@bongos/core 1.20.10 → 1.20.12

package/tests/claimable_blocker_status.mjs

@@ -13,6 +13,16 @@
 // feed. Latent when found (every blocker was open), but eleven tasks were one
 // resolve away from vanishing.
 //
+// TASK 1004190 WIDENED THIS FILE TO THE SECOND CLAUSE. core_239's header deferred
+// the OTHER gap in the same view by name — it never consulted `dependencies`, so a
+// 'ready' task whose predecessor had not shipped was advertised by /builder-start
+// and then refused by POST /claims with DEPS_NOT_SHIPPED. core_264 closes it. The
+// "LAST definition" test below is what forced the blocker clause to be carried
+// forward into that rewrite rather than lost the way 177 lost migration 176's;
+// it now pins core_264, and every clause assertion here reads the LIVE definition,
+// because a correct older migration still sitting in the tree proves nothing about
+// what Postgres runs.
+//
 // Run:  node tests/claimable_blocker_status.mjs
 
 import { strict as assert } from 'node:assert';
@@ -25,7 +35,7 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const repoRoot = join(__dirname, '..');
 const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
 
-const MIG = 'core_239_claimable_respects_blocker_status.sql';
+const MIG = 'core_264_claimable_respects_dependencies.sql';
 const mig = read('migrations', MIG);
 // Comments carry the rationale; strip them when asserting on the executable body
 // so a claim in prose can never stand in for the real SQL.
@@ -33,7 +43,7 @@ const body = mig.replace(/^\s*--.*$/gm, '').replace(/\s+/g, ' ');
 
 const { test, summary } = makeRunner();
 
-await test('239 replaces claimable_tasks, in core_231-s drop-and-create shape', () => {
+await test('the live migration replaces claimable_tasks, in core_231-s drop-and-create shape', () => {
   assert.match(body, /DROP VIEW IF EXISTS claimable_tasks;/);
   assert.match(body, /CREATE VIEW claimable_tasks AS/);
 });
@@ -74,10 +84,15 @@ await test('the column list stays the t.* wildcard (core_227-s silent-column les
   assert.match(body, /pms_calibrated_minutes\(t\.est_minutes, t\.kind\) AS est_minutes_calibrated/);
 });
 
-await test('239 is the LAST definition of claimable_tasks in migrations/', () => {
+await test('the pinned migration is the LAST definition of claimable_tasks in migrations/', () => {
   // If a later migration redefines the view, it inherits whatever that one says —
   // which is exactly how 177 silently dropped migration 176's blocker clause from
   // task_is_fully_unblocked. Catch the next one at the source.
+  //
+  // This pin is not theoretical: it is what made core_264 (task 1004190) carry
+  // core_239's blocker clause forward instead of replacing it. Moving MIG to the
+  // new file is HALF the job — every clause assertion above then runs against the
+  // new definition, and a rewrite that dropped one reds this file.
   const defs = readdirSync(join(repoRoot, 'migrations'))
     .filter((f) => f.endsWith('.sql'))
     .filter((f) => /CREATE VIEW claimable_tasks/.test(read('migrations', f)))
@@ -201,4 +216,146 @@ await test('the promotion sweep keeps its own, deliberately different, guard', (
     'the sweep resolves the blocker too — it just answers the legacy-link case differently');
 });
 
