@bongos/core 1.21.176 → 1.21.178

package/tests/gate_approvals.mjs

@@ -1,611 +0,0 @@
-// tests/gate_approvals.mjs
-//
-// Coverage for Archon gate-surface PR approval from the hall (task 1179, ADR 0058
-// amendment) — the path that lets an Archon clear a gate-review-blocked PR from the
-// builders' hall instead of leaving a GitHub review.
-//
-// Three layers, all with NO live DB / server / network:
-//   1. src/bongos/github-push.js helpers — listOpenPullRequests / getPullRequestFiles /
-//      setGateOwnerApproved / recheckPullRequest, through the injectable
-//      fetchImpl / repoInfo / token seams.
-//   2. The route handlers — GET /gate-approvals (filters to gate-review-red PRs and
-//      reuses the REAL classifyChanges to render why) + POST /gate-approvals/:pr/
-//      approve (sets the trustless gate-owner-approved status + re-runs the check),
-//      exercised by stubbing the github-push module the router holds.
-//   3. Structural gating — both routes are requireBuilder + classify to archon under
-//      the route-rank auditor (a silent downgrade of the approve route would let any
-//      builder clear the hard floor).
-//
-// Run:  node tests/gate_approvals.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-
-process.env.NODE_ENV = 'test';
-const require = createRequire(import.meta.url);
-
-const gp = require('../modules/lifecycle/github-push.js');
-const auth = require('../src/bongos/auth.js');
-const buildGateApprovalsRouter = require('../modules/lifecycle/routes/gate-approvals.js');
-const { checkRouteRanks } = require('../src/bongos/route-rank-check.js');
-const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
-
-let pass = 0, fail = 0;
-const t = async (name, fn) => {
-  try { await fn(); pass++; console.log(`PASS  ${name}`); }
-  catch (e) { fail++; console.log(`FAIL  ${name}\n      ${e.stack || e.message}`); }
-};
-
-const REPO = { owner: 'someowner', repo: 'somerepo', branch: 'main' };
-const SHA = 'a'.repeat(40);
-function jsonRes(status, body) {
-  return { ok: status >= 200 && status < 300, status, json: async () => body, text: async () => JSON.stringify(body) };
-}
-
-// Call the FINAL handler of a route (after the auth middleware) with a mock req/res.
-function routeHandler(router, method, routePath) {
-  const layer = router.stack.find((l) => l.route && l.route.path === routePath && l.route.methods[method]);
-  if (!layer) throw new Error(`route ${method} ${routePath} not registered`);
-  const stack = layer.route.stack;
-  return stack[stack.length - 1].handle;
-}
-function fakeRes() {
-  const res = { statusCode: 200, body: null };
-  res.status = (c) => { res.statusCode = c; return res; };
-  res.json = (b) => { res.body = b; return res; };
-  attachFail({}, res, () => {}); // install res.fail() as the router does (task 1991)
-  return res;
-}
-const ARCHON = { id: 1, rank: 'archon', github_login: 'example-owner' };
-
-// Snapshot/restore the github-push functions a route test stubs, so layers don't bleed.
-function withStubs(stubs, fn) {
-  const keys = Object.keys(stubs);
-  const saved = keys.map((k) => [k, gp[k]]);
-  for (const k of keys) gp[k] = stubs[k];
-  return (async () => { try { return await fn(); } finally { for (const [k, v] of saved) gp[k] = v; } })();
-}
-
-// A PR node as listOpenPullRequests returns it (already flattened).
