@bongos/core 1.20.4 → 1.20.6

package/tests/criterion_uat_routes.mjs

@@ -0,0 +1,232 @@
+// tests/criterion_uat_routes.mjs — task 1004392 / ADR 0351, the HTTP half.
+//
+// tests/criterion_uat.mjs proves the rules and the sign-off transaction. This
+// file proves the ROUTES consult them and say what they decided, through the
+// REAL Express routers and the REAL error envelope (res.fail drops unknown keys,
+// which is exactly the kind of thing only a route-level test catches: a refusal
+// that names the tasks not yet live must still name them on the wire).
+//
+// What it pins:
+//   1. /satisfy is the override now: no reason → refused and NOTHING written;
+//      with a reason → an override row is recorded BEFORE the criterion flips.
+//   2. A sign-off refusal reaches the caller with its code, status and details.
+//   3. The recording upload screens type + bytes, stores under a server-minted
+//      name, and a sign-off naming a recording that is not on disk is refused.
+//   4. Backend-only runs the criterion-authoring wall, and its refusal is the
+//      wall's own words.
+//   5. Each write asks for the permission route-rank-check pins it to.
+//
+// No DB, no network, no session: the data layer is stubbed at the module
+// boundary (the tests/criterion_goal_attach.mjs pattern).
+//
+// Run:  node tests/criterion_uat_routes.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { mkdtempSync, rmSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import http from 'node:http';
+import { makeRunner } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const recDir = mkdtempSync(join(tmpdir(), 'uat-routes-'));
+process.env.UAT_RECORDINGS_DIR = recDir;
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const api = require('../src/module-api.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const { test, summary } = makeRunner();
+
+// ---- the world ---------------------------------------------------------------
+const METIC = { id: 700, rank: 'metic' };
+let actor = METIC;
+const asked = [];         // every permission a route asked for, in build order
+const log = [];           // what the stubbed data layer was asked to do
+
+// A pool whose connect() hands out a recording client, so withTx runs for real
+// and a test can assert that the override's two writes share ONE transaction.
+const txLog = [];
+Object.defineProperty(api, 'pool', {
+  configurable: true,
+  value: {
+    query: async () => ({ rows: [] }),
+    connect: async () => ({
+      query: async (sql) => { txLog.push(String(sql).trim()); return { rows: [] }; },
+      release: () => {},
+    }),
+  },
+});
+
+api.requireBuilder = (req, _res, next) => { req.builder = actor; next(); };
+api.requirePermission = (...perms) => {
+  asked.push(perms.join('+'));
+  return (_req, _res, next) => next();
+};
+
+const db = require('../modules/lifecycle/db.js');
+const doneWhen = require('../modules/lifecycle/done-when.js');
+const uatDb = require('../modules/lifecycle/criterion-uat-db.js');
+
+doneWhen.getCriterion = async (id) => (Number(id) === 5 ? { id: 5, version_id: 'V', goal_id: 3, satisfied: false } : null);
+doneWhen.markCriterion = async (id, _task, deps = {}) => { log.push(['mark', Number(id), deps.client || null]); return { id: Number(id), goal_id: null, satisfied: true }; };
+db.achieveGoalIfComplete = async () => ({ achieved: false, goal: null });
+db.getVersion = async (id) => ({ id, status: 'building' });
+db.getGoal = async (id) => ({ id, version_id: 'V', status: 'open', created_by: 999 }); // not the actor's
+db.getGoalMember = async () => null;
+uatDb.recordOverride = async (exec, row) => { log.push(['override', row, exec]); return { id: 1, kind: 'override' }; };
+let signOffResult = null;
+uatDb.signOff = async (args) => { log.push(['signOff', args]); return signOffResult; };
+uatDb.setBackendOnly = async ({ authorize, ...rest }) => {
+  log.push(['setBackendOnly', rest]);
+  const denied = await authorize({}, { id: rest.criterionId, goal_id: 3, version_id: 'V' });
