@bongos/core 1.19.914 → 1.19.916

package/tests/ideas_config.mjs

@@ -0,0 +1,271 @@
+// tests/ideas_config.mjs — the two per-instance ideator dials (BV2.R05).
+//
+// What this file is actually guarding is not "the config parses". It is the
+// thing the task description originally got wrong: that the ignite floor is a
+// SCHEDULING preference and the trusted tier is an AUTHORITY boundary, and that
+// turning the first dial must not move the second. Most of the assertions below
+// exist to fail loudly if someone later "simplifies" this by making METIC_PLUS
+// itself configurable.
+
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+// fileURLToPath, never URL.pathname — a space becomes %20 and a Windows drive
+// gains a leading slash, so require()/fs throw MODULE_NOT_FOUND at load
+// (task 1002889; both tests/test_path_guard.mjs and fitness.js enforce it).
+const ROOT = fileURLToPath(new URL('..', import.meta.url));
+
+const ideasConfig = require(path.join(ROOT, 'modules/ideas/config.js'));
+const routing = require(path.join(ROOT, 'modules/ideas/routing.js'));
+const catalog = require(path.join(ROOT, 'modules/government/catalog.js'));
+const instanceConfig = require(path.join(ROOT, 'src/instance-config.js'));
+const api = require(path.join(ROOT, 'src/module-api.js'));
+
+// Env knobs are read through api.resolveEnv, which PREFIXES the suffix with the
+// instance's own env prefix (OTB_, CLOUDBONGOS_, ...). Resolving it here rather
+// than hard-coding one keeps this test honest on a rebranded instance — and
+// hard-coding the bare suffix is exactly how the first cut of this file passed a
+// name nothing reads.
+const ENV_PREFIX = instanceConfig.envPrefix();
+const envName = (suffix) => `${ENV_PREFIX}_${suffix}`;
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+// A scratch pair of config paths, so nothing here touches the real files.
+function withPacks(neutral, instance, fn) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ideas-config-'));
+  const neutralPath = path.join(dir, 'ideas.neutral.json');
+  const instancePath = path.join(dir, 'ideas.json');
+  if (neutral !== null) fs.writeFileSync(neutralPath, typeof neutral === 'string' ? neutral : JSON.stringify(neutral));
+  if (instance !== null) fs.writeFileSync(instancePath, typeof instance === 'string' ? instance : JSON.stringify(instance));
+  try { return fn({ neutralPath, instancePath }); }
+  finally { fs.rmSync(dir, { recursive: true, force: true }); }
+}
+const load = (neutral, instance, env = {}) =>
+  withPacks(neutral, instance, (roots) => ideasConfig.loadIdeasConfig({ env, roots }));
+
+// --- the defaults change nothing -------------------------------------------
+
+await test('the shipped neutral starter resolves to today\'s behaviour', () => {
+  const shipped = JSON.parse(fs.readFileSync(path.join(ROOT, 'config/ideas.neutral.json'), 'utf8'));
+  assert.equal(shipped.igniteFloor, 'metic', 'the neutral ignite floor must be metic — anything else widens on upgrade');
+  assert.equal(shipped.descentDecayRate, 0.5, 'decision 16 ruled halving');
+});
+
+await test('the default floor yields EXACTLY the METIC_PLUS set', () => {
+  // This is the assertion that makes `igniteFloor: 'metic'` a true no-op. If the
+  // ladder slice is ever off by one, these two sets diverge and every filing
+  // changes landing status silently.
