@bongos/core 1.19.703 → 1.19.705

package/tests/agents_validate.mjs

@@ -41,7 +41,15 @@ const OK_DEF = Object.freeze({
   model_tier: 'default',
   scope_modules: ['agents'],
 });
-const OPTS = Object.freeze({ authorRank: 'archon', allowedModules: ['agents'] });
+// task 1002492 added the scope_paths half of the rank wall, and with it the rule
+// that DECLARING paths requires the caller to supply the means to check them —
+// there is no `allowedPaths` counterpart to fail closed on, so an absent matcher
+// would be a silent hole. The baseline options therefore carry a matcher; the
+// uncheckable and protected cases each get their own test below.
+const NOTHING_PROTECTED = () => false;
+const OPTS = Object.freeze({
+  authorRank: 'archon', allowedModules: ['agents'], isProtectedPath: NOTHING_PROTECTED,
+});
 
 const codes = (r) => r.errors.map((e) => e.code);
 const hasCode = (r, code) => codes(r).includes(code);
@@ -241,6 +249,115 @@ await test('a scope_path that escapes the tree is refused', () => {
   assert.equal(validateAgentDefinition({ ...OK_DEF, scope_paths: ['modules/agents/'] }, OPTS).ok, true);
 });
 
+// --- THE scope_paths HALF OF THE WALL (task 1002492) ------------------------
+//
+// The defect this closes: the rank wall ran over scope_modules only, so
+// `scope_modules: ['government']` was refused below Metic while
+// `scope_paths: ['modules/government/']` reached the same code and passed at any
+// rank. One wall, two halves, disagreeing — and the path half was the one an
+// author would reach for to name a specific surface.
+
+const REACHES_GOVERNMENT = (p) => String(p).startsWith('modules/government');
+
+await test('a scope_path onto a protected surface is refused below the floor', () => {
+  const r = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['modules/government/catalog.js'] },
+    { authorRank: 'thetes', allowedModules: ['agents'], isProtectedPath: REACHES_GOVERNMENT }
+  );
+  assert.equal(r.ok, false, 'a thetes author may not scope onto the authority surface by path');
+  assert.ok(hasCode(r, 'scope_protected_rank'), JSON.stringify(codes(r)));
+  assert.match(r.errors.find((e) => e.code === 'scope_protected_rank').message, /scope_paths/);
+});
+
+await test('the two halves of the wall now agree', () => {
+  // The asymmetry itself, asserted: the same surface named as a module and as a
+  // path must reach the same verdict for the same author.
+  const asModule = validateAgentDefinition(
+    { ...OK_DEF, scope_modules: ['government'] },
+    { authorRank: 'thetes', allowedModules: ['agents', 'government'], protectedModules: ['government'], isProtectedPath: NOTHING_PROTECTED }
+  );
+  const asPath = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['modules/government/'] },
+    { authorRank: 'thetes', allowedModules: ['agents'], isProtectedPath: REACHES_GOVERNMENT }
+  );
+  assert.equal(asModule.ok, false, 'the module spelling was always refused');
+  assert.equal(asPath.ok, false, 'and the path spelling must be too — this is the whole task');
+  assert.ok(hasCode(asModule, 'scope_protected_rank'));
+  assert.ok(hasCode(asPath, 'scope_protected_rank'));
+});
+
+await test('a Metic+ author may scope onto a protected path', () => {
+  // The wall is a FLOOR, not a ban — a tightening that refused everyone would
+  // pass the test above while breaking the feature.
+  const r = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['modules/government/catalog.js'] },
+    { authorRank: 'metic', allowedModules: ['agents'], isProtectedPath: REACHES_GOVERNMENT }
+  );
+  assert.equal(r.ok, true, JSON.stringify(codes(r)));
+  assert.deepEqual(r.value.scope_paths, ['modules/government/catalog.js']);
+});
+
+await test('an UNPROTECTED path is unaffected at any rank', () => {
+  const r = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['modules/agents/lib/'] },
+    { authorRank: 'xenos', allowedModules: ['agents'], isProtectedPath: REACHES_GOVERNMENT }
+  );
+  assert.equal(r.ok, true, 'the wall must not become a blanket refusal of path scopes');
+});
+
+await test('declaring scope_paths with NO matcher is refused, not admitted', () => {
+  // scope_modules fails closed through `allowedModules` defaulting to empty.
