@bongos/core 1.19.839 → 1.19.841

package/scripts/gds/provision.js

@@ -52,7 +52,7 @@ const crypto = require('node:crypto');
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, dbRoleCmd, dbRoleCmdShown, dbRoleGrantsCmd, ensureInstanceUserCmd, generateDbPassword, grantInstanceRepoReadCmd, instanceDbRole, instanceStateDir, instanceUser, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
-const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
+const { caddyBlock, caddySnippetPath, checkCaddyWiring, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
 const { capacityPreflight, statusCapacityLine } = require('./provision-capacity.js');
 const { installedCoreVersion, runnerBanner } = require('./runner-drift.js');
 const { teardownInstance } = require('./provision-teardown.js');
@@ -263,6 +263,13 @@ async function provisionInstance(inst, deps) {
       log(`  [preflight] would verify the Cloudflare token can reach zone ${zoneForDomain(inst.domain)} before the address step`);
     }
   }
+  // Caddy preflight (task 1002860, ADR 0303): a box whose base Caddyfile has no tls-check ask
+  // can never certify this domain, so refuse before touching it. Injectable like the DNS check.
+  const caddyCheck = deps.checkCaddyWiring || checkCaddyWiring;
+  if (inst.domain && inst.hosting_shape !== 'dedicated' && apply) {
+    const gap = caddyCheck(boxExec, { domain: inst.domain });
+    if (gap) return { ok: false, error: `Caddy preflight failed: ${gap}` };
+  }
   const room = await capacityPreflight(inst, deps);   // box capacity (ADR 0285, task 1003927): an honest refusal BEFORE the status flip — never a silent oversubscribe
   if (room.ok === false) return room;
   if (apply) await provisioning.setInstanceStatus(db, inst.id, 'provisioning');
@@ -502,11 +509,14 @@ async function provisionInstance(inst, deps) {
   // Write the instance's OWN <slug>.caddy snippet (idempotent overwrite via the
   // injected writeFile — no read-modify-append to a shared Caddyfile), then reload.
   // The main Caddyfile carries a one-time `import <snippetDir>/*.caddy` (operator
-  // setup). The on-demand-ACME TLS hardening of this block is task P4 (#1945).
+  // setup) — verified after the write, since only a written snippet proves the import
+  // reaches it. The reload is loud: Caddy keeps its old config when it rejects the new one.
   log('  [caddy] write site snippet + reload');
   if (local) {
     boxWriteFile(caddySnippetPath(inst), caddyBlock(inst), { mode: 0o644, sudo: true });
-    boxExec(`${sudoP}systemctl reload caddy`, { allowFail: true });
+    const gap = inst.domain && apply ? caddyCheck(boxExec, { domain: inst.domain, requireHost: true }) : null;
+    if (gap) return { ok: false, error: `Caddy wiring failed: ${gap}` };
+    boxExec(`${sudoP}systemctl reload caddy`);
   } else { log('    (Caddy on the droplet via cloud-init)'); }
 
   // ── step 7: healthz ───────────────────────────────────────────────────────
@@ -740,6 +750,11 @@ async function domainAttachInstance(inst, deps) {
     }
     log(`  [preflight] DNS token can reach zone ${scope.zone} ✓`);
   }
+  const caddyCheck = deps.checkCaddyWiring || checkCaddyWiring;   // Caddy preflight (task 1002860, ADR 0303)
+  if (apply) {
+    const gap = caddyCheck(boxExec, { domain: inst.domain });
+    if (gap) return { ok: false, error: `Caddy preflight failed: ${gap}` };
+  }
 
   // The A-record target — the same derivation as provisionInstance step 1.
   const recordIp = standalone
@@ -791,7 +806,9 @@ async function domainAttachInstance(inst, deps) {
   // (and tls-check stops vouching for it) with no separate un-wire step.
   log('  [caddy] write site snippet + reload');
   boxWriteFile(caddySnippetPath(inst), caddyBlock(inst), { mode: 0o644, sudo: true });
-  boxExec(`${sudoP}systemctl reload caddy`, { allowFail: true });
+  const gap = apply ? caddyCheck(boxExec, { domain: inst.domain, requireHost: true }) : null;
+  if (gap) return { ok: false, error: `Caddy wiring failed: ${gap}` };
+  boxExec(`${sudoP}systemctl reload caddy`);
 
