@bongos/core 1.19.790 → 1.19.792

package/scripts/gds/accessibility-replay.js

@@ -0,0 +1,195 @@
+// scripts/gds/accessibility-replay.js — the two-profile replay regression for the
+// accessibility dimension (task 1002517; clauses 5 and 8 of criterion
+// `accessibility-fluency-profile`, which named this run as its OWN proof).
+//
+// WHAT IT PROVES, and why it is not already covered.
+// tests/session_accessibility.mjs pins the scorer's contracts against synthetic
+// fixtures it builds itself — a test of the arithmetic. It cannot answer the
+// criterion's actual question, which is about PROSE: does the dimension reward a
+// reply a newcomer can use, and does it leave an expert's reply alone? So this
+// harness takes a FIXED set of eight questions a newcomer really asks, each the
+// documented trigger of a surface that exists, answered twice — once in each
+// register — and scores both runs.
+//
+// Four legs. Each one fails a different way of being wrong:
+//
+//   1. FLOOR          the non-technical run, under the non-technical profile,
+//                     clears FLOOR. The dimension recognises accessible prose.
+//   2. NO PENALTY     the engineer run, under the engineer profile, is not
+//                     scored at all — every signal waived, score null.
+//   3. DISCRIMINATION the SAME engineer prose under the NON-TECHNICAL profile
+//                     falls BELOW FLOOR, with every detector registering hits.
+//                     Without this leg 1 proves nothing — a scorer that returned
+//                     10 for everything, or three detectors that had gone blind,
+//                     would pass leg 1 and look identical to a working one.
+//   4. LENGTH         `doubleRun` says the same prose twice. Chars double, hits
+//                     double, the rate is unchanged, so the score must be
+//                     IDENTICAL. That is the metric reading density rather than
+//                     volume, asserted against real prose.
+//
+// WHERE TERSENESS PROTECTION ACTUALLY COMES FROM, since the task's "watch out"
+// is a metric that punishes an expert's brevity. It is leg 2 — the WAIVER — not
+// the per-1000-character rates. The rates make the score independent of how long
+// an answer is at a fixed density (leg 4); they do NOT make it independent of
+// density, and they should not: three undefined terms in three hundred
+// characters really is denser than three in three thousand. What protects the
+// expert is that their profile removes those two signals from the scoring set
+// entirely. `terseVariant` — every turn cut to its first sentence, a genuinely
+// shorter and thinner answer — is checked too, asserting only that answering
+// more briefly never COSTS points; it is a guard, not the mechanism.
+//
+// One honest asymmetry this surfaced and the corpus now records: under
+// `technical_level: engineer` with `toolchain_familiarity: new`, the engineer
+// run still scores, because terminal-where-a-click-path-exists is waived by the
+// TOOLCHAIN setting, not the technical one. "I think in code" and "I live in a
+// terminal" are two different answers, and the scorer is right to keep them
+// apart. tests/accessibility_replay.mjs pins that pairing so a future widening
+// of the engineer waiver has to be a deliberate edit.
+//
+// The corpus is data — tests/fixtures/accessibility-replay.json — so adding a
+// prompt is an edit to JSON, not to code.
+//
+// Run:  node scripts/gds/accessibility-replay.js
+//       node scripts/gds/accessibility-replay.js --json
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { scoreAccessibility, bandFor } = require('../../modules/sessions/accessibility.js');
+
+const CORPUS_PATH = path.join(__dirname, '..', '..', 'tests', 'fixtures', 'accessibility-replay.json');
+
+// FLOOR — the score a non-technical run has to clear. It is bandFor()'s
+// 'workable' boundary and deliberately not a second independent number: the
+// scorer already draws the line between prose a newcomer can work with and prose
+// that is merely dense, and inventing a different one here would let the two
+// drift. tests/accessibility_replay.mjs asserts they stay tied.
+const FLOOR = 6.0;
+
+function loadCorpus(file = CORPUS_PATH) {
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+
+// terseVariant — each turn cut to its first sentence: a shorter, thinner answer.
+// Mechanical on purpose. A hand-written "terse version" in the corpus would be a
+// version tuned until it passed; taking the first sentence of prose written for
+// another purpose is a variant nobody got to tune.
+function terseVariant(turns) {
+  return turns.map((t) => {
