@bongos/core 1.20.26 → 1.20.28

package/tests/pending_invite_purge_db.mjs

@@ -0,0 +1,129 @@
+// tests/pending_invite_purge_db.mjs — task 1004408 (owner decision on ADR 0353's
+// open consequence). Real DB.
+//
+// Proves migration platform_identity_028 against real SQL: it deletes the `pending`
+// rows the OLD hub invite wrote (they can lead to a locked door) and keeps every
+// notice the project wrote since the hub first ran ADR 0353. The cutoff is read from
+// the core_upgrades ledger — the earliest upgrade to 1.20.22 or later — so only a
+// real engine can show the version comparison (numeric, not lexical), the malformed
+// ledger rows it must skip without failing the deploy, and the one-shot guard.
+//
+// Each scenario builds its own tables in a throwaway schema, so the migration's
+// table-wide DELETE can never touch a shared database's rows.
+//
+// Real-DB integration test: self-skips without a reachable Postgres; in the
+// INTEGRATION set (scripts/gds/run-unit-tests.js) so the default DB-free lane
+// never runs it.
+//
+// Run:  DATABASE_URL=... node tests/pending_invite_purge_db.mjs
+
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const here = dirname(fileURLToPath(import.meta.url));
+const PI_MIG = join(here, '..', 'modules', 'platform-identity', 'migrations');
+const CORE_MIG = join(here, '..', 'migrations');
+const piSql = (f) => readFileSync(join(PI_MIG, `platform_identity_${f}.sql`), 'utf8');
+const PURGE = piSql('028_purge_pre_notice_invites');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined, max: 1 });
+let client;
+try {
+  client = await pool.connect();
+} catch (e) {
+  console.log(`pending_invite_purge_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const q = (sql, params) => client.query(sql, params);
+const at = (hh, mm = 0) => new Date(Date.UTC(2026, 8, 30, hh, mm)).toISOString();
+const schemas = [];
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); pass++; console.log(`  ok - ${msg}`); };
+
+// A fresh hub in its own schema: the memberships table as it stands today (003, then
+// 010 + 021's rename), schema_migrations, and — unless `ledger` is false — the
+// core_upgrades ledger (core_189).
+async function freshHub(tag, { ledger = true } = {}) {
+  const schema = `t1004408_${tag}_${process.pid}`;
+  schemas.push(schema);
+  await q(`CREATE SCHEMA ${schema}`);
+  await q(`SET search_path TO ${schema}`);
+  await q('CREATE TABLE schema_migrations (version text PRIMARY KEY, applied_at timestamptz NOT NULL DEFAULT now())');
+  for (const f of ['003_project_memberships', '010_membership_kind', '021_drop_legacy_role']) await q(piSql(f));
+  if (ledger) await q(readFileSync(join(CORE_MIG, 'core_189_core_upgrades_ledger.sql'), 'utf8'));
+}
+const member = (client_id, github_id, kind, joinedAt) => q(
+  `INSERT INTO platform_identity_project_memberships (client_id, github_id, membership_kind, joined_at, last_active)
+   VALUES ($1, $2, $3, $4, $4)`, [client_id, github_id, kind, joinedAt]);
+const upgraded = (toVersion, appliedAt) => q(
+  'INSERT INTO core_upgrades (to_version, applied_at) VALUES ($1, $2)', [toVersion, appliedAt]);
+const rows = async () => (await q(
+  'SELECT client_id, github_id::int AS id, membership_kind AS kind FROM platform_identity_project_memberships ORDER BY github_id',
+)).rows.map((r) => `${r.id}:${r.kind}`).join(' ');
+
+try {
+  // ── The expected case: the hub has never run ADR 0353 (it served 1.19.1081). ──
+  await freshHub('never');
+  await upgraded('1.19.1081', at(8));
+  await member('spike-harbor', 1, 'pending', at(9));   // the live example's shape
+  await member('spike-harbor', 2, 'owner', at(9));
+  await member('spike-harbor', 3, 'member', at(9));
+  await member('mercury', 4, 'visitor', at(9));
+  await member('mercury', 5, 'pending', at(10));
+  await q(PURGE);
+  ok(await rows() === '2:owner 3:member 4:visitor',
+    'no ledger row at 1.20.22+: every pending row is an old one and goes; owners, members and visitors stay');
+  ok((await q(`SELECT 1 FROM schema_migrations WHERE version = 'platform_identity_028_purge_pre_notice_invites'`)).rowCount === 1,
+    'the migration records itself');
+
+  // One-shot: a notice written after the deploy survives a replay.
