@bongos/core 1.19.907 → 1.19.910

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.907'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.910'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/collab_page.mjs

@@ -136,6 +136,98 @@ test('the two calm bands are not chips, and the date is not said twice', () => {
   assert.match(js, /title="Asked \$\{escapeHtml\(String\(req\.created_at/, 'the exact date is still reachable');
 });
 
+// ---- THE ROOM'S OWN CONDITION (task 1004067, from idea 1001065) -----------
+//
+// The report: fourteen of fourteen rows wore the "waiting over a week" pill, so
+// the loudest thing on the page carried no information. Task 1004041 made the
+// WORDS differ, which is why these tests are about the TREATMENT — fourteen
+// differently-worded rows in identical danger ink and identical rings still read
+// as a wall. Each case below is run through the lib, not grepped, so a rule that
+// is wrong fails here rather than looking plausible in a diff.
+const room = (...ages) => ages.map((d) => ({ created_at: daysAgo(d) }));
+
+test('a uniformly old room states its condition once instead of on every row', () => {
+  const L = lib();
+  // The reported board, reproduced: fourteen rows, every one past a week.
+  const rows = room(8, 9, 11, 13, 15, 16, 18, 21, 24, 27, 30, 34, 38, 41);
+  const baseline = L.roomBaseline(rows, NOW);
+  assert.ok(baseline, 'fourteen of fourteen is a room condition, not fourteen warnings');
+  assert.equal(baseline.band.id, 'stale');
+  assert.equal(L.roomAgeLine(baseline), 'all 14 waiting over a week');
+  const loud = rows.filter((r) => !L.isRoomQuiet(L.ageBand(r.created_at, NOW), baseline));
+  assert.equal(loud.length, 0, 'no row is worse than a room where every row is the same');
+  // And nothing is silently dead: each row still says its own real age.
+  const words = new Set(rows.map((r) => L.ageLabel(r.created_at, NOW)));
+  assert.ok(words.size > 1, 'the per-row words still carry the differing ages');
+});
+
+test('the pill is kept for the row that is worse than its room', () => {
+  const L = lib();
+  // Six of eight sitting a few days, two genuinely old. The two are the whole
+  // point of the column, and before this they were indistinguishable from the six.
+  const rows = room(4, 4, 5, 5, 5, 6, 21, 30);
+  const baseline = L.roomBaseline(rows, NOW);
+  assert.equal(baseline.band.id, 'aging');
+  assert.equal(L.roomAgeLine(baseline), '6 of 8 waiting a few days');
+  const loud = rows
+    .filter((r) => !L.isRoomQuiet(L.ageBand(r.created_at, NOW), baseline))
+    .map((r) => L.ageLabel(r.created_at, NOW));
+  assert.deepEqual(loud, ['waiting 3 weeks', 'waiting 4 weeks'], 'only the exceptions keep a chip');
+});
+
+test('a mixed room is left exactly as it was', () => {
+  const L = lib();
+  // No band is dominant here, so nothing is quieted and nothing is announced —
+  // which is what keeps this inert on the board as it usually looks.
+  const rows = room(0.2, 0.5, 1, 2, 4, 5, 9, 21);
+  assert.equal(L.roomBaseline(rows, NOW), null);
+  assert.equal(L.roomAgeLine(null), '');
+  for (const r of rows) {
+    assert.equal(L.isRoomQuiet(L.ageBand(r.created_at, NOW), null), false, 'no baseline quiets nothing');
+  }
+});
+
+test('a short list keeps every pill, and a calm room announces nothing', () => {
+  const L = lib();
+  // Three chips can be read one at a time; a wall needs a crowd.
+  assert.equal(L.roomBaseline(room(30, 30, 30), NOW), null, 'under the minimum, every row keeps its own');
+  assert.equal(L.BASELINE_MIN_ROWS, 4);
+  // A room that is uniformly calm has no alarm to move to the head. Announcing
+  // one there would invent the noise this removes.
+  assert.equal(L.roomBaseline(room(0.1, 0.2, 0.3, 0.4, 0.5), NOW), null, 'all fresh says nothing');
+  assert.equal(L.roomBaseline(room(1, 1, 2, 2, 2), NOW), null, 'all waiting-a-day says nothing either');
+});
+
+test('the room line and the rows cannot describe the threshold two ways', () => {
+  const L = lib();
+  // The head's words come from the band's own label, so there is one vocabulary.
+  for (const b of L.BANDS) {
+    const line = L.roomAgeLine({ band: b, count: 9, total: 12 });
+    assert.equal(line, `9 of 12 ${b.label}`, `${b.id} reads in its own words`);
+  }
+});
+
+test('the quiet treatment is wired through the render, not just defined', () => {
+  const js = read('modules', 'hall-ui', 'public', 'collab.js');
+  assert.match(js, /function ageChip\(req, nowMs, baseline\)/, 'the chip is told about its room');
+  assert.match(js, /L\.isRoomQuiet\(band, baseline\)/, 'through the lib, so the rule is the tested one');
+  assert.match(js, /cb-age--quiet/, 'and the class reaches the markup');
+  // Over the WHOLE list: a baseline computed on the shown three would flip when
+  // a reader pressed "Show all" and re-alarm the rows it had just quieted.
+  assert.match(js, /const baseline = L\.roomBaseline\(list, nowMs\)/, 'the room is the whole block');
+  const html = read('modules', 'hall-ui', 'public', 'collab.html');
+  for (const key of ['for-me', 'mine', 'all']) {
+    assert.ok(html.includes(`id="cb-${key}-age"`), `the ${key} head has somewhere to say it`);
+  }
+  const css = read('modules', 'hall-ui', 'public', 'collab.css');
+  assert.match(
+    css,
+    /\.cb-age\.cb-age--quiet\s*\{[^}]*border-color: transparent/,
+    'the quieted row drops its ring',
+  );
+  assert.match(css, /\.cb-age\.cb-age--quiet\s*\{[^}]*color: var\(--ink-soft\)/, 'and the danger ink with it');
+});
+
 test('the alarm does not sit beside the accent control', () => {
   // DESIGN.md spends the accent only on what is pressable or live. On "Your
   // asks" the age pill (danger ink) used to share the right column with the

