@bongos/core 1.21.112 → 1.21.114

package/scripts/hall-preview/scrub-identity.js

@@ -30,7 +30,10 @@
 // NOT TOUCHED. Instance-local numeric ids (builder, task, goal) — the harness routes on
 // them (analytics/builder/:id, /profile?id=…) and they name nobody outside that one
 // instance. Free text (task titles, descriptions) — project content, not a person's
-// record. The repo's own coordinates (instance.repo.owner is where the code lives).
+// record — EXCEPT where it names a person the run has already met in a field: a
+// snapshot run ends with createTextScrubber (task 1004685, below), which replaces
+// those people inside prose too. The repo's own coordinates (instance.repo.owner is
+// where the code lives).
 //
 // FIXED POINT. Every stand-in is recognised on the way back in (`builder-3` is person
 // 3), so scrubbing an already-scrubbed fixture changes nothing. tests/hall_preview_scrub.mjs
@@ -69,8 +72,13 @@ const isByKey = (k) => k === 'by' || /_by$/.test(k);
 // login. Task 1004531: the constitution fixture carries that table. Only on a
 // table ROW (it names its building in `area`), so a login that happens to be one
 // of the three words anywhere else is still scrubbed.
+// The live docket carries the same word on each building's `decision` (task 1004685),
+// which names its rule rather than its area: { rule: 'decide', decided_by: 'gate' }.
+// Scrubbed as a login there, "gate" and "board" became stand-ins and the prose pass
+// then rewrote every "stealth gate" and "Board Room" in the snapshot.
 const DECISION_WORDS = new Set(['gate', 'board', 'nobody']);
-const isDecisionWord = (k, v, obj) => k === 'decided_by' && DECISION_WORDS.has(v) && !!obj && typeof obj.area === 'string';
+const isDecisionWord = (k, v, obj) => k === 'decided_by' && DECISION_WORDS.has(v) && !!obj
+  && (typeof obj.area === 'string' || typeof obj.rule === 'string');
 const looksLikeLogin = (v) => /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(v) && !/^\d+$/.test(v);
 
 // The login a name-shaped key belongs to, or undefined when the key is not a person's
@@ -88,9 +96,27 @@ function nameOwnerKey(key, obj) {
 // createScrubber — one registry of people for one run, so a builder gets the same n in
 // every file the run touches. `firstNumber` lets a run start above stand-ins already on
 // disk, so a new person never collides with one a hand-written fixture already uses.
-function createScrubber({ firstNumber = 1 } = {}) {
+//
+// `seed` (task 1004685) is people whose stand-in is already fixed on disk —
+// [{ login, name, n }], which refresh-fixtures.js reads off the committed roster by
+// builder id — so a re-run keeps every builder's number instead of renumbering the
+// whole snapshot, and a file added to the run lines up with the ones already there.
+function createScrubber({ firstNumber = 1, seed = [] } = {}) {
   const people = new Map(); // 'login:<lower>' | 'name:<text>' | 'id:<github id>' | 'email:<lower>' → n
+  // A login as it was written (the registry keys it lowercased), for the free-text
+  // pass: `samRiverStone` shows where a first name ends, `samriverstone` does not.
+  const spelled = new Map();
+  const loginKeyOf = (v) => { spelled.set(v.toLowerCase(), v); return `login:${v.toLowerCase()}`; };
   let next = Math.max(1, Number(firstNumber) || 1);
+  for (const p of Array.isArray(seed) ? seed : []) {
+    const n = Number(p && p.n);
+    if (!Number.isInteger(n) || n <= 0) continue;
+    const login = typeof p.login === 'string' && p.login && !STAND_IN_LOGIN.test(p.login) ? p.login : '';
+    const name = typeof p.name === 'string' && p.name && !STAND_IN_NAME.test(p.name) ? p.name : '';
+    if (login || name) people.set(login ? loginKeyOf(login) : `name:${name}`, n);
+    if (login && name) people.set(`name:${name}`, n);
+    if ((login || name) && n >= next) next = n + 1;
+  }
 
   function numberFor(keys) {
     for (const k of keys) if (k && people.has(k)) return remember(keys, people.get(k));
@@ -109,7 +135,7 @@ function createScrubber({ firstNumber = 1 } = {}) {
     const name = nameKey && typeof obj[nameKey] === 'string' ? obj[nameKey] : '';
     const standIn = STAND_IN_LOGIN.exec(login) || STAND_IN_NAME.exec(name);
     if (standIn) return remember([], Number(standIn[1]));
-    return numberFor([login && `login:${login.toLowerCase()}`, name && `name:${name}`]);
+    return numberFor([login && loginKeyOf(login), name && `name:${name}`]);
   }
 
