@bongos/core 1.21.177 → 1.21.178

package/tests/search_isolation_db.mjs

@@ -0,0 +1,140 @@
+// tests/search_isolation_db.mjs
+//
+// Layer C of the GDS search isolation suite (task 950, V4.R12 / ADR 0060 §6 / ADR 0016),
+// against a REAL Postgres. Layers A (pure + SQL structure) and B (the HTTP route derives
+// scope from the session only) are DB-free and stay in tests/search_isolation.mjs.
+//
+// Seeds rank-gated + owner-scoped chunks and runs the REAL searchChunks and
+// searchPublicDocs in a ROLLED-BACK transaction for the done-when cases
+// (xenos-vs-protected, cross-builder memory, owner-sees-own, the public port's fixed
+// scope). The search index must never be a read-side bypass of the trust boundary.
+//
+// SPLIT OUT by task 1004863. As the third layer of search_isolation.mjs it said it ran in
+// the integration gate, but that file was never in the INTEGRATION set — so in CI it
+// always skipped and no lane executed it. This file is in the set; it needs a MIGRATED
+// database (builders 1 and 2 are the seeded system rows the owned chunk points at).
+//
+// Run:  DATABASE_URL=postgres://... node tests/search_isolation_db.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const search = require('../modules/memory/search.js');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+// ---------------------------------------------------------------------------
+// Layer C — DB-backed real-query scoping (auto-skips without Postgres)
+// ---------------------------------------------------------------------------
+console.log('Layer C — real searchChunks against a live DB (skips if unreachable):');
+
+let pool = null;
+try {
+  // task 1003207: this said `../src/db`, which has not existed since the kernel
+  // carve — so the require ALWAYS threw, pool stayed null, and Layer C skipped
+  // even against a live Postgres. It was a dead layer reporting as a skip.
+  ({ pool } = require('../src/bongos/pool'));
+} catch { pool = null; }
+
+async function dbReachable() {
+  if (!pool) return null;
+  try {
+    const c = await pool.connect();
+    try { await c.query('SELECT 1'); return c; } catch { c.release(); return null; }
+  } catch { return null; }
+}
+
+const client = await dbReachable();
+if (!client) {
+  console.log('  SKIP  no reachable Postgres — this runs in the integration lane (run-unit-tests.js INTEGRATION) / wherever a Postgres is reachable.');
+  console.log('        (The same scoping cases were proven on the prod DB in a rolled-back transaction at ship time.)');
+  // END THE POOL ON THE SKIP PATH TOO (task 1003848). Only the else-branch below
+  // ended it, so when Postgres was unreachable the Pool survived with libuv handles
+  // still closing from its failed connect — and the process.exit() at the bottom of
+  // the old combined file then tore down the loop underneath them. On Windows that surfaces as
+  // `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), src\win\async.c`, exit
+  // 0xC0000409: a process-teardown crash AFTER '5 passed, 0 failed', which reads as
+  // a failing suite in the unit gate while every assertion actually passed.
+  if (pool) await pool.end().catch(() => {});
+} else {
+  try {
+    await client.query('BEGIN');
+    await client.query(`SET LOCAL pg_trgm.word_similarity_threshold = ${search.TRGM_THRESHOLD}`);
+    // builder 1 exists (example-owner); seed a protected (metic) chunk, a public one,
+    // and a chunk owned by builder 1 — all matching q=ISO_TERM.
+    //
+    // ISO_TERM is a word no real document contains (task 1004889). It used to be
+    // 'enforcement', and in the integration lane the booted server's search-index
+    // poller fills search_chunks with the repo's docs first: 149 real chunks matched,
+    // the three seeded rows fell out of the top 50, and every "sees" case failed.
+    // Worse, the "does NOT see" cases were then passing VACUOUSLY — a hidden row and a
+    // crowded-out row look the same. With a unique term the seeded rows are the only
+    // candidates, so a row missing from the results can only mean the scope removed it.