+  // scope_paths has no such counterpart, so an absent matcher would be a silent
+  // hole — "nobody checked" must not read the same as "nothing was protected".
+  const r = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['anything/at/all'] },
+    { authorRank: 'archon', allowedModules: ['agents'] }
+  );
+  assert.equal(r.ok, false);
+  assert.ok(hasCode(r, 'scope_paths_uncheckable'), JSON.stringify(codes(r)));
+  // …and an ARCHON is refused too: this is not a rank question, it is a
+  // "we could not answer the question" question.
+  assert.equal(r.value, null);
+});
+
+await test('a THROWING matcher counts as a hit, never as a clean path', () => {
+  const boom = () => { throw new Error('registry unreadable'); };
+  const low = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['whatever'] },
+    { authorRank: 'xenos', allowedModules: ['agents'], isProtectedPath: boom }
+  );
+  assert.equal(low.ok, false, 'an unanswered question must not resolve to "not protected"');
+  assert.ok(hasCode(low, 'scope_protected_rank'));
+  // The floor still applies: a Metic+ author is admitted, because the
+  // fail-closed reading is "treat as protected", not "refuse everyone".
+  const high = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['whatever'] },
+    { authorRank: 'archon', allowedModules: ['agents'], isProtectedPath: boom }
+  );
+  assert.equal(high.ok, true);
+});
+
+await test('ONLY an explicit false clears a path — ambiguity reads as protected', () => {
+  // The fail-open trap: `answer === true` would read undefined (a matcher that
+  // forgot a return), a truthy string, or null as "not protected" — silently
+  // opening the wall on the exact question it exists to ask. Reading ambiguity
+  // as protected is loud and gets fixed; reading it as clean is not.
+  for (const answer of [undefined, null, 'yes', 0, '']) {
+    const r = validateAgentDefinition(
+      { ...OK_DEF, scope_paths: ['x'] },
+      { authorRank: 'xenos', allowedModules: ['agents'], isProtectedPath: () => answer }
+    );
+    assert.equal(r.ok, false, `a matcher answering ${JSON.stringify(answer)} must not clear the path`);
+    assert.ok(hasCode(r, 'scope_protected_rank'));
+  }
+  // …and a real `false` does clear it, or the wall would refuse everything.
+  const clean = validateAgentDefinition(
+    { ...OK_DEF, scope_paths: ['x'] },
+    { authorRank: 'xenos', allowedModules: ['agents'], isProtectedPath: () => false }
+  );
+  assert.equal(clean.ok, true);
+});
+
 // --- THE RANK WALL (ADR 0016 — authority is the author's LIVE rank) ---------
 
 await test('RANK_ORDER is the ladder low→high, and the scope floor is Metic', () => {

package/tests/exec_path_guard.mjs

@@ -0,0 +1,248 @@
+// tests/exec_path_guard.mjs — task 1003371, audit ref B50 (2026-08-29 security audit).
+//
+// WHAT THE CHECK IS FOR. Nothing in the repo asked what the SERVER EXECUTES, or out of
+// whose tree. route-rank-check asks who may call a route; permission-path-check asks who
+// may edit a file; neither looks at execution. All three CRITICALs in the audit lived in
+// that gap.
+//
+// WHAT THESE TESTS PIN. Two things, and the second is the one that matters:
+//   1. the check CATCHES the defect shape — a script path assembled from a runtime value;
+//   2. it does not catch everything that merely LOOKS like one. A scan that fires on
+//      `/re/.exec(s)` or on the word "spawn (" inside a sentence gets exempted into
+//      uselessness within a month, so the negative cases are pinned as hard as the
+//      positive ones. Both of those false positives were real during development.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+// fileURLToPath, not URL.pathname. Both a test (tests/test_path_guard.mjs) and a
+// fitness check (scripts/gds/test-path-guard.js, Check 30) reject the pathname form.