-function pr(over = {}) {
-  return {
-    number: 201, title: 'task 1163: x', url: 'http://gh/pr/201', is_draft: false,
-    head_ref: 'claude/x', head_sha: SHA, author: 'someone', body: '', review_decision: null,
-    rollup_state: 'FAILURE',
-    checks: [{ name: 'gate-review', conclusion: 'FAILURE', status: 'COMPLETED', url: 'http://ci' }],
-    ...over,
-  };
-}
-const gateCheck = (conclusion, status = 'COMPLETED') => ({ name: 'gate-review', conclusion, status, url: 'http://ci' });
-
-// ===========================================================================
-// Layer 1 — github-push helpers (injected seams)
-// ===========================================================================
-
-await t('listOpenPullRequests: maps GraphQL nodes → number/head_sha/author/flattened checks', async () => {
-  const fetchImpl = async (_url, opts) => {
-    assert.ok(/pullRequests\(states:OPEN/.test(JSON.parse(opts.body).query), 'queries OPEN PRs');
-    return jsonRes(200, { data: { repository: { pullRequests: { nodes: [{
-      number: 7, title: 'task 9: t', url: 'http://gh/pr/7', isDraft: false, headRefName: 'claude/y',
-      bodyText: 'body', author: { login: 'dev1' }, reviewDecision: 'REVIEW_REQUIRED',
-      commits: { nodes: [{ commit: { oid: SHA, statusCheckRollup: { state: 'FAILURE', contexts: { nodes: [
-        { __typename: 'CheckRun', name: 'gate-review', conclusion: 'FAILURE', status: 'COMPLETED', detailsUrl: 'http://ci' },
-        { __typename: 'StatusContext', context: 'gate-author-trust', state: 'SUCCESS', targetUrl: '' },
-      ] } } } }] },
-    }] } } } });
-  };
-  const out = await gp.listOpenPullRequests({ token: 'T', repoInfo: REPO, fetchImpl });
-  assert.equal(out.length, 1);
-  assert.equal(out[0].number, 7);
-  assert.equal(out[0].head_sha, SHA);
-  assert.equal(out[0].author, 'dev1');
-  assert.equal(out[0].checks.find((c) => c.name === 'gate-review').conclusion, 'FAILURE');
-  assert.equal(out[0].checks.find((c) => c.name === 'gate-author-trust').conclusion, 'SUCCESS');
-});
-
-await t('listOpenPullRequests: tolerates a PARTIAL FORBIDDEN (App lacks Checks:read) — uses data, flags partialErrors', async () => {
-  // GitHub returns `data` (PR list intact) ALONGSIDE an errors[] when statusCheckRollup.contexts
-  // is FORBIDDEN. The old code did `if (out.errors) throw` and 502'd; it must now use the data.
-  const fetchImpl = async () => jsonRes(200, {
-    data: { repository: { pullRequests: { nodes: [{
-      number: 167, title: 'task 1234: x', url: 'http://gh/pr/167', isDraft: false, headRefName: 'claude/z',
-      bodyText: 'b', author: { login: 'dev2' }, reviewDecision: null,
-      // REAL shape: the FORBIDDEN nulls the individual CheckRun ELEMENTS inside the array
-      // (a null hole) — NOT the whole `nodes` list. Readable StatusContexts survive.
-      commits: { nodes: [{ commit: { oid: SHA, statusCheckRollup: { state: 'FAILURE', contexts: { nodes: [
-        null, // the gate-review CheckRun, FORBIDDEN without Checks:read
-        { __typename: 'StatusContext', context: 'gate-author-trust', state: 'SUCCESS', targetUrl: '' },
-      ] } } } }] },
-    }] } } },
-    errors: [{ type: 'FORBIDDEN', path: ['repository', 'pullRequests', 'nodes', 0, 'commits', 'nodes', 0, 'commit', 'statusCheckRollup', 'contexts', 'nodes', 0] }],
-  });
-  const out = await gp.listOpenPullRequests({ token: 'T', repoInfo: REPO, fetchImpl });
-  assert.equal(out.length, 1, 'PR list is still returned despite the partial error');
-  assert.equal(out[0].number, 167);
-  assert.equal(out[0].head_sha, SHA, 'head sha — all the approve path actually needs — survives');
-  // The null CheckRun hole is filtered out (would otherwise crash on c.__typename); the
-  // readable StatusContext survives, so gate-author-trust / gate-owner-approved still show.
-  assert.deepEqual(out[0].checks.map((c) => c.name), ['gate-author-trust'], 'null CheckRun dropped, StatusContext kept');
-  assert.deepEqual(out.partialErrors, ['FORBIDDEN'], 'reduced fidelity is signalled, not silent');
-});
-
-await t('listOpenPullRequests: a TOP-LEVEL GraphQL failure (no data) still throws GRAPHQL_FAILED with detail', async () => {
-  const fetchImpl = async () => jsonRes(200, { data: null, errors: [{ type: 'FORBIDDEN', message: 'bad creds' }] });
-  await assert.rejects(
-    () => gp.listOpenPullRequests({ token: 'T', repoInfo: REPO, fetchImpl }),
-    (e) => e.code === 'GRAPHQL_FAILED' && /FORBIDDEN/.test(e.detail || '')
-  );
-});
-
-await t('getMergeState: a partial FORBIDDEN on the rollup still yields mergeable/merge_state (merge driver survives)', async () => {
-  const fetchImpl = async () => jsonRes(200, {
-    data: { repository: { pullRequests: { nodes: [{
-      number: 167, id: 'PR_x', state: 'OPEN', merged: false, mergeable: 'MERGEABLE', reviewDecision: null,
-      mergeStateStatus: 'CLEAN',
-      // null CheckRun hole (FORBIDDEN) alongside a readable StatusContext.