+    const ISO_TERM = 'zqxisoprobe';
+    await client.query(`INSERT INTO search_chunks (source_kind, source_ref, chunk_index, heading_path, title, body, min_rank, owner_builder_id, content_hash) VALUES
+      ('doc','__iso__/protected.md',0,'p','PROT','trust boundary permission core ${ISO_TERM}','metic',NULL,'i1'),
+      ('doc','__iso__/public.md',0,'pub','PUB','trust boundary public ${ISO_TERM} overview','xenos',NULL,'i2'),
+      ('db','__iso__/memory:1',0,'m','MEM1','builder one private ${ISO_TERM} memo','xenos',1,'i3')`);
+
+    const titles = (rows) => rows.map((r) => r.title).sort().join(',');
+
+    await t('xenos caller sees the public chunk but NOT the metic-protected one (xenos-vs-protected)', async () => {
+      const rows = await search.searchChunks({ q: ISO_TERM, builderId: 2, builderRank: 'xenos', limit: 50 }, { client });
+      const ts = titles(rows);
+      assert.ok(ts.includes('PUB'), `expected PUB, got [${ts}]`);
+      assert.ok(!ts.includes('PROT'), `xenos must NOT see the metic chunk, got [${ts}]`);
+    });
+
+    await t('metic caller sees the protected chunk too', async () => {
+      const rows = await search.searchChunks({ q: ISO_TERM, builderId: 2, builderRank: 'metic', limit: 50 }, { client });
+      const ts = titles(rows);
+      assert.ok(ts.includes('PROT') && ts.includes('PUB'), `metic should see PROT+PUB, got [${ts}]`);
+    });
+
+    await t('builder 2 does NOT see builder 1\'s owned chunk (cross-builder memory)', async () => {
+      const rows = await search.searchChunks({ q: ISO_TERM, builderId: 2, builderRank: 'archon', limit: 50 }, { client });
+      assert.ok(!rows.some((r) => r.title === 'MEM1'), 'an Archon STILL must not see another builder\'s private chunk');
+    });
+
+    await t('builder 1 DOES see their own owned chunk (owner-sees-own)', async () => {
+      const rows = await search.searchChunks({ q: ISO_TERM, builderId: 1, builderRank: 'xenos', limit: 50 }, { client });
+      assert.ok(rows.some((r) => r.title === 'MEM1'), 'a builder must see their own private chunk');
+    });
+
+    // The public port (task 1002534, ADR 0367): the Discord #support answerer
+    // has no session, so its scope is fixed — shared xenos docs on the
+    // allowlist, nothing else, whatever matches the query.
+    await client.query(`INSERT INTO search_chunks (source_kind, source_ref, chunk_index, heading_path, title, body, min_rank, owner_builder_id, content_hash) VALUES
+      ('doc','__pub__/allowed/guide.md',0,'g','PUBOK','support enforcement guide','xenos',NULL,'p1'),
+      ('doc','__pub__/allowed/locked.md',0,'l','PUBMETIC','support enforcement locked','metic',NULL,'p2'),
+      ('doc','__pub__/allowed/mine.md',0,'m','PUBOWNED','support enforcement owned','xenos',1,'p3'),
+      ('db','__pub__/allowed/task:1',0,'d','PUBDB','support enforcement task prose','xenos',NULL,'p4'),
+      ('doc','__pub__/elsewhere.md',0,'e','PUBOFFLIST','support enforcement off the list','xenos',NULL,'p5')`);
+
+    await t('searchPublicDocs returns ONLY a shared xenos doc on the allowlist (no metic, owned, db, or off-list row)', async () => {
+      const rows = await search.searchPublicDocs({ q: 'support enforcement', refs: ['__pub__/allowed/'], limit: 10 }, { client });
+      const ts = titles(rows);
+      assert.equal(ts, 'PUBOK', `expected only PUBOK, got [${ts}]`);
+      assert.ok(rows[0].body.includes('support enforcement guide'), 'the body comes back with the hit');
+    });
+
+    await t('searchPublicDocs with no allowlist returns nothing at all', async () => {
+      assert.deepEqual(await search.searchPublicDocs({ q: 'support enforcement', refs: [] }, { client }), []);
+    });
+  } finally {
+    await client.query('ROLLBACK').catch(() => {});
+    client.release();
+    await pool.end().catch(() => {});
+  }
+}
+
+console.log(`\n${passed} passed, ${failed} failed`);
+// exitCode, not process.exit() (task 1003848): a hard exit can tear the loop down under a
+// pg handle still closing after a failed connect — the skip path.
