@bongos/core 1.19.729 → 1.19.731

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.729",
-  "core_contract": "1.19.729",
-  "source_commit": "399870dc41f0d71a77a79d1d48131070fbfe9828",
+  "core_version": "1.19.731",
+  "core_contract": "1.19.731",
+  "source_commit": "242d39240bacfa3d1d4c88f6a78ae22248c4cbdd",
   "source_ref": "HEAD",
-  "built_at": "2026-09-13T15:18:33.790Z",
+  "built_at": "2026-09-13T15:35:28.869Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2602,
-  "tree_sha256": "787a5eba74a590d18c09c0e87a40655d7eb5dcdcd9865660bc209392db78f8ca",
+  "tree_sha256": "1117799d57ae5cfa87178217b7fec728cc0de76ee02b0caba9abc559f2ecd9fa",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1237,7 +1237,7 @@
     {
       "path": "docs/adr/0151-governance-permissions-as-atom-ranks-as-roles.md",
       "mode": "0000644",
-      "sha256": "fe05aa8c4719600b299a638a85ce39b4b6d75b7fc78d58151e9c92cb91825a2e"
+      "sha256": "0ad167bf535aab268bfedece8339cfcf315d85d264028d403ca2c889b6044fe2"
     },
     {
       "path": "docs/adr/0152-landing-gate-served-by-the-core-app.md",
@@ -2482,7 +2482,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "635d466437068d5f1e6875cb6307c836dc57eb10c2ac7a50c39aba18c423f386"
+      "sha256": "a4d5bc973b439bfbf41bd0b7d59b0cdffde6b0b4c18c6b4d1d73731a92736c84"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4362,7 +4362,7 @@
     {
       "path": "modules/government/protected-surfaces.json",
       "mode": "0000644",
-      "sha256": "2a6c392d4499498f0e0fb80c80002ba9d82a3f5e66e48cce9802c21c276af2a0"
+      "sha256": "ec125c2bfba680c7645dda0b65dd6ece183dd57ceecdb5616ea2b8b34b776e56"
     },
     {
       "path": "modules/government/ranks.js",
@@ -7512,12 +7512,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "51b06b26595e4850db318f091ea0cf01399add4ddff70489a7bd42c62e6dc85c"
+      "sha256": "7027beb6f7d395889a8876a1f54a1c2c69b992f4a78b0d1a53441b748d018669"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "46d1603b0da9d38a1afe85820cfce1f1f485e26f692a7b077bf8951793dc1ac6"
+      "sha256": "5e1af6b1b0101a246e04b20ce6b36a756a3839dc9f2e436d2e524b6a331165ff"
     },
     {
       "path": "public-docs/index.html",
@@ -9317,7 +9317,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c96971200e4ddee6375444c84cd0433158c026423638822b76ae941fa50f3956"
+      "sha256": "39823a07155b3f5a8b13d2a6362985aab8ac0831d46ac25778e7893708d4fd5b"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10807,7 +10807,7 @@
     {
       "path": "tests/government_protected_surfaces.mjs",
       "mode": "0000644",
-      "sha256": "dfde7ca6e223324317a0d56960db7adc9b30bdfc35f718269e9d6978344545ac"
+      "sha256": "4478853e79266130c2ad3ab7a523f0f20fb98a97e88f1dd2476ef09db6b96dcc"
     },
     {
       "path": "tests/government_rank_sync.mjs",

package/docs/adr/0151-governance-permissions-as-atom-ranks-as-roles.md

@@ -79,6 +79,8 @@ This is the pillar that keeps configurability from becoming a foot-gun, and it h
 