-      commits: { nodes: [{ commit: { oid: SHA, statusCheckRollup: { state: 'FAILURE', contexts: { nodes: [
-        null, { __typename: 'StatusContext', context: 'gate-author-trust', state: 'SUCCESS' },
-      ] } } } }] },
-    }] } } },
-    errors: [{ type: 'FORBIDDEN', path: ['repository', 'pullRequests', 'nodes', 0, 'commits', 'nodes', 0, 'commit', 'statusCheckRollup', 'contexts', 'nodes', 0] }],
-  });
-  const s = await gp.getMergeState({ branch: 'claude/z' }, { token: 'T', repoInfo: REPO, fetchImpl });
-  assert.equal(s.mergeable, 'MERGEABLE');
-  assert.equal(s.merge_state, 'CLEAN', 'the gate signal mergeIfGreen depends on is intact');
-  assert.deepEqual(s.checks.map((c) => c.name), ['gate-author-trust'], 'null hole filtered; readable status kept');
-});
-
-await t('getPullRequestFiles: maps REST files → {path,deleted,status}; reflects deletions', async () => {
-  const fetchImpl = async (url) => {
-    assert.ok(/\/pulls\/201\/files/.test(url));
-    return jsonRes(200, [
-      { filename: 'src/bongos/route-rank-check.js', status: 'modified', additions: 3, deletions: 1 },
-      { filename: 'old.js', status: 'removed', additions: 0, deletions: 9 },
-    ]);
-  };
-  const files = await gp.getPullRequestFiles({ number: 201 }, { token: 'T', repoInfo: REPO, fetchImpl });
-  assert.equal(files.length, 2);
-  assert.equal(files[0].path, 'src/bongos/route-rank-check.js');
-  assert.equal(files[0].deleted, false);
-  assert.equal(files[1].deleted, true, 'status removed → deleted');
-});
-
-await t('getPullRequestFiles: rejects a non-positive PR number before any fetch', async () => {
-  await assert.rejects(
-    () => gp.getPullRequestFiles({ number: 0 }, { token: 'T', repoInfo: REPO, fetchImpl: async () => { throw new Error('no fetch'); } }),
-    (e) => e.code === 'BAD_PR'
-  );
-});
-
-await t('setGateOwnerApproved: POSTs a gate-owner-approved success status on the sha', async () => {
-  let captured = null;
-  const fetchImpl = async (url, opts) => { captured = { url, body: JSON.parse(opts.body) }; return { ok: true }; };
-  const ok = await gp.setGateOwnerApproved({ sha: SHA, login: 'example-owner' }, { token: 'T', repoInfo: REPO, fetchImpl });
-  assert.equal(ok, true);
-  assert.ok(captured.url.endsWith(`/statuses/${SHA}`), captured.url);
-  assert.equal(captured.body.context, gp.GATE_OWNER_APPROVED_CONTEXT);
-  assert.equal(captured.body.context, 'gate-owner-approved');
-  assert.equal(captured.body.state, 'success');
-  assert.ok(/example-owner/.test(captured.body.description), 'records who approved');
-});
-
-await t('recheckPullRequest: PATCHes state=closed then state=open, then re-arms auto-merge', async () => {
-  const calls = [];
-  const fetchImpl = async (url, opts) => {
-    const method = (opts && opts.method) || 'GET';
-    if (method === 'PATCH') { calls.push(JSON.parse(opts.body).state); return jsonRes(200, { node_id: 'N1', state: JSON.parse(opts.body).state }); }
-    if (url === 'https://api.github.com/graphql') { calls.push('automerge'); return jsonRes(200, { data: { enablePullRequestAutoMerge: {} } }); }
-    throw new Error('unexpected ' + url + ' ' + method);
-  };
-  const r = await gp.recheckPullRequest({ number: 201 }, { token: 'T', repoInfo: REPO, fetchImpl, reopenDelayMs: 0 });
-  assert.deepEqual(calls, ['closed', 'open', 'automerge'], 'close → reopen → re-arm auto-merge, in order');
-  assert.equal(r.reopened, true);
-  assert.equal(r.auto_merge, true);
-});
-
-await t('recheckPullRequest: waits between close and reopen so GitHub fires a distinct reopened event (task 1241)', async () => {
-  // Regression for task 1241: a close+reopen issued ~1s apart is coalesced by GitHub
-  // into no net change and dispatches no `pull_request: reopened` event, so the
-  // gate-review run never re-fires. recheckPullRequest must sleep BETWEEN the close
-  // PATCH and the reopen PATCH (deps.reopenDelayMs, default 4s in prod) so the reopen
-  // lands as a distinct state transition.
-  //
-  // task 1002644: this used to sleep a REAL 30ms and assert wall-clock elapsed >=
-  // 30 — Date.now() truncation + NTP slew on CI runners can read a punctual timer
-  // as 29ms, which flaked the unit lane (the ONLY required merge check, ADR 0162).
