@bongos/core 1.19.68 → 1.19.69

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.68",
-  "core_contract": "1.19.68",
-  "source_commit": "0b0e7e636f0a28d01e1bc8f354a06981d6f1ef70",
+  "core_version": "1.19.69",
+  "core_contract": "1.19.69",
+  "source_commit": "d1240d104fd475ebb67216412776c96dbffb1709",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T14:42:16.480Z",
+  "built_at": "2026-08-12T14:45:41.164Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 292,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1222,
+    "functional_verbatim": 1223,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1535,
-  "tree_sha256": "cc9278ac9df146953fa33e771313791e8ce82f5d69b05a307763c48bae6207e9",
+  "file_count": 1536,
+  "tree_sha256": "d983bcf2513056ef9cb9aca9fb6ecdb74aa1289b7a7601ba3ad00104a26b8992",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1337,7 +1337,7 @@
     {
       "path": "docs/canonical-permissions.md",
       "mode": "0000644",
-      "sha256": "b7f66c6f1fbed274e5ba3295c06db8fc8edb84edd44f6ce92f6734e18267e3d9"
+      "sha256": "96ae791fc131dc389158f326e5fc698283de3d67d3396003bae2632f24a148b0"
     },
     {
       "path": "docs/design-contract.md",
@@ -2977,7 +2977,7 @@
     {
       "path": "modules/hall-ui/public/builders.js",
       "mode": "0000644",
-      "sha256": "5bdd907f10ae15f8efdb55adce3ce23991a376122eb79c549e025f8f4845fae5"
+      "sha256": "076103658308541ef6b976bc333c67a2dc0069913fadbd5551c6241cc320bda4"
     },
     {
       "path": "modules/hall-ui/public/chime.wav",
@@ -3282,7 +3282,7 @@
     {
       "path": "modules/hall-ui/public/shell.js",
       "mode": "0000644",
-      "sha256": "56c1450dd72fcda19841f3a0a98b918b1b875f49971e93d60218fb62e8a21dad"
+      "sha256": "ac31de1ecb51a0899d043b7fa098693ae69cbc3ebe858c97e6c8df2c4cef8015"
     },
     {
       "path": "modules/hall-ui/public/style.css",
@@ -4042,12 +4042,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9319b9acd693e6a9804c215db5ed78ae38f4caf1a698e0596972bfef9555b91c"
+      "sha256": "cfa1a680de61b09d8231908031aedaee2c923dc91ccdf933f1e62895f00f681d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "147790e86972f4273aa18bd24bf508797c4470a4491a20a9614207edeb2e3478"
+      "sha256": "314dffe32265d0bade3708b1591061bbfef4cd8f3e8cfcf6e9eb2879f539ecb9"
     },
     {
       "path": "public-docs/index.html",
@@ -5642,7 +5642,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "2f88796346b1c3a6dc49e25766b223fbf2d99e34b38b9a0f1e64a6fb9a59856d"
+      "sha256": "006a51d3bd71cc496742e9399c53dc5b1ebd18c87a54e675aabda6ac312b4b96"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -5672,7 +5672,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "28675b76775e2936b6ba819fa37c6628f96b259b850248f2ce1033e9bcd7fe20"
+      "sha256": "7e3fc1c20665a092ead5773ba12e2714ecce38641335f602abbb0597bb87dc2f"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6697,7 +6697,12 @@
     {
       "path": "tests/hall_nav.mjs",
       "mode": "0000644",
-      "sha256": "c2456b6fe8845c5778e9e57323cd7a0f2f9d6e96ef9d3a9d4f47f0312da07964"
+      "sha256": "b0da8fb0e46c57419821dbf8cb5ddeda3c98da76d1b2918c3ce77798ee2768fb"
+    },
+    {
+      "path": "tests/hall_page_gate_map.mjs",
+      "mode": "0000644",
+      "sha256": "1e59d5608c205aa6f271c5efd0acb7899f4996dfbaecbf35c387737f19c735f5"
     },
     {
       "path": "tests/hall_palette.mjs",

