@bongos/core 1.19.917 → 1.19.919

package/tests/module-scope-map.mjs

@@ -2,6 +2,7 @@
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
+import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -78,12 +79,24 @@ test('`protected` is DERIVED from the imported PROTECTED_GLOBS, never hand-set',
 // three is still refused by the path wall (asserted below). What changed is who
 // may CREATE a goal whose territory happens to include them.
 //
-// `builder-settings` STAYS, deliberately: its overlap is src/bongos/routes/me.js
-// caught by the blanket src/bongos/routes/ prefix, not a command, so narrowing it
-// needs the me.js strangler move or a blanket-glob change — out of scope here.
+// NARROWED NINE -> EIGHT BY ADR 0318 (task 1004110). `builder-settings` left the
+// set. It derived protected on exactly one glob, src/bongos/routes/me.js, caught
+// by the blanket src/bongos/routes/ prefix. That glob was never an ownership
+// claim: MODULE_GLOBS listed it for task AFFINITY and said in the same comment
+// that the GET /me aggregator stays a thin CORE facade. It resolves ten module
+// ports and builder-settings is one of them, so the file is kernel territory and
+// is now owned there. Same shape as ADR 0314 one step on: owning the command is
+// not owning the authority, and neither is being listed next to it.
+//
+// Neither of the two routes the task proposed was taken, and the measurements are
+// why. Narrowing the blanket prefix was rejected because all 18 files under
+// src/bongos/routes/ are protected by that prefix AND NOTHING ELSE, so narrowing
+// removes the only wall from auth.js, builders.js, backup.js and core-update.js.
+// Moving me.js into modules/builder-settings/ was rejected because a ten-port
+// aggregator inside one module would have to resolve nine foreign ports from
+// inside a module, which is the core->module edge ADR 0083 rule 1 forbids.
 const PROTECTED_MODULES = [
   'agents',
-  'builder-settings',
   'dev-box',
   'devsecops',
   'government',
@@ -632,9 +645,16 @@ test('adopting the unowned paths did NOT change which modules are protected', ()
   for (const k of ['kernel', 'lifecycle', 'dev-box', 'devsecops', 'methodology']) {
     assert.equal(scope.scopeForModule(k).protected, true, `${k} was already protected and must stay so`);
   }
-  // and the ADR 0314 nine are still exactly the nine — PROTECTED_MODULES above
-  // is the by-name pin; this states the intent of THIS task against it.
-  assert.equal(scope.protectedModules().length, 9, 'adoption must not change the size of the protected set');
+  // and the adoption changed no COUNT either. Pinned against PROTECTED_MODULES
+  // rather than a literal, so the by-name pin above stays the single place the
+  // set is spelled out: a deliberate departure (ADR 0318 removing
+  // builder-settings) edits one list, while an ACCIDENTAL widening still reds
+  // both this and the by-name test. A literal here duplicated the roster and
+  // made an intended change look like two unrelated failures.
+  assert.equal(
+    scope.protectedModules().length, PROTECTED_MODULES.length,
+    'adoption must not change the size of the protected set',
+  );
 });
 
 test('the probe trap: matchOne takes an ARRAY, and a string reports everything unowned', () => {
@@ -651,3 +671,76 @@ test('the probe trap: matchOne takes an ARRAY, and a string reports everything u
     'a STRING second argument must not be mistaken for a working query',
   );
 });
+
+// --- ADR 0318: the GET /me aggregator is kernel territory (task 1004110) ---
+
+test('the GET /me aggregator is owned by kernel, not by builder-settings', () => {
+  // The affinity listing that made a whole module Archon-only. MODULE_GLOBS put
+  // src/bongos/routes/me.js under builder-settings and said in the same comment
+  // that the aggregator stays a thin CORE facade - so the glob was task affinity,
+  // never an ownership claim, and isProtected() could not tell the two apart.
