@bongos/core 1.20.80 → 1.20.82

package/tests/autonomy_builder_scope.mjs

@@ -0,0 +1,474 @@
+// tests/autonomy_builder_scope.mjs — each builder's own runner scope, and the
+// project-level runner permissions (task 1004501).
+//
+// Owner ruling, 2026-10-01: every builder picks which work THEIR runner takes; a
+// builder who has picked nothing gets NO autonomous work; who may run a runner at
+// all is a project permission (`autonomy.run`); and the owner can pause one
+// builder's runner without throwing the master switch. The server composes all of
+// it into the fence the runner reads, so the runner stays dumb and cannot widen
+// its own fence.
+//
+// The pure composition is driven directly; the routes are driven as REAL requests
+// through the assembled router with only the auth gates stubbed (the
+// autonomy_fence_priority precedent); the SQL runs against a stubbed pool.
+//
+// DB-free, no network. Run:  node --test tests/autonomy_builder_scope.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const req = createRequire(import.meta.url);
+const express = req('express');
+const { attachFail } = req(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+const fence = req(path.join(ROOT, 'modules/autonomy/fence.js'));
+const cadence = req(path.join(ROOT, 'modules/autonomy/cadence.js'));
+
+const PROJECT = Object.freeze({
+  enabled: true, paused_reason: null, priority_goal_id: 1000118,
+  updated_at: '2026-10-01T09:53:08.874Z', updated_by: '3',
+  goals: [{ goal_id: 1000118, note: 'bug squash' }, { goal_id: 1000090, note: null }],
+});
+
+// ── the pure composition ─────────────────────────────────────────────────────
+
+test('picks NARROW the project allowlist and can never add to it', () => {
+  const f = fence.effectiveFence({ project: PROJECT, scope: { goals: [1000090, 4242] }, mayRun: true });
+  assert.equal(f.enabled, true);
+  assert.deepEqual(f.goals.map((g) => g.goal_id), [1000090], 'a picked goal the project does not allow is dropped');
+  assert.equal(f.priority_goal_id, null, 'the priority is not in the picks, so there is none');
+  assert.deepEqual(f.project, PROJECT, 'the owner page still gets the unnarrowed fence');
+});
+
+test('a builder who has picked nothing gets NO goals (owner ruling), never the whole allowlist', () => {
+  for (const scope of [null, { goals: [] }]) {
+    const f = fence.effectiveFence({ project: PROJECT, scope, mayRun: true });
+    assert.deepEqual(f.goals, [], `scope=${JSON.stringify(scope)}`);
+    const d = fence.decideRun({ fence: f, graderBypassed: false });
+    assert.equal(d.go, false);
+    assert.equal(d.code, 'no_builder_scope');
+    assert.match(d.reason, /Settings/, 'the runner log says where to fix it');
+  }
+});
+
+test('the three stops win in the order an operator asks "why is it idle"', () => {
+  const off = fence.effectiveFence({ project: { ...PROJECT, enabled: false, paused_reason: 'night off' }, scope: { goals: [1000118], owner_paused: true }, mayRun: false });
+  assert.equal(off.stop_code, 'kill_switch', 'the project switch stops everyone first');
+  assert.equal(fence.decideRun({ fence: off, graderBypassed: false }).code, 'kill_switch');
+
+  const noPerm = fence.effectiveFence({ project: PROJECT, scope: { goals: [1000118], owner_paused: true }, mayRun: false });
+  assert.equal(noPerm.enabled, false);
+  assert.equal(noPerm.stop_code, 'not_permitted', 'then whether this builder may run at all');
+  assert.equal(fence.decideRun({ fence: noPerm, graderBypassed: false }).code, 'not_permitted');
+
+  const paused = fence.effectiveFence({ project: PROJECT, scope: { goals: [1000118], owner_paused: true, owner_paused_reason: 'too many PRs' }, mayRun: true });
+  assert.equal(paused.stop_code, 'builder_paused', 'then the owner’s pause on this builder');
+  const d = fence.decideRun({ fence: paused, graderBypassed: false });
+  assert.equal(d.code, 'builder_paused');
+  assert.match(d.reason, /too many PRs/);
+});
+
+test('anything but an explicit true for autonomy.run refuses', () => {
+  for (const mayRun of [undefined, null, 'true', 1]) {
