@bongos/core 1.21.92 → 1.21.94

package/tests/government_act_alone_buildings.mjs

@@ -0,0 +1,430 @@
+// tests/government_act_alone_buildings.mjs — "decide by vote" binds on EVERY
+// building's own pages, not only People's (task 1004657, goal 1000111; ADR 0363
+// D5 and its Consequences).
+//
+// What this pins:
+//   1. THE GATE (src/bongos/act-alone.js, on the doorway as requireActAlone):
+//      as today it lets the request through; while the row names a sitting it
+//      refuses with People's exact shape (409 decided_by_sitting + area, rule,
+//      who, what_this_means, open_with); no government module → as today; an
+//      unreadable table → 503, fail-closed, like People.
+//   2. THE RECORD (decision-rules AREAS[].acts) matches the source BOTH WAYS:
+//      every listed route mounts the gate for its building, and every mounted
+//      gate is listed. The charter says why it has no direct route.
+//   3. EVERY BUILDING, THROUGH ITS REAL ROUTER, with the real permission gate
+//      and the real checkActAlone over a stubbed table: each listed route is
+//      refused while its building is a sitting and reaches its handler as today.
+//   4. NOT A LONE ACT: a brake (fence off, pause), a dry run, and a passed
+//      matter's act (which never passes through a route) are never refused.
+//
+// DB-free: the government table read and every write are stubbed by property.
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+
+const api = require(path.join(ROOT, 'src', 'module-api.js'));
+const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
+const authMod = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
+const { requireActAlone } = require(path.join(ROOT, 'src', 'bongos', 'act-alone.js'));
+const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
+const dr = require(path.join(GOV, 'decision-rules.js'));
+const board = require(path.join(GOV, 'board.js'));
+const govDb = require(path.join(GOV, 'db.js'));
+const express = require('express');
+
+async function stub(obj, stubs, fn) {
+  const originals = {};
+  for (const [k, v] of Object.entries(stubs)) { originals[k] = obj[k]; obj[k] = v; }
+  try { return await fn(); } finally { for (const [k, v] of Object.entries(originals)) obj[k] = v; }
+}
+
+// ── 1. the gate itself ──────────────────────────────────────────────────────
+
+function fakeRes() {
+  const res = { failed: null };
+  res.fail = (code, a, b) => { res.failed = { code, a, b }; return res; };
+  return res;
+}
+async function runGate(gate, req = { builder: { id: 42 }, body: {} }) {
+  const res = fakeRes();
+  let passed = false;
+  await gate(req, res, () => { passed = true; });
+  return { passed, failed: res.failed };
+}
+async function withPort(port, fn) {
+  seams._reset();
+  if (port) seams.registerProvider('government', port);
+  try { return await fn(); } finally { seams._reset(); registerMainPort(); }
+}
+// The port the routers below are driven through (section 3); restored after
+// each gate test swaps in its own.
+const ATOMS = [
+  'autonomy.fence.manage', 'criterion.satisfy', 'criterion.unsatisfy', 'gate_approval.decide', 'override_request.decide',
+  'core.pin.move', 'builder.budget.set', 'goal.create', 'goal.reorder', 'version.focus.set', 'project.settings.manage',
+  'security.report.adjudicate', 'access_request.review', 'government.manage',
+];
+function registerMainPort() {
+  seams.registerProvider('government', { resolveBuilderPermissions: async () => ATOMS, checkActAlone: board.checkActAlone });
+}
+
+test('the gate: no government module, or a port without the check, is as today', async () => {
+  await withPort(null, async () => assert.equal((await runGate(requireActAlone('release'))).passed, true));
+  await withPort({ resolveBuilderPermissions: async () => [] }, async () => assert.equal((await runGate(requireActAlone('release'))).passed, true));
+});
+
+test('the gate: as today passes, asking for the named building and the live builder', async () => {
+  const asked = [];
+  await withPort({ checkActAlone: async (area, id) => { asked.push([area, id]); return { ok: true }; } }, async () => {
+    assert.equal((await runGate(requireActAlone('treasury'))).passed, true);
+  });
+  assert.deepEqual(asked, [['treasury', 42]]);
+});
+
+test('the gate: a sitting refuses in People\'s exact shape, naming the matter route', async () => {
+  const refusal = { ok: false, reason: 'decided_by_sitting', area: 'review', rule: 'majority', who: 'the council', what_this_means: 'Review is decided by the council (majority vote). Put it to them as a matter instead.', open_with: 'POST /government/board/matters' };
+  await withPort({ checkActAlone: async () => refusal }, async () => {
+    const out = await runGate(requireActAlone('review'));
+    assert.equal(out.passed, false);
