@bongos/core 1.20.36 → 1.20.38

package/tests/instance_feedback.mjs

@@ -0,0 +1,327 @@
+// tests/instance_feedback.mjs — `bongos feedback`: a builder on a managed project
+// reports something about Bongos itself, their project relays it to the hub, and
+// the hub files it (task 1004462). DB-free: the hub half is driven through its
+// pure module with a fake `ideas.capture`, the project half through its real
+// router with a fake hub.
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require_ = createRequire(import.meta.url);
+const IF = require_(path.join(ROOT, 'modules/platform-identity/instance-feedback.js'));
+const { decideLanding } = require_(path.join(ROOT, 'modules/ideas/routing.js'));
+
+const CLIENT = { client_id: 'acme', name: 'Acme', origin: 'https://acme.example.com' };
+
+// ── the hub: who gets to file, and where it lands ─────────────────────────────
+
+test('a relayed bug lands as a homeless bug AWAITING A NOD, never claimable', () => {
+  // The owner's rule (2026-09-30): every report waits. The relay files with no
+  // rank, so no sender — the hub's own Archon included — can skip the nod.
+  const d = decideLanding({ goalId: null, kind: 'bug', filerRank: null, vector: 'instance-feedback' });
+  assert.deepEqual(d, { route: true, status: 'backlog', homeless: true, reason: 'bug_homeless_awaiting_nod' });
+});
+
+test('a relayed idea is not a defect — it stays in the inbox', () => {
+  const d = decideLanding({ goalId: null, kind: IF.FEEDBACK_KINDS.idea, filerRank: null, vector: 'instance-feedback' });
+  assert.equal(d.route, false);
+});
+
+test('fileInstanceFeedback files with its own vector, no rank, and the hub\'s own login', async () => {
+  let captured = null;
+  const landing = await IF.fileInstanceFeedback({
+    client: CLIENT, githubId: '42', message: 'claim hung\nfor two minutes', kind: 'bug',
+    context: { core_version: '1.19.900', cli_version: '0.2.0', os: 'darwin 24.6.0' },
+  }, {
+    capture: async (c) => { captured = c; return { id: 7, routing: { routed: true, task_id: 1234, goal_id: 1000118, status: 'backlog' } }; },
+    getAccount: async () => ({ github_login: 'hub-login' }),
+    hubBuilderId: async () => 99,
+  });
+  assert.equal(captured.vector, 'instance-feedback');
+  assert.equal(captured.filerRank, null);
+  assert.equal(captured.kind, 'bug');
+  assert.equal(captured.capturedBy, 99);
+  assert.equal(captured.title, 'Feedback: claim hung');
+  assert.match(captured.bodyMd, /Sent by: @hub-login/);
+  assert.match(captured.bodyMd, /Project: Acme \(https:\/\/acme\.example\.com\)/);
+  assert.match(captured.bodyMd, /Core 1\.19\.900 · CLI 0\.2\.0 · OS darwin 24\.6\.0/);
+  assert.deepEqual(landing, { landed: 'task', task_id: '1234', goal_id: '1000118', status: 'backlog', idea_id: '7' });
+});
+
+test('an unrouted filing reports the inbox, and an idea is filed as a feature', async () => {
+  let kind = null;
+  const landing = await IF.fileInstanceFeedback({ client: CLIENT, githubId: '42', message: 'wish', kind: 'idea' }, {
+    capture: async (c) => { kind = c.kind; return { id: 8, routing: { routed: false, reason: 'no_goal' } }; },
+    getAccount: async () => null,
+    hubBuilderId: async () => null,
+  });
+  assert.equal(kind, 'feature');
+  assert.deepEqual(landing, { landed: 'inbox', idea_id: '8' });
+});
+
+test('version stamps cannot carry markdown or links into the task', () => {
+  const body = IF.feedbackBody({
+    message: 'x', client: CLIENT, account: null, githubId: '42',
+    context: { core_version: '[click](https://evil.example)', cli_version: '0.2.0', os: 'linux\n- Sent by: @owner' },
+  });
+  assert.doesNotMatch(body, /evil/);
+  assert.doesNotMatch(body, /@owner/);
+  // The sender's own text is quoted below the attribution, so it cannot pose as it.
