@bongos/core 1.21.91 → 1.21.93

package/tests/government_act_alone_buildings.mjs

@@ -0,0 +1,430 @@
+// tests/government_act_alone_buildings.mjs — "decide by vote" binds on EVERY
+// building's own pages, not only People's (task 1004657, goal 1000111; ADR 0363
+// D5 and its Consequences).
+//
+// What this pins:
+//   1. THE GATE (src/bongos/act-alone.js, on the doorway as requireActAlone):
+//      as today it lets the request through; while the row names a sitting it
+//      refuses with People's exact shape (409 decided_by_sitting + area, rule,
+//      who, what_this_means, open_with); no government module → as today; an
+//      unreadable table → 503, fail-closed, like People.
+//   2. THE RECORD (decision-rules AREAS[].acts) matches the source BOTH WAYS:
+//      every listed route mounts the gate for its building, and every mounted
+//      gate is listed. The charter says why it has no direct route.
+//   3. EVERY BUILDING, THROUGH ITS REAL ROUTER, with the real permission gate
+//      and the real checkActAlone over a stubbed table: each listed route is
+//      refused while its building is a sitting and reaches its handler as today.
+//   4. NOT A LONE ACT: a brake (fence off, pause), a dry run, and a passed
+//      matter's act (which never passes through a route) are never refused.
+//
+// DB-free: the government table read and every write are stubbed by property.
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+
+const api = require(path.join(ROOT, 'src', 'module-api.js'));
+const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
+const authMod = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
+const { requireActAlone } = require(path.join(ROOT, 'src', 'bongos', 'act-alone.js'));
+const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
+const dr = require(path.join(GOV, 'decision-rules.js'));
+const board = require(path.join(GOV, 'board.js'));
+const govDb = require(path.join(GOV, 'db.js'));
+const express = require('express');
+
+async function stub(obj, stubs, fn) {
+  const originals = {};
+  for (const [k, v] of Object.entries(stubs)) { originals[k] = obj[k]; obj[k] = v; }
+  try { return await fn(); } finally { for (const [k, v] of Object.entries(originals)) obj[k] = v; }
+}
+
+// ── 1. the gate itself ──────────────────────────────────────────────────────
+
+function fakeRes() {
+  const res = { failed: null };
+  res.fail = (code, a, b) => { res.failed = { code, a, b }; return res; };
+  return res;
+}
+async function runGate(gate, req = { builder: { id: 42 }, body: {} }) {
+  const res = fakeRes();
+  let passed = false;
+  await gate(req, res, () => { passed = true; });
+  return { passed, failed: res.failed };
+}
+async function withPort(port, fn) {
+  seams._reset();
+  if (port) seams.registerProvider('government', port);
+  try { return await fn(); } finally { seams._reset(); registerMainPort(); }
+}
+// The port the routers below are driven through (section 3); restored after
+// each gate test swaps in its own.
+const ATOMS = [
+  'autonomy.fence.manage', 'criterion.satisfy', 'criterion.unsatisfy', 'gate_approval.decide', 'override_request.decide',
+  'core.pin.move', 'builder.budget.set', 'goal.create', 'goal.reorder', 'version.focus.set', 'project.settings.manage',
+  'security.report.adjudicate', 'access_request.review', 'government.manage',
+];
+function registerMainPort() {
+  seams.registerProvider('government', { resolveBuilderPermissions: async () => ATOMS, checkActAlone: board.checkActAlone });
+}
+
+test('the gate: no government module, or a port without the check, is as today', async () => {
+  await withPort(null, async () => assert.equal((await runGate(requireActAlone('release'))).passed, true));
+  await withPort({ resolveBuilderPermissions: async () => [] }, async () => assert.equal((await runGate(requireActAlone('release'))).passed, true));
+});
+
+test('the gate: as today passes, asking for the named building and the live builder', async () => {
+  const asked = [];