+    assert.deepEqual(out.failed, { code: 'decided_by_sitting', a: 409, b: { area: 'review', rule: 'majority', who: 'the council', what_this_means: refusal.what_this_means, open_with: 'POST /government/board/matters' } });
+  });
+});
+
+test('the gate: an unreadable table, or an answer it does not know, refuses 503 — fail-closed like People', async () => {
+  await withPort({ checkActAlone: async () => { throw new Error('db down'); } }, async () => {
+    const out = await runGate(requireActAlone('rules'));
+    assert.equal(out.passed, false);
+    assert.equal(out.failed.code, 'decision_rule_unreadable');
+    assert.equal(out.failed.a.status, 503);
+  });
+  await withPort({ checkActAlone: async () => ({ ok: false, reason: 'unknown_area' }) }, async () => {
+    const out = await runGate(requireActAlone('nowhere'));
+    assert.equal(out.passed, false);
+    assert.equal(out.failed.code, 'decision_rule_unreadable');
+  });
+});
+
+test('the gate: `unless` lets a non-decision through without asking; a bad call is refused at mount', async () => {
+  let asked = 0;
+  await withPort({ checkActAlone: async () => { asked += 1; return { ok: false, reason: 'decided_by_sitting' }; } }, async () => {
+    const out = await runGate(requireActAlone('automation', { unless: (req) => req.body.enabled === false }), { builder: { id: 1 }, body: { enabled: false } });
+    assert.equal(out.passed, true);
+  });
+  assert.equal(asked, 0);
+  assert.throws(() => requireActAlone(''), TypeError);
+  assert.throws(() => requireActAlone('rules', { unless: true }), TypeError);
+  assert.equal(api.requireActAlone, requireActAlone, 'modules reach it through the doorway');
+});
+
+// ── 2. the record matches the source, both ways ─────────────────────────────
+
+function routeFiles() {
+  const out = [];
+  for (const dir of [path.join(ROOT, 'src', 'bongos', 'routes'), ...fs.readdirSync(path.join(ROOT, 'modules')).map((m) => path.join(ROOT, 'modules', m, 'routes'))]) {
+    if (!fs.existsSync(dir)) continue;
+    for (const f of fs.readdirSync(dir)) if (f.endsWith('.js')) out.push(path.join(dir, f));
+  }
+  return out;
+}
+const SOURCES = routeFiles().map((f) => ({ file: path.relative(ROOT, f), src: fs.readFileSync(f, 'utf8') }));
+const REG_RE = /router\.(get|post|put|patch|delete)\(\s*'([^']+)'/g;
+
+// The middleware text of one registration: from `router.x('path'` to its handler.
+function registration(act) {
+  const [method, p] = act.split(' ');
+  const hits = [];
+  for (const { file, src } of SOURCES) {
+    for (const m of src.matchAll(REG_RE)) {
+      if (m[1].toUpperCase() !== method || m[2] !== p) continue;
+      const rest = src.slice(m.index);
+      const end = Math.min(...['(req, res', 'Handler('].map((s) => { const i = rest.indexOf(s); return i === -1 ? Infinity : i; }));
+      hits.push({ file, head: rest.slice(0, end), body: rest.slice(0, 3000) });
+    }
+  }
+  return hits;
+}
+
+test('the record: every building but the charter has direct routes; the charter says why it has none', () => {
+  for (const a of dr.AREAS) {
+    if (a.key === 'charter') {
+      assert.equal(a.acts.length, 0);
+      assert.match(a.no_direct_route, /amend/);
+      assert.equal(dr.resolveAll([]).find((r) => r.area === 'charter').no_direct_route, a.no_direct_route, 'the record rides the table view');
+    } else {
+      assert.ok(a.acts.length > 0, `${a.key} lists its direct routes`);
+    }
+  }
+});
+
+test('the record → the source: every listed route mounts its own building\'s gate', () => {
+  for (const a of dr.AREAS) {
+    for (const act of a.acts) {
+      const hits = registration(act);
+      assert.equal(hits.length, 1, `${act} is registered exactly once (${hits.map((h) => h.file)})`);
+      const { head, body } = hits[0];
+      const mounted = head.includes(`requireActAlone('${a.key}'`);
+      const inModule = a.key === 'people' && /peopleMayActAlone\(req, res\)/.test(body);
+      assert.ok(mounted || inModule, `${act} (${hits[0].file}) defers to the ${a.key} row`);
+      if (mounted) assert.ok(head.indexOf('requireActAlone') > head.search(/requirePermission|requireOwnProjectOrPin/), `${act}: the permission gate stays first`);
+    }
+  }
+});
+
+test('the source → the record: every mounted gate is listed under the building it names', () => {
+  let seen = 0;
+  for (const { file, src } of SOURCES) {
+    for (const m of src.matchAll(/requireActAlone\('([a-z]+)'/g)) {
+      const before = [...src.slice(0, m.index).matchAll(REG_RE)].pop();
+      assert.ok(before, `${file}: requireActAlone outside a route registration`);
+      const act = `${before[1].toUpperCase()} ${before[2]}`;
+      const area = dr.areaByKey(m[1]);
+      assert.ok(area, `${file}: requireActAlone('${m[1]}') names no building`);
