@bongos/core 1.23.21 → 1.24.1

package/tests/shell_hooks.mjs

@@ -0,0 +1,209 @@
+// tests/shell_hooks.mjs — the per-shell-call hooks run in ONE node process
+// (.claude/hooks/shell-hooks.js, task 1004931) and conclude exactly what the separate
+// processes did. Every case SPAWNS the dispatcher with a real payload (the contract
+// Claude Code sees: exit code, stdout JSON, stderr) and, where it matters, spawns the
+// same hooks ALONE and compares — so a drift between a hook's run() and its own main()
+// reds here.
+//
+// .claude/hooks/ is package-excluded, so a clean core checkout skips this file
+// (tests/host_topology_skips.mjs carries the allowlist entry).
+//
+// Run:  node tests/shell_hooks.mjs
+
+import { strict as assert } from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { requireHostModule } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const dispatcher = requireHostModule(require, '../.claude/hooks/shell-hooks.js');
+const { plainCardLines } = require('../scripts/bongos/plain-cards.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const HOOKS = path.join(ROOT, '.claude', 'hooks');
+const DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'shell-hooks-'));
+const ENV = {
+  ...process.env, OTB_STUCK_DIR: DIR, CLAUDE_PROJECT_DIR: ROOT,
+  BONGOS_STUCK_DETECTOR_OFF: '', BONGOS_GIT_GUARD_OFF: '', BONGOS_SECRET_GATE_OFF: '', OTB_SECRET_GATE_OFF: '',
+  BONGOS_ALLOW_RULE_GUARD_OFF: '', OTB_SESSION_CARDS_OFF: '', OTB_SUBAGENT: '',
+};
+const PRE = ['secret-gate.js', 'git-guard.js', 'allow-rule-guard.js'];
+const POST = ['lifecycle-card.js', 'stuck-detector.js'];
+
+function spawn(file, args, input, env = {}) {
+  const r = spawnSync(process.execPath, [path.join(HOOKS, file), ...args], {
+    input: typeof input === 'string' ? input : JSON.stringify(input), encoding: 'utf8', timeout: 15000, env: { ...ENV, ...env },
+  });
+  return { status: r.status, stdout: r.stdout || '', stderr: r.stderr || '' };
+}
+const together = (names, payload, env) => spawn('shell-hooks.js', names, payload, env);
+const alone = (name, payload, env) => spawn(name, [], payload, env);
+const out = (r) => (r.stdout.trim() ? JSON.parse(r.stdout).hookSpecificOutput : null);
+// A credential-shaped string built at runtime, so this file never holds one literally.
+const FAKE_KEY = ['gh', 'p_'].join('') + 'A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8';
+const shell = (tool, command, extra = {}) => ({ session_id: `s-${Math.random()}`, tool_name: tool, tool_input: { command }, ...extra });
+
+// ---- PreToolUse -----------------------------------------------------------
+t('a clean command: exit 0, nothing on stdout or stderr — same as each hook alone', () => {
+  for (const tool of ['Bash', 'PowerShell']) {
+    const p = shell(tool, 'ls -la');
+    const r = together(PRE, p);
+    assert.deepEqual(r, { status: 0, stdout: '', stderr: '' }, tool);
+    for (const h of PRE) assert.equal(alone(h, p).status, 0, `${h} alone`);
+  }
+});
+
+t('git-guard blocks through the dispatcher with the exact stderr it prints alone', () => {
+  const p = shell('Bash', 'git stash push -m x');
+  const a = alone('git-guard.js', { ...p, session_id: 's-gg-alone' });
+  const r = together(PRE, { ...p, session_id: 's-gg-together' });
+  assert.equal(a.status, 2);
+  assert.equal(r.status, 2, 'a block is still exit 2');
+  assert.equal(r.stderr, a.stderr, 'the block reason is the one git-guard gives on its own');
+  assert.equal(r.stdout, '');
+});
+
+t('secret-gate blocks a credential in a shell command through the dispatcher', () => {
+  const p = shell('PowerShell', `echo ${FAKE_KEY}`);
