@bongos/core 1.21.112 → 1.21.114

package/tests/hall_nav.mjs

@@ -24,11 +24,18 @@ import { fileURLToPath } from 'node:url';
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
 const SRC = fs.readFileSync(path.join(HALL, 'shell.js'), 'utf8');
+const POSITIONS_SRC = fs.readFileSync(path.join(HALL, 'gov-positions.js'), 'utf8');
+const FX = path.join(ROOT, 'scripts/hall-preview/fixtures');
+const fx = (name) => JSON.parse(fs.readFileSync(path.join(FX, name + '.json'), 'utf8'));
 
 // Boot shell.js under a DOM stub and return { sidebarHtml, viewHidden }.
 // Elements are memoised per id so the assertions can inspect what the router did
 // to them (#view-standing etc.) after boot.
-function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
+// `requests` (task 1004685) answers the shell's own reads by path — { '<path>':
+// { status, data } } — so the lazily computed positions can settle; anything not
+// named never settles, as before. `positions: true` pre-loads gov-positions.js the
+// way the page's lazy <script> would.
+function boot({ page = 'settings', hash = '', pathname = '/settings', search = '', requests = null, positions = false } = {}) {
   const els = new Map();
   const makeEl = () => {
     const el = {
@@ -50,7 +57,7 @@ function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
   const location = {
     hostname: 'builders.cloudbongos.com',
     origin: 'https://builders.cloudbongos.com',
-    pathname, hash,
+    pathname, hash, search,
     assign() {},
     replace(target) { replaced.push(String(target)); },
   };
@@ -76,6 +83,9 @@ function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
       el.dataset.gate = gate;
       const mod = attr(tag, 'data-module');
       if (mod) el.dataset.module = mod;
+      // task 1004685: the governing-surface flag the position gate reads.
+      const pos = attr(tag, 'data-position');
+      if (pos) el.dataset.position = pos;
       out.push(el);
     }
     return out;
@@ -130,7 +140,7 @@ function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
     // Index pages never reach probeMe (builders.js owns /me there); a non-index
     // boot would, so hand back a never-settling promise rather than fake auth —
     // these assertions are about the rendered model, not the gated state.
-    BongosClient: { createClient: () => ({ request: () => new Promise(() => {}) }) },
+    BongosClient: { createClient: () => ({ request: (method, p) => (requests && p in requests ? Promise.resolve(requests[p]) : new Promise(() => {})) }) },
     matchMedia: () => ({ matches: false, addEventListener() {} }),
     localStorage: { getItem() { return null; }, setItem() {} },
     requestAnimationFrame() {},
@@ -145,6 +155,7 @@ function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
   };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
+  if (positions) vm.runInContext(POSITIONS_SRC, sandbox, { filename: 'gov-positions.js' });
   vm.runInContext(SRC, sandbox, { filename: 'shell.js' });
 
