@bongos/core 1.19.704 → 1.19.705

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.704",
-  "core_contract": "1.19.704",
-  "source_commit": "86a7901eed7ffd687d8366c14b70b6dbce1a36f8",
+  "core_version": "1.19.705",
+  "core_contract": "1.19.705",
+  "source_commit": "ee446c148a7c0bc6e13028a538e32f2288b74802",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T04:51:44.117Z",
+  "built_at": "2026-09-13T05:14:27.400Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2132,
+    "functional_verbatim": 2134,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2633,
-  "tree_sha256": "6a38a87e7ab24df8fa7020189772ed67bc02d6271601eda7a94aeddf84bfc12d",
+  "file_count": 2635,
+  "tree_sha256": "b975cdb11e18889435478808545314cf6b5f9d2a3f17411eb4cd63d3d294e047",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "339e97fa485b7a1b3090c5964a23d6d30d3863781e549e30af68610fb3eedb91"
+      "sha256": "64a2ef09f0be002b9c3af200c125b35b09775adb665a273b44e235a79b7265b9"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7782,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8eb4b18a9a0ee8ec64bab2712698fca515ff92277ebeed12adbb7126fe30e3e2"
+      "sha256": "b74ccfc9d9bcd1da47c4bdf0010e1516b48e5213cc435f10069bb30454b6e4fc"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6c55beca8912927a2d103ef0efee212341daa09be17e346d4d298377e3958d19"
+      "sha256": "59663e88e9591b8ef999f69c31757eac4275b7aa1376b9497ad6467223a21b3a"
     },
     {
       "path": "public-docs/index.html",
@@ -8199,6 +8199,11 @@
       "mode": "0000644",
       "sha256": "2fcc3f97558ed6a653638df96d585dc7a1ef7dd884657a63d3a9545dbdb03e92"
     },
+    {
+      "path": "scripts/gds/exec-path-guard.js",
+      "mode": "0000644",
+      "sha256": "e568575a922de8c4538f11fa0e67ca0a97ab75317ff59b6aea27e6020a87313c"
+    },
     {
       "path": "scripts/gds/feedback-latest.js",
       "mode": "0000644",
@@ -8252,7 +8257,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "d6120a5427f9053529639cf15a59bad0afae9602d5a1e8301017f3321493038b"
+      "sha256": "418376cea128d2b1683e65017d74c453eb170e163bd131c1252ec79c6baf0920"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -9557,7 +9562,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0954b91956641ff68caa5c9373be6d33d3ac3fdacda102846de75a339326fc86"
+      "sha256": "d5b14e265925245fcd8ff4c280c68d0162a3bec6d58ee5358047e43708bdeaed"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10574,6 +10579,11 @@
       "mode": "0000644",
       "sha256": "d6a78357533fdeea3bc33fe97cfcd27b1d04747c600d0a7800ddfca5199dbb1f"
     },
+    {
+      "path": "tests/exec_path_guard.mjs",
+      "mode": "0000644",
+      "sha256": "478075d19af9592d87ef9419c06496e72c132f4c045e19a1ebf821ab6ff7074b"
+    },
     {
       "path": "tests/executed_closure.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1867,5 +1867,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.702 with no explicit bump. run 34736566183. (task 1002620)
   1.19.704 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.703 with no explicit bump. run 34738864605. (task 1002620)
+  1.19.705 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.704 with no explicit bump. run 34739785273. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.704",
+  "version": "1.19.705",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.704",
+      "version": "1.19.705",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.704",
+  "version": "1.19.705",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/exec-path-guard.js

@@ -0,0 +1,564 @@
+#!/usr/bin/env node
+// scripts/gds/exec-path-guard.js — server-side code must not EXECUTE a path it does
+// not statically control (task 1003371, audit ref B50, 2026-08-29 security audit).
+//
+// THE BLIND SPOT THIS EXISTS TO CLOSE. Every other gate asks who may CALL something:
+// route-rank-check.js checks who may reach a route, fitness Check 4 checks the gates
+// exist, permission-path-check.js checks who may EDIT a file. Nothing asked what the
+// server RUNS, or out of whose tree. All three CRITICALs in the 2026-08-29 audit lived
+// in that one gap, and none of them were caught by anything.
+//
+// THE DEFECT SHAPE. modules/lifecycle/conflict-resolve.js clones a builder's branch to
+// a temp dir and runs `execFile(process.execPath, [path.join(work, rel)])` — a script
+// out of the CLONE, with the live server's DATABASE_URL and BUILDER_SECRET_KEY
+// inherited. The path is assembled from `work`, a runtime value, so no amount of
+// reading the call site tells you what binary actually runs.
+//
+// THE RULE. An executed path must be STATICALLY ROOTED AT THE CORE CHECKOUT: built only
+// from string literals, __dirname/__filename, process.execPath, and module-level consts
+// that are themselves so built. A path that reaches the call through a parameter, a
+// let, or any other runtime value is flagged. That is a deliberately blunt rule — it
+// cannot tell a safe runtime path from an unsafe one, so it insists the question never
+// arises. Where a runtime path is genuinely correct, EXEMPTIONS below records why, and
+// the exemption is the review.
+//
+// WHY STATIC AND NOT A RUNTIME GUARD. The dangerous call already ran with full
+// privilege by the time a runtime check could see it, and the sites are few and rarely
+// touched — this is exactly the shape a build-time scan handles well.
+//
+// THE RESIDUAL ASSUMPTION, stated so it can be re-checked rather than rediscovered.
