@bongos/core 1.19.836 → 1.19.838

package/tests/agents_event_router.mjs

@@ -0,0 +1,523 @@
+// tests/agents_event_router.mjs — the event-router poller (task 1002494).
+//
+// Everything is dependency-injected — a fake pool, a fake matcher, a fake sink,
+// a fake runner. No database, no model call, no server. What is proven here are
+// the four properties the router's header claims, and each test is written so it
+// REDS if the property is removed:
+//
+//   1. the touches[] pre-filter runs BEFORE any spawn, and a miss costs nothing
+//   2. the depth guard refuses a ship attributed to an agent run, fail-closed
+//   3. an unwired/unavailable sink refuses BEFORE the spawn, not after
+//   4. nothing the router does can block, slow or fail the ship it reacted to
+//
+// Run:  node tests/agents_event_router.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const router = require('../modules/agents/pollers/event-router.js');
+const {
+  fanOut, onShipped, matchesTouches, selectFiring, depthRefsFor,
+  sinkNameFor, resolveSink, declaredGlobs, EVENT, SINK_CATALOG, DEFAULT_SINK,
+} = router;
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.stack || err.message}`); }
+}
+
+// A stand-in for permissionPathCheck.compileGlobMatcher. It splits on `**`
+// rather than substituting a sentinel character: the sentinel this originally
+// used was a literal NUL, which made the whole test file a binary blob git
+// would not render as a diff — invisible locally, and caught only in review.
+const compile = (globs) => (file) => globs.some((g) => {
+  if (g.endsWith('/')) return file.startsWith(g);
+  const src = g.split('**')
+    .map((seg) => seg.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '[^/]*'))
+    .join('.*');
+  return new RegExp('^' + src + '$').test(file);
+});
+
+function def(over = {}) {
+  return {
+    id: 1, name: 'review-lens', title: null, persona: 'observe and report',
+    trigger_type: 'event', trigger_spec: { event: EVENT }, model_tier: 'default',
+    scope_violation: null, enabled: true, ...over,
+  };
+}
+
+// A pool that answers the router's three reads by SHAPE and records every
+// statement, so the ledger can be asserted on directly (tests/agents_spawn.mjs
+// idiom). `defs`, `task` and `attributedRuns` are what the reads return.
+function fakePool({ defs = [], task = null, attributedRuns = [], spent = '0', throwOn = null } = {}) {
+  const calls = [];
+  let nextRunId = 100;
+  return {
+    calls,
+    async query(sql, params) {
+      calls.push({ sql, params });
+      if (throwOn && throwOn.test(sql)) throw new Error('boom');
+      if (/FROM agents_definitions/.test(sql)) return { rows: defs };
+      if (/FROM tasks/.test(sql)) return { rows: task ? [task] : [] };
+      if (/FROM agents_runs\n\s*WHERE output_ref/.test(sql) || /output_ref = ANY/.test(sql)) return { rows: attributedRuns };
+      if (/SUM\(cost_usd\)/.test(sql)) return { rows: [{ spent }] };
+      if (/^INSERT INTO agents_runs/.test(sql)) return { rows: [{ id: nextRunId++ }] };
+      return { rows: [] };
+    },
+    ledgered() {
+      return calls.filter((c) => /^INSERT INTO agents_runs/.test(c.sql)).map((c) => {
+        const cols = c.sql.match(/\(([^)]+)\) VALUES/)[1].split(',').map((s) => s.trim());
+        return Object.fromEntries(cols.map((k, i) => [k, c.params[i]]));
+      });
+    },
+  };
+}
+
+const SINK_OK = { resolveOptional: (port) => (port === 'ideas.capture' ? async () => ({ id: 777 }) : null) };
+
+// ===========================================================================
+// PROPERTY 1 — the cheap filter, first
+// ===========================================================================
+
+await test('NO declared filter fires on every ship — an absent filter is not an empty one', () => {
+  assert.deepEqual(declaredGlobs(def()), []);
+  assert.equal(matchesTouches(def(), ['anything/at/all.js'], compile).match, true);
+  // ...and a task with no touches[] at all still matches an unfiltered agent.