+  await member('mercury', 6, 'pending', at(11));
+  await q(PURGE);
+  ok(await rows() === '2:owner 3:member 4:visitor 6:pending',
+    'replaying the recorded migration deletes nothing, so a hand-run can never sweep real notices');
+
+  // ── The hub already ran ADR 0353 before this deploy: only rows older than that go. ──
+  await freshHub('since');
+  await upgraded('garbage', at(9));
+  await upgraded('1.20.99999999999', at(9, 30));        // malformed: must be skipped, not overflow the cast
+  await upgraded('1.19.1081', at(10));
+  await upgraded('1.20.21', at(11));
+  await upgraded('1.20.22', at(12));                    // the first release carrying ADR 0353
+  await upgraded('1.20.25', at(13));
+  await member('spike-harbor', 11, 'pending', at(11, 30)); // old hub invite: a locked door
+  await member('spike-harbor', 12, 'pending', at(12, 30)); // a project's own notice
+  await member('spike-harbor', 13, 'member', at(10));
+  await q(PURGE);
+  ok(await rows() === '12:pending 13:member',
+    'the earliest 1.20.22+ upgrade is the cutoff: the older pending row goes, the notice written after it stays');
+
+  // ── Versions compare as numbers, and a prefix or suffix does not hide one. ──
+  await freshHub('numeric');
+  await upgraded('1.9.0', at(9));                       // '1.9.0' > '1.20.22' as TEXT — must not count
+  await upgraded('v1.20.30-rc.1', at(12));
+  await member('demo', 21, 'pending', at(11));
+  await member('demo', 22, 'pending', at(13));
+  await q(PURGE);
+  ok(await rows() === '22:pending',
+    '1.9.0 is below 1.20.22 (numeric compare), and v1.20.30-rc.1 counts as 1.20.30');
+
+  // ── An instance with no ledger table at all (the module without core_189). ──
+  await freshHub('noledger', { ledger: false });
+  await member('demo', 31, 'pending', at(9));
+  await member('demo', 32, 'owner', at(9));
+  await q(PURGE);
+  ok(await rows() === '32:owner', 'no core_upgrades table: treated as never having run ADR 0353');
+
+  console.log(`\npending_invite_purge_db.mjs: ${pass} passed`);
+} finally {
+  for (const s of schemas) await q(`DROP SCHEMA IF EXISTS ${s} CASCADE`).catch(() => {});
+  client.release();
+  await pool.end().catch(() => {});
+}

package/tests/project_admin_console_model.mjs

@@ -6,8 +6,9 @@
 // drift quietly is worse than none, so the load-bearing ones are pinned here:
 //
 //   D1  the hub relays and notifies; it never writes a project's admission row
-//   D2  an invite is a row the existing gate already reads — `kind` and
-//       `created_by` are descriptive and never enter the admission read
+//   D2  an invite is a row the existing gate already reads — `created_by` never
+//       enters the admission read, and `kind` enters it only through the invite
+//       expiry, which can close a door and never open one (ADR 0356 amends D2.5)
 //   D3  the admission verdict stays `access_request.review` at the archon floor,
 //       and `project.recruit`, once minted, takes exactly the shape the ADR fixes
 //
@@ -66,16 +67,22 @@ test('the ADR exists, is indexed, and ADR 0141 names it as superseding its §5 i
 
 // Both admission reads: the gate's own (hasInvitedAccessRequest) and the state the
 // "confirming access" waiting page polls (accessStateByLogin), which must agree with it.
-test('D2: both admission reads look at status alone — an invite and an approved application admit identically', () => {
+// Since ADR 0356 (task 1002969) `kind` reaches them through ONE door: the ANDed
+// invite-expiry unit, which only ever narrows `status = 'invited'`.