+  await withPort({ checkActAlone: async (area, id) => { asked.push([area, id]); return { ok: true }; } }, async () => {
+    assert.equal((await runGate(requireActAlone('treasury'))).passed, true);
+  });
+  assert.deepEqual(asked, [['treasury', 42]]);
+});
+
+test('the gate: a sitting refuses in People\'s exact shape, naming the matter route', async () => {
+  const refusal = { ok: false, reason: 'decided_by_sitting', area: 'review', rule: 'majority', who: 'the council', what_this_means: 'Review is decided by the council (majority vote). Put it to them as a matter instead.', open_with: 'POST /government/board/matters' };
+  await withPort({ checkActAlone: async () => refusal }, async () => {
+    const out = await runGate(requireActAlone('review'));
+    assert.equal(out.passed, false);
+    assert.deepEqual(out.failed, { code: 'decided_by_sitting', a: 409, b: { area: 'review', rule: 'majority', who: 'the council', what_this_means: refusal.what_this_means, open_with: 'POST /government/board/matters' } });
+  });
+});
+
+test('the gate: an unreadable table, or an answer it does not know, refuses 503 — fail-closed like People', async () => {
+  await withPort({ checkActAlone: async () => { throw new Error('db down'); } }, async () => {
+    const out = await runGate(requireActAlone('rules'));
+    assert.equal(out.passed, false);
+    assert.equal(out.failed.code, 'decision_rule_unreadable');
+    assert.equal(out.failed.a.status, 503);
+  });
+  await withPort({ checkActAlone: async () => ({ ok: false, reason: 'unknown_area' }) }, async () => {
+    const out = await runGate(requireActAlone('nowhere'));
+    assert.equal(out.passed, false);
+    assert.equal(out.failed.code, 'decision_rule_unreadable');
+  });
+});
+
+test('the gate: `unless` lets a non-decision through without asking; a bad call is refused at mount', async () => {
+  let asked = 0;
+  await withPort({ checkActAlone: async () => { asked += 1; return { ok: false, reason: 'decided_by_sitting' }; } }, async () => {
+    const out = await runGate(requireActAlone('automation', { unless: (req) => req.body.enabled === false }), { builder: { id: 1 }, body: { enabled: false } });
+    assert.equal(out.passed, true);
+  });
+  assert.equal(asked, 0);
+  assert.throws(() => requireActAlone(''), TypeError);
+  assert.throws(() => requireActAlone('rules', { unless: true }), TypeError);
+  assert.equal(api.requireActAlone, requireActAlone, 'modules reach it through the doorway');
+});
+
+// ── 2. the record matches the source, both ways ─────────────────────────────
+
+function routeFiles() {
+  const out = [];
+  for (const dir of [path.join(ROOT, 'src', 'bongos', 'routes'), ...fs.readdirSync(path.join(ROOT, 'modules')).map((m) => path.join(ROOT, 'modules', m, 'routes'))]) {
+    if (!fs.existsSync(dir)) continue;
+    for (const f of fs.readdirSync(dir)) if (f.endsWith('.js')) out.push(path.join(dir, f));
+  }
+  return out;
+}
+const SOURCES = routeFiles().map((f) => ({ file: path.relative(ROOT, f), src: fs.readFileSync(f, 'utf8') }));
+const REG_RE = /router\.(get|post|put|patch|delete)\(\s*'([^']+)'/g;
+
+// The middleware text of one registration: from `router.x('path'` to its handler.
+function registration(act) {
+  const [method, p] = act.split(' ');
+  const hits = [];
+  for (const { file, src } of SOURCES) {
+    for (const m of src.matchAll(REG_RE)) {
+      if (m[1].toUpperCase() !== method || m[2] !== p) continue;
+      const rest = src.slice(m.index);
+      const end = Math.min(...['(req, res', 'Handler('].map((s) => { const i = rest.indexOf(s); return i === -1 ? Infinity : i; }));
+      hits.push({ file, head: rest.slice(0, end), body: rest.slice(0, 3000) });
+    }
+  }
+  return hits;
+}
+
+test('the record: every building but the charter has direct routes; the charter says why it has none', () => {
+  for (const a of dr.AREAS) {
+    if (a.key === 'charter') {
+      assert.equal(a.acts.length, 0);
+      assert.match(a.no_direct_route, /amend/);