   function scrubObject(obj, ctx) {
@@ -169,13 +195,13 @@ function createScrubber({ firstNumber = 1 } = {}) {
       }
       if (isByKey(key) && looksLikeLogin(value) && !isDecisionWord(key, value, obj)) {
         if (STAND_IN_LOGIN.test(value)) return value;
-        return `builder-${numberFor([`login:${value.toLowerCase()}`])}`;
+        return `builder-${numberFor([loginKeyOf(value)])}`;
       }
       // A PR / commit author is a GitHub login; elsewhere `author` credits an
       // organisation (a module's author), which is nobody's personal record.
       if (key === 'author' && 'head_sha' in obj && looksLikeLogin(value)) {
         if (STAND_IN_LOGIN.test(value)) return value;
-        return `builder-${numberFor([`login:${value.toLowerCase()}`])}`;
+        return `builder-${numberFor([loginKeyOf(value)])}`;
       }
       if (key in PLACEHOLDER_TEXT) return PLACEHOLDER_TEXT[key];
       if (isGithubIdKey(key)) return String(githubIdFor(obj, value, self, isPersonRecord));
@@ -225,7 +251,326 @@ function createScrubber({ firstNumber = 1 } = {}) {
     return data && typeof data === 'object' ? scrubObject(data, ctx) : data;
   }
 