+    assert.equal(fence.effectiveFence({ project: PROJECT, scope: { goals: [1000118] }, mayRun }).enabled, false, String(mayRun));
+  }
+});
+
+test('a permitted, unpaused builder with picks gets exactly their picks, priority first', () => {
+  const f = fence.effectiveFence({ project: PROJECT, scope: { goals: [1000090, 1000118] }, mayRun: true });
+  const d = fence.decideRun({ fence: f, graderBypassed: false });
+  assert.equal(d.go, true);
+  assert.deepEqual(d.goals, [1000118, 1000090]);
+  assert.equal(d.priorityGoal, 1000118);
+});
+
+test('a pick or a pause moves updated_at, so it wakes a runner waiting on the fence', () => {
+  const later = '2026-10-02T00:00:00.000Z';
+  assert.equal(fence.effectiveFence({ project: PROJECT, scope: { goals: [], updated_at: later }, mayRun: true }).updated_at, later);
+  assert.equal(fence.effectiveFence({ project: PROJECT, scope: null, mayRun: true }).updated_at, new Date(PROJECT.updated_at).toISOString());
+});
+
+test('an unreadable project fence stays unreadable', () => {
+  assert.equal(fence.effectiveFence({ project: null, scope: { goals: [1] }, mayRun: true }), null);
+});
+
+test('a fence from a server that predates the split still reads as the kill switch', () => {
+  const d = fence.decideRun({ fence: { enabled: false, paused_reason: 'x', goals: [] }, graderBypassed: false });
+  assert.equal(d.code, 'kill_switch');
+  const odd = fence.decideRun({ fence: { enabled: false, stop_code: 'something_new', goals: [] }, graderBypassed: false });
+  assert.equal(odd.code, 'kill_switch', 'an unknown stop code is never a way to open the fence');
+});
+
+test('cadence treats a per-builder stop like the kill switch: stopped, not a fault', () => {
+  for (const code of ['builder_paused', 'not_permitted']) {
+    assert.equal(cadence.classifyEvent({ event: 'fenced', code, reason: 'r' }).class, 'stopped', code);
+  }
+  assert.equal(cadence.classifyEvent({ event: 'fenced', code: 'no_builder_scope', reason: 'r' }).class, 'quiet');
+});
+
+// ── the routes ───────────────────────────────────────────────────────────────
+
+const permStub = (key) => {
+  const mw = (_req, _res, next) => next();
+  mw.permKey = key;
+  return mw;
+};
+// The session fold (task 1002556) rides requireBuilder as req.rawPermissionKeys;
+// null = the session row did not carry it. Mutable so one test can drive both.
+let sessionKeys = null;
+const passBuilder = (reqq, _res, next) => { reqq.builder = { id: 7, rank: 'metic' }; reqq.rawPermissionKeys = sessionKeys; next(); };
+
+function autonomyRouter() {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const saved = { b: api.requireBuilder, p: api.requirePermission };
+  api.requireBuilder = passBuilder;
+  api.requirePermission = permStub;
+  const routePath = req.resolve(path.join(ROOT, 'modules/autonomy/routes/autonomy.js'));
+  delete req.cache[routePath];
+  try {
+    return req(routePath)();
+  } finally {
+    api.requireBuilder = saved.b;
+    api.requirePermission = saved.p;
+  }
+}
+
+async function serve(router) {
+  const app = express();
+  app.use(express.json());
+  app.use(attachFail);
+  app.use(router);
+  const server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  return { base: `http://127.0.0.1:${server.address().port}`, close: () => server.close() };
+}
+
+const send = (base, method, p, body) => fetch(`${base}${p}`, {
+  method, headers: { 'content-type': 'application/json' }, body: body === undefined ? undefined : JSON.stringify(body),
+});
+
+function gateOf(router, p, method) {
+  const layer = router.stack.find((l) => l.route && l.route.path === p && l.route.methods[method]);
+  assert.ok(layer, `${method.toUpperCase()} ${p} is registered`);
+  return layer.route.stack.map((s) => s.handle.permKey).filter(Boolean);
+}
+
+test('the gates: picks behind autonomy.run, the pause and the owner view behind the owner-only atom', () => {
+  const router = autonomyRouter();
+  assert.deepEqual(gateOf(router, '/autonomy/me/goals', 'put'), ['autonomy.run']);
