@bongos/core 1.21.92 → 1.21.93

package/tests/government_act_alone_buildings.mjs

@@ -0,0 +1,430 @@
+// tests/government_act_alone_buildings.mjs — "decide by vote" binds on EVERY
+// building's own pages, not only People's (task 1004657, goal 1000111; ADR 0363
+// D5 and its Consequences).
+//
+// What this pins:
+//   1. THE GATE (src/bongos/act-alone.js, on the doorway as requireActAlone):
+//      as today it lets the request through; while the row names a sitting it
+//      refuses with People's exact shape (409 decided_by_sitting + area, rule,
+//      who, what_this_means, open_with); no government module → as today; an
+//      unreadable table → 503, fail-closed, like People.
+//   2. THE RECORD (decision-rules AREAS[].acts) matches the source BOTH WAYS:
+//      every listed route mounts the gate for its building, and every mounted
+//      gate is listed. The charter says why it has no direct route.
+//   3. EVERY BUILDING, THROUGH ITS REAL ROUTER, with the real permission gate
+//      and the real checkActAlone over a stubbed table: each listed route is
+//      refused while its building is a sitting and reaches its handler as today.
+//   4. NOT A LONE ACT: a brake (fence off, pause), a dry run, and a passed
+//      matter's act (which never passes through a route) are never refused.
+//
+// DB-free: the government table read and every write are stubbed by property.
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+
+const api = require(path.join(ROOT, 'src', 'module-api.js'));
+const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
+const authMod = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
+const { requireActAlone } = require(path.join(ROOT, 'src', 'bongos', 'act-alone.js'));
+const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
+const dr = require(path.join(GOV, 'decision-rules.js'));
+const board = require(path.join(GOV, 'board.js'));
+const govDb = require(path.join(GOV, 'db.js'));
+const express = require('express');
+
+async function stub(obj, stubs, fn) {
+  const originals = {};
+  for (const [k, v] of Object.entries(stubs)) { originals[k] = obj[k]; obj[k] = v; }
+  try { return await fn(); } finally { for (const [k, v] of Object.entries(originals)) obj[k] = v; }
+}
+
+// ── 1. the gate itself ──────────────────────────────────────────────────────
+
+function fakeRes() {
+  const res = { failed: null };
+  res.fail = (code, a, b) => { res.failed = { code, a, b }; return res; };
+  return res;
+}
+async function runGate(gate, req = { builder: { id: 42 }, body: {} }) {
+  const res = fakeRes();
+  let passed = false;
+  await gate(req, res, () => { passed = true; });
+  return { passed, failed: res.failed };
+}
+async function withPort(port, fn) {
+  seams._reset();
+  if (port) seams.registerProvider('government', port);
+  try { return await fn(); } finally { seams._reset(); registerMainPort(); }
+}
+// The port the routers below are driven through (section 3); restored after
+// each gate test swaps in its own.