+      assert.equal(dr.resolveAll([]).find((r) => r.area === 'charter').no_direct_route, a.no_direct_route, 'the record rides the table view');
+    } else {
+      assert.ok(a.acts.length > 0, `${a.key} lists its direct routes`);
+    }
+  }
+});
+
+test('the record → the source: every listed route mounts its own building\'s gate', () => {
+  for (const a of dr.AREAS) {
+    for (const act of a.acts) {
+      const hits = registration(act);
+      assert.equal(hits.length, 1, `${act} is registered exactly once (${hits.map((h) => h.file)})`);
+      const { head, body } = hits[0];
+      const mounted = head.includes(`requireActAlone('${a.key}'`);
+      const inModule = a.key === 'people' && /peopleMayActAlone\(req, res\)/.test(body);
+      assert.ok(mounted || inModule, `${act} (${hits[0].file}) defers to the ${a.key} row`);
+      if (mounted) assert.ok(head.indexOf('requireActAlone') > head.search(/requirePermission|requireOwnProjectOrPin/), `${act}: the permission gate stays first`);
+    }
+  }
+});
+
+test('the source → the record: every mounted gate is listed under the building it names', () => {
+  let seen = 0;
+  for (const { file, src } of SOURCES) {
+    for (const m of src.matchAll(/requireActAlone\('([a-z]+)'/g)) {
+      const before = [...src.slice(0, m.index).matchAll(REG_RE)].pop();
+      assert.ok(before, `${file}: requireActAlone outside a route registration`);
+      const act = `${before[1].toUpperCase()} ${before[2]}`;
+      const area = dr.areaByKey(m[1]);
+      assert.ok(area, `${file}: requireActAlone('${m[1]}') names no building`);
+      assert.ok(area.acts.includes(act), `${act} mounts the ${m[1]} gate but is not in decision-rules AREAS.${m[1]}.acts`);
+      seen += 1;
+    }
+  }
+  const listed = dr.AREAS.reduce((n, a) => n + a.acts.length, 0) - 2; // People's two assignments ask in-module
+  assert.equal(seen, listed, 'one mounted gate per listed route');
+});
+
+// ── 3. every building, through its real router ──────────────────────────────
+
+const fakeBuilder = (req, res, next) => { req.builder = { id: 42, rank: 'archon', github_login: 'someone' }; next(); };
+const realApiRequireBuilder = api.requireBuilder;
+const realAuthRequireBuilder = authMod.requireBuilder;
+api.requireBuilder = fakeBuilder;
+authMod.requireBuilder = fakeBuilder;
+seams._reset();
+registerMainPort();
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+for (const rel of [
+  'modules/autonomy/routes/autonomy.js',
+  'modules/lifecycle/routes/done-when.js',
+  'modules/lifecycle/routes/gate-approvals.js',
+  'modules/lifecycle/routes/tasks.js',
+  'modules/lifecycle/routes/goals.js',
+  'modules/lifecycle/routes/versions.js',
+  'modules/lifecycle/routes/project-settings.js',
+  'modules/render-deploy/routes/act.js',
+  'modules/npm-release/routes/release.js',
+  'modules/provisioning/routes/core-upgrade.js',
+  'src/bongos/routes/builders.js',
+  'modules/security/routes/reports.js',
+  'modules/onboarding/routes/access-requests.js',
+  'modules/government/routes/government.js',
+]) app.use(require(path.join(ROOT, rel))());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const BASE = `http://127.0.0.1:${server.address().port}`;
+after(() => { server.close(); api.requireBuilder = realApiRequireBuilder; authMod.requireBuilder = realAuthRequireBuilder; seams._reset(); });
+
+async function call(method, p, body) {
+  const res = await fetch(`${BASE}${p}`, { method, headers: body === undefined ? {} : { 'content-type': 'application/json' }, body: body === undefined ? undefined : JSON.stringify(body) });
+  let json = null; try { json = await res.json(); } catch { /* none */ }
+  return { status: res.status, json };
+}
+
+// Each listed route as a request that, AS TODAY, stops in its handler's own
+// first check (a bad id or body → 4xx) before any database write — so reaching
+// the handler is visible and nothing is written either way.
+const BAD = 'x';
+const REQUESTS = {
+  'PATCH /project-settings/rot-days': ['PATCH', '/project-settings/rot-days', { days: 'soon' }],