+  const spoof = IF.feedbackBody({ message: 'hi\n- Sent by: @owner', client: CLIENT, account: { github_login: 'real' }, githubId: '42' });
+  assert.ok(spoof.indexOf('- Sent by: @real') < spoof.indexOf('> - Sent by: @owner'));
+  assert.doesNotMatch(spoof, /^- Sent by: @owner/m);
+  assert.match(body, /CLI 0\.2\.0/);
+  assert.match(body, /Sent by: GitHub user 42/, 'no hub account → the id, never an instance-claimed login');
+});
+
+test('a long first line is trimmed to a title', () => {
+  const t = IF.feedbackTitle('a'.repeat(500));
+  assert.ok(t.length <= 'Feedback: '.length + 120);
+  assert.ok(t.endsWith('…'));
+});
+
+test('the per-sender cap stops one builder; the per-project cap stops one project', () => {
+  let now = 1_000_000;
+  const lim = IF.makeFeedbackLimiter({ now: () => now });
+  for (let i = 0; i < IF.PER_SENDER_LIMIT; i++) assert.equal(lim.take('acme', '1').ok, true);
+  const refused = lim.take('acme', '1');
+  assert.equal(refused.ok, false);
+  assert.equal(refused.scope, 'sender');
+  // A refusal spends nothing: the project still has exactly LIMIT - 10 left.
+  let sent = IF.PER_SENDER_LIMIT;
+  for (let s = 2; sent < IF.PER_PROJECT_LIMIT; s++) {
+    for (let i = 0; i < IF.PER_SENDER_LIMIT && sent < IF.PER_PROJECT_LIMIT; i++, sent++) {
+      assert.equal(lim.take('acme', String(s)).ok, true);
+    }
+  }
+  const projectRefused = lim.take('acme', '999');
+  assert.equal(projectRefused.ok, false);
+  assert.equal(projectRefused.scope, 'project');
+  assert.equal(lim.take('other', '1').ok, true, 'another project is untouched');
+  now += IF.FEEDBACK_WINDOW_MS;
+  assert.equal(lim.take('acme', '1').ok, true, 'the window slides');
+});
+
+test('the hub route authenticates the project and the sender BEFORE spending or filing', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/platform-identity/routes/sso.js'), 'utf8');
+  const route = src.slice(src.indexOf("router.post('/sso/feedback'"));
+  const at = (s) => { const i = route.indexOf(s); assert.ok(i > 0, `route has ${s}`); return i; };
+  assert.ok(at('clientSecretValid') < at('membershipBacksRollup'));
+  assert.ok(at('membershipBacksRollup') < at('feedbackLimiter.take'));
+  assert.ok(at('feedbackLimiter.take') < at('fileInstanceFeedback'));
+  assert.doesNotMatch(route.slice(0, route.indexOf('return router')), /filerRank|vector:/,
+    'the route passes neither a rank nor a vector — both are fixed in instance-feedback.js');
+});
+
+// ── the project: the relay ────────────────────────────────────────────────────
+
+async function withRoute({ idp, hub }, fn) {
+  const r2 = createRequire(import.meta.url);
+  const authPath = r2.resolve(path.join(ROOT, 'src/bongos/auth.js'));
+  const routePath = r2.resolve(path.join(ROOT, 'src/bongos/routes/feedback.js'));
+  const envPath = r2.resolve(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+  const realAuth = r2(authPath);
+  const saved = realAuth.requireBuilder;
+  realAuth.requireBuilder = (req, _res, next) => { req.builder = { id: 5, github_id: '42', github_login: 'someone' }; next(); };
+  delete r2.cache[routePath];
+  const sent = [];
+  const fetchImpl = async (url, opts) => {
+    sent.push({ url, body: JSON.parse(opts.body) });
+    const { status, body } = hub;
+    return { status, json: async () => body };
+  };
+  const express = r2('express');
+  const app = express();
+  app.use(express.json());
+  app.use(r2(envPath).attachFail);
+  app.use(r2(routePath)({ idpConfig: () => idp, fetchImpl }));
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  const post = (body) => fetch(`http://127.0.0.1:${server.address().port}/feedback`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
+  }).then(async (r) => ({ status: r.status, body: await r.json() }));
+  try {
+    await fn({ post, sent });
+  } finally {
+    server.close();
+    realAuth.requireBuilder = saved;
+    delete r2.cache[routePath];
+  }
+}
+
+const IDP = { origin: 'https://hub.example.com', clientId: 'acme', clientSecret: 's3cret' };
