@bongos/core 1.19.715 → 1.19.724

package/tests/go_live.mjs

@@ -25,6 +25,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -109,6 +110,149 @@ test('an undetermined divergence halts and does not fall through to a bump', ()
   assert.equal(p.from, null, 'must not invent a from-version');
 });
 
+// ---------------------------------------------------------------------------
+// The artist gate (ADR 0241, task 1003575)
+//
+// This is the one halt that comes from a PERSON'S queue rather than from git, so
+// what these pin is the boundary around it: it stops a PIN MOVE, it names its own
+// remedy, and it never fires on anything but a definite 'strict'-with-open-reviews
+// answer. A gate that halted on "I could not tell" would brick deploys on an
+// unrelated outage with no task id to release against — the blocked-state-that-
+// does-not-explain-itself failure ADR 0241 §4 was written against.
+// ---------------------------------------------------------------------------
+
+// The shape readArtistGate() resolves to, as the live instance reports it.
+const gate = (over = {}) => ({ mode: 'strict', since: null, holds: false, reviews: [], halt: null, ...over });
+const heldGate = (n = 1) => gate({
+  holds: true,
+  reviews: Array.from({ length: n }, (_, i) => ({ id: String(9000 + i), title: 'Artist review: …' })),
+  halt: {
+    code: 'ARTIST_REVIEW_UNRESOLVED',
+    message: `${n} unresolved artist review${n === 1 ? '' : 's'} hold this deploy — the project runs artist_gate 'strict'`,
+    detail: 'Held by task 9000. Two ways out … POST /tasks/:id/override-request …',
+  },
+});
+
+test('an unresolved artist review HALTS the pin move', () => {
+  const p = G.planGoLive({ div: div(), target: okTarget, targetVersion: '1.19.306', artistGate: heldGate(2) });
+  const h = p.halts.find((x) => x.code === 'ARTIST_REVIEW_UNRESOLVED');
+  assert.ok(h, 'expected ARTIST_REVIEW_UNRESOLVED');
+  // The refusal has to carry its own way out, or it is the stall ADR 0162 retired.
+  assert.match(h.detail, /override-request/);
+});
+
+test('a gate that holds nothing halts nothing — at any level', () => {
+  for (const mode of ['off', 'advisory', 'strict']) {
+    const p = G.planGoLive({ div: div(), target: okTarget, targetVersion: '1.19.306', artistGate: gate({ mode }) });
+    assert.equal(p.halts.length, 0, `${mode}: ${JSON.stringify(p.halts)}`);
+  }
+});
+
+test('an UNREAD gate is a note, never a halt — and never renders as "nothing holds"', () => {
+  // No session, or an instance too old to serve the route: we do not know the
+  // gate applies at all, and halting every deploy on that would brick the pin
+  // with no task id to release against.
+  const p = G.planGoLive({
+    div: div(), target: okTarget, targetVersion: '1.19.306',
+    artistGate: { unread: 'this instance does not serve /artist-gate — it predates ADR 0241' },
+  });
+  assert.equal(p.halts.length, 0, 'not knowing must not brick the pin');
+  const n = p.notes.find((x) => x.code === 'ARTIST_GATE_UNREAD');
+  assert.ok(n, 'but it must be REPORTED — "could not tell" is not "nothing holds"');
+  assert.match(n.message, /may be holding/, 'the wording must not claim the gate is clear');
+});
+
+test('a gate that is THERE and BROKEN halts — the fail-closed half', () => {
+  // The other side of the line: the route exists and 500s. We know the gate
+  // applies and cannot get an answer from it, so deploying past would be a
+  // quieter way through than the owner's own override — the asymmetry to refuse.
+  const p = G.planGoLive({
+    div: div(), target: okTarget, targetVersion: '1.19.306',
+    artistGate: { broken: 'GET /artist-gate returned 500' },
+  });
+  const h = p.halts.find((x) => x.code === 'ARTIST_GATE_UNREADABLE');
+  assert.ok(h, 'expected ARTIST_GATE_UNREADABLE');
+  assert.match(h.detail, /fault on the instance/, 'and it must point at the instance, not at an artist');
+  assert.equal(p.notes.find((x) => x.code === 'ARTIST_GATE_UNREAD'), undefined, 'one verdict, not two');
+});
+
+test('artistGateEntries is the shared composer, so the gitless lane cannot skip the gate', () => {
+  // The on-box lane builds its plan without planGoLive; it reaches the same halt
+  // through this, which is what stops "no git checkout" from meaning "no gate".
+  assert.equal(G.artistGateEntries(heldGate()).halts[0].code, 'ARTIST_REVIEW_UNRESOLVED');
+  assert.deepEqual(G.artistGateEntries(null), { halts: [], notes: [] });
+  assert.equal(G.artistGateEntries({ unread: 'no session' }).notes[0].code, 'ARTIST_GATE_UNREAD');