+    const m = /^[^.!?]*[.!?]/.exec(t);
+    return m ? m[0] : t;
+  });
+}
+
+// doubleRun — the same prose said twice. Every count doubles and so does the
+// character total, so every rate is unchanged and the score must come back
+// EXACTLY equal. This is the length-independence property at prose altitude: a
+// scorer that had drifted to absolute counts would double its penalties here.
+function doubleRun(turns) {
+  return [...turns, ...turns];
+}
+
+// asDetail — a run's replies as the per-turn digest shape scoreAccessibility
+// reads. The user turns are included because a real digest has them and
+// assistantProse must keep ignoring them; if it ever stopped, the prompts would
+// start scoring the builder's own words and every number here would move.
+function asDetail(corpus, replies, { transform } = {}) {
+  const detail = [];
+  let i = 0;
+  for (const { id, prompt } of corpus.prompts) {
+    detail.push({ i: i++, role: 'user', snippet: prompt });
+    const turns = replies[id] || [];
+    for (const snippet of transform ? transform(turns) : turns) {
+      detail.push({ i: i++, role: 'assistant', snippet });
+    }
+  }
+  return detail;
+}
+
+const TRANSFORMS = { terse: terseVariant, doubled: doubleRun };
+
+// replay — score one named run under one profile. `profile` defaults to the
+// run's own declared profile, which is the pairing the criterion asks about;
+// passing another is how leg 3 reads engineer prose as a newcomer would.
+function replay(corpus, runName, { profile, variant } = {}) {
+  const run = corpus.runs[runName];
+  if (!run) throw new Error(`no such run in the corpus: ${runName}`);
+  const transform = variant ? TRANSFORMS[variant] : undefined;
+  if (variant && !transform) throw new Error(`no such variant: ${variant}`);
+  const effective = profile || run.profile;
+  const result = scoreAccessibility(asDetail(corpus, run.replies, { transform }), { profile: effective });
+  return { run: runName, variant: variant || 'full', profile: effective, result };
+}
+
+// The partial engineer profile — thinks in code, new to the toolchain. Named
+// here because it is the pairing that shows the two waivers are independent.
+const ENGINEER_NEW_TO_TOOLCHAIN = Object.freeze({ technical_level: 'engineer', toolchain_familiarity: 'new' });
+
+function rows(corpus) {
+  const newcomer = corpus.runs.non_technical.profile;
+  return [
+    ['non-technical prose, non-technical profile', replay(corpus, 'non_technical')],
+    ['engineer prose, engineer profile', replay(corpus, 'engineer')],
+    ['engineer prose, NON-TECHNICAL profile', replay(corpus, 'engineer', { profile: newcomer })],
+    ['engineer prose, engineer but new to the terminal', replay(corpus, 'engineer', { profile: ENGINEER_NEW_TO_TOOLCHAIN })],
+    ['non-technical prose, said twice', replay(corpus, 'non_technical', { variant: 'doubled' })],
+    ['non-technical prose, first sentences only', replay(corpus, 'non_technical', { variant: 'terse' })],
+  ];
+}
+
+function fmt(n) {
+  return n == null ? '—' : n.toFixed(1);
+}
+
+function formatReport(corpus) {
+  const lines = [`accessibility replay — ${corpus.prompts.length} fixed beginner prompts, floor ${FLOOR.toFixed(1)}`, ''];
+  for (const [label, r] of rows(corpus)) {
+    const { score, band, sampled_chars: chars, sampled_turns: turns } = r.result;
+    const waived = r.result.signals.filter((s) => s.waived).length;
+    lines.push(
+      `  ${label.padEnd(48)} ${fmt(score).padStart(5)}  ${band.padEnd(9)} ` +
+        `${String(turns).padStart(3)} turns  ${String(chars).padStart(5)} chars  ${waived}/3 waived`
+    );
+    for (const s of r.result.signals) {
+      if (s.waived) continue;
+      if (!s.count) continue;
+      lines.push(
+        `      ${s.type.padEnd(28)} ${String(s.count).padStart(2)} hits  rate ${s.rate.toFixed(2)}/1k  −${s.penalty.toFixed(2)}`
+      );
+    }
+  }
+  return lines.join('\n');
+}
+
+// main — the CLI. `write` is injectable so the test can exercise both output
+// paths without printing a screenful of JSON into the test log.
+function main(argv = process.argv.slice(2), write = (s) => process.stdout.write(s)) {
+  const corpus = loadCorpus();
+  if (argv.includes('--json')) {
+    const out = { floor: FLOOR };
+    for (const [label, r] of rows(corpus)) out[label] = r.result;
+    write(`${JSON.stringify(out, null, 2)}\n`);
+    return 0;
+  }
+  write(`${formatReport(corpus)}\n`);
+  return 0;
+}
+
+module.exports = {
+  FLOOR,
+  CORPUS_PATH,
+  ENGINEER_NEW_TO_TOOLCHAIN,
+  loadCorpus,
+  terseVariant,
+  doubleRun,
+  asDetail,
+  replay,
+  rows,
+  formatReport,
+  bandFor,
+  main,
+};
+
+if (require.main === module) process.exit(main());

