@bongos/core 1.21.70 → 1.21.71

package/tests/cli_allowlist_permissions.mjs

@@ -308,8 +308,12 @@ perTool('the read-only subset is pre-allowed', (tool) => {
   }
 });
 
-test('the instance starter mirrors this list in verb form (claude-materialize.js STARTER_ALLOW)', () => {
-  assert.deepEqual([...STARTER_ALLOW].sort(), allowList().map((rule) => bongosify(rule)).sort());
+// Compared as SETS: the core carries both `node scripts/gds/paste-token.js:*` (what its skills
+// run) and `npx bongos paste-token:*` (what Settings → CLI access hands out, task 1004575), and
+// in a project both are the one `npx bongos paste-token:*` rule (task 1004621).
+test('the instance starter mirrors this list in its `npx bongos` form (claude-materialize.js STARTER_ALLOW)', () => {
+  assert.equal(new Set(STARTER_ALLOW).size, STARTER_ALLOW.length, 'the starter carries no duplicate rule');
+  assert.deepEqual([...STARTER_ALLOW].sort(), [...new Set(allowList().map((rule) => bongosify(rule)))].sort());
 });
 
 console.log('');

package/tests/cli_surface.mjs

@@ -49,9 +49,9 @@ test('the surface is never inferred from isTTY', () => {
 
 test('actions name a command the reader can actually run', () => {
   assert.equal(surface.action('ship', 123, AGENT_ENV), '/builder-ship 123');
-  assert.equal(surface.action('ship', 123, TERM_ENV), 'bongos ship 123');
+  assert.equal(surface.action('ship', 123, TERM_ENV), 'npx bongos ship 123'); // not on PATH in a project (task 1004621)
   assert.equal(surface.action('start', null, AGENT_ENV), '/builder-start');
-  assert.equal(surface.action('start', null, TERM_ENV), 'bongos start');
+  assert.equal(surface.action('start', null, TERM_ENV), 'npx bongos start');
 });
 
 test('task refs stay hall links for agents and go plain for terminals', () => {

package/tests/fixtures/page-ledger.mjs

@@ -231,6 +231,11 @@ export function installPageLedger(api, { builders }) {
       for (const x of hit) Object.assign(x, { status: 'resolved', resolved_task_id: String(p[1]), resolved_by: String(p[2]), resolution_note: p[4] });
       return { rows: hit.map((x) => ({ id: x.id })) };
     }
+    // createTask's spec-task lookup (task 1004585, goal-spec-task.js): a page's tweak
+    // goal is never made in the hall form, so it has no spec task and gates nothing.
+    if (/^SELECT id FROM tasks WHERE goal_id = \$1 AND source = \$2 AND source_ref = \$3/.test(q)) {
+      return { rows: db.tasks.filter((t) => t.goal_id === p[0] && t.source === p[1] && t.source_ref === p[2] && !['shipped', 'abandoned'].includes(t.status)).map((t) => ({ id: t.id })) };
+    }
     throw new Error(`unexpected SQL: ${q.slice(0, 160)}`);
   }
 

package/tests/goal_admission_override.mjs

@@ -156,7 +156,7 @@ test('reading a goal shows whether it was admitted', () => {
 });
 
 test('the create response says whether the override took effect', () => {
-  assert.match(postGoals(), /admitted \}\);/);
+  assert.match(postGoals(), /admitted(, spec_task: specTask)? \}\);/);
 });
 
 // ---- ADR 0250 §3: the exception is counted, or it is not an exception --------

package/tests/goal_category.mjs

@@ -169,7 +169,7 @@ test('the advisory is advice on a 201, never a refusal', () => {
   // and never fails the create over it (best-effort, wrapped in try).
   const routes = read('modules', 'lifecycle', 'routes', 'goals.js');
   assert.match(routes, /category_advisory = goalCategory\.adviseCategory/);
-  assert.match(routes, /res\.status\(201\)\.json\(\{ ok: true, goal, succeeds_goal_id: succeedsId, category_advisory, admitted \}\)/,
+  assert.match(routes, /res\.status\(201\)\.json\(\{ ok: true, goal, succeeds_goal_id: succeedsId, category_advisory, admitted(, spec_task: specTask)? \}\)/,
     'it rides the 201 — advice appended to a request that already succeeded');
 });
 

