, rows.map((t) => t.id).sort((a, b) => a - b));
+});
+
+test('groupByGoal tolerates junk', () => {
+  assert.deepEqual(br.groupByGoal(null), []);
+  assert.deepEqual(br.groupByGoal([null, undefined]), []);
+});
+
+// --- the verb offer -------------------------------------------------------
+
+test('a backlog row is offered promote, never demote', () => {
+  const v = br.verbsFor(task({ status: 'backlog' }));
+  assert.ok(v.includes('promote'));
+  assert.ok(!v.includes('demote'), 'POST /tasks/:id/demote requires status=ready — it would 409 cannot_demote here');
+});
+
+test('a ready row is offered demote, never promote', () => {
+  const v = br.verbsFor(task({ status: 'ready' }));
+  assert.ok(v.includes('demote'));
+  assert.ok(!v.includes('promote'), 'POST /tasks/:id/promote accepts only backlog|blocked|abandoned');
+});
+
+test('blocked and abandoned rows accept promote (the blocked→ready and un-abandon paths)', () => {
+  assert.ok(br.verbsFor(task({ status: 'blocked' })).includes('promote'));
+  assert.ok(br.verbsFor(task({ status: 'abandoned' })).includes('promote'), 'ADR 0152: abandoned → backlog restore');
+});
+
+test('water is offered on every row and kill is never offered on a terminal one', () => {
+  for (const status of ['backlog', 'ready', 'blocked', 'active', 'shipped', 'abandoned']) {
+    assert.ok(br.verbsFor(task({ status })).includes('water'), `water missing for ${status}`);
+  }
+  assert.ok(!br.verbsFor(task({ status: 'shipped' })).includes('kill'));
+  assert.ok(!br.verbsFor(task({ status: 'abandoned' })).includes('kill'));
+  assert.ok(br.verbsFor(task({ status: 'backlog' })).includes('kill'));
+});
+
+test('the API limit the script asks for is within the route cap of 1000', () => {
+  assert.ok(br.MAX_API_LIMIT <= 1000, 'routes/tasks.js: "limit must be a positive integer up to 1000"');
+  assert.ok(br.MAX_API_LIMIT > 0);
+});
+
+// --- the skill names a command that exists and runs -----------------------
+
+test('SKILL.md names scripts/gds/backlog-review.js and that file loads and partitions', () => {
+  const skill = fs.readFileSync(path.join(ROOT, '.claude', 'skills', 'backlog-review', 'SKILL.md'), 'utf8');
+  assert.match(skill, /scripts\/gds\/backlog-review\.js/, 'the skill must name the script it runs');
+  // Executed, not paraphrased: the module the prose points at really answers.
+  const p = br.partitionBacklog([task({ id: 99 })]);
+  assert.deepEqual(p.nod.map((t) => t.id), [99]);
+});
+
+test('SKILL.md does not tell a builder to demote a backlog row', () => {
+  const skill = fs.readFileSync(path.join(ROOT, '.claude', 'skills', 'backlog-review', 'SKILL.md'), 'utf8');
+  assert.ok(!/\[p\]rune/.test(skill), 'prune/demote is a guaranteed 409 on a backlog row');
+});

package/tests/cli_sessions.mjs

@@ -0,0 +1,168 @@
+// tests/cli_sessions.mjs — one session slot became one per instance (task 1003741).
+//
+// THE BUG. The CLI resolved its session path from the BRANDING PACK, which is read out of whatever
+// checkout you happen to be standing in. That gave it exactly one slot, with two failure modes:
+//
+//   • standalone (the public @cloudbongos/cli's whole situation) the brand cannot resolve, so every
+//     instance shared ~/.config/cloudbongos/gds-session.json and `bongos login <other>` DESTROYED
+//     the session you already had. The owner's own config dir carries a hand-made
+//     `gds-session.hermeslines-clobber-2026-08-12.bak.json` from exactly this.
+//   • in-repo the session landed in ~/.config/<slug>/ where the standalone CLI could never find it.