-  // Inject the sleep and assert its PLACE in the event sequence instead — strictly
-  // stronger (total elapsed never proved the wait sat BETWEEN the two PATCHes) and
-  // fully deterministic.
-  const events = [];
-  const delayMs = 4000; // the prod-default shape — never actually slept (injected)
-  const fetchImpl = async (url, opts) => {
-    const method = (opts && opts.method) || 'GET';
-    if (method === 'PATCH') { events.push('patch:' + JSON.parse(opts.body).state); return jsonRes(200, { node_id: 'N1', state: JSON.parse(opts.body).state }); }
-    if (url === 'https://api.github.com/graphql') { events.push('automerge'); return jsonRes(200, { data: { enablePullRequestAutoMerge: {} } }); }
-    throw new Error('unexpected ' + url + ' ' + method);
-  };
-  const sleepImpl = async (ms) => { events.push(`sleep:${ms}`); };
-  await gp.recheckPullRequest({ number: 202 }, { token: 'T', repoInfo: REPO, fetchImpl, sleepImpl, reopenDelayMs: delayMs });
-  assert.deepEqual(events, ['patch:closed', `sleep:${delayMs}`, 'patch:open', 'automerge'],
-    'the wait happens BETWEEN the close and the reopen — a coalesced close+reopen dispatches no reopened event');
-});
-
-// ===========================================================================
-// Layer 2 — GET /gate-approvals handler logic (stub the github-push module)
-// ===========================================================================
-
-await t('GET /gate-approvals: lists ONLY gate-review-red PRs, with real classifier verdict + reasons', async () => {
-  const prs = [
-    pr({ number: 201, title: 'task 1163: harbor', checks: [gateCheck('FAILURE')] }),       // escalate (route-rank-check)
-    pr({ number: 202, checks: [gateCheck('SUCCESS')] }),                                     // green → excluded
-    pr({ number: 203, is_draft: true, checks: [gateCheck('FAILURE')] }),                     // draft → excluded
-    pr({ number: 204, checks: [gateCheck(null, 'IN_PROGRESS')] }),                           // still checking
-    pr({ number: 205, title: 'task 50: mig', checks: [gateCheck('FAILURE')] }),              // needs_trust (migration)
-    pr({ number: 206, checks: [] }),                                                         // no gate-review → excluded
-  ];
-  const filesByPr = {
-    201: [{ path: 'src/bongos/route-rank-check.js', status: 'modified' }],
-    205: [{ path: 'migrations/200_x.sql', status: 'added' }],
-  };
-  await withStubs({
-    isConfigured: () => true,
-    listOpenPullRequests: async () => prs,
-    getPullRequestFiles: async ({ number }) => filesByPr[number] || [],
-  }, async () => {
-    const handler = routeHandler(buildGateApprovalsRouter(), 'get', '/gate-approvals');
-    const res = fakeRes();
-    await handler({ builder: ARCHON, params: {}, body: {} }, res);
-    assert.equal(res.statusCode, 200);
-    const nums = res.body.awaiting.map((a) => a.number).sort();
-    assert.deepEqual(nums, [201, 205], 'only the two completed-FAILURE non-draft gate PRs');
-    assert.equal(res.body.checking, 1, 'the in-progress PR is counted as checking');
-    const a201 = res.body.awaiting.find((a) => a.number === 201);
-    assert.equal(a201.verdict, 'escalate');
-    assert.equal(a201.task, 1163, 'task id parsed from the title');
-    assert.ok(a201.reasons.some((r) => r.hard_floor === true), 'route-rank-check flagged as hard floor');
-    const a205 = res.body.awaiting.find((a) => a.number === 205);
-    assert.equal(a205.verdict, 'needs_trust');
-    assert.ok(a205.reasons.length >= 1 && a205.reasons.every((r) => r.hard_floor === false));
-  });
-});
-
-await t('GET /gate-approvals: marks already_approved when a gate-owner-approved status is present', async () => {
-  await withStubs({
-    isConfigured: () => true,
-    listOpenPullRequests: async () => [pr({
-      number: 210,
-      checks: [gateCheck('FAILURE'), { name: 'gate-owner-approved', conclusion: 'SUCCESS', status: 'COMPLETED' }],
-    })],
-    getPullRequestFiles: async () => [{ path: 'src/bongos/route-rank-check.js', status: 'modified' }],
-  }, async () => {
-    const handler = routeHandler(buildGateApprovalsRouter(), 'get', '/gate-approvals');
-    const res = fakeRes();
-    await handler({ builder: ARCHON, params: {}, body: {} }, res);
-    assert.equal(res.body.awaiting[0].already_approved, true);
-  });
-});
-
-await t('GET /gate-approvals: 503 when no GitHub credential is configured', async () => {
-  await withStubs({ isConfigured: () => false }, async () => {
-    const handler = routeHandler(buildGateApprovalsRouter(), 'get', '/gate-approvals');
-    const res = fakeRes();
-    await handler({ builder: ARCHON, params: {}, body: {} }, res);
-    assert.equal(res.statusCode, 503);
-    assert.equal(res.body.error.code, 'publish_unconfigured');
-  });
-});
-
-await t('GET /gate-approvals: surfaces checks_readable=false + a note when the check rollup is unreadable', async () => {
-  // listOpenPullRequests returned PRs but flagged a partial error → checks unreadable.