+const ATOMS = [
+  'autonomy.fence.manage', 'criterion.satisfy', 'criterion.unsatisfy', 'gate_approval.decide', 'override_request.decide',
+  'core.pin.move', 'builder.budget.set', 'goal.create', 'goal.reorder', 'version.focus.set', 'project.settings.manage',
+  'security.report.adjudicate', 'access_request.review', 'government.manage',
+];
+function registerMainPort() {
+  seams.registerProvider('government', { resolveBuilderPermissions: async () => ATOMS, checkActAlone: board.checkActAlone });
+}
+
+test('the gate: no government module, or a port without the check, is as today', async () => {
+  await withPort(null, async () => assert.equal((await runGate(requireActAlone('release'))).passed, true));
+  await withPort({ resolveBuilderPermissions: async () => [] }, async () => assert.equal((await runGate(requireActAlone('release'))).passed, true));
+});
+
+test('the gate: as today passes, asking for the named building and the live builder', async () => {
+  const asked = [];
+  await withPort({ checkActAlone: async (area, id) => { asked.push([area, id]); return { ok: true }; } }, async () => {
+    assert.equal((await runGate(requireActAlone('treasury'))).passed, true);
+  });
+  assert.deepEqual(asked, [['treasury', 42]]);
+});
+
+test('the gate: a sitting refuses in People\'s exact shape, naming the matter route', async () => {
+  const refusal = { ok: false, reason: 'decided_by_sitting', area: 'review', rule: 'majority', who: 'the council', what_this_means: 'Review is decided by the council (majority vote). Put it to them as a matter instead.', open_with: 'POST /government/board/matters' };
+  await withPort({ checkActAlone: async () => refusal }, async () => {
+    const out = await runGate(requireActAlone('review'));
+    assert.equal(out.passed, false);
+    assert.deepEqual(out.failed, { code: 'decided_by_sitting', a: 409, b: { area: 'review', rule: 'majority', who: 'the council', what_this_means: refusal.what_this_means, open_with: 'POST /government/board/matters' } });
+  });
+});
+
+test('the gate: an unreadable table, or an answer it does not know, refuses 503 — fail-closed like People', async () => {
+  await withPort({ checkActAlone: async () => { throw new Error('db down'); } }, async () => {
+    const out = await runGate(requireActAlone('rules'));
+    assert.equal(out.passed, false);
+    assert.equal(out.failed.code, 'decision_rule_unreadable');
+    assert.equal(out.failed.a.status, 503);
+  });
+  await withPort({ checkActAlone: async () => ({ ok: false, reason: 'unknown_area' }) }, async () => {
+    const out = await runGate(requireActAlone('nowhere'));
+    assert.equal(out.passed, false);
+    assert.equal(out.failed.code, 'decision_rule_unreadable');
+  });
+});
+
+test('the gate: `unless` lets a non-decision through without asking; a bad call is refused at mount', async () => {
+  let asked = 0;
+  await withPort({ checkActAlone: async () => { asked += 1; return { ok: false, reason: 'decided_by_sitting' }; } }, async () => {
+    const out = await runGate(requireActAlone('automation', { unless: (req) => req.body.enabled === false }), { builder: { id: 1 }, body: { enabled: false } });
+    assert.equal(out.passed, true);
+  });
+  assert.equal(asked, 0);
+  assert.throws(() => requireActAlone(''), TypeError);
+  assert.throws(() => requireActAlone('rules', { unless: true }), TypeError);
+  assert.equal(api.requireActAlone, requireActAlone, 'modules reach it through the doorway');
+});
+
+// ── 2. the record matches the source, both ways ─────────────────────────────
+
+function routeFiles() {
+  const out = [];
+  for (const dir of [path.join(ROOT, 'src', 'bongos', 'routes'), ...fs.readdirSync(path.join(ROOT, 'modules')).map((m) => path.join(ROOT, 'modules', m, 'routes'))]) {
+    if (!fs.existsSync(dir)) continue;
+    for (const f of fs.readdirSync(dir)) if (f.endsWith('.js')) out.push(path.join(dir, f));
+  }
+  return out;
+}
+const SOURCES = routeFiles().map((f) => ({ file: path.relative(ROOT, f), src: fs.readFileSync(f, 'utf8') }));
+const REG_RE = /router\.(get|post|put|patch|delete)\(\s*'([^']+)'/g;
+
+// The middleware text of one registration: from `router.x('path'` to its handler.
