@bongos/core 1.19.714 → 1.19.724

package/tests/rank_roles_audit.mjs

@@ -0,0 +1,114 @@
+// tests/rank_roles_audit.mjs
+//
+// task 1002873 — the re-runnable half of "does the live roster hold only the four
+// live ranks?".
+//
+// THE GAP THIS CLOSES. migrations/023's CHECK on builders.rank still admits twelve
+// legacy values. governance_002's backfill INNER JOINs rank → the four seeded
+// governance_roles, so a builder on a legacy rank gets no role row and resolves to
+// ZERO permissions — admitted by threshold under requireRank, refused by the
+// resolver, and told nothing. ADR 0151 chose that fail-closed direction
+// deliberately; what was missing was anyone CHECKING.
+//
+// Three things had looked like the check and were not:
+//   - governance_002's own comment ("none exist today — verified") is a
+//     point-in-time manual note that nothing re-runs.
+//   - tests/governance_parity.mjs is DB-free by necessity (the unit gate has no
+//     Postgres) and says in the repo that it defers the roster half.
+//   - R114's live proof ran on a scratch DB holding only the four seeded
+//     rank-roles; the production roster was never queried.
+//
+// So the decision is a PURE function and this is a DB-free test of it. That is not
+// a compromise — no-Postgres-in-CI is precisely why the gap survived, and a
+// decision that can be tested without a database is the only kind that gets tested
+// at all here. The live read is the script's thin shell around it.
+//
+// Run:  node tests/rank_roles_audit.mjs
+
+import { strict as assert } from 'node:assert';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { findRanksWithoutRoles, summarize } = require(path.join(ROOT, 'scripts', 'gds', 'audit-rank-roles.js'));
+const { LIVE_RANK_LADDER } = require(path.join(ROOT, 'src', 'bongos', 'db-kernel.js'));
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const live = (rank, id = 1) => ({ id, github_login: `u${id}`, rank, status: 'active' });
+
+t('the live ladder is the four ranks this audit is about', () => {
+  // Derived, not retyped: if the ladder ever gains a rank, this audit must be
+  // re-reasoned rather than silently widened.
+  assert.deepEqual([...LIVE_RANK_LADDER].sort(), ['archon', 'metic', 'thetes', 'xenos']);
+});
+
+t('a roster of only live ranks has no offenders', () => {
+  const rows = LIVE_RANK_LADDER.map((r, i) => live(r, i + 1));
+  assert.deepEqual(findRanksWithoutRoles(rows), []);
+});
+
+t('a LEGACY rank is caught — the whole point', () => {
+  const out = findRanksWithoutRoles([live('archon', 1), { id: 2, github_login: 'old', rank: 'ephor', status: 'active' }]);
+  assert.equal(out.length, 1);
+  assert.equal(out[0].rank, 'ephor');
+  assert.equal(out[0].id, '2', 'the id must be reported as a string an operator can paste');
+  assert.equal(out[0].github_login, 'old', 'and the login, which is what identifies the account');
+});
+
+t('a NULL or missing rank is caught too — it fails the same INNER JOIN', () => {
+  for (const row of [
+    { id: 3, rank: null, status: 'active' },
+    { id: 4, status: 'active' },
+    { id: 5, rank: '', status: 'active' },
+  ]) {
+    const out = findRanksWithoutRoles([row]);
+    assert.equal(out.length, 1, `${JSON.stringify(row)} must be reported`);
+    assert.equal(out[0].rank, row.rank === undefined ? null : row.rank);
+  }
+});
+
+t('an INACTIVE builder on a legacy rank is still reported', () => {
+  // The roster query has no WHERE on `builders`, and this is the row a future
+  // CHECK-narrowing migration would fail to apply over. Skipping it would make a
+  // clean audit a false assurance for exactly the case that matters.
+  const out = findRanksWithoutRoles([{ id: 9, github_login: 'gone', rank: 'hoplite', status: 'inactive' }]);
+  assert.equal(out.length, 1);
+  assert.equal(out[0].status, 'inactive', 'and the status is carried so the operator can judge urgency');
+});
+
+t('case matters — the backfill JOIN is exact', () => {
+  const out = findRanksWithoutRoles([{ id: 6, rank: 'Archon', status: 'active' }]);
+  assert.equal(out.length, 1, '`Archon` does not equal `archon` in SQL; a near-miss is still zero permissions');
+});
+
+t('an empty or junk roster reports nothing and never throws', () => {
+  for (const bad of [[], null, undefined, 'nope', {}]) {
+    assert.deepEqual(findRanksWithoutRoles(bad), [], `${JSON.stringify(bad)} must be a quiet empty result`);
+  }
+  assert.deepEqual(findRanksWithoutRoles([null, undefined]), [], 'null rows are skipped, not dereferenced');
+});
+
+t('the live-rank set is injectable, so the test is not asserting against itself', () => {
+  // Pass a deliberately different ladder: the function must obey its argument
+  // rather than a hardcoded list, or this whole file would be tautological.
+  assert.equal(findRanksWithoutRoles([live('archon')], ['xenos']).length, 1);
+  assert.equal(findRanksWithoutRoles([live('xenos')], ['xenos']).length, 0);
+});
+
+t('summarize counts every rank, including the missing one', () => {
+  const h = summarize([live('xenos', 1), live('xenos', 2), live('archon', 3), { id: 4, rank: null }]);
+  assert.deepEqual(h, [['xenos', 2], ['archon', 1], ['(none)', 1]],
+    'a clean run must still say what it looked at — a check that prints nothing is '
+    + 'indistinguishable from one that read nothing, which is the failure this task is about');
+});
+
+console.log(`\nrank_roles_audit: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/scrubber_corpus.mjs

