@bongos/core 1.19.663 → 1.19.665

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.663",
+  "version": "1.19.665",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.663",
+      "version": "1.19.665",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.663",
+  "version": "1.19.665",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/hall-preview/server.js

@@ -183,6 +183,17 @@ app.use((req, res, next) => {
     return;
   }
 
+  // The ship-time VISUAL is an image, not a fixture (task 1003829). Without
+  // this, every surface that renders one — the task record, a ship feed, the
+  // Studio's review card, where the picture IS the card — previews as a broken
+  // frame, so the one thing being reviewed is the one thing you cannot see.
+  // A generated stand-in; see scripts/hall-preview/task-visual.js.
+  if (/^task-visuals\/[A-Za-z0-9._-]+$/.test(apiPath) && req.method === 'GET') {
+    const png = require('./task-visual').placeholderPng();
+    res.set({ 'content-type': 'image/png', 'cache-control': 'no-store' });
+    return res.end(png);
+  }
+
   if (req.method !== 'GET') {
     return res.status(501).json({ error: { code: 'preview_readonly', message: 'the preview harness serves fixtures; writes are not wired' } });
   }

package/scripts/hall-preview/task-visual.js

@@ -0,0 +1,89 @@
+'use strict';
+// scripts/hall-preview/task-visual.js — a stand-in ship-time visual for the
+// preview harness (task 1003829).
+//
+// WHY THIS EXISTS. Everything else in this harness is answered from a checked-in
+// JSON fixture, but a ship-time visual is an IMAGE: the API stub answers
+// /api/bongos/* with JSON, so a page that renders <img src="/api/bongos/
+// task-visuals/task-1899-….png"> got a 404 body and a broken frame. The Studio's
+// review card (task 1003829) makes that image the subject of the card, and a
+// surface whose subject cannot be rendered cannot be reviewed — the whole point
+// of this harness.
+//
+// It is a GENERATED placeholder, not a checked-in screenshot: a few flat bands
+// at a real screenshot's aspect ratio, so a reviewer can judge the plate's size,
+// fit, caption and crop without a binary in the repo. Deliberately obvious —
+// nobody should mistake it for a real ship's visual.
+//
+// A ~40-line PNG encoder rather than a dependency, matching the kit's own
+// png.js (a ~50-line DEcoder for the same reason). One IDAT, filter type 0.
+const zlib = require('node:zlib');
+
+function chunk(type, data) {
+  const len = Buffer.alloc(4);
+  len.writeUInt32BE(data.length);
+  const body = Buffer.concat([Buffer.from(type, 'ascii'), data]);
+  const crc = Buffer.alloc(4);
+  crc.writeUInt32BE(crc32(body) >>> 0);
+  return Buffer.concat([len, body, crc]);
+}
+
+let CRC_TABLE = null;
+function crc32(buf) {
+  if (!CRC_TABLE) {
+    CRC_TABLE = new Int32Array(256);
+    for (let n = 0; n < 256; n++) {
+      let c = n;
+      for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+      CRC_TABLE[n] = c;
+    }
+  }
+  let c = -1;
+  for (let i = 0; i < buf.length; i++) c = CRC_TABLE[(c ^ buf[i]) & 0xff] ^ (c >>> 8);
+  return c ^ -1;
+}
+
+// An RGB PNG from a per-pixel colour function. RGB (colour type 2), 8-bit,
+// non-interlaced — the shape the kit's decoder also speaks.
+function encodeRgb(w, h, at) {
+  const stride = w * 3;
+  const raw = Buffer.alloc((stride + 1) * h);
+  for (let y = 0; y < h; y++) {
+    const row = y * (stride + 1);
+    raw[row] = 0;  // filter: none
+    for (let x = 0; x < w; x++) {
+      const [r, g, b] = at(x, y);
+      const p = row + 1 + x * 3;
+      raw[p] = r; raw[p + 1] = g; raw[p + 2] = b;
+    }
+  }
+  const ihdr = Buffer.alloc(13);
+  ihdr.writeUInt32BE(w, 0);
+  ihdr.writeUInt32BE(h, 4);
+  ihdr[8] = 8; ihdr[9] = 2; ihdr[10] = 0; ihdr[11] = 0; ihdr[12] = 0;
+  return Buffer.concat([
+    Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]),
+    chunk('IHDR', ihdr),
+    chunk('IDAT', zlib.deflateSync(raw, { level: 9 })),
+    chunk('IEND', Buffer.alloc(0)),
+  ]);
+}
+
+// The stand-in: a wide plate of flat bands with a paler inset, so its edges,
+// aspect ratio and any crop are all visible at a glance. Cached — the harness
+// may serve it on every paint.
