@bongos/core 1.19.700 → 1.19.701

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.700",
-  "core_contract": "1.19.700",
-  "source_commit": "7af21bffa8227c67a1c257f64a8fd73f2c1760dc",
+  "core_version": "1.19.701",
+  "core_contract": "1.19.701",
+  "source_commit": "6c01baa69654043099e16c9bf0353eff61d2012d",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T03:16:24.200Z",
+  "built_at": "2026-09-13T03:22:47.893Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2128,
+    "functional_verbatim": 2130,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2629,
-  "tree_sha256": "3e7d4889874e8dafb6bc2f7d30722f62c5495396f2760d7a3d06985a79b6adb8",
+  "file_count": 2631,
+  "tree_sha256": "640bb539971ad78a750aa80116d26c7f1f81fc1b2afb21ef0fd33855189fe10a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ba12cd298d7b45de5f7764920115a0419101b4ba4f172ef3ff95ef8798c57508"
+      "sha256": "4fc39aaaae76afb8153485474fc9f3459a2ee380b96f59d1d693a4a7680db464"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5642,7 +5642,7 @@
     {
       "path": "modules/lifecycle/conflict-resolve.js",
       "mode": "0000644",
-      "sha256": "3e20f4965d1d83d17f8e777201bd7e4fd7857843295180542914de16ae51e936"
+      "sha256": "4114eb2632a95a9b830956d0e476ad92ed6eaaa526d9bd46e7ddba8a6fb566e3"
     },
     {
       "path": "modules/lifecycle/criterion-suggest.js",
@@ -5729,6 +5729,11 @@
       "mode": "0000644",
       "sha256": "23ee20e57c67adb5d2ec29c654d2bc469434cafa010b375a8a4452ced1df49e3"
     },
+    {
+      "path": "modules/lifecycle/executed-closure.js",
+      "mode": "0000644",
+      "sha256": "70be81206f577910d250e70ed0841466bbe329691324156b5b15bb75abcd93d3"
+    },
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
@@ -5852,7 +5857,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "28c61d55fe2b492f0fce4c99b60e88f0cbeb542c47c04482558818d65628e0d7"
+      "sha256": "9f3e3ae52f9fa49a1f5638d92a4b985d0c23fe0433d917d017aa78876c41ca43"
     },
     {
       "path": "modules/lifecycle/rot.js",
@@ -7777,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4cab339364e2c40b9adb593184fe0c78b8775c11203d6551d019c12de6675e5d"
+      "sha256": "f7fb304e4955f8024186863281f2540c2e92299e49b16f7f6ea0f78c6d46d22a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ed864f4879e51f4bc1adf7222e46b6fb9446fa93d59ea3b17bc26dbde19f18e2"
+      "sha256": "be0e756de883b5e3291f721efe8515540771994df5d83f0eb96bd07f87ecf1e8"
     },
     {
       "path": "public-docs/index.html",
@@ -9547,7 +9552,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "46a02032df3b4b36ac48c77f8f373ee44735d00dca00ec483100ffd0f7b9062e"
+      "sha256": "2fdd8c72769bba600991d5c886878c7390ef2086f67ad8c1036555e45631a971"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10559,6 +10564,11 @@
       "mode": "0000644",
       "sha256": "d6a78357533fdeea3bc33fe97cfcd27b1d04747c600d0a7800ddfca5199dbb1f"
     },
+    {
+      "path": "tests/executed_closure.mjs",
+      "mode": "0000644",
+      "sha256": "9f4b768e74b542e080f2f2d92db3e5d7a05a66e0fe8822528a40e1b9399f178c"
+    },
     {
       "path": "tests/explore_visible_states.mjs",
       "mode": "0000644",
@@ -12222,7 +12232,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "4c7c58a1fd28427fbcace0d20a9446f88c2a90cc19eb5fd4826236207732be26"
+      "sha256": "92806699b18a064233330d844d4a5bd85ae5ebc628231be81bcdc4548063f074"
     },
     {
       "path": "tests/push_path_brief.mjs",

package/docs/module-api-changelog.md

@@ -1859,5 +1859,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.698 with no explicit bump. run 34734848584. (task 1002620)
   1.19.700 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.699 with no explicit bump. run 34735048203. (task 1002620)
+  1.19.701 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.700 with no explicit bump. run 34735311256. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/conflict-resolve.js

@@ -51,6 +51,16 @@ const githubPush = require('./github-push');
 const { repoInfo, branding } = require('../../src/module-api');
 const { loadRepoInfo } = repoInfo;
 const { registerMergeDriver } = require('../../scripts/gds/install-git-hooks');
+const { computeExecutedClosure, branchTouchesExecutedCode } = require('./executed-closure');
+
+// The closure is a property of the SERVER's trusted tree, not of the branch being
+// resolved, so it is computed once per root and cached. Asking the clone what our code
+// executes would let the branch answer the question the check exists to ask.
+const closureCache = new Map();
+function executedClosure(root) {
+  if (!closureCache.has(root)) closureCache.set(root, computeExecutedClosure({ root }));
+  return closureCache.get(root);
+}
 
 const execFileP = promisify(execFile);
 