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
+const g = require(path.join(ROOT, 'scripts', 'gds', 'exec-path-guard.js'));
+
+const scan = (src, rel = 'modules/probe/x.js') => g.scanFile(rel, src);
+const CP = "const { execFile, execFileSync, spawn, execSync } = require('node:child_process');\n";
+
+// ---- the defect shape it must catch ---------------------------------------
+
+test('a script path built from a runtime value is flagged', () => {
+  // conflict-resolve.js:382 in miniature: arg 0 is perfectly static (process.execPath)
+  // and the DANGER is in the args array, which is why the check reads inside it.
+  const f = scan(CP + "execFile(process.execPath, [path.join(work, rel)], { cwd: work });");
+  assert.equal(f.length, 1, 'the clone-rooted script path must be reported');
+  assert.equal(f[0].role, 'script', 'the finding must name the args-array script, not arg 0');
+  assert.match(f[0].expr, /work/);
+});
+
+test('a non-static EXECUTABLE is flagged too, not just the script', () => {
+  const f = scan(CP + 'spawn(bin, args);');
+  assert.equal(f.length, 1);
+  assert.equal(f[0].role, 'executable');
+});
+
+test('a path laundered through a helper still reads as non-static (fails toward noise)', () => {
+  // The scan does not follow values across functions. The honest consequence is that an
+  // indirect path is FLAGGED rather than missed — pinned so the direction of failure is
+  // a decision on record, not an accident.
+  const f = scan(CP + 'execFile(process.execPath, [resolveScript()], {});');
+  assert.equal(f.length, 1);
+});
+
+// ---- what it must NOT catch ------------------------------------------------
+
+test("a regex's .exec() is never mistaken for child_process.exec", () => {
+  // The dominant false positive: `.exec(` outnumbers real spawner calls ~5:1 in this repo.
+  const src = "const m = /^Bearer\\s+(\\w+)$/.exec(header);\nconst k = RE.exec(line);";
+  assert.deepEqual(scan(src), [], 'a file that never requires child_process has no call sites');
+});
+
+test('the word "spawn (" inside a string is not a call site', () => {
+  // Real regression: modules/grading/grader.js carries "before worker spawn
+  // (GRADER_BYPASS_ENABLED / runOpts.bypass)" in a note string, and the first draft
+  // reported that sentence as an executed path.
+  const src = CP + "const note = 'Grader bypassed before worker spawn (GRADER_BYPASS_ENABLED / x) — none ran.';";
+  assert.deepEqual(scan(src), []);
+});
+
+test('a call site inside a comment is not a call site', () => {
+  assert.deepEqual(scan(CP + '// execFile(process.execPath, [path.join(work, rel)]);'), []);
+  assert.deepEqual(scan(CP + '/* spawn(bin, args); */'), []);
+});
+
+test('a literal binary and a __dirname-rooted script are static', () => {
+  assert.deepEqual(scan(CP + "execSync('git rev-parse HEAD');"), []);
+  assert.deepEqual(scan(CP + "execFile(process.execPath, [path.join(__dirname, 'serve.js')]);"), []);
+});
+
+test('a module-level const rooted at __dirname is static, transitively', () => {
+  const src = CP
+    + "const KIT_DIR = path.join(__dirname, 'kit');\n"
+    + "const ENTRY = path.join(KIT_DIR, 'serve.js');\n"
+    + 'spawn(process.execPath, [ENTRY]);';
+  assert.deepEqual(scan(src), [], 'const → const → __dirname must resolve to static');
+});
+
+test('a const declared INSIDE a function is not a fixed root', () => {
+  // Module level is column 0. A const rebound per call is a runtime value however it reads.
+  const src = CP + 'function run(work) {\n  const entry = path.join(work, "gen.js");\n  spawn(process.execPath, [entry]);\n}';
+  assert.equal(scan(src).length, 1);
+});
+
+// ---- template literals: the one-character bypass (grade round 2) ----------
+
+test('a path built from a TEMPLATE LITERAL is flagged, not silently static', () => {
+  // The bypass: stripStrings() used to blank a whole template, leaving zero free
+  // identifiers, and isStatic()'s every() over an empty set is vacuously true. Writing a
+  // backtick instead of calling path.join defeated the entire check for exactly the
+  // runtime-derived path B1/B50 are about.
