@bongos/core 1.19.945 → 1.19.947

package/tests/goal_map_page.mjs

@@ -0,0 +1,236 @@
+// tests/goal_map_page.mjs — the goal map page, EXECUTED (task 1003479, goal
+// 1000089; ADR 0227 §5 and §7).
+//
+// The real hall-kit.js, the real goal-map-lib.js and the real goal-map.js run in
+// one vm against a stub DOM and a stubbed GET /goals/graph. What the ADR made
+// non-negotiable is asserted here as behaviour, not read off the source:
+//   - the TABLE is on the page by default (§5.1) — no toggle hides it;
+//   - category is TEXT on every node as well as a colour (§5.3);
+//   - the picture scrolls inside its own box and never widens the page (§5.2);
+//   - there is no control that could reach view A (every task) or view D
+//     (densified) (§7) — the only fetch is the aggregate;
+//   - the stand-alone goals are a list, not dots (§10.4 item 1), and the split is
+//     stated on the page.
+// Plus the one thing the browser adds that a lib test cannot see: a goal title is
+// builder-authored text and must never become markup.
+//
+// Run:  node tests/goal_map_page.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { makeRunner, makeEl, walk } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
+const KIT_JS = read('hall-kit.js');
+const LIB_JS = read('goal-map-lib.js');
+const PAGE_JS = read('goal-map.js');
+const PAGE_HTML = read('goal-map.html');
+const PAGE_CSS = read('goal-map.css');
+const FIXTURE = JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts/hall-preview/fixtures/goals__graph.json'), 'utf8'));
+
+const { test, summary } = makeRunner();
+const tick = () => new Promise((r) => setTimeout(r, 0));
+const settle = async () => { for (let i = 0; i < 20; i++) await tick(); };
+
+const node = (id, extra = {}) => ({ goal_id: String(id), title: `Goal ${id}`, status: 'open', version_id: 'V1', category: null, task_total: 5, task_done: 2, depends_on: 0, depended_on_by: 0, ...extra });
+
+async function boot(payload, { status = 200, fail = false } = {}) {
+  const root = makeEl('div');
+  const reg = (id, hidden = false) => { const el = makeEl('div', { id }); if (hidden) el.hidden = true; root.appendChild(el); return el; };
+  ['gm-sub', 'gm-graph', 'gm-legend', 'gm-alone', 'gm-alone-lede', 'gm-table'].forEach((id) => reg(id));
+  ['gm-alone-scroll', 'gm-table-scroll'].forEach((id) => reg(id, true));
+
+  const documentObj = {
+    getElementById: (id) => walk(root, (el) => (el.id === id ? el : null)),
+    // SVG elements: the stub's own class/id only follow attrs at construction, so
+    // mirror what a browser does when setAttribute writes them.
+    createElementNS(_ns, tag) {
+      const el = makeEl(tag);
+      const orig = el.setAttribute.bind(el);
+      el.setAttribute = (k, v) => { orig(k, v); if (k === 'class') el.className = String(v); if (k === 'id') el.id = String(v); };
+      return el;
+    },
+  };
+  const requests = [];
+  const navigations = [];
+  const locationObj = { hostname: 'builders.example.test', assign: (u) => navigations.push(u) };
+  const windowObj = {
+    OTB: { escapeHtml: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])) },
+    localStorage: { getItem: () => null, setItem() {} },
+    location: locationObj,
+    addEventListener() {},
+  };
+  const sandbox = {
+    window: windowObj, self: windowObj, document: documentObj, location: locationObj, console: { error() {}, log() {}, warn() {} },
+    setTimeout, clearTimeout, Promise, Date, Math, JSON, Error, Number, String, Object, Array, Boolean, Set, Map, RegExp, encodeURIComponent,
+    fetch: async (url) => {
+      requests.push(url);
+      if (fail) throw new Error('offline');
+      return { ok: status === 200, status, json: async () => payload };
+    },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(KIT_JS, sandbox, { filename: 'hall-kit.js' });
+  vm.runInContext(LIB_JS, sandbox, { filename: 'goal-map-lib.js' });
+  vm.runInContext(PAGE_JS, sandbox, { filename: 'goal-map.js' });
+  await settle();
+  const $ = (id) => documentObj.getElementById(id);
+  // The stub matches one compound selector at a time, so `tbody tr` is two steps.
