@bongos/core 1.20.37 → 1.20.38

package/tests/autonomy_fence_priority.mjs

@@ -0,0 +1,211 @@
+// tests/autonomy_fence_priority.mjs — the fence's priority goal, server side
+// (task 1004453).
+//
+// Owner ruling, 2026-09-30: whoever starts the runner names the goal it works
+// FIRST, from the hall's /builders/gate page or the API, and the server refuses a
+// priority that is not on the allowlist. These drive REAL requests through the
+// assembled autonomy router with only the auth gates stubbed (the
+// routine_observability_api precedent), pin the SQL against a stubbed pool, and
+// hold the migration to the shape the route relies on. The pure ordering rule is
+// tests/autobongos_fence.mjs; the runner's use of it is tests/autobongos_loop.mjs.
+//
+// DB-free, no network. Run:  node --test tests/autonomy_fence_priority.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const req = createRequire(import.meta.url);
+const express = req('express');
+const { attachFail } = req(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+
+const permStub = (key) => {
+  const mw = (_req, _res, next) => next();
+  mw.permKey = key;
+  return mw;
+};
+const passBuilder = (reqq, _res, next) => { reqq.builder = { id: 3, rank: 'archon' }; next(); };
+
+function autonomyRouter() {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const saved = { b: api.requireBuilder, p: api.requirePermission };
+  api.requireBuilder = passBuilder;
+  api.requirePermission = permStub;
+  const routePath = req.resolve(path.join(ROOT, 'modules/autonomy/routes/autonomy.js'));
+  delete req.cache[routePath];
+  try {
+    return req(routePath)();
+  } finally {
+    api.requireBuilder = saved.b;
+    api.requirePermission = saved.p;
+  }
+}
+
+async function serve(router) {
+  const app = express();
+  app.use(express.json());
+  app.use(attachFail);
+  app.use(router);
+  const server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  return { base: `http://127.0.0.1:${server.address().port}`, close: () => server.close() };
+}
+
+const post = (base, p, body) => fetch(`${base}${p}`, {
+  method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+});
+
+test('POST /autonomy/fence/priority sits behind the same owner-only atom as the allowlist', () => {
+  const router = autonomyRouter();
+  const layer = router.stack.find((l) => l.route && l.route.path === '/autonomy/fence/priority');
+  assert.ok(layer, 'the route is registered');
+  assert.equal(layer.route.methods.post, true);
+  assert.equal(layer.route.stack.length, 3, 'requireBuilder + requirePermission + handler');
+  assert.equal(layer.route.stack[1].handle.permKey, 'autonomy.fence.manage');
+});
+
+test('the route sets, clears, and refuses a goal that is not allowlisted', async () => {
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = db.setPriorityGoal;
+  const seen = [];
+  let answer = { row: { priority_goal_id: 1000119, updated_at: '2026-09-30T00:00:00.000Z' } };
+  db.setPriorityGoal = async (args) => { seen.push(args); return answer; };
+  const s = await serve(autonomyRouter());
+  try {
+    let r = await post(s.base, '/autonomy/fence/priority', { goal_id: 1000119 });
+    assert.equal(r.status, 200);
+    assert.equal((await r.json()).priority_goal_id, 1000119);
+    assert.deepEqual(seen.pop(), { goalId: 1000119, builderId: 3 }, 'the writer is the SESSION, never the body');
+
+    r = await post(s.base, '/autonomy/fence/priority', { goal_id: '1000119' });
+    assert.equal(r.status, 200, 'a stringified id is accepted, as the allowlist route accepts one');
+    assert.equal(seen.pop().goalId, 1000119);
+
+    answer = { row: { priority_goal_id: null, updated_at: '2026-09-30T00:00:00.000Z' } };
+    r = await post(s.base, '/autonomy/fence/priority', { goal_id: null });