+// This is a LINE/BRACKET scan, not a parse (the repo ships no JS parser — see
+// route-rank-check.js, which reads route files the same way for the same reason). It
+// resolves child_process bindings per file, so a regex's `.exec()` is never mistaken
+// for the child_process one, and it balances brackets to read a multi-line call. It
+// does NOT follow a value across files or through a function return. A path laundered
+// through a helper in another module would read as a bare identifier here and be
+// FLAGGED, not missed — the scan fails toward noise, never toward silence.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const NAME = 'no server-side exec/spawn runs a path that is not statically rooted at the core checkout (task 1003371)';
+
+// The child_process members that start a process. `fork` included: it runs a module
+// path the same way execFile does.
+const SPAWNERS = new Set([
+  'exec', 'execSync', 'execFile', 'execFileSync', 'spawn', 'spawnSync', 'fork',
+]);
+
+// Identifiers an executed path may be built from without the scan knowing more. These
+// are fixed at module load and cannot be steered by a request or a branch.
+const STATIC_ROOTS = new Set([
+  '__dirname', '__filename', 'process', 'path', 'require',
+  'String', 'Number', 'JSON', 'Boolean', 'Array', 'Object',
+]);
+
+// Reviewed exemptions. Each is a call the scan flags where a runtime path is the
+// correct behaviour, with the reason it is safe. An entry is a REVIEW, not a mute:
+// adding one is the moment to argue the case, which is why `why` is asserted non-empty
+// by tests/exec_path_guard.mjs. Keyed `<repo-relative file>:<line>` is deliberately
+// brittle — a line shift re-opens the review rather than carrying a stale approval.
+const EXEMPTIONS = [
+  {
+    at: 'modules/lifecycle/conflict-resolve.js:382',
+    why: 'THE site this check was written for (audit ref B1), and the one place a runtime path is '
+       + 'REQUIRED rather than tolerated. Each generator derives its repo root from its own '
+       + '__dirname, so running the SERVER\'s copy would regenerate the deploy tree instead of the '
+       + 'throwaway clone — rooting this statically would break the feature and corrupt the live '
+       + 'checkout. It is safe because of a control OUTSIDE this call: task 1003367 made '
+       + 'resolveBranchConflicts refuse to auto-resolve any branch touching '
+       + 'computeExecutedClosure() (steps 5b/4b), so this line is unreachable for a branch that '
+       + 'edited executed code, and task 1003366 put all eight execution roots at the Metic floor. '
+       + 'If that refusal is ever removed this exemption dies with it.',
+  },
+  {
+    at: 'modules/grading/generated-provenance.js:156',
+    why: '`dir` defaults to path.join(__dirname, ..., \'scripts\', \'gds\') — the SERVER\'s own tree — '
+       + 'and `script` comes from the module-level GENERATORS table, which holds string literals '
+       + 'only. The `scriptDir` seam exists so the unit test never spawns a process and is never '
+       + 'set in production. The untrusted input here is the CWD, not the script: this runs a '
+       + 'trusted generator against a suspect tree, which is the inverse of the B50 shape.',
+  },
+  {
+    at: 'modules/grading/generated-provenance.js:223',
+    why: 'The async twin of the call at :156 — same `dir` default, same literal GENERATORS table, '
+       + 'same test-only `scriptDir` seam. Listed separately rather than folded in because an '
+       + 'exemption is keyed to a line: if one of the two calls changes shape, only that one '
+       + 're-opens for review.',
+  },
+  {
+    at: 'src/module-loader/loader.js:190',
+    why: 'The plugin loader, and the second site the audit named (B50 "motivating sites"). It '
+       + 'require()s a discovered module\'s route file, so the specifier is a runtime path BY '
+       + 'DESIGN — a plugin system whose module paths are compile-time constants is not a plugin '
+       + 'system. What bounds it is not this call but WHICH ROOTS are discovered: DEFAULT_ROOTS is '
+       + 'the core package\'s modules/ plus the instance\'s own, both operator-controlled, never a '
+       + 'builder branch. The residual risk — an instance accepting an untrusted module — is a '
+       + 'different boundary with its own control: ADR 0107 designates an accept-time module '
+       + 'security review, tracked as task 1003400. Exempt here so that work is not silently '
+       + 'absorbed into this check.',
+  },
+  {
+    at: 'src/module-loader/loader.js:293',
+    why: 'The poller twin of the route require at :190 — same DEFAULT_ROOTS bound, same plugin-by-'
+       + 'design rationale, same ADR 0107 / task 1003400 follow-on. Listed on its own line so a '
+       + 'change to either call re-opens only that one.',
+  },
+  {
+    at: 'modules/ui-design/scripts/validate-design.js:222',
+    why: 'A developer validation script, not a server path: it require()s each adapter\'s index.js '
+       + 'to check the adapter contract, and loading the thing under test is the whole point. '
+       + 'indexPath is path.join(ADAPTERS_DIR, adapterName, \'index.js\') where ADAPTERS_DIR is '
+       + '__dirname-rooted and adapterName comes from reading that same directory — so it cannot '
+       + 'escape the core checkout. Flagged only because the scan does not model a directory '
+       + 'listing as a constrained source.',
+  },
+  {
+    at: 'src/bongos/llm-cache.js:116',
+    why: 'Not an executed path at all. `cmd` is a `git rev-parse HEAD:<p>` command string built in '
+       + 'scopeShaFor from a code-defined paths list; the binary is git, resolved from PATH, and '
+       + 'nothing is run out of a builder tree. Flagged because the check reads arg 0 of every '
+       + 'spawner and cannot tell a command string from a path — the honest cost of a rule blunt '
+       + 'enough to have no gaps. NOTE for a future reader: interpolating `p` into a shell string '
+       + 'is a real smell of a DIFFERENT class (shell metacharacters, not tree provenance). It is '
+       + 'not exploitable today because every caller passes a literal, and it is out of scope for '
+       + 'B50 — but it is the thing to fix if `paths` ever becomes request-derived.',
+  },
+];
+
+// ---------------------------------------------------------------------------
+// binding resolution — which local names in THIS file are child_process spawners
+// ---------------------------------------------------------------------------
+
+const REQUIRE_CP_RE = /(?:const|let|var)\s+(\{[^}]*\}|[A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"](?:node:)?child_process['"]\s*\)/g;
+
+// ESM: `import { execFile, spawn as sp } from 'node:child_process'`, and the namespace
+// form. The repo is CJS today, but a check that only understands CJS quietly stops
+// working the day a file converts — and stops without a signal, which is the failure
+// mode this file exists to avoid.