+  assert.equal(matchesTouches(def(), [], compile).match, true);
+});
+
+await test('a declared filter matches only an overlapping touches[]', () => {
+  const d = def({ trigger_spec: { event: EVENT, touches: ['docs/**', 'src/bongos/'] } });
+  assert.equal(matchesTouches(d, ['docs/adr/0001.md'], compile).match, true, '** crosses separators');
+  assert.equal(matchesTouches(d, ['src/bongos/db.js'], compile).match, true, 'a trailing / is a subtree');
+  assert.equal(matchesTouches(d, ['modules/agents/spawn.js'], compile).match, false);
+  // One hit anywhere in touches[] is enough — a ship is relevant if ANY of what
+  // it touched is in scope.
+  assert.equal(matchesTouches(d, ['modules/x.js', 'docs/readme.md'], compile).match, true);
+});
+
+await test('a DECLARED filter against an EMPTY touches[] does NOT fire — no evidence must not read as go', () => {
+  const d = def({ trigger_spec: { event: EVENT, touches: ['docs/**'] } });
+  const v = matchesTouches(d, [], compile);
+  assert.equal(v.match, false);
+  assert.equal(v.reason, 'task_declared_no_touches');
+  assert.equal(matchesTouches(d, null, compile).match, false, 'a null touches[] is the same absence');
+});
+
+await test('a MALFORMED filter widens to "no filter", never narrows to "matches nothing"', () => {
+  // Narrowing would disarm an armed agent with nothing recording why.
+  for (const bad of ['docs/**', 42, {}, null, [], ['', '  ']]) {
+    assert.equal(matchesTouches(def({ trigger_spec: { event: EVENT, touches: bad } }), ['x.js'], compile).match,
+      true, `touches: ${JSON.stringify(bad)} must not silently disarm the agent`);
+  }
+});
+
+await test('an UNCOMPILABLE filter refuses the fire rather than matching everything', () => {
+  const d = def({ trigger_spec: { event: EVENT, touches: ['docs/**'] } });
+  const v = matchesTouches(d, ['docs/x.md'], () => { throw new Error('bad glob'); });
+  assert.equal(v.match, false);
+  assert.equal(v.reason, 'filter_uncompilable');
+});
+
+await test('selectFiring splits the roster and never loses a definition', () => {
+  const defs = [
+    def({ id: 1, name: 'a', trigger_spec: { event: EVENT, touches: ['docs/**'] } }),
+    def({ id: 2, name: 'b', trigger_spec: { event: EVENT, touches: ['infra/**'] } }),
+    def({ id: 3, name: 'c' }),
+  ];
+  const { firing, filtered } = selectFiring(defs, ['docs/a.md'], compile);
+  assert.deepEqual(firing.map((f) => f.definition.name), ['a', 'c']);
+  assert.deepEqual(filtered.map((f) => f.definition.name), ['b']);
+  assert.equal(firing.length + filtered.length, defs.length);
+});
+
+await test('a PRE-FILTER MISS spawns nothing AND ledgers nothing — the fire never happened', async () => {
+  let spawned = 0;
+  const pool = fakePool({
+    defs: [def({ trigger_spec: { event: EVENT, touches: ['infra/**'] } })],
+    task: { id: '9', title: 'T', touches: ['docs/a.md'], source: null },
+  });
+  const report = await fanOut({ id: '9' }, {
+    pool, compileGlobMatcher: compile, spendPayer: null, ...SINK_OK,
+    runSubagentCached: async () => { spawned++; return { stdout: 'x' }; },
+  });
+  assert.equal(spawned, 0, 'the cheap filter must run BEFORE any spawn');
+  assert.equal(report.fired, 0);
+  assert.equal(report.filtered, 1);
+  assert.equal(report.reason, 'no_agent_matched_touches');
+  assert.deepEqual(pool.ledgered(), [], 'selection is not refusal — a miss writes no ledger row');
+});
+
+await test('with NOTHING armed the router reads no task row and writes nothing', async () => {
+  const pool = fakePool({ defs: [] });
+  const report = await fanOut({ id: '9' }, { pool, compileGlobMatcher: compile, spendPayer: null, ...SINK_OK });
+  assert.equal(report.reason, 'no_armed_event_agents');
+  assert.equal(pool.calls.filter((c) => /FROM tasks/.test(c.sql)).length, 0,
+    'the definition read is first and cheapest; a quiet instance must not pay for a task read');
+});
+
+// ===========================================================================
+// PROPERTY 2 — the depth guard
+// ===========================================================================
+
+await test('depthRefsFor covers BOTH hops: a direct task pointer and a promoted idea', () => {
+  assert.deepEqual(depthRefsFor({ id: '55', source: null }), ['task:55']);
+  assert.deepEqual(depthRefsFor({ id: '55', source: 'idea-1000527' }), ['task:55', 'idea:1000527']);
+  // A source that is not an idea promotion contributes no idea ref.