-  return { scrub };
+  // knownPeople — every REAL login and name this run has met in a structured field,
+  // with its stand-in n, for the free-text pass (createTextScrubber below). Logins come
+  // back as they were written. Stand-ins are not listed: a fixture already on disk
+  // teaches the registry nothing real.
+  function knownPeople() {
+    const logins = [];
+    const names = [];
+    for (const [key, n] of people) {
+      if (key.startsWith('login:')) {
+        const lower = key.slice('login:'.length);
+        logins.push({ login: spelled.get(lower) || lower, n });
+      } else if (key.startsWith('name:')) names.push({ name: key.slice('name:'.length), n });
+    }
+    return { logins, names };
+  }
+
+  return { scrub, knownPeople };
+}
+
+// ---------- free text (task 1004685) ----------
+// The structured pass above replaces a person wherever a FIELD names them. Prose is
+// left alone by design (task titles and descriptions are project content), but the
+// governor docket carries prose that names people outright: "From <login>'s
+// feedback", "Owner: tell <login> their project was torn down", "<name>: stop runner".
+// So a snapshot run ends with one more pass over every string, replacing the people
+// the run has already met: by login, by display name, by the first name a login
+// visibly starts with (`alex42`, `AlexCode` → Alex; `willRiverStone` → Will), by a
+// capitalised word a login starts with (`bobbytabl` → "Bobby", "Bobby Tables"), and by a
+// capitalised nickname cut from the end of an all-caps login. It only ever knows
+// people a structured field named; it cannot recognise a stranger in a sentence,
+// which is why the structured pass still comes first.
+//
+// Kept on purpose: the repo's own coordinates (`github.com/<owner>/<repo>` and the
+// manifest's `repo.owner`), exactly as the structured pass keeps them.
+//
+// A name that is also a common English word ("will") is replaced only where it is
+// written as a name (capitalised), so "the agent will stop" survives the pass.
+const COMMON_WORD_NAMES = new Set([
+  'will', 'mark', 'max', 'may', 'bill', 'art', 'grant', 'rob', 'pat', 'sue', 'jack', 'don', 'ray', 'rose',
+  'dawn', 'hope', 'joy', 'faith', 'grace', 'sky', 'king', 'frank', 'miles', 'chase', 'hunter', 'summer',
+  'june', 'april', 'august', 'eve', 'cliff', 'glen', 'dean', 'victor', 'sam', 'nick', 'drew', 'lane',
+]);
+// Capitalised words a login may start with that are not first names ("Large files…"
+// is not `largefellow-x`). Only the start-of-login rule consults it.
+const NOT_A_NAME = new Set([
+  'large', 'small', 'open', 'code', 'data', 'super', 'mega', 'cloud', 'home', 'build', 'test', 'team',
+  'labs', 'online', 'master', 'admin', 'user', 'real', 'other', 'scoot', 'mack', 'kind', 'line',
+]);
+// a system account (`discord-bot-system`) is nobody, and its "first name" is a product
+const SYSTEM_ACCOUNT = /(^|-)(system|bot)(-|$)|\(system\)/i;
+const EMAIL_IN_TEXT = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+const KEEP_EMAIL = /^(git|noreply|no-reply)@|@example\.(com|org)$/i;
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const titleCase = (s) => s[0].toUpperCase() + s.slice(1);
+
+// The first name a login starts with, when the login shows where it ends: a digit,
+// a hyphen or a camelCase step, after at least three letters. An all-lowercase login
+// with no boundary (`jpetersen`) shows no first name, so none is guessed.
+function firstNameOf(login) {
+  if (SYSTEM_ACCOUNT.test(login)) return null;
+  const m = /^([A-Z]?[a-z]{2,})(?=[A-Z0-9_-])/.exec(login);
+  return m ? m[1].toLowerCase() : null;
+}
+
+// createTextScrubber(known) → (data) => a deep copy with the known people replaced in
+// every string. `known` is a scrubber's knownPeople(). A login is replaced by its
+// login-shaped stand-in (`builder-3`), a name by its name-shaped one (`Builder 3`),
+// and a first name by whichever shape it was written in.
+function createTextScrubber({ logins = [], names = [] } = {}) {
+  const rules = []; // { re, len, to }, applied longest needle first
+  const add = (needle, n, { caseless, shape }) => {
+    // a decision word is vocabulary, whatever field once mistook it for a login
+    if (!needle || needle.length < 3 || DECISION_WORDS.has(needle.toLowerCase())) return;
+    // never inside a longer word, never the owner segment of a GitHub URL
+    const re = new RegExp(`(?<![A-Za-z0-9_-])(?<!github\\.com/)${escapeRe(needle)}(?![A-Za-z0-9_-])`, caseless ? 'gi' : 'g');
+    const to = shape === 'login' ? () => `builder-${n}`
+      : shape === 'name' ? () => `Builder ${n}`
+        : (hit) => (/^[A-Z]/.test(hit) ? `Builder ${n}` : `builder-${n}`);
+    rules.push({ re, len: needle.length, to });
+  };
+  // a nickname or a first name that is a common word only ever counts capitalised
+  const addWord = (word, n, shape) => {
+    if (COMMON_WORD_NAMES.has(word.toLowerCase())) add(titleCase(word.toLowerCase()), n, { caseless: false, shape: shape === 'login' ? 'name' : shape });
+    else add(word, n, { caseless: true, shape });
+  };
+  const capsLogins = [];
+  const prefixLogins = [];
+  for (const { login, n } of logins) {
+    if (!login || STAND_IN_LOGIN.test(login)) continue;
+    if (!SYSTEM_ACCOUNT.test(login)) prefixLogins.push({ lower: login.toLowerCase(), n });
+    addWord(login, n, 'login');
+    const first = firstNameOf(login);
+    if (first && first !== login.toLowerCase()) addWord(first, n, 'first');
+    if (/^[A-Z0-9]{8,}$/.test(login) && /[A-Z]{6,}/.test(login)) capsLogins.push({ lower: login.toLowerCase(), n });
+  }
+  for (const { name, n } of names) {
+    if (!name || STAND_IN_NAME.test(name) || SYSTEM_ACCOUNT.test(name)) continue;
+    if (name.length >= 4 && !COMMON_WORD_NAMES.has(name.toLowerCase())) add(name, n, { caseless: false, shape: 'name' });
+    const parts = name.split(/\s+/);
+    if (parts.length > 1 && /^[A-Z][a-z]{2,}$/.test(parts[0]) && !COMMON_WORD_NAMES.has(parts[0].toLowerCase())) add(parts[0], n, { caseless: false, shape: 'name' });
+  }
+  rules.sort((a, b) => b.len - a.len);
+
+  function text(s) {
+    let out = s;