+  const ME = 'src/bongos/routes/me.js';
+  assert.ok(
+    matchOne(ME, scope.scopeForModule('kernel').globs),
+    'kernel must own the /me aggregator - it is the core read facade over ten module ports',
+  );
+  assert.equal(
+    matchOne(ME, scope.scopeForModule('builder-settings').globs), null,
+    'builder-settings must NOT own /me: it is one of the ten ports the facade resolves, not its home',
+  );
+});
+
+test('builder-settings is not protected, and its own territory is what says so', () => {
+  assert.equal(
+    scope.scopeForModule('builder-settings').protected, false,
+    'builder-settings derived protected on the me.js affinity listing alone - removing it is the whole point of ADR 0318',
+  );
+  // Prove the module did not simply lose its territory on the way: it still owns
+  // its own directory, and that directory is genuinely not protected. Without
+  // this, blanking the globs entirely would pass the assertion above.
+  assert.ok(
+    matchOne('modules/builder-settings/interaction-prefs.js', scope.scopeForModule('builder-settings').globs),
+    'builder-settings must still own its own module directory',
+  );
+});
+
+test('unprotecting builder-settings did NOT open the path wall on /me', () => {
+  // The half that would make this a false success, mirroring the ADR 0314 test
+  // above. The module flag decides who may CREATE a goal over the territory; the
+  // per-file wall decides who may WRITE it. Only the first was meant to move.
+  const ME = 'src/bongos/routes/me.js';
+  assert.ok(
+    touchesOverlap([ME], PROTECTED_GLOBS),
+    'fixture assumption: /me is still a protected surface via the src/bongos/routes/ prefix',
+  );
+  assert.equal(gsc.scopeSubset(['kernel'], [ME]).ok, true, 'fixture assumption: kernel now owns /me');
+  const r = gsc.check(['kernel'], [ME], 'thetes');
+  assert.equal(r.ok, false, 'a sub-Metic builder must still be refused on /me');
+  assert.equal(r.code, 'protected_path', '/me must be refused BY THE PATH WALL, not by scope');
+  assert.equal(gsc.check(['kernel'], [ME], 'metic').ok, true, 'a Metic must still be able to author on /me');
+});
+
+test('every file under src/bongos/routes/ is protected by the blanket prefix AND NOTHING ELSE', () => {
+  // The measurement that killed the other option on task 1004110, pinned so the
+  // next reader does not have to re-derive it. Narrowing the blanket
+  // src/bongos/routes/ prefix looks like a small change and is not: it is the
+  // ONLY protection every route file has, auth.js and core-update.js included.
+  //
+  // If this reds because a route gained its own PROTECTED_GLOBS entry, that is
+  // fine and the exemption should be stated deliberately. If it reds because the
+  // blanket entry went away, read task 1004116 before touching anything.
+  const BLANKET = 'src/bongos/routes/';
+  assert.ok(PROTECTED_GLOBS.includes(BLANKET), 'the blanket route prefix must still be a protected glob');
+  const others = PROTECTED_GLOBS.filter((g) => g !== BLANKET);
+  const dir = path.join(ROOT, 'src', 'bongos', 'routes');
+  const files = fs.readdirSync(dir).filter((f) => f.endsWith('.js') || f.endsWith('.md'));
+  assert.ok(files.length >= 18, 'expected the route directory to still be populated, saw ' + files.length);
+  for (const f of files) {
+    const rel = BLANKET + f;
+    assert.ok(touchesOverlap([rel], PROTECTED_GLOBS), rel + ' must be protected');
+    assert.deepEqual(
+      others.filter((g) => matchOne(rel, [g])), [],
+      rel + ' is protected by the blanket prefix alone - narrowing the prefix would leave it unwalled',
+    );
+  }
+});

package/tests/removal_verdict.mjs

@@ -0,0 +1,311 @@
+// tests/removal_verdict.mjs — BV2.R16: confirming or dismissing a removal
+// proposal (task 1004095, ADR 0313 + ADR 0319). The sibling of
+// tests/removal_proposal.mjs, which covers the QUESTION this file answers.
