@bongos/core 1.21.175 → 1.21.177

package/scripts/bongos/audit-authorship.sh

@@ -0,0 +1,324 @@
+#!/usr/bin/env bash
+# scripts/bongos/audit-authorship.sh — V3.R12 (#236).
+#
+# Audits the repo for hardcoded references to the original Archon's identity
+# in IMPLEMENTATION code. The point: a second builder's commits, scripts,
+# error messages, and skill outputs must NOT silently impersonate or
+# hardcode-credit the founding builder.
+#
+# What counts as a violation here:
+#   * `/Users/larskristensen/...` paths in code or skill instructions.
+#     (Use `$HOME` / `os.path.expanduser('~')` instead.)
+#   * `builder_id = 1` / `shipped_by = 1` hardcodes in code paths that run
+#     during a builder's session. (Use `req.builder.id` / the active claim.)
+#   * `lars589` / `larskristensen` literals in setup-path code or test data
+#     that would mis-attribute a second builder's work.
+#   * The founder's unix account in account position (`-o`/`-u <it>`,
+#     `User=<it>`, `APP_USER = '<it>'`) in runtime code — section 6.
+#
+# What is INTENTIONAL and allow-listed (NOT a violation):
+#   * Archived shipping docs in `limitations/*-shipped.md` — historical record.
+#   * ADRs, session logs, and the chat-broadcast plan — historical / decision
+#     records that name the founder by intent.
+#   * `CLAUDE.md` — §2 is explicitly about working with Lars as the prompter
+#     and project owner; that framing IS the point.
+#   * Droplet operational identity (`User=<owner>`, `<owner>@<droplet-ip>`,
+#     `/home/lars/amazonprimea`, `lars@hermeslines.com`) — that's the actual
+#     unix user / SSH target / ACME contact on the production server. It's
+#     infra config, not impersonation of a builder identity.
+#   * The seed script that ORIGINALLY created the V3 tasks
+#     (`scripts/bongos/seed-v3-tasks.js`) — a frozen migration-style snapshot.
+#     Names appear in task descriptions by historical necessity.
+#     (The earlier `seed-v2-tasks.js` + `import-backlog.js` seeds were
+#     deleted as dead code in task 1079.)
+#   * Self-references in this audit script and in the V3.R09 / V3.R12 task
+#     descriptions captured in `seed-v3-tasks.js`.
+#   * GitHub remote `lars589/amazonprimea` — actual repo owner; cloning
+#     anything else would clone a different project.
+#   * Comments that document who decided something or who originally ran a
+#     one-time backfill — historical decision-attribution. Allowlisted
+#     PER FILE below (a content-level "looks like a comment" filter would
+#     also match live code — a JS private class field, a //host literal —
+#     so it could be gamed; file entries with justifications can't).
+#   * Test data that pins a real contract, allowlisted PER FILE below: owner
+#     approval RECORDS the Archon's login, the terminal-URL guard validates
+#     term-<login> hostnames — identity in an assertion is the contract.
+#     New test files are still scanned (no blanket tests/ exclusion).
+#   * Sample API payloads (fixtures/) and gitignored build output (dist/).
+#
+# Usage:
+#   bash scripts/bongos/audit-authorship.sh           # check, exit 1 on new hits
+#   bash scripts/bongos/audit-authorship.sh --verbose # print every hit (incl.
+#                                                  # allowlisted) for review
+#
+# CI lane: tests/authorship_audit.mjs runs this inside the required `unit`
+# check (task 1002640 — it previously had no caller and 342 stale hits).
+# No writes, no network.
+
+set -uo pipefail
+
+# Anchor to repo root regardless of where the script was invoked from.
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$REPO_ROOT"
+
+VERBOSE=0
+for arg in "$@"; do
+  case "$arg" in
+    --verbose|-v) VERBOSE=1 ;;
+    -h|--help)
+      sed -n '2,50p' "$0" | sed 's/^# \{0,1\}//'
+      exit 0
+      ;;
+  esac
+done
+
+# Uses plain `grep -RE` so the script runs on any machine — including CI
+# images that don't bundle ripgrep — and on the bare droplet. Exclude paths
+# are passed via the standard --exclude / --exclude-dir flags.
+
+# ----------------------------------------------------------------------------
+# 1. Path-exclusion args — paths where hits NEVER count (frozen archives,
+#    generated content, dot-git, third-party deps). Filtered at the grep
+#    level so they never even enter the candidate set.
