@bongos/core 1.19.880 → 1.19.882

package/tests/box_ship_permissions.mjs

@@ -6,6 +6,12 @@
 // dead-ended on `node scripts/gds/ship.js` at the auto classifier; this guards
 // against that allow-rule being silently dropped.
 //
+// task 1004014: every check below runs once per SHELL TOOL. Claude Code's shell tool is
+// `Bash` on a Mac or Linux box and `PowerShell` on a Windows laptop, and a `Bash(...)`
+// rule says nothing about a PowerShell command — so a Windows session met the prompt
+// on every routine read. The list of tools is `.claude/hooks/shell-tools.js`, the same
+// one the guards read: a rule may only exist for a tool git-guard and secret-gate see.
+//
 // Run:  node tests/box_ship_permissions.mjs
 
 import { strict as assert } from 'node:assert';
@@ -20,6 +26,7 @@ const settingsPath = path.join(__dirname, '..', '.claude', 'settings.json');
 skipUnlessPresent('.claude/settings.json');
 const require = createRequire(import.meta.url);
 const guard = requireHostModule(require, '../.claude/hooks/git-guard.js');
+const { SHELL_TOOLS } = requireHostModule(require, '../.claude/hooks/shell-tools.js');
 const { STARTER_ALLOW, bongosify } = require('../scripts/gds/claude-materialize.js');
 
 let passed = 0, failed = 0;
@@ -27,26 +34,30 @@ function test(name, fn) {
   try { fn(); passed++; console.log(`  ok  ${name}`); }
   catch (err) { failed++; console.log(`  FAIL ${name}\n     ${err.message}`); }
 }
+// One case per shell tool, named for it, so a failure says WHICH tool's rules are wrong.
+function perTool(name, fn) {
+  for (const tool of SHELL_TOOLS) test(`[${tool}] ${name}`, () => fn(tool));
+}
 
 const raw = fs.readFileSync(settingsPath, 'utf8');
 let settings;
 test('.claude/settings.json is valid JSON', () => {
   settings = JSON.parse(raw);
 });
+const allowList = () => (settings.permissions && settings.permissions.allow) || [];
 
-test('permissions.allow pre-allows the blessed ship/claim/reauth scripts (box auto-mode would deny them otherwise)', () => {
-  const allow = (settings.permissions && settings.permissions.allow) || [];
+perTool('permissions.allow pre-allows the blessed ship/claim/reauth scripts (auto-mode would deny them otherwise)', (tool) => {
+  const allow = allowList();
   // The exact command the #1027 nightmare hard-stopped on:
-  assert.ok(allow.includes('Bash(node scripts/gds/ship.js:*)'),
-    'ship.js MUST be pre-allowed — a dev box cannot complete a ship if its own classifier denies the command');
-  // The rest of the core ship loop a box runs hands-free:
+  assert.ok(allow.includes(`${tool}(node scripts/gds/ship.js:*)`),
+    'ship.js MUST be pre-allowed — a session cannot complete a ship if its own classifier denies the command');
+  // The rest of the core ship loop a session runs hands-free:
   for (const s of ['claim', 'reauth', 'release', 'paste-token']) {
-    assert.ok(allow.includes(`Bash(node scripts/gds/${s}.js:*)`), `${s}.js should be pre-allowed`);
+    assert.ok(allow.includes(`${tool}(node scripts/gds/${s}.js:*)`), `${s}.js should be pre-allowed`);
   }
 });
 
-test('permissions.allow pre-allows the generic GDS API channel api.js (auto-mode denies the whole autonomous GDS loop otherwise)', () => {
-  const allow = (settings.permissions && settings.permissions.allow) || [];
+perTool('permissions.allow pre-allows the generic GDS API channel api.js (auto-mode denies the whole autonomous GDS loop otherwise)', (tool) => {
   // task 1716 (completes 1051): every GDS operation without a dedicated script —
   // idea-triage promote, create-task, blocker-resolve, criterion ratify, goal
   // create, cost-via-API, security reports — rides the generic caller
@@ -57,18 +68,18 @@ test('permissions.allow pre-allows the generic GDS API channel api.js (auto-mode
   // GDS server enforces builders.rank on every request (ADR 0016), so this rule
   // grants nothing beyond the caller's rank; it removes a redundant, weaker,
   // wrong harness prompt (owner-decided 2026-07-02, ADR 0104).
-  assert.ok(allow.includes('Bash(node scripts/gds/api.js:*)'),
+  assert.ok(allowList().includes(`${tool}(node scripts/gds/api.js:*)`),
     'api.js MUST be pre-allowed — the autonomous GDS loop (promote/create-task/blocker-resolve/cost) rides this generic channel; auto-mode denies it otherwise');
 });
 
