@bongos/core 1.21.125 → 1.21.127

package/tests/module_assess_score.mjs

@@ -18,6 +18,9 @@ const { composeScore, recomposeScore } = require('../scripts/gds/module-assess-s
 const { assessVersion, queueAssessment, QUEUE_MAX } = require('../scripts/gds/module-assess-version.js');
 
 const sig = (id, part, outcome, score = null) => ({ id, part, outcome, score });
+// Every assessVersion call here stubs the test-runner dispatch, so a shell with
+// MODULE_TEST_REPO/MODULE_TEST_TOKEN set can never make this suite reach GitHub.
+const noDispatch = async () => null;
 
 // ---------------------------------------------------------------------------
 // composeScore — the rule, pure
@@ -98,7 +101,7 @@ function fakeDb({ versions = [{ id: 7, module_key: 'weather', version: '1.0.0' }
   const db = {
     signals, scores,
     async query(sql, params = []) {
-      if (/^SELECT id, module_key, version FROM store_module_versions WHERE id/.test(sql)) {
+      if (/^SELECT id, module_key, version(, artifact_path)? FROM store_module_versions WHERE id/.test(sql)) {
         return { rows: versions.filter((v) => String(v.id) === String(params[0])) };
       }
       if (/SELECT DISTINCT ON \(part\)/.test(sql)) {
@@ -158,7 +161,7 @@ test('assessVersion on publish: Tests pending, the Security gate, Docs, then the
   const seen = [];
   const recordSecurity = async (id, { db: d }) => { seen.push(id); const row = d.add(id, 'security', 'passed'); return { ok: true, signal: row }; };
   const recordDocs = async (id, { db: d }) => { seen.push(`docs:${id}`); return { ok: true, signal: d.add(id, 'docs', 'scored', 20) }; };
-  const res = await assessVersion(7, { db, recordSecurity, recordDocs });
+  const res = await assessVersion(7, { db, dispatchTests: noDispatch, recordSecurity, recordDocs });
   assert.equal(res.ok, true);
   assert.deepEqual(seen, [7, 'docs:7'], 'Security, then Docs');
   assert.equal(res.docs.part, 'docs');
@@ -173,11 +176,18 @@ test('assessVersion on publish: Tests pending, the Security gate, Docs, then the
 test('re-assessing never hides a real Tests score behind a newer "pending"', async () => {
   const db = fakeDb();
   db.add(7, 'tests', 'scored', 85);
-  const res = await assessVersion(7, { db, recordSecurity: async (id, { db: d }) => ({ ok: true, signal: d.add(id, 'security', 'passed') }), recordDocs: async () => null });
+  const res = await assessVersion(7, { db, dispatchTests: noDispatch, recordSecurity: async (id, { db: d }) => ({ ok: true, signal: d.add(id, 'security', 'passed') }), recordDocs: async () => null });
   assert.equal(db.signals.filter((s) => s.part === 'tests').length, 1);
   assert.equal(res.score.overall, 85);
 });
 
+test('assessVersion hands the version to the test-runner dispatch before recording Tests pending', async () => {
+  const db = fakeDb();
+  const sent = [];
+  await assessVersion(7, { db, dispatchTests: async (ver, { db: d }) => { sent.push(ver.id); assert.equal(d, db); return null; }, recordSecurity: async () => null, recordDocs: async () => null });
+  assert.deepEqual(sent, [7]);
+});
+
 test('assessVersion on an unknown version writes nothing', async () => {
   const db = fakeDb({ versions: [] });
   const res = await assessVersion(99, { db, recordSecurity: async () => { throw new Error('must not run'); } });

package/tests/module_error_counts.mjs

@@ -0,0 +1,265 @@
+// tests/module_error_counts.mjs — instances count each store module's runtime
+// errors per day and send the daily count with the builder sign-in on the box
+// (task 1004637): the loader's attribution, the on-disk tally, and the sender.