+      assert.ok(area.acts.includes(act), `${act} mounts the ${m[1]} gate but is not in decision-rules AREAS.${m[1]}.acts`);
+      seen += 1;
+    }
+  }
+  const listed = dr.AREAS.reduce((n, a) => n + a.acts.length, 0) - 2; // People's two assignments ask in-module
+  assert.equal(seen, listed, 'one mounted gate per listed route');
+});
+
+// ── 3. every building, through its real router ──────────────────────────────
+
+const fakeBuilder = (req, res, next) => { req.builder = { id: 42, rank: 'archon', github_login: 'someone' }; next(); };
+const realApiRequireBuilder = api.requireBuilder;
+const realAuthRequireBuilder = authMod.requireBuilder;
+api.requireBuilder = fakeBuilder;
+authMod.requireBuilder = fakeBuilder;
+seams._reset();
+registerMainPort();
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+for (const rel of [
+  'modules/autonomy/routes/autonomy.js',
+  'modules/lifecycle/routes/done-when.js',
+  'modules/lifecycle/routes/gate-approvals.js',
+  'modules/lifecycle/routes/tasks.js',
+  'modules/lifecycle/routes/goals.js',
+  'modules/lifecycle/routes/versions.js',
+  'modules/lifecycle/routes/project-settings.js',
+  'modules/render-deploy/routes/act.js',
+  'modules/npm-release/routes/release.js',
+  'modules/provisioning/routes/core-upgrade.js',
+  'src/bongos/routes/builders.js',
+  'modules/security/routes/reports.js',
+  'modules/onboarding/routes/access-requests.js',
+  'modules/government/routes/government.js',
+]) app.use(require(path.join(ROOT, rel))());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const BASE = `http://127.0.0.1:${server.address().port}`;
+after(() => { server.close(); api.requireBuilder = realApiRequireBuilder; authMod.requireBuilder = realAuthRequireBuilder; seams._reset(); });
+
+async function call(method, p, body) {
+  const res = await fetch(`${BASE}${p}`, { method, headers: body === undefined ? {} : { 'content-type': 'application/json' }, body: body === undefined ? undefined : JSON.stringify(body) });
+  let json = null; try { json = await res.json(); } catch { /* none */ }
+  return { status: res.status, json };
+}
+
+// Each listed route as a request that, AS TODAY, stops in its handler's own
+// first check (a bad id or body → 4xx) before any database write — so reaching
+// the handler is visible and nothing is written either way.
+const BAD = 'x';
+const REQUESTS = {
+  'PATCH /project-settings/rot-days': ['PATCH', '/project-settings/rot-days', { days: 'soon' }],
+  'PATCH /project-settings/ship-mode': ['PATCH', '/project-settings/ship-mode', { mode: 'sometimes' }],
+  'PATCH /work-categories/:id': ['PATCH', `/work-categories/${BAD}`, {}],
+  'POST /security/reports/:id/confirm': ['POST', `/security/reports/${BAD}/confirm`, {}],
+  'POST /security/reports/:id/dispute': ['POST', `/security/reports/${BAD}/dispute`, {}],
+  'POST /security/reports/:id/fix': ['POST', `/security/reports/${BAD}/fix`, {}],
+  // People's own two ask after their validation (task 1004529), so they carry a
+  // valid custom rank; the writes are stubbed (PEOPLE_DB) and counted.
+  'POST /government/assignments': ['POST', '/government/assignments', { builder_id: 7, rank_key: 'tester' }],
+  'DELETE /government/assignments/:builderId/:rankKey': ['DELETE', '/government/assignments/7/tester'],
+  'PATCH /access-requests/:id': ['PATCH', `/access-requests/${BAD}`, { status: 'invited' }],
+  'POST /access-requests/invite': ['POST', '/access-requests/invite', {}],
+  'POST /goals': ['POST', '/goals', {}],
+  'POST /goals/reorder': ['POST', '/goals/reorder', {}],
+  'POST /work-categories': ['POST', '/work-categories', {}],
+  'PUT /versions/focus': ['PUT', '/versions/focus', { version_id: '   ' }],
+  'POST /autonomy/fence': ['POST', '/autonomy/fence', { enabled: 'yes' }],
+  'POST /autonomy/fence/goals': ['POST', '/autonomy/fence/goals', { goal_id: 0 }],
+  'DELETE /autonomy/fence/goals/:goalId': ['DELETE', `/autonomy/fence/goals/${BAD}`],
+  'POST /autonomy/fence/priority': ['POST', '/autonomy/fence/priority', {}],
+  'POST /autonomy/builders/:builderId/pause': ['POST', `/autonomy/builders/${BAD}/pause`, { paused: false }],
+  'POST /done-when/:criterionId/satisfy': ['POST', `/done-when/${BAD}/satisfy`, {}],
+  'POST /done-when/:criterionId/unsatisfy': ['POST', `/done-when/${BAD}/unsatisfy`, {}],
+  'POST /gate-approvals/:pr/approve': ['POST', `/gate-approvals/${BAD}/approve`, {}],
+  'POST /override-requests/:id/decide': ['POST', `/override-requests/${BAD}/decide`, { decision: 'approve' }],
+  'POST /provisioning/instances/:id/core-upgrade': ['POST', `/provisioning/instances/${BAD}/core-upgrade`, { to: '1.2.3' }],
+  'POST /provisioning/instances/:id/update-channel': ['POST', `/provisioning/instances/${BAD}/update-channel`, { channel: 'nightly' }],
+  'POST /render-deploy/act': ['POST', '/render-deploy/act', { action: 'launch' }],
