@bongos/core 1.21.176 → 1.21.177

package/scripts/security/dep-audit.js

@@ -1,41 +1,33 @@
 #!/usr/bin/env node
-// Dependency vulnerability scan — single source of truth for both CI and the
-// droplet nightly cron (V3.R37 / #258).
+// Dependency vulnerability scan — single source of truth for the CLI and the
+// server's daily check (V3.R37 / #258; in-process since task 1004878).
 //
-// Two scans are run, in order:
-//   1. `npm audit --audit-level=high --json` against the root package.json.
-//   2. `python3 -m pip_audit -r art/pipeline/requirements.txt --format json`.
+// One scan: `npm audit --audit-level=high --json` against the root package.json.
+// (A second scan, pip-audit over art/pipeline/requirements.txt, went with the art
+// pipeline it audited — task 1004860 deleted that pipeline, task 1004878 the scan.)
 //
-// The script parses both outputs and emits ONE deterministic JSON report on
-// stdout containing every high/critical finding. A short, builder-readable
-// summary goes to stderr so a CI log is skim-able.
+// The script parses the output and emits ONE deterministic JSON report on stdout
+// containing every high/critical finding. A short, builder-readable summary goes
+// to stderr so a log is skim-able.
 //
 // Two modes:
 //
-//   --report-mode=ci         (default; used by .github/workflows/dep-audit.yml)
-//                            exit 1 if ANY finding is high or critical.
-//                            exit 0 if both scans clean.
+//   --report-mode=ci         (default) exit 1 if ANY finding is high or critical,
+//                            exit 0 if the scan is clean, exit 2 if npm is missing.
 //
-//   --report-mode=nightly    (used by .claude/scheduled-tasks/dep-audit-nightly)
-//                            ALWAYS exit 0 — a nightly cron must not block the
-//                            droplet's other routines. The skill consumes the
-//                            JSON, posts to the team chat-inbox, and creates a
-//                            vulnerability_report row in the Archon security
-//                            view via src/bongos/security.js.
+//   --report-mode=nightly    ALWAYS exit 0 — the report is the product.
 //
-// Tool resolution:
-//   - npm is required (CI image has it; droplet has it).
-//   - pip-audit is resolved as `python3 -m pip_audit` (works whether installed
-//     via pip, pipx, or pip --user — module form is the most portable).
-//     If neither is found, the script reports `tool_missing: pip-audit` and the
-//     mode decides whether to fail.
+// WHERE IT RUNS ON A SCHEDULE. Nowhere through this CLI: the always-on server runs
+// the same scan daily in-process (modules/autonomy/pollers/daily-checks.js), with an
+// ASYNC spawn — spawnSync here would freeze every request for the whole scan — and
+// hands the output to parseNpmAudit below, so the two cannot disagree about what a
+// finding is.
 //
 // Output schema (stdout, always valid JSON, even on failure):
 //   {
 //     "ran_at": "<ISO timestamp>",
 //     "mode": "ci" | "nightly",
 //     "npm": { "ok": true|false, "tool_missing": false|true, "findings": [...] },
-//     "pip": { "ok": true|false, "tool_missing": false|true, "findings": [...] },
 //     "high_or_critical_count": <int>,
 //     "exit_code": <int>
 //   }
@@ -46,10 +38,8 @@
 
 const { spawnSync } = require('node:child_process');
 const path = require('node:path');
-const fs = require('node:fs');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
-const PIP_REQUIREMENTS = path.join(REPO_ROOT, 'art', 'pipeline', 'requirements.txt');
 