+// Hermetic — temp dirs, a fake store client, an in-process express app.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import http from 'node:http';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const loader = require(path.join(ROOT, 'src', 'module-loader', 'loader.js'));
+const { seed, record, readTally, start, startDailySend, _reset } = require(path.join(ROOT, 'src', 'module-loader', 'error-tally.js'));
+// the in-memory tally is read the way tooling reads it: through the loader's snapshot
+const tally = { seed, record, readTally, start, startDailySend, _reset, snapshot: () => loader.loaderSnapshot().errorCounts };
+const sender = require(path.join(ROOT, 'scripts', 'gds', 'module-error-report.js'));
+const express = require('express');
+
+function tmpDir(prefix) { return fs.mkdtempSync(path.join(os.tmpdir(), prefix)); }
+
+function fixtureRoot(spec) {
+  const root = tmpDir('bongos-errmods-');
+  for (const [key, def] of Object.entries(spec)) {
+    const d = path.join(root, key);
+    fs.mkdirSync(d, { recursive: true });
+    fs.writeFileSync(path.join(d, 'module.json'), JSON.stringify({
+      key, title: key, description: 'd', version: def.version === undefined ? '1.2.0' : def.version,
+      coreVersion: '^1.0.0', contributes: def.contributes || {},
+    }));
+    for (const [rel, content] of Object.entries(def.files || {})) {
+      const fp = path.join(d, rel);
+      fs.mkdirSync(path.dirname(fp), { recursive: true });
+      fs.writeFileSync(fp, content);
+    }
+  }
+  return root;
+}
+
+const TODAY = new Date().toISOString().slice(0, 10);
+
+// ---------------------------------------------------------------------------
+// The tally
+// ---------------------------------------------------------------------------
+
+test('seed gives every exactly-versioned module a 0 today; record counts only those', () => {
+  tally._reset();
+  const n = tally.seed([
+    { key: 'alpha', manifest: { version: '1.2.0' } },
+    { key: 'loose', manifest: { version: '^1.0.0' } },
+    { key: 'none', manifest: {} },
+  ]);
+  assert.equal(n, 1);
+  assert.deepEqual(tally.snapshot()[TODAY], { 'alpha@1.2.0': 0 }, 'a clean day is a 0, not a missing row');
+  assert.equal(tally.record('alpha'), true);
+  assert.equal(tally.record('alpha'), true);
+  assert.equal(tally.record('loose'), false, 'no exact version, nothing to file it against');
+  assert.equal(tally.record('ghost'), false, 'a stray key never invents a module');
+  assert.deepEqual(tally.snapshot()[TODAY], { 'alpha@1.2.0': 2 });
+  tally._reset();
+});
+
+test('nothing touches disk until start(); start merges the file (higher count wins) and prunes old days', () => {
+  tally._reset();
+  const dir = tmpDir('bongos-tally-');
+  const file = path.join(dir, 'module-error-counts.json');
+  tally.seed([{ key: 'alpha', manifest: { version: '1.2.0' } }]);
+  tally.record('alpha');
+  assert.equal(fs.existsSync(file), false);
+  fs.writeFileSync(file, JSON.stringify({ days: {
+    [TODAY]: { 'alpha@1.2.0': 5 },
+    '2000-01-01': { 'alpha@1.0.0': 9 },
+  } }));
+  tally.start({ file });
+  const onDisk = tally.readTally(file);
+  assert.equal(onDisk[TODAY]['alpha@1.2.0'], 5, 'a restart mid-day keeps the morning count');
+  assert.equal(onDisk['2000-01-01'], undefined, 'days past the window are pruned');
+  tally._reset();
+});
+
+test('the tally on disk holds counts only — key@version and a number, nothing else', () => {
+  tally._reset();
+  const file = path.join(tmpDir('bongos-tally-'), 'c.json');
+  tally.seed([{ key: 'alpha', manifest: { version: '1.2.0' } }]);
+  tally.record('alpha');
+  tally.start({ file });
+  const raw = JSON.parse(fs.readFileSync(file, 'utf8'));
+  assert.deepEqual(Object.keys(raw), ['days']);
+  for (const row of Object.values(raw.days)) {
+    for (const [k, v] of Object.entries(row)) {
+      assert.match(k, /^[a-z0-9-]+@\d+\.\d+\.\d+$/);
+      assert.ok(Number.isInteger(v));
+    }
+  }
+  tally._reset();
+});
+
+// ---------------------------------------------------------------------------
+// The loader attributes a 500 to the module that answered it
+// ---------------------------------------------------------------------------
+
+async function withServer(app, fn) {
+  const server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  try { return await fn(base); } finally { await new Promise((r) => server.close(r)); }
+}
+
+test('a module route that throws or answers 500 counts against it; a 4xx, a 503 and a fall-through do not', async () => {
+  loader._reset();
+  const root = fixtureRoot({
+    alpha: {
+      contributes: { routes: ['main'] },
+      files: { 'routes/main.js': `
+        const express = require(${JSON.stringify(require.resolve('express'))});
+        module.exports = () => {
+          const r = express.Router();
+          r.get('/alpha/boom', () => { throw new Error('boom'); });
+          r.get('/alpha/fail', (req, res) => res.status(500).json({ error: 'x' }));
+          r.get('/alpha/bad', (req, res) => res.status(400).json({ error: 'x' }));
+          r.get('/alpha/off', (req, res) => res.status(503).json({ error: 'not set up' }));
+          r.get('/alpha/pass', (req, res, next) => next(new Error('handed on')));
+          return r;
+        };` },
+    },
+    beta: { contributes: {} },
+  });
+  const app = express();