+const IMPORT_CP_RE = /import\s+(\*\s*as\s*[A-Za-z_$][\w$]*|\{[^}]*\}|[A-Za-z_$][\w$]*)\s*from\s*['"](?:node:)?child_process['"]/g;
+
+// The UNBOUND form: `require('node:child_process').execFileSync(...)` called straight off
+// the require. It binds no name, so binding resolution alone never sees it — and the
+// first draft of this check short-circuited the WHOLE FILE on "no bindings", so a file
+// spawning this way was skipped entirely rather than scanned. That is the exact
+// inversion of this scan's stated "fails toward noise, never toward silence" contract,
+// and the form is not hypothetical: scripts/gds/autonomy-gate.js and
+// scripts/gds/ship-land.js both already use it.
+const INLINE_CP_RE = new RegExp(
+  `require\\(\\s*['"](?:node:)?child_process['"]\\s*\\)\\s*\\.\\s*(?:${[...SPAWNERS].join('|')})\\s*\\(`,
+  'g',
+);
+
+// A require() whose specifier is not a literal: the server LOADS AND RUNS that module in
+// its own process, which is the same question this check asks of exec/spawn through a
+// different mechanism. src/module-loader/loader.js is the motivating site the audit named
+// alongside conflict-resolve.js.
+const REQUIRE_CALL_RE = /(?<![.\w$])require\s*\(/g;
+
+// Returns { direct:Set<name>, namespaces:Set<name> } — `direct` are names bound to a
+// spawner (destructuring or ESM named import, renames included), `namespaces` are
+// whole-module bindings used as `cp.execFile(...)`.
+function resolveBindings(src) {
+  const direct = new Set();
+  const namespaces = new Set();
+  const takeList = (lhs) => {
+    if (!lhs.startsWith('{')) {
+      namespaces.add(lhs.replace(/^\*\s*as\s*/, '').trim());
+      return;
+    }
+    for (const part of lhs.slice(1, -1).split(',')) {
+      const [orig, alias] = part.split(/:|\bas\b/).map((s) => s.trim());
+      if (orig && SPAWNERS.has(orig)) direct.add(alias || orig);
+    }
+  };
+  for (const re of [REQUIRE_CP_RE, IMPORT_CP_RE]) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(src))) takeList(m[1].trim());
+  }
+  return { direct, namespaces };
+}
+
+// ---------------------------------------------------------------------------
+// argument extraction — read a call's arguments, balancing brackets and strings
+// ---------------------------------------------------------------------------
+
+// From the index of a call's '(', return the raw argument text, or null if unbalanced.
+function readCallArgs(src, openIdx) {
+  let depth = 0;
+  let quote = null;
+  for (let i = openIdx; i < src.length; i += 1) {
+    const c = src[i];
+    if (quote) {
+      if (c === '\\') { i += 1; continue; }
+      if (c === quote) quote = null;
+      continue;
+    }
+    if (c === "'" || c === '"' || c === '`') { quote = c; continue; }
+    if (c === '(' || c === '[' || c === '{') depth += 1;
+    else if (c === ')' || c === ']' || c === '}') {
+      depth -= 1;
+      if (depth === 0) return src.slice(openIdx + 1, i);
+    }
+  }
+  return null;
+}
+
+// Split argument text on TOP-LEVEL commas only.
+function splitArgs(argText) {
+  const out = [];
+  let depth = 0;
+  let quote = null;
+  let start = 0;
+  for (let i = 0; i < argText.length; i += 1) {
+    const c = argText[i];
+    if (quote) {
+      if (c === '\\') { i += 1; continue; }
+      if (c === quote) quote = null;
+      continue;
+    }
+    if (c === "'" || c === '"' || c === '`') { quote = c; continue; }
+    if (c === '(' || c === '[' || c === '{') depth += 1;
+    else if (c === ')' || c === ']' || c === '}') depth -= 1;
+    else if (c === ',' && depth === 0) { out.push(argText.slice(start, i)); start = i + 1; }
+  }
+  out.push(argText.slice(start));
+  return out.map((s) => s.trim()).filter((s) => s.length);
+}
+
+// ---------------------------------------------------------------------------
+// staticness — is an expression built only from roots fixed at module load?
+// ---------------------------------------------------------------------------
+
+// Blank string CONTENT so it cannot contribute identifiers — with one exception that
+// decides whether this check works at all.
+//
+// A template literal's `${...}` holes are CODE, not content. Blanking a whole template
+// the way a quoted string is blanked leaves `${work}/gen.js` with no free identifiers,
+// and isStatic()'s every() over an empty set is vacuously TRUE — so the path reads as
+// static and the call is never flagged. That is not a missed edge: it is a one-character
+// bypass of the entire check (write a backtick instead of calling path.join) for exactly
+// the runtime-derived path B1/B50 are about. Found by the grader, reproduced, pinned by
+// tests/exec_path_guard.mjs.
+//
+// So a template is reduced to a call-shaped list of its interpolated expressions —
+// `${a}/x/${b}` becomes `(a,b)` — which keeps every identifier the hole referenced and
+// discards the literal text around it. Templates are handled BEFORE the quoted forms so
+// a quote inside a hole cannot be mistaken for a string opener.
