@bongos/core 1.21.176 → 1.21.178

package/tests/page_notes_db.mjs

@@ -10,6 +10,7 @@ import { strict as assert } from 'node:assert';
 import fs from 'node:fs';
 import path from 'node:path';
 import url from 'node:url';
+import { insertTestBuilders } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const { Pool } = require('pg');
@@ -42,15 +43,15 @@ async function refuses(sql, params, constraint) {
   throw new Error(`expected ${constraint || 'a refusal'}, but the write landed`);
 }
 
-await pool.query(`
-  CREATE TABLE IF NOT EXISTS schema_migrations (version text PRIMARY KEY);
-  CREATE TABLE IF NOT EXISTS builders (id bigserial PRIMARY KEY, github_login text, display_name text);
-  CREATE TABLE IF NOT EXISTS idea_inbox (id bigserial PRIMARY KEY, title text, status text);
-`);
+// Needs a MIGRATED database (the integration lane's). The stand-in builders /
+// idea_inbox tables this once created drifted from the schema (builders.github_id
+// became NOT NULL) and are gone (task 1004863).
 const A = 910000001;
 const B = 910000002;
-await pool.query('INSERT INTO builders (id, github_login, display_name) VALUES ($1,$2,$3),($4,$5,$6) ON CONFLICT (id) DO NOTHING',
-  [A, 'pntest-a', 'Page Notes Test A', B, 'pntest-b', '']);
+await insertTestBuilders(pool, [
+  { id: A, login: 'pntest-a', display_name: 'Page Notes Test A' },
+  { id: B, login: 'pntest-b', display_name: '' },
+]);
 
 const MIGRATION = fs.readFileSync(path.join(ROOT, 'modules/page-notes/migrations/page_notes_001_notes.sql'), 'utf8');
 await pool.query(MIGRATION);
@@ -137,7 +138,6 @@ await test('deleting a doc takes its images with it', async () => {
 });
 
 await clean();
-await pool.query('DELETE FROM builders WHERE id = ANY($1::bigint[])', [[A, B]]).catch(() => {});
 await test('THE SITE LIST (task 1004499): one surface, submitted only, newest first, read through its own index', async () => {
   await pool.query(MIGRATION_2);
   const mk = async (author, page, at) => {
@@ -162,6 +162,10 @@ await test('THE SITE LIST (task 1004499): one surface, submitted only, newest fi
   await clean();
 });
 
+// The builders go LAST (task 1004863): the site-list case above writes notes authored
+// by A and B, and page_notes_docs.author_id is a foreign key into builders.
+await clean();
+await pool.query('DELETE FROM builders WHERE id = ANY($1::bigint[])', [[A, B]]).catch(() => {});
 await pool.end();
 console.log(`page_notes_db: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/page_tweak_no_rearm.mjs

@@ -0,0 +1,50 @@
+// tests/page_tweak_no_rearm.mjs — a page tweak held for its artist is never
+// re-armed for auto-merge from outside github-push (task 1004859).
+//
+// WHY. ADR 0341 D7 holds a page tweak until its artist signs it off. The one
+// caller that could re-arm auto-merge on an open PR was the hall's gate-approval
+// route (POST /gate-approvals/:pr/approve → recheckPullRequest), and
+// tests/gate_approvals.mjs "layer 3" pinned that it passed { arm: false } for a
+// held tweak. Task 1004859 deleted that route with the dead held-PR list. The
+// guarantee now rests on there being NO other caller, so this pins that: a
+// new caller of recheckPullRequest must come with its own held-tweak check
+// and its own test, and this file is where it gets noticed.
+//
+// DB-free, no network. Run: node --test tests/page_tweak_no_rearm.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const OWNER = 'modules/lifecycle/github-push.js';
+
+// Code only: a comment naming the function is not a call.
+const stripComments = (src) => src.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '');
+
+function callers(files, read) {
+  return files.filter((f) => f !== OWNER && /recheckPullRequest\s*\(/.test(stripComments(read(f))));
+}
+
+test('nothing outside github-push calls recheckPullRequest (the only re-arm path was the removed gate route)', () => {
+  const files = execFileSync('git', ['ls-files', 'src', 'modules', 'scripts'], { cwd: ROOT, encoding: 'utf8' })
+    .split('\n').filter((f) => /\.(c|m)?js$/.test(f) && !/\/tests?\//.test(f));
+  assert.ok(files.length > 500, `only ${files.length} files scanned — the sweep is not reading the tree`);
+  const read = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8');
+  assert.deepEqual(callers(files, read), [],
+    'a new caller re-arms auto-merge on an open PR: it must check heldForArtistFailClosed for the PR\'s task '
+    + 'and pass { arm: false } when held (ADR 0341 D7), with a test, then be listed here');
+  assert.ok(!fs.existsSync(path.join(ROOT, 'modules/lifecycle/routes/gate-approvals.js')), 'the gate route stays removed');
+});
+
+test('the sweep would catch a caller (counterfactual), and ignores one in a comment', () => {
+  const fake = {
+    'modules/x/a.js': 'await githubPush.recheckPullRequest({ number: 1 });',
+    'modules/x/b.js': '// recheckPullRequest(...) is described here only',
+    [OWNER]: 'async function recheckPullRequest() {}',
+  };
+  assert.deepEqual(callers(Object.keys(fake), (f) => fake[f]), ['modules/x/a.js']);
+});

