@bongos/core 1.21.3 → 1.21.5

package/src/bongos/routes/core-update.js

@@ -90,12 +90,52 @@ function upgradesLimit(raw) {
   return Math.min(100, Math.max(1, n));
 }
 
+// The governor's docket (task 1004523, modules/government/docket.js): a newer
+// core stands at Release as a matter — "taking it is your call". Contributed on
+// the kernel seam because the read is core's (a module cannot require it), and
+// shown only to a viewer holding `core.pin.move`, GET /core-update's own atom (the
+// running version is a vulnerability-window disclosure, ADR 0043). Same
+// readCoreUpdate the banner uses: TTL-cached, never throws; `no_answer` from the
+// registry reads as unavailable, never as "up to date".
+function coreUpdateDocketMatters(update) {
+  if (!update || update.reading !== 'ok') throw new Error('core_update_no_answer');
+  if (!update.behind) return [];
+  return [{
+    id: String(update.latest),
+    rule: 'decide',
+    state: 'needs',
+    title: `Take core ${update.latest} (running ${update.running})`,
+    short: `core ${update.latest}`,
+    where: 'release · core update',
+    opened_at: null,
+    deadline: null,
+    proposer: null,
+    tally: null,
+    href: '/settings#software-update',
+    ref: { type: 'core_version', id: String(update.latest) },
+  }];
+}
+// The running core, or null when it cannot be named. Read lazily and fail-soft,
+// the same way the two routes below read it per request.
+function runningCoreVersion() {
+  try { return require('../../module-api').CORE_VERSION; } catch { return null; }
+}
+function contributeCoreUpdateToDocket(read = readCoreUpdate) {
+  seams.contribute('governor.docket', {
+    source: 'core_update',
+    building: 'release',
+    gate: { permission: 'core.pin.move' },
+    read: async () => coreUpdateDocketMatters(await read({ running: runningCoreVersion() })),
+  });
+}
+
 function buildCoreUpdateRouter({
   upgrades = readCoreUpgrades,
   softwareUpdate = readSoftwareUpdate,
   canUpdate = holdsCorePin,
   doorInputs = () => ({ provisioning: provisioningEnabled(), idp: safeIdpConfig() }),
 } = {}) {
+  contributeCoreUpdateToDocket();
   const router = express.Router();
 
   router.get(
@@ -156,3 +196,4 @@ function buildCoreUpdateRouter({
 
 module.exports = buildCoreUpdateRouter;
 module.exports.hubDeployUrl = hubDeployUrl;
+module.exports.coreUpdateDocketMatters = coreUpdateDocketMatters;

package/src/bongos/routes/modules.js

@@ -77,6 +77,8 @@ const modulesLib = require('../../modules');
 // server process.
 const moduleCli = require('../../../scripts/gds/module');
 const moduleSubmissions = require('../module-submissions');
+const moduleRechecks = require('../module-rechecks');
+const seams = require('../../module-seams');
 const moduleArtifact = require('../../../scripts/gds/module-artifact');
 const moduleAssessVersion = require('../../../scripts/gds/module-assess-version');
 const { checkEntitlement, listEntitlements, grantEntitlement, recordAcquired } = require('../module-entitlements');
@@ -160,7 +162,22 @@ const HOWTO_CACHE_MAX = 200;
 // list bounded.
 const STORE_LATEST_MAX_KEYS = 200;
 
+// The governor's docket (task 1004523, ADR 0362): module versions flagged for, or
+// going through, a re-check stand at Release. Shown only to a viewer holding
+// `module.assessment.rerun`, the atom of the reassess route below, the one act
+// a governor can take on one (there is no assessment read route to borrow from).
+function contributeModuleRechecksToDocket() {
+  seams.contribute('governor.docket', {
+    source: 'module_rechecks',
+    building: 'release',
+    gate: { permission: 'module.assessment.rerun' },
+    read: async (ctx) => (await moduleRechecks.listModuleRechecks())
+      .map((r) => moduleRechecks.moduleRecheckMatter(r, ctx.has('module.assessment.rerun'))),
+  });
+}
+
 module.exports = function buildModulesRouter() {
+  contributeModuleRechecksToDocket();
   const router = express.Router();
   // Checked how-tos by "key@version:tarball_sha256". Per router, so a test's fresh
   // router starts empty.