 **The protected-surface registry.** Today's rank→surface map — `PROTECTED_GLOBS` + the per-tier `EXPECTED_RANKS` — is baked into code (`src/bongos/permission-path-check.js`). Governance takes ownership of it **as data**: which paths are protected, and at what floor, becomes a governance-owned registry. The **out-of-band substrate stays the enforcer** — the pre-push hook, the grader pre-pass, `main-audit.js`, `gate-review.js`, and the goal-scope check *read the registry* instead of a hardcoded list, but enforcement never moves into the app. The Metic floor and the `system`-permission mapping *flow from* the registry. The registry (R101) is also the moment to **close the [ADR 0087](0087-compete-on-governance-not-tooling-cursor.md) §3 path-matching gap** the sweep confirmed: `permission-path-check.js`'s `normalize()` does backslash→slash + strip-`./` only — **no case-folding and no Unicode normalization** — so a case-varied or homoglyph path evades the protected-glob match (Linux-deployed, so latent today, but it is the Cursor-class `.cursorignore`/case-bypass CVE shape). The registry matcher should normalize (case-fold + Unicode NFC) and gate file **creation** as strictly as edits.
 
+**Amendment, 2026-09-13 (task 1002891).** The registry now protects the files that *hold* the DigitalOcean and Cloudflare credentials, not only the files that decide who may spend them — and it does so from a **computed** set: `tests/government_protected_surfaces.mjs` recomputes every `process.env` credential read from the tracked tree and reds the build if one is unregistered. The task that asked for this named a single file as "the sole holder" of both tokens; by the time it was claimed that file read neither, and the readers had spread to five. A registry entry transcribed from prose would have recorded the gap as closed while leaving every live reader unprotected — the same drift the MIT1 execution-root tripwire exists to catch, which is why this one is built the same way.
+
 The invariant this buys, stated as a testable promise (R112, R114): **the tab can re-map which surfaces are protected and at what floor (policy), but it cannot move enforcement into the request path (substrate).** An Archon can create a custom role and grant it every `system: false` permission in the catalog, assign it to a `xenos`, and that builder gains exactly those operational powers — **while a `system` permission the role "has" stays enforced by the substrate**: the deploy / protected-path / SSH attempt is still blocked, because [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md)'s layer-3 audit reads the real git history and the real registry, independent of anything the app grants. Config owns policy; the substrate owns enforcement; a forced grant cannot cross that line. (Note: `main` on this repo still has **no** GitHub branch protection — re-verified 2026-07-24, [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) §"Branch-protection status" — so `main-audit.js` remains the *authoritative* substrate layer, not a redundant net. The registry does not change that; it only makes the protected list data instead of a constant.)
 
 ### 5. Capability in core, settings per project (C4)

package/docs/module-api-changelog.md

@@ -1932,5 +1932,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.727 with no explicit bump. run 34764630913. (task 1002620)
   1.19.729 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.728 with no explicit bump. run 34765179905. (task 1002620)
+  1.19.730 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.729 with no explicit bump. run 34765502139. (task 1002620)
+  1.19.731 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.730 with no explicit bump. run 34766029928. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/government/protected-surfaces.json