+test('D2: both admission reads look at status, narrowed only by the invite expiry — never widened by kind', () => {
   const src = read('src', 'bongos', 'db-kernel.js');
   for (const fn of ['hasInvitedAccessRequest', 'accessStateByLogin']) {
     const m = new RegExp(`async function ${fn}\\([^)]*\\)\\s*\\{([\\s\\S]*?)\\n\\}`).exec(src);
     assert.ok(m, `${fn} is still an admission read in db-kernel.js`);
     const body = m[1];
-    assert.match(body, /status\s*=\s*'invited'/, `${fn}: admission is status = invited`);
-    assert.doesNotMatch(body, /\bkind\b/, `${fn}: kind is descriptive; it must never decide admission`);
+    assert.match(body, /status\s*=\s*'invited'\s+AND\s+\$\{inviteLiveSql\(\)\}/, `${fn}: admission is status = invited AND the invite has not expired`);
+    assert.doesNotMatch(body, /\bkind\b/, `${fn}: kind is never read directly; only through inviteLiveSql`);
     assert.doesNotMatch(body, /\bcreated_by\b/, `${fn}: created_by is audit data; it must never decide admission`);
   }
+  // And that unit can only close a door: NOT (an invite AND past its window).
+  const { inviteLiveSql } = require('../src/bongos/invite-expiry.js');
+  assert.match(inviteLiveSql(), /^NOT \(kind = 'invite' AND created_at <= now\(\) - interval '\d+ days'\)$/,
+    'the expiry is a pure narrowing: a row that is not an invite is untouched by it');
 });
 
 test('D1: no hub (platform-identity) source writes access_requests — the hub relays, it never admits', () => {

package/tests/provisioning_planet_physics.mjs

@@ -0,0 +1,377 @@
+// tests/provisioning_planet_physics.mjs
+//
+// The seven planet-physics answers, the screening hook, and the soft-limit rule
+// table (BV2.PS02, task 1004416; goal 1000121, spec
+// docs/specs/bongos-v2-project-startup.md decision D6).
+//
+// Done when: a create request can carry the answers, they read back on the project,
+// and a test pins the vocabulary and the stop path. Four layers:
+//   • the vocabulary   — every kind of question, stored canonically, refused loudly
+//   • soft limits      — a reason on every rule, every rule names real answers, and
+//                        nothing claims a limit is enforced
+//   • screening        — the stop path, and the honest projects it must let through
+//   • the routes       — POST /instances carries and reads back the answers; a
+//                        screened description is stopped BEFORE anything is created;
+//                        PATCH …/detail un-answers with null
+//
+// DB-free: the data-access functions the routes need are stubbed on the cached
+// module object, over a loopback listener (the provisioning_module_selection.mjs rig).
+//
+// Run:  node tests/provisioning_planet_physics.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+// ESM named imports off the CJS modules on purpose — knip cannot trace a
+// createRequire() import (the tests/provisioning_module_selection.mjs note).
+import { EU_COUNTRIES, COUNTRY_CODES, REGION_CODES, crossAnswerFault }
+  from '../modules/provisioning/planet-physics.js';
+import { SOFT_LIMIT_RULES, EFFECTS, softLimitsFor } from '../modules/provisioning/soft-limits.js';
+import { SCREENING_RULES, STOP_MESSAGE, screenProject } from '../modules/provisioning/screening.js';
+import { badProjectDetail, screenedOut } from '../modules/provisioning/routes/body-validators.js';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// The Kestrel sample from the canvas, answered in full.
+const KESTREL = Object.freeze({
+  project_state: 'existing', existing_work: ['digital-files', 'code'], main_work: 'code',
+  home_country: 'US', home_region: 'US-NY', builder_geography: 'global',
+  minors_on_board: true, entity: 'for-profit',
+  builders_at_start: 3, builders_expected: 8,
+  reward_intents: ['future-payouts', 'non-monetary'],
+  framing: 'hybrid', services: ['hosting', 'starter-kit', 'guild-access'],
+});
+
+console.log('\nThe vocabulary:');
+
+await t('the seven answers are all questions the detail column knows, beside team_shape', () => {
+  const keys = Object.keys(provisioning.PROJECT_DETAIL_QUESTIONS);
+  for (const key of ['team_shape', ...Object.keys(KESTREL)]) assert.ok(keys.includes(key), `${key} is a question`);
+  assert.deepEqual(provisioning.PROJECT_DETAIL_VOCAB.team_shape, ['solo', 'small-team', 'community'], 'the R15 answer is untouched');
+  // Framing is A–D, in that order.
