@bongos/core 1.21.4 → 1.21.5

package/src/bongos/routes/core-update.js

@@ -90,12 +90,52 @@ function upgradesLimit(raw) {
   return Math.min(100, Math.max(1, n));
 }
 
+// The governor's docket (task 1004523, modules/government/docket.js): a newer
+// core stands at Release as a matter — "taking it is your call". Contributed on
+// the kernel seam because the read is core's (a module cannot require it), and
+// shown only to a viewer holding `core.pin.move`, GET /core-update's own atom (the
+// running version is a vulnerability-window disclosure, ADR 0043). Same
+// readCoreUpdate the banner uses: TTL-cached, never throws; `no_answer` from the
+// registry reads as unavailable, never as "up to date".
+function coreUpdateDocketMatters(update) {
+  if (!update || update.reading !== 'ok') throw new Error('core_update_no_answer');
+  if (!update.behind) return [];
+  return [{
+    id: String(update.latest),
+    rule: 'decide',
+    state: 'needs',
+    title: `Take core ${update.latest} (running ${update.running})`,
+    short: `core ${update.latest}`,
+    where: 'release · core update',
+    opened_at: null,
+    deadline: null,
+    proposer: null,
+    tally: null,
+    href: '/settings#software-update',
+    ref: { type: 'core_version', id: String(update.latest) },
+  }];
+}
+// The running core, or null when it cannot be named. Read lazily and fail-soft,
+// the same way the two routes below read it per request.
+function runningCoreVersion() {
+  try { return require('../../module-api').CORE_VERSION; } catch { return null; }
+}
+function contributeCoreUpdateToDocket(read = readCoreUpdate) {
+  seams.contribute('governor.docket', {
+    source: 'core_update',
+    building: 'release',
+    gate: { permission: 'core.pin.move' },
+    read: async () => coreUpdateDocketMatters(await read({ running: runningCoreVersion() })),
+  });
+}
+
 function buildCoreUpdateRouter({
   upgrades = readCoreUpgrades,
   softwareUpdate = readSoftwareUpdate,
   canUpdate = holdsCorePin,
   doorInputs = () => ({ provisioning: provisioningEnabled(), idp: safeIdpConfig() }),
 } = {}) {
+  contributeCoreUpdateToDocket();
   const router = express.Router();
 
   router.get(
@@ -156,3 +196,4 @@ function buildCoreUpdateRouter({
 
 module.exports = buildCoreUpdateRouter;
 module.exports.hubDeployUrl = hubDeployUrl;
+module.exports.coreUpdateDocketMatters = coreUpdateDocketMatters;

package/src/bongos/routes/modules.js

@@ -77,6 +77,8 @@ const modulesLib = require('../../modules');
 // server process.
 const moduleCli = require('../../../scripts/gds/module');
 const moduleSubmissions = require('../module-submissions');
+const moduleRechecks = require('../module-rechecks');
+const seams = require('../../module-seams');
 const moduleArtifact = require('../../../scripts/gds/module-artifact');
 const moduleAssessVersion = require('../../../scripts/gds/module-assess-version');
 const { checkEntitlement, listEntitlements, grantEntitlement, recordAcquired } = require('../module-entitlements');
@@ -160,7 +162,22 @@ const HOWTO_CACHE_MAX = 200;
 // list bounded.
 const STORE_LATEST_MAX_KEYS = 200;
 
+// The governor's docket (task 1004523, ADR 0362): module versions flagged for, or
+// going through, a re-check stand at Release. Shown only to a viewer holding
+// `module.assessment.rerun`, the atom of the reassess route below, the one act
+// a governor can take on one (there is no assessment read route to borrow from).
+function contributeModuleRechecksToDocket() {
+  seams.contribute('governor.docket', {
+    source: 'module_rechecks',
+    building: 'release',
+    gate: { permission: 'module.assessment.rerun' },
+    read: async (ctx) => (await moduleRechecks.listModuleRechecks())
+      .map((r) => moduleRechecks.moduleRecheckMatter(r, ctx.has('module.assessment.rerun'))),
+  });
+}
+
 module.exports = function buildModulesRouter() {
+  contributeModuleRechecksToDocket();
   const router = express.Router();
   // Checked how-tos by "key@version:tarball_sha256". Per router, so a test's fresh
   // router starts empty.