 // CLI args ----------------------------------------------------------------
 
@@ -77,33 +67,47 @@ function printHelp() {
 
 // npm audit ---------------------------------------------------------------
 
-// npm audit emits a JSON document. `--audit-level=high` controls the EXIT CODE
-// only — the JSON still contains every level. We parse the full set, then we
-// filter to high+critical ourselves so the threshold is consistent across both
-// scanners.
-function runNpmAudit() {
-  const res = spawnSync('npm', ['audit', '--audit-level=high', '--json'], {
-    cwd: REPO_ROOT,
+// The npm invocation, shared with the server's async spawn. `--audit-level=high`
+// controls the EXIT CODE only — the JSON still contains every level, and
+// extractNpmFindings filters to high+critical itself.
+const NPM_AUDIT_ARGS = ['audit', '--audit-level=high', '--json'];
+
+function runNpmAudit({ cwd = REPO_ROOT } = {}) {
+  const res = spawnSync('npm', NPM_AUDIT_ARGS, {
+    cwd,
     encoding: 'utf8',
     maxBuffer: 32 * 1024 * 1024,
   });
-  // npm audit exits 1 when findings >= the threshold, 0 otherwise. Both cases
-  // still produce JSON on stdout. We don't trust the exit code; we read the
-  // JSON and decide for ourselves.
   if (res.error) {
     return { ok: false, tool_missing: true, findings: [], raw_error: String(res.error.message || res.error) };
   }
+  return parseNpmAudit(res.stdout, res.stderr);
+}
+
+// parseNpmAudit — npm audit's raw output → { ok, tool_missing, findings }. Pure.
+// npm audit exits 1 when findings >= the threshold, 0 otherwise, and both cases
+// still produce JSON on stdout — so the exit code is never read; the JSON decides.
+function parseNpmAudit(stdout, stderr = '') {
   let parsed;
   try {
-    parsed = JSON.parse(res.stdout || '{}');
+    parsed = JSON.parse(stdout || '{}');
   } catch (e) {
     return {
       ok: false, tool_missing: false, findings: [],
-      raw_error: `npm audit JSON parse failed: ${e.message}; stderr=${res.stderr.slice(0, 500)}`,
+      raw_error: `npm audit JSON parse failed: ${e.message}; stderr=${String(stderr || '').slice(0, 500)}`,
     };
   }
-  const findings = extractNpmFindings(parsed);
-  return { ok: true, tool_missing: false, findings };
+  // npm reports its own failures (no lockfile, registry unreachable) as JSON with
+  // an `error` object and no vulnerabilities. That is "could not audit", never a
+  // clean bill of health.
+  if (parsed && parsed.error && !parsed.vulnerabilities) {
+    const e = parsed.error;
+    return {
+      ok: false, tool_missing: false, findings: [],
+      raw_error: `npm audit failed: ${(e && (e.summary || e.code)) || 'unknown error'}`,
+    };
+  }
+  return { ok: true, tool_missing: false, findings: extractNpmFindings(parsed) };
 }
 
 // npm audit v7+ JSON shape: `vulnerabilities` is an object keyed by package
@@ -143,81 +147,6 @@ function extractNpmFindings(parsed) {
   return out;
 }
 
