@bongos/core 1.19.715 → 1.19.725

package/tests/provisioning_settings.mjs

@@ -164,7 +164,7 @@ await ta('owner reads DEFAULTS (public / apply) on a row with empty settings —
   reset();
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
   // the planet rides beside the settings (task 1003347): no default — null = the platform's own pick
   assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null, card_backdrop: null });
   assert.deepEqual(r.body.options, {
@@ -175,6 +175,10 @@ await ta('owner reads DEFAULTS (public / apply) on a row with empty settings —
     // what a PUBLIC join grants (task 1002331, ADR 0247) — the fourth policy
     // axis, offered to the form the same way
     join_grant: ['view', 'apply', 'full'],
+    // the artist gate (task 1003575, ADR 0241) — the fifth policy axis. It is
+    // offered to the form like the rest; what makes it different is only its
+    // default, which is the owner's ruling rather than today's behaviour.
+    artist_gate: ['off', 'advisory', 'strict'],
     planet_template: [...provisioning.PLANET_TEMPLATES], planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
     // the card's backdrop (task 1003352) is the same kind of key: platform-drawn,
     // closed list, no default, no push — so it rides the same vocab
@@ -187,14 +191,14 @@ await ta('a stored planet reads back; a name that left the vocabulary reads null
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: null, card_backdrop: null });
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' }, 'the planet is not a setting: the policy read is untouched');
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' }, 'the planet is not a setting: the policy read is untouched');
 });
 
 await ta('stored keys overlay the defaults', async () => {
   reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', settings: { joinability: 'invite_only' } } });
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full' });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
 });
 
 await ta('ANOTHER builder\'s GET → 404 (no existence leak)', async () => {
@@ -222,7 +226,7 @@ await ta('owner changes one key — merged, returned effective, audited api:self
   reset();
   const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full' }, 'the SAVED value — the response never claims the instance runs it (task 1003140)');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict' }, 'the SAVED value — the response never claims the instance runs it (task 1003140)');
   assert.equal(r.body.push.queued, true, 'an active co-tenant gets the live push (task 1003140)');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { joinability: 'open' } }], 'exactly the sent key, nothing else');
   assert.equal(events.length, 1);
@@ -235,7 +239,7 @@ await ta('owner changes both keys in one call', async () => {
   reset();
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated', joinability: 'invite_only' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'invite_only', visibility: 'public', join_grant: 'full' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
 });
 
 await ta('the OWN-SCOPE WALL: another builder\'s PATCH → 404 and the write path is never reached', async () => {
@@ -274,7 +278,7 @@ await ta('the owner sets the door to stealth — stored, echoed effective, audit
   reset();
   const r = await patch('/provisioning/instances/18/settings', { visibility: 'stealth' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full', artist_gate: 'strict' });
   assert.deepEqual(updateCalls, [{ id: 18, patch: { visibility: 'stealth' } }], 'exactly the sent key, nothing else');
   assert.equal(events[0].actor, 'api:self');
   assert.match(events[0].detail, /visibility=stealth/);
@@ -334,7 +338,7 @@ await ta('the owner picks a planet: saved, echoed as `planet`, audited — and N
   const r = await patch('/provisioning/instances/18/settings', { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' });
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: 'sea', card_backdrop: null });
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full' }, 'the policy half is untouched');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' }, 'the policy half is untouched');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' } }]);
   assert.equal(r.body.push.queued, false);
   assert.equal(r.body.push.restart, false, 'an active co-tenant would get a push for a POLICY change — never for the planet');