+  const router = express.Router();
+  loader.mountModuleRoutes(router, { isEnabled: () => true }, { roots: [root], core: '1.0.0' });
+  router.get('/kernel/boom', () => { throw new Error('kernel'); });
+  app.use(router);
+  app.use((err, req, res, next) => res.status(500).json({ error: 'internal' })); // eslint-disable-line no-unused-vars
+
+  await withServer(app, async (base) => {
+    for (const p of ['/alpha/boom', '/alpha/fail', '/alpha/bad', '/alpha/off', '/alpha/pass', '/kernel/boom']) {
+      await (await fetch(base + p)).text();
+    }
+  });
+  await new Promise((r) => setImmediate(r));
+  const day = tally.snapshot()[TODAY];
+  assert.equal(day['alpha@1.2.0'], 3, 'boom + fail + next(err) — not the 400, not the 503, not the kernel route');
+  assert.equal(day['beta@1.2.0'], 0, 'an enabled module with no routes still files its clean day');
+  loader._reset();
+});
+
+test('the wrapped router still exposes the module’s own routes to tooling', () => {
+  loader._reset();
+  const root = fixtureRoot({
+    alpha: {
+      contributes: { routes: ['main'] },
+      files: { 'routes/main.js': `
+        const express = require(${JSON.stringify(require.resolve('express'))});
+        module.exports = () => { const r = express.Router(); r.get('/alpha/x', (q, s) => s.end()); return r; };` },
+    },
+  });
+  const used = [];
+  loader.mountModuleRoutes({ use: (r) => used.push(r) }, { isEnabled: () => true }, { roots: [root], core: '1.0.0' });
+  assert.equal(used.length, 1);
+  const paths = (used[0].stack || []).filter((l) => l.route).map((l) => l.route.path);
+  assert.deepEqual(paths, ['/alpha/x']);
+  loader._reset();
+});
+
+test('a poller that throws on start counts, and a running poller can report through reportError', async () => {
+  loader._reset();
+  const root = fixtureRoot({
+    broken: { contributes: { pollers: ['p'] }, files: { 'pollers/p.js': 'module.exports = { start() { throw new Error("x"); } };' } },
+    rejecting: { contributes: { pollers: ['p'] }, files: { 'pollers/p.js': 'module.exports = { start() { return Promise.reject(new Error("x")); } };' } },
+    reporting: { contributes: { pollers: ['p'] }, files: { 'pollers/p.js': 'module.exports = { start(deps) { deps.reportError(); deps.reportError(); } };' } },
+  });
+  const opts = { roots: [root], core: '1.0.0' };
+  loader.mountModuleRoutes({ use: () => {} }, { isEnabled: () => true }, opts);
+  const origErr = console.error;
+  console.error = () => {};
+  try {
+    loader.startModulePollers({}, { isEnabled: () => true }, opts);
+    await new Promise((r) => setImmediate(r));
+  } finally { console.error = origErr; }
+  const day = tally.snapshot()[TODAY];
+  assert.equal(day['broken@1.2.0'], 1);
+  assert.equal(day['rejecting@1.2.0'], 1);
+  assert.equal(day['reporting@1.2.0'], 2);
+  loader._reset();
+});
+
+// ---------------------------------------------------------------------------
+// The sender
+// ---------------------------------------------------------------------------
+
+function fakeStore({ enabled = true, known = ['alpha'], post = () => ({ ok: true, status: 200 }) } = {}) {
+  const calls = [];
+  const call = async (method, p, opts = {}) => {
+    calls.push({ method, p, json: opts.json });
+    if (p === '/store/usage-reporting') return { ok: true, status: 200, data: { enabled } };
+    if (p.startsWith('/store/modules/latest')) {
+      return { ok: true, status: 200, data: { latest: Object.fromEntries(known.map((k) => [k, { version: '1.2.0' }])) } };
+    }
+    return post(p, opts.json);
+  };
+  return { call, calls };
+}
+
+test('pendingDays: finished, unsent days inside the store window, oldest first', () => {
+  const days = { '2026-10-14': {}, '2026-10-15': {}, '2026-10-12': {}, '2026-09-01': {} };
+  assert.deepEqual(sender.pendingDays(days, { '2026-10-12': true }, '2026-10-15'), ['2026-10-14']);
+});
+
+test('sendPending sends every count for a store module, zeros included, and skips modules the store does not know', async () => {
+  const { call, calls } = fakeStore();
+  const days = { '2026-10-14': { 'alpha@1.2.0': 0, 'core-thing@3.0.0': 4 } };
+  const out = await sender.sendPending({ days, today: '2026-10-15', call });
+  const posts = calls.filter((c) => c.method === 'POST');
+  assert.equal(posts.length, 1);
+  assert.equal(posts[0].p, '/store/modules/alpha/versions/1.2.0/error-count');
+  assert.deepEqual(posts[0].json, { day: '2026-10-14', count: 0 }, 'a clean day goes as a 0');
+  assert.deepEqual(out.sentDays, ['2026-10-14']);
+  assert.equal(out.skipped, 1);
+});
+
+test('an opted-out builder sends nothing, and the days are marked done', async () => {
+  const { call, calls } = fakeStore({ enabled: false });
+  const out = await sender.sendPending({ days: { '2026-10-14': { 'alpha@1.2.0': 2 } }, today: '2026-10-15', call });
+  assert.equal(calls.filter((c) => c.method === 'POST').length, 0);
+  assert.equal(out.optedOut, true);
+  assert.deepEqual(out.sentDays, ['2026-10-14']);
+});
+
+test('a refusal for good (4xx) is done; a server error leaves the day for the next run', async () => {
+  const refused = fakeStore({ post: () => ({ ok: false, status: 403 }) });
+  const a = await sender.sendPending({ days: { '2026-10-14': { 'alpha@1.2.0': 1 } }, today: '2026-10-15', call: refused.call });