+  assert.deepEqual(gateOf(router, '/autonomy/builders/:builderId/pause', 'post'), ['autonomy.fence.manage']);
+  assert.deepEqual(gateOf(router, '/autonomy/runners/all', 'get'), ['autonomy.fence.manage']);
+  assert.deepEqual(gateOf(router, '/autonomy/fence', 'get'), [], 'the fence read stays any-builder: a runner must always learn it should stop');
+});
+
+test('GET /autonomy/fence answers with the CALLER’s fence, asking the permission of the government port', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = { rf: db.readFence, rs: db.readBuilderScope, ro: api.resolveOptional };
+  const asked = [];
+  let holds = true;
+  db.readFence = async () => PROJECT;
+  db.readBuilderScope = async (id) => { asked.push(['scope', id]); return { goals: [1000090], owner_paused: false, updated_at: null }; };
+  api.resolveOptional = (name) => (name === 'government'
+    ? { builderHasPermissions: async (id, keys) => { asked.push(['perm', id, keys]); return holds; } }
+    : saved.ro(name));
+  const s = await serve(autonomyRouter());
+  try {
+    let r = await send(s.base, 'GET', '/autonomy/fence');
+    assert.equal(r.status, 200);
+    let body = await r.json();
+    assert.equal(body.enabled, true);
+    assert.deepEqual(body.goals.map((g) => g.goal_id), [1000090]);
+    assert.equal(body.project.goals.length, 2);
+    assert.deepEqual(asked, [['scope', 7], ['perm', 7, ['autonomy.run']]], 'scope and permission are the SESSION builder’s');
+
+    holds = false;
+    body = await (await send(s.base, 'GET', '/autonomy/fence')).json();
+    assert.equal(body.enabled, false);
+    assert.equal(body.stop_code, 'not_permitted');
+
+    api.resolveOptional = () => ({ builderHasPermissions: async () => { throw new Error('resolver down'); } });
+    body = await (await send(s.base, 'GET', '/autonomy/fence')).json();
+    assert.equal(body.enabled, false, 'a resolver that throws turns the fence OFF, never on');
+
+    api.resolveOptional = () => null;
+    body = await (await send(s.base, 'GET', '/autonomy/fence')).json();
+    assert.equal(body.enabled, false, 'no government port: off');
+  } finally {
+    s.close();
+    db.readFence = saved.rf; db.readBuilderScope = saved.rs; api.resolveOptional = saved.ro;
+  }
+});
+
+test('the fence read answers autonomy.run from the session fold, adding NO query to the runner’s every-iteration read', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = { rf: db.readFence, rs: db.readBuilderScope, ro: api.resolveOptional };
+  let resolves = 0;
+  const folded = [];
+  db.readFence = async () => PROJECT;
+  db.readBuilderScope = async () => ({ goals: [1000118], owner_paused: false, updated_at: null });
+  api.resolveOptional = () => ({
+    effectivePermissions: (keys) => { folded.push(keys); return keys; },
+    builderHasPermissions: async () => { resolves += 1; return true; },
+  });
+  const s = await serve(autonomyRouter());
+  try {
+    sessionKeys = ['autonomy.run', 'task.claim'];
+    let body = await (await send(s.base, 'GET', '/autonomy/fence')).json();
+    assert.equal(body.enabled, true);
+    assert.equal(resolves, 0, 'the fold answered — no DB resolve');
+    assert.deepEqual(folded, [['autonomy.run', 'task.claim']]);
+
+    sessionKeys = ['task.claim'];
+    body = await (await send(s.base, 'GET', '/autonomy/fence')).json();
+    assert.equal(body.stop_code, 'not_permitted', 'the fold says not held, and that is the answer');
+    assert.equal(resolves, 0);
+
+    sessionKeys = null;
+    body = await (await send(s.base, 'GET', '/autonomy/fence')).json();
+    assert.equal(resolves, 1, 'no fold on the session: the resolve is the fallback, as in requirePermission');
+  } finally {
+    s.close();
+    sessionKeys = null;
+    db.readFence = saved.rf; db.readBuilderScope = saved.rs; api.resolveOptional = saved.ro;
+  }
+});
+
+test('GET /autonomy/runners/all attaches the server’s health verdict to every builder’s runner', async () => {
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = db.readAllRunnerScopes;
+  db.readAllRunnerScopes = async () => [