+//
+// The store is keyed by instance host at a FIXED anchor, so the same instance resolves to the same
+// file from either direction. The per-brand gds-session.json stays the ACTIVE pointer, untouched,
+// so every existing reader behaves identically — that back-compat is asserted here too.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import os from 'node:os';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
+
+const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require = createRequire(import.meta.url);
+const ic  = require(path.join(REPO_ROOT, 'src', 'instance-config.js'));
+const lib = require(path.join(REPO_ROOT, 'scripts', 'gds', 'cli-lib.js'));
+
+// SESSION_PATH is frozen at module load from os.homedir(), so anything touching the real save path
+// runs in a child with its own HOME.
+function inSandbox(body) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-sess-'));
+  try {
+    const code = `const R=${JSON.stringify(REPO_ROOT)};
+      const lib=require(R+'/scripts/gds/cli-lib.js');
+      const ic=require(R+'/src/instance-config.js');
+      const fs=require('node:fs'), path=require('node:path');
+      (async()=>{ ${body} })().catch((e)=>{ console.error('ERR '+e.message); process.exit(1); });`;
+    const r = spawnSync(process.execPath, ['-e', code], { encoding: 'utf8', env: { ...process.env, HOME: home } });
+    return { home, out: `${r.stdout || ''}${r.stderr || ''}`, status: r.status };
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+}
+
+// ── 1. The key and the anchor ───────────────────────────────────────────────────────────────
+
+test('a session is keyed by the instance host', () => {
+  assert.equal(lib.sessionHostKey('https://cloudbongos.com'), 'cloudbongos.com');
+  assert.equal(lib.sessionHostKey('https://hermeslines-marketing.cloudbongos.com'), 'hermeslines-marketing.cloudbongos.com');
+  assert.equal(lib.sessionHostKey('http://localhost:3000'), 'localhost_3000');
+});
+
+test('an unkeyable base is stored nowhere, never under a guess', () => {
+  for (const bad of ['', null, undefined, 'not a url', '/etc/passwd', '../../escape']) {
+    assert.equal(lib.sessionHostKey(bad), null, `should refuse ${JSON.stringify(bad)}`);
+    assert.equal(lib.sessionStorePath(bad), null);
+  }
+});
+
+test('no host can escape the store directory', () => {
+  // The key becomes a filename, so a traversal in a hostile api_base must not reach outside.
+  for (const b of ['https://cloudbongos.com', 'http://localhost:3000']) {
+    const p = lib.sessionStorePath(b);
+    assert.equal(path.dirname(p), lib.sessionStoreDir(), `${b} escaped the store dir`);
+    assert.ok(!path.basename(p).includes('/') && !path.basename(p).includes('\\'));
+  }
+});
+
+test('the store anchor is FIXED, not brand-derived — that is the whole fix', () => {
+  // A brand-derived anchor is what split in-repo from standalone in the first place. If someone
+  // "helpfully" routes this through configHome() again, the two diverge and the bug is back.
+  assert.equal(lib.sessionStoreDir(), path.join(os.homedir(), '.config', ic.FALLBACK_DIR, 'instances'));
+  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'cli-lib.js'), 'utf8');
+  const body = src.slice(src.indexOf('function sessionStoreDir()'));
+  const fn = body.slice(0, body.indexOf('\n}') + 2);
+  assert.ok(!/configHome|configDirName|safeBrand/.test(fn), `sessionStoreDir must not read the brand:\n${fn}`);
+});
+
+// ── 2. A login never destroys another instance's session ────────────────────────────────────
+
+test('signing into a second instance PRESERVES the first — including one written before the store existed', () => {
+  const { out } = inSandbox(`
+    // A session from before this feature: an active pointer, nothing in the store.
+    const active = ic.configPath('gds-session.json');
+    fs.mkdirSync(path.dirname(active), { recursive: true });
+    fs.writeFileSync(active, JSON.stringify({ token:'TOKEN-A', api_base:'https://a.example.com',
+      builder:{github_login:'someone'} }), { mode: 0o600 });
+
+    await lib.saveSession({ token:'TOKEN-B', api_base:'https://b.example.com', builder:{github_login:'someone'} });
+
+    const rescued = await lib.loadStoredSession('https://a.example.com');
+    const stored  = await lib.loadStoredSession('https://b.example.com');
+    const pointer = JSON.parse(fs.readFileSync(active,'utf8'));
+    console.log(JSON.stringify({
+      firstSurvived: !!(rescued && rescued.token === 'TOKEN-A'),
+      secondStored:  !!(stored  && stored.token  === 'TOKEN-B'),
+      activeIsSecond: pointer.api_base === 'https://b.example.com',
+      hosts: lib.listStoredSessions().map(s => s.host),
+    }));`);
+  const r = JSON.parse(out.trim().split('\n').pop());
+  assert.equal(r.firstSurvived, true, 'the first instance\'s session was destroyed — the bug is back');
+  assert.equal(r.secondStored, true);
+  assert.equal(r.activeIsSecond, true, 'the active pointer must follow the newest sign-in');
+  assert.deepEqual(r.hosts, ['a.example.com', 'b.example.com']);
+});
+
+test('the ACTIVE pointer still lands exactly where every existing reader looks', () => {
+  // In-repo skills, hooks and the dev box all read gds-session.json in the configured dir. The
+  // store is additive; if this moved, every one of them would silently stop finding a session.
