@bongos/core 1.19.813 → 1.19.814

package/tests/abandon_creator_authz.mjs

@@ -0,0 +1,176 @@
+// tests/abandon_creator_authz.mjs
+//
+// Regression guard for task 1002443 / ADR 0297 — the PURE abandon decision in
+// modules/lifecycle/abandon-authz.js.
+//
+// WHAT IS BEING PROTECTED. POST /tasks/:id/abandon went from one rank-shaped
+// authority to two, only one of which a rank can express:
+//   • task.abandon     (floor metic) — retire ANY task.
+//   • task.abandon.own (floor xenos) — retire a task you CREATED, and only while
+//     it is still backlog/ready/blocked.
+// The second is the ADR 0151 ownership axis. Its whole safety property is that an
+// own-scoped key is NEVER sufficient by itself: it must be met by a predicate over
+// the concrete row. Every test below exists to stop that collapsing back into an
+// unconditional grant — the `.own` → `.any` degradation the axis was built to
+// prevent.
+//
+// DB-free and route-free by construction (the goal-route-authz.js /
+// shouldRefuseSessionClaim precedent), so every branch is pinned directly rather
+// than only through a live HTTP path.
+//
+// Run:  node --test tests/abandon_creator_authz.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const authz = require('../modules/lifecycle/abandon-authz.js');
+const {
+  abandonVerdict, mayAttemptAbandon, strictSameOwner,
+  CREATOR_ABANDONABLE, ABANDON_ANY_KEY, ABANDON_OWN_KEY,
+} = authz;
+
+const { test, summary } = makeRunner();
+
+const ME = 7;
+const SOMEONE_ELSE = 8;
+
+// ── the cross-owner branch ───────────────────────────────────────────────────
+await test('holding task.abandon admits on ANY task, whoever created it', async () => {
+  const out = abandonVerdict({ holdsAny: true, builderId: ME, createdBy: SOMEONE_ELSE, status: 'ready' });
+  assert.equal(out.ok, true);
+  assert.equal(out.via, ABANDON_ANY_KEY, 'reports WHICH authority admitted');
+});
+
+await test('task.abandon is NOT narrowed by the creator status window', async () => {
+  // A Metic+ keeps exactly the power ADR 0152 gave them. The creator window is an
+  // ADDITION for sub-metic authors, never a new ceiling on triage authority — if
+  // this ever fails, the widening has silently become a restriction.
+  for (const status of ['completed', 'confirmed', 'active', 'backlog']) {
+    const out = abandonVerdict({ holdsAny: true, builderId: ME, createdBy: SOMEONE_ELSE, status });
+    assert.equal(out.ok, true, `task.abandon must still admit on '${status}'`);
+  }
+});
+
+// ── holding nothing ──────────────────────────────────────────────────────────
+await test('holding neither key is refused, even on your own ready task', async () => {
+  const out = abandonVerdict({ holdsAny: false, holdsOwn: false, builderId: ME, createdBy: ME, status: 'ready' });
+  assert.equal(out.ok, false);
+  assert.equal(out.reason, 'missing_permission');
+  assert.match(out.message, /task\.abandon/, 'the denial names the atom it wants');
+});
+
+await test('the default verdict denies — an empty call is never an admit', async () => {
+  assert.equal(abandonVerdict().ok, false, 'fail-closed with no arguments at all');
+  assert.equal(abandonVerdict({}).ok, false, 'fail-closed with an empty options object');
+});
+
+// ── the ownership branch: the key alone is NOT enough ────────────────────────
+await test('task.abandon.own alone does NOT admit on someone else\'s task', async () => {
+  const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: SOMEONE_ELSE, status: 'ready' });
+  assert.equal(out.ok, false, 'an own-scoped key must never reach another owner\'s row');
+  assert.equal(out.reason, 'not_task_creator');
+});
+
+await test('an UNATTRIBUTED task (created_by null) belongs to nobody', async () => {
+  // Every task filed before core_227, plus the seed / restock / discord-bug system
+  // vectors. If null ever matched, one own-scoped grant would open ~1,357 historical
+  // tasks to any builder at once — the single widest failure mode here.