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.4'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.5'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/discord_craft_broadcast.mjs

@@ -0,0 +1,162 @@
+// tests/discord_craft_broadcast.mjs — the Discord feed announces an artist's and
+// an ideator's moments, not only shipped tasks (task 1004439 / WA6.RP09, goal
+// 1000095, criterion wa6-roles-read-true-in-public).
+//
+// The done-when: "a ratified idea and an approved page each post one line to the
+// feed". Run for real, through the module's own posters with the webhook stubbed:
+//
+//   1. A RATIFIED IDEA. board.item.passed for a full_idea posts ONE line to
+//      #ship-feed naming its author; an amendment or a genesis stage posts nothing;
+//      the idea's title never leaves the hall.
+//   2. A FULL IDEA AT THE BAR. idea.graded.full posts at economy's own pass bar
+//      and not below it, naming the developer when someone else developed it.
+//   3. AN APPROVED PAGE. A page-tweak round's ship line says "page approved" and
+//      names its ARTIST (the shipped_by of task 1004432), never the applier; a
+//      security-flagged round still goes only to the security feed.
+//   4. THE WIRING. The module subscribes to both events, and nothing here pays.
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const ROOT = fileURLToPath(new URL('..', import.meta.url));
+const { test, summary } = makeRunner();
+const craft = require('../modules/discord/craft-broadcast.js');
+const ship = require('../modules/discord/ship-broadcast.js');
+const credits = require('../modules/economy/credits.js');
+
+const BUILDERS = { 7: { display_name: 'Builder 7' }, 9: { display_name: 'Builder 9' }, 4: { display_name: 'Builder 4' } };
+function harness({ channel = true } = {}) {
+  const posts = [];
+  return {
+    posts,
+    deps: {
+      getBuilder: async (id) => BUILDERS[id] || null,
+      hasChannel: () => channel,
+      post: async (ch, text) => { posts.push({ ch, text }); },
+      postWebhook: async (ch, text) => { posts.push({ ch, text }); },
+      reward: { IDEA_FULL_PASS_BAR: credits.IDEA_FULL_PASS_BAR },
+      log: () => {},
+    },
+  };
+}
+
+// ---- 1. a ratified idea ---------------------------------------------------------
+
+await test('a ratified idea posts ONE line to #ship-feed, naming its author and linking the idea', async () => {
+  const h = harness();
+  const r = await craft.postIdeaRatified({ item_id: 31, subject_type: 'full_idea', subject_id: 812, idea_id: 812, author_id: 9, completeness_score: 80, passed_at: 'now' }, h.deps);
+  assert.equal(r.posted, true);
+  assert.equal(h.posts.length, 1, 'one line');
+  assert.equal(h.posts[0].ch, 'ship_feed');
+  assert.match(h.posts[0].text, /The board ratified an idea by Builder 9\./);
+  assert.match(h.posts[0].text, /\/#\/idea\/812$/, 'the hall link carries the rest to whoever may see it');
+  assert.ok(!h.posts[0].text.startsWith('#'), 'never read by the applause bot as a ship');
+});
+
+await test('an amendment or a genesis stage is the project\'s decision, not an ideator\'s moment — nothing posts', async () => {
+  for (const subject_type of ['constitutional_amendment', 'genesis_stage']) {
+    const h = harness();
+    const r = await craft.postIdeaRatified({ item_id: 2, subject_type, subject_id: 3, idea_id: null, author_id: 4 }, h.deps);
+    assert.equal(r.skipped, 'not_an_idea');
+    assert.equal(h.posts.length, 0);
+  }
+});
+
+await test('the idea\'s title is never posted, and a name cannot carry formatting or a link', async () => {
+  const h = harness();
+  BUILDERS[66] = { display_name: '@everyone [click](evil.example) **x**' };
+  await craft.postIdeaRatified({ subject_type: 'full_idea', idea_id: 5, author_id: 66, title: 'Secret plan for the private goal' }, h.deps);
+  assert.ok(!h.posts[0].text.includes('Secret plan'), 'a payload title would not be read even if one were sent');
+  assert.ok(!/[\[\]()*@]/.test(h.posts[0].text.split(' by ')[1].split('.')[0]), 'the shared name sanitizer ran');
+  delete BUILDERS[66];
+});
+
+await test('an unconfigured feed is a named skip, and a failed post never throws', async () => {
+  const off = harness({ channel: false });
+  assert.equal((await craft.postIdeaRatified({ subject_type: 'full_idea', idea_id: 1, author_id: 9 }, off.deps)).skipped, 'channel_not_configured');
+  const broken = harness();
+  broken.deps.post = async () => { throw new Error('discord down'); };
+  const r = await craft.postIdeaRatified({ subject_type: 'full_idea', idea_id: 1, author_id: 9 }, broken.deps);