-// pip-audit ---------------------------------------------------------------
-
-function runPipAudit() {
-  if (!fs.existsSync(PIP_REQUIREMENTS)) {
-    return {
-      ok: false, tool_missing: false, findings: [],
-      raw_error: `requirements file not found: ${PIP_REQUIREMENTS}`,
-    };
-  }
-  const res = spawnSync('python3', [
-    '-m', 'pip_audit',
-    '-r', PIP_REQUIREMENTS,
-    '--format', 'json',
-    '--vulnerability-service', 'pypi',
-  ], {
-    cwd: REPO_ROOT,
-    encoding: 'utf8',
-    maxBuffer: 32 * 1024 * 1024,
-  });
-  if (res.error) {
-    return { ok: false, tool_missing: true, findings: [], raw_error: String(res.error.message || res.error) };
-  }
-  if (res.status !== 0 && res.status !== 1) {
-    // pip-audit exits 0 on clean, 1 on findings. Anything else (missing module,
-    // bad requirements file) is a tool problem.
-    const stderr = (res.stderr || '').slice(0, 1000);
-    const missing = /No module named ['"]?pip_audit/.test(stderr);
-    return {
-      ok: false, tool_missing: missing, findings: [],
-      raw_error: `pip-audit exit=${res.status}; stderr=${stderr}`,
-    };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(res.stdout || '{}');
-  } catch (e) {
-    return {
-      ok: false, tool_missing: false, findings: [],
-      raw_error: `pip-audit JSON parse failed: ${e.message}; stderr=${res.stderr.slice(0, 500)}`,
-    };
-  }
-  const findings = extractPipFindings(parsed);
-  return { ok: true, tool_missing: false, findings };
-}
-
-// pip-audit JSON shape: { "dependencies": [ { "name", "version",
-// "vulns": [ { "id", "fix_versions": [], "description", "aliases": [] } ] } ] }
-// pip-audit does NOT classify severity itself — PyPI/OSV advisories carry it
-// in `aliases` (CVE IDs) plus a `description` field. To stay conservative, we
-// treat EVERY pip-audit finding as high — by the time PyPI's advisory DB has
-// picked it up, the project's posture is "fix or document." This is the same
-// stance the GitHub `pip-audit-action` takes by default.
-function extractPipFindings(parsed) {
-  const out = [];
-  const deps = (parsed && parsed.dependencies) || [];
-  for (const dep of deps) {
-    const vulns = Array.isArray(dep.vulns) ? dep.vulns : [];
-    for (const v of vulns) {
-      out.push({
-        ecosystem: 'pypi',
-        package: dep.name,
-        version: dep.version,
-        severity: 'high', // see note above
-        id: v.id || (Array.isArray(v.aliases) && v.aliases[0]) || null,
-        summary: (v.description || '').split('\n')[0].slice(0, 240) || `${dep.name} ${dep.version}: ${v.id}`,
-        fix: Array.isArray(v.fix_versions) && v.fix_versions.length
-          ? `upgrade to ${v.fix_versions.join(' / ')}`
-          : 'no fix available',
-        url: v.id ? `https://osv.dev/vulnerability/${v.id}` : null,
-      });
-    }
-  }
-  return out;
-}
-
 // Main --------------------------------------------------------------------
 
 function main() {
@@ -226,14 +155,13 @@ function main() {
 
   const ranAt = new Date().toISOString();
   const npm = runNpmAudit();
-  const pip = runPipAudit();
 
-  const allFindings = [...npm.findings, ...pip.findings];
+  const allFindings = npm.findings;
   const highCount = allFindings.filter(f => f.severity === 'high' || f.severity === 'critical').length;
 
   // CI mode: a tool being entirely missing in a CI environment is a build
   // problem, not a security problem — fail loudly so we don't ship blind.
-  const toolProblem = (npm.tool_missing || pip.tool_missing) && args.mode === 'ci';
+  const toolProblem = npm.tool_missing && args.mode === 'ci';
 
   let exitCode = 0;
   if (toolProblem) exitCode = 2;
@@ -244,7 +172,6 @@ function main() {
     ran_at: ranAt,
     mode: args.mode,
     npm,
-    pip,
     high_or_critical_count: highCount,
     findings: allFindings,
     exit_code: exitCode,
@@ -253,8 +180,7 @@ function main() {
   // Human summary to stderr.
   const lines = [];
   lines.push(`dep-audit [${args.mode}] @ ${ranAt}`);
-  lines.push(`  npm:       ${npm.tool_missing ? 'TOOL MISSING' : (npm.ok ? `${npm.findings.length} high/critical` : `ERROR — ${npm.raw_error}`)}`);
-  lines.push(`  pip-audit: ${pip.tool_missing ? 'TOOL MISSING' : (pip.ok ? `${pip.findings.length} high/critical` : `ERROR — ${pip.raw_error}`)}`);
+  lines.push(`  npm: ${npm.tool_missing ? 'TOOL MISSING' : (npm.ok ? `${npm.findings.length} high/critical` : `ERROR — ${npm.raw_error}`)}`);
   if (allFindings.length) {
     lines.push(`  findings:`);
     for (const f of allFindings) {
@@ -271,6 +197,6 @@ function main() {
 
 if (require.main === module) main();
 
-// Exported for unit testing / for the nightly skill if it ever wants to drive
-// the scan in-process instead of via spawn.
-module.exports = { runNpmAudit, runPipAudit, extractNpmFindings, extractPipFindings };
+// Exported for unit testing and for the server's in-process daily check, which
+// spawns NPM_AUDIT_ARGS itself (asynchronously) and parses with parseNpmAudit.
+module.exports = { runNpmAudit, parseNpmAudit, extractNpmFindings, NPM_AUDIT_ARGS };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.176'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.177'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/autonomy_daily_checks.mjs