+});
+
+// ---------------------------------------------------------------------------
+// readArtistGate — the network leg.
+//
+// This is tested rather than left to the file's ssh/spawnSync boundary because a
+// mistake here is INVISIBLE: cli-lib's apiCall composes `${origin}${path}`, so a
+// path missing its `/api/bongos` prefix lands on the origin's catch-all and the
+// gate reports itself unread on every instance — including the ones that fully
+// support it — while the plan reads exactly like a clean run. It shipped that way
+// once. The URL is pinned against the route's REAL mount point in the generated
+// OpenAPI spec, so a rename on either side reds this rather than going quiet.
+// ---------------------------------------------------------------------------
+
+test('the path it requests is the one the server actually mounts', () => {
+  // The spec's paths are relative to its server base, and apiCall prepends
+  // nothing — so the URL go-live builds must be base + path, assembled from the
+  // spec rather than retyped. A rename on either side reds this.
+  const spec = JSON.parse(fs.readFileSync(new URL('../docs/api/openapi.json', import.meta.url), 'utf8'));
+  const bases = (spec.servers || []).map((s) => s.url);
+  const full = new Set(bases.flatMap((b) => Object.keys(spec.paths || {}).map((p) => `${b}${p}`)));
+  assert.ok(full.has(G.ARTIST_GATE_PATH),
+    `go-live requests ${G.ARTIST_GATE_PATH}, which the API spec does not serve — it would hit the origin's catch-all and read as "unread" forever`);
+  assert.match(G.ARTIST_GATE_PATH, /^\/api\//, 'apiCall does not prepend an API prefix — the path must carry it');
+});
+
+test('a real answer is parsed; a 200 that is NOT this route reads as unread, never as "nothing holds"', async () => {
+  const seen = [];
+  const call = async (method, path, body, opts) => { seen.push({ method, path, opts }); return call._res; };
+
+  call._res = { status: 200, ok: true, data: { mode: 'strict', since: null, holds: true, reviews: [{ id: '9001' }], halt: { message: 'm', detail: 'd' } } };
+  const got = await G.readArtistGate(call);
+  assert.deepEqual(seen[0].method, 'GET');
+  assert.equal(seen[0].path, G.ARTIST_GATE_PATH);
+  assert.equal(got.mode, 'strict');
+  assert.ok(got.halt, 'a real halt survives the read');
+
+  // An SPA index.html from a catch-all, or a proxy's own page: 200, no gate. The
+  // one failure that would wave a deploy through in silence.
+  call._res = { status: 200, ok: true, data: { raw: '<!doctype html><html>…' } };
+  const spa = await G.readArtistGate(call);
+  assert.ok(spa.unread, 'a 200 from something else is NOT a gate that holds nothing');
+  assert.equal(spa.halt, undefined);
+});
+
+test('every failure shape resolves — 404 and a lost connection are notes, a 5xx is the halt', async () => {
+  const res = (r) => async () => r;
+  assert.match((await G.readArtistGate(res({ status: 404, ok: false, data: {} }))).unread, /predates ADR 0241/);
+  assert.match((await G.readArtistGate(res({ status: 401, ok: false, data: {} }))).unread, /401/);
+  assert.match((await G.readArtistGate(res({ status: 500, ok: false, data: {} }))).broken, /500/);
+  assert.match((await G.readArtistGate(res({ status: 503, ok: false, data: {} }))).broken, /503/);
+  // It must never throw: a go-live that crashes on a gate read is worse than one
+  // that halts on it.
+  const thrower = async () => { throw new Error('ECONNREFUSED'); };
+  assert.match((await G.readArtistGate(thrower)).unread, /ECONNREFUSED/);
+});
+
+test('the level vocabulary go-live checks against is the gate\'s own', async () => {
+  const gate = await import('../src/bongos/artist-gate.js');
+  assert.deepEqual([...G.ARTIST_GATE_LEVELS].sort(), [...gate.ARTIST_GATE_LEVELS].sort(),
+    'the mirrored list must not drift from src/bongos/artist-gate.js');
+});
+
+test('the plan SHOWS the gate level even when nothing is held', () => {
+  const out = G.renderPlan(
+    { ...G.planGoLive({ div: div(), target: okTarget, targetVersion: '1.19.306', artistGate: gate({ mode: 'advisory' }) }), artistGate: gate({ mode: 'advisory' }) },
+    { targetName: 'web' }
+  );
+  assert.match(out, /artist gate\s+advisory/, '"why did nothing stop?" must be answerable from the plan');
+});
+
 // ---------------------------------------------------------------------------
 // Shell safety — this builds a command that runs as root over ssh
 // ---------------------------------------------------------------------------