+  const { out } = inSandbox(`
+    await lib.saveSession({ token:'T', api_base:'https://a.example.com', builder:{github_login:'x'} });
+    console.log(JSON.stringify({ wroteActive: fs.existsSync(ic.configPath('gds-session.json')) }));`);
+  assert.equal(JSON.parse(out.trim().split('\n').pop()).wroteActive, true);
+});
+
+test('re-saving the SAME instance is idempotent and files nothing extra', () => {
+  const { out } = inSandbox(`
+    const s = { token:'T1', api_base:'https://a.example.com', builder:{github_login:'x'} };
+    await lib.saveSession(s);
+    await lib.saveSession({ ...s, token:'T2' });   // e.g. fetch-art-key rewriting one field
+    const cur = await lib.loadStoredSession('https://a.example.com');
+    console.log(JSON.stringify({ hosts: lib.listStoredSessions().map(h=>h.host), token: cur.token }));`);
+  const r = JSON.parse(out.trim().split('\n').pop());
+  assert.deepEqual(r.hosts, ['a.example.com'], 'a same-instance re-save must not fan out');
+  assert.equal(r.token, 'T2');
+});
+
+test('session files are owner-only', () => {
+  const { out } = inSandbox(`
+    await lib.saveSession({ token:'T', api_base:'https://a.example.com', builder:{github_login:'x'} });
+    const f = fs.statSync(lib.sessionStorePath('https://a.example.com')).mode & 0o777;
+    const d = fs.statSync(lib.sessionStoreDir()).mode & 0o777;
+    console.log(JSON.stringify({ file: f.toString(8), dir: d.toString(8) }));`);
+  const r = JSON.parse(out.trim().split('\n').pop());
+  assert.equal(r.file, '600', 'a session file holds a bearer token');
+  assert.equal(r.dir, '700');
+});
+
+test('a corrupt store entry is skipped, never fatal', () => {
+  const { out } = inSandbox(`
+    await lib.saveSession({ token:'T', api_base:'https://a.example.com', builder:{github_login:'x'} });
+    fs.writeFileSync(path.join(lib.sessionStoreDir(),'broken.json'), '{ not json');
+    console.log(JSON.stringify({ hosts: lib.listStoredSessions().map(h=>h.host) }));`);
+  assert.deepEqual(JSON.parse(out.trim().split('\n').pop()).hosts, ['a.example.com']);
+});
+
+// ── 3. Switching back ───────────────────────────────────────────────────────────────────────
+
+test('login VERIFIES a stored token before trusting it, and can be forced past', () => {
+  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'login.js'), 'utf8');
+  // A stored token may be expired or revoked. Reinstating one unchecked would leave the builder
+  // "signed in" to a session every later command then fails on.
+  assert.match(src, /loadStoredSession\(base\)/);
+  assert.match(src, /\/api\/gds\/me`, \{ headers: \{ Authorization/);
+  assert.match(src, /if \(me\.ok && me\.data && me\.data\.builder\)/);
+  assert.match(src, /--force/, 'there must be a way to sign in as somebody else');
+});
+
+test('login names the other instances and how to move between them', () => {
+  const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'login.js'), 'utf8');
+  assert.match(src, /function logOtherInstances/);
+  assert.match(src, /Also signed in to/);
+  // Terminal reader: no slash command may appear in that guidance (task 1003730's rule).