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.3'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.5'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/criterion_goal_attach.mjs

@@ -487,7 +487,7 @@ await test('FOR UPDATE outside a transaction is refused, not silently downgraded
 await test('CREATE: the goal is locked, inside the transaction (task 1003840)', async () => {
   actor = ARCHON;
   goalReads.length = 0;
-  const r = await post(V1, { criterion_id: 'C9', criterion_md: 'x', goal_id: 3 });
+  const r = await post(V1, { criterion_id: 'brand-new-slug', criterion_md: 'x', goal_id: 3 });
   assert.equal(r.status, 201, JSON.stringify(r.body));
   assert.ok(goalReads.length > 0, 'the route read the goal');
   for (const g of goalReads) {
@@ -498,7 +498,7 @@ await test('CREATE: the goal is locked, inside the transaction (task 1003840)',
 
 await test('CREATE: the INSERT runs ON the transaction client (task 1003840)', async () => {
   actor = ARCHON;
-  await post(V1, { criterion_id: 'C9', criterion_md: 'x', goal_id: 3 });
+  await post(V1, { criterion_id: 'brand-new-slug', criterion_md: 'x', goal_id: 3 });
   const inserts = sqlLog.filter((q) => /INSERT INTO done_when_criteria/.test(q.sql));
   assert.equal(inserts.length, 1, 'exactly one INSERT');
   assert.equal(inserts[0].via, 'client', 'the INSERT must not leave the transaction');
@@ -512,7 +512,7 @@ await test('CREATE: the INSERT runs ON the transaction client (task 1003840)', a
 await test('CREATE: a refusal writes nothing and releases the client (task 1003840)', async () => {
   actor = METIC;
   goals.set(3, { id: 3, version_id: V1, owner_builder_id: 999, status: 'open' });
-  const r = await post(V1, { criterion_id: 'C9', criterion_md: 'x', goal_id: 3 });
+  const r = await post(V1, { criterion_id: 'brand-new-slug', criterion_md: 'x', goal_id: 3 });
   assert.ok(r.status >= 400, `expected a refusal, got ${r.status}`);
   assert.equal(sqlLog.filter((q) => /INSERT INTO done_when_criteria/.test(q.sql)).length, 0, 'nothing was inserted');
   assert.ok(clients.length > 0 && clients.every((c) => c.released), 'the client is released on the refusal path');
@@ -524,7 +524,7 @@ await test('the VERSION is locked too, not only the goal (task 1003840)', async
   // version could still be frozen between this read and this COMMIT.
   actor = ARCHON;
   versionReads.length = 0;
-  await post(V1, { criterion_id: 'C9', criterion_md: 'x', goal_id: 3 });
+  await post(V1, { criterion_id: 'brand-new-slug', criterion_md: 'x', goal_id: 3 });
   assert.ok(versionReads.length > 0, 'the route read the version');
   for (const v of versionReads) {
     assert.ok(v.deps && v.deps.client, 'the version was read outside the transaction');
@@ -566,6 +566,14 @@ await test('setGoalStatus writes on the transaction client (task 1003840)', asyn
   assert.match(seen[1].sql, /UPDATE goal_membership_requests/);
 });
 