package/tests/publish_manifest.mjs

@@ -22,6 +22,7 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 import url from 'node:url';
+import { execFileSync } from 'node:child_process';
 
 const ROOT = path.resolve(path.dirname(url.fileURLToPath(import.meta.url)), '..');
 const require = createRequire(import.meta.url);
@@ -324,5 +325,68 @@ t('no publishable test statically imports an excluded module (R89 boundary)', ()
   assert.equal(offenders.length, 0, '\n        ' + offenders.join('\n        '));
 });
 
+// ── hall-preview fixtures stay out of the core; the harness stays in (task 1004888) ──
+// scripts/hall-preview/fixtures/ is ~2.4 MB of captured hall data from THIS instance
+// (owner login, world name, prior instance name). INSTANCE_EXCLUDE keeps it out of the
+// published core (task 1002219, audit H5); this pins that, so an edit to the exclude
+// list cannot silently start shipping the fixtures to every hosted project again.
+// The selection is built the way package-core builds it: enumerate the git tree
+// (`git ls-tree -r` on a ref) and keep what isPublishable() admits.
+const HALL_PREVIEW = 'scripts/hall-preview/';
+const HALL_FIXTURES = `${HALL_PREVIEW}fixtures/`;
+// The harness files the preview cannot boot without: the server and its two local
+// requires (./live-identity, ./pref-writes). A named floor, so the check below can
+// never pass by finding no harness at all.
+const HALL_HARNESS_FLOOR = ['server.js', 'live-identity.js', 'pref-writes.js'].map((f) => HALL_PREVIEW + f);
+
+function treeFiles() {
+  // package-core's ref path: every blob on HEAD. A core checkout with no git history
+  // (a consumer's vendored core) falls back to walking the disk, as --from-worktree does.
+  try {
+    const out = execFileSync('git', ['ls-tree', '-r', '--name-only', 'HEAD'], { cwd: ROOT, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 * 1024 * 1024 });
+    return out.split('\n').filter(Boolean);
+  } catch (_) {
+    const files = [];
+    const walk = (rel) => {
+      for (const ent of fs.readdirSync(path.join(ROOT, rel), { withFileTypes: true })) {
+        const r = rel ? `${rel}/${ent.name}` : ent.name;
+        if (ent.isDirectory()) walk(r); else files.push(r);
+      }
+    };
+    if (fs.existsSync(path.join(ROOT, HALL_PREVIEW))) walk(HALL_PREVIEW.slice(0, -1));
+    return files;
+  }
+}
+
+t('hall-preview fixtures are excluded from the core (path rule, task 1004888)', () => {
+  // Holds even where the fixtures are not on disk (a consumer core never has them).
+  for (const p of [`${HALL_FIXTURES}me.json`, `${HALL_FIXTURES}nested/deep.json`, `${HALL_FIXTURES}tasks.json`]) {
+    assert.equal(isPublishable(p), false, `${p} would ship in the published core — keep '${HALL_FIXTURES}' in INSTANCE_EXCLUDE`);
+  }
+  for (const p of HALL_HARNESS_FLOOR) {
+    assert.equal(isPublishable(p), true, `${p} is the preview harness and must still publish`);
+  }
+});
+
+t('the package-core selection carries no hall-preview fixture, but keeps the harness (task 1004888)', () => {
+  const hall = treeFiles().filter((f) => f.startsWith(HALL_PREVIEW));
+  const fixtures = hall.filter((f) => f.startsWith(HALL_FIXTURES));
+  const harness = hall.filter((f) => !f.startsWith(HALL_FIXTURES));
+  const { publish } = partitionPaths(hall);
+  const leaked = publish.filter((f) => f.startsWith(HALL_FIXTURES));
+  assert.equal(leaked.length, 0, `${leaked.length} hall-preview fixture(s) would ship in the core, e.g. ${leaked.slice(0, 3).join(', ')} — keep '${HALL_FIXTURES}' in INSTANCE_EXCLUDE`);
+  // Every harness file on the tree publishes, and the named floor is among them
+  // whenever the harness exists here at all (the source repo always has it).
+  const dropped = harness.filter((f) => !publish.includes(f));
+  assert.equal(dropped.length, 0, `hall-preview harness file(s) dropped from the core: ${dropped.join(', ')}`);
+  if (harness.length) {
+    for (const p of HALL_HARNESS_FLOOR) assert.ok(publish.includes(p), `${p} missing from the core selection`);
+  }
+  // Non-vacuous in the source repo: the fixtures are there to be excluded.
+  if (fs.existsSync(path.join(ROOT, HALL_FIXTURES))) {
+    assert.ok(fixtures.length > 0, `found ${HALL_FIXTURES} on disk but no fixture in the enumerated tree — the enumeration is broken, so this check proves nothing`);
+  }
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/routine_capture_kind.mjs

