@bongos/core 1.19.970 → 1.19.972

package/modules/lifecycle/db-goals.js

@@ -395,18 +395,35 @@ async function getGoalDependencies(goalId, deps = {}) {
 // table to `g` would have been tidier and would have rewritten four lines whose
 // literal text tests/goal_tier.mjs pins ("priority-first, then stable
 // ordering"). An additive change should read as additive in the diff.
-async function listGoals({ versionId = null, status = null, limit = null } = {}, deps = {}) {
+//
+// `viewerId` adds `viewer_is_member` — is the READER of this list one of this
+// goal's members? The "My goals" lens on the goal board used to answer that from
+// the per-goal DETAIL prefetch, which meant the lens silently returned NOTHING
+// whenever that best-effort fan-out had not landed (or had failed), and the Tasks
+// board could not ask the question at all without N extra requests. One EXISTS on
+// a list the client already fetches answers it for both.
+//
+// `null` viewerId yields `false` everywhere, never NULL: an unauthenticated or
+// identity-less read gets a well-formed row whose answer is "not yours", which is
+// the truthful answer and keeps the wire shape one type. EXISTS (not a LEFT JOIN)
+// for the `admitted` reason directly above — goal_members is keyed
+// (goal_id, builder_id) so a join could not duplicate today, but the shape of the
+// query should not depend on that.
+async function listGoals({ versionId = null, status = null, limit = null, viewerId = null } = {}, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
     `SELECT ${GOAL_COLS},
             EXISTS (SELECT 1 FROM lifecycle_goal_version_admissions a
-                     WHERE a.goal_id = goals.id) AS admitted
+                     WHERE a.goal_id = goals.id) AS admitted,
+            ($4::bigint IS NOT NULL
+              AND EXISTS (SELECT 1 FROM goal_members gm
+                           WHERE gm.goal_id = goals.id AND gm.builder_id = $4::bigint)) AS viewer_is_member
        FROM goals
       WHERE ($1::text IS NULL OR version_id = $1)
         AND ($2::text IS NULL OR status = $2)
       ORDER BY version_id, sort_order, created_at, id
       LIMIT $3::int`,
-    [versionId, status, limit]
+    [versionId, status, limit, viewerId]
   );
   return rows;
 }

package/modules/lifecycle/routes/goals.js

@@ -215,7 +215,7 @@ module.exports = function buildGoalsRouter() {
   // rank: any-builder — GET /goals/graph, the goal board's map (task 1003479, ADR 0227); before /goals/:id.
   router.get('/goals/graph', auth.requireBuilder, goalGraph.goalGraphHandler({ log }));
 
-  // GET /goals?version=&status= — list goals (read).
+  // GET /goals?version=&status= — list goals (read); each row carries `viewer_is_member` for the reader.
   // rank: any-builder — viewing the goal board.
   router.get('/goals', auth.requireBuilder, async (req, res) => {
     const { version, status } = req.query;
@@ -223,7 +223,7 @@ module.exports = function buildGoalsRouter() {
       return res.fail('bad_status', 400, { valid: VALID_GOAL_STATUSES });
     }
     try {
-      const goals = await db.listGoals({ versionId: version || null, status: status || null });
+      const goals = await db.listGoals({ versionId: version || null, status: status || null, viewerId: req.builder.id });
       // task 1003275: ONE category query decorates the whole board (never a join
       // per goal). Purely a label for the reader — nothing downstream branches on it.
       const byId = await goalCategory.categoryIndex();

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.970",
+  "version": "1.19.972",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.970",
+      "version": "1.19.972",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.970",
+  "version": "1.19.972",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/claim.js