   // Release what the re-point moved off, AFTER the new address is wired: the DNS
   // record is the only half of an abandoned address the platform still holds, and

package/scripts/gds/publish-manifest.js

@@ -80,6 +80,7 @@ const PUBLISH_ALLOWLIST = [
   'config/design-tokens.schema.json',  // the design-token contract (generic schema, no instance values)
   'config/hierarchy.neutral.json',
   'config/government.neutral.json',     // the starting rank templates a fresh instance inherits (BV1.R96; renamed from governance.neutral.json by ADR 0174)
+  'config/scheduled-routines.json',     // the routine SWITCHBOARD (ADR 0115) — per routine: enabled, cadence, requiresAutonomy. It carries no *.neutral.json twin because it IS the neutral starter: ADR 0115's contract is that "a fresh instance inherits this whole set from the core template", and the operator then opts in/out HERE. PUBLISHES rather than topology-excludes for that reason — a released core without it would hand a new instance an empty scheduler and no record of what the routines under .claude/scheduled-tasks/ are for. It reached this list when task 1002500 registered it as a protected surface, which forces the choice; before that it was default-denied by silence, which is the accident that rule exists to catch.
   // --- the portable methodology core, governance, and sanitized docs ---
   'CLAUDE.md',
   'README.md',

package/scripts/gds/ship-land.js

@@ -209,6 +209,8 @@ async function ciLandServer(taskId, branch, valueSummary) {
       return landBailed(`server publish failed — ${e}`, strandCommand(taskId, 'server'));
     }
     console.log(`  ci-land: server pushed ${branch} + PR ${r.data.pr_url} (auto-merge ${r.data.auto_merge ? 'enabled' : 'NOT enabled — merge it on GitHub'}).`);
+    const assigneeLine = prAssigneeLine(r.data.pr_assignee);
+    if (assigneeLine) console.log(assigneeLine);
     return pollServerPublish(taskId, branch);
   } finally {
     try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch (_) { /* best-effort */ }
@@ -332,6 +334,15 @@ function reconcileBlockedLines(taskId, reason) {
   ];
 }
 
+// task 1003991 — the server opens the PR with ITS credential, so "created by me" on
+// GitHub is empty for the builder; it assigns the PR to them instead, and this says
+// where that makes it findable. Null when the server assigned nobody. Pure + exported.
+function prAssigneeLine(login) {
+  return /^[A-Za-z\d_-]{1,39}$/.test(String(login || ''))
+    ? `  ci-land: the PR is assigned to @${login} — on GitHub it is under Pull requests → Assigned to you (the server opened it, so "Created by you" stays empty).`
+    : null;
+}
+
 // task 1003988 — what to tell a builder while their PR sits RED. The poll used to
 // wait out its nine minutes in silence, so a credential-less box learned only that
 // the land was "pending" and pushed the same commit again (PR 922: nine red runs).
@@ -724,6 +735,7 @@ module.exports = {
   landed,
   pickStaleGateReviewRun,
   reconcileBlockedLines,
+  prAssigneeLine,
   redPrLine,
   redPrLines,
   reconciledCardStatus,