package/docs/canonical-permissions.md

@@ -179,7 +179,9 @@ or missing ranks fail closed.
   **[ADR 0157](adr/<redacted>.md) added the whole operational block here** —
   20 permissions that had been Archon-gated only by ADR 0016's fail-closed default, never by a decision:
   the governance/monitoring **pages** (`/watch`, `/harbor`, `/gate` — `page.view.governance`) and
-  `GET /api/gds/sessions/search`; the **dev-box + provisioning fleets** (`GET /boxes[/cost-ledger]`,
+  `GET /api/gds/sessions/search` (whose own `/sessions` page had no server gate at all until
+  task 1002710 put it behind `page.view.governance` alongside its three group-mates); the
+  **dev-box + provisioning fleets** (`GET /boxes[/cost-ledger]`,
   `POST /boxes/:b/close`, `PATCH .../block`, `GET /provisioning/fleet[/cost-ledger]`,
   `POST .../force-teardown`); **security adjudication** (`GET /security/reports`,
   `POST /security/reports/:id/{confirm,dispute,fix,link-fix}`, `/security/docs` CRUD);

package/modules/hall-ui/public/builders.js

@@ -493,16 +493,17 @@
   // Roll) stays hidden so a fresh arrival isn't drowned before they've
   // shipped their first works. The Settings link is the exception (task
   // 1291): a newcomer needs it for first-time setup — CLI re-auth (Settings
-  // → CLI Access) and choosing their craft both live there. #766 also hides the
-  // citizen's primer + the "how the system works" maps — a newcomer's path is
-  // action-only. #770: the Work Board link IS shown to a Xenos — a newcomer
-  // needs to find the work they can claim, so the path "find work → claim →
-  // ship three" stays one click away; the rank ladder also stays so they can
-  // see what they're climbing toward. This is cosmetic UX only — every data
-  // endpoint stays server-rank-gated regardless (the Work Board's claimable
-  // feed only returns work accessible to the caller's rank), and a Xenos who
-  // types /primer or /diagrams directly is bounced to /builders/not-ready by
-  // the server (#770). Set early in loadAll so the async karma/acclaim feeds
+  // → CLI Access) and choosing their craft both live there. The citizen's
+  // primer and the "how the system works" maps are ALSO visible to a Xenos as
+  // of task 1002710 — #766/#770 had hidden them on an "action-only path"
+  // reading, but they are the onboarding documents, so the reader they were
+  // written for was the one being turned away. #770: the Work Board link IS
+  // shown to a Xenos — a newcomer needs to find the work they can claim, so the
+  // path "find work → claim → ship three" stays one click away; the rank ladder
+  // also stays so they can see what they're climbing toward. This is cosmetic
+  // UX only — every data endpoint stays server-rank-gated regardless (the Work
+  // Board's claimable feed only returns work accessible to the caller's rank).
+  // Set early in loadAll so the async karma/acclaim feeds
   // (which un-hide their own scroll on data) respect it; the section-hiding
   // sweep then runs before renderNav so the chip strip matches.
   const NEWCOMER_VISIBLE_SECTIONS = new Set([