+# ----------------------------------------------------------------------------
+EXCLUDE_DIRS=(
+  --exclude-dir=node_modules
+  --exclude-dir=.git
+  --exclude-dir=dist               # gitignored build/package output (a stale
+                                   # core tarball tree re-reports every hit in
+                                   # it — task 1002640); grep -R walks the
+                                   # filesystem, not the git index.
+  --exclude-dir=iterations         # under art/, historical cost ledger
+  --exclude-dir=generated          # under art/, generated PNGs / metadata
+  --exclude-dir=docs               # human prose: ADRs, recipes, plans,
+                                   # session logs, architecture notes —
+                                   # naming the founder by intent
+  --exclude-dir=blockers           # blockers ARE the things stuck on Lars
+  --exclude-dir=limitations        # archives + scope-truth docs
+  --exclude-dir=fixtures           # sample API payloads (hall-preview) mirror
+                                   # real prod rows, which name real builders —
+                                   # frozen sample data, not runtime code.
+  --exclude-dir=worktrees          # .claude/worktrees/ holds N full repo
+                                   # copies (one per builder worktree); from
+                                   # the main checkout, recursing them is slow
+                                   # AND produces 100s of duplicate self-hits
+                                   # (#558). Each worktree audits its own tree.
+)
+EXCLUDE_FILES=(
+  --exclude=session-log-archive.md
+  --exclude='*-shipped.md'         # frozen version archives in limitations/
+  --exclude='*.sql'                # migrations ran AS lars at migration time
+  --exclude=CLAUDE.md              # §2 is about the prompter by intent
+  --exclude=README.md              # README credits / examples
+  --exclude=chat-inbox.md          # framing references
+  --exclude=generative-ideas.md    # historical idea capture
+  --exclude=.git                   # in a worktree, .git is a file (gitdir
+                                   # pointer to main repo) — skip it
+)
+
+# ----------------------------------------------------------------------------
+# 2. The regex — what we're scanning for.
+#    Three families:
+#      a) /Users/larskristensen/... — runtime hardcoded home-dir paths
+#      b) builder_id = 1 / shipped_by = 1 — hardcoded primary key references
+#      c) literal lars589 / larskristensen identifiers in code surface
+# ----------------------------------------------------------------------------
+PATTERN='(/Users/larskristensen)|(\bbuilder_id\s*=\s*1\b)|(\bshipped_by\s*=\s*1\b)|(\blars589\b)|(\blarskristensen\b)'
+
+# ----------------------------------------------------------------------------
+# 3. The allowlist — file:line tokens where the regex IS expected to match.
+#    Each entry is a substring match against "file:line: <captured-text>"
+#    style records. Add a new allowlist entry only with a justification
+#    comment.
+# ----------------------------------------------------------------------------
+ALLOWLIST=(
+  # Frozen seed scripts — the V3 plan literally contains the strings being
+  # audited because the task DESCRIPTION (#234/V3.R09 and #236/V3.R12) names
+  # them. Stripping them would lose the task history.
+  'scripts/bongos/seed-v3-tasks.js'
+
+  # Audit-replay docs the builders table example "1 for lars589" — that's
+  # the actual row in the prod DB; renaming the example breaks the doc.
+  'scripts/bongos/audit-replay.sh'
+
+  # provision-staging.sh clones the actual GitHub repo owned by lars589.
+  # That's the GitHub org/user that owns the repo; not a builder identity.
+  'scripts/deploy/provision-staging.sh'
+
+  # CODEOWNERS is GitHub's owner-review list (task 1002611 / ADR 0159): the
+  # format requires the literal @username on every entry. Repo-hosting
+  # identity, same nature as provision-staging.sh — not a builder identity
+  # hardcoded in code.
+  'CODEOWNERS'
+
+  # This audit script's own self-reference (it documents what it's looking for).
+  'scripts/bongos/audit-authorship.sh'
+
+  # skill-usage-review explains how Claude Code encodes cwd into the
+  # transcripts directory name — explanatory text describing why the glob
+  # is now builder-agnostic. Not a runtime hardcode.
+  '.claude/scheduled-tasks/skill-usage-review/SKILL.md'
+
+  # setup_smoke explicitly asserts the ABSENCE of /Users/larskristensen
+  # leaks in setup.js — the string appearing in the comment IS the
+  # specification of what's forbidden in implementation code.