+function registration(act) {
+  const [method, p] = act.split(' ');
+  const hits = [];
+  for (const { file, src } of SOURCES) {
+    for (const m of src.matchAll(REG_RE)) {
+      if (m[1].toUpperCase() !== method || m[2] !== p) continue;
+      const rest = src.slice(m.index);
+      const end = Math.min(...['(req, res', 'Handler('].map((s) => { const i = rest.indexOf(s); return i === -1 ? Infinity : i; }));
+      hits.push({ file, head: rest.slice(0, end), body: rest.slice(0, 3000) });
+    }
+  }
+  return hits;
+}
+
+test('the record: every building but the charter has direct routes; the charter says why it has none', () => {
+  for (const a of dr.AREAS) {
+    if (a.key === 'charter') {
+      assert.equal(a.acts.length, 0);
+      assert.match(a.no_direct_route, /amend/);
+      assert.equal(dr.resolveAll([]).find((r) => r.area === 'charter').no_direct_route, a.no_direct_route, 'the record rides the table view');
+    } else {
+      assert.ok(a.acts.length > 0, `${a.key} lists its direct routes`);
+    }
+  }
+});
+
+test('the record → the source: every listed route mounts its own building\'s gate', () => {
+  for (const a of dr.AREAS) {
+    for (const act of a.acts) {
+      const hits = registration(act);
+      assert.equal(hits.length, 1, `${act} is registered exactly once (${hits.map((h) => h.file)})`);
+      const { head, body } = hits[0];
+      const mounted = head.includes(`requireActAlone('${a.key}'`);
+      const inModule = a.key === 'people' && /peopleMayActAlone\(req, res\)/.test(body);
+      assert.ok(mounted || inModule, `${act} (${hits[0].file}) defers to the ${a.key} row`);
+      if (mounted) assert.ok(head.indexOf('requireActAlone') > head.search(/requirePermission|requireOwnProjectOrPin/), `${act}: the permission gate stays first`);
+    }
+  }
+});
+
+test('the source → the record: every mounted gate is listed under the building it names', () => {
+  let seen = 0;
+  for (const { file, src } of SOURCES) {
+    for (const m of src.matchAll(/requireActAlone\('([a-z]+)'/g)) {
+      const before = [...src.slice(0, m.index).matchAll(REG_RE)].pop();
+      assert.ok(before, `${file}: requireActAlone outside a route registration`);
+      const act = `${before[1].toUpperCase()} ${before[2]}`;
+      const area = dr.areaByKey(m[1]);
+      assert.ok(area, `${file}: requireActAlone('${m[1]}') names no building`);
+      assert.ok(area.acts.includes(act), `${act} mounts the ${m[1]} gate but is not in decision-rules AREAS.${m[1]}.acts`);
+      seen += 1;
+    }
+  }
+  const listed = dr.AREAS.reduce((n, a) => n + a.acts.length, 0) - 2; // People's two assignments ask in-module
+  assert.equal(seen, listed, 'one mounted gate per listed route');
+});
+
+// ── 3. every building, through its real router ──────────────────────────────
+
+const fakeBuilder = (req, res, next) => { req.builder = { id: 42, rank: 'archon', github_login: 'someone' }; next(); };
+const realApiRequireBuilder = api.requireBuilder;
+const realAuthRequireBuilder = authMod.requireBuilder;
+api.requireBuilder = fakeBuilder;
+authMod.requireBuilder = fakeBuilder;
+seams._reset();
+registerMainPort();
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+for (const rel of [
+  'modules/autonomy/routes/autonomy.js',
+  'modules/lifecycle/routes/done-when.js',
+  'modules/lifecycle/routes/gate-approvals.js',
+  'modules/lifecycle/routes/tasks.js',
+  'modules/lifecycle/routes/goals.js',
+  'modules/lifecycle/routes/versions.js',
+  'modules/lifecycle/routes/project-settings.js',
+  'modules/render-deploy/routes/act.js',
+  'modules/npm-release/routes/release.js',
+  'modules/provisioning/routes/core-upgrade.js',
+  'src/bongos/routes/builders.js',
+  'modules/security/routes/reports.js',
+  'modules/onboarding/routes/access-requests.js',
+  'modules/government/routes/government.js',
+]) app.use(require(path.join(ROOT, rel))());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const BASE = `http://127.0.0.1:${server.address().port}`;
+after(() => { server.close(); api.requireBuilder = realApiRequireBuilder; authMod.requireBuilder = realAuthRequireBuilder; seams._reset(); });
+
+async function call(method, p, body) {
+  const res = await fetch(`${BASE}${p}`, { method, headers: body === undefined ? {} : { 'content-type': 'application/json' }, body: body === undefined ? undefined : JSON.stringify(body) });
+  let json = null; try { json = await res.json(); } catch { /* none */ }
+  return { status: res.status, json };
+}
+
+// Each listed route as a request that, AS TODAY, stops in its handler's own
+// first check (a bad id or body → 4xx) before any database write — so reaching
+// the handler is visible and nothing is written either way.