+  const f = scan(CP + 'execFile(process.execPath, [`${work}/gen.js`]);');
+  assert.equal(f.length, 1, 'a template-literal script path must be reported');
+  assert.match(f[0].expr, /work/);
+});
+
+test('a template-literal require() specifier is flagged too', () => {
+  assert.equal(scan('const m = require(`${dir}/routes.js`);').length, 1);
+});
+
+test('stripStrings keeps interpolated expressions and drops literal text', () => {
+  // Pinned at unit altitude: a regression here is invisible through scanFile alone,
+  // because the symptom is a finding that quietly stops appearing.
+  assert.match(g.stripStrings('`${a}/x/${b}`'), /a/);
+  assert.match(g.stripStrings('`${a}/x/${b}`'), /b/);
+  assert.doesNotMatch(g.stripStrings('`${a}/secretword/${b}`'), /secretword/);
+  assert.equal(g.isStatic('`${work}/gen.js`', new Set(['path', '__dirname'])), false);
+  assert.equal(g.isStatic('`no-holes-here`', new Set(['path'])), true, 'a hole-less template is a constant');
+});
+
+test('a template rooted at __dirname is still static', () => {
+  assert.deepEqual(scan(CP + 'execFile(process.execPath, [`${__dirname}/serve.js`]);'), []);
+});
+
+// ---- the unbound + ESM forms (grade round 1: the check's own contract) -----
+
+test('an UNBOUND require(...).execFileSync(runtimePath) is caught', () => {
+  // The gap that failed the first grade. This form binds no name, and the first draft
+  // short-circuited the whole file on "no bindings" — so a file spawning this way was
+  // skipped entirely. Not hypothetical: scripts/gds/autonomy-gate.js and
+  // scripts/gds/ship-land.js already use exactly this shape.
+  const f = scan("require('node:child_process').execFileSync(process.execPath, [path.join(work, rel)]);");
+  assert.equal(f.length, 1, 'the unbound spawner form must not escape the scan');
+  assert.equal(f[0].role, 'script');
+});
+
+test('a file with NO child_process binding is still scanned, not skipped wholesale', () => {
+  // The severity of the round-1 finding was not the missed call — it was that ONE
+  // unbound call made the scan abandon the ENTIRE file.
+  const src = "require('child_process').exec(userCmd);\nconst x = 1;";
+  assert.equal(scan(src).length, 1);
+});
+
+test('an ESM named import of a spawner is tracked, renames included', () => {
+  const src = "import { execFile as run } from 'node:child_process';\nrun(process.execPath, [path.join(work, 'x.js')]);";
+  assert.equal(scan(src).length, 1, 'the repo is CJS today; a check that only reads CJS dies silently on conversion');
+});
+
+// ---- dynamic require(): same question, different mechanism -----------------
+
+test('a require() of a runtime path is reported as an executed module', () => {
+  // src/module-loader/loader.js:190 is the second site the audit named. The server
+  // LOADS AND RUNS that module in-process, which is execution by another name.
+  const f = scan("const m = require(path.join(dir, 'routes', rk + '.js'));");
+  assert.equal(f.length, 1);
+  assert.equal(f[0].role, 'module');
+});
+
+test('an ordinary literal require is not a finding', () => {
+  // The whole repo is built on these; firing on them would make the check unusable.
+  assert.deepEqual(scan("const path = require('node:path');\nconst db = require('../db');"), []);
+});
+
+// ---- enumeration coverage --------------------------------------------------
+
+test('enumeration is complete for src/ and modules/, and not glob-dependent', () => {
+  // Round-1 finding: the scan enumerated via 'src/**/*.js'-style pathspecs, whose
+  // completeness rests on git matching '*' ACROSS '/' — true, but a property a reader
+  // must already know to trust the line. This pins the result rather than the spelling:
+  // whatever the implementation, it must see every tracked .js under src/ and modules/
+  // that is not a browser or desktop-app asset.
