@bongos/core 1.19.881 → 1.19.883

package/tests/box_ship_permissions.mjs

@@ -6,6 +6,12 @@
 // dead-ended on `node scripts/gds/ship.js` at the auto classifier; this guards
 // against that allow-rule being silently dropped.
 //
+// task 1004014: every check below runs once per SHELL TOOL. Claude Code's shell tool is
+// `Bash` on a Mac or Linux box and `PowerShell` on a Windows laptop, and a `Bash(...)`
+// rule says nothing about a PowerShell command — so a Windows session met the prompt
+// on every routine read. The list of tools is `.claude/hooks/shell-tools.js`, the same
+// one the guards read: a rule may only exist for a tool git-guard and secret-gate see.
+//
 // Run:  node tests/box_ship_permissions.mjs
 
 import { strict as assert } from 'node:assert';
@@ -20,6 +26,7 @@ const settingsPath = path.join(__dirname, '..', '.claude', 'settings.json');
 skipUnlessPresent('.claude/settings.json');
 const require = createRequire(import.meta.url);
 const guard = requireHostModule(require, '../.claude/hooks/git-guard.js');
+const { SHELL_TOOLS } = requireHostModule(require, '../.claude/hooks/shell-tools.js');
 const { STARTER_ALLOW, bongosify } = require('../scripts/gds/claude-materialize.js');
 
 let passed = 0, failed = 0;
@@ -27,26 +34,30 @@ function test(name, fn) {
   try { fn(); passed++; console.log(`  ok  ${name}`); }
   catch (err) { failed++; console.log(`  FAIL ${name}\n     ${err.message}`); }
 }
+// One case per shell tool, named for it, so a failure says WHICH tool's rules are wrong.
+function perTool(name, fn) {
+  for (const tool of SHELL_TOOLS) test(`[${tool}] ${name}`, () => fn(tool));
+}
 
 const raw = fs.readFileSync(settingsPath, 'utf8');
 let settings;
 test('.claude/settings.json is valid JSON', () => {
   settings = JSON.parse(raw);
 });
+const allowList = () => (settings.permissions && settings.permissions.allow) || [];
 
-test('permissions.allow pre-allows the blessed ship/claim/reauth scripts (box auto-mode would deny them otherwise)', () => {
-  const allow = (settings.permissions && settings.permissions.allow) || [];
+perTool('permissions.allow pre-allows the blessed ship/claim/reauth scripts (auto-mode would deny them otherwise)', (tool) => {
+  const allow = allowList();
   // The exact command the #1027 nightmare hard-stopped on:
-  assert.ok(allow.includes('Bash(node scripts/gds/ship.js:*)'),
-    'ship.js MUST be pre-allowed — a dev box cannot complete a ship if its own classifier denies the command');
-  // The rest of the core ship loop a box runs hands-free:
+  assert.ok(allow.includes(`${tool}(node scripts/gds/ship.js:*)`),
+    'ship.js MUST be pre-allowed — a session cannot complete a ship if its own classifier denies the command');
+  // The rest of the core ship loop a session runs hands-free:
   for (const s of ['claim', 'reauth', 'release', 'paste-token']) {
-    assert.ok(allow.includes(`Bash(node scripts/gds/${s}.js:*)`), `${s}.js should be pre-allowed`);
+    assert.ok(allow.includes(`${tool}(node scripts/gds/${s}.js:*)`), `${s}.js should be pre-allowed`);
   }
 });
 
-test('permissions.allow pre-allows the generic GDS API channel api.js (auto-mode denies the whole autonomous GDS loop otherwise)', () => {
-  const allow = (settings.permissions && settings.permissions.allow) || [];
+perTool('permissions.allow pre-allows the generic GDS API channel api.js (auto-mode denies the whole autonomous GDS loop otherwise)', (tool) => {
   // task 1716 (completes 1051): every GDS operation without a dedicated script —
   // idea-triage promote, create-task, blocker-resolve, criterion ratify, goal
   // create, cost-via-API, security reports — rides the generic caller
@@ -57,18 +68,18 @@ test('permissions.allow pre-allows the generic GDS API channel api.js (auto-mode
   // GDS server enforces builders.rank on every request (ADR 0016), so this rule
   // grants nothing beyond the caller's rank; it removes a redundant, weaker,
   // wrong harness prompt (owner-decided 2026-07-02, ADR 0104).
-  assert.ok(allow.includes('Bash(node scripts/gds/api.js:*)'),
+  assert.ok(allowList().includes(`${tool}(node scripts/gds/api.js:*)`),
     'api.js MUST be pre-allowed — the autonomous GDS loop (promote/create-task/blocker-resolve/cost) rides this generic channel; auto-mode denies it otherwise');
 });
 