+const SCRIPT_RULE = new RegExp(String.raw`^(${SHELL_TOOLS.join('|')})\(node scripts\/gds\/([a-z-]+)\.js:\*\)$`);
+
 test('every allow-rule points at a script that actually exists (no inert rules)', () => {
-  const allow = (settings.permissions && settings.permissions.allow) || [];
-  const re = /^Bash\(node (scripts\/gds\/[a-z-]+\.js):\*\)$/;
-  for (const rule of allow) {
-    const m = rule.match(re);
+  for (const rule of allowList()) {
+    const m = rule.match(SCRIPT_RULE);
     if (!m) continue; // only audit the gds-script rules
-    const p = path.join(__dirname, '..', m[1]);
-    assert.ok(fs.existsSync(p), `allow-rule references a missing script: ${m[1]}`);
+    const p = path.join(__dirname, '..', 'scripts', 'gds', `${m[2]}.js`);
+    assert.ok(fs.existsSync(p), `allow-rule references a missing script: ${m[2]}.js`);
   }
 });
 
@@ -79,24 +90,32 @@ test('every allow-rule points at a script that actually exists (no inert rules)'
 // git-guard blocks, and must stay read-only.
 // ---------------------------------------------------------------------------
 
-// How Claude Code reads a Bash rule: `Bash(x:*)` covers x and anything starting
-// "x "; `Bash(x)` covers exactly x. A chained command is covered only when every
-// part is, so `git status && git stash` is not covered by a `git status` rule.
-function ruleCovers(rule, part) {
-  const m = rule.match(/^Bash\((.*?)(:\*)?\)$/);
-  if (!m) return false;
-  return part === m[1] || (Boolean(m[2]) && part.startsWith(`${m[1]} `));
+// How Claude Code reads a shell rule: `Tool(x:*)` covers x and anything starting
+// "x "; `Tool(x)` covers exactly x. A chained or piped command is covered only when
+// every part is, so `git status && git stash` is not covered by a `git status` rule.
+// PowerShell rules match case-INSENSITIVELY (documented), which matters here because
+// git's own flags do not: `-d` and `-D` are different commands.
+//
+// WHAT THIS MODEL IS NOT. It knows rule shape, separators and case folding — nothing else. It
+// reads `git status $(…)`, `$env:X=…; node …` and `gh pr view 1 > x` as covered, where the real
+// client asks for each whatever the allow-list says (ADR 0304's amendment records where that was
+// read). So no such sample is listed: it would be red here for a command that does prompt.
+function ruleCovers(rule, part, tool) {
+  const m = rule.match(/^(\w+)\((.*?)(:\*)?\)$/);
+  if (!m || m[1] !== tool) return false;
+  const fold = (s) => (tool === 'PowerShell' ? s.toLowerCase() : s);
+  return fold(part) === fold(m[2]) || (Boolean(m[3]) && fold(part).startsWith(`${fold(m[2])} `));
 }
-function allowCovers(allow, command) {
+function allowCovers(allow, command, tool) {
   const parts = command.split(/&&|\|\||[;|&\n]/).map((s) => s.trim()).filter(Boolean);
-  return parts.every((part) => allow.some((rule) => ruleCovers(rule, part)));
+  return parts.every((part) => allow.some((rule) => ruleCovers(rule, part, tool)));
 }
-const isBlocked = (command) => guard.decide({ tool_name: 'Bash', tool_input: { command } }, {}).block;
-const isBlockedPwsh = (command) => guard.decide({ tool_name: 'PowerShell', tool_input: { command } }, {}).block;
+const isBlocked = (command, tool) => guard.decide({ tool_name: tool, tool_input: { command } }, {}).block;
+const isBlockedPwsh = (command) => isBlocked(command, 'PowerShell');
 
 // At least one sample per git-guard rule, keyed by the rule's own name.
 const BLOCKED_SAMPLES = {
-  'git stash': ['git stash', 'git stash pop', 'git stash push -m wip', 'git status && git stash'],
+  'git stash': ['git stash', 'git stash pop', 'git stash push -m wip', 'git status && git stash', 'git status; git stash'],
   'git worktree remove': ['git worktree remove ../wt', 'git worktree remove --force ../wt'],
   'git push origin main': ['git push origin main', 'git push -u origin HEAD:main', 'git push --force origin task-1:main'],
   'git branch -D': ['git branch -D task-1', 'git branch --list -D task-1', 'git branch -a -D task-1'],
@@ -114,13 +133,20 @@ const BLOCKED_SAMPLES_PWSH = {
   'git branch -D': ['GIT branch -D task-1', 'Git.exe branch -a -D task-1'],
 };
 