+    for (const r of rules) out = out.replace(r.re, r.to);
+    // a capitalised first name a login starts with but does not mark off (`bobbytabl`
+    // → "Bobby", "Bobby Tables"), taking a capitalised surname with it
+    if (prefixLogins.length) {
+      out = out.replace(/(?<![A-Za-z0-9_-])([A-Z][a-z]{3,})(\s[A-Z][a-z]+)?(?![A-Za-z0-9_-])/g, (whole, w, surname) => {
+        const lower = w.toLowerCase();
+        if (COMMON_WORD_NAMES.has(lower) || NOT_A_NAME.has(lower)) return whole;
+        const hit = prefixLogins.find((p) => p.lower.startsWith(lower) && p.lower.length >= lower.length + 2);
+        return hit ? `Builder ${hit.n}` : whole;
+      });
+    }
+    // a capitalised nickname cut from the end of an all-caps login (IAMSOMEONE → "Someone")
+    if (capsLogins.length) {
+      out = out.replace(/(?<![A-Za-z0-9_-])[A-Z][a-z]{5,}(?![A-Za-z0-9_-])/g, (w) => {
+        const hit = capsLogins.find((c) => c.lower.endsWith(w.toLowerCase()) && c.lower !== w.toLowerCase());
+        return hit ? `Builder ${hit.n}` : w;
+      });
+    }
+    return out.replace(EMAIL_IN_TEXT, (e) => (KEEP_EMAIL.test(e) ? e : 'builder@example.com'));
+  }
+  function walk(v, key, parent) {
+    if (typeof v === 'string') {
+      // the manifest's repo coordinates stay, as the structured pass keeps them
+      if (key === 'owner' && parent && typeof parent.repo === 'string') return v;
+      return text(v);
+    }
+    if (Array.isArray(v)) return v.map((x) => walk(x, null, v));
+    if (v && typeof v === 'object') {
+      const out = {};
+      for (const [k, val] of Object.entries(v)) out[k] = walk(val, k, v);
+      return out;
+    }
+    return v;
+  }
+  return (data) => walk(data, null, null);
+}
+
+// ---------- security content (task 1004685, after its security review) ----------
+// People are not the only thing a live snapshot must not commit. The governor
+// docket is read at a rank floor, and it carries the project's open red-team
+// reports (file and line references, exploit chains, proofs of concept) and the
+// owner's blockers (host config diffs, recovery runbooks naming a bot token). A
+// committed fixture hands all of that to anyone with read access to the repo. So
+// every snapshot run, and --scrub-only, ends with a structural pass:
+//
+//   • A RED-TEAM RECORD (source redteam_reports, a vulnerability/security-report
+//     ref, an id like `redteam_reports:N`, a "Security report:" title, a
+//     `repro_steps` field) keeps only REPORT_KEYS — id, state, severity bucket,
+//     where it stands, its acts — and its title becomes REPORT_TITLE. Every other
+//     field (detail, body, repro, target, proposer, facts…) is dropped.
+//   • A BLOCKER (source blockers, a blocker ref, a `blocking_task_ids` row) loses
+//     every body field, and keeps its title only when the title itself names no
+//     secret, config, path, token or customer instance.
+//   • The SECURITY BACKLOG — a task flagged security_sensitive or belonging to a
+//     goal of category `security` — keeps its shape but not its words: the title
+//     becomes TASK_TITLE and its description, summary and touched paths go; the
+//     security goal itself keeps its title and loses its description.
+//   • ANY other record: a prose field (description, detail, body, summary…) that
+//     names one is emptied, and a title that does becomes ITEM_TITLE.
+//   • A customer instance's own domain (any host not on PUBLIC_DOMAINS) becomes
+//     `instance.example`, and its bare name, wherever else it appears, `instance-name`.
+//
+// Over-redaction is the safe failure here: a withheld title costs a preview its
+// colour; a leaked one cannot be taken back.
+const REPORT_TITLE = 'Security report — details withheld';
+const BLOCKER_TITLE = 'Blocker — details withheld';
+const ITEM_TITLE = 'Details withheld';
+const TASK_TITLE = 'Security task — details withheld';
+const REPORT_KEYS = new Set([
+  'id', 'source', 'building', 'rule', 'state', 'status', 'severity', 'short', 'where', 'desk', 'fact',
+  'opened_at', 'created_at', 'closed_at', 'at', 'deadline', 'outcome', 'tally', 'href', 'ref', 'acts',
+  'needs', 'tool', 'over', 'kind', 'label', 'count',
+  // a stored ask's card for a report (task 1004703; its words are walked like any prose)
+  'question', 'options', 'recommend', 'waits_on', 'if_nobody_answers', 'routing_note', 'raw',
+  // who it waits on, as the docket routes it (task 1004705): a seat, never the report's words
+  'route',
+]);
+const TITLE_KEYS = new Set(['title', 'name', 'subject']);
+const PROSE_KEYS = new Set([
+  'description', 'detail', 'details', 'body', 'body_md', 'summary', 'value_summary', 'notes', 'note',
+  'repro', 'repro_steps', 'impact', 'target', 'rationale_md', 'resolution_note', 'triage_note',
+  'paused_reason', 'owner_paused_reason', 'reason', 'criterion_md', 'line', 'lines', 'facts', 'fact', 'text', 'tags',
+]);
+const BLOCKER_BODY_KEYS = new Set(['body', 'body_md', 'notes', 'note', 'details', 'detail', 'description', 'resolution_note', 'steps', 'facts']);
+// What a security write-up, a host runbook or a credential looks like in prose: the
+// SPECIFIC marks of one (exploit and proof-of-concept talk, host config and paths,
+// a named credential, the code identifiers a live report points at, a customer's
+// project or instance). Plain words such as "security" or "token reward" are not
+// on it, so ordinary project prose is left alone; a red-team record itself is caught
+// by its shape (isReportRecord), not by its words.
+const SENSITIVE_TEXT = new RegExp([
+  'exploit', '\\bPoC\\b', 'proof[- ]of[- ]concept', '\\brepro_steps\\b', '\\bCVE-\\d', 'privilege escalation',
+  'frame-ancestors', 'X-Frame-Options', 'Content-Security-Policy', '\\bCaddy', '\\bnginx\\b', 'systemctl', '\\bsudo\\b',
+  '/etc/', '/home/', 'WorkingDirectory=', '\\bweb\\.env\\b', '\\bbot token', '\\b(api|bearer|access|personal access|deploy) token\\b',
+  '\\bapi[ _-]?key\\b', 'private key', 'secret key', '\\b(credential|password|secret)s? (is |are |still )*(live|in git|leaked|exposed)',
+  'committed_files', 'auth-idp', 'serverSideGuards', 'verifyHubAssertion', 'GRADER_BYPASS', 'reconcile-on-read',