+await test('POST refuses a Cn-shaped criterion_id with a 400 before any SQL runs (task 1003122)', async () => {
+  actor = ARCHON;
+  const r = await post(V1, { criterion_id: 'C5', criterion_md: 'x', goal_id: 3 });
+  assert.equal(r.status, 400);
+  assert.equal(r.body.error, 'reserved_criterion_slug');
+  assert.equal(sqlLog.length, 0, 'refused before the transaction took any lock');
+});
+
 // The wrapper installed above is removed, so nothing after this file's own tests
 // inherits a patched module export.
 db.getGoal = realGetGoal;

package/tests/criterion_ref_parse.mjs

@@ -16,6 +16,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const db = require('../modules/lifecycle/db.js');
+const { isReservedCriterionSlug } = require('../modules/lifecycle/criterion-ref.js');
 
 let passed = 0;
 let failed = 0;
@@ -51,6 +52,20 @@ test('a "Cn" embedded in a longer string does NOT match (anchored)', () => {
   assert.equal(db.parseCriterionRef('see C8 above').kind, 'slug');
 });
 
+test('a Cn-shaped slug is reserved; real slugs are not (task 1003122)', () => {
+  for (const r of ['C5', 'c10', ' C1 ']) assert.equal(isReservedCriterionSlug(r), true, r);
+  for (const r of ['C', 'C8x', 'wa6-kernel', 'C-5', '5', '']) assert.equal(isReservedCriterionSlug(r), false, r);
+});
+
+test("core_272 renames all ten of goal 1000045's Cn slugs to non-Cn names (task 1003122)", () => {
+  const sql = require('node:fs').readFileSync(new URL('../migrations/core_272_rename_cn_criterion_slugs.sql', import.meta.url), 'utf8');
+  const pairs = [...sql.matchAll(/\('(C\d+)',\s*'([^']+)'\)/g)].map((m) => [m[1], m[2]]);
+  assert.deepEqual(pairs.map((p) => p[0]), ['C1','C2','C3','C4','C5','C6','C7','C8','C9','C10']);
+  assert.equal(new Set(pairs.map((p) => p[1])).size, 10, 'new slugs are distinct');
+  for (const [, n] of pairs) assert.equal(isReservedCriterionSlug(n), false, n);
+  assert.match(sql, /goal_id = 1000045/);
+});
+
 // --- resolveCriterionIds: the multi-goal refusal (task 1003108) -------------
 // resolveCriterionIds is DB-backed, but it takes an `executor` seam (the one
 // countTasksWithoutCriterionLink uses), so a fake SQL-recording client covers the
@@ -125,6 +140,32 @@ async function main() {
     assert.deepEqual(r, { ids: [], unresolved: [], ambiguous: [] });
   });
 
+  await atest('a criterion whose slug is literally "C5" is read positionally, never by slug (task 1003122)', async () => {
+    // The incident shape: goal 1000045 slugs ten criteria C1..C10. The ref "C5"
+    // takes the positional branch on a single-goal version (the 5th row, NOT the
+    // row slugged C5) and is refused on a multi-goal one, so the slug is
+    // unreachable — which is why creation now refuses the shape.
+    const rows = [
+      { id: 601, criterion_id: 'alpha', cnum: 1 },
+      { id: 602, criterion_id: 'C1', cnum: 2 },
+      { id: 603, criterion_id: 'C5', cnum: 3 },
+    ];
+    const ex = (goals) => ({ async query(sql) { return /FROM goals/.test(sql) ? { rows: [{ n: goals }] } : { rows }; } });
+    const single = await db.resolveCriterionIds('V9', ['C1'], ex(1));
+    assert.deepEqual(single.ids, [601], 'C1 means position 1, not the row slugged C1 (602)');
+    const multi = await db.resolveCriterionIds('V9', ['C5'], ex(2));
+    assert.deepEqual(multi.ids, []);
+    assert.deepEqual(multi.ambiguous, ['C5']);
+  });
+
+  await atest('createCriterion refuses a Cn slug before touching the database (task 1003122)', async () => {
+    const ex = { query: async () => { throw new Error('must not query'); } };
+    await assert.rejects(
+      db.createCriterion({ versionId: 'V9', criterionId: 'C5', criterionMd: 'x', goalId: 1 }, { client: ex }),
+      (e) => e.code === 'RESERVED_CRITERION_SLUG'
+    );
+  });
+
   console.log(`\ncriterion ref parse (task 438) + multi-goal refusal (task 1003108) tests: ${passed} passed, ${failed} failed`);
   process.exit(failed > 0 ? 1 : 0);
 }

