@bongos/core 1.19.823 → 1.19.825

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.823",
-  "core_contract": "1.19.823",
-  "source_commit": "2dbaf2b0a9d49393d3f3daf6f501a09087b8a156",
+  "core_version": "1.19.825",
+  "core_contract": "1.19.825",
+  "source_commit": "cb729764661db914505acde16e83bf6db16e47fb",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T11:55:48.898Z",
+  "built_at": "2026-09-17T13:27:19.562Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 490,
+    "docs_redacted": 491,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2230,
+    "functional_verbatim": 2234,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2746,
-  "tree_sha256": "6b21d5cba0536e95777730af1de9c226f7d38a89997a4cb586847a39748e7f37",
+  "file_count": 2751,
+  "tree_sha256": "d080ea1d5501cd02f6af8cde89d25b58442a1abf7d282379bbf683df5b00ee33",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1979,10 +1979,15 @@
       "mode": "0000644",
       "sha256": "8fcac086f276e57b59ba635cdf34600bf78bfb69d80177d43065dfc6776b0611"
     },
+    {
+      "path": "docs/adr/0299-the-nod-queue-stays-scoped-to-routed-filings.md",
+      "mode": "0000644",
+      "sha256": "f52bf2568d02d5cf8589dc394dc76cbf0ea3a7ba193275f300e320c2ab64a51c"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "14c4e2e04bba4a0438375364a88e41eca44983ab0fb2c3ecd13bf0190f0ad151"
+      "sha256": "0b4e0cd78a8bd6ae3d41c0d010634dfdc29ecd4dca1f8b49127791d1b4cd7450"
     },
     {
       "path": "docs/api-reference.md",
@@ -2537,7 +2542,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "5560da3dad24d04ba192d4cbcab9f7e669ebd6ead35bde8d92a222a763289a36"
+      "sha256": "4cacfe54b3e4f80aa1cd7a4b190bf673da867f99d5101cc1c7870ee13021c008"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2547,7 +2552,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "5236a1550b3f87d767e2f59479b3f2ef8859621f0c57bbd7a054b8d056c1a2ef"
+      "sha256": "bc4fb1f646f00a5ac5870be4468a5bcb94c1bc19d6c69eea48c54d63f5d0eb70"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5422,7 +5427,7 @@
     {
       "path": "modules/ideas/inbox.js",
       "mode": "0000644",
-      "sha256": "36481a27a5921e3eb930268bf96bccd178259d3f7cce67b19b0dc4246f7d9bf1"
+      "sha256": "683e2234893c9814c2ecec490099c140e273e764e993707bb1cc4c5c9d1baed3"
     },
     {
       "path": "modules/ideas/migrations/ideas_001_grades.sql",
@@ -7812,12 +7817,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ade8e48efd7ae7eaeb9f51472f731940ca866a1f0a8917de7dadab245428908b"
+      "sha256": "2a7a81e9c97e32cc83b22d74eef060a6829d4e6847dfabaa9a851ebff576b151"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "bd706beddc637ac4587a99436be805e327d7392306525124874ea39092fa6149"
+      "sha256": "67e42f1c6c167a0857846b43f877395adc67ce48ae72c31cc4709240906e6432"
     },
     {
       "path": "public-docs/index.html",
@@ -8092,7 +8097,7 @@
     {
       "path": "scripts/gds/category-advisory-guard.js",
       "mode": "0000644",
-      "sha256": "a71ac076299b9e37bf8e0a6ff8761f8ba3059271b2596b6ee8941fc24533357d"
+      "sha256": "19fd98214001bb83ed69789653519d820ece8d94fea4451503ecf85ff4285f32"
     },
     {
       "path": "scripts/gds/cf-tunnel.js",
@@ -8357,7 +8362,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "8725f7a8dcdd6445e8d2379e24c3985624b1889cc67be055cce8365b312457d2"
+      "sha256": "aa1a26c0b2871cd6e49b619254ce2b11d477780da8f4b037c38cb16b0ccd68fc"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -8869,6 +8874,11 @@
       "mode": "0000644",
       "sha256": "c82513a9333724c77ba3a99667726861c292d576ea493f2144e6051dd78c47b6"
     },
+    {
+      "path": "scripts/gds/scope-map-guard.js",
+      "mode": "0000644",
+      "sha256": "75f0791698a36e48ec232d2285e6f80dac6d64c2a23a23a26cd54c1c05883c3b"
+    },
     {
       "path": "scripts/gds/seam-wiring-guard.js",
       "mode": "0000644",
@@ -9239,6 +9249,11 @@
       "mode": "0000644",
       "sha256": "2a9959bd2e45046dadcda9982998a5b7163cef00b5d719ff299314daa5409770"
     },
+    {
+      "path": "scripts/gds/stranded-rows.js",
+      "mode": "0000644",
+      "sha256": "573e608a90b5822f9bf77f203d54cf8a80ef9e96bdc51b22e5dec1226da3ee98"
+    },
     {
       "path": "scripts/gds/stray-unit-sweep.sh",
       "mode": "0000644",
@@ -9537,7 +9552,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "8d7b749edca694b4c9d8a563a4334c7fe3fc7be64c520c3d14c3b63febff132a"
+      "sha256": "7f393fc515fe751d5296ce0a574e0d3e40695c0346933a0d8b9c30ed6ae39a1b"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -9727,7 +9742,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2ac366c05863ab86d0bdb5b3df3bf6f605e4edb0182a977c83c781cf503bf5b7"
+      "sha256": "8f04e8b51652109c0e95424fbc9801ed170b2bc899f91793ac827152e653c07a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10372,7 +10387,7 @@
     {
       "path": "tests/category_advisory_guard.mjs",
       "mode": "0000644",
-      "sha256": "8fd7b066c264ddaeccaa2dfa9a3c1fe6204a943933a1161c6a235f45b40ab121"
+      "sha256": "0fdb3c4e34fadc0f6697eb3ee3083d6739273e4df3c5693b7c3693cf0dfb1ef1"
     },
     {
       "path": "tests/cf_ruleset_preflight.mjs",
@@ -12879,6 +12894,11 @@
       "mode": "0000644",
       "sha256": "8d516fe0fb398d8322e014773901449b6909439ab1567c90d8354b49f211cdbf"
     },
+    {
+      "path": "tests/scope_map_guard.mjs",
+      "mode": "0000644",
+      "sha256": "278e334a945d151c225d849b51464a3dffc8f0bb0dcb1d39b72d12bae57efd4f"
+    },
     {
       "path": "tests/scouting_owner_access_and_reach.mjs",
       "mode": "0000644",
@@ -13389,6 +13409,11 @@
       "mode": "0000644",
       "sha256": "bba2bde5b7a4a25ccddff58fb2fde0ef84ef67224e63819232221a461234a30f"
     },
+    {
+      "path": "tests/stranded_rows.mjs",
+      "mode": "0000644",
+      "sha256": "63070400896c81e90e53e6b9480beb55eafee854d7d54971e201cee70056d487"
+    },
     {
       "path": "tests/streak.mjs",
       "mode": "0000644",

package/docs/adr/0299-the-nod-queue-stays-scoped-to-routed-filings.md

@@ -0,0 +1,65 @@
+# ADR 0299 — The nod queue stays scoped to routed filings; the backlog walk is the widening
+
+**Status:** accepted · **Date:** 2026-09-17 · **Task:** [task 1003748](https://cloudbongos.com/builders#/task/1003748) (goal 1000089)
+
+## Context
+
+`listRoutedAwaitingNod` (`modules/ideas/inbox.js`) feeds the "Reported work awaiting a
+nod" slice of the Home attention card, and it filters `WHERE l.origin = 'route'`. On
+2026-09-08 that read returned 11 rows while 232 tasks sat at `backlog`. The task asked
+whether a queue that omits ~95% of the un-nodded backlog is honestly named, or should
+grow a second slice for un-routed rows. It noted two things that bound any widening:
+dep-gated rows wait on a trigger (migration 163), not a person, so they must not be
+shown as needing a nod; and [task 1003746](https://cloudbongos.com/builders#/task/1003746)
+(`/backlog-review`) might make the question moot, so decide after that exists.