package/tests/goal_create_spec_entry.mjs

@@ -0,0 +1,61 @@
+// tests/goal_create_spec_entry.mjs — /goal-create's "finish a hall-made goal's spec
+// task" entry (task 1004586, ADR 0366 D3) names real routes, fields and identifiers.
+// A skill is prose an agent follows literally; when the code it cites moves, the agent
+// follows a path that no longer exists. So every load-bearing claim in the new section
+// is held against the code it describes, not against a copy of it.
+//
+// Run:  node --test tests/goal_create_spec_entry.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require_ = createRequire(import.meta.url);
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const skill = read('.claude/skills/goal-create/SKILL.md');
+const section = skill.slice(skill.indexOf("## Finishing a hall-made goal's spec task"), skill.indexOf('## The sibling advisory'));
+const spec = require_(path.join(ROOT, 'modules/lifecycle/goal-spec-task.js'));
+const goalsRoutes = read('modules/lifecycle/routes/goals.js');
+
+test('the section exists and the description carries its trigger', () => {
+  assert.ok(section.length > 500, 'the spec-task section is present');
+  assert.match(skill.split('\n---')[0], /"spec goal N"/, 'the trigger phrase is in the description');
+});
+
+test('the spec task it tells you to find is the one the server files', () => {
+  assert.match(section, /`source: goal-spec`/);
+  assert.equal(spec.SPEC_SOURCE, 'goal-spec');
+  assert.match(section, /`source_ref: goal-<N>-spec`/);
+  assert.equal(spec.specSourceRef(7), 'goal-7-spec');
+  assert.match(spec.specTaskFields({ id: 7, version_id: 'V', title: 't' }).title, /^Spec goal 7: its scope, criteria and first tasks$/);
+  assert.match(section, /"Spec goal N: its scope, criteria and first tasks"/);
+});
+
+test('the scope write it names is the real route and body', () => {
+  assert.match(section, /POST \/api\/bongos\/goals\/<N>\/scope --body '\{"add":\["<key>"\]\}'/);
+  assert.match(goalsRoutes, /router\.post\('\/goals\/:id\/scope'/);
+  const scopeRoute = goalsRoutes.slice(goalsRoutes.indexOf("router.post('/goals/:id/scope'"));
+  assert.match(scopeRoute.slice(0, 3000), /add:/, 'the route reads an `add` list');
+});
+
+test('"do not promote them" is true: new tasks in the goal wait on the open spec task', () => {
+  assert.match(section, /do not promote them/);
+  assert.match(read('modules/lifecycle/db-tasks.js'), /await gateOnSpecTask\(rows\[0\], deps\.client \|\| pool\)/);
+});
+
+test('the strict-fields note lists spec_task and the validator accepts it', () => {
+  assert.match(skill, /plus admit_reason[\s\S]{0,40}and spec_task, which ONLY the hall form sends/);
+  assert.match(goalsRoutes, /spec_task: \{ type: 'boolean' \}/);
+  assert.match(goalsRoutes, /admit_reason: \{ type: 'string'/);
+});
+
+test('skill-lint passes on the edited skill (the same lint fitness runs in CI)', async () => {
+  const { spawnSync } = await import('node:child_process');
+  const r = spawnSync(process.execPath, [path.join(ROOT, 'scripts/gds/skill-lint.js')], { cwd: ROOT, encoding: 'utf8' });
+  assert.equal(r.status, 0, `skill-lint failed:\n${r.stdout}\n${r.stderr}`);
+  assert.match(r.stdout, /0 error\(s\)/);
+});

