@bongos/core 1.21.175 → 1.21.176

package/tests/wizard_demo.mjs

@@ -263,7 +263,7 @@ test('the small link opens the demo in place, the steppers stay in their limits,
   assert.equal(h.$('demoSetup').hidden, true, 'the same link closes it again');
   assert.equal(h.$('wizDemo').attrs['aria-expanded'], 'false');
   assert.doesNotMatch(HUB, /id="demoReady"|id="demoRing"|id="demoNext1"|id="demoBack1"|id="demoBack2"|id="demoStageCap"|id="forkIntro"/, 'no second demo screen and no fork');
-  assert.match(HUB, /<p class="pageSub" id="pageSub">Three parts, one page\. Just looking\? <button type="button" class="linklike" id="wizDemo" aria-controls="demoSetup" aria-expanded="false">Try a small demo instead<\/button>\.<\/p>/,
+  assert.match(HUB, /<p class="pageSub" id="pageSub">Just looking\? <button type="button" class="linklike" id="wizDemo" aria-controls="demoSetup" aria-expanded="false">Try a small demo instead<\/button>\.<\/p>/,
     'the demo is a small link under the heading, in the mockup\'s words');
 });
 

package/tests/wizard_one_page.mjs

@@ -61,7 +61,7 @@ test('the old screens, their doors and the confirm-every-row machinery are gone,
 test('the page opens with the mockup\'s own words, in the mockup\'s order', () => {
   const words = [
     'Make something.',
-    'Three parts, one page. Just looking?',
+    'Just looking?',
     'Try a small demo instead',
     'Your project',
     'A few quick checks. They decide which legal and payout options we can offer.',
@@ -70,11 +70,12 @@ test('the page opens with the mockup\'s own words, in the mockup\'s order', () =
     'Create my project',
     'Connect GitHub',
     'opens once your project exists',
-    'One trip to GitHub. Approve the app, pick your repo, and you land back here. We tick each step as it happens, from any tab or device.',
+    'Two steps on GitHub: approve the app, then install it on your repo. You land back here afterwards.',
   ];
   let at = 0;
   for (const w of words) {
-    assert.ok(MOCK.includes(w.replace('How it’s run', 'How it\'s run')), `"${w}" is the mockup's own`);
+    // part 03's sub-line was rewritten after the mockup (owner feedback from UAT): plain words, what to do
+    if (!w.startsWith('Two steps on GitHub')) assert.ok(MOCK.includes(w.replace('How it’s run', 'How it\'s run')), `"${w}" is the mockup's own`);
     const i = PAGE.indexOf(w, at);
     assert.ok(i >= at, `"${w}" comes next on the page`);
     at = i;

package/tests/wizard_physics.mjs

@@ -111,7 +111,9 @@ test('the page carries the server\'s countries, regions and entity forms, exactl
   const plain = (v) => JSON.parse(JSON.stringify(v)); // values born in the vm
   assert.deepEqual(plain(box.PHYS_COUNTRIES), [...physics.COUNTRY_CODES]);
   assert.deepEqual(Object.keys(box.PHYS_REGIONS).sort(), [...physics.REGION_CODES].sort());
-  assert.deepEqual(plain(box.PHYS_ENTITY_FORMS), [...physics.ENTITY_FORMS]);
+  // the page no longer offers the two group forms (a group is an owner answer with its own text);
+  // the server still accepts them for projects that stored one
+  assert.deepEqual(plain(box.PHYS_ENTITY_FORMS), physics.ENTITY_FORMS.filter((f) => f !== 'university-project' && f !== 'social-group'));
   // every entity the page has words for is an entity answer (PHYS_MATERIAL, the plates
   // per entity, left with the forming planet in task 1004504)
   assert.equal(box.PHYS_MATERIAL, undefined, 'the per-entity plates are gone');

package/tests/wizard_physics_more.mjs

@@ -243,6 +243,45 @@ test('the kit stub\'s physics hide rules are the table\'s own, word for word', (
   }
 });
 