package/tests/main_worktree_busy_reason.mjs

@@ -0,0 +1,167 @@
+// tests/main_worktree_busy_reason.mjs
+//
+// task 1002871 — every bail that touches the shared main checkout must identify
+// the OCCUPANT, not just the symptom.
+//
+// THE INCIDENT (idea 1000604, 2026-07-28). A shared main checkout sat parked on
+// `task-1002503-backfill-recovery` with 2 unpushed commits and 4 modified
+// generated files, and blocked the auto-merge leg for NINE confirmed tasks. Most
+// of that idea was fixed: ship-merge.js now detects a main checkout on a feature
+// branch, names it, and states the cure.
+//
+// What was NOT fixed is the exact shape of the incident. mainWorktreeBusy() runs
+// FIRST, and only ever said 'a merge is already in progress' or 'the working tree
+// is dirty or has unmerged files'. A checkout that is BOTH parked AND dirty — the
+// 2026-07-28 state precisely — short-circuits there, so the named-branch
+// diagnostic was reachable only when the tree was clean: the one case where
+// nobody needs telling twice.
+//
+// The decision is pure now so the exact string is pinned rather than eyeballed.
+// This is the ship hot path and the string IS the deliverable.
+//
+// Run:  node tests/main_worktree_busy_reason.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { describeMainWorktreeBusy } = require(path.join(ROOT, 'scripts', 'gds', 'ship-regen.js'));
+const { parkedMainCheckoutWarning } = require(path.join(ROOT, 'scripts', 'gds', 'worktree-claim-guard.js'));
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// --- describeMainWorktreeBusy ------------------------------------------------
+
+t('a clean main checkout on main is not busy', () => {
+  assert.equal(describeMainWorktreeBusy({ mergeInProgress: false, dirty: false, branch: 'main' }), null);
+});
+
+t('THE INCIDENT: dirty AND parked on a feature branch names the branch', () => {
+  const reason = describeMainWorktreeBusy({
+    mergeInProgress: false, dirty: true, branch: 'task-1002503-backfill-recovery',
+  });
+  assert.match(reason, /dirty or has unmerged files/, 'keeps the original symptom');
+  assert.match(reason, /task-1002503-backfill-recovery/, 'and NAMES the squatting branch — the whole point');
+  assert.match(reason, /not `main`/, 'and says what it should have been');
+});
+
+t('a merge in progress on a feature branch also names it', () => {
+  const reason = describeMainWorktreeBusy({ mergeInProgress: true, dirty: true, branch: 'task-999' });
+  assert.match(reason, /merge is already in progress/);
+  assert.match(reason, /task-999/, 'the branch is named on this arm too, not just the dirty one');
+});
+
+t('merge-in-progress wins over dirty — one reason, the most specific', () => {
+  const reason = describeMainWorktreeBusy({ mergeInProgress: true, dirty: true, branch: 'main' });
+  assert.match(reason, /merge is already in progress/);
+  assert.ok(!/dirty/.test(reason), 'must not concatenate both symptoms into one run-on reason');
+});
+
+t('on `main` itself the branch is NOT named — that line would be pure noise', () => {
+  const reason = describeMainWorktreeBusy({ mergeInProgress: false, dirty: true, branch: 'main' });
+  assert.equal(reason, 'the working tree is dirty or has unmerged files',
+    'saying "(on main, not main)" in every bail trains the reader to skip the line');
+});
+
+t('an unreadable branch degrades to the old wording rather than inventing one', () => {
+  for (const branch of [null, undefined, '', 'HEAD']) {
+    const reason = describeMainWorktreeBusy({ mergeInProgress: false, dirty: true, branch });
+    assert.equal(reason, 'the working tree is dirty or has unmerged files',
+      `branch=${JSON.stringify(branch)} must not produce a half-formed name`);
+  }
+});
+
+t('a non-default defaultBranch is honoured', () => {
+  assert.equal(describeMainWorktreeBusy({ dirty: true, branch: 'trunk', defaultBranch: 'trunk' }),
+    'the working tree is dirty or has unmerged files', 'the repo default is not hardcoded to main');
+  assert.match(describeMainWorktreeBusy({ dirty: true, branch: 'main', defaultBranch: 'trunk' }),
+    /on `main`, not `trunk`/);
+});
+
+t('no facts at all is a quiet null, never a throw', () => {
+  assert.equal(describeMainWorktreeBusy(), null);
+  assert.equal(describeMainWorktreeBusy({}), null);
+});
+
+// --- parkedMainCheckoutWarning (the release.js half) -------------------------
+
+t('release warning is silent when the main checkout is on main', () => {