-test('every git-guard rule has blocked samples here (a new rule forces a new sample)', () => {
+// MERGE NOTE (task 1004052 strand walk). Two rounds built PowerShell coverage from
+// opposite ends and collided here: task 1004014 made every case in this file run once
+// per tool (`perTool`), and task 1004028 added the sample set above, arguing correctly
+// that a Bash-shaped string replayed against PowerShell only re-proves the spelling that
+// already matched. Neither supersedes the other — 1004014 is breadth (eight cases, both
+// tools), 1004028 is depth (one case, in spellings only PowerShell resolves). Both are
+// kept: the per-tool wrapper stays, and the PowerShell-spelled set is asserted inside it.
+perTool('every git-guard rule has blocked samples here (a new rule forces a new sample)', (tool) => {
   for (const [name] of guard.RULES) {
     assert.ok((BLOCKED_SAMPLES[name] || []).length, `no blocked sample for git-guard rule "${name}"`);
     assert.ok((BLOCKED_SAMPLES_PWSH[name] || []).length, `no PowerShell-spelled sample for git-guard rule "${name}"`);
   }
   for (const samples of Object.values(BLOCKED_SAMPLES)) {
-    for (const cmd of samples) assert.ok(isBlocked(cmd), `sample is not actually blocked by git-guard: ${cmd}`);
+    for (const cmd of samples) assert.ok(isBlocked(cmd, tool), `sample is not actually blocked by git-guard: ${cmd}`);
   }
   for (const samples of Object.values(BLOCKED_SAMPLES_PWSH)) {
     for (const cmd of samples) {
@@ -140,36 +166,50 @@ test('the PowerShell samples are genuinely different spellings, not a copy', ()
   }
 });
 
-test('no allow-rule covers a command git-guard blocks', () => {
-  const allow = settings.permissions.allow;
+perTool('no allow-rule covers a command git-guard blocks', (tool) => {
+  const allow = allowList();
   for (const rule of allow) {
-    const text = rule.replace(/^Bash\(/, '').replace(/(:\*)?\)$/, '');
-    assert.ok(!isBlocked(text), `allow-rule is itself a git-guard-blocked command: ${rule}`);
+    const m = rule.match(/^(\w+)\((.*?)(:\*)?\)$/);
+    if (m && m[1] === tool) assert.ok(!isBlocked(m[2], tool), `allow-rule is itself a git-guard-blocked command: ${rule}`);
   }
   for (const cmd of Object.values(BLOCKED_SAMPLES).flat()) {
-    assert.ok(!allowCovers(allow, cmd), `an allow-rule covers a git-guard-blocked command: ${cmd}`);
+    assert.ok(!allowCovers(allow, cmd, tool), `an allow-rule covers a git-guard-blocked command: ${cmd}`);
   }
 });
 
-test('the check has teeth: a too-broad git rule IS caught', () => {
+perTool('the check has teeth: a too-broad git rule IS caught', (tool) => {
   const samples = Object.values(BLOCKED_SAMPLES).flat();
-  for (const broad of ['Bash(git:*)', 'Bash(git stash:*)', 'Bash(git worktree:*)', 'Bash(git push:*)', 'Bash(git branch:*)', 'Bash(git branch --list:*)']) {
-    assert.ok(samples.some((cmd) => allowCovers([broad], cmd)), `${broad} should cover a blocked sample`);
+  for (const broad of ['git:*', 'git stash:*', 'git worktree:*', 'git push:*', 'git branch:*', 'git branch --list:*']) {
+    assert.ok(samples.some((cmd) => allowCovers([`${tool}(${broad})`], cmd, tool)), `${tool}(${broad}) should cover a blocked sample`);
   }
 });
 