+    assert.equal(r.status, 200);
+    assert.equal(seen.pop().goalId, null, 'null clears the priority');
+
+    answer = { notAllowed: true };
+    r = await post(s.base, '/autonomy/fence/priority', { goal_id: 1000090 });
+    assert.equal(r.status, 409, 'a priority must already be on the allowlist');
+    assert.equal((await r.json()).error.code, 'goal_not_allowlisted');
+
+    answer = { missing: true };
+    r = await post(s.base, '/autonomy/fence/priority', { goal_id: 1000119 });
+    assert.equal(r.status, 503);
+
+    const before = seen.length;
+    for (const bad of [{}, { goal_id: 0 }, { goal_id: -1 }, { goal_id: 'abc' }, { goal_id: 1.5 }]) {
+      r = await post(s.base, '/autonomy/fence/priority', bad);
+      assert.equal(r.status, 400, `${JSON.stringify(bad)} is refused`);
+    }
+    assert.equal(seen.length, before, 'a malformed request never reaches the database');
+
+    db.setPriorityGoal = async () => { throw new Error('connection reset'); };
+    r = await post(s.base, '/autonomy/fence/priority', { goal_id: 1000119 });
+    assert.equal(r.status, 500);
+    assert.ok(!JSON.stringify(await r.json()).includes('connection reset'), 'the database error stays in the log');
+  } finally {
+    s.close();
+    db.setPriorityGoal = saved;
+  }
+});
+
+test('setPriorityGoal: the WHERE refuses a goal that is not allowlisted, and says which refusal it was', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  const calls = [];
+  let replies = [];
+  api.pool.query = async (sql, params) => { calls.push({ sql, params }); return replies.shift(); };
+  try {
+    replies = [{ rows: [{ priority_goal_id: '1000119', updated_at: 't' }] }];
+    assert.deepEqual(await db.setPriorityGoal({ goalId: 1000119, builderId: 3 }), { row: { priority_goal_id: 1000119, updated_at: 't' } });
+    assert.match(calls[0].sql, /UPDATE autonomy_fence/);
+    assert.match(calls[0].sql, /EXISTS \(SELECT 1 FROM autonomy_allowed_goals WHERE goal_id = \$1::bigint\)/);
+    assert.deepEqual(calls[0].params, [1000119, 3]);
+
+    replies = [{ rows: [] }, { rows: [{ '?column?': 1 }] }];
+    assert.deepEqual(await db.setPriorityGoal({ goalId: 1000090 }), { notAllowed: true });
+
+    replies = [{ rows: [] }, { rows: [] }];
+    assert.deepEqual(await db.setPriorityGoal({ goalId: 1000090 }), { missing: true });
+
+    replies = [{ rows: [{ priority_goal_id: null, updated_at: 't' }] }];
+    assert.deepEqual(await db.setPriorityGoal({ goalId: null }), { row: { priority_goal_id: null, updated_at: 't' } });
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+test('readFence carries the priority as a number, and null when unset', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  let pri = '1000119';
+  api.pool.query = async (sql) => (/FROM autonomy_fence/.test(sql)
+    ? { rows: [{ enabled: true, paused_reason: null, priority_goal_id: pri, updated_at: 't', updated_by: '3' }] }
+    : { rows: [{ goal_id: '1000119', note: null, added_at: 't', added_by: '3' }] });
+  try {
+    assert.equal((await db.readFence()).priority_goal_id, 1000119, 'a bigint string would never equal a numeric goal id');
+    pri = null;
+    assert.equal((await db.readFence()).priority_goal_id, null);
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+test('the heartbeat stores and returns the goal the current task came from', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  const calls = [];
+  api.pool.query = async (sql, params) => { calls.push({ sql, params }); return { rows: [{ working_task_id: 4242, working_goal_id: 1000090 }] }; };
+  try {
+    await db.recordRunnerHeartbeat({ builderId: 3, host: 'winbox', workingTaskId: 4242, workingGoalId: 1000090 });