+  assert.deepEqual(parkedMainCheckoutWarning({ branch: 'main' }), []);
+  assert.deepEqual(parkedMainCheckoutWarning({ branch: null }), [], 'an unreadable branch says nothing');
+  assert.deepEqual(parkedMainCheckoutWarning({}), []);
+});
+
+t('release warning names the parked branch, the cost, and the cure', () => {
+  const out = parkedMainCheckoutWarning({ branch: 'task-1002503-backfill-recovery' }).join('\n');
+  assert.match(out, /task-1002503-backfill-recovery/, 'names the occupant');
+  assert.match(out, /nowhere to merge INTO/, 'states the cost, not just the fact');
+  assert.match(out, /someone else/, 'and that the cost lands on other builders too');
+  assert.match(out, /checkout main/, 'and gives the cure');
+});
+
+t('release warning NEVER offers to restore the tree — on EITHER branch of the message', () => {
+  // Both arms, deliberately. A probe that made only the clean-tree line offer a
+  // restore kept this test green when it checked the dirty arm alone: the
+  // "we will not touch it" promise has two renderings and both must keep it.
+  for (const dirty of [true, false]) {
+    const out = parkedMainCheckoutWarning({ branch: 'task-42', dirty }).join('\n');
+    assert.match(out, /nothing here will touch it/i,
+      `dirty=${dirty}: switching the tree back would be a destructive guess — the branch may hold real work`);
+    assert.ok(!/\brestore it\b/i.test(out),
+      `dirty=${dirty}: must not offer to restore the tree on the builder's behalf`);
+  }
+  const dirtyOut = parkedMainCheckoutWarning({ branch: 'task-42', dirty: true }).join('\n');
+  assert.match(dirtyOut, /uncommitted changes/i, 'and when it IS dirty, say so — that is why we do not touch it');
+});
+
+// --- the probes that gather the facts must not build shell strings -----------
+//
+// Caught by the grader on this task: the first cut ran
+// `git -C "${root}" rev-parse …` through execSync, which spawns a shell. A
+// resolved filesystem path is NOT trusted input — a directory containing a quote,
+// backtick or `$()` breaks the quoting and executes as shell. The repo's
+// established pattern passes the directory to child_process instead of
+// interpolating it into a command string, and release.js now goes further and
+// uses an argv array with no shell at all.
+t('release.js never interpolates a path into a git command string', () => {
+  const raw = readFileSync(path.join(ROOT, 'scripts', 'gds', 'release.js'), 'utf8');
+  // Strip comments first: the file DESCRIBES the unsafe form on purpose, to stop
+  // the next reader reintroducing it. Scanning prose as if it were code is how a
+  // guard reds on its own documentation — which this one did, first run.
+  const src = raw.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '');
+  assert.ok(!/git\s+-C\s+["'`]?\$\{/.test(src),
+    'a `git -C "${path}"` command string is shell-interpolated — pass the directory to child_process instead');
+  assert.ok(!/execSync\s*\(\s*[`'"]git /.test(src),
+    'a git command built as a shell string re-opens the injection this test exists to close');
+  assert.match(src, /execFileSync\('git', args/,
+    'git must be invoked with an argv array, which never reaches a shell');
+  assert.match(src, /cwd,/, 'and the directory must travel as cwd, not inside the command');
+  // The stripper must not have eaten the file: a guard over an empty string
+  // passes every negative assertion above and proves nothing.
+  assert.ok(src.length > 500, `comment-stripping left only ${src.length} chars — the scan is reading nothing`);
+});
+
+t('release.js imports nothing outside the published CLI package', () => {
+  const src = readFileSync(path.join(ROOT, 'scripts', 'gds', 'release.js'), 'utf8');
+  const manifest = readFileSync(path.join(ROOT, 'scripts', 'gds', 'build-cli-package.js'), 'utf8');
+  const locals = [...src.matchAll(/require\('\.\/([A-Za-z0-9._-]+)'\)/g)].map((m) => m[1]);
+  assert.ok(locals.length > 0, 'no local requires found — this guard is reading the wrong shape');
+  for (const name of locals) {
+    const file = name.endsWith('.js') ? name : `${name}.js`;
+    assert.ok(manifest.includes(`scripts/gds/${file}`),
+      `release.js requires ./${name}, which is not in the CLI package FILES list — `
+      + '`bongos release` would crash at require time in the published package (it did once already)');
+  }
+});
+
+console.log(`\nmain_worktree_busy_reason: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/membership_kind_lockstep.mjs