+const TEMPLATE_RE = /`(?:[^`\\]|\\.)*`/g;
+const HOLE_RE = /\$\{([^{}]*(?:\{[^{}]*\}[^{}]*)*)\}/g;
+
+function stripStrings(expr) {
+  return expr
+    .replace(TEMPLATE_RE, (lit) => {
+      const holes = [];
+      HOLE_RE.lastIndex = 0;
+      let m;
+      while ((m = HOLE_RE.exec(lit))) holes.push(m[1]);
+      return holes.length ? `(${holes.join(',')})` : '``';
+    })
+    .replace(/'(?:[^'\\]|\\.)*'/g, "''")
+    .replace(/"(?:[^"\\]|\\.)*"/g, '""');
+}
+
+// Free identifiers: tokens not preceded by '.' (property names) and not object keys.
+function freeIdentifiers(expr) {
+  const bare = stripStrings(expr);
+  const out = new Set();
+  const re = /(^|[^.\w$])([A-Za-z_$][\w$]*)/g;
+  let m;
+  while ((m = re.exec(bare))) out.add(m[2]);
+  return out;
+}
+
+// Module-level `const NAME = <expr>;` declarations — the only indirection the scan
+// follows. Column 0 is the test for module level; a const nested in a function is
+// re-assigned per call and is not a fixed root.
+function moduleConsts(src) {
+  const out = new Map();
+  const re = /^const\s+([A-Za-z_$][\w$]*)\s*=\s*([^\n]*?);?\s*$/gm;
+  let m;
+  while ((m = re.exec(src))) out.set(m[1], m[2]);
+  return out;
+}
+
+// The safe set: STATIC_ROOTS plus module consts that resolve to safe expressions.
+// Iterated to a fixpoint so `const A = __dirname; const B = path.join(A, 'x')` works.
+function safeIdentifiers(src) {
+  const consts = moduleConsts(src);
+  const safe = new Set(STATIC_ROOTS);
+  for (let pass = 0; pass < 5; pass += 1) {
+    let grew = false;
+    for (const [name, expr] of consts) {
+      if (safe.has(name)) continue;
+      if ([...freeIdentifiers(expr)].every((id) => safe.has(id))) { safe.add(name); grew = true; }
+    }
+    if (!grew) break;
+  }
+  return safe;
+}
+
+function isStatic(expr, safe) {
+  return [...freeIdentifiers(expr)].every((id) => safe.has(id));
+}
+
+// ---------------------------------------------------------------------------
+// masking — blank comments, string bodies and regex literals before matching
+// ---------------------------------------------------------------------------
+
+// Call sites are matched against a MASKED copy of the source, never the raw text.
+// Without this the scan reads prose: modules/grading/grader.js carries the words
+// "before worker spawn (GRADER_BYPASS_ENABLED / runOpts.bypass)" inside a note string,
+// and a bare /spawn\s*\(/ matches it and reports the sentence as an executed path.
+// Masking preserves LENGTH and NEWLINES, so offsets and line numbers computed on the
+// mask still address the original text and argument text is read back from it.
+//
+// Regex literals are detected by what precedes them — after an operator or an opening
+// bracket a `/` starts a pattern, after a value it is division. That heuristic is the
+// standard one and it can be wrong; being wrong here masks or unmasks a few characters
+// and can only add a finding, never hide one, which is the direction this scan fails in
+// everywhere else too.
+function maskNonCode(src) {
+  const out = src.split('');
+  const blank = (i) => { if (out[i] !== '\n') out[i] = ' '; };
+  let i = 0;
+  let prev = '';
+  while (i < src.length) {
+    const c = src[i];
+    const next = src[i + 1];
+    if (c === '/' && next === '/') {
+      while (i < src.length && src[i] !== '\n') { blank(i); i += 1; }
+      continue;
+    }
+    if (c === '/' && next === '*') {
+      blank(i); blank(i + 1); i += 2;
+      while (i < src.length && !(src[i] === '*' && src[i + 1] === '/')) { blank(i); i += 1; }
+      if (i < src.length) { blank(i); blank(i + 1); i += 2; }
+      continue;
+    }
+    if (c === "'" || c === '"' || c === '`') {
+      i += 1; // keep the opening quote so string-shaped args stay recognisable
+      while (i < src.length && src[i] !== c) {
+        if (src[i] === '\\') { blank(i); i += 1; }
+        if (i < src.length) { blank(i); i += 1; }
+      }
+      if (i < src.length) i += 1;
+      prev = c;
+      continue;
+    }
+    if (c === '/' && /[(,=:[!&|?{};+\-*%<>~^]/.test(prev)) {
+      i += 1;
+      while (i < src.length && src[i] !== '/' && src[i] !== '\n') {
+        if (src[i] === '\\') { blank(i); i += 1; }
+        if (i < src.length) { blank(i); i += 1; }
+      }
+      if (i < src.length && src[i] === '/') i += 1;
+      prev = '/';
+      continue;
+    }
+    if (!/\s/.test(c)) prev = c;
+    i += 1;
+  }
+  return out.join('');
+}
+
+// ---------------------------------------------------------------------------
+// the scan
+// ---------------------------------------------------------------------------
+
+// Which argument carries the executed path? Always arg 0. When arg 0 is the node
+// binary, the SCRIPT is the first element of the args array, so that is checked too —
+// `execFile(process.execPath, [path.join(work, rel)])` is the exact defect and its
+// arg 0 is perfectly static.