+    assert.match(calls[0].sql, /working_goal_id = EXCLUDED\.working_goal_id/);
+    assert.equal(calls[0].params[8], 1000090);
+    const rows = await db.readRunnerHeartbeats(3);
+    assert.equal(rows[0].working_goal_id, '1000090');
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+test('the route accepts working_goal_id on a heartbeat and passes it through', async () => {
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = db.recordRunnerHeartbeat;
+  const seen = [];
+  db.recordRunnerHeartbeat = async (args) => { seen.push(args); return {}; };
+  const s = await serve(autonomyRouter());
+  try {
+    const r = await post(s.base, '/autonomy/heartbeat', { host: 'winbox', working_task_id: 4242, working_goal_id: 1000090 });
+    assert.equal(r.status, 200);
+    assert.equal(seen[0].workingGoalId, 1000090);
+  } finally {
+    s.close();
+    db.recordRunnerHeartbeat = saved;
+  }
+});
+
+test('the migration ties the priority to the allowlist and clears it on revoke', () => {
+  const sql = fs.readFileSync(path.join(ROOT, 'modules/autonomy/migrations/autonomy_003_priority_goal.sql'), 'utf8')
+    .split('\n').filter((l) => !l.trim().startsWith('--')).join('\n');
+  assert.match(sql, /ADD COLUMN IF NOT EXISTS priority_goal_id bigint\s+REFERENCES autonomy_allowed_goals \(goal_id\) ON DELETE SET NULL/,
+    'revoking the priority goal must clear the priority, never leave a revoked goal "first"');
+  assert.match(sql, /ADD COLUMN IF NOT EXISTS working_goal_id bigint/);
+  assert.doesNotMatch(sql, /\bDROP\b/i, 'module migrations are additive');
+});
+
+test('the gate page renders the priority, lists it first, and posts to the priority route', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.js'), 'utf8');
+  assert.match(src, /renderFenceGoals\(fence\.goals, fence\.priority_goal_id\)/, 'the page must pass the priority it read');
+  assert.match(src, /sendJson\('POST', '\/autonomy\/fence\/priority', \{ goal_id: goalId \}\)/);
+  assert.match(src, /Make priority/);
+  assert.match(src, /Clear priority/);
+});

package/tests/bongos_cli.mjs

@@ -87,7 +87,13 @@ test('VERBS: selfHelp is only claimed by scripts that really print their own usa
   // `serve` is dev.js with --server pinned on, so it inherits dev's own usage()
   // printer — verified: `bongos serve --help` prints the card and exits 0.
   const selfHelp = Object.entries(cli.VERBS).filter(([, d]) => d.selfHelp).map(([v]) => v).sort();
-  assert.deepEqual(selfHelp, ['dev', 'module', 'serve', 'status', 'task', 'upgrade']);
+  assert.deepEqual(selfHelp, ['dev', 'feedback', 'module', 'serve', 'status', 'task', 'upgrade']);
+});
+
+test('bongos feedback --help prints its own usage and sends nothing', () => {
+  const r = run('feedback', '--help');
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /bongos feedback "what went wrong"/);
 });
 
 // ---- spawned: the dispatcher answers --help without touching the script ----

package/tests/filing_abuse_matrix.mjs

@@ -405,10 +405,15 @@ await test('[F18] the vector fails CLOSED — forged, absent or unknown never op
       `vector ${JSON.stringify(vector)} must not route`
     );
   }
-  // The allowlist is exactly two members, and both are server-set at their call
+  // The allowlist is exactly three members, and all are server-set at their call
   // site — never read from a request body, which is what makes forging it a
   // non-move rather than a merely-hard one.
-  assert.deepEqual([...routing.HOMELESS_ROUTING_VECTORS].sort(), ['api', 'discord-bugs']);
+  assert.deepEqual([...routing.HOMELESS_ROUTING_VECTORS].sort(), ['api', 'discord-bugs', 'instance-feedback']);
+  // The hub's feedback relay (task 1004462) names its own vector and never a rank,
+  // so a relayed bug can only ever land at 'backlog'.