+  assert.deepEqual(provisioning.PROJECT_DETAIL_VOCAB.framing, ['managed', 'hybrid', 'local', 'open-source']);
+});
+
+await t('every enumerated question has a closed answer list, and every count a range — no defaults anywhere', () => {
+  for (const [key, q] of Object.entries(provisioning.PROJECT_DETAIL_QUESTIONS)) {
+    if (q.kind === 'count') {
+      assert.ok(Number.isInteger(q.min) && q.max > q.min, `${key} has a range`);
+      assert.ok(!(key in provisioning.PROJECT_DETAIL_VOCAB), `${key} has no answer list to offer`);
+    } else {
+      assert.ok(['one', 'many'].includes(q.kind), `${key} is a known kind`);
+      assert.ok(Array.isArray(q.values) && q.values.length, `${key} has a closed list`);
+      assert.equal(provisioning.PROJECT_DETAIL_VOCAB[key], q.values, `${key}'s list is what options serves`);
+    }
+    assert.equal(q.default, undefined, `${key} carries no default`);
+  }
+});
+
+await t('a full set of answers stores canonically and reads back on the project', () => {
+  const stored = provisioning.normalizeProjectDetail(KESTREL);
+  // `many` answers come back in the vocabulary's order, so two spellings store one value.
+  assert.deepEqual(stored.existing_work, ['code', 'digital-files']);
+  assert.deepEqual(stored.reward_intents, ['non-monetary', 'future-payouts']);
+  assert.equal(stored.minors_on_board, true);
+  assert.equal(stored.builders_at_start, 3);
+  const read = provisioning.publicInstance({ id: 1, slug: 'kestrel', detail: stored }).detail;
+  assert.deepEqual(read, stored, 'the read is the stored answers, nothing added or lost');
+  assert.equal(Object.keys(read).length, Object.keys(KESTREL).length);
+});
+
+await t('false and an empty list are real answers, distinct from never answering', () => {
+  const stored = provisioning.normalizeProjectDetail({ minors_on_board: false, reward_intents: [] });
+  assert.deepEqual(stored, { minors_on_board: false, reward_intents: [] });
+  assert.deepEqual(provisioning.normalizeProjectDetail({}), {});
+});
+
+await t('badProjectDetail refuses every kind of wrong answer LOUDLY, naming the question', () => {
+  const cases = [
+    [{ plannet_state: 'new' }, /Unknown detail answer "plannet_state"/],
+    [{ project_state: 'brownfield' }, /"project_state" must be one of: new, existing/],
+    [{ existing_work: 'code' }, /"existing_work" must be a list/],
+    [{ existing_work: ['code', 'sculpture'] }, /"existing_work" must be a list, each item one of/],
+    [{ home_country: 'ZZ' }, /ISO 3166-1 alpha-2/],
+    [{ home_country: 'us' }, /ISO 3166-1 alpha-2/],
+    [{ home_region: 'US-XX' }, /US state or Canadian province/],
+    [{ minors_on_board: 'yes' }, /"minors_on_board" must be one of: false, true/],
+    [{ entity: 'llc' }, /"entity" must be one of/],
+    [{ builders_at_start: 0 }, /whole number from 1/],
+    [{ builders_expected: 2.5 }, /whole number/],
+    [{ builders_expected: '8' }, /whole number/],
+    [{ framing: 'b' }, /"framing" must be one of: managed, hybrid, local, open-source/],
+    [{ services: ['hosting', 'yacht'] }, /"services" must be a list/],
+  ];
+  for (const [detail, re] of cases) {
+    const fault = badProjectDetail(detail);
+    assert.ok(fault, `${JSON.stringify(detail)} is refused`);
+    assert.equal(fault.code, 'bad_detail');
+    assert.match(fault.message, re, JSON.stringify(detail));
+  }
+  assert.equal(badProjectDetail(KESTREL), null, 'the canvas sample is clean');
+});
+
+await t('null un-answers every kind of question — and only null does', () => {
+  const nulls = Object.fromEntries(Object.keys(KESTREL).map((k) => [k, null]));
+  assert.equal(badProjectDetail(nulls), null, 'null is accepted for every question');
+  const { set, clear } = provisioning.projectDetailPatch(nulls);
+  assert.deepEqual(set, {});
+  assert.deepEqual(clear.sort(), Object.keys(KESTREL).sort());
+  assert.ok(badProjectDetail({ existing_work: '' }), 'an empty string is still a typo, not an erase');
+});
+
+await t('answers sent together must agree: main work is one of the existing kinds, the region is in the country', () => {
+  assert.match(badProjectDetail({ existing_work: ['code'], main_work: 'physical-work' }).message, /"main_work" must be one of the kinds/);
+  assert.match(badProjectDetail({ home_country: 'DE', home_region: 'US-CA' }).message, /not in "home_country" DE/);
+  assert.equal(badProjectDetail({ home_country: 'CA', home_region: 'CA-ON' }), null);
+  // Across two writes it is not refused: a merge patch may change one half first.