+let CACHED = null;
+function placeholderPng() {
+  if (CACHED) return CACHED;
+  const W = 1200, H = 700;
+  const BANDS = [[38, 34, 30], [74, 66, 58], [176, 96, 62], [214, 200, 184], [246, 243, 238]];
+  CACHED = encodeRgb(W, H, (x, y) => {
+    const inset = x > W * 0.08 && x < W * 0.92 && y > H * 0.14 && y < H * 0.86;
+    const band = BANDS[Math.min(BANDS.length - 1, Math.floor((y / H) * BANDS.length))];
+    if (!inset) return band;
+    return band.map((c) => Math.min(255, Math.round(c + (255 - c) * 0.42)));
+  });
+  return CACHED;
+}
+
+module.exports = { placeholderPng, encodeRgb };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.663'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.665'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
@@ -197,6 +197,20 @@ module.exports = {
   //     isConfigured/encrypt/decrypt/provisionMasterKey without reaching core.
   get secretBox() { return require('./bongos/secret-box'); },
 
+  // --- grantedScopeCoversRepos(scope) — does a scope string GitHub ACTUALLY
+  //     GRANTED still reach private repos? Exposed for the provisioning module's
+  //     create-route credential preflight (task 1002909), which must tell "that
+  //     repo does not exist" apart from "it is private and your pre-ADR-0155 token
+  //     cannot see it" — GitHub answers 404 to both.
+  //
+  //     Shared rather than re-implemented because the subtlety is a trap:
+  //     `public_repo` CONTAINS the substring "repo", so a naive match accepts
+  //     exactly the stale token this guards against. auth-config.js is KERNEL
+  //     (ADR 0091 §1), so this stays inside the kernel-imports-only rule — unlike
+  //     db.getGithubToken / github-repos, which are domain and which a module
+  //     therefore reaches via the exposed `pool` and its own client instead.
+  get grantedScopeCoversRepos() { return require('./bongos/auth-config').grantedScopeCoversRepos; },
+
   // --- KERNEL trust classifiers (ADR 0091 §1, KERNEL_FILES) — the deterministic
   //     route→rank + protected-path matchers. They are KERNEL (the trust
   //     boundary, never "called" by a domain), exposed so a module that runs the

package/tests/hall_studio_world.mjs

@@ -28,15 +28,130 @@ const HTML = read('studio.html');
 const HTML_NC = HTML.replace(/<!--[\s\S]*?-->/g, '');
 const JS = read('studio.js');
 const CSS = read('studio.css');
+// The file's comments legitimately NAME routes and rules it must not call (the
+// header explains what the room does not do, and the allowlist documents each
+// entry), so the route invariants below scan the CODE. Comments only — string
+// contents are untouched, which is where a real route would live.
+const JS_NC = JS.replace(/^\s*\/\/.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '');
 
-test('the Studio writes NOTHING — the goal\'s no-live-CMS rule, at the surface', () => {
-  // Every craft act (coach the grader, remake copy, propose wording) happens on
-  // the surface that owns it (the task record, the copy desk) as a claimed,
-  // graded, shipped task. This room only READS and ROUTES. A POST/PATCH/DELETE
-  // here would be the live-CMS write path the goal forbids (criterion
-  // artist-edits-land-as-tasks) — so it must not exist.
-  const writes = JS.match(/\.request\(\s*['"](POST|PATCH|PUT|DELETE)['"]/g) || [];
-  assert.deepEqual(writes, [], `studio.js must issue no writes; found ${writes.join(', ')}`);
+// ---------------------------------------------------------------------------
+// What the room may write — NARROWED, not dropped (task 1003829).
+//
+// This test used to assert studio.js issued NO write at all. Task 1003829
+// relaxed that, deliberately and only this far: "The Studio's no-write posture
+// is relaxed only for the artist's own verdict on their own queue — it still
+// gates nothing and still holds no deploy." So the invariant becomes an
+// ALLOWLIST. The thing goal 1000074 actually forbids — a live CMS, a room that
+// edits a shipped string or asset — is what the second test below pins, and it
+// is the half that must never be relaxed again.
+// ---------------------------------------------------------------------------
+
+test('the Studio writes ONLY the artist\'s verdict on their own review queue', () => {
+  // Each permitted write moves the REVIEW TASK (dismiss it, note on it, file
+  // its follow-up and close it against that). Every one of them is a route the
+  // board's ordinary triage already had; none of them touches the product.