+  const feedbackSrc = read('modules/platform-identity/instance-feedback.js');
+  assert.match(feedbackSrc, /vector: 'instance-feedback'/, 'the relay hardcodes its own vector');
+  assert.match(feedbackSrc, /filerRank: null/, 'and files with no rank');
   const routeSrc = read('modules/ideas/routes/inbox.js');
   assert.match(routeSrc, /vector: 'api'/, 'the route hardcodes its own vector');
   assert.ok(!/vector:\s*body\.|vector:\s*req\.body/.test(routeSrc),

package/tests/idea_routing.mjs

@@ -172,7 +172,7 @@ await test('matrix: FAIL-CLOSED — an absent or unrecognised rank never hard-la
 // -------------------------------------------------------------------------
 
 await test('matrix: a homeless BUG from a trusted vector routes, and keeps the rank split', () => {
-  for (const vector of ['api', 'discord-bugs']) {
+  for (const vector of ['api', 'discord-bugs', 'instance-feedback']) {
     assert.deepEqual(
       decideLanding({ goalId: null, kind: 'bug', filerRank: 'archon', vector }),
       { route: true, status: 'ready', homeless: true, reason: 'bug_homeless_trusted_filer' },

package/tests/instance_feedback.mjs

@@ -0,0 +1,327 @@
+// tests/instance_feedback.mjs — `bongos feedback`: a builder on a managed project
+// reports something about Bongos itself, their project relays it to the hub, and
+// the hub files it (task 1004462). DB-free: the hub half is driven through its
+// pure module with a fake `ideas.capture`, the project half through its real
+// router with a fake hub.
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require_ = createRequire(import.meta.url);
+const IF = require_(path.join(ROOT, 'modules/platform-identity/instance-feedback.js'));
+const { decideLanding } = require_(path.join(ROOT, 'modules/ideas/routing.js'));
+
+const CLIENT = { client_id: 'acme', name: 'Acme', origin: 'https://acme.example.com' };
+
+// ── the hub: who gets to file, and where it lands ─────────────────────────────
+
+test('a relayed bug lands as a homeless bug AWAITING A NOD, never claimable', () => {
+  // The owner's rule (2026-09-30): every report waits. The relay files with no
+  // rank, so no sender — the hub's own Archon included — can skip the nod.
+  const d = decideLanding({ goalId: null, kind: 'bug', filerRank: null, vector: 'instance-feedback' });
+  assert.deepEqual(d, { route: true, status: 'backlog', homeless: true, reason: 'bug_homeless_awaiting_nod' });
+});
+
+test('a relayed idea is not a defect — it stays in the inbox', () => {
+  const d = decideLanding({ goalId: null, kind: IF.FEEDBACK_KINDS.idea, filerRank: null, vector: 'instance-feedback' });
+  assert.equal(d.route, false);
+});
+
+test('fileInstanceFeedback files with its own vector, no rank, and the hub\'s own login', async () => {
+  let captured = null;
+  const landing = await IF.fileInstanceFeedback({
+    client: CLIENT, githubId: '42', message: 'claim hung\nfor two minutes', kind: 'bug',
+    context: { core_version: '1.19.900', cli_version: '0.2.0', os: 'darwin 24.6.0' },