package/tests/discord_craft_broadcast.mjs

@@ -0,0 +1,162 @@
+// tests/discord_craft_broadcast.mjs — the Discord feed announces an artist's and
+// an ideator's moments, not only shipped tasks (task 1004439 / WA6.RP09, goal
+// 1000095, criterion wa6-roles-read-true-in-public).
+//
+// The done-when: "a ratified idea and an approved page each post one line to the
+// feed". Run for real, through the module's own posters with the webhook stubbed:
+//
+//   1. A RATIFIED IDEA. board.item.passed for a full_idea posts ONE line to
+//      #ship-feed naming its author; an amendment or a genesis stage posts nothing;
+//      the idea's title never leaves the hall.
+//   2. A FULL IDEA AT THE BAR. idea.graded.full posts at economy's own pass bar
+//      and not below it, naming the developer when someone else developed it.
+//   3. AN APPROVED PAGE. A page-tweak round's ship line says "page approved" and
+//      names its ARTIST (the shipped_by of task 1004432), never the applier; a
+//      security-flagged round still goes only to the security feed.
+//   4. THE WIRING. The module subscribes to both events, and nothing here pays.
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const ROOT = fileURLToPath(new URL('..', import.meta.url));
+const { test, summary } = makeRunner();
+const craft = require('../modules/discord/craft-broadcast.js');
+const ship = require('../modules/discord/ship-broadcast.js');
+const credits = require('../modules/economy/credits.js');
+
+const BUILDERS = { 7: { display_name: 'Builder 7' }, 9: { display_name: 'Builder 9' }, 4: { display_name: 'Builder 4' } };
+function harness({ channel = true } = {}) {
+  const posts = [];
+  return {
+    posts,
+    deps: {
+      getBuilder: async (id) => BUILDERS[id] || null,
+      hasChannel: () => channel,
+      post: async (ch, text) => { posts.push({ ch, text }); },
+      postWebhook: async (ch, text) => { posts.push({ ch, text }); },
+      reward: { IDEA_FULL_PASS_BAR: credits.IDEA_FULL_PASS_BAR },
+      log: () => {},
+    },
+  };
+}
+
+// ---- 1. a ratified idea ---------------------------------------------------------
+
+await test('a ratified idea posts ONE line to #ship-feed, naming its author and linking the idea', async () => {
+  const h = harness();
+  const r = await craft.postIdeaRatified({ item_id: 31, subject_type: 'full_idea', subject_id: 812, idea_id: 812, author_id: 9, completeness_score: 80, passed_at: 'now' }, h.deps);
+  assert.equal(r.posted, true);
+  assert.equal(h.posts.length, 1, 'one line');
+  assert.equal(h.posts[0].ch, 'ship_feed');
+  assert.match(h.posts[0].text, /The board ratified an idea by Builder 9\./);
+  assert.match(h.posts[0].text, /\/#\/idea\/812$/, 'the hall link carries the rest to whoever may see it');
+  assert.ok(!h.posts[0].text.startsWith('#'), 'never read by the applause bot as a ship');
+});
+
+await test('an amendment or a genesis stage is the project\'s decision, not an ideator\'s moment — nothing posts', async () => {
+  for (const subject_type of ['constitutional_amendment', 'genesis_stage']) {
+    const h = harness();
+    const r = await craft.postIdeaRatified({ item_id: 2, subject_type, subject_id: 3, idea_id: null, author_id: 4 }, h.deps);
+    assert.equal(r.skipped, 'not_an_idea');
+    assert.equal(h.posts.length, 0);
+  }
+});
+
+await test('the idea\'s title is never posted, and a name cannot carry formatting or a link', async () => {
+  const h = harness();
+  BUILDERS[66] = { display_name: '@everyone [click](evil.example) **x**' };
+  await craft.postIdeaRatified({ subject_type: 'full_idea', idea_id: 5, author_id: 66, title: 'Secret plan for the private goal' }, h.deps);
+  assert.ok(!h.posts[0].text.includes('Secret plan'), 'a payload title would not be read even if one were sent');
+  assert.ok(!/[\[\]()*@]/.test(h.posts[0].text.split(' by ')[1].split('.')[0]), 'the shared name sanitizer ran');
+  delete BUILDERS[66];
+});
+
+await test('an unconfigured feed is a named skip, and a failed post never throws', async () => {
+  const off = harness({ channel: false });
+  assert.equal((await craft.postIdeaRatified({ subject_type: 'full_idea', idea_id: 1, author_id: 9 }, off.deps)).skipped, 'channel_not_configured');
+  const broken = harness();
+  broken.deps.post = async () => { throw new Error('discord down'); };
+  const r = await craft.postIdeaRatified({ subject_type: 'full_idea', idea_id: 1, author_id: 9 }, broken.deps);
+  assert.equal(r.skipped, 'post_failed');
+});
+