-// The whole git/gh allow-list, pinned. A flag can turn a read into a write or an
-// exec (`git fetch --upload-pack=<cmd>`, `git fetch origin x:main`, `git branch -D`),
-// so `branch` and `fetch` appear only as the exact commands a session runs.
+test('teeth: a rule for one shell tool covers nothing run by the other', () => {
+  assert.equal(allowCovers(['Bash(git status:*)'], 'git status', 'PowerShell'), false);
+  assert.equal(allowCovers(['PowerShell(git status:*)'], 'git status', 'Bash'), false);
+});
+
+test('teeth: a PowerShell rule matches case-insensitively, a Bash rule does not', () => {
+  assert.equal(allowCovers(['PowerShell(git branch -d:*)'], 'git branch -D task-1', 'PowerShell'), true,
+    'this is why no PowerShell rule may sit next to a flag whose other case is a different command');
+  assert.equal(allowCovers(['Bash(git branch -d:*)'], 'git branch -D task-1', 'Bash'), false);
+});
+
+// The whole git/gh allow-list, pinned — once, and carried by every shell tool. A flag
+// can turn a read into a write or an exec (`git fetch --upload-pack=<cmd>`,
+// `git fetch origin x:main`, `git branch -D`), so `branch` and `fetch` appear only as
+// the exact commands a session runs.
 //
 // NO `git diff|log|show` rule, on purpose. Claude Code already runs their read-only
-// forms without a prompt in every mode and checks their flags; a prefix rule would
-// switch that check off (see WRITES_DRESSED_AS_READS below — both were reproduced).
-const GIT_GH_RULES = [
-  'Bash(git status:*)',
-  'Bash(git branch --list)', 'Bash(git branch --show-current)', 'Bash(git branch -a)', 'Bash(git branch -vv)',
-  'Bash(git fetch)', 'Bash(git fetch origin)', 'Bash(git fetch origin main)',
-  'Bash(gh pr view:*)', 'Bash(gh pr checks:*)', 'Bash(gh pr list:*)', 'Bash(gh run view:*)', 'Bash(gh run list:*)',
+// forms without a prompt and checks their flags; a prefix rule would switch that check
+// off (see WRITES_DRESSED_AS_READS below — both were reproduced). That holds for the
+// PowerShell tool too: it has its own built-in read-only handling, and an allow-rule is
+// matched before it.
+const GIT_GH_COMMANDS = [
+  'git status:*',
+  'git branch --list', 'git branch --show-current', 'git branch -a', 'git branch -vv',
+  'git fetch', 'git fetch origin', 'git fetch origin main',
+  'gh pr view:*', 'gh pr checks:*', 'gh pr list:*', 'gh run view:*', 'gh run list:*',
 ];
 // gds CLIs audited read-only under EVERY flag they take — a prefix rule allows them all.
 // Audited and left OUT: backlog-review.js (POSTs from its default walk) and
@@ -178,12 +218,44 @@ const READ_ONLY_CLIS = ['start', 'status', 'recall', 'me', 'doctor', 'preflight'
   'ship-check', 'fitness', 'strand-watch', 'stale-worktrees', 'read-session-export'];
 const BLESSED_WRITERS = ['ship', 'claim', 'reauth', 'release', 'paste-token', 'api']; // tasks 1051 / 1716
 
-const SCRIPT_RULE = /^Bash\(node scripts\/gds\/([a-z-]+)\.js:\*\)$/;
-
-test('every allow-rule that is not a gds script is in the pinned git/gh set (adding one is a deliberate edit here)', () => {
+perTool('every allow-rule that is not a gds script is in the pinned git/gh set (adding one is a deliberate edit here)', (tool) => {
   // Catches `Bash(gh:*)`, `Bash(gh *)`, `Bash(git -C x status:*)`, a bare `Bash` — anything unlisted.
-  const rest = settings.permissions.allow.filter((rule) => !SCRIPT_RULE.test(rule));
-  assert.deepEqual([...rest].sort(), [...GIT_GH_RULES].sort());
+  const rest = allowList().filter((rule) => rule.startsWith(`${tool}(`) || rule === tool).filter((rule) => !SCRIPT_RULE.test(rule));
+  assert.deepEqual([...rest].sort(), GIT_GH_COMMANDS.map((c) => `${tool}(${c})`).sort());
+});
+
+test('every allow-rule belongs to a shell tool the guards see, and every tool carries the SAME list', () => {
+  // A rule for a tool outside SHELL_TOOLS would pre-allow commands git-guard and
+  // secret-gate never look at — allowing first and guarding second (ADR 0304).
+  const byTool = new Map(SHELL_TOOLS.map((tool) => [tool, []]));
+  for (const rule of allowList()) {
+    const m = rule.match(/^(\w+)\((.*)\)$/);
+    assert.ok(m && byTool.has(m[1]), `allow-rule is not for a guarded shell tool: ${rule}`);
+    byTool.get(m[1]).push(m[2]);
+  }
+  const [first, ...others] = SHELL_TOOLS;
+  for (const tool of others) {
+    assert.deepEqual([...byTool.get(tool)].sort(), [...byTool.get(first)].sort(),
+      `${tool} and ${first} must pre-allow the same commands — a twin that drifts is a prompt on one machine only`);
+  }
+});
+
+test('the RESTRICTIVE lists are twinned too: a shell command denied for one tool is denied for every tool', () => {
+  // The half that matters more. A deny with no twin is a hard stop on a Linux box and nothing at
+  // all on a Windows laptop — and git-guard, the only other barrier, is cooperative and fails open.
+  const shellRule = new RegExp(String.raw`^(${SHELL_TOOLS.join('|')})\((.*)\)$`);
+  for (const key of ['deny', 'ask']) {
+    const byTool = new Map(SHELL_TOOLS.map((tool) => [tool, []]));
+    for (const rule of settings.permissions[key] || []) {
+      const m = rule.match(shellRule);
+      if (m) byTool.get(m[1]).push(m[2]); // Read(...) and the rest are not shell rules
+    }
+    const [first, ...others] = SHELL_TOOLS;
+    for (const tool of others) {
+      assert.deepEqual([...byTool.get(tool)].sort(), [...byTool.get(first)].sort(), `permissions.${key}: ${tool} vs ${first}`);
+    }
+  }
+  assert.ok(settings.permissions.deny.includes('PowerShell(git stash:*)'), 'the one shell deny this repo carries');
 });
 