+const SCRIPT_RULE = new RegExp(String.raw`^(${SHELL_TOOLS.join('|')})\(node scripts\/gds\/([a-z-]+)\.js:\*\)$`);
+
 test('every allow-rule points at a script that actually exists (no inert rules)', () => {
-  const allow = (settings.permissions && settings.permissions.allow) || [];
-  const re = /^Bash\(node (scripts\/gds\/[a-z-]+\.js):\*\)$/;
-  for (const rule of allow) {
-    const m = rule.match(re);
+  for (const rule of allowList()) {
+    const m = rule.match(SCRIPT_RULE);
     if (!m) continue; // only audit the gds-script rules
-    const p = path.join(__dirname, '..', m[1]);
-    assert.ok(fs.existsSync(p), `allow-rule references a missing script: ${m[1]}`);
+    const p = path.join(__dirname, '..', 'scripts', 'gds', `${m[2]}.js`);
+    assert.ok(fs.existsSync(p), `allow-rule references a missing script: ${m[2]}.js`);
   }
 });
 
@@ -79,24 +90,32 @@ test('every allow-rule points at a script that actually exists (no inert rules)'
 // git-guard blocks, and must stay read-only.
 // ---------------------------------------------------------------------------
 
-// How Claude Code reads a Bash rule: `Bash(x:*)` covers x and anything starting
-// "x "; `Bash(x)` covers exactly x. A chained command is covered only when every
-// part is, so `git status && git stash` is not covered by a `git status` rule.
-function ruleCovers(rule, part) {
-  const m = rule.match(/^Bash\((.*?)(:\*)?\)$/);
-  if (!m) return false;
-  return part === m[1] || (Boolean(m[2]) && part.startsWith(`${m[1]} `));
+// How Claude Code reads a shell rule: `Tool(x:*)` covers x and anything starting
+// "x "; `Tool(x)` covers exactly x. A chained or piped command is covered only when
+// every part is, so `git status && git stash` is not covered by a `git status` rule.
+// PowerShell rules match case-INSENSITIVELY (documented), which matters here because
+// git's own flags do not: `-d` and `-D` are different commands.
+//
+// WHAT THIS MODEL IS NOT. It knows rule shape, separators and case folding — nothing else. It
+// reads `git status $(…)`, `$env:X=…; node …` and `gh pr view 1 > x` as covered, where the real
+// client asks for each whatever the allow-list says (ADR 0304's amendment records where that was
+// read). So no such sample is listed: it would be red here for a command that does prompt.
+function ruleCovers(rule, part, tool) {
+  const m = rule.match(/^(\w+)\((.*?)(:\*)?\)$/);
+  if (!m || m[1] !== tool) return false;
+  const fold = (s) => (tool === 'PowerShell' ? s.toLowerCase() : s);
+  return fold(part) === fold(m[2]) || (Boolean(m[3]) && fold(part).startsWith(`${fold(m[2])} `));
 }
-function allowCovers(allow, command) {
+function allowCovers(allow, command, tool) {
   const parts = command.split(/&&|\|\||[;|&\n]/).map((s) => s.trim()).filter(Boolean);
-  return parts.every((part) => allow.some((rule) => ruleCovers(rule, part)));
+  return parts.every((part) => allow.some((rule) => ruleCovers(rule, part, tool)));
 }
-const isBlocked = (command) => guard.decide({ tool_name: 'Bash', tool_input: { command } }, {}).block;
-const isBlockedPwsh = (command) => guard.decide({ tool_name: 'PowerShell', tool_input: { command } }, {}).block;
+const isBlocked = (command, tool) => guard.decide({ tool_name: tool, tool_input: { command } }, {}).block;
+const isBlockedPwsh = (command) => isBlocked(command, 'PowerShell');
 
 // At least one sample per git-guard rule, keyed by the rule's own name.
 const BLOCKED_SAMPLES = {
-  'git stash': ['git stash', 'git stash pop', 'git stash push -m wip', 'git status && git stash'],
+  'git stash': ['git stash', 'git stash pop', 'git stash push -m wip', 'git status && git stash', 'git status; git stash'],
   'git worktree remove': ['git worktree remove ../wt', 'git worktree remove --force ../wt'],
   'git push origin main': ['git push origin main', 'git push -u origin HEAD:main', 'git push --force origin task-1:main'],
   'git branch -D': ['git branch -D task-1', 'git branch --list -D task-1', 'git branch -a -D task-1'],
@@ -114,13 +133,20 @@ const BLOCKED_SAMPLES_PWSH = {
   'git branch -D': ['GIT branch -D task-1', 'Git.exe branch -a -D task-1'],
 };
 
