@bongos/core 1.19.838 → 1.19.840

package/src/branding.js

@@ -221,7 +221,11 @@ function clientBranding(b = branding()) {
     identity: {
       productName: b.identity?.productName || '',
       worldName: b.identity?.worldName || '',
-      company: { name: b.identity?.company?.name || '' },
+      company: {
+        name: b.identity?.company?.name || '',
+        site: b.identity?.company?.site || '',
+        tagline: b.identity?.company?.tagline || '',
+      },
     },
     currency: {
       label: b.currency?.label || 'credits',
@@ -308,4 +312,20 @@ function clientReward() {
   }
 }
 
-module.exports = { resolveBranding, loadBranding, deepMerge, branding, clientBranding, userAgent, NEUTRAL_PATH, INSTANCE_PATH };
+// Resolve the `<!--brand-if:KEY-->…<!--/brand-if:KEY-->` regions of a served page:
+// kept (markers removed) when `values[KEY]` is non-empty, dropped whole otherwise,
+// so an optional pack field removes its entire clause instead of rendering half a
+// sentence (task 1002853). Lives here, not in serve-internal, because the off-box
+// status mirror stamps the same page without loading the server. Repeats until
+// stable so a region nested inside a kept one resolves too.
+const BRAND_IF_REGION = /<!--brand-if:(\w+)-->([\s\S]*?)<!--\/brand-if:\1-->/g;
+function applyBrandConditionals(html, values) {
+  let out = String(html);
+  for (let prev; prev !== out;) {
+    prev = out;
+    out = out.replace(BRAND_IF_REGION, (_, key, inner) => (values[key] ? inner : ''));
+  }
+  return out;
+}
+
+module.exports = { resolveBranding, loadBranding, deepMerge, branding, clientBranding, userAgent, applyBrandConditionals, NEUTRAL_PATH, INSTANCE_PATH };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.838'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.840'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/bongos_cli.mjs

@@ -65,10 +65,19 @@ test('paste-token is bundled into the standalone binary, like reauth', () => {
 
 test('the server emits exactly the verb the CLI registers', () => {
   const routes = readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'src', 'bongos', 'routes', 'auth.js'), 'utf8');
-  const m = routes.match(/paste_command:\s*`([^`]+)`/);
-  assert.ok(m, 'auth.js should emit a paste_command template literal');
-  const verb = m[1].split(' ')[1];
-  assert.ok(cli.VERBS[verb], `server emits "bongos ${verb}" but the CLI has no such verb`);
+  // Read EVERY branch, not just a literal sitting immediately after the key. Since
+  // task 1003722 paste_command is a ternary (the issuing instance is stamped in when
+  // known), and a matcher anchored on `paste_command:\s*\`` silently stopped matching
+  // at all — reporting "auth.js should emit a paste_command template literal" for a
+  // field that was right there. A test that cannot find what it checks fails as though
+  // the thing were missing, which sends the reader hunting in the wrong file.
+  const tail = routes.slice(routes.indexOf('paste_command:'));
+  const cmds = [...tail.matchAll(/`([^`]*bongos paste-token[^`]*)`/g)].map((x) => x[1]);
+  assert.ok(cmds.length > 0, 'auth.js should emit at least one paste_command template literal');
+  for (const cmd of cmds) {
+    const verb = cmd.split(' ')[1];
+    assert.ok(cli.VERBS[verb], `server emits "bongos ${verb}" but the CLI has no such verb`);
+  }
 });
 
 test('VERBS: selfHelp is only claimed by scripts that really print their own usage', () => {

package/tests/cli_token_reissue.mjs

@@ -115,10 +115,24 @@ t('POST /auth/cli-token/issue is defined', () => {
 const issueBlock = (() => {
   const start = routeSrc.indexOf("'/auth/cli-token/issue'");
   if (start === -1) return '';
-  // crude but enough: take ~3000 chars from the route literal forward.
-  return routeSrc.slice(start, start + 3000);
+  // Bound the window at the NEXT route registration rather than a fixed char count.
+  // A fixed ~3000-char window silently truncates as soon as the handler grows: adding
+  // a comment to this route pushed paste_command out of the slice, and every assertion
+  // about it failed as though the field had been deleted (task 1003722). A byte budget
+  // is not a unit of code, and a scan that can quietly stop seeing what it checks is
+  // the same failure shape as a scan that quietly finds nothing.
+  const next = routeSrc.indexOf('\n  router.', start);
+  return routeSrc.slice(start, next === -1 ? routeSrc.length : next);
 })();
 