   return {
@@ -271,7 +282,10 @@ test('sidebar groups read by audience, in order', () => {
   // same atom and for the same reason (owner call; it leads the Governing mode).
   assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'goal-map', 'work', 'blockers', 'board-room', 'city', 'thinking', 'studio'],
     'the unlabeled group is the project itself (task 1002425 order)');
-  assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
+  // task 1004685 (the living-city prototype, round-3 board 6): 'my-agents' joins You —
+  // how your own Claude works for you, the personal half of "the city steers
+  // everyone, My agents steers yours". Its subject is the viewer's own agents.
+  assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile', 'my-agents'], 'You = your own numbers and your own agents');
   // task 1003444: 'people' LEFT the group — the owner deleted the hall's
   // cross-project directory (ADR 0337 D5); its home is the hub, and /people
   // redirects to /roster. Builders is the hall's directory now.
@@ -725,3 +739,92 @@ test('no glyph path data reads as an IP address to the release leak scan', () =>
   const hits = block.match(/\d+\.\d+\.\d+\.\d+/g) || [];
   assert.deepEqual(hits, [], 'separate the numbers with spaces so no four chain on dots');
 });
+
+// ── GOVERNING IS A POSITION (task 1004685, the living-city prototype) ─────────
+//
+// Round-3 board 8: you pick a craft, but you HOLD a seat or you don't. The
+// governing surfaces carry `position: true`, and the gate loop hides them from a
+// builder whose seats are KNOWN to be none — /me's server-resolved `positions`
+// block (task 1004713). These drive the real shell and the real gov-positions.js.
+
+const tick = () => new Promise((resolve) => setImmediate(resolve));
+const GOVERNING = ['board-room', 'city', 'watch', 'gate', 'sessions', 'project-settings', 'deploy', 'fleet', 'government'];
+const lead = (building, title) => ({ kind: 'lead', seat: 'lead:' + building, building, title });
+const block = (held) => ({ held, title: held.length ? held[0].title : null, has_position: held.length > 0 });
+
+// task 1004713: the seats are /me's server-resolved `positions` block, handed to
+// applyAccess exactly as probeMe and hall-render.js hand it. No read is answered
+// (`requests: {}`): the shell asks nothing else to know them.
+async function seated({ builder, positions, search = '' }) {
+  const b = boot({ positions: true, search, requests: {} });
+  b.shell.applyAccess({ authed: true, rank: builder.rank, permissions: { 'board.vote.cast': true }, builder, positions });
+  await tick();
+  await tick();
+  return b;
+}
+
+test('POSITION: exactly the governing surfaces carry the flag — the City, the Board Room and Government', () => {
+  const html = boot().sidebarHtml;
+  const flagged = [...html.matchAll(/id="nav-([^"]+)"[^>]*data-position="1"/g)].map((m) => m[1]);
+  assert.deepEqual(flagged, GOVERNING);
+  assert.match(html, /class="nav-group__head" data-gate="government" data-position="1" data-group="government"/,
+    'the Government head carries it too, so no label is left over an emptied group');
+  const nav = parseNav(html);
+  assert.ok(!nav.find((g) => g.label === 'You').items.some((i) => flagged.includes(i.id)), 'your own pages never need a seat');
+});
+
+test('POSITION: a Lead keeps every governing surface, and the seat names it', async () => {
+  const b = await seated({ builder: { id: '424242', rank: 'thetes' }, positions: block([lead('planning', 'Planning Lead')]) });
+  assert.equal(b.shell.positions().title, 'Planning Lead');
+  // a thetes Lead: the seat opens the governing tabs their rank and permissions allow
+  for (const id of ['board-room', 'city', 'my-agents']) assert.equal(b.navHidden(id), false, `${id} shows`);
+});
+
+test('POSITION: the fixture viewer holds what the fixture /me says', async () => {
+  const me = fx('me');
+  const b = await seated({ builder: me.builder, positions: me.positions });
+  assert.equal(b.shell.positions().title, me.positions.title);
+  assert.equal(b.navHidden('city'), false);
+});
+
+test('POSITION: a builder with no seat sees no governing surface, and only those go', async () => {
+  // an archon the server says holds no seat: rank, craft and permissions do not make one
+  const b = await seated({ builder: { id: '424242', rank: 'archon', preferred_disciplines: ['engineer'] }, positions: block([]) });
+  assert.equal(b.shell.positions().has_position, false);
+  for (const id of ['board-room', 'city', 'watch', 'project-settings', 'government']) assert.equal(b.navHidden(id), true, `${id} hides`);
+  for (const id of ['home', 'work', 'goals', 'my-agents', 'profile', 'primer']) assert.equal(b.navHidden(id), false, `${id} still shows`);
+});
+
+test('POSITION: unknown is today\'s nav — a /me with no positions block hides nothing', async () => {
+  for (const positions of [null, undefined]) {
+    const b = await seated({ builder: { id: '424242', rank: 'metic' }, positions });
+    assert.equal(b.shell.positions(), null, 'the seats could not be read');
+    for (const id of ['board-room', 'city', 'watch']) assert.equal(b.navHidden(id), false, `${id} shows, as it did before`);
+  }
+});
+
+test('POSITION: the shell hands /me\'s positions block to applyAccess, on every page and on the index', () => {
+  assert.match(SRC, /positions: me\.positions \|\| null/, 'probeMe passes the block');
+  const render = fs.readFileSync(path.join(HALL, 'hall-render.js'), 'utf8');
+  assert.match(render, /positions: \(ctx\.lastMeState && ctx\.lastMeState\.positions\) \|\| null/, 'the index passes it too');
+  assert.doesNotMatch(SRC, /proto\/governor-overlay/, 'the shell never reads the prototype overlay for seats');
+});
+
+test('POSITION: ?as=nobody views the hall with no seat, and can only hide', async () => {
+  const me = fx('me');
+  const b = await seated({ builder: me.builder, positions: me.positions, search: '?as=nobody' });
+  assert.equal(b.shell.positions().as, 'nobody');
+  for (const id of GOVERNING) assert.equal(b.navHidden(id), true, `${id} hides for the stand-in`);
+  assert.equal(b.navHidden('my-agents'), false);
+  // a xenos stand-in stays a xenos: the pretend rank never rises above the real one
+  const x = await seated({ builder: { id: '9', rank: 'xenos' }, positions: block([lead('planning', 'Planning Lead')]), search: '?as=nobody' });
+  assert.equal(x.navHidden('roadmap'), true, 'a member page stays hidden from a real xenos');
+});
+
+test('My agents draws its own glyph and lands on a real page', () => {
+  const item = parseNav(boot().sidebarHtml).flatMap((g) => g.items).find((i) => i.id === 'my-agents');
+  assert.ok(item, 'the item renders');
+  assert.equal(item.href, '/my-agents');
+  assert.equal(item.gate, 'signed');
+  assert.ok(hrefResolves(item), 'my-agents.html exists');
+});

package/tests/hall_page_gate_map.mjs

@@ -49,6 +49,10 @@ const ORACLE = {
   // task 1004473: the Commands page — its two reads (installed skills, CLI verbs)
   // are requireBuilder, so sign-in is the whole gate.
   '/builders/commands': 'requireBuilderPage',
+  // task 1004685 (the living-city prototype): My agents — the viewer's own agent
+  // settings. Every read behind it is the viewer's own (GET /me, /me/* prefs,
+  // /specialities) and requireBuilder, so sign-in is the whole gate.
+  '/builders/my-agents': 'requireBuilderPage',
   '/builders/goals': 'requireBuilderPage',
   // task 1003479: the goal map, on the goal board's tier. task 1004232 (sky part 4):
   // the URL now serves THE PROJECT SKY (the same page as /thinking, in its whole-project