+  assert.equal(r.skipped, 'post_failed');
+});
+
+await test('an author who cannot be read leaves the line unnamed, never fails it', async () => {
+  const h = harness();
+  await craft.postIdeaRatified({ subject_type: 'full_idea', idea_id: 1, author_id: 12345 }, h.deps);
+  assert.match(h.posts[0].text, /^\u{1F3DB}\u{FE0F} The board ratified an idea\. /u);
+});
+
+// ---- 2. a Full Idea at the bar ----------------------------------------------------
+
+await test('a Full Idea posts at economy\'s own pass bar, and not below it', async () => {
+  const bar = credits.IDEA_FULL_PASS_BAR;
+  const at = harness();
+  await craft.postFullIdeaPassed({ id: 40, idea_id: 40, grade: 'full', completeness_score: bar, captured_by: 9 }, at.deps);
+  assert.equal(at.posts.length, 1);
+  assert.match(at.posts[0].text, /Builder 9's Full Idea passed its completeness check\./);
+  const below = harness();
+  const r = await craft.postFullIdeaPassed({ id: 41, grade: 'full', completeness_score: bar - 1, captured_by: 9 }, below.deps);
+  assert.equal(r.skipped, 'below_bar');
+  assert.equal(below.posts.length, 0);
+  const unscored = harness();
+  assert.equal((await craft.postFullIdeaPassed({ id: 42, completeness_score: null, captured_by: 9 }, unscored.deps)).skipped, 'below_bar');
+});
+
+await test('a developed spark names its developer, as the credit split does; no economy, no bar, no line', async () => {
+  const h = harness();
+  await craft.postFullIdeaPassed({ id: 43, completeness_score: 90, captured_by: 9, developed_by: 7 }, h.deps);
+  assert.match(h.posts[0].text, /Builder 7's Full Idea/);
+  const none = harness();
+  none.deps.reward = null;
+  const r = await craft.postFullIdeaPassed({ id: 43, completeness_score: 90, captured_by: 9 }, { ...none.deps, reward: {} });
+  assert.equal(r.skipped, 'below_bar');
+  assert.equal(none.posts.length, 0);
+});
+
+await test('the reward port carries the bar the feed reads', () => {
+  const reward = require('../modules/economy/reward.js');
+  assert.equal(reward.IDEA_FULL_PASS_BAR, credits.IDEA_FULL_PASS_BAR);
+});
+
+// ---- 3. an approved page ----------------------------------------------------------
+
+await test('an approved page posts one line saying so, naming its ARTIST, not the applier', async () => {
+  const h = harness();
+  // shipped_by is the round's artist since task 1004432; the applier (4) is nowhere in the row
+  const r = await ship.postShipBroadcast({ id: 501, value_summary: 'The landing page reads plainly now.', security_sensitive: false, source: 'page-tweak', shipped_by: 7 }, h.deps);
+  assert.deepEqual(r.posted, ['ship_feed']);
+  assert.equal(h.posts.length, 1, 'one line');
+  assert.equal(h.posts[0].text, '#501 page approved — rewritten by Builder 7: The landing page reads plainly now.');
+  assert.ok(!h.posts[0].text.includes('Builder 4'));
+});
+
+await test('an ordinary ship is unchanged, and a security-flagged page round goes only to the security feed', async () => {
+  const h = harness();
+  await ship.postShipBroadcast({ id: 502, value_summary: 'Faster claims.', security_sensitive: false, source: null, shipped_by: 4 }, h.deps);
+  assert.equal(h.posts[0].text, '#502 shipped — Faster claims.');
+  const sec = harness();
+  await ship.postShipBroadcast({ id: 503, value_summary: 'x', security_sensitive: true, source: 'page-tweak', shipped_by: 7 }, sec.deps);
+  assert.deepEqual(sec.posts.map((p) => p.ch), ['security_ship_feed']);
+  assert.ok(!sec.posts[0].text.includes('Builder 7'), 'the security line is untouched');
+  const unknown = harness();
+  await ship.postShipBroadcast({ id: 504, value_summary: 'y', security_sensitive: false, source: 'page-tweak', shipped_by: 9999 }, unknown.deps);
+  assert.equal(unknown.posts[0].text, '#504 page approved: y', 'an unreadable artist names nobody rather than the applier');
+});
+
+// ---- 4. the wiring ------------------------------------------------------------------
+
+await test('the module subscribes to both events, and nothing on these paths pays', () => {
+  const routes = fs.readFileSync(path.join(ROOT, 'modules/discord/routes/discord.js'), 'utf8');
+  assert.match(routes, /api\.on\('board\.item\.passed', \(payload\) => craftBroadcast\.postIdeaRatified\(payload\)\)/);
+  assert.match(routes, /api\.on\('idea\.graded\.full', \(graded\) => craftBroadcast\.postFullIdeaPassed\(graded\)\)/);
+  const src = fs.readFileSync(path.join(ROOT, 'modules/discord/craft-broadcast.js'), 'utf8');
+  assert.ok(!/award|credit_log|INSERT/i.test(src.replace(/\/\/.*$/gm, '')), 'a mirror: it reads names and posts, it never books');
+});
+
+summary();