-test('every git-guard rule has blocked samples here (a new rule forces a new sample)', () => {
+// MERGE NOTE (task 1004052 strand walk). Two rounds built PowerShell coverage from
+// opposite ends and collided here: task 1004014 made every case in this file run once
+// per tool (`perTool`), and task 1004028 added the sample set above, arguing correctly
+// that a Bash-shaped string replayed against PowerShell only re-proves the spelling that
+// already matched. Neither supersedes the other — 1004014 is breadth (eight cases, both
+// tools), 1004028 is depth (one case, in spellings only PowerShell resolves). Both are
+// kept: the per-tool wrapper stays, and the PowerShell-spelled set is asserted inside it.
+perTool('every git-guard rule has blocked samples here (a new rule forces a new sample)', (tool) => {
   for (const [name] of guard.RULES) {
     assert.ok((BLOCKED_SAMPLES[name] || []).length, `no blocked sample for git-guard rule "${name}"`);
     assert.ok((BLOCKED_SAMPLES_PWSH[name] || []).length, `no PowerShell-spelled sample for git-guard rule "${name}"`);
   }
   for (const samples of Object.values(BLOCKED_SAMPLES)) {
-    for (const cmd of samples) assert.ok(isBlocked(cmd), `sample is not actually blocked by git-guard: ${cmd}`);
+    for (const cmd of samples) assert.ok(isBlocked(cmd, tool), `sample is not actually blocked by git-guard: ${cmd}`);
   }
   for (const samples of Object.values(BLOCKED_SAMPLES_PWSH)) {
     for (const cmd of samples) {
@@ -140,36 +166,50 @@ test('the PowerShell samples are genuinely different spellings, not a copy', ()
   }
 });
 
-test('no allow-rule covers a command git-guard blocks', () => {
-  const allow = settings.permissions.allow;
+perTool('no allow-rule covers a command git-guard blocks', (tool) => {
+  const allow = allowList();
   for (const rule of allow) {
-    const text = rule.replace(/^Bash\(/, '').replace(/(:\*)?\)$/, '');
-    assert.ok(!isBlocked(text), `allow-rule is itself a git-guard-blocked command: ${rule}`);
+    const m = rule.match(/^(\w+)\((.*?)(:\*)?\)$/);
+    if (m && m[1] === tool) assert.ok(!isBlocked(m[2], tool), `allow-rule is itself a git-guard-blocked command: ${rule}`);
   }
   for (const cmd of Object.values(BLOCKED_SAMPLES).flat()) {
-    assert.ok(!allowCovers(allow, cmd), `an allow-rule covers a git-guard-blocked command: ${cmd}`);
+    assert.ok(!allowCovers(allow, cmd, tool), `an allow-rule covers a git-guard-blocked command: ${cmd}`);
   }
 });
 
-test('the check has teeth: a too-broad git rule IS caught', () => {
+perTool('the check has teeth: a too-broad git rule IS caught', (tool) => {
   const samples = Object.values(BLOCKED_SAMPLES).flat();
-  for (const broad of ['Bash(git:*)', 'Bash(git stash:*)', 'Bash(git worktree:*)', 'Bash(git push:*)', 'Bash(git branch:*)', 'Bash(git branch --list:*)']) {
-    assert.ok(samples.some((cmd) => allowCovers([broad], cmd)), `${broad} should cover a blocked sample`);
+  for (const broad of ['git:*', 'git stash:*', 'git worktree:*', 'git push:*', 'git branch:*', 'git branch --list:*']) {
+    assert.ok(samples.some((cmd) => allowCovers([`${tool}(${broad})`], cmd, tool)), `${tool}(${broad}) should cover a blocked sample`);
   }
 });
 
