@bongos/core 1.19.702 → 1.19.704

package/tests/government_protected_surfaces.mjs

@@ -92,7 +92,89 @@ const EXPECTED_GLOBS_BEFORE_R101 = [
 // Each entry is { after, glob, why }: `after` is the glob it is inserted
 // directly below, so the expected list is reconstructed in order rather than
 // re-pasted (a re-paste is how the two lists drift apart).
-const ADDED_SINCE_R101 = [];
+// CONSIDERED AND DELIBERATELY NOT ADDED: `.claude/agents/` (task 1002492).
+//
+// It looks like it belongs — an agent definition is local automation that fires
+// on its own and declares its own scope, which is the stated reason
+// `.claude/hooks/` and `.claude/settings.json` sit in the automation group. It
+// was added, and backed out, because protectedness is DERIVED PER MODULE:
+// module-scope-map marks a module protected when ANY of its globs is, and
+// `.claude/agents/` is one of the `agents` module's globs. So the entry silently
+// rank-walls the WHOLE agents module — `modules/agents/` source included — and
+// with it goals 1000038/39/40, changing who may work them. Two guards caught it:
+// module-scope-map's "derived, not hand-set" assertion and publish_manifest's
+// rule that every protected glob be explicitly excluded or publishable.
+//
+// That is a policy decision about a rank floor on three goals. It is NOT the
+// decision task 1002492 was for — "an agent may not scope itself onto the
+// authority surface" — which the scope_paths wall in
+// modules/agents/lib/validate.js now enforces on its own. Protecting the
+// directory would gate who may EDIT a definition; it does nothing about where a
+// definition POINTS.
+//
+// If the owner does want the agents module rank-walled, it needs the entry here,
+// a publish-manifest carve-out, and the module-scope-map roster test updated —
+// three deliberate edits, not a side effect of a scope fix.
+const ADDED_SINCE_R101 = [
+  // task 1003366, audit ref MIT1 (2026-08-29 security audit, goal 1000084). The EIGHT
+  // execution roots the merge resolver runs out of a cloned branch. The audit named four
+  // of them ("the three gen-* scripts and .gitattributes"); modules/lifecycle/executed-
+  // closure.js names eight, so the audit's prose was already stale against shipped code.
+  // The drift tripwire below is what keeps this list honest from here.
+  {
+    after: 'scripts/gds/cli-lib.js',
+    glob: 'scripts/gds/git-merge-regen.js',
+    why: 'the otb-regen MERGE DRIVER. Registered as a relative command with cwd at the '
+       + 'clone root, so git merge runs the BRANCH copy with the live server environment '
+       + 'BEFORE any post-merge step — the earliest execution vector, and the one the '
+       + "audit's \"after the merge\" framing missed.",
+  },
+  {
+    after: 'scripts/gds/git-merge-regen.js',
+    glob: 'scripts/gds/gen-repo-map.js',
+    why: 'a post-merge generator the resolver runs as execFile(node, [<clone>/...]) — the '
+       + "branch's own copy, inheriting DATABASE_URL and BUILDER_SECRET_KEY.",
+  },
+  {
+    after: 'scripts/gds/gen-repo-map.js',
+    glob: 'scripts/gds/gen-file-map.js',
+    why: 'a post-merge generator the resolver executes out of the clone, on the same path '
+       + 'as gen-repo-map.js.',
+  },
+  {
+    after: 'scripts/gds/gen-file-map.js',
+    glob: 'scripts/gds/gen-session-index.js',
+    why: 'a post-merge generator the resolver executes out of the clone, on the same path '
+       + 'as gen-repo-map.js.',
+  },
+  {
+    after: 'scripts/gds/gen-session-index.js',
+    glob: 'scripts/gds/copy-inventory.js',
+    why: 'a post-merge generator the resolver executes out of the clone. NOT one of the '
+       + "audit's \"gen-* trio\" — it is the first of the four roots that prose omitted, "
+       + 'which is why this registry is pinned to the closure rather than to the audit.',
+  },
+  {
+    after: 'scripts/gds/copy-inventory.js',
+    glob: 'scripts/gds/gen-api-docs.js',
+    why: 'a post-merge generator the resolver executes out of the clone, and the widest '
+       + 'one: it require()s src/bongos/route-rank-check, api-prefix and routes/_helpers, '
+       + 'which is why a restore scoped to scripts/gds/ was never sufficient.',
+  },
+  {
+    after: 'scripts/gds/gen-api-docs.js',
+    glob: 'scripts/gds/gen-api-client.js',
+    why: 'a post-merge generator the resolver executes out of the clone, inheriting the '
+       + 'live server environment like its siblings.',
+  },
+  {
+    after: 'scripts/gds/gen-api-client.js',
+    glob: '.gitattributes',
+    why: 'never require()d, so it is not code — but it NAMES which paths git hands the '
+       + 'otb-regen driver, so editing it changes how much of the tree that driver '
+       + 'rewrites during a merge. executed-closure.js carries it as TRUSTED_NON_CODE.',
+  },
+];
 