+  const trusted = ideasConfig.trustedRanksForFloor('metic');
+  assert.deepEqual([...trusted].sort(), [...routing.METIC_PLUS].sort());
+});
+
+await test('a floor admits everything at or above it, and nothing below', () => {
+  assert.deepEqual([...ideasConfig.trustedRanksForFloor('xenos')].sort(), ['archon', 'metic', 'thetes', 'xenos']);
+  assert.deepEqual([...ideasConfig.trustedRanksForFloor('archon')].sort(), ['archon']);
+  assert.deepEqual([...ideasConfig.trustedRanksForFloor('thetes')].sort(), ['archon', 'metic', 'thetes']);
+});
+
+// --- the drift pin ----------------------------------------------------------
+
+await test('the rank ladder is DERIVED from the doorway, not restated', () => {
+  // tests/rank_tier_single_source.mjs forbids a ladder literal outside its
+  // allowlist; this is the behavioural half of that rule. Deriving means a rank
+  // added to the kernel widens this floor's vocabulary with no edit here.
+  assert.deepEqual([...ideasConfig.RANK_ORDER], [...api.LIVE_RANK_LADDER]);
+  // The government catalog is a third statement of the same ladder (allowlisted
+  // there). If the two sources ever disagree, the ignite floor and the rank
+  // gates would be reading different vocabularies, so pin them together.
+  assert.deepEqual([...api.LIVE_RANK_LADDER], [...catalog.RANK_ORDER],
+    'the kernel ladder and modules/government/catalog.js have drifted');
+});
+
+// --- precedence -------------------------------------------------------------
+
+await test('an instance pack overrides the neutral starter', () => {
+  const c = load({ igniteFloor: 'metic', descentDecayRate: 0.5 }, { igniteFloor: 'xenos', descentDecayRate: 0.25 });
+  assert.equal(c.igniteFloor, 'xenos');
+  assert.equal(c.descentDecayRate, 0.25);
+});
+
+await test('an instance pack may set one dial without restating the other', () => {
+  const c = load({ igniteFloor: 'metic', descentDecayRate: 0.5 }, { igniteFloor: 'thetes' });
+  assert.equal(c.igniteFloor, 'thetes');
+  assert.equal(c.descentDecayRate, 0.5, 'the unnamed dial must fall through to neutral, not to zero');
+});
+
+await test('env overrides both dials, above the instance pack', () => {
+  const c = load({ igniteFloor: 'metic' }, { igniteFloor: 'thetes' },
+    { [envName('IDEAS_IGNITE_FLOOR')]: 'archon', [envName('IDEAS_DESCENT_DECAY_RATE')]: '0.75' });
+  assert.equal(c.igniteFloor, 'archon');
+  assert.equal(c.descentDecayRate, 0.75);
+});
+
+await test('an UNPREFIXED env name is inert, not a second doorway', () => {
+  // resolveEnv only reads <PREFIX>_<SUFFIX>. A bare name must change nothing —
+  // otherwise any process with a generic IDEAS_IGNITE_FLOOR in its environment
+  // would silently move another instance's floor.
+  const c = load({ igniteFloor: 'metic' }, null,
+    { IDEAS_IGNITE_FLOOR: 'xenos', IDEAS_DESCENT_DECAY_RATE: '1' });
+  assert.equal(c.igniteFloor, 'metic');
+  assert.equal(c.descentDecayRate, 0.5);
+});
+
+await test('an invalid env value falls through to the pack, not to nothing', () => {
+  const c = load({ igniteFloor: 'metic', descentDecayRate: 0.5 }, { igniteFloor: 'thetes' },
+    { [envName('IDEAS_IGNITE_FLOOR')]: 'everyone', [envName('IDEAS_DESCENT_DECAY_RATE')]: 'soon' });
+  assert.equal(c.igniteFloor, 'thetes');
+  assert.equal(c.descentDecayRate, 0.5);
+});
+
+await test('no config at all still resolves to the in-code defaults', () => {
+  // The core whose config/ directory did not ship. It must boot to today's
+  // behaviour, not to an empty floor or a zero rate.