-// The whole git/gh allow-list, pinned. A flag can turn a read into a write or an
-// exec (`git fetch --upload-pack=<cmd>`, `git fetch origin x:main`, `git branch -D`),
-// so `branch` and `fetch` appear only as the exact commands a session runs.
+test('teeth: a rule for one shell tool covers nothing run by the other', () => {
+  assert.equal(allowCovers(['Bash(git status:*)'], 'git status', 'PowerShell'), false);
+  assert.equal(allowCovers(['PowerShell(git status:*)'], 'git status', 'Bash'), false);
+});
+
+test('teeth: a PowerShell rule matches case-insensitively, a Bash rule does not', () => {
+  assert.equal(allowCovers(['PowerShell(git branch -d:*)'], 'git branch -D task-1', 'PowerShell'), true,
+    'this is why no PowerShell rule may sit next to a flag whose other case is a different command');
+  assert.equal(allowCovers(['Bash(git branch -d:*)'], 'git branch -D task-1', 'Bash'), false);
+});
+
+// The whole git/gh allow-list, pinned — once, and carried by every shell tool. A flag
+// can turn a read into a write or an exec (`git fetch --upload-pack=<cmd>`,
+// `git fetch origin x:main`, `git branch -D`), so `branch` and `fetch` appear only as
+// the exact commands a session runs.
 //
 // NO `git diff|log|show` rule, on purpose. Claude Code already runs their read-only
-// forms without a prompt in every mode and checks their flags; a prefix rule would
-// switch that check off (see WRITES_DRESSED_AS_READS below — both were reproduced).
-const GIT_GH_RULES = [
-  'Bash(git status:*)',
-  'Bash(git branch --list)', 'Bash(git branch --show-current)', 'Bash(git branch -a)', 'Bash(git branch -vv)',
-  'Bash(git fetch)', 'Bash(git fetch origin)', 'Bash(git fetch origin main)',
-  'Bash(gh pr view:*)', 'Bash(gh pr checks:*)', 'Bash(gh pr list:*)', 'Bash(gh run view:*)', 'Bash(gh run list:*)',
+// forms without a prompt and checks their flags; a prefix rule would switch that check
+// off (see WRITES_DRESSED_AS_READS below — both were reproduced). That holds for the
+// PowerShell tool too: it has its own built-in read-only handling, and an allow-rule is
+// matched before it.
+const GIT_GH_COMMANDS = [
+  'git status:*',
+  'git branch --list', 'git branch --show-current', 'git branch -a', 'git branch -vv',
+  'git fetch', 'git fetch origin', 'git fetch origin main',
+  'gh pr view:*', 'gh pr checks:*', 'gh pr list:*', 'gh run view:*', 'gh run list:*',
 ];
 // gds CLIs audited read-only under EVERY flag they take — a prefix rule allows them all.
 // Audited and left OUT: backlog-review.js (POSTs from its default walk) and
@@ -178,12 +218,44 @@ const READ_ONLY_CLIS = ['start', 'status', 'recall', 'me', 'doctor', 'preflight'
   'ship-check', 'fitness', 'strand-watch', 'stale-worktrees', 'read-session-export'];
 const BLESSED_WRITERS = ['ship', 'claim', 'reauth', 'release', 'paste-token', 'api']; // tasks 1051 / 1716
 
-const SCRIPT_RULE = /^Bash\(node scripts\/gds\/([a-z-]+)\.js:\*\)$/;
-
-test('every allow-rule that is not a gds script is in the pinned git/gh set (adding one is a deliberate edit here)', () => {
+perTool('every allow-rule that is not a gds script is in the pinned git/gh set (adding one is a deliberate edit here)', (tool) => {
   // Catches `Bash(gh:*)`, `Bash(gh *)`, `Bash(git -C x status:*)`, a bare `Bash` — anything unlisted.
-  const rest = settings.permissions.allow.filter((rule) => !SCRIPT_RULE.test(rule));
-  assert.deepEqual([...rest].sort(), [...GIT_GH_RULES].sort());
+  const rest = allowList().filter((rule) => rule.startsWith(`${tool}(`) || rule === tool).filter((rule) => !SCRIPT_RULE.test(rule));
+  assert.deepEqual([...rest].sort(), GIT_GH_COMMANDS.map((c) => `${tool}(${c})`).sort());
+});
+
+test('every allow-rule belongs to a shell tool the guards see, and every tool carries the SAME list', () => {
+  // A rule for a tool outside SHELL_TOOLS would pre-allow commands git-guard and
+  // secret-gate never look at — allowing first and guarding second (ADR 0304).
+  const byTool = new Map(SHELL_TOOLS.map((tool) => [tool, []]));
+  for (const rule of allowList()) {
+    const m = rule.match(/^(\w+)\((.*)\)$/);
+    assert.ok(m && byTool.has(m[1]), `allow-rule is not for a guarded shell tool: ${rule}`);
+    byTool.get(m[1]).push(m[2]);
+  }
+  const [first, ...others] = SHELL_TOOLS;
+  for (const tool of others) {
+    assert.deepEqual([...byTool.get(tool)].sort(), [...byTool.get(first)].sort(),
+      `${tool} and ${first} must pre-allow the same commands — a twin that drifts is a prompt on one machine only`);
+  }
+});
+
+test('the RESTRICTIVE lists are twinned too: a shell command denied for one tool is denied for every tool', () => {
+  // The half that matters more. A deny with no twin is a hard stop on a Linux box and nothing at
+  // all on a Windows laptop — and git-guard, the only other barrier, is cooperative and fails open.
+  const shellRule = new RegExp(String.raw`^(${SHELL_TOOLS.join('|')})\((.*)\)$`);
+  for (const key of ['deny', 'ask']) {
+    const byTool = new Map(SHELL_TOOLS.map((tool) => [tool, []]));
+    for (const rule of settings.permissions[key] || []) {
+      const m = rule.match(shellRule);
+      if (m) byTool.get(m[1]).push(m[2]); // Read(...) and the rest are not shell rules
+    }
+    const [first, ...others] = SHELL_TOOLS;
+    for (const tool of others) {
+      assert.deepEqual([...byTool.get(tool)].sort(), [...byTool.get(first)].sort(), `permissions.${key}: ${tool} vs ${first}`);
+    }
+  }
+  assert.ok(settings.permissions.deny.includes('PowerShell(git stash:*)'), 'the one shell deny this repo carries');
 });
 