+// ── the region is typed, and a group owner says what kind of group ───────────
+test('the region is a typed box: a name or a code becomes the code the server reads, anything else un-answers it', () => {
+  const w = boot();
+  w.run('physDefaults(); paintChecks();');
+  w.a().home_country = 'US';
+  for (const [typed, want] of [['New York', 'US-NY'], ['california', 'US-CA'], ['ny', 'US-NY'], ['Atlantis', null], ['', null]]) {
+    w.$('physRegion').value = typed;
+    w.$('physRegion').listeners.input();
+    assert.equal(w.a().home_region, want, `"${typed}" reads as ${want}`);
+  }
+  w.a().home_country = 'CA';
+  w.$('physRegion').value = 'Ontario';
+  w.$('physRegion').listeners.input();
+  assert.equal(w.a().home_region, 'CA-ON', 'Canada reads its own provinces');
+  w.$('physRegion').value = 'New York';
+  w.$('physRegion').listeners.input();
+  assert.equal(w.a().home_region, null, 'and not a state of another country');
+});
+
+test('"A group" asks what type of group, and the words travel with the create; no other owner sends them', () => {
+  const w = boot();
+  w.run('physDefaults(); paintChecks();');
+  assert.equal(w.$('physGroupField').hidden, true, 'hidden until A group is picked');
+  w.pick('entity', 'intent-group');
+  w.run('paintChecks()');
+  assert.equal(w.$('physGroupField').hidden, false, 'A group opens the question');
+  w.$('physGroupType').value = '  A neighborhood association ';
+  w.$('physGroupType').listeners.input();
+  assert.equal(w.a().entity_group_type, 'A neighborhood association');
+  const d = plain(w.run('createDetail()'));
+  assert.equal(d.entity, 'intent-group');
+  assert.equal(d.entity_group_type, 'A neighborhood association');
+  assert.equal(physics.canonicalAnswer(physics.PLANET_PHYSICS_QUESTIONS.entity_group_type, d.entity_group_type), d.entity_group_type, 'the server accepts what the page sends');
+  w.pick('entity', 'intent-company');
+  w.run('paintChecks()');
+  assert.equal(w.$('physGroupField').hidden, true, 'another owner closes it again');
+  assert.equal(plain(w.run('createDetail()')).entity_group_type, undefined, 'and the words are not sent');
+});
+
 // ── part 01, the quick checks ────────────────────────────────────────────────
 test('the quick checks reveal what an answer opens: the age tiers, the legal forms, a state or province', () => {
   const w = boot();
@@ -268,7 +307,7 @@ test('the quick checks reveal what an answer opens: the age tiers, the legal for
   w.$('physCountry').value = 'US';
   w.$('physCountry').listeners.change();
   assert.equal(w.$('physRegionField').hidden, false, 'a country with states asks for one');
-  assert.ok(w.$('physRegion').children.some((o) => o.value === 'US-CA'));
+  assert.ok(w.$('physRegionList').children.some((o) => o.value === 'California'));
   w.$('physCountry').value = 'NL';
   w.$('physCountry').listeners.change();
   assert.equal(w.$('physRegionField').hidden, true, 'and one without does not');
@@ -566,7 +605,7 @@ test('a new owner walks the page from the quick checks through the rows they cha
   const w = boot({ draft: { description: 'An inventory tool our team started last year.' } });
   w.run('physDefaults(); paintChecks(); paintSetup();');
   w.$('physCountry').value = 'US'; w.$('physCountry').listeners.change();
-  w.$('physRegion').value = 'US-NY'; w.$('physRegion').listeners.change();
+  w.$('physRegion').value = 'New York'; w.$('physRegion').listeners.input();
   w.pick('builder_geography', 'global');
   w.pick('minors_on_board', 'false');
   w.$('physHaveEntity').click();
@@ -722,7 +761,7 @@ test('a country picked from the list runs the select\'s own path: the region, th
   assert.equal(w.a().home_country, 'CA');
   assert.equal(w.a().home_region, null, 'a state of another country is dropped');
   assert.equal(w.$('physRegionField').hidden, false, 'a country with provinces asks for one');
-  assert.ok(w.$('physRegion').children.some((o) => o.value === 'CA-ON'));
+  assert.ok(w.$('physRegionList').children.some((o) => o.value === 'Ontario'));
   typeCountry(w, 'netherlands');
   w.$('physCountryList').children.find((c) => c.getAttribute('data-code') === 'NL').click();
   assert.equal(w.$('physRegionField').hidden, true, 'and one without does not');