package/tests/provisioning_settings_apply.mjs

@@ -225,7 +225,7 @@ await ta('ACTIVE standalone: the row is written FIRST, then a settings-apply int
   reset();
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full' }, 'the SAVED (requested) value — never `settings`, which a form would render as live');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict' }, 'the SAVED (requested) value — never `settings`, which a form would render as live');
   assert.equal(r.body.settings, undefined);
   assert.deepEqual(updateCalls.map((c) => c.patch), [{ platform_visibility: 'gated' }]);
   assert.equal(updateCalls[0].enqueuedSoFar, 0, 'the runner reads the row — the write must precede the intent');
@@ -274,7 +274,7 @@ await ta('an enqueue that THROWS still answers 200 "saved" — never a 500 that
   enqueueThrows = new Error('db down');
   const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
   assert.equal(updateCalls.length, 1, 'the write landed');
   receiptShape(r.body.push, { queued: false, restart: true, reachable: true });
   assert.match(r.body.push.message, /Saved, but the restart could not be queued/);
@@ -287,7 +287,7 @@ await ta('same values as already stored → no write, no event, no intent, "No c
   reset({ inst: { ...ACTIVE, settings: { platform_visibility: 'gated', joinability: 'open' } } });
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated', joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public', join_grant: 'full' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict' });
   assert.equal(updateCalls.length, 0, 'nothing written (no updated_at reshuffle)');
   assert.equal(events.length, 0, 'no "settings changed" event for a change that is not one');
   assert.equal(enqueueCalls.length, 0, 'a whole-form save must not bounce a live project');
@@ -404,7 +404,7 @@ await ta('save A queues → save B 409s while A RUNS → A settles → the UNCHA
   assert.equal(enqueueCalls.length, enqueuedBefore + 1, 'exactly one new intent');
   assert.equal(updateCalls.length, writesBefore, 'nothing re-written — the value was already stored in step 2');
   assert.deepEqual(owedCalls[owedCalls.length - 1], { id: 18, owed: false }, 'and the debt is settled');
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public', join_grant: 'full' },
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict' },
     'the value that finally ships is the one the owner saved');
 });
 

package/tests/provisioning_settings_env.mjs

@@ -59,8 +59,17 @@ t('a row with NO stored settings emits today\'s behavior EXPLICITLY, never nothi
   assert.equal(v.CLOUDBONGOS_VISIBILITY, 'public');
   // what a public join grants rides it too (task 1002331, ADR 0182 D6)
   assert.equal(v.CLOUDBONGOS_JOIN_GRANT, 'full');
+  // The artist gate is the one key whose default is NOT today's behaviour — it is
+  // the owner's ruling (ADR 0241 §4), and it is safe as a default because strict
+  // holds only a pin move, never a builder's ship.
+  assert.equal(v.CLOUDBONGOS_ARTIST_GATE, 'strict');
+  // Its companion stamp is emitted EMPTY rather than omitted: an absent variable is
+  // a policy the instance would have to infer, and empty already means "no cutoff".
+  assert.equal(v.CLOUDBONGOS_ARTIST_GATE_SINCE, '', 'present and empty — never absent');
+  assert.ok(linesOf(provisioning.settingsEnvLines({}, 'X')).some((l) => l === 'X_ARTIST_GATE_SINCE='));
   assert.equal(linesOf(provisioning.settingsEnvLines({}, 'X')).length,
-    Object.keys(provisioning.SETTINGS_VOCAB).length, 'every policy key always present');
+    Object.keys(provisioning.SETTINGS_VOCAB).length + Object.keys(provisioning.SETTINGS_COMPANION_ENV).length,
+    'every policy key and every declared companion always present');
 });
 
 t('an off-vocabulary stored value falls back to the default, never reaches the instance', () => {
@@ -82,10 +91,14 @@ t('the planet never rides the env transport (task 1003347): it is the platform\'
   assert.doesNotMatch(provisioning.settingsEnvLines({ settings: { planet_template: 'bead-obsidian-tint' } }, 'CB'), /planet|PLANET/);
 });
 
-t('every emitted key is in SETTINGS_VOCAB — the two lists cannot drift', () => {
+t('every emitted key is a vocabulary key or a DECLARED companion — the lists cannot drift', () => {
   const keys = linesOf(provisioning.settingsEnvLines({}, 'X')).map((l) => l.split('=')[0].replace(/^X_/, '').toLowerCase());
-  assert.deepEqual(keys.sort(), Object.keys(provisioning.SETTINGS_VOCAB).sort(),
-    'a key added to the vocabulary must be carried, or the instance never learns it');
+  const expected = [
+    ...Object.keys(provisioning.SETTINGS_VOCAB),
+    ...Object.keys(provisioning.SETTINGS_COMPANION_ENV).map((k) => k.toLowerCase()),
+  ];
+  assert.deepEqual(keys.sort(), expected.sort(),
+    'a key added to the vocabulary must be carried, or the instance never learns it — and an env var the instance reads must be a DECLARED companion, never an ad-hoc extra');
 });
 