@@ -310,7 +310,7 @@ const MAX_LISTED_TASKS = 20;
 function clip(s, max = 160) {
   if (s == null) return '';
   // eslint-disable-next-line no-control-regex
-  const flat = String(s).replace(/[--Ÿ]+/g, ' ').trim();
+  const flat = String(s).replace(/[\u0000--Ÿ]+/g, ' ').trim();
   return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
 }
 

package/scripts/gds/fitness.js

@@ -1204,8 +1204,94 @@ function checkSkillFrontmatter() {
   };
 }
 
+// ============================================================================
+// Check 35 — no raw NUL byte in tracked publishable text (task 1002854)
+// ============================================================================
+//
+// scripts/public-mirror-export.js decides binary-vs-text by sniffing for a NUL byte in
+// the first 8 KiB (`isBinary`, ~line 86), and `redactBlob` skips `redactText` entirely
+// for anything it classifies binary. So a TEXT source containing a raw NUL is published
+// to the public AGPL mirror WITHOUT REDACTION.
+//
+// WHAT THIS IS AND IS NOT. The binary branch is not unguarded: it still leak-scans the
+// blob's latin1 view, so an embedded instance literal trips the gate. But the gate uses
+// `sensitiveLiterals` — raw substrings — while `redactText` applies the full `rules` set.
+// The exposure is therefore the DELTA between them: anything redaction would have
+// rewritten but the literal gate does not recognise ships verbatim. That is a latent
+// unredacted-publish, not a live one, which is why this is a lint rather than a fix.
+//
+// THE CLASS RECURS, WHICH IS THE ARGUMENT FOR A LINT RATHER THAN ANOTHER FIX.
+// Task 1703 found and fixed three instances, all the same mistake: a raw NUL used as a
+// join delimiter instead of the `\u0000` escape. Task 1002507 fixed a fourth in session
+// digests. Open idea 1000523 covers a fifth (search-ingest rollback). This check found
+// four more — modules/copy-desk/proposals.js, scripts/gds/claim.js,
+// scripts/gds/probe-cache.js and tests/copy_inventory.mjs — fixed in the same commit so
+// the check lands green. Nothing prevented any of them; nothing would prevent the next.
+//
+// The fix is always the same and never changes behaviour: `\u0000` compiles to exactly
+// the same string, so hashes, joins and regex ranges are byte-identical at runtime. Only
+// the SOURCE stops carrying the byte.
+//
+// SCOPE. Tracked files only (git ls-files — an untracked scratch file is not published),
+// with publishable text extensions. Binary formats are out of scope by definition: a PNG
+// is *supposed* to contain NULs and the mirror is right to pass it through.
+const NUL_TEXT_EXTS = ['.js', '.mjs', '.cjs', '.mts', '.md', '.sql', '.json'];
+
+// Exemptions must be justified, not just listed. There are none today, and that is the
+// preferred state: the fix is a one-character escape with no behavioural cost, so