@@ -2,6 +2,7 @@
 // kind the server accepts (task 1003694).
 //
 // THE FAILURE THIS PINS. .claude/scheduled-tasks/dep-audit-nightly/SKILL.md filed
+// (before task 1004878 moved its filing into the server's daily-checks poller)
 // with `--kind security`. That is not one of the kinds — captureIdea throws BAD_KIND
 // and the route 400s — so the capture step of that nightly routine had NEVER filed
 // anything.
@@ -137,11 +138,21 @@ test('a capture command wrapped over lines is still read', () => {
     'dep-audit-nightly writes exactly this shape — a line-at-a-time matcher misses it');
 });
 
-test('dep-audit-nightly specifically now files with an accepted kind (task 1003694)', () => {
-  const p = path.join(REPO_ROOT, '.claude', 'scheduled-tasks', 'dep-audit-nightly', 'SKILL.md');
-  const src = readFileSync(p, 'utf8');
-  assert.ok(!/--kind\s+security\b/.test(src), 'security is not a kind and never was');
-  const kinds = literalKinds(src);
-  assert.ok(kinds.length > 0, 'the routine must still file something');
-  for (const k of kinds) assert.ok(VALID_KINDS.includes(k), `${k} is not a valid kind`);
+test('dep-audit-nightly specifically now files with an accepted kind (task 1003694)', async () => {
+  // Since task 1004878 the routine files from the server's daily-checks poller, not
+  // from a capture command in its SKILL.md — so the kind to check is the one the
+  // poller hands ideas.capture. Driven, not grepped: a stub npm reports one finding.
+  const { runCheck } = require('../modules/autonomy/pollers/daily-checks.js');
+  const filed = [];
+  const out = await runCheck('dep-audit-nightly', {
+    db: { readAutonomyRuns: async () => [], recordAutonomyRun: async () => ({}) },
+    cwd: '/instance',
+    npmAudit: async () => ({ stdout: JSON.stringify({ vulnerabilities: { x: { severity: 'high', via: [], fixAvailable: true } } }), stderr: '' }),
+    captureIdea: async (idea) => { filed.push(idea); return { id: 1 }; },
+    log: () => {}, error: () => {},
+  });
+  assert.equal(out.outcome, 'filed');
+  assert.equal(filed.length, 1);
+  assert.notEqual(filed[0].kind, 'security', 'security is not a kind and never was');
+  assert.ok(VALID_KINDS.includes(filed[0].kind), `${filed[0].kind} is not a valid kind`);
 });