+  assert.deepEqual(a.sentDays, ['2026-10-14']);
+  const down = fakeStore({ post: () => ({ ok: false, status: 502 }) });
+  const b = await sender.sendPending({ days: { '2026-10-14': { 'alpha@1.2.0': 1 } }, today: '2026-10-15', call: down.call });
+  assert.deepEqual(b.sentDays, []);
+  assert.equal(b.retryLater, true);
+});
+
+test('main records the days it sent, and a second run sends nothing again', async () => {
+  const dir = tmpDir('bongos-sender-');
+  const tallyFile = path.join(dir, 'counts.json');
+  const sentFile = path.join(dir, 'sent.json');
+  fs.writeFileSync(tallyFile, JSON.stringify({ days: { '2026-10-14': { 'alpha@1.2.0': 3 }, '2026-10-15': { 'alpha@1.2.0': 1 } } }));
+  const first = fakeStore();
+  const log = () => {};
+  assert.equal(await sender.main([], { log, request: first.call, tallyFile, sentFile, today: '2026-10-15' }), 0);
+  assert.equal(first.calls.filter((c) => c.method === 'POST').length, 1, 'today is not finished, so only yesterday goes');
+  assert.deepEqual(JSON.parse(fs.readFileSync(sentFile, 'utf8')).sent, { '2026-10-14': true });
+  const second = fakeStore();
+  assert.equal(await sender.main([], { log, request: second.call, tallyFile, sentFile, today: '2026-10-15' }), 0);
+  assert.equal(second.calls.length, 0);
+});
+
+test('the server runs the sender as a child process, never in its own process', () => {
+  tally._reset();
+  const ran = [];
+  const timers = tally.startDailySend({ spawnImpl: (s) => ran.push(s) });
+  assert.equal(timers.length, 2, 'a first run soon after boot, then every few hours');
+  tally._reset();
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'module-loader', 'error-tally.js'), 'utf8');
+  assert.doesNotMatch(src, /require\([^)]*cli-lib/, 'the session plumbing never loads in the server');
+});

package/tests/module_test_runner.mjs

@@ -0,0 +1,294 @@
+// tests/module_test_runner.mjs — the separate testing environment for a published
+// module's own tests (task 1004460): the control plane dispatches a run to a
+// private repo's GitHub Actions and PULLS the result back, accepting it only from
+// the run whose run-name carries the pending row's nonce. No network, no DB:
+// GitHub is a fake fetch, the DB an append-only fake.
+//
+// Run:  node tests/module_test_runner.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import zlib from 'node:zlib';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const runner = require('../scripts/gds/module-test-runner.js');
+const { runnerConfig, maybeDispatch, collectResults, sweepTick, readZipEntry, validateSignal, runName, artifactName } = runner;
+
+const CFG = { repo: 'owner/module-tests', token: 't0ken', coreRepo: 'owner/core' };
+const VER = { id: 7, module_key: 'weather', version: '1.0.0', artifact_path: 'weather/weather-1.0.0.tgz' };
+const quiet = { warn() {}, error() {} };
+
+// A minimal zip writer (stored or deflated), enough to stand in for an artifact.
+function makeZip(entries, { deflate = true } = {}) {
+  const locals = []; const centrals = []; let offset = 0;
+  for (const [name, data] of Object.entries(entries)) {
+    const raw = Buffer.from(data);
+    const body = deflate ? zlib.deflateRawSync(raw) : raw;
+    const n = Buffer.from(name);
+    const lh = Buffer.alloc(30); lh.writeUInt32LE(0x04034b50, 0); lh.writeUInt16LE(deflate ? 8 : 0, 8);
+    lh.writeUInt32LE(body.length, 18); lh.writeUInt32LE(raw.length, 22); lh.writeUInt16LE(n.length, 26);
+    const ch = Buffer.alloc(46); ch.writeUInt32LE(0x02014b50, 0); ch.writeUInt16LE(deflate ? 8 : 0, 10);
+    ch.writeUInt32LE(body.length, 20); ch.writeUInt32LE(raw.length, 24); ch.writeUInt16LE(n.length, 28); ch.writeUInt32LE(offset, 42);
+    locals.push(lh, n, body); centrals.push(ch, n); offset += 30 + n.length + body.length;
+  }
+  const cd = Buffer.concat(centrals);
+  const eocd = Buffer.alloc(22); eocd.writeUInt32LE(0x06054b50, 0);
+  eocd.writeUInt16LE(Object.keys(entries).length, 8); eocd.writeUInt16LE(Object.keys(entries).length, 10);
+  eocd.writeUInt32LE(cd.length, 12); eocd.writeUInt32LE(offset, 16);
+  return Buffer.concat([...locals, cd, eocd]);
+}
+
+function fakeDb() {
+  const signals = []; let clock = 0;
+  return {
+    signals,
+    async query(sql, params = []) {
+      if (/ORDER BY measured_at DESC, id DESC LIMIT 1/.test(sql) && !/CROSS JOIN LATERAL/.test(sql)) {
+        const mine = signals.filter((s) => String(s.version_id) === String(params[0]) && s.part === 'tests');
+        return { rows: mine.length ? [mine[mine.length - 1]] : [] };
+      }
+      if (/CROSS JOIN LATERAL/.test(sql)) {
+        assert.match(sql, /FROM store_module_versions v/, 'driven from the versions, not the whole signal history');
+        const cur = {};
+        for (const s of signals.filter((x) => x.part === 'tests')) cur[s.version_id] = s;
+        return { rows: Object.values(cur).filter((r) => r.outcome === 'pending' && r.detail && r.detail.runner) };
+      }
+      if (/INSERT INTO module_assessment_signals/.test(sql)) {
+        signals.push({ id: signals.length + 1, version_id: params[0], part: 'tests', outcome: 'pending', reason: params[1], detail: JSON.parse(params[2]), t: ++clock });
+        return { rows: [] };
+      }
+      throw new Error(`unexpected SQL: ${sql.slice(0, 80)}`);
+    },
+  };
+}
+
+// A fake GitHub: records every call, answers by route.