+  return denied ? { ok: false, refusal: denied } : { ok: true, backend_only: rest.backendOnly };
+};
+
+const app = express();
+app.use(attachFail);
+app.use(express.json());
+app.use(require('../modules/lifecycle/routes/done-when.js')());
+app.use(require('../modules/lifecycle/routes/criterion-uat.js')());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const base = `http://127.0.0.1:${server.address().port}`;
+
+async function call(method, path, { json, raw, type } = {}) {
+  const res = await fetch(`${base}${path}`, {
+    method,
+    headers: raw ? { 'content-type': type } : { 'content-type': 'application/json' },
+    body: raw || (json === undefined ? undefined : JSON.stringify(json)),
+  });
+  return { status: res.status, body: await res.json().catch(() => ({})) };
+}
+const errCode = (body) => (body && body.error && (body.error.code || body.error)) || null;
+const reset = () => { log.length = 0; txLog.length = 0; actor = METIC; signOffResult = null; };
+const mp4 = () => { const b = Buffer.alloc(64); b.write('ftyp', 4, 'latin1'); return b; };
+
+// ---- 1. the override --------------------------------------------------------
+
+await test('SATISFY: without override_reason it is refused and nothing is written', async () => {
+  reset();
+  const r = await call('POST', '/done-when/5/satisfy', { json: {} });
+  assert.equal(r.status, 400);
+  assert.equal(errCode(r.body), 'override_reason_required');
+  assert.match(JSON.stringify(r.body), /UAT/, 'the refusal explains that criteria close on a UAT');
+  assert.deepEqual(log, [], 'no override row, no flip');
+});
+
+await test('SATISFY: with a reason, the override row is recorded BEFORE the criterion flips', async () => {
+  reset();
+  const r = await call('POST', '/done-when/5/satisfy', { json: { override_reason: 'met by the old importer, owner confirmed' } });
+  assert.equal(r.status, 200, JSON.stringify(r.body));
+  assert.deepEqual(log.map((e) => e[0]), ['override', 'mark']);
+  assert.equal(log[0][1].reason, 'met by the old importer, owner confirmed');
+  assert.equal(log[0][1].signerId, METIC.id);
+  // ONE transaction: both writes ran on the same client, between BEGIN and COMMIT.
+  assert.ok(log[0][2] && log[0][2] === log[1][2], 'the override row and the flip share one transaction client');
+  assert.equal(txLog[0], 'BEGIN');
+  assert.equal(txLog[txLog.length - 1], 'COMMIT');
+});
+
+// ---- 2. the sign-off --------------------------------------------------------
+
+await test('SIGNOFF: a refusal reaches the caller with its code, status AND details', async () => {
+  reset();
+  signOffResult = { ok: false, refusal: { code: 'work_not_live', status: 409, message: 'not deployed yet', not_live: [{ task_id: '12', stage: 'not_live' }] } };
+  const r = await call('POST', '/done-when/5/uat', { json: { kind: 'backend_signoff', live_attested: true } });
+  assert.equal(r.status, 409);
+  assert.equal(errCode(r.body), 'work_not_live');
+  assert.deepEqual(r.body.error.details, { not_live: [{ task_id: '12', stage: 'not_live' }] }, 'the tasks not yet live must be named on the wire');
+});
+
+await test('SIGNOFF: the route hands signOff the authenticated signer, never a body field', async () => {
+  reset();
+  signOffResult = { ok: true, signoff: { id: 9 }, closed: { criteria: [{ id: 5 }], goals: [{ id: 3 }] } };
+  const r = await call('POST', '/done-when/5/uat', { json: { kind: 'backend_signoff', live_attested: true, note: 'checked' } });
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.equal(r.body.criterion_closed, true);
+  assert.deepEqual(r.body.achieved_goals, [3]);
+  const args = log.find((e) => e[0] === 'signOff')[1];
+  assert.equal(args.signerId, METIC.id);
+  assert.equal(args.liveAttested, true);
+  const smuggle = await call('POST', '/done-when/5/uat', { json: { kind: 'uat', signer_id: 1 } });
+  assert.equal(smuggle.status, 400, 'an unknown field is refused, so a signer id cannot ride the body');