 // "Read" commands whose flags write a file, read one the Read deny-list protects,
@@ -195,36 +267,45 @@ const WRITES_DRESSED_AS_READS = [
   'git diff --no-index -- /dev/null .env',
   'git fetch --upload-pack=./x origin',
   'git fetch origin task-1:main',
+  // a read piped or chained into something that writes or executes: every part must be covered
+  'git status | Out-File -FilePath .git/hooks/pre-push',
+  'gh pr view 1 --json body -q .body | Set-Content .git/hooks/pre-push',
+  'gh pr view 1 --json body -q .body | Invoke-Expression',
+  'gh pr list | iex',
+  'git status; Remove-Item -Recurse -Force src',
+  'gh pr view 1 | tee .git/hooks/pre-push',
 ];
 
-test('no allow-rule lets a write dressed as a read through (--output, --no-index, --upload-pack, a refspec)', () => {
+perTool('no allow-rule lets a write dressed as a read through (--output, --no-index, --upload-pack, a refspec, a pipe into a writer)', (tool) => {
   for (const cmd of WRITES_DRESSED_AS_READS) {
-    assert.ok(!allowCovers(settings.permissions.allow, cmd), `runs without a prompt: ${cmd}`);
+    assert.ok(!allowCovers(allowList(), cmd, tool), `runs without a prompt: ${cmd}`);
   }
   // Teeth: the prefix rules this list deliberately does NOT carry would let them through.
-  const tempting = ['Bash(git log:*)', 'Bash(git show:*)', 'Bash(git diff:*)', 'Bash(git fetch:*)'];
-  for (const cmd of WRITES_DRESSED_AS_READS) assert.ok(allowCovers(tempting, cmd), `teeth: ${cmd}`);
+  const tempting = ['git log:*', 'git show:*', 'git diff:*', 'git fetch:*', 'Out-File:*', 'Set-Content:*',
+    'Invoke-Expression:*', 'iex:*', 'Remove-Item:*', 'tee:*'].map((c) => `${tool}(${c})`);
+  for (const cmd of WRITES_DRESSED_AS_READS) {
+    assert.ok(allowCovers([...allowList(), ...tempting], cmd, tool), `teeth: ${cmd}`);
+  }
 });
 
 test('every gds-script allow-rule is a blessed writer or an audited read-only CLI', () => {
   const known = new Set([...BLESSED_WRITERS, ...READ_ONLY_CLIS]);
-  for (const rule of settings.permissions.allow) {
+  for (const rule of allowList()) {
     const m = rule.match(SCRIPT_RULE);
-    if (m) assert.ok(known.has(m[1]), `${m[1]}.js is pre-allowed but not audited here — a prefix rule allows every flag it takes`);
+    if (m) assert.ok(known.has(m[2]), `${m[2]}.js is pre-allowed but not audited here — a prefix rule allows every flag it takes`);
   }
 });
 
-test('the read-only subset is pre-allowed', () => {
-  const allow = settings.permissions.allow;
+perTool('the read-only subset is pre-allowed', (tool) => {
   for (const cmd of ['git status', 'git status --short', 'git branch --list', 'git fetch origin',
     'gh pr view 922', 'gh pr checks 922', 'gh pr list', 'gh run view 1 --log-failed', 'gh run list --limit 5',
     ...READ_ONLY_CLIS.map((s) => `node scripts/gds/${s}.js`)]) {
-    assert.ok(allowCovers(allow, cmd), `should run without a prompt: ${cmd}`);
+    assert.ok(allowCovers(allowList(), cmd, tool), `should run without a prompt: ${cmd}`);
   }
 });
 
 test('the instance starter mirrors this list in verb form (claude-materialize.js STARTER_ALLOW)', () => {
-  assert.deepEqual([...STARTER_ALLOW].sort(), settings.permissions.allow.map((rule) => bongosify(rule)).sort());
+  assert.deepEqual([...STARTER_ALLOW].sort(), allowList().map((rule) => bongosify(rule)).sort());
 });
 
 console.log('');

package/tests/box_sweep_docs.mjs

@@ -35,7 +35,11 @@ const read = (p) => fs.readFileSync(path.join(ROOT, p), 'utf8');
 const BOX_JS = 'scripts/gds/box.js';
 const IDLE_SKILL = '.claude/scheduled-tasks/box-idle-suspend/SKILL.md';
 const DORMANT_SKILL = '.claude/scheduled-tasks/box-dormant-reclaim/SKILL.md';
-const RECIPE = 'docs/recipes/builder-box-lifecycle.md';
+// The fourth surface this guard used to read, docs/recipes/builder-box-lifecycle.md,
+// was deleted with the other three published dev-box recipes (task 1004013,
+// ADR 0305: a recipe lives with what it documents). A file that does not exist
+// cannot invert against box.js, so it drops out of the lists below rather than
+// weakening them — the two SKILL.md surfaces are still read in full.
 