+  const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: null, status: 'ready' });
+  assert.equal(out.ok, false);
+  assert.equal(out.reason, 'not_task_creator');
+});
+
+await test('the creator DOES admit on their own task, in each allowed status', async () => {
+  assert.ok(CREATOR_ABANDONABLE.length > 0, 'a vacuous allow-list would make every case below pass for the wrong reason');
+  for (const status of CREATOR_ABANDONABLE) {
+    const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: ME, status });
+    assert.equal(out.ok, true, `a creator must be able to retire their own '${status}' task`);
+    assert.equal(out.via, ABANDON_OWN_KEY, 'and it must be recorded as the OWN authority, not the any one');
+  }
+});
+
+await test('the creator is refused once the task has moved past planning', async () => {
+  // Past the grader a retire is a correction to the ledger, not an author changing
+  // their mind, so completed/confirmed stay with the cross-owner authority.
+  for (const status of ['active', 'completed', 'confirmed', 'shipped']) {
+    const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: ME, status });
+    assert.equal(out.ok, false, `a creator must NOT retire their own '${status}' task`);
+    assert.equal(out.reason, 'creator_status_not_abandonable');
+    assert.match(out.message, new RegExp(status), 'the denial says which status refused it');
+  }
+});
+
+await test('an unknown or missing status is refused, not admitted', async () => {
+  for (const status of [undefined, null, '', 'READY', 'not-a-status']) {
+    const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: ME, status });
+    assert.equal(out.ok, false, `status ${JSON.stringify(status)} must fail closed`);
+  }
+});
+
+// ── the owner comparison ─────────────────────────────────────────────────────
+await test('owner ids compare across the string/number boundary', async () => {
+  // Postgres hands bigints back as strings; JS code carries them as numbers. If
+  // these stopped matching, every creator would be refused on their own task and
+  // the feature would be silently dead.
+  assert.equal(abandonVerdict({ holdsOwn: true, builderId: 7, createdBy: '7', status: 'ready' }).ok, true);
+  assert.equal(abandonVerdict({ holdsOwn: true, builderId: '7', createdBy: 7, status: 'ready' }).ok, true);
+});
+
+await test('nothing without a real identity matches anything', async () => {
+  // Mirrors the government resolver's ownerIdentity contract EXACTLY, which is the
+  // point — a second, subtly different normalization is how an ownership
+  // comparison quietly widens. Note what is deliberately absent from this list:
+  // any FINITE number is a real identity there (ids arrive as bigints from
+  // Postgres and as numbers in JS), so asserting otherwise here would pin a rule
+  // the two halves do not actually share.
+  for (const v of [null, undefined, '', NaN, Infinity, {}, [], true]) {
+    assert.equal(strictSameOwner(v, v), false, `${String(v)} must not match itself`);
+  }
+  assert.equal(strictSameOwner(7, 7), true, 'a real id still matches itself');
+  assert.equal(strictSameOwner(7, 8), false);
+  assert.equal(strictSameOwner(7, '7'), true, 'and across the bigint/number boundary');
+});
+
+await test('the INJECTED comparator is the one actually used', async () => {
+  // The route injects the government resolver's own normalization so the owner
+  // comparison exists in exactly one place. A refusing comparator must refuse a
+  // pair the built-in would have admitted — otherwise the injection is decorative
+  // and the two halves can drift apart unnoticed.
+  let saw = null;
+  const refuseAll = (a, b) => { saw = [a, b]; return false; };
+  const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: ME, status: 'ready', sameOwner: refuseAll });
+  assert.equal(out.ok, false, 'the injected comparator must be consulted, not bypassed');
+  assert.equal(out.reason, 'not_task_creator');
+  assert.deepEqual(saw, [ME, ME], 'and it must be handed (createdBy, builderId)');
+});
+
+await test('a non-function comparator falls back to the strict one, never to admit', async () => {
+  for (const bogus of [null, 'yes', 42, {}]) {
+    const out = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: SOMEONE_ELSE, status: 'ready', sameOwner: bogus });
+    assert.equal(out.ok, false, 'a broken comparator must not open the gate');
+  }
+  const ok = abandonVerdict({ holdsOwn: true, builderId: ME, createdBy: ME, status: 'ready', sameOwner: null });
+  assert.equal(ok.ok, true, 'and the fallback must still admit a genuine creator');
+});
+
+// ── the cheap pre-transaction half ───────────────────────────────────────────
+await test('mayAttemptAbandon opens the transaction for either key, and for neither', async () => {
+  assert.equal(mayAttemptAbandon({ holdsAny: true, holdsOwn: false }), true);
+  assert.equal(mayAttemptAbandon({ holdsAny: false, holdsOwn: true }), true, 'an own-holder must be let as far as the row question');
+  assert.equal(mayAttemptAbandon({ holdsAny: false, holdsOwn: false }), false);
+  assert.equal(mayAttemptAbandon({}), false, 'fail-closed on an empty call');
+  assert.equal(mayAttemptAbandon(), false);
+});
+
+await test('only a strict true counts as holding a key', async () => {
+  // Guards a caller that hands in a truthy non-boolean (a permission array, a
+  // string) and would otherwise be read as a grant.