+  'PATCH /project-settings/ship-mode': ['PATCH', '/project-settings/ship-mode', { mode: 'sometimes' }],
+  'PATCH /work-categories/:id': ['PATCH', `/work-categories/${BAD}`, {}],
+  'POST /security/reports/:id/confirm': ['POST', `/security/reports/${BAD}/confirm`, {}],
+  'POST /security/reports/:id/dispute': ['POST', `/security/reports/${BAD}/dispute`, {}],
+  'POST /security/reports/:id/fix': ['POST', `/security/reports/${BAD}/fix`, {}],
+  // People's own two ask after their validation (task 1004529), so they carry a
+  // valid custom rank; the writes are stubbed (PEOPLE_DB) and counted.
+  'POST /government/assignments': ['POST', '/government/assignments', { builder_id: 7, rank_key: 'tester' }],
+  'DELETE /government/assignments/:builderId/:rankKey': ['DELETE', '/government/assignments/7/tester'],
+  'PATCH /access-requests/:id': ['PATCH', `/access-requests/${BAD}`, { status: 'invited' }],
+  'POST /access-requests/invite': ['POST', '/access-requests/invite', {}],
+  'POST /goals': ['POST', '/goals', {}],
+  'POST /goals/reorder': ['POST', '/goals/reorder', {}],
+  'POST /work-categories': ['POST', '/work-categories', {}],
+  'PUT /versions/focus': ['PUT', '/versions/focus', { version_id: '   ' }],
+  'POST /autonomy/fence': ['POST', '/autonomy/fence', { enabled: 'yes' }],
+  'POST /autonomy/fence/goals': ['POST', '/autonomy/fence/goals', { goal_id: 0 }],
+  'DELETE /autonomy/fence/goals/:goalId': ['DELETE', `/autonomy/fence/goals/${BAD}`],
+  'POST /autonomy/fence/priority': ['POST', '/autonomy/fence/priority', {}],
+  'POST /autonomy/builders/:builderId/pause': ['POST', `/autonomy/builders/${BAD}/pause`, { paused: false }],
+  'POST /done-when/:criterionId/satisfy': ['POST', `/done-when/${BAD}/satisfy`, {}],
+  'POST /done-when/:criterionId/unsatisfy': ['POST', `/done-when/${BAD}/unsatisfy`, {}],
+  'POST /gate-approvals/:pr/approve': ['POST', `/gate-approvals/${BAD}/approve`, {}],
+  'POST /override-requests/:id/decide': ['POST', `/override-requests/${BAD}/decide`, { decision: 'approve' }],
+  'POST /provisioning/instances/:id/core-upgrade': ['POST', `/provisioning/instances/${BAD}/core-upgrade`, { to: '1.2.3' }],
+  'POST /provisioning/instances/:id/update-channel': ['POST', `/provisioning/instances/${BAD}/update-channel`, { channel: 'nightly' }],
+  'POST /render-deploy/act': ['POST', '/render-deploy/act', { action: 'launch' }],
+  'POST /npm-release/release': ['POST', '/npm-release/release', { version: 'v-next' }],
+  'PATCH /builders/:id/budget': ['PATCH', `/builders/${BAD}/budget`, { monthly_budget_usd: 5 }],
+};
+
+test('every listed route has a request in this test (a new act cannot go unexercised)', () => {
+  const listed = dr.AREAS.flatMap((a) => a.acts).sort();
+  assert.deepEqual(Object.keys(REQUESTS).sort(), listed);
+});
+
+const sitting = (area, rule = 'majority') => ({ area, decided_by: 'rank:council', rule, who: null, set_by_item_id: '30' });
+
+let peopleWrites = 0;
+const PEOPLE_DB = {
+  getRankByKey: async (k) => ({ rank_key: k, is_system: false, seeded_rank: null }),
+  assignRank: async () => { peopleWrites += 1; return true; },
+  unassignRank: async () => { peopleWrites += 1; return true; },
+};
+
+for (const a of dr.AREAS.filter((x) => x.acts.length)) {
+  test(`${a.name}: while a vote decides it, every direct route refuses one builder acting alone; as today each reaches its handler`, async () => {
+    peopleWrites = 0;
+    // A sitting at THIS building only: the refusal is the building's own row.
+    await stub(govDb, { ...PEOPLE_DB, listDecisionRules: async () => [sitting(a.key)], builderHoldsRankActive: async () => true }, async () => {
+      for (const act of a.acts) {
+        const [method, p, body] = REQUESTS[act];
+        const r = await call(method, p, body);
+        assert.equal(r.status, 409, `${act} under a vote → 409 (got ${r.status} ${JSON.stringify(r.json)})`);
+        assert.equal(r.json.error.code, 'decided_by_sitting', act);
+        const d = r.json.error.details || r.json.error;