package/tests/hall_preview_governor_fixtures.mjs

@@ -26,6 +26,7 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const FX = path.join(ROOT, 'scripts/hall-preview/fixtures');
 const require = createRequire(import.meta.url);
 const docketLib = require(path.join(ROOT, 'modules/government/docket.js'));
+const routing = require(path.join(ROOT, 'modules/government/routing.js'));
 const DR = require(path.join(ROOT, 'modules/government/decision-rules.js'));
 const DB = require(path.join(ROOT, 'modules/government/decision-board.js'));
 const A = require(path.join(ROOT, 'modules/hall-ui/public/street-amend.js'));
@@ -41,8 +42,23 @@ function countStates(ms) {
 test('the docket fixture: counts and the home line are derived from its matters, as buildDocket derives them', () => {
   const d = fx('government__docket');
   assert.ok(d.matters.length > 7, 'the dense docket (task 1004569), not the first seven');
-  assert.deepEqual(d.counts, countStates(d.matters));
-  assert.equal(d.line, docketLib.homeLine(d.counts), 'the city line under start governing agrees with the street header');
+  // routed (task 1004705): `yours` is the matters on the viewer's own seats, and the line counts those
+  const yours = d.matters.filter((m) => m.route && m.route.yours).length;
+  assert.equal(d.routed, true);
+  assert.deepEqual(d.counts, { ...countStates(d.matters), yours });
+  assert.equal(d.line, docketLib.homeLine({ needs: yours, moving: d.counts.moving }), 'the city line under start governing agrees with the street header');
+});
+
+test('the docket fixture: every route is the server\'s rule over the leads fixture and the holders (task 1004705)', () => {
+  const d = fx('government__docket');
+  const L = fx('government__leads');
+  const holders = {};
+  d.buildings.forEach((b) => { holders[b.key] = b.holders; });
+  const seats = { leads: L.buildings.filter((b) => b.lead).map((b) => ({ building: b.building, builder_id: b.lead.builder.id })), owner: L.owner, holders };
+  for (const m of d.matters) {
+    const { route, ...bare } = m;
+    assert.deepEqual(route, routing.routeMatter(bare, d.viewer.id, seats, Date.parse(d.generated_at)), m.id);
+  }
 });
 
 test('the docket fixture: every building counts exactly the matters standing at it', () => {
@@ -64,9 +80,20 @@ test('the docket fixture: the fairness reading is derived from the matters at Di
   assert.deepEqual({ value: f.value, figure: f.figure, line: f.line, hot: f.hot }, want);
 });
 
+// The decision-table rows a constitution fixture says are STORED: an area carries an
+// updated_at only when a row was written for it (decision-rules.js resolveOne). The
+// fixture is a live snapshot since task 1004685, and the live project has written its
+// rows (all "as today"), so the route's block is resolveAll over those rows, not [].
+function storedRows(block) {
+  return block.areas.filter((a) => a.updated_at).map((a) => ({
+    area: a.area, decided_by: a.decided_by, rule: a.as_today ? null : a.rule,
+    set_by_item_id: a.set_by_item_id, updated_at: a.updated_at,
+  }));
+}
+
 test('the constitution fixture: it carries the decision_rules block the route serves, so every building can draft an amendment', () => {
   const c = fx('government__constitution');
-  assert.deepEqual(c.decision_rules, JSON.parse(JSON.stringify(DB.constitutionBlock(DR.resolveAll([], { board: c.board })))), 'the server\'s own block for this board');
+  assert.deepEqual(c.decision_rules, JSON.parse(JSON.stringify(DB.constitutionBlock(DR.resolveAll(storedRows(c.decision_rules), { board: c.board })))), 'the server\'s own block for this board');
   for (const area of c.decision_rules.areas.map((r) => r.area)) {
     const d = A.draftFor(area, c);
     assert.equal(d.ok, true, area + ': change how this works drafts');

package/tests/hall_preview_scrub.mjs

@@ -29,7 +29,7 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const FIXTURES = path.join(ROOT, 'scripts', 'hall-preview', 'fixtures');
 const {
-  createScrubber, isOwnAccountFixture, highestStandIn, rewriteScalars, GHOST_AVATAR_URL,
+  createScrubber, createTextScrubber, isOwnAccountFixture, highestStandIn, rewriteScalars, GHOST_AVATAR_URL,
 } = require('../scripts/hall-preview/scrub-identity.js');
 const { refreshFixtures, scrubFixturesOnDisk } = require('../scripts/hall-preview/refresh-fixtures.js');
 
@@ -200,6 +200,64 @@ test('--scrub-only rewrites a hand-written fixture in place, once', () => {
   }
 });
 