 // Comments are stripped before scanning prose: each surface deliberately keeps a
 // sentence SAYING which model it used to describe, and a naive substring check
@@ -76,7 +80,7 @@ test('no box-sweep doc claims the IDLE sweep destroys, while the code parks', ()
     /single job is to DESTROY/i,
   ];
 
-  for (const file of [IDLE_SKILL, DORMANT_SKILL, RECIPE]) {
+  for (const file of [IDLE_SKILL, DORMANT_SKILL]) {
     const prose = stripHtmlComments(read(file));
     for (const lie of lies) {
       assert.doesNotMatch(prose, lie,
@@ -107,7 +111,7 @@ test('every surface names sweep-dormant as the only automated snapshot delete',
   // The safety property box.js implements in prose: full reclaim warns first, so
   // no automated path takes uncommitted work silently. A reader who misses this
   // is the reader who reaches for deprovision.
-  for (const file of [IDLE_SKILL, DORMANT_SKILL, RECIPE]) {
+  for (const file of [IDLE_SKILL, DORMANT_SKILL]) {
     assert.match(stripHtmlComments(read(file)), /only automated path that destroys a snapshot|only automated snapshot delete/i,
       `${file} never tells the reader that sweep-dormant is the only automated path that `
       + 'destroys a snapshot (and that it warns first) — the safety property this subsystem rests on.');

package/tests/claude_materialize.mjs

@@ -766,19 +766,23 @@ t('every allow-rule names a verb the CLI actually registers', () => {
   // The drift this catches: a rule naming a verb that was renamed or never existed
   // is silently inert — it looks like a permission and grants nothing, so the
   // builder still meets the classifier and nobody can see why.
+  const checkedByTool = {};
   for (const rule of m.STARTER_ALLOW) {
-    if (!rule.startsWith('Bash(bongos ')) continue; // the git/gh reads (task 1003992) name no verb
-    const inner = rule.replace(/^Bash\(/, '').replace(/:\*\)$/, '');
+    const [, tool, inner] = rule.match(/^(\w+)\((.*?)(?::\*)?\)$/); // any shell tool (task 1004014)
+    if (!inner.startsWith('bongos ')) continue; // the git/gh reads (task 1003992) name no verb
     const verb = inner.split(' ')[1];
     assert.ok(cliVerbs[verb], `allow-rule "${rule}" names "${verb}", which is not a registered bongos verb`);
+    checkedByTool[tool] = (checkedByTool[tool] || 0) + 1;
   }
+  assert.ok(checkedByTool.Bash > 0, 'the loop checked something');
+  assert.equal(checkedByTool.PowerShell, checkedByTool.Bash, 'a Windows session gets every verb a Bash one does');
 });
 
 t('the escape hatch is NOT blanket-allowed', () => {
   // `bongos exec` runs any script inside the core by path. Allow-listing it bare
   // would be a blanket grant wearing a narrow rule's clothes.
-  assert.ok(!m.STARTER_ALLOW.includes('Bash(bongos exec:*)'),
-    'bongos exec must never be allowed bare');
+  assert.deepEqual(m.STARTER_ALLOW.filter((r) => /^\w+\(bongos exec(:\*| \*)?\)$/.test(r)), [],
+    'bongos exec must never be allowed bare — under any shell tool');
   const execRules = m.STARTER_ALLOW.filter((r) => r.includes('bongos exec'));
   for (const r of execRules) {
     assert.match(r, /bongos exec scripts\/gds\/[a-z-]+\.js/,

package/tests/collab_page.mjs

@@ -23,6 +23,16 @@ function lib() {
   new Function('window', src)(win);
   return win.OTBCollabLib;
 }
+
+// The role vocabulary is pure too, so RUN it for the same reason — a grep over
+// roleWord()'s source would agree with a roleWord() that was wrong.
+function domUtils() {
+  const src = read('modules', 'hall-ui', 'public', 'dom-utils.js');
+  const win = { location: { search: '', hash: '', pathname: '/' }, addEventListener() {}, localStorage: null };
+  const doc = { addEventListener() {}, querySelector: () => null, querySelectorAll: () => [], documentElement: { dataset: {} } };
+  new Function('window', 'document', src)(win, doc);
+  return win.OTB;
+}
 const NOW = Date.parse('2026-08-24T12:00:00Z');
 const daysAgo = (d) => new Date(NOW - d * 86400000).toISOString();
 