+  const fnStart = src.indexOf('function logOtherInstances');
+  assert.ok(!/\/builder-/.test(src.slice(fnStart, fnStart + 700)), 'no slash command in terminal guidance');
+});

package/tests/government_config_roots.mjs

@@ -0,0 +1,159 @@
+// tests/government_config_roots.mjs — the constitution's two files come from two
+// different roots (task 1003739, ADR 0268).
+//
+// THE BUG THIS PINS, because it was silent for two weeks and cost a ratified
+// constitutional amendment. `modules/government/config.js` resolved BOTH the
+// neutral starter and the instance pack from `path.resolve(__dirname, '..',
+// '..')`, under a comment saying the two roots coincided "today". True in a
+// single checkout. False on cloudbongos.com, which runs a PINNED core: there
+// __dirname is inside node_modules/@cloudbongos/core, so the INSTANCE pack
+// resolved to a path inside the core package — one no host authors, and one
+// `npm ci` erases. The board ratified consent/metic+/1440 on 2026-08-25,
+// `applyBoardAmendment` wrote it into node_modules, the next core upgrade
+// deleted it, and GET /government/constitution went on answering the day-one
+// monarchy while its own history showed the amendment had passed.
+//
+// NOTHING THREW. Both paths exist, both are writable, and an absent instance
+// pack is a legal state (a vanilla instance has none), so the read fell through
+// to the neutral file exactly as designed. That is why this is a STRUCTURAL
+// test rather than a behavioural one: there is no error to assert on, only the
+// question of which root each path was built from.
+//
+// The single-checkout answers are asserted too, and deliberately: they are what
+// makes this fix byte-identical for a non-split instance, and a future "tidy-up"
+// that re-collapses the two roots must fail here rather than in production two
+// weeks later.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const CONFIG_PATH = path.join(GOV, 'config.js');
+const config = require(CONFIG_PATH);
+const api = require(path.join(ROOT, 'src', 'module-api.js'));
+
+// config.js resolves its two paths AT LOAD (deliberately — see its header), so
+// exercising a different instance root means re-loading it with the env set.
+// The cache delete is scoped to this one module; instance-config resolves the
+// env per call, so nothing else needs evicting.
+function loadWithInstanceRoot(dir) {
+  const KEY = 'CLOUDBONGOS_INSTANCE_ROOT';
+  const before = process.env[KEY];
+  process.env[KEY] = dir;
+  delete require.cache[require.resolve(CONFIG_PATH)];
+  try { return require(CONFIG_PATH); }
+  finally {
+    if (before === undefined) delete process.env[KEY]; else process.env[KEY] = before;
+    delete require.cache[require.resolve(CONFIG_PATH)];
+    require(CONFIG_PATH); // restore the module-cache entry every other test shares
+  }
+}
+
+// ── the doorway ─────────────────────────────────────────────────────────────
+
+test('the module doorway exposes BOTH roots — a module cannot tell them apart without it', () => {
+  // ADR 0083: a module never requires a core internal, so until this task the
+  // only way to reach a root from inside a module was to re-derive it from
+  // __dirname — which is precisely the derivation that was wrong.
+  assert.equal(typeof api.resolveCoreRoot, 'function');
+  assert.equal(typeof api.resolveInstanceRoot, 'function');
+  assert.equal(api.resolveCoreRoot(), ROOT, 'the core root is this checkout');
+});
+
+// ── the split ───────────────────────────────────────────────────────────────
+
+test('the NEUTRAL starter follows the CORE root and the INSTANCE pack follows the INSTANCE root', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gov-roots-'));
+  try {
+    const split = loadWithInstanceRoot(tmp);
+    assert.equal(split.NEUTRAL_PATH, path.join(ROOT, 'config', 'government.neutral.json'),
+      'the neutral starter is CORE content and must not follow the host');
+    assert.equal(split.INSTANCE_PATH, path.join(tmp, 'config', 'government.json'),
+      'the instance pack is HOST content — the bug was this landing inside the core package');
+    assert.notEqual(path.dirname(split.INSTANCE_PATH), path.dirname(split.NEUTRAL_PATH),
+      'a split instance must resolve the two to DIFFERENT directories');
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('in a single checkout the two roots coincide, exactly as before the fix', () => {
+  // The byte-identical claim for every non-split instance, asserted rather than
+  // asserted-in-prose. If this ever fails, the fix changed behaviour for the
+  // ordinary case and that is a regression, not a refinement.
