@bongos/core 1.19.875 → 1.19.876

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.875",
-  "core_contract": "1.19.875",
-  "source_commit": "d1782be0c7671dd7dd82c4f354a77d231fb274be",
+  "core_version": "1.19.876",
+  "core_contract": "1.19.876",
+  "source_commit": "faaa7283a4bba70f85f9eb8659db39b2a673e099",
   "source_ref": "HEAD",
-  "built_at": "2026-09-19T04:13:30.837Z",
+  "built_at": "2026-09-19T04:18:45.980Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 500,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2305,
+    "functional_verbatim": 2306,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2831,
-  "tree_sha256": "1217f7ece32a73d51483fbdd8aabfd37cb8021c9506bca34d253378aedbdd9b3",
+  "file_count": 2832,
+  "tree_sha256": "e510e319efe7ab6f5d4b1964953c53929d02edc31236f7c777c472eac1ed7d80",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2602,7 +2602,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "0d33c3fc850860d87fcb70790d850de2a2be38635fb152dd7d021c6176f67292"
+      "sha256": "d83c5188b30ecc313961e181bd2ec86ea94ab94ef30e995469669b1d4ed889dc"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7352,7 +7352,7 @@
     {
       "path": "modules/security/tests/artifact_scan.mjs",
       "mode": "0000644",
-      "sha256": "dbdc9f017a2a6dff3379c1a0acb08e023278cfb382d91b20a4ec0b5e5f8229b0"
+      "sha256": "ee957538ecc1b0639d631d74bfee043a6c7b8f169bb90f807d99038e84943cb3"
     },
     {
       "path": "modules/security/tests/floor.mjs",
@@ -7362,12 +7362,12 @@
     {
       "path": "modules/security/tests/mirror.mjs",
       "mode": "0000644",
-      "sha256": "fbded0d3f137a62c9f6255297b2aa5752e0dc2a6175ce0e344d461cf59bc53b1"
+      "sha256": "88415123848cc3f9a856104ca4a53db2fd73cdecaa98f8456e3e8369a050f194"
     },
     {
       "path": "modules/security/tests/sanitize_rebuild.mjs",
       "mode": "0000644",
-      "sha256": "4af88247bed3dcb3c12370e48380625871a9b50a0b430a6da34db0ce6d6c8aca"
+      "sha256": "2cec1a9277878d2973838a4ae5dccbd3927a1bd8cfe227227aec01ea29b2ca5e"
     },
     {
       "path": "modules/security/tests/scan_route_schema.mjs",
@@ -7947,12 +7947,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f5357bd73be9ea55bd37f72b3510637906159d36638a1ba23366fda56d93da6e"
+      "sha256": "45ea30974ab43d90bf7b88b4afab20d9bd2c8d8ba80c891e464eab1c1a882aff"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c4516d41236cc62820827c5fed694403aaf255e0e8ad566041ee6397e9eff429"
+      "sha256": "e96760085687e6a0e6a1aa6caf9f011f54eddd43e6229f40140cee9c02332734"
     },
     {
       "path": "public-docs/index.html",
@@ -9037,7 +9037,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "f55da8bbc3fef912cfa99935d35e4c6da1c65a0db52aa81a64c77c520ab60e47"
+      "sha256": "a6881d4f2edeeb200da7ad5953ed790dc24993a46e66cbfc5aa67d48a4e02395"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -9937,7 +9937,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "30eab36a9a6432777dcf0df87512a6d06b40eb03ded24b3119a8ceb231e0cc52"
+      "sha256": "106ce54796bb7d77e5438ef5848f8337927859114b48316ac151ca18f4f0c6be"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13659,6 +13659,11 @@
       "mode": "0000644",
       "sha256": "b86d0d1e0ffeefa07ebda360b129389a02bbcf05296661d56a610c225098d451"
     },
+    {
+      "path": "tests/skip_is_not_pass.mjs",
+      "mode": "0000644",
+      "sha256": "6258b4a3ad76a1d9139b053535c173760c5b42aa82510541501b6fef5ddd1fe1"
+    },
     {
       "path": "tests/smoke_preflight.mjs",
       "mode": "0000644",
@@ -13957,7 +13962,7 @@
     {
       "path": "tests/tool_scan_engine.mjs",
       "mode": "0000644",
-      "sha256": "10a6a41cafcba32406be1aa79e0be1ace1cde2c4163bf0b1a0efd1e5e8f8c403"
+      "sha256": "a0d6e1921069e406071498949c792159cfaefabecddff11ea0eda5359cee549f"
     },
     {
       "path": "tests/touches_overlap.mjs",
@@ -14002,7 +14007,7 @@
     {
       "path": "tests/unit_runner_teardown_abort.mjs",
       "mode": "0000644",
-      "sha256": "b10a938bb1b229ba03e9e8ba80b04e6d8f8686d25a2b71e2cafa50eba63a2b21"
+      "sha256": "d7e9a8e184cf17e889dac7a48f96b5e45f00ab787e79414ebf53bff731bd126d"
     },
     {
       "path": "tests/update_channel.mjs",