+// The window above must actually contain the handler — otherwise every assertion in
+// this file passes or fails for reasons that have nothing to do with the route.
+t('the extracted route window covers the whole handler', () => {
+  assert.ok(issueBlock.includes('sessionCookieToken(req)'), 'window should reach the cookie gate near the top');
+  assert.ok(issueBlock.includes('paste_command'), 'window should reach the response at the bottom');
+  assert.ok(!issueBlock.includes("'/auth/revoke'"), 'window should stop before the next route');
+});
+
 // Refreshed for the current handler (task 1003961). These two assertions named
 // `parseCookie(req, SESSION_COOKIE)` and `res.status(403)`, the shape BEFORE the
 // handler moved to the `sessionCookieToken` helper and the `res.fail` envelope.
@@ -154,15 +168,48 @@ t('returns a paste_command field the portal can show verbatim', () => {
 // instance builder a command naming a file they did not have. A verb has no such
 // coupling — `bongos` is on PATH wherever the core is installed.
 t('paste_command names a CLI VERB, never a filesystem path', () => {
-  const m = issueBlock.match(/paste_command:\s*`([^`]+)`/);
-  assert.ok(m, 'paste_command should be a template literal the test can read');
-  const cmd = m[1];
+  // Read EVERY template literal the field can evaluate to, not just the first. It is a
+  // ternary since task 1003722 (issuer present / absent), and an assertion that saw
+  // only one branch would leave the other unguarded — which is how a rule stops
+  // applying without anyone editing it.
+  const tail = issueBlock.slice(issueBlock.indexOf('paste_command:'));
+  const cmds = [...tail.matchAll(/`([^`]*bongos paste-token[^`]*)`/g)].map((m) => m[1]);
+  assert.equal(cmds.length, 2, `expected both ternary branches, got ${cmds.length}`);
+  for (const cmd of cmds) {
   assert.ok(/^bongos paste-token /.test(cmd),
     `paste_command must start with the verb form, got: ${cmd}`);
-  assert.ok(!cmd.includes('/'),
-    `paste_command must contain no path separator — it runs where the layout differs. Got: ${cmd}`);
+  // The invariant is "names no FILE ON THE RECIPIENT'S DISK", which the original
+  // spelling approximated as "contains no slash". That was too broad once the command
+  // had to carry the issuer URL (task 1003722) — `https://host` is not a filesystem
+  // path, and forbidding every slash would have blocked the fix for a different bug
+  // while protecting nothing extra. Pin what the comment above actually says instead.
+  assert.ok(!/(^|\s)[.~]?\/|\bscripts\b|\.js\b/.test(cmd),
+    `paste_command must name no path or script file — it runs where the layout differs. Got: ${cmd}`);
   assert.ok(!/\bnode\b/.test(cmd),
     `paste_command must not invoke node directly (that assumes a script on disk). Got: ${cmd}`);
+  }
+});
+
+// The bug this pins (task 1003722): a bearer is only valid against the instance that
+// minted it, but paste-token infers its base as env → the EXISTING session's api_base
+// → branding default. On a machine that has used a second instance the stale api_base
+// wins, so a token minted here was bound to the wrong host and every /builder-* command
+// then authenticated somewhere unintended. The issuer cannot be recovered at the other
+// end, so it has to travel with the token.
+t('paste_command carries the issuing instance, so the CLI cannot guess wrong', () => {
+  const m = issueBlock.match(/paste_command:\s*issuer\s*\?\s*`([^`]+)`/);
+  assert.ok(m, 'paste_command should still be a readable template literal');
+  assert.ok(/--api-base \$\{issuer\}/.test(m[1]),
+    `the issuing origin must be stamped into the command, got: ${m[1]}`);
+  assert.ok(/api_base:\s*issuer/.test(issueBlock),
+    'the response should also expose api_base for non-copy-paste consumers');
+});
+
+t('an instance that cannot state its own origin omits the flag rather than sending an empty one', () => {
+  // `--api-base ''` would read at the far end as an explicit instruction and suppress
+  // the fallback that works today — strictly worse than sending no flag at all.
+  assert.ok(/:\s*`bongos paste-token \$\{token\}`/.test(issueBlock),
+    'there must be a flagless branch for the empty-issuer case');
 });
 