+// task 1004685: the governor docket names people in its prose, so a run ends with a
+// pass over every string for the people its structured fields already named.
+test('prose: a person the run met in a field is replaced inside sentences too', () => {
+  const s = createScrubber();
+  s.scrub({ builders: [
+    { id: '3', github_login: 'Real-Person9', display_name: 'Real Person' },
+    { id: '4', github_login: 'willOtherHuman', display_name: 'willOtherHuman' },
+    { id: '5', github_login: 'IAMSOMEONEELSE', display_name: 'IAMSOMEONEELSE' },
+    { id: '6', github_login: 'discord-bot-system', display_name: 'Discord Bot (system)' },
+    { id: '7', github_login: 'bobbytabl', display_name: 'bobbytabl' },
+    { id: '8', github_login: 'largefellow-x', display_name: 'largefellow-x' },
+  ] });
+  const prose = createTextScrubber(s.knownPeople());
+  const out = prose({
+    detail: "From real-person9's feedback: Real Person says Real: stop the runner",
+    owner: 'Owner: **Will / Someoneelse**. The agent will stop when Discord is down.',
+    path: 'not /home/real/app, and mail 290184380+IAMSOMEONEELSE@users.noreply.github.com',
+    link: 'see https://github.com/Real-Person9/cloud-bongos/blob/main/x.md',
+    repo: { owner: 'Real-Person9', repo: 'cloud-bongos' },
+    named: "Bobby Tables's first run. Bobby again. Large files stay.",
+  });
+  assert.equal(out.named, "Builder 5's first run. Builder 5 again. Large files stay.",
+    'a capitalised word a login starts with is its first name, surname and all; a common word is not');
+  assert.equal(out.detail, "From builder-1's feedback: Builder 1 says Builder 1: stop the runner",
+    'a login, a display name and the first name the login starts with');
+  assert.equal(out.owner, 'Owner: **Builder 2 / Builder 3**. The agent will stop when Discord is down.',
+    'a first name that is a common word only counts capitalised; an all-caps login gives up its nickname; a system account gives up nothing');
+  assert.equal(out.path, 'not /home/builder-1/app, and mail builder@example.com');
+  assert.equal(out.link, 'see https://github.com/Real-Person9/cloud-bongos/blob/main/x.md', 'the repo\'s own coordinates stay');
+  assert.equal(out.repo.owner, 'Real-Person9', 'as the manifest\'s repo.owner does');
+  assert.deepEqual(createTextScrubber(createScrubber().knownPeople())({ a: 'Real Person' }), { a: 'Real Person' },
+    'a pass that met nobody changes nothing, which keeps --scrub-only a fixed point');
+});
+
+test('a building\'s decision word is vocabulary, not a login, on the docket\'s decision too', () => {
+  const s = createScrubber();
+  const d = s.scrub({ buildings: [{ key: 'review', decision: { rule: 'decide', decided_by: 'gate' } }, { key: 'charter', decision: { rule: 'unanimous', decided_by: 'board' } }] });
+  assert.deepEqual(d.buildings.map((b) => b.decision.decided_by), ['gate', 'board']);
+  assert.deepEqual(s.knownPeople().logins, [], 'and the prose pass is never taught to rewrite "the stealth gate"');
+});
+
+test('a re-run keeps the numbers the committed roster gives each builder', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'hall-fixtures-'));
+  try {
+    fs.writeFileSync(path.join(dir, 'builders__roster.json'), JSON.stringify({ builders: [{ id: '7', github_login: 'builder-40', display_name: 'Builder 40' }] }));
+    const responses = {
+      '/builders/roster': { builders: [{ id: '7', github_login: 'other-human', display_name: 'Other Human' }] },
+      '/builders/directory': { builders: [{ id: '7', github_login: 'other-human' }, { id: '8', github_login: 'a-newcomer' }] },
+    };
+    const api = { request: async (_m, p) => (p in responses ? { ok: true, status: 200, data: responses[p] } : { ok: false, status: 404 }) };
+    await refreshFixtures({ api, dir, snapshots: [['builders/directory', 'builders__directory']], log: () => {} });
+    const out = JSON.parse(fs.readFileSync(path.join(dir, 'builders__directory.json'), 'utf8'));
+    assert.deepEqual(out.builders.map((b) => b.github_login), ['builder-40', 'builder-41'], 'builder 7 keeps 40; a newcomer numbers above it');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 test('every committed fixture is already scrubbed — no real person is checked in', () => {
   const files = fs.readdirSync(FIXTURES).filter((f) => f.endsWith('.json')).sort();
   const texts = files.map((f) => fs.readFileSync(path.join(FIXTURES, f), 'utf8'));