 // Surfaces RENAMED since R101 — still protected, under a new path. Distinct from
 // a removal on purpose: a rename keeps the protection and moves it, a removal
@@ -172,6 +254,55 @@ test('every glob added since R101 carries a documented reason', () => {
   }
 });
 
+// ---------- the drift tripwire: every EXECUTION ROOT is a protected surface ----------
+//
+// task 1003366, audit ref MIT1. The audit prescribed "the three gen-* scripts and
+// .gitattributes" — four surfaces. modules/lifecycle/executed-closure.js (task 1003367,
+// ref B1) names SEVEN execution roots plus .gitattributes, because GENERATOR_SCRIPTS grew
+// after the audit was written. Pasting the audit's four names in would therefore have
+// shipped a hand-curated list that was ALREADY stale on the day it landed, leaving
+// git-merge-regen.js — the earliest vector of the three — writable by any rank.
+//
+// So the registry is pinned to the closure's own ENTRYPOINTS, and this test is what makes
+// the pin real: add a generator to GENERATOR_SCRIPTS (executed_closure.mjs already asserts
+// those two lists are identical) and the build reds HERE until the registry grows to match.
+//
+// WHY THE ENTRYPOINTS AND NOT THE WHOLE 81-FILE CLOSURE — two controls, different jobs:
+//   - the closure's TRANSITIVE TAIL is enforced by conflict-resolve.js steps 5b/4b, which
+//     REFUSE to auto-resolve a branch touching any of the 81. That refusal is substrate:
+//     it does not depend on the builder cooperating, and it cannot drift, because it is
+//     computed rather than listed.
+//   - this registry is COOPERATIVE (pre-push hook, grader pre-pass, main-audit). Its job
+//     is the rank floor and the audit trail. The task says so: MIT1 is the interim
+//     mitigation, B1 is the close.
+// Listing all 81 here would add no enforcement the refusal does not already provide, while
+// floor-gating ordinary source at Metic — src/bongos/logger.js, src/branding.js and
+// src/build-info.js are all in the closure — and locking newcomers out of routine work.
+// The entrypoints are different in kind: they exist ONLY to be executed by the pipeline,
+// which is exactly what group 'pipeline' already means for ship.js and gate-review.js.
+test('every execution root in the closure is a protected surface (MIT1 drift tripwire)', () => {
+  const ec = require(path.join(ROOT, 'modules', 'lifecycle', 'executed-closure.js'));
+  // ENTRYPOINTS lists both script-tree spellings across the C-series rename window; only
+  // the ones that exist can be executed, so only those must be protected.
+  const roots = [
+    ...ec.ENTRYPOINTS.filter((rel) => fs.existsSync(path.join(ROOT, rel))),
+    ...ec.TRUSTED_NON_CODE,
+  ];
+  assert.ok(roots.length >= 8,
+    'fixture sanity: the closure must declare the execution roots this test checks');
+  for (const rel of roots) {
+    const surface = ppc.surfaceFor(rel);
+    assert.ok(surface,
+      `${rel} is an EXECUTION ROOT — the merge resolver runs it out of a cloned branch `
+      + 'with the live server environment — but no protected surface covers it. Add it to '
+      + 'modules/government/protected-surfaces.json (group "pipeline") and declare it in '
+      + 'ADDED_SINCE_R101 above.');
+    assert.ok(ppc.RANK_TIER[surface.floor] >= ppc.RANK_TIER.metic,
+      `${rel} is an execution root floored at '${surface.floor}' — below Metic it stays `
+      + 'writable by the ranks ADR 0043 keeps out of the pipeline.');
+  }
+});
+
 // Metic is a FLOOR, not a fixed value (task 1003191). Pinning every surface to
 // exactly 'metic' made the registry's own contract untestable and, worse,
 // illegal: governance owns this data and raising one surface to 'archon' is a