+  'POST /npm-release/release': ['POST', '/npm-release/release', { version: 'v-next' }],
+  'PATCH /builders/:id/budget': ['PATCH', `/builders/${BAD}/budget`, { monthly_budget_usd: 5 }],
+};
+
+test('every listed route has a request in this test (a new act cannot go unexercised)', () => {
+  const listed = dr.AREAS.flatMap((a) => a.acts).sort();
+  assert.deepEqual(Object.keys(REQUESTS).sort(), listed);
+});
+
+const sitting = (area, rule = 'majority') => ({ area, decided_by: 'rank:council', rule, who: null, set_by_item_id: '30' });
+
+let peopleWrites = 0;
+const PEOPLE_DB = {
+  getRankByKey: async (k) => ({ rank_key: k, is_system: false, seeded_rank: null }),
+  assignRank: async () => { peopleWrites += 1; return true; },
+  unassignRank: async () => { peopleWrites += 1; return true; },
+};
+
+for (const a of dr.AREAS.filter((x) => x.acts.length)) {
+  test(`${a.name}: while a vote decides it, every direct route refuses one builder acting alone; as today each reaches its handler`, async () => {
+    peopleWrites = 0;
+    // A sitting at THIS building only: the refusal is the building's own row.
+    await stub(govDb, { ...PEOPLE_DB, listDecisionRules: async () => [sitting(a.key)], builderHoldsRankActive: async () => true }, async () => {
+      for (const act of a.acts) {
+        const [method, p, body] = REQUESTS[act];
+        const r = await call(method, p, body);
+        assert.equal(r.status, 409, `${act} under a vote → 409 (got ${r.status} ${JSON.stringify(r.json)})`);
+        assert.equal(r.json.error.code, 'decided_by_sitting', act);
+        const d = r.json.error.details || r.json.error;
+        assert.equal(d.area, a.key, `${act} names its own building`);
+        assert.equal(d.open_with, 'POST /government/board/matters', `${act} points at the sitting`);
+      }
+    });
+    assert.equal(peopleWrites, 0, 'nothing was written under the vote');
+    // Another building's sitting says nothing here, and with no row at all the
+    // route is exactly today's: its own handler answers (its own first check,
+    // or — for People's stubbed assignments — the write itself).
+    for (const rows of [[], [sitting(a.key === 'rules' ? 'planning' : 'rules')]]) {
+      await stub(govDb, { ...PEOPLE_DB, listDecisionRules: async () => rows, builderHoldsRankActive: async () => true }, async () => {
+        for (const act of a.acts) {
+          const [method, p, body] = REQUESTS[act];
+          const r = await call(method, p, body);
+          assert.notEqual(r.json && r.json.error && r.json.error.code, 'decided_by_sitting', `${act} as today`);
+          const ok = act.includes('/government/assignments') ? r.status < 300 : (r.status >= 400 && r.status < 500 && r.status !== 403);
+          assert.ok(ok, `${act} as today reaches its handler (got ${r.status} ${JSON.stringify(r.json)})`);
+        }
+      });
+    }
+  });
+}
+
+test('decide alone: a member the row seats may still act alone; one it does not seat may not', async () => {
+  const [method, p, body] = REQUESTS['PATCH /builders/:id/budget'];
+  await stub(govDb, { listDecisionRules: async () => [sitting('treasury', 'decide')], builderHoldsRankActive: async () => true }, async () => {
+    assert.equal((await call(method, p, body)).status, 400, 'seated: through to the handler (bad id)');
+  });
+  await stub(govDb, { listDecisionRules: async () => [sitting('treasury', 'decide')], builderHoldsRankActive: async () => false }, async () => {
+    assert.equal((await call(method, p, body)).status, 409, 'not seated: refused');
+  });
+});
+
+test('the check is cheap on the hot path: one table read, and no config-file read for any building\'s route', async () => {
+  let reads = 0;
+  let queries = 0;
+  const realRead = fs.readFileSync;
+  fs.readFileSync = (...args) => { reads += 1; return realRead(...args); };
+  try {
+    await stub(govDb, { listDecisionRules: async () => { queries += 1; return [sitting('review')]; }, builderHoldsRankActive: async () => true }, async () => {
+      for (const area of dr.AREA_KEYS.filter((k) => k !== 'charter')) await board.checkActAlone(area, '42');
+    });
+  } finally {
+    fs.readFileSync = realRead;
+  }
+  assert.equal(reads, 0, 'no synchronous file read per request (config.js is boot-only)');
+  assert.equal(queries, dr.AREA_KEYS.length - 1, 'one table read per check');
+  await stub(govDb, { listDecisionRules: async () => [sitting('review')] }, async () => {
+    assert.equal((await board.checkActAlone('review', '42')).ok, false, 'and the answer is unchanged');
+    assert.equal((await board.checkActAlone('rules', '42')).ok, true);
+    assert.equal((await board.checkActAlone('nowhere', '42')).reason, 'unknown_area');
+  });
+});
+
+test('an unreadable table refuses a building\'s route 503 — never waved through', async () => {