package/scripts/gds/box-auth-check.js

@@ -93,7 +93,7 @@ async function probeMe(tokenInfo) {
 function printReauth({ boxScoped }) {
   const why = boxScoped
     ? 'This box holds the BOX-SCOPED bootstrap token (source=box, ADR 0053) — it can bootstrap the box but is refused (403) on claim / ship / publish.'
-    : 'This session token is EXPIRED or revoked (CLI tokens carry a 24h idle TTL).';
+    : 'This session token is REVOKED or otherwise rejected (CLI tokens do not expire on their own — ADR 0294).';
   console.log('[otb] ── dev box: RE-AUTH BEFORE YOU WORK ──');
   console.log(`[otb] ${why}`);
   console.log('[otb] ⚠ FIRST STEP this session: get the builder onto a real CLI session BEFORE claiming or shipping —');

package/scripts/gds/cli-lib.js

@@ -521,9 +521,9 @@ function printUnauthGuidanceAndExit() {
   }
   console.error('');
   console.error('  Possible causes:');
-  console.error('    - Your session token expired (24h idle TTL, auto-refreshes on each request)');
-  console.error('    - Your token was revoked by an Archon');
+  console.error('    - Your token was revoked — by you ("Sign out everywhere") or by an Archon');
   console.error('    - A recent deploy applied an auth-changing migration (see deploy banner)');
+  console.error('    - This instance is older than ADR 0294 and still expires idle CLI sessions');
   console.error('');
   console.error('  Once re-authed, re-run whichever command you were trying.');
   // `doctor` is checkout-only — it is not one of the public CLI's verbs (ADR 0258).