+
+test('the relay sends the SESSION\'s identity and the running core to the hub, and returns the landing', async () => {
+  await withRoute({ idp: IDP, hub: { status: 201, body: { ok: true, landed: 'task', task_id: '1234', status: 'backlog' } } }, async ({ post, sent }) => {
+    assert.equal((await post({ message: 'x', github_id: '1' })).status, 400, 'a body naming a sender is refused outright');
+    assert.equal(sent.length, 0);
+    const r = await post({ message: '  it broke  ', context: { cli_version: '0.2.0', os: 'darwin', core_version: 'forged' } });
+    assert.equal(r.status, 201);
+    assert.equal(r.body.task_id, '1234');
+    assert.equal(r.body.hub_origin, IDP.origin);
+    assert.equal(sent.length, 1);
+    assert.equal(sent[0].url, 'https://hub.example.com/api/bongos/sso/feedback');
+    assert.equal(sent[0].body.github_id, '42', 'from the session, never the body');
+    assert.equal(sent[0].body.message, 'it broke');
+    assert.equal(sent[0].body.kind, 'bug');
+    assert.notEqual(sent[0].body.context.core_version, 'forged', 'the core version is this server\'s own');
+    assert.equal(sent[0].body.client_secret, 's3cret');
+  });
+});
+
+test('a project with no hub link says so, and sends nothing', async () => {
+  await withRoute({ idp: null, hub: { status: 500, body: {} } }, async ({ post, sent }) => {
+    const r = await post({ message: 'hello' });
+    assert.equal(r.status, 409);
+    assert.equal(r.body.error.code, 'not_hub_connected');
+    assert.equal(sent.length, 0);
+  });
+});
+
+test('an empty message or an unknown kind is refused locally', async () => {
+  await withRoute({ idp: IDP, hub: { status: 201, body: { ok: true } } }, async ({ post, sent }) => {
+    assert.equal((await post({ message: '   ' })).body.error.code, 'message_required');
+    const badKind = await post({ message: 'x', kind: 'task' });
+    assert.equal(badKind.status, 400);
+    assert.equal((await post({ message: 'x'.repeat(4001) })).status, 400, 'over the cap');
+    assert.equal(sent.length, 0);
+  });
+});
+
+test('a hub refusal the builder can act on is passed through; anything else is generic', async () => {
+  await withRoute({ idp: IDP, hub: { status: 429, body: { error: { code: 'rate_limited', details: { retry_after_seconds: 600 } } } } }, async ({ post }) => {
+    const r = await post({ message: 'x' });
+    assert.equal(r.status, 429);
+    assert.equal(r.body.error.code, 'rate_limited');
+    assert.equal(r.body.error.details.retry_after_seconds, 600);
+  });
+  await withRoute({ idp: IDP, hub: { status: 401, body: { error: { code: 'invalid_client', message: 'secret mismatch' } } } }, async ({ post }) => {
+    const r = await post({ message: 'x' });
+    assert.equal(r.status, 502);
+    assert.equal(r.body.error.code, 'hub_refused');
+    assert.doesNotMatch(JSON.stringify(r.body), /secret/);
+  });
+});
+
+// ── the CLI ───────────────────────────────────────────────────────────────────
+
+test('`bongos feedback` is a registered verb, and every refusal code has a plain line', () => {
+  const { VERBS } = require_(path.join(ROOT, 'bin/bongos.js'));
+  assert.equal(VERBS.feedback.script, 'feedback-send.js');
+  const { REFUSALS, readMessage } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  for (const code of ['message_required', 'not_hub_connected', 'membership_required', 'rate_limited', 'feedback_unavailable', 'hub_unreachable']) {
+    assert.ok(REFUSALS[code], code);
+  }
+  for (const code of ['validation_failed']) {
+    assert.ok(REFUSALS[code], code);
+  }
+  assert.equal(readMessage(['--idea', 'filter', 'by', 'goal']), 'filter by goal');
+});
+
+// ── the hub route, driven for real ────────────────────────────────────────────
+// The assembled /sso router with its DB edges stubbed: the client lookup, the
+// membership read and the account read on the platform-identity domain, the
+// builders lookup on the doorway's pool, and the `ideas.capture` port.