package/docs/module-api-changelog.md

@@ -2224,5 +2224,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.873 with no explicit bump. run 35419921833. (task 1002620)
   1.19.875 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.874 with no explicit bump. run 35420682750. (task 1002620)
+  1.19.876 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.875 with no explicit bump. run 35420916304. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/security/tests/artifact_scan.mjs

@@ -31,10 +31,35 @@ const { createQuarantine, siteRefusal, isSyncBacked, isInside, REPO_ROOT, CAPS }
 const { buildManifest, verifyUnchanged, CapExceeded, KIND } = manifest;
 const { validateTargetUrl, hardeningConfig, hardenedEnv, parseLsFiles, fetchArtifact, blockedAddress, assertHostResolvesPublic } = fetchMod;
 
+
+// Test hook (task 1003993): forces the platform-cannot-symlink branch so the skip path is
+// reachable on a box where symlinks work. Throws exactly where fs.symlinkSync would.
+function symlinkOrRefuse(target, link) {
+  if (process.env.BONGOS_TEST_FORCE_NO_SYMLINK === '1') throw new Error('EPERM (forced by BONGOS_TEST_FORCE_NO_SYMLINK)');
+  fs.symlinkSync(target, link);
+}
+
 let passed = 0;
 let failed = 0;
+let skipped = 0;
+
+// A case that did not run is NOT a case that passed (task 1003993). A bare `return` from a
+// case that found its platform unable to do the thing left the harness seeing a callback that
+// did not throw — so it printed `ok` and counted a pass for work never attempted. Returning
+// skipCase(why) instead is the same one-line exit, and it tells the truth.
+const SKIP = Symbol('skip');
+const skipCase = (why) => ({ [SKIP]: why });
+function noteSkip(name, why) {
+  skipped++;
+  console.log(`  SKIP ${name}`);
+  console.log(`     (not run: ${why})`);
+}
 async function test(name, fn) {
-  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  try {
+    const r = await fn();
+    if (r && r[SKIP]) { noteSkip(name, r[SKIP]); return; }
+    passed++; console.log(`  ok  ${name}`);
+  }
   catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
 }
 