+  '\\bproject [a-z0-9]+(?:-[a-z0-9]+)+\\b', '\\binstance \\d+\\b',
+].join('|'), 'i');
+// Domains that name a public service or the platform itself, never a customer.
+const PUBLIC_DOMAINS = [
+  'example.com', 'example.org', 'example.net', 'github.com', 'githubusercontent.com', 'cloudbongos.com', 'claude.ai',
+  'claude.com', 'anthropic.com', 'discord.com', 'discordapp.com', 'discordapp.net', 'w3.org', 'google.com',
+  'googleapis.com', 'gstatic.com', 'onrender.com', 'npmjs.com', 'npmjs.org', 'nodejs.org', 'cloudflare.com', 'shields.io',
+];
+const HOST_IN_TEXT = /\b((?:[a-z0-9-]+\.)*)([a-z0-9-]+)\.(com|net|org|io|app|dev|co|ai|xyz|cloud|site|tech)\b/gi;
+const isPublicDomain = (base) => PUBLIC_DOMAINS.some((d) => base === d || base.endsWith('.' + d));
+
+function isReportRecord(o) {
+  const ref = o.ref && typeof o.ref === 'object' ? o.ref : null;
+  return /^(redteam_reports?|security_reports?|vulnerability_reports?)$/.test(String(o.source || ''))
+    || (!!ref && /vulnerab|red_?team|security_report/i.test(String(ref.type || '')))
+    || (typeof o.id === 'string' && /^(redteam_reports?|security_reports?|vulnerability_reports?):/.test(o.id))
+    || /^security report\b/i.test(String(o.title || o.name || ''))
+    || 'repro_steps' in o
+    || /red_?team|vulnerab|security_report/i.test(String(o.kind || ''));
+}
+function isBlockerRecord(o) {
+  const ref = o.ref && typeof o.ref === 'object' ? o.ref : null;
+  return String(o.source || '') === 'blockers' || (!!ref && String(ref.type || '') === 'blocker')
+    || Array.isArray(o.blocking_task_ids) || (typeof o.id === 'string' && /^blockers:/.test(o.id));
+}
+
+// The customer instances a set of fixtures names: the registrable label of every
+// host not on PUBLIC_DOMAINS (`builders.someone.com` → `someone`).
+function instanceNamesIn(values) {
+  const names = new Set();
+  const visit = (v) => {
+    if (typeof v === 'string') {
+      for (const m of v.matchAll(HOST_IN_TEXT)) {
+        const base = `${m[2]}.${m[3]}`.toLowerCase();
+        if (!isPublicDomain(base) && m[2].length >= 4) names.add(m[2].toLowerCase());
+      }
+    } else if (Array.isArray(v)) v.forEach(visit);
+    else if (v && typeof v === 'object') Object.values(v).forEach(visit);
+  };
+  values.forEach(visit);
+  return [...names];
+}
+
+// The goals whose work IS the security backlog (category `security`): their tasks
+// describe open findings in their titles, so they are withheld by shape too.
+function securityGoalIdsIn(values) {
+  const ids = new Set();
+  const visit = (v) => {
+    if (Array.isArray(v)) v.forEach(visit);
+    else if (v && typeof v === 'object') {
+      if (v.id != null && v.category && typeof v.category === 'object' && v.category.slug === 'security' && 'scope_modules' in v) ids.add(String(v.id));
+      Object.values(v).forEach(visit);
+    }
+  };
+  values.forEach(visit);
+  return [...ids];
+}
+
+// A task (it has a goal and a title) that belongs to the security backlog or is
+// flagged security-sensitive.
+const TASK_PROSE_KEYS = new Set(['description', 'value_summary', 'touches', 'next_ready_title']);
+function isSecurityTask(o, securityGoals) {
+  if (!('title' in o) || !('goal_id' in o || 'security_sensitive' in o)) return false;
+  return o.security_sensitive === true || (o.goal_id != null && securityGoals.has(String(o.goal_id)));
+}
+
+// createSecurityRedactor({ instanceNames, securityGoals }) → (data) => a redacted deep copy.
+function createSecurityRedactor({ instanceNames = [], securityGoals = [] } = {}) {
+  const secGoals = new Set(securityGoals.map(String));
+  const bare = instanceNames.length
+    ? new RegExp(`(?<![A-Za-z0-9_])(${instanceNames.map(escapeRe).join('|')})(?![A-Za-z0-9_])`, 'gi')
+    : null;
+  const deDomain = (s) => {
+    let out = s.replace(HOST_IN_TEXT, (host, subs, label, tld) => (isPublicDomain(`${label}.${tld}`.toLowerCase()) ? host : `${subs}instance.example`));
+    if (bare) out = out.replace(bare, 'instance-name');
+    return out;
+  };
+  const sensitive = (v) => typeof v === 'string' ? SENSITIVE_TEXT.test(v)
+    : Array.isArray(v) ? v.some(sensitive) : (v && typeof v === 'object') ? Object.values(v).some(sensitive) : false;
+
+  function walk(v, key, parent) {
+    if (typeof v === 'string') {
+      if (key === 'owner' && parent && typeof parent.repo === 'string') return v; // the repo's coordinates
+      return deDomain(v);
+    }
+    if (Array.isArray(v)) return v.map((x) => walk(x, null, v));
+    if (!v || typeof v !== 'object') return v;
+    if (isReportRecord(v)) {
+      const out = {};
+      for (const [k, val] of Object.entries(v)) {
+        if (TITLE_KEYS.has(k) && typeof val === 'string') out[k] = REPORT_TITLE;
+        else if (REPORT_KEYS.has(k)) out[k] = walk(val, k, v);
+      }
+      return out;
+    }
+    const blocker = isBlockerRecord(v);
+    const secTask = !blocker && isSecurityTask(v, secGoals);
+    const secGoal = v.id != null && 'scope_modules' in v && secGoals.has(String(v.id));
+    const out = {};
+    for (const [k, val] of Object.entries(v)) {
+      if (blocker && BLOCKER_BODY_KEYS.has(k)) continue;
+      if (secGoal && k === 'description') { out[k] = ''; continue; }
+      if (secTask && k === 'title') { out[k] = TASK_TITLE; continue; }
+      if (secTask && TASK_PROSE_KEYS.has(k)) { out[k] = Array.isArray(val) ? [] : typeof val === 'string' ? '' : null; continue; }
+      if (TITLE_KEYS.has(k) && typeof val === 'string' && sensitive(val)) {
+        out[k] = blocker ? BLOCKER_TITLE : ITEM_TITLE;
+      } else if (PROSE_KEYS.has(k) && sensitive(val)) {
+        out[k] = Array.isArray(val) ? [] : typeof val === 'string' ? '' : null;
+      } else out[k] = walk(val, k, v);
+    }
+    return out;
+  }
+  return (data) => walk(data, null, null);
+}
+
+// securityRedactorFor(values) — a redactor that has learned, from every value it
+// will be applied to, the customer instances they name and the security goals.
+function securityRedactorFor(values) {
+  return createSecurityRedactor({ instanceNames: instanceNamesIn(values), securityGoals: securityGoalIdsIn(values) });
 }
 