@@ -35,9 +35,13 @@ import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import fs from 'node:fs';
 import path from 'node:path';
+import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 import { authSource } from './helpers.mjs';
 
+const require = createRequire(import.meta.url);
+const lint = require('../scripts/gds/lint-migrations.js');
+
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
 
@@ -111,3 +115,87 @@ test('the sender writes BOTH spellings, computing the kind once (the cross-versi
   assert.equal((body.match(/membershipKind\(\{ githubLogin \}\)/g) || []).length, 1,
     'the kind is computed ONCE per check-in, not per field');
 });
+
+// ── THE CONTRACT PHASE — the test of the shim's own removal (task 1003089) ─────
+//
+// ADR 0174's Lineage lesson: a time-boxed shim outlives its release unless its
+// removal ships with the test that says it is gone. core_240 closed the GOAL
+// membership window — the trigger, the function and `goal_members.role` are all
+// dropped, and `membership_kind` carries NOT NULL + DEFAULT itself rather than
+// resting on a trigger surviving.
+//
+// The PROJECT membership half (platform_identity_010) is deliberately NOT here:
+// it is still inside its cross-version federation window, its contract phase is
+// task 1003092, and the expand-phase block above is what still guards it. Do not
+// merge the two — the whole point of the pair is that they close on different
+// schedules.
+const CONTRACT = 'migrations/core_240_goal_members_drop_legacy_role.sql';
+
+test('core_240: the contract phase drops the trigger, the function AND the column', () => {
+  const sql = read(CONTRACT);
+  assert.match(sql, /DROP TRIGGER IF EXISTS goal_members_membership_kind_lockstep ON goal_members/);
+  assert.match(sql, /DROP FUNCTION IF EXISTS goal_members_membership_kind_lockstep\(\)/,
+    'the FUNCTION outlives the trigger unless it is dropped by name — dropping only the trigger '
+    + 'leaves a dangling plpgsql body naming a column that no longer exists');
+  assert.match(sql, /ALTER TABLE goal_members\s+DROP COLUMN IF EXISTS role/);
+  assert.match(sql, /ALTER COLUMN membership_kind SET NOT NULL/,
+    'the guarantee core_220 deferred to step 2 arrives here, or the column never gets one');
+  assert.match(sql, /ALTER COLUMN membership_kind SET DEFAULT 'member'/,
+    'safe only NOW: a default while the legacy column was still written is the task-1003093 bug');
+});
+
+test('core_240: the forward-unsafe pragma is present, and its FIRST line carries the reason', () => {
+  const scan = lint.scanMigrationSql(read(CONTRACT));
+  assert.deepEqual([...scan.unsafe].sort(), ['drop-column', 'set-not-null'],
+    'the linter must still SEE both operations — an acknowledged migration is not an exempt one');
+  assert.ok(scan.acknowledged,
+    'a drop-column with no pragma reds tests/migrations_forward_safe.mjs, which is the point');
+  // ACK_RE captures a SINGLE line, so a reason spread over a paragraph records
+  // nothing in the lint output. The release a rollback could restore is the one
+  // fact that makes the drop safe, so it belongs on that line.
+  assert.match(scan.ackReason, /1\.19\.238/,
+    'the pragma must name the release that stopped reading the column, not merely assert safety');
+});
+
+test('the FRESH-INSTALL seed writes the new name — the writer that is not application code', () => {
+  // The last writer of `goal_members.role` was a MODULE migration, not a query:
+  // lifecycle_001_goal_first_leads.sql named it in the INSERT list AND the
+  // ON CONFLICT arm. Module migrations run AFTER the core ones on every fresh
+  // install, so a stale name here survives the DROP invisibly on an existing
+  // instance (already in schema_migrations, never re-run) and breaks
+  // `cloudbongos init` for every new one. Zero rows on a fresh DB does not save
+  // it: a missing column is a plan-time error, not a row-time one.
+  const code = lint.stripSqlComments(read('modules/lifecycle/migrations/lifecycle_001_goal_first_leads.sql'));
+  assert.match(code, /INSERT INTO goal_members \(goal_id, builder_id, membership_kind\)/);
+  assert.match(code, /DO UPDATE SET membership_kind = 'lead'/,
+    'the ON CONFLICT arm names the column too — renaming only the INSERT list still fails to plan');
+  assert.ok(!/\brole\b/.test(code),
+    'no statement in the fresh-install seed may name the dropped column');
+});
+
+test('no migration outside the three that own its lifecycle still names goal_members.role', () => {
+  // Comments are stripped first: the history is allowed to DISCUSS the old column,
+  // and this rule is about statements. The three exemptions are the migrations that
+  // created the column, expanded away from it, and dropped it.
+  const OWNS_ITS_LIFECYCLE = new Set([
+    '160_goal_tier.sql',                          // created it
+    'core_220_goal_members_membership_kind.sql',  // expand: read it to backfill; the trigger kept it in step
+    'core_240_goal_members_drop_legacy_role.sql', // contract: dropped it
+  ]);
+  const dirs = [path.join(ROOT, 'migrations')];
+  for (const d of fs.readdirSync(path.join(ROOT, 'modules'), { withFileTypes: true })) {
+    if (!d.isDirectory()) continue;
+    const md = path.join(ROOT, 'modules', d.name, 'migrations');
+    if (fs.existsSync(md)) dirs.push(md);
+  }
+  const offenders = [];
+  for (const dir of dirs) {
+    for (const f of fs.readdirSync(dir)) {
+      if (!f.endsWith('.sql') || OWNS_ITS_LIFECYCLE.has(f)) continue;
+      const code = lint.stripSqlComments(fs.readFileSync(path.join(dir, f), 'utf8'));
+      if (/goal_members/.test(code) && /\brole\b/.test(code)) offenders.push(f);
+    }
+  }
+  assert.deepEqual(offenders, [],
+    `these migrations touch goal_members and still name the dropped column: ${offenders.join(', ')}`);
+});