package/modules/hall-ui/public/shell.js

@@ -136,14 +136,22 @@
     { group: 'Community', gate: 'member', items: [
       { id: 'leaderboard', label: 'Leaderboard', icon: 'leaderboard', href: '/#leaderboard', view: 'leaderboard', gate: 'member' },
       // task 1002577: the cross-project builder directory (/scouting graduated
-      // into the hall). Archon-gated to MATCH its data — /api/gds/scouting is
-      // deliberately "NOT shown to builders" (ADR 0141 §4) until spec R14 widens
-      // it; this gate is cosmetic, requireProjectCuratePage is the wall. The
-      // module gate hides the tab on instances without the platform-identity hub.
-      { id: 'people', label: 'People', icon: 'people', href: '/people', gate: 'archon', module: 'platform-identity' },
+      // into the hall). Gated to MATCH its data — /api/gds/scouting checks
+      // `project.curate`, whose catalog floor is METIC. This read 'archon' until
+      // task 1002710: the nav was stricter than the wall, so a Metic could open
+      // /people by URL but never saw the link. Cosmetic either way —
+      // requireProjectCuratePage is the wall — but a nav that disagrees with the
+      // gate teaches the ladder wrong. The module gate hides the tab on
+      // instances without the platform-identity hub.
+      { id: 'people', label: 'People', icon: 'people', href: '/people', gate: 'governance', module: 'platform-identity' },
     ] },
     { group: 'Docs', gate: 'signed', items: [
-      { id: 'primer', label: 'Primer', icon: 'docs', href: '/primer', gate: 'member' },
+      // task 1002710: primer + diagrams were gate:'member' (rank !== xenos) to
+      // mirror the old thetes+ page gate. That gate is gone — the reading rooms
+      // are for the first-session newcomer above all — so the links follow it
+      // down to 'signed'. Leaving them at 'member' would have ungated the pages
+      // while still hiding them from the only readers the change was for.
+      { id: 'primer', label: 'Primer', icon: 'docs', href: '/primer', gate: 'signed' },
       { id: 'ranks', label: 'Ranks', icon: 'docs', href: '/ranks', gate: 'signed' },
       // task 2175: /drachmae had no nav entry at all — reachable only from prose
       // links since task 2174 moved the bounty rate card onto it. It is reference
@@ -153,7 +161,7 @@
       // stays right whatever `branding.currency.label` is set to. Page is public
       // like /ranks — 'signed' is the same cosmetic "show it once you're in".
       { id: 'economy', label: 'Economy', icon: 'docs', href: '/drachmae', gate: 'signed' },
-      { id: 'diagrams', label: 'Diagrams', icon: 'docs', href: '/diagrams', gate: 'member' },
+      { id: 'diagrams', label: 'Diagrams', icon: 'docs', href: '/diagrams', gate: 'signed' },
       { id: 'atlas', label: 'Repo Atlas', icon: 'docs', href: '/atlas', gate: 'member' },
       { id: 'modules', label: 'Modules', icon: 'docs', href: '/modules', gate: 'member' },
       // The rendered OpenAPI reference lives on the APEX (/docs), not this builders

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.68",
+  "version": "1.19.69",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.68",
+      "version": "1.19.69",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.68",
+  "version": "1.19.69",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/serve-internal.js