+
+It exists now. Live numbers on 2026-09-17, from `node scripts/gds/backlog-review.js`:
+
+| Bucket | Rows |
+|---|---|
+| waiting on a dependency (auto-promotes on ship) | 109 |
+| spikes (backlog by convention, migration 020) | 2 |
+| stranded (dep abandoned — trigger can never fire) | 1 |
+| awaiting a nod (only a human gates it) | 3 |
+| **total backlog** | **115** |
+
+`GET /inbox/awaiting-nod` returned `count: 0`. `GET /inbox/rotting` returns 200 (the
+route-shadowing bug the task mentioned no longer reproduces), with no rows past the
+30-day timer.
+
+## Decision
+
+**Do not widen the nod queue or the card.** `origin='route'` stays the predicate.
+
+1. **The premise that ~220 rows had no path to a human is gone.** Of the rows the card
+   omits, 111 are correctly *not* a person's decision (109 dep-gated, 2 spikes). The
+   remaining 4 (3 nod + 1 stranded) are exactly what `/backlog-review` walks, goal by
+   goal, with the dependency predicate the task said any widening would need
+   (`include=deps` → per-edge `satisfied`). The widening the task asked for already
+   shipped — as a cadence skill, not a card slice.
+2. **The name is honest.** The card says *"Reported work awaiting a nod"* — reported
+   is the routed population. It never claimed to be the whole backlog.
+3. **A second slice would duplicate a partition.** The four-bucket split lives in
+   `backlog-review.js`; a card slice would need a second copy of the
+   stranded/dep-gated/spike rules in SQL, free to disagree with the walk. The rot
+   card already carries the same kind of warning about its verb list duplicated there.
+4. **The card is a push surface for filers.** A routed filing is someone waiting on an
+   answer; a planning-seeded backlog row is not. Mixing them dilutes the one signal
+   the card exists to carry (task 1003066, owner interview Q3).
+
+## Revisit when
+
+- The *awaiting a nod* bucket of `/backlog-review` (not dep-gated, not spike, not routed)
+  grows past what one daily walk clears — then a Home count linking to the walk earns
+  its place. Show a **count and link**, not rows, and derive it from the same partition
+  the walk uses.
+- `/backlog-review` stops being run — then the rot timer is again the only pull, and
+  this decision's first reason no longer holds.
+
+## Rejected
+
+- A second "un-routed backlog" slice on the card (duplicates the partition; dilutes the
+  filer signal).
+- Renaming the queue (the current copy already says *reported*).
+- Dropping the origin filter and relying on `has_unshipped_dep` (would pull planning rows
+  and spikes into a surface built for filers).

package/docs/adr/README.md

@@ -390,3 +390,4 @@ This keeps the decision history honest and traceable.
 | 0296 | [**A role speciality is data over three existing surfaces, not a fourth mechanism** ([task 1003855](https://cloudbongos.com/builders#/task/1003855), goal 1000095). A craft says HOW you work; nothing said what you work ON. A speciality is a named bundle of knowledge, skills and an interaction contract sitting under a craft — an ideator with an Economics speciality. **Decision: it is DATA, not an ADR 0083 code module** — a subject-matter expert authors one, and requiring them to ship a package puts the mechanism out of reach of exactly the person it exists for. It layers over three surfaces that already exist (discipline-modes.json, the `behavior_prefs.interaction` contract path, the manifest contribution seam); only the knowledge bundle is new. The contract **rides the existing GET /me -> Conductor injection path rather than adding a second one**, and is CRAFT-SCOPED: the hook injects only the contract matching the claim in hand (which needed `t.discipline` on the active-claims read), and with no claim there is no craft and **nothing is injected** — silence beats guessing which expertise applies. Training is two-fold per the owner's 2026-09-17 ruling: documents they supplied, plus learnings captured from sessions worked in it (pointing at existing `learnings` rows, never a second corpus). The corpus is **inventoried, never inlined** — a document may run to 100k chars — so `speciality_documents` joins the recall ingester, because otherwise the contract's "search it with /recall" is a lie whose failure is silent. **`sellable` is recorded with no storefront behind it**: ADR 0107 defers the marketplace and explicitly rejected building one, so the flag captures the owner's decision when they make it and grants nothing — a deliberate partial implementation, recorded rather than silently made. Index scoping errs toward UNDER-sharing: only a public speciality's documents are corpus-wide, because `project` names a set the index cannot express.](0296-a-role-speciality-is-data-over-three-existing-surfaces.md) | roles / modules |
 | 0297 | [**A task’s creator may retire it, and that is the ownership axis’s first route** ([task 1002443](https://cloudbongos.com/builders#/task/1002443), goal 1000095 — owner request 2026-07-25: *"the creator of that task should be able to abandon that task directly inside of the UI"*). Attribution itself shipped earlier and elsewhere (`core_227`, [task 1003278](https://cloudbongos.com/builders#/task/1003278)); what had not moved is that **retiring a task was a rank power and nothing else** — `task.abandon` floors at `metic` (ADR 0152), so a sub-Metic builder could file a task and then could not withdraw their own proposal. The model already had the vocabulary and had never used it: ADR 0151 §3 defines an **ownership axis** where a `scope:'own'` key authorizes nothing until a handler supplies the row's owner, R100 made `requirePermission` refuse such a key outright so `.own` can never degrade into `.any`, and it recorded that **zero call sites passed one**. This is that axis’s first real consumer. **Decision: two authorities, only one rank-shaped** — `task.abandon` (metic, any task) OR new `task.abandon.own` (xenos, a task you created, while it is still backlog/ready/blocked). Route becomes `requireBuilder` + an in-handler decision (the `POST /goals/:id/members` shape), pin `metic+archon`→`any-builder` so it now catches an accidental **tightening** as loudly as a gate removal. **The two facts resolve in two places on purpose:** the RANK fact is request-scoped and resolves before the transaction (uncached, ADR 0016); the OWNER fact is a column that can change under us, so `created_by` joins `abandonTask`’s existing `FOR UPDATE` SELECT and a new optional `authorize` callback decides under that lock. Reading `created_by` in the route would be a TOCTOU window; resolving permissions inside the transaction would hold a row lock across a second pool acquire. The decision is a PURE module (`abandon-authz.js`, the `goal-route-authz.js` precedent) so every branch is pinned DB-free and the hall hint and server verdict provably read one rule. **A creator’s window stops at the grader** — completed/confirmed stay cross-owner, because past the grader a retire is a ledger correction, not an author changing their mind; nothing is subtracted from `task.abandon`, pinned by a test. `counterpart: ['task.abandon']` is declared not derived, verb `act` not `manage` — `manage` would silently dominate every future narrower `task.*.own` key (the verb-blind escalation task 1003195 closed). **A null creator belongs to nobody and that is load-bearing:** ~1,357 pre-`core_227` tasks plus seed/restock/discord vectors are unattributed, so the owner comparison is the government resolver’s own — injected, never re-implemented, since a duplicated ownership comparison is how one quietly widens — and one slip would open every historical task to a xenos grant at once. Fail-closed throughout: a missing `government` port, a throwing resolver, and anything but an explicit `{ok:true}` all deny, and `authorize` runs BEFORE the idempotent already-abandoned return and the shipped/active-claim guards so an unauthorized caller cannot probe a row through a 200. No guard removed. Does NOT widen edit/promote/dependency (still Metic), does not touch `task.merge`, and does not backfill attribution — the control simply does not appear on tasks predating `core_227`.](0297-a-tasks-creator-may-retire-it.md) | authority / lifecycle / ownership |