@@ -182,10 +207,9 @@ await test('a symlink is recorded by its link text and its target is NEVER opene
   fs.writeFileSync(secret, 'AKIA-SUPER-SECRET-TOKEN\n');
   fs.writeFileSync(path.join(root, 'README.md'), 'hi\n');
   try {
-    fs.symlinkSync(secret, path.join(root, 'stolen'));
+    symlinkOrRefuse(secret, path.join(root, 'stolen'));
   } catch {
-    console.log('     (skipped: this platform/account cannot create symlinks)');
-    return;
+    return skipCase('this platform/account cannot create symlinks');
   }
   const m = await buildManifest(root, { maxFiles: 100, maxBytes: 1e6 });
   const link = m.entries.find((e) => e.path === 'stolen');
@@ -542,11 +566,10 @@ await test('symlinks count against maxFiles too — a cap on regular files only
   const root = mkTmp();
   fs.writeFileSync(path.join(root, 'a.txt'), 'a');
   try {
-    fs.symlinkSync(path.join(root, 'a.txt'), path.join(root, 'l1'));
-    fs.symlinkSync(path.join(root, 'a.txt'), path.join(root, 'l2'));
+    symlinkOrRefuse(path.join(root, 'a.txt'), path.join(root, 'l1'));
+    symlinkOrRefuse(path.join(root, 'a.txt'), path.join(root, 'l2'));
   } catch {
-    console.log('     (skipped: this platform/account cannot create symlinks)');
-    return;
+    return skipCase('this platform/account cannot create symlinks');
   }
   await assert.rejects(() => buildManifest(root, { maxFiles: 2, maxBytes: 1e6 }), /entry cap/);
 });
@@ -588,5 +611,5 @@ await test('CAPS are finite — no accidental unlimited default', async () => {
 
 for (const d of tmpDirs) { try { fs.rmSync(d, { recursive: true, force: true }); } catch { /* best effort */ } }
 
-console.log(`\nartifact_scan: ${passed} passed, ${failed} failed`);
+console.log(`\nartifact_scan: ${passed} passed, ${failed} failed, ${skipped} skipped`);
 if (failed > 0) process.exit(1);

package/modules/security/tests/mirror.mjs

@@ -35,14 +35,35 @@ const { scrubUntrusted, newFenceDelim, FENCE_MARKER, DANGEROUS_CHARS } = fenceLo
 
 let passed = 0;
 let failed = 0;
+let skipped = 0;
+
+// A case that did not run is NOT a case that passed (task 1003993). A bare `return` from a
+// case that found its platform unable to do the thing left the harness seeing a callback that
+// did not throw — so it printed `ok` and counted a pass for work never attempted. Returning
+// skipCase(why) instead is the same one-line exit, and it tells the truth.
+const SKIP = Symbol('skip');
+const skipCase = (why) => ({ [SKIP]: why });
+function noteSkip(name, why) {
+  skipped++;
+  console.log(`  SKIP ${name}`);
+  console.log(`     (not run: ${why})`);
+}
 async function test(name, fn) {
-  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  try {
+    const r = await fn();
+    if (r && r[SKIP]) { noteSkip(name, r[SKIP]); return; }
+    passed++; console.log(`  ok  ${name}`);
+  }
   catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
 }
 
 // Symlink creation needs privileges on some Windows accounts — same skip idiom
 // as artifact_scan.mjs so the suite stays green everywhere.
 function canSymlink(dir) {
+  // Test hook (task 1003993): the skip branch is unreachable on any box that CAN symlink,
+  // which is every CI runner — exactly why the old fake-pass went unnoticed for so long.
+  // tests/skip_is_not_pass.mjs sets this to exercise the skip path anywhere.
+  if (process.env.BONGOS_TEST_FORCE_NO_SYMLINK === '1') return false;
   const target = path.join(dir, 'symlink-probe-target');
   const link = path.join(dir, 'symlink-probe-link');
   try {
@@ -176,7 +197,7 @@ async function run() {
       const rel = `docs/${rlo}evil.md`;
       let wrote = true;
       try { writePristine(pen, rel, 'body'); } catch { wrote = false; }
-      if (!wrote) { console.log('     (skipped: this filesystem refuses bidi filenames)'); return; }
+      if (!wrote) return skipCase('this filesystem refuses bidi filenames');
       const res = await buildMirror({
         pristineDir: pen.pristineDir, mirrorDir: pen.mirrorDir, quarantineRoot: pen.root,
         entries: [fileEntry(rel, 4)],
@@ -313,7 +334,8 @@ async function run() {
       } finally { pen.cleanup(); }
     });
   } else {
-    console.log('     (skipped: this platform/account cannot create symlinks)');
+    noteSkip('a REAL on-disk symlink whose realpath escapes the pen is refused (defense in depth)',
+      'this platform/account cannot create symlinks');
   }
 