@@ -23,8 +23,9 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { scrubSecrets, shannonEntropy, looksHighEntropySecret, collectEnvSecrets } =
-  require('../scripts/gds/ship.js');
+const {
+  scrubSecrets, shannonEntropy, looksHighEntropySecret, collectEnvSecrets,
+} = require('../scripts/gds/ship.js');
 
 let passed = 0;
 let failed = 0;
@@ -190,6 +191,73 @@ test('benign prose and short identifiers survive untouched', () => {
   }
 });
 
+// ============================================================
+// task 1002460 — the doc-path exemption is an ALLOWLIST, so recall is provable.
+//
+// Three shape-based rules were tried first and each leaked: anything built on what
+// a filename LOOKS like also admits a secret dressed that way. The exemption now
+// spares a candidate only when the caller says that exact name is a file it is
+// publishing. A secret is not a file in the tree.
+// ============================================================
+
+const DOC_NAMES = new Set(["0016-trust-boundary-server-enforced-permissions.md","0083-module-system-plugin-api.md","core_231_project_settings_and_attention_water.sql"]);
+
+test('1002460 with NO allowlist there is no exemption at all — recall byte-identical', () => {
+  // The guarantee that matters. Every caller that does not opt in — including every
+  // transcript scrub — behaves exactly as it did before this task existed.
+  for (const name of DOC_NAMES) {
+    const link = `[x](${name})`;
+    assert.ok(scrubSecrets(link).includes(REDACTED),
+      `without an allowlist a long filename is still redacted, as before: ${name}`);
+  }
+});
+
+test('1002460 with the allowlist, real doc links survive', () => {
+  const opts = { knownDocNames: DOC_NAMES };
+  for (const name of DOC_NAMES) {
+    const link = `[x](${name})`;
+    assert.equal(scrubSecrets(link, [], opts), link, `over-redacted a real doc link: ${name}`);
+  }
+});
+
+test('1002460 a secret is never in the allowlist, so it is never spared', () => {
+  // The smuggling cases from rounds 1 and 2, now structurally impossible: each is
+  // offered WITH the allowlist active, and none of them is a name in it.
+  const opts = { knownDocNames: DOC_NAMES };
+  const dressed = [
+    '[x](k3f9d2m7-q8w1e4r6-t5y0u3i9-p2a7s4d1.md)',
+    '[x](qxzjvbwk-mrtplghd-nfyscuae-bvkxwqzj.md)',
+    '[x](qxjvbwkzptrmnfyaeuicohgdslx12-a.md)',   // the unbounded-run case round 2 missed
+    // NOTE on all-numeric strings: a long digit run joined by a hyphen is NOT
+    // caught by the scrubber with or without an allowlist — the hyphen breaks the
+    // all-hex rule C and H=3.30 is under rules A and B. That is a PRE-EXISTING gap
+    // in the entropy heuristic, not something this exemption opens, so it is noted
+    // here rather than asserted: a case that fails identically both ways would
+    // prove nothing about the allowlist.
+    '[x](a3f5c9e12b47d8016fa2c4e7b9d03518aa.md)',
+  ];
+  const leaked = dressed.filter((d) => !scrubSecrets(d, [], opts).includes(REDACTED));
+  assert.deepEqual(leaked, [], `these slipped the scrubber: ${leaked.join(" | ")}`);
+});
+
+test('1002460 the allowlist cannot spare a planted secret (recall unchanged, proven)', () => {
+  // The differential proof, now trivial: offer the WHOLE planted corpus with an
+  // allowlist active. Nothing in it is a filename, so nothing can be exempted.
+  const opts = { knownDocNames: DOC_NAMES };
+  for (const { name, secret, context } of positives()) {
+    const out = scrubSecrets(context, collectEnvSecrets({}), opts);
+    assert.ok(!out.includes(secret), `LEAK with allowlist active: "${name}" survived: ${out}`);
+  }
+});
+
+test('1002460 an allowlisted name only counts at a real doc extension boundary', () => {
+  // The name must be followed by its own extension. A secret that merely CONTAINS
+  // an allowlisted stem, or sits before a different extension, is not spared.
+  const opts = { knownDocNames: DOC_NAMES };
+  const notAName = '[x](0016-trust-boundary-server-enforced-permissions.env)';
+  assert.ok(scrubSecrets(notAName, [], opts).includes(REDACTED),
+    'the same stem before a NON-doc extension is not an allowlisted file');
+});
 test('empty / non-string / short-literal inputs are safe', () => {
   assert.equal(scrubSecrets(''), '');
   assert.equal(scrubSecrets(null), null);