+  const allowed = [
+    /^POST \$\{API\}\/tasks\/\$\{reviewId\}\/abandon$/,  // looks good → dismissed
+    /^PATCH \$\{API\}\/tasks\/\$\{reviewId\}$/,          // note it   → the words, on the review
+    /^POST \$\{API\}\/tasks$/,                           // needs work→ the follow-up task
+    /^POST \$\{API\}\/tasks\/\$\{reviewId\}\/merge$/,    // …and the review closed against it
+  ];
+  // Every write site, as "<VERB> <route expression>" — the verb from the
+  // request call, the route from the WRITE_ROUTES entry it names.
+  const routes = new Map(
+    [...JS.matchAll(/^\s*(\w+):\s*\([^)]*\)\s*=>\s*`([^`]+)`,/gm)].map((m) => [m[1], m[2]])
+  );
+  // EVERY write site in the file, with the URL argument it was given — so a
+  // write cannot dodge the allowlist by naming its URL inline. That totality is
+  // what makes this test a wall and not a sample.
+  const sites = [...JS_NC.matchAll(/\.request\(\s*['"](POST|PATCH|PUT|DELETE)['"]\s*,\s*([^,)]+)/g)]
+    .map(([, verb, arg]) => {
+      const named = /^WRITE_ROUTES\.(\w+)\(/.exec(arg.trim());
+      return { verb, arg: arg.trim(), route: named ? routes.get(named[1]) : null };
+    });
+  assert.equal(sites.length, 4, `exactly the four verdict writes; found ${sites.length}`);
+  for (const s of sites) {
+    assert.ok(s.route, `every write names a WRITE_ROUTES entry, never an inline URL: ${s.verb} ${s.arg}`);
+    const site = `${s.verb} ${s.route}`;
+    assert.ok(allowed.some((re) => re.test(site)), `write outside the allowlist: ${site}`);
+  }
+});
+
+test('the Studio still edits no live string and no asset — the no-live-CMS rule', () => {
+  // The half that is NOT relaxed (criterion artist-edits-land-as-tasks). A copy
+  // change or an asset change reaches people only as a claimed, graded, shipped
+  // task, so this room must never call the routes that would write one directly.
+  const forbidden = [
+    /copy-desk\/proposals/,       // wording — belongs to the copy desk, under a claim
+    /copy-desk\/flags\/[^'"`]*\/close/,  // someone else's flag verdict — the copy desk's own act
+    /\/visual\b/,                 // POST/DELETE /tasks/:id/visual — the asset itself
+    /\/confirm\b/, /\/ship\b/, /\/grade\b/, /\/claims\b/,  // the ship pipeline: it gates nothing
+  ];
+  for (const re of forbidden) {
+    assert.ok(!re.test(JS_NC), `the Studio must not write ${re}`);
+  }
+  // "Needs work" files a TASK and says so: the follow-up is ordinary work that
+  // somebody claims, not an edit this room performs.
+  assert.match(JS, /never edits a live string or asset/, 'the follow-up brief says what the room did not do');
+});
+
+test('the verdict is offered only to a viewer the routes will accept', () => {
+  // The task 1003751 lesson: a card must not print a verb its route refuses.
+  // All four verdict routes floor at metic (modules/government/catalog.js), so
+  // the weights are drawn only above that floor and everyone else is told where
+  // the verdict is recorded instead. Cosmetic — ADR 0016, the server enforces.
+  assert.match(JS, /RANK_ORDER\.metic/, 'the offer is gated on the routes\' own floor');
+  assert.match(JS, /function canVerdict\(\)/, 'and the gate is one named predicate');
+  assert.match(JS, /if \(!canVerdict\(\)\)/, 'read both by the renderer and by the handler');
+  assert.match(JS, /studio-verdict__sealed/, 'a viewer below the floor gets a sentence, not three dead buttons');
+});
+
+test('the review card shows the reviewed work\'s picture, through the kit', () => {
+  // "the picture is the card" — and drawn by the kit's ONE full-size renderer
+  // rather than a third hand-rolled <figure> (the task's own instruction).
+  assert.match(JS, /kit\.taskVisualFigureHtml\(/, 'the plate comes from the kit renderer');
+  assert.ok(!/<figure/.test(JS), 'studio.js builds no <figure> of its own');
+  assert.match(HTML, /hall-kit\.js/, 'and the page loads the kit that owns it');
+  // The degrade: a review with no visual (or one that could not be read) draws
+  // nothing at all rather than an empty frame, so it still reads as a review.
+  assert.match(JS, /if \(!p\.shipped \|\| !kit/, 'no reviewed task, no kit → no plate');
+  // The reviewed task is read for the card in focus, once — not 50 times up front.