 console.log('\nThe generated file tells the truth about what it is:');
@@ -99,11 +112,50 @@ t('it names the live push by the intent the runner actually dispatches (task 100
 });
 
 t('settingsEnvVars is the single source both legs derive from — same keys, same values as the lines', () => {
-  const row = { settings: { platform_visibility: 'gated', joinability: 'open', visibility: 'stealth', join_grant: 'view' } };
+  const row = { settings: { platform_visibility: 'gated', joinability: 'open', visibility: 'stealth', join_grant: 'view', artist_gate: 'advisory' } };
   const vars = provisioning.settingsEnvVars(row, 'CLOUDBONGOS');
-  assert.deepEqual(vars, { CLOUDBONGOS_PLATFORM_VISIBILITY: 'gated', CLOUDBONGOS_JOINABILITY: 'open', CLOUDBONGOS_VISIBILITY: 'stealth', CLOUDBONGOS_JOIN_GRANT: 'view' });
+  assert.deepEqual(vars, {
+    CLOUDBONGOS_PLATFORM_VISIBILITY: 'gated', CLOUDBONGOS_JOINABILITY: 'open', CLOUDBONGOS_VISIBILITY: 'stealth',
+    CLOUDBONGOS_JOIN_GRANT: 'view', CLOUDBONGOS_ARTIST_GATE: 'advisory', CLOUDBONGOS_ARTIST_GATE_SINCE: '',
+  });
+  // varsOf splits on '=', so an empty value reads as '' on both sides — the point
+  // of the comparison is that the standup lines carry exactly the same key set.
   assert.deepEqual(varsOf(provisioning.settingsEnvLines(row, 'CLOUDBONGOS')), vars, 'the standup lines ARE the vars');
-  assert.deepEqual(provisioning.settingsEnvVars({}, 'X'), { X_PLATFORM_VISIBILITY: 'public', X_JOINABILITY: 'apply', X_VISIBILITY: 'public', X_JOIN_GRANT: 'full' }, 'defaults, explicitly');
+  assert.deepEqual(provisioning.settingsEnvVars({}, 'X'), {
+    X_PLATFORM_VISIBILITY: 'public', X_JOINABILITY: 'apply', X_VISIBILITY: 'public', X_JOIN_GRANT: 'full',
+    X_ARTIST_GATE: 'strict', X_ARTIST_GATE_SINCE: '',
+  }, 'defaults, explicitly');
+});
+
+console.log('\nThe artist gate rides the same transport (ADR 0241, task 1003575):');
+
+t('the stamp is carried only when the gate was actually RAISED, and it is the row\'s own value', () => {
+  const stamped = { settings: { artist_gate: 'strict', artist_gate_strict_since: '2026-09-13T00:00:00.000Z' } };
+  assert.equal(provisioning.settingsEnvVars(stamped, 'X').X_ARTIST_GATE_SINCE, '2026-09-13T00:00:00.000Z');
+  // An unparseable stamp is NOT transmitted as a date nobody can read: it reads as
+  // absent, which is the safe direction — no cutoff, so every open review counts.
+  assert.equal(provisioning.settingsEnvVars({ settings: { artist_gate_strict_since: 'whenever' } }, 'X').X_ARTIST_GATE_SINCE, '');
+});
+
+t('artistGateStamp writes the cutoff on a RAISE only — no other save may move it (ADR 0241 §5)', () => {
+  const now = new Date('2026-09-13T12:00:00.000Z');
+  const key = provisioning.ARTIST_GATE_STRICT_SINCE_KEY;
+  // advisory → strict is the tightening the stamp exists for.
+  assert.deepEqual(provisioning.artistGateStamp({ settings: { artist_gate: 'advisory' } }, { artist_gate: 'strict' }, now),
+    { [key]: '2026-09-13T12:00:00.000Z' });
+  // A row with NO stored gate is already 'strict' by default — re-sending 'strict'
+  // is not a raise, and stamping it would silently un-hold reviews already held.
+  assert.deepEqual(provisioning.artistGateStamp({}, { artist_gate: 'strict' }, now), {});
+  // Lowering, and any save that does not touch the gate at all, move nothing.
+  assert.deepEqual(provisioning.artistGateStamp({ settings: { artist_gate: 'strict' } }, { artist_gate: 'off' }, now), {});
+  assert.deepEqual(provisioning.artistGateStamp({ settings: { artist_gate: 'advisory' } }, { joinability: 'open' }, now), {});
+});
+
+t('the stamp can neither leak as a setting nor be written by a client patch', () => {
+  const row = { settings: { artist_gate: 'strict', artist_gate_strict_since: '2026-09-13T00:00:00.000Z' } };
+  assert.ok(!(provisioning.ARTIST_GATE_STRICT_SINCE_KEY in provisioning.SETTINGS_VOCAB));
+  assert.ok(!(provisioning.ARTIST_GATE_STRICT_SINCE_KEY in provisioning.PLANET_VOCAB));
+  assert.ok(!(provisioning.ARTIST_GATE_STRICT_SINCE_KEY in provisioning.effectiveSettings(row)));
 });
 