+  const rows = () => { const tb = $('gm-table').querySelector('tbody'); return tb ? tb.querySelectorAll('tr') : []; };
+  return { $, requests, navigations, rows, svg: () => $('gm-graph').querySelector('svg') };
+}
+
+// ---- the table is the page ---------------------------------------------------------
+
+await test('the TABLE is on the page by default — every goal is a row, and nothing hides it behind a toggle', async () => {
+  const h = await boot(FIXTURE);
+  assert.equal(h.$('gm-table-scroll').hidden, false);
+  const rows = h.rows();
+  assert.equal(rows.length, FIXTURE.nodes.length, 'stand-alone goals are rows too');
+  assert.ok(h.$('gm-table').querySelector('table').getAttribute('aria-label'), 'the table is named for a screen reader');
+});
+
+await test('the picture is the enhancement, and it is a role=img figure: no focus stops, no links inside the drawing', async () => {
+  const h = await boot(FIXTURE);
+  const svg = h.svg();
+  assert.ok(svg, 'the map is drawn');
+  assert.equal(svg.getAttribute('role'), 'img');
+  assert.equal(svg.getAttribute('aria-labelledby'), 'gm-cap');
+  assert.equal(svg.querySelectorAll('a').length, 0, 'thirty-six hidden interactive elements from a drawing is the wrong trade');
+  assert.equal(svg.querySelectorAll('[tabindex]').length, 0);
+  assert.match(h.$('gm-graph').querySelector('figcaption').textContent, /also in the table below/);
+});
+
+await test('every goal in the map is a table row too, and every drawn dependency is named in the table', async () => {
+  const h = await boot(FIXTURE);
+  const drawn = h.svg().querySelectorAll('.gm-node').length;
+  assert.equal(drawn, FIXTURE.counts.connected);
+  const tableText = h.$('gm-table').textContent;
+  for (const e of FIXTURE.edges) {
+    const dependent = FIXTURE.nodes.find((n) => n.goal_id === e.from);
+    const dependency = FIXTURE.nodes.find((n) => n.goal_id === e.to);
+    assert.ok(tableText.includes(dependency.title || 'A private goal'), `the table names ${dependency.title}`);
+    assert.ok(tableText.includes(dependent.title || 'A private goal'));
+  }
+});
+
+// ---- category is text, not only colour ------------------------------------------------
+
+await test('CATEGORY IS A WORD on every drawn node, not only a colour — and "No category" is said too', async () => {
+  const h = await boot(FIXTURE);
+  const cats = h.svg().querySelectorAll('.gm-cat').map((t) => t.textContent);
+  assert.equal(cats.length, FIXTURE.counts.connected);
+  assert.ok(cats.every((c) => c.length > 0));
+  assert.ok(cats.includes('No category'), 'an uncategorised goal is legal and named as such (ADR 0192)');
+  assert.ok(cats.some((c) => /Modules|Security|Builders Hall|Economics/.test(c)));
+  assert.ok(h.$('gm-legend').textContent.includes('Modules'), 'and the legend spells each category out');
+});
+
+// ---- the split is stated, the alone goals are a list ----------------------------------
+
+await test('the stand-alone goals are a LIST, never dots, and the split is stated in the page head', async () => {
+  const h = await boot(FIXTURE);
+  const drawnIds = new Set(h.svg().querySelectorAll('.gm-node').map((g) => g.attrs.transform));
+  assert.equal(drawnIds.size, FIXTURE.counts.connected);
+  assert.equal(h.$('gm-alone-scroll').hidden, false);
+  assert.equal(h.$('gm-alone').querySelectorAll('li').length, FIXTURE.counts.isolated);
+  assert.match(h.$('gm-sub').textContent, new RegExp(`the other ${FIXTURE.counts.isolated} stand alone`));
+});
+
+// ---- no view A, no view D -------------------------------------------------------------------
+
+await test('NEITHER VIEW A NOR VIEW D is reachable: one aggregate fetch, and no control on the page that changes what is drawn', async () => {
+  const h = await boot(FIXTURE);
+  assert.deepEqual(h.requests, ['/api/bongos/goals/graph'], 'the only read is the aggregate — it carries no task identity');
+  const controls = /<(?:button|select|input|textarea)\b/i;
+  assert.equal(controls.test(PAGE_HTML), false, 'the page markup has no control at all');