+  for (const truthy of ['task.abandon', 1, ['task.abandon'], {}]) {
+    assert.equal(mayAttemptAbandon({ holdsAny: truthy }), false, `${JSON.stringify(truthy)} must not read as a grant`);
+    assert.equal(abandonVerdict({ holdsAny: truthy, builderId: ME, createdBy: SOMEONE_ELSE, status: 'ready' }).ok, false);
+  }
+});
+
+summary();

package/tests/abandon_route.mjs

@@ -0,0 +1,276 @@
+// tests/abandon_route.mjs
+//
+// Regression guard for task 1002443 / ADR 0297 — the COMPOSITION layer of
+// POST /tasks/:id/abandon (modules/lifecycle/routes/abandon-handler.js).
+//
+// WHY THIS FILE EXISTS. The route's authority is assembled from three pieces that
+// each have their own tests and none of which cover the seams between them:
+//   • abandon-authz.js  — the pure decision      (tests/abandon_creator_authz.mjs)
+//   • abandonTask       — the transaction seam   (tests/abandon_task.mjs)
+//   • this handler      — resolve, compose, map  (nothing, until now)
+// A mistake in the wiring — admitting when the government port is absent, mapping
+// a refusal to the wrong status, naming the wrong atom in a denial, passing the
+// wrong flags into the decision — would have passed both of the others. That gap
+// was the grade finding on the first ship of this task; this closes it.
+//
+// No Express, no DB, no live port: the handler takes its collaborators as `deps`,
+// so fakes are enough.
+//
+// Run:  node --test tests/abandon_route.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const { makeAbandonHandler } = require('../modules/lifecycle/routes/abandon-handler.js');
+
+const { test, summary } = makeRunner();
+
+const ME = 7;
+const ANY_KEY = 'task.abandon';
+const OWN_KEY = 'task.abandon.own';
+
+// A res that records instead of writing. `fail` mirrors the real envelope's two
+// call shapes: fail(code, status) and fail(code, { status, message, details }).
+function fakeRes() {
+  const rec = { json: null, fail: null };
+  return {
+    rec,
+    json(body) { rec.json = body; return this; },
+    fail(code, second, third) {
+      const opts = (second && typeof second === 'object') ? second : { status: second };
+      rec.fail = { code, status: opts.status, message: opts.message, details: opts.details ?? third };
+      return this;
+    },
+  };
+}
+
+// A government port with only what the handler actually consults.
+function fakeGovernance({ holds = [], crossOwner = [ANY_KEY], resolveThrows = false, omit = [] } = {}) {
+  const port = {
+    resolveBuilderPermissions: async () => {
+      if (resolveThrows) throw new Error('DB blip');
+      return [...holds];
+    },
+    sameOwner: (a, b) => a != null && b != null && String(a) === String(b),
+    crossOwnerKeysFor: () => [...crossOwner],
+    permissionFloor: (k) => (k === ANY_KEY ? 'metic' : k === OWN_KEY ? 'xenos' : null),
+  };
+  for (const k of omit) delete port[k];
+  return port;
+}
+
+function harness({ governance = fakeGovernance(), abandon, taskId = 42, body = {} } = {}) {
+  const calls = { abandon: null, logged: [] };
+  const deps = {
+    db: {
+      abandonTask: async (args) => {
+        calls.abandon = args;
+        if (typeof abandon === 'function') return abandon(args);
+        return { taskId: args.taskId, taskTitle: 'fixture', taskStatus: 'abandoned', previousStatus: 'ready', alreadyAbandoned: false };
+      },
+    },
+    seams: { resolveOptional: (name) => (name === 'government' ? governance : null) },
+    log: { error: (...a) => calls.logged.push(a) },
+    validateOrRespond: () => false,                    // body is valid
+    parseId: () => taskId,                             // id parses
+  };
+  const req = { builder: { id: ME }, body, params: { id: String(taskId) } };
+  const res = fakeRes();
+  return { handler: makeAbandonHandler(deps), req, res, calls };
+}
+
+// ── the port is the wall, and its absence denies ──────────────────────────────
+await test('a MISSING government port denies fail-closed, and never reaches the db', async () => {
+  // Admitting here would make disabling a module a privilege escalation — the
+  // inversion ADR 0016 exists to prevent.