+  'tests/setup_smoke.mjs'
+
+  # Test DATA that pins a real contract (task 1002640) — identity in an
+  # assertion IS the contract, not a mis-attribution: owner approval RECORDS
+  # the Archon's login (gate_approvals), packaging/provisioning tests
+  # exercise the real repo owner + the mirror-redaction floor. Listed per file
+  # (never a blanket tests/ exclusion) so a NEW test file is still scanned.
+  'tests/provision.mjs'
+  'tests/package_core.mjs'
+  'tests/init.mjs'
+  'tests/gate_approvals.mjs'
+  'tests/publish_reconciler.mjs'
+  'tests/dev_lib.mjs'
+  'tests/ship_card.mjs'
+  'tests/scrubber_corpus.mjs'
+  'tests/module_submissions.mjs'
+  'tests/provisioning_onboard_mode.mjs'
+  'tests/instance_manifest.mjs'
+  'tests/bongos_downloads.mjs'
+  'tests/status_mirror_sync.mjs'
+  'tests/search_isolation.mjs'
+  'tests/grade_aggregates_unavailable.mjs'
+  'tests/first_admin_bootstrap.mjs'
+  'tests/discord_approvals.mjs'
+  'tests/currency_label.mjs'
+  'tests/cloud_bongos_pack.mjs'
+  'tests/bump_version.mjs'
+  'tests/auth_inactive_builder.mjs'
+  'tests/auth_anthropic_identity.mjs'
+
+  # The mirror-redaction floor: PRIOR_INSTANCE_FLOOR carries the prior
+  # instance's owner literal precisely so packaging can SCRUB it from every
+  # published core — the anti-leak spec, not a runtime hardcode (task 1002640).
+  'scripts/bongos/package-core.js'
+)
+
+# ----------------------------------------------------------------------------
+# 4. Operational-identity allowlist — these patterns reference the droplet's
+#    unix user / SSH target / ACME contact / cron user / DB role. They are
+#    legitimate operational configuration, not impersonation of a builder.
+# ----------------------------------------------------------------------------
+OPS_ALLOWLIST_PATTERN='(^User=lars$|/home/lars/|lars@104\.236\.254\.243|lars@hermeslines\.com|^DROPLET=.*lars@|sudo -u postgres .*-O lars\b|PGUSER=lars\b|createdb -O lars\b|"-U" "?lars"?|-U lars\b|runs as user .lars.|service .* lars\b|cron .*lars\b)'
+
+# ----------------------------------------------------------------------------
+# 4b. Spec-string allowlist — content patterns where the literal "lars589"
+#    (etc.) appears precisely because it is the THING THE AUDIT FORBIDS,
+#    quoted inside a prompt/comment that instructs a reader (human or the LLM
+#    grader) to hunt for it. The grader workers' prompts say `Look for literal
+#    "lars", "lars589", absolute /Users paths ...` — that's the audit's own
+#    specification embedded in a prompt, not a runtime hardcode that
+#    mis-attributes a builder. Matched on line content (not file path) so the
+#    rest of grader.js stays auditable for a genuine hardcode.
+#
+#    The pattern is the FULL exact prompt phrase, not just `Look for literal`,
+#    so the suppression can't double as a smuggling channel: a contributor
+#    can't sneak a real hardcode past the audit by appending a short comment,
+#    because escaping requires reproducing this whole sentence verbatim — at
+#    which point the line is self-evidently a prompt-spec, not plausible cover
+#    for `builder_id = "lars589"`.
+# ----------------------------------------------------------------------------
+SPEC_ALLOWLIST_PATTERN='[Ll]ook for literal "lars", "lars589", absolute /Users paths'
+
+# ----------------------------------------------------------------------------
+# 5. Scan, filter, report.
+# ----------------------------------------------------------------------------
+TMP_RAW="$(mktemp)"
+TMP_HITS="$(mktemp)"
+TMP_FILTERED="$(mktemp)"
+trap 'rm -f "$TMP_RAW" "$TMP_HITS" "$TMP_FILTERED"' EXIT
+
+# Walk every file under repo root (excluding the path-level exclusions above).
+# grep -R recurses into hidden subdirs by default (including .claude/, which
+# absolutely DOES need auditing since skill prompts live there). The
+# --exclude-dir entries below cull the dirs we don't care about.
+grep -RIn -E "${EXCLUDE_DIRS[@]}" "${EXCLUDE_FILES[@]}" -e "$PATTERN" . 2>/dev/null \
+  | sed 's|^\./||' \
+  | sort -u \
+  > "$TMP_RAW" || true
+
+# Apply file-level allowlist (entry is a path prefix match against "file:" portion).