@@ -696,6 +696,13 @@ function mountInternalSurfaces(app) {
   const WATCH_PAGE_RE = /^\/builders\/watch(?:\.html)?\/?$/;
   const HARBOR_PAGE_RE = /^\/builders\/harbor(?:\.html)?\/?$/;
   const GATE_PAGE_RE = /^\/builders\/gate(?:\.html)?\/?$/;
+  // /sessions (the session-log ledger) belongs to that same Governance group and
+  // its data route (`session.search`) carries the same metic floor since ADR 0157
+  // — but it had NO page gate at all: sessions.js only called showSealed() after
+  // /api/bongos/me, so the shell was served to anyone who asked for the URL. The
+  // data never leaked (the route gate held), but the page was the one item in the
+  // group without a wall. Gated here so the group is uniform (task 1002710).
+  const SESSIONS_PAGE_RE = /^\/builders\/sessions(?:\.html)?\/?$/;
   // The /governance roles-and-permissions tab (BV1.R113) sits one floor higher:
   // the `governance.manage` atom itself (archon), the same key its data routes
   // check — requireGovernanceManagePage, not the metic-floored gate above.
@@ -704,17 +711,25 @@ function mountInternalSurfaces(app) {
   // exact permission its data route (GET /scouting) checks — same posture as the
   // /governance tab above (the page can never drift wider than the API it fronts).
   const PEOPLE_PAGE_RE = /^\/builders\/people(?:\.html)?\/?$/;
+  // /scouting is the LEGACY twin of /people — the same /api/gds/scouting directory,
+  // left behind when task 1002577 graduated it into the hall. It has no nav entry
+  // and its own header claims "Archon-only", but it was never page-gated: the page
+  // rendered for anyone and leaned entirely on the data route's 403. Gated on the
+  // same atom as /people so the two can't drift apart (task 1002710). Deleting it
+  // in favour of /people is a separate call — it is walled, not removed, here.
+  const SCOUTING_PAGE_RE = /^\/builders\/scouting(?:\.html)?\/?$/;
   app.use((req, res, next) => {
     if (isModuleSurfaceHost(req)) return next();
     if (!req.path.startsWith('/builders')) return next();
     const norm = path.posix.normalize(req.path);
-    if (WATCH_PAGE_RE.test(norm) || HARBOR_PAGE_RE.test(norm) || GATE_PAGE_RE.test(norm)) {
+    if (WATCH_PAGE_RE.test(norm) || HARBOR_PAGE_RE.test(norm) || GATE_PAGE_RE.test(norm)
+      || SESSIONS_PAGE_RE.test(norm)) {
       return gdsAuth.requireGovernancePage(req, res, next);
     }
     if (GOVERNANCE_PAGE_RE.test(norm)) {
       return gdsAuth.requireGovernanceManagePage(req, res, next);
     }
-    if (PEOPLE_PAGE_RE.test(norm)) {
+    if (PEOPLE_PAGE_RE.test(norm) || SCOUTING_PAGE_RE.test(norm)) {
       return gdsAuth.requireProjectCuratePage(req, res, next);
     }
     next();
@@ -820,24 +835,28 @@ function mountInternalSurfaces(app) {
   // (style.css, *.js, fonts, cursors), the not-ready notice, and the sign-in flow
   // itself stay PUBLIC so the landing card + GitHub button render for a stranger.
   //
-  // Two tiers of gate (#770):
-  //   * NON-XENOS (Thetes+) — the orientation reading rooms (primer, diagrams).
-  //     A Xenos's path is action-only; an unauth visitor is sent to sign-in, a
-  //     Xenos to the friendly /builders/not-ready notice.
-  //   * ANY SIGNED-IN BUILDER — the Work Board, Roadmap, the Goals page, the