   // ---------- the index: the record downstream stages reduce over ----------
@@ -352,5 +374,5 @@ function* walkFiles(dir) {
 }
 
 await run();
-console.log(`\nmirror: ${passed} passed, ${failed} failed`);
+console.log(`\nmirror: ${passed} passed, ${failed} failed, ${skipped} skipped`);
 if (failed > 0) process.exit(1);

package/modules/security/tests/sanitize_rebuild.mjs

@@ -25,11 +25,23 @@ const { excerpt } = require('../artifact-scan/detectors/shared.js');
 
 let passed = 0;
 let failed = 0;
+let skipped = 0;
 async function test(name, fn) {
   try { await fn(); passed++; console.log(`  ok  ${name}`); }
   catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
 }
 
+// A case that did not run is NOT a case that passed (task 1003993). This prints SKIP rather
+// than `ok` and counts separately, so the difference between "verified" and "not attempted"
+// survives into the summary line and into run-unit-tests.js's roll-up. It takes the same
+// `name` the real case would have used, because "which coverage did I lose?" is the only
+// question worth answering here.
+function skip(name, why) {
+  skipped++;
+  console.log(`  SKIP ${name}`);
+  console.log(`     (not run: ${why})`);
+}
+
 const RAW_DANGEROUS_RE = new RegExp(
   '[\\u200b-\\u200f\\u2028\\u2029\\u202a-\\u202e\\u2060\\u2066-\\u2069\\ufeff]|[\\u{e0000}-\\u{e007f}]', 'u');
 
@@ -384,6 +396,11 @@ await test('a failed build leaves NO partial sanitized/ tree, and a retry is sti
 // Symlink creation needs privileges on some Windows accounts — same skip idiom
 // as mirror.mjs / artifact_scan.mjs so the suite stays green everywhere.
 function canSymlink(dir) {
+  // A test hook, because the branch below is unreachable on any box that CAN symlink — which
+  // is every CI runner and most dev machines, and is precisely why the old fake-pass survived
+  // so long unnoticed. tests/skip_is_not_pass.mjs sets this to exercise the skip path on a
+  // platform where the real probe succeeds.
+  if (process.env.BONGOS_TEST_FORCE_NO_SYMLINK === '1') return false;
   const target = path.join(dir, 'probe-target');
   const link = path.join(dir, 'probe-link');
   try {
@@ -434,9 +451,13 @@ function canSymlink(dir) {
       } finally { pen.cleanup(); fs.rmSync(farAway, { recursive: true, force: true }); }
     });
   } else {
-    console.log('  ok  physical-confinement symlink cases');
-    console.log('     (skipped: this platform/account cannot create symlinks)');
-    passed += 2;
+    // These two are the ONLY coverage of physical confinement, so losing them silently is
+    // how task 1003848 reached CI red while this box read 760/760: a change to isInside()
+    // collapsed the lexical/physical staging in sanitize.js, and the cases that would have
+    // caught it had been reporting `ok` without running for as long as anyone could remember.
+    const why = 'this platform/account cannot create symlinks';
+    skip('physical confinement: a real symlink the manifest calls a "file" is refused, and its target never reaches sanitized/', why);
+    skip('physical confinement: a symlink whose realpath escapes the QUARANTINE entirely is refused', why);
   }
 }
 
@@ -495,5 +516,5 @@ await test('an artifact with no docs still yields an honest spec — the no-docs
 });
 
 console.log('');
-console.log(`${passed} passed, ${failed} failed`);
+console.log(`${passed} passed, ${failed} failed, ${skipped} skipped`);
 if (failed > 0) process.exit(1);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.875",
+  "version": "1.19.876",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.875",
+      "version": "1.19.876",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.875",
+  "version": "1.19.876",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -213,12 +213,27 @@ const KNOWN_FAILING = new Set([
 // suites set exitCode rather than hard-exiting, so they do not hit this.
 const LIBUV_TEARDOWN_ABORT = /Assertion failed: !\(handle->flags & UV_HANDLE_CLOSING\)/;
 