 // ---------------------------------------------------------------------------

package/tests/fitness.mjs

@@ -51,6 +51,51 @@ test('CLAUDE.md char/token budget actually fires on within-line bloat (not a no-
   assert.ok(r.violations.some((v) => /char/i.test(v) && /token/i.test(v)), 'the violation must name the char/token budget');
 });
 
+// --- the charter is RELOCATED, not deleted (task 1003687) --------------------
+// The charter body moved to a paths-scoped rule, so the kernel keeps only a heading
+// and a pointer. That makes the heading trivially fakeable: a section with nothing
+// behind it satisfies a substring check while the rules it names are gone. These
+// pin that the check resolves the pointer rather than trusting the heading — a green
+// check over a missing charter would be a false claim of coverage.
+const CHARTER_HEADING = '## Working with this file (content charter)';
+const CHARTER_RULE_REL = '.claude/rules/claudemd-authoring.md';
+
+test('the charter rule file exists and is paths-scoped to CLAUDE.md', () => {
+  const rule = fs.readFileSync(path.join(ROOT, CHARTER_RULE_REL), 'utf8');
+  assert.match(rule, /^---\r?\n[\s\S]*?\bpaths:[\s\S]*?["']\*\*\/CLAUDE\.md["'][\s\S]*?^---$/m,
+    'without `paths:` frontmatter matching **/CLAUDE.md the rule never loads, and the charter is simply gone');
+  assert.ok(rule.includes('Per-line test:'), 'the per-line test must survive the move');
+  assert.ok(rule.includes('## What goes where'), 'the "what goes where" table must survive the move');
+});
+
+test('the live CLAUDE.md delegates the charter to the rule file', () => {
+  const kernel = fs.readFileSync(path.join(ROOT, 'CLAUDE.md'), 'utf8');
+  assert.ok(kernel.includes(CHARTER_HEADING), 'the heading keeps the rule findable from the file it governs');
+  assert.ok(kernel.includes(CHARTER_RULE_REL), 'the heading must point somewhere, or it is decoration');
+});
+
+test('a hollow charter heading hard-fails (the heading alone is not the charter)', () => {
+  const r = fitness.checkClaudeMdBudget({ text: `${CHARTER_HEADING}\n` });
+  assert.equal(r.hardFail, true, 'a heading with neither inline rules nor a pointer must fail');
+  assert.ok(r.violations.some((v) => /hollow/i.test(v)), 'the violation must name the hollow section');
+});
+
+test('an inline charter still passes (a downstream kernel that never split it)', () => {
+  const r = fitness.checkClaudeMdBudget({ text: `${CHARTER_HEADING}\n- **Per-line test:** …\n` });
+  assert.equal(r.hardFail, false, 'relocation is the cure, not the requirement — inline is still a real charter');
+});
+
+test('a pointer at a missing rule file hard-fails', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'charter-ptr-'));
+  fs.writeFileSync(path.join(dir, 'CLAUDE.md'), `${CHARTER_HEADING}\ncharter: ${CHARTER_RULE_REL}\n`);
+  const out = require('node:child_process').execFileSync(process.execPath,
+    ['-e', `const f=require(${JSON.stringify(path.join(ROOT, 'scripts/gds/fitness.js'))});process.stdout.write(JSON.stringify(f.checkClaudeMdBudget()))`],
+    { env: { ...process.env, BONGOS_INSTANCE_ROOT: dir }, encoding: 'utf8' });
+  const r = JSON.parse(out);
+  assert.equal(r.hardFail, true, 'a pointer to nothing is worse than no pointer');
+  assert.ok(r.violations.some((v) => /does not exist/i.test(v)), 'the violation must say the target is missing');
+});
+
 test('CLAUDE.md char budget is ratcheted and ordered (target < ceiling, live file under it)', () => {
   assert.ok(fitness.ROOT_CHAR_TARGET < fitness.ROOT_CHAR_HARD_MAX, 'target must sit below the hard ceiling');
   const r = fitness.checkClaudeMdBudget();
@@ -778,6 +823,8 @@ test('identity gate actually CATCHES a re-hardcode (code, URL, HTML) — not a n
   assert.equal(scanPromptIdentity('x.js', 'const u = "https://amazonprimea.com/x";').length, 1, 'a leak inside a URL must be caught');
   assert.equal(scanPromptIdentity('x.html', '<title>Amazonprimea</title>').length, 1, 'an HTML title leak must be caught');
   assert.equal(scanPromptIdentity('x.js', 'const p = "Off the Boats";').length, 1, 'the product name must be caught');
+  // task 1002853: the founder's company rode the core status footer because only the product was listed
+  assert.equal(scanPromptIdentity('x.html', '<a href="https://hermeslines.com">Hermeslines</a>').length, 1, 'the host company must be caught');
 });
 