+function fakeGitHub(routes = {}) {
+  const calls = [];
+  const fetchImpl = async (url, init = {}) => {
+    const method = init.method || 'GET';
+    calls.push({ method, url, body: init.body ? JSON.parse(init.body) : null, auth: init.headers && init.headers.Authorization });
+    for (const [pattern, answer] of Object.entries(routes)) {
+      const [m, re] = pattern.split(' ');
+      if (m === method && new RegExp(re).test(url)) {
+        const a = typeof answer === 'function' ? answer(url, init) : answer;
+        if (a instanceof Response) return a;
+        return new Response(a === null ? null : JSON.stringify(a), { status: a === null ? 204 : 200 });
+      }
+    }
+    return new Response('{"message":"not found"}', { status: 404 });
+  };
+  return { calls, fetchImpl };
+}
+
+const dispatchRoutes = {
+  'POST /git/blobs$': { sha: 'blob1' },
+  'POST /git/trees$': { sha: 'tree1' },
+  'POST /git/commits$': { sha: 'commit1' },
+  'POST /git/refs$': { ref: 'x' },
+  'POST /dispatches$': null,
+};
+
+// ---------------------------------------------------------------------------
+test('unconfigured: no runner, so Tests stays plain pending and nothing is sent', async () => {
+  assert.equal(runnerConfig({}), null);
+  assert.equal(runnerConfig({ MODULE_TEST_REPO: 'a/b' }), null, 'a repo with no token is not configured');
+  const db = fakeDb();
+  assert.equal(await maybeDispatch(VER, { db, env: {} }), null);
+  assert.equal(db.signals.length, 0);
+});
+
+test('config: owner/name is required, the core repo falls back to git origin', () => {
+  assert.throws(() => runnerConfig({ MODULE_TEST_REPO: 'nope', MODULE_TEST_TOKEN: 'x' }), /owner\/name/);
+  const c = runnerConfig({ MODULE_TEST_REPO: 'o/r', MODULE_TEST_TOKEN: 'x' }, { origin: () => 'o/core' });
+  assert.deepEqual(c, { repo: 'o/r', token: 'x', coreRepo: 'o/core', ref: 'main' });
+  assert.equal(runnerConfig({ MODULE_TEST_REPO: 'o/r', MODULE_TEST_TOKEN: 'x', MODULE_TEST_REF: 'trunk' }, { origin: () => 'o/core' }).ref, 'trunk');
+});
+
+test('dispatch pushes the tarball to a throwaway branch, dispatches, and records the nonce', async () => {
+  const db = fakeDb();
+  const gh = fakeGitHub(dispatchRoutes);
+  const r = await maybeDispatch(VER, { db, cfg: CFG, fetchImpl: gh.fetchImpl, readTarball: async () => Buffer.from('tgz'), coreRef: () => 'abc123', log: quiet });
+  assert.match(r.nonce, /^[0-9a-f]{32}$/);
+  assert.equal(r.branch, `module-test/${r.nonce}`);
+  assert.deepEqual(gh.calls.map((c) => `${c.method} ${c.url.replace('https://api.github.com/repos/owner/module-tests', '')}`), [
+    'POST /git/blobs', 'POST /git/trees', 'POST /git/commits', 'POST /git/refs', 'POST /actions/workflows/module-tests.yml/dispatches']);
+  assert.deepEqual(gh.calls[2].body.parents, [], 'an orphan commit: the branch carries only the tarball');
+  assert.equal(gh.calls[3].body.ref, `refs/heads/module-test/${r.nonce}`);
+  assert.equal(gh.calls[4].body.ref, 'main');
+  assert.deepEqual(gh.calls[4].body.inputs, { version_id: '7', module_key: 'weather', nonce: r.nonce, core_repo: 'owner/core', core_ref: 'abc123' });
+  assert.equal(db.signals.length, 1);
+  assert.equal(db.signals[0].outcome, 'pending');
+  assert.equal(db.signals[0].detail.runner.nonce, r.nonce);
+});
+
+test('a version with a real Tests result, or a run already in flight, is not dispatched again', async () => {
+  for (const existing of [{ outcome: 'scored', detail: {} }, { outcome: 'pending', detail: { runner: { nonce: 'a'.repeat(32) } } }]) {
+    const db = fakeDb();
+    db.signals.push({ id: 1, version_id: 7, part: 'tests', ...existing });
+    const gh = fakeGitHub(dispatchRoutes);
+    assert.equal(await maybeDispatch(VER, { db, cfg: CFG, fetchImpl: gh.fetchImpl, readTarball: async () => Buffer.from('x'), coreRef: () => 'c', log: quiet }), null);
+    assert.equal(gh.calls.length, 0);
+  }
+});
+
+test('a plain pending (from before the runner was set up) is dispatched', async () => {
+  const db = fakeDb();
+  db.signals.push({ id: 1, version_id: 7, part: 'tests', outcome: 'pending', detail: {} });