+// "exempt it" should always lose to "escape it". Kept as a named, empty constant so a
+// future addition is a visible, reviewable edit rather than a quiet change to a regex.
+const NUL_EXEMPT_PATHS = [];
+
+function scanForRawNul(root, { listFiles, readFile } = {}) {
+  const list = listFiles || (() => execFileSync('git', ['ls-files', '-z'], {
+    cwd: root, encoding: 'latin1', maxBuffer: 1 << 26,
+  }).split('\u0000').filter(Boolean));
+  const read = readFile || ((f) => fs.readFileSync(path.join(root, f)));
+
+  const hits = [];
+  for (const f of list()) {
+    if (!NUL_TEXT_EXTS.includes(path.extname(f))) continue;
+    if (NUL_EXEMPT_PATHS.some((e) => f === e || f.startsWith(e))) continue;
+    let buf;
+    try { buf = read(f); } catch (_) { continue; }   // deleted-but-tracked, or unreadable
+    const at = buf.indexOf(0);
+    if (at === -1) continue;
+    // Report the LINE, not the byte offset — a byte offset is not actionable.
+    const line = buf.slice(0, at).toString('latin1').split('\n').length;
+    hits.push(`${f}:${line} — raw NUL byte; use the \\u0000 escape (same string at runtime, no NUL in source)`);
+  }
+  return hits;
+}
+
+function checkNoRawNulInText() {
+  let violations = [];
+  let note = '';
+  try {
+    violations = scanForRawNul(REPO_ROOT);
+    note = `tracked ${NUL_TEXT_EXTS.join('/')} sources carry no raw NUL byte, so none can be misclassified `
+      + 'as binary and skip public-mirror redaction (task 1002854).';
+  } catch (e) {
+    // Never let the scan itself fail the build — a git failure is not a boundary breach.
+    return {
+      name: 'no raw NUL byte in tracked publishable text (task 1002854)',
+      ok: true, hardFail: false, violations: [], warnings: [`skipped: ${e.message}`],
+      note: 'could not list tracked files — check skipped.',
+    };
+  }
+  return {
+    name: 'no raw NUL byte in tracked publishable text (task 1002854)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note,
+  };
+}
+
 const CHECKS = [
   checkCoreHostBoundary,
+  checkNoRawNulInText, // Check 35 — task 1002854: a raw NUL makes the mirror skip redaction
   checkClaudeMdBudget,
   // Check 32 — task 1002990 / criterion wa6-kernel-and-packs: the root CLAUDE.md is
   // now a role-neutral KERNEL and each craft's playbook lives in a pack under
@@ -1222,6 +1308,9 @@ const CHECKS = [
   checkCoreNeverImportsModule,
   checkModulesImportOnlyApi,
   checkScopeMapImportsProtected,
+  // Check 36 — task 1002900: a carved module with no roster key walls nothing. Extracted
+  // to its own file (the role-pack-guard.js precedent) to keep fitness.js under the size ratchet.
+  () => require('./scope-roster-guard.js').checkScopeRosterCoversModules({ repoRoot: REPO_ROOT, discoveredModuleKeys }),
   checkCoreCarriesNoModuleCode,
   checkKernelImportsNoDomain,
   checkModuleMigrationsAdditive,
@@ -1307,6 +1396,7 @@ function main() {
 if (require.main === module) main();
 