+  assert.equal(h.$('gm-graph').querySelectorAll('button, select, input').length, 0);
+  assert.equal(/include=|\/tasks|task_id|densif/i.test(PAGE_JS.replace(/^\s*\/\/.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '')), false,
+    'no path in the page script can ask for a task');
+});
+
+// ---- scrolling ----------------------------------------------------------------------------
+
+await test('the picture scrolls INSIDE its own region and names both overflow axes (the page never scrolls sideways)', async () => {
+  const h = await boot(FIXTURE);
+  const region = h.$('gm-graph').querySelector('.gm-scroll');
+  assert.ok(region && region.contains(h.svg()));
+  assert.equal(region.getAttribute('tabindex'), '0', 'a keyboard reader can scroll it');
+  assert.equal(region.getAttribute('role'), 'region');
+  const rule = PAGE_CSS.match(/\.gm-scroll\s*\{[^}]*\}/)[0];
+  assert.match(rule, /overflow-x:\s*auto/);
+  assert.match(rule, /overflow-y:\s*hidden/, 'one axis named alone makes the other auto (task 1004130)');
+  assert.match(rule, /max-width:\s*100%/);
+});
+
+// ---- text is never markup -------------------------------------------------------------------
+
+await test('a goal title is builder-authored text: it never becomes markup, in the picture or the table or the chips', async () => {
+  const evil = '<img src=x onerror=alert(1)>';
+  const h = await boot({
+    nodes: [node(1, { title: evil, depends_on: 1 }), node(2, { depended_on_by: 1 }), node(3, { title: evil })],
+    edges: [{ from: '1', to: '2', count: 1 }],
+    counts: {},
+  });
+  assert.equal(h.svg().querySelectorAll('img').length, 0);
+  assert.ok(h.svg().querySelectorAll('.gm-name').some((t) => t.textContent.includes('<img')), 'as literal text in the drawing');
+  assert.equal(h.$('gm-table').querySelectorAll('img').length, 0);
+  assert.equal(h.$('gm-alone').querySelectorAll('img').length, 0);
+  assert.ok(h.$('gm-table').textContent.includes(evil), 'shown as the characters the author typed');
+});
+
+// ---- honest states ----------------------------------------------------------------------------
+
+await test('a private goal the viewer cannot read is named as one and is not a link', async () => {
+  const h = await boot({ nodes: [node(1, { title: null, depended_on_by: 1 }), node(2, { depends_on: 1 })], edges: [{ from: '2', to: '1', count: 2 }], counts: {} });
+  const row = h.rows().find((r) => r.textContent.includes('A private goal'));
+  assert.ok(row, 'the row exists');
+  assert.equal(row.querySelectorAll('a').length, 0, 'nothing to open');
+});
+
+await test('no dependency at all says so plainly, draws no picture, and the table is still the whole map', async () => {
+  const h = await boot({ nodes: [node(1), node(2)], edges: [], counts: {} });
+  assert.equal(h.svg(), null);
+  assert.match(h.$('gm-graph').textContent, /no graph to draw — the table below is the whole map/);
+  assert.equal(h.rows().length, 2);
+  assert.equal(h.$('gm-alone-scroll').hidden, true, 'nothing to split when nothing is connected');
+});
+
+await test('an empty corpus renders the empty state and no table', async () => {
+  const h = await boot({ nodes: [], edges: [], counts: {} });
+  assert.match(h.$('gm-graph').textContent, /No goal carries any work yet/);
+  assert.equal(h.$('gm-table-scroll').hidden, true);
+});
+
+await test('a failed read is one honest line — not a blank page, not a stack', async () => {
+  const h = await boot(null, { fail: true });
+  assert.match(h.$('gm-sub').textContent, /Couldn.t load the goal map/);
+  assert.equal(h.svg(), null);
+  assert.equal(h.$('gm-table-scroll').hidden, true);
+});
+
+await test('signed out (401) goes to sign-in like every other hall read', async () => {
+  const h = await boot(null, { status: 401 });
+  assert.deepEqual(h.navigations, ['/api/bongos/auth/web/start']);
+});
+
+// ---- the shell ---------------------------------------------------------------------------------
+