+//
+// WHAT THESE ASSERTIONS ARE FOR. The feature's whole output is a fact that
+// survives the click: which answer a person gave. So the tests that matter are
+// the ones that fail if the two answers ever become indistinguishable — if a
+// verdict stops being written, if the closing status is the only record, if the
+// prefix match widens to a task nobody proposed removing, or if a second click
+// silently overwrites the first.
+//
+// Nothing here talks to a database. The pure half is pure; the transaction runs
+// against the #538 `deps.pool` seam with a SQL-aware fake, the abandon_task.mjs
+// posture. The one thing a fake cannot pin — that the SQL is valid Postgres — is
+// left to the live route, deliberately rather than by omission.
+//
+// Run:  node tests/removal_verdict.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const cascade = require('../modules/lifecycle/cascade.js');
+const rot = require('../modules/lifecycle/rot.js');
+const proposals = require('../modules/lifecycle/removal-proposals.js');
+
+const { test, summary } = makeRunner();
+
+const SHIP = 1004090;
+const PROPOSAL = 555001;
+const DECIDER = 42;
+
+// The ref a REAL proposal carries, built by the same code that files one rather
+// than typed out here. A literal would let this file agree with itself while
+// disagreeing with production — the exact failure mode task 1004090 shipped.
+const rule = cascade.CASCADES.find((r) => r.key === cascade.REMOVAL_RULE_KEY);
+const realSpec = cascade.cascadeTaskSpec(
+  rule,
+  { id: SHIP, goal_id: 1000095, version_id: 'BONGOS-V2' },
+  cascade.TRIGGERS.ship,
+  { removals: [{ taskId: '1003000', title: 'earlier work', paths: ['a/gone.js'] }] }
+);
+const REAL_REF = realSpec.sourceRef;
+
+// --- the prefix, end to end -------------------------------------------------
+
+await test('the prefix matches what the cascade actually writes', () => {
+  // THE WHOLE PATH, not its middle: the prefix is asserted against a spec the
+  // real rule produced, so a change to the key or to cascadeSourceRef's format
+  // reds here instead of quietly making the queue read return nothing.
+  assert.ok(REAL_REF.startsWith(proposals.PROPOSAL_SOURCE_REF_PREFIX),
+    `a real proposal ref (${REAL_REF}) must carry the prefix the reader matches`);
+  assert.equal(proposals.shipTaskIdFromSourceRef(REAL_REF), SHIP,
+    'and the ship id must come back out of it');
+});
+
+await test('the prefix does NOT match the other cascade rule', () => {
+  // Both rules write `source: 'cascade'`, so the ref prefix is the ONLY thing
+  // separating a removal question from an artist review. If it ever widened, a
+  // Confirm button would appear on a copy review and answering it would record a
+  // removal verdict about work nobody proposed removing.
+  const artist = cascade.CASCADES.find((r) => r.key === 'artist-review-on-ship');
+  const artistRef = cascade.cascadeSourceRef(artist.key, SHIP);
+  assert.ok(!artistRef.startsWith(proposals.PROPOSAL_SOURCE_REF_PREFIX));
+  assert.equal(proposals.shipTaskIdFromSourceRef(artistRef), null);
+});
+
+await test('a malformed or foreign ref yields null, never a guess', () => {
+  const P = proposals.PROPOSAL_SOURCE_REF_PREFIX;
+  assert.equal(proposals.shipTaskIdFromSourceRef(`${P}not-a-number`), null);
+  assert.equal(proposals.shipTaskIdFromSourceRef(P), null, 'a bare prefix names no ship');
+  assert.equal(proposals.shipTaskIdFromSourceRef(`${P}0`), null, 'zero is not a task id');
+  assert.equal(proposals.shipTaskIdFromSourceRef(`${P}12.5`), null);
+  assert.equal(proposals.shipTaskIdFromSourceRef('planning-session-bv2'), null);
+  assert.equal(proposals.shipTaskIdFromSourceRef(null), null);
+  assert.equal(proposals.shipTaskIdFromSourceRef(undefined), null);
+});
+
+// --- the vocabulary ---------------------------------------------------------
+
+await test('the verdict vocabulary is an allow-list of exactly two', () => {
+  assert.deepEqual([...proposals.VERDICTS].sort(), ['confirmed', 'dismissed']);
+});
+
+await test('an unknown verdict is refused BEFORE the transaction opens', async () => {
+  // A deny-list ("anything that is not dismissed confirms") would admit every
+  // value added later, and the admitted one is the answer that dims a star. The
+  // refusal must also cost no connection — a rejected verdict that still opened a
+  // transaction would be a lock taken for a write that can never happen.