+function executedExpressions(args) {
+  const out = [];
+  if (!args.length) return out;
+  out.push({ expr: args[0], role: 'executable' });
+  const isNode = /process\.execPath/.test(args[0]) || /^['"](?:node|node\.exe)['"]$/.test(args[0].trim());
+  if (isNode && args[1] && args[1].trim().startsWith('[')) {
+    const first = splitArgs(args[1].trim().slice(1, -1))[0];
+    if (first) out.push({ expr: first, role: 'script' });
+  }
+  return out;
+}
+
+// Record one finding if the expression is not statically rooted.
+function consider(findings, { rel, masked, src, idx, callText, role, expr, safe }) {
+  if (expr == null || isStatic(expr, safe)) return;
+  findings.push({
+    file: rel,
+    line: src.slice(0, idx).split('\n').length,
+    role,
+    expr: expr.replace(/\s+/g, ' ').slice(0, 120),
+    call: callText,
+  });
+}
+
+function scanFile(rel, src) {
+  // Everything regex-matched below runs against `masked`; argument TEXT is read back
+  // from `src` at the same offsets, which masking keeps aligned.
+  const masked = maskNonCode(src);
+  // Bindings are resolved from the ORIGINAL text: masking blanks string bodies, and the
+  // require specifier 'node:child_process' IS a string body — reading bindings off the
+  // mask finds none, and the scan silently passes every file (caught in review).
+  const { direct, namespaces } = resolveBindings(src);
+  const safe = safeIdentifiers(masked);
+  const findings = [];
+
+  // Every way a spawner can be reached: a bound name, a namespace member, and the
+  // unbound require('child_process').x() form. NOT short-circuited on "no bindings" —
+  // the inline form has none by construction.
+  const forms = [
+    ...[...direct].map((n) => `(?<![.\\w$])${n}\\s*\\(`),
+    ...[...namespaces].map((ns) => `(?<![.\\w$])${ns}\\s*\\.\\s*(?:${[...SPAWNERS].join('|')})\\s*\\(`),
+  ];
+
+  // Bound spawner calls are matched against the MASK, so prose can never be one.
+  const hits = [];
+  if (forms.length) {
+    const bound = new RegExp(forms.join('|'), 'g');
+    let b;
+    while ((b = bound.exec(masked))) hits.push(b);
+  }
+
+  // The UNBOUND form is matched against the ORIGINAL text, because the thing that
+  // identifies it IS a specifier string and masking blanks string bodies — the same trap
+  // that once made binding resolution see nothing at all. Prose is still excluded
+  // without re-reading the raw text wholesale: had the construct sat inside a comment or
+  // a string, its trailing '(' would have been blanked too, so the mask is consulted for
+  // that one character.
+  INLINE_CP_RE.lastIndex = 0;
+  let im;
+  while ((im = INLINE_CP_RE.exec(src))) {
+    if (masked[im.index + im[0].length - 1] === '(') hits.push(im);
+  }
+
+  for (const m of hits) {
+    const openIdx = m.index + m[0].length - 1;
+    const argText = readCallArgs(src, openIdx);
+    if (argText == null) continue;
+    const args = splitArgs(argText);
+    const callText = m[0].slice(0, -1).trim().replace(/\s+/g, '');
+    for (const { expr, role } of executedExpressions(args)) {
+      consider(findings, { rel, masked, src, idx: m.index, callText, role, expr, safe });
+    }
+  }
+
+  // Dynamic require(): the server loads and RUNS that module in-process. Same question,
+  // different mechanism — src/module-loader/loader.js is the site the audit named.
+  REQUIRE_CALL_RE.lastIndex = 0;
+  let r;
+  while ((r = REQUIRE_CALL_RE.exec(masked))) {
+    const openIdx = r.index + r[0].length - 1;
+    const argText = readCallArgs(src, openIdx);
+    if (argText == null) continue;
+    const spec = splitArgs(argText)[0];
+    consider(findings, {
+      rel, masked, src, idx: r.index, callText: 'require', role: 'module', expr: spec, safe,
+    });
+  }
+
+  return findings;
+}
+
+// Every tracked first-party server file. Browser assets under public/ never spawn.
+function trackedServerFiles() {
+  try {
+    // DIRECTORY pathspecs, filtered by extension here, rather than '**/*.js' globs.
+    // NOT a bug fix — the glob form enumerated the same 351 files, because a git pathspec
+    // '*' crosses '/' (fnmatch without FNM_PATHNAME), so 'src/*.js' already matched every
+    // nested file and 'src/**/*.js' — which matches only 63 — was pure redundancy. That
+    // equivalence is a non-obvious property of git that a reader has to know to trust the
+    // line, and the cost of being wrong about it is coverage that narrows with no signal.
+    // A directory pathspec needs no such knowledge. Pinned by the enumeration test below.
+    const out = execFileSync('git', ['ls-files', '--', 'src', 'modules'],
+      { cwd: REPO_ROOT, encoding: 'utf8' });
+    return [...new Set(out.split('\n').map((x) => x.trim()).filter(Boolean))]
+      .filter((f) => f.endsWith('.js'))
+      .filter((f) => !f.includes('/public/') && !f.includes('/app/'));
+  } catch {
+    return [];
+  }
+}
+
+function exemptionFor(f) {
+  return EXEMPTIONS.find((e) => e.at === `${f.file}:${f.line}`) || null;
+}
+
+function checkExecPathsStatic({ files, read } = {}) {
+  const list = files || trackedServerFiles();
+  if (!list.length) {
+    return {
+      name: NAME, ok: false, hardFail: true,
+      violations: ['scan defect — enumerated 0 tracked server files; a broken enumeration, not a clean result.'],
+      warnings: [], note: 'static scan of src/ + modules/ for executed paths.',
+    };
+  }
+  const reader = read || ((rel) => {
+    try { return fs.readFileSync(path.join(REPO_ROOT, rel), 'utf8'); } catch { return null; }
+  });
+
+  const violations = [];
+  // Exemptions are NOT warnings. Four reviewed entries emitted as warnings make this check
+  // read WARN on every single run, and a check that is permanently yellow is one people stop
+  // reading. They ride in `exempt` instead: counted in the note, listed in full by the
+  // standalone run (node scripts/gds/exec-path-guard.js).