-  //     task-detail page, the Repo Atlas, the Dev Box pair page,
-  //     and Settings (#748, #904, task 1293, task 1757, task 751): a Xenos IS
-  //     allowed, but an unauthenticated visitor is bounced into sign-in rather
-  //     than served the page shell. Settings sits in THIS tier (not the
-  //     reading-room tier) because a newcomer needs it for first-time setup —
-  //     CLI re-auth (the "CLI Access" section) and choosing their craft both
-  //     live there (task 1291). It must still stay behind sign-in: it shows
-  //     personal prefs and mints CLI tokens.
-  // The link-hiding in builders.js is only cosmetic; these are the real gates.
-  const NONXENOS_BUILDERS_PAGE_RE =
-    /^\/builders\/(?:primer(?:\.md|\.html)?|diagrams(?:\.html)?)\/?$/;
-  const NONXENOS_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;
-  const SIGNEDIN_BUILDERS_PAGE_RE = /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap)(?:\.html)?\/?$/;
+  // ONE tier of gate: ANY SIGNED-IN BUILDER — the Work Board, Roadmap, the Goals
+  // page, the task-detail page, the Repo Atlas, the Dev Box pair page, Settings
+  // (#748, #904, task 1293, task 1757, task 751) and, since task 1002710, the
+  // orientation reading rooms (primer, diagrams). A Xenos IS allowed; an
+  // unauthenticated visitor is bounced into sign-in rather than served the shell.
+  // Settings is in here (not gated higher) because a newcomer needs it for
+  // first-time setup — CLI re-auth and choosing their craft both live there
+  // (task 1291) — while still staying behind sign-in: it shows personal prefs
+  // and mints CLI tokens.
+  //
+  // The reading rooms USED to sit a tier above this, behind requireNonXenosPage
+  // (page.view.builder, thetes+), on #770's reasoning that a Xenos's path is
+  // action-only. That got it backwards: the citizen's primer and the onboarding
+  // diagrams are written FOR the first-session newcomer, and gating them at
+  // thetes redirected exactly that reader to /builders/not-ready. Owner's call
+  // (task 1002710) — the RANK floor is gone; sign-in is unchanged.
+  // The link-hiding in shell.js is only cosmetic; these are the real gates.
+  const SIGNEDIN_BUILDERS_PAGE_RE =
+    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
+  // The diagram image assets under /builders/diagrams/ ride the same tier as the
+  // page that embeds them.
+  const SIGNEDIN_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;
   app.use((req, res, next) => {
     if (isModuleSurfaceHost(req)) return next();
     // Cheap early-out: only /builders/* paths can ever be gated, so skip the
@@ -850,10 +869,8 @@ function mountInternalSurfaces(app) {
     // closes that bypass so the gate holds at the application layer, not just
     // behind the proxy's path normalization.
     const norm = path.posix.normalize(req.path);
-    if (NONXENOS_BUILDERS_PAGE_RE.test(norm) || NONXENOS_BUILDERS_PREFIX_RE.test(norm)) {
-      return gdsAuth.requireNonXenosPage(req, res, next);
-    }
-    if (SIGNEDIN_BUILDERS_PAGE_RE.test(norm) || TASK_DETAIL_PAGE_RE.test(norm)) {
+    if (SIGNEDIN_BUILDERS_PAGE_RE.test(norm) || SIGNEDIN_BUILDERS_PREFIX_RE.test(norm)
+      || TASK_DETAIL_PAGE_RE.test(norm)) {
       return gdsAuth.requireBuilderPage(req, res, next);
     }
     next();