@@ -0,0 +1,201 @@
+// tests/autonomy_daily_checks.mjs — the server's daily checks run once a day, file
+// each distinct finding once, and never record "could not check" as clean
+// (task 1004878).
+//
+// DB-free and network-free: the run ledger, the roster, npm and the idea inbox are
+// all injected. The one thing these tests exist to stop is the failure every one of
+// these routines already had — declared daily, run never — so the scheduling half
+// (isDue against the ledger, not the boot) is pinned as hard as the filing half.
+//
+// Run:  node --test tests/autonomy_daily_checks.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const dc = require('../modules/autonomy/pollers/daily-checks.js');
+const { SERVER_ROUTINES, DAY_MS, WEEK_MS } = require('../modules/autonomy/server-schedule.js');
+const rt = require('../modules/autonomy/pollers/routine-timers.js');
+
+const NOW = Date.parse('2026-10-26T12:00:00Z');
+const hoursAgo = (h) => new Date(NOW - h * 3600_000).toISOString();
+const LADDER = ['xenos', 'thetes', 'metic', 'archon'];
+
+// A fake ledger: rows newest-first, plus a list of what got recorded.
+function ledger(rows = []) {
+  const recorded = [];
+  return {
+    recorded,
+    db: {
+      readAutonomyRuns: async () => rows,
+      recordAutonomyRun: async (r) => { recorded.push(r); return {}; },
+      readRankRoster: async () => [
+        { id: 1, github_login: 'ok', rank: 'archon', status: 'active' },
+        { id: 2, github_login: 'old', rank: 'ephor', status: 'inactive' },
+      ],
+    },
+  };
+}
+const quiet = { log: () => {}, error: () => {} };
+const capturing = () => {
+  const filed = [];
+  return { filed, captureIdea: async (i) => { filed.push(i); return { id: 42 }; } };
+};
+
+// ------------------------------------------------------------- the schedule table
+
+test('the daily poller runs exactly the server-schedule rows that name it', () => {
+  assert.deepEqual(dc.ROUTINES, SERVER_ROUTINES.filter((r) => r.poller === 'daily-checks').map((r) => r.routine));
+  assert.deepEqual(dc.ROUTINES.sort(), ['dep-audit-nightly', 'rank-roles-audit']);
+});
+
+test('peer-vote-tally takes its period from the same table (weekly)', () => {
+  assert.equal(rt.PEER_VOTE_INTERVAL_MS, WEEK_MS);
+});
+
+// ------------------------------------------------------------------ isDue
+
+test('due when it has never run', () => {
+  assert.equal(dc.isDue([], 'rank-roles-audit', NOW), true);
+});
+
+test('not due 20 hours after the last run, due 23.5 hours after — daily, not per boot', () => {
+  assert.equal(dc.isDue([{ created_at: hoursAgo(20) }], 'rank-roles-audit', NOW), false);
+  assert.equal(dc.isDue([{ created_at: hoursAgo(23.5) }], 'rank-roles-audit', NOW), true);
+  assert.equal(dc.DUE_SLACK_MS < DAY_MS / 24, true, 'slack must stay under one hourly tick or runs drift');
+});
+
+test('an ERROR row counts as a run too, so a broken check is retried daily, not hourly', async () => {
+  const L = ledger([{ decision: 'no-go', reason: 'error: x', created_at: hoursAgo(2) }]);
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, ...quiet });
+  assert.equal(out.skipped, 'not_due');
+  assert.equal(L.recorded.length, 0);
+});
+
+// --------------------------------------------------------------- filing
+
+test('a finding is filed as one idea and the run records its fingerprint', async () => {
+  const L = ledger();
+  const C = capturing();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: C.captureIdea, ...quiet });
+  assert.equal(out.outcome, 'filed');
+  assert.equal(C.filed.length, 1);
+  assert.match(C.filed[0].title, /^\[rank-roles\] 1 builder/);
+  assert.match(C.filed[0].bodyMd, /builder 2 \(old\) rank=ephor status=inactive/);
+  assert.equal(C.filed[0].kind, 'bug');
+  assert.equal(L.recorded[0].decision, 'go');
+  assert.match(L.recorded[0].reason, /^findings n=1 fp=[0-9a-f]{12} idea=42$/);
+});
+
+test('the SAME finding the next day is recorded unchanged and NOT filed again', async () => {
+  const fp = dc.fingerprint(['2:ephor']);
+  const L = ledger([{ decision: 'go', reason: `findings n=1 fp=${fp} idea=42`, created_at: hoursAgo(24) }]);
+  const C = capturing();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: C.captureIdea, ...quiet });
+  assert.equal(out.outcome, 'unchanged');
+  assert.equal(C.filed.length, 0);
+  assert.match(L.recorded[0].reason, /unchanged$/);
+});
+
+test('an error between two identical findings does not cause a duplicate filing', async () => {
+  const fp = dc.fingerprint(['2:ephor']);
+  const L = ledger([
+    { decision: 'no-go', reason: 'error: db blip', created_at: hoursAgo(24) },