+  assert.deepEqual(depthRefsFor({ id: '55', source: 'discord' }), ['task:55']);
+  assert.deepEqual(depthRefsFor({}), [], 'an unidentifiable task yields no refs');
+});
+
+await test('a ship ATTRIBUTED to an agent run fires nothing, and the refusal IS ledgered', async () => {
+  let spawned = 0;
+  const pool = fakePool({
+    defs: [def()],
+    task: { id: '9', title: 'T', touches: ['docs/a.md'], source: 'idea-1000527' },
+    attributedRuns: [{ id: '42', agent_name: 'review-lens' }],
+  });
+  const report = await fanOut({ id: '9' }, {
+    pool, compileGlobMatcher: compile, spendPayer: null, ...SINK_OK,
+    runSubagentCached: async () => { spawned++; return { stdout: 'x' }; },
+  });
+  assert.equal(spawned, 0, 'agents must not trigger each other forever');
+  assert.equal(report.reason, 'depth_guard');
+  const rows = pool.ledgered();
+  assert.equal(rows.length, 1, 'a loop guard that leaves no trace is invisible');
+  assert.equal(rows[0].gate_decision, 'no-go');
+  assert.equal(rows[0].status, 'skipped');
+  assert.match(String(rows[0].gate_reason), /attributed to agent run 42/);
+});
+
+await test('the depth guard FAILS CLOSED on an unreadable ledger', async () => {
+  const thrower = { query: async () => { throw new Error('db down'); } };
+  const v = await router.isAgentAttributed(thrower, { id: '9' });
+  assert.equal(v.attributed, true, '"I could not check for a loop" must never read as "no loop"');
+  assert.match(v.reason, /threw/);
+
+  assert.equal((await router.isAgentAttributed(null, { id: '9' })).attributed, true, 'no pool ⇒ no fire');
+  assert.equal((await router.isAgentAttributed({ query: async () => ({ rows: [] }) }, {})).attributed, true,
+    'an unidentifiable task ⇒ no fire');
+});
+
+await test('an UNREADABLE task row refuses every armed agent rather than firing blind', async () => {
+  let spawned = 0;
+  const pool = fakePool({ defs: [def({ id: 1, name: 'a' }), def({ id: 2, name: 'b' })], task: null });
+  const report = await fanOut({ id: '9' }, {
+    pool, compileGlobMatcher: compile, spendPayer: null, ...SINK_OK,
+    runSubagentCached: async () => { spawned++; return { stdout: 'x' }; },
+  });
+  assert.equal(spawned, 0, 'with no touches[] the pre-filter cannot run, so nothing may fire');
+  assert.equal(report.reason, 'task_unreadable');
+  assert.equal(pool.ledgered().length, 2, 'these fires WOULD have happened — refusing them is a refusal');
+});
+
+// ===========================================================================
+// PROPERTY 3 — the sink, checked before the spawn
+// ===========================================================================
+
+await test('the sink catalog is the WIRED set — every entry has a port behind it', () => {
+  assert.deepEqual(Object.keys(SINK_CATALOG).sort(), ['discord', 'ideas.capture']);
+  assert.equal(DEFAULT_SINK, 'ideas.capture');
+  assert.equal(sinkNameFor(def()), 'ideas.capture', 'an absent sink defaults rather than leaving a finding homeless');
+  assert.equal(sinkNameFor(def({ trigger_spec: { event: EVENT, sink: 'discord' } })), 'discord');
+  // A name nothing delivers to is refused, not stored — the EVENT_CATALOG rule.