package/tests/routine_schedule.mjs

@@ -234,3 +234,45 @@ test('LIVE: the patrol workflow installs gitleaks, which the history scan cannot
   assert.match(wf, /sha256sum -c -/, 'the binary must be checksum-verified (the tj-actions lesson)');
   assert.match(wf, /fetch-depth: 0/, 'a shallow clone makes the history scan a confident no-op');
 });
+
+// ------------------------------------------------- the server scheduler (task 1004878)
+
+const SRV = [{ routine: 'nightly-thing', cadence: 'daily' }];
+
+test('a server row fires its routine: declared daily + server daily is green with NO workflow', () => {
+  const r = rs.evaluate(routines([{ name: 'nightly-thing', cadence: 'daily', steps: [] }]), [], SRV);
+  assert.deepEqual(r.violations, []);
+});
+
+test('without the server row the same routine is dormant — the row is what makes it green', () => {
+  const v = rs.evaluate(routines([{ name: 'nightly-thing', cadence: 'daily', steps: [] }]), [], []).violations;
+  assert.match(v[0], /NOTHING fires it/);
+});
+
+test('a server row at a different period than the routine declares is red', () => {
+  const v = rs.evaluate(routines([{ name: 'nightly-thing', cadence: 'weekly', steps: [] }]), [], SRV).violations;
+  assert.match(v[0], /declares cadence: weekly but the server fires it daily/);
+});
+
+test('the server firing a routine whose SKILL.md declares no cadence is red, not a quiet warning', () => {
+  const r = rs.evaluate(routines([], [{ name: 'nightly-thing' }]), [], SRV);
+  assert.match(r.violations[0], /fired daily by the server but its SKILL\.md declares no cadence/);
+  assert.equal(r.warnings.length, 0, 'the same routine must not ALSO read as manual-only');
+});
+
+test('a server row naming a routine that is gone is red (rename rot)', () => {
+  const v = rs.evaluate(routines(WEEKLY), [WEEKLY_WF], SRV).violations;
+  assert.ok(v.some((x) => /fires routine 'nightly-thing', which has no/.test(x)), v.join(' | '));
+});
+
+test('with no routine tree at all (an instance before materialize) server rows are not dangling', () => {
+  assert.deepEqual(rs.evaluate(routines([]), null, SRV).violations, []);
+});
+
+test('LIVE: every server-fired routine declares the cadence the server realizes', () => {
+  const { SERVER_ROUTINES } = require(path.join(ROOT, 'modules', 'autonomy', 'server-schedule.js'));
+  const declared = new Map(rs.readRoutines().withCadence.map((r) => [r.name, r.cadence]));
+  for (const s of SERVER_ROUTINES) {
+    assert.equal(declared.get(s.routine), s.cadence, `${s.routine}: SKILL.md cadence vs server-schedule.js`);
+  }
+});

package/tests/search_isolation.mjs

@@ -14,15 +14,13 @@
 //      to searchChunks and IGNORES any attempt to widen scope via the body
 //      (builder_id / rank / min_rank / owner_builder_id). This is the
 //      "can't be tricked" proof.
-//   C. DB-backed (auto-SKIPS without a reachable Postgres): seeds rank-gated +
-//      owner-scoped chunks and runs the REAL searchChunks in a ROLLED-BACK
-//      transaction for the done-when cases (xenos-vs-protected, cross-builder
-//      memory, owner-sees-own). The same cases were also proven against the prod
-//      DB in a rolled-back transaction at ship time (the authoritative evidence).
+//   C. DB-backed: lives in tests/search_isolation_db.mjs (task 1004863). It was
+//      the third layer of this file, whose comment said it ran in the integration
+//      gate — but this file was never in that set, so in CI Layer C always skipped
+//      and no lane executed it. Split out, it is in the INTEGRATION set, and A + B
+//      stay here in the DB-free unit lane.
 //
 // Run:  node tests/search_isolation.mjs
-//   (Layer C runs only where a Postgres is reachable — the integration gate / any
-//    machine with one; it skips cleanly otherwise so the DB-free unit gate stays green.)
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
@@ -136,102 +134,6 @@ try {
   search.searchChunks = orig.searchChunks;
 }
 