+
+async function withHub(overrides, fn) {
+  const r2 = createRequire(import.meta.url);
+  const api = r2(path.join(ROOT, 'src/module-api.js'));
+  const seams = r2(path.join(ROOT, 'src/module-seams.js'));
+  const pi = r2(path.join(ROOT, 'modules/platform-identity/platform-identity.js'));
+  const saved = { ...pi };
+  const savedQuery = api.pool.query;
+  const captured = [];
+  Object.assign(pi, {
+    getClient: async (id) => (id === 'acme' ? { ...CLIENT, status: 'active' } : null),
+    clientSecretValid: (_c, s) => s === 'right',
+    getMembership: async () => ({ membership_kind: 'member', signin_verified_at: new Date() }),
+    getAccount: async () => ({ github_login: 'hub-login' }),
+  }, overrides);
+  api.pool.query = async () => ({ rows: [] });
+  if (!seams.hasProvider('ideas.capture')) {
+    seams.registerProvider('ideas.capture', async (c) => { captured.push(c); return { id: 1, routing: { routed: true, task_id: 55, goal_id: 9, status: 'backlog' } }; });
+  }
+  const routerPath = r2.resolve(path.join(ROOT, 'modules/platform-identity/routes/sso.js'));
+  delete r2.cache[routerPath];
+  const express = r2('express');
+  const app = express();
+  app.use(express.json());
+  app.use(r2(path.join(ROOT, 'src/bongos/middleware/error-envelope.js')).attachFail);
+  app.use(r2(routerPath)());
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  const post = (body) => fetch(`http://127.0.0.1:${server.address().port}/sso/feedback`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
+  }).then(async (res) => ({ status: res.status, body: await res.json() }));
+  try { await fn({ post, captured }); } finally {
+    server.close();
+    Object.assign(pi, saved);
+    api.pool.query = savedQuery;
+    delete r2.cache[routerPath];
+  }
+}
+
+const GOOD = { client_id: 'acme', client_secret: 'right', github_id: '42', message: 'claim hung' };
+
+test('hub: a witnessed member\'s bug is filed at backlog and the landing comes back 201', async () => {
+  await withHub({}, async ({ post, captured }) => {
+    const r = await post(GOOD);
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    assert.deepEqual(r.body, { ok: true, landed: 'task', task_id: '55', goal_id: '9', status: 'backlog', idea_id: '1' });
+    assert.equal(captured.at(-1).vector, 'instance-feedback');
+    assert.equal(captured.at(-1).filerRank, null);
+  });
+});
+
+test('hub: a wrong secret, an unwitnessed sender and a forged field are all refused before filing', async () => {
+  await withHub({}, async ({ post, captured }) => {
+    const before = captured.length;
+    assert.equal((await post({ ...GOOD, client_secret: 'wrong' })).status, 401);
+    assert.equal((await post({ ...GOOD, github_id: 'abc' })).status, 400);
+    assert.equal((await post({ ...GOOD, filer_rank: 'archon' })).status, 400, 'no rank can ride the body');
+    assert.equal(captured.length, before);
+  });
+  await withHub({ getMembership: async () => ({ membership_kind: 'member', signin_verified_at: null }) }, async ({ post, captured }) => {
+    const before = captured.length;
+    const r = await post(GOOD);
+    assert.equal(r.status, 409);
+    assert.equal(r.body.error.code, 'membership_required');
+    assert.equal(captured.length, before);
+  });
+});
+
+// ── proactive filing (task 1004467) ───────────────────────────────────────────
+// The owner's rule: a builder venting that Bongos is broken gets it filed without
+// asking. That lives in two places, and both must keep saying it.