 console.log('\nwebEnvBody — the settings ride the real per-instance env file:');

package/tests/public_mirror_export.mjs

@@ -103,6 +103,18 @@ t('redactBlob SCRUBS a secret shape from a text blob (handled, not leaked)', ()
   assert.ok(!r.buf.toString('utf8').includes('AKIAABCDEFGHIJKLMNOP'), 'the secret must be scrubbed from the published text');
   assert.equal(r.secret, false, 'a scrubbed text secret is handled, so it is not a residual leak');
 });
+// Regression (task 1003873). The secret verdict audits THIS call's own scrub, so it has to
+// share the scrub's knownDocNames allowlist. When it did not, the audit re-redacted the ADR
+// filename the scrub had just spared, read the difference as a leak, and failed the packager
+// closed on every doc in the tree — the publish lane stayed red for seven core releases.
+t('redactBlob reports no secret for an allowlisted doc filename (the gate agrees with its own scrub)', () => {
+  const name = '0281-differential-audit-allowlist-symmetry.md';
+  const knownDocNames = new Set([name]);
+  const r = redactBlob({ buf: Buffer.from(`see [ADR 0281](docs/adr/${name}) for why`), rules, sensitiveLiterals, envSecrets: [], knownDocNames });
+  assert.ok(r.buf.toString('utf8').includes(name), 'the allowlisted filename must survive the scrub');
+  assert.equal(r.secret, false, 'and must not then be reported as a residual secret');
+  assert.deepEqual(r.leaks, []);
+});
 t('redactBlob FAILS CLOSED on a secret inside a BINARY blob (cannot safely rewrite it)', () => {
   const bin = Buffer.concat([Buffer.from('BIN\x00'), Buffer.from('AKIA' + 'ABCDEFGHIJKLMNOP')]);
   const r = redactBlob({ buf: bin, rules, sensitiveLiterals, envSecrets: [] });