-  const prs = [pr({ number: 167, checks: [] })];
-  prs.partialErrors = ['FORBIDDEN'];
-  await withStubs({
-    isConfigured: () => true,
-    listOpenPullRequests: async () => prs,
-    getPullRequestFiles: async () => [],
-  }, async () => {
-    const handler = routeHandler(buildGateApprovalsRouter(), 'get', '/gate-approvals');
-    const res = fakeRes();
-    await handler({ builder: ARCHON, params: {}, body: {} }, res);
-    assert.equal(res.statusCode, 200);
-    assert.equal(res.body.checks_readable, false);
-    assert.ok(/Checks:read/.test(res.body.note), 'tells the operator exactly what to grant');
-    assert.equal(res.body.count, 0, 'no PRs are listed as awaiting when checks are unreadable (honest empty)');
-  });
-});
-
-// ===========================================================================
-// Layer 2 — POST /gate-approvals/:pr/approve handler logic
-// ===========================================================================
-
-await t('POST approve: sets the owner-approval status on the head sha + re-runs the check', async () => {
-  let approved = null, rechecked = null;
-  await withStubs({
-    isConfigured: () => true,
-    listOpenPullRequests: async () => [pr({ number: 201, head_sha: SHA, checks: [gateCheck('FAILURE')] })],
-    setGateOwnerApproved: async ({ sha, login }) => { approved = { sha, login }; return true; },
-    recheckPullRequest: async ({ number }) => { rechecked = number; return { reopened: true, auto_merge: true }; },
-  }, async () => {
-    const handler = routeHandler(buildGateApprovalsRouter(), 'post', '/gate-approvals/:pr/approve');
-    const res = fakeRes();
-    await handler({ builder: ARCHON, params: { pr: '201' }, body: {} }, res);
-    assert.equal(res.statusCode, 200);
-    assert.equal(res.body.ok, true);
-    assert.equal(res.body.status_set, true);
-    assert.deepEqual(approved, { sha: SHA, login: 'example-owner' }, 'approval is sha-pinned to head + records the Archon');
-    assert.equal(rechecked, 201, 'the gate check is re-run for the PR');
-  });
-});
-
-await t('POST approve: still works when checks are unreadable (no gate-review check visible) — sets status + reopens', async () => {
-  // App lacks Checks:read → listOpenPullRequests returns the PR but with empty checks. The
-  // approve path must not depend on reading the gate-review conclusion: it resolves head_sha,
-  // sets the owner-approval status, and reopens. (This is the reported-bug path post-fix.)