+
+test('the skill files unasked on a Bongos rant, and the kernel tells every session to', () => {
+  const skill = fs.readFileSync(path.join(ROOT, '.claude/skills/bongos-feedback/SKILL.md'), 'utf8');
+  const description = skill.split('\n---')[0];
+  assert.match(description, /unasked/, 'the listing entry itself says it acts unprompted');
+  assert.match(description, /Bongos is broken/, 'a venting phrase is a trigger');
+  assert.match(skill, /File it without being asked/);
+  assert.match(skill, /Never paste the rant/, 'a report, not the raw complaint');
+  assert.match(skill, /own project/, 'their own code is out of scope');
+  assert.match(skill, /One filing per distinct problem per session/);
+  const kernel = fs.readFileSync(path.join(ROOT, 'CLAUDE.md'), 'utf8');
+  assert.match(kernel, /vents that Bongos itself is broken.*\/bongos-feedback/);
+});
+
+test('every report is secret-scrubbed before it leaves the machine, and never sent unscrubbed', async () => {
+  const { scrubReport } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const token = 'ghp_' + 'a1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8';
+  const envValue = 'zq9-private-value-7781';
+  const r = scrubReport(`claim failed, my token is ${token} and the key is ${envValue}`, { MY_API_KEY: envValue });
+  assert.doesNotMatch(r.text, /ghp_/);
+  assert.ok(!r.text.includes(envValue), 'an env secret is stripped by value');
+  assert.ok(r.removed >= 2);
+  assert.equal(scrubReport('bongos claim hung for two minutes', {}).text, 'bongos claim hung for two minutes', 'plain prose is untouched');
+  const src = fs.readFileSync(path.join(ROOT, 'scripts/gds/feedback-send.js'), 'utf8');
+  assert.ok(src.indexOf('scrubReport(message)') < src.indexOf("api.request('POST', '/feedback'"), 'scrubbed before the request');
+  assert.match(src, /message: scrubbed\.text/, 'only the scrubbed text is sent');
+});

package/tests/module_assess_tests.mjs

@@ -0,0 +1,232 @@
+// tests/module_assess_tests.mjs — the Tests assessment signal (task 1003791, ADR 0343).
+// No database: the module's tests really run (real node child processes, from a REAL
+// packed tarball verified by module-artifact.js), and the signal row goes to a fake
+// pg client, so what is pinned is the outcome vocabulary core_265 stores:
+//   no tests      -> no_data, never a fail
+//   tests ran     -> scored, round(100 x passing files / files), sample_size = files
+//   unreadable    -> not_scored
+// plus the two safety properties: the sandbox is always removed, and a module's test
+// process never inherits the parent's credentials. And it runs regardless of whether
+// the module is enabled — nothing here consults isModuleEnabled.