+  await stub(govDb, { listDecisionRules: async () => { throw new Error('db down'); } }, async () => {
+    const [method, p, body] = REQUESTS['POST /goals'];
+    const r = await call(method, p, body);
+    assert.equal(r.status, 503);
+    assert.equal(r.json.error.code, 'decision_rule_unreadable');
+  });
+});
+
+// ── 4. not a lone act ───────────────────────────────────────────────────────
+
+const autoDb = require(path.join(ROOT, 'modules', 'autonomy', 'db.js'));
+
+test('the brake is never refused: the fence switched OFF and one runner paused, while a vote decides Automation', async () => {
+  const wrote = [];
+  await stub(autoDb, {
+    setFenceEnabled: async (a) => { wrote.push(['fence', a.enabled]); return { enabled: a.enabled }; },
+    setBuilderPause: async (a) => { wrote.push(['pause', a.paused]); return { builder_id: a.builderId, paused: a.paused }; },
+  }, async () => {
+    await stub(govDb, { listDecisionRules: async () => [sitting('automation', 'unanimous')], builderHoldsRankActive: async () => true }, async () => {
+      assert.equal((await call('POST', '/autonomy/fence', { enabled: false, reason: 'stop' })).status, 200);
+      assert.equal((await call('POST', '/autonomy/builders/7/pause', { paused: true })).status, 200);
+      assert.equal((await call('POST', '/autonomy/fence', { enabled: true })).status, 409, 'switching it ON is a decision');
+      assert.equal((await call('POST', '/autonomy/builders/7/pause', { paused: false })).status, 409, 'resuming is a decision');
+    });
+  });
+  assert.deepEqual(wrote, [['fence', false], ['pause', true]]);
+});
+
+test('a dry run of the pin move only reads, so it is not refused under a vote', async () => {
+  await stub(govDb, { listDecisionRules: async () => [sitting('release')], builderHoldsRankActive: async () => true }, async () => {
+    const r = await call('POST', `/provisioning/instances/${BAD}/core-upgrade`, { to: '1.2.3', dry_run: true });
+    assert.notEqual(r.json && r.json.error && r.json.error.code, 'decided_by_sitting');
+    assert.equal((await call('POST', `/provisioning/instances/${BAD}/core-upgrade`, { to: '1.2.3' })).status, 409, 'the real move is');
+  });
+});
+
+test('a PASSED matter\'s act is the sitting itself: it runs while the gate would refuse every lone act', async () => {
+  const decisionBoard = require(path.join(GOV, 'decision-board.js'));
+  require(path.join(ROOT, 'modules', 'autonomy', 'matter-acts.js')).contributeAutomationMatterActs();
+  const wrote = [];
+  await stub(autoDb, { setFenceEnabled: async (a) => { wrote.push(a.enabled); return { enabled: a.enabled }; } }, async () => {
+    await stub(govDb, {
+      listDecisionRules: async () => dr.AREA_KEYS.filter((k) => k !== 'charter').map((k) => sitting(k, 'unanimous')),
+      builderHoldsRankActive: async () => true,
+      getMatter: async () => ({ id: '8', area: 'automation', title: 'Switch it on', action: { type: 'switch_on' }, proposed_by: '7' }),
+    }, async () => {
+      // the direct route is refused …
+      assert.equal((await call('POST', '/autonomy/fence', { enabled: true })).status, 409);
+      // … and the passed matter still acts, through the owning module's act
+      const out = await decisionBoard.actOnPassedMatter({ id: '40', subject_type: 'automation_matter', subject_id: '8', outcome: 'passed' });
+      assert.equal(out.result.done, true, JSON.stringify(out.result));
+    });
+  });
+  assert.deepEqual(wrote, [true], 'only the passed matter switched it');
+});
+
+test('a PASSED Treasury matter sets the limit (core\'s act) while the budget route refuses a lone act', async () => {
+  const decisionBoard = require(path.join(GOV, 'decision-board.js'));
+  require(path.join(ROOT, 'src', 'bongos', 'routes', 'builders.js'))(); // contributes the Treasury act, as at boot
+  const set = [];
+  seams.registerProvider('reward', { setBuilderMonthlyBudget: async (id, usd) => { set.push([id, usd]); return { id, monthly_budget_usd: usd }; } });
+  try {
+    await stub(govDb, {
+      listDecisionRules: async () => [sitting('treasury', 'unanimous')],
+      builderHoldsRankActive: async () => true,
+      getMatter: async () => ({ id: '9', area: 'treasury', title: 'Lu gets $50 a month', action: { type: 'set_budget', builder_id: 7, monthly_usd: 50 }, proposed_by: '7' }),
+    }, async () => {
+      assert.equal((await call('PATCH', '/builders/7/budget', { monthly_budget_usd: 50 })).status, 409, 'the lone act is refused');
+      const out = await decisionBoard.actOnPassedMatter({ id: '41', subject_type: 'treasury_matter', subject_id: '9', outcome: 'passed' });
+      assert.equal(out.result.done, true, JSON.stringify(out.result));
+    });
+  } finally {
+    seams._reset();
+    registerMainPort();
+  }
+  assert.deepEqual(set, [[7, 50]], 'only the passed matter wrote the limit');
+});