package/src/bongos/routes/auth.js

@@ -1066,20 +1066,41 @@ module.exports = function buildAuthRouter() {
         // The builder kills it from this same Settings page, under Active sessions.
         expiresAt: null,
       });
+      // NAME THE INSTANCE THAT MINTED THIS (task 1003722). A bearer is only
+      // meaningful against the instance that issued it, and the CLI cannot work
+      // that out on its own: paste-token resolves its base as env → the EXISTING
+      // session's api_base → branding default. So on any machine that has talked
+      // to another instance, the STALE api_base wins and a perfectly good token is
+      // verified against — and then bound to — the wrong host. That is the reported
+      // bug: a token minted here landed as a token for a different instance.
+      //
+      // The issuer is the one fact that cannot be recovered at the other end, so it
+      // travels with the token. Same discipline as configuredOAuthOrigin() above:
+      // this instance may state its OWN identity and must assume nothing about the
+      // recipient's machine.
+      const issuer = String(resolveEnv('PUBLIC_ORIGIN') || configuredOAuthOrigin() || '')
+        .trim().replace(/\/+$/, '');
       res.json({
         ok: true,
         token,
         expires_at: row.expires_at,
         builder_login: req.builder.github_login,
+        api_base: issuer || null,
         // A VERB, never a path (task 1003961). This string is composed HERE and run
         // THERE — on an instance, where the core is an installed dependency and
         // `scripts/gds/` does not exist, so the previous
         // `node scripts/gds/paste-token.js <token>` named a file the builder did not
         // have and the copy button handed out a command that could not run. `bongos`
         // is on PATH in any installed instance, so the verb form is layout- and
-        // directory-independent. Same discipline as configuredOAuthOrigin() above:
-        // nothing about the RECIPIENT's filesystem may be assumed here.
-        paste_command: `bongos paste-token ${token}`,
+        // directory-independent.
+        //
+        // The --api-base flag carries the issuer above. Omitted when this instance
+        // cannot state its own origin, because a flag with an empty value would be
+        // worse than none: paste-token would take '' as an explicit instruction and
+        // stop falling back to the resolution that works today.
+        paste_command: issuer
+          ? `bongos paste-token ${token} --api-base ${issuer}`
+          : `bongos paste-token ${token}`,
       });
     } catch (err) {
       log.error('[gds] POST /auth/cli-token/issue', err);

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.839'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.841'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/bongos_cli.mjs

@@ -65,10 +65,19 @@ test('paste-token is bundled into the standalone binary, like reauth', () => {
 
 test('the server emits exactly the verb the CLI registers', () => {
   const routes = readFileSync(join(dirname(fileURLToPath(import.meta.url)), '..', 'src', 'bongos', 'routes', 'auth.js'), 'utf8');
-  const m = routes.match(/paste_command:\s*`([^`]+)`/);
-  assert.ok(m, 'auth.js should emit a paste_command template literal');
-  const verb = m[1].split(' ')[1];
-  assert.ok(cli.VERBS[verb], `server emits "bongos ${verb}" but the CLI has no such verb`);
+  // Read EVERY branch, not just a literal sitting immediately after the key. Since
+  // task 1003722 paste_command is a ternary (the issuing instance is stamped in when
+  // known), and a matcher anchored on `paste_command:\s*\`` silently stopped matching
+  // at all — reporting "auth.js should emit a paste_command template literal" for a
+  // field that was right there. A test that cannot find what it checks fails as though
+  // the thing were missing, which sends the reader hunting in the wrong file.
+  const tail = routes.slice(routes.indexOf('paste_command:'));
+  const cmds = [...tail.matchAll(/`([^`]*bongos paste-token[^`]*)`/g)].map((x) => x[1]);
+  assert.ok(cmds.length > 0, 'auth.js should emit at least one paste_command template literal');
+  for (const cmd of cmds) {
+    const verb = cmd.split(' ')[1];
+    assert.ok(cli.VERBS[verb], `server emits "bongos ${verb}" but the CLI has no such verb`);
+  }
 });
 
 test('VERBS: selfHelp is only claimed by scripts that really print their own usage', () => {

package/tests/cli_token_reissue.mjs

@@ -115,10 +115,24 @@ t('POST /auth/cli-token/issue is defined', () => {
 const issueBlock = (() => {
   const start = routeSrc.indexOf("'/auth/cli-token/issue'");
   if (start === -1) return '';
-  // crude but enough: take ~3000 chars from the route literal forward.
-  return routeSrc.slice(start, start + 3000);
+  // Bound the window at the NEXT route registration rather than a fixed char count.
+  // A fixed ~3000-char window silently truncates as soon as the handler grows: adding
+  // a comment to this route pushed paste_command out of the slice, and every assertion
+  // about it failed as though the field had been deleted (task 1003722). A byte budget
+  // is not a unit of code, and a scan that can quietly stop seeing what it checks is
+  // the same failure shape as a scan that quietly finds nothing.
+  const next = routeSrc.indexOf('\n  router.', start);
+  return routeSrc.slice(start, next === -1 ? routeSrc.length : next);
 })();
 