+/* ───────────────────────────────────────────────────────────────────────────
+   Task 1004190 / finding #60 — THE SECOND CLAUSE.
+
+   core_239 deferred the other half of the same defect by name: the view filtered
+   on status, smoke titles, blockers and touches-overlap and never once on
+   `dependencies`, so a 'ready' task whose predecessor had not shipped was
+   advertised by /builder-start and then refused by POST /claims. core_264 adds
+   the clause, and it has the same three copies the blocker guard does — so it
+   gets the same three-file treatment, because a migration alone did not move the
+   feed last time either.
+   ─────────────────────────────────────────────────────────────────────────── */
+
+// The dependency predicate, lifted out of the LIVE migration. Everything below
+// compares the JS copies against what Postgres actually runs rather than against a
+// second hand-written spelling of the same idea — the same reason GUARDED above is
+// derived from the migration and not typed out here.
+const DEPS_START = 'NOT EXISTS ( SELECT 1 FROM dependencies d';
+const DEPS_END = "x.status <> 'achieved'))) )";
+function depsClause(src, what) {
+  const i = src.indexOf(DEPS_START);
+  const j = i < 0 ? -1 : src.indexOf(DEPS_END, i);
+  assert.ok(i >= 0 && j > i, `${what} carries the dependency clause`);
+  return src.slice(i, j + DEPS_END.length);
+}
+
+await test('the view resolves the same three gating sources as the claim gate', () => {
+  const clause = depsClause(body, MIG);
+  assert.match(clause, /d\.from_kind = 'task' AND d\.from_id = t\.id/, "the task's own edges");
+  assert.match(clause, /d\.from_kind = 'goal' AND d\.from_id = t\.goal_id/, 'plus what it inherits from its goal');
+  assert.match(clause, /d\.from_kind = 'criterion' AND d\.from_id IN \( SELECT tc\.criterion_id FROM task_criteria tc WHERE tc\.task_id = t\.id\)/,
+    'and from every criterion it fulfils');
+  assert.match(clause, /d\.to_kind = 'task' AND EXISTS \(SELECT 1 FROM tasks x WHERE x\.id = d\.to_id AND x\.status <> 'shipped'\)/);
+  assert.match(clause, /d\.to_kind = 'criterion' AND EXISTS \(SELECT 1 FROM done_when_criteria x WHERE x\.id = d\.to_id AND x\.satisfied = false\)/);
+  assert.match(clause, /d\.to_kind = 'goal' AND EXISTS \(SELECT 1 FROM goals x WHERE x\.id = d\.to_id AND x\.status <> 'achieved'\)/);
+});
+
+await test('the view mirrors unsatisfiedDeps (the CLAIM path), not task_is_fully_unblocked (promotion)', () => {
+  // The two dependency predicates in this codebase disagree on exactly one case,
+  // and both sides of the disagreement are deliberate: an edge whose target row no
+  // longer exists gates PROMOTION (core_245's header calls that fail-closed) and
+  // does NOT gate a claim (every unsatisfiedDeps arm JOINs the target, so an orphan
+  // yields no row). Calling task_is_fully_unblocked from the view is the shorter
+  // line and it would hide a task POST /claims accepts — core_239's bug inverted,
+  // with no blocker row to explain it. The done-when of 1004190 is that the feed
+  // and the gate AGREE, so this asserts WHICH one the view copied.
+  assert.doesNotMatch(body, /task_is_fully_unblocked/,
+    'the feed must not borrow the promotion predicate — it answers the orphaned-edge case the other way');
+  const deps = code('modules', 'lifecycle', 'db-deps-criteria.js');
+  const clause = depsClause(body, MIG);
+  for (const frag of [
+    "d.from_kind = 'task' AND d.from_id = t.id",
+    "d.from_kind = 'goal' AND d.from_id = t.goal_id",
+    "d.from_kind = 'criterion' AND d.from_id IN ( SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)",
+    "x.status <> 'shipped'",
+    'x.satisfied = false',
+    "x.status <> 'achieved'",
+  ]) {
+    assert.ok(deps.includes(frag),
+      `unsatisfiedDeps no longer spells it "${frag}" — the view copied that spelling and must be re-checked against it`);
+    assert.ok(clause.includes(frag), `the view must carry "${frag}" exactly as the claim gate does`);
+  }
+});
+
+await test('each runtime copy declares the dependency guard ONCE, and the claimable query uses it', () => {
+  for (const f of RUNTIME) {
+    const src = code(...f);
+    const decls = (src.match(/const UNSHIPPED_DEPS_GUARD = /g) || []).length;