 | 0298 | [**The grader gets a reader lens: advisory, scoped to copy-bearing diffs, and it waits on a written voice** ([task 1003937](https://cloudbongos.com/builders#/task/1003937), goal 1000095 — Working area 6; owner decision 2026-09-17). Every artist review the cascade files opened with *“REVIEW THE GRADER … coach it”*, and it could not be followed: the v4 panel runs narc, quality, hacker and efficiency — completion, code quality, security, runtime cost — and not one of them reads a sentence for whether it is true, clear, in the project’s voice or worth a person’s attention. Four consecutive reviews hit the same wall and all four graded ships deservedly PASSED on the axes that were measured; the gate is not lenient, it is not pointed at this. `grader-prompt.js` already injects the craft’s written responsibility, but only when `discipline === ‘artist’`, so the unjudged case is copy shipped by someone whose craft is not the copy. **Decision: a fifth ADVISORY `reader` worker, on three settled terms.** It runs only where `modules/lifecycle/cascade.js`’s existing `hasCopyOrVisualWork` says the ship is copy-bearing — the same predicate the after-the-fact review uses, so the two can never disagree about coverage, and every other ship costs exactly what it costs today. It records `issues[]` and a `copy_score` and can never verdict `fail` or drag the panel to `concerns`, because [ADR 0241](0241-the-artist-gate-is-a-per-project-deploy-gate-that-reads-a-state.md) put the artist’s judgement on the DEPLOY and off the ship path; gating would need that ADR amended first. And it is NOT BUILT until the instance writes a voice guide — today the whole written standard is one dash rule in `DESIGN.md`, a tagline, a registry of which 1,860 strings exist, and one responsibility sentence, so a lens built now would record taste and call it a finding. Until the reader exists, STEP 1 asks the artist to WRITE DOWN what the grade could not see rather than to coach a lens that is not listening — followable today, and the corpus both the guide and the lens get written from. Nothing in the rubric, the active panel or any existing worker changes.](0298-the-reader-lens-is-advisory-and-waits-on-a-voice-guide.md) | grading / the artist’s loop / voice |
+| 0299 | [**The nod queue stays scoped to routed filings; the backlog walk is the widening** ([task 1003748](https://cloudbongos.com/builders#/task/1003748), goal 1000089). `listRoutedAwaitingNod` filters `origin='route'`, and on 2026-09-08 showed 11 of 232 backlog rows. Re-measured after `/backlog-review` (task 1003746) shipped: 115 backlog rows = 109 dep-gated + 2 spikes (not a person's decision) + 1 stranded + 3 awaiting a nod, all four walked by `/backlog-review`. **Decision: do not widen the card.** The omitted population already has a walkable review with the dependency predicate any widening needed; the copy says *reported* work, so the name is honest; a card slice would be a second copy of the walk's four-bucket partition. Revisit if the un-routed nod bucket outgrows a daily walk (then a count + link, derived from the same partition) or if the walk stops being run.](0299-the-nod-queue-stays-scoped-to-routed-filings.md) | ideas / backlog / attention |

package/docs/file-map.md

@@ -464,7 +464,8 @@ tests/
 ├── repo-simplify-sweep/SKILL.md       ← weekly repo-cleanliness janitor — runs repo-metrics, files dead-code findings to idea_inbox, and auto-fixes only the narrow safe class (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── security-review-weekly/SKILL.md    ← weekly security-state review — stale vulnerability_reports, ageing security-tagged tasks, recent high/critical dependency alerts; one Archon broadcast when anything is stale, silent otherwise (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
 ├── skill-usage-review/SKILL.md        ← nightly skill-usage feedback loop — aggregates 24h of skill invocations into friction findings filed as `[skill-friction]` idea_inbox rows (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
-└── stale-claim-release/SKILL.md       ← hourly sweep releasing claims whose session_pulses heartbeat has been silent for GDS_STALE_CLAIM_HOURS, returning the task to ready and pinging the builder (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+├── stale-claim-release/SKILL.md       ← hourly sweep releasing claims whose session_pulses heartbeat has been silent for GDS_STALE_CLAIM_HOURS, returning the task to ready and pinging the builder (restored in task 1003365; unscheduled in core — only redteam-weekly has a firing workflow; config/scheduled-routines.json records the intended cadence)
+└── stranded-rows/SKILL.md             ← flags an open task whose work ALREADY LANDED on main (task 1003775): a row still in ready/backlog while a commit claims it with a line ending in `(task N)`. Narrower than "mentions N" on purpose — idea 1000807 measured that a mention-scan returns ~44 open rows that merely cite an id. Measured clean at 878 claims vs 434 open rows, and still catches the historical case (task 1002200, whose claim lives in the MERGE commit body). NO cadence declared: nothing schedules it yet, so it is run by hand — wiring a scheduler needs the control plane, and declaring a cadence with no cron firing it fails fitness Check 25 (task 1003209, ADR 0188). Prints ids + fixed vocabulary only, never builder-authored text.
 ```
 <!-- END GENERATED FILE-MAP .claude/scheduled-tasks/ -->
 

package/docs/module-api-changelog.md

@@ -2119,6 +2119,10 @@ is load-bearing: the script throws rather than guess if it is missing, and
   1.19.822 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.821 with no explicit bump. run 35213847140. (task 1002620)
   1.19.823 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
-        landed since 1.19.822 with no explicit bump. run 35218228051. (task 1002620)
+        landed since 1.19.822 with no explicit bump. run 35218585239. (task 1002620)
+  1.19.824 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.823 with no explicit bump. run 35220051893. (task 1002620)
+  1.19.825 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.824 with no explicit bump. run 35227106979. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/ideas/inbox.js

@@ -891,7 +891,9 @@ async function sourceIdeaForTask(taskId) {
 //
 // Scoped by the lineage row (origin='route'), not by status alone — a task can be
 // at backlog for a dozen unrelated reasons, and this queue is specifically "a
-// person reported this and the system is waiting on a human". It reads the FILER
+// person reported this and the system is waiting on a human". Widening it to the
+// rest of the backlog was weighed and declined (ADR 0299): /backlog-review walks
+// that population with the dependency split this read lacks. It reads the FILER
 // too (captured_by), because Q3's copy calls the pending state "awaiting a nod"
 // and shows kind + who filed it.