+});
+
+// ---- 3. the recording -------------------------------------------------------
+
+await test('UPLOAD: a real mp4 is stored under a server-minted name for THIS criterion', async () => {
+  reset();
+  const r = await call('POST', '/done-when/5/uat/recording', { raw: mp4(), type: 'video/mp4' });
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.match(r.body.recording, /^uat-5-[0-9a-f]{16}\.mp4$/);
+  assert.ok(existsSync(join(recDir, r.body.recording)));
+});
+
+await test('UPLOAD: bytes that are not the claimed video are refused in words', async () => {
+  reset();
+  const r = await call('POST', '/done-when/5/uat/recording', { raw: Buffer.alloc(64, 1), type: 'video/mp4' });
+  assert.equal(r.status, 400);
+  assert.equal(errCode(r.body), 'sniff_mismatch');
+  const png = await call('POST', '/done-when/5/uat/recording', { raw: Buffer.alloc(64, 1), type: 'image/png' });
+  assert.equal(png.status, 400, 'a non-video type never reaches the store');
+});
+
+await test('UPLOAD: an unknown criterion is a 404 and stores nothing', async () => {
+  reset();
+  const r = await call('POST', '/done-when/6/uat/recording', { raw: mp4(), type: 'video/mp4' });
+  assert.equal(r.status, 404);
+});
+
+await test('SIGNOFF: a recording that is not on disk is refused before signOff runs', async () => {
+  reset();
+  const r = await call('POST', '/done-when/5/uat', { json: { kind: 'uat', recording: 'uat-5-0123456789abcdef.mp4' } });
+  assert.equal(r.status, 400);
+  assert.equal(errCode(r.body), 'recording_not_found');
+  assert.ok(!log.some((e) => e[0] === 'signOff'));
+  const bad = await call('POST', '/done-when/5/uat', { json: { kind: 'uat', recording: '../../etc/passwd' } });
+  assert.equal(bad.status, 400);
+  assert.equal(errCode(bad.body), 'bad_recording');
+});
+
+await test('PLAY: a stored recording is served with its type; a bad name is refused', async () => {
+  reset();
+  const up = await call('POST', '/done-when/5/uat/recording', { raw: mp4(), type: 'video/mp4' });
+  const res = await fetch(`${base}/criterion-uats/recordings/${up.body.recording}`);
+  assert.equal(res.status, 200);
+  assert.match(res.headers.get('content-type'), /^video\/mp4/);
+  assert.equal(res.headers.get('x-content-type-options'), 'nosniff');
+  const bad = await fetch(`${base}/criterion-uats/recordings/..%2F..%2Fsecret.mp4`);
+  assert.equal(bad.status, 400);
+});
+
+// ---- 4. backend-only --------------------------------------------------------
+
+await test('BACKEND-ONLY: the authoring wall runs, and its refusal is the wall\'s own words', async () => {
+  reset();
+  const r = await call('PUT', '/done-when/5/backend-only', { json: { backend_only: true } });
+  assert.equal(r.status, 403);
+  assert.equal(errCode(r.body), 'goal_not_yours', 'a Metic who does not own the goal may not decide whether it needs a recording');
+  actor = { id: 900, rank: 'archon' };
+  const ok = await call('PUT', '/done-when/5/backend-only', { json: { backend_only: true } });
+  assert.equal(ok.status, 200, JSON.stringify(ok.body));
+  assert.equal(ok.body.backend_only, true);
+});
+
+// ---- 5. the permissions each write asks for --------------------------------
+
+await test('GATES: the writes ask for exactly the atoms route-rank-check pins', () => {
+  const { MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
+  const pins = MODULE_EXPECTED_RANKS.lifecycle;
+  assert.equal(pins['POST /done-when/:criterionId/uat/recording'], 'perm:criterion.review');
+  assert.equal(pins['POST /done-when/:criterionId/uat'], 'perm:criterion.review');
+  assert.equal(pins['PUT /done-when/:criterionId/backend-only'], 'perm:criterion.create');
+  // criterion-uat.js is built after done-when.js; its three gated routes asked, in
+  // order, for review · review · create.
+  assert.deepEqual(asked.slice(-3), ['criterion.review', 'criterion.review', 'criterion.create']);
+});
+
+server.close();
+rmSync(recDir, { recursive: true, force: true });
+summary();