+        assert.equal(d.area, a.key, `${act} names its own building`);
+        assert.equal(d.open_with, 'POST /government/board/matters', `${act} points at the sitting`);
+      }
+    });
+    assert.equal(peopleWrites, 0, 'nothing was written under the vote');
+    // Another building's sitting says nothing here, and with no row at all the
+    // route is exactly today's: its own handler answers (its own first check,
+    // or — for People's stubbed assignments — the write itself).
+    for (const rows of [[], [sitting(a.key === 'rules' ? 'planning' : 'rules')]]) {
+      await stub(govDb, { ...PEOPLE_DB, listDecisionRules: async () => rows, builderHoldsRankActive: async () => true }, async () => {
+        for (const act of a.acts) {
+          const [method, p, body] = REQUESTS[act];
+          const r = await call(method, p, body);
+          assert.notEqual(r.json && r.json.error && r.json.error.code, 'decided_by_sitting', `${act} as today`);
+          const ok = act.includes('/government/assignments') ? r.status < 300 : (r.status >= 400 && r.status < 500 && r.status !== 403);
+          assert.ok(ok, `${act} as today reaches its handler (got ${r.status} ${JSON.stringify(r.json)})`);
+        }
+      });
+    }
+  });
+}
+
+test('decide alone: a member the row seats may still act alone; one it does not seat may not', async () => {
+  const [method, p, body] = REQUESTS['PATCH /builders/:id/budget'];
+  await stub(govDb, { listDecisionRules: async () => [sitting('treasury', 'decide')], builderHoldsRankActive: async () => true }, async () => {
+    assert.equal((await call(method, p, body)).status, 400, 'seated: through to the handler (bad id)');
+  });
+  await stub(govDb, { listDecisionRules: async () => [sitting('treasury', 'decide')], builderHoldsRankActive: async () => false }, async () => {
+    assert.equal((await call(method, p, body)).status, 409, 'not seated: refused');
+  });
+});
+
+test('the check is cheap on the hot path: one table read, and no config-file read for any building\'s route', async () => {
+  let reads = 0;
+  let queries = 0;
+  const realRead = fs.readFileSync;
+  fs.readFileSync = (...args) => { reads += 1; return realRead(...args); };
+  try {
+    await stub(govDb, { listDecisionRules: async () => { queries += 1; return [sitting('review')]; }, builderHoldsRankActive: async () => true }, async () => {
+      for (const area of dr.AREA_KEYS.filter((k) => k !== 'charter')) await board.checkActAlone(area, '42');
+    });
+  } finally {
+    fs.readFileSync = realRead;
+  }
+  assert.equal(reads, 0, 'no synchronous file read per request (config.js is boot-only)');
+  assert.equal(queries, dr.AREA_KEYS.length - 1, 'one table read per check');
+  await stub(govDb, { listDecisionRules: async () => [sitting('review')] }, async () => {
+    assert.equal((await board.checkActAlone('review', '42')).ok, false, 'and the answer is unchanged');
+    assert.equal((await board.checkActAlone('rules', '42')).ok, true);
+    assert.equal((await board.checkActAlone('nowhere', '42')).reason, 'unknown_area');
+  });
+});
+
+test('an unreadable table refuses a building\'s route 503 — never waved through', async () => {
+  await stub(govDb, { listDecisionRules: async () => { throw new Error('db down'); } }, async () => {
+    const [method, p, body] = REQUESTS['POST /goals'];
+    const r = await call(method, p, body);
+    assert.equal(r.status, 503);
+    assert.equal(r.json.error.code, 'decision_rule_unreadable');
+  });
+});
+
+// ── 4. not a lone act ───────────────────────────────────────────────────────
+
+const autoDb = require(path.join(ROOT, 'modules', 'autonomy', 'db.js'));
+
+test('the brake is never refused: the fence switched OFF and one runner paused, while a vote decides Automation', async () => {
+  const wrote = [];
+  await stub(autoDb, {
+    setFenceEnabled: async (a) => { wrote.push(['fence', a.enabled]); return { enabled: a.enabled }; },
+    setBuilderPause: async (a) => { wrote.push(['pause', a.paused]); return { builder_id: a.builderId, paused: a.paused }; },