-  let approved = null, rechecked = null;
-  await withStubs({
-    isConfigured: () => true,
-    listOpenPullRequests: async () => [pr({ number: 167, head_sha: SHA, checks: [] })],
-    setGateOwnerApproved: async ({ sha, login }) => { approved = { sha, login }; return true; },
-    recheckPullRequest: async ({ number }) => { rechecked = number; return { reopened: true, auto_merge: true }; },
-  }, async () => {
-    const handler = routeHandler(buildGateApprovalsRouter(), 'post', '/gate-approvals/:pr/approve');
-    const res = fakeRes();
-    await handler({ builder: ARCHON, params: { pr: '167' }, body: {} }, res);
-    assert.equal(res.statusCode, 200);
-    assert.equal(res.body.status_set, true);
-    assert.deepEqual(approved, { sha: SHA, login: 'example-owner' });
-    assert.equal(rechecked, 167);
-  });
-});
-
-await t('POST approve: a green gate-review is a no-op (already_clear; no status set)', async () => {
-  let approvedCalled = false;
-  await withStubs({
-    isConfigured: () => true,
-    listOpenPullRequests: async () => [pr({ number: 201, checks: [gateCheck('SUCCESS')] })],
-    setGateOwnerApproved: async () => { approvedCalled = true; return true; },
-    recheckPullRequest: async () => ({ reopened: true }),
-  }, async () => {
-    const handler = routeHandler(buildGateApprovalsRouter(), 'post', '/gate-approvals/:pr/approve');
-    const res = fakeRes();
-    await handler({ builder: ARCHON, params: { pr: '201' }, body: {} }, res);
-    assert.equal(res.body.already_clear, true);
-    assert.equal(approvedCalled, false, 'must not set an approval status when nothing is blocked');
-  });
-});
-
-await t('POST approve: 404 when the PR is not open', async () => {
-  await withStubs({
-    isConfigured: () => true,
-    listOpenPullRequests: async () => [],
-  }, async () => {
-    const handler = routeHandler(buildGateApprovalsRouter(), 'post', '/gate-approvals/:pr/approve');
-    const res = fakeRes();
-    await handler({ builder: ARCHON, params: { pr: '999' }, body: {} }, res);
-    assert.equal(res.statusCode, 404);
-    assert.equal(res.body.error.code, 'pr_not_open');
-  });
-});
-
-await t('POST approve: 500 (not 502) when the status write fails — Cloudflare masks an origin 502', async () => {
-  await withStubs({
-    isConfigured: () => true,
-    listOpenPullRequests: async () => [pr({ number: 201, checks: [gateCheck('FAILURE')] })],
-    setGateOwnerApproved: async () => false,
-  }, async () => {
-    const handler = routeHandler(buildGateApprovalsRouter(), 'post', '/gate-approvals/:pr/approve');
-    const res = fakeRes();
-    await handler({ builder: ARCHON, params: { pr: '201' }, body: {} }, res);
-    assert.equal(res.statusCode, 500, 'never a bare 502 — Cloudflare would replace its body');
-    assert.equal(res.body.error.code, 'status_set_failed');
-  });
-});
-
-await t('POST approve: a thrown github-push error becomes a structured 500 with detail (never a bare 502)', async () => {
-  await withStubs({
-    isConfigured: () => true,
-    listOpenPullRequests: async () => { throw Object.assign(new Error('GRAPHQL_FAILED'), { code: 'GRAPHQL_FAILED', detail: '[{"type":"FORBIDDEN"}]' }); },
-  }, async () => {
-    const handler = routeHandler(buildGateApprovalsRouter(), 'post', '/gate-approvals/:pr/approve');
-    const res = fakeRes();
-    await handler({ builder: ARCHON, params: { pr: '201' }, body: {} }, res);
-    assert.equal(res.statusCode, 500, 'a failed upstream read is a 500, not a Cloudflare-masked 502');
-    assert.equal(res.body.error.code, 'gate_approve_failed');
-    assert.equal(res.body.error.message, 'GRAPHQL_FAILED');
-    assert.ok(/FORBIDDEN/.test(res.body.error.details.detail), 'the GraphQL detail is surfaced loudly, not swallowed');
-  });
-});
-
-await t('POST approve: a non-positive :pr is rejected 400 before any GitHub call', async () => {
-  await withStubs({
-    isConfigured: () => { throw new Error('should not reach isConfigured'); },
-  }, async () => {
-    const handler = routeHandler(buildGateApprovalsRouter(), 'post', '/gate-approvals/:pr/approve');
-    const res = fakeRes();
-    await handler({ builder: ARCHON, params: { pr: 'abc' }, body: {} }, res);
-    assert.equal(res.statusCode, 400);
-    assert.equal(res.body.error.code, 'bad_pr');
-  });
-});
-
-// ===========================================================================
-// Layer 3 — structural gating: requireBuilder present + archon under the auditor
-// ===========================================================================
-
-await t('both routes are requireBuilder-gated and registered', async () => {
-  const router = buildGateApprovalsRouter();
-  for (const [method, p] of [['get', '/gate-approvals'], ['post', '/gate-approvals/:pr/approve']]) {
-    const layer = router.stack.find((l) => l.route && l.route.path === p && l.route.methods[method]);
-    assert.ok(layer, `${method.toUpperCase()} ${p} registered`);
-    const handles = layer.route.stack.map((s) => s.handle);
-    assert.ok(handles.includes(auth.requireBuilder), `${p} must be requireBuilder-gated`);
-  }
-});
-
-// ADR 0157 SPLIT these two apart: reading the held-PR list is `gate_approval.read`
-// (metic — the Gate page opens to the working rank, and a page whose only data endpoint
-// 403s is a page that renders an error), while APPROVING still clears the gate-review
-// hard floor and stays `gate_approval.decide` (archon, system:true). Asserting the split
-// explicitly is the point — a future edit that re-merged them onto one atom would either
-// close the page again or hand out the approval, and both are caught here.