package/scripts/gds/reauth.js

@@ -3,11 +3,13 @@
 //
 // The fast, UI-first path to refresh an expired/invalid GDS CLI session.
 //
-// Why this exists: CLI bearer tokens carry a 24h idle TTL (refresh-on-use) for
-// auth-token hygiene (GDS-V3 criterion C9) — a leaked or abandoned token in the
-// plaintext session file dies on its own instead of living forever. That's a
-// keeper. The friction it caused (re-auth via the slow Device Flow, terminal
-// codes, Gemini-key prompts) is NOT a keeper. This script is the fix:
+// Why this exists: a CLI session can stop working — revoked from the hall's
+// "Sign out everywhere", swept by a demotion, or invalidated by an auth-changing
+// deploy. (It no longer stops working from mere disuse: ADR 0294 removed the idle
+// expiry, because the timer only ever signed out the legitimate holder while
+// refresh-on-use kept a thief's copy alive.) Whatever killed it, the friction of
+// getting back in — the slow Device Flow, terminal codes, Gemini-key prompts — is
+// not something to keep. This script is the fix:
 //
 //   1. Detect — is the current session still valid? (GET /api/gds/me)
 //        valid   → print who you are + exit 0. Nothing to do.
@@ -133,8 +135,8 @@ async function main() {
     const b = (res.data && res.data.builder) || {};
     console.log(`Your GDS CLI session is valid — no re-auth needed.`);
     console.log(`  Signed in as ${b.github_login || '?'}${b.rank ? ` (rank: ${b.rank})` : ''}.`);
-    console.log('  (Sessions carry a 24h idle TTL and refresh on every use, so an');
-    console.log('   actively-used session stays alive.)');
+    console.log('  (CLI sessions do not expire — they last until revoked. Kill one from');
+    console.log('   Settings → Active sessions, or "Sign out everywhere".)');
     process.exit(0);
   }
 

package/scripts/gds/run-unit-tests.js

@@ -145,6 +145,13 @@ const INTEGRATION = new Set([
   // prove the CHECK actually refuses a stored fourth state, that the backfill lands on a
   // pre-migration row, and that publishableSql and projectPublishability agree.
   'project_visibility_db',
+  // task 1003956 (ADR 0294): that CLI sessions really never expire. The DB-free
+  // sibling (auth_session_ttl) pins the constant, createSession's value against a
+  // stub pool, and the TEXT of the refresh statement — but a regex over source
+  // proves the characters are there, not that Postgres does what they mean. Only a
+  // real engine can show the CASE guard leaving a NULL alone on an actual use,
+  // which is exactly where the removed timeout would come back.
+  'auth_session_expiry_db',
   'scouting_rollup_fanout', 'session_records',
   // task 1003217: the cost-row RAISE against real SQL. Every claim in it IS the
   // SQL — an ON CONFLICT DO UPDATE guarded to move a row only upward, and a

package/src/bongos/auth-github.js

@@ -218,6 +218,8 @@ async function pollDeviceFlow(deviceCode, userAgent) {
       source: 'cli',
       userAgent: userAgent ?? null,
       // CLI tokens have no expiry (manually revocable). Web tokens expire.
+      // True again as of ADR 0294: migration 035 made this line a lie for two years
+      // by defaulting a null to a TTL, and removing that default restored it.
       expiresAt: null,
     });
     // V3.R75 (#294): tick the onboarding state machine. Best-effort — auth

package/src/bongos/db-kernel.js

@@ -262,16 +262,25 @@ async function accessStateByLogin(login) {
 
 // --- Auth sessions (kernel: the builder_sessions token store auth.js drives) ----
 
-// SESSION_TTL_MS — session TTL on create/refresh. Centralized so the migration's
-// grace formula, the tests, and the code agree on one number.
+// SESSION_TTL_MS — the roll-forward window for a session that HAS an expiry.
+// It is no longer a default: a caller that names no expiry gets none (ADR 0294).
+// What still reads it is refresh-on-use below, which rolls an already-dated row
+// (the web flow's) forward on each request. Centralized so the tests and the
+// code agree on one number.
 const SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
 