+  const exempt = [];
+  let scanned = 0;
+  let callSites = 0;
+  for (const rel of list) {
+    const src = reader(rel);
+    if (src == null) continue;
+    scanned += 1;
+    for (const f of scanFile(rel, src)) {
+      callSites += 1;
+      const ex = exemptionFor(f);
+      if (ex) { exempt.push(`${f.file}:${f.line} exempt — ${ex.why}`); continue; }
+      violations.push(
+        `${f.file}:${f.line} ${f.call}() runs a ${f.role} path that is not statically rooted at the core `
+        + `checkout: \`${f.expr}\`. The server executes it with its OWN environment — DATABASE_URL, `
+        + 'BUILDER_SECRET_KEY — so a path assembled at runtime is a path an untrusted tree can steer. '
+        + 'Root it at __dirname or a module-level const, or add a reviewed EXEMPTIONS entry in '
+        + 'scripts/gds/exec-path-guard.js saying why a runtime path is correct here.',
+      );
+    }
+  }
+
+  return {
+    name: NAME,
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    exempt,
+    note: `${scanned} server file(s) scanned for child_process calls; ${callSites} non-static executed `
+      + `path(s) found, ${EXEMPTIONS.length} reviewed exemption(s). An executed path must be built only `
+      + 'from literals, __dirname/__filename, process.execPath and module-level consts — the server runs '
+      + 'it with its own credentials, so "what runs" must be answerable by reading the call site.',
+  };
+}
+
+function main() {
+  const r = checkExecPathsStatic();
+  for (const v of r.violations) console.error(`✗ ${v}`);
+  for (const w of r.exempt) console.log(`  - ${w}`);
+  console.log(`${r.hardFail ? 'FAIL' : 'PASS'}  ${r.note}`);
+  process.exit(r.hardFail ? 1 : 0);
+}
+
+if (require.main === module) main();
+
+// Exported surface = what fitness.js, the standalone main and the tests actually use.
+// stripStrings/maskNonCode/isStatic are exported because the template-literal bypass
+// above is the kind of defect that needs a test at ITS OWN altitude, not only through
+// scanFile — a unit-level probe is how that regression stays visible.
+module.exports = {
+  checkExecPathsStatic, scanFile, resolveBindings, trackedServerFiles,
+  stripStrings, maskNonCode, isStatic, safeIdentifiers,
+  EXEMPTIONS, NAME,
+};

package/scripts/gds/fitness.js

@@ -1406,7 +1406,7 @@ const CHECKS = [
   // migrations: same shared, monotonic, human-allocated number line, and until this
   // landed only one of the two was enforced. An ADR number is a citation target, so a
   // duplicate is wrong forever (ADR 0195).
-  require('./adr-namespace.js').checkAdrNumbering,
+  require('./adr-namespace.js').checkAdrNumbering, require('./exec-path-guard.js').checkExecPathsStatic, // Check 32 — task 1003371 / B50: what the server EXECUTES, out of whose tree — the blind spot all three 2026-08-29 CRITICALs shared. Rationale + reviewed exemptions live in that file. Sharing Check 31's line (the 19c/19d + 23/24 precedent above): fitness.js is AT the 1,500 ratchet and a new check cannot afford a line until task 1003825 buys it back.
 ];
 
 function runAll() {

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.704'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.705'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/exec_path_guard.mjs

@@ -0,0 +1,248 @@
+// tests/exec_path_guard.mjs — task 1003371, audit ref B50 (2026-08-29 security audit).
+//
+// WHAT THE CHECK IS FOR. Nothing in the repo asked what the SERVER EXECUTES, or out of
+// whose tree. route-rank-check asks who may call a route; permission-path-check asks who
+// may edit a file; neither looks at execution. All three CRITICALs in the audit lived in
+// that gap.
+//
+// WHAT THESE TESTS PIN. Two things, and the second is the one that matters:
+//   1. the check CATCHES the defect shape — a script path assembled from a runtime value;
+//   2. it does not catch everything that merely LOOKS like one. A scan that fires on
+//      `/re/.exec(s)` or on the word "spawn (" inside a sentence gets exempted into
+//      uselessness within a month, so the negative cases are pinned as hard as the
+//      positive ones. Both of those false positives were real during development.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+// fileURLToPath, not URL.pathname. Both a test (tests/test_path_guard.mjs) and a
+// fitness check (scripts/gds/test-path-guard.js, Check 30) reject the pathname form.
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(fileURLToPath(new URL('..', import.meta.url)));
+const g = require(path.join(ROOT, 'scripts', 'gds', 'exec-path-guard.js'));
+
+const scan = (src, rel = 'modules/probe/x.js') => g.scanFile(rel, src);
+const CP = "const { execFile, execFileSync, spawn, execSync } = require('node:child_process');\n";
+
+// ---- the defect shape it must catch ---------------------------------------
+
+test('a script path built from a runtime value is flagged', () => {
+  // conflict-resolve.js:382 in miniature: arg 0 is perfectly static (process.execPath)
+  // and the DANGER is in the args array, which is why the check reads inside it.