@@ -141,7 +151,8 @@ async function hasConflictMarkers(gitIn) {
 //   { resolved: true,  head_sha, branch, regenerated }            — merged + pushed
 //   { resolved: false, skipped: '<why>' [, conflicted: [...] ] }  — left as-is
 // skipped reasons: disabled | unconfigured | already_up_to_date | clone_failed |
-//   fetch_failed | checkout_failed | markers_remain | push_failed |
+//   fetch_failed | checkout_failed | diff_failed | branch_modifies_executed_code
+//   (with executes[]) | markers_remain | push_failed |
 //   unresolvable_conflict (with conflicted[]) | generator_failed | commit_failed.
 // `regenerated` says whether step 7b had to commit post-merge generator drift on top
 // of the merge (task 1003546) — head_sha is that commit when it did.
@@ -211,6 +222,28 @@ async function resolveBranchConflicts({ branch } = {}, deps = {}) {
     if (r.code !== 0) return { resolved: false, skipped: 'checkout_failed' };
     const before = (await git(['rev-parse', 'HEAD'])).stdout.trim();
 
+    // 5b. REFUSE A BRANCH THAT EDITS THE CODE THIS FUNCTION IS ABOUT TO RUN
+    //     (task 1003367, audit B1). Everything below executes out of the clone with the
+    //     live server's environment — the merge driver at step 6 and the generators at
+    //     7b — so a branch that rewrote any of it would be running its own code as the
+    //     server. This check must sit BEFORE the merge, not after it: `git merge` invokes
+    //     `node scripts/gds/git-merge-regen.js` by RELATIVE path with cwd at the clone
+    //     root, so the driver is the clone's copy and it runs at step 6.
+    //
+    //     Fail CLOSED and hand the merge to a human. The alternative — scrubbing the
+    //     clone and running anyway — has to be right about every file it restores, and
+    //     the closure is 80-odd files deep through src/instance-config and src/bongos/*,
+    //     not the scripts/ directory alone.
+    const touched = await git(['diff', '--name-only', 'refs/remotes/origin/main...HEAD']);
+    if (touched.code !== 0) return { resolved: false, skipped: 'diff_failed' };
+    const executes = branchTouchesExecutedCode(
+      touched.stdout.split('\n'),
+      deps.executedClosure || executedClosure(repoRoot),
+    );
+    if (executes.length) {
+      return { resolved: false, skipped: 'branch_modifies_executed_code', executes };
+    }
+
     // 6. Merge origin/main into the branch. The otb-regen driver resolves the
     //    generated files; union resolves docs/adr/README.md; any genuine conflict
     //    leaves the merge non-zero.
@@ -392,7 +425,8 @@ async function defaultRunGenerators({ work, execFile = execFileP } = {}) {
 //     is a no-op for the strand.
 // Returns { refreshed: true, head_sha, branch } | { refreshed: false, skipped }.
 // skipped reasons: disabled | unconfigured | clone_failed | fetch_failed |
-//   checkout_failed | merge_conflict | generator_failed | no_regen_diff |
+//   checkout_failed | diff_failed | branch_modifies_executed_code (with executes[]) |
+//   merge_conflict | generator_failed | no_regen_diff |
 //   markers_remain | commit_failed | push_failed.
 async function refreshStaleGenerated({ branch } = {}, deps = {}) {
   const disabled = deps.disabled !== undefined ? deps.disabled : process.env.CONFLICT_RESOLVE_DISABLED === '1';
@@ -441,6 +475,22 @@ async function refreshStaleGenerated({ branch } = {}, deps = {}) {
     r = await git(['checkout', '-B', branch, `refs/remotes/origin/${branch}`]);
     if (r.code !== 0) return { refreshed: false, skipped: 'checkout_failed' };
 
+    // 4b. Same refusal as resolveBranchConflicts step 5b (task 1003367, audit B1). This
+    //     path registers no merge driver, so its only execution vector is runGenerators
+    //     at step 6 — but the check still belongs BEFORE the merge, because after it the
+    //     tree is a mix of both sides and `origin/main...HEAD` no longer answers "what
+    //     did this BRANCH change". Same closure, same fail-closed posture, so the two
+    //     heals cannot drift into different security postures.
+    const touched = await git(['diff', '--name-only', 'refs/remotes/origin/main...HEAD']);
+    if (touched.code !== 0) return { refreshed: false, skipped: 'diff_failed' };
+    const executes = branchTouchesExecutedCode(
+      touched.stdout.split('\n'),
+      deps.executedClosure || executedClosure(repoRoot),
+    );
+    if (executes.length) {
+      return { refreshed: false, skipped: 'branch_modifies_executed_code', executes };
+    }
+
     // 5. Merge origin/main. Expected CLEAN for this strand (the PR was mergeable and
     //    the failing signal was a stale-generated CHECK, not a conflict). A genuine
     //    conflict → abort + report merge_conflict so the resolveBranchConflicts path