-// createSession — mint a builder_sessions row. Defaults expiry to NOW()+TTL when
-// the caller passes null/undefined (refresh-on-use keeps active sessions alive).
+// createSession — mint a builder_sessions row.
+//
+// A null/undefined expiresAt means NO EXPIRY (expires_at NULL), which
+// lookupSession honours as never-expires. That is the CLI's contract (ADR 0294,
+// restoring 003_pms.sql's original one): a `bongos` sign-in lasts until it is
+// revoked, because an idle expiry only ever logged out the legitimate holder —
+// the remedy for a leaked bearer is the own-scoped revoke of ADR 0206, which is
+// immediate where a timer is not. Every caller that passes null is source='cli'.
+//
+// Web callers pass an explicit date (30 days) and are untouched by this default.
 async function createSession({ builderId, token, source, userAgent, expiresAt }) {
-  const effectiveExpiresAt = expiresAt === undefined || expiresAt === null
-    ? new Date(Date.now() + SESSION_TTL_MS)
-    : expiresAt;
+  const effectiveExpiresAt = expiresAt ?? null;
   const { rows } = await pool.query(
     `INSERT INTO builder_sessions (builder_id, token, source, user_agent, expires_at)
      VALUES ($1, $2, $3, $4, $5)
@@ -282,9 +291,10 @@ async function createSession({ builderId, token, source, userAgent, expiresAt })
 }
 
 // lookupSession — resolve a live (unrevoked, unexpired) session token to its
-// builder identity, and refresh-on-use (bump last_used_at + roll expiry forward,
-// fire-and-forget). Returns null for missing/revoked/expired. Read fresh per
-// request, never cached (ADR 0016).
+// builder identity, and refresh-on-use (bump last_used_at, and roll expiry
+// forward for a row that has one, fire-and-forget). Returns null for
+// missing/revoked/expired; a row with expires_at NULL never expires. Read fresh
+// per request, never cached (ADR 0016).
 //
 // The governance FOLD (task 1002556): when the governance module is enabled, the
 // same round-trip also aggregates the builder's raw permission grant keys, so
@@ -335,11 +345,19 @@ async function lookupSession(token) {
   if (!row) return null;
   if (row.revoked_at) return null;
   if (row.expires_at && row.expires_at < new Date()) return null;
+  // Refresh-on-use. last_used_at always moves — the own-sessions list (ADR 0206)
+  // is how a person spots a session they don't recognise, and that reading is the
+  // whole remedy now that CLI rows never lapse. expires_at only rolls forward for
+  // a row that HAS one: the CASE is what stops a use from minting an expiry on a
+  // never-expires row and quietly reintroducing the timeout per ADR 0294.
   pool
     .query(
       `UPDATE builder_sessions
           SET last_used_at = now(),
-              expires_at   = now() + ($2::int * INTERVAL '1 millisecond')
+              expires_at   = CASE
+                               WHEN expires_at IS NULL THEN NULL
+                               ELSE now() + ($2::int * INTERVAL '1 millisecond')
+                             END
         WHERE id = $1`,
       [row.session_id, SESSION_TTL_MS]
     )