+ALLOWLIST_RE=''
+for e in "${ALLOWLIST[@]}"; do
+  # Escape regex metachars conservatively (just dots — paths only have those).
+  esc="${e//./\\.}"
+  ALLOWLIST_RE+="^${esc}:|"
+done
+ALLOWLIST_RE="${ALLOWLIST_RE%|}"
+
+if [ -n "$ALLOWLIST_RE" ]; then
+  grep -vE "$ALLOWLIST_RE" "$TMP_RAW" > "$TMP_HITS" || true
+else
+  cp "$TMP_RAW" "$TMP_HITS"
+fi
+
+# Apply operational-identity + spec-string pattern allowlists (both match on
+# line content, not file path). NB deliberately NO comment-line filter: a
+# content pattern like `^\s*(//|#)` also matches live code (a JS private class
+# field `#name = ...`, a protocol-relative `//host` continuation line), so a
+# real hardcode could dress as a comment to slip through. Historical-
+# attribution comments get per-file ALLOWLIST entries instead (task 1002640).
+grep -vE "$OPS_ALLOWLIST_PATTERN" "$TMP_HITS" \
+  | grep -vE "$SPEC_ALLOWLIST_PATTERN" > "$TMP_FILTERED" || true
+
+# ----------------------------------------------------------------------------
+# 6. The founder's UNIX ACCOUNT in account position (task 1002719). Family (c)
+#    greps the GitHub login, and a unix name is not a GitHub login — which is
+#    how the standup's `install -d -o <founder> …` reached every operator's box
+#    unseen. Runtime code only (tests/ pin fixtures by design), and the ops
+#    allowlist above does NOT apply: "that is the droplet's unix user" is the
+#    very assumption this family refuses in code that runs on other planes.
+#    Derive the account instead (provision-repo.js appUser()).
+# ----------------------------------------------------------------------------
+UNIX_USER_PATTERN='((^|[^A-Za-z0-9_.-])(-o|-g|-u)[ =]lars\b)|(\b(User|Group)=lars\b)|(\bchown( -R)? lars\b)|([A-Za-z_]*[Uu][Ss][Ee][Rr][A-Za-z_]*\s*[:=]\s*["'"'"']lars["'"'"'])'
+UNIX_ALLOWLIST=(
+  # This script's own pattern.
+  'scripts/bongos/audit-authorship.sh'
+)
+UNIX_ALLOWLIST_RE=''
+for e in "${UNIX_ALLOWLIST[@]}"; do
+  UNIX_ALLOWLIST_RE+="^${e//./\\.}:|"
+done
+UNIX_ALLOWLIST_RE="${UNIX_ALLOWLIST_RE%|}"
+
+grep -RIn -E "${EXCLUDE_DIRS[@]}" --exclude-dir=tests --exclude-dir=test "${EXCLUDE_FILES[@]}" -e "$UNIX_USER_PATTERN" . 2>/dev/null \
+  | sed 's|^\./||' \
+  | sort -u \
+  | grep -vE "$UNIX_ALLOWLIST_RE" >> "$TMP_FILTERED" || true
+
+HIT_COUNT=$(wc -l < "$TMP_FILTERED" | tr -d ' ')
+
+if [ "$VERBOSE" = "1" ]; then
+  TOTAL=$(wc -l < "$TMP_RAW" | tr -d ' ')
+  AFTER_FILE=$(wc -l < "$TMP_HITS" | tr -d ' ')
+  echo "audit-authorship: scan summary"
+  echo "  raw hits (post path-exclude): $TOTAL"
+  echo "  after file allowlist:          $AFTER_FILE"
+  echo "  after ops + spec allowlists:   $HIT_COUNT"
+  echo ""
+fi
+
+if [ "$HIT_COUNT" -eq 0 ]; then
+  echo "audit-authorship: PASS — no hardcoded Archon-identity references in implementation code."
+  exit 0
+fi
+
+echo "audit-authorship: FAIL — found $HIT_COUNT hardcoded reference(s) to the original Archon in implementation code."
+echo ""
+echo "Hits:"
+cat "$TMP_FILTERED"
+echo ""
+echo "Remediation:"
+echo "  * Paths like /Users/larskristensen/...  ->  use \$HOME or os.path.expanduser('~')"
+echo "  * builder_id = 1 / shipped_by = 1       ->  use req.builder.id / the active claim"
+echo "  * lars589 / larskristensen literals     ->  use the current builder's github_login"
+echo "  * -o/-u lars, User=lars, *user = 'lars' ->  derive the account (appUser() in provision-repo.js)"
+echo ""
+echo "If a hit IS intentional (historical doc, droplet operational identity,"
+echo "or a frozen seed/import script), add it to the ALLOWLIST or"
+echo "OPS_ALLOWLIST_PATTERN in this script with a one-line justification."