+  assert.match(JS, /p\.hydrated = true;/, 'the read is made once per review');
+  assert.match(JS, /\$\{API\}\/tasks\/\$\{encodeURIComponent\(p\.shippedId\)\}/, 'and it reads the SHIPPED task the review names');
+});
+
+test('a security_sensitive task\'s visual is suppressed, as the server suppresses it', () => {
+  // modules/lifecycle/task-visuals.js isPubliclyViewable makes a
+  // security_sensitive task's image the one visual the platform does not
+  // re-publish; the public feed's SQL agrees. The room agrees too — it keeps the
+  // id and drops the rest, so the card degrades to the copy it always showed.
+  assert.match(JS, /security_sensitive === true \? \{ id: t\.id \}/, 'the row is stripped to its id when it is sensitive');
+});
+
+test('a note APPENDS to a freshly-read brief — it can never blank one', () => {
+  // PATCH description REPLACES the field. Appending to a base that is stale, or
+  // that a narrowed list projection simply did not carry, would delete the
+  // cascade's brief instead of adding to it — so the base is re-read and the
+  // write is skipped entirely when that read fails.
+  assert.match(JS_NC, /const cur = await api\.request\('GET', `\$\{API\}\/tasks\/\$\{p\.taskId\}`\);/, 'the current brief is re-read');
+  assert.match(JS_NC, /if \(base === null\) \{/, 'and a failed re-read writes nothing');
+  assert.match(JS_NC, /description: `\$\{base\}\$\{block\}`/, 'the write is base + the note, in that order');
+  // Ordering, stated as code: the GET must precede the PATCH in the function.
+  const fn = /async function verdictNote[\s\S]*?\n  \}/.exec(JS_NC)[0];
+  assert.ok(fn.indexOf("request('GET'") < fn.indexOf("request('PATCH'"), 'read before write');
+});
+
+test('the three weights are the whole verdict, and two of them require words', () => {
+  // The room asks for nothing else (the task's DONE WHEN): one field, three
+  // answers. "looks good" may be wordless; a note with no note and a follow-up
+  // with no brief are refused inline rather than filed empty.
+  assert.match(JS, /const VERDICTS = \{ good: verdictGood, note: verdictNote, work: verdictWork \};/, 'exactly three weights');
+  assert.match(JS, /if \(!said\) return verdictError\('Write what you saw first/, 'a note needs words');
+  assert.match(JS, /if \(!said\) return verdictError\('Write what needs work first/, 'a follow-up needs a brief');
+  // The follow-up is idempotent on (source, source_ref), so a double-click
+  // resolves to the same task instead of filing two.
+  assert.match(JS, /source_ref: `studio-needs-work-on-review-\$\{p\.taskId\}`/, 'the follow-up is keyed for idempotency');
+  assert.match(JS, /let busy = false;/, 'and one verdict runs at a time');
 });
 
 test('the reviews read is bounded and correct', () => {
@@ -88,6 +203,318 @@ test('the accent is spent only where the rule allows', () => {
   assert.ok(accentFills.length <= 1, `studio.css spends the accent on at most the lamp; found ${accentFills.length}`);
 });
 
+// ---------------------------------------------------------------------------
+// Boot the REAL studio.js under a DOM stub, with the REAL hall-kit.js beside it
+// (the bootShell pattern below, pointed at the page script). The static-source
+// assertions above pin the wiring; these render the card and read what it
+// actually says, which is the only way to pin a DEGRADE — "no picture" and
+// "picture suppressed" both have to produce a review that still reads as one.
+// ---------------------------------------------------------------------------
+// `onWrite` decides what each non-GET answers, so a test can drive the happy
+// path AND the refusals. Default: every write succeeds, and POST /tasks mints
+// NEW_TASK_ID so the "needs work" pair can be followed to its merge.
+const NEW_TASK_ID = '2001';
+async function bootStudio({ reviews = [], shipped = {}, rank = 'metic', flags = null, onWrite = null } = {}) {
+  // The REAL kit, not a stub — the plate's URL guard and escaping are its code,
+  // and a stub here would make the degrade tests below pass for the wrong reason
+  // (no kit also means no plate). It is node-require-safe by its own contract.