package/tests/hall_preview_security.mjs

@@ -0,0 +1,169 @@
+// tests/hall_preview_security.mjs — no committed hall-preview fixture carries the
+// project's security content (task 1004685, after its security review).
+//
+// The governor docket the harness snapshots is read at a rank floor, and it holds
+// the open red-team reports (file and line references, exploit chains, proofs of
+// concept) and the owner's blockers (host config diffs, recovery runbooks). A
+// committed fixture would hand those to anyone with repo read access. The fix is
+// in the WRITER (scrub-identity.js createSecurityRedactor, run by every snapshot
+// and by --scrub-only); these tests pin it:
+//   1. every red-team record keeps only the allowed keys and the withheld title;
+//   2. every blocker keeps no body, and no title that names a secret or a host;
+//   3. the security backlog's tasks keep their shape, not their words;
+//   4. no fixture anywhere carries the strings the review found;
+//   5. every committed fixture is already a fixed point of the pass;
+//   6. the checks are not vacuous: put one body back and they fail.
+//
+// Run:  node --test tests/hall_preview_security.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const FIXTURES = path.join(ROOT, 'scripts', 'hall-preview', 'fixtures');
+const S = require('../scripts/hall-preview/scrub-identity.js');
+const { refreshFixtures } = require('../scripts/hall-preview/refresh-fixtures.js');
+
+const FILES = fs.readdirSync(FIXTURES).filter((f) => f.endsWith('.json')).sort();
+const load = () => FILES.map((f) => ({ file: f, data: JSON.parse(fs.readFileSync(path.join(FIXTURES, f), 'utf8')) }));
+
+// The strings the review found in the committed fixtures, and anything like them.
+// (GRADER_BYPASS is the env var's spelling: /me's own `grader_bypass` flag is a field name.)
+// The prior instance's brand comes from PRIOR_INSTANCE_FLOOR, the one definition package-core's
+// leak scan refuses. This file ships in the core package, so it must not spell the word out
+// itself; resolving it from the floor keeps the check and the scan in step (task 1004722).
+// It is the floor's one-word token; the multi-word one is the module authorship credit,
+// which modules.json legitimately carries and which this check never named.
+const { PRIOR_INSTANCE_FLOOR } = require('../scripts/gds/package-core.js');
+const PRIOR_BRAND = PRIOR_INSTANCE_FLOOR.tokens.find((t) => /^[a-z0-9]+$/i.test(t));
+assert.ok(PRIOR_BRAND, 'PRIOR_INSTANCE_FLOOR must name a one-word brand, or the brand checks below are vacuous');
+const LEAKED = [/committed_files/i, /auth-idp/i, /verifyHubAssertion/i, /serverSideGuards/i, new RegExp(PRIOR_BRAND, 'i'), /frame-ancestors/i,
+  /\bcaddy/i, /bot token/i, /GRADER_BYPASS/, /reconcile-on-read/i, /X-Frame-Options/i, /Content-Security-Policy/i, /\/etc\/cloudbongos/i];
+// Inside a red-team record not even these may appear.
+const IN_REPORT = new RegExp(String.raw`committed_files|auth-idp|\bPoC\b|frame-ancestors|${PRIOR_BRAND}|exploit|token|repro|\.js\b|:\d+-\d+`, 'i');
+const BLOCKER_BODY = ['body', 'body_md', 'notes', 'note', 'details', 'detail', 'description', 'resolution_note', 'steps', 'facts'];
+
+function records(v, where, out = []) {
+  if (Array.isArray(v)) v.forEach((x, i) => records(x, `${where}[${i}]`, out));
+  else if (v && typeof v === 'object') {
+    out.push({ where, o: v });
+    for (const [k, x] of Object.entries(v)) records(x, `${where}.${k}`, out);
+  }
+  return out;
+}
+function strings(v, out = []) {
+  if (typeof v === 'string') out.push(v);
+  else if (Array.isArray(v)) v.forEach((x) => strings(x, out));
+  else if (v && typeof v === 'object') Object.values(v).forEach((x) => strings(x, out));
+  return out;
+}
+
+// Every way a set of fixtures can leak, as a list (empty = clean).
+function leaksIn(fixtures) {
+  const leaks = [];
+  const secGoals = new Set(S.securityGoalIdsIn(fixtures.map((f) => f.data)));
+  for (const { file, data } of fixtures) {
+    for (const { where, o } of records(data, file)) {
+      if (S.isReportRecord(o)) {
+        for (const k of Object.keys(o)) if (!S.REPORT_KEYS.has(k) && !S.TITLE_KEYS.has(k)) leaks.push(`${where}: a red-team record carries "${k}"`);
+        for (const k of S.TITLE_KEYS) if (typeof o[k] === 'string' && o[k] !== S.REPORT_TITLE) leaks.push(`${where}.${k}: a red-team title is not withheld`);
+        for (const s of strings(o)) if (IN_REPORT.test(s)) leaks.push(`${where}: red-team prose "${s.slice(0, 40)}"`);
+      } else if (S.isBlockerRecord(o)) {
+        for (const k of BLOCKER_BODY) if (k in o) leaks.push(`${where}: a blocker carries its "${k}"`);
+        if (typeof o.title === 'string' && S.SENSITIVE_TEXT.test(o.title)) leaks.push(`${where}.title: a blocker title names a secret or a host`);
+      }
+      if ('title' in o && (o.security_sensitive === true || (o.goal_id != null && secGoals.has(String(o.goal_id))))) {
+        if (o.title !== S.TASK_TITLE) leaks.push(`${where}: a security-backlog task keeps its title`);
+        if (typeof o.description === 'string' && o.description) leaks.push(`${where}: a security-backlog task keeps its description`);
+      }
+    }
+    const text = JSON.stringify(data);
+    for (const re of LEAKED) if (re.test(text)) leaks.push(`${file}: contains ${re}`);
+  }
+  return leaks;
+}
+
+test('every committed fixture is clean: red-team records, blockers, the security backlog, the review\'s strings', () => {
+  const fixtures = load();
+  assert.deepEqual(leaksIn(fixtures), []);
+  // and the checks had something to check
+  const all = fixtures.flatMap(({ file, data }) => records(data, file));