package/tests/rank_roles_audit.mjs

@@ -0,0 +1,114 @@
+// tests/rank_roles_audit.mjs
+//
+// task 1002873 — the re-runnable half of "does the live roster hold only the four
+// live ranks?".
+//
+// THE GAP THIS CLOSES. migrations/023's CHECK on builders.rank still admits twelve
+// legacy values. governance_002's backfill INNER JOINs rank → the four seeded
+// governance_roles, so a builder on a legacy rank gets no role row and resolves to
+// ZERO permissions — admitted by threshold under requireRank, refused by the
+// resolver, and told nothing. ADR 0151 chose that fail-closed direction
+// deliberately; what was missing was anyone CHECKING.
+//
+// Three things had looked like the check and were not:
+//   - governance_002's own comment ("none exist today — verified") is a
+//     point-in-time manual note that nothing re-runs.
+//   - tests/governance_parity.mjs is DB-free by necessity (the unit gate has no
+//     Postgres) and says in the repo that it defers the roster half.
+//   - R114's live proof ran on a scratch DB holding only the four seeded
+//     rank-roles; the production roster was never queried.
+//
+// So the decision is a PURE function and this is a DB-free test of it. That is not
+// a compromise — no-Postgres-in-CI is precisely why the gap survived, and a
+// decision that can be tested without a database is the only kind that gets tested
+// at all here. The live read is the script's thin shell around it.
+//
+// Run:  node tests/rank_roles_audit.mjs
+
+import { strict as assert } from 'node:assert';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { findRanksWithoutRoles, summarize } = require(path.join(ROOT, 'scripts', 'gds', 'audit-rank-roles.js'));
+const { LIVE_RANK_LADDER } = require(path.join(ROOT, 'src', 'bongos', 'db-kernel.js'));
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const live = (rank, id = 1) => ({ id, github_login: `u${id}`, rank, status: 'active' });
+
+t('the live ladder is the four ranks this audit is about', () => {
+  // Derived, not retyped: if the ladder ever gains a rank, this audit must be
+  // re-reasoned rather than silently widened.
+  assert.deepEqual([...LIVE_RANK_LADDER].sort(), ['archon', 'metic', 'thetes', 'xenos']);
+});
+
+t('a roster of only live ranks has no offenders', () => {
+  const rows = LIVE_RANK_LADDER.map((r, i) => live(r, i + 1));
+  assert.deepEqual(findRanksWithoutRoles(rows), []);
+});
+
+t('a LEGACY rank is caught — the whole point', () => {
+  const out = findRanksWithoutRoles([live('archon', 1), { id: 2, github_login: 'old', rank: 'ephor', status: 'active' }]);
+  assert.equal(out.length, 1);
+  assert.equal(out[0].rank, 'ephor');
+  assert.equal(out[0].id, '2', 'the id must be reported as a string an operator can paste');
+  assert.equal(out[0].github_login, 'old', 'and the login, which is what identifies the account');
+});
+
+t('a NULL or missing rank is caught too — it fails the same INNER JOIN', () => {
+  for (const row of [
+    { id: 3, rank: null, status: 'active' },
+    { id: 4, status: 'active' },
+    { id: 5, rank: '', status: 'active' },
+  ]) {
+    const out = findRanksWithoutRoles([row]);
+    assert.equal(out.length, 1, `${JSON.stringify(row)} must be reported`);
+    assert.equal(out[0].rank, row.rank === undefined ? null : row.rank);
+  }
+});
+
+t('an INACTIVE builder on a legacy rank is still reported', () => {
+  // The roster query has no WHERE on `builders`, and this is the row a future
+  // CHECK-narrowing migration would fail to apply over. Skipping it would make a
+  // clean audit a false assurance for exactly the case that matters.
+  const out = findRanksWithoutRoles([{ id: 9, github_login: 'gone', rank: 'hoplite', status: 'inactive' }]);
+  assert.equal(out.length, 1);
+  assert.equal(out[0].status, 'inactive', 'and the status is carried so the operator can judge urgency');
+});
+
+t('case matters — the backfill JOIN is exact', () => {
+  const out = findRanksWithoutRoles([{ id: 6, rank: 'Archon', status: 'active' }]);
+  assert.equal(out.length, 1, '`Archon` does not equal `archon` in SQL; a near-miss is still zero permissions');
+});
+
+t('an empty or junk roster reports nothing and never throws', () => {
+  for (const bad of [[], null, undefined, 'nope', {}]) {
+    assert.deepEqual(findRanksWithoutRoles(bad), [], `${JSON.stringify(bad)} must be a quiet empty result`);
+  }
+  assert.deepEqual(findRanksWithoutRoles([null, undefined]), [], 'null rows are skipped, not dereferenced');
+});
+
+t('the live-rank set is injectable, so the test is not asserting against itself', () => {
+  // Pass a deliberately different ladder: the function must obey its argument
+  // rather than a hardcoded list, or this whole file would be tautological.
+  assert.equal(findRanksWithoutRoles([live('archon')], ['xenos']).length, 1);
+  assert.equal(findRanksWithoutRoles([live('xenos')], ['xenos']).length, 0);
+});
+
+t('summarize counts every rank, including the missing one', () => {
+  const h = summarize([live('xenos', 1), live('xenos', 2), live('archon', 3), { id: 4, rank: null }]);
+  assert.deepEqual(h, [['xenos', 2], ['archon', 1], ['(none)', 1]],
+    'a clean run must still say what it looked at — a check that prints nothing is '
+    + 'indistinguishable from one that read nothing, which is the failure this task is about');
+});
+
+console.log(`\nrank_roles_audit: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/repo_info_binding.mjs

@@ -208,6 +208,88 @@ test('a good bind still produces the blob/tree bases callers rely on', () => {
   }
 });
 