+  }, async () => {
+    await stub(govDb, { listDecisionRules: async () => [sitting('automation', 'unanimous')], builderHoldsRankActive: async () => true }, async () => {
+      assert.equal((await call('POST', '/autonomy/fence', { enabled: false, reason: 'stop' })).status, 200);
+      assert.equal((await call('POST', '/autonomy/builders/7/pause', { paused: true })).status, 200);
+      assert.equal((await call('POST', '/autonomy/fence', { enabled: true })).status, 409, 'switching it ON is a decision');
+      assert.equal((await call('POST', '/autonomy/builders/7/pause', { paused: false })).status, 409, 'resuming is a decision');
+    });
+  });
+  assert.deepEqual(wrote, [['fence', false], ['pause', true]]);
+});
+
+test('a dry run of the pin move only reads, so it is not refused under a vote', async () => {
+  await stub(govDb, { listDecisionRules: async () => [sitting('release')], builderHoldsRankActive: async () => true }, async () => {
+    const r = await call('POST', `/provisioning/instances/${BAD}/core-upgrade`, { to: '1.2.3', dry_run: true });
+    assert.notEqual(r.json && r.json.error && r.json.error.code, 'decided_by_sitting');
+    assert.equal((await call('POST', `/provisioning/instances/${BAD}/core-upgrade`, { to: '1.2.3' })).status, 409, 'the real move is');
+  });
+});
+
+test('a PASSED matter\'s act is the sitting itself: it runs while the gate would refuse every lone act', async () => {
+  const decisionBoard = require(path.join(GOV, 'decision-board.js'));
+  require(path.join(ROOT, 'modules', 'autonomy', 'matter-acts.js')).contributeAutomationMatterActs();
+  const wrote = [];
+  await stub(autoDb, { setFenceEnabled: async (a) => { wrote.push(a.enabled); return { enabled: a.enabled }; } }, async () => {
+    await stub(govDb, {
+      listDecisionRules: async () => dr.AREA_KEYS.filter((k) => k !== 'charter').map((k) => sitting(k, 'unanimous')),
+      builderHoldsRankActive: async () => true,
+      getMatter: async () => ({ id: '8', area: 'automation', title: 'Switch it on', action: { type: 'switch_on' }, proposed_by: '7' }),
+    }, async () => {
+      // the direct route is refused …
+      assert.equal((await call('POST', '/autonomy/fence', { enabled: true })).status, 409);
+      // … and the passed matter still acts, through the owning module's act
+      const out = await decisionBoard.actOnPassedMatter({ id: '40', subject_type: 'automation_matter', subject_id: '8', outcome: 'passed' });
+      assert.equal(out.result.done, true, JSON.stringify(out.result));
+    });
+  });
+  assert.deepEqual(wrote, [true], 'only the passed matter switched it');
+});
+
+test('a PASSED Treasury matter sets the limit (core\'s act) while the budget route refuses a lone act', async () => {
+  const decisionBoard = require(path.join(GOV, 'decision-board.js'));
+  require(path.join(ROOT, 'src', 'bongos', 'routes', 'builders.js'))(); // contributes the Treasury act, as at boot
+  const set = [];
+  seams.registerProvider('reward', { setBuilderMonthlyBudget: async (id, usd) => { set.push([id, usd]); return { id, monthly_budget_usd: usd }; } });
+  try {
+    await stub(govDb, {
+      listDecisionRules: async () => [sitting('treasury', 'unanimous')],
+      builderHoldsRankActive: async () => true,
+      getMatter: async () => ({ id: '9', area: 'treasury', title: 'Lu gets $50 a month', action: { type: 'set_budget', builder_id: 7, monthly_usd: 50 }, proposed_by: '7' }),
+    }, async () => {
+      assert.equal((await call('PATCH', '/builders/7/budget', { monthly_budget_usd: 50 })).status, 409, 'the lone act is refused');
+      const out = await decisionBoard.actOnPassedMatter({ id: '41', subject_type: 'treasury_matter', subject_id: '9', outcome: 'passed' });
+      assert.equal(out.result.done, true, JSON.stringify(out.result));
+    });
+  } finally {
+    seams._reset();
+    registerMainPort();
+  }
+  assert.deepEqual(set, [[7, 50]], 'only the passed matter wrote the limit');
+});