package/tests/goal_spec_task.mjs

@@ -0,0 +1,197 @@
+// tests/goal_spec_task.mjs — a goal made in the hall carries its own spec task, and
+// its other work waits behind it (task 1004585, ADR 0366 D3). DB-free: the gate
+// against a SQL-aware fake client, createTask's hook through its own client seam, and
+// POST /goals through the assembled router. The real-Postgres half (the claim gate's
+// read and the ship-time auto-promotion) is tests/goal_spec_task_db.mjs.
+//
+// Run:  node --test tests/goal_spec_task.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+process.env.NODE_ENV = 'test';
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require_ = createRequire(import.meta.url);
+const spec = require_(path.join(ROOT, 'modules/lifecycle/goal-spec-task.js'));
+
+// A fake client that knows one goal's spec task and records every edge written.
+function fakeClient({ specId = null, specStatus = 'ready' } = {}) {
+  const edges = [];
+  return {
+    edges,
+    async query(sql, params) {
+      const s = String(sql).replace(/\s+/g, ' ');
+      if (/SELECT id FROM tasks WHERE goal_id = \$1 AND source = \$2 AND source_ref = \$3/.test(s)) {
+        assert.match(s, /status NOT IN \('shipped', 'abandoned'\)/, 'only an OPEN spec task gates');
+        const open = specId != null && !['shipped', 'abandoned'].includes(specStatus);
+        return { rows: open && params[1] === spec.SPEC_SOURCE && params[2] === spec.specSourceRef(params[0]) ? [{ id: String(specId) }] : [] };
+      }
+      if (/INSERT INTO dependencies/.test(s)) {
+        assert.match(s, /VALUES \('task', \$1, 'task', \$2\)/, 'a plain task→task edge, the shape unsatisfiedDeps reads');
+        edges.push([Number(params[0]), Number(params[1])]);
+        return { rows: [] };
+      }
+      return { rows: [] };
+    },
+  };
+}
+
+test('the spec task is a ready spike in the goal, keyed for idempotency', () => {
+  const f = spec.specTaskFields({ id: 42, version_id: 'V9', title: 'Hall goal' }, { createdBy: 7 });
+  assert.equal(f.status, 'ready');
+  assert.equal(f.kind, 'spike');
+  assert.equal(f.goalId, 42);
+  assert.equal(f.versionId, 'V9');
+  assert.equal(f.source, 'goal-spec');
+  assert.equal(f.sourceRef, 'goal-42-spec');
+  assert.equal(f.createdBy, 7);
+  assert.match(f.title, /^Spec goal 42: /);
+  assert.match(f.description, /POST \/goals\/42\/scope/);
+  assert.match(f.description, /POST \/versions\/V9\/done-when/);
+});
+
+test('a task entering a goal with an open spec task waits on it', async () => {
+  const c = fakeClient({ specId: 500 });
+  assert.equal(await spec.gateOnSpecTask({ id: 501, goal_id: 42 }, c), 500);
+  assert.deepEqual(c.edges, [[501, 500]]);
+});
+
+test('the spec task never waits on itself', async () => {
+  const c = fakeClient({ specId: 500 });
+  assert.equal(await spec.gateOnSpecTask({ id: 500, goal_id: 42, source: 'goal-spec', source_ref: 'goal-42-spec' }, c), null);
+  assert.deepEqual(c.edges, []);
+});
+
+test('no edge when the goal has no spec task, or it shipped, or it was abandoned, or the task has no goal', async () => {
+  for (const c of [fakeClient(), fakeClient({ specId: 500, specStatus: 'shipped' }), fakeClient({ specId: 500, specStatus: 'abandoned' })]) {
+    assert.equal(await spec.gateOnSpecTask({ id: 501, goal_id: 42 }, c), null);
+    assert.deepEqual(c.edges, []);
+  }
+  const c = fakeClient({ specId: 500 });
+  assert.equal(await spec.gateOnSpecTask({ id: 501, goal_id: null }, c), null);
+});
+
+test('a MOVED task goes through the cycle-checked path, and a cycle leaves the move without the edge', async () => {
+  const calls = [];
+  const ok = await spec.gateOnSpecTask({ id: 501, goal_id: 42 }, fakeClient({ specId: 500 }), {
+    addTaskDependency: async (a, b) => { calls.push([a, b]); },
+  });
+  assert.equal(ok, 500);
+  assert.deepEqual(calls, [[501, 500]]);
+  const cyc = await spec.gateOnSpecTask({ id: 501, goal_id: 42 }, fakeClient({ specId: 500 }), {
+    addTaskDependency: async () => { throw { code: 'CYCLE', path: [500, 501] }; },
+  });
+  assert.equal(cyc, null);
+  await assert.rejects(spec.gateOnSpecTask({ id: 501, goal_id: 42 }, fakeClient({ specId: 500 }), {
+    addTaskDependency: async () => { throw { code: 'TASK_NOT_FOUND' }; },
+  }), (e) => e.code === 'TASK_NOT_FOUND', 'any other failure is not swallowed');
+});
+
+test('createTask itself adds the edge — every create vector inherits it', async () => {
+  const db = require_(path.join(ROOT, 'modules/lifecycle/db-tasks.js'));
+  const c = fakeClient({ specId: 500 });
+  const inner = c.query.bind(c);
+  c.query = async (sql, params) => {
+    if (/INSERT INTO tasks/.test(sql)) return { rows: [{ id: '777', goal_id: params[22], source: params[11], source_ref: params[12] }] };
+    return inner(sql, params);
+  };
+  const row = await db.createTask({ versionId: 'V9', goalId: 42, title: 'Build the page', kind: 'feature', discipline: 'engineer', creditsReward: 5 }, { client: c });