+exit 1

package/scripts/bongos/audit-deps.js

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+// scripts/bongos/audit-deps.js — likely-missing-dependency detector CLI (task 349).
+//
+// WHY: an under-specified dependencies[] lets work start before the task it
+// implicitly builds on has shipped, racing already-built work (the original
+// motivation: task 307 was claimable before the rank system it needed had
+// shipped). This surfaces OPEN tasks whose touches[] overlap an UNSHIPPED task
+// they do NOT already depend on — candidate missing edges for a human to triage.
+//
+// THIS IS ADVISORY. Most touches[] overlaps are PARALLEL work on a shared surface
+// (src/bongos/db.js, migrations/, CLAUDE.md, …), NOT a build-order dependency.
+// Backfilling a wrong edge GATES the dependent (POST /claims → 409
+// DEPS_NOT_SHIPPED) until the named blocker ships. So: act only on `high`
+// confidence, by hand, after reading both task descriptions.
+//
+// PURE CORE MOVED to modules/lifecycle/missing-dep-classify.js (task 1002827),
+// so dependency-advisory.js's live POST /tasks path can reuse the ONE canonical
+// `classify`/`findMissingDeps` — the same one tests/audit_deps.mjs covers —
+// without pulling this file's CLI-only machinery (cliClient's session-token
+// I/O, resolveDefaultVersion) into the running server. This file is now the
+// CLI wrapper only: argv parsing, the corpus fetch, and --stranded's dead-edge
+// report. Every name below is RE-EXPORTED unchanged so no caller of this file
+// (including tests/audit_deps.mjs) needs to know it moved.
+//
+//   node scripts/bongos/audit-deps.js [--version GDS-V3] [--min high|medium|low] [--json]
+//   node scripts/bongos/audit-deps.js --stranded [--json]   # the INVERSE: dead edges (task 1003153),
+//                                                      # plus prose-declared gates naming a dead task (task 1003857, advisory)
+
+const { cliClient } = require('./cli-lib');
+const { resolveDefaultVersion } = require('./version-select.js');
+// task 1003153 — the DEAD-edge detector core, shared with the claim refusal so
+// "abandoned dependency" means one thing across the CLI, the route and this audit.
+const { findStrandedTasks, findProseGatedTasks } = require('../../modules/lifecycle/dead-deps.js');
+// task 1003752 — the route's page bound + the first-page offset rule, declared once.
+const { TASK_LIST_MAX_LIMIT, buildTaskPageQuery } = require('../../modules/lifecycle/task-list-limits.js');
+const { OPEN, isUnshippedBlocker, HOTSPOTS, classify, findMissingDeps } =
+  require('../../modules/lifecycle/missing-dep-classify.js');
+
+// Read the WHOLE task corpus, one allowed page at a time (task 1003752). This
+// was a single `limit: 3000` read, which GET /tasks caps at TASK_LIST_MAX_LIMIT
+// (1000) — so it 400'd on every run and the detector below never saw a single
+// task. Paging is not a nicety here: the corpus passed one page long ago (3610
+// rows on 2026-09-16), so even a legal `limit: 1000` would silently UNDER-read,
+// which in a detector is the same failure wearing a success exit code.
+//
+// `getPage(query)` is injected rather than closed over so the loop is testable
+// with no API; it returns the { ok, status, data } shape cliClient gives back.
+// Dedupes by id: listTasks orders by `priority NULLS LAST, created_at, id`, so
+// pages are stable — but a detector whose whole job is surfacing rows nobody
+// can see must not be the thing that loses one.
+async function fetchAllTasks(getPage, { query = {}, pageSize = TASK_LIST_MAX_LIMIT, maxPages = 100 } = {}) {
+  const byId = new Map();
+  let offset = 0;
+  for (let page = 0; page < maxPages; page++) {
+    const q = buildTaskPageQuery({ ...query, limit: pageSize, offset });
+    const r = await getPage(q);
+    if (!r || !r.ok) throw new Error(`HTTP ${r && r.status}`);
+    const rows = (r.data && r.data.tasks) || [];
+    for (const t of rows) byId.set(String(t.id), t);
+    // A short page is the end of the table. Compare against the CLAMPED size
+    // the route actually honoured, never the size the caller asked for.