+await test('the page has its h1 in static markup (so every state has one) and loads the lib before the page script', () => {
+  assert.match(PAGE_HTML, /<h1 class="page-head__h">Goal map<\/h1>/);
+  assert.ok(PAGE_HTML.indexOf('goal-map-lib.js') > -1 && PAGE_HTML.indexOf('goal-map-lib.js') < PAGE_HTML.indexOf('goal-map.js'));
+  assert.ok(PAGE_HTML.indexOf('hall-kit.js') < PAGE_HTML.indexOf('goal-map.js'));
+});
+
+await test('it takes NO nav slot (the sky’s rule) — the Goals page is its door', () => {
+  const shell = read('shell.js');
+  assert.equal(/goal-map/.test(shell), false, 'no nav item');
+  assert.match(read('goals.html'), /href="\/builders\/goal-map"/);
+});
+
+summary();

package/tests/hall_page_gate_map.mjs

@@ -48,6 +48,9 @@ const ORACLE = {
   '/builders/atlas': 'requireBuilderPage',
   '/builders/modules': 'requireBuilderPage',
   '/builders/goals': 'requireBuilderPage',
+  // task 1003479: the goal map. GET /goals/graph is requireBuilder like the goal board it
+  // maps, so the page sits on the same tier — and takes no nav slot (the sky's rule).
+  '/builders/goal-map': 'requireBuilderPage',
   '/builders/roadmap': 'requireBuilderPage',
   // Gated at this tier all along, but with no row until task 1003448 walked the
   // module's pages: copy-desk (task 1003113) and ideas (task 1002928) are open to

package/tests/scope_map_guard.mjs

@@ -17,7 +17,11 @@ import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { checkDevsecopsOwnsItsChecks, siblingRequires } = require('../scripts/gds/scope-map-guard.js');
+const { checkDevsecopsOwnsItsChecks, siblingRequires, checkEveryModuleDirIsScoped, moduleDirsOnDisk,
+        checkNoNewUnownedRoot, trackedRoots, rootIsTouched } = require('../scripts/gds/scope-map-guard.js');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
 
 test('every file fitness.js requires is owned by some MODULE_SCOPE_MAP key', () => {
   const r = checkDevsecopsOwnsItsChecks();
@@ -80,3 +84,99 @@ test('the PASS note carries the count, so the check cannot look green while doin
   const n = Number(r.note.match(/^(\d+) file/)[1]);
   assert.ok(n > 14, `expected more than the fourteen the filing task listed, saw ${n}`);
 });
+
+// ── the same defect one level up: a carved module nobody can scope to (task 1004132) ──
+//
+// modules/specialities/ shipped a whole module — manifest, db slice, routes, two
+// migrations — with no MODULE_SCOPE_MAP key, so a goal scoped to `specialities` was
+// refused out_of_scope for touching the module it is named after. 21 of the 22 modules
+// were fine, which is exactly why it went unseen.
+
+test('every carved module on disk is claimed by some MODULE_SCOPE_MAP key', () => {
+  const r = checkEveryModuleDirIsScoped();
+  assert.equal(r.ok, true, r.violations.join('\n'));
+  assert.equal(r.hardFail, false);
+});
+
+test('specialities specifically — the module this check was written for', () => {
+  const { MODULE_SCOPE_MAP } = require('../src/bongos/module-scope-map.js');
+  const globsOf = (v) => (Array.isArray(v) ? v : (v && v.globs) || []);
+  const all = Object.values(MODULE_SCOPE_MAP).flatMap(globsOf);
+  assert.ok(all.includes('modules/specialities/'),
+    'modules/specialities/ lost its owner again — a goal scoped to specialities cannot touch it');
+});
+
+test('moduleDirsOnDisk counts a manifest, not a directory', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-modules-'));
+  fs.mkdirSync(path.join(root, 'real'));
+  fs.writeFileSync(path.join(root, 'real', 'module.json'), '{"key":"real"}');
+  fs.mkdirSync(path.join(root, 'not-a-module'));           // no manifest
+  fs.writeFileSync(path.join(root, 'stray.txt'), 'x');      // not a directory
+  assert.deepEqual(moduleDirsOnDisk(root), ['real']);
+  fs.rmSync(root, { recursive: true, force: true });
+});
+
+test('the scan cannot pass vacuously — an empty modules/ is a BROKEN scan, not a clean one', () => {
+  // The failure this mirrors is the one the sibling check above documents: a scanner
+  // that matches nothing reports a healthy repo, and healthy is what broken looks like.