package/tests/file_map.mjs

@@ -93,6 +93,65 @@ test('generation is deterministic + idempotent (a second run is a no-op)', () =>
   assert.match(r2.stdout, /already current/);
 });
 
+// ── module coverage (task 1004066) ────────────────────────────────────────────
+// The check is a set comparison over a directory listing, and a set comparison breaks by
+// comparing two empty sets and passing. Every case below is written so that a matcher which
+// vouches for everything, or a scan which enumerates nothing, FAILS here.
+
+test('every dir under modules/ is documented in file-map.md — and the set being compared is not empty', () => {
+  const cov = gen.moduleCoverage();
+  assert.ok(cov.onDisk.length > 0, 'modules/ enumerated to nothing — the coverage check would be vacuous');
+  assert.deepEqual(cov.defects, [], `module-coverage scan defects: ${cov.defects.join('; ')}`);
+  assert.deepEqual(cov.undocumented, [], `modules with no file-map entry: ${cov.undocumented.join(', ')}`);
+});
+
+test('--check FAILS (exit 2) on a module with no file-map entry — the trap case', () => {
+  const probe = path.join(ROOT, 'modules', '__filemap_probe__');
+  try {
+    mkdirSync(probe, { recursive: true });
+    writeFileSync(path.join(probe, 'module.json'), '{"key":"__filemap_probe__"}\n');
+    const cov = gen.moduleCoverage();
+    assert.ok(cov.onDisk.includes('__filemap_probe__'), 'the probe module must be enumerated');
+    assert.deepEqual(cov.undocumented, ['__filemap_probe__'], 'an undocumented module must be the ONLY finding');
+    const r = run(['--check']);
+    assert.equal(r.code, 2, 'an undocumented module must fail the gate');
+    assert.match(r.stderr, /modules with NO docs\/file-map\.md entry/);
+    assert.match(r.stderr, /__filemap_probe__/);
+  } finally {
+    rmSync(probe, { recursive: true, force: true });
+  }
+  // Asserted on the module finding rather than the exit code: --check reports every problem class
+  // at once, and a checkout carrying unrelated local noise (materialised module skills with no
+  // note) would otherwise make this read as "the probe is still there".
+  const after = run(['--check']);
+  assert.equal(gen.moduleCoverage().undocumented.length, 0, 'coverage is clean once the probe module is removed');
+  assert.doesNotMatch(after.stderr || '', /modules with NO docs\/file-map\.md entry/);
+});
+
+test('the matcher discriminates: a real module passes, an absent one does not, and a prefix cannot vouch', () => {
+  const md = readFileSync(path.join(ROOT, 'docs', 'file-map.md'), 'utf8');
+  const block = gen.modulesBlock(md);
+  assert.ok(block.length > 0, 'the modules/ tree block must be findable — an empty block would make entries unreadable');
+  assert.ok(gen.isModuleDocumented(md, block, 'government'), 'a documented module reads as documented');
+  assert.equal(gen.isModuleDocumented(md, block, '__no_such_module__'), false, 'an absent module must NOT read as documented');
+  // A bare substring test would let `modules/agents-extra` vouch for `agents`.