+    const uses = (src.match(/\$\{UNSHIPPED_DEPS_GUARD\}/g) || []).length;
+    assert.equal(decls, 1, `${f.join('/')} must declare the dependency guard exactly once`);
+    // ONE, where the blocker guard has two — and that asymmetry is the decision,
+    // not an omission. The session-fit body is only ever JOINed onto the claimable
+    // body (here and in listClaimableTasks), so every row it can reach is already
+    // guarded; putting the clause there would change what the tasks_session_fit
+    // VIEW means with no migration saying so.
+    assert.equal(uses, 1, `${f.join('/')}: the CLAIMABLE body interpolates it; the session-fit body deliberately does not`);
+  }
+});
+
+await test('each runtime copy-s dependency guard is the live migration-s predicate, verbatim', () => {
+  const fromMigration = depsClause(body, MIG);
+  for (const f of RUNTIME) {
+    const decl = (code(...f).match(/const UNSHIPPED_DEPS_GUARD = `[^`]*`/) || [])[0];
+    assert.ok(decl, `${f.join('/')} declares the dependency guard as a template literal`);
+    assert.ok(decl.includes(fromMigration),
+      `${f.join('/')}'s dependency guard must be the migration's predicate verbatim — a paraphrase is how the next one drifts`);
+  }
+});
+
+await test('the dependency guard actually reaches the composed claimable statement', () => {
+  const fromMigration = depsClause(body, MIG);
+  for (const f of RUNTIME) {
+    const raw = read(...f);
+    const gm = raw.match(/const UNSHIPPED_DEPS_GUARD = `([\s\S]*?)`;/);
+    assert.ok(gm, `${f.join('/')} declares the dependency guard`);
+    const expanded = raw.split('${UNSHIPPED_DEPS_GUARD}').join(gm[1]).replace(/\s+/g, ' ');
+    const hits = expanded.split(fromMigration).length - 1;
+    assert.equal(hits, 2, `${f.join('/')}: one declaration plus one expanded use`);
+  }
+});
+
+await test('every lookup the dependency clause makes is index-covered', () => {
+  // This runs on the /builder-start hot path, so "a correlated NOT EXISTS with no
+  // index migration beside it" is the right thing to ask about the clause. The
+  // answer is that nothing new was needed — but that answer lived in two OTHER
+  // migrations, which is to say it was unverifiable from here and therefore not
+  // really an answer. Pin it, so deleting the cover reds this file instead of
+  // quietly turning the queue into a seq scan.
+  const allSql = readdirSync(join(repoRoot, 'migrations'))
+    .filter((f) => f.endsWith('.sql'))
+    .map((f) => read('migrations', f))
+    .join('\n');
+  assert.match(allSql, /CREATE INDEX IF NOT EXISTS idx_dependencies_from ON dependencies \(from_kind, from_id\)/,
+    'all three from_kind arms probe (from_kind, from_id) — migration 163');
+  assert.match(allSql, /CREATE INDEX IF NOT EXISTS idx_task_criteria_task\s+ON task_criteria \(task_id\)/,
+    "the criterion arm's IN probes task_criteria by task_id — migration 055");
+  assert.doesNotMatch(allSql, /DROP INDEX[^;]*idx_dependencies_from/,
+    'a later migration drops the index the claimable feed now depends on');
+  assert.doesNotMatch(allSql, /DROP INDEX[^;]*idx_task_criteria_task/,
+    'a later migration drops the index the criterion arm now depends on');
+  // The three doneness EXISTS lookups are by primary key (tasks.id,
+  // done_when_criteria.id, goals.id) and need nothing of their own.
+});
+
+await test('the dependency clause closes every paren it opens, in all three copies', () => {
+  // Nothing in this repo can reach a Postgres, so a stray paren in a clause this
+  // nested ships green and takes the ENTIRE claimable feed down with a syntax error
+  // on the first query after deploy — the feed, the optimizer and /builder-start at
+  // once. Counting is the cheapest real check available, and it is the failure mode
+  // hand-written inline SQL actually has.
+  const sources = [[body, MIG], ...RUNTIME.map((f) => [code(...f), f.join('/')])];
+  for (const [src, what] of sources) {
+    const clause = depsClause(src, what);
+    let depth = 0;
+    for (const ch of clause) {
+      if (ch === '(') depth++;
+      else if (ch === ')') depth--;
+      assert.ok(depth >= 0, `${what}: a closing paren with nothing open`);
+    }
+    assert.equal(depth, 0, `${what}: the clause closes every group it opens`);
+  }
+});
+
 summary();