package/tests/work_title_wrap.mjs

@@ -2,7 +2,7 @@
 //
 // At 390 the backlog title "Watch redesign: … People/Operations/Security tabs" ran
 // 44px past its column: a slash-joined run offers the browser no break point. The
-// rendered check (scripts/gds/render-check.js) is what measures it; this pins the
+// rendered check (scripts/bongos/render-check.js) is what measures it; this pins the
 // two halves of the fix in source so neither is dropped by an unrelated edit.
 //
 // Run:  node tests/work_title_wrap.mjs

package/tests/workflow_exec_paths.mjs

@@ -18,7 +18,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
-const { lintWorkflowExec } = require('../scripts/gds/lint-workflow-exec.js');
+const { lintWorkflowExec } = require('../scripts/bongos/lint-workflow-exec.js');
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const REPO = path.resolve(__dirname, '..');
 const CORE_PATH_SH = path.join(REPO, 'infra', 'core-path.sh');
@@ -48,8 +48,8 @@ hostTest('lint-workflow-exec: every core invocation is routed + publishable (no
   assert.ok(r.ok, 'lint should pass');
   // The security-critical merge gates + the functional gates must all be covered.
   const rels = r.checked.map((c) => `${c.file}:${c.rel}`);
-  assert.ok(rels.some((s) => s.startsWith('gate-review.yml:') && s.endsWith('scripts/gds/gate-review.js')), 'gate-review routed');
-  assert.ok(rels.some((s) => s.startsWith('grade-gate.yml:') && s.endsWith('scripts/gds/ci-grade.js')), 'grade-gate routed');
+  assert.ok(rels.some((s) => s.startsWith('gate-review.yml:') && s.endsWith('scripts/bongos/gate-review.js')), 'gate-review routed');
+  assert.ok(rels.some((s) => s.startsWith('grade-gate.yml:') && s.endsWith('scripts/bongos/ci-grade.js')), 'grade-gate routed');
   assert.ok(rels.some((s) => s.endsWith('scripts/migrate.sh')), 'selfhost migrate routed via core-path.sh');
 });
 
@@ -57,10 +57,10 @@ test('lint-workflow-exec: a bare core invocation in a workflow is flagged (count
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'wf-lint-'));
   try {
     fs.mkdirSync(path.join(tmp, '.github', 'workflows'), { recursive: true });
-    fs.mkdirSync(path.join(tmp, 'scripts', 'gds'), { recursive: true });
-    fs.writeFileSync(path.join(tmp, 'scripts', 'gds', 'gate-review.js'), '// probe\n');
+    fs.mkdirSync(path.join(tmp, 'scripts', 'bongos'), { recursive: true });
+    fs.writeFileSync(path.join(tmp, 'scripts', 'bongos', 'gate-review.js'), '// probe\n');
     fs.writeFileSync(path.join(tmp, '.github', 'workflows', 'legacy.yml'),
-      'jobs:\n  x:\n    steps:\n      - run: node scripts/gds/gate-review.js\n');
+      'jobs:\n  x:\n    steps:\n      - run: node scripts/bongos/gate-review.js\n');
     const r = lintWorkflowExec({ instanceRoot: tmp, coreRoot: tmp });
     assert.ok(!r.ok, 'a bare core invocation must fail the lint');
     assert.equal(r.violations.length, 1);

package/tests/worktree_claim_guard.mjs

@@ -15,7 +15,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { decideWorktreeClaim, ESCAPE_FLAG } = require('../scripts/gds/worktree-claim-guard.js');
+const { decideWorktreeClaim, ESCAPE_FLAG } = require('../scripts/bongos/worktree-claim-guard.js');
 
 let passed = 0;
 let failed = 0;