 //

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.823",
+  "version": "1.19.825",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.823",
+      "version": "1.19.825",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.823",
+  "version": "1.19.825",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/category-advisory-guard.js

@@ -69,6 +69,18 @@ const FEATURE_ANCHORS = [
 // Word-bounded on purpose: `subcategory_id` in some unrelated module is not this
 // feature, and a guard that cries wolf gets suppressed rather than obeyed. The
 // table name needs no boundary — nothing else is called that.
+// A quoted path to a scripts/gds/*.js file is a FILENAME, not a category read
+// (task 1003949). One of these guards is itself called category-advisory-guard.js,
+// so the moment any decision surface lists the enforcement tooling by path — which
+// module-scope-map.js must, to own it — this check fired on its own name.
+//
+// Blanked rather than exempted by file, and kept as narrow as it can be: only the
+// quoted path is removed, so the rest of the line is still scanned. A genuine
+// category read cannot hide inside a string that ends in .js.
+function withoutScriptPaths(line) {
+  return String(line).replace(/(['\"`])[^'\"`]*\.js\1/g, '""');
+}
+
 const CATEGORY_RE = /\bcategor(y|ies|ised|ized|isation|ization)\b|\bcategory_id\b|work_categories/i;
 
 // Strip // line comments and /* */ blocks so a citation of a rule is legal and only
@@ -147,7 +159,7 @@ function scanGates(files, read) {
     const code = stripComments(src);
     const hits = code.split('\n')
       .map((line, i) => ({ line: line.trim(), n: i + 1 }))
-      .filter(({ line }) => CATEGORY_RE.test(line));
+      .filter(({ line }) => CATEGORY_RE.test(withoutScriptPaths(line)));
     for (const { line, n } of hits) {
       violations.push(
         `${rel}:${n} reads a work CATEGORY inside a decision surface — \`${line.slice(0, 100)}\`. `

package/scripts/gds/fitness.js

@@ -1234,6 +1234,7 @@ const CHECKS = [
   // one (ADR 0289). Rationale + the seam→consumer table live in that file.
   require('./seam-wiring-guard.js').checkSeamWiring,
   require('./home-isolation-guard.js').checkHomeIsolation, // Check 34 — task 1003763: a test that sets HOME for a child without USERPROFILE isolates NOTHING on win32, so it silently stops testing what its comment says. Three tasks fixed this one site at a time. Rationale in that file.
+  require('./scope-map-guard.js').checkDevsecopsOwnsItsChecks, // Check 35 — task 1003949: a check file no MODULE_SCOPE_MAP key owns cannot be authorized by the goal scoped to own it, and the list drifts once per new check. Rationale in that file.
   require('./adr-namespace.js').checkAdrNumbering, require('./exec-path-guard.js').checkExecPathsStatic, // Check 32 — task 1003371 / B50: what the server EXECUTES, out of whose tree — the blind spot all three 2026-08-29 CRITICALs shared. Rationale + reviewed exemptions live in that file. Sharing Check 31's line (the 19c/19d + 23/24 precedent above): fitness.js is AT the 1,500 ratchet and a new check cannot afford a line until task 1003825 buys it back.
 ];
 

package/scripts/gds/scope-map-guard.js

@@ -0,0 +1,120 @@
+'use strict';
+
+// scripts/gds/scope-map-guard.js — the enforcement tooling owns itself (task 1003949).
+//
+// THE DRIFT THIS STOPS. MODULE_SCOPE_MAP's `devsecops` key enumerates the
+// enforcement tooling by exact path, and the house style since fitness.js hit its
+// line ratchet is that every new check gets its OWN file beside it. Those two facts
+// disagree once per new check: the file appears, nobody adds it to the map, and
+// scopeSubset() resolves it to no module territory — so a goal scoped to devsecops
+// is refused out_of_scope for touching the very tooling it exists to own. That is
+// the same class as tasks 1002690 / 1002736 / 1003124 / 1003655, and it WIDENS with
+// every check added.
+//
+// WHY A GUARD RATHER THAN A LONGER LIST. The list was appended to this time too —
+// but a list that needs appending is the defect, not the fix. Note the evidence:
+// the task that filed this named fourteen unowned files, and fitness.js requires more than that, and the number moves
+// with every check added — which is why this reads the file instead of citing a count. The list was already stale again by the time
+// somebody wrote it down.
+//
+// WHY NOT A PREFIX OR A DIRECTORY MOVE. The scope-map format has no wildcards, so
+// owning the family by prefix means moving the guards into scripts/gds/fitness/ —
+// and those filenames are named in workflows, skills, ADRs, session logs, the file
+// map and the docs tree (40+ files). That is a real refactor with a wide blast
+// radius, and it is deliberately NOT bundled here; this makes the drift impossible
+// first, which is what the goal wall actually needs.
+//
+// WHY THE LIST STAYS EXPLICIT. MODULE_SCOPE_MAP feeds an AUTHORIZATION decision.
+// Deriving it at runtime from a static scan of another file would mean what a goal
+// may touch depends on a regex over source text — a worse property than a list a
+// human can read. So the list stays literal and CI keeps it honest.
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const FITNESS = path.join('scripts', 'gds', 'fitness.js');
+
+// Every `require('./x.js')` in fitness.js — the files it actually runs, which is
+// the definition of "the enforcement tooling" that matters here.
+//
+// PURE, and exported, so the extraction is testable without the real file: a
+// scanner that quietly matches nothing looks exactly like a clean result, and this
+// one's whole job is to produce a non-empty set.
+// THE EXTENSION IS OPTIONAL, and requiring it was a real gap (grade round 1). Node
+// resolves `require('./run-routine')` to run-routine.js, and fitness.js writes FOUR of
+// its sibling requires that way — gen-api-docs, migration-namespace, run-routine,
+// skill-lint. A pattern anchored on `.js` found none of them, so four check files
+// stayed unowned while this guard reported the set clean.
+//
+// That is the failure shape this file exists to end, committed by the guard itself: a
+// scan that matches less than it should reports a healthy repo, and healthy is exactly
+// what a broken scan looks like.
+function siblingRequires(source) {
+  const out = new Set();
+  for (const m of String(source || '').matchAll(/require\(['"]\.\/([A-Za-z0-9._-]+?)(\.js)?['"]\)/g)) {
+    out.add(`scripts/gds/${m[1]}.js`);
+  }
+  return [...out].sort();
+}
+
+// PURE — which of those files no module key claims. A DIRECTORY entry owns everything
+// beneath it, which is why `dirs` is a parameter rather than something the caller
+// pre-filters: forgetting it would report every file under an owned directory as
+// unowned.
+function unownedBy(siblings, ownedPaths, dirs = []) {
+  const owned = new Set(ownedPaths);
+  return siblings.filter((p) => !owned.has(p) && !dirs.some((d) => p.startsWith(d)));
+}
+
+function checkDevsecopsOwnsItsChecks() {
+  const name = 'the enforcement tooling owns itself (task 1003949)';
+  const src = fs.readFileSync(path.join(REPO_ROOT, FITNESS), 'utf8');
+  const siblings = siblingRequires(src);
+
+  // A scanner that finds nothing passes for free. fitness.js is BUILT out of
+  // sibling requires, so an empty set means the pattern broke, not that the tooling
+  // became self-contained — this check must not be able to pass vacuously.