+  const f = scan(CP + "execFile(process.execPath, [path.join(work, rel)], { cwd: work });");
+  assert.equal(f.length, 1, 'the clone-rooted script path must be reported');
+  assert.equal(f[0].role, 'script', 'the finding must name the args-array script, not arg 0');
+  assert.match(f[0].expr, /work/);
+});
+
+test('a non-static EXECUTABLE is flagged too, not just the script', () => {
+  const f = scan(CP + 'spawn(bin, args);');
+  assert.equal(f.length, 1);
+  assert.equal(f[0].role, 'executable');
+});
+
+test('a path laundered through a helper still reads as non-static (fails toward noise)', () => {
+  // The scan does not follow values across functions. The honest consequence is that an
+  // indirect path is FLAGGED rather than missed — pinned so the direction of failure is
+  // a decision on record, not an accident.
+  const f = scan(CP + 'execFile(process.execPath, [resolveScript()], {});');
+  assert.equal(f.length, 1);
+});
+
+// ---- what it must NOT catch ------------------------------------------------
+
+test("a regex's .exec() is never mistaken for child_process.exec", () => {
+  // The dominant false positive: `.exec(` outnumbers real spawner calls ~5:1 in this repo.
+  const src = "const m = /^Bearer\\s+(\\w+)$/.exec(header);\nconst k = RE.exec(line);";
+  assert.deepEqual(scan(src), [], 'a file that never requires child_process has no call sites');
+});
+
+test('the word "spawn (" inside a string is not a call site', () => {
+  // Real regression: modules/grading/grader.js carries "before worker spawn
+  // (GRADER_BYPASS_ENABLED / runOpts.bypass)" in a note string, and the first draft
+  // reported that sentence as an executed path.
+  const src = CP + "const note = 'Grader bypassed before worker spawn (GRADER_BYPASS_ENABLED / x) — none ran.';";
+  assert.deepEqual(scan(src), []);
+});
+
+test('a call site inside a comment is not a call site', () => {
+  assert.deepEqual(scan(CP + '// execFile(process.execPath, [path.join(work, rel)]);'), []);
+  assert.deepEqual(scan(CP + '/* spawn(bin, args); */'), []);
+});
+
+test('a literal binary and a __dirname-rooted script are static', () => {
+  assert.deepEqual(scan(CP + "execSync('git rev-parse HEAD');"), []);
+  assert.deepEqual(scan(CP + "execFile(process.execPath, [path.join(__dirname, 'serve.js')]);"), []);
+});
+
+test('a module-level const rooted at __dirname is static, transitively', () => {
+  const src = CP
+    + "const KIT_DIR = path.join(__dirname, 'kit');\n"
+    + "const ENTRY = path.join(KIT_DIR, 'serve.js');\n"
+    + 'spawn(process.execPath, [ENTRY]);';
+  assert.deepEqual(scan(src), [], 'const → const → __dirname must resolve to static');
+});
+
+test('a const declared INSIDE a function is not a fixed root', () => {
+  // Module level is column 0. A const rebound per call is a runtime value however it reads.
+  const src = CP + 'function run(work) {\n  const entry = path.join(work, "gen.js");\n  spawn(process.execPath, [entry]);\n}';
+  assert.equal(scan(src).length, 1);
+});
+
+// ---- template literals: the one-character bypass (grade round 2) ----------
+
+test('a path built from a TEMPLATE LITERAL is flagged, not silently static', () => {
+  // The bypass: stripStrings() used to blank a whole template, leaving zero free
+  // identifiers, and isStatic()'s every() over an empty set is vacuously true. Writing a
+  // backtick instead of calling path.join defeated the entire check for exactly the
+  // runtime-derived path B1/B50 are about.
+  const f = scan(CP + 'execFile(process.execPath, [`${work}/gen.js`]);');
+  assert.equal(f.length, 1, 'a template-literal script path must be reported');
+  assert.match(f[0].expr, /work/);
+});
+
+test('a template-literal require() specifier is flagged too', () => {
+  assert.equal(scan('const m = require(`${dir}/routes.js`);').length, 1);
+});
+
+test('stripStrings keeps interpolated expressions and drops literal text', () => {
+  // Pinned at unit altitude: a regression here is invisible through scanFile alone,
+  // because the symptom is a finding that quietly stops appearing.
+  assert.match(g.stripStrings('`${a}/x/${b}`'), /a/);
+  assert.match(g.stripStrings('`${a}/x/${b}`'), /b/);
+  assert.doesNotMatch(g.stripStrings('`${a}/secretword/${b}`'), /secretword/);
+  assert.equal(g.isStatic('`${work}/gen.js`', new Set(['path', '__dirname'])), false);
+  assert.equal(g.isStatic('`no-holes-here`', new Set(['path'])), true, 'a hole-less template is a constant');
+});
+
+test('a template rooted at __dirname is still static', () => {
+  assert.deepEqual(scan(CP + 'execFile(process.execPath, [`${__dirname}/serve.js`]);'), []);
+});
+
+// ---- the unbound + ESM forms (grade round 1: the check's own contract) -----
+
+test('an UNBOUND require(...).execFileSync(runtimePath) is caught', () => {
+  // The gap that failed the first grade. This form binds no name, and the first draft
+  // short-circuited the whole file on "no bindings" — so a file spawning this way was
+  // skipped entirely. Not hypothetical: scripts/gds/autonomy-gate.js and
+  // scripts/gds/ship-land.js already use exactly this shape.
+  const f = scan("require('node:child_process').execFileSync(process.execPath, [path.join(work, rel)]);");
+  assert.equal(f.length, 1, 'the unbound spawner form must not escape the scan');
+  assert.equal(f[0].role, 'script');
+});
+
+test('a file with NO child_process binding is still scanned, not skipped wholesale', () => {
+  // The severity of the round-1 finding was not the missed call — it was that ONE
+  // unbound call made the scan abandon the ENTIRE file.