+// The window above must actually contain the handler — otherwise every assertion in
+// this file passes or fails for reasons that have nothing to do with the route.
+t('the extracted route window covers the whole handler', () => {
+  assert.ok(issueBlock.includes('sessionCookieToken(req)'), 'window should reach the cookie gate near the top');
+  assert.ok(issueBlock.includes('paste_command'), 'window should reach the response at the bottom');
+  assert.ok(!issueBlock.includes("'/auth/revoke'"), 'window should stop before the next route');
+});
+
 // Refreshed for the current handler (task 1003961). These two assertions named
 // `parseCookie(req, SESSION_COOKIE)` and `res.status(403)`, the shape BEFORE the
 // handler moved to the `sessionCookieToken` helper and the `res.fail` envelope.
@@ -154,15 +168,48 @@ t('returns a paste_command field the portal can show verbatim', () => {
 // instance builder a command naming a file they did not have. A verb has no such
 // coupling — `bongos` is on PATH wherever the core is installed.
 t('paste_command names a CLI VERB, never a filesystem path', () => {
-  const m = issueBlock.match(/paste_command:\s*`([^`]+)`/);
-  assert.ok(m, 'paste_command should be a template literal the test can read');
-  const cmd = m[1];
+  // Read EVERY template literal the field can evaluate to, not just the first. It is a
+  // ternary since task 1003722 (issuer present / absent), and an assertion that saw
+  // only one branch would leave the other unguarded — which is how a rule stops
+  // applying without anyone editing it.
+  const tail = issueBlock.slice(issueBlock.indexOf('paste_command:'));
+  const cmds = [...tail.matchAll(/`([^`]*bongos paste-token[^`]*)`/g)].map((m) => m[1]);
+  assert.equal(cmds.length, 2, `expected both ternary branches, got ${cmds.length}`);
+  for (const cmd of cmds) {
   assert.ok(/^bongos paste-token /.test(cmd),
     `paste_command must start with the verb form, got: ${cmd}`);
-  assert.ok(!cmd.includes('/'),
-    `paste_command must contain no path separator — it runs where the layout differs. Got: ${cmd}`);
+  // The invariant is "names no FILE ON THE RECIPIENT'S DISK", which the original
+  // spelling approximated as "contains no slash". That was too broad once the command
+  // had to carry the issuer URL (task 1003722) — `https://host` is not a filesystem
+  // path, and forbidding every slash would have blocked the fix for a different bug
+  // while protecting nothing extra. Pin what the comment above actually says instead.
+  assert.ok(!/(^|\s)[.~]?\/|\bscripts\b|\.js\b/.test(cmd),
+    `paste_command must name no path or script file — it runs where the layout differs. Got: ${cmd}`);
   assert.ok(!/\bnode\b/.test(cmd),
     `paste_command must not invoke node directly (that assumes a script on disk). Got: ${cmd}`);
+  }
+});
+
+// The bug this pins (task 1003722): a bearer is only valid against the instance that
+// minted it, but paste-token infers its base as env → the EXISTING session's api_base
+// → branding default. On a machine that has used a second instance the stale api_base
+// wins, so a token minted here was bound to the wrong host and every /builder-* command
+// then authenticated somewhere unintended. The issuer cannot be recovered at the other
+// end, so it has to travel with the token.
+t('paste_command carries the issuing instance, so the CLI cannot guess wrong', () => {
+  const m = issueBlock.match(/paste_command:\s*issuer\s*\?\s*`([^`]+)`/);
+  assert.ok(m, 'paste_command should still be a readable template literal');
+  assert.ok(/--api-base \$\{issuer\}/.test(m[1]),
+    `the issuing origin must be stamped into the command, got: ${m[1]}`);
+  assert.ok(/api_base:\s*issuer/.test(issueBlock),
+    'the response should also expose api_base for non-copy-paste consumers');
+});
+
+t('an instance that cannot state its own origin omits the flag rather than sending an empty one', () => {
+  // `--api-base ''` would read at the far end as an explicit instruction and suppress
+  // the fallback that works today — strictly worse than sending no flag at all.
+  assert.ok(/:\s*`bongos paste-token \$\{token\}`/.test(issueBlock),
+    'there must be a flagless branch for the empty-issuer case');
 });
 