package/tests/fitness.mjs

@@ -928,7 +928,9 @@ test('write-route validation exemptions are the known dynamic-key prefs routes,
   // own parser and read by a checker that refuses anything malformed (docx.readUpload,
   // module-artifact.verifyModuleArtifact). Named here so each raw-body exemption is a
   // reviewed diff.
-  const RAW_FILE_UPLOADS = ['POST /copy-desk/pages/:pageId/draft.docx', 'POST /store/modules/:key/versions'];
+  // The UAT recording (task 1004392) is the third: raw mp4/webm bytes, read by
+  // criterion-uat.screenRecording.
+  const RAW_FILE_UPLOADS = ['POST /copy-desk/pages/:pageId/draft.docx', 'POST /store/modules/:key/versions', 'POST /done-when/:criterionId/uat/recording'];
   const exempt = [...fitness.WRITE_VALIDATION_EXEMPT];
   assert.ok(exempt.length >= 1 && exempt.every((e) => e.startsWith('PATCH /me/') || RAW_FILE_UPLOADS.includes(e)),
     'exemptions are all /me/* prefs patches or a named raw-file upload: ' + exempt.join(', '));

package/tests/goal_achievement.mjs

@@ -118,14 +118,16 @@ await test('achieveGoalIfComplete: unknown goal id → { achieved:false, goal:nu
 // =========================================================================
 const PENDING_ROW = {
   id: 10, version_id: 'BONGOS-V1', criterion_id: 'c-one', criterion_md: 'md',
-  goal_id: 7, sort_order: 1, task_total: 2, goal_title: 'Goal hierarchy',
+  goal_id: 7, sort_order: 1, task_total: 2, shipped_total: 2, goal_title: 'Goal hierarchy',
   goal_status: 'open', is_last_in_goal: true,
 };
 
 await test('listPendingReviewCriteria: returns the queue rows; no version → param [null]', async () => {
   const pool = fakePool((s) => (/WITH pending AS/.test(s) ? { rows: [PENDING_ROW] } : null));
   const out = await listPendingReviewCriteria({}, { pool });
-  assert.deepEqual(out, [PENDING_ROW]);
+  // task 1004392: each row carries its UAT state; delivered work with no sign-off
+  // is Awaiting UAT (the /goal-uat queue).
+  assert.deepEqual(out, [{ ...PENDING_ROW, backend_only: false, uat_state: 'awaiting_uat', awaiting_uat: true }]);
   const q = find(pool.queries, /WITH pending AS/);
   assert.deepEqual(q.params, [null], 'an unscoped call binds versionId=null (no filter)');
 });

package/tests/goal_routes.mjs

@@ -144,7 +144,8 @@ await test('builder_id coercion contract: Number() accepts int + numeric string,
 // task 1002164: the projection now carries the per-criterion link counts and the
 // DERIVED pending_review flag, so the hall's goal-detail page can render the
 // third criterion state (met — ready to confirm) without a second round-trip.
-const CRIT_SQL_RE = /FROM done_when_criteria WHERE goal_id = \$1/;
+// task 1004392 aliased the table (d) to read each criterion's UAT columns.
+const CRIT_SQL_RE = /FROM done_when_criteria d WHERE d\.goal_id = \$1/;
 const critRow = (over = {}) => ({
   id: 1, version_id: 'V1', criterion_id: 'c1', criterion_md: 'md', satisfied: false,
   sort_order: 6, goal_id: 3, linked_tasks: 0, unshipped_tasks: 0, ...over,
@@ -155,7 +156,8 @@ await test('listCriteriaForGoal: SELECT by goal_id, ordered, returns rows', asyn
   const ROW = critRow();
   const pool = critPool([ROW]);
   const out = await listCriteriaForGoal(3, { pool });
-  assert.deepEqual(out, [{ ...ROW, pending_review: false }]);
+  // task 1004392: every row also carries its UAT state (no linked work → open).
+  assert.deepEqual(out, [{ ...ROW, backend_only: false, pending_review: false, uat_state: 'open', awaiting_uat: false }]);
   const sel = find(pool.queries, CRIT_SQL_RE);
   assert.equal(sel.params[0], 3);
   assert.match(sel.sql, /ORDER BY sort_order, id/);