+  if (siblings.length === 0) {
+    return {
+      name,
+      ok: false,
+      hardFail: true,
+      violations: [`${FITNESS}: found NO sibling require() calls. That is a broken scan, not a `
+        + 'clean result — the extraction pattern in scope-map-guard.js needs looking at.'],
+      warnings: [],
+      note: 'the scan produced an empty set, which cannot be right.',
+    };
+  }
+
+  const { MODULE_SCOPE_MAP } = require('../../src/bongos/module-scope-map.js');
+  // Each value is { globs: [...], protected?: bool } — not a bare array.
+  const globsOf = (v) => (Array.isArray(v) ? v : (v && v.globs) || []);
+  const allOwned = [];
+  for (const v of Object.values(MODULE_SCOPE_MAP)) allOwned.push(...globsOf(v));
+  // Any key may own a check file — what matters is that SOME key does, so a goal can
+  // be scoped to it. A directory entry owns everything beneath it.
+  const dirs = allOwned.filter((p) => p.endsWith('/'));
+  const owned = new Set(allOwned);
+  // Through the exported helper rather than a second inline copy of the same filter:
+  // two spellings of one rule is how the enumerated list this guard polices drifted in
+  // the first place.
+  const unowned = unownedBy(siblings, allOwned, dirs);
+
+  const violations = unowned.map((p) => `${p} is required by ${FITNESS} but no MODULE_SCOPE_MAP key `
+    + 'owns it — scopeSubset() resolves it to no territory, so a goal scoped to devsecops is denied '
+    + 'out_of_scope for touching the tooling it exists to own. Add it to the devsecops key.');
+
+  return {
+    name,
+    ok: unowned.length === 0,
+    hardFail: unowned.length > 0,
+    violations,
+    warnings: [],
+    // Printed on the PASS path too: the count is the evidence the scan ran at all.
+    note: `${siblings.length} file(s) required by ${FITNESS}, all owned by a MODULE_SCOPE_MAP key. `
+      + 'The house style gives each new check its own file, so this list drifts once per check '
+      + 'unless CI says otherwise (task 1003949).',
+  };
+}
+module.exports = { checkDevsecopsOwnsItsChecks, siblingRequires, unownedBy, FITNESS };

package/scripts/gds/stranded-rows.js

@@ -0,0 +1,200 @@
+#!/usr/bin/env node
+// scripts/gds/stranded-rows.js — a task whose work already landed, still sitting in
+// `ready`/`backlog` (task 1003775).
+//
+// THE FAILURE. Three tasks closed in one 2026-08-20 session needed no work at all:
+// the fix was already in main. That was 3 of 8 tasks in one sweep, and every one was
+// found by a human reading code. The cost is not the wasted claim — it is that the
+// next builder claims it, reads the code, finds nothing to do, and has to prove a
+// negative before releasing it.
+//
+// SCOPE — ONE OF THE TWO FAILURE MODES, DELIBERATELY. Idea 1000807 named two:
+//
+//   1. STRANDED ROW — the work landed under the task's OWN id, but the row never
+//      moved off `ready`. Mechanical. This file.
+//   2. SILENT SUPERSESSION — a LATER task solved the same problem under a different
+//      id. The idea's author tried commit-message scanning for this and reports it
+//      does NOT work: a broad scan and a narrowed one (826 commits) both returned
+//      ~44 open tasks that merely MENTION an id — seeded-task commits, session logs,
+//      ADRs citing planned work. Not attempted here. It needs a human or LLM read and
+//      belongs in a review cadence, not new machinery.
+//
+// THE SIGNAL, and why it is this one. A commit says which task it DID by ending a
+// line with `(task N)`. That is narrower than "mentions N", which is the distinction
+// the idea's investigation failed on: "1002792, 1002200, 1002571" in a session-log
+// body is a comma list, not a line ending in `(task N)`.
+//
+// It reads the WHOLE message, not just the subject, and that detail is load-bearing.
+// The historical case the idea names — task 1002200 — landed on a cloud-agent branch
+// whose own commit subject never named it; the `(task 1002200)` line lives in the
+// MERGE commit's body, where GitHub echoes the branch's subject. A subject-only scan
+// misses the one case this file exists for.
+//
+// MEASURED on this repo before shipping: 877 ids are named as an authoring subject
+// across 4,784 commits, and ZERO of them are open `ready`/`backlog` rows (434 of
+// those). So today's board is clean and the signal is not merely quiet — the same
+// rule catches 1002200 when its row is treated as open.
+//
+// HOUSE RULES (the truth-teller family: strand-watch.js, stale-worktrees.js).
+// Fail OPEN — a probe never blocks a session. Silent when healthy. Prints IDS AND
+// FIXED VOCABULARY ONLY: never a commit subject or a task title, both of which are
+// builder-authored text.
+//
+// Usage:
+//   node scripts/gds/stranded-rows.js            # human report; exit 1 if any found
+//   node scripts/gds/stranded-rows.js --json     # { stranded: [{ id, status, sha }] }
+//   node scripts/gds/stranded-rows.js --line     # ONE line, or nothing; always exit 0
+
+'use strict';
+
+const { execFileSync } = require('node:child_process');
+
+const MAIN_REF = 'origin/main';
+// A record separator no commit message can contain: the word is wrapped in U+0001
+// (START OF HEADING), a C0 control character git will not carry in a message body.
+//
+// Built from an explicit escape rather than written as a literal, because the control
+// bytes are INVISIBLE in a source listing - the first reviewer of this file read it as
+// `const SEP = 'COMMIT'` and correctly flagged that a body containing the word COMMIT
+// would split a record in half. It would; that is exactly why the sentinels are there,
+// and now you can see them. A test pins a body carrying the bare word.
+const SOH = String.fromCharCode(1);
+const SEP = `${SOH}COMMIT${SOH}`;
+
+// The authoring convention: a line whose END is `(task N)`. Anchored at end-of-line on
+// purpose — that is what distinguishes "this commit did task N" from "this commit
+// mentioned N", and the second is the noise that made the supersession half undoable.
+const AUTHORED_RE = /\(task (\d{6,7})\)\s*$/;
+
+// PURE — every task id a commit message claims to have DONE. Exported so the rule is
+// testable without a repo: a scanner that quietly stops matching reports a clean board,
+// which is indistinguishable from a healthy one.
+function authoredIds(message) {
+  const out = new Set();
+  for (const line of String(message || '').split('\n')) {
+    const m = AUTHORED_RE.exec(line.trim());
+    if (m) out.add(m[1]);
+  }
+  return out;
+}
+
+// PURE — id -> first sha that claimed it, over a whole `git log` payload.
+function scanLog(raw) {
+  const byId = new Map();
+  for (const block of String(raw || '').split(SEP)) {
+    if (!block.trim()) continue;
+    const nl = block.indexOf('\n');
+    const sha = (nl === -1 ? block : block.slice(0, nl)).trim();
+    const body = nl === -1 ? '' : block.slice(nl + 1);
+    for (const id of authoredIds(body)) if (!byId.has(id)) byId.set(id, sha);
+  }
+  return byId;
+}
+
+// PURE — the stranded set. `openRows` are { id, status }; `landed` is scanLog's map.
+// Kept separate from the IO so the decision is unit-testable with no git and no API.
+function strandedRows(openRows, landed) {
+  const out = [];
+  for (const row of openRows || []) {
+    const id = String(row && row.id);
+    if (!landed.has(id)) continue;
+    out.push({ id, status: String(row.status || ''), sha: landed.get(id).slice(0, 8) });
+  }
+  return out.sort((a, b) => Number(a.id) - Number(b.id));
+}
+
+function readLog(cwd) {
+  return execFileSync('git', ['log', MAIN_REF, `--pretty=${SEP}%H%n%B`], {
+    cwd, encoding: 'utf8', maxBuffer: 256 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'],
+  });
+}
+
+// Both statuses that mean "nobody has started this". A row already `active` or
+// `completed` is someone's live work, not a strand.