package/tests/start_rebase_warning.mjs

@@ -99,5 +99,55 @@ t('widget HTML-escapes the refs (no raw angle brackets from ids)', () => {
   assert.ok(html.includes('<b>'), 'the id is HTML-escaped');
 });
 
+// ---------------------------------------------------------------------------
+// task 1002788 — this banner must not send a builder into a deadlock.
+//
+// The branch is ALREADY PUBLISHED when the gate fires, and server-mediated
+// publish is append-only by deliberate design (github-push.js: "Refuse
+// non-fast-forward implicitly (no --force, ever)"). So "rebase + re-ship" —
+// what this banner used to say — rewrites history the server already holds, and
+// every later publish is rejected non-fast-forward. The builder is then gated
+// from new claims AND unable to land the one they hold, which is exactly the
+// loop reproduced end-to-end on task 1002485. `git merge origin/main` reaches
+// the same up-to-date branch and stays a fast-forward.
+//
+// The negative assertion is deliberately narrow: it bans INSTRUCTING a rebase,
+// not the word. "Merge, never rebase" must keep working — that sentence is the
+// point.
+// ---------------------------------------------------------------------------
+const INSTRUCTS_A_REBASE = [
+  /\brebase\s*\+\s*re-ship\b/i,
+  /\brebase (the|its|your) branch\b/i,
+  /\brebases it\b/i,
+];
+
+t('markdown prescribes MERGE, and never instructs a rebase', () => {
+  const md = rebaseWarningMarkdown([{ id: 123 }]);
+  assert.ok(md.includes('git merge origin/main'), 'must name the fast-forward-safe command');
+  for (const re of INSTRUCTS_A_REBASE) {
+    assert.ok(!re.test(md), `must not instruct a rebase of a published branch (matched ${re}): ${md}`);
+  }
+  assert.match(md, /never rebase/i, 'and must say why the other move is wrong, not merely omit it');
+});
+
+t('widget prescribes MERGE, and never instructs a rebase', () => {
+  const html = rebaseWarningWidget([{ id: 123 }]);
+  assert.ok(html.includes('git merge origin/main'), 'must name the fast-forward-safe command');
+  for (const re of INSTRUCTS_A_REBASE) {
+    assert.ok(!re.test(html), `must not instruct a rebase of a published branch (matched ${re}): ${html}`);
+  }
+  assert.match(html, /never rebase/i);
+});
+
+t('the two renderings give the SAME advice — a builder must not get different instructions per surface', () => {
+  const md = rebaseWarningMarkdown([{ id: 123 }]);
+  const html = rebaseWarningWidget([{ id: 123 }]);
+  for (const [name, text] of [['markdown', md], ['widget', html]]) {
+    assert.ok(text.includes('git merge origin/main'), `${name} lost the command`);
+    assert.match(text, /never rebase/i, `${name} lost the warning`);
+    assert.ok(text.includes('/builder-release'), `${name} lost the give-up exit`);
+  }
+});
+
 console.log(`\nstart_rebase_warning: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exitCode = 1;