+  for (const bad of ['removed', 'CONFIRMED', 'confirm', '', null, undefined, 1]) {
+    let connected = false;
+    const pool = { connect: async () => { connected = true; throw new Error('must not connect'); } };
+    await assert.rejects(
+      () => proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: bad }, { pool }),
+      (err) => err.code === 'BAD_VERDICT',
+      `verdict ${JSON.stringify(bad)} must be refused`
+    );
+    assert.equal(connected, false, 'no transaction for a refused verdict');
+  }
+});
+
+// --- the transaction --------------------------------------------------------
+
+// The fake: one proposal row, an optional existing verdict, and a recording log.
+function fakePool({
+  status = 'backlog',
+  notFound = false,
+  source = 'cascade',
+  sourceRef = REAL_REF,
+  existingVerdict = null,
+} = {}) {
+  return makeSqlAwareClient((s, params) => {
+    if (/^SELECT id::text AS id, title, status, source, source_ref FROM tasks WHERE id = \$1 FOR UPDATE/.test(s)) {
+      return { rows: notFound ? [] : [{ id: String(params[0]), title: 'Was this removed?', status, source, source_ref: sourceRef }] };
+    }
+    if (/^SELECT verdict, decided_by/.test(s)) {
+      return { rows: existingVerdict ? [existingVerdict] : [] };
+    }
+    if (/^INSERT INTO lifecycle_removal_verdicts/.test(s)) {
+      return {
+        rows: [{
+          proposal_task_id: String(params[0]),
+          ship_task_id: params[1] == null ? null : String(params[1]),
+          verdict: params[2],
+          decided_by: params[3] == null ? null : String(params[3]),
+          decided_at: '2026-09-20T00:00:00.000Z',
+          note: params[4] || null,
+        }],
+      };
+    }
+    return { rows: [] };  // BEGIN / COMMIT / ROLLBACK / UPDATE tasks
+  });
+}
+
+const find = (queries, re) => queries.find((q) => re.test(String(q.sql).replace(/\s+/g, ' ').trim()));
+
+await test('confirming writes the verdict AND closes the question, in one txn', async () => {
+  const pool = fakePool();
+  const out = await proposals.recordVerdict(
+    { proposalTaskId: PROPOSAL, verdict: 'confirmed', builderId: DECIDER },
+    { pool }
+  );
+
+  assert.equal(out.verdict, 'confirmed');
+  assert.equal(out.ship_task_id, String(SHIP), 'the ship is denormalised out of the ref');
+  assert.equal(out.decided_by, String(DECIDER), 'a verdict without an author is a rumour');
+
+  const ins = find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/);
+  assert.ok(ins, 'the verdict row is the record — it must be written');
+  assert.deepEqual(ins.params.slice(0, 4), [PROPOSAL, SHIP, 'confirmed', DECIDER]);
+
+  const upd = find(pool._client.queries, /^UPDATE tasks/);
+  assert.ok(upd, 'the answered question must leave the queue');
+  assert.ok(/status = 'abandoned'/.test(String(upd.sql)), 'closed as abandoned, the ledger\'s one spelling');
+  assert.ok(find(pool._client.queries, /^COMMIT/), 'both writes commit together');
+  assert.ok(!find(pool._client.queries, /^ROLLBACK/));
+});
+
+await test('dismissing writes the OPPOSITE verdict and closes it the same way', async () => {
+  // The point of the whole table: the two answers differ in the verdict column
+  // and NOWHERE else that matters. If a future edit made dismiss skip the insert,
+  // a dismissed proposal would be indistinguishable from an unanswered one that
+  // somebody killed off the rot feed.