+// ---- loadFromBranding: the source a standalone instance actually has -------
+//
+// An installed core sits in node_modules/@bongos/core, so loadFromGit correctly refuses
+// and nothing sets the env pin — which meant EVERY standalone instance served a 503 from
+// /public/repo-info while `config/branding.json` held the answer. These cases pin the new
+// source AND, just as importantly, pin that it did not disturb the two above it.
+
+const PACK = { repo: { owner: FIXTURE_OWNER, name: FIXTURE_REPO } };
+
+test('a branding pack with owner + name binds (repo.name maps to repo)', () => {
+  assert.deepEqual(ri.loadFromBranding({ branding: () => PACK }), {
+    owner: FIXTURE_OWNER,
+    repo: FIXTURE_REPO,
+  });
+});
+
+test('the neutral pack (empty strings) is NOT an answer', () => {
+  assert.equal(ri.loadFromBranding({ branding: () => ({ repo: { owner: '', name: '' } }) }), null);
+  assert.equal(ri.loadFromBranding({ branding: () => ({ repo: { owner: '  ', name: FIXTURE_REPO } }) }), null);
+});
+
+test('a pack with no repo key at all → null', () => {
+  assert.equal(ri.loadFromBranding({ branding: () => ({ identity: { productName: 'x' } }) }), null);
+  assert.equal(ri.loadFromBranding({ branding: () => null }), null);
+});
+
+test('a THROWING branding loader degrades to null, never a crash', () => {
+  assert.equal(ri.loadFromBranding({ branding: () => { throw new Error('malformed pack'); } }), null);
+});
+
+test('THE FIX: packaged instance, no env, no git → branding answers instead of 503', () => {
+  ri._resetCacheForTests();
+  try {
+    const root = path.resolve('/srv/instance/node_modules/@bongos/core');
+    const info = ri.loadRepoInfo({
+      execSync: mkExec({ toplevel: path.resolve('/srv/instance') }), // git walks up → refused
+      packageRoot: root,
+      branding: () => PACK,
+    });
+    assert.equal(info.error, undefined, 'the instance declares its own repo — that is not an error case');
+    assert.equal(info.owner, FIXTURE_OWNER);
+    assert.equal(info.repo, FIXTURE_REPO);
+    assert.equal(info.blob_base, `https://github.com/${FIXTURE_OWNER}/${FIXTURE_REPO}/blob/main`);
+  } finally {
+    ri._resetCacheForTests();
+  }
+});
+
+test('git still WINS over branding (the core dev checkout is unchanged)', () => {
+  ri._resetCacheForTests();
+  try {
+    const root = path.resolve('/srv/cloud-bongos');
+    const info = ri.loadRepoInfo({
+      execSync: mkExec({ toplevel: root }), // the remote resolves → git answers
+      packageRoot: root,
+      branding: () => ({ repo: { owner: 'packowner', name: 'packrepo' } }),
+    });
+    assert.equal(info.owner, FIXTURE_OWNER, 'branding must never override a resolved git remote');
+  } finally {
+    ri._resetCacheForTests();
+  }
+});
+
+test('the env pin still WINS over branding (the operator override stays on top)', () => {
+  ri._resetCacheForTests();
+  process.env.OTB_GITHUB_OWNER = 'envowner';
+  process.env.OTB_GITHUB_REPO = 'envrepo';
+  try {
+    const root = path.resolve('/srv/instance/node_modules/@bongos/core');
+    const info = ri.loadRepoInfo({
+      execSync: mkExec({ toplevel: path.resolve('/srv/instance') }),
+      packageRoot: root,
+      branding: () => PACK,
+    });
+    assert.equal(info.owner, 'envowner');
+  } finally {
+    delete process.env.OTB_GITHUB_OWNER;
+    delete process.env.OTB_GITHUB_REPO;
+    ri._resetCacheForTests();
+  }
+});
+
 // ---- end-to-end canary: the regression this must never cause ---------------
 //
 // The only case that touches real git. It earns its place — an anchor rule that is too

package/tests/scrubber_corpus.mjs

@@ -23,8 +23,9 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { scrubSecrets, shannonEntropy, looksHighEntropySecret, collectEnvSecrets } =
-  require('../scripts/gds/ship.js');
+const {
+  scrubSecrets, shannonEntropy, looksHighEntropySecret, collectEnvSecrets,
+} = require('../scripts/gds/ship.js');
 
 let passed = 0;
 let failed = 0;
@@ -190,6 +191,73 @@ test('benign prose and short identifiers survive untouched', () => {
   }
 });
 