+  assert.equal(row.id, '777');
+  assert.deepEqual(c.edges, [[777, 500]]);
+});
+
+// ── POST /goals through the assembled router ─────────────────────────────────
+
+async function withGoalsServer(fn) {
+  const r2 = createRequire(import.meta.url);
+  const authPath = r2.resolve(path.join(ROOT, 'src/bongos/auth.js'));
+  const routePath = r2.resolve(path.join(ROOT, 'modules/lifecycle/routes/goals.js'));
+  const auth = r2(authPath);
+  const api = r2(path.join(ROOT, 'src/module-api.js'));
+  const db = r2(path.join(ROOT, 'modules/lifecycle/db.js'));
+  const saved = { rb: auth.requireBuilder, rp: auth.requirePermission, tx: api.withTx, gv: db.getVersion, cg: db.createGoal, ct: db.createTask };
+  const calls = { createGoal: [], createTask: [], tx: 0 };
+  auth.requireBuilder = (req, _res, next) => { req.builder = { id: 7, rank: 'metic' }; next(); };
+  auth.requirePermission = () => (_req, _res, next) => next();
+  const txClient = { query: async () => ({ rows: [] }) };
+  api.withTx = async (f) => { calls.tx += 1; return f(txClient); };
+  db.getVersion = async (id) => ({ id, status: 'planning' });
+  db.createGoal = async (fields, deps = {}) => { calls.createGoal.push({ fields, client: deps.client || null }); return { id: 42, version_id: fields.versionId, title: fields.title }; };
+  db.createTask = async (fields, deps = {}) => { calls.createTask.push({ fields, client: deps.client || null }); return { id: 500, ...fields }; };
+  delete r2.cache[routePath];
+  const express = r2('express');
+  const { attachFail } = r2(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+  const app = express();
+  app.use(express.json());
+  app.use(attachFail);
+  app.use(r2(routePath)());
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  const post = (body) => fetch(`http://127.0.0.1:${server.address().port}/goals`, {
+    method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+  });
+  try { await fn(post, calls, txClient); } finally {
+    server.close();
+    auth.requireBuilder = saved.rb; auth.requirePermission = saved.rp; api.withTx = saved.tx;
+    db.getVersion = saved.gv; db.createGoal = saved.cg; db.createTask = saved.ct;
+    delete r2.cache[routePath];
+  }
+}
+
+test('POST /goals with spec_task creates the goal and its spec task in ONE transaction', async () => {
+  await withGoalsServer(async (post, calls, txClient) => {
+    const res = await post({ version_id: 'V9', title: 'Hall goal', category_id: undefined, spec_task: true });
+    assert.equal(res.status, 201, await res.clone().text());
+    const body = await res.json();
+    assert.equal(calls.tx, 1);
+    assert.equal(calls.createGoal[0].client, txClient, 'the goal is written inside the transaction');
+    assert.equal(calls.createTask.length, 1);
+    assert.equal(calls.createTask[0].client, txClient, 'and so is its spec task');
+    assert.equal(calls.createTask[0].fields.sourceRef, 'goal-42-spec');
+    assert.equal(body.spec_task.id, 500);
+  });
+});
+
+test('POST /goals without spec_task behaves exactly as before', async () => {
+  await withGoalsServer(async (post, calls) => {
+    const res = await post({ version_id: 'V9', title: 'CLI goal' });
+    assert.equal(res.status, 201);
+    assert.equal(calls.tx, 0);
+    assert.equal(calls.createGoal[0].client, null);
+    assert.equal(calls.createTask.length, 0);
+    assert.equal((await res.json()).spec_task, null);
+  });
+});
+
+test('spec_task must be a boolean', async () => {
+  await withGoalsServer(async (post, calls) => {
+    const res = await post({ version_id: 'V9', title: 'Hall goal', spec_task: 'yes' });
+    assert.equal(res.status, 400);
+    assert.equal(calls.createGoal.length, 0);
+  });
+});
+
+test('ensureSpecTask is safe to run twice: the second run returns the first spec task and writes nothing', async () => {
+  // A stateful fake: the spec task the first run creates is what the second run's read finds.
+  const created = [];
+  const client = {
+    async query(sql, params) {
+      if (/SELECT id FROM tasks WHERE goal_id = \$1 AND source = \$2 AND source_ref = \$3/.test(String(sql).replace(/\s+/g, ' '))) {
+        const hit = created.find((t) => t.goalId === params[0] && t.source === params[1] && t.sourceRef === params[2]);
+        return { rows: hit ? [{ id: String(hit.id) }] : [] };
+      }
+      return { rows: [] };
+    },
+  };
+  const db = { createTask: async (fields) => { const t = { id: 600 + created.length, ...fields }; created.push(t); return t; } };
+  const goal = { id: 42, version_id: 'V9', title: 'Hall goal' };
+  const first = await spec.ensureSpecTask({ db, goal, client, createdBy: 7 });
+  const second = await spec.ensureSpecTask({ db, goal, client, createdBy: 7 });
+  assert.equal(first.created, true);
+  assert.equal(second.created, false);
+  assert.equal(second.specTask.id, first.specTask.id);
+  assert.equal(created.length, 1, 'exactly one spec task for the goal');
+});