+  const a = alone('secret-gate.js', p);
+  const r = together(PRE, p);
+  assert.equal(a.status, 2);
+  assert.equal(r.status, 2);
+  assert.equal(r.stderr, a.stderr);
+});
+
+t('two hooks blocking at once: exit 2 and BOTH reasons, never a JSON answer beside them', () => {
+  const p = shell('PowerShell', `git stash push -m ${FAKE_KEY}`);
+  const r = together(PRE, p);
+  assert.equal(r.status, 2);
+  assert.match(r.stderr, /secret-gate: blocked/);
+  assert.match(r.stderr, /git-guard: blocked/);
+  assert.equal(r.stdout, '', 'a block outranks the allow-rule-guard ask');
+});
+
+t('allow-rule-guard asks on PowerShell through the dispatcher, with its own JSON', () => {
+  const p = shell('PowerShell', 'git status $(Remove-Item x)');
+  const a = alone('allow-rule-guard.js', p);
+  const r = together(PRE, p);
+  assert.equal(r.status, 0);
+  assert.deepEqual(out(r), out(a));
+  assert.equal(out(r).permissionDecision, 'ask');
+  assert.equal(together(PRE, shell('Bash', 'git status $(rm x)')).stdout, '', 'Bash is not its tool');
+});
+
+t('kill switches still work through the dispatcher', () => {
+  assert.equal(together(PRE, shell('Bash', 'git stash push -m x'), { BONGOS_GIT_GUARD_OFF: '1' }).status, 0);
+  assert.equal(together(PRE, shell('Bash', `echo ${FAKE_KEY}`), { BONGOS_SECRET_GATE_OFF: '1' }).status, 0);
+  assert.equal(together(PRE, shell('PowerShell', 'git status $(x)'), { BONGOS_ALLOW_RULE_GUARD_OFF: '1' }).stdout, '');
+});
+
+t('the third git-guard block in a session still carries the stuck line (the shared counter runs)', () => {
+  const p = { ...shell('Bash', 'git branch -D x'), session_id: 's-third' };
+  together(PRE, p); together(PRE, p);
+  assert.match(together(PRE, p).stderr, /\[otb-stuck\]/);
+});
+
+// ---- PostToolUse ----------------------------------------------------------
+t('stuck-detector context comes through the dispatcher on the third wall, as alone', () => {
+  const card = plainCardLines('TASK_NOT_READY', {}).join('\n');
+  const mk = (s) => ({ ...shell('Bash', 'node scripts/bongos/claim.js 9'), session_id: s, hook_event_name: 'PostToolUse', tool_response: { stdout: card, stderr: '' } });
+  for (let i = 0; i < 2; i++) { alone('stuck-detector.js', mk('s-post-alone')); together(POST, mk('s-post-together')); }
+  const a = alone('stuck-detector.js', mk('s-post-alone'));
+  const r = together(POST, mk('s-post-together'));
+  assert.equal(r.status, 0);
+  assert.deepEqual(out(r), out(a));
+  assert.match(out(r).additionalContext, /\[otb-stuck\]/);
+});
+
+t('lifecycle-card context comes through the dispatcher, as alone', () => {
+  const cardPath = path.join(DIR, 'otb-ship-card-77.html');
+  fs.writeFileSync(cardPath, '<div>card</div>');
+  const p = { ...shell('Bash', 'node scripts/bongos/claim.js 77'), hook_event_name: 'PostToolUse', tool_response: { stdout: `[otb-card-html] ${cardPath}\n`, stderr: '' } };
+  const a = alone('lifecycle-card.js', p);
+  const r = together(POST, p);
+  assert.ok(out(a), 'fixture: lifecycle-card alone injects a card');
+  assert.deepEqual(out(r), out(a));
+  assert.equal(together(POST, p, { OTB_SESSION_CARDS_OFF: '1' }).stdout, '', 'its kill switch holds');
+});
+
+t('two context producers in one call are merged into one JSON, both texts kept', () => {
+  const merged = dispatcher.merge([
+    { code: 0, stdout: JSON.stringify({ hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: 'one' } }) },
+    { code: 0, stdout: '' },
+    { code: 0, stdout: JSON.stringify({ hookSpecificOutput: { hookEventName: 'PostToolUse', additionalContext: 'two' } }) },
+  ]);