package/tests/worktree_helper.mjs

@@ -1,6 +1,6 @@
 // tests/worktree_helper.mjs
 //
-// Unit tests for the pure decision helpers behind scripts/gds/worktree.js
+// Unit tests for the pure decision helpers behind scripts/bongos/worktree.js
 // (task 1002809) — the junction-safe worktree lifecycle for Windows builders.
 //
 // The trap this tooling kills: a worktree OUTSIDE the repo root (C:/tmp/wt-N,
@@ -27,7 +27,7 @@ import os from 'node:os';
 import path from 'node:path';
 
 const require = createRequire(import.meta.url);
-const { worktreeNameFor, needsJunction, removalPlan, nodeModulesState, shadowingNodeModules, huskDisposition, unlinkNodeModulesLink } = require('../scripts/gds/worktree.js');
+const { worktreeNameFor, needsJunction, removalPlan, nodeModulesState, shadowingNodeModules, huskDisposition, unlinkNodeModulesLink } = require('../scripts/bongos/worktree.js');
 
 const HOUR = 60 * 60 * 1000;
 

package/tests/write_validation_gaps.mjs

@@ -23,20 +23,20 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const read = (p) => fs.readFileSync(path.join(ROOT, p), 'utf8');
 
 test('the baseline is empty — the invariant is back to hard-zero', () => {
-  const fit = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
+  const fit = require(path.join(ROOT, 'scripts', 'bongos', 'fitness.js'));
   const baseline = fit.WRITE_VALIDATION_BASELINE;
   if (baseline !== undefined) {
     assert.equal(baseline.size, 0, `still-exempt write routes: ${[...baseline].join(', ')}`);
   } else {
     // Deleted outright rather than emptied — also acceptable, and the fitness
     // check below is the real assertion either way.
-    assert.doesNotMatch(read('scripts/gds/fitness.js'), /'POST \/inbox\/:id\/ratify'/,
+    assert.doesNotMatch(read('scripts/bongos/fitness.js'), /'POST \/inbox\/:id\/ratify'/,
       'the ratify entry must be gone from the baseline');
   }
 });
 
 test('fitness reports ZERO unvalidated write routes', () => {
-  const fit = require(path.join(ROOT, 'scripts', 'gds', 'fitness.js'));
+  const fit = require(path.join(ROOT, 'scripts', 'bongos', 'fitness.js'));
   assert.equal(typeof fit.scanUnvalidatedWriteRoutes, 'function',
     'the scanner must stay exported so this cannot silently stop being checked');
   const unvalidated = fit.scanUnvalidatedWriteRoutes();

package/scripts/gds/api.sh

@@ -1,6 +0,0 @@
-#!/usr/bin/env bash
-# scripts/gds/api.sh — Git Bash/Linux passthrough wrapper around api.js.
-# MSYS_NO_PATHCONV avoids Git Bash mangling API paths (e.g. /api/bongos/inbox) into
-# Windows paths before node ever sees them.
-export MSYS_NO_PATHCONV=1
-exec node "$(dirname "$0")/api.js" "$@"