+  const v = resolveSink(def({ trigger_spec: { event: EVENT, sink: 'carrier-pigeon' } }), SINK_OK);
+  assert.equal(v.ok, false);
+  assert.match(v.reason, /not wired/);
+});
+
+await test('an UNAVAILABLE port refuses too — wired is not the same as present', () => {
+  const v = resolveSink(def(), { resolveOptional: () => null });
+  assert.equal(v.ok, false);
+  assert.match(v.reason, /port is not available/);
+});
+
+await test('an unwired sink refuses BEFORE the model runs, and is ledgered', async () => {
+  let spawned = 0;
+  const pool = fakePool({
+    defs: [def({ trigger_spec: { event: EVENT, sink: 'carrier-pigeon' } })],
+    task: { id: '9', title: 'T', touches: ['docs/a.md'], source: null },
+  });
+  const report = await fanOut({ id: '9' }, {
+    pool, compileGlobMatcher: compile, spendPayer: null, ...SINK_OK,
+    runSubagentCached: async () => { spawned++; return { stdout: 'x' }; },
+  });
+  assert.equal(spawned, 0, 'a finding nobody receives is money spent for nothing');
+  assert.equal(report.reason, 'no_deliverable_sink');
+  assert.match(String(pool.ledgered()[0].gate_reason), /not wired/);
+});
+
+// ===========================================================================
+// THE HAPPY PATH, AND WHAT IT WRITES
+// ===========================================================================
+
+await test('a matching ship fires, files the finding, and records the POINTER on the run', async () => {
+  const filed = [];
+  const pool = fakePool({
+    defs: [def({ trigger_spec: { event: EVENT, touches: ['docs/**'] } })],
+    task: { id: '9', title: 'Ship the docs', touches: ['docs/a.md'], source: null },
+  });
+  const report = await fanOut({ id: '9' }, {
+    pool,
+    compileGlobMatcher: compile,
+    spendPayer: null,
+    resolveOptional: (port) => (port === 'ideas.capture'
+      ? async (arg) => { filed.push(arg); return { id: 777 }; }
+      : null),
+    runSubagentCached: async () => ({ stdout: 'the copy on line 3 reads oddly', cost_usd: 0.9 }),
+  });
+  assert.equal(report.fired, 1);
+  assert.equal(filed.length, 1, 'the finding reaches its declared sink');
+  assert.match(filed[0].title, /^review-lens: Ship the docs/);
+  assert.match(filed[0].bodyMd, /the copy on line 3 reads oddly/);
+  assert.equal(filed[0].capturedBy, null);
+  assert.equal(filed[0].vector, undefined,
+    'NO vector: an agent may report, and may not manufacture claimable work');
+
+  const insert = pool.ledgered()[0];
+  assert.equal(insert.gate_decision, 'go');
+  assert.equal(insert.trigger_type, 'event');
+  assert.equal(insert.trigger_ref, `${EVENT}:9`);
+  assert.equal(insert.requested_by_builder_id, null);
+  assert.equal(insert.payer_kind, 'project', 'an event fire has no caller, so the project pays');
+
+  const update = pool.calls.find((c) => /^UPDATE agents_runs/.test(c.sql));
+  assert.ok(update, 'the run is finished, not left pending');
+  assert.ok(update.params.includes('idea:777'),
+    'the output_ref pointer must land on the SAME update that records the cost');
+});
+
+await test('a fire with NOTHING to say is a success with no pointer, not a failure', async () => {
+  let filedCount = 0;
+  const pool = fakePool({
+    defs: [def()],
+    task: { id: '9', title: 'T', touches: ['docs/a.md'], source: null },
+  });
+  const report = await fanOut({ id: '9' }, {
+    pool,
+    compileGlobMatcher: compile,
+    spendPayer: null,
+    resolveOptional: (port) => (port === 'ideas.capture' ? async () => { filedCount++; return { id: 1 }; } : null),
+    runSubagentCached: async () => ({ stdout: '   \n  ' }),
+  });
+  assert.equal(report.fired, 1);
+  assert.equal(filedCount, 0, 'an empty finding must not become an empty inbox row');