package/tests/speciality_offer_ui.mjs

@@ -0,0 +1,185 @@
+// tests/speciality_offer_ui.mjs — a speciality's OWNER chooses what it offers,
+// from the hall (task 1004404; ADR 0310 §1).
+//
+// Before this only the API could set a speciality's offered skills, so nothing
+// made in the hall offered any and the adoption walkthrough never appeared. These
+// pin that the owner can choose on create AND afterwards, that each choice shows
+// the skill's plain description, that only installed skills are choices, and that
+// a skill removed since is named rather than silently kept.
+//
+// Like tests/speciality_walkthrough_ui.mjs this EXECUTES the real
+// modules/hall-ui/public/settings-specialities.js in a vm under a minimal DOM
+// stub against a fake API, and drives the delegated handlers the page wires.
+//
+// Run:  node tests/speciality_offer_ui.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/settings-specialities.js'), 'utf8');
+const HTML = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
+const { test, summary } = makeRunner();
+
+const INSTALLED = [
+  { name: 'builder-cost', does: 'Records money spent on the project.', cost: 'Free. It only adds an entry.' },
+  { name: 'recall', does: 'Searches everything the project already knows.', cost: 'Free, and it changes nothing.' },
+  { name: 'status', does: 'Shows how far along a version is.', cost: 'Free, and it changes nothing.' },
+];
+
+const mine = (over = {}) => ({ id: 12, name: 'Pricing', discipline: 'engineer', summary: '', contract_md: '', visibility: 'private', adoptable: true, mine: true, skills: ['recall', 'retired-skill'], ...over });
+const theirs = (over = {}) => ({ id: 9, name: 'Economics', discipline: 'ideator', summary: '', contract_md: '', visibility: 'public', adoptable: true, mine: false, skills: ['recall'], ...over });
+
+// The checked boxes a form would submit, read off the rendered markup.
+const checkedIn = (html) => [...html.matchAll(/<input type="checkbox" name="skill" value="([^"]+)" checked/g)].map((m) => m[1]);
+const fakeForm = (dataset, values) => ({
+  dataset,
+  querySelectorAll: (sel) => (sel === 'input[name="skill"]:checked' ? values.map((value) => ({ value })) : []),
+});
+
+async function boot({ catalog = [mine(), theirs()] } = {}) {
+  const requests = [];
+  const toasts = [];
+  const els = new Map();
+  const handlers = new Map();
+  const makeEl = (id) => ({
+    id, hidden: id === 'specialities-scroll', innerHTML: '', textContent: '', elements: {}, dataset: {}, open: false,
+    addEventListener(type, fn) { handlers.set(`${id}:${type}`, fn); },
+  });
+  for (const id of ['specialities-scroll', 'specialities-rows', 'speciality-suggestions', 'specialities-status', 'speciality-create', 'speciality-create-offer', 'speciality-create-skills']) els.set(id, makeEl(id));
+  // The create form's fields, as settings.html declares them.
+  const create = els.get('speciality-create');
+  const field = (value) => ({ value, addEventListener() {} });
+  create.elements = { name: field(''), discipline: field(''), summary: field(''), contract_md: field(''), visibility: field('private'), sellable: { checked: false, disabled: false, addEventListener() {} } };
+  create.reset = () => { create.elements.name.value = ''; };
+  create.querySelectorAll = () => [];
+
+  const fetch = async (url, opts = {}) => {
+    const method = opts.method || 'GET';
+    const p = url.replace('/api/bongos', '');
+    requests.push({ method, path: p, body: opts.body ? JSON.parse(opts.body) : undefined });
+    let body = {};