package/tests/module_api.mjs

@@ -22,6 +22,7 @@ const PUBLISHED_SURFACE = [
   'CORE_VERSION',
   'requireBuilder', 'requireRank', 'rankMeetsThreshold', 'requireBfgPrincipal', 'allowBoxScope', 'resolveSession',
   'requirePermission', // BV1.R105: the authority-atom gate module routes migrate onto (1.19.0; ADR 0151)
+  'requireActAlone', // added by task 1004657 (ADR 0363 D5): a building's own page asks its decision-rules row before one builder acts alone. On the doorway because eight buildings' pages live in six modules and core, and each must refuse the same way People does
   'pool', 'getPool', 'instanceDbName', 'withTx', 'getBuilderById',
   // added by task 1003575 (ADR 0241 §3): the instance's PROJECT OWNER — its first
   // admitted human builder. Kernel identity like getBuilderById beside it, and

package/tests/npm_release_release.mjs

@@ -180,7 +180,8 @@ test('the route is gated like the deploy page (core.pin.move), never by rank', (
   const router = buildRouter();
   const layer = router.stack.find((l) => l.route && l.route.path === '/npm-release/release');
   assert.ok(layer.route.methods.post);
-  assert.equal(layer.route.stack.length, 3, 'requireBuilder, the permission gate, then the handler');
+  assert.equal(layer.route.stack.length, 4, 'requireBuilder, the permission gate, Release\'s decision rule (task 1004657), then the handler');
+  assert.equal(layer.route.stack[2].handle.name, 'actAloneGate');
   const src = fs.readFileSync(new URL('../modules/npm-release/routes/release.js', import.meta.url), 'utf8');
   assert.match(src, /api\.requireBuilder,\s*\n\s*api\.requirePermission\('core\.pin\.move'\)/);
   assert.doesNotMatch(src, /api\.requireRank\(/);

package/tests/projects_hub_dns_ready.mjs

@@ -165,7 +165,8 @@ test('every door to the address on the page asks addressReady', () => {
   const SCRIPT = HUB;
   assert.match(SCRIPT, /inst\.status === 'active' && addressReady\(inst\)\) acts\.push\('<a class="btn small ghost" href="https:\/\/' \+ esc\(inst\.domain\) \+ '" target="_blank" rel="noopener">View<\/a>'\)/, 'the row\'s View');
   assert.match(SCRIPT, /inst\.status === 'active' && addressReady\(inst\)\) acts\.push\('<a class="btn small ghost" href="https:\/\/' \+ esc\(inst\.domain\) \+ '" target="_blank" rel="noopener">Open site →<\/a>'\)/, 'the manage page\'s Open site');
-  assert.match(SCRIPT, /live\.instStatus !== 'active' \|\| !live\.addrReady \|\| live\.manifest !== 'done'/, 'first sign-in and the hall step stay locked');
+  // task 1004649: "Builders can sign in" opens its door only on a resolving address
+  assert.match(SCRIPT, /var open = live\.instStatus === 'active' && live\.addrReady;\n\s*return '<li class="sdone" data-onboard-step="first-sign-in">/, 'the sign-in step\'s door waits for the address');
   assert.match(SCRIPT, /live\.addrReady = addressReady\(inst\); renderSteps\(\);/, 'and unlock on the tick the lookup answers');
   assert.equal((SCRIPT.match(/inst\.status !== 'active' \|\| !addressReady\(inst\)\) \{ (vis|join)Runs\(''\); return; \}/g) || []).length, 2,
     'the browser\'s own manifest reads wait for the name too');

package/tests/projects_hub_pre_uat.mjs

@@ -185,14 +185,18 @@ test('the 33-minute hand-off keeps a snag honest and keeps its flow', () => {
   assert.match(SCRIPT, /progressMarkup\(1, 1, m\.slice\(5\), 'isErr', watchFlow\)/, 'the session-expiry message keeps its flow too');
 });
 