package/tests/goal_spec_task_db.mjs

@@ -0,0 +1,95 @@
+// tests/goal_spec_task_db.mjs — a goal made in the hall carries its own spec task,
+// and its other work waits behind it (task 1004585, ADR 0366 D3). REAL DB: the
+// claim gate and the auto-promotion are the database's, so this proves the edge
+// gateOnSpecTask writes is one they actually honour.
+//
+// Real-DB integration test (self-skips without a reachable Postgres; in the
+// INTEGRATION set so the default DB-free lane never runs it).
+//
+// Run:  DATABASE_URL=... node tests/goal_spec_task_db.mjs
+
+import { createRequire } from 'node:module';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`goal_spec_task_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const seams = require('../src/module-seams.js');
+if (!seams.hasProvider('reward')) seams.registerProvider('reward', require('../modules/economy/reward.js'));
+const db = require('../modules/lifecycle/db.js');
+const spec = require('../modules/lifecycle/goal-spec-task.js');
+
+const VER = 'ZZZ-SPEC', WORKER = 90000401;
+const q = (sql, params) => pool.query(sql, params).then((r) => r.rows);
+
+async function cleanup() {
+  const ids = (await q(`SELECT id FROM tasks WHERE version_id=$1`, [VER]).catch(() => [])).map((r) => r.id);
+  await q(`DELETE FROM claims WHERE task_id = ANY($1::bigint[])`, [ids]).catch(() => {});
+  await q(`DELETE FROM credit_log WHERE builder_id=$1 OR task_id = ANY($2::bigint[])`, [WORKER, ids]).catch(() => {});
+  await q(`DELETE FROM builder_achievements WHERE builder_id=$1`, [WORKER]).catch(() => {});
+  await q(`DELETE FROM dependencies WHERE (from_kind='task' AND from_id = ANY($1::bigint[])) OR (to_kind='task' AND to_id = ANY($1::bigint[]))`, [ids]).catch(() => {});
+  await q(`DELETE FROM tasks WHERE version_id=$1`, [VER]).catch(() => {});
+  await q(`DELETE FROM goal_members WHERE goal_id IN (SELECT id FROM goals WHERE version_id=$1)`, [VER]).catch(() => {});
+  await q(`DELETE FROM goals WHERE version_id=$1`, [VER]).catch(() => {});
+  await q(`DELETE FROM builders WHERE id=$1`, [WORKER]).catch(() => {});
+  await q(`DELETE FROM versions WHERE id=$1`, [VER]).catch(() => {});
+}
+
+let pass = 0;
+const ok = (cond, msg) => { assert.ok(cond, msg); console.log(`  ok  ${msg}`); pass++; };
+const statusOf = async (id) => (await q(`SELECT status FROM tasks WHERE id=$1`, [id]))[0].status;
+const edges = async (id) => (await q(`SELECT to_id FROM dependencies WHERE from_kind='task' AND from_id=$1 AND to_kind='task'`, [id])).map((r) => Number(r.to_id));
+
+try {
+  await cleanup();
+  await q(`INSERT INTO versions (id,name,status,track) VALUES ($1,'spec','building','internal') ON CONFLICT (id) DO NOTHING`, [VER]);
+  await q(`INSERT INTO builders (id,github_id,github_login,display_name,rank) VALUES ($1,'spec-w','spec-worker','Spec Worker','archon')`, [WORKER]);
+
+  // A hall-made goal and its spec task (what POST /goals { spec_task: true } writes).
+  const goal = await db.createGoal({ versionId: VER, title: 'Hall goal', createdBy: WORKER });
+  const specTask = await db.createTask(spec.specTaskFields(goal, { createdBy: WORKER }));
+  ok(specTask.status === 'ready' && specTask.kind === 'spike', 'the spec task is born ready, a spike');
+  ok((await edges(specTask.id)).length === 0, 'the spec task does not wait on itself');
+
+  // 1) A task filed into the goal waits on the spec task, and the claim gate says so.
+  const work = await db.createTask({ versionId: VER, goalId: goal.id, title: 'Build the first page', kind: 'feature', discipline: 'engineer', creditsReward: 10 });
+  ok((await edges(work.id)).includes(Number(specTask.id)), 'a filed task carries an edge to the spec task');
+  // unsatisfiedDeps is the read the claim gate refuses on (db-claims.js: a non-empty
+  // answer throws DEPS_NOT_SHIPPED). The full claim path is not driven here — its own
+  // DB test (claim_gate_open_blocker) is parked in this lane for unrelated setup.
+  const gating = await db.unsatisfiedDeps(work.id);
+  ok(gating.some((d) => d.kind === 'task' && Number(d.id) === Number(specTask.id)), 'the claim gate read names the spec task as unshipped');
+
+  // 2) Shipping the spec task releases it: the auto-promotion trigger moves it to ready.
+  await q(`UPDATE tasks SET status='shipped' WHERE id=$1`, [specTask.id]);
+  ok((await db.unsatisfiedDeps(work.id)).length === 0, 'nothing gates the task once the spec ships');
+  ok((await statusOf(work.id)) === 'ready', `the waiting task auto-promotes to ready (got ${await statusOf(work.id)})`);
+
+  // 3) A task filed after the spec shipped waits on nothing.
+  const later = await db.createTask({ versionId: VER, goalId: goal.id, title: 'Build the second page', kind: 'feature', discipline: 'engineer' });
+  ok((await edges(later.id)).length === 0, 'a shipped spec gates nothing new');
+
+  // 4) A goal made WITHOUT a spec task behaves exactly as before.
+  const plain = await db.createGoal({ versionId: VER, title: 'CLI goal', createdBy: WORKER });
+  const plainTask = await db.createTask({ versionId: VER, goalId: plain.id, title: 'Build the third page', kind: 'feature', discipline: 'engineer' });
+  ok((await edges(plainTask.id)).length === 0, 'a goal with no spec task adds no edge');
+
+  // 5) A task MOVED into a goal with an open spec task waits on it too.
+  const goal2 = await db.createGoal({ versionId: VER, title: 'Second hall goal', createdBy: WORKER });
+  const spec2 = await db.createTask(spec.specTaskFields(goal2, { createdBy: WORKER }));
+  await db.updateTaskGoal(plainTask.id, goal2.id);
+  ok((await edges(plainTask.id)).includes(Number(spec2.id)), 'a moved-in task carries an edge to the open spec task');
+
+  console.log(`\n${pass} passed, 0 failed`);
+} finally {
+  await cleanup();
+  await pool.end();
+}