+    { builder_id: '3', goals: [1000118], owner_paused: false, runners: [{ host: 'winbox', last_seen_at: new Date().toISOString(), last_event: 'cadence' }] },
+    { builder_id: '9', goals: [], owner_paused: true, runners: [] },
+  ];
+  const s = await serve(autonomyRouter());
+  try {
+    const r = await send(s.base, 'GET', '/autonomy/runners/all');
+    assert.equal(r.status, 200);
+    const { builders } = await r.json();
+    assert.equal(builders.length, 2);
+    assert.equal(builders[0].runners[0].health.state, 'alive');
+    assert.deepEqual(builders[1].runners, []);
+
+    db.readAllRunnerScopes = async () => { throw new Error('db down'); };
+    assert.equal((await send(s.base, 'GET', '/autonomy/runners/all')).status, 503, 'unreadable is a 503, never an empty list');
+  } finally {
+    s.close();
+    db.readAllRunnerScopes = saved;
+  }
+});
+
+test('PUT /autonomy/me/goals writes the session builder’s picks and refuses a goal the project does not allow', async () => {
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = db.setBuilderGoals;
+  const seen = [];
+  let answer = { goals: [1000090, 1000118] };
+  db.setBuilderGoals = async (args) => { seen.push(args); return answer; };
+  const s = await serve(autonomyRouter());
+  try {
+    let r = await send(s.base, 'PUT', '/autonomy/me/goals', { goal_ids: [1000118, '1000090'] });
+    assert.equal(r.status, 200);
+    assert.deepEqual(await r.json(), { goals: [1000090, 1000118] });
+    assert.deepEqual(seen[0], { builderId: 7, goalIds: [1000118, 1000090] });
+
+    answer = { goals: [] };
+    r = await send(s.base, 'PUT', '/autonomy/me/goals', { goal_ids: [] });
+    assert.equal(r.status, 200, 'an empty list is a real answer: "my runner takes no work"');
+
+    answer = { notAllowed: [4242] };
+    r = await send(s.base, 'PUT', '/autonomy/me/goals', { goal_ids: [4242] });
+    assert.equal(r.status, 409);
+    assert.match((await r.json()).error.message, /4242/);
+
+    const before = seen.length;
+    for (const bad of [{ goal_ids: 'x' }, { goal_ids: [0] }, { goal_ids: [-3] }, { goal_ids: ['abc'] }]) {
+      r = await send(s.base, 'PUT', '/autonomy/me/goals', bad);
+      assert.equal(r.status, 400, JSON.stringify(bad));
+    }
+    assert.equal(seen.length, before, 'a malformed list never reaches the database');
+  } finally {
+    s.close();
+    db.setBuilderGoals = saved;
+  }
+});
+
+test('POST /autonomy/builders/:id/pause pauses THAT builder, keeps the reason only while paused', async () => {
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = db.setBuilderPause;
+  const seen = [];
+  db.setBuilderPause = async (args) => { seen.push(args); return { builder_id: String(args.builderId), owner_paused: args.paused }; };
+  const s = await serve(autonomyRouter());
+  try {
+    let r = await send(s.base, 'POST', '/autonomy/builders/42/pause', { paused: true, reason: 'too many PRs' });
+    assert.equal(r.status, 200);
+    assert.deepEqual(seen[0], { builderId: 42, paused: true, reason: 'too many PRs', byBuilderId: 7 });
+    db.setBuilderPause = async () => null;
+    r = await send(s.base, 'POST', '/autonomy/builders/999999/pause', { paused: true });
+    assert.equal(r.status, 404, 'no such builder: refused, never an orphan row');
+    r = await send(s.base, 'POST', '/autonomy/builders/nope/pause', { paused: true });
+    assert.equal(r.status, 400);
+    r = await send(s.base, 'POST', '/autonomy/builders/42/pause', {});
+    assert.equal(r.status, 400, 'paused is required');
+  } finally {
+    s.close();
+    db.setBuilderPause = saved;
+  }
+});
+
+// ── the SQL ──────────────────────────────────────────────────────────────────
+
+function stubClient(replies) {
+  const calls = [];
+  const client = { query: async (sql, params) => { calls.push({ sql, params }); return replies.shift() || { rows: [] }; }, release: () => { calls.push({ sql: 'RELEASE' }); } };
+  return { client, calls };
+}
+
+test('setBuilderGoals writes nothing when any goal is not allowlisted, and replaces the list otherwise', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.connect;
+  try {