@@ -38,6 +38,12 @@
     { "glob": "modules/dev-box/boxes.js", "group": "box-access", "why": "boxScopeForRank / provision floor — decides who gets a full source clone" },
     { "glob": "modules/dev-box/box-access.js", "group": "box-access", "why": "decideSourceAccess (rank → starter|full source)" },
     { "glob": "modules/dev-box/box-credential.js", "group": "box-access", "why": "mints the box source credential" },
+    { "glob": "scripts/gds/provision-config.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.DO_API_TOKEN. The group already protects who DECIDES box access (boxes.js, box-access.js, box-credential.js) but protected nothing that HOLDS the infrastructure credentials those decisions spend — an asymmetry idea 1000692 raised and this entry closes. The set is computed, not listed: the tripwire in tests/government_protected_surfaces.mjs recomputes every process.env credential read from the tracked tree and reds if one is unregistered." },
+    { "glob": "scripts/gds/provision-net.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.CLOUDFLARE_API_TOKEN in checkDnsTokenScope. The filing task asserted this code lived in scripts/gds/provision.js; it had moved, and provision.js reads no credential at all. Registering the named file rather than the computed one would have recorded the gap as closed while closing nothing." },
+    { "glob": "scripts/gds/box-infra.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.CLOUDFLARE_API_TOKEN and process.env.CLOUDFLARE_ACCOUNT_ID into the CF config the box plane provisions against." },
+    { "glob": "scripts/gds/cf-tunnel.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: defaults its token parameter to process.env.CLOUDFLARE_API_TOKEN, so it reads the credential whenever a caller omits one. Not named by the recorded decision — the recomputation found it, which is the whole argument for computing the set instead of transcribing it." },
+    { "glob": "scripts/gds/box.js", "group": "box-access", "why": "task 1002891. CREDENTIAL READER: reads process.env.DO_API_TOKEN — the DigitalOcean control plane for the box fleet. Also not named by the recorded decision. Registering it does NOT widen any module wall: the dev-box module key already lists this file and already derives protected:true from the modules/dev-box/ entries above, so the derived protected-module set is unchanged (verified before and after against src/bongos/module-scope-map.js)." },
+    { "glob": "scripts/gds/do-api.js", "group": "box-access", "why": "task 1002891. The DigitalOcean API client the token is handed TO. Unlike the five above it reads no process.env value — it takes the token as a parameter and throws when a live call has none — so the drift tripwire does not demand it and its absence from that computed set is expected, not a bug. It is registered because the recorded decision named it and because it is the code that puts the credential on the wire." },
     { "glob": "modules/grading/grader.js", "group": "pipeline", "why": "BV1.R73: grading carved to modules/grading/ — the glob follows the file" },
     { "glob": "modules/grading/grader-workers/", "group": "pipeline", "why": "the adversarial panel (Narc/Hacker/Quality/Efficiency) — blunting these blunts the gate" },
     { "glob": "modules/grading/grader-rubric.json", "group": "pipeline", "why": "the grader's scoring rubric (ADR 0058)" },

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.729",