+// A suite that reports honest skips ends `N passed, 0 failed, M skipped` (task 1003993), so
+// the optional suffix is part of a clean verdict. Without it, the first suite to start telling
+// the truth about unrun coverage would have its clean verdict read as unrecognised and its
+// Windows teardown abort counted as a real failure — a fix for one honesty bug creating another.
+const CLEAN_VERDICT_RE = /\b[1-9]\d* passed, 0 failed(?:, \d+ skipped)?\s*$/;
+
+// `  SKIP <name>` from a suite's own stdout. Counted here rather than parsed out of the summary
+// line so a suite that prints skips without a summary suffix is still surfaced.
+const SKIP_LINE_RE = /^\s*SKIP\b/;
+
+function countSkips(stdout) {
+  if (!stdout) return 0;
+  return stdout.split('\n').filter((l) => SKIP_LINE_RE.test(l)).length;
+}
+
 function isCleanTeardownAbort(stdout, stderr) {
   if (!LIBUV_TEARDOWN_ABORT.test(stderr)) return false;
   // Line-leading only: a passing case titled "... is FAIL-CLOSED" is not a failure.
   if (/^\s*FAIL\b/m.test(stdout)) return false;
   const lastLine = stdout.trim().split('\n').pop();
-  return /\b[1-9]\d* passed, 0 failed\s*$/.test(lastLine);
+  return CLEAN_VERDICT_RE.test(lastLine);
 }
 
 // The failing tests as ONE line, for the `unit-report` commit status the workflow
@@ -427,9 +442,13 @@ function main() {
 
   const failures = [];
   const teardownAborts = [];
+  // A GREEN suite that skipped cases is the shape this roll-up used to hide: the suite said so
+  // on its own stdout, which was discarded on success, so the only visible line was `ok` and a
+  // session reading the roll-up could not tell exercised coverage from absent coverage.
+  const skipped = [];
   const runOne = (displayName, filePath) => {
     try {
-      execFileSync(process.execPath, [filePath], {
+      const out = execFileSync(process.execPath, [filePath], {
         // task 1002644: stdout used to be IGNORED, so the failing assertion (test
         // files print their FAIL lines to stdout) was discarded and the only
         // context shown was the last 3 STDERR lines — often stale diagnostic
@@ -441,7 +460,9 @@ function main() {
         timeout: perTestTimeout,
         env: { ...process.env, NODE_ENV: 'test' },
       });
-      console.log(`  ok    ${displayName}`);
+      const n = countSkips(out ? out.toString() : '');
+      if (n) skipped.push({ name: displayName, n });
+      console.log(`  ok    ${displayName}${n ? ` (${n} SKIPPED — not run on this platform)` : ''}`);
     } catch (err) {
       const why = err.killed ? 'TIMEOUT' : `exit ${err.status}`;
       const stdoutText = (err.stdout ? err.stdout.toString() : '').trim();
@@ -492,6 +513,11 @@ function main() {
   if (teardownAborts.length) {
     console.log(`${label}: ${teardownAborts.length} passed but aborted in libuv teardown (not failures; task 1003845) — ${teardownAborts.join(', ')}`);
   }
+  if (skipped.length) {
+    const n = skipped.reduce((sum, s) => sum + s.n, 0);
+    console.log(`${label}: ${n} case(s) NOT RUN on this platform — ${skipped.map((s) => `${s.name} (${s.n})`).join(', ')}`);
+    console.log(`${label}: a skipped case is not a passing one. Green here does not mean that coverage was exercised.`);
+  }
   reportToWorkflow(failures);
   if (failures.length === 0) {
     console.log(`${label}: all ${total} passed.`);
@@ -503,4 +529,4 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { discoverModuleTests, isCleanTeardownAbort, describeFailures, STATUS_DESCRIPTION_MAX, INTEGRATION, INTEGRATION_PARKED, KNOWN_FAILING };
+module.exports = { discoverModuleTests, isCleanTeardownAbort, countSkips, describeFailures, STATUS_DESCRIPTION_MAX, INTEGRATION, INTEGRATION_PARKED, KNOWN_FAILING };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.875'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.876'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/skip_is_not_pass.mjs