+    { decision: 'go', reason: `findings n=1 fp=${fp} idea=42`, created_at: hoursAgo(48) },
+  ]);
+  const C = capturing();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: C.captureIdea, ...quiet });
+  assert.equal(out.outcome, 'unchanged');
+  assert.equal(C.filed.length, 0);
+});
+
+test('a finding that comes back after a clean day is filed again', async () => {
+  const L = ledger([{ decision: 'go', reason: 'clean', created_at: hoursAgo(24) }]);
+  const C = capturing();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: C.captureIdea, ...quiet });
+  assert.equal(out.outcome, 'filed');
+});
+
+test('the fingerprint ignores order and changes when the set changes', () => {
+  assert.equal(dc.fingerprint(['a', 'b']), dc.fingerprint(['b', 'a']));
+  assert.notEqual(dc.fingerprint(['a']), dc.fingerprint(['a', 'b']));
+});
+
+test('a clean run files nothing and records clean', async () => {
+  const L = ledger();
+  L.db.readRankRoster = async () => [{ id: 1, rank: 'archon' }];
+  const C = capturing();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: C.captureIdea, ...quiet });
+  assert.equal(out.outcome, 'clean');
+  assert.equal(C.filed.length, 0);
+  assert.deepEqual(L.recorded[0], { routine: 'rank-roles-audit', decision: 'go', reason: 'clean' });
+});
+
+test('no idea inbox (ideas module off) is recorded as undelivered, and retried next time', async () => {
+  const L = ledger();
+  const out = await dc.runCheck('rank-roles-audit', { db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: 'not a function', ...quiet });
+  assert.equal(out.outcome, 'undelivered');
+  assert.equal(L.recorded[0].decision, 'no-go', 'a no-go row is never read as delivered');
+  assert.equal(dc.lastFiledFingerprint(L.recorded.map((r) => ({ ...r }))), null);
+});
+
+test('a capture that throws is undelivered, never a crash', async () => {
+  const L = ledger();
+  const out = await dc.runCheck('rank-roles-audit', {
+    db: L.db, now: () => NOW, liveRanks: LADDER, captureIdea: async () => { throw { code: 'BAD_KIND' }; }, ...quiet,
+  });
+  assert.equal(out.outcome, 'undelivered');
+  assert.match(L.recorded[0].reason, /undelivered: BAD_KIND/);
+});
+
+// ------------------------------------------------------- could not check ≠ clean
+
+test('npm missing is an ERROR row, not clean', async () => {
+  const L = ledger();
+  const out = await dc.runCheck('dep-audit-nightly', {
+    db: L.db, now: () => NOW, cwd: '/i', npmAudit: async () => ({ error: 'npm not found' }), ...quiet,
+  });
+  assert.equal(out.outcome, 'error');
+  assert.deepEqual(L.recorded[0], { routine: 'dep-audit-nightly', decision: 'no-go', reason: 'error: npm not found' });
+});
+
+test("npm's own JSON error (no lockfile) is an ERROR row, not clean", async () => {
+  const L = ledger();
+  const out = await dc.runCheck('dep-audit-nightly', {
+    db: L.db, now: () => NOW, cwd: '/i',
+    npmAudit: async () => ({ stdout: JSON.stringify({ error: { code: 'ENOLOCK', summary: 'This command requires an existing lockfile.' } }), stderr: '' }),
+    ...quiet,
+  });
+  assert.equal(out.outcome, 'error');
+  assert.match(L.recorded[0].reason, /lockfile/);
+});
+
+test('dep-audit audits the cwd it is handed and files high/critical findings only', async () => {
+  const L = ledger();
+  const C = capturing();
+  let auditedIn = null;
+  const out = await dc.runCheck('dep-audit-nightly', {
+    db: L.db, now: () => NOW, cwd: '/srv/instance', captureIdea: C.captureIdea, ...quiet,
+    npmAudit: async (cwd) => {
+      auditedIn = cwd;
+      return { stdout: JSON.stringify({ vulnerabilities: {
+        bad: { severity: 'critical', via: [{ severity: 'critical', title: 'RCE', url: 'https://x/1', source: 1 }], fixAvailable: true },
+        meh: { severity: 'moderate', via: [], fixAvailable: true },
+      } }), stderr: '' };
+    },
+  });
+  assert.equal(auditedIn, '/srv/instance');
+  assert.equal(out.outcome, 'filed');
+  assert.match(C.filed[0].title, /^\[dep-audit\] 1 high\/critical vulnerability in/);
+  assert.match(C.filed[0].bodyMd, /\*\*bad\*\* \(critical\) — RCE/);
+  assert.doesNotMatch(C.filed[0].bodyMd, /meh/);
+});
+
+// --------------------------------------------------------------- the tick
+
+test('an unreachable database is a quiet skip for every routine (a builder laptop)', async () => {
+  const db = { readAutonomyRuns: async () => { throw new Error('connect ENOENT /var/run/postgresql'); } };
+  const out = await dc.tick({ db, ...quiet });
+  assert.deepEqual(out.map((r) => r.skipped), dc.ROUTINES.map(() => 'db_unreachable'));
+});