+process.exitCode = failed === 0 ? 0 : 1;

package/tests/session_earnings_mirror_db.mjs

@@ -125,6 +125,8 @@ async function fixture(client) {
     title: `${tag} task`,
     status: 'shipped',
     version_id: version.id,
+    // Named, not placeholder-filled: tasks_discipline_check admits only the live crafts.
+    discipline: 'engineer',
   });
   const sessionId = `${tag}-session`;
   await insertRow(client, 'session_records', {

package/tests/workflow_exec_paths.mjs

@@ -23,11 +23,12 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const REPO = path.resolve(__dirname, '..');
 const CORE_PATH_SH = path.join(REPO, 'infra', 'core-path.sh');
 
-// infra/ + the gate workflows under .github/ are HOST topology (publish-manifest.js
-// PROTECTED_TOPOLOGY_EXCLUDE) — absent from a neutral core checkout (task 1002470).
-// The real-tree checks only mean something where that tree exists; the synthetic
-// counterfactual below always runs.
-const HAS_GATE_WORKFLOWS = fs.existsSync(path.join(REPO, '.github', 'workflows', 'gate-review.yml'));
+// infra/ is HOST topology (publish-manifest.js PROTECTED_TOPOLOGY_EXCLUDE) — absent
+// from a neutral core checkout (task 1002470). The real-tree checks only mean
+// something where that tree exists; the synthetic counterfactual below always runs.
+// Task 1004859: this used to key on .github/workflows/gate-review.yml, a workflow that
+// was only ever planned; it now keys on the resolver every routed invocation needs.
+const HAS_HOST_TOPOLOGY = fs.existsSync(path.join(REPO, 'infra', 'core-node.sh'));
 const HAS_CORE_PATH = fs.existsSync(CORE_PATH_SH);
 
 let passed = 0, failed = 0;
@@ -42,14 +43,11 @@ function hostTest(name, present, fn) {
 }
 
 // ---- A. the workflow lint is green on the real tree ---------------------------------------------
-hostTest('lint-workflow-exec: every core invocation is routed + publishable (no bare repo-relative form)', HAS_GATE_WORKFLOWS, () => {
+hostTest('lint-workflow-exec: every core invocation is routed + publishable (no bare repo-relative form)', HAS_HOST_TOPOLOGY, () => {
   const r = lintWorkflowExec({ instanceRoot: REPO, coreRoot: REPO });
   assert.deepEqual(r.violations, [], `expected no violations, got: ${JSON.stringify(r.violations, null, 2)}`);
   assert.ok(r.ok, 'lint should pass');
-  // The security-critical merge gates + the functional gates must all be covered.
   const rels = r.checked.map((c) => `${c.file}:${c.rel}`);
-  assert.ok(rels.some((s) => s.startsWith('gate-review.yml:') && s.endsWith('scripts/bongos/gate-review.js')), 'gate-review routed');
-  assert.ok(rels.some((s) => s.startsWith('grade-gate.yml:') && s.endsWith('scripts/bongos/ci-grade.js')), 'grade-gate routed');
   assert.ok(rels.some((s) => s.endsWith('scripts/migrate.sh')), 'selfhost migrate routed via core-path.sh');
 });
 
@@ -58,9 +56,9 @@ test('lint-workflow-exec: a bare core invocation in a workflow is flagged (count
   try {
     fs.mkdirSync(path.join(tmp, '.github', 'workflows'), { recursive: true });
     fs.mkdirSync(path.join(tmp, 'scripts', 'bongos'), { recursive: true });
-    fs.writeFileSync(path.join(tmp, 'scripts', 'bongos', 'gate-review.js'), '// probe\n');
+    fs.writeFileSync(path.join(tmp, 'scripts', 'bongos', 'main-audit.js'), '// probe\n');
     fs.writeFileSync(path.join(tmp, '.github', 'workflows', 'legacy.yml'),
-      'jobs:\n  x:\n    steps:\n      - run: node scripts/bongos/gate-review.js\n');
+      'jobs:\n  x:\n    steps:\n      - run: node scripts/bongos/main-audit.js\n');
     const r = lintWorkflowExec({ instanceRoot: tmp, coreRoot: tmp });
     assert.ok(!r.ok, 'a bare core invocation must fail the lint');
     assert.equal(r.violations.length, 1);

package/modules/lifecycle/routes/gate-approvals.js

@@ -1,299 +0,0 @@
-// src/bongos/routes/gate-approvals.js — Archon gate-surface PR approval from the hall
-// (task 1179, ADR 0058 amendment).