+  const listed = new Set(g.trackedServerFiles());
+  const expected = execFileSync('git', ['ls-files', '--', 'src', 'modules'], { cwd: ROOT, encoding: 'utf8' })
+    .split('\n').map((s) => s.trim()).filter(Boolean)
+    .filter((f) => f.endsWith('.js'))
+    .filter((f) => !f.includes('/public/') && !f.includes('/app/'));
+  const missing = expected.filter((f) => !listed.has(f));
+  assert.deepEqual(missing, [], 'every tracked server .js must be scanned — silent narrowing is the one failure this check cannot survive');
+  assert.ok(expected.length > 300, `enumeration collapsed to ${expected.length} files`);
+});
+
+// ---- binding resolution ----------------------------------------------------
+
+test('only names actually bound to child_process count as spawners', () => {
+  // `spawn` here is a local helper with nothing to do with processes.
+  const src = "const spawn = (n) => new Array(n);\nspawn(itemCount);";
+  assert.deepEqual(scan(src), []);
+});
+
+test('a renamed destructured binding is still tracked', () => {
+  const src = "const { execFile: ef } = require('node:child_process');\nef(process.execPath, [path.join(work, 'x.js')]);";
+  assert.equal(scan(src).length, 1, 'an alias must not escape the scan');
+});
+
+test('a namespace binding (cp.execFile) is tracked', () => {
+  const src = "const cp = require('child_process');\ncp.execFile(process.execPath, [path.join(work, 'x.js')]);";
+  assert.equal(scan(src).length, 1);
+});
+
+test('bindings survive masking — the require specifier is a string body', () => {
+  // Regression: resolving bindings from the MASKED source blanked
+  // 'node:child_process' itself, so no file had bindings and the whole scan passed
+  // vacuously. A check that silently passes everything is worse than no check.
+  const { direct } = g.resolveBindings(CP);
+  assert.ok(direct.has('execFile') && direct.has('spawn'), 'bindings must resolve from real source');
+});
+
+// ---- the exemption list is a review, not a mute ----------------------------
+
+test('every exemption names a file:line and carries a substantive reason', () => {
+  for (const e of g.EXEMPTIONS) {
+    assert.match(e.at, /^[\w./-]+:\d+$/, `${e.at} must be a repo-relative file:line`);
+    assert.ok(e.why && e.why.length > 80,
+      `${e.at} must record WHY a runtime path is correct there — a bare entry is a mute, not a review.`);
+  }
+});
+
+test('the motivating CRITICAL is on the list with its compensating control named', () => {
+  // If conflict-resolve.js:382 ever drops off this list silently, the audit finding has
+  // been forgotten rather than fixed.
+  const e = g.EXEMPTIONS.find((x) => x.at.startsWith('modules/lifecycle/conflict-resolve.js'));
+  assert.ok(e, 'the B1 site must be accounted for explicitly');
+  assert.match(e.why, /computeExecutedClosure|1003367/,
+    'the exemption must name the control that makes it safe, not merely assert it is');
+});
+
+// ---- the check runs clean on the real tree --------------------------------
+
+test('the repo passes, and the scan is not vacuous', () => {
+  const r = g.checkExecPathsStatic();
+  assert.equal(r.hardFail, false, `unexempted executed paths:\n${r.violations.join('\n')}`);
+  assert.ok(/\b(\d{2,})\s+server file\(s\) scanned/.test(r.note),
+    'a scan reporting a handful of files has broken its enumeration');
+  assert.equal(r.exempt.length, g.EXEMPTIONS.length,
+    'every exemption must still match a real finding — a stale one means the code moved and the '
+    + 'review was silently carried forward');
+});
+
+test('exemptions never surface as warnings — a permanently-yellow check stops being read', () => {
+  const r = g.checkExecPathsStatic();
+  assert.deepEqual(r.warnings, [], 'reviewed exemptions belong in `exempt`, not `warnings`');
+  assert.ok(r.exempt.length > 0, 'and they must still be reported somewhere');
+});
+
+test('an empty file list is a scan defect, not a pass', () => {
+  const r = g.checkExecPathsStatic({ files: [] });
+  assert.equal(r.hardFail, true, 'zero files enumerated must fail closed');
+});

package/tests/government_protected_surfaces.mjs

@@ -92,7 +92,89 @@ const EXPECTED_GLOBS_BEFORE_R101 = [
 // Each entry is { after, glob, why }: `after` is the glob it is inserted
 // directly below, so the expected list is reconstructed in order rather than
 // re-pasted (a re-paste is how the two lists drift apart).