-// ---------------------------------------------------------------------------
-// Layer C — DB-backed real-query scoping (auto-skips without Postgres)
-// ---------------------------------------------------------------------------
-console.log('\nLayer C — real searchChunks against a live DB (skips if unreachable):');
-
-let pool = null;
-try {
-  // task 1003207: this said `../src/db`, which has not existed since the kernel
-  // carve — so the require ALWAYS threw, pool stayed null, and Layer C skipped
-  // even against a live Postgres. It was a dead layer reporting as a skip.
-  ({ pool } = require('../src/bongos/pool'));
-} catch { pool = null; }
-
-async function dbReachable() {
-  if (!pool) return null;
-  try {
-    const c = await pool.connect();
-    try { await c.query('SELECT 1'); return c; } catch { c.release(); return null; }
-  } catch { return null; }
-}
-
-const client = await dbReachable();
-if (!client) {
-  console.log('  SKIP  no reachable Postgres — Layer C runs in the integration gate / wherever a Postgres is reachable.');
-  console.log('        (The same scoping cases were proven on the prod DB in a rolled-back transaction at ship time.)');
-  // END THE POOL ON THE SKIP PATH TOO (task 1003848). Only the else-branch below
-  // ended it, so when Postgres was unreachable the Pool survived with libuv handles
-  // still closing from its failed connect — and the process.exit() at the bottom of
-  // this file then tore down the loop underneath them. On Windows that surfaces as
-  // `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), src\win\async.c`, exit
-  // 0xC0000409: a process-teardown crash AFTER '5 passed, 0 failed', which reads as
-  // a failing suite in the unit gate while every assertion actually passed.
-  if (pool) await pool.end().catch(() => {});
-} else {
-  try {
-    await client.query('BEGIN');
-    await client.query(`SET LOCAL pg_trgm.word_similarity_threshold = ${search.TRGM_THRESHOLD}`);
-    // builder 1 exists (example-owner); seed a protected (metic) chunk, a public one,
-    // and a chunk owned by builder 1 — all matching q='enforcement'.
-    await client.query(`INSERT INTO search_chunks (source_kind, source_ref, chunk_index, heading_path, title, body, min_rank, owner_builder_id, content_hash) VALUES
-      ('doc','__iso__/protected.md',0,'p','PROT','trust boundary permission core enforcement','metic',NULL,'i1'),
-      ('doc','__iso__/public.md',0,'pub','PUB','trust boundary public enforcement overview','xenos',NULL,'i2'),
-      ('db','__iso__/memory:1',0,'m','MEM1','builder one private enforcement memo','xenos',1,'i3')`);
-
-    const titles = (rows) => rows.map((r) => r.title).sort().join(',');
-
-    await t('xenos caller sees the public chunk but NOT the metic-protected one (xenos-vs-protected)', async () => {
-      const rows = await search.searchChunks({ q: 'enforcement', builderId: 2, builderRank: 'xenos', limit: 50 }, { client });
-      const ts = titles(rows);
-      assert.ok(ts.includes('PUB'), `expected PUB, got [${ts}]`);
-      assert.ok(!ts.includes('PROT'), `xenos must NOT see the metic chunk, got [${ts}]`);
-    });
-
-    await t('metic caller sees the protected chunk too', async () => {
-      const rows = await search.searchChunks({ q: 'enforcement', builderId: 2, builderRank: 'metic', limit: 50 }, { client });
-      const ts = titles(rows);
-      assert.ok(ts.includes('PROT') && ts.includes('PUB'), `metic should see PROT+PUB, got [${ts}]`);
-    });
-
-    await t('builder 2 does NOT see builder 1\'s owned chunk (cross-builder memory)', async () => {
-      const rows = await search.searchChunks({ q: 'enforcement', builderId: 2, builderRank: 'archon', limit: 50 }, { client });
-      assert.ok(!rows.some((r) => r.title === 'MEM1'), 'an Archon STILL must not see another builder\'s private chunk');
-    });
-
-    await t('builder 1 DOES see their own owned chunk (owner-sees-own)', async () => {
-      const rows = await search.searchChunks({ q: 'enforcement', builderId: 1, builderRank: 'xenos', limit: 50 }, { client });
-      assert.ok(rows.some((r) => r.title === 'MEM1'), 'a builder must see their own private chunk');
-    });
-
-    // The public port (task 1002534, ADR 0367): the Discord #support answerer
-    // has no session, so its scope is fixed — shared xenos docs on the
-    // allowlist, nothing else, whatever matches the query.
-    await client.query(`INSERT INTO search_chunks (source_kind, source_ref, chunk_index, heading_path, title, body, min_rank, owner_builder_id, content_hash) VALUES
-      ('doc','__pub__/allowed/guide.md',0,'g','PUBOK','support enforcement guide','xenos',NULL,'p1'),
-      ('doc','__pub__/allowed/locked.md',0,'l','PUBMETIC','support enforcement locked','metic',NULL,'p2'),
-      ('doc','__pub__/allowed/mine.md',0,'m','PUBOWNED','support enforcement owned','xenos',1,'p3'),
-      ('db','__pub__/allowed/task:1',0,'d','PUBDB','support enforcement task prose','xenos',NULL,'p4'),
-      ('doc','__pub__/elsewhere.md',0,'e','PUBOFFLIST','support enforcement off the list','xenos',NULL,'p5')`);
-
-    await t('searchPublicDocs returns ONLY a shared xenos doc on the allowlist (no metic, owned, db, or off-list row)', async () => {
-      const rows = await search.searchPublicDocs({ q: 'support enforcement', refs: ['__pub__/allowed/'], limit: 10 }, { client });
-      const ts = titles(rows);
-      assert.equal(ts, 'PUBOK', `expected only PUBOK, got [${ts}]`);
-      assert.ok(rows[0].body.includes('support enforcement guide'), 'the body comes back with the hit');
-    });
-
-    await t('searchPublicDocs with no allowlist returns nothing at all', async () => {
-      assert.deepEqual(await search.searchPublicDocs({ q: 'support enforcement', refs: [] }, { client }), []);
-    });
-  } finally {
-    await client.query('ROLLBACK').catch(() => {});
-    client.release();
-    await pool.end().catch(() => {});
-  }
-}
-
 console.log(`\n${passed} passed, ${failed} failed`);
 // EXIT CODE, NOT process.exit() (task 1003848). A hard exit tears the event loop down
 // underneath any handle that is still closing — and pg leaves one behind after a