+//
+// Run:  node tests/module_assess_tests.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { discoverTestFiles, assessTests, recordTestsSignal, insertSignal, runRefusal, testEnv, SANDBOX_PREFIX } = require('../scripts/gds/module-assess-tests.js');
+const { packModule, verifyModuleArtifact } = require('../scripts/gds/module-artifact.js');
+const { relativeArtifactPath } = require('../src/bongos/module-store.js');
+
+const PASS = "import assert from 'node:assert'; assert.equal(1 + 1, 2); console.log('1 passed, 0 failed');\n";
+const FAIL = "import assert from 'node:assert'; assert.equal(1 + 1, 3);\n";
+const file = (p, text) => ({ path: p, buf: Buffer.from(text) });
+const tmpRoot = () => fs.mkdtempSync(path.join(os.tmpdir(), 'mod-assess-root-'));
+const sandboxesIn = (root) => fs.readdirSync(root).filter((n) => n.startsWith(SANDBOX_PREFIX));
+
+test('only tests/*.mjs at the top of tests/ count, as in the unit gate', () => {
+  assert.deepEqual(
+    discoverTestFiles(['module.json', 'tests/b.mjs', 'tests/a.mjs', 'tests/fixtures/x.mjs', 'tests/helper.js', 'lib/tests/c.mjs']),
+    ['tests/a.mjs', 'tests/b.mjs']);
+});
+
+test('a module that declares no tests is no_data, not a fail', async () => {
+  const root = tmpRoot();
+  const s = await assessTests('weather', [file('module.json', '{}'), file('index.js', '')], { trusted: true, root });
+  assert.equal(s.outcome, 'no_data');
+  assert.equal(s.score, null, 'no_data carries no number (core_265: score exactly when scored)');
+  assert.equal(s.sample_size, 0);
+  assert.match(s.reason, /declares no tests/);
+  assert.deepEqual(sandboxesIn(root), [], 'nothing is unpacked when there is nothing to run');
+});
+
+test('all passing scores 100; one of two failing scores 50', async () => {
+  const root = tmpRoot();
+  const all = await assessTests('weather', [file('tests/a.mjs', PASS), file('tests/b.mjs', PASS)], { trusted: true, root });
+  assert.equal(all.outcome, 'scored');
+  assert.equal(all.score, 100);
+  assert.equal(all.sample_size, 2);
+
+  const half = await assessTests('weather', [file('tests/a.mjs', PASS), file('tests/b.mjs', FAIL)], { trusted: true, root });
+  assert.equal(half.outcome, 'scored');
+  assert.equal(half.score, 50);
+  assert.equal(half.sample_size, 2);
+  assert.match(half.reason, /1 of 2/);
+  const failed = half.detail.files.find((f) => f.file === 'tests/b.mjs');
+  assert.equal(failed.passed, false);
+  assert.match(failed.tail, /AssertionError|assert/i, 'a failing file keeps a bounded tail of why');
+  assert.deepEqual(sandboxesIn(root), [], 'the sandbox is removed after every run');
+});
+
+test('every failing still scores 0 — distinct from no_data', async () => {
+  const s = await assessTests('weather', [file('tests/a.mjs', FAIL)], { trusted: true, root: tmpRoot() });
+  assert.equal(s.outcome, 'scored');
+  assert.equal(s.score, 0);
+});
+
+test('a module test reaches its own files by relative path, at the modules/<key>/ depth', async () => {
+  const s = await assessTests('weather', [
+    file('lib/add.js', 'module.exports = (a, b) => a + b;\n'),
+    file('tests/a.mjs', "import { createRequire } from 'node:module'; import assert from 'node:assert';\nconst add = createRequire(import.meta.url)('../lib/add.js'); assert.equal(add(2, 2), 4);\n"),
+  ], { trusted: true, root: tmpRoot() });
+  assert.equal(s.score, 100, JSON.stringify(s.detail));
+});
+
+test('a module test process never inherits the parent\'s credentials', async () => {
+  process.env.DATABASE_URL = 'postgres://secret@host/db';
+  process.env.BONGOS_TOKEN = 'secret-token';
+  try {
+    const s = await assessTests('weather', [file('tests/env.mjs',