 // ---------------------------------------------------------------------------

package/tests/government_protected_surfaces.mjs

@@ -17,6 +17,7 @@ import { test } from 'node:test';
 import { createRequire } from 'node:module';
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -226,6 +227,19 @@ const ADDED_SINCE_R101 = [
        + 'that computed set is expected. Registered because it is the code that puts the '
        + 'credential on the wire.',
   },
+  // task 1002500. The routine SWITCHBOARD — the counterpart to the hooks/settings entries
+  // in group 'automation', which protect how a session behaves but said nothing about what
+  // fires with no session at all. The routine-switch tripwire below recomputes this set
+  // from config/ by SHAPE, so a second switchboard cannot land unregistered.
+  {
+    after: '.claude/settings.json',
+    glob: 'config/scheduled-routines.json',
+    why: 'decides, per routine, enabled / cadence / requiresAutonomy. Arming '
+       + 'overnight-builder there starts an autonomous claim-and-ship loop; clearing '
+       + "main-audit's entry silences the post-merge backstop that catches a sub-Metic "
+       + 'edit which slipped past the pre-push hook and the grader — the one ADR 0043 '
+       + 'layer that does not depend on the builder cooperating.',
+  },
 ];
 
 // Surfaces RENAMED since R101 — still protected, under a new path. Distinct from
@@ -561,6 +575,173 @@ test('registering the credential readers widened no module wall', () => {
     + 'is not, the premise of the box.js entry has changed.');
 });
 