package/tests/task_field_bounds_match_db.mjs

@@ -0,0 +1,140 @@
+// tests/task_field_bounds_match_db.mjs
+//
+// task 1002845 — a value the route validator accepts must be one the INSERT
+// accepts. When those two disagree the caller gets an opaque 500 from deep inside
+// the DB, with nothing naming the field.
+//
+// THE DEFECT, measured against the live API before the fix:
+//   POST /tasks {manual_degree: 0}  →  500 {"code":"create_failed","message":"internal error"}
+// TASK_FIELD_BOUNDS said min 0; migrations/003_pms.sql says
+// `manual_degree integer CHECK (manual_degree BETWEEN 1 AND 5)`. The route let 0
+// through, the INSERT raised SQLSTATE 23514, and the generic catch answered
+// "internal error". Idea 1000456 records roughly four blind retries spent on this.
+//
+// This is the SECOND time: task 1233 fixed the identical defect on `priority`
+// (a laxer 0-100 range) and left a comment saying so, and `manual_degree` sat
+// beside it unfixed. So the guard here is not "is manual_degree 1..5" — it is
+// "does EVERY bound in TASK_FIELD_BOUNDS match the DB CHECK it mirrors", derived
+// from the migration rather than hand-copied, so the third instance fails loudly.
+//
+// Run:  node tests/task_field_bounds_match_db.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { TASK_FIELD_BOUNDS } = require(path.join(ROOT, 'modules', 'lifecycle', 'task-classifier.js'));
+const { describeCheckViolation, CHECK_VIOLATION } = require(path.join(ROOT, 'modules', 'lifecycle', 'pg-constraint-fail.js'));
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// Read the DB's own CHECK bounds out of the migrations, newest definition wins.
+// Derived, not hand-copied: a migration that later widens or narrows a CHECK must
+// move this test's expectation with it, which is the whole point.
+function dbCheckBounds(column) {
+  const dir = path.join(ROOT, 'migrations');
+  const files = fs.readdirSync(dir).filter((f) => f.endsWith('.sql')).sort();
+  assert.ok(files.length > 10, `only ${files.length} migrations read — the sweep is not finding the migrations dir`);
+  const re = new RegExp(`${column}\\s+integer[^,]*?CHECK\\s*\\(\\s*${column}\\s+BETWEEN\\s+(\\d+)\\s+AND\\s+(\\d+)\\s*\\)`, 'i');
+  const alterRe = new RegExp(`ALTER\\s+TABLE[^;]*?${column}[^;]*?BETWEEN\\s+(\\d+)\\s+AND\\s+(\\d+)`, 'is');
+  let found = null;
+  for (const f of files) {
+    const sql = fs.readFileSync(path.join(dir, f), 'utf8');
+    const m = sql.match(re) || sql.match(alterRe);
+    if (m) found = { min: Number(m[1]), max: Number(m[2]), file: f };
+  }
+  return found;
+}
+
+t('the migrations really do declare a CHECK for every bounded field (the scan works)', () => {
+  for (const column of Object.keys(TASK_FIELD_BOUNDS)) {
+    const db = dbCheckBounds(column);
+    assert.ok(db, `no CHECK found for ${column} — either the column lost its constraint or this scan has drifted off the SQL shape`);
+  }
+});
+
+t('every TASK_FIELD_BOUNDS range matches the DB CHECK it mirrors', () => {
+  for (const [column, bounds] of Object.entries(TASK_FIELD_BOUNDS)) {
+    const db = dbCheckBounds(column);
+    assert.equal(bounds.min, db.min,
+      `${column}: validator accepts from ${bounds.min} but the DB CHECK in ${db.file} starts at ${db.min} — a value in between passes the route and dies in the INSERT as an opaque 500`);
+    assert.equal(bounds.max, db.max,
+      `${column}: validator accepts up to ${bounds.max} but the DB CHECK in ${db.file} stops at ${db.max}`);
+  }
+});
+
+t('manual_degree specifically — the regression this task fixed', () => {
+  assert.equal(TASK_FIELD_BOUNDS.manual_degree.min, 1,
+    'min 0 is what let POST /tasks {manual_degree:0} reach the INSERT and 500');