+      "import assert from 'node:assert'; assert.equal(process.env.DATABASE_URL, undefined); assert.equal(process.env.BONGOS_TOKEN, undefined); assert.equal(process.env.NODE_ENV, 'test');\n")],
+      { trusted: true, root: tmpRoot() });
+    assert.equal(s.score, 100, JSON.stringify(s.detail));
+  } finally {
+    delete process.env.DATABASE_URL;
+    delete process.env.BONGOS_TOKEN;
+  }
+});
+
+test('a hung test file is killed at the timeout and counted as failed', async () => {
+  const s = await assessTests('weather', [file('tests/hang.mjs', 'setInterval(() => {}, 1000);\n'), file('tests/ok.mjs', PASS)],
+    { trusted: true, root: tmpRoot(), timeoutMs: 1500 });
+  assert.equal(s.score, 50);
+  assert.equal(s.detail.files.find((f) => f.file === 'tests/hang.mjs').timed_out, true);
+});
+
+// ---- recordTestsSignal: tarball in, one appended row out ----
+
+const SANDBOX_ENV = { MODULE_TEST_SANDBOX: '1', PATH: process.env.PATH, SystemRoot: process.env.SystemRoot };
+
+test('outside the separate testing environment, a published module is never run', async () => {
+  let ran = false;
+  const db = { async query() { ran = true; return { rows: [] }; } };
+  for (const env of [{}, { MODULE_TEST_SANDBOX: 'true' }, { MODULE_TEST_SANDBOX: '0' }]) {
+    const res = await recordTestsSignal(42, { db, env, root: tmpRoot() });
+    assert.equal(res.ok, false);
+    assert.equal(res.code, 'not_in_test_sandbox');
+  }
+  assert.equal(ran, false, 'refused before reading the store or the tarball');
+});
+
+test('the test environment keeps no credential and pins HOME to the sandbox', () => {
+  process.env.SOME_API_KEY = 'x';
+  try {
+    const env = testEnv('/sb');
+    assert.equal(env.SOME_API_KEY, undefined);
+    assert.equal(env.HOME, '/sb');
+    assert.equal(env.NODE_ENV, 'test');
+  } finally { delete process.env.SOME_API_KEY; }
+});
+
+function fakeDb(versionRow) {
+  const inserts = [];
+  return {
+    inserts,
+    async query(sql, params) {
+      if (/FROM store_module_versions/.test(sql)) return { rows: versionRow ? [versionRow] : [] };
+      if (/INSERT INTO module_assessment_signals/.test(sql)) {
+        assert.doesNotMatch(sql, /UPDATE/i, 'append-only');
+        inserts.push(params);
+        const [version_id, outcome, score, sample_size, reason] = params;
+        return { rows: [{ id: 7, version_id, part: 'tests', outcome, score, sample_size, reason, measured_at: new Date() }] };
+      }
+      throw new Error(`unexpected query: ${sql}`);
+    },
+  };
+}
+
+function publishedFixture(extraFiles) {
+  const src = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-assess-src-'));
+  const dir = path.join(src, 'weather');
+  fs.mkdirSync(path.join(dir, 'tests'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'module.json'), JSON.stringify({ key: 'weather', title: 'Weather', description: 'x', version: '1.2.0', coreVersion: '^1.0.0', contributes: {} }));
+  for (const [p, text] of Object.entries(extraFiles)) fs.writeFileSync(path.join(dir, ...p.split('/')), text);
+  const { tgz } = packModule('weather', { modulesDir: src, now: () => new Date('2026-09-30T00:00:00Z'), modeOf: () => '644' });
+  const storeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-assess-store-'));
+  const final = path.join(storeDir, 'weather', 'weather-1.2.0.tgz');
+  fs.mkdirSync(path.dirname(final), { recursive: true });
+  fs.writeFileSync(final, tgz);
+  return { storeDir, final, row: { id: 42, module_key: 'weather', version: '1.2.0', artifact_path: relativeArtifactPath(final, { dir: storeDir }) } };
+}
+
+test('a published version is tested from its tarball and one tests row is appended', async () => {
+  const { storeDir, row } = publishedFixture({ 'tests/a.mjs': PASS, 'tests/b.mjs': FAIL });
+  const db = fakeDb(row);
+  const res = await recordTestsSignal(42, { db, storeDir, root: tmpRoot(), env: SANDBOX_ENV });