+  const kit = (await import(`file://${path.join(HALL, 'hall-kit.js').replace(/\\/g, '/')}`)).default;
+  assert.equal(typeof kit.taskVisualFigureHtml, 'function', 'the real kit loaded');
+  const els = new Map();
+  const el = (id) => {
+    if (!els.has(id)) els.set(id, { id, innerHTML: '', textContent: '', hidden: false, value: '' });
+    return els.get(id);
+  };
+  const calls = [];
+  const request = async (method, url, body) => {
+    calls.push({ method, url, body });
+    if (method !== 'GET') {
+      const custom = onWrite && onWrite({ method, url, body });
+      if (custom) return custom;
+      if (/\/tasks$/.test(url)) return { ok: true, data: { task: { id: NEW_TASK_ID } } };
+      return { ok: true, data: { ok: true } };
+    }
+    if (/\/me$/.test(url)) return { ok: true, data: { builder: { display_name: 'Artist A', rank } } };
+    if (/\/tasks\?discipline=artist/.test(url)) return { ok: true, data: { tasks: reviews } };
+    if (/\/copy-desk\/queue/.test(url)) return flags ? { ok: true, data: { flags } } : { ok: false, data: {} };
+    // GET /tasks/:id answers for BOTH kinds of row the room reads by id: the
+    // reviewed (shipped) task the card's picture comes from, and the review
+    // itself, which "note it" re-reads before appending. `shipped` is the
+    // per-test control for the first; the queue rows serve the second, as the
+    // real route would. An id in neither is a 404, which is its own test.
+    const m = /\/tasks\/(\d+)$/.exec(url);
+    if (m && shipped[m[1]]) return { ok: true, data: { task: shipped[m[1]] } };
+    const review = m && reviews.find((r) => String(r.id) === m[1]);
+    if (review) return { ok: true, data: { task: review } };
+    return { ok: false, data: {} };
+  };
+  const handlers = [];
+  const window = {
+    BongosClient: { createClient: () => ({ request }) },
+    OTB: {
+      escapeHtml: (s) => String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
+      $: (sel) => el(String(sel).replace(/^#/, '')),
+      toast: () => {},
+      errMessage: (d) => (d && d.error && d.error.message) || '',
+    },
+    OTBKit: kit,
+    scrollTo: () => {},
+  };
+  const document = { addEventListener: (t, h) => handlers.push({ t, h }) };
+  const sandbox = { window, document, console, setTimeout, clearTimeout, Date, encodeURIComponent };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(JS, sandbox, { filename: 'studio.js' });
+  const settle = async (n = 8) => { for (let i = 0; i < n; i++) await new Promise((r) => setImmediate(r)); };
+  // The boot IIFE awaits /me, then the two queue reads, then paint() fires the
+  // lazy reviewed-task read which repaints.
+  await settle();
+  // Fire the page's OWN delegated click handler with the element it looks for,
+  // so the verdict flows are exercised rather than read. `say` fills the words
+  // field first, exactly as a person would.
+  const fire = async (attr, value, { say = null } = {}) => {
+    if (say !== null) el('studio-words').value = say;
+    const node = { dataset: { [attr]: value } };
+    const ev = { target: { closest: (sel) => (sel === `[data-${attr}]` ? node : null) } };
+    for (const { t, h } of handlers) if (t === 'click') h(ev);
+    await settle();
+  };
+  return {
+    focus: () => el('studio-focus').innerHTML,
+    err: () => ({ text: el('studio-verdict-err').textContent, hidden: el('studio-verdict-err').hidden }),
+    field: () => el('studio-words').value,
+    writes: () => calls.filter((c) => c.method !== 'GET'),
+    calls,
+    verdict: (kind, opts) => fire('verdict', kind, opts),
+    skip: () => fire('skip', ''),
+    settle,
+  };
+}
+
+const REVIEW = {
+  id: '1900',
+  title: 'Artist review: the copy and visuals that shipped in task 1899',
+  description: 'STEP 1 — coach the grader.',
+  status: 'backlog',
+  source: 'cascade',
+  source_ref: 'cascade-artist-review-on-ship-1899',
+  goal_id: '1000074',
+  version_id: 'BONGOS-V2',
+  created_at: '2026-09-04T12:30:00.000Z',
+};
+const VISUAL_URL = '/api/bongos/task-visuals/task-1899-0011223344556677.png';
+
+test('a review WITH a visual shows the picture, and folds the steps behind the door', async () => {
+  const { focus, calls } = await bootStudio({
+    reviews: [REVIEW],
+    shipped: { 1899: { id: '1899', visual_url: VISUAL_URL, visual_alt: 'The new hero, dark mode', security_sensitive: false } },
+  });
+  const html = focus();
+  assert.match(html, /class="studio-plate"/, 'the plate is drawn');
+  assert.match(html, /src="\/api\/bongos\/task-visuals\/task-1899-0011223344556677\.png"/, 'from the reviewed task\'s own visual');
+  assert.match(html, /studio-plate__caption">The new hero, dark mode/, 'with visual_alt as the caption');
+  // With a picture on it the card is the picture, one line of framing, and the
+  // verdict — the steps describe what happens after the door, not before it.