package/tests/genesis_home.mjs

@@ -340,7 +340,7 @@ test('a demo\'s genesis card: no decide form, the settled plan in one line, each
   await new Promise((r) => setImmediate(r));
   assert.equal(host.hidden, false);
   assert.match(host.innerHTML, /Monarchy \/ BDFL, 3 people, 4 hours each/);
-  assert.match(host.innerHTML, /about 49 minutes/);
+  assert.match(host.innerHTML, /about 49 min\. /, 'one unit for a demo stage: "min", as the stage rows say (task 1004504)');
   assert.match(host.innerHTML, /14 min, due /, 'the stage in progress is due at a time, not a date');
   assert.match(host.innerHTML, /Stage 1 of 5 · scope · demo/);
   assert.doesNotMatch(host.innerHTML, /data-genesis-plan/, 'a demo never shows the decide form');

package/tests/government_routes.mjs

@@ -93,7 +93,9 @@ test('every /governance route gates via REAL middleware on exactly its PINNED at
   // everything outside the Board Room family — the /board/ routes and the
   // /constitution read (R18: reading the rule you vote under is part of
   // casting) — still gates on government.manage.
-  const boardFamily = (key) => key.includes('/board/') || key.endsWith('/government/constitution');
+  // task 1004523: the docket reads the board family's atom too — opening the city
+  // is part of casting, and each source inside is scoped to its own atom.
+  const boardFamily = (key) => key.includes('/board/') || key.endsWith('/government/constitution') || key.endsWith('/government/docket');
   for (const r of classified.filter((x) => !boardFamily(x.key))) {
     assert.deepEqual(r.perms, ['government.manage'], `${r.key}: the admin surface gates on the manage atom`);
   }