 module.exports = {
+  scanForRawNul,
   checkVocabularyWall, VOCAB_ALLOW, VOCAB_CITATION, VOCAB_EXTS, vocabFilesToScan,
   checkGoalMembershipVocabulary, GOAL_VOCAB_SURFACE, checkGovernmentRenameIdentity, RENAME_IDENTITY_RE, checkPrelaunchVocabulary, PRELAUNCH_SURFACE, // 19c task 1003120, 19d task 1003152
   runAll,

package/scripts/gds/scope-roster-guard.js

@@ -0,0 +1,118 @@
+// scripts/gds/scope-roster-guard.js
+//
+// WHAT. The fitness check behind the module scope roster (task 1002900): every module
+// discovered at modules/<key>/module.json must have a covering key in MODULE_GLOBS
+// (src/bongos/module-scope-map.js).
+//
+// WHY IT IS A HARD FAIL, when the runtime symptom is a denial rather than a crash.
+// The roster is maintained by HAND. A module lands, nobody adds the entry, and any goal
+// scoped to that work hits an authorize-NOTHING wall: goal-scope-check.check() denies
+// with empty_scope / unknown_scope. Nothing announces it — it surfaces only when someone
+// tries to set a goal's wall and cannot, which is long after the module landed and far
+// from the edit that caused it. CI is the only place the gap is visible at the moment it
+// is created.
+//
+// It has happened three times by hand: task 1002690 (provisioning + public-landing,
+// goal 1000059), task 1002322 (platform-identity, goal 1000046) and `agents`, the
+// instance this check was filed for. Each was fixed after someone tripped over it.
+//
+// WHY SUBSET AND NOT EQUALITY. The roster legitimately carries keys with no
+// modules/<key>/ directory, for two different reasons, and equality would fail on all
+// five of them in this tree:
+//   - NON-MODULE SCOPES — `kernel`, `methodology`, `devsecops` are surfaces, not modules.
+//   - ABSENT MODULES — `art-pipeline`, `game` are rostered but not present in this
+//     instance (ADR 0108: a host may carry a different module set).
+// So the invariant is one-directional: every DISCOVERED module must be rostered; a
+// rostered key with no module is not a fault. Getting that backwards would produce a
+// check nobody can keep green, which is worse than no check.
+//
+// Extracted from fitness.js (which the size ratchet caps) following the
+// role-pack-guard.js precedent. The pure scanner is exported for tests/fitness_scope_roster.mjs.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+// The machinery already existed — fitness.js's discoveredModuleKeys() feeds the
+// kernel-machinery check — but nothing cross-checked it against moduleKeys().
+// checkScopeMapImportsProtected guards HOW `protected` is derived, not WHETHER every
+// module is listed.
+
+// SCOPE: modules/ ONLY — the two named orphans, decided rather than left open.
+// Task 1002900 asked for a ruling on two files said to be covered by no glob. Both
+// answers changed when checked against origin/main on 2026-09-22:
+//   - scripts/gds/fitness.js  — NOT uncovered. The `devsecops` key matches it. The row's
+//                               claim was stale.
+//   - src/server.js           — does not exist any more.
+//   - src/platform-server.js  — genuinely uncovered, and DELIBERATELY still is.
+// This check asserts what its name says: every carved MODULE has a roster key. Widening
+// it to arbitrary src/ entrypoints is a different question about a different registry —
+// `kernel` lists individual files by hand, so "should platform-server join it" is a call
+// for whoever owns that scope, not a side effect of adding a module-coverage lint. Left