+    if (rows.length < q.limit) return [...byId.values()];
+    offset += q.limit;
+  }
+  throw new Error(`more than ${maxPages} pages of tasks — refusing to loop forever`);
+}
+// --stranded (task 1003153): the INVERSE audit. findMissingDeps asks "which edge
+// is MISSING"; this asks "which existing edge is DEAD" — a live task gated by an
+// ABANDONED dependency. That edge can never satisfy (an abandoned task can never
+// ship), so the dependent never auto-promotes and can never be claimed: stranded,
+// not waiting. Per the owner ruling (2026-08-21) the gates stay strict, which
+// makes this detector the remedy — an abandoned dependency must be REPORTED as a
+// top-priority thing to resolve rather than blocking silently and forever.
+// Exits 1 when anything is stranded, so a sweep or CI leg can gate on it.
+async function reportStranded({ asJson }) {
+  const api = await cliClient();
+  let all;
+  try {
+    all = await fetchAllTasks((query) => api.tasks.getTasks({ query }), { query: { include: 'deps' } });
+  } catch (e) {
+    console.error(`audit-deps: could not list tasks (${e.message})`);
+    process.exit(1);
+  }
+  const stranded = findStrandedTasks(all);
+  // task 1003857: the same question asked of PROSE. The structured graph above
+  // reads blocked_by edges; a gate written in a description is unpoliced, and stales
+  // identically — task 1002839 told a builder to coordinate with "existing open task
+  // 1001380", abandoned since 2026-08-18. Reported HERE rather than in a second tool
+  // so there is one answer to "what is stranded".
+  const statusById = (() => {
+    const byId = new Map(all.map((t) => [String(t.id), String(t.status)]));
+    return (id) => byId.get(String(id)) || null;
+  })();
+  const proseGated = findProseGatedTasks(all, statusById);
+
+  // Context worth stating even at zero: abandoned tasks that still CARRY
+  // dependents are the latent trap. They report clean only because every
+  // dependent happens to be terminal too — one promote would light them up.
+  const gatingAbandoned = new Set();
+  for (const t of all) for (const d of (t.blocked_by || [])) {
+    if (String(d.status) === 'abandoned') gatingAbandoned.add(String(d.id));
+  }
+
+  if (asJson) {
+    console.log(JSON.stringify({ stranded, prose_gated: proseGated, abandoned_deps_with_dependents: [...gatingAbandoned] }, null, 2));
+    // ADVISORY: a prose match never changes the exit code. It is weaker evidence than
+    // an edge — the text may be history, a citation, or simply wrong — so it reports
+    // candidates for a human and must not gate a sweep or a CI leg.
+    return stranded.length ? 1 : 0;
+  }
+  console.log(`audit-deps --stranded: ${all.length} task(s) scanned — ${stranded.length} LIVE task(s) stranded by an abandoned dependency\n`);
+  for (const s of stranded) {
+    console.log(`[STRANDED] #${s.task_id} [${s.status}]  ${(s.title || '').slice(0, 70)}`);
+    for (const d of s.dead_deps) console.log(`           dead edge → #${d.id} [${d.status}]  ${(d.title || '').slice(0, 60)}`);
+    console.log(`           fix: drop the edge (DELETE /dependencies {"from_kind":"task","from_id":${s.task_id},"to_kind":"task","to_id":${s.dead_deps[0].id}})`);
+    console.log(`             or restore the dep (POST /tasks/${s.dead_deps[0].id}/promote)\n`);
+  }
+  if (proseGated.length) {
+    console.log(`Prose-declared gates naming a dead task: ${proseGated.length} (ADVISORY — a human reads these; they never gate a claim)\n`);
+    for (const p of proseGated) {
+      console.log(`[PROSE]    #${p.task_id} [${p.status}]  ${(p.title || '').slice(0, 70)}`);
+      for (const d of p.prose_dead_deps) console.log(`           body names → #${d.id} [${d.status}]`);
+      console.log('           fix: correct the sentence (PATCH /tasks/' + p.task_id + ' {"description":…}), or promote the named task if the gate is real\n');
+    }
+  }
+  if (!stranded.length) {
+    console.log('Nothing stranded — no live task is gated by an abandoned dependency.');
+    console.log(`Latent exposure: ${gatingAbandoned.size} abandoned task(s) still carry dependents; they read clean only`);
+    console.log('because those dependents are themselves terminal. Promoting one would strand it immediately.');
+  }
+  return stranded.length ? 1 : 0;
+}
+
+async function main() {
+  const argv = process.argv.slice(2);
+  if (argv.includes('--stranded')) {
+    process.exitCode = await reportStranded({ asJson: argv.includes('--json') });
+    return;
+  }
+  // task 1003166 (G02): the default was 'GDS-V3', which has shipped — so a bare
+  // `audit-deps` audited a closed version and reported nothing useful.