@@ -71,8 +81,75 @@ test('ageing changes how a row LOOKS, not only where it sits', () => {
 test('the row markup carries the band class and the label', () => {
   const js = read('modules', 'hall-ui', 'public', 'collab.js');
   assert.match(js, /cb-age cb-age--\$\{band\.id\}/, 'the pill\'s class comes from the band');
-  assert.match(js, /escapeHtml\(band\.label\)/, 'the label is rendered, escaped');
+  assert.match(js, /escapeHtml\(L\.ageLabel\(req\.created_at, nowMs\)\)/, 'the label is rendered, escaped');
   assert.match(js, /L\.ageBand\(req\.created_at, nowMs\)/, 'through the lib, so the boundaries are the tested ones');
+  // THE BAND AND THE LABEL ARE TWO SOURCES ON PURPOSE (task 1004041). Until then
+  // the pill rendered `band.label`, so the band decided both how loud the row
+  // looked AND what it said — which is why fourteen rows past a week carried
+  // fourteen copies of "waiting over a week". The class still comes from the
+  // band (four treatments, readable down a column) and the words now come from
+  // ageLabel (the real age, different on every row). Asserting only one of the
+  // two would let them be collapsed back onto each other.
+  assert.ok(!/escapeHtml\(band\.label\)/.test(js), 'the words are the real age, not the band name again');
+});
+
+test('two rows in the same band do not read identically', () => {
+  // The artist's finding, as an executable claim: a signal that never varies is
+  // not a signal. Every one of these is band 'stale', and no two say the same
+  // thing.
+  const L = lib();
+  const said = [8, 9, 13, 21, 40, 400].map((d) => {
+    assert.equal(L.ageBand(daysAgo(d), NOW).id, 'stale', `${d} days is stale`);
+    return L.ageLabel(daysAgo(d), NOW);
+  });
+  assert.equal(new Set(said).size, said.length, `six stale rows, six different readings: ${said.join(' / ')}`);
+});
+
+test('the age label says how long, coarsely, and never accuses an unknown age', () => {
+  const L = lib();
+  assert.equal(L.ageLabel(daysAgo(0.4), NOW), 'just asked');
+  assert.equal(L.ageLabel(daysAgo(1), NOW), 'waiting a day');
+  assert.equal(L.ageLabel(daysAgo(4), NOW), 'waiting 4 days');
+  assert.equal(L.ageLabel(daysAgo(13), NOW), 'waiting 13 days');
+  // Past a fortnight it goes to weeks: 'waiting 38 days' is a precision nobody
+  // acts on, the same argument the bands were written on.
+  assert.equal(L.ageLabel(daysAgo(21), NOW), 'waiting 3 weeks');
+  for (const bad of [null, undefined, '', 'nonsense']) {
+    assert.equal(L.ageLabel(bad, NOW), 'just asked', `${JSON.stringify(bad)} must not look neglected`);
+  }
+});
+
+test('the two calm bands are not chips, and the date is not said twice', () => {
+  // The chip appears where there is something to say. All four bands keep their
+  // own ink (the test above), but fresh and waiting drop the pill's ring, so a
+  // board of healthy asks does not open as a wall of chips.
+  const css = read('modules', 'hall-ui', 'public', 'collab.css');
+  assert.match(
+    css,
+    /\.cb-age--fresh,\s*\n\.cb-age--waiting\s*\{[^}]*border-color: transparent/,
+    'the calm bands read as quiet text, not as chips',
+  );
+  // And the separate date line is gone: the pill carries the age in words and
+  // the exact timestamp on its title, so a date beside it was one fact twice.
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  assert.ok(!/ov-row__when/.test(js), 'no second rendering of the same fact');
+  assert.match(js, /title="Asked \$\{escapeHtml\(String\(req\.created_at/, 'the exact date is still reachable');
+});
+
+test('the alarm does not sit beside the accent control', () => {
+  // DESIGN.md spends the accent only on what is pressable or live. On "Your
+  // asks" the age pill (danger ink) used to share the right column with the
+  // solid-accent "Someone helped" button, so a warning and a control sat two
+  // centimetres apart in one colour family. The age is a FACT about the ask now;
+  // the right column on that row holds only what you can press.
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  const mine = js.slice(js.indexOf('function mineRow('), js.indexOf('function allRow('));
+  assert.ok(mine.length > 100, 'found mineRow');
+  const right = mine.slice(mine.indexOf('ov-row__right'));
+  assert.ok(!right.includes('ageChip'), 'no age pill in the column that holds the accent button');
+  assert.ok(right.includes('btn-accent'), 'the accent button is still there');
+  const facts = mine.slice(mine.indexOf('ov-row__facts'), mine.indexOf('ov-row__right'));
+  assert.ok(facts.includes('ageChip'), 'the age reads as a fact about the ask');
 });
 
 test('oldest first WITHIN the page, in addition to the band', () => {
@@ -264,6 +341,64 @@ test('the page is the three blocks, led by faces, with the ledes gone', () => {
   assert.match(html, /class="cb-foot"/, 'and it is the foot, not the opener');
 });
 