+  assert.equal(merged.code, 0);
+  assert.deepEqual(JSON.parse(merged.stdout).hookSpecificOutput, { hookEventName: 'PostToolUse', additionalContext: 'one\n\ntwo' });
+});
+
+t('the most restrictive permission decision wins, with its own reason', () => {
+  const ans = (d, why) => ({ code: 0, stdout: JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: d, permissionDecisionReason: why } }) });
+  const h = JSON.parse(dispatcher.merge([ans('ask', 'a'), ans('deny', 'd'), ans('allow', 'x')]).stdout).hookSpecificOutput;
+  assert.equal(h.permissionDecision, 'deny');
+  assert.equal(h.permissionDecisionReason, 'd');
+});
+
+// ---- failure modes --------------------------------------------------------
+t('unparseable stdin: every hook fails open — exit 0, silent', () => {
+  assert.deepEqual(together([...PRE, ...POST], 'not json'), { status: 0, stdout: '', stderr: '' });
+});
+
+t('a missing hook is visible (exit 1, one line) and never blocks; the others still run', () => {
+  const r = together(['no-such-hook.js', 'git-guard.js'], shell('Bash', 'ls'));
+  assert.equal(r.status, 1);
+  assert.match(r.stderr, /no-such-hook\.js/);
+  const b = together(['no-such-hook.js', 'git-guard.js'], shell('Bash', 'git stash push -m x'));
+  assert.equal(b.status, 2, 'a real block still blocks beside a missing hook');
+});
+
+t('only plain sibling names load — no paths, not itself', () => {
+  for (const bad of ['../hooks/git-guard.js', 'sub/x.js', 'shell-hooks.js', 'git-guard', '']) {
+    assert.equal(dispatcher.loadHook(bad), null, bad);
+  }
+  assert.equal(typeof dispatcher.loadHook('git-guard.js'), 'function');
+});
+
+t('a hook that throws fails open; the rest of the roster still answers', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'shell-hooks-throw-'));
+  fs.writeFileSync(path.join(tmp, 'boom.js'), 'module.exports = { run() { throw new Error("x"); } };');
+  fs.writeFileSync(path.join(tmp, 'ctx.js'), 'module.exports = { run: () => ({ code: 0, stdout: JSON.stringify({ hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: "kept" } }) }) };');
+  const r = dispatcher.dispatch(['boom.js', 'ctx.js'], '{}', process.env, tmp);
+  assert.equal(r.code, 0);
+  assert.equal(JSON.parse(r.stdout).hookSpecificOutput.additionalContext, 'kept');
+  fs.rmSync(tmp, { recursive: true, force: true });
+});
+
+// ---- wiring ---------------------------------------------------------------
+t('settings.json: one process per shell call on each side, rostered by file name, through run-node.sh', () => {
+  const settings = JSON.parse(fs.readFileSync(path.join(ROOT, '.claude', 'settings.json'), 'utf8'));
+  const shellEntries = (event) => (settings.hooks[event] || [])
+    .filter((g) => (g.matcher || '').split('|').includes('Bash'))
+    .flatMap((g) => g.hooks.map((h) => h.command));
+  const pre = shellEntries('PreToolUse');
+  const post = shellEntries('PostToolUse');
+  assert.equal(pre.length, 1, `PreToolUse spawns ${pre.length} processes per Bash call`);
+  assert.equal(post.length, 1, `PostToolUse spawns ${post.length} processes per Bash call`);
+  for (const [cmd, roster] of [[pre[0], PRE], [post[0], POST]]) {
+    assert.match(cmd, /run-node\.sh/);
+    assert.match(cmd, /shell-hooks\.js/);
+    for (const h of roster) assert.ok(cmd.includes(` ${h}`), `${h} missing from "${cmd}"`);
+  }
+  for (const h of [...PRE, ...POST]) {
+    assert.equal(typeof dispatcher.loadHook(h), 'function', `${h} exports run()`);
+  }
+});
+
+fs.rmSync(DIR, { recursive: true, force: true });
+console.log(`\nshell_hooks: ${passed} passed, ${failed} failed`);
+process.exitCode = failed ? 1 : 0;