 // A fixture named `me` or `me__…` is the snapshotting account's own record.
@@ -297,6 +642,20 @@ function rewriteScalars(text, next) {
 
 module.exports = {
   createScrubber,
+  createTextScrubber,
+  createSecurityRedactor,
+  instanceNamesIn,
+  securityGoalIdsIn,
+  securityRedactorFor,
+  TASK_TITLE,
+  isReportRecord,
+  isBlockerRecord,
+  REPORT_KEYS,
+  TITLE_KEYS,
+  REPORT_TITLE,
+  BLOCKER_TITLE,
+  ITEM_TITLE,
+  SENSITIVE_TEXT,
   isOwnAccountFixture,
   highestStandIn,
   rewriteScalars,

package/scripts/hall-preview/server.js

@@ -81,6 +81,9 @@ const { injectBrandingGlobal, mountInternalSurfaces, injectModuleHallWidgets } =
 const { hallWidgetScripts } = require(path.join(ROOT, 'src', 'module-loader', 'loader.js'));
 const { clientModules } = require(path.join(ROOT, 'src', 'modules.js'));
 const { overrideKey, resolveLiveIdentity } = require('./live-identity');
+// task 1004685: the per-builder pref PATCHes, answered by the real shapers in memory.
+const { createPrefRecorder, readJsonBody } = require('./pref-writes');
+const PREFS = createPrefRecorder();
 