package/tests/provision_settings_apply.mjs

@@ -78,6 +78,7 @@ ${NEUTRAL_PREFIX}_LOGO_URL=
 ${NEUTRAL_PREFIX}_FOUNDING_BIRTH=
 ${NEUTRAL_PREFIX}_DEMO_PEOPLE=
 ${NEUTRAL_PREFIX}_DEMO_HOURS=
+${NEUTRAL_PREFIX}_HUB_UPGRADE_URL=
 `;
 
 t('replaces an existing KEY= line where it stands; every other line survives byte-for-byte', () => {
@@ -147,6 +148,8 @@ t('settingsEnvVarsFor: the runner pushes the SAME pair webEnvBody writes at stan
     [`${NEUTRAL_PREFIX}_LOOK_ACCENT`]: '', [`${NEUTRAL_PREFIX}_LOGO_URL`]: '',
     // the birth marker and a demo's box (task 1004506), empty on an un-stamped row
     [`${NEUTRAL_PREFIX}_FOUNDING_BIRTH`]: '', [`${NEUTRAL_PREFIX}_DEMO_PEOPLE`]: '', [`${NEUTRAL_PREFIX}_DEMO_HOURS`]: '',
+    // where the hall's Update button goes (task 1004608), empty when no hub origin resolves
+    [`${NEUTRAL_PREFIX}_HUB_UPGRADE_URL`]: '',
   });
   const body = P.webEnvBody(inst, {});
   for (const [k, v] of Object.entries(vars)) assert.match(body, new RegExp(`^${k}=${v}$`, 'm'), `${k} at standup`);
@@ -247,7 +250,7 @@ await ta('dry-run PLANS the patch: reads nothing real, writes NOTHING (no synthe
   assert.equal(r.ok, true);
   assert.equal(r.healthy, null, 'nothing ran, nothing observed');
   assert.equal(writes.length, 0, 'a dry-run must not plan a two-line overwrite of web.env');
-  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY, .*_VISIBILITY, .*_JOIN_GRANT, .*_ARTIST_GATE, .*_SPEND_PAYER, .*_LOOK, .*_NIGHT_TINT, .*_ARTIST_GATE_SINCE, .*_LOOK_ACCENT, .*_LOGO_URL, .*_FOUNDING_BIRTH, .*_DEMO_PEOPLE, .*_DEMO_HOURS in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
+  assert.ok(logs.some((l) => /would patch .*_PLATFORM_VISIBILITY, .*_JOINABILITY, .*_VISIBILITY, .*_JOIN_GRANT, .*_ARTIST_GATE, .*_SPEND_PAYER, .*_LOOK, .*_NIGHT_TINT, .*_ARTIST_GATE_SINCE, .*_LOOK_ACCENT, .*_LOGO_URL, .*_FOUNDING_BIRTH, .*_DEMO_PEOPLE, .*_DEMO_HOURS, .*_HUB_UPGRADE_URL in \/etc\/spike\/web\.env in place/.test(l)), logs.join('\n'));
   assert.ok(cmds.some((c) => /restart spike/.test(c)), 'the restart is still in the plan');
   assert.ok(logs.some((l) => /dry-run — nothing ran/.test(l)), 'the closing line does not claim a restart happened');
 });
@@ -630,5 +633,26 @@ await ta('a failed write reports the error without the value', async () => {
   assert.ok(!r.error.includes(SECRET), r.error);
 });
 
+console.log('\nhubUpgradeEnvVarsFor — where a hosted project\'s Update button goes (task 1004608):');
+
+t('both tenant shapes get the hub door for THEIR slug; no other shape gets the key; it rides standup AND the push', () => {
+  const saved = process.env.PROVISION_HUB_ORIGIN;
+  process.env.PROVISION_HUB_ORIGIN = 'https://hub.example.com/';
+  try {
+    const key = `${NEUTRAL_PREFIX}_HUB_UPGRADE_URL`;
+    for (const shape of ['cloud-host', 'co-tenant']) {
+      const inst = { slug: 'mercury', port: 3009, hosting_shape: shape, target_ref: 'will/mercury' };
+      assert.deepEqual(require('../scripts/gds/provision-units.js').hubUpgradeEnvVarsFor(inst), { [key]: 'https://hub.example.com/deploy?project=mercury' }, shape);
+      assert.equal(P.settingsEnvVarsFor(inst)[key], 'https://hub.example.com/deploy?project=mercury', `${shape} push`);
+      assert.match(P.webEnvBody(inst, {}), new RegExp(`^${key}=https://hub\\.example\\.com/deploy\\?project=mercury$`, 'm'), `${shape} standup`);
+    }
+    for (const shape of ['byo-host', 'control-plane']) {
+      assert.deepEqual(require('../scripts/gds/provision-units.js').hubUpgradeEnvVarsFor({ slug: 'x', hosting_shape: shape }), {}, shape);
+    }
+  } finally {
+    if (saved === undefined) delete process.env.PROVISION_HUB_ORIGIN; else process.env.PROVISION_HUB_ORIGIN = saved;
+  }
+});
+
 console.log(`\nprovision_settings_apply: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/software_update.mjs