package/src/module-api.js

@@ -563,8 +563,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.66 with no explicit bump. run 31605591253. (task 1002620)
 //   1.19.68 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.67 with no explicit bump. run 31608183268. (task 1002620)
+//   1.19.69 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.68 with no explicit bump. run 31608503813. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.68'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.69'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_nav.mjs

@@ -134,8 +134,9 @@ test('sidebar groups read by audience, in order', () => {
     'the unlabeled group is the project itself (task 1002425 order)');
   assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
   // People (task 1002577): the /scouting directory graduated into the hall.
-  // Archon-gated cosmetically to match its data endpoint; requireProjectCuratePage
-  // is the wall server-side.
+  // Gated cosmetically to match its data endpoint — `project.curate`, floor METIC,
+  // so the nav entry reads 'governance' since task 1002710 (it said 'archon', which
+  // was stricter than the wall). requireProjectCuratePage is the wall server-side.
   assert.deepEqual(nav[2].items.map((i) => i.id), ['leaderboard', 'people'], 'Community = everyone else');
   assert.deepEqual(nav[3].items.map((i) => i.id),
     ['primer', 'ranks', 'economy', 'diagrams', 'atlas', 'modules', 'apidocs'], 'Docs = reference material');

package/tests/hall_page_gate_map.mjs

@@ -0,0 +1,166 @@
+// tests/hall_page_gate_map.mjs
+//
+// GUARD (task 1002710): pins WHICH page gate each hall URL routes to.
+//
+// tests/governance_page_gates.mjs proves each gate FUNCTION admits the right
+// audience. Nothing proved the other half — that a given /builders/* URL is
+// wired to the gate it is supposed to be wired to. That gap is not theoretical:
+// /sessions and /scouting each shipped with NO page gate at all, relying on a
+// client-side showSealed() and a data-route 403 respectively, and no test
+// noticed. A page whose shell is served to everyone is not a data leak while
+// its API holds, but it is a wall that exists only in the reviewer's head.
+//
+// It parses serve-internal.js STATICALLY (no import — that pulls the whole app),
+// in the style of tests/served_paths_shipped.mjs: pull the `*_PAGE_RE` literals
+// out of the source, pull the `if (…) return gdsAuth.<gate>(…)` dispatch out of
+// the same source, and run the oracle's URLs through the reconstructed map.
+//
+// Run:  node tests/hall_page_gate_map.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { posix as posixPath } from 'node:path';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SRC = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'utf8');
+
+// ═══ the ORACLE — hand-written, one row per gated hall URL ═══════════════════
+// `null` means "no page gate": the shell is served to anyone who asks. That is
+// correct for the genuinely public pages and a BUG anywhere else, so every such
+// row is spelled out rather than left to a default.
+//
+// Audiences (the floors live in modules/governance/catalog.js; the gate
+// functions in src/bongos/auth.js):
+//   requireBuilderPage          page.view.public    any signed-in builder (xenos+)
+//   requireGovernancePage       page.view.governance  metic+   (ADR 0157)
+//   requireProjectCuratePage    project.curate        metic+
+//   requireGovernanceManagePage governance.manage     archon
+const ORACLE = {
+  // Any signed-in builder — no rank floor.
+  '/builders/work': 'requireBuilderPage',
+  '/builders/pair': 'requireBuilderPage',
+  '/builders/settings': 'requireBuilderPage',
+  '/builders/atlas': 'requireBuilderPage',
+  '/builders/modules': 'requireBuilderPage',
+  '/builders/goals': 'requireBuilderPage',
+  '/builders/roadmap': 'requireBuilderPage',
+  // task 1002710: the orientation reading rooms moved DOWN to this tier from
+  // requireNonXenosPage (thetes+). They are the onboarding documents, so gating
+  // them above xenos turned away the exact reader they were written for. The
+  // sign-in requirement is unchanged — only the RANK floor is gone.
+  '/builders/primer': 'requireBuilderPage',
+  '/builders/primer.md': 'requireBuilderPage',
+  '/builders/diagrams': 'requireBuilderPage',
+  '/builders/diagrams/02-b.png': 'requireBuilderPage',
+
+  // Metic+ operator surfaces (the Governance nav group).
+  '/builders/watch': 'requireGovernancePage',
+  '/builders/harbor': 'requireGovernancePage',
+  '/builders/gate': 'requireGovernancePage',
+  '/builders/sessions': 'requireGovernancePage',
+