 // The session is the ONE thing this harness reads from outside its own tree, and
 // it reads it through the FAIL-OPEN helper on purpose: apiCall/cliClient exit the
@@ -247,7 +250,20 @@ function emptied(v) {
 // case that needs it (task 1003281) is the profile activity log, where the ROW
 // SHAPE is chosen by ?section=, not by the path, so one fixture per path would
 // render goal rows into the tasks ledger.
+// ONE PATH, TWO READS (task 1004685). /tasks with no status is the ready list the
+// goal pages read (tasks.json); /tasks?status=active is the work being built, which
+// the living city counts as agents on the move. Query strings are otherwise ignored,
+// so a read that differs only by query names its fixture here, ahead of the exact match.
+const QUERY_FIXTURES = [
+  [/^tasks$/, (q) => (q.status === 'active' ? 'tasks__status-active' : null)],
+];
+
 function fixtureFor(apiPath, query = {}) {
+  for (const [re, pick] of QUERY_FIXTURES) {
+    const name = re.test(apiPath) ? pick(query) : null;
+    const hit = name && loadFixture(name);
+    if (hit !== undefined && hit !== null) return hit;
+  }
   const exact = loadFixture(apiPath.replace(/\//g, '__'));
   if (exact !== undefined) return exact;
   for (const [re, name] of FIXTURE_FALLBACKS) {
@@ -330,6 +346,16 @@ app.use((req, res, next) => {
   const READ_SHAPED_POSTS = new Set([
     'inbox/preview-landing', // the landing verdict for a draft (task 1004083)
   ]);
+  // task 1004685: RECORDED WRITES (pref-writes.js) — the five /me/* pref PATCHes get
+  // the real route's answer from the real shapers, and the state rides later reads.
+  if (PREFS.handles(req.method, apiPath)) {
+    return readJsonBody(req).then((body) => {
+      if (body === null) return res.status(400).json({ error: { code: 'bad_json', message: 'the body is not JSON' } });
+      const me = liveOverrides.get('me') ?? fixtureFor('me');
+      const r = PREFS.write(apiPath, body, { me: RANK_OVERRIDE && me && me.builder ? { ...me, builder: { ...me.builder, rank: RANK_OVERRIDE } } : me, skillFixture: fixtureFor('me/skill-prefs') });
+      return res.status(r.status).json(r.body);
+    });
+  }
   const canned = CANNED_WRITES.find(([method, re]) => method === req.method && re.test(apiPath));
   if (canned) {
     const hit = loadFixture(canned[2]);
@@ -353,7 +379,7 @@ app.use((req, res, next) => {
     if (payload.builder) payload.builder.rank = RANK_OVERRIDE;
     else if ('rank' in payload) payload.rank = RANK_OVERRIDE;
   }
-  res.json(payload);
+  res.json(PREFS.overlay(apiPath, payload));
 });
 
 // The hall pages, pre-auth-gate, through the real seams: boot-time stamped

package/scripts/render-diagrams.sh

@@ -79,8 +79,10 @@ for src in "${SOURCES[@]}"; do
   png="${src%.mmd}.png"
   echo "render-diagrams: $src -> $svg + $png"
   # SVG first (vector, scale-independent — the interactive viewer's primary
-  # asset), then PNG at 2x (the static fallback). White background so both read
-  # correctly on the parchment page and don't show through as transparent.
+  # asset), then PNG at 2x (the static fallback). White background so an
+  # external embed never shows through as transparent. The hall drops the SVG's
+  # white and, in dark, inverts both (task 1003639) — ONE light render serves
+  # both themes, so do not add a second, dark render here.
   "${MMDC[@]}" -i "$src" -o "$svg" -b white "${CONFIG_ARGS[@]}" >/dev/null 2>&1
   "${MMDC[@]}" -i "$src" -o "$png" -s 2 -b white "${CONFIG_ARGS[@]}" >/dev/null 2>&1
 done

package/src/bongos/auth-idp.js

@@ -272,11 +272,16 @@ function applicationVouchIdentity(token, { githubLogin, publicKey, clientId, now
   try {
     payload = verifyHubApplicationVouch(token, { publicKey, clientId, nowMs });
   } catch (err) {
-    log.info({ reason: err.message }, 'application vouch not accepted — the request is written unvouched');
+    // debug, not info: this runs on the PUBLIC unauthenticated POST /access-requests,
+    // so anyone with a garbage header can trigger the line.
+    log.debug({ reason: err.message }, 'application vouch not accepted — the request is written unvouched');
     return null;
   }
   // The body's login is a string anyone may type: a vouch for another account is no vouch.
   if (String(payload.applicant_login).toLowerCase() !== String(githubLogin || '').toLowerCase()) return null;
+  // The hub mints only for a numeric GitHub id; anything else is not one, and the id
+  // feeds readApplicantProfileFromHub (defence in depth, the ADR 0171 D2 guard).
+  if (!/^\d+$/.test(String(payload.sub))) return null;
   if (vouchJtiSeenAndRecord(payload.jti, payload.exp, nowMs)) return null;
   return {
     githubId: String(payload.sub),

package/src/bongos/project-settings.js

@@ -52,6 +52,7 @@ const SETTING_KEYS = {
   SHIP_MODE: 'ship.mode',
   TWEAK_AUTOPICKUP: 'tweak.autopickup',
   TWEAK_AUTOPICKUP_CAP: 'tweak.autopickup_monthly_cap',
+  SPEND_CAP: 'treasury.spend_cap_usd',
 };
 
 // SHIP MODE (task 1004628, ADR 0369) — WHO starts a ship, never HOW it lands.
@@ -349,6 +350,41 @@ function describeTweakAutopickup(resolved) {
   return `On: a running Autobongos runner applies submitted pages on its own, up to ${r.cap} a month. The artist still approves every one.`;
 }
 