package/tests/claude_materialize.mjs

@@ -177,7 +177,7 @@ t('materializeClaude: materializes scheduled-tasks — bodies→bongos, companio
   assert.ok(existsSync(rt), '.claude/scheduled-tasks created in the instance');
   // Every materialized routine's core invocation is bongosified — asserted over
   // WHATEVER routines the tree carries (the neutral core carries redteam-weekly;
-  // the founder core also carries stale-claim-release/diagram-drift). No routine
+  // the founder core also carries rank-roles-audit/peer-vote-tally). No routine
   // body may keep a bare `node scripts/bongos/…` core invocation.
   let sawBongosified = false;
   for (const name of readdirSync(rt)) {
@@ -191,17 +191,17 @@ t('materializeClaude: materializes scheduled-tasks — bodies→bongos, companio
   // Founder-specific fixtures — assert their finer behavior only when present, so
   // this coverage stays live on the founder core without demanding those routines
   // exist in the neutral core (which carries a different routine set).
-  const stalePath = join(rt, 'stale-claim-release', 'SKILL.md');
-  if (existsSync(stalePath)) {
-    assert.ok(readFileSync(stalePath, 'utf8').includes('bongos exec scripts/bongos/pulse.js'), 'body core-invocation rewritten to bongos exec');
-  }
-  const ddCheck = join(rt, 'diagram-drift', 'check.js');
-  if (existsSync(ddCheck)) {
-    const dd = readFileSync(join(rt, 'diagram-drift', 'SKILL.md'), 'utf8');
-    assert.ok(dd.includes('node .claude/scheduled-tasks/diagram-drift/check.js'), 'companion-path step command preserved');
-    const check = readFileSync(ddCheck, 'utf8');
-    assert.ok(check.includes("require('../../hooks/_core-resolve.js')"), 'companion resolves core via _core-resolve');
-    assert.ok(!check.includes("require('../../../scripts/bongos/"), 'no bare ../../../scripts/bongos require left in the companion');
+  // The companion-script case (task 1004878 moved this off the retired
+  // diagram-drift routine): a routine whose step runs a .js beside its SKILL.md.
+  const pvTally = join(rt, 'peer-vote-tally', 'tally.js');
+  if (existsSync(pvTally)) {
+    const pv = readFileSync(join(rt, 'peer-vote-tally', 'SKILL.md'), 'utf8');
+    assert.ok(pv.includes('node .claude/scheduled-tasks/peer-vote-tally/tally.js'), 'companion-path step command preserved');
+    const tally = readFileSync(pvTally, 'utf8');
+    assert.ok(tally.includes("require('../../hooks/_core-resolve.js')"), 'companion resolves core via _core-resolve');
+    // Code lines only: tally.js's own header QUOTES the bare form to explain why it is gone.
+    const code = tally.split('\n').filter((l) => !/^\s*\/\//.test(l)).join('\n');
+    assert.ok(!code.includes("require('../../../scripts/bongos/"), 'no bare ../../../scripts/bongos require left in the companion');
   }
   rmSync(dir, { recursive: true, force: true });
 });