+  "version": "1.19.731",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.729",
+      "version": "1.19.731",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.729",
+  "version": "1.19.731",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.729'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.731'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_protected_surfaces.mjs

@@ -174,6 +174,58 @@ const ADDED_SINCE_R101 = [
        + 'otb-regen driver, so editing it changes how much of the tree that driver '
        + 'rewrites during a merge. executed-closure.js carries it as TRUSTED_NON_CODE.',
   },
+  // task 1002891 (from idea 1000692, raised by the grader's hacker worker). Group
+  // 'box-access' protected who DECIDES box access but nothing that HOLDS the
+  // infrastructure credentials those decisions spend. The five readers below are the
+  // COMPUTED set — the credential-reader tripwire further down recomputes it from the
+  // tracked tree on every run — plus do-api.js, which the credential is handed to.
+  {
+    after: 'modules/dev-box/box-credential.js',
+    glob: 'scripts/gds/provision-config.js',
+    why: 'reads process.env.DO_API_TOKEN. The DigitalOcean credential for instance '
+       + 'provisioning, previously unprotected at any rank while the files deciding WHO '
+       + 'may provision were protected at Metic.',
+  },
+  {
+    after: 'scripts/gds/provision-config.js',
+    glob: 'scripts/gds/provision-net.js',
+    why: 'reads process.env.CLOUDFLARE_API_TOKEN in checkDnsTokenScope. The filing task '
+       + 'placed this code in scripts/gds/provision.js, which by the time of the claim '
+       + 'read no credential at all — registering the file the prose named would have '
+       + 'recorded the gap as closed while closing nothing.',
+  },
+  {
+    after: 'scripts/gds/provision-net.js',
+    glob: 'scripts/gds/box-infra.js',
+    why: 'reads process.env.CLOUDFLARE_API_TOKEN and process.env.CLOUDFLARE_ACCOUNT_ID '
+       + 'into the Cloudflare config the box plane provisions tunnels and DNS against.',
+  },
+  {
+    after: 'scripts/gds/box-infra.js',
+    glob: 'scripts/gds/cf-tunnel.js',
+    why: 'defaults its token parameter to process.env.CLOUDFLARE_API_TOKEN, so it reads '
+       + 'the credential whenever a caller omits one. The recorded decision did not name '
+       + 'this file; the recomputation found it, which is the case for computing the set '
+       + 'rather than transcribing a list.',
+  },
+  {
+    after: 'scripts/gds/cf-tunnel.js',
+    glob: 'scripts/gds/box.js',
+    why: 'reads process.env.DO_API_TOKEN — the DigitalOcean control plane for the box '
+       + 'fleet, and also not named by the recorded decision. Adding it widens no module '
+       + 'wall: the dev-box key already lists this path and already derives protected '
+       + 'from the modules/dev-box/ entries, so the derived protected-module set is '
+       + 'unchanged (asserted below).',
+  },
+  {
+    after: 'scripts/gds/box.js',
+    glob: 'scripts/gds/do-api.js',
+    why: 'the DigitalOcean API client the token is handed TO. It reads no process.env '
+       + 'value — the token arrives as a parameter and the constructor throws when a live '
+       + 'call has none — so the tripwire below does not demand it and its absence from '
+       + 'that computed set is expected. Registered because it is the code that puts the '
+       + 'credential on the wire.',
+  },
 ];
 