 test('identity gate skips comments + instance-injected tokens (no false positives)', () => {

package/tests/paste_token_api_base.mjs

@@ -0,0 +1,87 @@
+// tests/paste_token_api_base.mjs — which INSTANCE a pasted CLI token belongs to
+// (task 1003722, re-filed from task 1003312).
+//
+// A bearer is only meaningful against the instance that minted it. paste-token used to
+// decide that entirely by inference — env → the EXISTING session's api_base → branding
+// default — which is correct right up until the builder touches a second instance. The
+// stale api_base then outranks the instance that actually issued the token, so the
+// paste is verified against, and written as, the wrong host. The reported symptom was a
+// token minted on this instance landing as a token for an unrelated one, after which
+// every /builder-* command authenticated somewhere unintended.
+//
+// The hall now stamps the issuer into the paste command, and the flag outranks every
+// inferred source. These exercise the two pure helpers directly rather than scanning
+// the file, because the thing that broke is a DECISION, not a spelling.
+//
+// Run:  node --test tests/paste_token_api_base.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { parseArgs, resolveBaseForPaste } = require(path.join(ROOT, 'scripts', 'gds', 'paste-token.js'));
+
+const STALE = 'https://some-other-instance.example';
+const stale = () => STALE;
+
+test('the flag wins over the inferred base — the whole point of the fix', () => {
+  const r = resolveBaseForPaste({ flag: 'https://cloudbongos.com', resolve: stale });
+  assert.equal(r.base, 'https://cloudbongos.com');
+  assert.equal(r.source, 'flag');
+});
+
+test('no flag keeps the existing resolution exactly as it was', () => {
+  // An older instance's paste command carries no flag. That path must not change, or
+  // this fix trades one wrong-instance bug for another.
+  for (const flag of [undefined, null, '', '   ']) {
+    const r = resolveBaseForPaste({ flag, resolve: stale });
+    assert.equal(r.base, STALE, `flag ${JSON.stringify(flag)} should fall through`);
+    assert.equal(r.source, 'resolved');
+  }
+});
+
+test('a trailing slash is normalised, so the verify URL never doubles it', () => {
+  // API_BASE is concatenated with '/api/bongos/me'; a kept slash makes '//api/...'.
+  assert.equal(resolveBaseForPaste({ flag: 'https://x.example/', resolve: stale }).base, 'https://x.example');
+  assert.equal(resolveBaseForPaste({ flag: 'https://x.example///', resolve: stale }).base, 'https://x.example');
+});
+
+test('a malformed --api-base is refused, never silently ignored', () => {
+  // Refusing matters more than it looks: falling back on a malformed flag would send
+  // the token to the stale host — the exact failure the flag exists to prevent, but
+  // now silent, because the builder believes they named the instance.
+  for (const bad of ['cloudbongos.com', 'ftp://x.example', 'javascript:alert(1)', '/builders', 'https://']) {
+    const r = resolveBaseForPaste({ flag: bad, resolve: stale });
+    assert.equal(r.base, null, `${bad} should not resolve`);
+    assert.equal(r.source, 'invalid');
+  }
+});
+
+test('parseArgs reads the token and both flag spellings', () => {
+  const T = 'a'.repeat(64);
+  assert.deepEqual(parseArgs([T]), { token: T, apiBase: null });
+  assert.deepEqual(parseArgs([T, '--api-base', 'https://x.example']), { token: T, apiBase: 'https://x.example' });
+  assert.deepEqual(parseArgs([T, '--api-base=https://x.example']), { token: T, apiBase: 'https://x.example' });
+  // Order must not matter: the hall composes the command, and a future change to that
+  // string should not be able to break the paste silently.
+  assert.deepEqual(parseArgs(['--api-base', 'https://x.example', T]), { token: T, apiBase: 'https://x.example' });
+});
+
+test('a flag value is never mistaken for the token', () => {
+  // The bug this forecloses: treating argv[2] as the token, as the script used to,
+  // makes `--api-base https://x T` paste the URL as a bearer.
+  assert.equal(parseArgs(['--api-base', 'https://x.example', 'tok']).token, 'tok');
+  assert.equal(parseArgs(['--api-base=https://x.example', 'tok']).token, 'tok');
+});
+
+test('a dangling --api-base does not swallow the token', () => {
+  // `bongos paste-token --api-base` with nothing after it: the flag is empty and
+  // invalid, and main() exits on that rather than pasting whatever followed.
+  const a = parseArgs(['--api-base']);
+  assert.equal(a.apiBase, '');
+  assert.equal(a.token, null);
+});