+const BAD = 'x';
+const REQUESTS = {
+  'PATCH /project-settings/rot-days': ['PATCH', '/project-settings/rot-days', { days: 'soon' }],
+  'PATCH /project-settings/ship-mode': ['PATCH', '/project-settings/ship-mode', { mode: 'sometimes' }],
+  'PATCH /work-categories/:id': ['PATCH', `/work-categories/${BAD}`, {}],
+  'POST /security/reports/:id/confirm': ['POST', `/security/reports/${BAD}/confirm`, {}],
+  'POST /security/reports/:id/dispute': ['POST', `/security/reports/${BAD}/dispute`, {}],
+  'POST /security/reports/:id/fix': ['POST', `/security/reports/${BAD}/fix`, {}],
+  // People's own two ask after their validation (task 1004529), so they carry a
+  // valid custom rank; the writes are stubbed (PEOPLE_DB) and counted.
+  'POST /government/assignments': ['POST', '/government/assignments', { builder_id: 7, rank_key: 'tester' }],
+  'DELETE /government/assignments/:builderId/:rankKey': ['DELETE', '/government/assignments/7/tester'],
+  'PATCH /access-requests/:id': ['PATCH', `/access-requests/${BAD}`, { status: 'invited' }],
+  'POST /access-requests/invite': ['POST', '/access-requests/invite', {}],
+  'POST /goals': ['POST', '/goals', {}],
+  'POST /goals/reorder': ['POST', '/goals/reorder', {}],
+  'POST /work-categories': ['POST', '/work-categories', {}],
+  'PUT /versions/focus': ['PUT', '/versions/focus', { version_id: '   ' }],
+  'POST /autonomy/fence': ['POST', '/autonomy/fence', { enabled: 'yes' }],
+  'POST /autonomy/fence/goals': ['POST', '/autonomy/fence/goals', { goal_id: 0 }],
+  'DELETE /autonomy/fence/goals/:goalId': ['DELETE', `/autonomy/fence/goals/${BAD}`],
+  'POST /autonomy/fence/priority': ['POST', '/autonomy/fence/priority', {}],
+  'POST /autonomy/builders/:builderId/pause': ['POST', `/autonomy/builders/${BAD}/pause`, { paused: false }],
+  'POST /done-when/:criterionId/satisfy': ['POST', `/done-when/${BAD}/satisfy`, {}],
+  'POST /done-when/:criterionId/unsatisfy': ['POST', `/done-when/${BAD}/unsatisfy`, {}],
+  'POST /gate-approvals/:pr/approve': ['POST', `/gate-approvals/${BAD}/approve`, {}],
+  'POST /override-requests/:id/decide': ['POST', `/override-requests/${BAD}/decide`, { decision: 'approve' }],
+  'POST /provisioning/instances/:id/core-upgrade': ['POST', `/provisioning/instances/${BAD}/core-upgrade`, { to: '1.2.3' }],
+  'POST /provisioning/instances/:id/update-channel': ['POST', `/provisioning/instances/${BAD}/update-channel`, { channel: 'nightly' }],
+  'POST /render-deploy/act': ['POST', '/render-deploy/act', { action: 'launch' }],
+  'POST /npm-release/release': ['POST', '/npm-release/release', { version: 'v-next' }],
+  'PATCH /builders/:id/budget': ['PATCH', `/builders/${BAD}/budget`, { monthly_budget_usd: 5 }],
+};
+
+test('every listed route has a request in this test (a new act cannot go unexercised)', () => {
+  const listed = dr.AREAS.flatMap((a) => a.acts).sort();
+  assert.deepEqual(Object.keys(REQUESTS).sort(), listed);
+});
+
+const sitting = (area, rule = 'majority') => ({ area, decided_by: 'rank:council', rule, who: null, set_by_item_id: '30' });
+
+let peopleWrites = 0;
+const PEOPLE_DB = {
+  getRankByKey: async (k) => ({ rank_key: k, is_system: false, seeded_rank: null }),
+  assignRank: async () => { peopleWrites += 1; return true; },
+  unassignRank: async () => { peopleWrites += 1; return true; },
+};
+
+for (const a of dr.AREAS.filter((x) => x.acts.length)) {
+  test(`${a.name}: while a vote decides it, every direct route refuses one builder acting alone; as today each reaches its handler`, async () => {
+    peopleWrites = 0;
+    // A sitting at THIS building only: the refusal is the building's own row.