-//
-// WHY. The gate-review CI check (ADR 0058) clears an ESCALATE (hard floor) ONLY on
-// an owner approval, and a NEEDS_TRUST without a Metic+ author likewise blocks until
-// the owner approves. Historically that owner approval was a GitHub APPROVED review
-// by the repo owner on the head sha — i.e. the owner had to leave a GitHub/terminal review.
-// This router gives Archons a browser-only equivalent (feedback: auth flows must be
-// UI-first), trust-consistent with the existing server-set `gate-author-trust`
-// status: the server re-checks the caller's Archon rank server-side (ADR 0016) and
-// sets a `gate-owner-approved` commit status that the gate-review workflow honors as
-// owner approval. A PR author cannot forge it (only the server holds the credential).
-//
-//   GET  /gate-approvals               — open PRs whose gate-review check is red,
-//                                         with the verdict + per-file reasons (Archon)
-//   POST /gate-approvals/:pr/approve    — record owner approval + re-run the check (Archon)
-//
-// The list's "is this awaiting approval" signal is the LIVE gate-review check
-// conclusion (authoritative), not a re-derivation; classifyChanges() is reused only
-// to render WHY each PR escalated, so the hall shows exactly the CI reasoning.
-
-const express = require('express');
-// Intra-module + the published doorway — a module never requires a core internal.
-const api = require('../../../src/module-api');
-const auth = api;
-const githubPush = require('../github-push');
-// The page-tweak hold (task 1004323 / BV2.TW12, ADR 0341 D7): the approve below
-// re-arms auto-merge on the reopened PR, and a page tweak held for its artist must
-// never be armed from here. Called through the module object so tests can stub it.
-const pageTweakReads = require('../page-tweak-reads');
-
-// Would POST /gate-approvals/:pr/approve let this viewer through? The same two
-// checks it mounts, read for the list (task 1004829): the hall draws a held PR as
-// an ask card only on true, so a Metic who may read the gate never sees an Approve
-// the route would refuse. Fail-closed like requirePermission: no government port,
-// or one that throws, is false; an absent act-alone check passes, as the
-// requireActAlone gate does.
-async function viewerMayApprove(builderId) {
-  try {
-    const government = api.resolveOptional('government');
-    if (!government || typeof government.builderHasPermissions !== 'function') return false;
-    if (!(await government.builderHasPermissions(Number(builderId), ['gate_approval.decide']))) return false;
-    if (typeof government.checkActAlone !== 'function') return true;
-    const out = await government.checkActAlone('release', builderId);
-    return !!(out && out.ok === true);
-  } catch {
-    // authority that cannot be established is a denial (ADR 0016); the list still answers
-    return false;
-  }
-}
-const { HELD_NOT_ARMED } = require('../page-tweak-hold');
-const { parseId } = api;
-// The SAME pure classifier the CI gate runs — reused (never duplicated) so the hall
-// shows identical verdict + reasons. Safe to require: gate-review.js guards its CLI
-// entrypoint behind `require.main === module`, so importing it runs no side effects.
-const { classifyChanges, resolveAction } = require('../../../scripts/bongos/gate-review');
-
-// Pull a GDS task id out of a server-published PR's title ("task 1163: …") or body
-// ("… for task 1163."). Returns a number or null. Display-only.
-function taskIdFromPr(pr) {
-  const hay = `${pr.title || ''}\n${pr.body || ''}`;
-  const m = /\btask\s+(\d{1,7})\b/i.exec(hay);
-  return m ? Number(m[1]) : null;
-}
-
-// Find a named check/status in the head-commit rollup (CheckRun.name or
-// StatusContext.context — listOpenPullRequests flattens both to `name`).