+// as a recorded decision rather than an exemption entry, because there is nothing to
+// exempt: modules/ is the stated scope and platform-server.js was never in it.
+
+const SCOPE_ROSTER_REL = 'src/bongos/module-scope-map.js';
+
+function scanScopeRosterCoverage({ discovered, rostered, globs, exists }) {
+  const missing = discovered.filter((k) => !rostered.includes(k)).sort();
+  const violations = missing.map((k) =>
+    `module '${k}' (modules/${k}/module.json) has no key in ${SCOPE_ROSTER_REL} MODULE_GLOBS — `
+    + 'any goal scoped to it will deny with empty_scope/unknown_scope');
+
+  // The mirror-image rot, reported as a WARNING rather than a failure: a roster glob that
+  // names an exact FILE which no longer exists. It cannot wall anything off, so it is a
+  // silent hole in a scope rather than a build breakage — and unlike a missing key it has
+  // no runtime symptom at all. Only exact file paths are checked; a directory glob may
+  // legitimately point at an absent optional module (see SUBSET above).
+  const warnings = [];
+  for (const [key, list] of Object.entries(globs || {})) {
+    for (const g of list || []) {
+      if (g.endsWith('/') || g.includes('*')) continue;
+      if (!exists(g)) warnings.push(`${SCOPE_ROSTER_REL}: scope '${key}' lists '${g}', which does not exist — dead entry, walls nothing`);
+    }
+  }
+  return { violations, warnings };
+}
+
+// REPO_ROOT and discoveredModuleKeys come from fitness.js, which owns module discovery
+// (it unions across MODULE_ROOTS per ADR 0108). Passed in rather than re-derived so the
+// two can never disagree about what a module is.
+function checkScopeRosterCoversModules({ repoRoot, discoveredModuleKeys }) {
+  let res;
+  try {
+    const scopeMap = require(path.join(repoRoot, SCOPE_ROSTER_REL));
+    res = scanScopeRosterCoverage({
+      discovered: discoveredModuleKeys(),
+      rostered: scopeMap.moduleKeys(),
+      globs: scopeMap.MODULE_GLOBS,
+      exists: (g) => fs.existsSync(path.join(repoRoot, g)),
+    });
+  } catch (e) {
+    // FAILS OPEN, deliberately and narrowly. This catch fires only if requiring the scope
+    // map throws — i.e. the file is syntactically broken — and that is not this check's
+    // job to report: src/bongos/module-scope-map.js has its own unit coverage, and every
+    // sibling scope check (checkScopeMapImportsProtected, the ownership checks) would red
+    // on the same input. A coverage lint that hard-fails on someone else's syntax error
+    // adds a second confusing message to a build that is already failing for the real
+    // reason. The skip is surfaced as a warning rather than swallowed.
+    return {
+      name: 'every discovered module has a scope-roster key (task 1002900)',
+      ok: true, hardFail: false, violations: [], warnings: [`skipped: ${e.message}`],
+      note: `could not load ${SCOPE_ROSTER_REL} — check skipped.`,
+    };
+  }
+  return {
+    name: 'every discovered module has a scope-roster key (task 1002900)',
+    ok: res.violations.length === 0,
+    hardFail: res.violations.length > 0,
+    violations: res.violations,
+    warnings: res.warnings,
+    note: `every modules/<key>/ carrying module.json has a MODULE_GLOBS entry, so a goal can be `
+      + `scoped to it. Subset, not equality: a rostered key with no module is legitimate `
+      + `(non-module scopes like kernel/methodology/devsecops, and modules absent from this instance).`,
+  };
+}
+
+module.exports = { checkScopeRosterCoversModules, scanScopeRosterCoverage, SCOPE_ROSTER_REL };