+  const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-empty-'));
+  assert.deepEqual(moduleDirsOnDisk(empty), []);
+  assert.deepEqual(moduleDirsOnDisk(path.join(empty, 'does-not-exist')), [],
+    'a missing modules/ must return empty rather than throw — the check turns that into a hard fail');
+  fs.rmSync(empty, { recursive: true, force: true });
+});
+
+// ── the record of what is deliberately unowned, and that it cannot rot (task 1004132) ──
+//
+// The decision "the core is owned by nobody" is DATA (UNOWNED_ROOTS), not prose, so
+// that it can be enforced. A one-directional check would let the list become a
+// rubber stamp, so both directions are pinned here.
+
+test('the repo has no unowned root that UNOWNED_ROOTS does not account for', () => {
+  const r = checkNoNewUnownedRoot();
+  assert.equal(r.ok, true, r.violations.join('\n'));
+});
+
+test('a NEW unowned root fails — the growth this exists to stop', () => {
+  const files = require('node:child_process')
+    .execFileSync('git', ['ls-files'], { encoding: 'utf8' }).trim().split('\n');
+  const r = checkNoNewUnownedRoot([...files, 'vendor/thing.js']);
+  assert.equal(r.ok, false);
+  assert.equal(r.hardFail, true);
+  assert.match(r.violations.join('\n'), /'vendor\/' is tracked but NO module glob/);
+});
+
+test('a STALE entry fails too — the list may shrink, never lie', () => {
+  const files = require('node:child_process')
+    .execFileSync('git', ['ls-files'], { encoding: 'utf8' }).trim().split('\n');
+  const r = checkNoNewUnownedRoot(files.filter((f) => f !== 'LICENSE'));
+  assert.equal(r.ok, false);
+  assert.match(r.violations.join('\n'), /lists 'LICENSE', which is not a tracked root any more/);
+});
+
+test('the scan cannot pass vacuously', () => {
+  const r = checkNoNewUnownedRoot([]);
+  assert.equal(r.ok, false);
+  assert.equal(r.hardFail, true);
+  assert.match(r.violations.join('\n'), /broken scan, not a clean result/);
+});
+
+test('trackedRoots collapses paths to roots; rootIsTouched sees a PARTIAL carve', () => {
+  assert.deepEqual(trackedRoots(['src/a/b.js', 'src/c.js', 'LICENSE', 'bin/x']),
+    ['LICENSE', 'bin/', 'src/']);
+  // src/ is partially owned (one file claimed) — that is the normal in-progress
+  // state of ADR 0083's carve, and must NOT read as unowned territory.
+  assert.equal(rootIsTouched('src/', ['src/bongos/llm-pricing.js']), true);
+  assert.equal(rootIsTouched('vendor/', ['src/bongos/llm-pricing.js']), false);
+  // A directory glob covering the whole root counts.
+  assert.equal(rootIsTouched('modules/', ['modules/ideas/']), true);
+});
+
+test('every UNOWNED_ROOTS entry carries a reason', () => {
+  const { UNOWNED_ROOTS } = require('../src/bongos/module-scope-map.js');
+  for (const [root, reason] of Object.entries(UNOWNED_ROOTS)) {
+    assert.equal(typeof reason, 'string', `${root} has no reason`);
+    assert.ok(reason.trim().length > 8,
+      `${root}'s reason is too thin to justify an unowned root: ${JSON.stringify(reason)}`);
+  }
+});