+    await stub(govDb, { ...PEOPLE_DB, listDecisionRules: async () => [sitting(a.key)], builderHoldsRankActive: async () => true }, async () => {
+      for (const act of a.acts) {
+        const [method, p, body] = REQUESTS[act];
+        const r = await call(method, p, body);
+        assert.equal(r.status, 409, `${act} under a vote → 409 (got ${r.status} ${JSON.stringify(r.json)})`);
+        assert.equal(r.json.error.code, 'decided_by_sitting', act);
+        const d = r.json.error.details || r.json.error;
+        assert.equal(d.area, a.key, `${act} names its own building`);
+        assert.equal(d.open_with, 'POST /government/board/matters', `${act} points at the sitting`);
+      }
+    });
+    assert.equal(peopleWrites, 0, 'nothing was written under the vote');
+    // Another building's sitting says nothing here, and with no row at all the
+    // route is exactly today's: its own handler answers (its own first check,
+    // or — for People's stubbed assignments — the write itself).
+    for (const rows of [[], [sitting(a.key === 'rules' ? 'planning' : 'rules')]]) {
+      await stub(govDb, { ...PEOPLE_DB, listDecisionRules: async () => rows, builderHoldsRankActive: async () => true }, async () => {
+        for (const act of a.acts) {
+          const [method, p, body] = REQUESTS[act];
+          const r = await call(method, p, body);
+          assert.notEqual(r.json && r.json.error && r.json.error.code, 'decided_by_sitting', `${act} as today`);
+          const ok = act.includes('/government/assignments') ? r.status < 300 : (r.status >= 400 && r.status < 500 && r.status !== 403);
+          assert.ok(ok, `${act} as today reaches its handler (got ${r.status} ${JSON.stringify(r.json)})`);
+        }
+      });
+    }
+  });
+}
+
+test('decide alone: a member the row seats may still act alone; one it does not seat may not', async () => {
+  const [method, p, body] = REQUESTS['PATCH /builders/:id/budget'];
+  await stub(govDb, { listDecisionRules: async () => [sitting('treasury', 'decide')], builderHoldsRankActive: async () => true }, async () => {
+    assert.equal((await call(method, p, body)).status, 400, 'seated: through to the handler (bad id)');
+  });
+  await stub(govDb, { listDecisionRules: async () => [sitting('treasury', 'decide')], builderHoldsRankActive: async () => false }, async () => {
+    assert.equal((await call(method, p, body)).status, 409, 'not seated: refused');
+  });
+});
+
+test('the check is cheap on the hot path: one table read, and no config-file read for any building\'s route', async () => {
+  let reads = 0;
+  let queries = 0;
+  const realRead = fs.readFileSync;
+  fs.readFileSync = (...args) => { reads += 1; return realRead(...args); };
+  try {
+    await stub(govDb, { listDecisionRules: async () => { queries += 1; return [sitting('review')]; }, builderHoldsRankActive: async () => true }, async () => {
+      for (const area of dr.AREA_KEYS.filter((k) => k !== 'charter')) await board.checkActAlone(area, '42');
+    });
+  } finally {
+    fs.readFileSync = realRead;
+  }
+  assert.equal(reads, 0, 'no synchronous file read per request (config.js is boot-only)');
+  assert.equal(queries, dr.AREA_KEYS.length - 1, 'one table read per check');
+  await stub(govDb, { listDecisionRules: async () => [sitting('review')] }, async () => {
+    assert.equal((await board.checkActAlone('review', '42')).ok, false, 'and the answer is unchanged');
+    assert.equal((await board.checkActAlone('rules', '42')).ok, true);
+    assert.equal((await board.checkActAlone('nowhere', '42')).reason, 'unknown_area');
+  });
+});
+
+test('an unreadable table refuses a building\'s route 503 — never waved through', async () => {