@@ -0,0 +1,121 @@
+// tests/skip_is_not_pass.mjs
+//
+// A case that did not run is not a case that passed (task 1003993).
+//
+// modules/security/tests/sanitize_rebuild.mjs gated its two physical-confinement symlink
+// cases behind canSymlink() and, in the else-branch, printed `ok` and did `passed += 2`.
+// So on any machine that cannot create symlinks — the Windows dev box, a container without
+// CAP_SYMLINK, a non-admin account — the suite reported two passes for two cases that never
+// ran, and those two are the ONLY coverage of physical confinement.
+//
+// It was not cosmetic. On task 1003848 a change to isInside() in quarantine.js made
+// containment resolve symlinks, collapsing the deliberate lexical-then-physical staging in
+// sanitize.js so the specific refusals became unreachable. The local suite read 760/760; CI
+// went red on Linux, where those cases actually run. A whole session was spent re-deriving
+// what the suite already knew and had reported as "ok".
+//
+// THE AUDIT THE TASK ASKED FOR FOUND FOUR MORE, in a second and more common shape: a bare
+// `return` from inside the case's own callback. The harness sees a callback that did not
+// throw, so it prints `ok` and counts a pass — the identical lie, written differently. Both
+// shapes are fixed, and all four suites are covered below by one invariant.
+//
+// The branch under test is unreachable wherever symlinks work, which is every CI runner and
+// most dev machines — which is exactly how these survived. BONGOS_TEST_FORCE_NO_SYMLINK
+// exists so the skip paths can be exercised anywhere.
+//
+// Run:  node --test tests/skip_is_not_pass.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { execFileSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { countSkips } from '../scripts/gds/run-unit-tests.js';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// Every suite whose coverage can go missing on a platform that refuses symlinks, with how
+// many cases each one loses. The counts are the point: they are what a fake pass hides.
+const SUITES = [
+  { file: 'modules/security/tests/sanitize_rebuild.mjs', skips: 2 },
+  { file: 'modules/security/tests/artifact_scan.mjs', skips: 2 },
+  { file: 'tests/tool_scan_engine.mjs', skips: 2 },
+  { file: 'modules/security/tests/mirror.mjs', skips: 1 },
+];
+
+function runSuite(file, { forceNoSymlink }) {
+  const env = { ...process.env, NODE_ENV: 'test' };
+  if (forceNoSymlink) env.BONGOS_TEST_FORCE_NO_SYMLINK = '1';
+  else delete env.BONGOS_TEST_FORCE_NO_SYMLINK;
+  // A skip must never be an error exit — execFileSync throws on non-zero, so reaching the
+  // parse below is itself the assertion that skipping did not fail the suite.
+  const stdout = execFileSync(process.execPath, [path.join(ROOT, file)], {
+    env, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024,
+  });
+  const summary = stdout.trim().split('\n').pop();
+  const m = summary.match(/(\d+) passed, (\d+) failed, (\d+) skipped\s*$/);
+  assert.ok(m, `${file}: summary must carry all three counts, got: ${JSON.stringify(summary)}`);
+  return { stdout, summary, passed: Number(m[1]), failed: Number(m[2]), skipped: Number(m[3]) };
+}
+
+for (const { file, skips } of SUITES) {