+  const ver = argv.includes('--version')
+    ? argv[argv.indexOf('--version') + 1]
+    : await resolveDefaultVersion();
+  if (!ver) {
+    console.error('audit-deps: no version is building; pass --version <id>.');
+    process.exitCode = 1;
+    return;
+  }
+  const minRank = argv.includes('--min') ? argv[argv.indexOf('--min') + 1] : 'low';
+  const asJson = argv.includes('--json');
+  const order = { high: 3, medium: 2, low: 1 };
+
+  const api = await cliClient();
+  const r = await api.tasks.getTasks({ query: { version: ver } });
+  if (!r.ok) { console.error(`audit-deps: could not list tasks (${r.status})`); process.exit(1); }
+  const all = r.data.tasks || [];
+  const openTasks = all.filter((t) => OPEN.has(t.status) && Array.isArray(t.touches) && t.touches.length);
+
+  // dependencies[] lives in a join table, not the task row — hydrate per open task.
+  for (const t of openTasks) {
+    const dr = await api.tasks.getTasksIdDependencies({ id: t.id });
+    t.dependencies = dr.ok ? (dr.data.dependencies || []).map((d) => String(d.id)) : [];
+  }
+  const byId = new Map(all.map((t) => [String(t.id), t]));
+  // Feed the FULL task set (open + others) so blockers in any status are visible.
+  const edges = findMissingDeps([...openTasks, ...all.filter((t) => !OPEN.has(t.status))])
+    .filter((e) => order[e.confidence] >= (order[minRank] || 1))
+    .sort((a, b) => order[b.confidence] - order[a.confidence]);
+
+  if (asJson) { console.log(JSON.stringify(edges, null, 2)); return; }
+  console.log(`audit-deps: ${ver} — ${openTasks.length} open task(s) audited, ${edges.length} candidate edge(s) >= ${minRank}\n`);
+  for (const e of edges) {
+    const t = byId.get(String(e.task_id)) || {};
+    const o = byId.get(String(e.dep_id)) || {};
+    console.log(`[${e.confidence.toUpperCase().padEnd(6)}] #${e.task_id} should-maybe-depend-on #${e.dep_id} [${e.dep_status}]`);
+    console.log(`         from: ${(t.title || '').slice(0, 70)}`);
+    console.log(`         dep : ${(o.title || '').slice(0, 70)}`);
+    console.log(`         on  : ${e.paths.join(', ')}\n`);
+  }
+  if (!edges.length) console.log('No candidate missing dependencies at this confidence — the graph is clean here.');
+  console.log('NB: advisory only. Backfill `high` edges by hand (POST /tasks/:id/dependencies) after reading both tasks; a wrong edge gates the dependent.');
+}
+
+module.exports = { findMissingDeps, classify, OPEN, isUnshippedBlocker, HOTSPOTS, reportStranded, fetchAllTasks };
+
+if (require.main === module) {
+  main().catch((e) => { console.error('audit-deps:', e.message); process.exit(1); });
+}

package/scripts/bongos/audit-gate.js

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+// scripts/bongos/audit-gate.js — the dependency vulnerability gate (task 1003127,
+// goal 1000076; ADR 0180, docs/audits/ai-dev-redteam-baseline.md §3).
+//
+// Ratchet semantics, matching the goal's other budgets: a committed BASELINE
+// (config/audit-baseline.json) records the advisories that predate the gate.
+// A HIGH or CRITICAL advisory NOT in the baseline fails CI; anything below
+// high warns; a baseline entry that no longer reproduces prints a shrink nudge
+// (removing it is an ordinary PR). Fixes are explicit tasks — a blanket
+// `npm audit fix` does not even run against this tree (workspace: protocol).
+//
+// Fail contract: CLOSED on findings, OPEN on infrastructure — a registry
+// outage or unparseable audit output warns and exits 0 rather than bricking
+// every PR (the gate's job is catching new advisories, not proving uptime).