package/tests/ship_assurance.mjs

@@ -385,5 +385,33 @@ await t('the gate sends the cause as the error MESSAGE, which is what the CLI pr
   assert.match(src, /res\.fail\(code, \{ status, message, details \}\)/);
 });
 
+// Task 1004879: the audit row used method 'SHIP', which audit_log's CHECK
+// refuses, so every write failed into a warning. Read the allowed list from the
+// migration itself, so a future verb change is checked against the real rule.
+await t('the ship-assurance audit row uses a method audit_log accepts', async () => {
+  const { recordShipAssurance } = require(path.join(ROOT, 'modules/lifecycle/ship-assurance.js'));
+  const sql = fs.readFileSync(path.join(ROOT, 'migrations/033_audit_log.sql'), 'utf8');
+  const m = sql.match(/method\s+text NOT NULL CHECK \(method IN \(([^)]*)\)\)/);
+  assert.ok(m, 'migration 033 still declares the method CHECK');
+  const allowed = m[1].split(',').map((s) => s.trim().replace(/'/g, ''));
+  assert.ok(allowed.length >= 4, `parsed the allowed list: ${allowed}`);
+  const rows = [];
+  const warns = [];
+  await recordShipAssurance({
+    insertAuditLog: async (row) => {
+      if (!allowed.includes(row.method)) throw new Error('violates check constraint "audit_log_method_check"');
+      rows.push(row);
+    },
+    taskId: 7,
+    builderId: 1,
+    assurance: { kind: 'proof', sha: TIP },
+    log: { warn: (...a) => warns.push(a.join(' ')) },
+  });
+  assert.deepEqual(warns, []);
+  assert.equal(rows.length, 1);
+  assert.equal(rows[0].route, '/tasks/7/ship');
+  assert.deepEqual(rows[0].requestBodyRedacted, { ship_assurance: { kind: 'proof', sha: TIP } });
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/ship_card.mjs

@@ -54,6 +54,10 @@ test('fmtTokens / fmtUsd / fmtMins', () => {
 });
 
 // ---- shipped ----
+// task 1004741: shipped means MERGED. With no reading of the live build the card
+// must not say "live" — a merge reaches no instance until a release carries it.
+const MERGED_NOT_LIVE = 'merged · 967fb4a — not live until a published release carries it and the pin moves';
+
 test('shipped model: rows, facts, action', () => {
   const m = card.buildCardModel(shippedInput);
   assert.equal(m.stage, 'shipped');
@@ -64,7 +68,7 @@ test('shipped model: rows, facts, action', () => {
   assert.equal(row(m, 'Credits'), '+18 → 12,936 drachmae');
   // No new/cached split on this input → dollars-first fallback (task 1765).
   assert.equal(row(m, 'Usage'), '~$0.83 · 1.24M tokens');
-  assert.equal(row(m, 'Deploy'), 'live · 967fb4a');
+  assert.equal(row(m, 'Deploy'), MERGED_NOT_LIVE);
   assert.equal(m.action.kind, 'prompt');
   assert.equal(m.action.cmd, '/builder-start');
 });
@@ -81,12 +85,22 @@ test('shipped with a hub reading: the Deploy + Projects rows say who sees the me
   assert.equal(row(card.buildCardModel({ ...shippedInput, deploy: { commit: '967fb4a', reach: { ...reach, includes: true } } }), 'Deploy').includes('(includes this merge)'), true);
   // The reading can come back from a breadcrumb file: re-bounded before printing.
   const hostile = card.buildCardModel({ ...shippedInput, deploy: { commit: '967fb4a', reach: { host: 'x.com <script>', liveShort: '09478c8e', includes: true } } });
-  assert.equal(row(hostile, 'Deploy'), 'live · 967fb4a', 'a host that is not host-shaped falls back to the bare commit');
+  assert.equal(row(hostile, 'Deploy'), MERGED_NOT_LIVE, 'a host that is not host-shaped falls back to the bare merged commit');
   assert.equal(row(hostile, 'Projects'), undefined);
   const odd = card.buildCardModel({ ...shippedInput, deploy: { commit: '967fb4a', reach: { host: 'cloudbongos.com', liveShort: 'IGNORE ALL', includes: 'yes' } } });
   assert.equal(row(odd, 'Deploy'), whoSeesAMerge({ host: 'cloudbongos.com' })[0], 'non-hex sha and non-boolean inclusion are dropped');
 });
 