+  test(`${file}: unrun cases are reported as SKIPPED, not passed`, () => {
+    const r = runSuite(file, { forceNoSymlink: true });
+    assert.equal(r.skipped, skips, 'every unrun case must be counted as skipped');
+    assert.equal(r.failed, 0, 'a skip is not a failure');
+  });
+
+  test(`${file}: THE BUG — skipped cases no longer inflate the passed count`, () => {
+    // The heart of it. Under the old code BOTH runs printed the same pass count: the cases
+    // that did not run were indistinguishable from the ones that did. If these two ever
+    // agree again, the fake pass is back, whatever the summary line claims.
+    const ran = runSuite(file, { forceNoSymlink: false });
+    const skippedRun = runSuite(file, { forceNoSymlink: true });
+
+    assert.equal(ran.skipped, 0, 'where symlinks work, nothing is skipped');
+    assert.equal(skippedRun.passed, ran.passed - skips,
+      `skipping ${skips} case(s) must LOWER the pass count by exactly ${skips} `
+      + `(ran: ${ran.passed}, skipped-run: ${skippedRun.passed})`);
+    assert.equal(skippedRun.passed + skippedRun.skipped, ran.passed,
+      'passed + skipped must account for every case either way');
+  });
+
+  test(`${file}: the skip names what was lost and never claims "ok"`, () => {
+    const r = runSuite(file, { forceNoSymlink: true });
+    const skipLines = r.stdout.split('\n').filter((l) => /^\s*SKIP\b/.test(l));
+    assert.equal(skipLines.length, skips, 'one SKIP line per unrun case');
+    for (const l of skipLines) {
+      assert.ok(l.trim().length > 'SKIP'.length + 8,
+        `a SKIP line must name the case, got: ${JSON.stringify(l)}`);
+    }
+    assert.ok(/not run:/.test(r.stdout), 'the reason must be stated, not merely implied');
+    assert.ok(
+      !/^\s*ok\s+physical-confinement/m.test(r.stdout),
+      'the old fake-pass line ("ok  physical-confinement symlink cases") must not come back',
+    );
+  });
+}
+
+test('sanitize_rebuild names both physical-confinement cases it lost', () => {
+  // The two that matter most: they are the ONLY coverage of physical confinement, and the
+  // pair whose silent absence let task 1003848 reach CI red.
+  const r = runSuite('modules/security/tests/sanitize_rebuild.mjs', { forceNoSymlink: true });
+  const skipLines = r.stdout.split('\n').filter((l) => /^\s*SKIP\b/.test(l));
+  assert.ok(
+    skipLines.some((l) => /manifest calls a "file"/.test(l)),
+    'the manifest-lies-about-a-symlink case must be named',
+  );
+  assert.ok(
+    skipLines.some((l) => /realpath escapes the QUARANTINE/.test(l)),
+    'the escaping-realpath case must be named',
+  );
+});
+
+test('the runner counts those SKIP lines, so a green roll-up still says coverage was not exercised', () => {
+  const r = runSuite('modules/security/tests/sanitize_rebuild.mjs', { forceNoSymlink: true });
+  assert.equal(countSkips(r.stdout), 2);
+  assert.equal(countSkips('  ok  a\n  ok  b\n\n2 passed, 0 failed, 0 skipped\n'), 0);
+  // Line-leading only, the same discipline isCleanTeardownAbort uses for FAIL: a case whose
+  // NAME contains the word must not be miscounted.
+  assert.equal(countSkips('  ok  refuses to SKIP a dangerous entry\n'), 0);
+});