@@ -180,7 +180,8 @@ async function drive(deps) {
   const build = require('../src/bongos/routes/core-update.js');
   const express = require('express');
   const app = express();
-  app.use(build(deps));
+  // The ask state's stored row is the DB's; these tests never reach one (task 1004595).
+  app.use(build({ askDeps: () => ({ hub: 'https://cloudbongos.com', getSetting: async () => null }), ...deps }));
   auth.requireBuilder = saved;
   const server = app.listen(0);
   await new Promise((r) => server.once('listening', r));
@@ -205,6 +206,22 @@ test('a hosted project: the Update button goes to the hub\'s door for THIS proje
   assert.deepEqual(r.body.door, { kind: 'hub', url: 'https://cloudbongos.com/deploy?project=hoodify-finance' });
 });
 
+// Task 1004608: Will's mercury (a cloud-host that keeps its own GitHub app) has no sign-in
+// federation, so the panel told its owner to run `bongos upgrade` on the platform's server.
+test('a hosted project that does not federate sign-in still gets the hub\'s door, from HUB_UPGRADE_URL', async () => {
+  const r = await drive({ softwareUpdate: async () => STUB_UPDATE, canUpdate: async () => true,
+    doorInputs: () => ({ provisioning: false, idp: null, hubUpgradeUrl: 'https://cloudbongos.com/deploy?project=mercury' }) });
+  assert.deepEqual(r.body.door, { kind: 'hub', url: 'https://cloudbongos.com/deploy?project=mercury' });
+});
+
+test('HUB_UPGRADE_URL is taken only as a hub /deploy address; anything else stays the cli answer', async () => {
+  for (const bad of ['', 'javascript:alert(1)', 'https://evil.example/phish', 'https://cloudbongos.com/deploy?project=a b', '/deploy']) {
+    const r = await drive({ softwareUpdate: async () => STUB_UPDATE, canUpdate: async () => true,
+      doorInputs: () => ({ provisioning: false, idp: null, hubUpgradeUrl: bad }) });
+    assert.deepEqual(r.body.door, { kind: 'cli', url: null }, bad);
+  }
+});
+
 test('a self-hosted instance has no door to link, and says how it is upgraded instead', async () => {
   const r = await drive({ softwareUpdate: async () => STUB_UPDATE, canUpdate: async () => true, doorInputs: () => ({ provisioning: false, idp: null }) });
   assert.deepEqual(r.body.door, { kind: 'cli', url: null });

package/tests/start_env_guard.mjs

@@ -94,8 +94,8 @@ t('offers the wrong-instance escape hatch (bongos login)', () => {
 t('a hosted origin never routes to bongos dev', () => {
   for (const deps of [true, false]) {
     const card = instanceNotRunningCard({ origin: 'https://example-instance.cloudbongos.com', depsMissing: deps });
-    assert.ok(!/^\s*\d+\.\s*`bongos dev`/m.test(card), 'must not list `bongos dev` as a step');
-    assert.ok(/Don't run `bongos dev`/.test(card), 'must say plainly not to, and why');
+    assert.ok(!/^\s*\d+\.\s*`(npx )?bongos dev`/m.test(card), 'must not list `bongos dev` as a step');
+    assert.ok(/Don't run `npx bongos dev`/.test(card), 'must say plainly not to, and why');
     assert.ok(/empty database/.test(card), 'must name the consequence, not just forbid it');
   }
 });