+  assert.equal(
+    gen.isModuleDocumented('see modules/agents-extra/thing.js', '', 'agents'),
+    false,
+    'a longer path sharing the prefix must not count as an entry',
+  );
+  // A skill dir listed in the same `├── name/` shape elsewhere in the map must not vouch either:
+  // the entry search is scoped to the modules/ block.
+  assert.equal(gen.modulesBlock('├── .claude/skills/\n├── recall/  ← a skill\n'), '', 'no modules/ block → no block to read entries from');
+});
+
+test('module coverage reports a SCAN DEFECT rather than passing when the map cannot be read', () => {
+  const cov = gen.moduleCoverage('');
+  assert.ok(cov.onDisk.length > 0);
+  assert.equal(cov.defects.length, 1, 'an unreadable map is a defect, not a pass');
+  assert.match(cov.defects[0], /cannot run/);
+});
+
 test('every note maps to a real skill/routine (sidecar has no dangling keys)', () => {
   const notes = JSON.parse(readFileSync(path.join(ROOT, 'docs', 'file-map.notes.json'), 'utf8'));
   for (const section of gen.SECTIONS) {

package/tests/hall_collab_world.mjs

@@ -230,7 +230,11 @@ test('the door and the copy control are on the row, and the copy control is reac
   // One request can appear in three blocks at once, so the id is block-scoped.
   assert.match(js, /function askId\(key, id\)/);
   assert.match(js, /cb-ask-\$\{key\}-/);
-  assert.match(js, /rowFn\(r, nowMs, false, key\)/, 'and paintBlock hands the key down');
+  // A bracket class, not a closing paren: paintBlock also hands the row its
+  // block's age baseline (task 1004067), and pinning the exact arity would red
+  // this on an argument the invariant — that the KEY reaches the row — does not
+  // care about.
+  assert.match(js, /rowFn\(r, nowMs, false, key[,)]/, 'and paintBlock hands the key down');
 
   const css = read('collab.css');
   for (const cls of ['.cb-ask ', '.cb-ask__door', '.cb-ask__copy', '.cb-ask__full']) {
@@ -262,8 +266,12 @@ test('the age is a state pill in the row\'s right column, and every band has its
   assert.match(css, /\.cb-age--stale\s*\{[^}]*var\(--danger\)/, 'stale is the danger ink');
   assert.match(css, /\.cb-age--aging\s*\{[^}]*var\(--warn\)/, 'aging is the warn ink');
   const js = read('collab.js');
-  assert.match(js, /class="fact-pill cb-age cb-age--\$\{band\.id\}"/, 'the pill is the shell\'s fact-pill');
-  assert.match(js, /<div class="ov-row__right">\$\{ageChip\(req, nowMs\)\}/, 'in the right column, so a glance down the list reads the ages');
+  // Both pins stop short of the closing character, because the band's class is
+  // now followed by the room's quiet modifier and ageChip by the baseline that
+  // decides it (task 1004067). What they assert is unchanged: the shell's pill,
+  // in the right column.
+  assert.match(js, /class="fact-pill cb-age cb-age--\$\{band\.id\}/, 'the pill is the shell\'s fact-pill');
+  assert.match(js, /<div class="ov-row__right">\$\{ageChip\(req, nowMs[,)]/, 'in the right column, so a glance down the list reads the ages');
 });
 