+// ============================================================
+// task 1002460 — the doc-path exemption is an ALLOWLIST, so recall is provable.
+//
+// Three shape-based rules were tried first and each leaked: anything built on what
+// a filename LOOKS like also admits a secret dressed that way. The exemption now
+// spares a candidate only when the caller says that exact name is a file it is
+// publishing. A secret is not a file in the tree.
+// ============================================================
+
+const DOC_NAMES = new Set(["0016-trust-boundary-server-enforced-permissions.md","0083-module-system-plugin-api.md","core_231_project_settings_and_attention_water.sql"]);
+
+test('1002460 with NO allowlist there is no exemption at all — recall byte-identical', () => {
+  // The guarantee that matters. Every caller that does not opt in — including every
+  // transcript scrub — behaves exactly as it did before this task existed.
+  for (const name of DOC_NAMES) {
+    const link = `[x](${name})`;
+    assert.ok(scrubSecrets(link).includes(REDACTED),
+      `without an allowlist a long filename is still redacted, as before: ${name}`);
+  }
+});
+
+test('1002460 with the allowlist, real doc links survive', () => {
+  const opts = { knownDocNames: DOC_NAMES };
+  for (const name of DOC_NAMES) {
+    const link = `[x](${name})`;
+    assert.equal(scrubSecrets(link, [], opts), link, `over-redacted a real doc link: ${name}`);
+  }
+});
+
+test('1002460 a secret is never in the allowlist, so it is never spared', () => {
+  // The smuggling cases from rounds 1 and 2, now structurally impossible: each is
+  // offered WITH the allowlist active, and none of them is a name in it.
+  const opts = { knownDocNames: DOC_NAMES };
+  const dressed = [
+    '[x](k3f9d2m7-q8w1e4r6-t5y0u3i9-p2a7s4d1.md)',
+    '[x](qxzjvbwk-mrtplghd-nfyscuae-bvkxwqzj.md)',
+    '[x](qxjvbwkzptrmnfyaeuicohgdslx12-a.md)',   // the unbounded-run case round 2 missed
+    // NOTE on all-numeric strings: a long digit run joined by a hyphen is NOT
+    // caught by the scrubber with or without an allowlist — the hyphen breaks the
+    // all-hex rule C and H=3.30 is under rules A and B. That is a PRE-EXISTING gap
+    // in the entropy heuristic, not something this exemption opens, so it is noted
+    // here rather than asserted: a case that fails identically both ways would
+    // prove nothing about the allowlist.
+    '[x](a3f5c9e12b47d8016fa2c4e7b9d03518aa.md)',
+  ];
+  const leaked = dressed.filter((d) => !scrubSecrets(d, [], opts).includes(REDACTED));
+  assert.deepEqual(leaked, [], `these slipped the scrubber: ${leaked.join(" | ")}`);
+});
+
+test('1002460 the allowlist cannot spare a planted secret (recall unchanged, proven)', () => {
+  // The differential proof, now trivial: offer the WHOLE planted corpus with an
+  // allowlist active. Nothing in it is a filename, so nothing can be exempted.
+  const opts = { knownDocNames: DOC_NAMES };
+  for (const { name, secret, context } of positives()) {
+    const out = scrubSecrets(context, collectEnvSecrets({}), opts);
+    assert.ok(!out.includes(secret), `LEAK with allowlist active: "${name}" survived: ${out}`);
+  }
+});
+
+test('1002460 an allowlisted name only counts at a real doc extension boundary', () => {
+  // The name must be followed by its own extension. A secret that merely CONTAINS
+  // an allowlisted stem, or sits before a different extension, is not spared.
+  const opts = { knownDocNames: DOC_NAMES };
+  const notAName = '[x](0016-trust-boundary-server-enforced-permissions.env)';
+  assert.ok(scrubSecrets(notAName, [], opts).includes(REDACTED),
+    'the same stem before a NON-doc extension is not an allowlisted file');
+});
 test('empty / non-string / short-literal inputs are safe', () => {
   assert.equal(scrubSecrets(''), '');
   assert.equal(scrubSecrets(null), null);

package/tests/setup_device_flow_fallback.mjs

@@ -91,6 +91,22 @@ t('names the Settings page, CLI Access, and the owner checkbox repair', () => {
   assert.match(text, /Web sign-in is unaffected/i, 'says what still works');
 });
 