package/tests/module_api.mjs

@@ -22,6 +22,7 @@ const PUBLISHED_SURFACE = [
   'CORE_VERSION',
   'requireBuilder', 'requireRank', 'rankMeetsThreshold', 'requireBfgPrincipal', 'allowBoxScope', 'resolveSession',
   'requirePermission', // BV1.R105: the authority-atom gate module routes migrate onto (1.19.0; ADR 0151)
+  'requireActAlone', // added by task 1004657 (ADR 0363 D5): a building's own page asks its decision-rules row before one builder acts alone. On the doorway because eight buildings' pages live in six modules and core, and each must refuse the same way People does
   'pool', 'getPool', 'instanceDbName', 'withTx', 'getBuilderById',
   // added by task 1003575 (ADR 0241 §3): the instance's PROJECT OWNER — its first
   // admitted human builder. Kernel identity like getBuilderById beside it, and

package/tests/npm_release_release.mjs

@@ -180,7 +180,8 @@ test('the route is gated like the deploy page (core.pin.move), never by rank', (
   const router = buildRouter();
   const layer = router.stack.find((l) => l.route && l.route.path === '/npm-release/release');
   assert.ok(layer.route.methods.post);
-  assert.equal(layer.route.stack.length, 3, 'requireBuilder, the permission gate, then the handler');
+  assert.equal(layer.route.stack.length, 4, 'requireBuilder, the permission gate, Release\'s decision rule (task 1004657), then the handler');
+  assert.equal(layer.route.stack[2].handle.name, 'actAloneGate');
   const src = fs.readFileSync(new URL('../modules/npm-release/routes/release.js', import.meta.url), 'utf8');
   assert.match(src, /api\.requireBuilder,\s*\n\s*api\.requirePermission\('core\.pin\.move'\)/);
   assert.doesNotMatch(src, /api\.requireRank\(/);

package/tests/onboard.mjs

@@ -81,15 +81,15 @@ test('every form OFFERS the optional step and names what skipping costs — skil
   assert.match(cli, /Press Enter to skip/, 'the terminal form offers the skip in the prompt itself');
   assert.match(cli, /off the public map/, 'and says what a missing description means');
 