package/src/bongos/db.js

@@ -664,32 +664,41 @@ async function reactivateBuilder({ builderId, actorBuilderId }) {
 // Sessions (auth tokens)
 // -------------------------------------------------------------------------
 //
-// V3.R38 / task #259 — short-lived sessions with refresh-on-use.
+// V3.R38 / task #259 — short-lived sessions with refresh-on-use (1h).
 // V3.R90 / task #400 (2026-05-29) — TTL widened from 1h to 24h.
+// ADR 0294 / task 1003956 (2026-09-16) — CLI sessions lose their expiry entirely.
 //
-//   * Every NEW session (CLI or web) defaults to a 24-hour TTL. The caller may
-//     still pass an explicit expiresAt to override (web flow uses 30 days for
-//     the cookie's max-age, but the SERVER-SIDE row still uses 24h + roll-on-use
-//     so a logged-out browser tab in someone's history can't be replayed weeks
-//     later).
-//   * Every successful lookupSession bumps BOTH last_used_at AND expires_at to
-//     NOW() + 24h. This is the "refresh-on-use" half: an actively-used session
-//     stays valid; an idle session expires after 24h. The bump is fire-and-
-//     forget — it's an optimization for the next request, not a precondition
-//     for THIS request, so we don't add request latency by awaiting it.
-//   * Migration 035 backfilled all pre-existing rows with a 24h grace runway
-//     so deploying the V3.R38 change didn't kick the supervisor / mid-flow
-//     builders. With the V3.R90 TTL = 24h, the refresh window matches that
-//     grace formula exactly — no further migration needed.
-//   * The 1h value originally backstopped C7 (rank-change-near-instant), but
-//     setBuilderRank already calls revokeAllSessionsForBuilder on every
-//     demotion (see below), so the TTL is no longer load-bearing for C7. Its
-//     remaining job is idle-session hygiene under C9 (security baseline).
-//     24h still kills idle sessions overnight; an active builder no longer
-//     gets kicked out over lunch.
-
-// Session TTL on refresh / creation, in milliseconds. Centralized so the
-// migration's grace formula, the test suite, and the code agree on one number.
+// The arc is one long argument the idle timer kept losing. 1h kicked builders
+// out over lunch; 24h kicked them out over a weekend. Each round shortened the
+// nuisance without touching the threat, because the timer never bounded a leaked
+// token in the first place — refresh-on-use means the thief's own traffic keeps
+// it alive, and only the legitimate holder, who steps away, is ever signed out.
+// So the expiry is gone from CLI sessions rather than widened a third time.
+//
+//   * A NEW session whose caller names no expiry gets NONE — expires_at NULL,
+//     which lookupSession treats as never-expires. Every such caller is
+//     source='cli'. The WEB flow passes an explicit 30 days and is unchanged.
+//   * Every successful lookupSession bumps last_used_at, and rolls expires_at
+//     forward to NOW()+24h ONLY for a row that already has one. A NULL stays
+//     NULL — otherwise the first request after sign-in would mint the very
+//     timeout this removed. The bump is fire-and-forget: an optimization for the
+//     next request, not a precondition for THIS one, so it isn't awaited.
+//   * Migration core_243 cleared expires_at on live source='cli' rows, so the
+//     change reached sessions that already existed instead of making every
+//     builder re-auth one last time. (Migration 035 had backfilled a 24h grace
+//     in the other direction, for the same reason: don't sign out the session
+//     deploying the migration.)
+//   * Nothing here is load-bearing for C7 (rank-change-near-instant):
+//     setBuilderRank calls revokeAllSessionsForBuilder on every demotion (see
+//     below) and requireBuilder denies a deactivated builder on the hot path, so
+//     authority drift is closed by revocation, not by waiting out a clock.
+//   * The remedy for a leaked bearer is the own-scoped revoke of ADR 0206 —
+//     GET/POST /me/sessions, and "Sign out everywhere" in the hall — which kills
+//     it now rather than within a day. That is why the timer is affordable to
+//     lose: the thing it was nominally for has a faster answer that already ships.
+
+// The roll-forward window for a session that HAS an expiry, in milliseconds.
+// Centralized so the test suite and the code agree on one number.
 
 // SESSION_TTL_MS — carved to ./db-kernel (ADR 0102); imported + re-exported above.
 

package/src/bongos/routes/auth.js

@@ -1049,7 +1049,8 @@ module.exports = function buildAuthRouter() {
         // audit_log distinguishes portal-reissue from Device Flow tokens.
         source: 'cli',
         userAgent: req.headers['user-agent'] ?? null,
-        // expiresAt: null → createSession applies SESSION_TTL_MS (24h after V3.R90).
+        // expiresAt: null → NO expiry: a CLI bearer lasts until revoked (ADR 0294).
+        // The builder kills it from this same Settings page, under Active sessions.
         expiresAt: null,
       });
       res.json({
@@ -1189,7 +1190,7 @@ module.exports = function buildAuthRouter() {
         token,
         source: 'cli', // 003_pms.sql CHECK; the app is a CLI-class bearer client
         userAgent: `devbox-app pair (${req.headers['user-agent'] ?? 'unknown'})`,
-        expiresAt: null, // createSession applies the 24h refresh-on-use TTL
+        expiresAt: null, // no expiry — a CLI bearer lasts until revoked (ADR 0294)
       });
       const out = pairStore.approve((req.body || {}).pair_code, {
         token,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.790'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.792'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');