+  const { handler, req, res, calls } = harness({ governance: null });
+  await handler(req, res);
+  assert.equal(res.rec.fail.status, 403);
+  assert.equal(res.rec.fail.code, 'permission_forbidden');
+  assert.equal(res.rec.fail.details.held, null, 'held is null when authority could not be ESTABLISHED');
+  assert.equal(calls.abandon, null, 'no transaction may be opened');
+});
+
+await test('a MALFORMED port (missing a function the decision needs) also denies', async () => {
+  for (const missing of ['resolveBuilderPermissions', 'sameOwner']) {
+    const { handler, req, res, calls } = harness({ governance: fakeGovernance({ holds: [ANY_KEY], omit: [missing] }) });
+    await handler(req, res);
+    assert.equal(res.rec.fail.status, 403, `a port without ${missing} must deny`);
+    assert.equal(calls.abandon, null);
+  }
+});
+
+await test('a THROWING resolver denies rather than surfacing as a 500', async () => {
+  const { handler, req, res, calls } = harness({ governance: fakeGovernance({ resolveThrows: true }) });
+  await handler(req, res);
+  assert.equal(res.rec.fail.status, 403);
+  assert.equal(res.rec.fail.details.held, null);
+  assert.equal(calls.abandon, null);
+  assert.equal(calls.logged.length, 1, 'and it is logged — a DB blip should be visible');
+});
+
+// ── the denial names the right atoms ──────────────────────────────────────────
+await test('holding neither atom is a 403 naming BOTH ways in, with their floors', async () => {
+  const { handler, req, res, calls } = harness({ governance: fakeGovernance({ holds: [] }) });
+  await handler(req, res);
+  assert.equal(res.rec.fail.status, 403);
+  assert.deepEqual(res.rec.fail.details.required, [ANY_KEY, OWN_KEY],
+    'a denial listing only the metic key would send a creator after the wrong permission');
+  assert.deepEqual(res.rec.fail.details.floors, { [ANY_KEY]: 'metic', [OWN_KEY]: 'xenos' });
+  assert.deepEqual(res.rec.fail.details.held, []);
+  assert.equal(calls.abandon, null, 'the cheap pre-check must not open a transaction');
+});
+
+await test('floors come from the PORT, so a moved floor cannot leave a lie in the denial', async () => {
+  const gov = fakeGovernance({ holds: [] });
+  gov.permissionFloor = (k) => (k === ANY_KEY ? 'archon' : null);
+  const { handler, req, res } = harness({ governance: gov });
+  await handler(req, res);
+  assert.deepEqual(res.rec.fail.details.floors, { [ANY_KEY]: 'archon' },
+    'the floor is read at deny time, never hardcoded');
+});
+
+await test('a port that cannot answer floors still denies, without inventing one', async () => {
+  const { handler, req, res } = harness({ governance: fakeGovernance({ holds: [], omit: ['permissionFloor'] }) });
+  await handler(req, res);
+  assert.equal(res.rec.fail.status, 403);
+  assert.deepEqual(res.rec.fail.details.floors, {});
+});
+
+// ── the escalation path is read from the catalog ──────────────────────────────
+await test('the cross-owner key is DERIVED from the catalog, not hardcoded', async () => {
+  // If the declared counterpart ever changes, the route must follow it rather than
+  // keep admitting on a stale pairing.
+  const { handler, req, res, calls } = harness({
+    governance: fakeGovernance({ holds: ['task.manage.any'], crossOwner: ['task.manage.any'] }),
+  });
+  await handler(req, res);
+  assert.equal(res.rec.fail, null, 'the declared counterpart must admit');
+  assert.equal(res.rec.json.ok, true);
+  assert.equal(calls.abandon.authorize({ createdBy: 999, status: 'completed' }).ok, true,
+    'and it must compose as the CROSS-OWNER branch, unbounded by the creator window');
+});
+
+await test('holding the OLD atom does not admit once the catalog has moved on', async () => {
+  const { handler, req, res, calls } = harness({
+    governance: fakeGovernance({ holds: [ANY_KEY], crossOwner: ['task.manage.any'] }),
+  });
+  await handler(req, res);
+  assert.equal(res.rec.fail.status, 403, 'a catalog that moved on must not leave this gate wide');
+  assert.equal(calls.abandon, null);
+});
+
+await test('a port that cannot name the escalation falls back to the known atom, never to open', async () => {
+  const { handler, req, res } = harness({
+    governance: fakeGovernance({ holds: [ANY_KEY], omit: ['crossOwnerKeysFor'] }),
+  });
+  await handler(req, res);
+  assert.equal(res.rec.fail, null, 'the fallback keeps the metic path working');
+  assert.equal(res.rec.json.ok, true);
+});
+
+// ── composition: what the decision is actually handed ─────────────────────────
+await test('the own-scoped holder reaches the row question, composed correctly', async () => {
+  const { handler, req, res, calls } = harness({ governance: fakeGovernance({ holds: [OWN_KEY] }) });
+  await handler(req, res);
+  assert.ok(calls.abandon, 'an own-holder must be let as far as the transaction');
+  const verdict = calls.abandon.authorize;
+  assert.equal(verdict({ createdBy: ME, status: 'ready' }).ok, true, 'their own ready task admits');
+  assert.equal(verdict({ createdBy: 999, status: 'ready' }).ok, false, 'someone else\'s does not');
+  assert.equal(verdict({ createdBy: ME, status: 'completed' }).ok, false, 'and not past the grader');
+});
+
+await test('the callback is handed the CALLER as the owner to compare against', async () => {
+  // A wiring slip here (comparing against the task id, or a constant) would make
+  // every creator either always or never the owner.