package/modules/lifecycle/executed-closure.js

@@ -0,0 +1,183 @@
+// modules/lifecycle/executed-closure.js — which files does the merge resolver EXECUTE
+// out of a builder's branch? (task 1003367, audit ref B1, 2026-08-29 security audit.)
+//
+// WHY. resolveBranchConflicts and refreshStaleGenerated clone a builder's branch into a
+// temp tree and run code out of it with the LIVE SERVER's environment — DATABASE_URL,
+// BUILDER_SECRET_KEY, GITHUB_PUSH_TOKEN, DISCORD_BOT_TOKEN all inherited. That happens
+// on two separate paths, and the second one is easy to miss:
+//
+//   1. the `otb-regen` MERGE DRIVER. registerMergeDriver writes the driver command
+//      `node scripts/gds/git-merge-regen.js %O %A %B %P` with cwd at the clone root, so
+//      git runs the CLONE's copy during `git merge` — before any post-merge step.
+//   2. the GENERATORS, run after the merge as execFile(node, [<clone>/scripts/gds/…]).
+//
+// Both resolve their repo root from __dirname, which is why the trusted-code problem
+// cannot be solved by pointing them at the server's own copy: a server-rooted
+// git-merge-regen.js would regenerate the SERVER's checkout instead of the clone.
+//
+// WHAT THIS MODULE IS FOR. The audit prescribed restoring scripts/gds/ from origin/main.
+// That is not sufficient on its own: every generator requires ../../src/instance-config,
+// and gen-api-docs additionally requires src/bongos/route-rank-check, api-prefix and
+// routes/_helpers. A restore scoped to scripts/gds/ leaves those builder-controlled and
+// the hole open. So rather than curate a list by hand, we COMPUTE the transitive
+// require-closure of the real entrypoints and let the callers refuse to auto-resolve a
+// branch that touches any of it.
+//
+// The closure is computed against the SERVER's trusted tree on purpose. The question is
+// "what does OUR code execute", and asking the clone would let the branch answer it.
+//
+// THE RESIDUAL ASSUMPTION, stated so it can be re-checked rather than rediscovered.
+// This is a STATIC walk of string-literal require()s, so it is sound exactly as far as
+// that style holds. A computed require of real code — string concatenation, a template
+// literal, a variable — inside a closure member would be invisible here and the closure
+// would under-report what a branch can make the server run. That is not hypothetical:
+// src/module-loader/loader.js is in the closure and computed-requires every module's
+// route file, but only from loadModules(), which nothing on the generator path calls.
+// tests/executed_closure.mjs pins the known computed requires per file and fails the
+// build on a new one — which catches a change to OUR tree, and is therefore a tripwire,
+// not a widening. If a generator ever starts loading modules, or a closure member
+// switches to dynamic require, this walk must grow to match before it is trusted again.
+//
+// COST. computeExecutedClosure does synchronous readFileSync/statSync over ~80 files.
+// It runs in the live server process, so that is worth knowing — but it is called from a
+// ~5-minute background sweep, never a request path, and conflict-resolve.js caches it per
+// repo root for the process lifetime. Revisit if the entrypoint set grows a lot, or if
+// the cache key ever stops being a constant.
+//
+// Route files are deliberately NOT in here: src/bongos/route-rank-check.js reads them as
+// DATA, never require()s them (ADR 0083's one-way rule, and its own comment says so), and
+// gen-api-docs scans route sources textually. That distinction is what makes a narrow
+// closure correct — the resolver still REGENERATES from the builder's merged tree, it
+// just never EXECUTES it.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+
+// The two execution roots, as repo-relative POSIX paths.
+//
+// BOTH script-tree spellings are listed while the compat shim exists. Task 1003705 moves
+// these to scripts/bongos/ and leaves scripts/gds/ holding WORKING forwarders, which git
+// still executes by the driver's relative path — so a guard that knew only the new name
+// would stop seeing edits to code that still runs. Missing entries are skipped, so this
+// is correct before the rename, during the shim window, and after C3d retires it.