package/tests/effective_visibility_predicate.mjs

@@ -145,24 +145,6 @@ const SPELLING_EXEMPTIONS = [
     obligation: (code) => !/\.query\s*\(/.test(code) && !/require\(\s*'pg'\s*\)/.test(code),
     demands: 'issues no database query and loads no database driver — it answers from fixtures only',
   },
-  {
-    file: 'scripts/bongos/seed-bv1-privacy-invites-tasks.js',
-    allow: [
-      { text: "profile_state='", count: 1, why: 'a one-shot historical seeder: this sits inside a task DESCRIPTION string, quoting the predicate as prose describing the work to be done. Its subject IS this predicate.' },
-      { text: 'NOT hide_stats', count: 1, why: 'the second half of that same quoted sentence in that same task description — prose, not a query.' },
-    ],
-    obligation: (code) => !/\.query\s*\(/.test(code),
-    demands: 'issues no database query at all — it posts task rows over HTTP',
-  },
-  {
-    file: 'scripts/bongos/seed-bv1-r01-delta-tasks.js',
-    allow: [
-      { text: "profile_state='", count: 1, why: 'the ADR 0171 R01 seeder: the predicate is quoted as prose inside the task briefs this script files, the same shape as the privacy seeder above.' },
-      { text: 'NOT hide_stats', count: 1, why: 'the second half of that same quoted sentence in that same brief — prose describing work, never executed.' },
-    ],
-    obligation: (code) => !/\.query\s*\(/.test(code),
-    demands: 'issues no database query at all — it posts task rows over HTTP',
-  },
 ];
 
 // Every SELECT against platform_identity_accounts that is deliberately NOT a

package/tests/routine_capture_kind.mjs

@@ -2,6 +2,7 @@
 // kind the server accepts (task 1003694).
 //
 // THE FAILURE THIS PINS. .claude/scheduled-tasks/dep-audit-nightly/SKILL.md filed
+// (before task 1004878 moved its filing into the server's daily-checks poller)
 // with `--kind security`. That is not one of the kinds — captureIdea throws BAD_KIND
 // and the route 400s — so the capture step of that nightly routine had NEVER filed
 // anything.
@@ -137,11 +138,21 @@ test('a capture command wrapped over lines is still read', () => {
     'dep-audit-nightly writes exactly this shape — a line-at-a-time matcher misses it');
 });
 