package/tests/search_isolation_db.mjs

@@ -0,0 +1,140 @@
+// tests/search_isolation_db.mjs
+//
+// Layer C of the GDS search isolation suite (task 950, V4.R12 / ADR 0060 §6 / ADR 0016),
+// against a REAL Postgres. Layers A (pure + SQL structure) and B (the HTTP route derives
+// scope from the session only) are DB-free and stay in tests/search_isolation.mjs.
+//
+// Seeds rank-gated + owner-scoped chunks and runs the REAL searchChunks and
+// searchPublicDocs in a ROLLED-BACK transaction for the done-when cases
+// (xenos-vs-protected, cross-builder memory, owner-sees-own, the public port's fixed
+// scope). The search index must never be a read-side bypass of the trust boundary.
+//
+// SPLIT OUT by task 1004863. As the third layer of search_isolation.mjs it said it ran in
+// the integration gate, but that file was never in the INTEGRATION set — so in CI it
+// always skipped and no lane executed it. This file is in the set; it needs a MIGRATED
+// database (builders 1 and 2 are the seeded system rows the owned chunk points at).
+//
+// Run:  DATABASE_URL=postgres://... node tests/search_isolation_db.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const search = require('../modules/memory/search.js');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+// ---------------------------------------------------------------------------
+// Layer C — DB-backed real-query scoping (auto-skips without Postgres)
+// ---------------------------------------------------------------------------
+console.log('Layer C — real searchChunks against a live DB (skips if unreachable):');
+
+let pool = null;
+try {
+  // task 1003207: this said `../src/db`, which has not existed since the kernel
+  // carve — so the require ALWAYS threw, pool stayed null, and Layer C skipped
+  // even against a live Postgres. It was a dead layer reporting as a skip.
+  ({ pool } = require('../src/bongos/pool'));
+} catch { pool = null; }
+
+async function dbReachable() {
+  if (!pool) return null;
+  try {
+    const c = await pool.connect();
+    try { await c.query('SELECT 1'); return c; } catch { c.release(); return null; }
+  } catch { return null; }
+}
+
+const client = await dbReachable();
+if (!client) {
+  console.log('  SKIP  no reachable Postgres — this runs in the integration lane (run-unit-tests.js INTEGRATION) / wherever a Postgres is reachable.');
+  console.log('        (The same scoping cases were proven on the prod DB in a rolled-back transaction at ship time.)');
+  // END THE POOL ON THE SKIP PATH TOO (task 1003848). Only the else-branch below
+  // ended it, so when Postgres was unreachable the Pool survived with libuv handles
+  // still closing from its failed connect — and the process.exit() at the bottom of
+  // the old combined file then tore down the loop underneath them. On Windows that surfaces as
+  // `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), src\win\async.c`, exit
+  // 0xC0000409: a process-teardown crash AFTER '5 passed, 0 failed', which reads as
+  // a failing suite in the unit gate while every assertion actually passed.
+  if (pool) await pool.end().catch(() => {});
+} else {
+  try {
+    await client.query('BEGIN');
+    await client.query(`SET LOCAL pg_trgm.word_similarity_threshold = ${search.TRGM_THRESHOLD}`);
+    // builder 1 exists (example-owner); seed a protected (metic) chunk, a public one,
+    // and a chunk owned by builder 1 — all matching q=ISO_TERM.
+    //
+    // ISO_TERM is a word no real document contains (task 1004889). It used to be
+    // 'enforcement', and in the integration lane the booted server's search-index
+    // poller fills search_chunks with the repo's docs first: 149 real chunks matched,
+    // the three seeded rows fell out of the top 50, and every "sees" case failed.
+    // Worse, the "does NOT see" cases were then passing VACUOUSLY — a hidden row and a
+    // crowded-out row look the same. With a unique term the seeded rows are the only
+    // candidates, so a row missing from the results can only mean the scope removed it.