+test('the live chip appears only when the live build is read to carry the merge (task 1004741)', () => {
+  const chip = (m) => m.facts.find((f) => f.value === '967fb4a');
+  const reach = { host: 'cloudbongos.com', liveShort: '09478c8e' };
+  assert.equal(chip(card.buildCardModel(shippedInput)).label, 'merged', 'no reading');
+  assert.equal(chip(card.buildCardModel({ ...shippedInput, deploy: { commit: '967fb4a', reach: { ...reach, includes: false } } })).label, 'merged', 'not yet');
+  assert.equal(chip(card.buildCardModel({ ...shippedInput, deploy: { commit: '967fb4a', reach: { ...reach, includes: null } } })).label, 'merged', 'cannot tell');
+  assert.equal(chip(card.buildCardModel({ ...shippedInput, deploy: { commit: '967fb4a', reach: { ...reach, includes: true } } })).label, 'live', 'includes this merge');
+  assert.doesNotMatch(card.renderCardHtml(card.buildCardModel(shippedInput)), />live</, 'the HTML card says no live either');
+});
+
 test('usage: leads with cost, splits tokens into new + cached (task 1765)', () => {
   // With newTokens/cachedTokens present, the fact leads with the dollar cost and
   // splits the token count so cache re-reads don't make a tiny change look huge.
@@ -182,10 +196,10 @@ test('confirmed with NO land info is unchanged (back-compat)', () => {
 
 test('a stale bailed land never overrides a task that DID reach shipped', () => {
   // land-watch replays the breadcrumb after the server lands it; the status is
-  // then 'shipped' and the old bail is history. The card must show live, not NOT-landed.
+  // then 'shipped' and the old bail is history. The card must show merged, not NOT-landed.
   const m = card.buildCardModel({ ...bailed, postGradeStatus: 'shipped' });
   assert.equal(m.stage, 'shipped');
-  assert.equal(row(m, 'Deploy'), 'live · 967fb4a');
+  assert.equal(row(m, 'Deploy'), MERGED_NOT_LIVE);
   assert.equal(m.cfg.tone, 'success');
 });
 
@@ -460,7 +474,8 @@ test('confirmLine: every stage yields one line naming the stage and the task', (
 test('confirmLine: a shipped line carries the facts the owner asks for ("did it land?")', () => {
   const line = card.confirmLine(card.buildCardModel(shippedInput));
   assert.match(line, /^shipped: task 1266/, 'leads with the outcome, not chrome');
-  assert.match(line, /deploy live/, 'says it actually deployed — the commit rides in this row');
+  assert.match(line, /deploy merged · 967fb4a/, 'says it merged — the commit rides in this row');
+  assert.doesNotMatch(line, /\blive ·/, 'never claims live without a reading of the live build (task 1004741)');
   assert.match(line, /credits/, 'carries the credit outcome');
 });
 