+// ---------- the routine-switch tripwire: every SWITCHBOARD is a protected surface ----------
+//
+// task 1002500. Group 'automation' protected how a SESSION behaves — .claude/hooks/ and
+// .claude/settings.json — and said nothing about what fires when no session exists at all.
+// config/scheduled-routines.json is that file: per routine it carries enabled, cadence and
+// requiresAutonomy, so one edit there arms overnight-builder (an autonomous claim-and-ship
+// loop) or silences main-audit, which is the only ADR 0043 layer that does not depend on
+// the builder cooperating.
+//
+// DETECTED BY SHAPE, NOT BY NAME. Naming the one file we know about today is the failure
+// this project keeps re-learning (the audit's stale "gen-* trio" above, the filing task's
+// wrong path for the Cloudflare reader): the registry would record the gap as closed while
+// a second switchboard lands beside it unprotected. So the set is recomputed from config/
+// on every run, and an entry whose values decide whether-and-how-often a routine runs must
+// be registered or this reds.
+//
+// WHY ONLY THE SWITCHBOARD, NOT THE ROUTINE BODIES. .claude/scheduled-tasks/ is the
+// autonomy module's source surface, and `protected` DERIVES per module from overlap with
+// this registry — so registering the bodies would rank-wall the whole autonomy module and
+// every goal scoped to it. That is a policy decision with three deliberate edits attached
+// (registry, publish-manifest carve-out, the module-scope-map roster), exactly as recorded
+// for .claude/agents/ at the head of this file. Protecting the switchboard gates who may
+// ARM a routine; it deliberately says nothing about who may edit what one does.
+const CONFIG_DIR = path.join(ROOT, 'config');
+
+// Does this JSON declare routine SWITCHES — entries deciding whether a routine runs and
+// how often? True for an object carrying `requiresAutonomy`, or `enabled` alongside a
+// `cadence`. Recursive so a flat manifest is caught as readily as the nested `routines`
+// map today; `enabled` ALONE is deliberately not enough, or every feature-flag file in
+// config/ would match and the tripwire would mean nothing.
+//
+// MAX_SWITCH_DEPTH is the deepest nesting a switchboard is searched at. The shapes that
+// exist are depth 0 (a flat `{ "<routine>": {...} }` map, where the entry sits one level
+// in) and depth 1 (today's `{ "routines": { "<routine>": {...} } }`). Three is that plus a
+// level of headroom, and it is a bound rather than a guess: the cost of it being too low
+// is a switchboard buried deeper than any we write going unnoticed, and the cost of
+// removing it is walking arbitrarily deep into unrelated config for a key that only ever
+// appears near the top. Raise it and the tripwire still holds; the negative test below is
+// what would catch a raise that starts matching ordinary config.
+const MAX_SWITCH_DEPTH = 3;
+
+function declaresRoutineSwitches(node, depth = 0) {
+  if (!node || typeof node !== 'object' || Array.isArray(node) || depth > MAX_SWITCH_DEPTH) return false;
+  if (typeof node.requiresAutonomy === 'boolean') return true;
+  if (typeof node.enabled === 'boolean' && typeof node.cadence === 'string') return true;
+  return Object.values(node).some((v) => declaresRoutineSwitches(v, depth + 1));
+}
+
+// Every config/*.json that declares routine switches, as repo-relative paths.
+function routineSwitchManifests(dir = CONFIG_DIR) {
+  const out = [];
+  for (const name of fs.readdirSync(dir).sort()) {
+    if (!name.endsWith('.json')) continue;
+    let doc;
+    try { doc = JSON.parse(fs.readFileSync(path.join(dir, name), 'utf8')); } catch (_) { continue; }
+    if (declaresRoutineSwitches(doc)) out.push(`config/${name}`);
+  }
+  return out;
+}
+
+test('declaresRoutineSwitches detects a switchboard in both shapes', () => {
+  assert.equal(declaresRoutineSwitches({ routines: { a: { enabled: true, cadence: 'daily' } } }), true,
+    'the nested shape config/scheduled-routines.json uses today');
+  assert.equal(declaresRoutineSwitches({ 'overnight-builder': { requiresAutonomy: true } }), true,
+    'a FLAT manifest — the shape a second switchboard is most likely to arrive in');
+  assert.equal(declaresRoutineSwitches({ a: { b: { c: { requiresAutonomy: false } } } }), true,
+    'requiresAutonomy:false still declares the switch — the value is policy, the key is the shape');
+});
+
+test('declaresRoutineSwitches does not fire on a near-miss', () => {
+  assert.equal(declaresRoutineSwitches({ game: false, discord: true }), false,
+    'a feature-flag map is not a routine switchboard');
+  assert.equal(declaresRoutineSwitches({ mod: { enabled: true } }), false,
+    'enabled ALONE is not enough — it must decide how often something fires');
+  assert.equal(declaresRoutineSwitches({ chart: { cadence: 'weekly' } }), false,
+    'a cadence with nothing enabling it is prose, not a switch');
+  assert.equal(declaresRoutineSwitches(null), false);
+  assert.equal(declaresRoutineSwitches([{ enabled: true, cadence: 'daily' }]), false,
+    'an array is not an entry map');
+});
+
+// The near-miss test above uses hand-built objects, which only proves the detector rejects
+// the shapes I thought to write. This proves the negative against the REAL directory: of
+// the config files actually in the tree, exactly one is a switchboard. Without it, a
+// detector that matched everything in config/ would still pass the tripwire (every other