+  assert.equal(config.NEUTRAL_PATH, path.join(ROOT, 'config', 'government.neutral.json'));
+  assert.equal(config.INSTANCE_PATH, path.join(ROOT, 'config', 'government.json'));
+});
+
+test('a host instance pack at the INSTANCE root is actually READ', () => {
+  // The other half of the same bug, and the half a host would have hit first:
+  // before the fix, an instance that hand-authored config/government.json in its
+  // own repo — the documented way to set a constitution — was silently ignored,
+  // because the reader was looking inside node_modules.
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gov-roots-'));
+  try {
+    fs.mkdirSync(path.join(tmp, 'config'));
+    fs.writeFileSync(path.join(tmp, 'config', 'government.json'), JSON.stringify({
+      board: { membership: 'rank:metic+', pass_rule: 'unanimous', window_minutes: 1440, close_early_on_full_turnout: true },
+    }));
+    const split = loadWithInstanceRoot(tmp);
+    const { board } = split.loadGovernmentConfig({ instancePath: split.INSTANCE_PATH });
+    assert.equal(board.pass_rule, 'unanimous');
+    assert.equal(board.membership, 'rank:metic+');
+    assert.equal(board.window_minutes, 1440);
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+// ── the write ───────────────────────────────────────────────────────────────
+
+test('a ratified amendment creates the config directory rather than dying on ENOENT', () => {
+  // Now that the write targets the INSTANCE root, the directory genuinely may
+  // not exist: an instance that has never been branded and never amended has no
+  // config/ of its own. Before the fix the write always landed beside the core's
+  // own config/, which is why this never came up — and a ratified amendment
+  // lost to a missing directory is the same failure as the one being fixed.
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gov-roots-'));
+  try {
+    const target = path.join(tmp, 'nested', 'config', 'government.json');
+    assert.equal(fs.existsSync(path.dirname(target)), false, 'sanity: the directory is absent');
+    const applied = config.applyBoardAmendment(
+      { membership: 'rank:archon', pass_rule: 'unanimous', window_minutes: 1440, close_early_on_full_turnout: true },
+      { instancePath: target },
+    );
+    assert.equal(applied.pass_rule, 'unanimous');
+    assert.deepEqual(JSON.parse(fs.readFileSync(target, 'utf8')).board, applied,
+      'what was written back is what was returned');
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('applying an amendment preserves the rest of the instance pack', () => {
+  // Unchanged behaviour, re-pinned here because the write now happens in a
+  // directory the core does not own: an instance pack holds rank templates too,
+  // and a constitution change must not take them with it.
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gov-roots-'));
+  try {
+    const target = path.join(tmp, 'config', 'government.json');
+    fs.mkdirSync(path.dirname(target));
+    fs.writeFileSync(target, JSON.stringify({ ranks: { metic: { label: 'Trusted' } }, board: { pass_rule: 'consent' } }));
+    config.applyBoardAmendment(
+      { membership: 'rank:archon', pass_rule: 'majority', window_minutes: 1440, close_early_on_full_turnout: true },
+      { instancePath: target },
+    );
+    const after = JSON.parse(fs.readFileSync(target, 'utf8'));
+    assert.equal(after.board.pass_rule, 'majority');
+    assert.deepEqual(after.ranks, { metic: { label: 'Trusted' } }, 'the rank templates survive');
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('this checkout still ships NO instance pack — the vanilla-state guard', () => {
+  // The pre-existing guard (a test once wrote a real config/government.json into
+  // the checkout), kept because the write path moved. It is now doubly
+  // load-bearing: with the instance root defaulting to process.cwd(), a stray
+  // file here would be read by every test that follows.
+  assert.equal(fs.existsSync(path.join(ROOT, 'config', 'government.json')), false,
+    'config/government.json must not exist in the core checkout — a test wrote one once');
+});

package/tests/government_constitution_divergence.mjs

@@ -0,0 +1,123 @@
+// tests/government_constitution_divergence.mjs — the detector for a ratified
+// amendment that did not take (task 1003739, ADR 0268).
+//
+// The path bug that caused the live failure is fixed at its source, in
+// config.js, and pinned by tests/government_config_roots.mjs. THIS is the
+// detector for the CLASS: any future reason a ratified amendment fails to reach
+// the live constitution — a failed write, a rolled-back deploy, a hand edit that
+// reverts one — now surfaces on the constitution view instead of being invisible.