+  const update = pool.calls.find((c) => /^UPDATE agents_runs/.test(c.sql));
+  assert.ok(update.params.includes('ok'), 'reporting "nothing here" is the outcome most fires should have');
+});
+
+await test('a fire whose finding could NOT be delivered is an ERROR row, never a quiet ok', async () => {
+  const pool = fakePool({
+    defs: [def()],
+    task: { id: '9', title: 'T', touches: ['docs/a.md'], source: null },
+  });
+  await fanOut({ id: '9' }, {
+    pool,
+    compileGlobMatcher: compile,
+    spendPayer: null,
+    resolveOptional: (port) => (port === 'ideas.capture' ? async () => { throw new Error('inbox down'); } : null),
+    runSubagentCached: async () => ({ stdout: 'a real finding', cost_usd: 0.9 }),
+  });
+  const update = pool.calls.find((c) => /^UPDATE agents_runs/.test(c.sql));
+  assert.ok(update.params.includes('error'),
+    'a finding that evaporated must never look like an agent that found nothing');
+  assert.ok(update.params.includes('sink_delivery_failed'));
+  assert.ok(update.params.includes(0.9), 'the fire still cost money and the ledger still says so');
+});
+
+// ===========================================================================
+// THE SPEND BOUNDS
+// ===========================================================================
+
+await test('the FAN-OUT CAP bounds one event, because no per-builder ceiling can', async () => {
+  const many = Array.from({ length: router.FANOUT_MAX + 2 }, (_, i) => def({ id: i + 1, name: `a${i}` }));
+  const pool = fakePool({ defs: many, task: { id: '9', title: 'T', touches: ['docs/a.md'], source: null } });
+  let spawned = 0;
+  const report = await fanOut({ id: '9' }, {
+    pool, compileGlobMatcher: compile, spendPayer: null, ...SINK_OK,
+    runSubagentCached: async () => { spawned++; return { stdout: '' }; },
+  });
+  assert.equal(spawned, router.FANOUT_MAX, 'an event fire has no builder, so fire-budget cannot bound it');
+  assert.equal(report.fired, router.FANOUT_MAX);
+  assert.equal(report.skipped, 2);
+  const overflow = pool.ledgered().filter((r) => /at most/.test(String(r.gate_reason)));
+  assert.equal(overflow.length, 2, 'the agents the cap dropped are on the record');
+});
+
+await test('an EXHAUSTED or UNREADABLE spend ceiling refuses every fire, ledgered', async () => {
+  for (const [label, ceiling] of [
+    ['exhausted', { check: async () => ({ ok: false, reason: 'spend_cap_reached', capUsd: 25, spentUsd: 25 }) }],
+    ['unreadable', { check: async () => ({ ok: false, reason: 'ledger_unreadable', capUsd: 25, spentUsd: null }) }],
+  ]) {
+    let spawned = 0;
+    const pool = fakePool({ defs: [def()], task: { id: '9', title: 'T', touches: ['docs/a.md'], source: null } });
+    const report = await fanOut({ id: '9' }, {
+      pool, compileGlobMatcher: compile, spendPayer: null, spendCeiling: ceiling, ...SINK_OK,
+      runSubagentCached: async () => { spawned++; return { stdout: 'x' }; },
+    });
+    assert.equal(spawned, 0, `${label}: a ceiling that cannot be read must not be assumed`);
+    assert.equal(report.reason, 'spend_ceiling');
+    assert.equal(pool.ledgered().length, 1, `${label}: the refusal is on the record`);
+  }
+});
+
+// ===========================================================================
+// PROPERTY 4 — it can never block, slow or fail a ship
+// ===========================================================================
+
+await test('the subscribed handler is SYNCHRONOUS — emitAsync must not await a model call', () => {
+  // emitAsync awaits what a listener returns and the ship route awaits the emit,
+  // so a returned promise would hold a shipping builder's request open for the
+  // length of a fire. This is the assertion that keeps that from regressing.