package/tests/ideator_full_idea_shapes_space_proof.mjs

@@ -216,11 +216,12 @@ function answer(sql, params) {
     // was answering a question the read had stopped asking.
     return { rows: g ? [project(g, s)] : [] };
   }
-  if (/WITH crit AS \( SELECT id, version_id, criterion_id, criterion_md, satisfied, sort_order, goal_id FROM done_when_criteria WHERE goal_id = \$1/i.test(s)) {
+  // task 1004392: the read aliases the table (d) and carries the UAT columns.
+  if (/WITH crit AS \( SELECT d\.id, d\.version_id, d\.criterion_id, d\.criterion_md, d\.satisfied, d\.sort_order, d\.goal_id, .*FROM done_when_criteria d WHERE d\.goal_id = \$1/i.test(s)) {
     const rows = db.criteria
       .filter((c) => c.goal_id === String(params[0]))
       .sort((a, b) => a.sort_order - b.sort_order || String(a.id).localeCompare(String(b.id)))
-      .map((c) => ({ ...c, linked_tasks: 0, unshipped_tasks: 0 }));
+      .map((c) => ({ ...c, uat_kind: null, backend_only: false, linked_tasks: 0, unshipped_tasks: 0, shipped_tasks: 0 }));
     return { rows };
   }
 

package/tests/npm_release_where.mjs

@@ -22,7 +22,7 @@ import { npmTarball, npmPackument, fakeHttpsGet } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const { readTaskWhere } = require('../modules/npm-release/work.js');
+const { readTaskWhere, readTasksWhere } = require('../modules/npm-release/work.js');
 const buildRouter = require('../modules/npm-release/routes/task-where.js');
 
 const ORIGIN = 'https://registry.npmjs.org';
@@ -61,6 +61,9 @@ function fakePool() {
         const t = TASKS[params[0]];
         return { rows: t ? [{ id: params[0], ...t }] : [] };
       }
+      if (/FROM tasks WHERE id = ANY\(\$1::bigint\[\]\)/.test(sql)) {
+        return { rows: params[0].filter((id) => TASKS[id]).map((id) => ({ id, ...TASKS[id] })) };
+      }
       throw new Error(`unexpected query: ${sql}`);
     },
   };
@@ -77,7 +80,7 @@ function setup({ latest = '1.0.1', pkStatus = 200 } = {}) {
   const pool = fakePool();
   const store = freshStore();
   const read = (id, over = {}) => readTaskWhere({ pool, id, pkg: PKG, live: '1.0.2', get: fg.get, store, installedNotes: () => null, now: () => Date.parse('2026-09-26T13:00:00Z'), ...over });
-  return { read, pool, asked: fg.asked };
+  return { read, pool, asked: fg.asked, get: fg.get };
 }
 
 // ---- the reading ---------------------------------------------------------------------
@@ -135,6 +138,19 @@ test('the offered flag follows the deploy page: published before this hall ran i
   assert.equal(w.offered, true);
 });
 
+test('the batch reading (task 1004392) places many tasks with ONE query and ONE versions read, and agrees with the single reading', async () => {
+  const single = setup();
+  const batch = setup();
+  const ids = [11, 12, 13, 30, 999];
+  const out = await readTasksWhere({ pool: batch.pool, ids, pkg: PKG, live: '1.0.2', get: (...a) => batch.get(...a), store: freshStore(), installedNotes: () => null, now: () => Date.parse('2026-09-26T13:00:00Z') }).catch((e) => { throw e; });
+  assert.equal(batch.pool.queries.length, 1, 'one task query for every id');
+  assert.deepEqual(batch.asked.map(String).sort(), [`${ORIGIN}/@bongos%2fcore`, `${ORIGIN}/@bongos/core/-/core-1.0.4.tgz`].sort(),
+    'the packument and the notes are fetched once for all three shipped tasks');
+  for (const id of [11, 12, 13, 30]) assert.deepEqual(out[String(id)], await single.read(id), 'task ' + id);
+  assert.ok(!('999' in out), 'an unknown id is absent, not an error');
+  assert.deepEqual(await readTasksWhere({ pool: batch.pool, ids: ['1; DROP', ''] }), {}, 'bad ids are never queried');
+});
+
 // ---- the route -----------------------------------------------------------------------
 