+  assert.ok(!/studio-steps/.test(html), 'the two steps are not between the artist and their answer');
+  assert.match(html, /Say what you see/, 'one short line of framing instead');
+  assert.match(html, /data-verdict="good"/, 'and the three weights are there');
+  // ONE extra read for the card in focus, not one per queued review.
+  const reads = calls.filter((c) => /\/tasks\/\d+$/.test(c.url));
+  assert.equal(reads.length, 1, `one reviewed-task read; made ${reads.length}`);
+});
+
+test('a review with NO visual degrades to the copy it always showed', async () => {
+  const { focus } = await bootStudio({
+    reviews: [REVIEW],
+    shipped: { 1899: { id: '1899', visual_url: null, security_sensitive: false } },
+  });
+  const html = focus();
+  assert.ok(!/studio-plate/.test(html), 'no empty frame');
+  assert.ok(!/<img/.test(html), 'and no image at all');
+  assert.match(html, /studio-steps/, 'both craft steps are back');
+  assert.match(html, /coaches the grader on how it judged the work/, 'as is the full framing paragraph');
+  assert.match(html, /data-verdict="good"/, 'the verdict is still offered — this is still a review');
+});
+
+test('a security_sensitive reviewed task shows no picture, and still reads as a review', async () => {
+  const { focus } = await bootStudio({
+    reviews: [REVIEW],
+    shipped: { 1899: { id: '1899', visual_url: VISUAL_URL, visual_alt: 'the exploit', security_sensitive: true } },
+  });
+  const html = focus();
+  assert.ok(!/task-visuals/.test(html), 'the URL never reaches the page');
+  assert.ok(!/the exploit/.test(html), 'nor does the alt text');
+  assert.match(html, /studio-steps/, 'it degrades to the copy, exactly like a review with no visual');
+});
+
+test('a reviewed task that cannot be read leaves a working review card', async () => {
+  // A 404/403 on the reviewed task (it was merged, or the viewer cannot see it)
+  // must cost the artist nothing: the card is the one it always was.
+  const { focus } = await bootStudio({ reviews: [REVIEW], shipped: {} });
+  const html = focus();
+  assert.ok(!/studio-plate/.test(html));
+  assert.match(html, /studio-steps/);
+  assert.match(html, /The copy and visuals that shipped in task #1899/);
+});
+
+test('below the routes\' floor the card offers a sentence, not three refusals', async () => {
+  const { focus } = await bootStudio({
+    reviews: [REVIEW],
+    shipped: { 1899: { id: '1899', visual_url: VISUAL_URL, visual_alt: 'a', security_sensitive: false } },
+    rank: 'xenos',
+  });
+  const html = focus();
+  assert.ok(!/data-verdict=/.test(html), 'no weight is drawn');
+  assert.match(html, /studio-verdict__sealed/, 'the sentence is');
+  assert.match(html, /open it to dismiss it, note what you saw, or file the follow-up/);
+  // The picture is NOT rank-gated — looking is every craft's business.
+  assert.match(html, /studio-plate/, 'and the artist can still see the work');
+});
+
+// ---------------------------------------------------------------------------
+// The verdict flows, FIRED rather than read. The static assertions above pin
+// the wiring and the allowlist; these click the page's own delegated handler
+// and inspect what it actually sent and what state it left behind — the splice
+// math in retire(), the double-submit guard, and the exact request bodies.
+// ---------------------------------------------------------------------------
+const SHIPPED_WITH_VISUAL = { 1899: { id: '1899', visual_url: VISUAL_URL, visual_alt: 'The new hero', security_sensitive: false } };
+const three = () => [
+  { ...REVIEW, id: '1900', source_ref: 'cascade-artist-review-on-ship-1899' },
+  { ...REVIEW, id: '1901', source_ref: 'cascade-artist-review-on-ship-1898', created_at: '2026-09-03T00:00:00.000Z' },
+  { ...REVIEW, id: '1902', source_ref: 'cascade-artist-review-on-ship-1897', created_at: '2026-09-02T00:00:00.000Z' },
+];
+
+test('FIRE looks good: one abandon, carrying who said so, and the stone is gone', async () => {
+  const s = await bootStudio({ reviews: three(), shipped: SHIPPED_WITH_VISUAL });
+  assert.match(s.focus(), /1 of 3/);
+  await s.verdict('good', { say: 'The hero lands.' });
+  const w = s.writes();
+  assert.equal(w.length, 1, `exactly one write; got ${JSON.stringify(w.map((c) => c.method + ' ' + c.url))}`);
+  assert.match(w[0].url, /\/tasks\/1900\/abandon$/, 'the REVIEW is abandoned, not the reviewed task');
+  assert.match(w[0].body.reason, /Reviewed in the studio by Artist A/, 'the reason names who judged it');
+  assert.match(w[0].body.reason, /The hero lands\./, 'and carries the optional words');
+  // retire() dropped it and the count re-read: 3 → 2, and the NEXT review is in
+  // focus rather than the list renumbering around a hole.