 // Surfaces RENAMED since R101 — still protected, under a new path. Distinct from
@@ -303,6 +355,212 @@ test('every execution root in the closure is a protected surface (MIT1 drift tri
   }
 });
 
+// ---------- the credential tripwire: every credential READER is a protected surface ----------
+//
+// task 1002891, from idea 1000692 (the grader's hacker worker, on the 1002690 re-grade).
+// Group 'box-access' protected the files that decide WHO may provision a box, but nothing
+// that HOLDS the DigitalOcean / Cloudflare credentials those decisions spend.
+//
+// WHY THIS IS COMPUTED AND NOT LISTED. The task offered two options, both resting on a
+// named file: "scripts/gds/provision.js is the sole holder of the DO and CF tokens". By
+// the time it was claimed that sentence was false in both halves — provision.js reads
+// NEITHER token (the code moved), and the readers are spread across five files. Taking the
+// prose at its word would have registered a file holding no credential and recorded the
+// gap as closed. That is the failure shape of task 1003366, where an audit named four
+// execution roots and the code had eight, and the four missed the earliest vector.
+//
+// So the registry is pinned to what the tree actually does, and this test is the pin: add
+// a process.env read of a credential anywhere in tracked JS and the build reds until the
+// registry grows to match.
+//
+// FAIL CLOSED, DELIBERATELY. The scan is textual, so a `process.env.DO_API_TOKEN` written
+// inside a comment counts as a read. That over-reports rather than under-reports, which is
+// the right direction for a security tripwire: the fix is to register the file or reword
+// the comment, and neither leaves a live credential unprotected.
+const CREDENTIAL_ENV = ['DO_API_TOKEN', 'CLOUDFLARE_API_TOKEN', 'CLOUDFLARE_ACCOUNT_ID'];
+
+// Which CREDENTIAL_ENV names this source reads off process.env. Four spellings, because a
+// tripwire that only knows the idiom in use today goes quiet the first time someone writes
+// the same read differently: `process.env.NAME`, `process.env['NAME']`,
+// `process['env']['NAME']`, and destructuring — `const { NAME } = process.env`, rename and
+// multi-line included.
+//
+// KNOWN LIMIT, stated rather than papered over: a read through an intermediate binding
+// (`const env = process.env; env.DO_API_TOKEN`) or a name assembled at runtime is not
+// textually detectable and is not caught. Closing that needs an AST pass over the tree,
+// which is a different piece of work; nothing in the tree reads a credential that way
+// today, and the registry entries do not depend on the scan to stay correct — the scan is
+// what catches DRIFT.
+//
+// Returns a sorted array; [] means "reads none", which is indistinguishable from "the
+// scanner broke", so every caller also asserts the whole scan is non-vacuous. A scanner
+// that quietly finds nothing looks exactly like a passing test.
+function credentialReadsIn(source) {
+  const found = new Set();
+  for (const name of CREDENTIAL_ENV) {
+    const forms = [
+      new RegExp(`process\\.env\\.${name}\\b`),
+      new RegExp(`process\\.env\\[\\s*['"\`]${name}['"\`]\\s*\\]`),
+      new RegExp(`process\\s*\\[\\s*['"\`]env['"\`]\\s*\\]\\s*\\[\\s*['"\`]${name}['"\`]\\s*\\]`),
+      // Destructuring. [^}]* spans newlines inside a character class, so a multi-line
+      // destructure matches; the \\b keeps NAME_SUFFIX from counting as NAME.
+      new RegExp(`\\{[^}]*\\b${name}\\b[^}]*\\}\\s*=\\s*process\\.env\\b`),
+    ];
+    if (forms.some((re) => re.test(source))) found.add(name);
+  }
+  return [...found].sort();
+}
+
+// tests/ is out of scope, and the exclusion is load-bearing rather than convenient: the
+// unit tests directly below hold `process.env.DO_API_TOKEN` as fixture text, so without it
+// this scanner reports ITSELF as an unregistered credential holder (it did, on the first
+// run — which is also the evidence that it detects rather than quietly finding nothing).
+// A test fixture is not a credential holder: tests/ is not the provisioning path, holds no
+// live token, and is never what a droplet executes. Every path that DOES reach DigitalOcean
+// or Cloudflare lives under scripts/ or modules/ and stays in scope.
+const SCAN_EXCLUDED = /^tests\//;
+
+// The tracked JS tree, scanned for credential reads. git ls-files (not a directory walk)