+  assert.ok(all.filter(({ o }) => S.isReportRecord(o)).length >= 10, 'the docket\'s reports, its rulings and the overlay\'s cards were all examined');
+  assert.ok(all.filter(({ o }) => S.isBlockerRecord(o)).length >= 9, 'and every blocker');
+  assert.ok(all.filter(({ o }) => o.title === S.TASK_TITLE).length >= 10, 'and the security backlog');
+});
+
+test('the checks are not vacuous: one body put back, one title restored, one host named — each is caught', () => {
+  const docket = () => load().map((f) => (f.file === 'government__docket.json' ? f : null)).filter(Boolean);
+  const withBody = docket();
+  withBody[0].data.matters.find((m) => m.source === 'redteam_reports').detail = 'An invented chain of steps against widget.js:10-20';
+  assert.ok(leaksIn(withBody).some((l) => l.includes('carries "detail"')));
+  const titled = docket();
+  titled[0].data.matters.find((m) => m.source === 'redteam_reports').title = 'Security report: a real finding';
+  assert.ok(leaksIn(titled).some((l) => l.includes('title is not withheld')));
+  const blocker = docket();
+  blocker[0].data.matters.find((m) => m.source === 'blockers').detail = 'Steps on the host';
+  assert.ok(leaksIn(blocker).some((l) => l.includes('a blocker carries its "detail"')));
+  const host = docket();
+  host[0].data.line = 'see builders.someones-instance.com';
+  assert.equal(leaksIn(host).length, 0, 'an unknown host is the redactor\'s to catch, not this list\'s');
+  assert.match(S.securityRedactorFor([host[0].data])(host[0].data).line, /instance\.example/);
+});
+
+test('this file never spells a prior-instance word whole, so the release leak scan stays green', () => {
+  assert.ok(PRIOR_INSTANCE_FLOOR.tokens.length > 0, 'the floor must name at least one word, or this check is vacuous');
+  const own = fs.readFileSync(fileURLToPath(import.meta.url), 'utf8').toLowerCase();
+  for (const w of PRIOR_INSTANCE_FLOOR.tokens) assert.ok(!own.includes(w.toLowerCase()), 'resolve prior-instance words from PRIOR_INSTANCE_FLOOR, never inline them');
+});
+
+test('every committed fixture is already a fixed point of the security pass', () => {
+  const fixtures = load();
+  const secure = S.securityRedactorFor(fixtures.map((f) => f.data));
+  const dirty = fixtures.filter(({ data }) => JSON.stringify(secure(data)) !== JSON.stringify(data)).map((f) => f.file);
+  assert.deepEqual(dirty, [], 'run `node scripts/hall-preview/refresh-fixtures.js --scrub-only` and commit the result');
+});
+
+test('the redactor: a report keeps its shape, a blocker its title, a security task its place', () => {
+  const secure = S.createSecurityRedactor({ instanceNames: ['someones'], securityGoals: ['9'] });
+  const out = secure({
+    matters: [
+      { id: 'redteam_reports:7', source: 'redteam_reports', building: 'disputes', state: 'needs', short: 'high report', title: 'Security report: an invented finding', detail: 'Target: widget.js:117 — an invented PoC', proposer: { id: '3' }, acts: [{ key: 'confirm' }] },
+      { id: 'blockers:8', source: 'blockers', title: 'Invented host step: set frame-ancestors on the widget proxy', detail: 'an invented runbook' },
+      { id: 'blockers:9', source: 'blockers', title: 'Decide how far modules are trusted', detail: 'Options a, b, c' },
+    ],
+    history: [{ id: 'rulings:5', source: 'rulings', title: 'Security report: an invented ruling', at: '2026-09-01' }],
+    tasks: [
+      { id: '1', goal_id: '9', title: 'An invented security task', description: 'an invented detail', touches: ['src/widget.js'], status: 'ready' },
+      { id: '2', goal_id: '4', title: 'Draw the city', description: 'see builders.someones.com and the someones repo', status: 'ready' },
+    ],
+  });
+  assert.deepEqual(out.matters[0], { id: 'redteam_reports:7', source: 'redteam_reports', building: 'disputes', state: 'needs', short: 'high report', title: S.REPORT_TITLE, acts: [{ key: 'confirm' }] });
+  assert.deepEqual(out.matters[1], { id: 'blockers:8', source: 'blockers', title: S.BLOCKER_TITLE });
+  assert.deepEqual(out.matters[2], { id: 'blockers:9', source: 'blockers', title: 'Decide how far modules are trusted' }, 'a harmless title stays; the body never does');
+  assert.equal(out.history[0].title, S.REPORT_TITLE);
+  assert.deepEqual(out.tasks[0], { id: '1', goal_id: '9', title: S.TASK_TITLE, description: '', touches: [], status: 'ready' });
+  assert.equal(out.tasks[1].description, 'see builders.instance.example and the instance-name repo', 'a customer\'s domain and name');
+});
+
+test('the WRITER redacts: refreshFixtures never puts a red-team body or a blocker body on disk', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'hall-fixtures-'));
+  try {
+    const docket = { matters: [
+      { id: 'redteam_reports:7', source: 'redteam_reports', state: 'needs', title: 'Security report: an invented finding about widgets', detail: 'an invented chain of steps' },
+      { id: 'blockers:8', source: 'blockers', state: 'needs', title: 'Host step', detail: 'an invented host runbook' },
+    ] };
+    const api = { request: async (_m, p) => (p === '/government/docket' ? { ok: true, status: 200, data: docket } : { ok: false, status: 404 }) };
+    await refreshFixtures({ api, dir, snapshots: [['government/docket', 'government__docket']], log: () => {} });
+    const text = fs.readFileSync(path.join(dir, 'government__docket.json'), 'utf8');
+    for (const s of ['an invented chain', 'an invented host runbook', 'about widgets']) assert.ok(!text.includes(s), `${s} must never reach the fixture directory`);
+    assert.ok(text.includes(S.REPORT_TITLE));
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});