+await test('an author who cannot be read leaves the line unnamed, never fails it', async () => {
+  const h = harness();
+  await craft.postIdeaRatified({ subject_type: 'full_idea', idea_id: 1, author_id: 12345 }, h.deps);
+  assert.match(h.posts[0].text, /^\u{1F3DB}\u{FE0F} The board ratified an idea\. /u);
+});
+
+// ---- 2. a Full Idea at the bar ----------------------------------------------------
+
+await test('a Full Idea posts at economy\'s own pass bar, and not below it', async () => {
+  const bar = credits.IDEA_FULL_PASS_BAR;
+  const at = harness();
+  await craft.postFullIdeaPassed({ id: 40, idea_id: 40, grade: 'full', completeness_score: bar, captured_by: 9 }, at.deps);
+  assert.equal(at.posts.length, 1);
+  assert.match(at.posts[0].text, /Builder 9's Full Idea passed its completeness check\./);
+  const below = harness();
+  const r = await craft.postFullIdeaPassed({ id: 41, grade: 'full', completeness_score: bar - 1, captured_by: 9 }, below.deps);
+  assert.equal(r.skipped, 'below_bar');
+  assert.equal(below.posts.length, 0);
+  const unscored = harness();
+  assert.equal((await craft.postFullIdeaPassed({ id: 42, completeness_score: null, captured_by: 9 }, unscored.deps)).skipped, 'below_bar');
+});
+
+await test('a developed spark names its developer, as the credit split does; no economy, no bar, no line', async () => {
+  const h = harness();
+  await craft.postFullIdeaPassed({ id: 43, completeness_score: 90, captured_by: 9, developed_by: 7 }, h.deps);
+  assert.match(h.posts[0].text, /Builder 7's Full Idea/);
+  const none = harness();
+  none.deps.reward = null;
+  const r = await craft.postFullIdeaPassed({ id: 43, completeness_score: 90, captured_by: 9 }, { ...none.deps, reward: {} });
+  assert.equal(r.skipped, 'below_bar');
+  assert.equal(none.posts.length, 0);
+});
+
+await test('the reward port carries the bar the feed reads', () => {
+  const reward = require('../modules/economy/reward.js');
+  assert.equal(reward.IDEA_FULL_PASS_BAR, credits.IDEA_FULL_PASS_BAR);
+});
+
+// ---- 3. an approved page ----------------------------------------------------------
+
+await test('an approved page posts one line saying so, naming its ARTIST, not the applier', async () => {
+  const h = harness();
+  // shipped_by is the round's artist since task 1004432; the applier (4) is nowhere in the row
+  const r = await ship.postShipBroadcast({ id: 501, value_summary: 'The landing page reads plainly now.', security_sensitive: false, source: 'page-tweak', shipped_by: 7 }, h.deps);
+  assert.deepEqual(r.posted, ['ship_feed']);
+  assert.equal(h.posts.length, 1, 'one line');
+  assert.equal(h.posts[0].text, '#501 page approved — rewritten by Builder 7: The landing page reads plainly now.');
+  assert.ok(!h.posts[0].text.includes('Builder 4'));
+});
+
+await test('an ordinary ship is unchanged, and a security-flagged page round goes only to the security feed', async () => {
+  const h = harness();
+  await ship.postShipBroadcast({ id: 502, value_summary: 'Faster claims.', security_sensitive: false, source: null, shipped_by: 4 }, h.deps);
+  assert.equal(h.posts[0].text, '#502 shipped — Faster claims.');
+  const sec = harness();
+  await ship.postShipBroadcast({ id: 503, value_summary: 'x', security_sensitive: true, source: 'page-tweak', shipped_by: 7 }, sec.deps);
+  assert.deepEqual(sec.posts.map((p) => p.ch), ['security_ship_feed']);
+  assert.ok(!sec.posts[0].text.includes('Builder 7'), 'the security line is untouched');
+  const unknown = harness();
+  await ship.postShipBroadcast({ id: 504, value_summary: 'y', security_sensitive: false, source: 'page-tweak', shipped_by: 9999 }, unknown.deps);
+  assert.equal(unknown.posts[0].text, '#504 page approved: y', 'an unreadable artist names nobody rather than the applier');
+});
+
+// ---- 4. the wiring ------------------------------------------------------------------
+
+await test('the module subscribes to both events, and nothing on these paths pays', () => {
+  const routes = fs.readFileSync(path.join(ROOT, 'modules/discord/routes/discord.js'), 'utf8');
+  assert.match(routes, /api\.on\('board\.item\.passed', \(payload\) => craftBroadcast\.postIdeaRatified\(payload\)\)/);
+  assert.match(routes, /api\.on\('idea\.graded\.full', \(graded\) => craftBroadcast\.postFullIdeaPassed\(graded\)\)/);
+  const src = fs.readFileSync(path.join(ROOT, 'modules/discord/craft-broadcast.js'), 'utf8');
+  assert.ok(!/award|credit_log|INSERT/i.test(src.replace(/\/\/.*$/gm, '')), 'a mirror: it reads names and posts, it never books');
+});
+
+summary();