package/tests/upgrade_operator.mjs

@@ -0,0 +1,105 @@
+// tests/upgrade_operator.mjs — on a project its operator runs, `bongos upgrade` from a
+// builder's own computer says who upgrades it and how to ask, with no server steps
+// (task 1004596).
+//
+// WHAT IS AT RISK. A builder on a hosted project ran `bongos upgrade` from their laptop and
+// got "cannot determine which database to migrate. Set PGDATABASE…". Their assistant then
+// wrote them server instructions full of guessed names for a machine they cannot reach.
+// This pins (1) the wording that replaces that dead end and (2) the condition that shows
+// it — including that it never fires where a database is known, which is the operator's
+// own run on the server.
+//
+// Run:  node --test tests/upgrade_operator.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const op = require('../scripts/gds/upgrade-operator.js');
+const upgrade = require('../scripts/gds/upgrade.js');
+
+const HUB = { kind: 'hub', url: 'https://hub.example.com/deploy?project=mercury', hall: 'https://mercury.example.com/builders' };
+
+test('the message says who upgrades it and how to ask — and nothing to run on a server', () => {
+  const msg = op.operatorRunMessage(HUB);
+  assert.match(msg, /^This project is upgraded by its operator, not from this computer\./);
+  assert.match(msg, /https:\/\/mercury\.example\.com\/builders\/settings#software-update/);
+  assert.match(msg, /bongos feedback "Please upgrade this project to the latest version"/);
+  assert.match(msg, /There are no server steps for you to take\./);
+  // None of what sent the last assistant down the wrong road.
+  for (const bad of [/PGDATABASE/, /ssh/i, /sudo/, /--health-url/, /--service/, /systemctl/, /<[a-z_-]+>/i, /log in to the server/i]) {
+    assert.doesNotMatch(msg, bad, `the operator message must not mention ${bad}`);
+  }
+  // Without a known hall it still names the place, in words.
+  assert.match(op.operatorRunMessage({ kind: 'hub' }), /Open Settings → Software update and use the button there\./);
+});
+
+test('a database known here (the server) → no message, and the project is never even asked', async () => {
+  let asked = false;
+  const door = await op.operatorRunsThisProject({ instanceDir: '/srv/x' }, {
+    resolveInstanceDb: () => ({ db: 'mercury', ran: true }),
+    readUpdateDoor: async () => { asked = true; return HUB; },
+  });
+  assert.equal(door, null);
+  assert.equal(asked, false, 'the operator\'s own run must not depend on any network answer');
+});
+
+test('no database here + the project says its door is the hub → operator-run', async () => {
+  for (const probe of [{ db: null, ran: true }, { db: null, ran: false }]) {
+    const door = await op.operatorRunsThisProject({ instanceDir: '/laptop/x' }, {
+      resolveInstanceDb: () => probe, readUpdateDoor: async () => HUB,
+    });
+    assert.deepEqual(door, HUB);
+  }
+});
+
+test('operatorNotice is the message exactly when the project is operator-run', async () => {
+  const deps = { resolveInstanceDb: () => ({ db: null, ran: true }) };
+  assert.equal(await op.operatorNotice({ instanceDir: '/x' }, { ...deps, readUpdateDoor: async () => HUB }), op.operatorRunMessage(HUB));
+  assert.equal(await op.operatorNotice({ instanceDir: '/x' }, { ...deps, readUpdateDoor: async () => ({ kind: 'cli' }) }), null);
+});
+
+test('no database here, but a self-hosted / provisioning project, or no answer → behave as before', async () => {
+  for (const answer of [{ kind: 'cli', url: null }, { kind: 'local', url: '/deploy' }, null]) {
+    const door = await op.operatorRunsThisProject({ instanceDir: '/laptop/x' }, {
+      resolveInstanceDb: () => ({ db: null, ran: true }), readUpdateDoor: async () => answer,
+    });
+    assert.equal(door, null, `door ${JSON.stringify(answer)} must not trigger the operator message`);
+  }
+});
+
+function capture(stream) {
+  const orig = stream.write.bind(stream);
+  let out = '';
+  stream.write = (chunk, ...rest) => { out += String(chunk); return true; };
+  return { text: () => out, restore: () => { stream.write = orig; } };
+}
+
+test('`bongos upgrade --to …` on an operator-run project refuses with the message before anything moves', async () => {
+  const err = capture(process.stderr);
+  let code;
+  try {
+    code = await upgrade.main(['--to', '99.0.0', '--dry-run'], { operatorNotice: async () => op.operatorRunMessage(HUB) });
+  } finally { err.restore(); }
+  assert.equal(code, 1);
+  assert.match(err.text(), /✖ This project is upgraded by its operator/);
+  assert.doesNotMatch(err.text(), /cannot determine which database/);
+});
+
+test('bare `bongos upgrade` keeps its pre-check result and adds who upgrades it', async () => {
+  const out = capture(process.stdout);
+  let code;
+  try {
+    code = await upgrade.main([], { cmdUpgrade: async () => 0, operatorNotice: async () => op.operatorRunMessage(HUB) });
+  } finally { out.restore(); }
+  assert.equal(code, 0, 'the pre-check exit code is unchanged');
+  assert.match(out.text(), /This project is upgraded by its operator/);
+
+  const quiet = capture(process.stdout);
+  try {
+    code = await upgrade.main([], { cmdUpgrade: async () => 1, operatorNotice: async () => null });
+  } finally { quiet.restore(); }
+  assert.equal(code, 1);
+  assert.doesNotMatch(quiet.text(), /upgraded by its operator/, 'not an operator-run project → no message');
+});