+  const pool = fakePool();
+  const out = await proposals.recordVerdict(
+    { proposalTaskId: PROPOSAL, verdict: 'dismissed', builderId: DECIDER },
+    { pool }
+  );
+  assert.equal(out.verdict, 'dismissed');
+  const ins = find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/);
+  assert.equal(ins.params[2], 'dismissed');
+  assert.ok(find(pool._client.queries, /^UPDATE tasks/), 'dismissing closes the question too');
+  assert.ok(find(pool._client.queries, /^COMMIT/));
+});
+
+await test('the proposal row is locked FOR UPDATE before anything is decided', async () => {
+  // Two people pressing Confirm and Dismiss at the same moment must not both read
+  // "undecided" and both write. The lock is what makes the second one lose.
+  const pool = fakePool();
+  await proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'confirmed' }, { pool });
+  const sel = find(pool._client.queries, /FROM tasks WHERE id = \$1 FOR UPDATE/);
+  assert.ok(sel, 'the row must be locked');
+  const order = pool._client.queries.map((q) => String(q.sql).replace(/\s+/g, ' ').trim());
+  assert.ok(order.indexOf('BEGIN') < order.findIndex((s) => /FOR UPDATE/.test(s)),
+    'the lock is taken inside the transaction');
+});
+
+await test('a task that is not a removal proposal cannot be answered', async () => {
+  const pool = fakePool({ source: 'planning-session', sourceRef: 'bv2-ideator-surface-R15a' });
+  await assert.rejects(
+    () => proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'confirmed' }, { pool }),
+    (err) => err.code === 'NOT_A_PROPOSAL'
+  );
+  assert.ok(!find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/), 'nothing written');
+  assert.ok(find(pool._client.queries, /^ROLLBACK/));
+});
+
+await test('an ARTIST REVIEW is not a removal proposal either', async () => {
+  // Same `source`, different rule. This is the row most likely to be mistaken for
+  // one, because everything except the ref matches.
+  const artistRef = cascade.cascadeSourceRef('artist-review-on-ship', SHIP);
+  const pool = fakePool({ source: 'cascade', sourceRef: artistRef });
+  await assert.rejects(
+    () => proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'dismissed' }, { pool }),
+    (err) => err.code === 'NOT_A_PROPOSAL'
+  );
+  assert.ok(!find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/));
+});
+
+await test('a missing task is NOT_FOUND and rolls back', async () => {
+  const pool = fakePool({ notFound: true });
+  await assert.rejects(
+    () => proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'confirmed' }, { pool }),
+    (err) => err.code === 'NOT_FOUND'
+  );
+  assert.ok(find(pool._client.queries, /^ROLLBACK/));
+});
+
+await test('a second answer is refused, never an overwrite', async () => {
+  // Not an upsert and not an idempotent 200. Overwriting would destroy the record
+  // that a person answered differently, which is the one thing this table holds.
+  const pool = fakePool({
+    status: 'abandoned',
+    existingVerdict: { verdict: 'dismissed', decided_by: '7', decided_at: '2026-09-19T00:00:00.000Z' },
+  });
+  await assert.rejects(
+    () => proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'confirmed' }, { pool }),
+    (err) => err.code === 'ALREADY_DECIDED' && err.existing && err.existing.verdict === 'dismissed'
+  );
+  assert.ok(!find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/));
+});
+
+await test('already-decided outranks already-closed, so the message is the useful one', async () => {
+  // An answered proposal is ALSO abandoned, so checking the status first would
+  // report "this is not an open question" to someone whose real answer is "it was
+  // already dismissed, by builder 7, yesterday".