+  }, {
+    capture: async (c) => { captured = c; return { id: 7, routing: { routed: true, task_id: 1234, goal_id: 1000118, status: 'backlog' } }; },
+    getAccount: async () => ({ github_login: 'hub-login' }),
+    hubBuilderId: async () => 99,
+  });
+  assert.equal(captured.vector, 'instance-feedback');
+  assert.equal(captured.filerRank, null);
+  assert.equal(captured.kind, 'bug');
+  assert.equal(captured.capturedBy, 99);
+  assert.equal(captured.title, 'Feedback: claim hung');
+  assert.match(captured.bodyMd, /Sent by: @hub-login/);
+  assert.match(captured.bodyMd, /Project: Acme \(https:\/\/acme\.example\.com\)/);
+  assert.match(captured.bodyMd, /Core 1\.19\.900 · CLI 0\.2\.0 · OS darwin 24\.6\.0/);
+  assert.deepEqual(landing, { landed: 'task', task_id: '1234', goal_id: '1000118', status: 'backlog', idea_id: '7' });
+});
+
+test('an unrouted filing reports the inbox, and an idea is filed as a feature', async () => {
+  let kind = null;
+  const landing = await IF.fileInstanceFeedback({ client: CLIENT, githubId: '42', message: 'wish', kind: 'idea' }, {
+    capture: async (c) => { kind = c.kind; return { id: 8, routing: { routed: false, reason: 'no_goal' } }; },
+    getAccount: async () => null,
+    hubBuilderId: async () => null,
+  });
+  assert.equal(kind, 'feature');
+  assert.deepEqual(landing, { landed: 'inbox', idea_id: '8' });
+});
+
+test('version stamps cannot carry markdown or links into the task', () => {
+  const body = IF.feedbackBody({
+    message: 'x', client: CLIENT, account: null, githubId: '42',
+    context: { core_version: '[click](https://evil.example)', cli_version: '0.2.0', os: 'linux\n- Sent by: @owner' },
+  });
+  assert.doesNotMatch(body, /evil/);
+  assert.doesNotMatch(body, /@owner/);
+  // The sender's own text is quoted below the attribution, so it cannot pose as it.
+  const spoof = IF.feedbackBody({ message: 'hi\n- Sent by: @owner', client: CLIENT, account: { github_login: 'real' }, githubId: '42' });
+  assert.ok(spoof.indexOf('- Sent by: @real') < spoof.indexOf('> - Sent by: @owner'));
+  assert.doesNotMatch(spoof, /^- Sent by: @owner/m);
+  assert.match(body, /CLI 0\.2\.0/);
+  assert.match(body, /Sent by: GitHub user 42/, 'no hub account → the id, never an instance-claimed login');
+});
+
+test('a long first line is trimmed to a title', () => {
+  const t = IF.feedbackTitle('a'.repeat(500));
+  assert.ok(t.length <= 'Feedback: '.length + 120);
+  assert.ok(t.endsWith('…'));
+});
+
+test('the per-sender cap stops one builder; the per-project cap stops one project', () => {
+  let now = 1_000_000;
+  const lim = IF.makeFeedbackLimiter({ now: () => now });
+  for (let i = 0; i < IF.PER_SENDER_LIMIT; i++) assert.equal(lim.take('acme', '1').ok, true);
+  const refused = lim.take('acme', '1');
+  assert.equal(refused.ok, false);
+  assert.equal(refused.scope, 'sender');
+  // A refusal spends nothing: the project still has exactly LIMIT - 10 left.