package/scripts/gds/audit-exports.js

@@ -1,128 +0,0 @@
-#!/usr/bin/env node
-// audit-exports.js — V3.R?? (#467). Dead-export checker for the grader modules.
-//
-// The MAS grader accreted v1/v2/v3 code; some exported symbols outlived their
-// only consumer (the dead exports #466 deletes). This script is the cheap,
-// greppable, CI-hookable guard that catches that class — same spirit as
-// audit-authorship.sh (V3.R12): require the target modules, read their actual
-// export keys, then scan the repo for a real consumer of each.
-//
-// Classification per exported symbol:
-//   consumed   — referenced in src/ or scripts/ outside the defining file
-//   test-only  — referenced ONLY under tests/ (a warning: exported for tests)
-//   DEAD       — no word-boundary reference anywhere outside the defining file
-//
-// Exit 1 if any DEAD export (nothing imports it). test-only is reported but
-// does not fail. --json prints the raw classification.
-//
-// Usage: node scripts/gds/audit-exports.js [--json]
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-const REPO_ROOT = path.resolve(__dirname, '../..');
-
-// Modules whose export surface we police. Add more as the grader grows.
-const TARGETS = [
-  'modules/grading/grader.js',
-  'modules/grading/grader-workers/index.js',
-];
-
-// Dirs scanned for consumers.
-const SCAN_DIRS = ['src', 'scripts', 'tests'];
-const CODE_EXT = new Set(['.js', '.mjs', '.cjs']);
-
-// Walk a dir collecting code files (skip node_modules / .git).
-function collectFiles(dir, out) {
-  let entries;
-  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return out; }
-  for (const e of entries) {
-    if (e.name === 'node_modules' || e.name === '.git') continue;
-    const full = path.join(dir, e.name);
-    if (e.isDirectory()) collectFiles(full, out);
-    else if (CODE_EXT.has(path.extname(e.name))) out.push(full);
-  }
-  return out;
-}
-
-// Build { absPath: content } for the whole scan corpus.
-function buildCorpus() {
-  const files = [];
-  for (const d of SCAN_DIRS) collectFiles(path.join(REPO_ROOT, d), files);
-  const corpus = {};
-  for (const f of files) {
-    try { corpus[f] = fs.readFileSync(f, 'utf8'); } catch { /* skip unreadable */ }
-  }
-  return corpus;
-}
-
-// Pure core: given a target's absolute path + its exported symbol names + the
-// corpus ({absPath: content}), classify each export. A reference is a
-// word-boundary match of the symbol in any corpus file OTHER than the defining
-// file. Exported under tests/ only → test-only; nowhere → DEAD.
-function classifyExports(targetAbsPath, exportNames, corpus) {
-  const results = [];
-  for (const name of exportNames) {
-    const re = new RegExp(`\\b${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`);
-    let inSrcOrScripts = false;
-    let inTests = false;
-    for (const [file, content] of Object.entries(corpus)) {
-      if (file === targetAbsPath) continue; // self-references don't count
-      if (!re.test(content)) continue;
-      // A file is a test by virtue of living under a tests/ segment — checked
-      // on the raw path (not REPO_ROOT-relative) so the core stays pure +
-      // unit-testable with synthetic paths.
-      const isTest = /(^|[\\/])tests[\\/]/.test(file);
-      if (isTest) inTests = true;
-      else inSrcOrScripts = true;
-    }
-    const status = inSrcOrScripts ? 'consumed' : inTests ? 'test-only' : 'DEAD';
-    results.push({ name, status });
-  }
-  return results;
-}
-
-function run({ json = false } = {}) {
-  const corpus = buildCorpus();
-  const all = [];
-  for (const rel of TARGETS) {
-    const abs = path.join(REPO_ROOT, rel);
-    let mod;
-    try { mod = require(abs); } catch (err) {
-      console.error(`audit-exports: could not require ${rel}: ${err.message}`);
-      process.exitCode = 1;
-      continue;
-    }
-    const names = Object.keys(mod);
-    for (const r of classifyExports(abs, names, corpus)) {
-      all.push({ module: rel, ...r });
-    }
-  }
-
-  const dead = all.filter((r) => r.status === 'DEAD');
-  const testOnly = all.filter((r) => r.status === 'test-only');
-
-  if (json) {
-    console.log(JSON.stringify({ dead, test_only: testOnly, all }, null, 2));
-  } else {
-    console.log(`audit-exports: ${all.length} exported symbol(s) across ${TARGETS.length} module(s)`);
-    if (dead.length) {
-      console.log(`\n  DEAD (no consumer anywhere — un-export or delete):`);
-      for (const r of dead) console.log(`    ✗ ${r.module} → ${r.name}`);
-    }
-    if (testOnly.length) {
-      console.log(`\n  test-only (exported but used only by tests):`);
-      for (const r of testOnly) console.log(`    • ${r.module} → ${r.name}`);
-    }
-    if (!dead.length) console.log('  no dead exports — every exported symbol has a consumer ✓');
-  }
-
-  if (dead.length) process.exitCode = 1;
-  return { dead, testOnly, all };
-}
-
-if (require.main === module) {
-  run({ json: process.argv.includes('--json') });
-}
-
-module.exports = { classifyExports, buildCorpus, run, TARGETS };