 // "Read" commands whose flags write a file, read one the Read deny-list protects,
@@ -195,36 +267,45 @@ const WRITES_DRESSED_AS_READS = [
   'git diff --no-index -- /dev/null .env',
   'git fetch --upload-pack=./x origin',
   'git fetch origin task-1:main',
+  // a read piped or chained into something that writes or executes: every part must be covered
+  'git status | Out-File -FilePath .git/hooks/pre-push',
+  'gh pr view 1 --json body -q .body | Set-Content .git/hooks/pre-push',
+  'gh pr view 1 --json body -q .body | Invoke-Expression',
+  'gh pr list | iex',
+  'git status; Remove-Item -Recurse -Force src',
+  'gh pr view 1 | tee .git/hooks/pre-push',
 ];
 
-test('no allow-rule lets a write dressed as a read through (--output, --no-index, --upload-pack, a refspec)', () => {
+perTool('no allow-rule lets a write dressed as a read through (--output, --no-index, --upload-pack, a refspec, a pipe into a writer)', (tool) => {
   for (const cmd of WRITES_DRESSED_AS_READS) {
-    assert.ok(!allowCovers(settings.permissions.allow, cmd), `runs without a prompt: ${cmd}`);
+    assert.ok(!allowCovers(allowList(), cmd, tool), `runs without a prompt: ${cmd}`);
   }
   // Teeth: the prefix rules this list deliberately does NOT carry would let them through.
-  const tempting = ['Bash(git log:*)', 'Bash(git show:*)', 'Bash(git diff:*)', 'Bash(git fetch:*)'];
-  for (const cmd of WRITES_DRESSED_AS_READS) assert.ok(allowCovers(tempting, cmd), `teeth: ${cmd}`);
+  const tempting = ['git log:*', 'git show:*', 'git diff:*', 'git fetch:*', 'Out-File:*', 'Set-Content:*',
+    'Invoke-Expression:*', 'iex:*', 'Remove-Item:*', 'tee:*'].map((c) => `${tool}(${c})`);
+  for (const cmd of WRITES_DRESSED_AS_READS) {
+    assert.ok(allowCovers([...allowList(), ...tempting], cmd, tool), `teeth: ${cmd}`);
+  }
 });
 
 test('every gds-script allow-rule is a blessed writer or an audited read-only CLI', () => {
   const known = new Set([...BLESSED_WRITERS, ...READ_ONLY_CLIS]);
-  for (const rule of settings.permissions.allow) {
+  for (const rule of allowList()) {
     const m = rule.match(SCRIPT_RULE);
-    if (m) assert.ok(known.has(m[1]), `${m[1]}.js is pre-allowed but not audited here — a prefix rule allows every flag it takes`);
+    if (m) assert.ok(known.has(m[2]), `${m[2]}.js is pre-allowed but not audited here — a prefix rule allows every flag it takes`);
   }
 });
 
-test('the read-only subset is pre-allowed', () => {
-  const allow = settings.permissions.allow;
+perTool('the read-only subset is pre-allowed', (tool) => {
   for (const cmd of ['git status', 'git status --short', 'git branch --list', 'git fetch origin',
     'gh pr view 922', 'gh pr checks 922', 'gh pr list', 'gh run view 1 --log-failed', 'gh run list --limit 5',
     ...READ_ONLY_CLIS.map((s) => `node scripts/gds/${s}.js`)]) {
-    assert.ok(allowCovers(allow, cmd), `should run without a prompt: ${cmd}`);
+    assert.ok(allowCovers(allowList(), cmd, tool), `should run without a prompt: ${cmd}`);
   }
 });
 
 test('the instance starter mirrors this list in verb form (claude-materialize.js STARTER_ALLOW)', () => {
-  assert.deepEqual([...STARTER_ALLOW].sort(), settings.permissions.allow.map((rule) => bongosify(rule)).sort());
+  assert.deepEqual([...STARTER_ALLOW].sort(), allowList().map((rule) => bongosify(rule)).sort());
 });
 