-function findCheck(pr, name) {
-  return (pr.checks || []).find((c) => c.name === name) || null;
-}
-const isSuccess = (c) => c && String(c.conclusion || '').toUpperCase() === 'SUCCESS';
-const isFailure = (c) => c && String(c.conclusion || '').toUpperCase() === 'FAILURE';
-
-// Run the pure classifier over a PR's changed files to produce the display verdict +
-// reasons. blobAt returns null (no file content fetched): the path-level hard-floor /
-// sensitive-surface rules — which produce the human reasons — do not need content;
-// the content-only AUTO-narrowing certifications fail-closed to a stricter verdict,
-// which is the safe direction for a read-only "why is this stuck" view.
-function summarizeGate(files) {
-  const r = classifyChanges({ files, blobAt: () => null, diffBytes: 0 });
-  const reasons = [
-    ...(r.escalations || []).map((e) => ({ path: e.path, reason: e.reason, hard_floor: true })),
-    ...(r.needsTrust || []).map((e) => ({ path: e.path, reason: e.reason, hard_floor: false })),
-  ];
-  return { verdict: r.verdict, reasons, surfaces: r.surfaces || [] };
-}
-
-// The awaiting list itself: open, non-draft PRs whose gate-review check is
-// COMPLETED and red, each with its verdict and reasons. Shared by GET
-// /gate-approvals and the governor's docket (task 1004523), so the two can never
-// disagree about what is waiting. `withFiles: false` skips the per-PR file read
-// (the docket needs only the count and the titles, not the per-file reasons).
-async function listAwaitingGateApprovals({ withFiles = true } = {}) {
-  const prs = await githubPush.listOpenPullRequests({});
-  const awaiting = [];
-  let checking = 0;
-  for (const pr of prs) {
-    if (pr.is_draft) continue;
-    const gate = findCheck(pr, 'gate-review');
-    if (!gate) continue; // not a gate-reviewed PR (or it hasn't run yet)
-    if (String(gate.status || '').toUpperCase() !== 'COMPLETED') { checking += 1; continue; }
-    if (!isFailure(gate)) continue; // green/neutral → not awaiting
-    // gate-review is red → blocked awaiting trust/owner approval. Render WHY.
-    let summary = { verdict: 'unknown', reasons: [], surfaces: [], files: [] };
-    if (withFiles) {
-      try {
-        const files = await githubPush.getPullRequestFiles({ number: pr.number });
-        summary = summarizeGate(files);
-        summary.files = files.map((f) => ({ path: f.path, status: f.status }));
-      } catch (_) {
-        summary.files = [];
-      }
-    }
-    awaiting.push({
-      number: pr.number,
-      title: pr.title,
-      url: pr.url,
-      task: taskIdFromPr(pr),
-      author: pr.author,
-      head_sha: pr.head_sha,
-      verdict: summary.verdict,
-      reasons: summary.reasons,
-      files: summary.files,
-      author_trusted: isSuccess(findCheck(pr, 'gate-author-trust')),
-      already_approved: isSuccess(findCheck(pr, githubPush.GATE_OWNER_APPROVED_CONTEXT)),
-      gate_review_url: gate.url || null,
-    });
-  }
-  return { prs, awaiting, checking };
-}
-
-// The governor's docket (task 1004523): a PR held at the gate stands at Release,
-// shown only to a viewer holding `gate_approval.read` (this list route's own atom)
-// and needing only a viewer who may clear it (`gate_approval.decide`). An
-// unconfigured server credential is a read error, so the docket reports the
-// source `unavailable` rather than an empty, falsely calm Release.