+const ENTRYPOINTS = Object.freeze([
+  // 1. the merge driver (runs DURING `git merge`)
+  'scripts/gds/git-merge-regen.js',
+  'scripts/bongos/git-merge-regen.js',
+  // 2. the generators (run after the merge) — mirrors GENERATOR_SCRIPTS in
+  //    conflict-resolve.js; asserted identical by tests/executed_closure.mjs so the two
+  //    lists cannot drift apart.
+  'scripts/gds/gen-repo-map.js',
+  'scripts/bongos/gen-repo-map.js',
+  'scripts/gds/gen-file-map.js',
+  'scripts/bongos/gen-file-map.js',
+  'scripts/gds/gen-session-index.js',
+  'scripts/bongos/gen-session-index.js',
+  'scripts/gds/copy-inventory.js',
+  'scripts/bongos/copy-inventory.js',
+  'scripts/gds/gen-api-docs.js',
+  'scripts/bongos/gen-api-docs.js',
+  'scripts/gds/gen-api-client.js',
+  'scripts/bongos/gen-api-client.js',
+]);
+
+// Files that are not require()d but still decide what runs. .gitattributes names which
+// paths the otb-regen driver is applied to, so editing it changes what git hands the
+// driver and how much of the tree that driver rewrites during a merge.
+const TRUSTED_NON_CODE = Object.freeze(['.gitattributes']);
+
+const REQUIRE_RE = /\brequire\(\s*(['"])([^'"]+)\1\s*\)/g;
+
+function toPosix(p) {
+  return p.split(path.sep).join('/');
+}
+
+// Resolve a relative require specifier to a repo-relative file, trying the extensions
+// node would. Returns null for bare/`node:` specifiers and for anything that escapes the
+// repo — a require that leaves the tree is not a file a branch can edit.
+function resolveRelative(fromFileAbs, spec, { root }) {
+  if (!spec.startsWith('.')) return null;
+  const base = path.resolve(path.dirname(fromFileAbs), spec);
+  const candidates = [base, base + '.js', base + '.json', path.join(base, 'index.js')];
+  for (const c of candidates) {
+    let st;
+    try {
+      st = fs.statSync(c);
+    } catch {
+      continue;
+    }
+    if (!st.isFile()) continue;
+    const rel = toPosix(path.relative(root, c));
+    if (!rel || rel.startsWith('..') || path.isAbsolute(rel)) return null;
+    return rel;
+  }
+  return null;
+}
+
+// computeExecutedClosure — every file the resolver can execute out of a cloned branch.
+//
+// A STATIC walk of require() literals. It deliberately does not try to follow a computed
+// require: the one that exists (gen-api-docs' require(path.join(CORE_ROOT,
+// 'package.json'))) resolves to package.json, which is parsed as JSON rather than run.
+// If a computed require of real CODE is ever added, the closure would under-report — so
+// tests/executed_closure.mjs fails the build on any computed require inside the closure,
+// which is the honest way to hold a static analysis to its assumption.
+function computeExecutedClosure({ root = REPO_ROOT, entrypoints = ENTRYPOINTS } = {}) {
+  const seen = new Set();
+  const queue = [];
+
+  for (const rel of entrypoints) {
+    const abs = path.join(root, rel);
+    if (fs.existsSync(abs)) queue.push(rel);
+  }
+
+  while (queue.length) {
+    const rel = queue.shift();
+    if (seen.has(rel)) continue;
+    seen.add(rel);
+
+    const abs = path.join(root, rel);
+    let src;
+    try {
+      src = fs.readFileSync(abs, 'utf8');
+    } catch {
+      continue;
+    }
+    REQUIRE_RE.lastIndex = 0;
+    let m;
+    while ((m = REQUIRE_RE.exec(src))) {
+      const next = resolveRelative(abs, m[2], { root });
+      if (next && !seen.has(next)) queue.push(next);
+    }
+  }
+
+  for (const rel of TRUSTED_NON_CODE) seen.add(rel);
+  return Object.freeze([...seen].sort());
+}
+
+// branchTouchesExecutedCode — pure predicate over `git diff --name-only` output.
+//
+// Returns the SORTED INTERSECTION rather than a boolean so the caller can name the
+// offending files in its skip reason. A resolver that refuses without saying which file
+// tripped it is one nobody can act on.
+function branchTouchesExecutedCode(touchedPaths, closure) {
+  const inClosure = new Set(closure);
+  const hits = [];
+  for (const raw of touchedPaths || []) {
+    const rel = toPosix(String(raw).trim());
+    if (rel && inClosure.has(rel)) hits.push(rel);
+  }
+  return [...new Set(hits)].sort();
+}
+
+module.exports = {
+  ENTRYPOINTS,
+  TRUSTED_NON_CODE,
+  REPO_ROOT,
+  computeExecutedClosure,
+  branchTouchesExecutedCode,
+};