+    if (method === 'GET' && p === '/specialities') body = { specialities: catalog };
+    else if (method === 'GET' && p === '/me/specialities') body = { adoptions: [] };
+    else if (method === 'GET' && p === '/specialities/offered') body = { suggestions: [] };
+    else if (method === 'GET' && p === '/specialities/installed-skills') body = { skills: INSTALLED };
+    else if (method === 'PATCH') body = { speciality: { id: 12 } };
+    else if (method === 'POST' && p === '/specialities') body = { speciality: { id: 13 } };
+    return { ok: true, status: 200, json: async () => body };
+  };
+
+  const document = { readyState: 'complete', getElementById: (id) => els.get(id) || null, addEventListener() {}, querySelector: () => null };
+  const window = {
+    OTB: {
+      escapeHtml: (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;'),
+      $: () => null, toast: (m) => toasts.push(m), roleAxisLabel: () => 'Role',
+    },
+    location: { assign() {} },
+  };
+  vm.runInNewContext(SRC, { window, document, fetch, JSON, Promise, Map, Set, String, Number, Array, Object, Math, RegExp, console });
+  const settle = async () => { for (let i = 0; i < 8; i++) await new Promise((r) => setTimeout(r, 0)); };
+  await settle();
+
+  const rows = els.get('specialities-rows');
+  async function click(act, id) {
+    const btn = { dataset: { act, id: String(id) } };
+    handlers.get('specialities-rows:click')({ target: { closest: (sel) => (sel === 'button[data-act]' ? btn : null) } });
+    await settle();
+  }
+  async function submitOffer(id, values) {
+    const form = fakeForm({ id: String(id) }, values);
+    handlers.get('specialities-rows:submit')({ target: { closest: (sel) => (sel === 'form.speciality-offer' ? form : null) }, preventDefault() {} });
+    await settle();
+  }
+  return { els, rows, requests, toasts, click, submitOffer, handlers, create, settle };
+}
+
+const writes = (h) => h.requests.filter((r) => r.method !== 'GET');
+const installedReads = (h) => h.requests.filter((r) => r.path === '/specialities/installed-skills').length;
+
+await test('only a speciality you own has an "Offered skills" control', async () => {
+  const h = await boot();
+  const buttons = [...h.rows.innerHTML.matchAll(/data-act="offer" data-id="(\d+)"/g)].map((m) => m[1]);
+  assert.deepEqual(buttons, ['12']);
+});
+
+await test('opening it lists every installed skill with its plain description and cost, the current offer ticked', async () => {
+  const h = await boot();
+  assert.equal(installedReads(h), 0, 'nothing is fetched until the owner asks');
+  await h.click('offer', 12);
+  assert.equal(installedReads(h), 1);
+  const html = h.rows.innerHTML;
+  for (const k of INSTALLED) {
+    assert.ok(html.includes(`value="${k.name}"`), `${k.name} is a choice`);
+    assert.ok(html.includes(k.does), `${k.name} shows what it does`);
+    assert.ok(html.includes(k.cost), `${k.name} shows what it costs`);
+  }
+  assert.deepEqual(checkedIn(html), ['recall'], 'what it offers today is ticked');
+  assert.match(html, /Offering a skill turns nothing on/);
+});
+
+await test('a skill it offers that the instance no longer has is named, not offered as a choice', async () => {
+  const h = await boot();
+  await h.click('offer', 12);
+  assert.ok(!h.rows.innerHTML.includes('value="retired-skill"'), 'not a checkbox');
+  assert.match(h.rows.innerHTML, /No longer on this project, so saving drops it from the offer: <code>retired-skill<\/code>/);
+});
+
+await test('saving sends exactly the ticked skills as one PATCH, and nothing is written before', async () => {