+//
+// WHY A DETECTOR AND NOT JUST THE FIX. On 2026-08-25 this board ratified an
+// amendment and the constitution went on answering the day-one monarchy. The API
+// had BOTH facts in ONE payload the whole time — a passed amendment in `history`,
+// a contradicting `board` beside it — and simply never compared them. Two weeks
+// of sittings were decided under a rule the board had voted to replace, and the
+// only reason anyone noticed was someone reading the JSON by hand.
+//
+// IT REPORTS, IT NEVER HEALS, and that is a decision rather than an omission.
+// The instance pack is also the file a human editing the constitution touches
+// (config.js §applyBoardAmendment), so a silent re-apply would revert a
+// legitimate hand edit with no way to tell the two apart — trading a visible
+// wrong constitution for an unstoppable one.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const board = require(path.join(GOV, 'board.js'));
+const db = require(path.join(GOV, 'db.js'));
+
+const { constitutionDivergence, constitutionView } = board;
+
+const MONARCHY = { membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true };
+// The REAL proposal from cloudbongos.com's amendment 1, item 11 — the sitting
+// that passed and never took. Kept verbatim so this test is the live failure
+// rather than a sketch of it.
+const PASSED_2026_08_25 = {
+  item_id: '11', amendment_id: '1', outcome: 'passed', closed_at: '2026-08-25T16:53:45.655Z',
+  proposed: { pass_rule: 'consent', membership: 'rank:metic+', window_minutes: 1440, close_early_on_full_turnout: true },
+};
+
+test('THE LIVE FAILURE: a passed amendment beside a contradicting constitution is named', () => {
+  const d = constitutionDivergence(MONARCHY, [PASSED_2026_08_25]);
+  assert.ok(d, 'the divergence must be reported, not null');
+  assert.equal(d.item_id, '11');
+  assert.equal(d.amendment_id, '1');
+  const byField = Object.fromEntries(d.fields.map((f) => [f.field, f]));
+  assert.deepEqual(Object.keys(byField).sort(), ['membership', 'pass_rule', 'window_minutes']);
+  assert.deepEqual(byField.pass_rule, { field: 'pass_rule', ratified: 'consent', in_force: 'first_ratifier' });
+  assert.deepEqual(byField.membership, { field: 'membership', ratified: 'rank:metic+', in_force: 'rank:archon' });
+  assert.deepEqual(byField.window_minutes, { field: 'window_minutes', ratified: 1440, in_force: null });
+  assert.equal(d.fields.some((f) => f.field === 'close_early_on_full_turnout'), false,
+    'a field that AGREES is not reported — the report is the delta, not the whole block');
+});
+
+test('a constitution that IS the last ratified one reports nothing', () => {
+  // The healthy answer, and the one the hall renders nothing for. A detector
+  // that fires on a working system is a detector people learn to ignore.
+  const inForce = { membership: 'rank:metic+', pass_rule: 'consent', window_minutes: 1440, close_early_on_full_turnout: true };
+  assert.equal(constitutionDivergence(inForce, [PASSED_2026_08_25]), null);
+});
+
+test('a RETURNED amendment is not a decision and never diverges', () => {
+  // The whole meaning of 'returned'. Comparing against it would report a
+  // divergence on every rejected proposal — i.e. on the system working.
+  const returned = { ...PASSED_2026_08_25, outcome: 'returned' };
+  assert.equal(constitutionDivergence(MONARCHY, [returned]), null);
+  // …and the newest PASSED one still stands, with later returns above it.
+  const d = constitutionDivergence(MONARCHY, [returned, PASSED_2026_08_25]);
+  assert.ok(d);
+  assert.equal(d.item_id, '11');
+});
+
+test('a board that has never amended anything reports nothing', () => {
+  assert.equal(constitutionDivergence(MONARCHY, []), null);
+  assert.equal(constitutionDivergence(MONARCHY, null), null);
+  assert.equal(constitutionDivergence(MONARCHY, [{ outcome: 'passed' }]), null, 'a row with no proposal is not a claim');
+});
+
+test('the comparison is against the SANITIZED proposal, not the raw one', () => {
+  // applyBoardAmendment sanitizes on write, so comparing the RAW proposal would
+  // report a phantom divergence on any field the sanitizer legitimately
+  // normalises — and a warning that can never be cleared is worse than none.