package/tests/hall_reading_world.mjs

@@ -297,6 +297,50 @@ test('the room frames BOTH figures the viewer upgrades', () => {
   assert.match(inner[1], /border:\s*0/);
 });
 
+// ---- 7b. the figure follows the theme (task 1003639) ----------------------
+//
+// mermaid-cli renders ONE light figure per diagram, at deploy, with `-b white`
+// baked into the SVG root. On the hall's dark mode the canvas was a white plate
+// on black. The fix is CSS, so it is silent in every test that does not look:
+// a lost twin is a dark page that is right after shell.js runs and wrong on
+// first paint (or the reverse), and a lost backgroundColor line brings the
+// plate back as a black one. Rendered and measured for the ship: 16.1:1 on a
+// node, 11.4:1 on an edge label, 18.8:1 on the note, dark, at 137%.
+
+// The body of `<sel> { … }` inside the media block's braces, comments stripped.
+const mediaRule = (css, sel) => {
+  const esc = sel.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const m = decomment(css).match(new RegExp(`@media \\(prefers-color-scheme: dark\\)\\s*\\{\\s*${esc}\\s*\\{([^}]*)\\}`));
+  return m ? m[1] : null;
+};
+const TURN = /^\s*filter:\s*invert\(1\) hue-rotate\(180deg\);\s*$/;
+
+test('dark turns the canvas figure, in both twins, byte-identical', () => {
+  const sw = rule(viewerCss, 'html[data-theme="dark"] .dgv__pan svg');
+  const media = mediaRule(viewerCss, 'html:not([data-theme]) .dgv__pan svg');
+  assert.ok(sw, 'the [data-theme] switch shell.js owns turns the figure');
+  assert.ok(media, 'and so does the media block, which is first paint before shell.js runs');
+  assert.equal(media, sw, 'the twins are byte-identical, or the two paints disagree');
+  assert.match(sw, TURN, 'invert, then turn the hues back round: dark ink reads light, a purple edge stays purple');
+  assert.doesNotMatch(rule(viewerCss, '.dgv__pan svg'), /filter/, 'light keeps the render exactly as mermaid drew it');
+});
+
+test('the fallback PNG turns with it, on BOTH figures the viewer upgrades', () => {
+  const both = (pre) => `${pre} .primer-figure img, ${pre} figure.diagram img`;
+  const sw = rule(roomCss, both('html[data-theme="dark"]'));
+  const media = mediaRule(roomCss, both('html:not([data-theme])'));
+  assert.ok(sw && media, 'the PNG shows before the SVG arrives and whenever it cannot — a dark reader must not get a white flash');
+  assert.equal(media, sw, 'byte-identical twins');
+  assert.match(sw, TURN, 'the same turn as the canvas, so the two paths read as one figure');
+});
+
+test('the viewer drops the white ground mermaid bakes into the SVG', () => {
+  assert.match(viewerJs, /parsed\.style\.backgroundColor = '';/,
+    'without it the inverted figure is a black plate on the dark canvas instead of a white one');
+  assert.ok(viewerJs.indexOf("parsed.style.backgroundColor = '';") < viewerJs.indexOf('buildViewer(img, document.importNode(parsed'),
+    'and it happens before the SVG is imported into the canvas');
+});
+
 // ---- 8. every room has exactly one h1 -------------------------------------
 
 const ROOMS = [['primer.html', primerHtml], ['diagrams.html', diagramsHtml], ['roadmap.html', roadmapHtml], ['ranks.html', ranksHtml]];

package/tests/hall_roster_world.mjs

@@ -280,9 +280,13 @@ test('the harness feeds: rollups for every goal and the category set', () => {
   const goals = readJson('goals.json').goals;
   const rollups = readJson('goals__rollups.json').rollups;
   const byGoal = new Set(rollups.map((r) => String(r.goal_id)));
-  for (const g of goals) assert.ok(byGoal.has(String(g.id)), `goal ${g.id} has a rollup row`);
+  // every goal a page draws a rollup for (an archived goal is a pill, no counters):
+  // the snapshot of the live read (task 1004685) carries no row for the archived ones
+  for (const g of goals.filter((x) => x.status !== 'archived')) assert.ok(byGoal.has(String(g.id)), `goal ${g.id} has a rollup row`);
   assert.ok(rollups.some((r) => r.next_ready_id), 'at least one row has a claimable next task');
-  assert.ok(rollups.some((r) => r.blocked > 0 && r.ready === 0 && r.active === 0), 'at least one goal is blocked-only');
+  // the blocked-only goal was a hand-made row; the live snapshot (task 1004685) has
+  // none, so the harness shows a goal with blocked work beside ready work instead
+  assert.ok(rollups.some((r) => r.blocked > 0), 'at least one goal holds blocked work');
   assert.ok(goals.some((g) => g.subtitle), 'some goals carry a subtitle');
   assert.ok(goals.some((g) => g.category && g.category.slug), 'some goals carry a category');
   const cats = readJson('work-categories.json').categories;