+    const ISO_TERM = 'zqxisoprobe';
+    await client.query(`INSERT INTO search_chunks (source_kind, source_ref, chunk_index, heading_path, title, body, min_rank, owner_builder_id, content_hash) VALUES
+      ('doc','__iso__/protected.md',0,'p','PROT','trust boundary permission core ${ISO_TERM}','metic',NULL,'i1'),
+      ('doc','__iso__/public.md',0,'pub','PUB','trust boundary public ${ISO_TERM} overview','xenos',NULL,'i2'),
+      ('db','__iso__/memory:1',0,'m','MEM1','builder one private ${ISO_TERM} memo','xenos',1,'i3')`);
+
+    const titles = (rows) => rows.map((r) => r.title).sort().join(',');
+
+    await t('xenos caller sees the public chunk but NOT the metic-protected one (xenos-vs-protected)', async () => {
+      const rows = await search.searchChunks({ q: ISO_TERM, builderId: 2, builderRank: 'xenos', limit: 50 }, { client });
+      const ts = titles(rows);
+      assert.ok(ts.includes('PUB'), `expected PUB, got [${ts}]`);
+      assert.ok(!ts.includes('PROT'), `xenos must NOT see the metic chunk, got [${ts}]`);
+    });
+
+    await t('metic caller sees the protected chunk too', async () => {
+      const rows = await search.searchChunks({ q: ISO_TERM, builderId: 2, builderRank: 'metic', limit: 50 }, { client });
+      const ts = titles(rows);
+      assert.ok(ts.includes('PROT') && ts.includes('PUB'), `metic should see PROT+PUB, got [${ts}]`);
+    });
+
+    await t('builder 2 does NOT see builder 1\'s owned chunk (cross-builder memory)', async () => {
+      const rows = await search.searchChunks({ q: ISO_TERM, builderId: 2, builderRank: 'archon', limit: 50 }, { client });
+      assert.ok(!rows.some((r) => r.title === 'MEM1'), 'an Archon STILL must not see another builder\'s private chunk');
+    });
+
+    await t('builder 1 DOES see their own owned chunk (owner-sees-own)', async () => {
+      const rows = await search.searchChunks({ q: ISO_TERM, builderId: 1, builderRank: 'xenos', limit: 50 }, { client });
+      assert.ok(rows.some((r) => r.title === 'MEM1'), 'a builder must see their own private chunk');
+    });
+
+    // The public port (task 1002534, ADR 0367): the Discord #support answerer
+    // has no session, so its scope is fixed — shared xenos docs on the
+    // allowlist, nothing else, whatever matches the query.
+    await client.query(`INSERT INTO search_chunks (source_kind, source_ref, chunk_index, heading_path, title, body, min_rank, owner_builder_id, content_hash) VALUES
+      ('doc','__pub__/allowed/guide.md',0,'g','PUBOK','support enforcement guide','xenos',NULL,'p1'),
+      ('doc','__pub__/allowed/locked.md',0,'l','PUBMETIC','support enforcement locked','metic',NULL,'p2'),
+      ('doc','__pub__/allowed/mine.md',0,'m','PUBOWNED','support enforcement owned','xenos',1,'p3'),
+      ('db','__pub__/allowed/task:1',0,'d','PUBDB','support enforcement task prose','xenos',NULL,'p4'),
+      ('doc','__pub__/elsewhere.md',0,'e','PUBOFFLIST','support enforcement off the list','xenos',NULL,'p5')`);
+
+    await t('searchPublicDocs returns ONLY a shared xenos doc on the allowlist (no metic, owned, db, or off-list row)', async () => {
+      const rows = await search.searchPublicDocs({ q: 'support enforcement', refs: ['__pub__/allowed/'], limit: 10 }, { client });
+      const ts = titles(rows);
+      assert.equal(ts, 'PUBOK', `expected only PUBOK, got [${ts}]`);
+      assert.ok(rows[0].body.includes('support enforcement guide'), 'the body comes back with the hit');
+    });
+
+    await t('searchPublicDocs with no allowlist returns nothing at all', async () => {
+      assert.deepEqual(await search.searchPublicDocs({ q: 'support enforcement', refs: [] }, { client }), []);
+    });
+  } finally {
+    await client.query('ROLLBACK').catch(() => {});
+    client.release();
+    await pool.end().catch(() => {});
+  }
+}
+
+console.log(`\n${passed} passed, ${failed} failed`);
+// exitCode, not process.exit() (task 1003848): a hard exit can tear the loop down under a
+// pg handle still closing after a failed connect — the skip path.
+process.exitCode = failed === 0 ? 0 : 1;