package/tests/pr_assign.mjs

@@ -0,0 +1,189 @@
+// tests/pr_assign.mjs — a shipped pull request is assigned to the builder who wrote it
+// (task 1003991).
+//
+// The server opens every builder-box PR with its own credential, so the PR's AUTHOR is
+// the owner account: 259 of the last 300 PRs. The builder who wrote the work found
+// "created by me" empty on GitHub — and the PR is where CI and merge state live. The
+// server now assigns the PR to the task's claim holder and names them in the body.
+//
+// Two layers, no DB / network:
+//   1. modules/lifecycle/pr-assign.js through its injectable fetch — the assignment call
+//      and every fail-soft shape (it must NEVER reject: an assignment is a courtesy).
+//   2. The real POST /tasks/:id/publish-branch router with the data layer, the auth gate
+//      and the git/GitHub calls stubbed at the module boundary — proving the route assigns
+//      the CLAIM HOLDER (not the Archon who re-shipped it), names them in the body, and
+//      still answers 201 when the assignment fails.
+//
+// Run:  node tests/pr_assign.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { prAssigneeLine } from '../scripts/gds/ship-land.js';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+
+const express = require('express');
+const api = require('../src/module-api.js');
+const db = require('../modules/lifecycle/db.js');
+const gp = require('../modules/lifecycle/github-push.js');
+const prAssign = require('../modules/lifecycle/pr-assign.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  return Promise.resolve().then(fn)
+    .then(() => { passed++; console.log(`  PASS  ${name}`); })
+    .catch((e) => { failed++; console.log(`  FAIL  ${name}\n        ${e.stack || e.message}`); });
+}
+
+const REPO = { owner: 'someowner', repo: 'somerepo', branch: 'main' };
+const okJson = (body, status = 201) => ({ ok: status < 300, status, json: async () => body, text: async () => JSON.stringify(body) });
+const quiet = { warn() {} };
+
+// ---- layer 1: the assignment call -----------------------------------------
+await t('assignPullRequest POSTs the login to /issues/:number/assignees', async () => {
+  let seen = null;
+  const fetchImpl = async (url, opts) => { seen = { url, method: opts.method, body: JSON.parse(opts.body), auth: opts.headers.Authorization, signal: opts.signal }; return okJson({ assignees: [{ login: 'Some-Builder' }] }); };
+  const out = await prAssign.assignPullRequest({ number: 946, login: 'some-builder' }, { token: 'T', repoInfo: REPO, fetchImpl, logImpl: quiet });
+  assert.deepEqual(out, { assigned: true });
+  assert.equal(seen.url, 'https://api.github.com/repos/someowner/somerepo/issues/946/assignees');
+  assert.equal(seen.method, 'POST');
+  assert.deepEqual(seen.body, { assignees: ['some-builder'] });
+  assert.equal(seen.auth, 'Bearer T');
+  assert.ok(seen.signal instanceof AbortSignal, 'the one optional call before the 201 is time-boxed');
+});
+
+await t('fail-soft: every failure RESOLVES with a reason — it never rejects', async () => {
+  const run = (args, deps) => prAssign.assignPullRequest(args, { token: 'T', repoInfo: REPO, logImpl: quiet, ...deps });
+  const never = async () => { throw new Error('must not fetch'); };
+  assert.deepEqual(await run({ number: 1, login: 'x' }, { fetchImpl: async () => okJson({ message: 'Resource not accessible by integration' }, 403) }), { assigned: false, reason: 'http_403' });