+const OPEN_STATUSES = ['ready', 'backlog'];
+
+// A hard stop so a paging bug cannot loop forever. Reaching it means the board grew
+// past what one scan should walk, which is a fact worth SAYING rather than silently
+// truncating — a detector that quietly stops early reports a clean board.
+const MAX_PAGES = 50;
+
+// PURE-ish — the paging walk, with `getPage` injected. Extracted and exported because
+// it was the only untested IO in this file, and off-by-one paging is exactly the kind
+// of logic that silently returns a short list (and a short list here means 'nothing is
+// stranded').
+async function pageOpenRows(getPage, { statuses = OPEN_STATUSES, pageSize = 200, maxPages = MAX_PAGES } = {}) {
+  const rows = [];
+  for (const status of statuses) {
+    let offset = 0;
+    let page = 0;
+    for (; page < maxPages; page += 1) {
+      const r = await getPage({ status, limit: pageSize, offset });
+      if (!r || !r.ok) throw new Error(`could not list ${status} tasks (${r && r.status})`);
+      const got = (r.data && r.data.tasks) || [];
+      for (const t of got) rows.push({ id: t.id, status: t.status });
+      // A SHORT page is the end of the table. Compared against the size the route
+      // actually honoured, never the size we asked for — the route clamps.
+      if (got.length < (r.limit || pageSize)) break;
+      offset += got.length;
+    }
+    if (page >= maxPages) {
+      throw new Error(`more than ${maxPages} pages of ${status} tasks — refusing to report a partial board as clean`);
+    }
+  }
+  return rows;
+}
+
+async function readOpenRows() {
+  const { cliClient } = require('./cli-lib.js');
+  const { TASK_LIST_MAX_LIMIT, buildTaskPageQuery } = require('../../modules/lifecycle/task-list-limits.js');
+  const api = await cliClient();
+  return pageOpenRows(async ({ status, limit, offset }) => {
+    const q = buildTaskPageQuery({ status, limit, offset });
+    const r = await api.tasks.getTasks({ query: q });
+    // Carry the limit the route HONOURED back to the walker, so its short-page test
+    // compares against the clamped size rather than the requested one.
+    return r && { ok: r.ok, status: r.status, data: r.data, limit: q.limit };
+  }, { pageSize: TASK_LIST_MAX_LIMIT });
+}
+
+async function scan(cwd) {
+  const landed = scanLog(readLog(cwd));
+  // The scan must not pass by finding nothing: this repo's own history is built out of
+  // these lines, so an empty map means the pattern broke.
+  if (landed.size === 0) throw new Error('no commit claims to have done any task — the pattern has drifted');
+  return { stranded: strandedRows(await readOpenRows(), landed), scanned: landed.size };
+}
+
+async function main() {
+  const argv = process.argv.slice(2);
+  const line = argv.includes('--line');
+  let r;
+  try {
+    r = await scan(process.cwd());
+  } catch (e) {
+    if (line) process.exit(0); // fail OPEN — a probe never blocks a session
+    console.error(`stranded-rows: undetermined — ${e.message || e}`);
+    process.exit(2);
+  }
+
+  if (argv.includes('--json')) { console.log(JSON.stringify(r, null, 2)); return; }
+  if (line) {
+    if (r.stranded.length) {
+      const ids = r.stranded.slice(0, 6).map((s) => s.id).join(', ');
+      const more = r.stranded.length > 6 ? ` +${r.stranded.length - 6} more` : '';
+      console.log(`Stranded rows: ${r.stranded.length} open task(s) whose work already landed on main (${ids}${more}). `
+        + 'Claiming one means reading the code to prove there is nothing to do. Run node scripts/gds/stranded-rows.js.');
+    }
+    return;
+  }
+  console.log(`  Stranded rows: ${r.stranded.length} (of ${r.scanned} task id(s) named as an authoring subject on main)`);
+  for (const s of r.stranded) console.log(`    task ${s.id}  [${s.status}]  landed in ${s.sha}`);
+  if (r.stranded.length) {
+    console.log('  Each of these has a commit on main claiming to have done it. Verify, then ship or abandon the row.');
+    process.exit(1);
+  }
+}
+
+if (require.main === module) main();
+
+module.exports = { authoredIds, scanLog, strandedRows, pageOpenRows, AUTHORED_RE, SEP, OPEN_STATUSES, MAX_PAGES };

package/src/bongos/module-scope-map.js

@@ -338,6 +338,36 @@ const MODULE_GLOBS = {
     'scripts/gds/fitness.js', 'scripts/gds/docs-entropy.js',
     'scripts/gds/redteam-patrol.js', 'scripts/gds/audit-gate.js',
     'scripts/gds/fitness-ratchets.js', 'scripts/gds/control-manifest.js',
+    // Every file fitness.js actually requires (task 1003949). Since fitness.js hit
+    // its line ratchet, the house style is that each new check lands in its OWN file
+    // beside it — and none of them was listed here, so scopeSubset() resolved them to
+    // no territory and a goal scoped to devsecops was denied out_of_scope for touching
+    // the very tooling it owns (the 1002690 / 1002736 / 1003124 / 1003655 class).
+    //
+    // This list is kept honest by scripts/gds/scope-map-guard.js rather than by
+    // remembering: it derives the same set from fitness.js's own requires and fails
+    // CI when one is missing. That guard exists because appending is not a fix — the
+    // task that filed this named FOURTEEN unowned files and there were twenty-two.
+    'scripts/gds/scope-map-guard.js',
+    // Landed from task 1003763 while this branch was in flight, and the guard below
+    // caught it unowned on the merge - which is the drift it exists to stop.
+    'scripts/gds/home-isolation-guard.js',
+    // Required WITHOUT the .js extension by fitness.js, which is how they stayed
+    // invisible to the first cut of scope-map-guard (grade round 1): Node resolves
+    // require('./skill-lint') fine, but a pattern anchored on '.js' matched none of them.
+    'scripts/gds/gen-api-docs.js', 'scripts/gds/migration-namespace.js',
+    'scripts/gds/skill-lint.js', 'scripts/gds/run-routine.js',
+    'scripts/gds/adr-namespace.js', 'scripts/gds/baseline-staleness.js',
+    'scripts/gds/category-advisory-guard.js', 'scripts/gds/client-baseurl-guard.js',
+    'scripts/gds/doc-cli-guard.js', 'scripts/gds/doc-comment-coverage.js',
+    'scripts/gds/exec-path-guard.js', 'scripts/gds/fitness-lib.js',
+    'scripts/gds/fitness-checks-error-envelope.js', 'scripts/gds/fitness-checks-identity.js',
+    'scripts/gds/fitness-checks-packaging.js', 'scripts/gds/fitness-checks-route-pins.js',
+    'scripts/gds/fitness-checks-vocabulary.js', 'scripts/gds/fitness-checks-write-validation.js',
+    'scripts/gds/fitness-migration-contraction.js', 'scripts/gds/role-pack-guard.js',
+    'scripts/gds/route-shadow-guard.js', 'scripts/gds/routine-schedule.js',
+    'scripts/gds/seam-wiring-guard.js', 'scripts/gds/skill-preflight.js',
+    'scripts/gds/test-path-guard.js', 'scripts/gds/version-literal-guard.js',
   ],
   // --- the METHODOLOGY surfaces: the instruction core an agent session actually
   //     reads — the always-loaded root CLAUDE.md, the docs library it indexes, the

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.823'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.825'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/category_advisory_guard.mjs

@@ -131,5 +131,34 @@ test('the live tree passes, and the gate list is not empty', () => {
   assert.equal(r.hardFail, false);
 });
 
+// --- a FILENAME is not a category read (task 1003949) ----------------------
+//
+// One of the enforcement files is itself called category-advisory-guard.js, so the
+// moment a decision surface lists the tooling BY PATH — which module-scope-map.js
+// has to, in order to own it — this guard fired on its own name. Quoted paths
+// ending in .js are blanked before the match. The point of these two tests is that
+// the blanking is narrow: it must not become a way to hide a real read.