+  let sawArgs = null;
+  const gov = fakeGovernance({ holds: [OWN_KEY] });
+  gov.sameOwner = (a, b) => { sawArgs = [a, b]; return true; };
+  const { handler, req, res, calls } = harness({ governance: gov });
+  await handler(req, res);
+  calls.abandon.authorize({ createdBy: 'abc', status: 'ready' });
+  assert.deepEqual(sawArgs, ['abc', ME], 'the row owner and the requesting builder, in that order');
+});
+
+await test('the reason is passed through and clamped to 2000 characters', async () => {
+  const { handler, req, res, calls } = harness({
+    governance: fakeGovernance({ holds: [ANY_KEY] }),
+    body: { reason: 'x'.repeat(2500) },
+  });
+  await handler(req, res);
+  assert.equal(calls.abandon.reason.length, 2000);
+});
+
+// ── refusal mapping ──────────────────────────────────────────────────────────
+await test('ABANDON_FORBIDDEN from the locked row maps to 403, carrying its reason', async () => {
+  const { handler, req, res } = harness({
+    governance: fakeGovernance({ holds: [OWN_KEY] }),
+    abandon: async () => { throw Object.assign(new Error('not yours'), { code: 'ABANDON_FORBIDDEN', reason: 'not_task_creator' }); },
+  });
+  await handler(req, res);
+  assert.equal(res.rec.fail.status, 403);
+  assert.equal(res.rec.fail.message, 'not yours', 'the row-scoped message reaches the caller');
+  assert.equal(res.rec.fail.details.reason, 'not_task_creator');
+  assert.deepEqual(res.rec.fail.details.held, [OWN_KEY], 'and it reports what they DO hold');
+});
+
+await test('the three lifecycle guards keep their own status codes', async () => {
+  const cases = [
+    ['TASK_NOT_FOUND', 404, 'task_not_found'],
+    ['CANNOT_ABANDON_SHIPPED', 409, 'cannot_abandon_shipped'],
+    ['TASK_HAS_ACTIVE_CLAIM', 409, 'task_has_active_claim'],
+  ];
+  for (const [code, status, envelope] of cases) {
+    const { handler, req, res } = harness({
+      governance: fakeGovernance({ holds: [ANY_KEY] }),
+      abandon: async () => { throw Object.assign(new Error(code), { code }); },
+    });
+    await handler(req, res);
+    assert.equal(res.rec.fail.status, status, `${code} must stay a ${status}`);
+    assert.equal(res.rec.fail.code, envelope);
+  }
+});
+
+await test('an unexpected error is a 500 and is logged, never a silent 403', async () => {
+  const { handler, req, res, calls } = harness({
+    governance: fakeGovernance({ holds: [ANY_KEY] }),
+    abandon: async () => { throw new Error('something else entirely'); },
+  });
+  await handler(req, res);
+  assert.equal(res.rec.fail.status, 500);
+  assert.equal(res.rec.fail.code, 'abandon_failed');
+  assert.equal(calls.logged.length, 1);
+});
+
+// ── the happy path ───────────────────────────────────────────────────────────
+await test('a successful retire answers ok with the db result spread in', async () => {
+  const { handler, req, res } = harness({ governance: fakeGovernance({ holds: [ANY_KEY] }) });
+  await handler(req, res);
+  assert.equal(res.rec.fail, null);
+  assert.equal(res.rec.json.ok, true);
+  assert.equal(res.rec.json.taskStatus, 'abandoned');
+  assert.equal(res.rec.json.previousStatus, 'ready');
+});
+
+await test('an invalid body or id short-circuits before any authority work', async () => {
+  for (const stop of ['body', 'id']) {
+    const calls = { abandon: null, resolved: 0 };
+    const gov = fakeGovernance({ holds: [ANY_KEY] });
+    const realResolve = gov.resolveBuilderPermissions;