+  const gh = fakeGitHub(dispatchRoutes);
+  assert.ok(await maybeDispatch(VER, { db, cfg: CFG, fetchImpl: gh.fetchImpl, readTarball: async () => Buffer.from('x'), coreRef: () => 'c', log: quiet }));
+});
+
+test('a failed dispatch deletes the branch, records nothing and never throws', async () => {
+  const db = fakeDb();
+  const gh = fakeGitHub({ ...dispatchRoutes, 'POST /dispatches$': () => new Response('{"message":"nope"}', { status: 422 }), 'DELETE /git/refs/heads/module-test/': null });
+  assert.equal(await maybeDispatch(VER, { db, cfg: CFG, fetchImpl: gh.fetchImpl, readTarball: async () => Buffer.from('x'), coreRef: () => 'c', log: quiet }), null);
+  assert.equal(gh.calls.at(-1).method, 'DELETE');
+  assert.equal(db.signals.length, 0);
+});
+
+// ---------------------------------------------------------------------------
+test('readZipEntry reads deflated and stored entries, and refuses an oversized one', () => {
+  const z = makeZip({ 'other.txt': 'x', 'signal.json': '{"a":1}' });
+  assert.equal(readZipEntry(z, 'signal.json').toString(), '{"a":1}');
+  assert.equal(readZipEntry(makeZip({ 'signal.json': 'plain' }, { deflate: false }), 'signal.json').toString(), 'plain');
+  assert.equal(readZipEntry(z, 'missing.json'), null);
+  assert.throws(() => readZipEntry(makeZip({ 'signal.json': 'x'.repeat(2000) }), 'signal.json', { maxBytes: 1000 }), /over 1000 bytes/);
+  assert.throws(() => readZipEntry(Buffer.from('not a zip at all, definitely not'), 'signal.json'), /not a zip/);
+});
+
+test('validateSignal holds the payload to its run and to the stored shape', () => {
+  const base = { version_id: '7', nonce: 'n', outcome: 'scored', score: 80, sample_size: 5, reason: 'r', detail: { files: [{ file: 'tests/a.mjs', passed: true, extra: 'dropped' }] } };
+  const ok = validateSignal(base, { versionId: 7, nonce: 'n' });
+  assert.deepEqual(ok, { outcome: 'scored', score: 80, sample_size: 5, reason: 'r', detail: { files: [{ file: 'tests/a.mjs', passed: true }] } });
+  assert.throws(() => validateSignal({ ...base, nonce: 'other' }, { versionId: 7, nonce: 'n' }), /different version or run/);
+  assert.throws(() => validateSignal({ ...base, version_id: '8' }, { versionId: 7, nonce: 'n' }), /different version or run/);
+  assert.throws(() => validateSignal({ ...base, score: 101 }, { versionId: 7, nonce: 'n' }), /0–100/);
+  assert.throws(() => validateSignal({ ...base, outcome: 'passed' }, { versionId: 7, nonce: 'n' }), /unknown outcome/);
+  assert.equal(validateSignal({ ...base, outcome: 'no_data', score: 99 }, { versionId: 7, nonce: 'n' }).score, null);
+});
+
+// ---------------------------------------------------------------------------
+const NONCE = 'b'.repeat(32);
+function pendingDb(at = new Date().toISOString()) {
+  const db = fakeDb();
+  db.signals.push({ id: 1, version_id: 7, part: 'tests', outcome: 'pending', detail: { runner: { nonce: NONCE, branch: `module-test/${NONCE}`, dispatched_at: at } } });
+  return db;
+}
+const recorded = [];
+const insert = async (id, s) => { recorded.push({ id, ...s }); };
+const recompose = async () => {};
+
+test('collect takes only the run whose run-name carries the nonce, and only its artifact of that name', async () => {
+  recorded.length = 0;
+  const payload = { version_id: '7', nonce: NONCE, outcome: 'scored', score: 50, sample_size: 2, reason: '1 of 2 failed', detail: { files: [] } };
+  const forged = { ...payload, score: 100 };
+  const gh = fakeGitHub({
+    'GET /workflows/module-tests.yml/runs': { runs: [
+      { id: 900, display_title: runName(8, 'c'.repeat(32)), status: 'completed', conclusion: 'success' },
+      { id: 901, display_title: runName(7, NONCE), status: 'completed', conclusion: 'success' },
+    ] },
+    // run 900 (another version's run) uploads an artifact claiming version 7's name
+    'GET /runs/900/artifacts': { artifacts: [{ name: artifactName(7, NONCE), archive_download_url: 'https://dl/900', expired: false }] },