-test('First sign-in and Enter your builders hall unlock only when the project answers AND sign-in is wired', () => {
+test('"Builders can sign in" ticks on verified sign-in, and its door opens only when the project answers (task 1004649)', () => {
+  // the one-page checklist (task 1004649): the step's tick is the server's 'done';
+  // the door to the project still waits for a resolving address (task 1004505)
   const first = fn('renderStepFirstSignIn');
+  assert.match(first, /<b>Builders can sign in<\/b>/);
+  assert.match(first, /if \(live\.manifest !== 'done'\) \{\n\s*return '<li class="slocked"/, 'locked until the platform has seen sign-in work');
+  assert.match(first, /var open = live\.instStatus === 'active' && live\.addrReady;/, 'the door gates on status and a resolving address');
+  assert.match(first, /\(open \? '<a class="ghbtn" href="https:\/\/' \+ esc\(domain\)/, 'and only then links the address');
+  // the hall is the "is alive" block's way in; the step survives only for the local hall
   const hall = fn('renderStepEnterHall');
-  for (const [name, body] of [['first-sign-in', first], ['enter-hall', hall]]) {
-    assert.match(body, /live\.instStatus !== 'active' \|\| !live\.addrReady \|\| live\.manifest !== 'done'/, `${name} gates on status, a resolving address (task 1004505) and sign-in`);
-    assert.match(body, /class="slocked"/, `${name} has a locked rendering`);
-  }
-  assert.match(first, /Unlocks once your project is answering and sign-in above is wired/);
+  assert.match(hall, /if \(domain\) return '';/);
+  assert.match(hall, /bongos dev/);
 });
 
 test('the domainless build is standing, not "Live"', () => {
@@ -208,7 +212,7 @@ test('the fallback checklist carries every human step the canonical plan has', (
 test('the manifest step acknowledges code_received, offers a restart after a stall, and rides the CREATED record', () => {
   // 'converting' is the same stage — it used to fall through to "waiting for approval" (task 1004572)
   assert.match(SCRIPT, /if \(live\.manifest === 'code_received' \|\| live\.manifest === 'converting'\)/, 'GitHub’s half is acknowledged');
-  assert.match(SCRIPT, /GitHub’s part is done/);
+  assert.match(SCRIPT, /Approved on GitHub\. The platform is placing the app’s keys on your project/);
   assert.match(SCRIPT, /manifestStale \? '<button type="button" class="linklike" data-action="manifest-start">/, 'a stalled wait gets a restart door');
   assert.match(SCRIPT, /\(Date\.now\(\) - manifestStartedAt\) > 90000/, 'after ~90 seconds');
   assert.match(SCRIPT, /function rememberManifest\(stateToken, status, appSlug\)/);
@@ -610,10 +614,14 @@ test('teardown copy is state-aware: a queued project is told nothing was built',
 
 test('founder voice on the Device Flow step and the manual OAuth fallback', () => {
   const df = fn('renderStepDeviceFlow');
-  assert.equal((df.match(/<b>Let builders sign in from a command line — one checkbox<\/b>/g) || []).length, 2, 'both branches carry the outcome-first title');
+  // the mockup's words (task 1004649): one title, in every branch
+  assert.match(df, /var title = '<b>Command-line sign-in is on<\/b>';/, 'the outcome-first title');
   assert.doesNotMatch(df, /<b>Enable Device Flow — one checkbox<\/b>/);
   assert.match(df, /the <code style="font-family:var\(--font-mono\)">bongos setup<\/code> command builders run on their own machine/, 'the command is glossed, not bare-coded');
-  assert.doesNotMatch(df, /Optional/, 'not optional — a manifest-born App has Device Flow off');
+  // GitHub has no manifest field and no API for device flow (task 1004649's spike), so the
+  // step is OPTIONAL by design and never holds the project back
+  assert.equal((df.match(/Optional — turn it on later\./g) || []).length, 2, 'the not-yet branches say it is optional');
+  assert.equal((df.match(/class="[^"]*soptional/g) || []).length, 3, 'every branch is marked optional, so "connected" never waits on it');
   assert.equal((df.match(/<strong>Enable Device Flow<\/strong>/g) || []).length, 2, 'GitHub’s own checkbox label stays verbatim in the instructions');
   const manual = fn('manualOauthDetails');
   assert.match(manual, /The platform team places the generated credentials; this step ticks itself once they land\.<\/p><\/details>/);

package/tests/provision.mjs

@@ -1740,13 +1740,54 @@ await ta('drainOAuthManifests (--apply): claims a code_received row, places cred
   };
   const r = await P.drainOAuthManifests(deps);
   assert.deepEqual(r, { converted: 1, errors: 0 });
-  assert.equal(resolved.length, 1);
-  assert.equal(resolved[0].status, 'done');
-  assert.equal(resolved[0].patch.app_slug, 'app-3');
-  assert.equal(resolved[0].patch.github_code, null, 'a done row holds no re-convertible code (F23)');
+  // task 1004649: the slug lands the moment the creds are placed (still 'converting'),
+  // so the callback page can send the founder on to the install before sign-in is checked
+  assert.deepEqual(resolved.map((x) => x.status), ['converting', 'done']);
+  assert.deepEqual(resolved[0].patch, { app_id: 3, app_slug: 'app-3' });
+  assert.equal(resolved[1].patch.app_slug, 'app-3');
+  assert.equal(resolved[1].patch.github_code, null, 'a done row holds no re-convertible code (F23)');
   assert.ok(events.includes('oauth-manifest-done'));
 });
 