+    gov.resolveBuilderPermissions = async (...a) => { calls.resolved++; return realResolve(...a); };
+    const handler = makeAbandonHandler({
+      db: { abandonTask: async () => { calls.abandon = true; } },
+      seams: { resolveOptional: () => gov },
+      log: { error: () => {} },
+      validateOrRespond: () => stop === 'body',
+      parseId: () => (stop === 'id' ? null : 42),
+    });
+    await handler({ builder: { id: ME }, body: {}, params: {} }, fakeRes());
+    assert.equal(calls.abandon, null, `a bad ${stop} must not reach the db`);
+    assert.equal(calls.resolved, 0, `a bad ${stop} must not even resolve permissions`);
+  }
+});
+
+summary();

package/tests/abandon_task.mjs

@@ -40,10 +40,17 @@ const { test, summary } = makeRunner();
 //   status         → the row's current status
 //   hasActiveClaim → the claims lookup returns an unreleased claim
 //   updatedStatus  → what the UPDATE ... RETURNING reports (restore returns 'backlog')
-function fakePool({ status = 'ready', notFound = false, hasActiveClaim = false, updatedStatus = 'abandoned' }) {
+// createdBy (task 1002443) rides the locked SELECT so the ownership predicate and
+// the UPDATE read the same row version; null is the honest default (every task
+// filed before core_227, and every system vector, has no creator).
+function fakePool({ status = 'ready', notFound = false, hasActiveClaim = false, updatedStatus = 'abandoned', createdBy = null }) {
   return makeSqlAwareClient((s, params) => {
-      if (/^SELECT id, title, status FROM tasks WHERE id = \$1 FOR UPDATE/.test(s)) {
-        return { rows: notFound ? [] : [{ id: params[0], title: 'fixture task', status }] };
+      // Both locked SELECTs, and the optional group is load-bearing: abandonTask
+      // reads created_by (task 1002443) and restoreTask does not, so a regex
+      // pinned to either one alone silently returns no row for the other — which
+      // surfaces as TASK_NOT_FOUND and looks like a code bug, not a fake bug.
+      if (/^SELECT id, title, status(, created_by)? FROM tasks WHERE id = \$1 FOR UPDATE/.test(s)) {
+        return { rows: notFound ? [] : [{ id: params[0], title: 'fixture task', status, created_by: createdBy }] };
       }
       if (/SELECT id FROM claims WHERE task_id = \$1 AND released_at IS NULL/.test(s)) {
         return { rows: hasActiveClaim ? [{ id: 999 }] : [] };
@@ -207,5 +214,140 @@ await test('restore: never consults claims (an abandoned task has none by constr
   assert.equal(all(pool._client.queries, /SELECT id FROM claims/).length, 0);
 });
 
+// =========================================================================
+// task 1002443 / ADR 0297 — the `authorize` seam: the row-scoped veto that lets a
+// task's CREATOR retire their own work without holding the metic-floor
+// task.abandon. The DECISION itself is pinned branch-by-branch in
+// tests/abandon_creator_authz.mjs; what is pinned HERE is the seam's mechanics —
+// what it is handed, when it runs, and that every unhappy path denies.
+
+await test('authorize is handed the LOCKED row: created_by and status', async () => {
+  // The whole point of doing this inside the transaction. If the callback were fed
+  // anything other than the row abandonTask just locked FOR UPDATE, the ownership
+  // check would be reading a different version than the UPDATE writes — the TOCTOU
+  // window this seam exists to close.