 function layers(read) {

package/tests/speciality_session_skills.mjs

@@ -0,0 +1,150 @@
+// tests/speciality_session_skills.mjs — a builder's ENABLED skills reach their
+// session through the existing injection path (task 1004074, part 3 of 3 of
+// ADR 0310).
+//
+// The whole path, not its middle: the adoption row as db.listAdoptions returns
+// it → the real kernel port (describeActiveFor, registered by the real router
+// factory) → the real Conductor's evaluateTriggers. A hand-built contract fed
+// straight to the Conductor would stay green if the port stopped reading
+// enabled_skills, so the port is always in the loop here.
+//
+// Run:  node tests/speciality_session_skills.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const S = require('../modules/specialities/specialities.js');
+const skills = require('../modules/specialities/skills.js');
+const db = require('../modules/specialities/db.js');
+const api = require('../src/module-api.js');
+const conductor = require(path.join(ROOT, '.claude', 'hooks', 'conductor.js'));
+const { test, summary } = makeRunner();
+
+const LEAN = /chose to lean on these skills/;
+
+// ---- the pure line ----------------------------------------------------------
+const row = (over = {}) => ({ id: 9, slug: 'economics', name: 'Economics', discipline: 'ideator', summary: '', contract_md: '', skills: ['recall', 'status'], enabled_skills: [], active: true, ...over });
+
+await test('enabled skills are named in the contract', () => {
+  const d = S.describeForApi(row({ enabled_skills: ['recall', 'status'] }));
+  assert.match(d.contract, LEAN);
+  assert.match(d.contract, /\/recall, \/status/);
+});
+
+await test('nothing enabled says nothing — silent, not an empty list', () => {
+  const none = S.describeForApi(row({ enabled_skills: [] }));
+  const absent = S.describeForApi(row({ enabled_skills: undefined }));
+  const baseline = S.describeForApi(row({ skills: [], enabled_skills: [] }));
+  assert.doesNotMatch(none.contract, LEAN);
+  assert.equal(none.contract, baseline.contract, 'an adoption with nothing on reads exactly like one with no skills at all');
+  assert.equal(absent.contract, baseline.contract);
+});
+
+await test('a skill no longer offered, or no longer installed, is not named', () => {
+  const d = S.describeForApi(row({ skills: ['recall'], enabled_skills: ['recall', 'status'] }));
+  assert.match(d.contract, /\/recall\./);
+  assert.doesNotMatch(d.contract, /\/status/, 'the author dropped it from the offer');
+  const gone = S.describeForApi(row({ enabled_skills: ['recall', 'status'] }), { installed: new Map([['status', {}]]) });
+  assert.match(gone.contract, /\/status\./);
+  assert.doesNotMatch(gone.contract, /\/recall/, 'a deploy removed it');
+  const allGone = S.describeForApi(row({ enabled_skills: ['recall'] }), { installed: new Map() });
+  assert.doesNotMatch(allGone.contract, LEAN, 'filtered to nothing is silent too');
+});
+
+await test('the line is advice and says so — it grants nothing', () => {
+  const d = S.describeForApi(row({ enabled_skills: ['recall'] }));
+  assert.match(d.contract, /advice, not permission/);
+  assert.match(d.contract, /only if the builder's rank allows it/);
+});
+
+await test('the skills line sits AFTER the provenance fence — it is the adopter\'s choice, not the author\'s prose', () => {
+  const d = S.describeForApi(row({ contract_md: 'Speak in elasticities.', enabled_skills: ['recall'] }), { selfAuthored: false, authorLabel: 'Ada' });
+  const lines = d.contract.split('\n');
+  assert.match(lines[0], /stated working preferences of Ada/);
+  assert.match(lines[lines.length - 1], LEAN);
+});
+
+await test('a malformed name in the stored set is never relayed', () => {
+  const d = S.describeForApi(row({ skills: ['recall', 'Bad Name; rm -rf'], enabled_skills: ['recall', 'Bad Name; rm -rf'] }));