package/modules/lifecycle/publish-reconciler.js

@@ -386,6 +386,21 @@ async function runSweep(deps = {}) {
                   `strand:unresolvable_conflict${files ? `:${files}` : ''}`,
                   `PR #${m.number} (${branch}) has a hand-written conflict (${files || 'unknown files'}) only its builder can resolve`
                 );
+              } else if (rr && rr.skipped === 'branch_modifies_executed_code') {
+                // task 1003367 (audit B1): DEFINITIVE in exactly the sense P-3 means it —
+                // the resolver refused because the branch edits code the resolver would
+                // have executed, and no number of later sweeps changes that. Without this
+                // branch the skip fell through both chains with no log and no flag, so the
+                // PR retried silently every ~5 min forever. Announcing it is not polish:
+                // a refusal nobody is told about is indistinguishable from a resolver that
+                // quietly stopped working, and this file's own header says a strand must
+                // reach its builder when it is DETECTED.
+                const files = (rr.executes || []).slice(0, 5).join(',');
+                await announceStrand(
+                  r,
+                  `strand:branch_modifies_executed_code${files ? `:${files}` : ''}`,
+                  `PR #${m.number} (${branch}) changes code the merge resolver executes (${files || 'unknown files'}) — it will not be auto-resolved; a human must land it`
+                );
               }
             } catch (e) {
               errFn(`[publish-reconciler] conflict-resolve for task ${r.task_id} (non-blocking): ${e && e.message}`);
@@ -470,6 +485,19 @@ async function runSweep(deps = {}) {
                   logFn(
                     `[publish-reconciler] task ${r.task_id} (${branch}) PR #${m.number} red (${m.reason}) but regeneration produced no diff — a real check failure, left for a human`
                   );
+                } else if (rr && rr.skipped === 'branch_modifies_executed_code') {
+                  // task 1003367 (audit B1). A tree-level determination, so it burns a cap
+                  // slot like the two above rather than retrying as if it were flaky infra:
+                  // the answer is the same on every future sweep. Announced for the same
+                  // reason as the conflict path — silence here is a PR that never lands and
+                  // never says why.
+                  attempts.set(branch, n + 1);
+                  const files = (rr.executes || []).slice(0, 5).join(',');
+                  await announceStrand(
+                    r,
+                    `strand:branch_modifies_executed_code${files ? `:${files}` : ''}`,
+                    `PR #${m.number} (${branch}) changes code the regen heal executes (${files || 'unknown files'}) — it will not be auto-healed; a human must land it`
+                  );
                 }
               } catch (e) {
                 errFn(`[publish-reconciler] regen-heal for task ${r.task_id} (non-blocking): ${e && e.message}`);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.700",
+  "version": "1.19.701",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.700",
+      "version": "1.19.701",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.700",
+  "version": "1.19.701",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.700'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.701'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/executed_closure.mjs