+await ta('the sign-in check reads the JSON health answer, never the root /healthz "ok" (task 1004577)', async () => {
+  // The REAL answers of the two endpoints (src/bongos/serve-internal.js answers GET /healthz
+  // with a plain "ok"; src/bongos/routes/healthz.js answers /api/bongos/healthz with JSON).
+  // The old probe hit /healthz, never parsed, and recorded every working setup as FAILED.
+  const real = (cmd) => (/\/api\/bongos\/healthz/.test(cmd) ? '{"ok":true,"auth_configured":true}'
+    : /\/healthz/.test(cmd) ? 'ok' : '');
+  const inst = { ...coTenant, domain: 'mercury.example.com' };
+  const probes = [];
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    convertManifestCode: async () => ({ clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 7, appSlug: 'mercury-app' }),
+    exec: (cmd) => { if (/healthz/.test(cmd)) probes.push(cmd); return { ok: true, stdout: real(cmd) }; },
+    writeFile: () => ({ ok: true }),
+  };
+  const r = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, deps);
+  assert.equal(r.ok, true, 'a project whose JSON health says auth_configured is verified');
+  assert.ok(probes.length >= 1 && probes.every((c) => /\/api\/bongos\/healthz/.test(c)), 'only the JSON endpoint is asked');
+  assert.equal(P.authHealthzCmd({ port: 4100 }), 'curl -sS --max-time 5 http://127.0.0.1:4100/api/bongos/healthz');
+  // and a plain "ok" is no verdict either way: it never reads as configured
+  const plain = await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, { ...deps, exec: () => ({ ok: true, stdout: 'ok' }) });
+  assert.equal(plain.ok, false, 'a bare "ok" never confirms sign-in');
+  const oauthSecret = require('../scripts/gds/oauth-secret.js');
+  assert.deepEqual(oauthSecret.parseHealthzAuth('ok'), { ok: false, authConfigured: false, parseError: true });
+  assert.match(readFileSync(new URL('../scripts/gds/oauth-secret.js', import.meta.url), 'utf8'), /127\.0\.0\.1:\$\{port\}\/api\/bongos\/healthz/, 'the manual placement probes the same JSON answer');
+});
+
+await ta('the slug is recorded only AFTER the credentials are placed (task 1004649)', async () => {
+  const order = [];
+  const inst = { ...coTenant, domain: 'mercury.example.com' };
+  await P.placeManifestCreds(inst, { github_code: 'C', attempts: 1 }, {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    convertManifestCode: async () => ({ clientId: 'Iv1.abcdef0123456789', clientSecret: 'z'.repeat(40), appId: 7, appSlug: 'mercury-app' }),
+    exec: (cmd) => { if (/systemctl restart/.test(cmd)) order.push('restart'); return { ok: true, stdout: '{"auth_configured":true}' }; },
+    writeFile: (p) => { if (/web\.env$/.test(p)) order.push('write'); return { ok: true }; },
+    onCredsPlaced: async (c) => { order.push(`slug:${c.appSlug}`); },
+  });
+  assert.deepEqual(order, ['write', 'restart', 'slug:mercury-app'], 'the first tick means the keys are on the project');
+});
+
 await ta('a SPENT code is never re-converted — terminal error, no code_received reset (F23)', async () => {
   // A stateful one-row store: claimNext honors status, resolve writes it back —
   // exactly the reset loop that used to re-convert a burned code on the next tick.
@@ -1804,11 +1845,12 @@ await ta('a sign-in check that never confirms still records WHICH App GitHub mad
       recordEvent: async () => {},
     },
   });
-  assert.equal(resolves.length, 1);
-  assert.equal(resolves[0].status, 'error');
-  assert.equal(resolves[0].patch.app_slug, 'mercury-cloudbongos-com', 'the error row names the App');
-  assert.equal(resolves[0].patch.app_id, 5189633);
-  assert.equal(resolves[0].patch.github_code, null, 'the burned code is still scrubbed');
+  // the slug is recorded at placement (task 1004649), then the row settles as an error
+  assert.deepEqual(resolves.map((x) => x.status), ['converting', 'error']);
+  const settled = resolves[1];
+  assert.equal(settled.patch.app_slug, 'mercury-cloudbongos-com', 'the error row names the App');
+  assert.equal(settled.patch.app_id, 5189633);
+  assert.equal(settled.patch.github_code, null, 'the burned code is still scrubbed');
 });
 
 await ta('a failure BEFORE GitHub handed over credentials claims no App (task 1004572)', async () => {