+// so an untracked scratch file can never add or remove a protected surface.
+function credentialReaders() {
+  const tracked = execFileSync('git', ['ls-files', '*.js', '*.mjs', '*.cjs'],
+    { cwd: ROOT, encoding: 'utf8' })
+    .split('\n').map((s) => s.trim()).filter(Boolean);
+  return tracked
+    .filter((rel) => !SCAN_EXCLUDED.test(rel))
+    .filter((rel) => credentialReadsIn(fs.readFileSync(path.join(ROOT, rel), 'utf8')).length > 0)
+    .sort();
+}
+
+test('credentialReadsIn detects a read in every form it must', () => {
+  assert.deepEqual(credentialReadsIn('const t = process.env.DO_API_TOKEN || null;'),
+    ['DO_API_TOKEN']);
+  assert.deepEqual(credentialReadsIn("process.env['CLOUDFLARE_API_TOKEN']"),
+    ['CLOUDFLARE_API_TOKEN']);
+  assert.deepEqual(credentialReadsIn('process.env["CLOUDFLARE_ACCOUNT_ID"]'),
+    ['CLOUDFLARE_ACCOUNT_ID']);
+  assert.deepEqual(credentialReadsIn('process.env[ `DO_API_TOKEN` ]'), ['DO_API_TOKEN']);
+  assert.deepEqual(credentialReadsIn("process['env']['DO_API_TOKEN']"), ['DO_API_TOKEN']);
+  assert.deepEqual(credentialReadsIn('const { DO_API_TOKEN } = process.env;'),
+    ['DO_API_TOKEN']);
+  assert.deepEqual(credentialReadsIn('const { DO_API_TOKEN: tok } = process.env;'),
+    ['DO_API_TOKEN'], 'a renamed destructure is still a read');
+  assert.deepEqual(
+    credentialReadsIn('const {\n  PORT,\n  CLOUDFLARE_API_TOKEN,\n} = process.env;'),
+    ['CLOUDFLARE_API_TOKEN'], 'a multi-line destructure is still a read');
+  assert.deepEqual(
+    credentialReadsIn('process.env.DO_API_TOKEN; process.env.CLOUDFLARE_API_TOKEN;'),
+    ['CLOUDFLARE_API_TOKEN', 'DO_API_TOKEN']);
+});
+
+test('credentialReadsIn does not fire on a near-miss', () => {
+  // The guard that matters: a scanner matching too loosely reds honest files until
+  // someone loosens it, and a loosened scanner protects nothing.
+  assert.deepEqual(credentialReadsIn(''), []);
+  assert.deepEqual(credentialReadsIn('export DO_API_TOKEN or run without --apply'), []);
+  assert.deepEqual(credentialReadsIn('opts.token || cfg.DO_API_TOKEN'), []);
+  assert.deepEqual(credentialReadsIn('process.env.DO_API_TOKEN_FILE'), [],
+    'a longer env name that merely starts with a credential name is a different variable');
+  assert.deepEqual(credentialReadsIn('process.env.SOME_OTHER_TOKEN'), []);
+  assert.deepEqual(credentialReadsIn('const { DO_API_TOKEN_FILE } = process.env;'), [],
+    'the destructure form must respect the word boundary too');
+  assert.deepEqual(credentialReadsIn('const { DO_API_TOKEN } = someOtherObject;'), [],
+    'destructuring a credential-shaped name off something else is not an env read');
+});
+
+test('every credential reader in the tree is a protected surface (1002891 tripwire)', () => {
+  const readers = credentialReaders();
+  assert.ok(readers.length >= 5,
+    'fixture sanity: the scan found '
+    + `${readers.length} credential reader(s), and the tree has had at least five since `
+    + 'task 1002891. A scan that finds nothing passes every assertion below without '
+    + 'checking anything — treat this as the scanner being broken, not as good news.');
+  for (const rel of readers) {
+    const surface = ppc.surfaceFor(rel);
+    assert.ok(surface,
+      `${rel} READS an infrastructure credential off process.env `
+      + `(${credentialReadsIn(fs.readFileSync(path.join(ROOT, rel), 'utf8')).join(', ')}) `
+      + 'but no protected surface covers it. Add it to '
+      + 'modules/government/protected-surfaces.json (group "box-access") and declare it '
+      + 'in ADDED_SINCE_R101 above.');
+    assert.ok(ppc.RANK_TIER[surface.floor] >= ppc.RANK_TIER.metic,
+      `${rel} holds an infrastructure credential but is floored at '${surface.floor}' — `
+      + 'below Metic it stays writable by the ranks ADR 0043 keeps out of the trust core.');
+  }
+});
+
+// ---------- the hard-floor subset: gate-review's second list may narrow, never diverge ----------
+//
+// task 1002875, from idea 1000620 (raised as a major by the BV1.R101 ship grader).
+// scripts/gds/gate-review.js keeps its own HARD_FLOOR_GLOBS — the rank-INDEPENDENT
+// escalate-to-owner set — and the comment above it declares the array to be "A subset of
+// PROTECTED_GLOBS". That was a checkable invariant stated in prose and enforced by nothing.
+//
+// TWO LISTS IS THE DESIGN, NOT THE BUG, which is why this is a subset test and not a