package/tests/mirror_redact.mjs

@@ -161,6 +161,20 @@ t('findSecretLeak detects a secret shape, clean text passes', () => {
   assert.equal(findSecretLeak('token ghp_' + 'a'.repeat(36)), true);
   assert.equal(findSecretLeak('just ordinary prose here'), false);
 });
+// Regression (task 1003873). findSecretLeak is a DIFFERENTIAL audit — it re-scrubs and asks
+// "did anything change?" — so it must run with the same options as the scrub it is auditing.
+// Given none, it re-redacts the long ADR filename that task 1002460's allowlist deliberately
+// spared, mistakes its own disagreement for a leak, and (the gate being fail-closed) reports
+// a phantom secret in every published doc.
+t('findSecretLeak forwards scrub options, so it can audit a scrub that used them', () => {
+  const name = '0281-differential-audit-allowlist-symmetry.md';
+  const doc = `see docs/adr/${name} for the rationale`;
+  const knownDocNames = new Set([name]);
+  assert.equal(findSecretLeak(doc), true, 'without the allowlist the filename reads as a secret');
+  assert.equal(findSecretLeak(doc, [], { knownDocNames }), false, 'with it, a file is a file');
+  // …and the allowlist is not a smuggling channel: a real shape beside it still trips.
+  assert.equal(findSecretLeak(`ghp_${'a'.repeat(36)} in docs/adr/${name}`, [], { knownDocNames }), true);
+});
 
 // ── vanilla instance (empty branding) — IP floor still works, no token/owner rules ────
 t('empty branding derives no tokens/owners but the IP floor still redacts', () => {

package/tests/module_api.mjs

@@ -23,6 +23,11 @@ const PUBLISHED_SURFACE = [
   'requireBuilder', 'requireRank', 'rankMeetsThreshold', 'requireBfgPrincipal', 'allowBoxScope', 'resolveSession',
   'requirePermission', // BV1.R105: the authority-atom gate module routes migrate onto (1.19.0; ADR 0151)
   'pool', 'getPool', 'instanceDbName', 'withTx', 'getBuilderById',
+  // added by task 1003575 (ADR 0241 §3): the instance's PROJECT OWNER — its first
+  // admitted human builder. Kernel identity like getBuilderById beside it, and
+  // published because the artist gate's one escape hatch is the owner's alone, and
+  // a module cannot enforce that without being able to ask who the owner is.
+  'getFoundingBuilder',
   'secretBox', // Gemini-key storage relocated to modules/art-pipeline + its 'art.getBuilderGeminiKeyRow' port (ADR 0102)
   'grantedScopeCoversRepos', // the create-route credential preflight's scope read (task 1002909); kernel (auth-config.js), unlike db/github-repos which the module reaches via `pool` + its own client
   'accountExistenceReadRateLimit', // task 1003339 (ADR 0209): the shared per-IP budget both account-existence probes spend from — one instance, not a factory, so the budget is genuinely shared
@@ -40,6 +45,7 @@ const PUBLISHED_SURFACE = [
   'resolveRotDays', 'projectSettings', // added by task 1003279 (ADR 0232; goal 1000072): the ROT timer + the live knob store behind it. A DIFFERENT question from the stale-claim timer above — days not hours, DB not env, work nobody picked up rather than a builder who went quiet, and it only ever ASKS a human where that one ACTS. Both ride the doorway so no module hardcodes either.
   'joinabilityMode', // added by task 1003044 (ADR 0194; the carrier after 1.19.374): the project's membership door, one reader for the sign-in gate AND the onboarding module's public POST
   'projectJoinDoor', // added by task 1002331 (ADR 0182 D6 / ADR 0247): the COMPOSED join/apply door — visibility × join grant × joinability, one answer, so a module reading a single knob cannot re-open a door the other two closed
+  'artistGate', // added by task 1003575 (ADR 0241): the artist gate — off | advisory | strict, plus the pure verdict helpers over it. Two modules ask it two different questions ("file this review?" and "does an open one hold the deploy?") and both must resolve the knob through this one reader, never branding().project
   'readApplicantProfileFromHub', // added by task 1002972 (privacy spec D7): the reviewer queue's LIVE per-render read of one applicant's hub profile view. NARROW by design — the underlying call is authenticated with this instance's hub client secret, and loadIdpConfig stays OFF the doorway so no module ever holds the credential that speaks for the whole project
   'enabledDisciplines', // BV1.R81: instance offered-disciplines (1.9.0; onboarding restock backstop)
   'registerProvider', 'hasProvider', 'resolve', 'resolveOptional', 'listPorts', 'verifyPortsSatisfied',