package/tests/session_earnings_mirror_db.mjs

@@ -125,6 +125,8 @@ async function fixture(client) {
     title: `${tag} task`,
     status: 'shipped',
     version_id: version.id,
+    // Named, not placeholder-filled: tasks_discipline_check admits only the live crafts.
+    discipline: 'engineer',
   });
   const sessionId = `${tag}-session`;
   await insertRow(client, 'session_records', {

package/tests/workflow_exec_paths.mjs

@@ -23,11 +23,12 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const REPO = path.resolve(__dirname, '..');
 const CORE_PATH_SH = path.join(REPO, 'infra', 'core-path.sh');
 
-// infra/ + the gate workflows under .github/ are HOST topology (publish-manifest.js
-// PROTECTED_TOPOLOGY_EXCLUDE) — absent from a neutral core checkout (task 1002470).
-// The real-tree checks only mean something where that tree exists; the synthetic
-// counterfactual below always runs.
-const HAS_GATE_WORKFLOWS = fs.existsSync(path.join(REPO, '.github', 'workflows', 'gate-review.yml'));
+// infra/ is HOST topology (publish-manifest.js PROTECTED_TOPOLOGY_EXCLUDE) — absent
+// from a neutral core checkout (task 1002470). The real-tree checks only mean
+// something where that tree exists; the synthetic counterfactual below always runs.
+// Task 1004859: this used to key on .github/workflows/gate-review.yml, a workflow that
+// was only ever planned; it now keys on the resolver every routed invocation needs.
+const HAS_HOST_TOPOLOGY = fs.existsSync(path.join(REPO, 'infra', 'core-node.sh'));
 const HAS_CORE_PATH = fs.existsSync(CORE_PATH_SH);
 
 let passed = 0, failed = 0;
@@ -42,14 +43,11 @@ function hostTest(name, present, fn) {
 }
 
 // ---- A. the workflow lint is green on the real tree ---------------------------------------------
-hostTest('lint-workflow-exec: every core invocation is routed + publishable (no bare repo-relative form)', HAS_GATE_WORKFLOWS, () => {
+hostTest('lint-workflow-exec: every core invocation is routed + publishable (no bare repo-relative form)', HAS_HOST_TOPOLOGY, () => {
   const r = lintWorkflowExec({ instanceRoot: REPO, coreRoot: REPO });
   assert.deepEqual(r.violations, [], `expected no violations, got: ${JSON.stringify(r.violations, null, 2)}`);
   assert.ok(r.ok, 'lint should pass');
-  // The security-critical merge gates + the functional gates must all be covered.
   const rels = r.checked.map((c) => `${c.file}:${c.rel}`);
-  assert.ok(rels.some((s) => s.startsWith('gate-review.yml:') && s.endsWith('scripts/bongos/gate-review.js')), 'gate-review routed');
-  assert.ok(rels.some((s) => s.startsWith('grade-gate.yml:') && s.endsWith('scripts/bongos/ci-grade.js')), 'grade-gate routed');
   assert.ok(rels.some((s) => s.endsWith('scripts/migrate.sh')), 'selfhost migrate routed via core-path.sh');
 });
 
@@ -58,9 +56,9 @@ test('lint-workflow-exec: a bare core invocation in a workflow is flagged (count
   try {
     fs.mkdirSync(path.join(tmp, '.github', 'workflows'), { recursive: true });
     fs.mkdirSync(path.join(tmp, 'scripts', 'bongos'), { recursive: true });
-    fs.writeFileSync(path.join(tmp, 'scripts', 'bongos', 'gate-review.js'), '// probe\n');
+    fs.writeFileSync(path.join(tmp, 'scripts', 'bongos', 'main-audit.js'), '// probe\n');
     fs.writeFileSync(path.join(tmp, '.github', 'workflows', 'legacy.yml'),
-      'jobs:\n  x:\n    steps:\n      - run: node scripts/bongos/gate-review.js\n');
+      'jobs:\n  x:\n    steps:\n      - run: node scripts/bongos/main-audit.js\n');
     const r = lintWorkflowExec({ instanceRoot: tmp, coreRoot: tmp });
     assert.ok(!r.ok, 'a bare core invocation must fail the lint');
     assert.equal(r.violations.length, 1);