+  assert.equal(res.ok, true);
+  assert.equal(db.inserts.length, 1);
+  const [versionId, outcome, score, sample, , detail] = db.inserts[0];
+  assert.equal(versionId, 42);
+  assert.equal(outcome, 'scored');
+  assert.equal(score, 50);
+  assert.equal(sample, 2);
+  assert.equal(JSON.parse(detail).files.length, 2);
+});
+
+test('a version whose tarball is missing or tampered is not_scored, not failed', async () => {
+  const { storeDir, final, row } = publishedFixture({ 'tests/a.mjs': PASS });
+  fs.writeFileSync(final, Buffer.from('not a tarball'));
+  const db = fakeDb(row);
+  const res = await recordTestsSignal(42, { db, storeDir, root: tmpRoot(), env: SANDBOX_ENV });
+  assert.equal(res.ok, true);
+  const [, outcome, score] = db.inserts[0];
+  assert.equal(outcome, 'not_scored');
+  assert.equal(score, null);
+
+  fs.rmSync(final);
+  const db2 = fakeDb(row);
+  await recordTestsSignal(42, { db: db2, storeDir, root: tmpRoot(), env: SANDBOX_ENV });
+  assert.equal(db2.inserts[0][1], 'not_scored');
+  assert.doesNotMatch(db2.inserts[0][4], /[\/]/, 'the stored reason carries an error code, never a local path');
+});
+
+test('an unknown version writes nothing', async () => {
+  const db = fakeDb(null);
+  const res = await recordTestsSignal(99, { db, root: tmpRoot(), env: SANDBOX_ENV });
+  assert.equal(res.ok, false);
+  assert.equal(res.code, 'version_not_found');
+  assert.equal(db.inserts.length, 0);
+});
+
+test('the runner never consults whether the module is enabled', () => {
+  const src = fs.readFileSync(new URL('../scripts/gds/module-assess-tests.js', import.meta.url), 'utf8').replace(/\/\/.*$/gm, '');
+  assert.doesNotMatch(src, /isModuleEnabled/);
+});
+
+test('the sandbox dir is gitignored in case a run is killed mid-way', () => {
+  const gi = fs.readFileSync(new URL('../.gitignore', import.meta.url), 'utf8');
+  assert.match(gi, /^\/\.module-assess-\*\/$/m);
+});
+
+test('the gate lives in the runner itself: assessTests refuses untrusted code outside the testing environment', async () => {
+  const root = tmpRoot();
+  await assert.rejects(assessTests('weather', [file('tests/a.mjs', PASS)], { root, env: {} }), { code: 'not_in_test_sandbox' });
+  assert.deepEqual(sandboxesIn(root), [], 'refused before anything is unpacked');
+});
+
+test('a mis-set flag on a machine that holds secrets is still refused', async () => {
+  const root = tmpRoot();
+  for (const k of ['DATABASE_URL', 'BONGOS_TOKEN', 'STRIPE_SECRET', 'OPENAI_API_KEY']) {
+    assert.equal(runRefusal({ env: { ...SANDBOX_ENV, [k]: 'x' }, root }).code, 'secrets_present', k);
+  }
+  assert.equal(runRefusal({ env: SANDBOX_ENV, root }), null, 'a clean testing environment may run');
+  fs.writeFileSync(path.join(root, '.env'), 'DATABASE_URL=x\n');
+  assert.equal(runRefusal({ env: SANDBOX_ENV, root }).code, 'secrets_present', 'a .env at the core root counts');
+  await assert.rejects(assessTests('weather', [file('tests/a.mjs', PASS)], { root, env: SANDBOX_ENV }), { code: 'secrets_present' });
+  assert.equal(runRefusal({ trusted: true, env: {}, root }), null, 'your own checkout (--dir) is trusted');
+});
+
+test('insertSignal appends exactly one tests row with the signal fields', async () => {
+  const seen = [];
+  const db = { async query(sql, params) { seen.push({ sql, params }); return { rows: [{ id: 1 }] }; } };
+  await insertSignal(5, { outcome: 'scored', score: 80, sample_size: 5, reason: 'r', detail: { files: [] } }, { db });
+  assert.equal(seen.length, 1);
+  assert.match(seen[0].sql, /INSERT INTO module_assessment_signals[\s\S]*'tests'/);
+  assert.doesNotMatch(seen[0].sql, /UPDATE/i);
+  assert.deepEqual(seen[0].params, [5, 'scored', 80, 5, 'r', '{"files":[]}']);
+});