+  assert.match(s.focus(), /1 of 2/, 'the garden shrank and did not skip');
+  assert.match(s.focus(), /task #1898/, 'the next stone is the one that was behind it');
+});
+
+test('FIRE looks good with no words: still one abandon, no empty-words refusal', async () => {
+  const s = await bootStudio({ reviews: three(), shipped: SHIPPED_WITH_VISUAL });
+  await s.verdict('good');
+  assert.equal(s.writes().length, 1, '"looks good" is the one weight that needs no words');
+  assert.ok(!/undefined|null/.test(s.writes()[0].body.reason), 'and says nothing about absent words');
+});
+
+test('FIRE note it: the brief is re-read, appended, and the review STAYS in the garden', async () => {
+  const s = await bootStudio({ reviews: three(), shipped: SHIPPED_WITH_VISUAL });
+  await s.verdict('note', { say: 'The sub-line reads like a brochure.' });
+  const w = s.writes();
+  assert.equal(w.length, 1);
+  assert.equal(w[0].method, 'PATCH');
+  assert.match(w[0].url, /\/tasks\/1900$/);
+  // The cascade's own brief survives, with the note after it — the failure mode
+  // here is a PATCH that REPLACES the body, so assert both halves are present.
+  assert.match(w[0].body.description, /^STEP 1 — coach the grader\./, 'the original brief is still the start of the field');
+  assert.match(w[0].body.description, /ARTIST NOTE \(\d{4}-\d{2}-\d{2}, Artist A, from the studio\)/, 'the note is stamped and attributed');
+  assert.match(w[0].body.description, /The sub-line reads like a brochure\.$/, 'and ends with what was written');
+  // A note is not a dismissal.
+  assert.match(s.focus(), /1 of 3/, 'the review is still waiting');
+  assert.equal(s.field(), '', 'the field is cleared for the next thought');
+  assert.equal(s.err().hidden, true);
+});
+
+test('FIRE note it with no words: nothing is sent at all', async () => {
+  const s = await bootStudio({ reviews: three(), shipped: SHIPPED_WITH_VISUAL });
+  await s.verdict('note', { say: '   ' });
+  assert.deepEqual(s.writes(), [], 'no write');
+  assert.deepEqual(s.calls.filter((c) => /\/tasks\/1900$/.test(c.url)), [], 'and not even the re-read');
+  assert.match(s.err().text, /Write what you saw first/);
+  assert.equal(s.err().hidden, false);
+});
+
+test('FIRE needs work: a task in the reviewed work\'s goal, then the review closed against it', async () => {
+  const s = await bootStudio({ reviews: three(), shipped: SHIPPED_WITH_VISUAL });
+  await s.verdict('work', { say: 'The plate is muddy at 320.' });
+  const w = s.writes();
+  assert.equal(w.length, 2, 'the pair: create, then merge');
+  const [create, merge] = w;
+  assert.match(create.url, /\/tasks$/);
+  assert.equal(create.body.goal_id, 1000074, 'the follow-up lands in the reviewed work\'s goal, as a number');
+  assert.equal(create.body.version_id, 'BONGOS-V2');
+  assert.equal(create.body.discipline, 'artist');
+  assert.equal(create.body.source_ref, 'studio-needs-work-on-review-1900', 'keyed so a double-click cannot file twice');
+  assert.match(create.body.description, /The plate is muddy at 320\./, 'the artist\'s words are the brief');
+  assert.match(create.body.description, /never edits a live string or asset/, 'and the brief says this is ordinary work');
+  assert.match(merge.url, /\/tasks\/1900\/merge$/, 'the REVIEW is the one closed');
+  assert.equal(merge.body.into_task_id, Number(NEW_TASK_ID), 'against the task just filed');
+  assert.match(s.focus(), /1 of 2/, 'and the review left the garden');
+});
+
+test('FIRE needs work when the merge fails: the filed task is NAMED, not lost', async () => {
+  // The half-done case is the one that matters: the follow-up exists, so the
+  // artist must be told its id rather than left thinking nothing happened.