package/scripts/gds/resolve-skill-model.js

@@ -1,57 +0,0 @@
-#!/usr/bin/env node
-// Resolve the effective model token for a skill invocation.
-//
-// Usage:
-//   node scripts/gds/resolve-skill-model.js <skill-name>
-//
-// Prints one of: opus | sonnet | haiku | script
-//
-// Each SKILL.md that spawns an Agent tool call should invoke this helper
-// at the top to honour the builder's per-skill model preferences (V3.R85
-// / ADR #304). Without this, the skill-model-preferences matrix is
-// honest but inert — the builder sets a preference, but every Agent call
-// still uses whatever model the parent session inherits.
-//
-// Exit 0 + prints the model token on success.
-// Exit 1 + prints an error on failure (network, no session, unknown
-// skill). Callers should treat exit 1 as "fall back to opus" rather
-// than aborting — a failure in preference resolution should not block
-// the skill itself.
-
-const { cliClient, requireSession } = require('./cli-lib');
-
-(async () => {
-  await requireSession();
-  const skillName = process.argv[2];
-  if (!skillName) {
-    console.error('usage: node scripts/gds/resolve-skill-model.js <skill-name>');
-    process.exit(1);
-  }
-
-  const api = await cliClient();
-  const r = await api.me.getMeSkillPrefs();
-  if (!r.ok) {
-    console.error(`resolve-skill-model: GET /me/skill-prefs failed (${r.status})`);
-    process.exit(1);
-  }
-
-  const effective = r.data?.effective;
-  if (!Array.isArray(effective)) {
-    console.error('resolve-skill-model: unexpected response shape');
-    process.exit(1);
-  }
-
-  const row = effective.find((e) => e.skill === skillName);
-  if (!row) {
-    // Unknown skill — not in KNOWN_SKILLS. Fall back to opus so the
-    // caller can proceed; stderr surfaces the gap for the builder.
-    console.error(`resolve-skill-model: '${skillName}' is not in the known-skills list — defaulting to opus`);
-    console.log('opus');
-    process.exit(0);
-  }
-
-  console.log(row.effective_model);
-})().catch((err) => {
-  console.error('resolve-skill-model: fatal:', err.message || err);
-  process.exit(1);
-});