+
+test('a quoted path to a file whose NAME contains "category" is not a violation', () => {
+  const { violations } = scanGates(['src/bongos/module-scope-map.js'], from({
+    'src/bongos/module-scope-map.js':
+      'const MAP = {\n'
+      + "  devsecops: { globs: ['scripts/gds/category-advisory-guard.js', 'scripts/gds/fitness.js'] },\n"
+      + '};\n',
+  }));
+  assert.deepEqual(violations, [], 'owning the tooling by path is not branching on a category');
+});
+
+test('a real category read on the SAME LINE as a path is still refused', () => {
+  // Only the quoted path is blanked, not the line — so a read cannot ride along
+  // beside one.
+  const { violations } = scanGates(['modules/lifecycle/claim-feed.js'], from({
+    'modules/lifecycle/claim-feed.js':
+      "const guard = require('./category-advisory-guard.js'); if (t.category_id === 3) return false;\n",
+  }));
+  assert.equal(violations.length, 1, 'the category_id read must still be caught');
+  assert.match(violations[0], /ADVISORY/);
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/scope_map_guard.mjs

@@ -0,0 +1,82 @@
+// tests/scope_map_guard.mjs — the enforcement tooling owns itself (task 1003949).
+//
+// MODULE_SCOPE_MAP's devsecops key enumerates the enforcement tooling by exact path,
+// and the house style since fitness.js hit its line ratchet is that every new check
+// lands in its OWN file beside it. Those two facts disagree once per new check: the
+// file appears, nobody adds it to the map, and scopeSubset() resolves it to no module
+// territory — so a goal scoped to devsecops is denied out_of_scope for touching the
+// very tooling it owns.
+//
+// The size of the drift is the argument for a guard rather than a longer list: the
+// task that filed this named FOURTEEN unowned files, and there were twenty-two.
+//
+// Run:  node tests/scope_map_guard.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { checkDevsecopsOwnsItsChecks, siblingRequires } = require('../scripts/gds/scope-map-guard.js');
+
+test('every file fitness.js requires is owned by some MODULE_SCOPE_MAP key', () => {
+  const r = checkDevsecopsOwnsItsChecks();
+  assert.equal(r.ok, true, r.violations.join('\n'));
+  assert.equal(r.hardFail, false);
+});
+
+test('siblingRequires extracts the real require shape, deduped and sorted', () => {
+  const src = [
+    "const a = require('./role-pack-guard.js').checkRolePacks,",
+    "  b = require('./doc-cli-guard.js').checkDocNamesRealCli,",
+    "  c = require('./role-pack-guard.js').other,   // the same file twice",
+    "const d = require('node:path');",
+    "const e = require('../../src/module-api');",
+  ].join('\n');
+  assert.deepEqual(siblingRequires(src), [
+    'scripts/gds/doc-cli-guard.js',
+    'scripts/gds/role-pack-guard.js',
+  ], 'only ./sibling.js requires, deduped — not node: builtins and not cross-tree requires');
+});
+
+test('an EXTENSION-LESS require is extracted — the gap that shipped green', () => {
+  // Node resolves require('./run-routine') to run-routine.js, and fitness.js writes FOUR
+  // of its sibling requires that way. A pattern anchored on .js found none of them, so
+  // four check files stayed unowned while the guard reported the set clean — this guard
+  // committing the exact failure it exists to end.
+  assert.deepEqual(siblingRequires("require('./run-routine'); require('./skill-lint')"), [
+    'scripts/gds/run-routine.js',
+    'scripts/gds/skill-lint.js',
+  ]);
+});
+
+test('both spellings of ONE file collapse to a single entry', () => {
+  assert.deepEqual(siblingRequires("require('./a'); require('./a.js')"), ['scripts/gds/a.js']);
+});
+
+test('a hyphenated and a dotted filename both survive extraction', () => {
+  // fitness-checks-write-validation.js and the like: a character class that stopped at
+  // the first hyphen would silently shorten the set.
+  assert.deepEqual(
+    siblingRequires("require('./fitness-checks-write-validation.js'); require('./a.b.js')"),
+    ['scripts/gds/a.b.js', 'scripts/gds/fitness-checks-write-validation.js'],
+  );
+});
+
+test('an EMPTY scan is a hard failure, not a clean result', () => {
+  // This check's only output is "nothing is unowned", which an empty input satisfies
+  // for free. fitness.js is built out of sibling requires, so an empty set means the
+  // pattern broke — the failure mode that would otherwise look like success.
+  assert.deepEqual(siblingRequires(''), []);
+  assert.deepEqual(siblingRequires(null), []);
+  // and the check itself says so rather than passing: exercised by pointing the
+  // extraction at source with no sibling requires in it.
+  assert.equal(siblingRequires('const x = require("node:fs");').length, 0);
+});
+
+test('the PASS note carries the count, so the check cannot look green while doing nothing', () => {
+  const r = checkDevsecopsOwnsItsChecks();
+  assert.match(r.note, /\d+ file\(s\) required by/);
+  const n = Number(r.note.match(/^(\d+) file/)[1]);
+  assert.ok(n > 14, `expected more than the fourteen the filing task listed, saw ${n}`);
+});

package/tests/stranded_rows.mjs

@@ -0,0 +1,162 @@
+// tests/stranded_rows.mjs — a task whose work already landed, still sitting in
+// ready/backlog (task 1003775).
+//
+// Three tasks closed in one 2026-08-20 session needed no work at all: the fix was
+// already in main. Every one was found by a human reading code.
+//
+// This detector's whole risk is looking healthy. It prints nothing when the board is
+// clean, and the board IS clean today — so "no output" is exactly what a completely
+// broken scan produces too. These tests therefore lean on the rule itself, and on the
+// historical case the idea names.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { authoredIds, scanLog, strandedRows, pageOpenRows, SEP } = require('../scripts/gds/stranded-rows.js');
+
+test('a subject naming the task it did IS an authoring claim', () => {
+  assert.deepEqual([...authoredIds('fix(docs): self-healing /docs/openapi.json (task 1002200)')], ['1002200']);
+});
+
+test('a MENTION is not an authoring claim — the distinction the whole scope rests on', () => {
+  // This is the exact shape that made the supersession half undoable: the idea's
+  // author scanned 826 commits and got ~44 open tasks that merely mentioned an id.