-test('dep-audit-nightly specifically now files with an accepted kind (task 1003694)', () => {
-  const p = path.join(REPO_ROOT, '.claude', 'scheduled-tasks', 'dep-audit-nightly', 'SKILL.md');
-  const src = readFileSync(p, 'utf8');
-  assert.ok(!/--kind\s+security\b/.test(src), 'security is not a kind and never was');
-  const kinds = literalKinds(src);
-  assert.ok(kinds.length > 0, 'the routine must still file something');
-  for (const k of kinds) assert.ok(VALID_KINDS.includes(k), `${k} is not a valid kind`);
+test('dep-audit-nightly specifically now files with an accepted kind (task 1003694)', async () => {
+  // Since task 1004878 the routine files from the server's daily-checks poller, not
+  // from a capture command in its SKILL.md — so the kind to check is the one the
+  // poller hands ideas.capture. Driven, not grepped: a stub npm reports one finding.
+  const { runCheck } = require('../modules/autonomy/pollers/daily-checks.js');
+  const filed = [];
+  const out = await runCheck('dep-audit-nightly', {
+    db: { readAutonomyRuns: async () => [], recordAutonomyRun: async () => ({}) },
+    cwd: '/instance',
+    npmAudit: async () => ({ stdout: JSON.stringify({ vulnerabilities: { x: { severity: 'high', via: [], fixAvailable: true } } }), stderr: '' }),
+    captureIdea: async (idea) => { filed.push(idea); return { id: 1 }; },
+    log: () => {}, error: () => {},
+  });
+  assert.equal(out.outcome, 'filed');
+  assert.equal(filed.length, 1);
+  assert.notEqual(filed[0].kind, 'security', 'security is not a kind and never was');
+  assert.ok(VALID_KINDS.includes(filed[0].kind), `${filed[0].kind} is not a valid kind`);
 });

package/tests/routine_schedule.mjs

@@ -234,3 +234,45 @@ test('LIVE: the patrol workflow installs gitleaks, which the history scan cannot
   assert.match(wf, /sha256sum -c -/, 'the binary must be checksum-verified (the tj-actions lesson)');
   assert.match(wf, /fetch-depth: 0/, 'a shallow clone makes the history scan a confident no-op');
 });
+
+// ------------------------------------------------- the server scheduler (task 1004878)
+
+const SRV = [{ routine: 'nightly-thing', cadence: 'daily' }];
+
+test('a server row fires its routine: declared daily + server daily is green with NO workflow', () => {
+  const r = rs.evaluate(routines([{ name: 'nightly-thing', cadence: 'daily', steps: [] }]), [], SRV);
+  assert.deepEqual(r.violations, []);
+});
+
+test('without the server row the same routine is dormant — the row is what makes it green', () => {
+  const v = rs.evaluate(routines([{ name: 'nightly-thing', cadence: 'daily', steps: [] }]), [], []).violations;
+  assert.match(v[0], /NOTHING fires it/);
+});
+
+test('a server row at a different period than the routine declares is red', () => {
+  const v = rs.evaluate(routines([{ name: 'nightly-thing', cadence: 'weekly', steps: [] }]), [], SRV).violations;
+  assert.match(v[0], /declares cadence: weekly but the server fires it daily/);
+});
+
+test('the server firing a routine whose SKILL.md declares no cadence is red, not a quiet warning', () => {
+  const r = rs.evaluate(routines([], [{ name: 'nightly-thing' }]), [], SRV);
+  assert.match(r.violations[0], /fired daily by the server but its SKILL\.md declares no cadence/);
+  assert.equal(r.warnings.length, 0, 'the same routine must not ALSO read as manual-only');
+});
+
+test('a server row naming a routine that is gone is red (rename rot)', () => {
+  const v = rs.evaluate(routines(WEEKLY), [WEEKLY_WF], SRV).violations;
+  assert.ok(v.some((x) => /fires routine 'nightly-thing', which has no/.test(x)), v.join(' | '));
+});
+
+test('with no routine tree at all (an instance before materialize) server rows are not dangling', () => {
+  assert.deepEqual(rs.evaluate(routines([]), null, SRV).violations, []);
+});
+
+test('LIVE: every server-fired routine declares the cadence the server realizes', () => {
+  const { SERVER_ROUTINES } = require(path.join(ROOT, 'modules', 'autonomy', 'server-schedule.js'));
+  const declared = new Map(rs.readRoutines().withCadence.map((r) => [r.name, r.cadence]));
+  for (const s of SERVER_ROUTINES) {
+    assert.equal(declared.get(s.routine), s.cadence, `${s.routine}: SKILL.md cadence vs server-schedule.js`);
+  }
+});