+    let s = stubClient([{}, { rows: [{ goal_id: '1000118' }] }]);
+    api.pool.connect = async () => s.client;
+    assert.deepEqual(await db.setBuilderGoals({ builderId: 7, goalIds: [1000118, 4242] }), { notAllowed: [4242] });
+    assert.ok(s.calls.some((c) => c.sql === 'ROLLBACK'));
+    assert.ok(!s.calls.some((c) => /INSERT INTO autonomy_builder_goals|DELETE FROM autonomy_builder_goals/.test(c.sql)), 'nothing is written');
+    assert.equal(s.calls.at(-1).sql, 'RELEASE');
+
+    s = stubClient([{}, { rows: [{ goal_id: '1000118' }, { goal_id: '1000090' }] }]);
+    api.pool.connect = async () => s.client;
+    assert.deepEqual(await db.setBuilderGoals({ builderId: 7, goalIds: [1000118, 1000090, 1000118] }), { goals: [1000090, 1000118] });
+    const sqls = s.calls.map((c) => c.sql);
+    assert.ok(sqls.some((q) => /DELETE FROM autonomy_builder_goals WHERE builder_id = \$1/.test(q)));
+    assert.ok(sqls.some((q) => /INSERT INTO autonomy_builder_goals/.test(q)));
+    assert.ok(sqls.some((q) => /INSERT INTO autonomy_builder_scope/.test(q)), 'the scope row is bumped so a waiting runner wakes');
+    assert.ok(sqls.includes('COMMIT'));
+
+    s = stubClient([{}]);
+    api.pool.connect = async () => s.client;
+    assert.deepEqual(await db.setBuilderGoals({ builderId: 7, goalIds: [] }), { goals: [] });
+    assert.ok(!s.calls.some((c) => /INSERT INTO autonomy_builder_goals/.test(c.sql)), 'an empty list clears and inserts nothing');
+  } finally {
+    api.pool.connect = saved;
+  }
+});
+
+test('readBuilderScope: null for a builder with no row and no picks; picks only while still allowlisted', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  const sqls = [];
+  let scopeRows = []; let goalRows = [];
+  api.pool.query = async (sql) => { sqls.push(sql); return { rows: /autonomy_builder_scope/.test(sql) ? scopeRows : goalRows }; };
+  try {
+    assert.equal(await db.readBuilderScope(7), null);
+    assert.ok(sqls.some((q) => /JOIN autonomy_allowed_goals/.test(q)));
+    scopeRows = [{ owner_paused: true, owner_paused_reason: 'r', owner_paused_by: '3', updated_at: 't' }];
+    goalRows = [{ goal_id: '1000118' }];
+    assert.deepEqual(await db.readBuilderScope(7), { goals: [1000118], owner_paused: true, owner_paused_reason: 'r', owner_paused_by: '3', updated_at: 't' });
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+test('readAllRunnerScopes: a builder with picks and no runner, and one with a runner and no picks, both appear', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  const sqls = [];
+  api.pool.query = async (sql, params) => {
+    sqls.push({ sql, params });
+    if (/FROM autonomy_builder_scope/.test(sql)) return { rows: [{ builder_id: '4', owner_paused: true, owner_paused_reason: 'too many PRs', updated_at: 't' }] };
+    if (/FROM autonomy_builder_goals/.test(sql)) return { rows: [{ builder_id: '3', goal_id: '1000118' }, { builder_id: '4', goal_id: '1000090' }] };
+    if (/FROM autonomy_runner_heartbeat/.test(sql)) return { rows: [{ builder_id: '9', host: 'pc9', working_task_id: '5', working_goal_id: null, last_seen_at: 't' }] };
+    if (/FROM builders/.test(sql)) return { rows: [{ id: '3', github_login: 'b3', display_name: 'Three', rank: 'archon' }, { id: '9', github_login: 'b9', display_name: 'Nine', rank: 'metic' }] };
+    return { rows: [] };
+  };
+  try {
+    const out = await db.readAllRunnerScopes();
+    const by = Object.fromEntries(out.map((b) => [b.builder_id, b]));
+    assert.deepEqual(Object.keys(by).sort(), ['3', '4', '9']);
+    assert.deepEqual(by['3'].goals, [1000118], 'picks only, no runner');
+    assert.deepEqual(by['3'].runners, []);
+    assert.equal(by['3'].display_name, 'Three');
+    assert.equal(by['4'].owner_paused, true);
+    assert.equal(by['4'].owner_paused_reason, 'too many PRs');
+    assert.equal(by['4'].display_name, undefined, 'no builders row: no name, and still listed');
+    assert.deepEqual(by['9'].goals, [], 'a runner and no picks');
+    assert.equal(by['9'].runners[0].host, 'pc9');
+    assert.equal(by['9'].runners[0].working_task_id, '5');