+// THE SPEND CAP (task 1004712, ADR 0379). The owner's ruling: there is NO spend
+// limit by default. A cap is an optional project setting, OFF until someone sets
+// it — no row means off, and clearing it deletes the row, so "never set" and
+// "cleared" are the same state (the getSetting null-is-meaningful rule). The
+// treasury (modules/government/treasury.js) reads it: with a cap on, a month past
+// it is said so and a new loan is recommended against. It never stops work.
+const MAX_SPEND_CAP_USD = 1000000;
+function parseSpendCap(raw) {
+  if (raw == null || raw === '') return { reason: 'empty' };
+  const n = Number(raw);
+  if (!Number.isFinite(n)) return { reason: 'not a number' };
+  if (n <= 0) return { reason: 'must be more than $0; clear the cap to turn it off' };
+  if (n > MAX_SPEND_CAP_USD) return { reason: `out of range (1..${MAX_SPEND_CAP_USD})` };
+  return { usd: Math.round(n * 100) / 100 };
+}
+// resolveSpendCap() — { on, usd, source, invalid }. Off (usd null) unless a usable
+// value is stored; an unreadable database answers off, the reporting posture.
+async function resolveSpendCap() {
+  const r = await resolveOne(SETTING_KEYS.SPEND_CAP, parseSpendCap, (g) => g.usd, null);
+  return { on: r.value != null, usd: r.value, source: r.source, invalid: r.invalid };
+}
+// setSpendCap(usd, builderId) — set it, or turn it off with null.
+async function setSpendCap(usd, builderId = null) {
+  if (usd == null || usd === '') {
+    await pool.query('DELETE FROM project_settings WHERE key = $1', [SETTING_KEYS.SPEND_CAP]);
+    logger.info(`project spend cap turned off by builder ${builderId == null ? 'unknown' : builderId}`);
+    return null;
+  }
+  return setSetting(SETTING_KEYS.SPEND_CAP, usd, builderId);
+}
+function describeSpendCap(resolved) {
+  const r = resolved || {};
+  return r.on ? `On: the treasury holds each month to $${Math.round(r.usd)}. Work is never stopped by it.` : 'Off: there is no spend limit. This is the default.';
+}
+
 // parseDays is exported for the tests only — the range check and the default are
 // asserted against the SAME constants the resolver reads, because a test that
 // re-typed 30 or 365 would be the second copy of the number this file exists to
@@ -378,4 +414,9 @@ module.exports = {
   parseAutopickupCap,
   resolveTweakAutopickup,
   describeTweakAutopickup,
+  MAX_SPEND_CAP_USD,
+  parseSpendCap,
+  resolveSpendCap,
+  setSpendCap,
+  describeSpendCap,
 };

package/src/bongos/route-rank-check.js

@@ -293,6 +293,33 @@ const GOVERNMENT_PINS = {
   // writes the table; neither route does.
   'POST /government/board/decision-rules': 'perm:board.item.open',
   'POST /government/board/matters': 'perm:board.item.open',
+  // task 1004706: the project's laws — a change is an amendment by another door
+  // (same atom as proposing one); the law book is read where the room is. Only a
+  // passed amendment writes a law; neither route does.
+  'POST /government/board/laws': 'perm:board.item.open',
+  'GET /government/laws': 'perm:board.vote.cast',
+  'GET /government/presets': 'perm:board.vote.cast',
+  // task 1004716: the government's counts are read where the docket they count is.
+  'GET /government/counts': 'perm:board.vote.cast',
+  'POST /government/board/presets': 'perm:board.item.open',
+  // task 1004709: the Lead of each building, read where the room is. A Lead is
+  // appointed and removed only by a passed People matter (the matters route).
+  'GET /government/leads': 'perm:board.vote.cast',
+  // task 1004711: a Lead's build-out. The room's atom; the wall is server-side —
+  // only the building's holder may ask, and build_rights decides at once or a vote.
+  'POST /government/buildouts': 'perm:board.vote.cast',
+  // task 1004712: the treasury. Read where the room is; a pot is set only by whoever
+  // answers for the Treasury, and a borrow answered only by the seat it waits on —
+  // both walls server-side, per request.
+  'GET /government/treasury': 'perm:board.vote.cast',
+  'PUT /government/treasury/pots/:goalId': 'perm:board.vote.cast',
+  'POST /government/treasury/borrows/:borrowId/answer': 'perm:board.vote.cast',
+  // task 1004703: the ask, one shape for every request from an agent to a person.
+  // Checked and written where the docket is read; the write also passes the
+  // matter's own source gate (docket.findMatter), so an ask never outreaches its matter.
+  'POST /government/asks/check': 'perm:board.vote.cast',
+  'PUT /government/asks/:matterId': 'perm:board.vote.cast',
+  'POST /government/asks/:matterId/pass': 'perm:board.vote.cast',
   // task 1004564: a proposer withdraws their own open sitting before any vote —
   // the proposer's half of putting one up, so the same atom. The proposer-only
   // and no-votes walls are in withdrawItem (board-withdraw.js) and its write.