+  await stub(govDb, { listDecisionRules: async () => { throw new Error('db down'); } }, async () => {
+    const [method, p, body] = REQUESTS['POST /goals'];
+    const r = await call(method, p, body);
+    assert.equal(r.status, 503);
+    assert.equal(r.json.error.code, 'decision_rule_unreadable');
+  });
+});
+
+// ── 4. not a lone act ───────────────────────────────────────────────────────
+
+const autoDb = require(path.join(ROOT, 'modules', 'autonomy', 'db.js'));
+
+test('the brake is never refused: the fence switched OFF and one runner paused, while a vote decides Automation', async () => {
+  const wrote = [];
+  await stub(autoDb, {
+    setFenceEnabled: async (a) => { wrote.push(['fence', a.enabled]); return { enabled: a.enabled }; },
+    setBuilderPause: async (a) => { wrote.push(['pause', a.paused]); return { builder_id: a.builderId, paused: a.paused }; },
+  }, async () => {
+    await stub(govDb, { listDecisionRules: async () => [sitting('automation', 'unanimous')], builderHoldsRankActive: async () => true }, async () => {
+      assert.equal((await call('POST', '/autonomy/fence', { enabled: false, reason: 'stop' })).status, 200);
+      assert.equal((await call('POST', '/autonomy/builders/7/pause', { paused: true })).status, 200);
+      assert.equal((await call('POST', '/autonomy/fence', { enabled: true })).status, 409, 'switching it ON is a decision');
+      assert.equal((await call('POST', '/autonomy/builders/7/pause', { paused: false })).status, 409, 'resuming is a decision');
+    });
+  });
+  assert.deepEqual(wrote, [['fence', false], ['pause', true]]);
+});
+
+test('a dry run of the pin move only reads, so it is not refused under a vote', async () => {
+  await stub(govDb, { listDecisionRules: async () => [sitting('release')], builderHoldsRankActive: async () => true }, async () => {
+    const r = await call('POST', `/provisioning/instances/${BAD}/core-upgrade`, { to: '1.2.3', dry_run: true });
+    assert.notEqual(r.json && r.json.error && r.json.error.code, 'decided_by_sitting');
+    assert.equal((await call('POST', `/provisioning/instances/${BAD}/core-upgrade`, { to: '1.2.3' })).status, 409, 'the real move is');
+  });
+});
+
+test('a PASSED matter\'s act is the sitting itself: it runs while the gate would refuse every lone act', async () => {
+  const decisionBoard = require(path.join(GOV, 'decision-board.js'));
+  require(path.join(ROOT, 'modules', 'autonomy', 'matter-acts.js')).contributeAutomationMatterActs();
+  const wrote = [];
+  await stub(autoDb, { setFenceEnabled: async (a) => { wrote.push(a.enabled); return { enabled: a.enabled }; } }, async () => {
+    await stub(govDb, {
+      listDecisionRules: async () => dr.AREA_KEYS.filter((k) => k !== 'charter').map((k) => sitting(k, 'unanimous')),
+      builderHoldsRankActive: async () => true,
+      getMatter: async () => ({ id: '8', area: 'automation', title: 'Switch it on', action: { type: 'switch_on' }, proposed_by: '7' }),
+    }, async () => {
+      // the direct route is refused …
+      assert.equal((await call('POST', '/autonomy/fence', { enabled: true })).status, 409);
+      // … and the passed matter still acts, through the owning module's act
+      const out = await decisionBoard.actOnPassedMatter({ id: '40', subject_type: 'automation_matter', subject_id: '8', outcome: 'passed' });
+      assert.equal(out.result.done, true, JSON.stringify(out.result));
+    });
+  });
+  assert.deepEqual(wrote, [true], 'only the passed matter switched it');
+});
+
+test('a PASSED Treasury matter sets the limit (core\'s act) while the budget route refuses a lone act', async () => {