+// file would simply have to be registered too, and the failure would read as a coverage
+// gap rather than as an over-broad detector).
+test('exactly one file in the real config/ is a switchboard — the rest do not match', () => {
+  const all = fs.readdirSync(CONFIG_DIR).filter((n) => n.endsWith('.json')).sort();
+  assert.ok(all.length >= 5,
+    `fixture sanity: config/ should hold several json files, found ${all.length}`);
+  const matched = routineSwitchManifests();
+  assert.deepEqual(matched, ['config/scheduled-routines.json'],
+    `the detector matched ${matched.length} of the ${all.length} files in config/. One is `
+    + 'correct. More means the shape test is too loose — a feature-flag or token file is '
+    + 'being read as a routine switchboard, which would turn this tripwire into a demand '
+    + 'to rank-wall ordinary config. Scanned: ' + all.join(', '));
+});
+
+test('every routine switchboard in config/ is a protected surface (1002500 tripwire)', () => {
+  const boards = routineSwitchManifests();
+  assert.ok(boards.includes('config/scheduled-routines.json'),
+    'fixture sanity: the known switchboard must be detected, or this tripwire is vacuous '
+    + '— the failure mode where a scan passes by quietly finding nothing');
+  for (const rel of boards) {
+    const surface = ppc.surfaceFor(rel);
+    assert.ok(surface,
+      `${rel} decides whether scheduled routines run and how often — arming one starts `
+      + 'unattended work, silencing one removes a gate — but no protected surface covers '
+      + 'it. Add it to modules/government/protected-surfaces.json (group "automation") and '
+      + 'declare it in ADDED_SINCE_R101 above.');
+    assert.ok(ppc.RANK_TIER[surface.floor] >= ppc.RANK_TIER.metic,
+      `${rel} is a routine switchboard floored at '${surface.floor}' — below Metic it `
+      + 'stays writable by the ranks ADR 0043 keeps out of the pipeline.');
+  }
+});
+
+// The tripwire above passes today because the one switchboard IS registered — which is
+// also what it would look like if it were broken and finding nothing. This proves the RED
+// path without mutating the shipped registry: a switchboard that is not in it must be
+// detected AND must resolve to no protected surface, which is exactly the pair the loop
+// above turns into a failure.
+test('the tripwire fires on an UNREGISTERED switchboard', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-switchboard-probe-'));
+  try {
+    fs.writeFileSync(path.join(dir, 'unrelated.json'), JSON.stringify({ game: false }));
+    fs.writeFileSync(path.join(dir, 'rogue-routines.json'),
+      JSON.stringify({ routines: { 'overnight-builder': { enabled: true, cadence: 'nightly', requiresAutonomy: true } } }));
+    const found = routineSwitchManifests(dir);
+    assert.deepEqual(found, ['config/rogue-routines.json'],
+      'the detector must find the rogue switchboard and ignore the feature-flag file');
+    assert.equal(ppc.surfaceFor('config/rogue-routines.json'), null,
+      'an unregistered config path must resolve to no surface — the falsy half the '
+      + 'tripwire asserts on. If this ever returns a surface, a config/ subtree glob was '
+      + 'added and the tripwire can no longer distinguish registered from unregistered.');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('registering the switchboard widened no module wall', () => {
+  // The same second-order effect asserted for the credential readers above. config/ is
+  // kernel territory (module-scope-map's kernel key), and kernel was already protected via
+  // src/bongos/auth.js and db.js — so this entry must change nothing.
+  //
+  // `agents` is the module to watch, and the ONLY one this test can honestly cite.
+  // `autonomy` — which owns .claude/scheduled-tasks/, the routine bodies — was ALREADY
+  // protected before this entry, through scripts/gds/conductor-dispatch.js in group
+  // 'pipeline' (verified glob by glob: none of its other five globs is protected). So its
+  // flag is not evidence either way here, and asserting it unprotected would have been a
+  // test that fails for a reason unrelated to what it claims to check.
+  const map = require(path.join(ROOT, 'src', 'bongos', 'module-scope-map.js'));
+  const protectedNow = map.protectedModules();
+  assert.ok(protectedNow.includes('kernel'),
+    'kernel owns config/ and was already protected before this entry; if it is not, the '
+    + 'premise that registering a config/ file widens nothing has changed.');
+  assert.ok(!protectedNow.includes('agents'),
+    'the agents module derived protected:true — a routine entry reached modules/agents/ '
+    + 'or .claude/agents/, which rank-walls every goal scoped to it. Protect the '
+    + 'SWITCHBOARD, not the agent or routine sources; walling that module is the separate '
+    + 'policy decision recorded for .claude/agents/ at the head of this file.');
+  assert.ok(ppc.surfaceFor('scripts/gds/conductor-dispatch.js'),
+    'the autonomy module was protected through conductor-dispatch.js before this entry. '
+    + 'If that glob is gone, re-derive which modules this registry walls before trusting '
+    + 'the assertion above.');
+});
+
 // Metic is a FLOOR, not a fixed value (task 1003191). Pinning every surface to
 // exactly 'metic' made the registry's own contract untestable and, worse,
 // illegal: governance owns this data and raising one surface to 'archon' is a