+  const h = await boot();
+  await h.click('offer', 12);
+  assert.equal(writes(h).length, 0);
+  await h.submitOffer(12, ['recall', 'status']);
+  const w = writes(h);
+  assert.equal(w.length, 1);
+  assert.equal(w[0].method, 'PATCH');
+  assert.equal(w[0].path, '/specialities/12');
+  assert.deepEqual(w[0].body, { skills: ['recall', 'status'] });
+  assert.ok(h.toasts.some((m) => /offers 2 skills/.test(m)));
+  assert.ok(!/class="speciality-offer"/.test(h.rows.innerHTML), 'the editor closes on save');
+});
+
+await test('offering nothing is a choice too', async () => {
+  const h = await boot();
+  await h.click('offer', 12);
+  await h.submitOffer(12, []);
+  assert.deepEqual(writes(h)[0].body, { skills: [] });
+});
+
+await test('the installed list is read once per page, however often the editor opens', async () => {
+  const h = await boot();
+  await h.click('offer', 12);
+  await h.click('offer', 12); // close
+  await h.click('offer', 12); // open again
+  assert.equal(installedReads(h), 1);
+});
+
+await test('the create form offers the same choices, filled on first open, and sends them with the new speciality', async () => {
+  const h = await boot();
+  const box = h.els.get('speciality-create-offer');
+  const host = h.els.get('speciality-create-skills');
+  box.open = true;
+  h.handlers.get('speciality-create-offer:toggle')();
+  await h.settle();
+  for (const k of INSTALLED) assert.ok(host.innerHTML.includes(`value="${k.name}"`) && host.innerHTML.includes(k.does));
+  assert.deepEqual(checkedIn(host.innerHTML), [], 'a new speciality starts offering nothing');
+  h.create.elements.name.value = 'New one';
+  h.create.elements.discipline.value = 'engineer';
+  h.create.querySelectorAll = (sel) => (sel === 'input[name="skill"]:checked' ? [{ value: 'status' }] : []);
+  h.handlers.get('speciality-create:submit')({ preventDefault() {} });
+  await h.settle();
+  const post = writes(h).find((r) => r.method === 'POST' && r.path === '/specialities');
+  assert.ok(post, 'created');
+  assert.deepEqual(post.body.skills, ['status']);
+});
+
+await test('settings.html carries the create form\'s picker inside the form it submits with', () => {
+  const form = HTML.slice(HTML.indexOf('<form id="speciality-create"'), HTML.indexOf('</form>', HTML.indexOf('<form id="speciality-create"')));
+  assert.match(form, /<details id="speciality-create-offer"/);
+  assert.match(form, /id="speciality-create-skills"/);
+});
+
+summary();

package/tests/speciality_skills.mjs

@@ -304,6 +304,15 @@ try {
     store.speciality = saved;
   });
 
+  await test('GET /specialities/installed-skills lists every installed skill, explained, for the owner\'s picker (task 1004404)', async () => {
+    const r = await call('GET', '/specialities/installed-skills');
+    assert.equal(r.status, 200, `not captured by /specialities/:id: ${JSON.stringify(r.body)}`);
+    assert.deepEqual(r.body.skills.map((s) => s.name), ['costing', 'recall', 'status'], 'every installed skill, by name — the choices are what the instance has');
+    const recall = r.body.skills.find((s) => s.name === 'recall');
+    assert.equal(recall.does, 'Search what the project knows. Read-only.', 'the same explanation the walkthrough shows');
+    assert.match(recall.cost, /^Read-only/);
+  });
+
   await test('PUT /specialities/:id/skills needs an active adoption', async () => {
     store.adoption = null;
     const r = await call('PUT', '/specialities/9/skills', { enabled_skills: ['recall'] });