@@ -0,0 +1,257 @@
+// tests/executed_closure.mjs — task 1003367, audit ref B1 (2026-08-29 security audit).
+//
+// THE DEFECT. resolveBranchConflicts and refreshStaleGenerated clone a builder's branch
+// and run code out of it with the live server's environment. The audit prescribed
+// restoring scripts/gds/ and .gitattributes from origin/main after the merge and before
+// runGenerators. Building it that way would have left the hole open TWICE, and both of
+// those are what these tests pin:
+//
+//   TOO NARROW — the generators require ../../src/instance-config, and gen-api-docs also
+//     requires src/bongos/route-rank-check, api-prefix and routes/_helpers. A restore
+//     scoped to scripts/gds/ leaves those builder-controlled and still executed.
+//   TOO LATE   — `git merge` runs the otb-regen driver, whose registered command is
+//     `node scripts/gds/git-merge-regen.js` by RELATIVE path with cwd at the clone root.
+//     That is the clone's copy, and it runs at the merge, before any post-merge step.
+//
+// So the assertions below care about two things: that the closure reaches past
+// scripts/, and that the refusal happens BEFORE git merge is ever issued.
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ec = require('../modules/lifecycle/executed-closure.js');
+const cr = require('../modules/lifecycle/conflict-resolve.js');
+
+// fileURLToPath, not URL.pathname: the latter percent-encodes spaces and leaves a Windows
+// drive behind a leading slash (tests/test_path_guard.mjs fails the build on it).
+const REPO_ROOT = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
+const CLOSURE = ec.computeExecutedClosure();
+
+// ---- what the closure must reach ------------------------------------------
+
+test('the closure reaches the src/ files a scripts/-only restore would have missed', () => {
+  // The exact four the audit's prescription would have left builder-writable. If this
+  // ever goes quiet it means the generators stopped requiring them, which is a reason to
+  // re-derive the fix, not to delete the test.
+  for (const rel of [
+    'src/instance-config.js',
+    'src/bongos/route-rank-check.js',
+    'src/bongos/api-prefix.js',
+    'src/bongos/routes/_helpers.js',
+  ]) {
+    assert.ok(CLOSURE.includes(rel),
+      `${rel} is require()d by a generator the resolver executes, so a branch editing it `
+      + 'runs code as the server — it must be in the executed closure');
+  }
+});
+
+test('the closure includes the MERGE DRIVER, not just the generators', () => {
+  // The half the audit's "after the merge" framing missed entirely.
+  const driver = CLOSURE.filter((f) => /git-merge-regen\.js$/.test(f));
+  assert.ok(driver.length > 0,
+    'git-merge-regen.js runs DURING git merge as the clone\'s own copy — omitting it '
+    + 'would leave the earliest execution vector unguarded');
+});
+
+test('the closure is deep, not just the entrypoints', () => {
+  // A static walk that silently failed to follow requires would still "pass" the two
+  // tests above if it happened to list them. Depth is the evidence it actually walked:
+  // the entrypoints alone are a dozen files.
+  assert.ok(CLOSURE.length > 40,
+    `closure has only ${CLOSURE.length} files — the require walk is probably not recursing`);
+});
+
+test('.gitattributes is guarded even though nothing requires it', () => {
+  assert.ok(CLOSURE.includes('.gitattributes'),
+    'it decides which paths the otb-regen driver is applied to, so it changes what runs');
+});
+
+// ---- holding the static analysis to its own assumption ---------------------
+
+test('every computed require inside the closure is one we have accounted for', () => {
+  // computeExecutedClosure follows string-literal requires only, so it is sound exactly
+  // as far as that assumption holds. Rather than assert the assumption (it is false —
+  // there are computed requires in here), pin the KNOWN set with a reason each, and fail
+  // on anything new. A computed require that appears later is the case where the closure
+  // would silently under-report what a branch can make the server execute.
+  //
+  // Why each known one does not widen the closure IN PRACTICE: all of them sit inside a
+  // function body, so they resolve when that function is CALLED, and nothing on the
+  // generator path calls them. src/module-loader/loader.js is the one worth naming —
+  // it is reachable (gen-file-map -> claude-materialize -> bin/bongos.js -> init.js ->
+  // module-api -> modules.js -> loader.js) and it computed-requires every module's route
+  // file, but only from loadModules(), which generation never invokes. If a generator
+  // ever loads modules, this closure must grow to cover modules/**/routes/*.js.
+  const ACCOUNTED = new Map([
+    ['src/module-loader/loader.js', 2],   // routes/<key>.js + pollerPath, from loadModules()
+    ['scripts/gds/onboard.js', 3],        // provision/oauth-secret/onboardPlan, inside the verb
+    ['scripts/gds/package-core.js', 5],   // publish-manifest/mirror-redact/secret-scrub/…
+    ['scripts/gds/upgrade.js', 1],        // a `node -e` child, not a require in this process
+    ['scripts/gds/gen-api-docs.js', 1],   // require(path.join(CORE_ROOT,'package.json')) — JSON
+  ]);
+
+  // Strip line comments and single/double-quoted strings first: prose and message strings
+  // that merely CONTAIN the word were the bulk of the first run's hits.
+  const strip = (src) => src
+    .split('\n')
+    .map((l) => l.replace(/\/\/.*$/, ''))
+    .join('\n')
+    .replace(/'(?:[^'\\]|\\.)*'/g, "''")
+    .replace(/"(?:[^"\\]|\\.)*"/g, '""')
+    .replace(/`(?:[^`\\]|\\.)*`/g, '``');
+
+  const found = new Map();
+  for (const rel of CLOSURE) {
+    if (!rel.endsWith('.js')) continue;
+    let src;
+    try { src = fs.readFileSync(path.join(REPO_ROOT, rel), 'utf8'); } catch { continue; }
+    const hits = (strip(src).match(/\brequire\(\s*[^'")\s]/g) || []).length;
+    if (hits) found.set(rel, hits);
+  }
+
+  const unexpected = [...found.keys()].filter((f) => !ACCOUNTED.has(f)).sort();
+  assert.deepEqual(unexpected, [],
+    'a NEW computed require appeared inside the executed closure — decide whether it can '
+    + 'load code out of a cloned branch before adding it to ACCOUNTED');