-function contributeGateApprovalsToDocket() {
-  api.contribute('governor.docket', {
-    source: 'gate_approvals',
-    building: 'release',
-    gate: { permission: 'gate_approval.read' },
-    read: async (ctx) => {
-      if (!githubPush.isConfigured()) throw new Error('publish_unconfigured');
-      const { awaiting } = await listAwaitingGateApprovals({ withFiles: false });
-      const mayDecide = ctx.has('gate_approval.decide');
-      return awaiting.filter((pr) => !pr.already_approved).map((pr) => ({
-        id: pr.number,
-        rule: 'decide',
-        state: mayDecide ? 'needs' : 'moving',
-        title: pr.title || `Pull request ${pr.number}`,
-        short: 'held at the gate',
-        where: 'release · held at the gate',
-        opened_at: null,
-        deadline: null,
-        proposer: pr.author ? { login: pr.author } : null,
-        tally: null,
-        href: '/gate',
-        ref: { type: 'pull_request', id: pr.number },
-      }));
-    },
-  });
-}
-
-// The approval itself, shared by the route above and a passed Release matter
-// (task 1004561, ../matter-acts.js) so the two can never differ. Returns
-// { ok: true, body } or { ok: false, code, status, message }; throws on an
-// unexpected failure (the caller says it). `login` is who approved, as the
-// status description names it.
-async function approveGatePr({ number, login }) {
-  if (!githubPush.isConfigured()) {
-    return { ok: false, code: 'publish_unconfigured', status: 503, message: 'No server GitHub credential configured — cannot approve.' };
-  }
-  // Resolve the live OPEN PR + its current head sha (the approval is sha-pinned,
-  // so a later commit's head carries no approval — red-team #2b protection).
-  const prs = await githubPush.listOpenPullRequests({});
-  const pr = prs.find((p) => p.number === number);
-  if (!pr) return { ok: false, code: 'pr_not_open', status: 404, message: `No open PR #${number}.` };
-  if (!pr.head_sha) return { ok: false, code: 'no_head_sha', status: 409, message: 'Could not resolve the PR head commit.' };
-
-  const gate = findCheck(pr, 'gate-review');
-  if (gate && isSuccess(gate)) {
-    return { ok: true, body: { ok: true, pr: number, already_clear: true, message: 'gate-review is already green — nothing to approve.' } };
-  }
-
-  // 1. Set the trustless owner-approval status on the head sha.
-  const set = await githubPush.setGateOwnerApproved({ sha: pr.head_sha, login, targetUrl: pr.url });
-  if (!set) {
-    // 500, not 502 — Cloudflare masks an origin 502 with its branded page (see the route's catch).
-    return { ok: false, code: 'status_set_failed', status: 500, message: 'Could not set the gate-owner-approved status.' };
-  }
-
-  // 2. Re-trigger gate-review (close+reopen → `pull_request: reopened`) so the
-  //    required check re-evaluates the new approval; re-arm auto-merge.
-  //    A PAGE TWEAK HELD FOR ITS ARTIST is reopened but NOT re-armed (task
-  //    1004323): clearing the gate check is the owner's act on the PR, and
-  //    approving the page is the artist's (ADR 0341 D7). Asked fail-closed: a
-  //    read that throws answers held, and an ordinary confirmed task left
-  //    un-armed still lands through the publish reconciler's sweep.
-  const prTask = taskIdFromPr(pr);
-  const held = prTask != null && await pageTweakReads.heldForArtistFailClosed(prTask);
-  let recheck = { reopened: false, auto_merge: false };
-  try {
-    recheck = await githubPush.recheckPullRequest(held ? { number, arm: false, heldReason: HELD_NOT_ARMED.reason } : { number });
-  } catch (e) {
-    // The status IS set; if the re-trigger failed, the next push or a manual
-    // re-run still clears it, and the publish reconciler sweep merges once green.
-    console.error('[gds] gate-approval recheck failed', e);
-    return {
-      ok: true,
-      body: {
-        ok: true, pr: number, head_sha: pr.head_sha, status_set: true, recheck: 'failed',
-        message: 'Approval recorded. Re-run of the gate check did not fire — it will clear on the next push or a manual re-run.',
-      },
-    };
-  }
-
-  return {
-    ok: true,
-    body: {
-      ok: true,
-      pr: number,
-      head_sha: pr.head_sha,
-      status_set: true,
-      recheck,
-      held_for_artist: held,
-      message: held
-        ? 'Approval recorded. Re-running the gate check. This is a page tweak waiting for its artist, so it lands only once the artist approves it in the studio.'
-        : 'Approval recorded. Re-running the gate check — the PR merges once it goes green.',
-    },
-  };
-}
-
-module.exports = function buildGateApprovalsRouter() {
-  contributeGateApprovalsToDocket();
-  const router = express.Router();
-
-  // GET /gate-approvals — open PRs awaiting owner approval (gate-review red), with the
-  // verdict + per-file reasons + changed files + diff link. rank: metic+archon.