package/tests/site_classified_once.mjs

@@ -0,0 +1,142 @@
+// tests/site_classified_once.mjs — a request's site is worked out ONCE (task 1004963).
+//
+// THE COST THIS PINS. About fifteen global handlers in src/bongos/serve-internal.js
+// each asked "is this the builders host?" / "is this a module-surface host?", and
+// every answer re-parsed the Host header (the builders question also re-parsed the
+// configured buildersOrigin URL). mountInternalSurfaces now classifies the request
+// at the top of its chain into req.bongosSite and every predicate reads that field.
+//
+// HOW IT IS OBSERVED. A front middleware, mounted BEFORE mountInternalSurfaces,
+// replaces the Host header value with a String object whose toLowerCase() counts
+// its calls — every parse of the Host starts with that call. With the fix, the
+// whole chain parses it exactly once (the classifier) whatever handler answers;
+// without it, a hall request parses it once per host-routed handler it passes.
+// (Counting plain property READS would be the wrong measure: siteOf re-reads the
+// raw header on purpose, to check the cached answer is for the same Host.)
+//
+// WHAT ELSE IT PINS. The routing answer per host is unchanged — the hall, the
+// canonical /builders redirects, the apex /docs, the API on both hosts — and the
+// cache can never answer for a Host it was not computed from.
+//
+// node:http, not fetch: fetch silently drops a Host override (see
+// tests/module_asset_subdomain.mjs for the trap).
+//
+// Run:  node --test tests/site_classified_once.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+
+const APEX = 'example.com';
+const HALL = 'builders.example.com';
+
+// The count of Host parses for the request currently in flight. One request at a
+// time (the helpers below await each), so a single counter is unambiguous.
+let hostReads = 0;
+
+// The same text as the real Host, but every toLowerCase() is counted. One instance
+// per request, so siteOf's identity check against the cached raw value still holds.
+class CountedHost extends String {
+  toLowerCase() { hostReads += 1; return String(this).toLowerCase(); }
+}
+
+async function withServer(fn) {
+  const express = require('express');
+  const { mountInternalSurfaces } = require('../src/bongos/serve-internal.js');
+  const app = express();
+  app.use((req, _res, next) => {
+    hostReads = 0;
+    req.headers.host = new CountedHost(req.headers.host);
+    next();
+  });
+  mountInternalSurfaces(app);
+  const server = await new Promise((resolve) => { const s = app.listen(0, () => resolve(s)); });
+  try { await fn(server.address().port); } finally { await new Promise((r) => server.close(r)); }
+}
+
+function get(port, path, host) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path, headers: { Host: host } }, (res) => {
+      let body = '';
+      res.setEncoding('utf8');
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => resolve({ status: res.statusCode, location: res.headers.location || null, body, reads: hostReads }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+// Requests that walk deep into the host-routed chain on each kind of host. The
+// hall index on the builders host passes EVERY host-routed handler down to the
+// final hall static; an unknown apex path falls through the whole chain to Express'
+// default 404. Before the fix these read the Host header a dozen-plus times.
+const WALKS = [
+  ['hall index on the builders host', '/', HALL],
+  ['hall asset on the builders host', '/builders/style.css', HALL],
+  ['unknown path on the builders host', '/no-such-page-xyz', HALL],
+  ['unknown path on the apex', '/no-such-page-xyz', APEX],
+  ['apex /docs', '/docs', APEX],
+  ['apex /builders redirect', '/builders/watch', APEX],
+  ['API healthz on the builders host', '/api/bongos/healthz', HALL],
+];
+
+test('the Host header is parsed once per request, whichever handler answers', async () => {
+  await withServer(async (port) => {
+    for (const [label, path, host] of WALKS) {
+      const r = await get(port, path, host);
+      assert.equal(r.reads, 1, `${label}: Host read ${r.reads} times — the site must be classified once and read from req.bongosSite`);
+    }
+  });
+});
+
+test('routing per host is unchanged', async () => {
+  await withServer(async (port) => {
+    // Apex /builders/* → the builders subdomain (301, path + query carried).
+    let r = await get(port, '/builders/watch?x=1', APEX);
+    assert.equal(r.status, 301);
+    assert.equal(r.location, `https://${HALL}/watch?x=1`);
+    // On the builders host the /builders prefix is redundant → clean path.
+    r = await get(port, '/builders/watch', HALL);
+    assert.equal(r.status, 301);
+    assert.equal(r.location, '/watch');
+    // The builders host serves the hall at its root.
+    r = await get(port, '/', HALL);
+    assert.equal(r.status, 200);
+    assert.match(r.body, /<html/i);
+    // Retired directory → /roster, prefix kept on the apex and dropped on the hall.
+    r = await get(port, '/builders/people', HALL);
+    assert.equal(r.status, 301, 'the canonical redirect answers first on the hall host');
+    assert.equal(r.location, '/people');
+    // /docs: the apex serves the API reference.
+    r = await get(port, '/docs', APEX);
+    assert.equal(r.status, 200);
+    // The API is host-agnostic.
+    for (const host of [APEX, HALL]) {
+      r = await get(port, '/api/bongos/healthz', host);
+      assert.equal(r.status, 200, `API healthz on ${host}`);
+    }
+  });
+});
+
+test('siteOf caches on the request and never answers for a different Host', () => {
+  const { siteOf, isBuildersHost, isStatusHost } = require('../src/bongos/serve-internal.js');
+  const req = { headers: { host: 'Builders.Example.com:8443' } };
+  const first = siteOf(req);
+  assert.equal(first.host, 'builders.example.com');
+  assert.equal(first.builders, true);
+  assert.equal(req.bongosSite, first, 'the classification lives on the request');
+  assert.equal(siteOf(req), first, 'a second read reuses it');
+  // A changed Host is re-classified, not served from the stale entry.
+  req.headers.host = 'status.example.com';
+  assert.equal(isBuildersHost(req), false);
+  assert.equal(isStatusHost(req), true);
+  assert.notEqual(req.bongosSite, first);
+  // A missing Host is the apex, as before.
+  const bare = { headers: {} };
+  assert.equal(isBuildersHost(bare), false);
+  assert.equal(isStatusHost(bare), false);
+});