package/scripts/gds/security-baseline-check.sh

@@ -1,180 +0,0 @@
-#!/usr/bin/env bash
-# scripts/gds/security-baseline-check.sh — V3.R44 (#253).
-#
-# The enforceable read of docs/security-baseline.md. Walks eight categories
-# and prints PASS / FAIL / pending for each. Exit 0 if no FAILs (pendings are
-# OK); exit 1 if any FAIL.
-#
-# Intended caller: the /merge-mode skill, before landing a non-Archon claim.
-# Also runs cleanly by hand: `bash scripts/gds/security-baseline-check.sh`.
-#
-# Pure check — no writes, no network calls. The point is to be cheap enough to
-# run on every merge.
-
-set -uo pipefail
-
-# Anchor to repo root regardless of where the script was invoked from.
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-cd "$REPO_ROOT"
-
-PASS_COUNT=0
-FAIL_COUNT=0
-PENDING_COUNT=0
-FAILED_ITEMS=()
-
-# emit <status> <label> <detail>
-emit() {
-  local status=$1; shift
-  local label=$1;  shift
-  local detail=$*
-  case "$status" in
-    PASS)    PASS_COUNT=$((PASS_COUNT+1));    printf '  \033[32mPASS\033[0m    %s — %s\n' "$label" "$detail" ;;
-    FAIL)    FAIL_COUNT=$((FAIL_COUNT+1));    FAILED_ITEMS+=("$label"); printf '  \033[31mFAIL\033[0m    %s — %s\n' "$label" "$detail" ;;
-    PENDING) PENDING_COUNT=$((PENDING_COUNT+1)); printf '  \033[33mpending\033[0m %s — %s\n' "$label" "$detail" ;;
-  esac
-}
-
-echo "security-baseline-check — walking 8 categories"
-echo "(repo: $REPO_ROOT)"
-echo ""
-
-# ---- 1. input validation on every write route -------------------------------
-# Every router file that defines POST/PATCH/PUT/DELETE must reference
-# validateOrRespond. A router with only GETs is exempt.
-miss=()
-for f in src/bongos/routes/*.js; do
-  if grep -qE "router\.(post|patch|put|delete)\b" "$f"; then
-    if ! grep -q "validateOrRespond" "$f"; then
-      miss+=("$f")
-    fi
-  fi
-done
-if [ ${#miss[@]} -eq 0 ]; then
-  emit PASS "1. input-validation" "every write-bearing router uses validateOrRespond"
-else
-  emit FAIL "1. input-validation" "missing in: ${miss[*]}"
-fi
-
-# ---- 2. auth-token hygiene --------------------------------------------------
-# Schema migration 035 is the floor. db.js must export the revocation helpers.
-if [ -f migrations/035_auth_token_hygiene.sql ] && \
-   grep -q "revokeSessionById" src/bongos/db.js && \
-   grep -q "revokeAllSessionsForBuilder" src/bongos/db.js; then
-  emit PASS "2. auth-token-hygiene" "migration 035 present, revocation helpers exported"
-else
-  emit FAIL "2. auth-token-hygiene" "migration 035 or revocation helpers missing"
-fi
-
-# ---- 3. rate limits on write paths ------------------------------------------
-# Caddy directive + Express middleware file (V3.R34 / #255 — still in flight
-# at the time this script was written; emit pending if not yet shipped).
-caddy_ok=0; mw_ok=0
-[ -f infra/Caddyfile ] && grep -q "rate_limit" infra/Caddyfile && caddy_ok=1
-[ -d src/bongos/middleware ] && find src/bongos/middleware -name "*rate*.js" -print -quit | grep -q . && mw_ok=1
-if [ "$caddy_ok" = "1" ] && [ "$mw_ok" = "1" ]; then
-  emit PASS "3. rate-limits" "Caddyfile + middleware/*rate*.js both present"
-elif [ "$caddy_ok" = "0" ] && [ "$mw_ok" = "0" ]; then
-  emit PENDING "3. rate-limits" "V3.R34 (#255) not yet shipped — neither Caddy directive nor middleware present"
-else
-  emit FAIL "3. rate-limits" "partial implementation (caddy=$caddy_ok middleware=$mw_ok); finish or revert"
-fi
-
-# ---- 4. audit logging on every authenticated write --------------------------
-if [ -f migrations/033_audit_log.sql ] && [ -f src/bongos/middleware/audit.js ]; then
-  emit PASS "4. audit-logging" "migration 033 + middleware/audit.js present"
-elif [ -f migrations/033_audit_log.sql ]; then
-  emit FAIL "4. audit-logging" "migration 033 present but src/bongos/middleware/audit.js missing"
-else
-  emit FAIL "4. audit-logging" "migration 033 missing"
-fi
-
-# ---- 5. dependency scanning in CI + nightly ---------------------------------
-ci_ok=0; cron_ok=0; scan_ok=0
-[ -f .github/workflows/dep-audit.yml ] && ci_ok=1
-[ -f .claude/scheduled-tasks/dep-audit-nightly/SKILL.md ] && cron_ok=1