package/tests/tool_scan_engine.mjs

@@ -53,8 +53,25 @@ const { normalizeScanPayload } = require(path.join(ROOT, '..', 'modules', 'secur
 
 let passed = 0;
 let failed = 0;
+let skipped = 0;
+
+// A case that did not run is NOT a case that passed (task 1003993). A bare `return` from a
+// case that found its platform unable to do the thing left the harness seeing a callback that
+// did not throw — so it printed `ok` and counted a pass for work never attempted. Returning
+// skipCase(why) instead is the same one-line exit, and it tells the truth.
+const SKIP = Symbol('skip');
+const skipCase = (why) => ({ [SKIP]: why });
+function noteSkip(name, why) {
+  skipped++;
+  console.log(`  SKIP ${name}`);
+  console.log(`     (not run: ${why})`);
+}
 async function test(name, fn) {
-  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  try {
+    const r = await fn();
+    if (r && r[SKIP]) { noteSkip(name, r[SKIP]); return; }
+    passed++; console.log(`  ok  ${name}`);
+  }
   catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
 }
 
@@ -118,6 +135,10 @@ function materializeMalicious({ persuasion = true } = {}) {
   fs.writeFileSync(credTarget, `[default]\naws_secret_access_key = ${sentinel}\n`, 'utf8');
   let linked = false;
   try {
+    // Test hook (task 1003993): the two cases guarded by `linked` are the containment proof,
+    // and they used to report `ok` when they did not run. This forces that branch so the skip
+    // path is reachable on a box where symlinks work — see tests/skip_is_not_pass.mjs.
+    if (process.env.BONGOS_TEST_FORCE_NO_SYMLINK === '1') throw new Error('EPERM (forced)');
     fs.symlinkSync(credTarget, path.join(q.pristineDir, 'home-creds'));
     linked = true;
   } catch { /* platform/account cannot create symlinks — guarded at call sites */ }
@@ -216,7 +237,7 @@ await test('fixture A verdict is BYTE-IDENTICAL with the persuasion prose delete
 
 await test('fixture A: the credential sentinel reaches NO mirror file, report, manifest, or row', async () => {
   const { q, sentinel, linked } = materializeMalicious();
-  if (!linked) { console.log('     (skipped: this platform/account cannot create symlinks)'); return; }
+  if (!linked) return skipCase('this platform/account cannot create symlinks');
 
   const lenses = healthyPanel();
   const { manifest, mirror, floorReport, reportPath, reduced } = await scan(q, { lenses });
@@ -257,7 +278,7 @@ await test('fixture A: the credential sentinel reaches NO mirror file, report, m
 
 await test('fixture A: the symlink is recorded but NEVER followed', async () => {
   const { q, credTarget, sentinel, linked } = materializeMalicious();
-  if (!linked) { console.log('     (skipped: this platform/account cannot create symlinks)'); return; }
+  if (!linked) return skipCase('this platform/account cannot create symlinks');
 
   const { manifest, mirror } = await scan(q);
   const link = manifest.entries.find((e) => e.path === 'home-creds');
@@ -342,5 +363,5 @@ await test('teardown leaves none of this run\'s temp dirs behind', () => {
 });
 
 console.log('');
-console.log(`tool_scan_engine: ${passed} passed, ${failed} failed`);
+console.log(`tool_scan_engine: ${passed} passed, ${failed} failed, ${skipped} skipped`);
 if (failed > 0) process.exit(1);

package/tests/unit_runner_teardown_abort.mjs

@@ -65,3 +65,40 @@ test('the verdict must be the LAST thing the suite printed', () => {
 test('a suite that asserted nothing is not vouched for', () => {
   assert.equal(isCleanTeardownAbort('\n0 passed, 0 failed\n', ABORT_76), false);
 });
+
+// ---------------------------------------------------------------------------
+// task 1003993 — a suite that reports honest skips still has a CLEAN verdict.
+//
+// The predicate above anchors on the summary line. When sanitize_rebuild.mjs stopped
+// counting two unrun symlink cases as passes, its summary grew a `, 2 skipped` suffix —
+// and an unchanged predicate would have stopped recognising it, turning that suite's
+// Windows teardown abort into a reported failure. One honesty fix must not create the
+// next false signal, so the suffix is pinned here.
+
+test('a verdict carrying a skip count is still clean', () => {
+  assert.equal(
+    isCleanTeardownAbort('  ok  a\n\n27 passed, 0 failed, 2 skipped\n', ABORT_76),
+    true,
+  );
+});
+
+test('a zero-skip suffix is clean too (the shape is printed unconditionally)', () => {
+  assert.equal(
+    isCleanTeardownAbort('  ok  a\n\n29 passed, 0 failed, 0 skipped\n', ABORT_94),
+    true,
+  );
+});
+
+test('skips do not launder a FAILING verdict into teardown noise', () => {
+  assert.equal(
+    isCleanTeardownAbort('  ok  a\n\n27 passed, 1 failed, 2 skipped\n', ABORT_76),
+    false,
+  );
+});
+
+test('a suite that ONLY skipped has no passes, so it is not a clean verdict', () => {
+  assert.equal(
+    isCleanTeardownAbort('  SKIP a\n\n0 passed, 0 failed, 2 skipped\n', ABORT_76),
+    false,
+  );
+});