+    const beat = sqls.find((c) => /FROM autonomy_runner_heartbeat/.test(c.sql)).sql;
+    assert.match(beat, /PARTITION BY builder_id/, 'the cap is per builder, so a busy builder cannot push a quiet one out');
+    assert.match(beat, /rn <= 20/);
+    assert.deepEqual(sqls.find((c) => /FROM builders/.test(c.sql)).params[0].slice().sort(), ['3', '4', '9']);
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+test('setBuilderPause writes only for a builder that exists', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  let seen = null;
+  api.pool.query = async (sql, params) => { seen = { sql, params }; return { rows: [] }; };
+  try {
+    assert.equal(await db.setBuilderPause({ builderId: 999, paused: true, reason: 'x', byBuilderId: 3 }), null);
+    assert.match(seen.sql, /WHERE EXISTS \(SELECT 1 FROM builders WHERE id = \$1\)/);
+    assert.deepEqual(seen.params, [999, true, 'x', 3]);
+    await db.setBuilderPause({ builderId: 4, paused: false, reason: 'ignored', byBuilderId: 3 });
+    assert.equal(seen.params[2], null, 'the reason is kept only while paused');
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+// ── the schema and the permission ────────────────────────────────────────────
+
+const sqlOf = (p) => fs.readFileSync(path.join(ROOT, p), 'utf8').split('\n').filter((l) => !l.trim().startsWith('--')).join('\n');
+
+test('the migration ties every pick to the allowlist and drops it when the goal is revoked', () => {
+  const sql = sqlOf('modules/autonomy/migrations/autonomy_005_builder_scope.sql');
+  assert.match(sql, /CREATE TABLE IF NOT EXISTS autonomy_builder_goals/);
+  assert.match(sql, /REFERENCES autonomy_allowed_goals \(goal_id\) ON DELETE CASCADE/);
+  assert.match(sql, /PRIMARY KEY \(builder_id, goal_id\)/);
+  assert.match(sql, /owner_paused\s+boolean NOT NULL DEFAULT false/);
+});
+
+test('autonomy.run is an operational Metic permission, granted to Metic and Archon', () => {
+  const { PERMISSIONS: CATALOG } = req(path.join(ROOT, 'modules/government/catalog.js'));
+  const entry = (CATALOG || []).find((p) => p.key === 'autonomy.run');
+  assert.ok(entry, 'in the catalog');
+  assert.equal(entry.system, false, 'composable into a custom rank — it cannot widen the fence');
+  assert.equal(entry.floor, 'metic');
+  const fm = (CATALOG || []).find((p) => p.key === 'autonomy.fence.manage');
+  assert.equal(fm.system, true, 'the fence itself stays the owner’s alone');
+  const grant = sqlOf('modules/government/migrations/government_022_autonomy_run.sql');
+  assert.match(grant, /SELECT 'metic', unnest\(ARRAY\[\s*'autonomy\.run'\s*\]\)/);
+  assert.match(grant, /SELECT 'archon', unnest\(ARRAY\[\s*'autonomy\.run'\s*\]\)/);
+});
+
+// ── the pages ────────────────────────────────────────────────────────────────
+
+test('the owner page draws the PROJECT fence and pauses one builder; the settings panel writes the caller’s own picks', () => {
+  const gate = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.js'), 'utf8');
+  assert.match(gate, /const fence = raw\.project \|\| raw;/, 'the switch panel must not draw the owner’s own narrowed picks as the project list');
+  assert.match(gate, /\/autonomy\/runners\/all/);
+  assert.match(gate, /\/autonomy\/builders\/\$\{encodeURIComponent\(id\)\}\/pause/);
+  const html = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.html'), 'utf8');
+  assert.match(html, /id="fence-builders"/);
+
+  const panel = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/settings-autobongos.js'), 'utf8');
+  assert.match(panel, /'PUT', `\$\{API\}\/autonomy\/me\/goals`/);
+  assert.match(panel, /scope\.may_run !== true/, 'a builder who may not run is told so instead of shown a form');
+  assert.match(panel, /'GET', `\$\{API\}\/goals`/, 'goals are named from the list this builder can already see');
+  assert.match(panel, /goalLabel\(g\.goal_id\)/);
+  const settings = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/settings.html'), 'utf8');
+  assert.match(settings, /id="autobongos-scroll"/);
+  assert.match(settings, /settings-autobongos\.js/);
+});