+  const pool = fakePool({ status: 'ready', createdBy: 7 });
+  let seen = null;
+  await abandonTask({
+    taskId: TASK,
+    reason: 'mine to retire',
+    authorize: (row) => { seen = row; return { ok: true }; },
+  }, { pool });
+  assert.equal(seen.createdBy, 7, 'created_by must reach the predicate');
+  assert.equal(seen.status, 'ready', 'and so must the row status');
+  assert.equal(seen.taskId, TASK);
+  assert.ok(find(pool._client.queries, /^UPDATE tasks/), 'an admit still performs the write');
+  assert.ok(find(pool._client.queries, /^COMMIT/));
+});
+
+await test('a refusing authorize throws ABANDON_FORBIDDEN, rolls back, writes nothing', async () => {
+  const pool = fakePool({ status: 'ready', createdBy: 8 });
+  await assert.rejects(
+    () => abandonTask({
+      taskId: TASK,
+      authorize: () => ({ ok: false, reason: 'not_task_creator', message: 'not yours' }),
+    }, { pool }),
+    (err) => err.code === 'ABANDON_FORBIDDEN' && err.reason === 'not_task_creator',
+  );
+  assert.equal(all(pool._client.queries, /^UPDATE tasks/).length, 0, 'a refusal must never write');
+  assert.ok(find(pool._client.queries, /^ROLLBACK/), 'must ROLLBACK');
+});
+
+await test('authorize runs BEFORE the already-abandoned idempotent return', async () => {
+  // Ordering, and it is a disclosure rule rather than a cosmetic one: if the
+  // idempotent branch came first, a builder with no authority over this row could
+  // probe it and read `alreadyAbandoned: true` back as a 200. An unauthorized retry
+  // is a refusal, not a no-op.
+  const pool = fakePool({ status: 'abandoned', createdBy: 8 });
+  await assert.rejects(
+    () => abandonTask({ taskId: TASK, authorize: () => ({ ok: false, reason: 'not_task_creator' }) }, { pool }),
+    (err) => err.code === 'ABANDON_FORBIDDEN',
+  );
+  assert.ok(!find(pool._client.queries, /^COMMIT/), 'must not COMMIT the idempotent no-op to an unauthorized caller');
+  assert.ok(find(pool._client.queries, /^ROLLBACK/));
+});
+
+await test('authorize also precedes the shipped and active-claim guards', async () => {
+  // Same reason: the 409s are informative, so an unauthorized caller must not be
+  // able to distinguish them. A refusal outranks every status branch below it.
+  for (const setup of [{ status: 'shipped' }, { status: 'ready', hasActiveClaim: true }]) {
+    const pool = fakePool({ ...setup, createdBy: 8 });
+    await assert.rejects(
+      () => abandonTask({ taskId: TASK, authorize: () => ({ ok: false }) }, { pool }),
+      (err) => err.code === 'ABANDON_FORBIDDEN',
+      `an unauthorized caller must get ABANDON_FORBIDDEN, not the ${setup.status} guard`,
+    );
+  }
+});
+
+await test('an authorized creator is STILL stopped by the existing guards', async () => {
+  // The widening adds an authority; it removes no guard. A creator who genuinely
+  // owns the row still cannot retire shipped history, nor a task someone is
+  // actively holding.
+  const shipped = fakePool({ status: 'shipped', createdBy: 7 });
+  await assert.rejects(
+    () => abandonTask({ taskId: TASK, authorize: () => ({ ok: true }) }, { pool: shipped }),
+    (err) => err.code === 'CANNOT_ABANDON_SHIPPED',
+  );
+  const claimed = fakePool({ status: 'ready', createdBy: 7, hasActiveClaim: true });
+  await assert.rejects(
+    () => abandonTask({ taskId: TASK, authorize: () => ({ ok: true }) }, { pool: claimed }),
+    (err) => err.code === 'TASK_HAS_ACTIVE_CLAIM',
+  );
+  assert.equal(all(claimed._client.queries, /^UPDATE tasks/).length, 0);
+});
+
+await test('the seam is FAIL-CLOSED: anything but an explicit { ok: true } denies', async () => {
+  for (const verdict of [undefined, null, false, {}, { ok: 'yes' }, { ok: 1 }, 'ok', { okay: true }]) {
+    const pool = fakePool({ status: 'ready', createdBy: 7 });
+    await assert.rejects(
+      () => abandonTask({ taskId: TASK, authorize: () => verdict }, { pool }),
+      (err) => err.code === 'ABANDON_FORBIDDEN',
+      `${JSON.stringify(verdict)} must not be read as an admit`,
+    );
+    assert.equal(all(pool._client.queries, /^UPDATE tasks/).length, 0);
+  }
+});
+
+await test('a THROWING authorize denies rather than escaping as a 500', async () => {
+  const pool = fakePool({ status: 'ready', createdBy: 7 });
+  await assert.rejects(
+    () => abandonTask({ taskId: TASK, authorize: () => { throw new Error('resolver blew up'); } }, { pool }),
+    (err) => err.code === 'ABANDON_FORBIDDEN' && err.reason === 'authorize_threw',
+  );
+  assert.equal(all(pool._client.queries, /^UPDATE tasks/).length, 0);
+  assert.ok(find(pool._client.queries, /^ROLLBACK/));
+});
+
+await test('authorize never runs for a task that does not exist', async () => {
+  const pool = fakePool({ notFound: true });
+  let called = false;
+  await assert.rejects(
+    () => abandonTask({ taskId: 424242, authorize: () => { called = true; return { ok: true }; } }, { pool }),
+    (err) => err.code === 'TASK_NOT_FOUND',
+  );
+  assert.equal(called, false, 'there is no row to be the owner of');
+});
+
+await test('OMITTING authorize preserves the pre-1002443 behaviour exactly', async () => {
+  // Every caller whose route already gated the transition (and the merge path,
+  // which mirrors this function) must be untouched by the new parameter.