+  const s = await bootStudio({
+    reviews: three(),
+    shipped: SHIPPED_WITH_VISUAL,
+    onWrite: ({ url }) => (/\/merge$/.test(url) ? { ok: false, data: { error: { code: 'x', message: 'no' } } } : null),
+  });
+  await s.verdict('work', { say: 'Muddy.' });
+  assert.equal(s.writes().length, 2, 'both halves were attempted');
+  assert.match(s.err().text, new RegExp(`Task ${NEW_TASK_ID} was filed`), 'the id is in the message');
+  assert.match(s.focus(), /1 of 3/, 'and the review stays put rather than vanishing unclosed');
+});
+
+test('FIRE a refused abandon: the review stays, and the server\'s own sentence is shown', async () => {
+  const s = await bootStudio({
+    reviews: three(),
+    shipped: SHIPPED_WITH_VISUAL,
+    onWrite: () => ({ ok: false, data: { error: { code: 'rank_forbidden', message: 'metic or above' } } }),
+  });
+  await s.verdict('good');
+  assert.equal(s.err().text, 'metic or above', 'the route\'s message, not a generic one');
+  assert.match(s.focus(), /1 of 3/, 'nothing was retired on a refusal');
+});
+
+test('FIRE two clicks: the second is swallowed, so a double-click files once', async () => {
+  // The busy flag, exercised: the write is held open, both clicks land, and only
+  // one request is made. Without the guard "needs work" files two tasks.
+  let release;
+  const held = new Promise((r) => { release = r; });
+  const s = await bootStudio({
+    reviews: three(),
+    shipped: SHIPPED_WITH_VISUAL,
+    onWrite: async () => { await held; return { ok: true, data: { ok: true } }; },
+  });
+  const first = s.verdict('good');
+  await s.verdict('good');
+  assert.equal(s.writes().length, 1, 'the second click did not start a second write');
+  release({ ok: true, data: { ok: true } });
+  await first;
+  await s.settle();
+  assert.equal(s.writes().length, 1);
+});
+
+test('FIRE below the floor: a forged click writes nothing', async () => {
+  // The weights are not drawn for a xenos — but the handler is delegated, so
+  // canVerdict() is re-checked in runVerdict rather than trusted to the render.
+  const s = await bootStudio({ reviews: three(), shipped: SHIPPED_WITH_VISUAL, rank: 'xenos' });
+  await s.verdict('good', { say: 'fine' });
+  await s.verdict('work', { say: 'not fine' });
+  assert.deepEqual(s.writes(), [], 'the room sends nothing it was not allowed to offer');
+});
+
+test('FIRE skip: it advances and writes nothing, and the last skip ends quietly', async () => {
+  const s = await bootStudio({ reviews: three(), shipped: SHIPPED_WITH_VISUAL });
+  await s.skip();
+  assert.match(s.focus(), /2 of 3/);
+  await s.skip();
+  await s.skip();
+  assert.deepEqual(s.writes(), [], 'skipping is not a verdict');
+  // Nothing was tended, so the emptied room reads as quiet, not as finished.
+  assert.match(s.focus(), /Nothing waits right now|tended everything/);
+});
+
 // Boot the real shell.js under a DOM stub (the hall_nav.mjs pattern) whose
 // #nav-studio records classList toggles, so applyCraftEmphasis is tested for
 // what it DOES, not just that it exists.

package/tests/module_api.mjs

@@ -24,6 +24,7 @@ const PUBLISHED_SURFACE = [
   'requirePermission', // BV1.R105: the authority-atom gate module routes migrate onto (1.19.0; ADR 0151)
   'pool', 'getPool', 'instanceDbName', 'withTx', 'getBuilderById',
   'secretBox', // Gemini-key storage relocated to modules/art-pipeline + its 'art.getBuilderGeminiKeyRow' port (ADR 0102)
+  'grantedScopeCoversRepos', // the create-route credential preflight's scope read (task 1002909); kernel (auth-config.js), unlike db/github-repos which the module reaches via `pool` + its own client
   'accountExistenceReadRateLimit', // task 1003339 (ADR 0209): the shared per-IP budget both account-existence probes spend from — one instance, not a factory, so the budget is genuinely shared
   'publicProjectFeedRateLimit', // task 1002327 (ADR 0252 §5.3): the per-IP ceiling on GET /projects/featured — the platform's most expensive anonymous read (a cold call fans out to up to 500 third-party origins). One instance for the same reason as its neighbour
   'routeRankCheck', 'permissionPathCheck', // BV1.R73: kernel trust classifiers (1.6.0)