package/tests/autonomy_fence_priority.mjs

@@ -204,8 +204,12 @@ test('the migration ties the priority to the allowlist and clears it on revoke',
 
 test('the gate page renders the priority, lists it first, and posts to the priority route', () => {
   const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.js'), 'utf8');
-  assert.match(src, /renderFenceGoals\(fence\.goals, fence\.priority_goal_id\)/, 'the page must pass the priority it read');
+  // The PROJECT fence's priority (task 1004501): GET /autonomy/fence now answers
+  // with the caller's narrowed fence, and the switch panel draws `project`.
+  // The chips (task 1004509) are drawn from that project fence.
+  assert.match(src, /goalChipsHtml\(fence\.goals, fence\.priority_goal_id\)/, 'the page must pass the priority it read');
   assert.match(src, /sendJson\('POST', '\/autonomy\/fence\/priority', \{ goal_id: goalId \}\)/);
-  assert.match(src, /Make priority/);
-  assert.match(src, /Clear priority/);
+  // The star on a chip sets it, and the star on the priority chip clears it.
+  assert.match(src, /Work this goal first/);
+  assert.match(src, /Worked first — click to clear/);
 });

package/tests/autonomy_runner_identity.mjs

@@ -208,7 +208,7 @@ test('the migration adds the four columns, additively', () => {
 
 test('the gate card draws the PC, the account, the code and the restarting label', () => {
   const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.js'), 'utf8');
-  assert.match(src, /restarting: 'Restarting'/);
+  assert.match(src, /Restarting to pick up new code/);
   assert.match(src, /PC <strong>\$\{escapeHtml\(h\.host\)\}<\/strong>/);
   assert.match(src, /Claude account \$\{escapeHtml\(h\.account\)\}/);
   assert.match(src, /behind main/);

package/tests/criterion_goal_attach.mjs

@@ -557,9 +557,13 @@ await test('setGoalStatus writes on the transaction client (task 1003840)', asyn
   const seen = [];
   const fakeClient = { query: async (sql, params) => { seen.push({ sql, params }); return { rows: [{ id: 3, status: 'achieved' }] }; } };
   await realGoals.setGoalStatus({ goalId: 3, status: 'achieved' }, { client: fakeClient });
-  assert.equal(seen.length, 1, 'the UPDATE reached the injected client');
+  // Two since task 1003660: the status flip, then the sweep of the goal's pending
+  // invites/requests. BOTH must land on the injected client, or the sweep would
+  // reintroduce the very pool-vs-transaction deadlock this test guards.
+  assert.equal(seen.length, 2, 'the UPDATE and the request sweep reached the injected client');
   assert.match(seen[0].sql, /UPDATE goals/);
   assert.deepEqual(seen[0].params, [3, 'achieved']);
+  assert.match(seen[1].sql, /UPDATE goal_membership_requests/);
 });
 
 // The wrapper installed above is removed, so nothing after this file's own tests