+  assert.deepEqual(await run({ number: 1, login: 'x' }, { fetchImpl: async () => { throw new Error('socket hang up'); } }), { assigned: false, reason: 'threw' });
+  // GitHub answers 201 and silently drops a login that cannot be assigned (not a collaborator).
+  assert.deepEqual(await run({ number: 1, login: 'x' }, { fetchImpl: async () => okJson({ assignees: [] }) }), { assigned: false, reason: 'not_assignable' });
+  assert.deepEqual(await run({ number: 1, login: 'x' }, { token: '', fetchImpl: never }), { assigned: false, reason: 'unconfigured' });
+  assert.deepEqual(await run({ number: 1, login: 'x' }, { repoInfo: { error: 'nope' }, fetchImpl: never }), { assigned: false, reason: 'unconfigured' });
+  assert.deepEqual(await run({ number: 'abc', login: 'x' }, { fetchImpl: never }), { assigned: false, reason: 'bad_pr_number' });
+});
+
+await t('a login that is not a GitHub login is refused before any request, and never reaches a PR body', async () => {
+  const never = async () => { throw new Error('must not fetch'); };
+  for (const login of ['', null, undefined, 'a b', '-lead', 'x/../y', 'a'.repeat(40), 'name\n@everyone', '@already']) {
+    assert.deepEqual(await prAssign.assignPullRequest({ number: 1, login }, { token: 'T', repoInfo: REPO, fetchImpl: never, logImpl: quiet }), { assigned: false, reason: 'bad_login' }, JSON.stringify(login));
+    assert.equal(prAssign.prBuilderLine(login), '', JSON.stringify(login));
+  }
+  assert.equal(prAssign.prBuilderLine('Some-Builder1'), 'Built by @Some-Builder1.');
+  assert.equal(prAssign.prBuilderLine('name_shortcode'), 'Built by @name_shortcode.', 'a managed-user login carries an underscore');
+});
+
+await t('a failure is logged without the credential', async () => {
+  const lines = [];
+  await prAssign.assignPullRequest({ number: 1, login: 'x' }, {
+    token: 'SECRET_TOKEN', repoInfo: REPO, logImpl: { warn: (...a) => lines.push(JSON.stringify(a)) },
+    fetchImpl: async () => { throw new Error('connect https://x-access-token:SECRET_TOKEN@github.com failed'); },
+  });
+  assert.equal(lines.length, 1);
+  assert.ok(!lines[0].includes('SECRET_TOKEN'), lines[0]);
+});
+
+await t('the ship CLI says where the PR is findable, and says nothing when nobody was assigned', () => {
+  assert.match(prAssigneeLine('some-builder'), /assigned to @some-builder .*Assigned to you/);
+  for (const v of [null, undefined, '', 'a b', 'x\n[otb-plain] forged', 'a'.repeat(40)]) assert.equal(prAssigneeLine(v), null, JSON.stringify(v));
+});
+
+// ---- layer 2: the real publish route --------------------------------------
+const HEAD = 'a'.repeat(40);
+let caller = null;         // req.builder
+let holder = null;         // db.getLastClaimHolder
+let assignResult = null;   // what the GitHub assignees call answers
+let opened = null;         // the PR the route asked for
+let assignCalls = [];
+
+api.requireBuilder = (req, res, next) => { req.builder = caller; next(); };
+db.getLastClaimHolder = async () => holder;
+db.setClaimPublishedSha = async () => {};
+gp.isConfigured = () => true;
+gp.pushBundle = async () => ({ head_sha: HEAD });
+gp.openOrFindPullRequest = async (args) => { opened = args; return { number: 77, url: 'https://github.com/o/r/pull/77', node_id: 'N' }; };
+gp.enableAutoMergeDetailed = async () => ({ ok: true });
+gp.setCommitStatus = async () => true;
+prAssign.assignPullRequest = async (args) => { assignCalls.push(args); if (assignResult instanceof Error) throw assignResult; return assignResult; };
+