package/tests/hall_street.mjs

@@ -487,7 +487,7 @@ test('the page holds the prototype\'s header, the street, the readings and the c
   assert.match(html, /<a class="street-mark" id="streetHome" href="\/builders\/city"[^>]*>\{\{productName\}\}</);
   for (const id of ['hudNeeds', 'hudMoving', 'hudShare', 'streetMode', 'streetSigns', 'streetPins', 'streetDoors', 'streetCard']) assert.match(html, new RegExp(`id="${id}"`), id);
   const scripts = [...html.matchAll(/<script src="\/builders\/([a-z-]+)\.js/g)].map((m) => m[1]);
-  assert.deepEqual(scripts, ['shell-trail', 'craft-mode', 'shell', 'palette', 'city-draw', 'street-draw', 'street-card', 'street-inside', 'street-desk', 'street-amend', 'street'], 'the hall shell (task 1004544), the shared kit, then the card (task 1004528), the interiors (task 1004526), the floor desk (task 1004558) and the drafted amendment (task 1004530)');
+  assert.deepEqual(scripts.filter((s) => !/^street-(deck|office)$/.test(s)), ['shell-trail', 'craft-mode', 'shell', 'palette', 'gov-living', 'gov-feeds', 'city-draw', 'street-draw', 'street-card', 'street-inside', 'street-depth', 'street-desk', 'street-amend', 'street'], 'the hall shell (task 1004544), the living model and its one reader (task 1004685: city-draw.js counts with it, so it loads first), the shared kit, then the card (task 1004528), the interiors (task 1004526), the living street\'s exterior (street-depth.js), the floor desk (task 1004558) and the drafted amendment (task 1004530); the deck rides beside them');
   assert.equal(City.STREET_HREF, '/builders/street', 'the city\'s door is this page');
 });
 
@@ -582,6 +582,7 @@ async function bootPage({ feeds = {}, stored = null, osDark = true, hash = '', s
   vm.runInContext(read('street-draw.js'), ctx);
   vm.runInContext(read('street-card.js'), ctx);
   vm.runInContext(read('street-inside.js'), ctx);
+  vm.runInContext(read('street-depth.js'), ctx);
   vm.runInContext(read('street-desk.js'), ctx);
   vm.runInContext(read('street.js'), ctx);
   await window.GovStreetPage.ready;
@@ -685,7 +686,7 @@ test('no two shown labels meet on a dense docket at 1440, 1024, 390 and 320 wide
 
 test('the header counts wear the pins\' colours, so they double as the legend', () => {
   const html = read('street.html');
-  assert.match(html, /<span class="street-hud__dot" id="hudDot" aria-hidden="true"><\/span>\s*<span class="street-label">needs you<\/span>/);
+  assert.match(html, /<span class="street-hud__dot" id="hudDot" aria-hidden="true"><\/span>\s*<span class="street-label">to do<\/span>/);
   assert.match(html, /<span class="street-hud__dot street-hud__dot--moving" aria-hidden="true"><\/span>\s*<span class="street-label">moving<\/span>/);
   const css = read('street.css').replace(/\/\*[\s\S]*?\*\//g, '');
   assert.match(css, /\.street-hud__dot \{[^}]*border: 1\.5px solid var\(--accent\)/, 'needs you is orange, a ring while nothing waits');
@@ -735,3 +736,18 @@ test('arriving through a door marks that building, and a failed docket says so',
   assert.ok(!q.calls.some((c) => /earnings/.test(c)), 'no viewer, no earnings read');
   assert.equal(q.byId.get('hudShare').textContent, '—');
 });
+
+// task 1004718: a wide window scales the street to its width, and the height
+// it does not need goes under the readings, never as empty sky over the street.
+test('a stage taller than the street gives its spare height to the foot, not the sky', async () => {
+  const p = await bootPage({ feeds: FEEDS([]), width: 1440 });
+  const win = p.byId.get('streetWindow'), sizer = p.byId.get('streetSizer');
+  win.clientHeight = 900;
+  p.key('resize', {});
+  const h = parseFloat(sizer.style.height);
+  assert.ok(h < 900, 'the street is width-bound here');
+  assert.equal(win.style.flex, '0 0 ' + h + 'px', 'the window shrinks to the street, so the readings sit right under it');
+  win.clientHeight = 300;
+  p.key('resize', {});
+  assert.equal(win.style.flex, '', 'a height-bound street fills its window, nothing to give back');
+});

package/tests/hall_street_amend.mjs

@@ -258,7 +258,7 @@ async function bootPage({ hash = '#building=review', cons = constitution(), answ
   };
   const ctx = vm.createContext({ window, document, fetch, Promise, Math, String, Number, Array, Object, JSON, Date, console, encodeURIComponent, decodeURIComponent, isNaN, isFinite, Map, setTimeout, clearTimeout });
   ctx.globalThis = ctx;
-  for (const f of ['city-draw.js', 'street-draw.js', 'street-card.js', 'street-inside.js', 'street-desk.js', 'street-amend.js', 'street.js']) vm.runInContext(read(f), ctx);
+  for (const f of ['city-draw.js', 'street-draw.js', 'street-card.js', 'street-inside.js', 'street-depth.js', 'street-desk.js', 'street-amend.js', 'street.js']) vm.runInContext(read(f), ctx);
   await window.GovStreetPage.ready;
   await tick();
   return { window, byId, focused, gets, posts, history };