package/tests/goal_close_cancels_requests.mjs

@@ -0,0 +1,82 @@
+// tests/goal_close_cancels_requests.mjs
+//
+// Task 1003660: closing a goal (achieved / archived) cancels its pending invites
+// and join-requests, so a stale row leaves the inbox instead of waiting to be
+// refused at accept time. DB-free: a SQL-aware fake records the statements.
+//
+// Run:  node tests/goal_close_cancels_requests.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { setGoalStatus } = require('../modules/lifecycle/db-goals.js');
+const { cancelPendingMembershipRequests } = require('../modules/lifecycle/goal-close-sweep.js');
+
+const { test, summary } = makeRunner();
+
+function fakePool(handler) {
+  const c = makeSqlAwareClient(handler);
+  return { query: (sql, params) => c._client.query(sql, params), connect: c.connect, queries: c._client.queries };
+}
+const norm = (q) => String(q.sql).replace(/\s+/g, ' ');
+const sweeps = (pool) => pool.queries.filter((q) => /^UPDATE goal_membership_requests/.test(norm(q)));
+const goalRow = (status) => ({ id: 7, status });
+const flip = (status) => (s) => (/^UPDATE goals/.test(s) ? { rows: [goalRow(status)] } : null);
+
+await test('cancelPendingMembershipRequests: cancels BOTH kinds, pending only, for the given goals', async () => {
+  const pool = fakePool(() => ({ rows: [], rowCount: 2 }));
+  const n = await cancelPendingMembershipRequests(pool, [7, '8']);
+  assert.equal(n, 2);
+  const [q] = sweeps(pool);
+  assert.match(norm(q), /SET status = 'cancelled'/);
+  assert.match(norm(q), /status = 'pending'/);
+  assert.doesNotMatch(norm(q), /kind\s*=/, 'neither the invite nor the request arm is excluded');
+  assert.deepEqual(q.params, [[7, 8]]);
+});
+
+await test('cancelPendingMembershipRequests: no ids → no statement', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  assert.equal(await cancelPendingMembershipRequests(pool, []), 0);
+  assert.equal(await cancelPendingMembershipRequests(pool, null), 0);
+  assert.equal(pool.queries.length, 0);
+});
+
+for (const status of ['achieved', 'archived']) {
+  await test(`setGoalStatus(${status}) sweeps the goal's pending requests`, async () => {
+    const pool = fakePool(flip(status));
+    await setGoalStatus({ goalId: 7, status }, { pool });
+    assert.equal(sweeps(pool).length, 1);
+    assert.deepEqual(sweeps(pool)[0].params, [[7]]);
+  });
+}
+
+await test('setGoalStatus(open) — a reopen — sweeps nothing', async () => {
+  const pool = fakePool(flip('open'));
+  await setGoalStatus({ goalId: 7, status: 'open' }, { pool });
+  assert.equal(sweeps(pool).length, 0);
+});
+
+await test('setGoalStatus on an unknown goal sweeps nothing', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  await setGoalStatus({ goalId: 99, status: 'archived' }, { pool });
+  assert.equal(sweeps(pool).length, 0);
+});
+
+await test('every in-module writer that archives or achieves a goal also sweeps', async () => {
+  const { readFileSync } = await import('node:fs');
+  const read = (f) => readFileSync(new URL(`../modules/lifecycle/${f}`, import.meta.url), 'utf8');
+  const count = (s, re) => (s.match(re) || []).length;
+  const closes = /status = 'archived'|status = 'achieved'/g;
+  for (const f of ['db-goals.js', 'db-versions.js', 'done-when.js']) {
+    const src = read(f);
+    // setGoalStatus takes the status as a parameter (covered above); every
+    // literal close in these files must have a sweep call.
+    assert.ok(count(src, /cancelPendingMembershipRequests\(/g) >= count(src, closes),
+      `${f}: each literal goal close needs a cancelPendingMembershipRequests call`);
+  }
+});
+
+summary();

package/tests/goal_closure_invariants.mjs

@@ -256,10 +256,13 @@ test('every statement goes through the caller exec — none reaches the module p
   // nothing reaches the module pool — is exactly what makes auto-close correct on
   // a ship: the goal it keys on was flipped in this uncommitted transaction, and
   // a pool read would not see it.
-  assert.equal(exec.calls.length, 3, 'the criterion close, the cascade and the version auto-close, all on exec');
+  // Task 1003660 added a fourth: the sweep of the achieved goal's pending
+  // invites/requests, between the cascade and the version auto-close.
+  assert.equal(exec.calls.length, 4, 'the criterion close, the cascade, the request sweep and the version auto-close, all on exec');
   assert.match(exec.calls[0].sql, /UPDATE done_when_criteria/);
   assert.match(exec.calls[1].sql, /UPDATE goals g/);
-  assert.match(exec.calls[2].sql, /UPDATE versions v/);
+  assert.match(exec.calls[2].sql, /UPDATE goal_membership_requests/);
+  assert.match(exec.calls[3].sql, /UPDATE versions v/);
 });
 
 // ---------------------------------------------------------------------------