package/tests/provision_settings_apply.mjs

@@ -61,6 +61,8 @@ ${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY=public
 ${NEUTRAL_PREFIX}_JOINABILITY=apply
 ${NEUTRAL_PREFIX}_VISIBILITY=public
 ${NEUTRAL_PREFIX}_JOIN_GRANT=full
+${NEUTRAL_PREFIX}_ARTIST_GATE=strict
+${NEUTRAL_PREFIX}_ARTIST_GATE_SINCE=
 `;
 
 t('replaces an existing KEY= line where it stands; every other line survives byte-for-byte', () => {
@@ -113,7 +115,13 @@ t('is PURE: same input, same output; empty body yields just the lines', () => {
 t('settingsEnvVarsFor: the runner pushes the SAME pair webEnvBody writes at standup, under the pack prefix', () => {
   const inst = { slug: 'spike', port: 3010, db_name: 'spike', hosting_shape: 'standalone', target_ref: 'jaxri/spike', settings: { platform_visibility: 'gated' } };
   const vars = P.settingsEnvVarsFor(inst);
-  assert.deepEqual(vars, { [`${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY`]: 'gated', [`${NEUTRAL_PREFIX}_JOINABILITY`]: 'apply', [`${NEUTRAL_PREFIX}_VISIBILITY`]: 'public', [`${NEUTRAL_PREFIX}_JOIN_GRANT`]: 'full' });
+  assert.deepEqual(vars, {
+    [`${NEUTRAL_PREFIX}_PLATFORM_VISIBILITY`]: 'gated', [`${NEUTRAL_PREFIX}_JOINABILITY`]: 'apply',
+    [`${NEUTRAL_PREFIX}_VISIBILITY`]: 'public', [`${NEUTRAL_PREFIX}_JOIN_GRANT`]: 'full',
+    // the artist gate + its non-retroactivity stamp (task 1003575, ADR 0241) ride
+    // the same transport; the stamp is empty until the gate is actually RAISED
+    [`${NEUTRAL_PREFIX}_ARTIST_GATE`]: 'strict', [`${NEUTRAL_PREFIX}_ARTIST_GATE_SINCE`]: '',
+  });
   const body = P.webEnvBody(inst, {});
   for (const [k, v] of Object.entries(vars)) assert.match(body, new RegExp(`^${k}=${v}$`, 'm'), `${k} at standup`);
 });
@@ -124,10 +132,10 @@ const GATED = { settings: { platform_visibility: 'gated', joinability: 'invite_o
 const manifestWith = (project) => JSON.stringify({ schema: 'instance-manifest/v1', brand: project === undefined ? {} : { project } });
 
 t('true when every pushed key matches brand.project (camelCase, the ENV_OVERRIDES targets)', () => {
-  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public', joinGrant: 'full' }), GATED), true);
+  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public', joinGrant: 'full', artistGate: 'strict' }), GATED), true);
 });
 t('false when the instance still reports a different value', () => {
-  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'public', joinability: 'invite_only', visibility: 'public', joinGrant: 'full' }), GATED), false);
+  assert.equal(P.settingsConsumed(manifestWith({ platformVisibility: 'public', joinability: 'invite_only', visibility: 'public', joinGrant: 'full', artistGate: 'strict' }), GATED), false);
   assert.equal(P.settingsConsumed(manifestWith({ joinability: 'invite_only' }), GATED), false, 'a missing key is a mismatch, not a pass');
 });
 t('null (unknown) when the manifest carries no project block — a core that predates task 1003139 — or does not parse', () => {
@@ -145,7 +153,7 @@ t('instanceManifestCmd asks the instance on loopback, like healthzCmd', () => {
 function recorder({ apply = false, envBody = LIVE_ENV, readFails = false, healthzFails = false, privileged = false,
   manifest = 'match', restartThrows = false, writeThrows = false } = {}) {
   const cmds = [], writes = [], events = [], probes = [], cleared = [], logs = [];
-  const manifestOut = manifest === 'match' ? manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public', joinGrant: 'full' })
+  const manifestOut = manifest === 'match' ? manifestWith({ platformVisibility: 'gated', joinability: 'invite_only', visibility: 'public', joinGrant: 'full', artistGate: 'strict' })
     : manifest === 'mismatch' ? manifestWith({ platformVisibility: 'public', joinability: 'apply', visibility: 'public' })
     : manifest === 'none' ? manifestWith(undefined) : 'nope';
   const exec = (cmd, opts = {}) => {
@@ -214,7 +222,7 @@ await ta('dry-run PLANS the patch: reads nothing real, writes NOTHING (no synthe
   assert.equal(r.ok, true);
   assert.equal(r.healthy, null, 'nothing ran, nothing observed');
   assert.equal(writes.length, 0, 'a dry-run must not plan a two-line overwrite of web.env');
-  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY, .*_VISIBILITY, .*_JOIN_GRANT in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
+  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY, .*_VISIBILITY, .*_JOIN_GRANT, .*_ARTIST_GATE, .*_ARTIST_GATE_SINCE in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
   assert.ok(cmds.some((c) => /restart spike/.test(c)), 'the restart is still in the plan');
   assert.ok(logs.some((l) => /dry-run — nothing ran/.test(l)), 'the closing line does not claim a restart happened');
 });