package/tests/speciality_db_shape.mjs

@@ -112,6 +112,29 @@ test('countTraining counts both halves of training in one round trip', async ()
   assert.equal(q.calls.length, 1);
 });
 
+// task 1004923: GET /me's specialities read is ONE query for all of them.
+test('describeTrainingFor reads owner + both counts for every id in one round trip', async () => {
+  const q = fake([{ rows: [
+    { id: '7', owner_kind: 'builder', owner_builder_id: '1', documents: '3', learnings: '2' },
+    { id: '8', owner_kind: 'project', owner_builder_id: null, documents: '0', learnings: '5' },
+  ], rowCount: 2 }]);
+  const out = await db.describeTrainingFor(['7', 8, '7'], q);
+  assert.equal(q.calls.length, 1, 'one query, however many specialities');
+  assert.match(q.calls[0].sql, /c\.id = ANY\(\$1::bigint\[\]\)/);
+  assert.match(q.calls[0].sql, /specialities_documents d WHERE d\.speciality_id = c\.id/);
+  assert.match(q.calls[0].sql, /specialities_learnings l WHERE l\.speciality_id = c\.id/);
+  assert.deepEqual(q.calls[0].params, [['7', '8']], 'ids are de-duplicated before they are sent');
+  assert.deepEqual(out.get('7'), { owner_kind: 'builder', owner_builder_id: '1', documentCount: 3, learningCount: 2 });
+  assert.deepEqual(out.get('8'), { owner_kind: 'project', owner_builder_id: null, documentCount: 0, learningCount: 5 });
+});
+
+test('describeTrainingFor with no ids asks the database nothing', async () => {
+  const q = fake();
+  const out = await db.describeTrainingFor([], q);
+  assert.equal(out.size, 0);
+  assert.equal(q.calls.length, 0);
+});
+
 test('taskDiscipline reads the CORE tasks table by id', async () => {
   const q = fake([{ rows: [{ discipline: 'engineer' }], rowCount: 1 }]);
   assert.equal(await db.taskDiscipline('1234', q), 'engineer');