 console.log('');

package/tests/claude_materialize.mjs

@@ -766,19 +766,23 @@ t('every allow-rule names a verb the CLI actually registers', () => {
   // The drift this catches: a rule naming a verb that was renamed or never existed
   // is silently inert — it looks like a permission and grants nothing, so the
   // builder still meets the classifier and nobody can see why.
+  const checkedByTool = {};
   for (const rule of m.STARTER_ALLOW) {
-    if (!rule.startsWith('Bash(bongos ')) continue; // the git/gh reads (task 1003992) name no verb
-    const inner = rule.replace(/^Bash\(/, '').replace(/:\*\)$/, '');
+    const [, tool, inner] = rule.match(/^(\w+)\((.*?)(?::\*)?\)$/); // any shell tool (task 1004014)
+    if (!inner.startsWith('bongos ')) continue; // the git/gh reads (task 1003992) name no verb
     const verb = inner.split(' ')[1];
     assert.ok(cliVerbs[verb], `allow-rule "${rule}" names "${verb}", which is not a registered bongos verb`);
+    checkedByTool[tool] = (checkedByTool[tool] || 0) + 1;
   }
+  assert.ok(checkedByTool.Bash > 0, 'the loop checked something');
+  assert.equal(checkedByTool.PowerShell, checkedByTool.Bash, 'a Windows session gets every verb a Bash one does');
 });
 
 t('the escape hatch is NOT blanket-allowed', () => {
   // `bongos exec` runs any script inside the core by path. Allow-listing it bare
   // would be a blanket grant wearing a narrow rule's clothes.
-  assert.ok(!m.STARTER_ALLOW.includes('Bash(bongos exec:*)'),
-    'bongos exec must never be allowed bare');
+  assert.deepEqual(m.STARTER_ALLOW.filter((r) => /^\w+\(bongos exec(:\*| \*)?\)$/.test(r)), [],
+    'bongos exec must never be allowed bare — under any shell tool');
   const execRules = m.STARTER_ALLOW.filter((r) => r.includes('bongos exec'));
   for (const r of execRules) {
     assert.match(r, /bongos exec scripts\/gds\/[a-z-]+\.js/,

package/tests/host_topology_skips.mjs

@@ -30,6 +30,7 @@ const TESTS_DIR = path.dirname(fileURLToPath(import.meta.url));
 // Every test file permitted to skip itself wholesale, with the topology it needs.
 // Adding a line here is a deliberate, reviewable act — that is the point.
 const ALLOWED = {
+  allow_rule_guard: '.claude/hooks/allow-rule-guard.js (package-excluded)',
   art_stage: 'scripts/gds/art-stage.js (art-pipeline tooling, not in the core)',
   bongos_downloads: 'config/bongos-cli.json (instance content)',
   box_dns_repoint: 'infra/box-dns-cloudflare.sh (host topology)',

package/tests/init.mjs

@@ -204,16 +204,18 @@ test('versionPayload: explicit criterion_id is slugified', () => {
   assert.equal(init.versionPayload(spec).criteria[0].criterion_id, 'prove-the-loop');
 });
 
-// versions.track is NOT NULL with no DB default — leaving it off the payload is
-// exactly the 1.18.18 bug (every POST /versions 500ed, blocking init outright).
-test('versionPayload: always sends an explicit, valid track', () => {
-  assert.equal(init.versionPayload(fullSpec()).track, 'product'); // instance's first version = product
-  const internal = fullSpec();
-  internal.version.track = 'internal';
-  assert.equal(init.versionPayload(internal).track, 'internal');  // explicit internal respected
-  const junk = fullSpec();
-  junk.version.track = 'bogus';
-  assert.equal(init.versionPayload(junk).track, 'product');       // junk coerced, never forwarded
+// The inverse of the case this replaces. That case pinned "always send an
+// explicit track", guarding the 1.18.18 bug where omitting it 500ed every
+// POST /versions against a NOT NULL column with no default. core_205 gave the
+// column DEFAULT 'product' and task 1003665 retired the concept, so the payload
+// must now NOT carry it — and a spec that still names one must not smuggle it
+// through to a route that no longer accepts the field.
+test('versionPayload: sends no track, and drops one a spec still names', () => {
+  assert.equal('track' in init.versionPayload(fullSpec()), false);
+  const legacy = fullSpec();
+  legacy.version.track = 'internal';
+  assert.equal('track' in init.versionPayload(legacy), false,
+    'an old spec file cannot reintroduce the field');
 });
 