+  const c = load(null, null);
+  assert.equal(c.igniteFloor, 'metic');
+  assert.equal(c.descentDecayRate, 0.5);
+});
+
+// --- fail to vanilla, never to dead ----------------------------------------
+
+await test('a malformed instance pack falls back rather than bricking boot', () => {
+  const c = load({ igniteFloor: 'thetes', descentDecayRate: 0.25 }, '{ this is not json');
+  assert.equal(c.igniteFloor, 'thetes');
+  assert.equal(c.descentDecayRate, 0.25);
+});
+
+await test('an unknown rank name is refused, not coerced', () => {
+  // The dangerous direction. A typo must not silently become the widest floor.
+  for (const bad of ['everyone', 'METIC ', '', 'admin', 'Xeno', null, 7, {}]) {
+    const c = load({ igniteFloor: 'metic' }, { igniteFloor: bad });
+    assert.equal(c.igniteFloor, 'metic', `floor "${String(bad)}" should have been refused`);
+  }
+});
+
+await test('a rank name is case-normalised but NOT trimmed', () => {
+  assert.equal(load({ igniteFloor: 'metic' }, { igniteFloor: 'ARCHON' }).igniteFloor, 'archon');
+  assert.equal(load({ igniteFloor: 'metic' }, { igniteFloor: ' archon' }).igniteFloor, 'metic',
+    'a padded rank is a hostile shape, not a rank');
+});
+
+await test('a decay rate outside [0,1] is refused rather than clamped', () => {
+  for (const bad of [1.5, -0.1, NaN, Infinity, -Infinity, '0.5', null, {}]) {
+    const c = load({ descentDecayRate: 0.5 }, { descentDecayRate: bad });
+    assert.equal(c.descentDecayRate, 0.5, `rate ${String(bad)} should have been refused`);
+  }
+});
+
+await test('both ends of the decay band are legitimate choices', () => {
+  assert.equal(load({ descentDecayRate: 0.5 }, { descentDecayRate: 0 }).descentDecayRate, 0);
+  assert.equal(load({ descentDecayRate: 0.5 }, { descentDecayRate: 1 }).descentDecayRate, 1);
+});
+
+await test('an unrecognised floor yields the DEFAULT set, never an empty one', () => {
+  // Failing closed here would stop every ignition on a config typo. The floor is
+  // a scheduling preference; a stopped queue is a worse failure than a default.
+  assert.deepEqual([...ideasConfig.trustedRanksForFloor('nonsense')].sort(), [...routing.METIC_PLUS].sort());
+  assert.deepEqual([...ideasConfig.trustedRanksForFloor(null)].sort(), [...routing.METIC_PLUS].sort());
+});
+
+// --- the dial actually moves the landing ------------------------------------
+
+await test('lowering the floor makes a sub-Metic bug land claimable', () => {
+  const trusted = ideasConfig.trustedRanksForFloor('xenos');
+  const d = routing.decideLanding({ goalId: 5, kind: 'bug', filerRank: 'xenos', trustedRanks: trusted });
+  assert.equal(d.status, 'ready');
+  assert.equal(d.reason, 'bug_trusted_filer');
+});
+
+await test('lowering the floor also moves the HOMELESS bug branch', () => {
+  // Two call sites read the floor. A fix that threaded only one of them would
+  // leave the dial half-connected and this is what catches it.
+  const trusted = ideasConfig.trustedRanksForFloor('xenos');
+  const d = routing.decideLanding({ goalId: null, kind: 'bug', filerRank: 'xenos', vector: 'api', trustedRanks: trusted });
+  assert.equal(d.status, 'ready');
+  assert.equal(d.reason, 'bug_homeless_trusted_filer');
+});
+
+await test('raising the floor makes a Metic bug await a nod', () => {
+  const trusted = ideasConfig.trustedRanksForFloor('archon');
+  const d = routing.decideLanding({ goalId: 5, kind: 'bug', filerRank: 'metic', trustedRanks: trusted });
+  assert.equal(d.status, 'backlog');
+  assert.equal(d.reason, 'bug_awaiting_nod');
+});
+
+await test('omitting trustedRanks reproduces the constant exactly', () => {
+  // Every pre-R05 caller and test omits it. If this ever diverges, the whole
+  // "defaults preserve today's behaviour" claim is false.