+  const started = Date.now();
+  const r = onShipped({ id: 'no-such-task' });
+  assert.equal(r, undefined, 'the handler must return undefined, never a promise');
+  assert.ok(Date.now() - started < 50, 'the handler must return immediately');
+});
+
+await test('a throwing fan-out never reaches the emitter', async () => {
+  // Every read path is broken at once: the pool throws on everything.
+  const pool = { query: async () => { throw new Error('everything is down'); } };
+  const report = await fanOut({ id: '9' }, { pool, compileGlobMatcher: compile, spendPayer: null, ...SINK_OK });
+  assert.equal(report.reason, 'definitions_unreadable', 'a reactor must never break the actor');
+  assert.equal(report.fired, 0);
+  // ...and the synchronous entry point swallows it too.
+  assert.equal(onShipped({ id: '9' }), undefined);
+});
+
+await test('a payload with no id is a no-op, not a crash', async () => {
+  for (const bad of [null, undefined, {}, { id: null }]) {
+    const report = await fanOut(bad, { pool: fakePool(), compileGlobMatcher: compile, spendPayer: null });
+    assert.equal(report.reason, 'no_task_id');
+  }
+});
+
+await test('start()/stop() subscribe exactly once and unsubscribe cleanly', () => {
+  const seams = require('../src/module-seams.js');
+  const before = seams.listEvents().includes(EVENT);
+  router.start();
+  router.start(); // idempotent — a duplicate listener would double every bill
+  assert.ok(seams.listEvents().includes(EVENT));
+  router.stop();
+  assert.equal(seams.listEvents().includes(EVENT), before,
+    'stop() must leave the seam registry exactly as it found it');
+});
+
+// ===========================================================================
+// THE DISCORD SINK — announce, never file
+// ===========================================================================
+
+const DISCORD_OK = (posts) => ({
+  resolveOptional: (port) => (port === 'discord.post'
+    ? async (arg) => { posts.push(arg); return { posted: true, channel: arg.channel }; }
+    : null),
+});
+
+await test('a discord-sinked finding is ANNOUNCED on #ship-feed and files nothing', async () => {
+  const posts = [];
+  const pool = fakePool({
+    defs: [def({ trigger_spec: { event: EVENT, sink: 'discord' } })],
+    task: { id: '9', title: 'Ship the docs', touches: ['docs/a.md'], source: null, security_sensitive: false },
+  });
+  const report = await fanOut({ id: '9' }, {
+    pool, compileGlobMatcher: compile, spendPayer: null, ...DISCORD_OK(posts),
+    runSubagentCached: async () => ({ stdout: 'the copy on line 3 reads oddly', cost_usd: 0.9 }),
+  });
+  assert.equal(report.fired, 1);
+  assert.equal(posts.length, 1);
+  assert.equal(posts[0].channel, 'ship_feed');
+  assert.match(posts[0].text, /review-lens: Ship the docs/);
+  assert.match(posts[0].text, /the copy on line 3 reads oddly/);
+  const update = pool.calls.find((c) => /^UPDATE agents_runs/.test(c.sql));
+  assert.ok(update.params.includes('discord:ship_feed:9'),
+    'the pointer names where it landed, so the ledger can be walked back');
+});
+
+await test('a finding about a SECURITY-SENSITIVE ship never reaches a public channel', async () => {
+  const posts = [];
+  const pool = fakePool({
+    defs: [def({ trigger_spec: { event: EVENT, sink: 'discord' } })],
+    task: { id: '9', title: 'Patch the hole', touches: ['docs/a.md'], source: null, security_sensitive: true },
+  });
+  await fanOut({ id: '9' }, {