-const ADDED_SINCE_R101 = [];
+// CONSIDERED AND DELIBERATELY NOT ADDED: `.claude/agents/` (task 1002492).
+//
+// It looks like it belongs — an agent definition is local automation that fires
+// on its own and declares its own scope, which is the stated reason
+// `.claude/hooks/` and `.claude/settings.json` sit in the automation group. It
+// was added, and backed out, because protectedness is DERIVED PER MODULE:
+// module-scope-map marks a module protected when ANY of its globs is, and
+// `.claude/agents/` is one of the `agents` module's globs. So the entry silently
+// rank-walls the WHOLE agents module — `modules/agents/` source included — and
+// with it goals 1000038/39/40, changing who may work them. Two guards caught it:
+// module-scope-map's "derived, not hand-set" assertion and publish_manifest's
+// rule that every protected glob be explicitly excluded or publishable.
+//
+// That is a policy decision about a rank floor on three goals. It is NOT the
+// decision task 1002492 was for — "an agent may not scope itself onto the
+// authority surface" — which the scope_paths wall in
+// modules/agents/lib/validate.js now enforces on its own. Protecting the
+// directory would gate who may EDIT a definition; it does nothing about where a
+// definition POINTS.
+//
+// If the owner does want the agents module rank-walled, it needs the entry here,
+// a publish-manifest carve-out, and the module-scope-map roster test updated —
+// three deliberate edits, not a side effect of a scope fix.
+const ADDED_SINCE_R101 = [
+  // task 1003366, audit ref MIT1 (2026-08-29 security audit, goal 1000084). The EIGHT
+  // execution roots the merge resolver runs out of a cloned branch. The audit named four
+  // of them ("the three gen-* scripts and .gitattributes"); modules/lifecycle/executed-
+  // closure.js names eight, so the audit's prose was already stale against shipped code.
+  // The drift tripwire below is what keeps this list honest from here.
+  {
+    after: 'scripts/gds/cli-lib.js',
+    glob: 'scripts/gds/git-merge-regen.js',
+    why: 'the otb-regen MERGE DRIVER. Registered as a relative command with cwd at the '
+       + 'clone root, so git merge runs the BRANCH copy with the live server environment '
+       + 'BEFORE any post-merge step — the earliest execution vector, and the one the '
+       + "audit's \"after the merge\" framing missed.",
+  },
+  {
+    after: 'scripts/gds/git-merge-regen.js',
+    glob: 'scripts/gds/gen-repo-map.js',
+    why: 'a post-merge generator the resolver runs as execFile(node, [<clone>/...]) — the '
+       + "branch's own copy, inheriting DATABASE_URL and BUILDER_SECRET_KEY.",
+  },
+  {
+    after: 'scripts/gds/gen-repo-map.js',
+    glob: 'scripts/gds/gen-file-map.js',
+    why: 'a post-merge generator the resolver executes out of the clone, on the same path '
+       + 'as gen-repo-map.js.',
+  },
+  {
+    after: 'scripts/gds/gen-file-map.js',
+    glob: 'scripts/gds/gen-session-index.js',
+    why: 'a post-merge generator the resolver executes out of the clone, on the same path '
+       + 'as gen-repo-map.js.',
+  },
+  {
+    after: 'scripts/gds/gen-session-index.js',
+    glob: 'scripts/gds/copy-inventory.js',
+    why: 'a post-merge generator the resolver executes out of the clone. NOT one of the '
+       + "audit's \"gen-* trio\" — it is the first of the four roots that prose omitted, "
+       + 'which is why this registry is pinned to the closure rather than to the audit.',
+  },
+  {
+    after: 'scripts/gds/copy-inventory.js',
+    glob: 'scripts/gds/gen-api-docs.js',
+    why: 'a post-merge generator the resolver executes out of the clone, and the widest '
+       + 'one: it require()s src/bongos/route-rank-check, api-prefix and routes/_helpers, '
+       + 'which is why a restore scoped to scripts/gds/ was never sufficient.',
+  },
+  {
+    after: 'scripts/gds/gen-api-docs.js',
+    glob: 'scripts/gds/gen-api-client.js',
+    why: 'a post-merge generator the resolver executes out of the clone, inheriting the '
+       + 'live server environment like its siblings.',