-  // BV1.R105 left this on requireRank because `gate_approval.decide` was declared over
-  // the /approve WRITE only and no atom named the read. ADR 0157 extends the catalog
-  // with exactly that atom — `gate_approval.read`, floor metic — so the mapping is now
-  // one the catalog makes. The split is load-bearing, not cosmetic: `page.view.government`
-  // opens /gate to Metic, and without a Metic-readable data endpoint that page would
-  // render nothing but a 403. Approving a held PR stays archon (`.decide`, system).
-  router.get('/gate-approvals', auth.requireBuilder, auth.requirePermission('gate_approval.read'), async (req, res) => {
-    if (!githubPush.isConfigured()) {
-      return res.fail('publish_unconfigured', { status: 503, message: 'No server GitHub credential configured — cannot read pull requests.' });
-    }
-    try {
-      const { prs, awaiting, checking } = await listAwaitingGateApprovals();
-      // The PR check rollup is unreadable when the server credential lacks `Checks: read`
-      // (operator blocker): listOpenPullRequests then returns partialErrors and every PR's
-      // `checks` is empty, so the awaiting list is silently empty. Surface that so the hall
-      // can say "checks unreadable — grant the App Checks:read" rather than "nothing stuck".
-      const checksReadable = !(prs.partialErrors && prs.partialErrors.length);
-      res.json({
-        configured: true,
-        awaiting,
-        count: awaiting.length,
-        checking,
-        viewer_may_approve: await viewerMayApprove(req.builder.id),
-        checks_readable: checksReadable,
-        ...(checksReadable ? {} : {
-          note: 'PR check rollup is unreadable — the server GitHub App is missing the Checks:read permission, so gate-review-red PRs cannot be listed. Grant it and reinstall.',
-        }),
-      });
-    } catch (err) {
-      console.error('[gds] GET /gate-approvals', err);
-      // 500, not 502: Cloudflare replaces an origin 502/504 with its own branded
-      // gateway-error page, which swallows this JSON body. A 500 is passed through, so
-      // the structured error actually reaches the caller (the "never a bare 502" rule).
-      res.fail('gate_list_failed', { status: 500, message: err.message, details: { detail: err.detail || null } });
-    }
-  });
-
-  // POST /gate-approvals/:pr/approve — record owner approval for a stuck gate PR and
-  // re-run the gate-review check so it clears. rank: archon (clears the hard floor —
-  // pinned in route-rank-check.EXPECTED_RANKS for downgrade protection).
-  router.post('/gate-approvals/:pr/approve', auth.requireBuilder, auth.requirePermission('gate_approval.decide'), auth.requireActAlone('release'), async (req, res) => {
-    const number = parseId(req, res, { param: 'pr', code: 'bad_pr', positiveInt: true });
-    if (number == null) return;
-    try {
-      const out = await approveGatePr({ number, login: req.builder.github_login });
-      if (!out.ok) return res.fail(out.code, { status: out.status, message: out.message });
-      res.json(out.body);
-    } catch (err) {
-      console.error('[gds] POST /gate-approvals/:pr/approve', err);
-      // 500, not 502: Cloudflare replaces an origin 502/504 with its own branded
-      // gateway-error page, swallowing this JSON. The reported symptom — a bare
-      // "error code: 502" interstitial instead of a structured error — was exactly this.
-      // A 500 is passed through, so the caller sees { error, message, detail }.
-      res.fail('gate_approve_failed', { status: 500, message: err.message, details: { detail: err.detail || null } });
-    }
-  });
-
-  return router;
-};
-
-module.exports.approveGatePr = approveGatePr;

package/scripts/bongos/ci-grade.js

@@ -1,82 +0,0 @@
-#!/usr/bin/env node
-// scripts/bongos/ci-grade.js — run the quality grader IN CI as a fail-closed PR
-// gate (#855, ADR 0042). This is the security KEYSTONE for the ci deploy mode.