+    'GET /runs/901/artifacts': { artifacts: [{ name: 'tarball-x', archive_download_url: 'https://dl/no' }, { name: artifactName(7, NONCE), archive_download_url: 'https://dl/901', expired: false }] },
+    'GET ^https://dl/900': () => new Response(makeZip({ 'signal.json': JSON.stringify(forged) })),
+    'GET ^https://dl/901': () => new Response(null, { status: 302, headers: { location: 'https://blob/901' } }),
+    'GET ^https://blob/901': () => new Response(makeZip({ 'signal.json': JSON.stringify(payload) })),
+    'DELETE /git/refs/heads/': null,
+  });
+  const res = await collectResults({ db: pendingDb(), cfg: CFG, fetchImpl: gh.fetchImpl, insert, recompose });
+  assert.deepEqual(res, [{ version_id: 7, status: 'recorded', outcome: 'scored' }]);
+  assert.equal(recorded[0].score, 50, 'the forged artifact in run 900 was never read');
+  assert.deepEqual(recorded[0].detail.runner, { nonce: NONCE, run_id: 901 });
+  assert.ok(!gh.calls.some((c) => c.url.includes('/runs/900/')), 'another run is never even listed');
+  const blob = gh.calls.find((c) => c.url === 'https://blob/901');
+  assert.equal(blob.auth, undefined, 'the token is not sent past the redirect');
+  assert.equal(gh.calls.at(-1).method, 'DELETE', 'the branch is deleted once the result is in');
+});
+
+test('collect waits on an unfinished run, and gives up on one past the age limit', async () => {
+  recorded.length = 0;
+  const gh = fakeGitHub({ 'GET /runs\\?': { runs: [{ id: 1, display_title: runName(7, NONCE), status: 'in_progress' }] }, 'DELETE /git/refs/': null });
+  assert.deepEqual(await collectResults({ db: pendingDb(), cfg: CFG, fetchImpl: gh.fetchImpl, insert, recompose }), [{ version_id: 7, status: 'waiting' }]);
+  assert.equal(recorded.length, 0);
+  const old = new Date(Date.now() - 7 * 3600_000).toISOString();
+  const res = await collectResults({ db: pendingDb(old), cfg: CFG, fetchImpl: gh.fetchImpl, insert, recompose });
+  assert.deepEqual(res, [{ version_id: 7, status: 'expired', outcome: 'not_scored' }]);
+  assert.match(recorded[0].reason, /did not finish in time/);
+});
+
+test('a run that never started is waited on, then expires as not_scored', async () => {
+  recorded.length = 0;
+  const gh = fakeGitHub({ 'GET /runs\\?': { runs: [] }, 'DELETE /git/refs/': null });
+  assert.deepEqual(await collectResults({ db: pendingDb(), cfg: CFG, fetchImpl: gh.fetchImpl, insert, recompose }), [{ version_id: 7, status: 'waiting' }]);
+  const old = new Date(Date.now() - 7 * 3600_000).toISOString();
+  const res = await collectResults({ db: pendingDb(old), cfg: CFG, fetchImpl: gh.fetchImpl, insert, recompose });
+  assert.deepEqual(res, [{ version_id: 7, status: 'expired', outcome: 'not_scored' }]);
+  assert.match(recorded[0].reason, /never started/);
+  assert.equal(gh.calls.at(-1).method, 'DELETE', 'its branch is still cleaned up');
+});
+
+test('the sweeper keeps going while a run is out or a sweep fails, and stops once nothing waits', async () => {
+  const tick = (res) => sweepTick({ db: {}, cfg: CFG, log: quiet, collect: async () => { if (res instanceof Error) throw res; return res; } });
+  assert.equal(await tick([{ version_id: 7, status: 'waiting' }, { version_id: 8, status: 'recorded' }]), true);
+  assert.equal(await tick(new Error('GitHub down')), true, 'a failed sweep is retried, not abandoned');
+  assert.equal(await tick([{ version_id: 7, status: 'recorded' }]), false);
+  assert.equal(await tick([]), false);
+});
+
+test('a run that ended with no result artifact records not_scored, never a zero', async () => {
+  recorded.length = 0;
+  const gh = fakeGitHub({ 'GET /runs\\?': { runs: [{ id: 5, display_title: runName(7, NONCE), status: 'completed', conclusion: 'failure' }] }, 'GET /runs/5/artifacts': { artifacts: [] }, 'DELETE /git/refs/': null });
+  await collectResults({ db: pendingDb(), cfg: CFG, fetchImpl: gh.fetchImpl, insert, recompose });
+  assert.equal(recorded[0].outcome, 'not_scored');
+  assert.equal(recorded[0].score, null);
+  assert.match(recorded[0].reason, /ended \(failure\) without a result/);
+});
+
+test('nothing pending: collect does not call GitHub', async () => {