+    pool, compileGlobMatcher: compile, spendPayer: null, ...DISCORD_OK(posts),
+    runSubagentCached: async () => ({ stdout: 'here is how the hole worked' }),
+  });
+  assert.equal(posts[0].channel, 'security_ship_feed',
+    'advertising the shape of an exploit on a channel the guild reads is the one thing this must not do');
+});
+
+await test('an INDETERMINATE security flag SUPPRESSES the post rather than guessing', async () => {
+  for (const flag of [null, undefined, 'yes', 1]) {
+    const posts = [];
+    const pool = fakePool({
+      defs: [def({ trigger_spec: { event: EVENT, sink: 'discord' } })],
+      task: { id: '9', title: 'T', touches: ['docs/a.md'], source: null, security_sensitive: flag },
+    });
+    await fanOut({ id: '9' }, {
+      pool, compileGlobMatcher: compile, spendPayer: null, ...DISCORD_OK(posts),
+      runSubagentCached: async () => ({ stdout: 'a finding' }),
+    });
+    assert.equal(posts.length, 0, `security_sensitive=${flag}: "we could not tell" must not resolve to "post it publicly"`);
+  }
+});
+
+await test('a post the operator never configured is NOT recorded as a pointer', async () => {
+  const pool = fakePool({
+    defs: [def({ trigger_spec: { event: EVENT, sink: 'discord' } })],
+    task: { id: '9', title: 'T', touches: ['docs/a.md'], source: null, security_sensitive: false },
+  });
+  await fanOut({ id: '9' }, {
+    pool,
+    compileGlobMatcher: compile,
+    spendPayer: null,
+    resolveOptional: (port) => (port === 'discord.post'
+      ? async () => ({ posted: false, reason: 'no_webhook_for_channel' })
+      : null),
+    runSubagentCached: async () => ({ stdout: 'a finding' }),
+  });
+  const update = pool.calls.find((c) => /^UPDATE agents_runs/.test(c.sql));
+  assert.ok(!update.params.some((x) => typeof x === 'string' && x.startsWith('discord:')),
+    'a pointer to a message that does not exist is a lie the ledger cannot be talked out of later');
+});
+
+// ===========================================================================
+// WHAT REACHES A SINK IS UNTRUSTED TEXT
+// ===========================================================================
+
+await test('control characters are stripped and the body is bounded before any sink sees it', async () => {
+  const filed = [];
+  const hostile = `a finding${String.fromCharCode(0)}with${String.fromCharCode(27)}[31m escapes`;
+  const pool = fakePool({
+    defs: [def()],
+    task: { id: '9', title: `T${String.fromCharCode(7)}itle`, touches: ['docs/a.md'], source: null },
+  });
+  await fanOut({ id: '9' }, {
+    pool,
+    compileGlobMatcher: compile,
+    spendPayer: null,
+    resolveOptional: (port) => (port === 'ideas.capture'
+      ? async (arg) => { filed.push(arg); return { id: 1 }; }
+      : null),
+    runSubagentCached: async () => ({ stdout: hostile + 'x'.repeat(20000) }),
+  });
+  const sent = JSON.stringify(filed[0]);
+  assert.ok(!sent.includes('\\u0000'), 'a NUL must never reach a rendering surface');
+  assert.ok(!sent.includes('\\u001b'), 'nor an ANSI escape');
+  assert.ok(filed[0].bodyMd.length < 9000, `the body is bounded; got ${filed[0].bodyMd.length}`);
+  assert.ok(filed[0].title.length <= 180, 'and so is the title');
+});
+
+await test('this test file and the router are TEXT — git must be able to diff them', () => {
+  // A literal control byte in the source makes git call the file binary, and a
+  // binary file is one nobody can review. Both files shipped that way once.