+  assert.equal(TASK_FIELD_BOUNDS.manual_degree.max, 5);
+});
+
+// --- the backstop: when a mismatch DOES slip through, say which constraint ----
+
+t('describeCheckViolation names the constraint on a 23514', () => {
+  const out = describeCheckViolation({ code: CHECK_VIOLATION, constraint: 'tasks_manual_degree_check' });
+  assert.equal(out.status, 400, 'a client-correctable value must not answer 500');
+  assert.equal(out.code, 'constraint_violation');
+  assert.match(out.message, /tasks_manual_degree_check/);
+  assert.equal(out.details.constraint, 'tasks_manual_degree_check');
+});
+
+t('describeCheckViolation NEVER echoes err.detail — it carries the failing row', () => {
+  const out = describeCheckViolation({
+    code: CHECK_VIOLATION,
+    constraint: 'tasks_manual_degree_check',
+    detail: 'Failing row contains (1, a-private-title, sk-live-abc123, 0).',
+    where: 'PL/pgSQL function some_trigger()',
+  });
+  const rendered = JSON.stringify(out);
+  assert.ok(!rendered.includes('Failing row'), 'the row dump must never reach the response body');
+  assert.ok(!rendered.includes('a-private-title'), 'row VALUES must never reach the response body');
+  assert.ok(!rendered.includes('sk-live-abc123'), 'a secret sitting in an adjacent column must never be echoed');
+  assert.ok(!rendered.includes('PL/pgSQL'), 'internal execution context is not the caller\'s business');
+});
+
+t('describeCheckViolation returns null for anything that is not a CHECK violation', () => {
+  assert.equal(describeCheckViolation(null), null);
+  assert.equal(describeCheckViolation(undefined), null);
+  assert.equal(describeCheckViolation({}), null);
+  assert.equal(describeCheckViolation(new Error('boom')), null, 'a plain error must fall through to the generic 500');
+  assert.equal(describeCheckViolation({ code: '23505', constraint: 'x_key' }), null,
+    'a UNIQUE violation is a different problem and must not be relabelled as a bad value');
+  assert.equal(describeCheckViolation({ code: '23503' }), null, 'nor a foreign-key violation');
+});
+
+t('describeCheckViolation still answers 400 when the driver gives no constraint name', () => {
+  const out = describeCheckViolation({ code: CHECK_VIOLATION });
+  assert.equal(out.status, 400);
+  assert.equal(out.details.constraint, null);
+  assert.ok(out.message.length > 0, 'a nameless violation still beats "internal error"');
+});
+
+t('constraint_violation is registered so its CATEGORY agrees with its status', () => {
+  const { categoryForCode, isRetriable } = require(path.join(ROOT, 'src', 'bongos', 'api-errors.js'));
+  assert.equal(categoryForCode('constraint_violation'), 'bad_request',
+    'unregistered it would classify as `internal` — a 400 body labelled a server fault, which tells a retrying client exactly the wrong thing');
+  assert.equal(isRetriable('constraint_violation'), false, 'retrying the same bad value cannot help');
+});
+
+t('the POST /tasks catch actually calls the backstop', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules', 'lifecycle', 'routes', 'task-write-routes.js'), 'utf8');
+  const i = src.indexOf("log.error('[gds] POST /tasks'");
+  assert.ok(i !== -1, 'could not find the POST /tasks catch — this guard is reading the wrong shape');
+  const tail = src.slice(i, i + 800);
+  assert.match(tail, /describeCheckViolation\s*\(/, 'the catch must consult the backstop before answering create_failed');
+  assert.ok(tail.indexOf('describeCheckViolation') < tail.indexOf("res.fail('create_failed'"),
+    'the backstop must run BEFORE the generic 500, or it can never fire');
+});
+
+console.log(`\ntask_field_bounds_match_db: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);