-await t('route-rank auditor: gate-approval READ is metic+, APPROVE stays archon, no findings', async () => {
-  const res = checkRouteRanks();
-  const mine = res.routes.filter((r) => r.route.includes('gate-approvals'));
-  assert.equal(mine.length, 2, 'both routes seen by the auditor');
-  const byKey = new Map(mine.map((r) => [r.key, r]));
-  const read = byKey.get('GET /gate-approvals');
-  const approve = byKey.get('POST /gate-approvals/:pr/approve');
-  assert.ok(read && approve, 'both the list and the approve route must be present');
-  assert.deepEqual(read.perms, ['gate_approval.read'], 'the list route gates on the read atom');
-  assert.equal(read.rank, 'metic+archon', 'the list route is metic+ (ADR 0157)');
-  assert.deepEqual(approve.perms, ['gate_approval.decide'], 'approve gates on the decide atom');
-  assert.equal(approve.rank, 'archon', 'approving a held PR must stay archon');
-  const myFindings = res.findings.filter((f) => (f.route || '').includes('gate-approvals'));
-  assert.deepEqual(myFindings, [], 'no auditor findings on the gate-approval routes');
-});
-
-
-// ===========================================================================
-// Layer 3 — the page-tweak hold (task 1004323 / BV2.TW12, ADR 0341 D7). The
-// approve re-arms auto-merge on the reopened PR; a page tweak held for its
-// artist must be reopened (the check re-runs) but NEVER armed from here.
-// ===========================================================================
-
-const pageTweakReads = require('../modules/lifecycle/page-tweak-reads.js');
-async function withHold(fnHeld, body) {
-  const saved = pageTweakReads.heldForArtistFailClosed;
-  pageTweakReads.heldForArtistFailClosed = fnHeld;
-  try { return await body(); } finally { pageTweakReads.heldForArtistFailClosed = saved; }
-}
-async function approveWith(prNode) {
-  let rechecked = null;
-  const res = fakeRes();
-  await withStubs({
-    isConfigured: () => true,
-    listOpenPullRequests: async () => [prNode],
-    setGateOwnerApproved: async () => true,
-    recheckPullRequest: async (args) => { rechecked = args; return { reopened: true, auto_merge: args.arm !== false }; },
-  }, async () => {
-    const handler = routeHandler(buildGateApprovalsRouter(), 'post', '/gate-approvals/:pr/approve');
-    await handler({ builder: ARCHON, params: { pr: String(prNode.number) }, body: {} }, res);
-  });
-  return { res, rechecked };
-}
-
-await t('POST approve: a page tweak HELD for its artist is reopened but not re-armed', async () => {
-  const asked = [];
-  await withHold(async (id) => { asked.push(id); return true; }, async () => {
-    const { res, rechecked } = await approveWith(pr({ number: 301, title: 'task 5001: Tweak: Home (landing:index)', head_sha: SHA, checks: [gateCheck('FAILURE')] }));
-    assert.equal(res.statusCode, 200);
-    assert.deepEqual(asked, [5001], 'the hold is asked of the PR\'s own task');
-    assert.equal(rechecked.number, 301);
-    assert.equal(rechecked.arm, false, 'the recheck must not arm auto-merge');
-    assert.match(rechecked.heldReason, /held for the artist/);
-    assert.equal(res.body.held_for_artist, true);
-    assert.match(res.body.message, /waiting for its artist/);
-  });
-});
-
-await t('POST approve: an ordinary task is re-armed exactly as before (no arm flag sent)', async () => {
-  await withHold(async () => false, async () => {
-    const { rechecked, res } = await approveWith(pr({ number: 302, title: 'task 1163: x', head_sha: SHA, checks: [gateCheck('FAILURE')] }));
-    assert.deepEqual(rechecked, { number: 302 }, 'the pre-change call, byte for byte');
-    assert.equal(res.body.held_for_artist, false);
-  });
-});
-
-await t('POST approve: a PR naming no task is never asked about a hold', async () => {
-  let asked = 0;
-  await withHold(async () => { asked++; return true; }, async () => {
-    const { rechecked } = await approveWith(pr({ number: 303, title: 'chore: no task here', head_sha: SHA, checks: [gateCheck('FAILURE')] }));
-    assert.equal(asked, 0);
-    assert.deepEqual(rechecked, { number: 303 });
-  });
-});
-
-await t('POST approve: the REAL fail-closed read answers held when it cannot read the ledger', async () => {
-  // No stub: page-tweak-reads.heldForArtistFailClosed runs, its read throws
-  // (no pool in this process), and the route must then withhold the arm.