+  // Metic+ via the `project.curate` atom — the exact permission GET /scouting
+  // checks, so neither page can drift wider than the API it fronts.
+  '/builders/people': 'requireProjectCuratePage',
+  '/builders/scouting': 'requireProjectCuratePage',
+
+  // Archon.
+  '/builders/governance': 'requireGovernanceManagePage',
+
+  // Deliberately UNGATED — the landing card, the rank ladder, the reward
+  // schedule and a builder's public portfolio all render for a stranger.
+  '/builders/': null,
+  '/builders/ranks': null,
+  '/builders/drachmae': null,
+  '/builders/profile': null,
+  '/builders/not-ready': null,
+};
+
+// ─── reconstruct the URL→gate map from the source ───────────────────────────
+// 1. every `const NAME_RE = /…/;` (the page-matching regexes)
+function readRegexes(src) {
+  const out = new Map();
+  const re = /const\s+([A-Z0-9_]+_RE)\s*=\s*(\/(?:\\.|\[(?:\\.|[^\]])*\]|[^/\\])+\/[gimsuy]*)\s*;/g;
+  for (const m of src.matchAll(re)) out.set(m[1], eval(m[2])); // eslint-disable-line no-eval
+  return out;
+}
+
+// 2. every `if (<condition>) { return gdsAuth.<gate>(req, res, next); }`
+function readDispatch(src) {
+  const out = [];
+  // `[^{};]` keeps the condition capture INSIDE one if-header. A permissive
+  // `[^]*?` looks lazy enough but will happily start at some earlier `if (` and
+  // swallow every intervening line, hoovering up unrelated *_RE names and
+  // mapping them all to the first gate it reaches.
+  const re = /if\s*\(([^{};]*?)\)\s*\{\s*return\s+gdsAuth\.(\w+)\(req,\s*res,\s*next\);/g;
+  for (const m of src.matchAll(re)) {
+    const names = [...m[1].matchAll(/([A-Z0-9_]+_RE)/g)].map((x) => x[1]);
+    if (names.length) out.push({ names, gate: m[2] });
+  }
+  return out;
+}
+
+const REGEXES = readRegexes(SRC);
+const DISPATCH = readDispatch(SRC);
+
+// The gate a URL resolves to, mirroring the middleware: first matching branch wins.
+function gateFor(urlPath) {
+  const norm = posixPath.normalize(urlPath);
+  for (const { names, gate } of DISPATCH) {
+    for (const name of names) {
+      const rx = REGEXES.get(name);
+      if (rx && rx.test(norm)) return gate;
+    }
+  }
+  return null;
+}
+
+test('the static parse actually found the gate wiring', () => {
+  assert.ok(REGEXES.size >= 8, `expected the *_PAGE_RE literals, found ${REGEXES.size}`);
+  assert.ok(DISPATCH.length >= 3, `expected the gdsAuth dispatch branches, found ${DISPATCH.length}`);
+  // If this file is ever restructured past the parser, these two fail LOUDLY
+  // rather than letting every row below pass vacuously against an empty map.
+  assert.ok(DISPATCH.some((d) => d.gate === 'requireBuilderPage'));
+  assert.ok(DISPATCH.some((d) => d.gate === 'requireGovernancePage'));
+});
+
+test('every hall URL routes to the page gate the oracle names', () => {
+  for (const [urlPath, expected] of Object.entries(ORACLE)) {
+    assert.equal(gateFor(urlPath), expected,
+      `${urlPath} → ${gateFor(urlPath) ?? 'NO GATE'} (expected ${expected ?? 'NO GATE'})`);
+  }
+});
+
+test('the .html twin of a gated page is gated identically', () => {
+  // express.static resolves /builders/watch from watch.html via extensions:['html'],
+  // so the explicit .html form must not slip past the gate the bare form carries.
+  for (const [urlPath, expected] of Object.entries(ORACLE)) {
+    if (expected === null || urlPath.includes('.')) continue;
+    assert.equal(gateFor(`${urlPath}.html`), expected, `${urlPath}.html must match ${urlPath}`);
+  }
+});
+
+test('path-normalization tricks do not slip past a gate', () => {
+  // The middleware normalizes before matching precisely so these forms — which
+  // express.static WILL resolve to the same file — cannot bypass an anchored RE.
+  for (const [urlPath, expected] of Object.entries(ORACLE)) {
+    if (expected === null) continue;
+    const tail = urlPath.replace(/^\/builders\//, '');
+    for (const sneaky of [`/builders//${tail}`, `/builders/./${tail}`]) {
+      assert.equal(gateFor(sneaky), expected, `${sneaky} must resolve to ${expected}`);
+    }
+  }
+});
+
+test('no gated page is left matching only a REMOVED gate function', () => {
+  // requireNonXenosPage still EXISTS in auth.js (page.view.builder is a live
+  // catalog atom an Archon can attach to a custom role) but task 1002710 left it
+  // guarding nothing. If someone re-points a URL at it, that is a deliberate act
+  // that should update this oracle — not something to happen silently.
+  const wired = new Set(DISPATCH.map((d) => d.gate));
+  assert.ok(!wired.has('requireNonXenosPage'),
+    'requireNonXenosPage guards no hall URL since task 1002710 — update the ORACLE if that changes');
+});