+  const pool = fakePool({
+    status: 'abandoned',
+    existingVerdict: { verdict: 'confirmed', decided_by: '7', decided_at: '2026-09-19T00:00:00.000Z' },
+  });
+  await assert.rejects(
+    () => proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'confirmed' }, { pool }),
+    (err) => err.code === 'ALREADY_DECIDED'
+  );
+});
+
+await test('a proposal that left backlog with no verdict is closed, not answerable', async () => {
+  // Killed or prioritised off the rot feed. The question is gone; a verdict on it
+  // would answer something nobody is asking.
+  const pool = fakePool({ status: 'ready' });
+  await assert.rejects(
+    () => proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'confirmed' }, { pool }),
+    (err) => err.code === 'PROPOSAL_CLOSED' && err.status === 'ready'
+  );
+  assert.ok(!find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/));
+});
+
+await test('an unparseable ref still answers — with a null ship, not a refusal', async () => {
+  // The verdict is the point. Refusing to record one because the convenience
+  // column could not be filled would be the tail wagging the dog.
+  const pool = fakePool({ sourceRef: `${proposals.PROPOSAL_SOURCE_REF_PREFIX}oops` });
+  const out = await proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'confirmed' }, { pool });
+  assert.equal(out.ship_task_id, null);
+  const ins = find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/);
+  assert.equal(ins.params[1], null, 'ship_task_id binds NULL rather than a guess');
+});
+
+await test('a note is trimmed and capped; an empty one stores nothing', async () => {
+  const pool = fakePool();
+  await proposals.recordVerdict(
+    { proposalTaskId: PROPOSAL, verdict: 'dismissed', note: '  it was a move  ' },
+    { pool }
+  );
+  assert.equal(find(pool._client.queries, /^INSERT INTO lifecycle_removal_verdicts/).params[4], 'it was a move');
+
+  const pool2 = fakePool();
+  await proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'dismissed', note: '   ' }, { pool: pool2 });
+  assert.equal(find(pool2._client.queries, /^INSERT INTO lifecycle_removal_verdicts/).params[4], '',
+    'blank binds the empty string, which NULLIF turns into NULL');
+
+  const pool3 = fakePool();
+  await proposals.recordVerdict({ proposalTaskId: PROPOSAL, verdict: 'dismissed', note: 'x'.repeat(5000) }, { pool: pool3 });
+  assert.ok(find(pool3._client.queries, /^INSERT INTO lifecycle_removal_verdicts/).params[4].length <= 2000);
+});
+
+await test('the closure line says which answer was given, and is not the record', () => {
+  const yes = proposals.closureSummary('confirmed', null);
+  const no = proposals.closureSummary('dismissed', null);
+  assert.notEqual(yes, no, 'the two answers must not read the same');
+  assert.match(yes, /confirmed/i);
+  assert.match(no, /dismissed/i);
+  assert.match(proposals.closureSummary('dismissed', 'a rename'), /a rename$/);
+});
+
+// --- the clock it rides rather than rebuilds --------------------------------
+
+await test('an unanswered proposal rots, an answered one leaves the feed', () => {
+  // Spec decision 14, proved against the rot module's own vocabulary rather than
+  // asserted in a comment. A proposal is filed at 'backlog' (pinned upstream in
+  // tests/removal_proposal.mjs) and answering it writes 'abandoned'.
+  assert.ok(rot.TASK_ROTTABLE_STATUSES.includes('backlog'),
+    'an unanswered proposal must sit in a rottable status');
+  assert.ok(!rot.TASK_ROTTABLE_STATUSES.includes('abandoned'),
+    'an answered one must fall out of the feed by the same mechanism');
+  assert.equal(realSpec.status, 'backlog', 'and that is the status the cascade actually files');
+});
+
+summary();