+  const decisionBoard = require(path.join(GOV, 'decision-board.js'));
+  require(path.join(ROOT, 'src', 'bongos', 'routes', 'builders.js'))(); // contributes the Treasury act, as at boot
+  const set = [];
+  seams.registerProvider('reward', { setBuilderMonthlyBudget: async (id, usd) => { set.push([id, usd]); return { id, monthly_budget_usd: usd }; } });
+  try {
+    await stub(govDb, {
+      listDecisionRules: async () => [sitting('treasury', 'unanimous')],
+      builderHoldsRankActive: async () => true,
+      getMatter: async () => ({ id: '9', area: 'treasury', title: 'Lu gets $50 a month', action: { type: 'set_budget', builder_id: 7, monthly_usd: 50 }, proposed_by: '7' }),
+    }, async () => {
+      assert.equal((await call('PATCH', '/builders/7/budget', { monthly_budget_usd: 50 })).status, 409, 'the lone act is refused');
+      const out = await decisionBoard.actOnPassedMatter({ id: '41', subject_type: 'treasury_matter', subject_id: '9', outcome: 'passed' });
+      assert.equal(out.result.done, true, JSON.stringify(out.result));
+    });
+  } finally {
+    seams._reset();
+    registerMainPort();
+  }
+  assert.deepEqual(set, [[7, 50]], 'only the passed matter wrote the limit');
+});

package/tests/module_api.mjs

@@ -22,6 +22,7 @@ const PUBLISHED_SURFACE = [
   'CORE_VERSION',
   'requireBuilder', 'requireRank', 'rankMeetsThreshold', 'requireBfgPrincipal', 'allowBoxScope', 'resolveSession',
   'requirePermission', // BV1.R105: the authority-atom gate module routes migrate onto (1.19.0; ADR 0151)
+  'requireActAlone', // added by task 1004657 (ADR 0363 D5): a building's own page asks its decision-rules row before one builder acts alone. On the doorway because eight buildings' pages live in six modules and core, and each must refuse the same way People does
   'pool', 'getPool', 'instanceDbName', 'withTx', 'getBuilderById',
   // added by task 1003575 (ADR 0241 §3): the instance's PROJECT OWNER — its first
   // admitted human builder. Kernel identity like getBuilderById beside it, and

package/tests/npm_release_release.mjs

@@ -180,7 +180,8 @@ test('the route is gated like the deploy page (core.pin.move), never by rank', (
   const router = buildRouter();
   const layer = router.stack.find((l) => l.route && l.route.path === '/npm-release/release');
   assert.ok(layer.route.methods.post);
-  assert.equal(layer.route.stack.length, 3, 'requireBuilder, the permission gate, then the handler');
+  assert.equal(layer.route.stack.length, 4, 'requireBuilder, the permission gate, Release\'s decision rule (task 1004657), then the handler');
+  assert.equal(layer.route.stack[2].handle.name, 'actAloneGate');
   const src = fs.readFileSync(new URL('../modules/npm-release/routes/release.js', import.meta.url), 'utf8');
   assert.match(src, /api\.requireBuilder,\s*\n\s*api\.requirePermission\('core\.pin\.move'\)/);
   assert.doesNotMatch(src, /api\.requireRank\(/);

package/tests/ship_mode.mjs

@@ -114,7 +114,8 @@ test('GET /project-settings/ship-mode is open to any signed-in builder, not gate
     const names = route('get', '/project-settings/ship-mode').stack.map((l) => l.name);
     assert.equal(names.length, 2, 'requireBuilder + the handler, and no permission gate');
     const write = route('patch', '/project-settings/ship-mode').stack;
-    assert.equal(write.length, 3, 'the write carries requireBuilder + the settings permission + the handler');
+    assert.equal(write.length, 4, 'the write carries requireBuilder + the settings permission + Rules\' decision rule (task 1004657) + the handler');
+    assert.equal(write[2].handle.name, 'actAloneGate');
   } finally { restore(); }
 });