+const buildTasksRouter = require('../modules/lifecycle/routes/tasks.js');
+const app = express();
+app.use((req, res, next) => {
+  res.fail = (code, status, extra) => res.status(typeof status === 'number' ? status : (status && status.status) || 500).json({ error: code, ...(extra || {}) });
+  next();
+});
+app.use(buildTasksRouter());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const base = `http://127.0.0.1:${server.address().port}`;
+
+async function publish() {
+  opened = null; assignCalls = [];
+  const res = await fetch(`${base}/tasks/1003848/publish-branch`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ branch: 'task-1003848', head_sha: HEAD, bundle_b64: Buffer.from('bundle').toString('base64'), value_summary: 'A thing got better.' }),
+  });
+  return { status: res.status, body: await res.json() };
+}
+
+await t('the route assigns the PR to the claim holder and names them in the body', async () => {
+  caller = { id: 5, rank: 'thetes', github_login: 'some-builder' };
+  holder = { builder_id: 5, github_login: 'some-builder' };
+  assignResult = { assigned: true };
+  const r = await publish();
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.deepEqual(assignCalls, [{ number: 77, login: 'some-builder' }]);
+  assert.match(opened.body, /Built by @some-builder\./);
+  assert.equal(r.body.pr_assignee, 'some-builder');
+});
+
+await t('an Archon re-shipping someone else\'s task assigns the AUTHOR, not themselves', async () => {
+  caller = { id: 1, rank: 'archon', github_login: 'the-archon' };
+  holder = { builder_id: 5, github_login: 'some-builder' };
+  assignResult = { assigned: true };
+  const r = await publish();
+  assert.equal(r.status, 201);
+  assert.equal(assignCalls[0].login, 'some-builder');
+  assert.ok(!opened.body.includes('the-archon'));
+});
+
+await t('a failed assignment never fails the ship: still 201, pr_assignee null', async () => {
+  caller = { id: 5, rank: 'thetes', github_login: 'some-builder' };
+  holder = { builder_id: 5, github_login: 'some-builder' };
+  for (const result of [{ assigned: false, reason: 'http_403' }, new Error('assign blew up')]) {
+    assignResult = result;
+    const r = await publish();
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    assert.equal(r.body.pr_url, 'https://github.com/o/r/pull/77');
+    assert.equal(r.body.pr_assignee, null);
+  }
+});
+
+await t('a never-claimed task falls back to the caller', async () => {
+  caller = { id: 1, rank: 'archon', github_login: 'the-archon' };
+  holder = null;
+  assignResult = { assigned: true };
+  const r = await publish();
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.equal(assignCalls[0].login, 'the-archon');
+});
+
+// A PR body is never rewritten, so a wrong name would be permanent: a lookup that FAILS
+// must name nobody rather than credit the Archon who happened to re-ship it.
+await t('a claim-holder lookup that THROWS names nobody, and still ships', async () => {
+  caller = { id: 1, rank: 'archon', github_login: 'the-archon' };
+  db.getLastClaimHolder = async () => { throw new Error('simulated DB outage'); };
+  assignResult = { assigned: false, reason: 'bad_login' };
+  const r = await publish();
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.equal(assignCalls[0].login, null);
+  assert.ok(!opened.body.includes('Built by'), opened.body);
+  assert.equal(r.body.pr_assignee, null);
+});
+
+server.close();
+console.log(`\npr_assign: ${passed} passed, ${failed} failed`);
+process.exitCode = failed ? 1 : 0;