+  assert.doesNotMatch(d.contract, /rm -rf/);
+});
+
+// ---- the whole path: row → real port → real Conductor -----------------------
+const store = { adoptions: [] };
+db.listAdoptions = async () => store.adoptions.map((a) => ({ ...a }));
+db.countTraining = async () => ({ documentCount: 0, learningCount: 0 });
+db.getSpeciality = async (id) => ({ id, owner_kind: 'builder', owner_builder_id: 1 });
+skills.installedSkillsCached = () => new Map([['recall', {}], ['status', {}]]);
+require('../modules/specialities/routes/specialities.js')();
+const port = api.resolveOptional('specialities');
+const claim = (discipline) => ({ task_id: '1', title: 't', discipline });
+
+async function sessionFor(adoptions, claims) {
+  store.adoptions = adoptions;
+  const specialities = await port.describeActiveFor(1);
+  return conductor.evaluateTriggers({ activeClaims: claims, specialities });
+}
+const specEntries = (out) => out.filter((a) => String(a.id).startsWith('speciality:'));
+
+await test('the port is the one the router registered', () => {
+  assert.equal(typeof port.describeActiveFor, 'function');
+});
+
+await test('an adoption with enabled skills reaches the session in its craft', async () => {
+  const out = await sessionFor([row({ enabled_skills: ['recall'] })], [claim('ideator')]);
+  const sp = specEntries(out);
+  assert.equal(sp.length, 1);
+  assert.match(sp[0].text, /Economics/);
+  assert.match(sp[0].text, /\/recall/);
+});
+
+await test('with nothing enabled the session gets the contract and not a word more', async () => {
+  const out = await sessionFor([row({ enabled_skills: [] })], [claim('ideator')]);
+  const sp = specEntries(out);
+  assert.equal(sp.length, 1, 'the speciality itself is still there');
+  assert.doesNotMatch(sp[0].text, LEAN);
+});
+
+await test('craft-scoped like the contract: an engineering session hears nothing of an ideator\'s skills', async () => {
+  const out = await sessionFor([row({ enabled_skills: ['recall'] })], [claim('engineer')]);
+  assert.equal(specEntries(out).length, 0);
+});
+
+await test('an inactive adoption relays nothing, skills included', async () => {
+  const out = await sessionFor([row({ active: false, enabled_skills: ['recall'] })], [claim('ideator')]);
+  assert.equal(specEntries(out).length, 0);
+});
+
+await test('a failed skills read degrades to the offered filter, never a lost contract', async () => {
+  const saved = skills.installedSkillsCached;
+  skills.installedSkillsCached = () => { throw new Error('disk gone'); };
+  try {
+    const out = await sessionFor([row({ enabled_skills: ['recall'] })], [claim('ideator')]);
+    assert.match(specEntries(out)[0].text, /\/recall/);
+  } finally { skills.installedSkillsCached = saved; }
+});
+
+await test('the real adoption read selects both sets the line needs', () => {
+  // listAdoptions is stubbed above, so pin the SQL it stands in for: drop either
+  // column and the line goes silent for everyone, with nothing erroring.
+  const sql = fs.readFileSync(path.join(ROOT, 'modules/specialities/db.js'), 'utf8');
+  const read = sql.slice(sql.indexOf('async function listAdoptions'), sql.indexOf('async function taskDiscipline'));
+  assert.match(read, /s\.skills/);
+  assert.match(read, /a\.enabled_skills/);
+});
+
+// ---- grants nothing: nothing that decides what runs reads the enabled set ----
+await test('no permission or materialisation surface reads enabled_skills', () => {
+  for (const rel of ['scripts/gds/claude-materialize.js', 'src/bongos/auth.js', 'src/bongos/permission-path-check.js', '.claude/hooks/conductor.js']) {
+    const text = fs.readFileSync(path.join(ROOT, rel), 'utf8');
+    assert.doesNotMatch(text, /enabled_skills/, `${rel} must not key anything off the enabled set`);
+  }
+});
+
+summary();