+  const gh = fakeGitHub({});
+  assert.deepEqual(await collectResults({ db: fakeDb(), cfg: CFG, fetchImpl: gh.fetchImpl, insert, recompose }), []);
+  assert.equal(gh.calls.length, 0);
+});
+
+// ---------------------------------------------------------------------------
+test('--tarball keeps the gate: outside the testing environment it refuses before reading anything', () => {
+  let out;
+  try {
+    execFileSync(process.execPath, ['scripts/gds/module-assess-tests.js', '--tarball', 'does-not-exist.tgz', '--key', 'weather', '--json'],
+      { cwd: ROOT, env: { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot }, encoding: 'utf8', stdio: 'pipe' });
+  } catch (e) { out = e; }
+  assert.ok(out, 'it exits non-zero');
+  assert.match(out.stderr, /separate testing environment/);
+});
+
+test('the workflow template: no permissions for the job that runs module code, nonce in the run-name, no inputs in shell', () => {
+  const yml = fs.readFileSync(path.join(ROOT, 'scripts/gds/module-test-runner/module-tests.yml'), 'utf8');
+  assert.match(yml, /^permissions: \{\}$/m);
+  assert.match(yml, /^run-name: module-tests \$\{\{ inputs\.version_id \}\} \$\{\{ inputs\.nonce \}\}$/m);
+  assert.equal(runName(7, 'n'), 'module-tests 7 n', 'collect matches the template\'s run-name');
+  const testJob = yml.slice(yml.indexOf('\n  test:'));
+  assert.match(testJob, /permissions: \{\}/);
+  assert.match(testJob, /MODULE_TEST_SANDBOX=1/);
+  // Module code runs as an unprivileged user whose packets the firewall rejects off loopback.
+  const cut = testJob.indexOf('Cut the network');
+  const run = testJob.indexOf("Run the module's own tests");
+  assert.ok(cut > testJob.indexOf('npm ci') && cut < run, 'the network is cut after the install and before module code runs');
+  assert.match(testJob, /--uid-owner moduletest -o lo -j ACCEPT/);
+  assert.match(testJob, /--uid-owner moduletest -j REJECT/);
+  assert.match(testJob.slice(run), /sudo -u moduletest -H env -i /, 'module code runs as moduletest with a cleared environment');
+  assert.match(testJob, /name: "module-tests-\$\{\{ inputs\.version_id \}\}-\$\{\{ inputs\.nonce \}\}"/);
+  assert.equal(artifactName(7, 'n'), 'module-tests-7-n');
+  // A `run:` block never interpolates an input (script injection): inputs reach shell only via env.
+  for (const block of yml.split(/\n\s+run: /).slice(1)) {
+    const body = block.split(/\n\s+- /)[0];
+    assert.doesNotMatch(body, /\$\{\{/, `a run block interpolates an expression: ${body.slice(0, 60)}`);
+  }
+  assert.doesNotMatch(yml, /secrets\./, 'the workflow reads no secrets');
+});

package/tests/project_catalog_routes.mjs

@@ -239,7 +239,7 @@ test('the OWNER READ self-heals the projection, with the row it just read (task
 });
 
 test('a REFUSED read heals NOTHING — the repair only ever rides an own-scoped request', async () => {
-  // instanceAccessDenied answers 404 for someone else's instance, and the heal must sit
+  // requireProjectOwner answers 404 for someone else's instance, and the heal must sit
   // BEHIND that gate: an unauthenticated or wrong-owner read must never make the platform
   // write a catalog row on a stranger's behalf.
   instance = { ...BASE_ROW, owner_builder_id: 99 };

package/tests/provision.mjs

@@ -637,6 +637,8 @@ t('systemd manager: emits byte-identical commands + unit paths to the inline str
     'sudo rm -f /etc/systemd/system/demo.service [allowFail]',
     'sudo systemctl disable --now demo-db-backup.timer [allowFail]',
     'sudo rm -f /etc/systemd/system/demo-db-backup.service /etc/systemd/system/demo-db-backup.timer [allowFail]',
+    'sudo rm -f /etc/systemd/system.control/demo.service.d/50-*.conf [allowFail]',   // the caps drop-in (task 1004414)
+    'sudo rmdir /etc/systemd/system.control/demo.service.d [allowFail]',
     'sudo systemctl daemon-reload [allowFail]',
     'sudo systemctl reset-failed demo.service demo-db-backup.service [allowFail]',
   ], 'including reset-failed — a removed unit\'s FAILED state outlives its file (task 1003940)');