+  assert.equal(crossAnswerFault({ main_work: 'physical-work' }), null);
+});
+
+await t('the reference lists are what they claim to be', () => {
+  assert.equal(new Set(COUNTRY_CODES).size, COUNTRY_CODES.length, 'no duplicate country');
+  assert.equal(COUNTRY_CODES.length, 249, 'the ISO 3166-1 officially assigned set');
+  assert.equal(EU_COUNTRIES.length, 27);
+  for (const c of EU_COUNTRIES) assert.ok(COUNTRY_CODES.includes(c), `${c} is a country`);
+  for (const r of REGION_CODES) assert.ok(COUNTRY_CODES.includes(r.slice(0, 2)), `${r} is inside a country`);
+});
+
+console.log('\nThe soft-limit table:');
+
+// Is `option` a real question, or a real member of one?
+function optionExists(option) {
+  const [key, member] = option.split(':');
+  const q = provisioning.PROJECT_DETAIL_QUESTIONS[key];
+  if (!q) return false;
+  return member === undefined || (q.values || []).map(String).includes(member);
+}
+
+await t('every rule carries a reason, a known effect, and names only real questions and answers', () => {
+  const ids = new Set();
+  for (const rule of SOFT_LIMIT_RULES) {
+    assert.ok(!ids.has(rule.id), `${rule.id} is unique`); ids.add(rule.id);
+    assert.ok(typeof rule.reason === 'string' && rule.reason.length > 10, `${rule.id} has a reason`);
+    assert.ok(EFFECTS.includes(rule.effect), `${rule.id}'s effect is one of ${EFFECTS}`);
+    assert.ok(rule.options.length, `${rule.id} names an option`);
+    for (const option of rule.options) assert.ok(optionExists(option), `${rule.id}: ${option} exists`);
+    for (const [key, test] of Object.entries(rule.when)) {
+      const q = provisioning.PROJECT_DETAIL_QUESTIONS[key];
+      assert.ok(q, `${rule.id}: ${key} is a question`);
+      const named = test.in || [test.has ?? test.lacks];
+      for (const v of named) assert.ok(q.values.includes(v), `${rule.id}: ${key}=${v} is a real answer`);
+    }
+  }
+});
+
+await t('nothing claims a limit is enforced — not the resolution, not any reason', () => {
+  assert.equal(softLimitsFor(KESTREL).enforced, false);
+  assert.equal(softLimitsFor({}).enforced, false);
+  for (const rule of SOFT_LIMIT_RULES) {
+    assert.doesNotMatch(rule.reason, /enforc|automatic|blocked|prohibit|not permitted|forbidden/i, `${rule.id} words advice as a rule`);
+  }
+});
+
+await t("the spec's three examples fire, each with its why line", () => {
+  const find = (answers, option) => softLimitsFor(answers).limits.filter((l) => l.option === option);
+  const equity = find({ entity: 'intent-solo' }, 'reward_intents:equity');
+  assert.equal(equity.length, 1); assert.equal(equity[0].effect, 'grey');
+  assert.match(equity[0].reason, /until you form a company/);
+  assert.match(find({ builder_geography: 'us-eu' }, 'reward_intents:cash')[0].reason, /EU aren't available yet/);
+  assert.match(find({ minors_on_board: true }, 'reward_intents:cash')[0].reason, /13 to 15 join non-monetary tracks only/);
+  // A formed company is not greyed out of equity.
+  assert.equal(find({ entity: 'for-profit' }, 'reward_intents:equity').length, 0);
+});
+
+await t('a rule never fires on an answer nobody gave — only the platform-wide facts apply to a skipped interview', () => {
+  const skipped = softLimitsFor({});
+  for (const limit of skipped.limits) {
+    const rule = SOFT_LIMIT_RULES.find((r) => r.id === limit.rule);
+    assert.deepEqual(rule.when, {}, `${rule.id} fired with no answers`);
+  }
+  // `lacks` is "said, and not this" — never "never said".