+test('a person meets the page\'s NUMBERS before its pills', () => {
+  // Task 1003942 promised "a glass figure strip at the top (waiting on you /
+  // your open asks / crafts you answer for)" and shipped without it; the
+  // grader's narc worker caught the omission and the artist's verdict named
+  // what it cost — with nothing calm at the top, the page opens on age pills.
+  const html = read('modules', 'hall-ui', 'public', 'collab.html');
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  assert.match(html, /<div class="stat-row ov-summary cb-figs" id="cb-figs"/, 'the strip is the shell\'s glass band');
+  // Position is the whole claim: before the blocks, not beside them.
+  assert.ok(html.indexOf('id="cb-figs"') < html.indexOf('cb-band'), 'the strip is ABOVE the blocks');
+  assert.ok(html.indexOf('id="cb-figs"') < html.indexOf('id="cb-all"'), 'and above the board');
+  assert.match(js, /function paintFigures\(/, 'the page fills it');
+  assert.match(js, /paintFigures\(rowsOf\(forMe\), rowsOf\(mine\), crafts\)/, 'from the reads it already makes — no fourth fetch');
+  for (const label of ['Waiting on you', 'Your open asks', 'Roles you answer for']) {
+    assert.ok(js.includes(label), `the strip carries "${label}"`);
+  }
+  // It is painted BEFORE the blocks, so the numbers are on screen first even on
+  // a slow paint.
+  assert.ok(js.indexOf('paintFigures(') < js.indexOf("paintBlock('for-me'"), 'and painted first');
+});
+
+test('ONE WORD, ONE CASING: a sentence takes roleWord, a control takes roleLabel', () => {
+  // The artist's third finding, and the design error under it. Collab said
+  // "Asks to Builders" in its sub line and "You asked artists" six lines down,
+  // because task 1003936 routed one call site through roleLabel() — correct for
+  // a picker, wrong in prose — and reasoned about the other separately.
+  const dom = read('modules', 'hall-ui', 'public', 'dom-utils.js');
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  assert.match(dom, /function roleWord\(d\)/, 'prose has its own helper');
+  assert.match(dom, /roleAxisLabel, roleLabel, roleWord,/, 'and it is exported');
+  // The rule is written down next to the helper that made it necessary, which is
+  // the third DONE WHEN clause of task 1004041.
+  const nearby = dom.slice(dom.indexOf('function roleLabel('), dom.indexOf('function roleWord('));
+  assert.match(nearby, /A CONTROL TAKES roleLabel\(\); A SENTENCE TAKES roleWord\(\)/, 'the rule sits beside roleLabel');
+  // The page's sentence no longer capitalises a common noun, and no longer
+  // opens on a clause the next clause repeats.
+  assert.match(js, /roleWord\(c\)\}s/, 'the sub line names roles as common nouns');
+  assert.ok(!/Builders asking builders/.test(js), 'the tautology is gone');
+  // A CALL, not a mention: the comment above the sub line names roleLabel() to
+  // explain why it is not used, and a bare /roleLabel\(/ would read that as the
+  // defect it warns about.
+  assert.ok(!/window\.OTB\.roleLabel\(/.test(js), 'no control-voice label inside a sentence on this page');
+});
+
+test('roleWord and roleLabel disagree exactly where they should', () => {
+  // Executed, not grepped: the acronym exception has to survive both ways, or
+  // "You asked uis" ships the next time a ui task files a help request.
+  const { roleLabel, roleWord } = domUtils();
+  assert.equal(roleLabel('engineer'), 'Engineer');
+  assert.equal(roleWord('engineer'), 'engineer');
+  assert.equal(roleLabel('ui'), 'UI');
+  assert.equal(roleWord('ui'), 'UI', 'an acronym is not a common noun in any sentence');
+  assert.equal(roleLabel('unclassified'), 'No role yet');
+  assert.equal(roleWord('unclassified'), 'no role yet');
+  assert.equal(roleWord(''), '');
+  assert.equal(roleWord(null), '');
+});
+
 test('the by-name ask is the one LIT thing — the accent goes on the personal call', () => {
   const js = read('modules', 'hall-ui', 'public', 'collab.js');
   const css = read('modules', 'hall-ui', 'public', 'collab.css');

package/tests/host_topology_skips.mjs

@@ -30,6 +30,7 @@ const TESTS_DIR = path.dirname(fileURLToPath(import.meta.url));
 // Every test file permitted to skip itself wholesale, with the topology it needs.
 // Adding a line here is a deliberate, reviewable act — that is the point.
 const ALLOWED = {
+  allow_rule_guard: '.claude/hooks/allow-rule-guard.js (package-excluded)',
   art_stage: 'scripts/gds/art-stage.js (art-pipeline tooling, not in the core)',
   bongos_downloads: 'config/bongos-cli.json (instance content)',
   box_dns_repoint: 'infra/box-dns-cloudflare.sh (host topology)',