-//
-// WHY it must run in CI (not "read the recorded grade"):
-//   POST /api/bongos/tasks/:id/grade records the grader scores FROM THE REQUEST
-//   BODY — the server does not independently recompute them. In laptop mode the
-//   grader runs on the OPERATOR's trusted machine, so that's fine. In ci mode the
-//   merge trigger moves to an UNTRUSTED builder machine; a tampered local ship.js
-//   could POST a fake passing grade, so a gate that merely READS the recorded
-//   grade is theater. The only tamper-proof gate runs the grader where the
-//   builder can't touch it: here, in GitHub Actions, against the PR diff.
-//
-// It reuses the EXACT production grading path (ship.js runSubagentGrader → the
-// adversarial worker panel / trivial-diff shot), so a CI pass means the same
-// thing a ship-time pass means. Exit 0 = pass, non-zero = fail (FAIL-CLOSED: any
-// grader error also exits non-zero).
-//
-// SKIP-SAFE until armed: if no grader auth is wired (CLAUDE_CODE_OAUTH_TOKEN /
-// ANTHROPIC_API_KEY), it prints SKIP and exits 0 — so merging this workflow
-// changes nothing until the operator (a) adds the auth secret and (b) marks this
-// a REQUIRED check in branch protection. Mirrors the inert-until-cutover pattern
-// of .github/workflows/deploy-prod.yml (#597). See ADR 0042 cutover precondition #1.
-//
-// Inputs (from the workflow env):
-//   GRADE_BASE_REF      base ref to diff against (default origin/main)
-//   GRADE_TASK_ID       the PR's task id (context only; grading is diff-based)
-//   GRADE_TASK_TITLE    the PR title (context for the grader prompt)
-//   GRADE_VALUE_SUMMARY the PR value summary (context for the grader prompt)
-
-const { execFileSync } = require('node:child_process');
-const ship = require('./ship.js');
-
-function git(args) {
-  return execFileSync('git', args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
-}
-
-(async () => {
-  // Auth presence — the grader spawns the `claude` CLI; without auth it cannot
-  // run. Until the operator wires it, stay green-but-not-gating (see header).
-  const hasAuth = !!(process.env.CLAUDE_CODE_OAUTH_TOKEN || process.env.ANTHROPIC_API_KEY);
-  if (!hasAuth) {
-    console.log(
-      'grade-gate: SKIP — no grader auth (CLAUDE_CODE_OAUTH_TOKEN / ANTHROPIC_API_KEY) configured. ' +
-        'This check is green-but-not-gating until the operator wires the secret AND marks it a required check ' +
-        '(ADR 0042 cutover precondition #1). It is NOT a real gate yet.'
-    );
-    process.exit(0);
-  }
-
-  const base = process.env.GRADE_BASE_REF || 'origin/main';
-  let baseline;
-  try {
-    baseline = git(['merge-base', base, 'HEAD']);
-  } catch (_) {
-    baseline = base; // shallow checkout / no common ancestor — diff against the ref directly
-  }
-
-  const changedFiles = ship.computeChangedFiles(baseline);
-  if (!changedFiles.length) {
-    console.log('grade-gate: no changes vs base — pass (nothing to grade).');
-    process.exit(0);
-  }
-
-  const task = {
-    id: process.env.GRADE_TASK_ID || null,
-    title: process.env.GRADE_TASK_TITLE || '(pull request)',
-  };
-  const valueSummary = process.env.GRADE_VALUE_SUMMARY || '';
-
-  console.log(`grade-gate: grading ${changedFiles.length} changed file(s) vs ${baseline.slice(0, 12)} ...`);
-  const result = await ship.runSubagentGrader({ task, valueSummary, baseline, changedFiles });
-
-  console.log(`grade-gate: verdict = ${result.passed ? 'PASS' : 'FAIL'}`);
-  if (result.notes_md) console.log(String(result.notes_md).slice(0, 6000));
-  // Fail-closed: only an explicit pass exits 0.
-  process.exit(result.passed ? 0 : 1);
-})().catch((err) => {
-  // FAIL-CLOSED: a grader error must block the merge, never wave it through.
-  console.error('grade-gate: FAIL (grader error — failing closed):', err && err.message ? err.message : err);
-  process.exit(1);
-});