-  const { rechecked } = await approveWith(pr({ number: 304, title: 'task 5002: y', head_sha: SHA, checks: [gateCheck('FAILURE')] }));
-  assert.equal(rechecked.arm, false, 'an unreadable hold is treated as held');
-});
-
-await t('recheckPullRequest({ arm: false }): closes and reopens, and never calls the auto-merge mutation', async () => {
-  const calls = [];
-  const fetchImpl = async (url, opts) => {
-    const method = (opts && opts.method) || 'GET';
-    if (method === 'PATCH') { calls.push(JSON.parse(opts.body).state); return jsonRes(200, { node_id: 'N1' }); }
-    calls.push(`unexpected ${url}`);
-    return jsonRes(200, {});
-  };
-  const r = await gp.recheckPullRequest({ number: 205, arm: false, heldReason: 'held for the artist' }, { token: 'T', repoInfo: REPO, fetchImpl, reopenDelayMs: 0 });
-  assert.deepEqual(calls, ['closed', 'open']);
-  assert.equal(r.reopened, true);
-  assert.equal(r.auto_merge, false);
-  assert.equal(r.auto_merge_reason, 'held for the artist');
-});
-
-await t('closePullRequest (github-pr-close.js): one PATCH to state=closed, and a refusal is thrown by name', async () => {
-  const prClose = require('../modules/lifecycle/github-pr-close.js');
-  const calls = [];
-  const fetchImpl = async (url, opts) => { calls.push([url, opts.method, JSON.parse(opts.body)]); return jsonRes(200, {}); };
-  const r = await prClose.closePullRequest({ number: 77 }, { token: 'T', repoInfo: REPO, fetchImpl });
-  assert.deepEqual(r, { closed: true, number: 77 });
-  assert.deepEqual(calls, [['https://api.github.com/repos/someowner/somerepo/pulls/77', 'PATCH', { state: 'closed' }]]);
-  await assert.rejects(
-    prClose.closePullRequest({ number: 77 }, { token: 'T', repoInfo: REPO, fetchImpl: async () => jsonRes(422, { message: 'no' }) }),
-    (e) => e.code === 'PR_PATCH_FAILED'
-  );
-});
-// ===========================================================================
-// task 1004829 — viewer_may_approve: the hall draws the Approve card only on true,
-// so the list says whether THIS viewer's approval would be let through — the same
-// two checks the approve route mounts (gate_approval.decide, then act-alone at
-// release), fail-closed.
-// ===========================================================================
-{
-  const seams = require('../src/module-seams.js');
-  const gov = { held: true, actAlone: { ok: true }, throws: false };
-  if (!seams.hasProvider('government')) {
-    seams.registerProvider('government', {
-      builderHasPermissions: async (id, keys) => {
-        if (gov.throws) throw new Error('resolver down');
-        return gov.held && keys.every((k) => k === 'gate_approval.decide');
-      },
-      checkActAlone: async (area) => {
-        assert.equal(area, 'release', 'the approve route\'s building');
-        return gov.actAlone;
-      },
-    });
-  }
-  const listFor = async () => withStubs({
-    isConfigured: () => true,
-    listOpenPullRequests: async () => [pr({ number: 301 })],
-    getPullRequestFiles: async () => [{ path: 'src/bongos/route-rank-check.js', status: 'modified' }],
-  }, async () => {
-    const res = fakeRes();
-    await routeHandler(buildGateApprovalsRouter(), 'get', '/gate-approvals')({ builder: ARCHON, params: {}, body: {} }, res);
-    return res.body;
-  });
-  await t('GET /gate-approvals: viewer_may_approve is true for a holder of gate_approval.decide who may act alone', async () => {
-    Object.assign(gov, { held: true, actAlone: { ok: true }, throws: false });
-    assert.equal((await listFor()).viewer_may_approve, true);
-  });
-  await t('GET /gate-approvals: viewer_may_approve is false without gate_approval.decide', async () => {
-    Object.assign(gov, { held: false, actAlone: { ok: true }, throws: false });
-    assert.equal((await listFor()).viewer_may_approve, false);
-  });
-  await t('GET /gate-approvals: viewer_may_approve is false when the board decides at release', async () => {
-    Object.assign(gov, { held: true, actAlone: { ok: false, reason: 'decided_by_sitting' }, throws: false });
-    assert.equal((await listFor()).viewer_may_approve, false);
-  });
-  await t('GET /gate-approvals: viewer_may_approve is false (and the list still answers) when authority cannot be read', async () => {
-    Object.assign(gov, { held: true, actAlone: { ok: true }, throws: true });
-    const body = await listFor();
-    assert.equal(body.viewer_may_approve, false);
-    assert.equal(body.awaiting.length, 1, 'the read itself is unharmed');
-  });
-}
-
-console.log(`\n${pass} passed, ${fail} failed`);
-process.exit(fail === 0 ? 0 : 1);