+// de-duplication. The registry answers "who may EDIT this path" (a rank floor, re-mappable
+// by government). The hard floor answers "may CI auto-merge an edit to this path at all"
+// — no, escalate to the owner, whatever the author's rank. The second is deliberately
+// narrower: every hard-floor surface must be protected, but most protected surfaces are
+// ordinary Metic work that should not ping the owner.
+//
+// Checked at BOTH altitudes on purpose. The source literal is what a reviewer reads and
+// what the decision asked be parsed; the exported array is what compileGlobMatcher actually
+// compiles at gate-review.js:102. Asserting they agree means a future refactor that
+// computes or filters the list cannot leave the visible source saying one thing while the
+// gate enforces another.
+function hardFloorGlobsFromSource() {
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'), 'utf8');
+  const block = src.match(/const HARD_FLOOR_GLOBS = \[([\s\S]*?)\n\];/);
+  assert.ok(block, 'could not find the HARD_FLOOR_GLOBS array literal in gate-review.js — '
+    + 'if it was renamed or restructured, this test must be taught the new shape rather '
+    + 'than deleted: it is the only thing holding the declared subset honest.');
+  return [...block[1].matchAll(/'([^']+)'/g)].map((m) => m[1]);
+}
+
+test('every hard-floor glob is a protected surface (1002875 subset tripwire)', () => {
+  const fromSource = hardFloorGlobsFromSource();
+  assert.ok(fromSource.length >= 20,
+    `fixture sanity: parsed ${fromSource.length} hard-floor globs out of gate-review.js, `
+    + 'and the array has held about two dozen since it was written. A parse that returns '
+    + 'few or none passes the subset check vacuously.');
+
+  const gr = require(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'));
+  assert.deepEqual(fromSource, gr.HARD_FLOOR_GLOBS,
+    'the HARD_FLOOR_GLOBS literal in gate-review.js no longer matches the array the module '
+    + 'exports and compiles into its matcher. The source and the enforced list must be the '
+    + 'same thing, or a reviewer reading the file is reading a list the gate does not use.');
+
+  const registry = new Set(ppc.PROTECTED_GLOBS);
+  for (const glob of gr.HARD_FLOOR_GLOBS) {
+    assert.ok(registry.has(glob),
+      `'${glob}' is a HARD FLOOR surface in scripts/gds/gate-review.js — CI escalates any `
+      + 'edit to it to the owner regardless of rank — but it is not in '
+      + 'modules/government/protected-surfaces.json, so no rank floor covers it at all. '
+      + 'The hard floor is declared to be a SUBSET of the protected set: it may be '
+      + 'narrower (most protected paths are ordinary Metic work and should not ping the '
+      + 'owner), never wider. Either add the glob to the registry, or remove it from '
+      + 'HARD_FLOOR_GLOBS — do not delete this assertion.');
+  }
+});
+
+test('registering the credential readers widened no module wall', () => {
+  // The second-order effect task 1002891 was explicitly warned about, asserted rather
+  // than reasoned about. src/bongos/module-scope-map.js DERIVES a module's `protected`
+  // flag from overlap with this registry, and a protected module makes its goals
+  // Archon-mediated-join. The six surfaces added for 1002891 are file-level for exactly
+  // this reason: the modules/provisioning/ subtree (the task's option (b)) would have
+  // flipped `provisioning` and walled goals 1000032, 1000046 and 1000059.
+  const map = require(path.join(ROOT, 'src', 'bongos', 'module-scope-map.js'));
+  const protectedNow = map.protectedModules();
+  assert.ok(!protectedNow.includes('provisioning'),
+    'the provisioning module derived protected:true — a credential-reader entry reached '
+    + 'modules/provisioning/ or scripts/gds/provision.js, which walls goals 1000032, '
+    + '1000046 and 1000059 behind an Archon join. Keep the entries file-level.');
+  assert.ok(protectedNow.includes('dev-box'),
+    'dev-box was already protected via its modules/dev-box/ globs before 1002891; if it '
+    + 'is not, the premise of the box.js entry has changed.');
+});
+
 // Metic is a FLOOR, not a fixed value (task 1003191). Pinning every surface to
 // exactly 'metic' made the registry's own contract untestable and, worse,
 // illegal: governance owns this data and raising one surface to 'archon' is a