+  },
+  {
+    after: 'scripts/gds/gen-api-client.js',
+    glob: '.gitattributes',
+    why: 'never require()d, so it is not code — but it NAMES which paths git hands the '
+       + 'otb-regen driver, so editing it changes how much of the tree that driver '
+       + 'rewrites during a merge. executed-closure.js carries it as TRUSTED_NON_CODE.',
+  },
+];
 
 // Surfaces RENAMED since R101 — still protected, under a new path. Distinct from
 // a removal on purpose: a rename keeps the protection and moves it, a removal
@@ -172,6 +254,55 @@ test('every glob added since R101 carries a documented reason', () => {
   }
 });
 
+// ---------- the drift tripwire: every EXECUTION ROOT is a protected surface ----------
+//
+// task 1003366, audit ref MIT1. The audit prescribed "the three gen-* scripts and
+// .gitattributes" — four surfaces. modules/lifecycle/executed-closure.js (task 1003367,
+// ref B1) names SEVEN execution roots plus .gitattributes, because GENERATOR_SCRIPTS grew
+// after the audit was written. Pasting the audit's four names in would therefore have
+// shipped a hand-curated list that was ALREADY stale on the day it landed, leaving
+// git-merge-regen.js — the earliest vector of the three — writable by any rank.
+//
+// So the registry is pinned to the closure's own ENTRYPOINTS, and this test is what makes
+// the pin real: add a generator to GENERATOR_SCRIPTS (executed_closure.mjs already asserts
+// those two lists are identical) and the build reds HERE until the registry grows to match.
+//
+// WHY THE ENTRYPOINTS AND NOT THE WHOLE 81-FILE CLOSURE — two controls, different jobs:
+//   - the closure's TRANSITIVE TAIL is enforced by conflict-resolve.js steps 5b/4b, which
+//     REFUSE to auto-resolve a branch touching any of the 81. That refusal is substrate:
+//     it does not depend on the builder cooperating, and it cannot drift, because it is
+//     computed rather than listed.
+//   - this registry is COOPERATIVE (pre-push hook, grader pre-pass, main-audit). Its job
+//     is the rank floor and the audit trail. The task says so: MIT1 is the interim
+//     mitigation, B1 is the close.
+// Listing all 81 here would add no enforcement the refusal does not already provide, while
+// floor-gating ordinary source at Metic — src/bongos/logger.js, src/branding.js and
+// src/build-info.js are all in the closure — and locking newcomers out of routine work.
+// The entrypoints are different in kind: they exist ONLY to be executed by the pipeline,
+// which is exactly what group 'pipeline' already means for ship.js and gate-review.js.
+test('every execution root in the closure is a protected surface (MIT1 drift tripwire)', () => {
+  const ec = require(path.join(ROOT, 'modules', 'lifecycle', 'executed-closure.js'));
+  // ENTRYPOINTS lists both script-tree spellings across the C-series rename window; only
+  // the ones that exist can be executed, so only those must be protected.
+  const roots = [
+    ...ec.ENTRYPOINTS.filter((rel) => fs.existsSync(path.join(ROOT, rel))),
+    ...ec.TRUSTED_NON_CODE,
+  ];
+  assert.ok(roots.length >= 8,
+    'fixture sanity: the closure must declare the execution roots this test checks');
+  for (const rel of roots) {
+    const surface = ppc.surfaceFor(rel);
+    assert.ok(surface,
+      `${rel} is an EXECUTION ROOT — the merge resolver runs it out of a cloned branch `
+      + 'with the live server environment — but no protected surface covers it. Add it to '
+      + 'modules/government/protected-surfaces.json (group "pipeline") and declare it in '
+      + 'ADDED_SINCE_R101 above.');
+    assert.ok(ppc.RANK_TIER[surface.floor] >= ppc.RANK_TIER.metic,
+      `${rel} is an execution root floored at '${surface.floor}' — below Metic it stays `
+      + 'writable by the ranks ADR 0043 keeps out of the pipeline.');
+  }
+});
+
 // Metic is a FLOOR, not a fixed value (task 1003191). Pinning every surface to
 // exactly 'metic' made the registry's own contract untestable and, worse,
 // illegal: governance owns this data and raising one surface to 'archon' is a