package/src/bongos/module-scope-map.js

@@ -451,6 +451,7 @@ const MODULE_GLOBS = {
     'scripts/gds/fitness-checks-packaging.js', 'scripts/gds/fitness-checks-route-pins.js',
     'scripts/gds/fitness-checks-vocabulary.js', 'scripts/gds/fitness-checks-write-validation.js',
     'scripts/gds/fitness-migration-contraction.js', 'scripts/gds/role-pack-guard.js',
+    'scripts/gds/scope-roster-guard.js',
     'scripts/gds/route-shadow-guard.js', 'scripts/gds/routine-schedule.js',
     'scripts/gds/seam-wiring-guard.js', 'scripts/gds/skill-preflight.js',
     'scripts/gds/test-path-guard.js', 'scripts/gds/version-literal-guard.js',

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.970'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.972'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/fitness_no_raw_nul.mjs

@@ -0,0 +1,113 @@
+// tests/fitness_no_raw_nul.mjs
+//
+// Task 1002854 — scripts/public-mirror-export.js sniffs for a NUL byte in the first
+// 8 KiB to decide binary-vs-text (`isBinary`), and `redactBlob` skips `redactText`
+// entirely for anything it classifies binary. So a TEXT source containing a raw NUL is
+// published to the public AGPL mirror WITHOUT redaction.
+//
+// The binary branch is not unguarded — it still leak-scans the latin1 view — but that
+// gate uses `sensitiveLiterals` (raw substrings) while redaction applies the full
+// `rules` set. The exposure is the DELTA: anything redaction would rewrite that the
+// literal gate does not recognise ships verbatim. Latent, not live — hence a lint.
+//
+// THE CLASS RECURS, which is why this is a lint and not a fifth point fix. Task 1703
+// fixed three instances, task 1002507 a fourth, idea 1000523 covers a fifth, and this
+// task found four more. Every one was the same mistake: a raw NUL used as a join
+// delimiter instead of the \u0000 escape.
+//
+// These tests drive the PURE scanner over INJECTED FIXTURES rather than over the real
+// tree. A test that only asserts "the repo is clean today" passes vacuously the moment
+// the scanner breaks — it would report success on a scanner that always returns [].
+//
+// Run:  node --test tests/fitness_no_raw_nul.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { scanForRawNul } = require(path.join(REPO_ROOT, 'scripts/gds/fitness.js'));
+
+// Built at runtime so THIS file never carries the byte it is about — otherwise the
+// check's own test would be its first violation.
+const NUL = String.fromCharCode(0);
+
+// A fake tree: { 'path' => 'contents' }, injected through the scanner's seams so no
+// temp files are needed and every fixture is visible in the test.
+function fakeTree(files) {
+  return {
+    listFiles: () => Object.keys(files),
+    readFile: (f) => Buffer.from(files[f], 'utf8'),
+  };
+}
+
+test('THE BUG: a raw NUL in a .js source is caught', () => {
+  const hits = scanForRawNul('/fake', fakeTree({
+    'src/join.js': `const k = a + '${NUL}' + b;\n`,
+  }));
+  assert.equal(hits.length, 1, 'a raw NUL in tracked JS must be a violation');
+  assert.match(hits[0], /src\/join\.js:1/, 'must name the file and LINE — a byte offset is not actionable');
+  assert.match(hits[0], /u0000/, 'and must name the fix');
+});
+
+test('THE FIX: the escape form is NOT caught — it leaves no NUL in the source', () => {
+  // The whole premise of the remedy: the escape compiles to the same string at runtime,
+  // and only the source stops carrying the byte. If the check flagged the escape too,
+  // the violation would be unfixable.
+  const hits = scanForRawNul('/fake', fakeTree({
+    'src/join.js': "const k = a + '\\u0000' + b;",
+  }));
+  assert.deepEqual(hits, [], 'the escape is the prescribed fix and must pass');
+});
+
+test('the reported line is the line the NUL is on, not the first line', () => {
+  const hits = scanForRawNul('/fake', fakeTree({
+    'a.js': `line one\nline two\nconst k = '${NUL}';\n`,
+  }));
+  assert.match(hits[0], /a\.js:3/);
+});
+
+test('binary extensions are out of scope — a PNG is SUPPOSED to contain NULs', () => {
+  const hits = scanForRawNul('/fake', fakeTree({
+    'public/logo.png': `PNG${NUL}${NUL}`,
+    'docs/diagram.svg': `<svg>${NUL}</svg>`,
+  }));
+  assert.deepEqual(hits, [],
+    'the mirror is right to pass binaries through verbatim; only TEXT sources are the hole');
+});
+
+test('every publishable text extension is scanned', () => {
+  const files = {};
+  for (const ext of ['.js', '.mjs', '.cjs', '.mts', '.md', '.sql', '.json']) files[`f${ext}`] = `x${NUL}y`;
+  assert.equal(scanForRawNul('/fake', fakeTree(files)).length, 7,
+    'a gap in the extension list is a gap in the guard');
+});
+
+test('an unreadable or deleted-but-tracked file is skipped, not a crash', () => {
+  const hits = scanForRawNul('/fake', {
+    listFiles: () => ['gone.js', 'here.js'],
+    readFile: (f) => {
+      if (f === 'gone.js') throw Object.assign(new Error('ENOENT'), { code: 'ENOENT' });
+      return Buffer.from(`ok${NUL}`, 'utf8');
+    },
+  });
+  assert.equal(hits.length, 1, 'the readable file is still checked');
+  assert.match(hits[0], /here\.js/);
+});
+
+test('a clean tree reports nothing', () => {
+  assert.deepEqual(scanForRawNul('/fake', fakeTree({
+    'a.js': 'const k = a + b;',
+    'b.md': '# heading',
+  })), []);
+});
+
+test('the REAL tree is clean (the check must land green)', () => {
+  // Deliberately last, and deliberately paired with the fixtures above: on its own this
+  // assertion would pass against a scanner that always returns [].
+  assert.deepEqual(scanForRawNul(REPO_ROOT), [],
+    'a raw NUL landed in a tracked text source — escape it (identical string at runtime)');
+});