+
+  for (const [file, n] of ACCOUNTED) {
+    if (!found.has(file)) continue; // the file left the closure; the next assertion covers that
+    assert.equal(found.get(file), n,
+      `${file} now has ${found.get(file)} computed require(s), not ${n} — re-check whether `
+      + 'the new one runs on the generator path');
+  }
+});
+
+test('ENTRYPOINTS covers every generator the resolver actually runs', () => {
+  // Two hand-maintained lists in two files is how a new generator gets executed without
+  // ever entering the closure. Read conflict-resolve's own list and compare by NAME.
+  const src = fs.readFileSync(path.join(REPO_ROOT, 'modules/lifecycle/conflict-resolve.js'), 'utf8');
+  const block = src.match(/const GENERATOR_SCRIPTS = \[([\s\S]*?)\];/);
+  assert.ok(block, 'could not read GENERATOR_SCRIPTS out of conflict-resolve.js');
+  const listed = [...block[1].matchAll(/'([^']+)'/g)].map((m) => m[1]);
+  assert.ok(listed.length > 0, 'GENERATOR_SCRIPTS parsed empty');
+
+  const basenames = new Set(ec.ENTRYPOINTS.map((p) => p.split('/').pop()));
+  for (const rel of listed) {
+    assert.ok(basenames.has(rel.split('/').pop()),
+      `${rel} is executed by the resolver but is not an executed-closure entrypoint`);
+  }
+});
+
+test('both script-tree spellings are entrypoints while the compat shim exists', () => {
+  // Task 1003705 moves these to scripts/bongos/ and leaves scripts/gds/ holding WORKING
+  // forwarders. The driver command is a relative path, so the old spelling still
+  // executes; a guard that knew only one name would stop seeing edits to live code.
+  for (const tree of ['scripts/gds', 'scripts/bongos']) {
+    assert.ok(ec.ENTRYPOINTS.some((p) => p === `${tree}/git-merge-regen.js`),
+      `${tree}/git-merge-regen.js must be an entrypoint while both trees can execute`);
+  }
+});
+
+// ---- the predicate ---------------------------------------------------------
+
+test('branchTouchesExecutedCode returns the sorted, deduped intersection', () => {
+  const closure = ['.gitattributes', 'src/a.js', 'src/b.js'];
+  assert.deepEqual(
+    ec.branchTouchesExecutedCode(['src/b.js', 'docs/x.md', 'src/a.js', 'src/b.js'], closure),
+    ['src/a.js', 'src/b.js'],
+    'the caller names the offending files in its skip reason, so order and dupes matter');
+  assert.deepEqual(ec.branchTouchesExecutedCode(['docs/x.md', 'README.md'], closure), [],
+    'an ordinary branch must not be refused');
+  assert.deepEqual(ec.branchTouchesExecutedCode(['', '  ', null], closure), [],
+    'blank lines from git output are not matches');
+});
+
+// ---- the guard, and WHEN it fires ------------------------------------------
+
+// Minimal git seam. Records every command so the ORDER can be asserted -- that is the
+// whole point of this fix, not merely that a refusal happened.
+function mkExec(touched) {
+  const calls = [];
+  const exec = async (args) => {
+    calls.push(args);
+    let a = args;
+    if (a[0] === '-C') a = a.slice(2);
+    const sub = a.join(' ');
+    if (a[0] === 'diff' && sub.includes('origin/main...HEAD')) {
+      return { code: 0, stdout: `${touched.join('\n')}\n`, stderr: '' };
+    }
+    if (a[0] === 'rev-parse') return { code: 0, stdout: 'aaaaaaa\n', stderr: '' };
+    if (a[0] === 'grep') return { code: 1, stdout: '', stderr: '' };
+    return { code: 0, stdout: '', stderr: '' };
+  };
+  exec.calls = calls;
+  return exec;
+}
+
+function mkDeps(touched, over = {}) {
+  const exec = mkExec(touched);
+  return {
+    exec,
+    executedClosure: ['.gitattributes', 'src/instance-config.js', 'scripts/gds/git-merge-regen.js'],
+    runGenerators: async () => ({ code: 0 }),
+    githubPush: {
+      isConfigured: () => true,
+      isSafeBranch: () => true,
+      resolveToken: async () => 'tok',
+      buildAuthUrl: () => 'https://x-access-token:REDACTED@github.com/o/r.git',
+    },
+    repoInfo: { owner: 'o', repo: 'r' },
+    registerMergeDriver: () => {},
+    repoRoot: '/srv/repo',
+    mkdtemp: () => '/tmp/otb-closure-test',
+    rmtmp: () => {},
+    ...over,
+    _exec: exec,
+  };
+}
+
+const ranMerge = (exec) => exec.calls.some((c) => {
+  const a = c[0] === '-C' ? c.slice(2) : c;
+  return a[0] === 'merge' && a[1] !== '--abort';
+});
+
+for (const [label, fn, okKey] of [
+  ['resolveBranchConflicts', (d) => cr.resolveBranchConflicts({ branch: 'task-1' }, d), 'resolved'],
+  ['refreshStaleGenerated', (d) => cr.refreshStaleGenerated({ branch: 'task-1' }, d), 'refreshed'],
+]) {
+  test(`${label} refuses a branch that edits code it would execute`, async () => {
+    const deps = mkDeps(['docs/x.md', 'src/instance-config.js']);
+    const r = await fn(deps);
+    assert.equal(r[okKey], false);
+    assert.equal(r.skipped, 'branch_modifies_executed_code');
+    assert.deepEqual(r.executes, ['src/instance-config.js'],
+      'the refusal must name the file, or nobody can act on it');
+  });
+
+  test(`${label} refuses BEFORE running git merge`, async () => {
+    // The assertion that distinguishes this fix from the one the audit prescribed. A
+    // post-merge restore would already have run the branch's merge driver by now.
+    const deps = mkDeps(['scripts/gds/git-merge-regen.js']);
+    const r = await fn(deps);
+    assert.equal(r.skipped, 'branch_modifies_executed_code');
+    assert.equal(ranMerge(deps._exec), false,
+      'git merge ran despite the refusal — the clone\'s own merge driver would have '
+      + 'executed, which is the earlier of the two vectors this task closes');
+  });
+
+  test(`${label} still proceeds for an ordinary branch`, async () => {
+    // Red-capability for the two above: if the guard refused everything, they would pass
+    // for the wrong reason.
+    const deps = mkDeps(['docs/x.md', 'modules/hall-ui/public/shell.js']);
+    const r = await fn(deps);
+    assert.notEqual(r.skipped, 'branch_modifies_executed_code');
+    assert.equal(ranMerge(deps._exec), true, 'an ordinary branch must still be merged');
+  });
+
+  test(`${label} refuses on a .gitattributes edit`, async () => {
+    const deps = mkDeps(['.gitattributes']);
+    const r = await fn(deps);
+    assert.equal(r.skipped, 'branch_modifies_executed_code');
+  });
+}