+//
+// Run:            node scripts/bongos/audit-gate.js
+// Refresh floor:  node scripts/bongos/audit-gate.js --update-baseline
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const BASELINE_PATH = path.join(ROOT, 'config', 'audit-baseline.json');
+const GATE_SEVERITIES = new Set(['high', 'critical']);
+
+// npm audit JSON → flat advisory findings, one per (advisory, vulnerable pkg).
+// Identity is the advisory's numeric `source` id + the package it hits — stable
+// across runs, unlike the parent-package rollups npm prints.
+function extractFindings(auditJson) {
+  const out = new Map();
+  const vulns = (auditJson && auditJson.vulnerabilities) || {};
+  for (const entry of Object.values(vulns)) {
+    for (const via of entry.via || []) {
+      if (typeof via !== 'object' || via === null || via.source == null) continue;
+      const key = `${via.source}:${via.name}`;
+      if (!out.has(key)) {
+        out.set(key, {
+          id: String(via.source),
+          name: via.name,
+          severity: String(via.severity || entry.severity || 'unknown').toLowerCase(),
+          title: via.title || '',
+        });
+      }
+    }
+  }
+  return [...out.values()].sort((a, b) => (a.name + a.id).localeCompare(b.name + b.id));
+}
+
+// Pure gate decision — exported for the hermetic test.
+function compare(currentFindings, baselineFindings) {
+  const baseKeys = new Set((baselineFindings || []).map((f) => `${f.id}:${f.name}`));
+  const curKeys = new Set(currentFindings.map((f) => `${f.id}:${f.name}`));
+  const fresh = currentFindings.filter((f) => !baseKeys.has(`${f.id}:${f.name}`));
+  return {
+    newGating: fresh.filter((f) => GATE_SEVERITIES.has(f.severity)),
+    newAdvisory: fresh.filter((f) => !GATE_SEVERITIES.has(f.severity)),
+    resolved: (baselineFindings || []).filter((f) => !curKeys.has(`${f.id}:${f.name}`)),
+  };
+}
+
+function readBaseline() {
+  try {
+    return JSON.parse(fs.readFileSync(BASELINE_PATH, 'utf8')).findings || [];
+  } catch {
+    return [];
+  }
+}
+
+function runAudit() {
+  try {
+    return execSync('npm audit --omit=dev --json', { cwd: ROOT, maxBuffer: 32 * 1024 * 1024 }).toString();
+  } catch (e) {
+    // npm audit exits 1 when advisories exist — that IS the payload.
+    if (e && e.stdout) return e.stdout.toString();
+    throw e;
+  }
+}
+
+function main() {
+  const update = process.argv.includes('--update-baseline');
+  let findings;
+  try {
+    findings = extractFindings(JSON.parse(runAudit()));
+  } catch (e) {
+    console.warn(`audit-gate: WARN — npm audit did not produce parseable JSON (${e.message}); failing OPEN (infra, not findings).`);
+    process.exit(0);
+  }
+
+  if (update) {
+    fs.writeFileSync(
+      BASELINE_PATH,
+      JSON.stringify({ _comment: 'audit-gate baseline (ADR 0180): pre-existing advisories the gate tolerates. Shrink-only — remove entries as fix tasks land; never add by hand to silence a NEW advisory.', updated: null, findings }, null, 2) + '\n',
+    );
+    console.log(`audit-gate: baseline updated — ${findings.length} finding(s) recorded at ${path.relative(ROOT, BASELINE_PATH)}.`);
+    return;
+  }
+
+  const verdict = compare(findings, readBaseline());
+  for (const f of verdict.resolved) {
+    console.log(`audit-gate: ratchet-down available — baseline entry no longer reproduces: [${f.severity}] ${f.name} (${f.id}) ${f.title}`);
+  }
+  for (const f of verdict.newAdvisory) {
+    console.warn(`audit-gate: WARN new ${f.severity} advisory (below the gate): ${f.name} (${f.id}) ${f.title}`);
+  }
+  if (verdict.newGating.length) {
+    console.error('audit-gate: FAIL — new high/critical advisories not in the baseline:');
+    for (const f of verdict.newGating) {
+      console.error(`  [${f.severity}] ${f.name} (advisory ${f.id}) ${f.title}`);
+    }
+    console.error('Fix or pin the dependency. The baseline only records PRE-GATE debt; do not add new entries to silence this.');
+    process.exit(1);
+  }
+  console.log(`audit-gate: PASS — ${findings.length} known finding(s), 0 new at high/critical.`);
+}
+
+if (require.main === module) main();
+
+module.exports = { extractFindings, compare, GATE_SEVERITIES, BASELINE_PATH };