+t('the closing step adapts to the caller — setup pastes, login runs a one-liner', () => {
+  const forSetup = setup.deviceFlowFallbackLines('https://spike.cloudbongos.com').join('\n');
+  const forLogin = setup.deviceFlowFallbackLines('https://spike.cloudbongos.com', { finish: 'login' }).join('\n');
+
+  // The default must be byte-stable — setup's own prompt still says "paste it below".
+  assert.match(forSetup, /paste it below/, 'setup keeps its inline-paste wording');
+  assert.doesNotMatch(forLogin, /paste it below/, '`bongos login` has no paste prompt to point at');
+  assert.match(forLogin, /run it in this shell/, 'login tells you what actually works there');
+
+  // Everything that is genuinely shared stays shared — one source of truth.
+  for (const shared of [/Enable Device Flow/, /CLI Access/, /builders\/settings/]) {
+    assert.match(forSetup, shared);
+    assert.match(forLogin, shared);
+  }
+});
+
 // ── redeemCliToken in a hermetic child against a stubbed instance API ────────
 // A child process because API_BASE + the session path resolve at module load:
 // the child gets GDS_API_BASE → the stub and HOME/USERPROFILE → a throwaway

package/tests/start_rebase_warning.mjs

@@ -99,5 +99,55 @@ t('widget HTML-escapes the refs (no raw angle brackets from ids)', () => {
   assert.ok(html.includes('<b>'), 'the id is HTML-escaped');
 });
 
+// ---------------------------------------------------------------------------
+// task 1002788 — this banner must not send a builder into a deadlock.
+//
+// The branch is ALREADY PUBLISHED when the gate fires, and server-mediated
+// publish is append-only by deliberate design (github-push.js: "Refuse
+// non-fast-forward implicitly (no --force, ever)"). So "rebase + re-ship" —
+// what this banner used to say — rewrites history the server already holds, and
+// every later publish is rejected non-fast-forward. The builder is then gated
+// from new claims AND unable to land the one they hold, which is exactly the
+// loop reproduced end-to-end on task 1002485. `git merge origin/main` reaches
+// the same up-to-date branch and stays a fast-forward.
+//
+// The negative assertion is deliberately narrow: it bans INSTRUCTING a rebase,
+// not the word. "Merge, never rebase" must keep working — that sentence is the
+// point.
+// ---------------------------------------------------------------------------
+const INSTRUCTS_A_REBASE = [
+  /\brebase\s*\+\s*re-ship\b/i,
+  /\brebase (the|its|your) branch\b/i,
+  /\brebases it\b/i,
+];
+
+t('markdown prescribes MERGE, and never instructs a rebase', () => {
+  const md = rebaseWarningMarkdown([{ id: 123 }]);
+  assert.ok(md.includes('git merge origin/main'), 'must name the fast-forward-safe command');
+  for (const re of INSTRUCTS_A_REBASE) {
+    assert.ok(!re.test(md), `must not instruct a rebase of a published branch (matched ${re}): ${md}`);
+  }
+  assert.match(md, /never rebase/i, 'and must say why the other move is wrong, not merely omit it');
+});
+
+t('widget prescribes MERGE, and never instructs a rebase', () => {
+  const html = rebaseWarningWidget([{ id: 123 }]);
+  assert.ok(html.includes('git merge origin/main'), 'must name the fast-forward-safe command');
+  for (const re of INSTRUCTS_A_REBASE) {
+    assert.ok(!re.test(html), `must not instruct a rebase of a published branch (matched ${re}): ${html}`);
+  }
+  assert.match(html, /never rebase/i);
+});
+
+t('the two renderings give the SAME advice — a builder must not get different instructions per surface', () => {
+  const md = rebaseWarningMarkdown([{ id: 123 }]);
+  const html = rebaseWarningWidget([{ id: 123 }]);
+  for (const [name, text] of [['markdown', md], ['widget', html]]) {
+    assert.ok(text.includes('git merge origin/main'), `${name} lost the command`);
+    assert.match(text, /never rebase/i, `${name} lost the warning`);
+    assert.ok(text.includes('/builder-release'), `${name} lost the give-up exit`);
+  }
+});
+
 console.log(`\nstart_rebase_warning: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exitCode = 1;