-[ -f scripts/security/dep-audit.js ] && scan_ok=1
-if [ "$ci_ok" = "1" ] && [ "$cron_ok" = "1" ] && [ "$scan_ok" = "1" ]; then
-  emit PASS "5. dep-scanning" "CI workflow + nightly cron + scan script all present"
-else
-  emit FAIL "5. dep-scanning" "missing: ci=$ci_ok cron=$cron_ok scan=$scan_ok"
-fi
-
-# ---- 6. no secrets in repo --------------------------------------------------
-hook_ok=0
-[ -f .husky/pre-commit ] && grep -qE "secret|trufflehog|gitleaks|secrets-scan" .husky/pre-commit && hook_ok=1
-[ "$hook_ok" = "0" ] && [ -f .git/hooks/pre-commit ] && grep -qE "secret|trufflehog|gitleaks|secrets-scan" .git/hooks/pre-commit && hook_ok=1
-# .env.local must be in .gitignore so it can't be staged accidentally.
-gitignore_ok=0
-[ -f .gitignore ] && grep -qE "^\.env\.local$|^\.env\.local\b" .gitignore && gitignore_ok=1
-if [ "$hook_ok" = "1" ] && [ "$gitignore_ok" = "1" ]; then
-  emit PASS "6. no-secrets-in-repo" "pre-commit secrets scan present + .env.local gitignored"
-elif [ "$gitignore_ok" = "1" ]; then
-  emit FAIL "6. no-secrets-in-repo" ".env.local gitignored OK, but no pre-commit secrets scan detected"
-else
-  emit FAIL "6. no-secrets-in-repo" "missing: pre-commit=$hook_ok gitignore=$gitignore_ok"
-fi
-
-# ---- 7. observability dashboards --------------------------------------------
-# The status dashboard surface moved to modules/status-ui/public/ in BV1.R84.
-status_ok=0; grafana_ok=0
-[ -d modules/status-ui/public ] && status_ok=1
-[ -d docs/grafana ] && find docs/grafana -name "*.json" -print -quit 2>/dev/null | grep -q . && grafana_ok=1
-if [ "$status_ok" = "1" ] && [ "$grafana_ok" = "1" ]; then
-  emit PASS "7. observability" "modules/status-ui/public/ + docs/grafana/*.json present"
-elif [ "$status_ok" = "1" ]; then
-  emit PENDING "7. observability" "V3.R42 (#263) not yet shipped — status dashboard OK, no provisioned grafana JSON yet"
-else
-  emit FAIL "7. observability" "modules/status-ui/public/ missing"
-fi
-
-# ---- 8. rank-check audit on every route -------------------------------------
-# Each router.<verb> declaration must EITHER have a 'rank:' comment within 5
-# lines above OR reference requireBuilder/requireRank in the middleware chain
-# of that declaration line. Routes that fail this surface explicitly so the
-# fix is local to the offending router file.
-ungated=()
-while read -r line; do
-  file="${line%%:*}"
-  rest="${line#*:}"
-  lineno="${rest%%:*}"
-  # capture the verb declaration line
-  decl=$(sed -n "${lineno}p" "$file")
-  # check the declaration line itself for auth.* middleware
-  if echo "$decl" | grep -qE "auth\.(requireBuilder|requireRank)"; then
-    continue
-  fi
-  # otherwise check the 5 lines above for a `rank:` comment OR a multi-line
-  # router definition where the middleware chain spans lines (the closing
-  # paren of router.<verb>(... can be many lines down). Search up to 20 lines
-  # forward for auth.require* in the same router(...) block.
-  start=$((lineno > 5 ? lineno - 5 : 1))
-  before=$(sed -n "${start},${lineno}p" "$file")
-  if echo "$before" | grep -qE "rank:|RANK:"; then
-    continue
-  fi
-  end=$((lineno + 20))
-  after=$(sed -n "${lineno},${end}p" "$file")
-  if echo "$after" | grep -qE "auth\.(requireBuilder|requireRank)"; then
-    continue
-  fi
-  ungated+=("$file:$lineno")
-done < <(grep -nE "router\.(get|post|patch|put|delete)\(" src/bongos/routes/*.js)
-if [ ${#ungated[@]} -eq 0 ]; then
-  emit PASS "8. rank-check-audit" "every route either rank-commented or uses requireBuilder/requireRank"
-else
-  emit FAIL "8. rank-check-audit" "ungated routes: ${ungated[*]}"
-fi
-
-# ---- summary ----------------------------------------------------------------
-echo ""
-echo "summary: PASS=$PASS_COUNT  pending=$PENDING_COUNT  FAIL=$FAIL_COUNT"
-if [ "$FAIL_COUNT" -gt 0 ]; then
-  echo "FAILED items:"
-  for it in "${FAILED_ITEMS[@]}"; do echo "  - $it"; done
-  echo ""
-  echo "Fix the FAILED items (or escalate to Archon for an audit-logged override) before /merge-mode lands a non-Archon claim."
-  exit 1
-fi
-echo ""
-echo "OK — baseline green. Non-Archon merges may proceed."
-exit 0