+  const pool = fakePool({ status: 'ready', createdBy: 8 });
+  const out = await abandonTask({ taskId: TASK, reason: 'no authorize supplied' }, { pool });
+  assert.equal(out.taskStatus, 'abandoned');
+  assert.equal(out.previousStatus, 'ready');
+  assert.ok(find(pool._client.queries, /^UPDATE tasks/));
+  assert.ok(find(pool._client.queries, /^COMMIT/));
+});
+
+await test('a non-function authorize is ignored, not treated as a refusal', async () => {
+  // `authorize: null` is the documented "no row-scoped veto" default; only a real
+  // function is consulted. This pins that a caller passing null does not
+  // accidentally brick the gated path it already guards in middleware.
+  const pool = fakePool({ status: 'ready', createdBy: 8 });
+  const out = await abandonTask({ taskId: TASK, authorize: null }, { pool });
+  assert.equal(out.taskStatus, 'abandoned');
+});
+
 // -------------------------------------------------------------------------
 summary();

package/tests/government_ownership_scope.mjs

@@ -100,18 +100,24 @@ test('A2: every ".own"-suffixed key DECLARES scope own — the namespace never o
 });
 
 test('A3: the modelled families are the ones the ownership sweep names', () => {
+  // `task` joined the modelled families in task 1002443 (ADR 0297) — the first
+  // family added because a ROUTE needed it rather than to complete the model.
   assert.deepEqual(Object.keys(RESOURCE_FAMILIES).sort(),
-    ['box', 'builder_prefs', 'claim', 'credential', 'goal', 'memory']);
+    ['box', 'builder_prefs', 'claim', 'credential', 'goal', 'memory', 'task']);
   assert.deepEqual([...ownershipScopedKeys()].sort(),
-    ['box.manage.own', 'credential.manage.own', 'goal.manage.own', 'me.wandering.set', 'memory.manage.own', 'task.act.own']);
-  // The cross-owner side is NOT derivable from spelling: box's is `box.fleet.manage`.
+    ['box.manage.own', 'credential.manage.own', 'goal.manage.own', 'me.wandering.set', 'memory.manage.own', 'task.abandon.own', 'task.act.own']);
+  // The cross-owner side is NOT derivable from spelling: box's is `box.fleet.manage`,
+  // and `task.abandon` carries no suffix at all — it predates the axis and was given
+  // scope/resource/verb in place rather than renamed, because it is seeded in live
+  // rank rows (governance_002) and a key rename is a migration, not a declaration.
   assert.deepEqual([...crossOwnerKeys()].sort(),
-    ['box.fleet.manage', 'claim.release.any', 'memory.read.any']);
+    ['box.fleet.manage', 'claim.release.any', 'memory.read.any', 'task.abandon']);
   // The escalation path is DECLARED per key, never derived from the resource
-  // family (task 1003195). box is the one REAL pair in the catalog today:
-  // `box.fleet.manage` is the same `manage` verb over every owner's box, so it
-  // genuinely subsumes managing your own.
+  // family (task 1003195). TWO real pairs now: `box.fleet.manage` is the same
+  // `manage` verb over every owner's box, and `task.abandon` the same `act` verb
+  // over every creator's task, so each genuinely subsumes doing it to your own.
   assert.deepEqual(crossOwnerKeysFor('box.manage.own'), ['box.fleet.manage']);
+  assert.deepEqual(crossOwnerKeysFor('task.abandon.own'), ['task.abandon']);
   // claim and memory each HAVE an `any` key in their family and still declare no
   // counterpart — the distinction the family-derived version could not make.
   // `claim.release.any` carries one third of `act` (release, not cost or notes);