package/tests/fitness_scope_roster.mjs

@@ -0,0 +1,117 @@
+// tests/fitness_scope_roster.mjs
+//
+// Task 1002900 — the scope roster in src/bongos/module-scope-map.js (MODULE_GLOBS) is
+// maintained by hand, and nothing asserted that every carved module has a covering key.
+// A module lands in modules/<key>/, nobody adds the entry, and any goal scoped to that
+// work hits an authorize-NOTHING wall: goal-scope-check.check() denies with
+// empty_scope / unknown_scope. It surfaces only when someone tries to set a goal's wall.
+//
+// Three hand-fixed instances before this check existed: task 1002690 (provisioning +
+// public-landing), task 1002322 (platform-identity), and `agents` — the one this row
+// was filed for, since added at module-scope-map.js:322.
+//
+// SUBSET, NOT EQUALITY. The roster legitimately carries keys with no modules/<key>/ dir,
+// for two distinct reasons, and equality would fail on all five in this tree:
+//   - non-module SCOPES: kernel, methodology, devsecops
+//   - modules ABSENT from this instance: art-pipeline, game (ADR 0108)
+// So the invariant is one-directional. These tests pin that direction explicitly,
+// because getting it wrong turns a useful check into one nobody can keep green.
+//
+// Run:  node --test tests/fitness_scope_roster.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { discoveredModuleKeys } = require(path.join(REPO_ROOT, 'scripts/gds/fitness.js'));
+// The check lives in its own file (the role-pack-guard.js precedent) so fitness.js stays
+// under the size ratchet; module discovery stays in fitness.js, which owns it.
+const { scanScopeRosterCoverage } = require(path.join(REPO_ROOT, 'scripts/gds/scope-roster-guard.js'));
+const scopeMap = require(path.join(REPO_ROOT, 'src/bongos/module-scope-map.js'));
+
+const nothingExists = () => false;
+const allExist = () => true;
+
+test('THE BUG: a discovered module with no roster key is a violation', () => {
+  const { violations } = scanScopeRosterCoverage({
+    discovered: ['lifecycle', 'agents'],
+    rostered: ['lifecycle'],
+    globs: {},
+    exists: allExist,
+  });
+  assert.equal(violations.length, 1);
+  assert.match(violations[0], /'agents'/, 'must name the uncovered module');
+  assert.match(violations[0], /empty_scope|unknown_scope/,
+    'and must name the symptom, since that is how this is actually discovered');
+});
+
+test('SUBSET NOT EQUALITY: a rostered key with no module is NOT a fault', () => {
+  // kernel/methodology/devsecops are surfaces, not modules; art-pipeline/game may be
+  // absent from a given instance. Failing on these would make the check unkeepable.
+  const { violations } = scanScopeRosterCoverage({
+    discovered: ['lifecycle'],
+    rostered: ['lifecycle', 'kernel', 'methodology', 'devsecops', 'art-pipeline', 'game'],
+    globs: {},
+    exists: allExist,
+  });
+  assert.deepEqual(violations, []);
+});
+
+test('several uncovered modules are all reported, sorted', () => {
+  const { violations } = scanScopeRosterCoverage({
+    discovered: ['zeta', 'alpha', 'lifecycle'],
+    rostered: ['lifecycle'],
+    globs: {},
+    exists: allExist,
+  });
+  assert.equal(violations.length, 2, 'one line per uncovered module — not just the first');
+  assert.match(violations[0], /'alpha'/);
+  assert.match(violations[1], /'zeta'/);
+});
+
+test('a dead exact-file glob is a WARNING, never a failure', () => {
+  // The mirror-image rot: a roster entry naming a file that no longer exists cannot wall
+  // anything off, but it breaks no build either — so it is reported, not enforced.
+  const { violations, warnings } = scanScopeRosterCoverage({
+    discovered: [], rostered: [],
+    globs: { kernel: ['server.js'] },
+    exists: nothingExists,
+  });
+  assert.deepEqual(violations, [], 'a dead glob must not fail the build');
+  assert.equal(warnings.length, 1);
+  assert.match(warnings[0], /server\.js/);
+  assert.match(warnings[0], /walls nothing/);
+});
+
+test('directory and wildcard globs are exempt from the existence warning', () => {
+  // A directory glob may legitimately point at an optional module absent from this
+  // instance — warning on those would bury the real signal in noise.
+  const { warnings } = scanScopeRosterCoverage({
+    discovered: [], rostered: [],
+    globs: { game: ['modules/game/', 'src/**/game-*.js'] },
+    exists: nothingExists,
+  });
+  assert.deepEqual(warnings, []);
+});
+
+test('THE REAL TREE: every discovered module is rostered (the check must land green)', () => {
+  // Last, and paired with the fixtures above: alone this would pass against a scanner
+  // that always returns [].
+  const { violations } = scanScopeRosterCoverage({
+    discovered: discoveredModuleKeys(),
+    rostered: scopeMap.moduleKeys(),
+    globs: {},
+    exists: allExist,
+  });
+  assert.deepEqual(violations, [],
+    'a module was carved without a MODULE_GLOBS key — any goal scoped to it denies everything');
+});
+
+test('agents specifically is rostered (the instance this row was filed for)', () => {
+  assert.ok(scopeMap.moduleKeys().includes('agents'));
+  assert.ok(discoveredModuleKeys().includes('agents'), 'and it is a real discovered module, not just a roster entry');
+});