+  // 999999 is past MAX_WINDOW_MINUTES, so it sanitizes to the default (null),
+  // which is what is in force: nothing to report.
+  const junkWindow = { ...PASSED_2026_08_25, proposed: { ...PASSED_2026_08_25.proposed, window_minutes: 999999 } };
+  const inForce = { membership: 'rank:metic+', pass_rule: 'consent', window_minutes: null, close_early_on_full_turnout: true };
+  assert.equal(constitutionDivergence(inForce, [junkWindow]), null);
+});
+
+test('the newest passed amendment wins — one it superseded is not compared', () => {
+  const older = {
+    item_id: '4', amendment_id: '2', outcome: 'passed', closed_at: '2026-08-01T00:00:00Z',
+    proposed: { pass_rule: 'majority', membership: 'rank:archon', window_minutes: 90, close_early_on_full_turnout: true },
+  };
+  // listAmendmentHistory returns newest-first, so the 08-25 row is the standing
+  // decision and the older one is history, not a claim on the present.
+  const d = constitutionDivergence(MONARCHY, [PASSED_2026_08_25, older]);
+  assert.equal(d.item_id, '11');
+  assert.equal(d.ratified.pass_rule, 'consent', 'not the older majority proposal');
+});
+
+test('the constitution view carries it, and this checkout is healthy', async () => {
+  // Wired end to end: the view computes the divergence from the history it
+  // already read, so there is no second query that could disagree with the rows
+  // shown beside it.
+  const originals = { listAmendmentHistory: db.listAmendmentHistory, countActiveBuilders: db.countActiveBuilders };
+  try {
+    Object.assign(db, { listAmendmentHistory: async () => [], countActiveBuilders: async () => 4 });
+    const clean = await constitutionView();
+    assert.equal(clean.divergence, null, 'a board with no amendments has nothing to warn about');
+
+    Object.assign(db, { listAmendmentHistory: async () => [PASSED_2026_08_25] });
+    const diverged = await constitutionView();
+    assert.ok(diverged.divergence, 'the live failure, reproduced through the real view');
+    assert.equal(diverged.divergence.item_id, '11');
+    assert.equal(diverged.board.pass_rule, 'first_ratifier', 'the view still reports what is actually in force');
+    assert.equal(diverged.divergence.ratified.pass_rule, 'consent', 'beside what was ratified');
+  } finally { Object.assign(db, originals); }
+});

package/tests/module_api.mjs

@@ -34,6 +34,7 @@ const PUBLISHED_SURFACE = [
   'llmCache', // BV1.R73: shared LLM-cost cache (1.6.0; tracked domain leak)
   'llmPricing', // BV1.R77: shared token→USD pricing (1.7.0; tracked domain leak — economy carve)
   'branding', 'clientBranding', 'userAgent', 'resolveEnv', 'readConfigFileSync', 'configHome', 'configPath', // userAgent added 1.12.0 (BV1.R86; github-push UA)
+  'resolveCoreRoot', 'resolveInstanceRoot', // added by task 1003739 (ADR 0268): the two ADR 0108 §1 roots. A module reading a HOST-owned file could not tell them apart without these, and re-deriving one from __dirname is right in a single checkout and silently wrong on a standalone instance — which is how a RATIFIED constitutional amendment came to be written into node_modules and erased by the next core upgrade. Core content → resolveCoreRoot(); host content → resolveInstanceRoot(); src/branding.js is the pattern
   'resolveStaleClaimHours', 'staleClaimMinutes', // added by task 1003476 (ADR 0226; goal 1000072): the PROJECT's stale-claim timer — the sweep that releases a silent claim and the Archon roster that reports one read the same number through here, after eighteen hours of disagreeing (6 vs 24)
   'resolveRotDays', 'projectSettings', // added by task 1003279 (ADR 0232; goal 1000072): the ROT timer + the live knob store behind it. A DIFFERENT question from the stale-claim timer above — days not hours, DB not env, work nobody picked up rather than a builder who went quiet, and it only ever ASKS a human where that one ACTS. Both ride the doorway so no module hardcodes either.
   'joinabilityMode', // added by task 1003044 (ADR 0194; the carrier after 1.19.374): the project's membership door, one reader for the sign-in gate AND the onboarding module's public POST