package/tests/provisioning_settings.mjs

@@ -164,7 +164,7 @@ await ta('owner reads DEFAULTS (public / apply) on a row with empty settings —
   reset();
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
   // the planet rides beside the settings (task 1003347): no default — null = the platform's own pick
   assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null, card_backdrop: null });
   assert.deepEqual(r.body.options, {
@@ -175,6 +175,10 @@ await ta('owner reads DEFAULTS (public / apply) on a row with empty settings —
     // what a PUBLIC join grants (task 1002331, ADR 0247) — the fourth policy
     // axis, offered to the form the same way
     join_grant: ['view', 'apply', 'full'],
+    // the artist gate (task 1003575, ADR 0241) — the fifth policy axis. It is
+    // offered to the form like the rest; what makes it different is only its
+    // default, which is the owner's ruling rather than today's behaviour.
+    artist_gate: ['off', 'advisory', 'strict'],
     planet_template: [...provisioning.PLANET_TEMPLATES], planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
     // the card's backdrop (task 1003352) is the same kind of key: platform-drawn,
     // closed list, no default, no push — so it rides the same vocab
@@ -187,14 +191,14 @@ await ta('a stored planet reads back; a name that left the vocabulary reads null
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: null, card_backdrop: null });
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' }, 'the planet is not a setting: the policy read is untouched');
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' }, 'the planet is not a setting: the policy read is untouched');
 });
 
 await ta('stored keys overlay the defaults', async () => {
   reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', settings: { joinability: 'invite_only' } } });
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full' });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
 });
 
 await ta('ANOTHER builder\'s GET → 404 (no existence leak)', async () => {
@@ -222,7 +226,7 @@ await ta('owner changes one key — merged, returned effective, audited api:self
   reset();
   const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full' }, 'the SAVED value — the response never claims the instance runs it (task 1003140)');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict' }, 'the SAVED value — the response never claims the instance runs it (task 1003140)');
   assert.equal(r.body.push.queued, true, 'an active co-tenant gets the live push (task 1003140)');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { joinability: 'open' } }], 'exactly the sent key, nothing else');
   assert.equal(events.length, 1);
@@ -235,7 +239,7 @@ await ta('owner changes both keys in one call', async () => {
   reset();
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated', joinability: 'invite_only' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'invite_only', visibility: 'public', join_grant: 'full' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
 });
 
 await ta('the OWN-SCOPE WALL: another builder\'s PATCH → 404 and the write path is never reached', async () => {
@@ -274,7 +278,7 @@ await ta('the owner sets the door to stealth — stored, echoed effective, audit
   reset();
   const r = await patch('/provisioning/instances/18/settings', { visibility: 'stealth' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full', artist_gate: 'strict' });
   assert.deepEqual(updateCalls, [{ id: 18, patch: { visibility: 'stealth' } }], 'exactly the sent key, nothing else');
   assert.equal(events[0].actor, 'api:self');
   assert.match(events[0].detail, /visibility=stealth/);
@@ -334,7 +338,7 @@ await ta('the owner picks a planet: saved, echoed as `planet`, audited — and N
   const r = await patch('/provisioning/instances/18/settings', { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' });
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: 'sea', card_backdrop: null });
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' }, 'the policy half is untouched');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' }, 'the policy half is untouched');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' } }]);
   assert.equal(r.body.push.queued, false);
   assert.equal(r.body.push.restart, false, 'an active co-tenant would get a push for a POLICY change — never for the planet');