+  const src = "require('child_process').exec(userCmd);\nconst x = 1;";
+  assert.equal(scan(src).length, 1);
+});
+
+test('an ESM named import of a spawner is tracked, renames included', () => {
+  const src = "import { execFile as run } from 'node:child_process';\nrun(process.execPath, [path.join(work, 'x.js')]);";
+  assert.equal(scan(src).length, 1, 'the repo is CJS today; a check that only reads CJS dies silently on conversion');
+});
+
+// ---- dynamic require(): same question, different mechanism -----------------
+
+test('a require() of a runtime path is reported as an executed module', () => {
+  // src/module-loader/loader.js:190 is the second site the audit named. The server
+  // LOADS AND RUNS that module in-process, which is execution by another name.
+  const f = scan("const m = require(path.join(dir, 'routes', rk + '.js'));");
+  assert.equal(f.length, 1);
+  assert.equal(f[0].role, 'module');
+});
+
+test('an ordinary literal require is not a finding', () => {
+  // The whole repo is built on these; firing on them would make the check unusable.
+  assert.deepEqual(scan("const path = require('node:path');\nconst db = require('../db');"), []);
+});
+
+// ---- enumeration coverage --------------------------------------------------
+
+test('enumeration is complete for src/ and modules/, and not glob-dependent', () => {
+  // Round-1 finding: the scan enumerated via 'src/**/*.js'-style pathspecs, whose
+  // completeness rests on git matching '*' ACROSS '/' — true, but a property a reader
+  // must already know to trust the line. This pins the result rather than the spelling:
+  // whatever the implementation, it must see every tracked .js under src/ and modules/
+  // that is not a browser or desktop-app asset.
+  const listed = new Set(g.trackedServerFiles());
+  const expected = execFileSync('git', ['ls-files', '--', 'src', 'modules'], { cwd: ROOT, encoding: 'utf8' })
+    .split('\n').map((s) => s.trim()).filter(Boolean)
+    .filter((f) => f.endsWith('.js'))
+    .filter((f) => !f.includes('/public/') && !f.includes('/app/'));
+  const missing = expected.filter((f) => !listed.has(f));
+  assert.deepEqual(missing, [], 'every tracked server .js must be scanned — silent narrowing is the one failure this check cannot survive');
+  assert.ok(expected.length > 300, `enumeration collapsed to ${expected.length} files`);
+});
+
+// ---- binding resolution ----------------------------------------------------
+
+test('only names actually bound to child_process count as spawners', () => {
+  // `spawn` here is a local helper with nothing to do with processes.
+  const src = "const spawn = (n) => new Array(n);\nspawn(itemCount);";
+  assert.deepEqual(scan(src), []);
+});
+
+test('a renamed destructured binding is still tracked', () => {
+  const src = "const { execFile: ef } = require('node:child_process');\nef(process.execPath, [path.join(work, 'x.js')]);";
+  assert.equal(scan(src).length, 1, 'an alias must not escape the scan');
+});
+
+test('a namespace binding (cp.execFile) is tracked', () => {
+  const src = "const cp = require('child_process');\ncp.execFile(process.execPath, [path.join(work, 'x.js')]);";
+  assert.equal(scan(src).length, 1);
+});
+
+test('bindings survive masking — the require specifier is a string body', () => {
+  // Regression: resolving bindings from the MASKED source blanked
+  // 'node:child_process' itself, so no file had bindings and the whole scan passed
+  // vacuously. A check that silently passes everything is worse than no check.
+  const { direct } = g.resolveBindings(CP);
+  assert.ok(direct.has('execFile') && direct.has('spawn'), 'bindings must resolve from real source');
+});
+
+// ---- the exemption list is a review, not a mute ----------------------------
+
+test('every exemption names a file:line and carries a substantive reason', () => {
+  for (const e of g.EXEMPTIONS) {
+    assert.match(e.at, /^[\w./-]+:\d+$/, `${e.at} must be a repo-relative file:line`);
+    assert.ok(e.why && e.why.length > 80,
+      `${e.at} must record WHY a runtime path is correct there — a bare entry is a mute, not a review.`);
+  }
+});
+
+test('the motivating CRITICAL is on the list with its compensating control named', () => {
+  // If conflict-resolve.js:382 ever drops off this list silently, the audit finding has
+  // been forgotten rather than fixed.
+  const e = g.EXEMPTIONS.find((x) => x.at.startsWith('modules/lifecycle/conflict-resolve.js'));
+  assert.ok(e, 'the B1 site must be accounted for explicitly');
+  assert.match(e.why, /computeExecutedClosure|1003367/,
+    'the exemption must name the control that makes it safe, not merely assert it is');
+});
+
+// ---- the check runs clean on the real tree --------------------------------
+
+test('the repo passes, and the scan is not vacuous', () => {
+  const r = g.checkExecPathsStatic();
+  assert.equal(r.hardFail, false, `unexempted executed paths:\n${r.violations.join('\n')}`);
+  assert.ok(/\b(\d{2,})\s+server file\(s\) scanned/.test(r.note),
+    'a scan reporting a handful of files has broken its enumeration');
+  assert.equal(r.exempt.length, g.EXEMPTIONS.length,
+    'every exemption must still match a real finding — a stale one means the code moved and the '
+    + 'review was silently carried forward');
+});
+
+test('exemptions never surface as warnings — a permanently-yellow check stops being read', () => {
+  const r = g.checkExecPathsStatic();
+  assert.deepEqual(r.warnings, [], 'reviewed exemptions belong in `exempt`, not `warnings`');
+  assert.ok(r.exempt.length > 0, 'and they must still be reported somewhere');
+});
+
+test('an empty file list is a scan defect, not a pass', () => {
+  const r = g.checkExecPathsStatic({ files: [] });
+  assert.equal(r.hardFail, true, 'zero files enumerated must fail closed');
+});