package/tests/publish_reconciler.mjs

@@ -1763,3 +1763,61 @@ test('1003217 an older deps bundle with no `raised` key still logs on reconciled
   assert.equal(logs.length, 1);
   assert.doesNotMatch(logs[0], /raised/, 'no phantom "raised 0" noise when the key is absent');
 });
+
+// ---------------------------------------------------------------------------
+// task 1003367 (audit B1) — the resolver's new refusal must REACH someone.
+//
+// Round 1 of this task's grade failed on exactly this: the guard was written, its
+// comment said "hand the merge to a human", and no call site told anyone. The skip
+// reason fell through both if/else chains with no log line and no strand flag, so a
+// PR stuck on it retried silently every ~5 min forever. These pin the announcement,
+// not the refusal — the refusal itself lives in tests/executed_closure.mjs.
+// ---------------------------------------------------------------------------
+
+test('1003367 a branch that edits resolver-executed code flags the strand immediately, naming the file', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 620, builder_id: 6, worktree_name: 'wt-exec', title: 'x', security_sensitive: false,
+             confirmed_at: new Date().toISOString() }],
+    mergeByBranch: { 'claude/wt-exec': { merged: false, merged_now: false, number: 620, reason: 'merge_conflict' } },
+    conflictResolveImpl: async () => ({
+      resolved: false, skipped: 'branch_modifies_executed_code', executes: ['src/instance-config.js'],
+    }),
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(deps._calls.flag.length, 1, 'a definitive refusal is flagged on THIS sweep, not left to the stale WARN');
+  assert.equal(deps._calls.flag[0].taskId, 620);
+  assert.match(deps._calls.flag[0].reason, /^strand:branch_modifies_executed_code:src\/instance-config\.js/,
+    'the reason names the offending file, so the builder knows what to take out of the branch');
+  assert.ok(deps._calls.errors.some((m) => /STRAND task 620/.test(m)),
+    'and it WARNs — an unannounced refusal is indistinguishable from a resolver that quietly stopped');
+  assert.equal(r.reconciled, 0, 'such a PR still never ships');
+});
+
+test('1003367 the regen-heal path announces the same refusal rather than retrying it forever', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 621, builder_id: 6, worktree_name: 'wt-exec2', title: 'x', security_sensitive: false,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-exec2': PENDING },
+    mergeByBranch: { 'claude/wt-exec2': mergeableRed('failing_check:unit') },
+    refreshStaleImpl: async () => ({
+      refreshed: false, skipped: 'branch_modifies_executed_code', executes: ['.gitattributes'],
+    }),
+  });
+  await reconciler.runSweep(deps);
+  assert.equal(deps._calls.flag.length, 1, 'the second heal path must not be the silent one');
+  assert.match(deps._calls.flag[0].reason, /^strand:branch_modifies_executed_code:\.gitattributes/);
+});
+
+test('1003367 an ordinary skip on either path still announces NOTHING', async () => {
+  // Red-capability for the two above: if every skip reason announced, they would pass
+  // for the wrong reason and the "definitive vs transient" distinction would be gone.
+  const deps = mkDeps({
+    rows: [{ task_id: 622, builder_id: 6, worktree_name: 'wt-ok', title: 'x', security_sensitive: false,
+             confirmed_at: new Date().toISOString() }],
+    mergeByBranch: { 'claude/wt-ok': { merged: false, merged_now: false, number: 622, reason: 'merge_conflict' } },
+    conflictResolveImpl: async () => ({ resolved: false, skipped: 'clone_failed' }),
+  });
+  await reconciler.runSweep(deps);
+  assert.equal(deps._calls.flag.length, 0,
+    'a transient infra miss must keep retrying quietly, not flag the builder');
+});