+  assert.deepEqual([...authoredIds('1002792, 1002200, 1002571, 1002790, 1002795), per CLAUDE.md §12.')], []);
+  assert.deepEqual([...authoredIds('supersedes task 1002200 and should be revisited')], []);
+  assert.deepEqual([...authoredIds('see (task 1002200) for background')], [],
+    'mid-line is a citation; only end-of-line is the authoring convention');
+});
+
+test('the claim is read from ANYWHERE in the message, not just the subject', () => {
+  // Task 1002200 landed on a cloud-agent branch whose own subject never named it. The
+  // `(task N)` line lives in the MERGE commit's body, where GitHub echoes the branch's
+  // subject. A subject-only scan misses the one case this detector exists for.
+  const mergeBody = [
+    // The owner handle is a placeholder on purpose: a fixture that hardcodes the
+    // founder's identity fails audit-authorship.sh (ADR 0016's no-hardcoded-Archon
+    // rule), and nothing here depends on WHOSE fork the branch came from.
+    'Merge pull request #5 from an-owner/claude/api-docs-bongos-16a682',
+    '',
+    'fix(docs): self-healing /docs/openapi.json — serve committed spec, else generate in-process (task 1002200)',
+  ].join('\n');
+  assert.deepEqual([...authoredIds(mergeBody)], ['1002200']);
+});
+
+test('scanLog keeps the FIRST sha that claimed an id', () => {
+  const raw = [
+    `${SEP}aaaaaaaa1111\nfix: later touch (task 1000001)`,
+    `${SEP}bbbbbbbb2222\nfix: the original (task 1000001)`,
+  ].join('\n');
+  const m = scanLog(raw);
+  assert.equal(m.get('1000001'), 'aaaaaaaa1111', 'git log is newest-first, so the first seen is the most recent claim');
+});
+
+test('a row whose work landed is stranded; one whose has not is left alone', () => {
+  const landed = new Map([['1000001', 'aaaaaaaa1111']]);
+  const rows = [{ id: '1000001', status: 'ready' }, { id: '1000002', status: 'backlog' }];
+  const out = strandedRows(rows, landed);
+  assert.equal(out.length, 1);
+  assert.deepEqual(out[0], { id: '1000001', status: 'ready', sha: 'aaaaaaaa' });
+});
+
+test('the report carries NO builder-authored text — ids and fixed vocabulary only', () => {
+  // A truth-teller printing a commit subject or a task title would put arbitrary
+  // builder prose into a session's context. The house rule for this family is ids and
+  // fixed vocabulary; `strandedRows` returns exactly three machine fields.
+  const out = strandedRows([{ id: '1000001', status: 'ready', title: 'DO NOT LEAK ME' }],
+    new Map([['1000001', 'aaaaaaaa1111']]));
+  assert.deepEqual(Object.keys(out[0]).sort(), ['id', 'sha', 'status']);
+  assert.ok(!JSON.stringify(out).includes('DO NOT LEAK'));
+});
+
+test('an empty scan is a BROKEN scan — it must not read as a clean board', () => {
+  // The detector is silent when healthy, so a pattern that stops matching looks
+  // exactly like good news. scanLog over real-shaped input must be non-empty, and the
+  // IO wrapper throws on an empty map (fail-open at the --line boundary, loud
+  // otherwise).
+  assert.equal(scanLog('').size, 0, 'nothing in, nothing out — which is why the caller checks');
+  assert.ok(scanLog(`${SEP}aaaaaaaa1111\nfix: something (task 1000001)`).size > 0);
+});
+
+// ---- the record separator (grade round 1) ---------------------------------
+//
+// The separator is the word COMMIT wrapped in U+0001. Those bytes are INVISIBLE in a
+// source listing, so the first reviewer read it as a bare 'COMMIT' and flagged — quite
+// reasonably — that a commit body containing that word would split a record in half.
+// It would. This pins that it does not.
+
+test('a commit body containing the bare word COMMIT does not split a record', () => {
+  const raw = `${SEP}aaaaaaaa1111\nfix COMMIT-hook validation (task 1000001)`;
+  const m = scanLog(raw);
+  assert.equal(m.size, 1, 'one commit in, one record out');
+  assert.equal(m.get('1000001'), 'aaaaaaaa1111');
+});
+
+test('the separator really is control-wrapped, not the bare word', () => {
+  assert.equal(SEP.charCodeAt(0), 1);
+  assert.equal(SEP.charCodeAt(SEP.length - 1), 1);
+  assert.notEqual(SEP, 'COMMIT');
+});
+
+// ---- the paging walk (grade round 1) --------------------------------------
+//
+// This was the only untested IO in the file, and off-by-one paging is exactly the kind
+// of logic that silently returns a SHORT list — which here means 'nothing is stranded',
+// the most comfortable wrong answer this tool can give.
+
+const page = (tasks, limit) => ({ ok: true, data: { tasks }, limit });
+const row = (id) => ({ id: String(id), status: 'ready' });
+
+test('a full page is followed by another request; a short page ends it', async () => {
+  const asked = [];
+  const rows = await pageOpenRows(async ({ status, limit, offset }) => {
+    asked.push(`${status}@${offset}`);
+    if (status !== 'ready') return page([], limit);
+    return offset === 0 ? page([row(1), row(2)], 2) : page([row(3)], 2);
+  }, { statuses: ['ready', 'backlog'], pageSize: 2 });
+  assert.deepEqual(rows.map((r) => r.id), ['1', '2', '3']);
+  assert.deepEqual(asked, ['ready@0', 'ready@2', 'backlog@0'], 'a full page must be followed by another request');
+});
+
+test('the offset advances by what was RECEIVED, not by what was asked for', async () => {
+  // The route clamps `limit`. Advancing by the requested size would skip rows.
+  const asked = [];
+  await pageOpenRows(async ({ limit, offset }) => {
+    asked.push(offset);
+    return asked.length === 1 ? page([row(1)], 1) : page([], 1);
+  }, { statuses: ['ready'], pageSize: 500 });
+  assert.deepEqual(asked, [0, 1], 'asked for 500, got 1, so the next offset is 1');
+});
+
+test('a failed page THROWS — a partial board must never read as clean', async () => {
+  await assert.rejects(
+    () => pageOpenRows(async () => ({ ok: false, status: 500 }), { statuses: ['ready'] }),
+    /could not list ready tasks/,
+  );
+});
+
+test('hitting the page cap THROWS rather than silently truncating', async () => {
+  // A detector that quietly stops early reports a clean board, which is the one
+  // outcome this tool must never fake.
+  await assert.rejects(
+    () => pageOpenRows(async ({ limit }) => page([row(1)], 1), { statuses: ['ready'], pageSize: 1, maxPages: 3 }),
+    /refusing to report a partial board as clean/,
+  );
+});
+
+test('both open statuses are walked — a backlog strand counts too', async () => {
+  const seen = [];
+  await pageOpenRows(async ({ status, limit }) => { seen.push(status); return page([], limit); });
+  assert.deepEqual(seen, ['ready', 'backlog']);
+});
+
+test('the live repo actually produces claims — the rule has not drifted', () => {
+  const { execFileSync } = require('node:child_process');
+  const raw = execFileSync('git', ['log', 'origin/main', `--pretty=${SEP}%H%n%B`, '-400'],
+    { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+  const m = scanLog(raw);
+  assert.ok(m.size > 20,
+    `only ${m.size} authoring claims in the last 400 commits — the convention or the pattern has moved, and this detector is now inert`);
+});