+  assert.ok(!softLimitsFor({}).limits.some((l) => l.rule === 'labor-payment-follows-cash'));
+  assert.ok(softLimitsFor({ reward_intents: ['equity'] }).limits.some((l) => l.rule === 'labor-payment-follows-cash'));
+  assert.ok(!softLimitsFor({ reward_intents: ['cash'] }).limits.some((l) => l.rule === 'labor-payment-follows-cash'));
+});
+
+await t('the table hides whole questions too: a new planet has no existing work, managed has no services to pick', () => {
+  const opts = (answers) => softLimitsFor(answers).limits.filter((l) => l.effect === 'hide').map((l) => l.option);
+  assert.deepEqual(opts({ project_state: 'new' }), ['existing_work', 'main_work']);
+  assert.ok(opts({ framing: 'managed' }).includes('services'));
+  assert.ok(!opts({ framing: 'hybrid' }).includes('services'));
+});
+
+await t('the soft limits read back on every owner read of the project, from the stored answers', () => {
+  const view = provisioning.publicInstance({ id: 1, slug: 'kestrel', detail: provisioning.normalizeProjectDetail({ entity: 'nonprofit' }) });
+  assert.equal(view.soft_limits.enforced, false);
+  assert.ok(view.soft_limits.limits.some((l) => l.rule === 'equity-not-in-a-nonprofit'));
+});
+
+console.log('\nScreening:');
+
+await t('the stop path: each rule stops a description that asks for the thing itself', () => {
+  const stops = [
+    ['A marketplace to sell ransomware to anyone who pays.', 'malware'],
+    ['We want to build a phishing kit that copies bank logins.', 'phishing'],
+    ['A site sharing explicit images of minors.', 'child-sexual-abuse'],
+  ];
+  for (const [description, rule] of stops) assert.deepEqual(screenProject({ description }), { stop: true, rule }, description);
+  assert.deepEqual(SCREENING_RULES.map((r) => r.id).sort(), stops.map(([, r]) => r).sort(), 'every rule has a stop case here');
+});
+
+await t('honest projects pass — including the ones that talk about the same things', () => {
+  for (const description of [
+    'A field guide app where birdwatchers log sightings together and build a shared map.',
+    'We build a ransomware detector for small clinics.',
+    'A phishing awareness course that runs simulated campaigns for our staff.',
+    'A child safety app that helps parents block harmful content.',
+    '', '   ',
+  ]) assert.deepEqual(screenProject({ description }), { stop: false }, description);
+  assert.deepEqual(screenProject({}), { stop: false }, 'no text is never a stop');
+  assert.deepEqual(screenProject({ description: 42 }), { stop: false });
+});
+
+await t('the hook is a seam: a caller can hand it different rules and nothing else changes', () => {
+  const rules = [{ id: 'test-only', match: /\bkestrel\b/i, unless: null }];
+  assert.deepEqual(screenProject({ description: 'Kestrel' }, rules), { stop: true, rule: 'test-only' });
+  assert.deepEqual(screenProject({ description: 'Kestrel' }), { stop: false });
+});
+
+await t('screenedOut answers with the canvas copy and names no rule anywhere in the reply', () => {
+  assert.equal(screenedOut('A birdwatching map.'), null);
+  assert.equal(screenedOut(undefined), null);
+  const out = screenedOut('We will sell ransomware.');
+  assert.equal(out.status, 422);
+  assert.equal(out.message, STOP_MESSAGE);
+  assert.match(out.message, /Nothing has been set up/);
+  assert.deepEqual(out.details, { screened: true }, 'naming the rule would teach a caller how to reword around it');
+  assert.doesNotMatch(JSON.stringify(out), /malware/);
+});
+
+console.log('\nThe routes:');
+
+let lastCreateArgs = null;
+let detailRow = null;
+provisioning.getInstanceBySlug = async () => null;
+provisioning.getInstanceByDomain = async () => null;
+provisioning.getInstanceById = async () => detailRow;
+provisioning.createInstance = async (_db, args) => {
+  lastCreateArgs = args;
+  return { instance: { id: 41, owner_builder_id: 7, slug: args.slug, status: 'requested', hosting_shape: 'byo-host',
+    description: args.description || null, detail: provisioning.normalizeProjectDetail(args.detail) }, created: true };
+};
+provisioning.enqueueIntent = async (_db, id, action) => ({ intent: { id: 9, action, state: 'pending' }, created: true });
+provisioning.getOpenIntent = async () => null;
+provisioning.recordEvent = async () => {};
+// Mirrors the real statement: merge the set answers, drop the un-answered keys.