package/tests/speciality_session_skills.mjs

@@ -78,8 +78,11 @@ await test('a malformed name in the stored set is never relayed', () => {
 // ---- the whole path: row → real port → real Conductor -----------------------
 const store = { adoptions: [] };
 db.listAdoptions = async () => store.adoptions.map((a) => ({ ...a }));
-db.countTraining = async () => ({ documentCount: 0, learningCount: 0 });
-db.getSpeciality = async (id) => ({ id, owner_kind: 'builder', owner_builder_id: 1 });
+// The port's ONE batched read (task 1004923); the per-row pair it replaced must
+// never be reached again, so those throw rather than answer.
+db.describeTrainingFor = async (ids) => new Map(ids.map((id) => [String(id), { owner_kind: 'builder', owner_builder_id: 1, documentCount: 0, learningCount: 0 }]));
+db.countTraining = async () => { throw new Error('per-row countTraining on the GET /me path'); };
+db.getSpeciality = async () => { throw new Error('per-row getSpeciality on the GET /me path'); };
 skills.installedSkillsCached = () => new Map([['recall', {}], ['status', {}]]);
 require('../modules/specialities/routes/specialities.js')();
 const port = api.resolveOptional('specialities');
@@ -147,4 +150,47 @@ await test('no permission or materialisation surface reads enabled_skills', () =
   }
 });
 
+// ---- task 1004923: the GET /me read is batched, not one pair per adoption ----
+await test('three active adoptions cost ONE training read, and each keeps its own owner and counts', async () => {
+  const saved = db.describeTrainingFor;
+  const calls = [];
+  db.describeTrainingFor = async (ids) => {
+    calls.push(ids.map(String));
+    return new Map([
+      ['9', { owner_kind: 'builder', owner_builder_id: 1, documentCount: 4, learningCount: 0 }],
+      ['10', { owner_kind: 'builder', owner_builder_id: 77, documentCount: 0, learningCount: 2 }],
+      // 11 has no catalogue row: counted as nothing, and not treated as self-authored.
+    ]);
+  };
+  try {
+    store.adoptions = [
+      row({ id: 9, name: 'Economics', contract_md: 'Mine.' }),
+      row({ id: 10, name: 'Law', discipline: 'engineer', contract_md: 'Theirs.' }),
+      row({ id: 11, name: 'Music', discipline: 'artist', contract_md: 'Gone.' }),
+      row({ id: 12, name: 'Old', discipline: 'ui', active: false }),
+    ];
+    const out = await port.describeActiveFor(1);
+    assert.equal(calls.length, 1, 'one batched read, not one per adoption');
+    assert.deepEqual(calls[0], ['9', '10', '11'], 'only ACTIVE adoptions are asked about');
+    const by = Object.fromEntries(out.map((d) => [d.name, d]));
+    assert.deepEqual(Object.keys(by).sort(), ['Economics', 'Law', 'Music']);
+    assert.match(by.Economics.contract, /4 document\(s\)/);
+    assert.doesNotMatch(by.Economics.contract, /stated working preferences/, 'your own speciality stays unfenced');
+    assert.match(by.Law.contract, /2 learning\(s\)/);
+    assert.match(by.Law.contract, /stated working preferences/, 'another builder\'s speciality carries its provenance');
+    assert.match(by.Music.contract, /stated working preferences/, 'a row the read did not return is never self-authored');
+  } finally { db.describeTrainingFor = saved; }
+});
+
+await test('no active adoption asks the database nothing more', async () => {
+  const saved = db.describeTrainingFor;
+  let called = 0;
+  db.describeTrainingFor = async () => { called++; return new Map(); };
+  try {
+    store.adoptions = [row({ active: false })];
+    assert.deepEqual(await port.describeActiveFor(1), []);
+    assert.equal(called, 0);
+  } finally { db.describeTrainingFor = saved; }
+});
+
 summary();