+  let sent = IF.PER_SENDER_LIMIT;
+  for (let s = 2; sent < IF.PER_PROJECT_LIMIT; s++) {
+    for (let i = 0; i < IF.PER_SENDER_LIMIT && sent < IF.PER_PROJECT_LIMIT; i++, sent++) {
+      assert.equal(lim.take('acme', String(s)).ok, true);
+    }
+  }
+  const projectRefused = lim.take('acme', '999');
+  assert.equal(projectRefused.ok, false);
+  assert.equal(projectRefused.scope, 'project');
+  assert.equal(lim.take('other', '1').ok, true, 'another project is untouched');
+  now += IF.FEEDBACK_WINDOW_MS;
+  assert.equal(lim.take('acme', '1').ok, true, 'the window slides');
+});
+
+test('the hub route authenticates the project and the sender BEFORE spending or filing', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/platform-identity/routes/sso.js'), 'utf8');
+  const route = src.slice(src.indexOf("router.post('/sso/feedback'"));
+  const at = (s) => { const i = route.indexOf(s); assert.ok(i > 0, `route has ${s}`); return i; };
+  assert.ok(at('clientSecretValid') < at('membershipBacksRollup'));
+  assert.ok(at('membershipBacksRollup') < at('feedbackLimiter.take'));
+  assert.ok(at('feedbackLimiter.take') < at('fileInstanceFeedback'));
+  assert.doesNotMatch(route.slice(0, route.indexOf('return router')), /filerRank|vector:/,
+    'the route passes neither a rank nor a vector — both are fixed in instance-feedback.js');
+});
+
+// ── the project: the relay ────────────────────────────────────────────────────
+
+async function withRoute({ idp, hub }, fn) {
+  const r2 = createRequire(import.meta.url);
+  const authPath = r2.resolve(path.join(ROOT, 'src/bongos/auth.js'));
+  const routePath = r2.resolve(path.join(ROOT, 'src/bongos/routes/feedback.js'));
+  const envPath = r2.resolve(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+  const realAuth = r2(authPath);
+  const saved = realAuth.requireBuilder;
+  realAuth.requireBuilder = (req, _res, next) => { req.builder = { id: 5, github_id: '42', github_login: 'someone' }; next(); };
+  delete r2.cache[routePath];
+  const sent = [];
+  const fetchImpl = async (url, opts) => {
+    sent.push({ url, body: JSON.parse(opts.body) });
+    const { status, body } = hub;
+    return { status, json: async () => body };
+  };
+  const express = r2('express');
+  const app = express();
+  app.use(express.json());
+  app.use(r2(envPath).attachFail);
+  app.use(r2(routePath)({ idpConfig: () => idp, fetchImpl }));
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  const post = (body) => fetch(`http://127.0.0.1:${server.address().port}/feedback`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
+  }).then(async (r) => ({ status: r.status, body: await r.json() }));
+  try {
+    await fn({ post, sent });
+  } finally {
+    server.close();
+    realAuth.requireBuilder = saved;
+    delete r2.cache[routePath];
+  }
+}
+
+const IDP = { origin: 'https://hub.example.com', clientId: 'acme', clientSecret: 's3cret' };
+
+test('the relay sends the SESSION\'s identity and the running core to the hub, and returns the landing', async () => {
+  await withRoute({ idp: IDP, hub: { status: 201, body: { ok: true, landed: 'task', task_id: '1234', status: 'backlog' } } }, async ({ post, sent }) => {
+    assert.equal((await post({ message: 'x', github_id: '1' })).status, 400, 'a body naming a sender is refused outright');
+    assert.equal(sent.length, 0);
+    const r = await post({ message: '  it broke  ', context: { cli_version: '0.2.0', os: 'darwin', core_version: 'forged' } });
+    assert.equal(r.status, 201);
+    assert.equal(r.body.task_id, '1234');
+    assert.equal(r.body.hub_origin, IDP.origin);
+    assert.equal(sent.length, 1);
+    assert.equal(sent[0].url, 'https://hub.example.com/api/bongos/sso/feedback');
+    assert.equal(sent[0].body.github_id, '42', 'from the session, never the body');
+    assert.equal(sent[0].body.message, 'it broke');
+    assert.equal(sent[0].body.kind, 'bug');
+    assert.notEqual(sent[0].body.context.core_version, 'forged', 'the core version is this server\'s own');
+    assert.equal(sent[0].body.client_secret, 's3cret');
+  });
+});
+