 // ---- the copy desk: quieter, and no fact lost ----------------------------------

package/tests/module-scope-map.mjs

@@ -54,6 +54,77 @@ test('`protected` is DERIVED from the imported PROTECTED_GLOBS, never hand-set',
   assert.ok(prot.length < scope.moduleKeys().length, 'expected at least one non-protected module');
 });
 
+// THE PROTECTED SET IS PINNED BY NAME (task 1004070, ADR 0314).
+//
+// The assertion above says the roster contains both kinds; it passes on any
+// twelve. That is the shape a silent unprotection hides in — a glob edit that
+// dropped `migrations/` off `lifecycle` would keep the count and leave the ship
+// pipeline scopeable by anyone. It has already drifted once in the other
+// direction: task 1004070 was written against a re-measurement of 11, and
+// `agents` (protected by `modules/agents/`, itself a PROTECTED_GLOBS entry) was
+// missing from it.
+//
+// So the set is spelled out. A module ARRIVING here is a deliberate line in a
+// diff; a module LEAVING is the one that must never happen quietly.
+const PROTECTED_MODULES = [
+  'agents',
+  'autonomy',
+  'builder-settings',
+  'copy-desk',
+  'dev-box',
+  'devsecops',
+  'government',
+  'grading',
+  'kernel',
+  'lifecycle',
+  'methodology',
+  'onboarding',
+];
+
+test('the protected module set is exactly this, by name', () => {
+  assert.deepEqual(
+    scope.protectedModules().slice().sort(),
+    [...PROTECTED_MODULES].sort(),
+    'the derived protected set changed — if that was intended, edit PROTECTED_MODULES in the same diff and say why',
+  );
+});
+
+test('the seven trust-core modules can never leave the protected set', () => {
+  // Stated separately from the pin above because these are not interchangeable
+  // with the rest: their territory IS the trust / ship / authz core, so an edit
+  // that unprotects one is a security regression rather than a roster change.
+  // ADR 0314 narrows which MODULES derive protected; it must never reach these.
+  for (const k of ['kernel', 'lifecycle', 'government', 'grading', 'dev-box', 'devsecops', 'methodology']) {
+    assert.equal(scope.scopeForModule(k).protected, true, `${k} must stay protected`);
+  }
+});
+
+test('narrowing the module roster must not narrow the PATH wall', () => {
+  // The other half of ADR 0314's verification, and the one that would make this
+  // a false success: whatever happens to the module flag, a sub-Metic builder
+  // touching a protected CLI is still refused, by the per-file check.
+  // Each file is scoped to the module that OWNS it, deliberately: check() runs
+  // scope-subset before the path wall, so scoping them all to one module would
+  // get `out_of_scope` and prove nothing about protection. The owning module is
+  // what makes the scope wall pass, leaving the path wall as the only thing that
+  // can refuse — which is exactly the claim under test.
+  const owned = [
+    ['onboarding', 'scripts/gds/setup.js'],
+    ['autonomy', 'scripts/gds/conductor-dispatch.js'],
+    ['copy-desk', 'scripts/gds/copy-inventory.js'],
+  ];
+  for (const [mod, f] of owned) {
+    assert.ok(PROTECTED_GLOBS.includes(f), `fixture assumption: ${f} is a protected surface`);
+    assert.equal(gsc.scopeSubset([mod], [f]).ok, true, `fixture assumption: ${mod} owns ${f}`);
+    const r = gsc.check([mod], [f], 'thetes');
+    assert.equal(r.ok, false, `a sub-Metic builder must still be refused on ${f}`);
+    assert.equal(r.code, 'protected_path', `${f} must be refused BY THE PATH WALL, not by scope`);
+    // ...and Metic+ passes, so the refusal is the rank floor and not the path
+    // being unreachable to everyone.
+    assert.equal(gsc.check([mod], [f], 'metic').ok, true, `a Metic must still be able to author on ${f}`);
+  }
+});
+
 test('isProtected actually consults PROTECTED_GLOBS (overlap, prefix-aware both ways)', () => {
   assert.ok(PROTECTED_GLOBS.includes('migrations/'), 'fixture assumption: migrations/ is protected');
   assert.equal(scope.isProtected(['migrations/']), true, 'a protected glob must compute protected');