+provisioning.updateInstanceDetail = async (_db, _id, patch) => {
+  const row = { ...detailRow };
+  if (patch.description !== undefined) row.description = patch.description;
+  if (patch.detail !== undefined) {
+    const { set, clear } = provisioning.projectDetailPatch(patch.detail);
+    row.detail = { ...(detailRow.detail || {}), ...set };
+    for (const key of clear) delete row.detail[key];
+  }
+  detailRow = row;
+  return row;
+};
+
+const api = require('../src/module-api.js');
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+
+const express = require('express');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(details || (typeof opts === 'object' ? opts : {})) } });
+  };
+  next();
+});
+app.use('/api/bongos', provisioningRoutes());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function send(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${path}`, {
+      method, headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+await t('POST /instances carries all seven answers to storage and reads them back on the project', async () => {
+  lastCreateArgs = null;
+  const res = await send('POST', '/provisioning/instances', {
+    slug: 'kestrel', hosting_shape: 'byo-host', description: 'An inventory tool our team started last year.', detail: KESTREL,
+  });
+  assert.equal(res.status, 201, res.raw);
+  assert.deepEqual(lastCreateArgs.detail, KESTREL, 'the answers reached createInstance');
+  assert.deepEqual(res.body.instance.detail, provisioning.normalizeProjectDetail(KESTREL), 'and read back on the project');
+  assert.equal(res.body.instance.soft_limits.enforced, false, 'with the soft limits beside them');
+});
+
+await t('POST /instances refuses an unknown answer with a 400 and creates nothing', async () => {
+  lastCreateArgs = null;
+  const res = await send('POST', '/provisioning/instances', { slug: 'kestrel', hosting_shape: 'byo-host', detail: { framing: 'e' } });
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'bad_detail');
+  assert.equal(lastCreateArgs, null);
+});
+
+await t('POST /instances: a screened description STOPS creation — 422, nothing created, no intent queued', async () => {
+  lastCreateArgs = null;
+  let queued = false;
+  const enqueue = provisioning.enqueueIntent;
+  provisioning.enqueueIntent = async (...a) => { queued = true; return enqueue(...a); };
+  const res = await send('POST', '/provisioning/instances', {
+    slug: 'kestrel', hosting_shape: 'byo-host', description: 'Build ransomware and sell it on forums.', detail: KESTREL,
+  });
+  provisioning.enqueueIntent = enqueue;
+  assert.equal(res.status, 422, res.raw);
+  assert.equal(res.body.error.code, 'screened_out');
+  assert.equal(res.body.error.message, STOP_MESSAGE);
+  assert.deepEqual(res.body.error.details, { screened: true }, 'the reply names no rule');
+  assert.equal(lastCreateArgs, null, 'createInstance never ran');
+  assert.equal(queued, false, 'and no provision intent exists');
+});
+
+await t('PATCH …/detail screens a new description too, so the stop cannot be walked around after creation', async () => {
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'kestrel', status: 'active', description: 'A map.', detail: {} };
+  const res = await send('PATCH', '/provisioning/instances/41/detail', { description: 'We will build a phishing kit.' });
+  assert.equal(res.status, 422, res.raw);
+  assert.equal(res.body.error.code, 'screened_out');
+  assert.equal(detailRow.description, 'A map.', 'nothing was written');
+});
+
+await t('PATCH …/detail answers, re-reads, and un-answers with null — soft limits following the stored answers', async () => {
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'kestrel', status: 'active', detail: {} };
+  const set = await send('PATCH', '/provisioning/instances/41/detail', { detail: { entity: 'intent-solo', reward_intents: ['equity'] } });
+  assert.equal(set.status, 200, set.raw);
+  assert.deepEqual(set.body.detail, { entity: 'intent-solo', reward_intents: ['equity'] });
+  assert.ok(set.body.soft_limits.limits.some((l) => l.rule === 'equity-needs-a-company'));
+  const cleared = await send('PATCH', '/provisioning/instances/41/detail', { detail: { entity: null } });
+  assert.equal(cleared.status, 200, cleared.raw);
+  assert.deepEqual(cleared.body.detail, { reward_intents: ['equity'] }, 'the entity is un-answered, the rest kept');
+  assert.ok(!cleared.body.soft_limits.limits.some((l) => l.rule === 'equity-needs-a-company'), 'and its limit left with it');
+});
+
+server.close();
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);