 // ---- provisioning arm (ADR 0111 §3, task 1946) ----
@@ -661,12 +663,13 @@ async function runSeedTests() {
     assert.ok(findTaskPost(api, /Production topology/), 'filed the manual fallback task on error');
   });
 
-  await at('seedViaApi: version POST carries the explicit track (the NOT NULL column)', async () => {
+  await at('seedViaApi: the version POST carries NO track (task 1003665)', async () => {
     const api = fakeApi();
     await init.seedViaApi(provSpec({}), { log: () => {}, api });
     const vpost = api.calls.find((c) => c.path.endsWith('/versions'));
     assert.ok(vpost, 'POSTed the version');
-    assert.equal(vpost.body.track, 'product');
+    assert.equal('track' in vpost.body, false,
+      'POST /versions no longer accepts the field; the DB default supplies the column');
   });
 
   await at('seedViaApi: the ideator kickoff task POSTs kind=decision + discipline=ideator', async () => {

package/tests/provision.mjs

@@ -59,16 +59,21 @@ t('dbCreateCmd / migrateCmd use the slug db + GDS-only migrate', () => {
   assert.match(P.migrateCmd(coTenant), /PGDATABASE=mercury MEDUSA_GDS_ONLY=1 \.\/scripts\/migrate\.sh/);
 });
 
-t('seedFirstVersionCmd: idempotent (only-if-empty) V1 seed against the slug db, track explicit, one criterion — the fix for the empty-versions bug (task 2119)', () => {
+t('seedFirstVersionCmd: idempotent (only-if-empty) V1 seed against the slug db, no track, one criterion — the fix for the empty-versions bug (task 2119)', () => {
   const cmd = P.seedFirstVersionCmd(coTenant);
   // targets the instance's OWN db, matching createdb/migrate
   assert.match(cmd, /psql .*-d mercury /, 'seeds the instance db');
   assert.match(cmd, /ON_ERROR_STOP=1/, 'aborts on any error (atomic, no half-seed)');
   // the version the greenfield init spec defines — ONE source of truth
   const v = P.instanceInitSpec(coTenant).version;
-  assert.match(cmd, /INSERT INTO versions \(id, name, track, status, done_when\)/);
+  assert.match(cmd, /INSERT INTO versions \(id, name, status, done_when\)/);
   assert.match(cmd, new RegExp(`\\$v\\$${reEsc(v.id)}\\$v\\$`), 'seeds the spec version id (V1)');
-  assert.match(cmd, /\$v\$product\$v\$/, 'track is set EXPLICITLY (versions.track is NOT NULL, no default since mig 112)');
+  // task 1003665 retired the two-track model. The seed names no track: it runs on
+  // a freshly-MIGRATED database, so core_205's DEFAULT 'product' fills the still-
+  // NOT NULL column. If that default is ever dropped, THIS seed 500s first and a
+  // new instance cannot stand up — which is why the assertion is stated that way.
+  assert.doesNotMatch(cmd, /\btrack\b/, 'the seed names no track column');
+  assert.doesNotMatch(cmd, /\$v\$product\$v\$/, 'nor smuggles its value in positionally');
   assert.match(cmd, /\$v\$building\$v\$/, 'status building, mirroring seedViaApi');
   assert.ok(cmd.includes(v.done_when), 'carries the spec done_when verbatim (incl. the → arrows)');
   // the IDEMPOTENT guard — only seeds when there is NO version yet, so it never disturbs an existing project

package/tests/version_first_goal.mjs

@@ -57,7 +57,9 @@ function fakeDb({ goalRow = { id: 77, title: 'Foundations' } } = {}) {
     query: async (sql, params) => {
       log.push({ sql, params });
       if (/^\s*(BEGIN|COMMIT|ROLLBACK)/i.test(sql)) return { rows: [] };
-      if (/INSERT INTO versions/i.test(sql)) return { rows: [{ id: params[0], name: params[1], status: params[2], track: params[3] }] };
+      // params are positional: (id, name, status, scope_doc_path, done_when).
+      // `track` sat at index 3 until task 1003665 removed it from the INSERT.
+      if (/INSERT INTO versions/i.test(sql)) return { rows: [{ id: params[0], name: params[1], status: params[2] }] };
       if (/INSERT INTO goals/i.test(sql)) return { rows: [goalRow] };
       if (/INSERT INTO done_when_criteria/i.test(sql)) {
         return { rows: [{ id: log.length, version_id: params[0], criterion_id: params[1], criterion_md: params[2], sort_order: params[3], goal_id: params[4], satisfied: false }] };
@@ -83,7 +85,7 @@ const CRITERIA = [
 console.log('createVersion — the version, its first goal, and its criteria:');
 
 const out = await createVersion({
-  id: 'V1', name: 'Foundations', status: 'building', track: 'product',
+  id: 'V1', name: 'Foundations', status: 'building',
   doneWhen: 'The loop closes.', criteria: CRITERIA, createdBy: 7,
 }, { pool: db.pool });
 

package/tests/versions_route.mjs

@@ -10,6 +10,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
 
 const require = createRequire(import.meta.url);
 const { validate } = require('../src/bongos/routes/_helpers.js');
@@ -23,12 +24,14 @@ function test(name, fn) {
 }
 