+test('a project with no hub link says so, and sends nothing', async () => {
+  await withRoute({ idp: null, hub: { status: 500, body: {} } }, async ({ post, sent }) => {
+    const r = await post({ message: 'hello' });
+    assert.equal(r.status, 409);
+    assert.equal(r.body.error.code, 'not_hub_connected');
+    assert.equal(sent.length, 0);
+  });
+});
+
+test('an empty message or an unknown kind is refused locally', async () => {
+  await withRoute({ idp: IDP, hub: { status: 201, body: { ok: true } } }, async ({ post, sent }) => {
+    assert.equal((await post({ message: '   ' })).body.error.code, 'message_required');
+    const badKind = await post({ message: 'x', kind: 'task' });
+    assert.equal(badKind.status, 400);
+    assert.equal((await post({ message: 'x'.repeat(4001) })).status, 400, 'over the cap');
+    assert.equal(sent.length, 0);
+  });
+});
+
+test('a hub refusal the builder can act on is passed through; anything else is generic', async () => {
+  await withRoute({ idp: IDP, hub: { status: 429, body: { error: { code: 'rate_limited', details: { retry_after_seconds: 600 } } } } }, async ({ post }) => {
+    const r = await post({ message: 'x' });
+    assert.equal(r.status, 429);
+    assert.equal(r.body.error.code, 'rate_limited');
+    assert.equal(r.body.error.details.retry_after_seconds, 600);
+  });
+  await withRoute({ idp: IDP, hub: { status: 401, body: { error: { code: 'invalid_client', message: 'secret mismatch' } } } }, async ({ post }) => {
+    const r = await post({ message: 'x' });
+    assert.equal(r.status, 502);
+    assert.equal(r.body.error.code, 'hub_refused');
+    assert.doesNotMatch(JSON.stringify(r.body), /secret/);
+  });
+});
+
+// ── the CLI ───────────────────────────────────────────────────────────────────
+
+test('`bongos feedback` is a registered verb, and every refusal code has a plain line', () => {
+  const { VERBS } = require_(path.join(ROOT, 'bin/bongos.js'));
+  assert.equal(VERBS.feedback.script, 'feedback-send.js');
+  const { REFUSALS, readMessage } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  for (const code of ['message_required', 'not_hub_connected', 'membership_required', 'rate_limited', 'feedback_unavailable', 'hub_unreachable']) {
+    assert.ok(REFUSALS[code], code);
+  }
+  for (const code of ['validation_failed']) {
+    assert.ok(REFUSALS[code], code);
+  }
+  assert.equal(readMessage(['--idea', 'filter', 'by', 'goal']), 'filter by goal');
+});
+
+// ── the hub route, driven for real ────────────────────────────────────────────
+// The assembled /sso router with its DB edges stubbed: the client lookup, the
+// membership read and the account read on the platform-identity domain, the
+// builders lookup on the doorway's pool, and the `ideas.capture` port.
+
+async function withHub(overrides, fn) {
+  const r2 = createRequire(import.meta.url);
+  const api = r2(path.join(ROOT, 'src/module-api.js'));
+  const seams = r2(path.join(ROOT, 'src/module-seams.js'));
+  const pi = r2(path.join(ROOT, 'modules/platform-identity/platform-identity.js'));
+  const saved = { ...pi };
+  const savedQuery = api.pool.query;
+  const captured = [];
+  Object.assign(pi, {
+    getClient: async (id) => (id === 'acme' ? { ...CLIENT, status: 'active' } : null),
+    clientSecretValid: (_c, s) => s === 'right',
+    getMembership: async () => ({ membership_kind: 'member', signin_verified_at: new Date() }),
+    getAccount: async () => ({ github_login: 'hub-login' }),
+  }, overrides);
+  api.pool.query = async () => ({ rows: [] });
+  if (!seams.hasProvider('ideas.capture')) {
+    seams.registerProvider('ideas.capture', async (c) => { captured.push(c); return { id: 1, routing: { routed: true, task_id: 55, goal_id: 9, status: 'backlog' } }; });
+  }
+  const routerPath = r2.resolve(path.join(ROOT, 'modules/platform-identity/routes/sso.js'));
+  delete r2.cache[routerPath];
+  const express = r2('express');
+  const app = express();
+  app.use(express.json());
+  app.use(r2(path.join(ROOT, 'src/bongos/middleware/error-envelope.js')).attachFail);