package/tests/paste_token_api_base.mjs

@@ -0,0 +1,87 @@
+// tests/paste_token_api_base.mjs — which INSTANCE a pasted CLI token belongs to
+// (task 1003722, re-filed from task 1003312).
+//
+// A bearer is only meaningful against the instance that minted it. paste-token used to
+// decide that entirely by inference — env → the EXISTING session's api_base → branding
+// default — which is correct right up until the builder touches a second instance. The
+// stale api_base then outranks the instance that actually issued the token, so the
+// paste is verified against, and written as, the wrong host. The reported symptom was a
+// token minted on this instance landing as a token for an unrelated one, after which
+// every /builder-* command authenticated somewhere unintended.
+//
+// The hall now stamps the issuer into the paste command, and the flag outranks every
+// inferred source. These exercise the two pure helpers directly rather than scanning
+// the file, because the thing that broke is a DECISION, not a spelling.
+//
+// Run:  node --test tests/paste_token_api_base.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { parseArgs, resolveBaseForPaste } = require(path.join(ROOT, 'scripts', 'gds', 'paste-token.js'));
+
+const STALE = 'https://some-other-instance.example';
+const stale = () => STALE;
+
+test('the flag wins over the inferred base — the whole point of the fix', () => {
+  const r = resolveBaseForPaste({ flag: 'https://cloudbongos.com', resolve: stale });
+  assert.equal(r.base, 'https://cloudbongos.com');
+  assert.equal(r.source, 'flag');
+});
+
+test('no flag keeps the existing resolution exactly as it was', () => {
+  // An older instance's paste command carries no flag. That path must not change, or
+  // this fix trades one wrong-instance bug for another.
+  for (const flag of [undefined, null, '', '   ']) {
+    const r = resolveBaseForPaste({ flag, resolve: stale });
+    assert.equal(r.base, STALE, `flag ${JSON.stringify(flag)} should fall through`);
+    assert.equal(r.source, 'resolved');
+  }
+});
+
+test('a trailing slash is normalised, so the verify URL never doubles it', () => {
+  // API_BASE is concatenated with '/api/bongos/me'; a kept slash makes '//api/...'.
+  assert.equal(resolveBaseForPaste({ flag: 'https://x.example/', resolve: stale }).base, 'https://x.example');
+  assert.equal(resolveBaseForPaste({ flag: 'https://x.example///', resolve: stale }).base, 'https://x.example');
+});
+
+test('a malformed --api-base is refused, never silently ignored', () => {
+  // Refusing matters more than it looks: falling back on a malformed flag would send
+  // the token to the stale host — the exact failure the flag exists to prevent, but
+  // now silent, because the builder believes they named the instance.
+  for (const bad of ['cloudbongos.com', 'ftp://x.example', 'javascript:alert(1)', '/builders', 'https://']) {
+    const r = resolveBaseForPaste({ flag: bad, resolve: stale });
+    assert.equal(r.base, null, `${bad} should not resolve`);
+    assert.equal(r.source, 'invalid');
+  }
+});
+
+test('parseArgs reads the token and both flag spellings', () => {
+  const T = 'a'.repeat(64);
+  assert.deepEqual(parseArgs([T]), { token: T, apiBase: null });
+  assert.deepEqual(parseArgs([T, '--api-base', 'https://x.example']), { token: T, apiBase: 'https://x.example' });
+  assert.deepEqual(parseArgs([T, '--api-base=https://x.example']), { token: T, apiBase: 'https://x.example' });
+  // Order must not matter: the hall composes the command, and a future change to that
+  // string should not be able to break the paste silently.
+  assert.deepEqual(parseArgs(['--api-base', 'https://x.example', T]), { token: T, apiBase: 'https://x.example' });
+});
+
+test('a flag value is never mistaken for the token', () => {
+  // The bug this forecloses: treating argv[2] as the token, as the script used to,
+  // makes `--api-base https://x T` paste the URL as a bearer.
+  assert.equal(parseArgs(['--api-base', 'https://x.example', 'tok']).token, 'tok');
+  assert.equal(parseArgs(['--api-base=https://x.example', 'tok']).token, 'tok');
+});
+
+test('a dangling --api-base does not swallow the token', () => {
+  // `bongos paste-token --api-base` with nothing after it: the flag is empty and
+  // invalid, and main() exits on that rather than pasting whatever followed.
+  const a = parseArgs(['--api-base']);
+  assert.equal(a.apiBase, '');
+  assert.equal(a.token, null);
+});