 // The EXACT schema declared in versions.js → POST /versions validateOrRespond().
-// Keep in sync if the route's schema changes.
+// Keep in sync if the route's schema changes — and note that "keep in sync" is a
+// promise a copy cannot keep on its own, so the track case below reads the
+// ROUTE SOURCE rather than this object. A copy that still declared `track` would
+// happily prove the old contract forever.
 const VERSIONS_POST_SCHEMA = {
   id: { required: true, type: 'string', maxLength: 64, minLength: 1 },
   name: { required: true, type: 'string', maxLength: 200, minLength: 1 },
   status: { type: 'string', maxLength: 32 },
-  track: { type: 'string', maxLength: 16 },
   done_when: { type: 'string', maxLength: 8000 },
   scope_doc_path: { type: 'string', maxLength: 256 },
   criteria: { type: 'array', maxItems: 100 },
@@ -75,18 +78,40 @@ test('INIT: unknown extra fields pass through (forward-compat)', () => {
   assert.equal(validate({ id: 'V1', name: 'x', future_field: 42 }, VERSIONS_POST_SCHEMA), null);
 });
 
-// versions.track is NOT NULL with no DB default (migration 003) — the create
-// path must accept it so callers can choose, and default it so omitting it can
-// never again 500 the route (the @bongos/core 1.18.18 `bongos init` blocker).
-test('INIT: explicit track passes the schema guard (both tracks)', () => {
-  assert.equal(validate({ id: 'V1', name: 'x', track: 'product' }, VERSIONS_POST_SCHEMA), null);
-  assert.equal(validate({ id: 'GDS-V5', name: 'x', track: 'internal' }, VERSIONS_POST_SCHEMA), null);
+// The two-track (product/internal) model was retired by task 1002006 and its code
+// unwound by task 1003665: role/discipline is the sole work-type axis. These read
+// the ROUTE'S OWN SOURCE, not the copied schema above — the point is that the
+// concept is gone from the file that enforces it.
+//
+// What made the removal safe, and what would make it unsafe again: versions.track
+// is still NOT NULL, so an INSERT omitting it is legal ONLY because core_205 gave
+// the column DEFAULT 'product'. Drop that default and every create 500s. The
+// comments this task deleted asserted the opposite ("no DB default") and were
+// stale from core_205 onward — which is precisely why five insert paths went on
+// supplying a value nothing read.
+const routeSrc = fs.readFileSync(
+  new URL('../modules/lifecycle/routes/versions.js', import.meta.url), 'utf8');
+
+test('the route no longer knows what a track is', () => {
+  for (const gone of ['VALID_VERSION_TRACKS', 'bad_track']) {
+    assert.ok(!routeSrc.includes(gone), `${gone} is gone from POST /versions`);
+  }
+  assert.ok(!/\btrack\b/.test(routeSrc.replace(/tracked|tracking/g, '')),
+    'no track identifier survives in the versions route');
 });
 
-test('BAD: non-string track → structured 400 shape, not a DB 500', () => {
-  const r = validate({ id: 'V1', name: 'x', track: 42 }, VERSIONS_POST_SCHEMA);
-  assert.ok(r);
-  assert.ok(r.details.some((d) => d.field === 'track'));
+test('a version is created WITHOUT a track, and that is the whole contract', () => {
+  // The create shape `bongos init` and provision-repo.js now send.
+  assert.equal(validate({ id: 'V1', name: 'x' }, VERSIONS_POST_SCHEMA), null);
+  assert.equal(validate({ id: 'GDS-V5', name: 'x', status: 'planning' }, VERSIONS_POST_SCHEMA), null);
+});
+
+test('the INSERT does not name the column either', () => {
+  const dbSrc = fs.readFileSync(
+    new URL('../modules/lifecycle/db-versions.js', import.meta.url), 'utf8');
+  const insert = dbSrc.slice(dbSrc.indexOf('INSERT INTO versions'));
+  assert.ok(!/^[^`]*\btrack\b/.test(insert.slice(0, insert.indexOf('`'))),
+    'INSERT INTO versions names no track column — the DB default supplies it');
 });
 
 // ---- BAD shapes must return a structured 400, never throw / 500 ----