package/tests/genesis_home.mjs

@@ -340,7 +340,7 @@ test('a demo\'s genesis card: no decide form, the settled plan in one line, each
   await new Promise((r) => setImmediate(r));
   assert.equal(host.hidden, false);
   assert.match(host.innerHTML, /Monarchy \/ BDFL, 3 people, 4 hours each/);
-  assert.match(host.innerHTML, /about 49 minutes/);
+  assert.match(host.innerHTML, /about 49 min\. /, 'one unit for a demo stage: "min", as the stage rows say (task 1004504)');
   assert.match(host.innerHTML, /14 min, due /, 'the stage in progress is due at a time, not a date');
   assert.match(host.innerHTML, /Stage 1 of 5 · scope · demo/);
   assert.doesNotMatch(host.innerHTML, /data-genesis-plan/, 'a demo never shows the decide form');

package/tests/government_routes.mjs

@@ -93,7 +93,9 @@ test('every /governance route gates via REAL middleware on exactly its PINNED at
   // everything outside the Board Room family — the /board/ routes and the
   // /constitution read (R18: reading the rule you vote under is part of
   // casting) — still gates on government.manage.
-  const boardFamily = (key) => key.includes('/board/') || key.endsWith('/government/constitution');
+  // task 1004523: the docket reads the board family's atom too — opening the city
+  // is part of casting, and each source inside is scoped to its own atom.
+  const boardFamily = (key) => key.includes('/board/') || key.endsWith('/government/constitution') || key.endsWith('/government/docket');
   for (const r of classified.filter((x) => !boardFamily(x.key))) {
     assert.deepEqual(r.perms, ['government.manage'], `${r.key}: the admin surface gates on the manage atom`);
   }