+  app.use(r2(routerPath)());
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  const post = (body) => fetch(`http://127.0.0.1:${server.address().port}/sso/feedback`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
+  }).then(async (res) => ({ status: res.status, body: await res.json() }));
+  try { await fn({ post, captured }); } finally {
+    server.close();
+    Object.assign(pi, saved);
+    api.pool.query = savedQuery;
+    delete r2.cache[routerPath];
+  }
+}
+
+const GOOD = { client_id: 'acme', client_secret: 'right', github_id: '42', message: 'claim hung' };
+
+test('hub: a witnessed member\'s bug is filed at backlog and the landing comes back 201', async () => {
+  await withHub({}, async ({ post, captured }) => {
+    const r = await post(GOOD);
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    assert.deepEqual(r.body, { ok: true, landed: 'task', task_id: '55', goal_id: '9', status: 'backlog', idea_id: '1' });
+    assert.equal(captured.at(-1).vector, 'instance-feedback');
+    assert.equal(captured.at(-1).filerRank, null);
+  });
+});
+
+test('hub: a wrong secret, an unwitnessed sender and a forged field are all refused before filing', async () => {
+  await withHub({}, async ({ post, captured }) => {
+    const before = captured.length;
+    assert.equal((await post({ ...GOOD, client_secret: 'wrong' })).status, 401);
+    assert.equal((await post({ ...GOOD, github_id: 'abc' })).status, 400);
+    assert.equal((await post({ ...GOOD, filer_rank: 'archon' })).status, 400, 'no rank can ride the body');
+    assert.equal(captured.length, before);
+  });
+  await withHub({ getMembership: async () => ({ membership_kind: 'member', signin_verified_at: null }) }, async ({ post, captured }) => {
+    const before = captured.length;
+    const r = await post(GOOD);
+    assert.equal(r.status, 409);
+    assert.equal(r.body.error.code, 'membership_required');
+    assert.equal(captured.length, before);
+  });
+});
+
+// ── proactive filing (task 1004467) ───────────────────────────────────────────
+// The owner's rule: a builder venting that Bongos is broken gets it filed without
+// asking. That lives in two places, and both must keep saying it.
+
+test('the skill files unasked on a Bongos rant, and the kernel tells every session to', () => {
+  const skill = fs.readFileSync(path.join(ROOT, '.claude/skills/bongos-feedback/SKILL.md'), 'utf8');
+  const description = skill.split('\n---')[0];
+  assert.match(description, /unasked/, 'the listing entry itself says it acts unprompted');
+  assert.match(description, /Bongos is broken/, 'a venting phrase is a trigger');
+  assert.match(skill, /File it without being asked/);
+  assert.match(skill, /Never paste the rant/, 'a report, not the raw complaint');
+  assert.match(skill, /own project/, 'their own code is out of scope');
+  assert.match(skill, /One filing per distinct problem per session/);
+  const kernel = fs.readFileSync(path.join(ROOT, 'CLAUDE.md'), 'utf8');
+  assert.match(kernel, /vents that Bongos itself is broken.*\/bongos-feedback/);
+});
+
+test('every report is secret-scrubbed before it leaves the machine, and never sent unscrubbed', async () => {
+  const { scrubReport } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const token = 'ghp_' + 'a1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8';
+  const envValue = 'zq9-private-value-7781';
+  const r = scrubReport(`claim failed, my token is ${token} and the key is ${envValue}`, { MY_API_KEY: envValue });
+  assert.doesNotMatch(r.text, /ghp_/);
+  assert.ok(!r.text.includes(envValue), 'an env secret is stripped by value');
+  assert.ok(r.removed >= 2);
+  assert.equal(scrubReport('bongos claim hung for two minutes', {}).text, 'bongos claim hung for two minutes', 'plain prose is untouched');
+  const src = fs.readFileSync(path.join(ROOT, 'scripts/gds/feedback-send.js'), 'utf8');
+  assert.ok(src.indexOf('scrubReport(message)') < src.indexOf("api.request('POST', '/feedback'"), 'scrubbed before the request');
+  assert.match(src, /message: scrubbed\.text/, 'only the scrubbed text is sent');
+});