+  for (const rank of ['xenos', 'thetes', 'metic', 'archon', null, 'nonsense']) {
+    const before = routing.decideLanding({ goalId: 5, kind: 'bug', filerRank: rank });
+    const after = routing.decideLanding({
+      goalId: 5, kind: 'bug', filerRank: rank,
+      trustedRanks: ideasConfig.trustedRanksForFloor('metic'),
+    });
+    assert.deepEqual(after, before, `rank ${String(rank)} diverged`);
+  }
+});
+
+await test('a non-Set trustedRanks is ignored, not trusted', () => {
+  // A caller handing an array, a string or an object must not accidentally widen
+  // anything — the guard is `instanceof Set`, and this pins it.
+  for (const bad of [['xenos'], 'xenos', { has: () => true }, true]) {
+    const d = routing.decideLanding({ goalId: 5, kind: 'bug', filerRank: 'xenos', trustedRanks: bad });
+    assert.equal(d.status, 'backlog', `trustedRanks ${JSON.stringify(bad)} was honoured and should not have been`);
+  }
+});
+
+// --- THE WALL: the floor is not the trusted tier ----------------------------
+
+await test('lowering the ignite floor does NOT let a sub-Metic propose a criterion', () => {
+  // The security claim the amended description turns on. mayProposeCriterion
+  // reads the fixed constant and takes no floor, so there is no argument this
+  // test could pass that would widen it.
+  assert.equal(ideasConfig.trustedRanksForFloor('xenos').has('xenos'), true, 'precondition: floor is wide open');
+  for (const rank of ['xenos', 'thetes']) {
+    assert.equal(routing.mayProposeCriterion(rank), false, `${rank} may not propose a criterion at any floor`);
+  }
+  assert.equal(routing.mayProposeCriterion('metic'), true);
+  assert.equal(routing.mayProposeCriterion('archon'), true);
+});
+
+await test('lowering the ignite floor does NOT breach the protected-scope wall', () => {
+  const trusted = ideasConfig.trustedRanksForFloor('xenos');
+  const landing = routing.decideLanding({ goalId: 5, kind: 'bug', filerRank: 'xenos', trustedRanks: trusted });
+  assert.equal(landing.status, 'ready', 'precondition: the dial is turned all the way down');
+
+  const verdict = routing.authorizeRoutedLanding({
+    landing, filerRank: 'xenos', scopeProtected: true,
+  });
+  assert.equal(verdict.ok, false, 'a wide-open ignite floor must not open the protected core');
+  assert.equal(verdict.code, 'protected_scope');
+});
+
+await test('authorizeRoutedLanding takes no floor argument at all', () => {
+  // Structural, not behavioural: if someone later adds one, this reds and makes
+  // them read the header rather than discovering the widening in production.
+  const src = fs.readFileSync(path.join(ROOT, 'modules/ideas/routing.js'), 'utf8');
+  const fn = src.slice(src.indexOf('function authorizeRoutedLanding'));
+  const sig = fn.slice(0, fn.indexOf(')') + 1);
+  assert.ok(!/trustedRanks|igniteFloor/.test(sig), `the scope wall grew a floor argument: ${sig}`);
+});
+
+await test('METIC_PLUS is still a hard-coded constant', () => {
+  // filing_abuse_matrix.mjs holds the same line. Keeping a copy here means the
+  // R05 test file itself refuses the shortcut it exists to prevent.
+  const src = fs.readFileSync(path.join(ROOT, 'modules/ideas/routing.js'), 'utf8');
+  assert.match(src, /METIC_PLUS = new Set\(\['metic', 'archon'\]\)/,
+    'METIC_PLUS must stay a constant — it is the trusted tier, not the ignite floor');
+});
+
+console.log(`\nideas_config: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);