+  const fs = require('node:fs');
+  for (const f of ['tests/agents_event_router.mjs', 'modules/agents/pollers/event-router.js']) {
+    assert.equal(fs.readFileSync(f).includes(0), false, `${f} contains a NUL byte`);
+  }
+});
+console.log(`\nagents_event_router: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/hooks_drain.mjs

@@ -20,7 +20,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const HOOKS = ['recall-hints', 'rank-change-greeting', 'conductor', 'pull-memory', 'edit-hints'].map((n) => path.join(ROOT, '.claude', 'hooks', `${n}.js`));
+const HOOKS = ['recall-hints', 'rank-change-greeting', 'conductor', 'pull-memory', 'edit-hints', 'stuck-detector'].map((n) => path.join(ROOT, '.claude', 'hooks', `${n}.js`));
 // The SessionStart/SessionEnd scripts that did network work and then process.exit()ed — 59 recorded
 // UV_HANDLE_CLOSING aborts in three days (task 1003548). Same contract: exit 0 on their own, no abort.
 // session-digest requires `pg` at load (via db-kernel), so it can only be exercised where node_modules

package/tests/host_topology_skips.mjs

@@ -49,6 +49,7 @@ const ALLOWED = {
   'session-cards': '.claude/hooks/session-cards.js (package-excluded)',
   session_start_freshness: '.claude/hooks/session-start.js (package-excluded)',
   stop_refcheck: '.claude/hooks/stop-refcheck.js (package-excluded; the task-1002234 precedent)',
+  stuck_detector: '.claude/hooks/stuck-strikes.js (package-excluded)',
   worktree_guard: '.claude/hooks/worktree-guard.js (package-excluded)',
 };
 

package/tests/provision.mjs

@@ -1219,6 +1219,21 @@ await ta('cmdRunIntents (dry-run) lists the pending queue, runs nothing', async
   assert.equal(r.ran, 0);
 });
 
+await ta('cmdRunIntents opens with the runner core version + path, so a journal grep shows a stale runner (task 1002722)', async () => {
+  for (const apply of [false, true]) {
+    const lines = [];
+    const deps = {
+      apply, log: (l) => lines.push(l), instanceRoot: '/no/such/instance',
+      db: { query: async () => ({ rows: [] }) },
+      provisioning: { claimNextIntent: async () => null, claimNextOAuthManifest: async () => null },
+      exec: () => ({ ok: true }), writeFile: () => ({ ok: true }),
+    };
+    await P.cmdRunIntents(deps);
+    const { REPO_ROOT } = require('../scripts/gds/provision-config.js');
+    assert.equal(lines[0], `runner core ${P.coreVersionSafe()} from ${REPO_ROOT} (no installed core at /no/such/instance)`, `apply=${apply}`);
+  }
+});
+
 await ta('cmdRunIntents (--apply) claims → provisions → resolves the intent done', async () => {
   let claims = 0; const resolved = [];
   const deps = {
@@ -2240,6 +2255,9 @@ await ta('cmdRunIntents (--apply): an UNKNOWN intent action never falls through
   assert.equal(resolved.length, 1);
   assert.equal(resolved[0].state, 'error');
   assert.ok(!cmds.some((c) => /systemctl (stop|disable)/.test(c)), 'no teardown commands ran');
+  // task 1002722 (the refusal itself landed in task 1002692): the error names the action AND
+  // the runner's core, so a stale runner is diagnosable from the intent row alone.
+  assert.equal(resolved[0].err, `unknown_action 'oauth-manifest' — runner core ${P.coreVersionSafe()} does not know it (runner too old?); refusing to guess`);
 });
 
 console.log('\nprovisioning truthfulness (task 1002720 — QA-walk F15/F16/F19):');