-  // the web form — since task 1004504 the optional step is no panel of its own: the
-  // sentence is an optional field on "What are you making?" whose label names what
-  // leaving it empty costs, and the team shape is the review's Team size row
+  // the web form — since task 1004648 the optional step is a field of part 01 of the one
+  // page, "Your project", whose label names what the sentence is for (the public map), and
+  // the team shape is part 02's Team row
   const hub = read('modules/public-landing/public/projects.html').replace(/\r\n/g, '\n');
-  const what = (hub.match(/<section class="panel" id="panel-what"[\s\S]*?\n {10}<\/section>/) || [''])[0];
-  assert.ok(what, 'the wizard ships the screen that carries the sentence');
-  assert.match(what, /<label class="wizField"><span>In a sentence <small>\(optional — puts it on the public map\)<\/small><\/span>\s*<input type="text" id="f-desc"/,
-    'the sentence is offered as optional, and its label says what skipping costs');
-  assert.match(hub, /<div class="setRow" data-row="team">[\s\S]*?id="teamCards"/, 'the team shape rides the review\'s Team size row');
+  const what = (hub.match(/<div class="part" id="part-project"[\s\S]*?\n {14}<\/div>\n/) || [''])[0];
+  assert.ok(what, 'the wizard ships the part that carries the sentence');
+  assert.match(what, /<label class="wizField"><span>In a sentence <small>\(optional, it goes on the public map\)<\/small><\/span>\s*<input type="text" id="f-desc"/,
+    'the sentence is offered as optional, and its label says what it is for');
+  assert.match(hub, /<div class="setRow" data-row="team">[\s\S]*?id="teamCards"/, 'the team shape rides part 02\'s Team row');
   assert.doesNotMatch(hub, /id="panel-detail"|id="skipDetail"/, 'the old About panel and its skip control are gone');
 
   // the route that receives it

package/tests/project_invite_ui.mjs

@@ -452,7 +452,7 @@ test('a skip moves focus on rather than stranding it inside the box it just hid'
 
   await ui.skip();
 
-  assert.deepEqual(ui.focused, ['doneStepsHead']);
+  assert.deepEqual(ui.focused, ['wizInviteLater'], 'the line saying where inviting lives afterwards (task 1004648)');
 });
 
 test('a NEW project starts the step clean — the last one’s pending lines do not follow it', async () => {
@@ -569,16 +569,17 @@ test('the project page opens the step from its own manage read, which the API al
 
 // ── the markup + the sheet ───────────────────────────────────────────────────
 
-test('the wizard’s invite step ships as real markup on the done panel, above the human steps', () => {
-  const panel = (HUB.match(/<section class="panel" id="panel-done"[\s\S]*?<\/section>/) || [''])[0];
+test('the wizard’s invite step ships as real markup in part 03, with the alive moment after the checklist', () => {
+  const panel = (HUB.match(/<div class="part waiting" id="panel-done"[\s\S]*?<\/section>/) || [''])[0];
   assert.ok(panel, '#panel-done ships as real markup');
   assert.match(panel, /<div class="inviteBox" id="wizInvite" hidden>/, 'the step is a real element the script only shows');
   assert.match(panel, /id="wizInviteWho"/, 'the one field');
   assert.match(panel, /data-invite-send="wizInvite"/, 'the sender');
   assert.match(panel, /data-invite-skip="wizInvite"/, 'and the skip is a CONTROL, not "leave it and move on"');
   assert.match(panel, /Optional/, 'the panel says so before it asks');
-  assert.ok(panel.indexOf('id="wizInvite"') < panel.indexOf('id="doneStepsHead"'),
-    'it stands before the steps only the owner can play');
+  assert.ok(panel.indexOf('id="humanSteps"') < panel.indexOf('id="done-h"') && panel.indexOf('id="done-h"') < panel.indexOf('id="wizInvite"'),
+    'the mockup\'s order: the checklist, then "is alive", then the invite (task 1004648)');
+  assert.match(panel, /Invite your first builders\. They become founding builders\./, 'in the mockup\'s words');
   assert.match(panel, /<p class="samePath" id="wizInviteLater"><\/p>/, 'and the way back afterwards is a slot beside the modules one');
   assert.match(SCRIPT, /\$\('wizInviteLater'\)\.innerHTML = 'You can invite builders any time from ' \+ projectPageLink\('the project’s own page'\) \+ '\.';/,
     'filled with one sentence naming THIS project, the doneModules idiom');