package/tests/provision.mjs

@@ -415,6 +415,8 @@ function recorder({ apply = false } = {}) {
     // Stub the DNS token-scope preflight (task 1980) so the composition stays hermetic
     // (no real CF call). Default: reachable; a test overrides it to exercise the block.
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
+    // Caddy's resolved-config check (task 1002860) stubbed wired; tests/provision_caddy_wiring.mjs covers it.
+    checkCaddyWiring: () => null,
     // Owner OAuth token lookup for the scaffold push (task 1002317). Default: none →
     // the scaffold takes the SSH `origin` fallback (so existing push assertions hold
     // without touching the real db module). A test overrides it to exercise the token path.
@@ -1115,6 +1117,7 @@ function dnsRecorder({ apply = false } = {}) {
     // Preflight (task 1980) stubbed reachable so --apply DNS tests reach the step-5
     // behavior they assert (the preflight itself is covered by its own test below).
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
+    checkCaddyWiring: () => null,
   };
   return { deps, cmds, envs, cleared };
 }
@@ -1525,6 +1528,7 @@ function privRecorder({ apply = false } = {}) {
     writeFile: (p, _body, opts) => { writes.push({ p, opts: opts || {} }); return { ok: true }; },
     doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
+    checkCaddyWiring: () => null,
   };
   return { deps, cmds, writes };
 }
@@ -1666,6 +1670,7 @@ await ta('provisionInstance(co-tenant, remote): box steps use the box `exec`, bu
       controlWriteFile: () => ({ ok: true }),
       doApi: null,
       checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
+      checkCaddyWiring: () => null,
     };
     await P.provisionInstance({ ...coTenant, domain: 'mercury.example.com' }, deps);
     // box-mutating steps → the box executor (which, in prod, ssh's to the co-hosting box)
@@ -1697,6 +1702,7 @@ await ta('provisionInstance(standalone, remote): EVERY box step runs control-pla
       controlWriteFile: (p) => { controlWrites.push(p); return { ok: true }; },                 // the control-plane writer
       doApi: null,
       checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+      checkCaddyWiring: () => null,
     };
     await P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'example-owner/mercury', domain: 'mercury.cloudbongos.com' }, deps);
     // The bug (task 2074): these landed on the REMOTE box, which never had the scaffolded
@@ -1736,6 +1742,7 @@ await ta('provisionInstance(standalone, remote, --apply): FAILS LOUD when the co
       exec: () => ({ ok: true, stdout: '' }), controlExec: () => ({ ok: true, stdout: '' }),
       writeFile: () => ({ ok: true }), controlWriteFile: () => ({ ok: true }), doApi: null,
       checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+      checkCaddyWiring: () => null,
     };
     await assert.rejects(
       () => P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'example-owner/mercury', domain: 'mercury.cloudbongos.com' }, deps),
@@ -1980,6 +1987,7 @@ function attachRecorder({ apply = false, envBody = WEB_ENV_ON_BOX } = {}) {
     writeFile: (p, body) => { writes.push({ path: p, body }); return { ok: true }; },
     doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+    checkCaddyWiring: () => null,
   };
   return { deps, cmds, envs, writes, events, dnsNotes, cleared };
 }
@@ -2226,6 +2234,7 @@ await ta('cmdRunIntents (--apply) routes a domain-attach intent to the attach le
     exec: (cmd) => ({ ok: true, stdout: /\bcat\b.*web\.env/.test(String(cmd)) ? 'PORT=3010\n' : '' }),
     writeFile: () => ({ ok: true }), doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+    checkCaddyWiring: () => null,
   };
   const r = await P.cmdRunIntents(deps);
   assert.equal(r.ran, 1);
@@ -2288,6 +2297,7 @@ function truthRecorder({ healthzFails = false } = {}) {
     writeFile: () => ({ ok: true }),
     doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'cloudbongos.com' }),
+    checkCaddyWiring: () => null,
     getGithubToken: async () => null,
   };
   return { deps, cmds, statuses, patches, probes, logs, events, dnsNotes };
@@ -2361,6 +2371,7 @@ await ta('F19: a RETIRED intent records its reason on the instance without chang
     },
     exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'z' }),
+    checkCaddyWiring: () => null,
   };
   const r = await P.cmdRunIntents(deps);
   assert.equal(r.errors, 1);
@@ -2386,6 +2397,7 @@ await ta('F19: a NON-final failure re-pends the intent and writes nothing on the
     },
     exec: () => ({ ok: true }), writeFile: () => ({ ok: true }), doApi: null,
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'z' }),
+    checkCaddyWiring: () => null,
   };
   await P.cmdRunIntents(deps);
   assert.equal(resolved.length, 0, 'not resolved — it re-pends for a later tick');